Lock Cracker S. Lust, E. Skjel, R. LeBlanc, C. Kim

Lock Cracker S. Lust, E. Skjel, R. LeBlanc, C. Kim Abstract - This project utilized Eleven Engineering s XInC2 development board to control several peripheral devices to open a standard 40 digit combination lock using both user specified inputs and a fast algorithm to determine an unknown combination. The project consisted of a stepper motor, encoder, analog feedback servo motor, LCD screen and 16 input keypad. The device was able to successfully accept a user specified combination and attempt it on the lock. It was also able to use the fast algorithm to determine the unknown combination of a lock in under 10 hours. 3.3V 16X2 Character LCD Screen with White LED Background 3.3V 4X4 Keypad Power Supply I. INTRODUCTION The proposed project was the Lock Cracker which used a microprocessor provided by the client (XInC2). While the device functioned as a lock cracker, the main objective of the project was to present the broad capabilities of the XInC2. Having been designed and originally intended for wireless audio applications, our project showed that it could also be used for other embedded systems such as our project. The two main functions of the Lock Cracker were to accept a known combination from the user to autonomously open a lock, or to be able to use a fast algorithm to open up a lock with an unknown combination. Several hardware components were used to construct the device including a stepper motor, servo motor, encoder, a keypad, and an LCD. The stepper was used to rotate the dial of the lock while the encoder continually relayed the position of the device back to the microcontroller. The servo motor was used to pull on the shackle of the lock to attempt to open it while a comparator circuit monitored the voltage coming from the servo feedback to determine if it had opened the lock. The LCD and keypad were used to communicate with the user. The device is small enough that it is portable and runs on standard outlet electricity. Fig. 1 System Block Diagram A. XInC2 Microcontroller Some of the features that make the XInC2 unique from other type of microcontrollers is that it has a multithreaded architecture, in which it has 8 independent threads. In this way multiple hardware and firmware based peripherals are able to run concurrently. Another strength that it has is that the XInC2 is a RISC processor, thus less instructions are required to achieve a higher performance. Additionally, RTOS is not required as the multithreaded feature of the XInC2 allows for real time operations. [1] For the lock cracker, a PCB was created that can be directly mounted on top of the XInC2 Dev board, of which we have dubbed the backpack. This board enabled the ability to securely mount the peripherals to the XInC2 correctly, and with ease. The backpack s design was created such that future groups may use it to mount their own design to the XInC2. II. HARDWARE DESIGN The hardware component of this project had seven main components: XInC2 Development Board 12V, 0.4A Unipolar Double Shaft Stepper Motor 5V Absolute Binary Magnetic Encoder 5V Analog Feedback Micro Servo Fig. 2 XInC2 Backpack Schematic and PCB Layout

B. 12V, 0.4A Unipolar Double Shaft Stepper Motor The dial of the lock had to be turned with precision and speed because of the three day limit. Each phase of the stepper motor is driven by an N-Channel COM-10213 power MOSFET which is switched on and off by toggling the corresponding pins (P13, P15, P17, and P19) on the XinC2 Dev Board. Protection 1N4004 diodes were placed from the coils to ground in order to protect the motor from any back emf current. The toggling is done in a state driven manner to achieve full stepping with two coils of the stepper motor always being activated. The motor would draw approximately 0.8A of current when running (0.4A per phase, 2 phases on per state). Fig. 4 Encoder Circuit Schematic Fig. 3 Stepper Motor Driver Schematic C. 5V Absolute Binary Magnetic Encoder For the lock cracker to know its position on the lock, the choice was made to use an absolute encoder which made keeping track of locations simple. The encoder runs on 5V, using the same voltage that the servo motor would run on. However, by using a 5V encoder, supporting hardware is required that would allow the encoder to communicate with the XInC2. The conversion from 3.3V to 5V was done using an LM358N, a dual op-amp IC which was required because of the tight spaces on the PCB and the need for 2 signal lines. These op-amps are configured as comparators, with a threshold set at 1.80V, such that they would output 5V when a 3.3V signal is presented. For the conversion from 5V to 3.3V, a simple voltage divider was implemented, bring the 5V down to 3.23V. D. 5V Analog Feedback Servo Motor In order to open the lock, a 5V servo was used to pull on the shackle. This servo motor not only needed to have sufficient torque to open the shackle but also needed to be fast to open the lock as quickly as possible. In order to mitigate the noise produced by the servo, a 0.1 μf capacitor was used, connected from the 5V line to ground and located as close as possible to the servo. Fig. 5 Servo Motor Schematic The feedback from the servo motor was an analog signal ranging from 0.6V to 2.6V when the servo was at 60 to 150 respectively. Using this, a comparator circuit using a LM311N was implemented, that outputs a low signal when the servos feedback drops below a threshold value set by the potentiometer and thus indicating that the lock has been opened.

used to adjust the stepper motor and pause the system while running. Fig. 6 Servo Feedback Comparator Schematic E. 3.3V 16X2 Character LCD Screen with White LED Background The LCD screen that was used for this device utilized the common ST7066/HD44780 parallel interface. This device has 2 lines which can display 16 characters per line and runs on 3.3V. A potentiometer was used to adjust the contrast of the display in order to get an optimal resolution. Pins 1 and 2 were used to power the LED backlight of the screen. Pin 3 was used to adjust the contrast of the LCD. Pins 4 is the data/instruction select bit. Pin 5 is the read/write bit which tells the LCD if it is reading or writing to the display. Pin 6 is the enable bit. Pins 7-14 were the data connection pins. Fig. 8 Keypad Schematic G. Power Supply The main source for the project was a 12V, 3A wall adapter, which fed the stepper motor and a second 5V, 3A DC-DC converter. This 5V converter would provide the necessary power for the servo, encoder and the XInC2. The XInC2 Dev board would then step down the 5V to 3.3V, required for its own operation and to power the LCD and keypad. Fig. 7 LCD Schematic F. 3.3V 4X4 Keypad To allow users to input information into the device, a 4x4 keypad was implemented using 1K Ω pull-down resistors. The choice to use a 4x4 keypad over a standard 4x3 was made so that an extra set of keys could be used to simplify the user interface. These extra keys included up/down arrows, 2nd, and help buttons that would be Fig. 9 Power Supply Schematic A. Peripherals III. SOFTWARE DESIGN Initialization: It is important to note that an initialization function was written for each peripheral. In these functions the correct pins and polarities were assigned to each component, including any other

initialization requirements specified by the corresponding data sheets. Keypad: The keypad was the only source of user input, allowing the user to input menu options and integer values. This was accomplished by writing a basic getkeypress function which polled the keypad for inputs. To improve the functionality of the keypad we wrote a getsinglekeypress function which polled the keypad but also waited for the button to be released before returning a value. Finally, a checkkeypress function was used to check if the user was pressing anything on the keypad. LCD: The LCD was the most useful tool for prompting and relaying information to the user. To access the many functions of the LCD a universal WriteToLCD function written used to set the necessary pin configurations. In addition a StringToLCD function was used to allow messages to more easily be printed to the screen. This was further improved by a NumToString function which converted multi-digit integers to strings. Servo: The servo motor operated on a pulse width modulated signal with a period of 20 ms. The degree that the servo motor would move was decided by varying the duty cycle of the PWM signal. The generation of this signal was done by using timera from the XInC2 microcontroller. The timera configuration was set to prescale down the input system frequency so that it could generate a signal of 20 ms. For our purposes the boundaries of the servo were set between 30 to a maximum of 150. Then the compare module was configured to set the duty cycle of the PWM signal based on the input angle. Stepper: A rotation function was written to accept an integer and direction to cycle the poles on the stepper that many times and in the correct sequence. This sequence involves keeping 2 phases on at a time, and switching inverted pairs on and off. Furthermore, when the stepper is required to travel for rotations greater than 90, a speed curve is implemented by slowly reducing the frequency of the switching, holding it constant, and finally increasing it again at the end. This created a smooth acceleration and deceleration, used to maintain accuracy and nearly eliminate under and overshoot. Encoder: To accurately use the encoder a function was needed to assign output ranges to dial values. In this way we could tell which digit the lock was turned to by reading the encoder and comparing it against the generated array, which is exactly how EncoderRead worked. When combined with the stepper a more robust rotation function was written ( movement ) that allowed us to simply input a dial number to be rotated to with a specified direction and number of additional full rotations. B. User Specified Input The first step in the design was to accept a known combination from a user to autonomously open the lock. This was easily accomplished by using the functions specified above. The user was prompted to input the combination, one value at a time, until a valid combination was given. From there the device would do three clockwise rotations to the first number, two rotations counter clockwise to the second number, and one final clockwise rotation to the final number. The servo was then used to raise the shackle. If opened, the LCD would return the user to the main menu. If for some reason the lock didn t open the dial would rotate three times clockwise to reset the lock and would then prompt the user to enter another combination. C. Fast Algorithm The implementation of the algorithm used to open a lock with an unknown combination was done using a brute force approach as required by the client, but done in such a way to reduce the number of rotations. This was done by observing the internal design of the lock tumblers, incrementing one tumbler at a time, instead of resetting them with each combination attempt. This idea is more evident when observing Fig.10. Each of the tumblers in the image are separate dials with interlocking tabs, where each change in the rotational direction (from clockwise to counter clockwise or vice versa) frees a tab, preventing the tumbler from changing while the others are moved.

IV. RESULTS Initial testing was conducted on the individual components at a breadboard stage using the lab supplied equipment. Fig. 10 Inner Workings of a Lock [2] The mechanisms of a single dial lock presented above shows that regardless of how a lock combination is specified, that is in CW-CCW-CW or CCW-CW-CCW, every lock has a combination corresponding to both schemes. Therefore designing the algorithm for either one scheme will open all locks and the only difference will be that the output combination will be in reference to the chosen scheme. The fast algorithm developed based on the above theory resulted in the reduction of a total of 384,000 rotations down to about 72,000 rotations. As the flowchart below presents, once the device made the rotations for the first two digits, instead of repeating the first five rotations every single time 40 times for each of the third digit number, the device simply attempted to pull the lock as the lock decremented from 0 down to 1. Once all 40 digits were tested, the second digit of the lock was decremented one digit below, and the same procedure was repeated. A. Individual Components Stepper Motor/Encoder: The initial function was able to successfully activate each phase of the stepper motor to turn it in a full step manner. The stepper motor initially was not accurate when moving quickly, which was rectified by implementing a step speed curve which would slowly ramp up or ramp down the speed if the stepper had to move through a large rotation. The stepper motor also was getting very hot during its operation which was fixed by cutting the current when it was not in operation. The movement function was able to take advantage of output of the encoder and the stepper control function to move the stepper to the exact number on the face of the dial. Servo Motor: The initial function utilized pulse width modulation using a process known as bit bashing. While this process worked when testing the servo individually, it did not work when running other processes due to changes in the timing. This was fixed by using the onboard timer on the XinC2. This gave a reliable way to control the servo motor. LCD: The potentiometer was able to successfully adjust the contrast of the LCD screen. After determining the correct initialization sequence the screen would be turned on and characters would be displayed. However the characters that were being displayed were not the correct ones, because the data pins were mirrored. Once this was rectified the LCD screen was able to successfully display characters as needed. Fig. 11 Unknown Combination Algorithm Flowchart Keypad: The polling circuit was able poll four lines while simultaneously reading the four perpendicular lines in order to determine which button was being pressed. The keypad was initially shown to work y having an LED flash for a number of times corresponding to the button that was pushed.

B. User Accepted Combinations Consolidating the components together provided a net set of challenges. On the first attempt of using the LCD screen at the same time as the stepper motor the stepper motor would start vibrating instead of rotating as expected. At 4mA, the XinC2 was not providing enough current to the pins to toggle the pins of the LCD to send characters and to toggle the pins of the stepper driver circuit to turn on the MOSFETs. This was fixed by increasing the output of the XinC2 to 16mA. After this the user input combination function was able to accept the combinations specified by the user and opened the lock. This was tested with several different locks and worked for every one. REFERENCES [1] 11:: Eleven Engineering Incorporated [Online], 2015. [Online]. Available: http://www.elevenengineering.com/products/chips/xinc2.php [Accessed: 15- Nov- 2015]. [2] Woodengears, tabs [Online image]. Available: https://woodgears.ca/combolock/ [Accessed: 15- Nov- 2015]. C. Fast Algorithm After solving the problems that accumulated when writing the user specified input function, the algorithm went much smoother. Since the algorithm worked by decrementing the first number from 40, a lock with a combination that started at 37 was used to verify our design worked as intended. The device was able to open the lock in less than 2500 attempts. V. CONCLUSION In conclusion the project completed all requirements that were set by our client in the initial design stage. The device was able to take user specified inputs and test them on the lock. It was also able to determine the combination of a lock using our fast algorithm. The comparator circuit worked as expected and was able to stop the process once the lock was opened. For future directions, the coupling for the lock could be changed so that different brands of locks could be used without having to make a new coupler each time. Furthermore, the algorithm could be improved so that if a user knows part of their combination, they could be able to input a digit or two and the device would attempt to open the lock from the rest of the combinations. Additional improvements to the algorithm would include eliminating impossible combinations such as A-A-A, or A-(A+1)- (A+2), due to the nature of the tumblers. While the client allotted us 72 hours to break a lock, our design would require only 10 hours to attempt all 64000 combinations. Overall the project was a success.