Why Tamper Detection Matters for Asset Tags
BLE asset tags are increasingly deployed on high-value equipment, pharmaceutical cold-chain packaging, and rental assets where unauthorized removal triggers financial or compliance risk. A tag that can be silently removed or disabled defeats the entire tracking purpose. Tamper-evident design adds a layer of physical security: once the tag is removed or the enclosure is opened, the event is logged and immediately reported.
This article breaks down practical tamper-detection implementations for BLE tags, comparing four common mechanisms, analyzing their power budgets, and providing firmware interrupt-handling patterns that actually work in production.
Tamper Detection Mechanisms Compared
| Mechanism | Trigger Condition | False Positive Rate | Power (idle) | Cost | Best For |
|---|---|---|---|---|---|
| Mechanical switch (micro-switch) | Physical pressure release | Low (~2%) | 0.5 uA (pull-up) | Low ($0.10) | Surface-mounted tags |
| Conductive trace (PCB/FPC) | Trace broken by opening | Medium (~5%) | 1.2 uA (pull-up) | Medium ($0.30) | Sealed enclosures |
| Light sensor (photo-transistor) | Enclosure opened, light enters | High (~15%) | 5-20 uA | Low ($0.08) | Indoor only |
| Hall effect (magnetic reed) | Magnet removed/separation | Low (~1%) | 3-8 uA | Medium ($0.50) | Removable tags (magnetic mount) |
Selection comes down to three questions: (1) Is the tag permanently affixed? (2) Does the enclosure need IP65+ sealing? (3) What is the acceptable false-alarm rate? For most industrial deployments, the conductive-trace approach hits the best balance of cost, reliability, and form-factor impact.
Conductive-Trace PCB Design
The conductive-trace method routes a thin copper trace (0.15 mm width, 1 oz copper) around the PCB perimeter or across a Bluetooth module mounting area. The trace connects to a GPIO configured as a pull-up input. When the enclosure is opened, the trace breaks, GPIO goes HIGH, and an interrupt fires.
Critical Design Rules
- Trace width vs. reliability: 0.15 mm is narrow enough to break cleanly but wide enough to survive reflow. Below 0.10 mm, PCB fabrication yield drops; above 0.20 mm, the trace may stretch rather than break.
- Vias as stress concentrators: Place vias at trace corners. The via drill hole acts as a stress riser, ensuring the trace breaks at a predictable location when the PCB is flexed during enclosure opening.
- Redundant loops: Route two independent traces (loop A and loop B) in parallel. Both must be intact for the tag to report “sealed.” This eliminates single-trace false positives from minor PCB flex.
Measured resistance of an intact 0.15 mm trace (50 mm length): ~0.8 ohm. After breaking: >10 Mohm (pull-up pulls to VCC). Debounce in firmware: 50 ms hardware debounce + 200 ms software confirmation before reporting.
Mechanical Switch Implementation
For surface-mounted tags (adhesive backing), a normally-closed (NC) micro-switch is compressed by the mounting surface. When the tag is removed, the switch opens, generating a tamper event. The Bluetooth Beacon housing must be designed so the switch is always compressed when properly installed. Any gap >0.3 mm triggers.
Switch Selection Parameters
| Parameter | Typical Value | Notes |
|---|---|---|
| Operating force | 0.5-1.5 N | Too low: false trigger from vibration |
| Travel (pretravel) | 0.15-0.3 mm | Must be less than housing tolerance stack-up |
| Electrical life | 100,000 cycles | Adequate for one-time deployment |
| Contact resistance | <100 mohm | Critical for low-power pull-up reliability |
Power impact: A 100 kohm pull-up on a 3.0 V supply draws 30 uA continuously, far too high for a coin-cell tag. The solution is to use the nRF52’s internal pull-up (13 kohm typical), which draws 230 uA but can be enabled only during brief sampling windows (10 ms every 1 s), yielding an average of 2.3 uA. For always-on detection, use an external 10 Mohm pull-up (0.3 uA) with the GPIO configured in wafer-level detection mode (WLD) available on some SoCs.
Firmware Interrupt Handling
The tamper-detect GPIO must generate an interrupt even when the SoC is in deep sleep (em4/em4p on EFR32, system-off on nRF52). This requires the GPIO to be wired to a wake-capable pin. Not all GPIOs support this. On nRF52840, any GPIO can wake the system, but only from system-ON (not system-OFF with RAM retention).
// nRF52 tamper IRQ handler (production pattern)
void tamper_irq_handler(void) {
nrf_gpio_int_disable(TAMPER_PIN);
if (nrf_gpio_pin_read(TAMPER_PIN) == TAMPER_ACTIVE_LEVEL) {
retention_ram->tamper_event_count++;
retention_ram->last_tamper_time = NRF_RTC0->COUNTER;
tamper_pending = 1;
ble_adv_start(ADV_MODE_TAMPER, 3000);
}
}Key pitfall: If the tag is powered off when the tamper event occurs (e.g., coin cell removed), the event is lost. The solution is a supercap (0.1 F, 2.7 V) that powers the SoC for ~200 ms after main power is removed. Calculate: 0.1 F, discharge from 3.0 V to 1.8 V (minimum SoC operating voltage), 25 mA active current. t = C * dV / I = 0.1 * 1.2 / 0.025 = 4.8 s. More than sufficient.
BLE GATT Notification for Tamper Events
The tamper event must be reported to the monitoring system. Three approaches, ranked by latency:
- Immediate connection + GATT indication: Tag wakes on tamper, establishes connection, sends indication on a custom tamper characteristic. Latency: 100-500 ms. Power cost: ~15 mAh per event.
- Advertising flag method: Tag sets a bit in the manufacturer-specific data (MSD) of its advertising packet. Gateways see it within the tag’s advertising interval (typically 500 ms). Latency: 500 ms-5 s. Power cost: ~50 uAh per event.
- Store-and-forward: Tag logs the event to internal flash and reports on the next scheduled check-in. Latency: minutes to hours. Power cost: negligible (<1 uAh).
For high-value assets, approach 1 or 2 is recommended. The MSD method is particularly elegant: define a single byte in the advertising payload as the “status flags” field, with bit 0 = tamper detected, bit 1 = battery low, bit 2 = motion detected. Gateways parse this in real time without needing to establish a connection.
Power Budget Impact
| Component | Active Current | Duty Cycle | Average Current |
|---|---|---|---|
| GPIO pull-up (10 Mohm) | 0.3 uA | 100% | 0.3 uA |
| Light sensor (TEMT6000) | 20 uA | 100% | 20 uA |
| Hall sensor (DRV5032) | 3 uA | 100% | 3 uA |
| nRF52 wake + advertise (tamper event) | 15 mA | 0.1% (1 event/day) | 15 uA |
| Total (conductive trace + 1 event/day) | – | – | 15.3 uA |
A CR2477 (1000 mAh) coin cell powers a conductive-trace tamper tag for approximately 1000 / (15.3 * 24 / 1000) = 2727 days (~7.5 years) assuming one tamper event per day. In practice, the battery self-discharge (~1%/year for LiMnO2) and temperature effects reduce this to ~5 years, which is still acceptable for most asset-tracking deployments.
Real-World Deployment Lessons
- Factory reset attack: If the tag can be factory-reset without physical evidence, tamper detection is useless. Solution: set a write-once (OTP) bit in SoC UICR that permanently enables tamper logging. Once set, the tag cannot be reset without also destroying the tamper log.
- Supercap sizing: The 0.1 F supercap has a tolerance of -20%/+80%. Always design for the -20% case (0.08 F), which still yields 3.8 s of holdup time.
- Enclosure material: For the light-sensor approach, the enclosure must transmit visible light. Clear polycarbonate works; tinted or UV-resistant coatings block the sensor. For outdoor deployments, the light-sensor method is not recommended due to diurnal temperature cycling causing false triggers.
- Certification impact: Adding a supercap or modifying the antenna ground plane for the conductive trace can affect FCC/CE certification. The conductive trace should be defined as part of the antenna keep-out area in the certification filing to avoid re-certification.
Conclusion
Tamper-evident design for BLE asset tags is a system-level problem spanning mechanical, electrical, and firmware domains. The conductive-trace PCB approach offers the best cost-performance ratio for most deployments, adding less than $0.30 to BOM cost and less than 1 uA to the average current draw. For removable tags, the Hall-effect magnetic approach provides clean tamper detection without mechanical wear. In all cases, the firmware must handle the wake-from-sleep interrupt correctly and log the event to retention memory before the SoC powers down. A supercap on VDD is cheap insurance against event loss during power failure.
When specifying BLE tags for high-value assets, explicitly require tamper detection in the procurement spec. The incremental cost is negligible; the risk mitigation value is substantial.