Fridge guard v1: how it behaves
Step through normal running, the France-style attack, the board tripping and holding, and the board itself failing. Wires carrying current show moving dashes; relay blades show where each contact sits. Temperatures are a chiller example: 8 °C time ceiling, 20 °C instant ceiling. Select any box on the right of the schematic for more on what it is and how the board controls it.
Normal
Attack
Board trips
Holding
Board failure
Reasons against spoofing the temperature
Previous
Play
Next
Why the board doesn’t spoof the controller’s sensor
The original idea was to route the case sensor through a resistor network and make the controller think the case was hot, so it would call for cooling itself. It was dropped from v1 for these reasons.
The attacker may have switched cooling off another way. If regulation is stopped, the controller is in manual mode or the cooling output is disabled, no sensor value will make it call for cooling.A high enough reading can look like a broken sensor. With the setpoint pushed to 50 °C, the spoofed reading may need to be beyond the sensor’s valid range. The controller then treats it as a sensor fault, and its fallback behaviour is something the attacker can also change.Many controllers use more than one sensor. Danfoss case controllers often weight air-on and air-off sensors together, so spoofing one only moves the reading part of the way.It’s slow. Each attempt has to wait out compressor restart delays, minimum off times and thermostat differentials before the result is known.The sensor type has to be known. Hotter means higher resistance for PTC and Pt1000 sensors but lower for NTC, so the board needs different resistor networks and a way to tell which is fitted.It can cause the faults it’s meant to prevent. Contact resistance on ordinary relays shifts readings (about 0.26 °C per ohm on a Pt1000), and any break while switching throws a sensor alarm.It adds cost and isolation work. Dry-circuit relays, a resistor network, a sensor-type setting and galvanic isolation on the sensor path, since some controllers’ sensor inputs aren’t well isolated from mains.It fails exactly when it’s needed. On sites where it was the only option, the attacks that defeat it are the same ones that make the override necessary. Ending a defrost by spoofing the termination sensor is covered more reliably by the heater cut relay.
Instead, the board takes the heaters, fans and cooling demand over directly with relays, which works whatever the controller’s settings are.
Watching
Normal operation
Case air, board’s own probe 3.2 °C
Animated guard board wiring
The guard board between the case controller and the cooling load, evaporator fans and heater contactor. Relay positions and current flow change with the selected step.
Case controller
Existing, unmodified
Cooling out
calling
Fan out
on
Defrost out
off
Sensors S3 / S4 / S5
wired as now
Guard board v1
No radio, no network port
Watching
J2
J3
J4
OC1 mains sense
→ SENSE_COOL
N
K1 cooling changeover
L_OVR
NO
NC
COM
coil
← DRV1
J2
Cooling load
Liquid solenoid coil, or
compressor contactor coil
Cooling
N
OC2 mains sense
→ SENSE_FAN
N
K2 fan changeover
L_OVR
NO
NC
COM
coil
← DRV2
J3
Evaporator fans
Fan motors, or
fan contactor coil
Running
N
OC3 mains sense
→ SENSE_DEF
N
K3 heater cut
NO, unused
NC
COM
coil
← DRV3
J4
Heater contactor coil
Defrost heaters switched by
the contactor, never via the board
Off
N
K4 alarm, volt-free
NO
NC
COM
coil
← DRV4
J5
Store alarm or BMS input
K4 energised = healthy
Opens on trip or board failure
Healthy
K0 override master
coil
← DRV0
L_OVR
Site supply, 230 V
Same circuit as the
case controller
L
N
PE
J1
F1 T500 mA
F2 T6.3 A
N bus
OC1–OC3 returns
Enclosure earth
PSU
230 V AC → 5 V / 3.3 V
Reinforced isolation
Watchdog
Drops K0 and coil supply
if heartbeat stops
MCU, no radio
e.g. RP2040 or STM32
ADC: own NTC
IN: SENSE_COOL / FAN / DEF
IN: DIP bank, reset, service key
OUT: LEDs, buzzer, heartbeat
ULN2003 relay driver
→ DRV0 – DRV4
J6
Own NTC probe
10 k, in case air-off
3.2 °C
Fridge guard, v1 behaviour
Concept schematic, not for build
Rev B, 5 November 2026