Test role access and inspect the audit log

Compare admin, guest, disabled, and unknown cards against zone permissions and verify the audit reason for each decision.

Shield Shelly: I want you to check who was recognized, what was allowed, and which audit entry proves it., your practice guide

Shield Shelly: I want you to check who was recognized, what was allowed, and which audit entry proves it.
Predict the reading, then compare it with the measurement.

Wokwi ESP32

Third party Tool

Tier 1 · Web · No account

Version tested: Compiled and booted by the Wokwi gate (ESP32 Arduino core 3.3.11); captured in the Wokwi web editor on 2026-09-09. Date: 2026-09-09.

Open the ESP32 editor, paste diagram.json, then paste sketch.ino.

Open Wokwi to paste in the files (new tab)

Get the files

Use both prepared files. This is a paste-in setup; saving a project requires a Wokwi account.

diagram.json

3,375 bytes · Circuit connections

Download

{
  "version": 1,
  "author": "IoTClass",
  "editor": "wokwi",
  "parts": [
    {
      "type": "wokwi-esp32-devkit-v1",
      "id": "esp",
      "top": 80,
      "left": 0,
      "attrs": {}
    },
    {
      "type": "wokwi-led",
      "id": "led0",
      "top": -100,
      "left": 0,
      "attrs": {
        "color": "green"
      }
    },
    {
      "type": "wokwi-resistor",
      "id": "r0",
      "top": -25,
      "left": 0,
      "attrs": {
        "value": "220"
      }
    },
    {
      "type": "wokwi-led",
      "id": "led1",
      "top": -100,
      "left": 85,
      "attrs": {
        "color": "red"
      }
    },
    {
      "type": "wokwi-resistor",
      "id": "r1",
      "top": -25,
      "left": 85,
      "attrs": {
        "value": "220"
      }
    },
    {
      "type": "wokwi-led",
      "id": "led2",
      "top": -100,
      "left": 170,
      "attrs": {
        "color": "yellow"
      }
    },
    {
      "type": "wokwi-resistor",
      "id": "r2",
      "top": -25,
      "left": 170,
      "attrs": {
        "value": "220"
      }
    },
    {
      "type": "wokwi-led",
      "id": "led3",
      "top": -100,
      "left": 255,
      "attrs": {
        "color": "blue"
      }
    },
    {
      "type": "wokwi-resistor",
      "id": "r3",
      "top": -25,
      "left": 255,
      "attrs": {
        "value": "220"
      }
    },
    {
      "type": "wokwi-buzzer",
      "id": "buzzer",
      "top": 100,
      "left": 250,
      "attrs": {}
    },
    {
      "type": "wokwi-pushbutton",
      "id": "button0",
      "top": 220,
      "left": 250,
      "attrs": {
        "color": "green",
        "label": "Select card",
        "bounce": "0"
      }
    },
    {
      "type": "wokwi-pushbutton",
      "id": "button1",
      "top": 310,
      "left": 250,
      "attrs": {
        "color": "blue",
        "label": "Request access",
        "bounce": "0"
      }
    }
  ],
  "connections": [
    [
      "esp:TX0",
      "$serialMonitor:RX",
      "",
      []
    ],
    [
      "esp:RX0",
      "$serialMonitor:TX",
      "",
      []
    ],
    [
      "esp:D2",
      "led0:A",
      "green",
      []
    ],
    [
      "led0:C",
      "r0:1",
      "black",
      []
    ],
    [
      "r0:2",
      "esp:GND.1",
      "black",
      []
    ],
    [
      "esp:D4",
      "led1:A",
      "red",
      []
    ],
    [
      "led1:C",
      "r1:1",
      "black",
      []
    ],
    [
      "r1:2",
      "esp:GND.1",
      "black",
      []
    ],
    [
      "esp:D5",
      "led2:A",
      "yellow",
      []
    ],
    [
      "led2:C",
      "r2:1",
      "black",
      []
    ],
    [
      "r2:2",
      "esp:GND.1",
      "black",
      []
    ],
    [
      "esp:D18",
      "led3:A",
      "blue",
      []
    ],
    [
      "led3:C",
      "r3:1",
      "black",
      []
    ],
    [
      "r3:2",
      "esp:GND.1",
      "black",
      []
    ],
    [
      "esp:D19",
      "buzzer:2",
      "purple",
      []
    ],
    [
      "buzzer:1",
      "esp:GND.1",
      "black",
      []
    ],
    [
      "esp:D15",
      "button0:1.l",
      "green",
      []
    ],
    [
      "button0:2.l",
      "esp:GND.1",
      "black",
      []
    ],
    [
      "esp:RX2",
      "button1:1.l",
      "green",
      []
    ],
    [
      "button1:2.l",
      "esp:GND.1",
      "black",
      []
    ]
  ]
}

sketch.ino

11,956 bytes · ESP32 program

Download

/*
 * Secure IoT Access Control System
 * Demonstrates: RFID-style authentication, role-based access control,
 *               lockout policies, and comprehensive audit logging
 */
#include <Arduino.h>

// Pin definitions
const int LED_ACCESS_GRANTED = 2;   // Green LED
const int LED_ACCESS_DENIED = 4;    // Red LED
const int LED_SYSTEM_STATUS = 5;    // Yellow LED
const int LED_ADMIN_MODE = 18;      // Blue LED
const int BUZZER_PIN = 19;
const int BUTTON_SELECT = 15;
const int BUTTON_ACCESS = 16;

// Access levels and credential structure
enum AccessLevel { ACCESS_NONE=0, ACCESS_GUEST=1, ACCESS_USER=2, ACCESS_ADMIN=3 };

struct UserCredential {
    const char* cardId;
    const char* userName;
    AccessLevel accessLevel;
    bool isActive;
};

const int NUM_USERS = 6;
UserCredential userDatabase[NUM_USERS] = {
    {"RFID_ADMIN_001", "Alice Admin", ACCESS_ADMIN, true},
    {"RFID_ADMIN_002", "Bob Admin", ACCESS_ADMIN, true},
    {"RFID_USER_001", "Charlie User", ACCESS_USER, true},
    {"RFID_USER_002", "Diana User", ACCESS_USER, true},
    {"RFID_GUEST_001", "Eve Guest", ACCESS_GUEST, true},
    {"RFID_DISABLED", "Frank Former", ACCESS_USER, false}
};

const int NUM_TEST_CARDS = 8;
const char* testCards[NUM_TEST_CARDS] = {
    "RFID_ADMIN_001", "RFID_USER_001", "RFID_GUEST_001", "RFID_DISABLED",
    "RFID_UNKNOWN_1", "RFID_UNKNOWN_2", "RFID_ADMIN_002", "RFID_USER_002"
};

const int MAX_FAILED_ATTEMPTS = 3;
const unsigned long LOCKOUT_DURATION_MS = 60000;
const unsigned long LOCKOUT_ESCALATION_MS = 30000;
const int MAX_LOCKOUT_DURATION_MS = 300000;

struct AccessZone { const char* zoneName; AccessLevel requiredLevel; };
const int NUM_ZONES = 4;
AccessZone accessZones[NUM_ZONES] = {
    {"Public Lobby", ACCESS_GUEST}, {"Office Area", ACCESS_USER},
    {"Server Room", ACCESS_ADMIN},  {"Control Center", ACCESS_ADMIN}
};

struct SecurityState {
    int failedAttempts;
    unsigned long lockoutEndTime;
    bool isLocked;
    int currentCardIndex;
    String lastAuthenticatedUser;
    AccessLevel currentAccessLevel;
    unsigned long sessionStartTime;
} secState;

struct AuditEntry {
    unsigned long timestamp;  const char* cardId;
    const char* userName;     const char* eventType;
    const char* zoneName;     bool success;
    AccessLevel attemptedLevel;
};

const int MAX_AUDIT_ENTRIES = 50;
AuditEntry auditLog[MAX_AUDIT_ENTRIES];
int auditIndex = 0;

unsigned long lastButtonSelectTime = 0;
unsigned long lastButtonAccessTime = 0;
const unsigned long DEBOUNCE_DELAY = 250;

// Forward declarations
void initializeSystem();  void handleButtons();
UserCredential* authenticateCard(const char* cardId);
bool authorizeAccess(AccessLevel userLevel, AccessLevel requiredLevel);
void requestAccess(int zoneIndex);
void logAuditEvent(const char* cardId, const char* userName,
    const char* eventType, const char* zoneName,
    bool success, AccessLevel level);
void printAuditLog();      void handleLockout();
void indicateAccessGranted(AccessLevel level);
void indicateAccessDenied(); void indicateSystemLocked();
void playTone(int frequency, int duration);
bool constantTimeCompare(const char* a, const char* b);
void processSerialCommands(); void printMenu();
const char* accessLevelToString(AccessLevel level);

void setup() {
    Serial.begin(115200);
    delay(1000);
    initializeSystem();
    Serial.println("\n=========================================");
    Serial.println("   IoT ACCESS CONTROL SYSTEM v1.0");
    Serial.println("=========================================");
    printMenu();
}

void loop() {
    handleButtons();
    handleLockout();
    processSerialCommands();
    delay(10);
}

void initializeSystem() {
    pinMode(LED_ACCESS_GRANTED, OUTPUT);
    pinMode(LED_ACCESS_DENIED, OUTPUT);
    pinMode(LED_SYSTEM_STATUS, OUTPUT);
    pinMode(LED_ADMIN_MODE, OUTPUT);
    pinMode(BUZZER_PIN, OUTPUT);
    pinMode(BUTTON_SELECT, INPUT_PULLUP);
    pinMode(BUTTON_ACCESS, INPUT_PULLUP);
    // All LEDs off, reset security state
    for (int pin : {LED_ACCESS_GRANTED, LED_ACCESS_DENIED,
                    LED_SYSTEM_STATUS, LED_ADMIN_MODE})
        digitalWrite(pin, LOW);
    secState = {0, 0, false, 0, "", ACCESS_NONE, 0};
    playTone(1000, 100); delay(100);
    playTone(1500, 100); delay(100);
    playTone(2000, 150);
}

UserCredential* authenticateCard(const char* cardId) {
    for (int i = 0; i < NUM_USERS; i++)
        if (constantTimeCompare(cardId, userDatabase[i].cardId))
            return &userDatabase[i];
    return NULL;
}

bool constantTimeCompare(const char* a, const char* b) {
    size_t lenA = strlen(a), lenB = strlen(b);
    size_t maxLen = (lenA > lenB) ? lenA : lenB;
    volatile int result = 0;
    for (size_t i = 0; i < maxLen; i++) {
        char charA = (i < lenA) ? a[i] : 0;
        char charB = (i < lenB) ? b[i] : 0;
        result |= charA ^ charB;
    }
    result |= (lenA != lenB);
    return (result == 0);
}

bool authorizeAccess(AccessLevel userLevel, AccessLevel required) {
    return userLevel >= required;
}

void requestAccess(int zoneIndex) {
    if (zoneIndex < 0 || zoneIndex >= NUM_ZONES) return;
    const char* cardId = testCards[secState.currentCardIndex];
    AccessZone* zone = &accessZones[zoneIndex];

Serial.println("\n=== ACCESS REQUEST ===");
    Serial.printf("Card: %s -> Zone: %s (Requires: %s)\n",
        cardId, zone->zoneName,
        accessLevelToString(zone->requiredLevel));

// Step 1: Check lockout
    if (secState.isLocked) {
        unsigned long remaining =
            (secState.lockoutEndTime - millis()) / 1000;
        Serial.printf("BLOCKED: Locked for %lu more seconds\n",
            remaining);
        logAuditEvent(cardId, "LOCKED_OUT", "ACCESS_BLOCKED",
            zone->zoneName, false, ACCESS_NONE);
        indicateSystemLocked();
        return;
    }

// Step 2: Authentication -- who are you?
    UserCredential* user = authenticateCard(cardId);
    if (user == NULL) {
        secState.failedAttempts++;
        Serial.printf("AUTH FAILED: Unknown card (%d/%d)\n",
            secState.failedAttempts, MAX_FAILED_ATTEMPTS);
        if (secState.failedAttempts >= MAX_FAILED_ATTEMPTS) {
            unsigned long lockTime = LOCKOUT_DURATION_MS +
                ((secState.failedAttempts - MAX_FAILED_ATTEMPTS)
                 * LOCKOUT_ESCALATION_MS);
            if (lockTime > MAX_LOCKOUT_DURATION_MS)
                lockTime = MAX_LOCKOUT_DURATION_MS;
            secState.isLocked = true;
            secState.lockoutEndTime = millis() + lockTime;
            Serial.println("!!! BRUTE FORCE LOCKOUT !!!");
        }
        logAuditEvent(cardId, "UNKNOWN", "AUTH_FAILED",
            zone->zoneName, false, ACCESS_NONE);
        indicateAccessDenied();
        return;
    }
    if (!user->isActive) {
        logAuditEvent(cardId, user->userName, "ACCOUNT_DISABLED",
            zone->zoneName, false, user->accessLevel);
        indicateAccessDenied();
        return;
    }

// Step 3: Authorization -- what can you do?
    if (authorizeAccess(user->accessLevel, zone->requiredLevel)) {
        Serial.printf("ACCESS GRANTED: %s -> %s\n",
            user->userName, zone->zoneName);
        secState.failedAttempts = 0;
        secState.lastAuthenticatedUser = user->userName;
        secState.currentAccessLevel = user->accessLevel;
        logAuditEvent(cardId, user->userName, "ACCESS_GRANTED",
            zone->zoneName, true, user->accessLevel);
        indicateAccessGranted(user->accessLevel);
    } else {
        Serial.printf("ACCESS DENIED: %s has %s, needs %s\n",
            user->userName,
            accessLevelToString(user->accessLevel),
            accessLevelToString(zone->requiredLevel));
        logAuditEvent(cardId, user->userName, "ACCESS_DENIED_AUTHZ",
            zone->zoneName, false, user->accessLevel);
        indicateAccessDenied();
    }
}

void handleLockout() {
    if (secState.isLocked && millis() >= secState.lockoutEndTime) {
        secState.isLocked = false;
        secState.failedAttempts = 0;
        Serial.println("Lockout expired -- system unlocked.");
        playTone(1000, 200); delay(100); playTone(1500, 200);
    }
}

void logAuditEvent(const char* cardId, const char* userName,
    const char* eventType, const char* zoneName,
    bool success, AccessLevel level) {
    AuditEntry* e = &auditLog[auditIndex];
    e->timestamp = millis(); e->cardId = cardId;
    e->userName = userName;  e->eventType = eventType;
    e->zoneName = zoneName;  e->success = success;
    e->attemptedLevel = level;
    auditIndex = (auditIndex + 1) % MAX_AUDIT_ENTRIES;
}

void indicateAccessGranted(AccessLevel level) {
    digitalWrite(LED_ACCESS_GRANTED, HIGH);
    digitalWrite(LED_ACCESS_DENIED, LOW);
    if (level == ACCESS_ADMIN) {
        digitalWrite(LED_ADMIN_MODE, HIGH);
        playTone(2000, 100); delay(50);
        playTone(2500, 100); delay(50);
        playTone(3000, 200);
    } else {
        playTone(1500, 150); delay(50);
        playTone(2000, 200);
    }
    delay(2000);
    digitalWrite(LED_ACCESS_GRANTED, LOW);
    digitalWrite(LED_ADMIN_MODE, LOW);
}

void indicateAccessDenied() {
    for (int i = 0; i < 3; i++) {
        digitalWrite(LED_ACCESS_DENIED, HIGH);
        playTone(400, 100); delay(100);
        digitalWrite(LED_ACCESS_DENIED, LOW); delay(100);
    }
}

void indicateSystemLocked() {
    for (int i = 0; i < 5; i++) {
        digitalWrite(LED_SYSTEM_STATUS, HIGH);
        digitalWrite(LED_ACCESS_DENIED, HIGH);
        playTone(300, 100); delay(100);
        digitalWrite(LED_SYSTEM_STATUS, LOW);
        digitalWrite(LED_ACCESS_DENIED, LOW); delay(100);
    }
}

void playTone(int frequency, int duration) {
    tone(BUZZER_PIN, frequency, duration);
}

void handleButtons() {
    unsigned long t = millis();
    if (digitalRead(BUTTON_SELECT) == LOW &&
        (t - lastButtonSelectTime) > DEBOUNCE_DELAY) {
        lastButtonSelectTime = t;
        secState.currentCardIndex =
            (secState.currentCardIndex + 1) % NUM_TEST_CARDS;
        Serial.printf("Card selected: %s\n",
            testCards[secState.currentCardIndex]);
    }
    if (digitalRead(BUTTON_ACCESS) == LOW &&
        (t - lastButtonAccessTime) > DEBOUNCE_DELAY) {
        lastButtonAccessTime = t;
        requestAccess(2);  // Default: Server Room
    }
}

void processSerialCommands() {
    if (!Serial.available()) return;
    String cmd = Serial.readStringUntil('\n');
    cmd.trim(); cmd.toUpperCase();

if (cmd == "HELP") printMenu();
    else if (cmd == "LOG")  printAuditLog();
    else if (cmd == "STATUS") {
        Serial.printf("Locked: %s | Fails: %d | Card: %s\n",
            secState.isLocked ? "YES":"NO",
            secState.failedAttempts,
            testCards[secState.currentCardIndex]);
    }
    else if (cmd.startsWith("ZONE "))
        requestAccess(cmd.substring(5).toInt());
    else if (cmd.startsWith("CARD ")) {
        int n = cmd.substring(5).toInt();
        if (n >= 0 && n < NUM_TEST_CARDS)
            secState.currentCardIndex = n;
    }
    else if (cmd == "RESET") {
        secState.failedAttempts = 0;
        secState.isLocked = false;
    }
}

void printMenu() {
    Serial.println("Commands: HELP STATUS USERS ZONES");
    Serial.println("  ZONE n | CARD n | LOG | RESET");
}

const char* accessLevelToString(AccessLevel level) {
    switch (level) {
        case ACCESS_NONE: return "NONE";
        case ACCESS_GUEST: return "GUEST";
        case ACCESS_USER: return "USER";
        case ACCESS_ADMIN: return "ADMIN";
        default: return "UNKNOWN";
    }
}

void printAuditLog() {
    Serial.println("\n=== SECURITY AUDIT LOG ===");
    for (int i = 0; i < MAX_AUDIT_ENTRIES; i++) {
        AuditEntry* e = &auditLog[i];
        if (e->timestamp > 0)
            Serial.printf("%8lu | %-16s | %-12s | %-13s | %s\n",
                e->timestamp, e->eventType, e->userName,
                e->zoneName, e->success ? "OK":"FAIL");
    }
}

Use the launch button above to open the ESP32 editor in Wokwi.
Select the editor’s diagram.json tab and replace all its text with the supplied diagram.json.
Select the sketch.ino tab, replace all its text with the supplied sketch.ino, then click Start Simulation.

Steps

Screens captured against Wokwi ESP32 Compiled and booted by the Wokwi gate (ESP32 Arduino core 3.3.11); captured in the Wokwi web editor on 2026-09-09 on 2026-09-09; the tool may have moved on — the text steps are the contract.

Step 1
Do
In Wokwi's project editor, paste diagram.json and sketch.ino into a new Wokwi ESP32 project; inspect the seven GPIO connections before starting.
You will see
LED 0 anode connects to ESP32 GPIO2 and returns through r0 to ground (diagram.json lines 129, 141). LED 1 anode connects to ESP32 GPIO4 and returns through r1 to ground (diagram.json lines 147, 159). LED 2 anode connects to ESP32 GPIO5 and returns through r2 to ground (diagram.json lines 165, 177). LED 3 anode connects to ESP32 GPIO18 and returns through r3 to ground (diagram.json lines 183, 195). Buzzer pin 2 connects to ESP32 GPIO19; pin 1 returns to ground (diagram.json lines 201, 207). Select-card button connects ESP32 GPIO15 to ground when pressed (diagram.json lines 213, 219). Request-access button connects ESP32 RX2/GPIO16 to ground when pressed (diagram.json lines 225, 231).
Why it matters
The four LED paths and buzzer expose later access decisions. The two grounded button inputs initiate card selection and access requests for the audit sequence.
Step 2
Do
In the Simulation toolbar, start the run; send STATUS in the Serial Monitor input field.
You will see
Input: send STATUS after startup. Observed: "IoT ACCESS CONTROL SYSTEM v1.0". Observed: "Locked: NO | Fails: 0 | Card: RFID_ADMIN_001". Expected: an unlocked baseline with zero failures.
Why it matters
The startup heading identifies the running sketch. The lockout state is NO. The failure counter is zero. The selected card is the admin fixture.
Step 3
Do
In the Serial Monitor input field, send CARD 0 and then ZONE 2.
You will see
Input: CARD 0, then ZONE 2. Observed: "Card: RFID_ADMIN_001 -> Zone: Server Room (Requires: ADMIN)". Observed: "ACCESS GRANTED: Alice Admin -> Server Room". Expected: the admin fixture may enter the server room.
Why it matters
The request states the ADMIN requirement. The selected card is the admin fixture. The decision is explicitly GRANTED. The output names the requested zone.
Step 4
Do
In the Serial Monitor input field, send CARD 2 and then ZONE 2.
You will see
Input: CARD 2, then ZONE 2. Observed: "Card: RFID_GUEST_001 -> Zone: Server Room (Requires: ADMIN)". Observed: "ACCESS DENIED: Eve Guest has GUEST, needs ADMIN". Expected: the guest is denied for an admin zone.
Why it matters
The card switched to the guest fixture. The requested zone still requires ADMIN. The output names the role mismatch. The result is a denial rather than an access grant.
Step 5
Do
In the Serial Monitor input field, keep CARD 2 and send ZONE 0.
You will see
Input: CARD 2 remains selected; send ZONE 0. Observed: "Card: RFID_GUEST_001 -> Zone: Public Lobby (Requires: GUEST)". Observed: "ACCESS GRANTED: Eve Guest -> Public Lobby". Expected: the same guest may enter the public lobby.
Why it matters
The guest role is sufficient for this zone. The request names the GUEST requirement. The decision changes to GRANTED. Comparing both zones shows a role based decision.
Step 6
Do
In Wokwi's Serial Monitor, send CARD 3, then ZONE 1, and finally LOG.
You will see
Input: send CARD 3, ZONE 1, and LOG in Wokwi Serial Monitor. Observed audit row: " 7058 | ACCOUNT_DISABLED | Frank Former | Office Area | FAIL". Observed earlier: the admin and guest entries have their own decisions. Expected: the disabled credential is denied for Office Area.
Why it matters
The row names the disabled-account reason. Frank Former is the named fixture in this run. The event is marked FAIL, not a grant. The timestamp 7058 belongs to this capture and may vary on another run.
Step 7
Do
In the Serial Monitor input field, send CARD 4 and ZONE 2 three times.
You will see
Input: unknown CARD 4, then three ZONE 2 requests. Observed: "AUTH FAILED: Unknown card (3/3)". Observed: "!!! BRUTE FORCE LOCKOUT !!!". Expected: the third failure trips the lockout.
Why it matters
The failure counter reached its threshold. The third request still used an unknown card. The lockout announcement follows that failure. A later request must be checked separately for blocking.
Step 8
Do
In Wokwi's Serial Monitor, during lockout, send CARD 0 and ZONE 2; then send LOG and STATUS.
You will see
Input: after three unknown-card failures, send CARD 0, ZONE 2, LOG, and STATUS. Observed audit row: " 9567 | ACCESS_BLOCKED | LOCKED_OUT | Server Room | FAIL". Observed status: "Locked: YES | Fails: 3 | Card: RFID_ADMIN_001". Expected: the admin credential remains blocked during lockout.
Why it matters
The selected card is the valid admin fixture. The gate blocks it because the system is locked. LOG records ACCESS_BLOCKED with LOCKED_OUT as the reason. The audit timestamp 9567 is specific to this real run.
Step 9
Do
In Wokwi's Serial Monitor, wait at least 60 simulated seconds for Lockout expired -- system unlocked.; send CARD 0 and ZONE 2 again.
You will see
The admin request is granted again. STATUS reports Locked: NO and Fails: 0.
Why it matters
Time and state change the result. This local cooldown illustrates contextual enforcement but does not implement a general ABAC engine.

Chapter checks

These questions refer to the chapter’s examples. Use the return links to review their answers.

A new technician account is created in an IoT platform. Following least privilege, what should its initial access be?
Return to the chapter’s knowledge check
An AWS IoT-style policy contains a broad statement that Allows publishing to all device topics and a separate statement that explicitly Denies publishing to another tenant's topics. A device tries to publish to another tenant's topic. What happens?
Return to the chapter’s knowledge check

Return to IoT Access Control: Models and Policy · Browse Labs

Wokwi ESP32

Get the files

diagram.json

sketch.ino

Steps

1 Step 1

2 Step 2

3 Step 3

4 Step 4

5 Step 5

6 Step 6

7 Step 7

8 Step 8

9 Step 9

Chapter checks

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Step 7

Step 8

Step 9