Design and Evaluation of a QR-Based Unmanned Car Wash Bay with Gateway-Free UPI Verification, Presence-Bound Sessions and Fault-Tolerant Recovery

1. K. Rai, “From cash to clicks: UPI’s role in shaping digital payments in India,” Commerce Res. Rev., vol. 2, no. 2, pp. 37–44, 2025, doi: 10.21844/crr.v2i02.1131.
2. National Payments Corporation of India, “UPI product statistics.” [Online]. Available: https://www.npci.org.in/what-we-do/upi/product-statistics (accessed Oct. 2026).
3. Razorpay, “UPI charges explained: MDR vs platform fees.” [Online]. Available: https://razorpay.com/blog/upi-charges-explained-mdr-vs-platform-fees/ (accessed Oct. 2026).
4. Z. A. Hamza, D. A. Hammood, A. H. Hamid, H. J. Mohammed and H. A. Faisal, “Smart automatic car washing machine based on IoT,” AIP Conf. Proc., vol. 3232, no. 1, Art. 020047, 2024, doi: 10.1063/5.0236136.
5. A. Hossain, H. Mural, A. Dash, Md. F. Kabir and Md. F. Rahman, “Fabrication of automatic car washing system with multiple features using IoT,” in Proc. 7th Bangladesh Conf. Ind. Eng. Oper. Manage., IEOM Society, 2024, doi: 10.46254/BA07.20240090.
6. D. Jing, “Control design of automatic intelligent car washing machine based on PLC,” in Proc. 10th Int. Conf. Appl. Sci., Eng. Technol. (ICASET 2021), Adv. Eng. Res., Atlantis Press, 2021, pp. 36–39, doi: 10.2991/aer.k.210817.008.
7. M. Z. Azman, S. Z. Mohammad Noor and S. Musa, “Automated carwash using programmable logic control (PLC),” Int. J. Acad. Res. Econ. Manage. Sci., vol. 11, no. 4, pp. 68–79, 2022, doi: 10.6007/IJAREMS/v11-i4/15019.
8. Y. Belev and K. Krustev, “Design of a control system for self-serve car wash with industrial programmable logic controllers with ‘Internet of Things’ (IoT) capabilities,” Sci., Eng. Educ., vol. 7, no. 1, pp. 27–36, 2022, doi: 10.59957/see.v7.i1.2022.4.
9. M. Erić, M. Stefanović, M. Zahar Đorđević, A. Kokić Arsić and A. Đorđević, “Smart cloud based ecological system for contactless vehicle cleaning,” J. Innov. Bus. Ind., vol. 2, no. 1, pp. 1–6, 2024, doi: 10.61552/JIBI.2024.01.001.
10. “Vehicle washing system based on Internet of Things, and vehicle washing method,” European Patent Application EP 3 885 209 A1, published Sep. 29, 2021.
11. G. V. Datta, A. Sumith, J. P and L. M. R, “Nexus Elite vehicle wash,” Karnataka State Council for Science and Technology, 49th Series Student Project Programme, Proj. Ref. 49S_BE_3611, 2025–26.
12. A. Antony, A. M. Jestine, D. J. T. J, E. V. Vineetha, N. R. T. R and P. V. Paul, “G-Pay integrated sanitary napkin vending machine,” AIJR Proc., vol. 7, no. 8, pp. 12–16, 2025, doi: 10.21467/proceedings.7.8.2.
13. M. F. Fahmi, D. T. Laksono and M. A. R. W. Wicaksono, “Design of a cashless vending machine system for the distribution and conservation of traditional herbal medicine,” J. Teknik Elektro dan Komputer TRIAC, vol. 12, no. 1, pp. 50–55, 2025.14. T. A. Nugroho, J. T. Edward, D. Angela and S. Suakanto, “Pengembangan vending machine berbasis IoT untuk penjualan otomatis menggunakan pembayaran dengan QRIS” [Development of an IoT-based vending machine using QRIS payment], in Proc. CENTIVE, vol. 4, no. 1, 2024.
15. S. K. Chung, H. T. Yew and A. Kiring, “IoT-based vending machine,” in Internet of Things and Artificial Intelligence for Smart Environments, Singapore: Springer, 2024, pp. 57–65, doi: 10.1007/978-981-97-1432-2_4.
16. D. T. Khanh and N. V. Hien, “Prepaid electricity bill payment method via bank transfer using QR code through SePay payment gateway integrated with ESP32 device,” J. Appl. Sci. Technol., vol. 49, pp. 67–73, 2026.
17. “ESP32 UPI payment terminal with Razorpay,” Hackster.io. [Online]. Available: https://www.hackster.io/Himanshudada/esp32-upi-payment-terminal-with-razorpay-30e8ec
18. A. Kuriakose and P. B. Sajoy, “Strategies and challenges of Unified Payment Interface: Towards facilitating a digital payments system in India,” J. Telecommun. Digit. Econ., vol. 11, no. 4, pp. 33–47, 2023, doi: 10.18080/jtde.v11n4.651.
19. R. Kumar, S. Kishore, H. Lu and A. Prakash, “Security analysis of Unified Payments Interface and payment apps in India,” in Proc. 29th USENIX Security Symp., 2020.
20. A. Diallo, J. Samhi, T. F. Bissyandé and J. Klein, “(In)security of mobile apps in developing countries: A systematic literature review,” arXiv:2405.05117, 2024.
21. C. Wu and Q. Zeng, “Do you see how I pose? Using poses as an implicit authentication factor for QR code payment,” in Proc. 33rd USENIX Security Symp., 2024.
22. X. Zhang, X. Zhang, B. Zhao, Z. Liu, J. Chen, H. Zhou, M. Yang and Y. Nan, “Demystifying the (in)security of QR code-based login in real-world deployments,” in Proc. 34th USENIX Security Symp., 2025.
23. W. Jonderko and W. Wodo, “Secure QR codes: Authenticity verification via EdDSA signatures and CBOR certificates,” arXiv:2607.08383, 2026.
24. R. Mustafa and N. I. Sarkar, “Secure QR-code attendance over RPL-based low-power IoT networks: Security analysis and scalability evaluation in Contiki-NG/Cooja,” Preprints, 2026, doi: 10.20944/preprints202609.2105.v1 (not peer-reviewed).
25. H. Byeon, “A security analysis and lightweight hardening of the authentication chains protocol for the Internet of Things,” Int. J. Saf. Secur. Eng., vol. 16, no. 1, pp. 169–176, 2026, doi: 10.18280/ijsse.160114.
26. M. Azhar, M. Azwar and O. Asroni, “Performance and security analysis of MQTT over TLS on ESP32-based IoT systems,” J. Appl. Informatics Comput., vol. 10, no. 4, pp. 4144–4156, 2026, doi: 10.30871/jaic.v10i4.13355.
27. C. Del-Valle-Soto, M. F. Alvarez-Garcia, R. A. Briseño, J. Rodriguez and P. Visconti, “Stability-aware security–performance trade-off analysis in resource-constrained IoT systems: A time-series and bootstrap-based evaluation of TLS and hybrid ECC–AES mechanisms,” Digital, vol. 6, Art. 35, 2026, doi: 10.3390/digital6020035.
28. H. Azwar and F. Gary, “Implementasi transport layer security dengan algoritma AES untuk meningkatkan keamanan komunikasi pada jaringan IoT berbasis MQTT menggunakan ESP32,” J. Elektro dan Mesin Terapan, vol. 11, no. 1, pp. 60–66, 2025, doi: 10.35143/elementer.v11i1.6478.
29. M. Fagan, K. N. Megas, K. Scarfone and M. Smith, “IoT device cybersecurity capability core baseline,” NIST IR 8259A, 2020, doi: 10.6028/NIST.IR.8259A.
30. National Payments Corporation of India, “UPI linking specifications.” [Online]. Available: https://www.npci.org.in
31. Android Developers, “NotificationListenerService.” [Online]. Available: https://developer.android.com/reference/android/service/notification/NotificationListenerService
32. YouPI-PG, open-source UPI payment gateway. [Online]. Available: https://github.com/youpi-pg/YouPI-PG
33. D. M’Raihi, S. Machani, M. Pei and J. Rydell, “TOTP: Time-based one-time password algorithm,” IETF RFC 6238, 2011, doi: 10.17487/RFC6238.
34. H. Krawczyk, M. Bellare and R. Canetti, “HMAC: Keyed-hashing for message authentication,” IETF RFC 2104, 1997, doi: 10.17487/RFC2104.
35. Espressif Systems, “Secure Boot v2” and “Flash encryption,” ESP-IDF Programming Guide. [Online]. Available: https://docs.espressif.com/projects/esp-idf/en/stable/esp32/security/
36. Espressif Systems, “Non-volatile storage library,” ESP-IDF Programming Guide. [Online]. Available: https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-reference/storage/nvs_flash.html
37. Safety of machinery – Electrical equipment of machines – Part 1: General requirements, IEC 60204-1:2016+AMD1:2021.
38. Code of Practice for Electrical Wiring Installations, IS 732:2019, Bureau of Indian Standards.
39. Low-voltage switchgear and controlgear – Part 4-1: Contactors and motor-starters – Electromechanical contactors and motor-starters, IEC 60947-4-1:2018.