DRIVERLESS VEHICLES

FEBRUARY 2018
circuitcellar.com ISSUE 331
CIRCUIT CELLAR | ISSUE 331 | FEBRUARY 2018

Inspiring the Evolution of Embedded Design

MCUs PAVE THE FUTURE FOR

DRIVERLESS VEHICLES

w Product Focus: MCU Development Tools w Non-Standard SBCs |

Programmable Ad Hoc Mesh Network | Building a VR Arm Tracker |
circuitcellar.com

Video Game Console Uses Microchip PIC32| Home Cleaning Robot (Part 3) |
w Shannon and Noise | IoT Security (Part 1) | Modulation Fundamentals |
Money Sorting Machines (Part 3) w The Future of Industrial IoT
 Trust Your Application

Developing embedded systems is a challenge. Higher complexity, better performance

and more connectivity brings a rapid increase of safety and security demands. This creates
needs for secure workflows and full code control, extending the developers’ reach all the
way from design through to production.

We are dedicated to provide you with the superior technology and close-at-hand
support you need to be confident in your code when building the products of today and
the innovations of tomorrow. Using the right tools, you can trust your application and
create for the future.

www.iar.com/ew
 Not Your Average SlingShot.

ACCELE R AT E . SlingShot Assembly’s state-of-the-art production

facility uses the latest software, processes and equipment to produce high-quality,
prototype and small-run PCB assemblies, fast. www.slingshotassembly.com

PROTOTYPES IN 5 DAYS. OR IT’S FREE.

For more details, contact us or go to SlingShotAssembly.com/prototypes
info@SlingShotAssembly.com 720.778.2400
©2018 COPYRIGHT SLINGSHOT ASSEMBLY
 NOT YOUR AVERAGE QUICK-TURN
PCB ASSEMBLY COMPANY
We are dedicated to helping engineers across
all industries speed the transformation of their
designs into properly functioning circuit boards. That
means more than simply providing fast, high-quality PCB assembly
at a reasonable price. We offer a variety of related services, all designed
to streamline the process of PCB prototyping and low-volume production
assembly. One of our unique tools includes our industry-best design check,
which identifies issues before assembly to save you time and frustration.
Give us a try. We believe you will be amazed at how we can help you meet
your project goals.

ACCELERATION: A NEW APPROACH TO PCB ASSEMBLY

CORE SERVICES
• No Order Too Small • Industry’s Best Design for Assembly
• Turn-Times as Fast as 24 Hours (DFA) on All Orders
• Bare Board and Component • Functional Test, Box Build and
Turn-Key Services Conformal Coating Services
• 24/7 Online Ordering and • High-Quality, Industry-Leading Jet Paste
Custom Quotes Printing Process
• Check Bom Instantly Online for Price • Quality Process Includes 3-D X-Ray of
and Availability BGAs/Leadless Parts and In-Line AOI

We accelerate your ideas by solving problems before they happen. We offer

these additional services so your project doesn’t get unnecessarily delayed.

BOM ANALYSIS • Identify Parts Availability and Price Issues Early

• Pre-Buy BOM and We’ll Store it for You
DESIGN ANALYSIS • Analize Design Files for Mistakes that will Stop
an Assembly Project
MANUFACTURABILITY ANALYSIS • Review Design to Identify Cost and Risk Drivers
for Manufacturing Early.

www.slingshotassembly.com info@SlingShotAssembly.com
Denver 720.778.2400
©2018 COPYRIGHT SLINGSHOT ASSEMBLY

SSA17-01 AverageSlingShotAd_vFFwww.indd 2 12/22/17 2:08 PM

 X
MARKS
THE
SPOT

What’s New in Unmanned Systems for Technology

New capabilities and technology advances are > 200+ educational sessions across four tracks:
transforming the unmanned systems industry. Policy | Technology | Business Solutions | Trending Topics

Now is the time to learn about the trends and > Covering the most timely topics:
Counter UAS | Artificial Intelligence | Data
best practices for the next generation of
unmanned technology as well as identify new > New products for technology
725+ exhibitors showcase the full spectrum of technolo-
unmanned systems solutions. gies, products and solutions

Colorado Convention Center | Denver | Educational Program: April 30 – May 3 Exhibits: May 1 – 3

Join us at the spot where new ideas are imagined. Register now at XPONENTIAL.org
2 CIRCUIT CELLAR • FEBRUARY 2018 #331

Issue 331 February 2018 | ISSN 1528-0608

OUR NETWORK CIRCUIT CELLAR® (ISSN 1528-0608) is published monthly by:

KCK Media Corp.

PO Box 417, Chase City, VA 23924

Periodical rates paid at Chase City, VA, and additional offices.

One-year (12 issues) subscription rate US and possessions
$50, Canada $65, Foreign/ ROW $75. All subscription orders
payable in US funds only via Visa, MasterCard, international
postal money order, or check drawn on US bank.

SUBSCRIPTION MANAGEMENT

Online Account Management: https://goo.gl/XFbewK

Renew | Change Address/email | Check Status

SUPPORTING COMPANIES CUSTOMER SERVICE

E-mail: circuitcellar@pcspublink.com

Accutrace, Inc. C3 Phone: 800.269.6301 | 760-738-4970 ext. 124

Mail: Circuit Cellar, P.O. Box 462256, Escondido, CA 92046

All Electronics Corp. 77 Postmaster: Send address changes to

Circuit Cellar, P.O. Box 462256, Escondido, CA 92046

NEW SUBSCRIPTIONS
AUVSI Xponential 1
circuitcellar.com/subscription

CCS, Inc. 77 ADVERTISING

Contact: Hugh Heinsohn

IAR Systems, Inc. C2 Phone: 757-525-3677

Fax: 888-980-1303
E-mail: hheinsohn@circuitcellar.com

Newhaven Display International, Inc. 19 Advertising rates and terms available on request.

NEW PRODUCTS

Siborg Systems, Inc. 11 E-mail: editor@circuitcellar.com

HEAD OFFICE

Technologic Systems, Inc. C4, 77 KCK Media Corp.

PO Box 417
Chase City, VA 23924
Phone: 434-533-0246

NOT A SUPPORTING COMPANY YET? COPYRIGHT NOTICE

Contact Hugh Heinsohn
(hugh@circuitcellar.com, Phone: 757-525-3677, Fax: 888-980-1303) Entire contents copyright © 2018 by KCK Media Corp.
to reserve space in the next issue of Circuit Cellar. All rights reserved. Circuit Cellar is a registered trademark
of KCK Media Corp. Reproduction of this publication in
whole or in part without written consent from
KCK Media Corp. is prohibited.

THE TEAM DISCLAIMER

KCK Media Corp. makes no warranties and assumes no

PRESIDENT EDITOR-IN-CHIEF GR APHICS responsibility or liability of any kind for errors in these
KC Prescott Jeff Child Grace Chen programs or schematics or for the consequences of any such
errors printed in Circuit Cellar®. Furthermore, because of
possible variation in the quality and condition of materials and
CONTROLLER ADVERTISING PROJECT EDITORS workmanship of reader-assembled projects, KCK Media Corp.
Chuck Fellows COORDINATOR Chris Coulston disclaims any responsibility for the safe and proper function
of reader-assembled projects based upon or from plans,
Nathaniel Black Ken Davidson descriptions, or information published in Circuit Cellar®.
FOUNDER David Tweed
Steve Ciarcia ADVERTISING SALES REP. The information provided in Circuit Cellar® by KCK Media
Corp. is for educational purposes. KCK Media Corp. makes
Hugh Heinsohn
no claims or warrants that readers have a right to build
things based upon these ideas under patent or other
COLUMNISTS
relevant intellectual property law in their jurisdiction, or
Jeff Bachiochi (From the Bench), Bob Japenga (Embedded in Thin that readers have a right to construct or operate any of
the devices described herein under the relevant patent or
Slices), Robert Lacoste (The Darker Side), Ed Nisley (Above the Ground other intellectual property law of the reader’s jurisdiction.
The reader assumes any risk of infringement liability for
Plane), George Novacek (The Consummate Engineer), and Colin O’Flynn constructing or operating such devices.
(Embedded Systems Essentials) © KCK Media Corp. 2018 Printed in the United States
 circuitcellar.com 3

INPUT
Voltage
Quantum Leaps

T hroughout my career, I’ve always been

impressed by Intel’s involvement in a wide
spectrum of computing and electronics
technologies. These range from the mundane
and practical on one hand, to forward-looking and disruptive
advances on the other. A lot of these weren’t technologies
will be 5 to 7 years before the industry gets to tackling
engineering-scale problems, and it will likely require
1 million or more qubits to achieve commercial relevance,”
said Mayberry.
Krzanich said the need to scale to greater numbers
of working qubits is why Intel, in addition to investing
for which Intel ever intended to take direct advantage of in superconducting qubits, is also researching another
over the long term. I think a lot about how Intel facilitated type called spin qubits in silicon. Spin qubits could have
the creation of and early advances in USB. Intel even sold a scaling advantage because they are much smaller
USB chips in the first couple years of USB’s emergence, than superconducting qubits. Spin qubits resemble a
but stepped aside from that with the knowledge that their single electron transistor, which is similar in many ways
main focus was selling processors. to conventional transistors and potentially able to be
USB made computers and a myriad of consumer manufactured with comparable processes. In fact, Intel
electronic devices better and easier to use, and that, has already invented a spin qubit fabrication flow on its
Intel knew, advanced the whole industry in which their 300-mm process technology.
microprocessors thrived. Today, look around your home, At CES, Krzanich also showcased Intel’s research into
your office and even your car and count the number of USB neuromorphic computing—a new computing paradigm
connectors there are. It’s pretty obvious that USB’s impact inspired by how the brain works that could unlock
has been truly universal. exponential gains in performance and power efficiency for
Aside from mainstream, practical solutions like USB, the future of artificial intelligence. Intel Labs has developed
Intel also continues to participate in the most forward- a neuromorphic research chip, code-named “Loihi,” which
looking compute technologies. Exemplifying that, last includes circuits that mimic the brain’s basic operation.
month at the Consumer Electronics Show (CES) show in While the concepts seem futuristic and abstract,
Las Vegas, Intel announced two major milestones in its Intel is thinking of the technology in terms of real-world
efforts to develop future computing technologies. In his uses. Intel says Neuromorphic chips could ultimately be
keynote address, Intel CEO Brian Krzanich announced the used anywhere real-world data needs to be processed in
successful design, fabrication and delivery of a 49-qubit evolving real-time environments. For example, these chips
superconducting quantum test chip. The keynote also could enable smarter security cameras and smart-city
focused on the promise of neuromorphic computing. infrastructure designed for real-time communication with
In his speech, Krzanich explained that, just two months autonomous vehicles. In the first half of this year, Intel
after delivery of a 17-qubit superconducting test chip, Intel plans to share the Loihi test chip with leading university
that day unveiled “Tangle Lake,” a 49-qubit superconducting and research institutions while applying it to more complex
quantum test chip. The chip is named after a chain of lakes data sets and problems.
in Alaska, a nod to the extreme cold temperatures and the For me to compare quantum and neuromorphic
entangled state that quantum bits (or “qubits”) require to computing to USB is an about as apples and oranges as you
function. can get. But, who
According to Intel, achieving a 49-qubit test chip is knows? When the
an important milestone because it will allow researchers day comes when
to assess and improve error correction techniques and quantum or
simulate computational problems. neuromorphic chips
Krzanich predicts that quantum computing will solve are in our everyday
problems that today might take our best supercomputers devices, maybe my
months or years to resolve, such as drug development, comparison won’t
financial modeling and climate forecasting. While quantum seem far-fetched at
computing has the potential to solve problems conventional all.
computers can’t handle, the field is still nascent.
Mike Mayberry, VP and managing director of Intel Labs
weighed in on the progress of the efforts. “We expect it

Jeff Child
4 CIRCUIT CELLAR • FEBRUARY 2018 #331

COLUMNS

50 Internet of Things Security

Embedded in Thin Slices

(Part 1)
Command Injection
By Bob Japenga

54 Modulation Fundamentals
The Consummate Engineer

By George Novacek

58 Shannon and Noise

The Darker Side

Putting the Theorem to Work

By Robert Lacoste

64 Money Sorting Machines

From the Bench
(Part 3)
Bill Validation
By Jeff Bachiochi

TECH THE FUTURE

79 Gearing up for a Post-3G,

The Future of Industrial IoT

Sensors Everywhere Era

By Brent Ward

71 : PRODUCT NEWS 78 : TEST YOUR EQ

@editor_cc
@circuitcellar circuitcellar
 circuitcellar.com 5

FEATURES

6 Video Gaming Console Uses

PIC32
Object Oriented Design
By Dongze Yue and Yixiao Zhang

14 Building a VR Arm Tracker

Sensor Fusion in Action
By Emma Wang, Daryl Sew and Zachary Zimmerman

20 Designing
Robot
a Home Cleaning
(Part 3)
Circuit Designs
By Nishant Mittal

26 Programmable
Network
Ad Hoc Mesh

Meshed-Up PICs
By Raghava Kumar, Brian Clark and Alex Wong

SPECIAL FEATURE

34 Electronics Propel Driverless

Vehicle Designs Forward
From Assist to Autonomous
By Jeff Child

TECHNOLOGY SPOTLIGHT

40 Non-Standard SBCs Put

Function Over Form
Compact, Low-Power Solutions
By Jeff Child

PRODUCT FOCUS

46 MCU Development Tools

Connectivity Expands
By Jeff Child
 6 CIRCUIT CELLAR • FEBRUARY 2018 #331

Video Gaming Console Uses PIC32

Object Oriented Design
FEATURES

Video game systems marry an interesting blend of graphics, computing and

display technologies. Learn how these two Cornell students designed a Microchip
PIC32-based gaming console that supports NTSC video output, audio output and
takes input from an NES Controller.

By
Dongze Yue and Yixiao Zhang

T he gaming console we built comes

with a demo game called Rope
Jumper that we implemented
with the game engine. We built
corresponding software libraries to support
rendering all the game components. Finally,
hierarchical structure so that loading the
scene also loads the corresponding objects
within it. We decided to exploit the possibility
of synthesizing real-time NTSC video as well as
supporting all the game mechanics on the tiny
PIC32 microcontroller. We proposed to build
we developed an easy-to-use game engine that a game console that arranges a composite
PIC hobbyists can use to develop any game on video signal, at approximately 3,000 sample/s
this console. Our motivation to build a PIC32- audio output and a polling input from a NES
based gaming console (Photo 1) came from Controller. Running on the console is the
a variety of sources. First, we were aware lightweight game engine that is derived from
of Nintendo’s popular game “WarioWare, the modern game engines that can load and
Inc.” with all its interesting minigames. And switch game scenes when it is triggered by
we saw how enjoyable it could be to quickly user-defined event.
switch between different minigames with We started by looking into the methods
PHOTO 1
totally different gameplay mechanics [1]. At of synthesizing video output from the
Our PIC32 Analog Video Gaming
the same time, game engines such as Unreal microcontroller. Then we moved on building
Console (PICGAME) is a portable
gaming device that supports real-time
and Unity Engine provide a straightforward the game engine itself with an incremental
NTSC video output. The Microstick and elegant way of managing a game into design approach. We then implemented the
II development board contains the components such as scenes and sprite objects. demo game, Rope Jumper, using our game
PIC32 MCU is plugged into a manually The “director/manager” part of the game can engine and explored ways of reducing graphic
soldered perfboard, and the board is then load and instantiate the components. artifacts on the display as well as relieving
fitted into a laser-cut acrylic casing. All the objects are arranged in a highly heavy memory usage. Figure 1 shows the
 circuitcellar.com 7

overall structure of our gaming console. NTSC signal. As electrons sweep across TV
As described in the block diagram in Figure screen, intensity at each point varies so that
1, PICGAME runs on a core Game Manager images are formed.
software block that uses various libraries Full NTSC display video system uses an
to interface with the peripheral devices and interlaced scanning technique, which updates
synthesize video output. Around the main the odd number lines and the even number

FEATURES
software block there are several hardware lines alternatively. The signal involves both
drivers that drives the controller, video output vertical sync signals that divide up even/
and audio. odd frames, and horizontal sync signals that
divide up scan lines. Figure 3 contains a
HARDWARE DESIGN breakdown of one horizontal scan line. Due
Figure 2 shows a wiring schematic of the to low resolution, we used a progressive
gaming console. The VIDEO pin and SYNC pin scanning approach that does not distinguish
are connected via a 2-bit digital-to-analog even/odd fields. To generate sync signals that
converter (DAC) and produce the composite meet NTSC standard and produce pixel-wise
video output. The NES Controller has five pins: black-and-white information of the image, we
CLK, LATCH, DATA, VCC and GND. Besides the used a timer that is accurate to one cycle to
voltage reference pins, the rest of the pins are generate the sync pulse and a DMA module to
wired to the IOPORTB pin 0-2 of the MCU. The get nanosecond accuracy.
audio output is connected to the CVREFOUT pin. The book Programming 32-bit
The NTSC standard (RS170) is used for Microcontrollers in C: Exploring the PIC32,
generating black and white analog signals by Lucio Di Jasio, introduced a way of
that display image on closed circuit TV. synthesizing NTSC video by chaining two DMA
Figure 3 shows a diagram for black/white channels together [2]. But another approach

PICGAME Gaming console

Resistor DAC 3.5mm

audio Jack
Video Combines video Audio
to signal and sync to
monitor signal into Outputs audio speaker
one analog into speaker
video signal

PIC32

NTSC Sync Gen NTSC Driver Audio driver

Generates timer Reads the internal Configures the
based vsync graphic memory DMA Channels
and hsync and generates to playback
pulses video signal soundtrack

NES Controller Controller driver

Graphics library
Takes user Handles
input polling of the Input event handler Scene switcher
controller
status Audio switcher Scene renderer

Game manager

Manager update
Thread 2:
Controller Thread 1: Game manager

FIGURE 1
The gaming console has a core software block called game manager that does the computing and runs all the game related contents. A series of drivers and signal generators lie
around the main software block, providing support to interface with peripheral devices.
 8 CIRCUIT CELLAR • FEBRUARY 2018 #331

($2
Controller uses a serial interface to transmit
a packet of data from the controller to the
&-
MCU. As shown on the schematic diagram
-)01

4



(Figure 2), the MCU sets the latch pin high to
begin transaction and toggles the clock pin
)


. 9

 
3
4

7 84 9-
 to emulate clock pulses. As the clock signal
FEATURES

-  
>
/ .

49
49

9-((
4,
+
/ pulses, the data pin will return the current
status of a corresponding key. Since there
4 : +


. 4, 4,
:
+ :
4,
4,

/

4, - (,-


are eight keys in total, an unsigned char with
4,
-((
4,


4,


8-bit length will contain all the information for
; 


49
49
-9
-((

; the controller keys.
20(



3
4,: 4,; 

SOFTWARE DESIGN




85 49: 4,


/
89<= - - 4,


:
+
9<9
:

4,+ 4,/
In order to operate the game on the
+-
) *+!
 ,
microcontroller, we needed to implement the
3




foreground and background components of
the game and run them at the same time. We
wrote with a library written in C that enables
manipulating screen buffer, rendering
objects and interfacing with the NTSC video
FIGURE 2 output. We packaged all the dependencies
This hardware schematic diagram shows the hardware hierarchy of our system. The synthesized sync pulse into a “game engine” so it can be reused for
and image signal are combined into one video output using a 2-bit DAC. The audio output is directly wired developing games.
to the CVref pin on the MCU. All the wires coming from the controller also get directly wired to GPIO pins
To support all the game components, we
on the MCU.
built a display library that has accessible
functions to draw and fill shapes on the
display buffer that is being synthesized into
analog video signal in real-time. Since we
define every pixel to be either black or white,
 %6
we draw or erase pixels on the display by
was available, which we decided to follow in setting or clearing the corresponding bit.
the end. This approach was introduced $!% in
5
To draw lines in a pixelated screen, we
Cornell Professor Bruce Land’s NTSC video adapted the Bresenham
(' line algorithm that
generation on PIC32, which uses an Output takes in the two sets of coordinates and
Compare module instead of two DMA channels automatically figures out which pixels to fill
to generate the front '"('

#

!
"
#$!%& porch of the signal [3]. between the starting and ending points [4].
We also added support of drawing quadratic
VOLTAGE REFERENCE bezier curves onto the display [5]. To do so,
The PIC32 MCU has an on-chip voltage we specified three anchor points on the screen
reference module that can be programmed to and used the parametric function to trace
output a reference voltage on an external pin. each point of the curve and fill the points. We
Although originally designed for providing developed functions to draw rectangles and
reference voltage for the comparator module, circles on the display buffer, following the
this module can be configured as a 4-bit DAC implementation of Adafruit’s TFT library.
and produce audio during gameplay. Since The game needed to have not only outline,
the VREF module is a 4-bit DAC, we had to but also more filled shapes. So, we also wrote
truncate and fit the original audio data into functions to fill rectangles and circles line-by-
16 voltage level bins. Also, since the MCU only line. When filling horizontal lines, we directly
has 128 kB flash, we have to resample the wrote 1’s the display buffer. However, when we
audio file into a much lower sample rate so actually kept erasing and filling a large rectangle
that the MCU could hold as many audio data frequently, we noticed significant blinking on
as possible while still being able to play the the shape. That’s because this filling technique
audio with acceptable quality. To rapidly is not fast enough when working with large
produce the header files for audio data, we shapes. We worked around the problem later
used Mathwork’s MATLAB’s resample function by avoiding repeatedly re-filling large shapes.
to convert original audio at a sample rate of In the end, we loaded the bitmap data for
44,100 down to 3,000 samples/s and then displaying characters on the screen.
wrote the data into a C header file that can be We decided to use an object-oriented
included into this project. approach for all the in-game components.
In order to take user input and be able to Because of this decision, we designed the
control the game, we adapted a Nintendo NES engine to enable the user to define all the game
Controller to interface with the player. The NES mechanics in the init and update functions
 circuitcellar.com 9

FIGURE 3
Shown here is the detailed breakdown
of a NTSC line signal. Each new line
starts with a horizontal sync pulse that
pulls the pin low and then followed
by a back porch on the voltage level
of black image. Then the actual

FEATURES
video signal comes in, showing the
brightness of each pixel on the line in
a 53.6 µs window.

within all the components. Our game engine the video driver to load a corresponding
has only one entry point that interacts with bitmap data to the display. Sprite contains
the outside main function called the game two function pointers, and those point to the
manager. Every component of the game is init and update function of the itself. There
defined and encapsulated within the game are two ways of displaying objects onto the
manager object. Therefore, by initializing the screen, one being directly loading the bitmap
game manager and routinely calling the game data. The other way is to use the functions
manager update function, we will be able to in the display library to repeatedly erase and
initialize and update all the game components draw shapes and texts.
that belongs to the game manager. We used the three data structures
Since there are multiple components introduced earlier to handle different parts
running at the same time, we adapted of the game. For example, consider this
Protothreads, a lightweight library that very basic scenario: A user interface panel
supports multithreading on microcontrollers appears on the screen showing the current
to support several independent modules at time and there is also a ball on the side of
the same time [6]. One of the threads we the screen that will bounce up when a user
created is the main game thread where the taps the controller key. In that example, we
game manager is initialized and routinely define two sprites, one for the current time
called. The other thread is the I/O thread, text and another for the bouncing ball. The
which periodically pulses the clock pin to game manager then selects the current scene
the NES Controller and latches the most to be se scene we just created.
recent controller status. The controller At initialization, the scene will draw the UI
status is saved as a global variable and can panel on the screen buffer. While it is doing
be immediately accessed by components so, the text sprite—which is attached to the
in the game manager. In our configuration, scene—also gets initialized and keeps drawing
we sample the input from the controller for the current time (saved as a global variable)
100 times a second and update the main text string on the screen. Finally, the ball
game 30 times a second. sprite gets initialized at a given position. And

SCENES AND SPRITES

Inside the game manager, the game
content is arranged in scenes. Scene is a ABOUT THE AUTHORS
data structure that resembles the idea of Dongze Yue (dy85@cornell.edu) is currently an undergraduate student at
a “world” which has its own rules, displays Cornell University, majoring in Electrical and Computer Engineering. Beside
and mechanics. The scene object contains all the coursework, he is very interested in embedded system and Internet
two function pointers that point to the init of Things projects in general. He is also a member of a student-led project
function and the update function of the scene. team, Cornell University Unmanned Air Systems or CUAir. In his free time,
It also contains a list of sprites that the scene he also makes indie films and does film photography.
contains. The init function initializes the
scene and all the scene’s sprites. The update
function will update the scene and all its Yixiao Zhang (yz624@cornell.edu) is an undergraduate Electrical and Comput-
children sprites. er Engineering major at Cornell University. Her major interest is in embedded
Sprite is really the notion of “object” in the system design and system programming. Yixiao has a broad interest in arts.
game. It represents anything on the display She has 10-year membership in Beijing Philharmonic choir, and is a Chinese
that has a position and dimension. It also has modern dance instructor at Cornell Amber Dance Troupe.
an optional data array pointer that allows
 10 CIRCUIT CELLAR • FEBRUARY 2018 #331

FIGURE 4
This Rope Jumper Game Components Scenes Sprites
Hierarchy Diagram shows the
available scenes under game manager Main menu
as well as all the sprites and system Buttons
components used by each scene.
Countdown Text System
Load page dependencies
FEATURES

(countdown)
Tooltip
Display
Rope library
The game
Character
Controller
Rope Human status
jumper:
game Game paused page
manager Audio
Buttons playback
Game over page
UI Box ISR Driven
clock

Credits page Text

Game engine
demo page

since the ball is just a circle, we use the display DEMO GAME
library to repetitively draw/erase the circle on When we finished building all the libraries
the display inside the update function. It also and hardware components, we moved on
checks the current keypress status variable to create Rope Jumper, the demo game.
that is constantly updated by the controller The objective of Rope Jumper is to keep the
thread. If a keypress is detected, the ball will character jumping when the rope is swiveling
decrease its y coordinate—the user observes past the ground. The player controls the
it to move up. character’s jump by pressing A on the
controller. The character’s jump speed and
interval are limited, so the player cannot
blindly spam the controller to hover above the
ground. The speed of the rope will also change
when player enters a certain level. Also, the
center of the rope will move left or right
randomly when a certain level is achieved.
As shown in Figure 4, the Game Manager
contains multiple scenes in it. The first
scene is the main menu that the game loads
by default. Inside the main menu scene
there are three sprites, each representing a
corresponding button. The user can use the
arrow keys on the controller to switch from
different buttons. The second scene is a
countdown scene that elegantly counts three
seconds and switches to the game scene.
The third scene is the main game scene that
contains four sprites: rope, character, human
and a UI tooltip sprite. Finally, there is a pause
menu scene which renders a pause menu on
top of the current game and a credits scene
that displays the makers of the game.
As shown in Photo 2, when the main
PHOTO 2 game scene loads up, it first draws a large
This screenshot shows the actual gameplay of Rope Jumper. The two human figures are holding and swinging box around the display as a container of
a bezier-curved rope, allowing the character in the middle to jump. all the other visual elements of the game.
 circuitcellar.com 11

Next, the scene loads all the attached sprites. On the two ends of the rope, there are
The rope sprite is a quadratic bezier curve two human sprites that draw the humans on
that contains three anchor points. To simulate the sides. The humans are pixel arrays that
the physics of the rope, we fixed the starting is generated from MATLAB by reading and
and ending point of the curve and vary the pixelating a hand sketched human figure.
middle point of the curve up and down. That The image array contains multiple frames so

FEATURES
makes it look like an elastic rope swinging. We that the human’s arm can move up and down
also used a sine table to map the y position of with the rope’s rotation. The update function
the middle point, so we can obtain a smooth of the sprite compares the current rope’s
and more realistic rope animation. In order rotation position with its frame number so
to compensate for gravity, we increased that if the rope rotates to a certain angle the
the falling speed of the rope by 1.5 times sprite changes its display frame to be the
compared to the rising speed by skipping corresponding frame number.
more samples in the sine table.
The character sprite can be found DRAWING HUMANS
in the center of Photo 1. It consists of a Our first approach to displaying motion
round rectangle and a text box on top of of the humans was to constantly remove
the rectangle. The sprite is drawn at init and redraw the figure when the rope moves.
and constantly erased and redrawn during However, since the size of the humans is
update. The sprite also checks the current fairly large, we saw very blinky images.
controller status and adds an upward thrust Therefore, in order to reduce visual artifact
to the object whenever a press on the key A as much as possible, we altered the code to
is detected. The thrust is treated as a vector only erase and redraw the middle portion of
force so that the character’s velocity and the figure that contains the human’s moving
position can be computed from it. Once the arm. Since the top and bottom part of the
character arises from ground, a new gravity figure does not move, they do not need to be
force (downward acceleration) will be applied updated at all. By doing so we were able to
to the character to make sure the character minimize visual artifact and optimize game
drops back to the ground. experience.

LCR-Reader Pro Shielded Kelvin

• 0.5% Basic Accuracy Probe Connector
• LCR- and ESR-meter • Smart Tweezers/LCR-Reader
• NIST Traceable • 5 Replaceable Probes
Calibration

LCR-Reader-MP Smart Tweezers ST5S-BT

• L-C-R, ESR, Diode/LED • 0.2% Basic Accuracy
• 0.1% Basic Accuracy • LCR, ESR, Q/D, Diode Test
• AC/DC Voltage, Frequency, • NIST Traceable,
Pulse Period, Duty Cycle Blue Tooth
• 100 kHz Oscilloscope

MADE IN CANADA

www.lcr-reader.com
 12 CIRCUIT CELLAR • FEBRUARY 2018 #331

overtime. It also contains an internal counter

to remove the text after a defined time
interval expires.
Finally, the game scene actively polls for
the current controller status so that if user
presses start key during game, the scene will
FEATURES

call game manager’s scene switcher function

to switch the current scene to the pause menu
scene by reassigning the game manager’s
current scene pointer to the target scene.
Therefore, at the next update cycle, the target
scene will get initialized and scheduled for
routine update. Also, the scene continuously
checks for conditions when the user press
the button too early or too late so that the
character trips over the rope. When those
condition are detected, the user will lose one
life, and the corresponding tooltip will be
displayed. Once the user loses all the lives,
the current scene will call scene switcher to
switch to the scene that displays the game
over contents.”

RESULTS
As shown in Photo 3, our complete system
build includes the game console running on
PHOTO 3 the PIC32 which has been installed in an
This shows the complete portable build of our system. A mobile battery pack provides the power for the MCU acrylic casing, a NES Controller that directly
and a portable speaker outputs audio generated by the console. Users can easily plug in the RCA cable to the plugs into the console, a mobile cellphone
analog video connector shown on the bottom right of the picture and start gaming right away. charger that powers up the console and a
speaker that outputs audio. When powered up,
our design is capable of rendering up to seven
scenes—each containing around 5 to 6 sprites
In the end, in order to further enhance with independent logic as well as playing a
experience, we wanted to display a floating looped soundtrack that is 10 seconds long.
text when the play levels up or encounters a We have used up around 90% of our 128 kB
new challenge. We decided to create a sprite programmable memory and every component
that displays a floating tooltip on top of the functions robustly.
character when defined events take place. Actual successful video generation under
Whenever there is a speed up, difficulty the NTSC standard is an essential foundation
change or the player loses lives, the tooltip for all the work we have done in the project.
sprite generates a text box over the character The video signal is stable enough so that on a
and the text box gently rises up and disappear normal sized monitor we can clearly identify
in three seconds. The generation, controlling all the components of the game. In the end,
and animation of the text is implemented as a we have extracted all the depending libraries
state machine so that whenever a new tooltip into a distributable game engine for quick
request comes in, it resets the floating text’s game development on PIC32. A demo video
position, displays the new text and gradually of this project along and a link to our project
shifts the position of the text upwards website can be found on the Circuit Cellar
article materials webpage.
We would like to acknowledge Yuqing Sun,
Additional materials from the author are available at: another member of our group, for participating
www.circuitcellar.com/article-materials in the overall scheme proposal and
contributing to game engine and global
References [1] through [6] as marked in the article can be found there. messaging implementation.

RESOURCES

Adafruit | www.adafruit.com

Mathworks | www.mathworks.com

Microchip | www.microchip.com
When it
comes to
robotics,
the future
is now!
From home control systems to
animatronic toys to unmanned
rovers, it’s an exciting time to
be a roboticist. Advanced Control Robotics
simplifies the theory and best practices of
advanced robot technologies, making
it ideal reading for beginners and experts
alike. You’ll gain superior knowledge of
embedded design theory by way of
handy code samples, essential schematics,
and valuable design tips.

With this book, you’ll learn about:

• Communication Technologies
• Control Robotics
• Embedded Technology
• Programming Language
• Visual Debugging... and more

Get it today at cc-webshop.com.

 14 CIRCUIT CELLAR • FEBRUARY 2018 #331

Building a VR Arm Tracker

Sensor Fusion in Action
FEATURES

Wearable technologies, virtual reality and sensor fusion make for a powerful
combination when all are used together. These Cornell graduates designed
a low-cost arm controller that translates arm motions into interactions with
virtual objects using sensor fusion technology.

By
Emma Wang, Daryl Sew and Zachary Zimmerman

T he three of us had an interest in

wearable technology, virtual reality
and sensor fusion, so we designed
a project that drew from all of
these fields. For a long time, we’ve wanted to
design an ergonomic wearable that could track
Commonly known as forward kinematics, this
process uses translation matrices to represent
a link (a forearm) and rotation matrices to
represent a joint (an elbow), and multiplies
them together to produce an output matrix
that represents the end effector pose.
posture and body position, so we set out to Our overall process can be explained as
design a device that would enable the evaluation follows: While the sensors gather data on
of form for fitness applications. We also saw an three axes, the Microchip PIC32MX250f128b
opportunity to expand to an immersive martial microcontroller retrieves their register
arts video gaming experience. contents via I 2C communication. The PIC32
You can find body pose tracking then communicates sensor readings over
applications in gaming, healthcare and other serial to a PC which integrates the readings
industries. But the more precise systems and applies filtering algorithms to produce
come with a high price tag. An effective, 3D positions and orientations. The computed
low-cost alternative would easily disrupt the results are then used as inputs into a virtual
existing high-end motion tracking market. reality application for user interaction. We
With that in mind, the opportunity for us to would like to acknowledge Kionix for donating
capture that market niche appealed to us. sensor units for us to use, NumPy for its open-
To track and ultimately display a source computation library and Panda3D for
user’s pose in real time, we used Inertial its graphics engine.
Measurement Units (IMUs) made of gyroscope-
accelerometer sensor units along three points HIGH-LEVEL DESIGN
of the arm to measure accelerations and We considered several different overall
angular velocities. After some filtering, our approaches to body pose tracking, such as
virtual reality application displays the user’s computer vision, LIDAR, structured light and
pose and movements by computing joint and flex sensor based approaches. We decided
end-effector positions for given joint angles. to use gyroscopes and accelerometers
 circuitcellar.com 15

because these components are extremely element” [1]. Therefore, electromagnetic

low cost and can easily be integrated into a interference from circuitry can affect the
wearable device—desirable features for the quality of the data, so common mode
consumer applications we have in mind. We cancellation is used to compensate for this.
anticipated that we would be able to apply The device temperature can also change the
advanced sensor fusion techniques to bring sensor reading. The benefit of using the Kionix

FEATURES
the odometry quality up to par with higher accelerometer is its onboard temperature
cost, higher fidelity sensors. sensor and digital signal processor (DSP) that
The accelerometer and gyroscope give data applies temperature compensation as well as
that can be used to compute arm trajectory. some basic filtering techniques.
There are several methods to process the
sensor data, and these methods vary in terms DEVELOPING THE POSE PROCESS
of simplicity and accuracy. One method is to Our process from raw data collection to
rely on accelerometer data exclusively. In this body tracking display can be summarized in
case, you would use tri-axis accelerometers three steps: 1) Collect angle velocities at a
to measure the acceleration in x-, y- and moment in time: 2) Apply the complementary
z-axes at a particular point on the arm. Using filter to the velocities collected and store the
standard relations of acceleration, velocity inferred orientation; and 3) Input orientations
and position, we know that this acceleration in the form of quaternions to the virtual reality
can be integrated to produce a velocity, and application and use forward kinematics to
that integrated velocity will produce position. draw the arm.
Using this method will most certainly We used the Kionix tri-axis gyroscopes-
result in unwanted drift. The solution to accelerometer unit, the KXG03, to measure the
minimizing the accelerometer drift is to (1) angular velocities and accelerations in x-, y-
calibrate, and to (2) weight the gyroscopic and z-axes at a particular point on an arm. We
and accelerometer data. To do this we then integrate these complementary filtered
implemented the complementary filter. The angular velocities and accelerations from the
complementary filter is essentially a weighted gyroscope to produce the orientation.
average of the gyroscopic and accelerometer Next, we represent the weighted angle
data. Figure 1 demonstrates the functionality velocities with quaternions to avoid the
of the complementary filter with sample data. singularities of an Euler angle orientation
Accelerometers sense acceleration representation. Similar to Euler angle
via “differential capacitance arising from orientation, quaternions indicate the
acceleration induced motion of the sense difference in rotation between each position

Demonstration of complementary filter

1.5
Complementary filter
Gyroscope data
1
Accelerometer data

0.5

Angle 0

−0.5
FIGURE 1
Shown here is a demonstration of a
complementary filter. Gyroscope data
−1 dominates at fast moving rates and
accelerometer data dominates at slow
moving rates. In other words, outliers
in the acceleration orientations will be
−1.5 ignored when the joint is fast-moving,
0 5 10 15 20 25 30 and the gyroscope’s orientation drifts
will be ignored when the joint is slow-
Time moving and the acceleration derived
orientations are high fidelity.
 16
FEATURES CIRCUIT CELLAR • FEBRUARY 2018 #331

PHOTO 1
Running controller.py results in real time arm angles being reflected in virtual reality. The user is free to move arm across and around body to interact with the virtual balls.

of the arm in 3D space. Passing quaternions its unique address. However, we discovered
to the virtual reality application allows smooth that the sensor unit designs only allowed
interpolation of data. In the field of robotic I 2C user addressing of one bit—resulting in
manipulation, forward kinematics refers to only two unique I 2C address per sensor unit.
the use of a model as a sequence of links That means we could hook up at most two
(translations) and joints (rotations) to produce gyroscope-accelerometer units on the one
the position of the end effector (given joint I 2C channel. Our first workaround was to
angles). In that way we are able to predict retrieve data from the third set of sensor
end effector position given only orientation units from the second I 2C channel on the
measurements. PIC3232MX250f128b. Due to problems
indicated in PIC32MX250f128b errata,
HARDWARE/SOFTWARE transmission from both I 2C channels stalled.
TRADEOFFS Instead of spending more time debugging
In order to read data as quickly as this issue, we moved on to an alternative
possible from the PIC3232MX250f128b and solution. This involved issuing read/write
IMU connections, we moved as much of the instructions to the same address for
computation as possible off the microcontroller gyroscope-accelerometer and toggling the
to a full powered computer. We accomplished ADDR line of each respective sensor unit.
this by sending the sensor register data to a Essentially, we implemented a Chip-Select
PC via serial communication. Doing this also function on one I 2C channel. We found that
enabled us to use a powerful, but CPU/GPU- there were no timing issues with toggling the
intensive 3D graphics engine—one with more ADDR line across each sensor unit. As a result,
compute performance than is available on the successful communication was established
PIC3232MX250f128b. amongst the three sensor units.
By using the I 2C bus, we were initially Aside from the addressing issue, we found
under the impression that we’d be able to the Kionix device versatile and relatively
open one channel and connect all gyroscope- hassle-free to use. In an ideal world, it
accelerometer sensor units to it—with each at would be best to source or work with the
 circuitcellar.com 17

manufacturer for the device to use the true PYTHON FILES

I 2C function. But in the meantime, we offer up These were run on Mac OS, but all
our implementation as a workaround. applications can be configured to run on
Windows or Linux.
SOFTWARE DESIGN
We created two main chunks of software. controller.py: This file runs the virtual

FEATURES
One we wrote in C code—to compile and load reality application and displays the user’s
onto the PIC32. It was responsible for reading arm movements in real-time (Photo 1). We
sensor data over I2C and sending it to a enabled concurrent execution of the game
computer over serial. The other chunk we wrote and reading from serial in a while True loop.
in Python. It resides on the computer and is Thanks to the global interpreter lock, the
responsible for parsing incoming data on the only way to be truly concurrent in Python
serial port, filtering/fusing it, integrating it and is to use process concurrency through
rendering it via the game library Panda3D. inter-process communication. As such, we
Starting with the C files, we used implemented a shared queue that the read_
Protothreads to schedule and connect to sensors.py process uses to communicate
a PC to communicate over serial. We found odometry data over to the process rendering
that adapting the i2c_helper.h file from a the game.
previous project for its i2c_read and i2c_ read_sensors.py: In this file, we use
write wrapper functions to be immensely pyserial to read incoming data on the
helpful [2]. The wrapper functions abstracted serial port and parse it into custom classes
away the I 2C methods of reading and for accelerometer data and gyroscope data.
writing to a register on a sensor. It’s best We implemented a calibration period of
to write these functions based on the sensor three seconds over which we asked the user
datasheets and PLIB manual for the sensors to extend his/her arm horizontally outward
and microcontroller unit of your choice. For with all three IMUs facing upwards. We
increased ease of use, it’s best to implement required that the devices be at rest during
functions for each of the three sensor units, this time. The first 120 sensor readings we
and for each accelerometer and gyroscope at collected during calibration were averaged
these locations. Read and write I 2C wrapper and used for initial values after which we
functions can be used for both initializing the integrated for relative changes in position
sensors as well as reading data from them. and orientation. The calibration offsets
We have a total of two threads. One depend on the location and temperature.
thread starts out by writing configuration In the read loop, we integrate the data
and wakeup values to the sensors and then and update an odometry dictionary, which
repeatedly reads from the sensors and sends keeps track of the position and velocity of
their data over serial in the second. Since only each sensor. If run as main, this file prints out
one thread is scheduled throughout this whole the sensor values it is reading. We also apply
process, the program reads and sends sensor the complementary filter to the orientation,
values at maximum configuration speed, where the angular velocity is replaced by
provided that the baud rate is set proper. 0.97 x angular_velocity + 0.03 x acceleration.
The protocol we designed for sending data
over serial uses spaces to delimit registers
from the same sensor, newlines to delimit ABOUT THE AUTHORS
different sensors and the word “init” followed
Emma Wang (exw2@cornell.edu) graduated from Cornell in 2017 with a B.S.
by a newline to delimit sensor readings at
Electrical Engineering, and Operations Research and Industrial Engineering.
different timesteps. This protocol enables
the corresponding Python script to connect She currently works at Johnson Controls as an Electrical Engineer within the
to the device at any time as the script can Special Hazards team. Her interests are in circuit design,and she has a pen-
use inits to separate out sensor readings by chant for developing wearables and spending time in her community.
timestamp.
The following is an example data chunk Zachary Zimmerman (zacharytzimmerman@gmail.com) graduated from the
from one timestep containing the angular Cornell in 2017 with a B.S. in Computer Science. He currently works at Micro-
velocity and acceleration readings from
soft doing rapid prototyping for new technologies. His interests include design
the gyroscope-accelerometer unit. You can
and ergonomics, computer graphics programming and game development.
compare results but note the variations due
to sensor fabrication and other settings:
Daryl Sew (darylsew@gmail.com) graduated from the Cornell College of En-
init gineering in December 2016 with a B.S. in Computer Science. He currently
6 34 8 -899 -14546 -9824 works at Snapchat on computer vision and augmented reality. He’s passionate
32511 40 28009 9119 -867 11209 about game design and robotics.
36 -259 -261 -3954 -2928 14885
 18 CIRCUIT CELLAR • FEBRUARY 2018 #331

Each output by the complementary filter

generates a quaternion.
game.py: In this file, we created a virtual
IMU Sensor location on body representation of an arm in a sandbox
environment, allowing users to interact with
Shoulder objects on the screen just by moving his/
FEATURES

her arm. Our game is made to demonstrate

these capabilities by letting the user hit balls
and watch them bounce around a ball pit
according to physics simulation.
You need several Python BSD compatible
Elbow
libraries to speed up the software development
process. All of these can be found with a search
engine. We chose libraries that were compatible
with our system and easy for us to use.
Wrist pyserial: This is used to process incoming
information on the serial port and can easily
be found using a search engine.
Panda3D: Used to render the virtual arm
visualization. We found this application through
a search engine and chose this application for
its ease of use and compatibility.
NumPy: Used for fast numerical
computation. Described as the “fundamental
package for scientific computing with Python”.
matplotlib: Used for creating graphs. This
was helpful when debugging and discovering
the value of our position data.

HARDWARE DESIGN
The PIC32MX250f128b serves as the
intermediary link between the sensor units
and the PC. It drives the I2C1 lines and the
FIGURE 2
IMU Sensors are placed along the right arm. Each joint, shoulder, elbow and wrist receive an IMU. Gyroscope
serial communications. Pins 17 and 18 are
and accelerometer data from each location is fused to generate and track arm position. reserved for the I 2C channel—pin 21 is UART
transmission and pin 22 is UART receiving.

a) b)


'/

"
6 73 8/
 
38, 8/))
 2
1.
."
38
3-

.  

3-, 3-
.
.
3-
3-

2 
3- / )-/ '2/
3  
., 3- 3-

83:3+
3. " 
'/
., /)) 3-
, 83::+
3  ,
., 38 /8 3 


,
 3
83 ( 38 /))




" )8

839 3-. 3-
,'
0


 )7

839  38. 3-" 3



2
/ 3-

.

3- 3-2
3" 3 32
, , ,
* + ,!
"-

c) 4+<, 4+<, 4+<,




 .  .  .
. 2 . 2 . 2
83 ( 839 839 
  "   "   "
)7
)7
)7

/  
, /  
, /  
,
'2/ )8
'2/ )8
'2/ )8

*;/



 *;/



 *;/




'2/ '2/ '2/


.

.

.


2

2

2

Shoulder - Gyro/Accel Elbow - Gyro/Accel Wrist - Gyro/Accel

FIGURE 3  &5

This shows the system’s wiring. (a) PIC32MX250f128b Wiring, note the construction of proper voltages to drive the ADDR pin of each KXG03 sensor unit; (b) Constructing proper
VDD for KXG03 units with diode voltage drop; (c) KXG03 wiring, note wiring is identical among the three units except for the ADDR pin %&!& 4

)(
 circuitcellar.com 19

In order to safely power the KXG03 sensors, filter produced orientation measurements
we had to construct proper voltages. Drawing that were impressively precise. With a
from the 3.3 V of the PIC32, we dropped PIC32MX250f128b baud rate of 115,200, we
down the voltage by using the diode to bias were able to read from all three sensors at
to approximately a 0.7 V drop. Ground the approximately 41 Hz. Enabling high speed
signal of this divider through a 1 kΩ resistor, I 2C mode compatibility on the devices and

FEATURES
using 10 µF and 0.1 µF capacitors to eliminate microcontroller could possibly result in higher
transients. You can also directly source from quality odometry. That’s because a higher
a power supply set to 2.6 V. quantity of sensor data would enable us to
The toggling address Chip Select lines improve our fusion algorithms.
also need to be alternating at 2.6 V and 0 V. Using a complementary filter substantially
The proper voltage must be constructed in increased the overall usability of our
this case because of the toggle instruction application. We went from having arm drift
originating from the PIC32. A voltage divider from the beginning (0 seconds) to being able
with the properly ratio of resistors is used to to run for up to two minutes before having
create the voltage for each sensor unit. This to reset to eliminate drift. If you have good
needs to be down with each address toggle ground truth measurements for arm motion
line. In this case, that means providing three then you would be able to provide a more
unique voltage dividers for each of the three quantitative analysis of your accuracy. In
sensor units. testing, we found that movement passing
The sensor units used are three of the through the initial calibration position
KXG03 gyroscope-accelerometer units. They periodically at about 1-minute intervals also
are also referred to as IMUs. The IMUs are helped the drift to correct itself.
placed along strategic mapping points along For code and details, go the Circuit Cellar
the limb—in this case an arm—at the shoulder, article materials page. You can view our
elbow and wrist (Figure 2). Essentially, each results and there are two demo videos
joint receives an IMU. where we demonstrate the use of our system
Each of our IMUs receive VDD, IO_VDD and give brief explanations of its inner
(same value as VDD), GND, I 2C channel, workings.
1 CLK and data lines, and a line that toggles
the last bit of I 2C address to 1 or 0. Using
the PIC32MX250f128b, we assigned 3 pins to
toggle the ADDR line of the shoulder unit, the
elbow unit, and the wrist unit. We used open
pins 4,5 and 6. See Figure 3 for a detailed
overall schematic.

RESULTS
We are pleased with the result of
the project. The device enables users to
manipulate objects in a virtual world when
moving their arm around. We are happy that
the complementary filter proved effective
in eliminating orientation drift. As demos
show, implementing the complementary

EVE2
Additional materials from the author are
available at:
www.circuitcellar.com/article-materials These Capacitive & Resistive

TFT Modules
Touch HMI displays feature:

4 sizes
References [1] and [2] as marked in the
article can be found there.
Power Re-Envisioned 3.5”, 4.3”, 5.0” and 7.0”

3
media types
RESOURCES High-res graphics, video and audio
Find a discount code and learn more
Kionix | www.kionix.com about these cutting-edge products:
NHdisplay.com/EVE2cc1
2 connectors
Standard 20-pin FFC and IDC

1 powerful chip
Microchip | www.microchip.com
EVE2 graphic engine by FTDI/Bridgetek
NumPy | www.numpy.org

Panda3D | www.panda3d.org
 20 CIRCUIT CELLAR • FEBRUARY 2018 #331

Designing a Home Cleaning

Robot (Part 3)
Circuit Design
FEATURES

Example of a basic iRobot cleaning robot

(Image courtesy of www.irobot.com)

In this next installment of his four-part article series about building a home
cleaning robot, Nishant discusses the circuitry behind the system. This involves
the selection of the electronic components and optimizing the system for overall
power consumption.

By
Nishant Mittal
Cypress Semiconductor

Motor2 Motor1
IR Sensors

Six sensors
I n the previous two parts (Circuit Cellar
329, December 2017 and Circuit Cellar
330, January 2018) of this home cleaning
robot article series, I setup the base of
the system and its mechanicals and put the
components together. In this and in next
Motor Driver month’s part, I’ll delve into the electronics
12 V and algorithms needed to make the automatic
home cleaner work.
Gnd 12 V 12 V 5V
Regulator Figure 1 shows the block diagram of the
Header for fitting electrical system. Because this is a mobile
CY8CKIT-042 BLE
5V Module system, a battery will be used instead of
Regulator
bench-top power supply. Because of the size
constraints of this system, we’re using a 9 V
12 V battery. Two voltage regulators are needed:
Motor Driver
one boost regulator for 9 V to 12 V, and one
buck regulator for 9 V to 5 V conversion. These
voltages are mostly required to drive the
Motor3 Motor4
motor and sensors. All the data processing and
data transfer happens through the controller
FIGURE 1 module from Cypress Semiconductor: the
Block diagram of the electrical system CY8CKIT-042 BLE.
 circuitcellar.com 21

This module is very easy to use. You can

make a custom board to meet your system
requirements and then hook up this module to
your custom board—and that’s what we did in
our design. Photo 1 shows the CY8CKIT-042
BLE module we used. This module contains the

FEATURES
PSoC 4200 BLE which is capable to handling
all kinds of digital and analog processing
within a single SoC. This SoC not only does
data processing, but also embeds Bluetooth
functionality—resulting in an extremely low
cost and compact solution.
The next important component choice
is the battery. When choosing a battery, we
had to consider current rating (in mA-hours)
PHOTO 1
and the required voltage. Higher the voltage
Cypress CY8CKIT-042 BLE module
rating, the bigger the battery needed. We
needed a battery with long life and a decent
voltage and current rating. The battery also
had to be rechargeable, low cost and long
lasting. With all that in mind, we chose the
HPB Power battery with 2,200 mA-hours and
9 V at 2 A. Photo 2 shows the battery—a
lithium polymer cell.
The next design element to be selected is the
sensor. Here, we chose an IR sensor although
an ultrasonic sensor was an option. Both have
their own advantages and disadvantages.
PHOTO 2
Instead of designing our own modules, we
Lithium polymer battery for the home cleaning robot
bought the module shown in Photo 3. In
this module, we can tune the distance. The
module contains the circuitry that modulates
the signal received and converts into digital
data. That data is then fed to the input of the
microcontroller. Using the potentiometer, the
modulation can be tuned to mark the distance
of object detection.

CIRCUIT DESIGN
We’ll begin the discussion of the circuit
with the power supply design. As mentioned
earlier, we have a 9 V, 2 A input. That is split PHOTO 3
into 12 V and 5 V as shown in Figure 1. To do IR sensor module
that, we needed to design a buck regulator
and a boost regulator. The boost regulator is
-

3
) 3

needed for 9 V to 12 V conversion. For that
%)
*

*
we chose a Texas Instruments (TI) LM2585 -012

(
+
chip. The LM2585 is a fly back boost regulator
with has a switching frequency of 100 kHz ,


and a wide input voltage range of 4 V to 40 V.
+


Figure 2 shows the design of boost regulator. )

- 

The resistor calculation for this is determined '7&
.

++,
/-
8

using the equation:

6

3
. ( )!) 

.
%
*
 R123 
Vout = Vref × 1 + where Vref = 1.23 V
 R125 
.,)+-

)

+%
,)+-

A 1% tolerance metal film resistor is

recommended for better accuracy. Figure 2
shows the circuit diagram of the same which FIGURE 2
is designed for this project. Boost regulator 9 V to 12 V
 22 CIRCUIT CELLAR • FEBRUARY 2018 #331

 Next up is the buck regulator. We went with

)3.;0-</
 a switching regulator instead of a low drop out
(LDO) regulator. That’s because we are using
DC motors that wouldn’t perform efficiently

,6 4
86/

</
using an LDO as a power source. We needed

,./

;/

))
#7
0 1
2 !3415/6 7

 ! 2 *  a buck regulator with a 9 V to 5 V output. The
FEATURES

power module from TI called LMZ14203HTZX/

,-./ ,-
,= , >$?%
NOPB meet these requirements. This regulator
8 
requires minimal circuit elements to make the
*
'
!2
8* chip work. This chip has an internal shielded


8 
 ,
'*
inductor which makes the PCB design easier.

+ ,
+ ,
*'
 This regulator has soft start-up sequencing
8* !! ! using external soft start and precision enable.

+ ,
+ , This regulator drives loads up to 3 A with
good power conversion efficiency and output

8*
8**


'
' 
 ,
accuracy.
The regulated output voltage determined
by external divider resistors RFBT and RFBB is:

FIGURE 3
 RFBT 
Power module (buck converter) Vout = 0.8V × 1 +
 RFBB 
*+, *+,


This resistor should be between 1 kΩ to
0

/
6.


*))

 50 kΩ. Figure 3 shows the circuit diagram of

+ +

+
4 &4

+ +

 + +
+



"

+.+ the power module for 9 V to 5 V converter

5 &5
7. 7.
&
,



1
used in this design.
*

7.
7.
7.
7.
1 *+,
, Figure 4 shows the motor driver circuitry.
 0


&
7. 7.

+.+ " +.+
 + + Here, we’ve used the L293D from TI, which
5 5

+. 4 4



+.






can &:
 
+.+
be used to drive two motors using a single
*) 6.
/
  IC. That means a total of those of these ICs
are required. The IC needs two power9 sources
*+,
-
*+,
 #&!
at 12 V and 5 V—5 V at Vss and 12 V at Vs. This


0

is to drive the motor directly using 12 V while
)(
/
 

6.
*))
  + + the IC voltage is at 5 V.
+
+ +



4 &4



" &+ +
&+

+.+ Figure 5 shows the I/O header for

5 &5
 !!
"#
$
%
&
,
7. 7.



1
 #&!'($)(

% inserting into the CY8CKIT-042 BLE module.
*
 1
7.
7.
7.
7.

, *+, We’d needed as many as 8 pins for the motor
0
1
and 6 pins for the sensors—however other

&
7. 7.
+.+ "
 &+.+  &+ +
5 5
+.



4 4





&+.

&+.+
pins are brought out as GPIOs. Figure 6
*) 6.
/

 shows the connector used to insert the sensor
- shown in Photo 3. These sensors are readily
available on any electronics hobbyist website.
FIGURE 4 These sensors are easy to use direct digital
L293D motor driver output sensors which can be connected to the
PSoC. The enable pin for these sensors are set
by default to ground because they are active
). low. However, these can also be connected to
)
/
 the GPIO pins and can be driven according to


/
 +*
 +
+*-
application needs.

*3
 % 3
* *-

*  + 5-  

*%

*
%

3 6,4(
 2*
*

*
+*2





2

 %*

*-

*- PCB DESIGN

*+ 
2 2*3 +*


+ %*2 Because our board contains switching
  %3

*




* ), *3
%
3 *
),4!

+
*2 *+

 *% regulators, designing the PCB appropriately is
2*+
%
3 2*% *
 2 *
very important. Very fast switching current
2*
2*2






2
2*
2*

*2 



+
*

!%
around&
2
long tracks and inductance generates
$  .$ 
voltage transients which
)( can cause problems.
For minimum ground loops and inductance,
track lengths need to be as short as possible.
  
! 
"# 
$ !% &' (#)( 

$ Single point grounding or a ground-plane
FIGURE 5 based approach is recommended for best
CY8CKIT-042 BLE header for module placement results. Power grounds and signal grounds can
 circuitcellar.com 23

+,- +,- +,- +,-

.- .) .
.





   

,) 
,

, 
,
0 /
 )* 0 /
0 )* 0 /
 )* 0 /
" )*
- - - -

34 /
 34 /
- 34 /
 34 /


FEATURES
)* )* )* )*
/
0" /
0 /
-) /
-

34 )* 34 )* 34 )* 34 )*

,) ,
, ,

+,- +,- +,- +,-

. .0 .- .





   

,0 
,- 
, 
,
0 /
0) )* 0 /
0 )* 0 /
00 )* 0 /
0 )*
- - - -

34 /
0
34 /
0 34 /
0- 34 /
0

)* )* )* )*
/
- /
- /
-0 /
--
34 )* 34 )* 34 )* 34 )*

,0 ,- , ,

FIGURE 6
Sensor connector

 %2

!% 1

('

   
!
"#
$ !% & '#('

$

PHOTO 4
(a) bottom track of board. (b) top track of board

VIN

LMZ14203H VO
VOUT
VIN

High
di ⁄ dt
CIN1 CO1
GND

Loop 1 Loop 2

FIGURE 7
Feedback routing of the power module on board
 24 CIRCUIT CELLAR • FEBRUARY 2018 #331

also be separated. But that’s not necessary,

provided there is analog processing circuitry
on board. Decoupling capacitors should
be placed as close to the chip as possible.
Photo 4 shows the overall routing of the top
and bottom layers. A file available on the
FEATURES

Circuit Cellar article materials page can be

used as a reference for the design.
For the power module, poor board layout
can disrupt the performance of the DC-DC
converter and surrounding circuitry due to
electro-magnetic interference (EMI), ground
bounce and resistive voltage drop in the traces.
These can send error signals to the converter
making the output poorly regulated and
unstable. Apart from those considerations, a
good power module PCB design should provide
short feedback paths. It’s also important
to place a feedback resistor near the chip
to ensure stability. A lot of heat sinking vias
should be placed around the board. Those will
also help to keep the ground uniformly spread.
Figure 7 shows the feedback routing of the
power module to be designed.
Photo 5 shows the placement diagram
PHOTO 5 of the PCB. The power supply section
Placement diagram is towards the left with all components
placed as close as possible. The Motor
driver is placed in the center so it can
be distributed throughout the board.
Sensors are placed all around the board
to be in line with the mechanical system.
Photo 6 shows the finally assembled board.
In this part of the article series we covered
electronics part of the system—the selection of
components, designing of the elements, power
supply, PCB design and so on. In the final
article next month, we’ll explore algorithms
and programming of the system.

ABOUT THE AUTHOR

Nishant Mittal is a Systems Engineer at
Cypress Semiconductors in Bangalore,
India.

Additional materials from the author are

available at:
www.circuitcellar.com/article-materials

RESOURCES

Cypress Semiconductor | www.cypress.com

PHOTO 6
Finally assembled board Texas Instruments | www.ti.com
 26 CIRCUIT CELLAR • FEBRUARY 2018 #331

Programmable Ad Hoc Mesh Network

Meshed-Up PICs
FEATURES

Can cutting edge IoT functionality be delivered at lower costs than today’s
expensive home automation solutions? These Cornell students set out to
prove that they can with their programmable mesh network project based on
Microchip’s PIC microcontroller.

By
Raghava Kumar, Brian Clark and Alex Wong

A s a final project for an upper

level technical course at Cornell,
we built low-cost, programmable
mesh network. It can be used
to build motion sensitive alarm systems,
automatic lighting, door alarms and various
automation system. Each node in our system
has one (analog or digital) input and one
output, to which a variety of sensors and
actuators may be connected. The system is
controlled by a “master” node that is capable
of querying any node’s input, controlling every
other home automation systems in a matter node’s output and setting arbitrary logical
of minutes. Our motivation for this project is relationships among the inputs and outputs
the high cost and low extensibility of existing of other nodes in the network (Photo 1). The
home automation solutions. We believe that master leverages the mesh to perform these
cutting edge IoT functionality can be delivered tasks, so it doesn’t need to be in direct range
at a fraction of the cost of these systems, and of the nodes it is configuring. Once these
are using this project as a proof-of-concept of relationships are configured, the mesh can
a versatile, configurable and scalable network operate independently of the master, and
that costs less than $20-per-node. To do this, can be used for a variety of “if-then-else”
we used a distributed mesh network capable automation tasks.
of defining relations between inputs and To manage complexity in our project, we
outputs across nodes. divided the system into the logical components
At the heart of our project is a version of shown in Figure 1. These are loosely based on
the Ad hoc On-Demand Distance Vector (AODV) the standard Open Systems Interconnection
[1] routing algorithm. It is used in popular (OSI) model. The bulk of our work was devoted
wireless protocols such as Zigbee. This to developing, integrating and optimizing the
algorithm is capable of learning, storing, and top the layers of this stack: application, mesh
updating paths through a network as needed. It and radio. The NRF24 library was developed
can therefore support any presented network earlier by Douglas Katz and Fred Kummer and
topology. We implemented this algorithm on used with minor modifications and edge case
the Microchip PIC32 microcontroller, and used corrections.
PHOTO 1
the Nordic NRF24 (nRF) radios to facilitate
Shown here is our master node wireless communication among nodes. APPLICATION LAYER
plugged into the USB port of a To demonstrate the power of this network, The application layer of our project is
laptop. we used it to build a programmable home designed to allow users to control various
 circuitcellar.com 27

FIGURE 1
We divided our project into
independent layers that interacted
using clean APIs. These layers are
based on telecommunications layers
defined in the OSI model, and helped
us manage complexity effectively.

FEATURES
devices, monitor the status of sensors and servos, LEDs and so on. Every node is capable
set logical relations to automate tasks in their of generating events that can affect other
home with a few keystrokes. For instance, our nodes, and maintains logical tables that
system may be used to: determine which events can modify its output.
The user can configure these settings using
● Remotely control the intensity of any the master node, and therefore set arbitrary
connected light in the house relationships between the inputs and outputs
● Check the temperature of every room their of other nodes.
house from the comfort of their bed All functions of the application layer
● Automatically turn the lights on when it is are supported through a custom, byte-
too dark in the kitchen encoded message protocol. We designed
● Configure what it means for it to be “too these messages to be short (so they can be
dark” transmitted reliably on the radio modules),
● Turn the lights off if no motion is detected easy to parse (to minimize microcontroller
in a room loading) and expose as little of the underlying
● Set off a buzzer whenever the fridge door software implementation as possible. Our
is left open system consists of the network messages
shown in Table 1. Messages that can only
Our code is designed to be as flexible as originate from the master node are marked
possible, enabling the system to interface with an asterisk.
with a variety of analog sensors, motors, The application layer supports user

Message Semantics
Force* Force a node’s output high or low
Query* Check the value of a node’s input, or any of its configurable parameters
Query Response Reply to the master with a requested value
Event Inform subscribers that the node’s input has just been turned high or low
Config* Configure a node parameter (see Table 2)
Add Event* Add a dependency to a node’s output
Add Subscriber* Add a subscriber to the node’s events
Remove Events* Remove all dependencies for a node’s on or off state
Remove Subscriber* Remove an event subscriber from this node’s subscriber list

TABLE 1
Application layer functionality is implemented through a set of custom messages that allow nodes to generate and subscribe to events. The messages marked with an asterisk can
only be sent by the master node for node configuration.
 28 CIRCUIT CELLAR • FEBRUARY 2018 #331

FIGURE 2
The user can configure the network
through a simple command-line
interface. They can query the status
of a node, force it on/off or build
links between different nodes in the
network.
FEATURES

interaction through the master node, node path communication is essential for
which can be plugged into the USB port of our project in order to provide an adaptive
a computer. Communication is facilitated distributive network. This protects against
using a CP2102 UART-to-USB converter, and possible attenuation between two nodes
is used to provide a command line interface by allowing communication through other
to the user. User commands are parsed by nodes. Dynamic route discovery allows for
the master node, and essentially translate each node to actively determine the shortest
to one or more network messages. A sample route to another node. Finally, dynamic
screenshot of this interface is shown in route reconfiguration enables our network
Figure 2. to maintain efficient communication by
The functions of the application layer constantly updating routes.
are supported by the mesh layer, which is Each node is loaded with almost identical
responsible for path discovery and message mesh network software, with the only
forwarding. The interface between these two difference being individual software-defined
layers is implemented using a mesh level send node IDs. These are defined in a header file at
function that routes messages within the program time and can be changed to include
network, and a receive callback function that more nodes into the network. As shown in
alerts the application layer when a message Table 2, only 1 byte is allocated for each field
addressed to this node is received. To use in our message sending structs, with one of
the mesh-level send function, the application them being the node ID. Because of this, there
layer simply inputs a message and destination is currently a limit of 256 nodes in the network
node and lets the mesh layer handle the rest. for this particular iteration of the project. In
the future, it would be very simple to modify
MESH LAYER the struct to have more bits and thus enable
The mesh layer of our project is more nodes in the network.
designed to provide a robust, reconfigurable A cache is used to house path information
networking protocol for the multiple PIC32 for each node which, upon startup, is initially
nodes. The protocol borrows heavily from empty. Each cache is implemented via an array
the well-established AODV algorithm with and pointers to the destination node, the next
several design changes to simplify the node to hop to (for multi-node hops) and the
software and improve reliability. The main total number of hops. When the send function
features of the network are: multi-node path is called by the application layer, the mesh
communication, dynamic route discovery layer will receive information on the source
and dynamic route reconfiguration. Multi- node, destination node, message and message
 circuitcellar.com 29

Type BYTE 0 BYTE 1 BYTE 2 BYTE 3 BYTE 4 BYTE 5 BYTE 6

Message Header type size src addr dst addr hop addr num hops curr hop
RREQ Message broadcast id dst addr dst seq cnt sec addr src seq cnt hop cnt pad
RREP Message dst addr dst seq num src addr lifetime pad pad pad
Route Table Entry dst addr dst seq num valid flag hop count next hop addr lifetime network int

FEATURES
size. The cache will be searched for a cache the destination through itself. It either has a TABLE 2
entry that contains a path to the destination. path in its cache or is in fact the destination This table shows the byte-level
encoding of the various message
If one is found, the cache hits and the mesh node. Because of this, all nodes that have
headers used in the mesh networking
layer can send immediately by transmitting a propagated forward the RREQ will also be
protocol.
packet with the data—along with a prepended able to fill in its cache information about the
7-byte header for information—to the next path. Eventually the source node will receive
hop node. Otherwise—if there is a cache the RREP message and fill in its own cache
miss—it will begin the cache miss process. before sending actual data packets through
We’ll detail that miss process more later. the found path to the destination.
Assuming a cache hit, the next hop node In order to properly forward the RREP
will decode the packet and see whether it is a message to the original requester of the path,
data packet to forward or to receive. This node the path that was taken by the RREQ message
will also have a cache entry to the destination, must be reversed. This is done by storing
so when the send function is called again, the propagator of the RREQ flood message
it will always respond with a cache hit and in every node in the path. If a node receives
send. This is shown in Figure 3 which shows a RREP, it’s because it was either one of the
a cache hit for a multi-node message send. nodes along a constructed path, and should
In this case, the source node, Node 50, will forward the RREP to the node that sent it
have the destination node in its cache with the corresponding RREQ, or the source. This
the next hop address field being Node 20. means after a RREQ has been propagated to
Node 20 receives this message and because the destination node, the RREP will exactly
of the way we propagate RREP messages, retrace the path of the RREQ. This is shown
will also have a cache hit. The data message in Figure 5, which shows how the RREQ and
is therefore sent forward to the destination RREP routines work. In this case, we have
node, Node 10. If there is a cache miss, then a network with 3 nodes with Node 50 and
there is currently no path from the current Node 10 far apart and Node 20 acting as an
node to the destination. As a result, the route intermediary node.
request routine must be started. In this specific case, the nodes are in
startup with empty caches. We have Node
ROUTE DISCOVERY 50 attempting to send to Node 10 so it
In addition to having multi-node sending, floods the network with a RREQ message.
it is also important to be able to discover Node 20 receives this and realizes that it
new routes from source nodes to destination
nodes. By having a dynamic routing algorithm,
the network is able to easily acclimate to Message legend:
losing connection with individual nodes. Upon Packet type | Source ID | Destination ID | Next hop ID
initialization of the network, the first possible
event that can happen is the master node
sending out any command. The master node
attempts to send to another node which it has 0 |50 |10 |20 0 |50 |10 |10
not established route information for, since
no paths are known. In this case, there will
be a cache miss which will begin the dynamic
route discovery routine.
Node Node Node
The dynamic route discovery routine 20 10
50
works by first sending a Route Request (RREQ)
message via a network flood. The RREQ
message acts as a broadcast to all nodes
saying that the source node does not have a FIGURE 3
path to the destination node. Any node which This graph shows how the message headers used in the mesh network change in order to allow multi-node
receives the RREQ has two options: forward hopping. Here we are only viewing sent message packets. In this case the first number represents the type
the RREQ message by flooding its own RREQ of the message (a data message, for example), the second number represents the source node ID, the third
message or return a Route Reply (RREP) is the destination node ID and the last is the next hop node ID. In this example, the packet types are only
message, signifying that it knows a path to data messages which has an ID of 0. The rest are self-explanatory.
 30 CIRCUIT CELLAR • FEBRUARY 2018 #331

of filling in all of the node’s caches and flooding

Message legend:
the network with RREQ messages and RREP
Packet type | Source ID | Destination ID | Next hop ID messages (Figure 7). But this networking
algorithm works very efficiently for both very
small networks with close proximity nodes
and also for very large networks with many
1|50 |10 |
FEATURES

nodes. In the first case, the discovered paths

will generally be direct paths. That’s because
simply receiving a message and returning at the
destination is faster than processing multiple
Node Node Node floods. For large networks, this topology is
50 20 10 almost necessary to have in order to ultimately
achieve efficient paths between the nodes.
Furthermore, this system was designed to be
long-term with a very long battery life. Because
2|50 |10 |50 of this, the large startup overhead needed for
achieving full network throughput is weighed
against getting the fastest path between all
FIGURE 4 nodes at steady-state.
This illustrates a route discovery routine where the source floods the network with a RREQ message and an In regards to our abstraction layers, the
intermediary node with a path receives it and sends back a RREP message. In this case we have two types mesh layer provides a simple send function
of packets—we have 1 = RREQ and 2 = RREP. to the application layer and uses the latter’s
receive callback function. The mesh layer in
turn uses the radio layer’s send function to
actually send messages between nodes. In
is not the destination and it has no path to addition, it provides its own receive callback
the destination so it propagates it forward function for the radio layer to use.
to Node 10. Node 10 receives this and is the
destination so it sends back a RREP message RADIO - HARDWARE LAYER
to the node which flooded it, Node 20. Node 20 At a high level, we wanted our nodes to
receives this and fills its cache and propagates be simple, lightweight and easy to interface
the RREP message to which node flooded it, with. In order to fulfill these requirements, we
Node 50. This then receives it and fills its own minimized physical node size and put effort
cache before sending out a data message. into streamlining the nodes for our users.
Figure 6 is a variant of a similar procedure Each node consists of the following key
except in which the distances between all components:
nodes are arbitrary. In this case, Nodes will
ignore multiple floods from the same source. ● nRF24l01+ Radio Transceiver
There is a lot of startup overhead in terms ● 3 AA battery pack
● PIC32 microcontroller
● TFT header for debugging
Message legend:
Packet type | Source ID | Destination ID | Next hop ID In order to create a fully functional
independent node for practical use, several
factors had to be considered when designing
1|50 |10 | 1|50 |10 the nodes. A node that’s too fragile, too large,
too expensive or even required too much
power would be impossible to implement from
a practical standpoint. With all that in mind,
we decided to use the PIC32MX250F128b
Node Node Node microcontroller as the processor for our nodes.
50 20 10 This inexpensive, easy-to- implement and hard-
to-break chip enabled us to use the required
libraries and tap into enough processing power
to meet our network demands while drawing
2|50 |10 |50 2|50 |10 |20 very low amounts of current. Figure 8 shows a
component-level circuit schematic diagram for
each general node.
FIGURE 5 The PIC32 and nRF24L01 require a constant
This shows how the route discovery routine functions. Intermediary nodes will re-flood original flood 3.3 V power supply, so three 1.5 V batteries are
messages while changing the next_hop field. This enables the destination node to send a route reply message fed into a 3.3 V regulator to provide a constant
using the newly discovered path. power source. There is about a 1 V drop across
 circuitcellar.com 31

the voltage regulator. This power is fed into the

nRF Vin pin and hooked up to the PIC32. Message legend:
Besides these considerations, the hardware Packet type | Source ID | Destination ID | Next hop ID
design was fairly straightforward. This is
because the hardware was designed to be as
flexible as possible, leaving as much room as 1|50 |10 |

FEATURES
possible for various configurations. With the
minimal hardware on board, the PIC32, TFT Node
and radio drew 100 mA of current in steady 20
state—enough for about 20 hours of battery
1|50 |10 |
life. However, if further optimizations were
made to the radio, and if we tapped into low- Node 2|50 |10 |50
power modes for the PIC32, or removed the 50
TFT, longer battery life could easily be achieved.
Each node except for the master contains
an optional TFT display so that the actual Node
10
packets going through the networked can
be visualized. This is useful for debugging
1|50 |10 |
purposes as well as ensuring correct
operation of various attachments put onto the
nodes. The master node, instead of having a FIGURE 6
TFT display, simply puts its outputs onto the This illustrates a route discovery routine where the source floods the network with a RREQ message and the
serial terminal that is used to interface with destination receives it and sends back a RREP message while another intermediary node receives the RREQ
it. This enables a user to communicate with flood and attempts a flood of its own which the destination ignores. (1 = RREQ, 2 = RREP)
all general nodes through a single master

Message legend:
Packet type | Source ID | Destination ID | Next hop ID

1|50 |10 1|50 |10

1|50 |10

2|50 |10 |20

Node Node Node
20 60 80

2|50 |10 |50 2|50 |10 |60

1|50 |10
1|50 |10 1|50 |10
2|50 |10 |80

Node Node Node Node

50 30 40 10
1|50 |10

1|50 |10
1|50 |10
Node Node 1|50 |10
FIGURE 7 50 70
This diagram illustrates the scalability of the mesh network
due to the simple software filtering of flood messages built
into the mesh layer’s receive callback. (1 = RREQ, 2 = RREP)
1|50 |10
 32 CIRCUIT CELLAR • FEBRUARY 2018 #331

FIGURE 8
'/
Component-level circuit schematic
diagram for each general node '/
3
 .'





)6

!
01 9 03 4/
  
)$ 01 34 4/))
.  7
FEATURES

)* 34
3-
,

, . ,
 3- 3-
.
7 , .
31)1; 3-
3-
 *
 7 
.( ) 3- / )-/
!  
0 <2 3- 3-


: ! 

/ '/ /)) 3-

: 
34 /4


:
34 /))



!
3-. 3-: > ,



34. 3-!


7
5
'/ / 3-

.
,
3-, 3-7
'/
3

* +,
!-


<2

/

1
.
)2
,
)$
7
6)*

*)6
!
*3=
6
23 .0
4 '/ '/

/ *2 6 ; '/ . 7
<2
'
5 '
5
0


4/

node that can be universally plugged into Once all three layers passed their unit
any computer with a USB port (Photo 1).tests, we put them together and began
The master node is also equipped with arigorous integration testing. First, we tested
simple one-to-one communication with
PIC32 and nRF24L01 so that it supports the
all three layers active. Once this worked,
same network interface as the general nodes.
we attempted communication with
   two
 &8
TESTING AND VERIFICATION nodes in range of the master node. It was
Consistent with the high-level abstraction $%
here that we first started to drop &
packets!
that we detailed earlier, we chose to among nodes. This didn’t happen earlier
independently develop our three layers prior because nRF radios have a built-in auto-
to integration. This meant unit testing of each acknowledgement packet that is sent out on
layer was handled by the respective developer. successful reception. With multiple nodes in




        
 
!" 
#$%  & !' (")( 

#
range however, the master node would never
● For the application layer, this involved know whether every node in range correctly
simulating data packets, observing node received the packet.
behavior, and ensuring user input was We bypassed this issue by disabling
serialized correctly. auto-acknowledgement on the radios and
● For the mesh network, unit testing mainly manually retransmitting a fixed number of
comprised of testing possible data paths times. This seemed to alleviate the problem
for sending and receiving, such as cache hit for a small number of radios, at the risk of
hop and cache miss hop. increasing the possibility of packet collision
● For radio layer, testing consisted of ensuring for a large number of nodes.
packet reliability and functionality across The next step was to test long range
different distances and number of nodes. message hopping. To do this, we placed one
radio outside the range of the master node
and another one in between the two. This
Additional materials from the author are available at: was difficult in practice, because there’s a
www.circuitcellar.com/article-materials grey area in which nodes would still be in
range, but with a very low success rate. All
Reference [1] as marked in the article can be found there. that said, we were able to make the master
node to communicate with nodes out of
RESOURCES direct range—demonstrating one of the
key functionalities of our mesh network.
Microchip | www.microchip.com
We were also able to verify path discovery
Nordic Semiconductor | www.nordicsemi.com in larger multi-node networks. In these
 circuitcellar.com 33

FIGURE 9
Packet success rate vs. Distance
Shown here is a racket reliability
100 chart. Straight: No obstacles between
the destination and master node.
90
Bend: 90º angles about every 45 feet
80 at which one hop node was placed.

FEATURES
70

60 Two nodes
Success Three nodes straight
rate 50 Three node bend
(%)
Four node bend
40

30

20

10

0
0 20 40 60 80 100 120 140 160 180
Distance between master and destination node (ft.)

networks, we observed high traffic in the among other factors, but were unable to
form of RREQ floods and RREP messages increase packet reliability beyond a certain
during route discovery stage, and had to add threshold. For future iterations, we believe
software packet filtering to ensure stable it would help to either experiment with
performance. different radio modules, use independent
radios for transmission and reception on
RESULTS each node, or find a more robust library.
After completing our project, we
conducted range tests and observed FUTURE DEVELOPMENT
performance to collect the results shown in We were able to achieve many of the
Figure 9. The application and mesh layers goals of our final project. While radios turned
performed consistently well through our out to be more fickle and mesh algorithms
experiments. We tested different commands far more difficult than expected, we were
and messages with up to four nodes able to demonstrate automation functionality
communicating and dynamically discovering on a mesh, as desired. Future work on this
paths in the network. We were able to verify project could involve testing with superior
multi-node paths by constructing several hardware, optimizing the mesh algorithm to
test cases with nodes out of direct range. increase reliability and adding more
This worked well for a small number of application layer functionality to make this
nodes, despite occasional packet drops and project into a full-fledged, highly
collisions. One limitation here was that four customizable automation system.
is a relatively small number for realistic
applications. Ideally, we would have liked to
test latency and throughput under higher
stress conditions.
ABOUT THE AUTHORS
The radio and hardware layers were able
to achieve a reasonable tradeoff between Raghava Kumar (rk534@cornell.edu) is a senior in Electrical and Computer
cost, performance and power-consumption. Engineering at Cornell University. He loves working with microcontrollers,
Our prototype nodes cost $20 each and FPGAs, and embedded computers.
would last 20 hours of continuous usage.
If we optimized for production, we believe
Alex Wong (aw528@cornell.edu) is a senior double majoring in Electrical and
cost could easily be halved, and battery life
Computer Engineering and Computer Science at Cornell University. He enjoys
could be increased significantly with some
all things Computer Architecture, ASIC/FPGA Design, and Space.
software support.
All that being said, hardware was the
limiting factor our in-network reliability. Brian Clark (bac239@cornell.edu) is a senior at Cornell University currently
A lot of effort was put into debugging the double majoring in Electrical and Computer Engineering and Computer sci-
seemingly inherent unreliability of the nRF in ence. You can find him spending his free time on applying microcontrollers
multi-node situations. We experimented with to practical applications and writing code for various application.
different channels, pipes and transmit rates
 34 CIRCUIT CELLAR • FEBRUARY 2018 #331

Electronics Propel Driverless

Vehicle Designs Forward
From Assist to Autonomous

It may not happen overnight, but the shift from driver assisted
vehicle controls to full autonomous driving is underway. To meet
demands, MCU and analog IC vendors are crafting new chip and
development tool solutions.
SPECIAL FEATURE

W
By Jeff Child, ithin the next couple years, we’ll blink our eyes and driverless
Editor-in-Chief cars will suddenly be a mainstream phenomenon. Building toward
that goal, chip vendors are evolving their driver assistance
technologies into complete driver replacement solutions. These
solutions make use of powerful system-on-chip (SoC) and microcontroller devices
to analyze a car’s surroundings, process the information and employ control
functionality to steer cars safely.
Building on their long histories of serving the automotive market, the leading
microcontroller vendors have taken the lead, facilitating driverless car systems
with not just chips, but also very elaborate development platform solutions. And
over the last 12 months, that trend has accelerated as MCU suppliers evolve their
driver assistance technologies in parallel with their autonomous vehicle solutions.

LEVEL 3 AUTONOMY
Exemplifying these trends, Infineon Technologies supplies key components for
the Audi A8, the first series production car featuring level 3 automated driving
(Photo 1). Level 3 automated driving is where drivers can temporarily take their
hands off the steering wheel under certain conditions. The Audi A8, for example,
allows this when parking and exiting, in slow-moving traffic or in traffic congestion.

PHOTO 1
The Audi A8 is the first series production car featuring level 3
automated driving. Level 3 is where drivers can temporarily take
their hands off the steering wheel under certain conditions.
 circuitcellar.com 35

Table 1 shows how the ability of cars to self- Autonomous Driving Levels
drive is split into a number of different levels. There are no automated driving features. The driver is
Various chips from Infineon enable responsible for longitudinal guidance (maintaining speed,
automated driving in the Audi A8. These Level 0
accelerating, braking) and lateral guidance (steering). There
include sensors, microcontrollers and power are no intervention systems, simply warning systems.
semiconductors. Radar sensor chips from the
A system can either take over longitudinal or lateral guidance
Infineon’s RASIC family are installed in the
Level 1 of the vehicle, while the driver permanently executes the
front and corner radar. They send and receive
other activity respectively.
high-frequency 77-GHz signals and forward
these on to the central driver assistance The driver can hand over longitudinal and lateral guidance to
controller (zFAS). A microcontroller from Level 2 the system in a specific application. The driver must always
Infineon’s AURIX family is a key component of be in a position to immediately retake control of the vehicle.
the zFAS for reliable automated driving. AURIX The system identifies the system limits independently. The
enable a secure connection to the vehicle driver no longer has to permanently monitor the longitudinal
data bus. It assesses and prioritizes data Level 2 and lateral guidance of the vehicle. However, the driver has
packets and initiates their processing in the to remain able to resume driving when prompted by the

SPECIAL FEATURE
fastest possible time. For example, it initiates system with a specific buffer time.
emergency braking based on data from radar The driver can hand over the full driving task to the system
and other sensor systems. The AURIX family Level 4 in specific applications (road type, speed zone, environmental
of microcontrollers is especially ideal for this conditions).
purpose thanks to high processing power and Driverless driving. The vehicle can perform the driving task
extensive safety features. Level 5 fully autonomously—on all road types, in all speed zones and
AURIX microcontrollers are used in several under all environmental conditions.
controllers in the Audi A8. They control
the functions for the engine. And they also TABLE 1
operate in the Audi AI active chassis and in the The ability of cars to self-drive is split into a number of different levels (Source: German Association of the
electronic chassis platform, which controls the Automotive Industry).

shock absorption. The microcontrollers also

support activation of the airbag. In addition to
the electronics for drive, driver assistance and The effort marries Renesas’ high-
chassis, other semiconductor solutions from performance image processing, low-power
Infineon are installed in the comfort and body automotive R-Car system-on-chip (SoC)
electronics, such as for example LED drivers from with Dibotics’ 3D simultaneous localization
Infineon’s LITIX Basic family in the tail lights as and mapping (SLAM) technology. The result
well as bridge drivers from the Embedded Power is the SLAM on Chip (Photo 2). The SLAM
family in the windscreen wipers.

PROCESSING LIDAR INPUT

LiDAR (Light Detection and Ranging) is a
critical technology used in vehicles to detect
surrounding conditions. And processing
incoming LiDAR data is a perfect example
of the kind of technology that address both
assisted driving functionality today and
automated driving of the future. With that
in mind, Renesas Electronics in December
announced a collaboration with Dibotics, a
supplier of real-time 3D LiDAR processing.
The companies are working together to
development an automotive-grade embedded
solution for LiDAR processing to be used in
advanced driver assistance systems (ADAS)
and automated driving applications. The
jointly-developed solution is expected to enable
system manufacturers to develop real-time 3D PHOTO 2
mapping systems with high level functional SLAM on Chip combines Renesas’ high-performance image processing, low-power automotive R-Car system-
safety (FuSa) and low-power consumption. on-chip (SoC) with Dibotics’ 3D simultaneous localization and mapping (SLAM) technology.
 36 CIRCUIT CELLAR • FEBRUARY 2018 #331

additional input from IMUs, GPS and or wheel

encoders. That eliminates extra integration
efforts, lowers bill-of-material (BOM) costs
and simplifies development. In addition, the
software realizes point-wise classification
detection and tracking of shape, speed and
trajectory of moving objects and Multi-LiDAR
fusion.

STEREO VISION SENSOR

In keeping with the theme of assisted
driving technology advances as a stepping
stone toward automated driving, Cypress
Semiconductor in October announced that
automotive supplier DENSO Corporation
selected Cypress’ 6-Channel Automotive
SPECIAL FEATURE

Power Management IC (PMIC) and FL-S Serial

NOR Flash memory solution to enable the
PHOTO 3 latest stereo vision sensor for Advanced
Cypress Semiconductor’s 6-Channel automotive PMIC regulates power for the entire sensor, and the FL-S Driver Assistance Systems (ADAS). The DENSO
NOR Flash memory enables fast program execution for high-performance systems. stereo vision sensor uses image processing
techniques to detect obstacles of different
shapes and lane lines, as well as empty spaces
on the road. This supports autonomous
emergency braking and automatic steering
on Chip implements 3D SLAM processing control to avoid obstacles. Cypress’ highly-
on a SoC, a function that used to require integrated, 6-Channel automotive PMIC
a high-performance PC. It also realizes 3D regulates power for the entire sensor, and
mapping with LiDAR data only, eliminating the FL-S NOR flash memory enables fast
the need to use inertial measurement units program execution for high-performance
(IMUs) and global positioning system (GPS) systems (Photo 3). Each device has a small
data. The collaboration enables a real- footprint that makes the solution ideal for
time 3D mapping system with low power this compact design.
consumption and high-level functional For its part, Cypress works with the
safety in automotive systems. several top automotive companies to supply
To prepare for the autonomous-driving them ADAS, 3-D graphics displays, wireless
era, the automotive market is optimizing the connectivity, full-featured touchscreens and
sensor technology required for autonomous vehicle body electronics. Cypress’ automotive
vehicles, including real-time, high-definition portfolio includes the Traveo MCU family,
perception of the environment, precise power-management ICs (PMICs), PSoC
localization of the vehicle and real-time programmable system-on-chip solutions,
sensor fusion. LiDAR has become a key part CapSense capacitive-sensing solutions,
of that puzzle, providing higher-precision TrueTouch touchscreens, NOR flash, F-RAM
obstacle sensing around the vehicle and real- and SRAM memories, along with USB, Wi-Fi
time electric control unit (ECU) management and Bluetooth connectivity solutions.
for vehicle control. Those are all welcome
advantages over alternative methods DEVELOPMENT KIT
such as cameras and radars. New LiDAR There’s no doubt that integrating
sensor technologies in turn increase in the automated driving technologies is a complex
amount of data to be processed, and that’s effort. Easing those efforts, technology
increasing the need for high-performance suppliers have recently been rolling out
real-time processing of all that data. complete development kids to make it easier
In contrast to existing approaches, to craft and test applications. An example
Dibotics’ Augmented LiDAR software realizes just last month was NXP Semiconductors with
3D SLAM technology that only requires data its new NXP Automated Drive Kit, a software
from the LiDAR sensor to achieve 3D mapping. enabled platform for the development and
As mentioned earlier, it does not require testing of automated vehicle applications.
 circuitcellar.com 37

The kit enables carmakers and suppliers

to develop, test and deploy autonomous
algorithms and applications quickly on an
open and flexible platform with an expanding
ecosystem of partners.
Automated driving applications require
easy access to multiple hardware and
software options. NXP has opened the door
to hardware and software partners to foster
a flexible development platform that meets
the needs of a diverse set of developers. The
NXP Automated Drive Kit provides a baseline
for level 3 development and will expand to
additional autonomy levels as the ecosystem’s
performance scales (Figure 1).
The first release of the Automated Drive
FIGURE 1

SPECIAL FEATURE
Kit will include a front vision system based on The first release of NXP’s Automated Drive Kit will include a front vision system based on NXP’s S32V234
NXP’s S32V234 processor, allowing customers processor, enabling developers to deploy their algorithms of choice.
to deploy their algorithms of choice. The
Kit also includes front camera application
software APIs and object detection
algorithms provided by Neusoft. The kit also CRATON2 chipset, an advanced and secure V2X
includes sophisticated radar options and GPS communication module.
positioning technology. System developers In a demonstration, they showed how
can choose from various LiDAR options the now commercially-ready technology can
and can add LiDAR Object Processing (LOP) be used to avoid collisions, describe road
modular software from AutonomouStuff, conditions and indicate distance to important
which provides ground segmentation and infrastructure, such as EV charging stations.
object tracking. The DSRC-based technology today exceeds
all existing US Department of Transportation
VEHICLE NETWORKING (USDOT) specifications. The exhibit featured a
An important piece of future autonomous virtual reality experience that allowed visitors
vehicle infrastructure is the ability for vehicles to “drive” a V2X-equiped vehicle so they can
to communicate with other vehicles and with see the technology’s benefits while “driving
other platforms outside the vehicle. Providing through” multiple hazardous road scenarios.
a solution for those needs are Vehicle-to-
vehicle (V2V) and vehicle-to-infrastructure MORE EFFICIENT CONNECTIVITY
(V2I) communication, collectively referred Automated driving functionality is certain
as V2X. V2X is a wireless technology aimed to increase the demand for accommodating
at increasing road safety and improve traffic
management. V2X technology is based on
5.9 GHz Dedicated Short Range
Communication, a derivative of Wi-Fi
specifically defined for fast moving objects.
It allows vehicles to communicate their
state, such as their position and speed, to
surrounding vehicles and infrastructures even
in non-line-of-sight condition, such as behind
a building or a curve.
At the Consumer Electronics Show (CES)
last month, Autotalks, a manufacturer of V2X
communication chipsets and STMicroelectronics
partnered to highlight both V2V and V2I use
cases at the show. The companies showed the
first mass-market-ready 2nd-gen DSRC-based
V2X solution (Figure 2). This includes ST’s FIGURE 2
Telemaco3 telematics platform and Autotalks’ This V2X solution includes ST’s Telemaco3 telematics platform and Autotalks’ CRATON2 chipset.
 38 CIRCUIT CELLAR • FEBRUARY 2018 #331

heavier amounts of data networking coaxial physical layer (cPHY), optical physical
throughout vehicles. This is being fueled not layer (oPHY), daisy-chain topologies or
only by the increasing amount of sophisticated creative hybrid combinations. Customers
driving electronics, but also the emergence currently using MOST150 systems can also
of more sophisticated infotainment systems rapidly migrate to new topologies or daisy-
aboard cars. Microchip Technology for is chain additional nodes with little hardware
part is helping evolve that networking with and software redesign.
its intelligent networking solution. In June Besides an integrated cPHY, a USB 2.0
of 2017, Microchip announced its newest high-speed user interface is also part of the
MOST150 Intelligent Network Interface OS81119 INIC. This integration further reduces
Controller (INIC). It enables automotive system component count, driving down overall
manufacturers and tier one suppliers costs. Time to market can be improved when
to incorporate Media Oriented Systems using the USB standard and corresponding
Transport (MOST) networks in a daisy-chain standardized MOST Linux Driver. Meanwhile,
configuration on coaxial physical layer with using an open-source Linux operating system
the support of full-duplex communication, in and driver for the OS81119 helps customers
SPECIAL FEATURE

addition to a ring topology. reduce costs. By employing the standard

MOST technology is the choice of many Application Programming Interfaces (APIs),
automobile manufacturers and tier one customers can also minimize the risk of
suppliers for in-vehicle networking. It application issues.
specifically targets infotainment and telematics
applications such as smart antennas, head RADAR SENSOR
units, amplifiers, digital clusters, rear seat While microcontroller vendors steal a lot
entertainment, Advanced Driver-Assistance of the spotlight for automotive electronics,
Systems (ADAS), driver/passenger information analog ICs are an indispensable part of the
systems and public transportation infotainment picture. And analog IC technologies are
and information systems. just as important for autonomous vehicle
With a full-duplex daisy-chained network, systems. In an example along those lines,
a single cable segment is sufficient to connect last April Analog Devices teamed up with
two adjacent devices in the network, reducing Renesas Electronics to collaborate on a
cables and connectors for the back channel on system-level 77/79-GHz RADAR sensor
each network connection. It also eliminates demonstrator to improve Advanced Driver
the return wire connecting the last node of Assistance Systems (ADAS) applications and
the network to the first. This reduces wiring enable autonomous driving vehicles. The
and component count resulting in lower demonstrator combines two cutting-edge
system costs as well as potential weight technologies that include the RH850/V1R-M
savings that can impact Corporate Average microcontroller from the Renesas autonomy
Fuel Economy (CAFE) goals and other fuel Platform and ADI’s Drive360 advanced 28 nm
efficiency regulations. CMOS RF-to-bits technology.
Using Microchip’s OS81119 INIC According to ADI, the seamless system-
allows developers to simplify the network level operation of these two technologies
architecture of automotive in-vehicle makes driving safer by enabling earlier
infotainment systems by using integrated detection of smaller and faster moving
objects at greater distances. It will also
lower RADAR system integration efforts and
reduce evaluation risks for automotive OEMs
RESOURCES and Tier One suppliers.
Analog Devices | www.analog.com Analog Devices Drive360 28 nm CMOS
Cypress Semiconductor | www.cypress.com RADAR technology platform builds on
Infineon Technologies | www.infineon.com
the company’s ADAS, MEMS, and RADAR
technology portfolio widely used throughout
Microchip | www.microchip.com
the automotive industry. Drive360 is the
NXP Semiconductors | www.nxp.com first automotive RADAR technology based
Renesas Electronics America | www.renesas.com on advanced 28 nm CMOS and provides high
RF performance for target identification and
ST Microelectronics | www.st.com
classification. ADI’s RADAR solution enables
Texas Instruments | www.ti.com earlier detection of smaller and faster
 circuitcellar.com 39

moving objects. High output power enables informational ADAS, integrated digital
greater range and identification of smaller cockpit, digital instrument cluster, head-
objects, while its low phase noise improves up display and more. Designed for
unambiguous detection of smaller objects in automotive safety and robustness, the
the presence of large objects. Jacinto heterogeneous architecture includes
The Renesas Autonomy Platform is an hardware firewalls, allows separation
open, innovative and trusted platform for between High Level OS (HLOS) and safety OS
ADAS and automated driving, supported as well as implementation of robust multi-
by Renesas’ sustainable and scalable SoC domain software architecture capable to be
and MCU roadmaps. The RH850/V1R-M MCU ASIL-B safety certified.
was specifically designed for use in RADAR
applications as part of the sustainable and INFOTAINMENT EVOLUTION
scalable portfolio. The new MCU includes Although it may seem obvious, the
optimized programmable digital signal emergence of autonomous vehicles will
processing (DSP), a dual CPU cores each naturally boost demands for more advanced
operating at 320 megahertz (MHz) with 2 MB in-vehicle infotainment systems. Drivers will be

SPECIAL FEATURE
of flash and 2 MB internal RAM. freed up to take advantage of those systems
With feet in both worlds, Texas once being hands-off the steering wheel
Instruments for its part is a provider of becomes “normal.” The trend toward more
both embedded processing and analog ICs advanced vehicle infotainment will involve a
aimed at the automotive space. For example, variety of high-performance computing,
TI’s Jacinto family of processors provides display and connectivity technologies. But we’ll
support for a variety of automotive digital save that for a future article.
cockpit applications including infotainment,
head unit co-processing for infotainment,
 40 CIRCUIT CELLAR • FEBRUARY 2018 #331

Non-Standard SBCs Put

Function Over Form
Compact, Low-Power
Solutions
TECH SPOTLIGHT

A rich set of single board

computer products fall into
the non-standards-based
category. These SBCs
offer complete embedded
computing solutions suited
for applications were
reducing size, weight and
power are the priorities.

PHOTO 1
TS-7553-V2 is developed around the NXP i.MX6 UltraLite, an advanced implementation of a single
ARM Cortex-A7 core, which operates at speeds up to 696 MHz. The board specifically targets the
industrial Internet of Things (IIoT) sector.

By Jeff Child,
Editor-in-Chief

W hile standard form factor

embedded computers
provide a lot of value,
many applications demand
that form take priority over function. The
majority of non-standard boards tend to
volume of the board takes precedence over
the need for standards. Instead the priority
is on cramming as much functionality and
compute density onto a single board solution.
And because they tend to be literately “single
board” solutions, there’s often no need to
be extremely compact, and well suited for be compatible with multiple companion I/O
size-constrained system designs. Although boards. These non-standard boards seem
there’s little doubt that standard open- to be targeting very different applications
architecture board form factors continue to areas—areas where slot-card backplane or
thrive across numerous embedded system PC/104 stacks wouldn’t be practical.
applications, non-standard form factors free Non-standard boards come in a variety
designers from the size and cost overheads of shapes and sizes. Some follow de facto
associated with including a standard bus or industry standard sizes like 3.5 inches, while
interconnect architecture. others take a twist on existing standards—
In very small systems, often the size and such as ATX, ITX or PC/104—to produce a “one
 circuitcellar.com 41

off” implementation that takes some of the SBCs featuring eight standard models. The
benefits of a standard form factor. There are Newport Family is based upon the Cavium
also some company-specific “standard” form Octeon TX 64-bit ARMv8 SoC, which has been
factors that offer an innovative new approach. designed specifically for high performance
The focus in this article is on commercial SBCs networking applications. The Newport Family
for professional applications, not modules for of boards offers processors ranging from
hobbyist projects. an 800 MHz Dual Core up to a 1.5 GHz Quad
Core. The Octeon TX features large L1/L2
ARM-BASED BOARDS caches, rich I/O with support for the latest
In terms of sheer numbers of SBC standards (PCIe Gen 3, SATA3.0, USB 3.0,
products, Intel processor-based solutions DDR4), security and networking acceleration
tend to dominate. But in recent years, non- engines, hardware virtualization, low power

TECH SPOTLIGHT
standard SBCs based on ARM embedded (less than 4 W) and IPSec performance of 8
processors are increasing mindshare in Gbps with only 2-cores.
the industry. In a recent example of an The Newport Family of network processor
ARM-based solution, Technologic Systems boards feature up to 8 GB of DDR4 DRAM,
in December starting shipping its newest up to 64 GB eMMC flash, up to 5 GbE Copper
SBC, the TS-7553-V2 (Photo 1). The board is Ethernet ports, up to 2 SFP ports for fiber
developed around the NXP i.MX6 UltraLite, a support, microSD, SIM and USB 3.0. The board
high-performance processor family featuring also has up to 4 Mini-PCIe expansion sites
an advanced implementation of a single ARM allowing support for a variety of peripherals
Cortex-A7 core, which operates at speeds up to including Wi-Fi radios, 4G/LTE cellular
696 MHz. While able to support a wide range of modems, mSATA drives and other Mini-PCIe
embedded applications, the TS-7553-V2 was cards. Optional features include GPS w/PPS
specifically designed to target the industrial support, CAN bus and a SHA-256 crypto-
Internet of Things (IIoT) sector. strong symmetric key-based authentication
The TS-7553-V2 was designed with IC for secure deployments.
connectivity in mind. An on-board Xbee Additional standard features include
interface, capable of supporting Xbee or digital I/O, RS232/RS485 ports, USB3.0,
NimbleLink, provides a simple path to adding SPI/I 2C expansion ports, wide voltage range
a variety of wireless interfaces. An Xbee input (8 VDC to 60 VDC), 802.3af/at PoE,
radio can be used to link in with a local industrial temperature operation and the
2.4 GHz or sub 1 GHz mesh networks, allowing Gateworks System Controller (GSC). The
for gateway or node deployments. Both Digi GSC provides system health monitoring and
and NimbleLink offer cellular radios for this advanced watchdog support, including the
socket, providing cellular connectivity for ability to power up and down the board at
applications such as remote equipment programmable intervals.
monitoring and control. There is also the Board sizes range from a small GW6100 at
option for a cellular modem via a daughter 35 mm x 100 mm, up to the largest GW6400
card. This allows transmission of serial data at 140 mm x 100 mm. Power consumptions of
via TCP, UDP or SMS over the cellular network.
The TS-7553-V2 also includes an on board
WiFi b/g/n and Bluetooth 4.0 option, providing
even more connectivity.
Further radio expansion can be
accomplished with the two internal USB
interfaces—one on a standard USB Type A
connector, and the second on simple pin
headers. The USB interfaces enable support
for multiple proprietary networks via a dongle
or USB connected device. This provides
the opportunity to run mesh, LoRa, ZigBee,
automotive WiFi or other protocols with the TS-
7553-v2. All of these radio options combined
with the on board 10/100Base-T Ethernet
create the opportunity to communicate
seamlessly with up to 5 different networks
simultaneously from a single point.

FAMILY OF ARM SBCs PHOTO 2

Also leveraging ARM technology, Gateworks The Gumstix Cobalt MC single board computer shows off some of the best multimedia features of the NXP
in October unveiled its Newport Family of SCM with CSI2 camera, native HDMI, and audio, and connects over Gbit Ethernet, Wi-Fi and Bluetooth.
 42 CIRCUIT CELLAR • FEBRUARY 2018 #331

healthcare and IoT. The board connects many

of its peripheral signals and I/Os through a
1.0 mm pitch 140-pin stamp hole expansion
interface to allow customer’s extension for
their next embedded design. The module is
ready to run Linux and can support industrial
operating temperature range from -40°C to
+85 °C.
MYIR also offers a development board
MYD-Y6ULX which is built around the MYC-
Y6ULX CPU Module with a specially designed
base board. A variety of peripheral interfaces
TECH SPOTLIGHT

have been brought out to the base board

through headers and connectors including
serial ports, two USB Host, one USB OTG,
two 10/100Mbps Ethernets, CAN, Camera,
LCD, Audio, TF card as well as a Mini PCIe
interface for 4G LTE Module. The board also
has an integrated Wi-Fi Module with external
antenna to allow wireless communications.
Along with some cable accessories, the MYD-
Y6ULX is a complete evaluation platform and
reference design for development based on
PHOTO 3 i.MX 6UL/6ULL processors.
The Zybo Z7 board is built around the Xilinx Zynq-7000 FPGA family. The Zynq family tightly integrates a
dual-core ARM Cortex-A9 processor with Xilinx 7-series FPGA logic.
DESIGN-TO-ORDER SBCs
As a provider of design-to-order embedded
boards, Gumstix comes at non-standard SBCs
the Newport Family boards range from 4 W from a different perspective than traditional
for the smallest board and up to 10 W for the off-the-shelf SBC vendors. Gumstix’s latest
largest model. ARM-related focus was its announcement
MYIR Tech Limited’s latest offering likewise in October about its adding the NXP
aimed ARM technology at a compact, low- Semiconductor SCM-i.MX 6Quad/6Dual Single
power solution with its MYC-Y6ULX CPU Module Chip System Module (SCM) to the Geppetto
announced in November. Measuring only D2O design library and the Gumstix Cobalt
37 mm by 39 mm, the MYC-Y6ULX CPU Module MC (Media Center) development board (Photo
is covered with a shield and powered by an NXP 2). The NXP SCM-i.MX 6D/Q [Dual, Quad] Core
i.MX 6UltraLite / 6ULL processor based on the SCM combines the i.MX 6 quad- or dual-
ARM Cortex-A7 architecture. The board offers core applications processor, NXP MMPF0100
a choice of G2 and Y2 sub family processors power management system, integrated flash
running at 528 MHz and integrated with memory, over 100 passives and up to 2 GB
256 MB DDR3 and 256 MB NAND flash (4 GB DDR2 Package-on-Package RAM into a single-
eMMC flash is optional). Applications well chip solution.
suited to the MYC-Y6ULX include industrial Using Gumstix’s services, embedded
control, communications, HMI, smart systems developers can, in minutes, design
and order SCM-powered hardware combining
their choices of network connection,
communication bus, and hardware features.
RESOURCES
During the design process, users can compare
AAEON | www.aaeon.com
alternatives for features and costs, create
Advantech | www.advantech.com multiple projects and receive complete custom
Axiomtek | www.axiomtek.com
BSPs and free automated documentation.
Designers can go straight from a design to
COMMELL | www.commell.com an order in one session with no engineering
Diamond Systems | www.diamondsystems.com required.
The NXP SCM is equipped with a wide
Digilent | www.digilent.com
range of I/O, multimedia processing, and
Gateworks | www.gateworks.com connectivity features. Condensing it, a
feature-rich power management IC and over
Gumstix | www.gumstix.com
100 passive circuit elements into a single
MYIR Tech Limited | www.myirtech.com package, the SCM-i.MX 6Quad/6Dual greatly
Technologic Systems | www.embeddedarm.com reduces the SoC’s cumulative footprint. The
 circuitcellar.com 43

feature-rich Gumstix Cobalt MC SBC shows included on Venus meets a majority of

off some of the best multimedia features today’s embedded computing connectivity
of the NXP SCM with CSI2 camera, native requirements. The board includes six USB
HDMI and audio—and it connects over Gbit 2.0/3.0 ports, four RS-232/422/485 serial
Ethernet, Wi-Fi and Bluetooth. The Gumstix ports, sixteen digital I/O lines, two Gigabit
Cobalt MC source description is available in Ethernet ports, HDA audio, camera interface
Geppetto for any Geppetto user to copy and and TPM support. Venus supports three
modify the board to meet their specific device simultaneous independent displays consisting
requirements in minutes. of VGA, HDMI and LVDS LCD. All three displays
Coming at embedded boards from an are 4K capable.
FPGA-core perspective, Digilent’s latest ARM For additional I/O needs, the board
offering is built around Xilinx FPGA technology. includes a PCIe/104 OneBank-Plus socket

TECH SPOTLIGHT
In November Digilent announced its Zybo Z7 (PCIe/104 and PCI-104 expansion) with
board (Photo 3), a feature-rich, ready-to- support for up to 4 I/O modules. Venus also
use embedded software and development supports two Mini Card sockets. The top side
board built around the Xilinx Zynq-7000 FPGA socket supports full-size PCIe and USB Mini
family. This is the second-generation update Card along with mSATA disk modules, while
to the popular Zybo that was released in the bottom side socket supports full and half
2012. The Zynq family is based on the Xilinx size PCIe Mini Card. Mass storage options
All Programmable System-on-Chip (AP SoC) include SATA DOM, mSATA and a connector
architecture, which tightly integrates a dual- for an external SATA drive (all ports are SATA
core ARM Cortex-A9 processor with Xilinx III capable). The wide range 9 V to 18 V input
7-series FPGA logic. voltage provides additional flexibility.
The Zybo Z7 surrounds the Zynq with Venus incorporates a full suite of rugged
a rich set of multimedia and connectivity features such as soldered memory, latching
peripherals to create a formidable SBC, even connectors, and a thicker PCB, making it
before considering the flexibility and power suitable for the most demanding vehicle
added by the FPGA. The Zybo Z7’s video- applications. The 4 GB soldered memory
capable feature set includes a MIPI CSI-2 may be upgraded to as high as 20 GB using
compatible Pcam connector, HDMI input, HDMI Diamond’s unique RSODIMM rugged memory
output and high DDR3L bandwidth. Attaching modules, which are designed to withstand
additional hardware is made easy by the Zybo MIL-STD-202G shock and vibration
Z7’s Pmod connectors, allowing access to specifications. Standard DDR4 SODIMM
Digilent’s catalog of over 70 Pmod peripheral modules may also be used.
boards, including motor controllers, sensors, The bottom side heat spreader provides
displays and more. Zybo Z7 comes in two the most efficient cooling solution in a
APSoC variants: Zybo Z7-10 features Xilinx
XC7Z010-1CLG400C. Zybo Z7-20 features the
larger Xilinx XC7Z020-1CLG400C.

DEFACTO STANDARD: 3.5 INCH

Among the most popular embedded board
form factor size these days in the 3.5-inch
SBC. The 3.5 wasn’t created by any official
standards body, but it’s close to PC/104’s
dimensions. The 3.5-inch size turns out to
be just right for Intel processor based SBCs.
And if the connectivity and stackable features
of PC/104 aren’t needed, then 3.5 inch is the
right size for many applications. Diamond
Systems, a long team key player in PC/104 and
other technologies, rolled out a 3.5” SBC last
year called the VENUS SBC based on the Intel
“Skylake” 6th Generation Core i7/i5 processor
(Photo 4). Venus features DDR4 memory
soldered on board, bottom side conduction
cooling, two PCIe Mini Card sockets, in the
3.5” embedded form factor. Venus is available
in two models, the high performance 2.6 GHz PHOTO 4
i7 version (VNS766-4GD) and a lower cost Based on the Intel “Skylake” 6th Generation Core i7/i5 processor, the Venus features DDR4 memory soldered
2.4 GHz i5 model (VNS563-4GD). on board, bottom side conduction cooling, two PCIe Mini Card sockets—all in the 3.5-inch embedded form
The wide range of I/O functionality factor.
 44 CIRCUIT CELLAR • FEBRUARY 2018 #331

weight-optimized design, enabling Venus to

run reliably at up to 85°C (lower operating
limit is -40°C). Venus is the latest addition to
Diamond’s Raptor rugged computer systems
that offer MIL-DTL-38999 connectors, MIL-
STD-202G shock/vibration conformance, MIL-
STD-461 compliance and IP67 environmental
rating. These systems can be customized to
include additional I/O boards and storage
media, as well as customer-specific connector
arrangements.
TECH SPOTLIGHT

XEON-BASED SBC
Likewise embracing the 3.5-inch defacto
standard, COMMELL in October announced
its LS-37K 3.5-inch embedded mini-board
based on Intel 6th/7th generation FCLGA1151
Skylake / Kaby Lake Core processor
family and Xeon E3-1200 v5 processor
PHOTO 5 (Photo 5). The Skylake PC is claimed to deliver
The LS-37K-3D8The LS-37K desktop 3.5-inch mini-board platform that supports DDR4 memory DIMM 30% better performance than a PC base on Ivy
1866/2133 MHz up to 16 GB. The board is based on Intel HD530 (Skylake) HD630, (Kaby Lake) and HD P530 Bridge architecture, 20% better performance
(Xeon E3-1200v5). than a PC based on Haswell, and 10% better
performance than a Broadwell PC.
LS-37K-3D8The LS-37K desktop 3.5-inch
mini-board platform supports DDR4 memory
DIMM 1866/2133 MHz up to 16 GB. The
platform is based on Intel HD530 (Skylake)
HD630, (Kaby Lake) and HD P530 (Xeon E3-
1200v5). For graphics, the Skylake GPU offers
24 execution units (EUs) clocked at up to
1150Mhz (depending on the CPU model). The
revised video engine now decodes H.265/HEVC
completely in hardware and thereby much
more efficiently than before, and HD Graphics
630 GPU is largely identical to the 530 found
in Skylake. The only real upgrade here is the
HEVC and VP9 support. LS-37K Displays can
be connected via 1 VGA, 1 LVDS, 1 DVI, 1 HDMI
and one DP port, up to three displays can be
controlled simultaneously.
LS-37K offers lots of features including
high-speed data transfer interfaces such as
4 x USB 3.0 and 2 x SATA III, equipped with
dual Gigabit Ethernet (One of the dual LAN
with iAMT 11.0 supported), and comes with
PS/2 port, 5 x RS232 and 1 x RS232/422/485,
4 x USB 2.0, Intel High Definition Audio, and
1 Mini PCIe socket (supporting mSATA) and
9 VDC to 30 VDC input.
Axiomtek’s offering is the CAPA312, a
fanless 3.5-inch embedded motherboard,
powered by the Intel Pentium processor
N4200 or Celeron processor N3350. This 3.5-
inch embedded board is a performance-driven
solution for IoT/M2M related applications,
such as industrial automation, self-service
terminals, digital signage, POS/kiosk displays,
medical and more. It offers a wide operating
PHOTO 6
temperature range from -20°C to +60°C (or
The GENE-SKU6 W1 is a 3.5-inch subcompact board designed to handle harsh, unstable conditions. This
optionally up to +70°C) and comes with rich
includes has a DC input range of 9 VDC to 36 VDC that enables it to take power drops and spikes in its stride
and continue operating.
I/O connectors, various display interfaces and
 circuitcellar.com 45

two PCI Express Mini Card slots for a wide

array of industrial applications.
For memory the board provides a
DDR3L-1867 SO-DIMM, up to 8 GB. The boards
rich set of I/O includes two USB 2.0 and four
USB 3.0 ports, four PCI Express Mini Card
slots and two Gbit Ethernet ports supporting
Wake-on-LAN. The board’s operating
temperature ranges from -20°C to +60°C
(-4°F to +140°F)—or with additional option up
to +70°C (+158°F).

TECH SPOTLIGHT
DESIGNED FOR HARSH
ENVIRONMENTS
Not all applications are equal when it
comes to their environmental requirements.
And several non-standard SBCs take special
care in their designs to enable them to operate
in harsh environments. Along those lines,
in December AAEON has launched its GENE-
SKU6 W1, a 3.5-inch subcompact board with
the specifications needed to handle harsh,
unstable conditions (Photo 6). When hardware
is used for outdoor, factory automation, or in-
PHOTO 7
vehicle applications, you can’t always be sure
The MIO-5350 is a 3.5-inch fanless SBC that supports the latest Intel Pentium N4200/ Celeron N3350/ Atom
that its DC input will remain stable. Because E3900 series low power consumption processors with a TDP of only 6 W to 12 W.
businesses can’t afford for their systems to
shut down, they need computers that can
withstand power fluctuations and keep on
running. With that in mind, the GENE-SKU6
W1 has a DC input range of 9 VDC to 36 VDC,
so it takes power drops and spikes in its stride
and continues operating.
This rugged subcompact board also PaaS/RMM—a cloud ready solution for remote
has a WiTAS 1 wide-temperature rating, device management that brings the benefits
meaning it’s guaranteed to run smoothly in of cloud computing within the reach of many
environments as cold as -20°C and as hot embedded application developers.
as 70°C. This capability is achieved through MIO-5350 is designed to fulfill a variety
intelligent design, low-power components and of vertical application needs. It adopts a rich
an effective heatsink. Those design features array of I/O interface including: dual LAN ports,
enable the GENE-SKU6 W1 to function as 2 x USB3.0, 4 x USB2.0, 4 x COM ports, and 2
a reliable, fanless solution. The board’s x SATAIII. For expansion, MIO-5350 supports
features include support for 4K resolution 1 x M.2 (key-E), 1 x full-size MiniPCIe (mSATA),
and independent DP, DVI, and LVDS display and MI/O Extension (MIOe). These allow various
outputs. It has Mini-card and mSATA slots, peripherals modules like WiFi, 3G/LTE, storage,
four USB 3.0 and two USB 2.0 ports, four COM and I/O expansion (EXM and MIOe) to expand
ports and an additional BIO interface enabling functionality. MIO-5350 can operate under wide
board-to-board connection. temperature settings ranging from -40 °C to
Meanwhile, Advantech latest play in the 85 °C, making it well suited ideal solution for
3.5-inch SBC arena is its MIO-5350. Released use in rugged and harsh environments such
in October, the MIO-5350 is a 3.5” fanless SBC as factory automation, railways and outdoor
that supports the latest Intel Pentium N4200/ signage and kiosks.
Celeron N3350/ Atom E3900 series low power While non-standard SBCs aren’t expected
consumption processors with a TDP of only to really encroach too much into the market
6 W to 12 W (Photo 7). MIO-5350 provides share of standards-based form factor
40% CPU performance enhancement and 46% solutions, they do have a bright future. The
graphic performance boosts compared with direction of semiconductor integration is
previous generations. It offers 4K2K graphics always leading to an ability to fit more
and three simultaneous displays through electronics on a smaller board. That means
HDMI/DP, LVDS/eDP, and VGA interfaces. that non-standard SBCs will trend toward
MIO-5350 comes bundled with Advantech’s ever higher compute-densities while pushing
exclusive iManager APIs, utilities and WISE- down the power dissipation curve.
 46 CIRCUIT CELLAR • FEBRUARY 2018 #331

Product Focus:
MCU Development Tools
Connectivity Expands

Today’s crop of microcontroller development platforms provide a rich set

PRODUCT FOCUS

of resources for embedded system developers. Wireless connectivity and

power design support are the latest trends for these solutions.

Photo 1
Because NXP’s Kinetis KW41Z wireless MCU supports multiple connectivity protocols, it was
possible to build an IoT-driven aquarium ecosystem. This enabled aquarium enthusiasts to
By Jeff Child, quickly and easily create a connected system of aquarium lights and pumps, and control it
all from anywhere with just a smartphone.
Editor-in-Chief

A s microcontrollers get ever more

powerful, adding new levels of
functionality, so too are the development
tools for those MCUs. Today’s crop of
MCU development tool packages provide advanced
software tools, rich design examples and complete
example. Certainly automotive, industrial
systems, smart city, smart home, wearable
devices and medical gear are among the
leading MCU application areas.
Exemplifying the diverse types of MCU uses,
C2 Development made use of NXP’s Multi-
development board resources. The two most obvious Protocol Kinetis KW41Z Wireless MCU to help
trends MCU development platforms over the past simply its simplify its aquarium systems control
year have been wireless connectivity and power application. The technology made it easy
system design. for C2 Development to simplify connecting,
Driven primarily by the fast-growing configuring and controlling aquarium lighting
Internet of Things (IoT) phenomenon, today’s and pumps. The design challenge for the C2
new generation of MCUs includes many Development engineers was to reduce the
product offerings that have on-chip wireless cost and complexity of creating an aquarium
connectivity. As a result, many of their ecosystem that connects AquaIllumination
associated development kits feature boards systems with each other—and with EcoTech
with antennas and RF transceivers to support Marine’s pumps. Because NXP’s Kinetis KW41Z
the development of connected IoT devices. wireless MCU supports multiple connectivity
Some even feature cloud-connectivity support protocols, it provided C2 Development with a
in their offerings. flexible, cost-efficient foundation for an IoT-
On the power design side, some MCU driven aquarium ecosystem (Photo 1). This
development kits have gone heavy in the enabled aquarium enthusiasts to quickly and
direction of including analog devices like easily create a connected system of aquarium
MOSFETs, line drivers and buck converters lights and pumps, and control it all from
on their boards. These enable MCU system anywhere with just a smartphone.
developers to measure transient responses There are a variety of MCU development
and the quality of the control loops under tools are represented in the product gallery
different load conditions. displayed on the next couple of pages. Naturally
Because MCUs are used in such diverse chip vendors have many development kit
applications and industries, it’s hard to solutions, so these are representative products
generalize or pick a truly representative design from each vendor.
 circuitcellar.com 47

PRODUCT FOCUS
Platform Supports ADI’s MCUs Tools for Cypress Semi’s PSoC Kit Enables XMC MCU Digital
and RF Transceivers BLE 6 MCU Power Development

The EV-COG-AD4050 is a development Cypress Semiconductor’s PSoC Infineon Technologies’ XMC digital
platform for Analog Devices’ Ultra Low BLE Pioneer Kit features a PSoC 63 power explorer kit uses Infineon’s
Power technology across ADI’s MCU MCU with Bluetooth Low Energy XMC range of ARM Cortex-M
and RF transceiver portfolio. The board (BLE) connectivity. The kit enables microcontrollers, OptiMOS BSC0924NDI
uses CrossCore Embedded Studio, an development of modern touch and MOSFETs and IRS2011S high and low
open source Eclipse based Interactive gesture-based interfaces that are side drivers. The kit’s power board
Development Environment (IDE), which robust and reliable with a linear slider, features synchronous buck converter
can be downloaded free of charge. touch buttons and proximity sensors with on-board resistive load banks. The
The platform contains many hardware based on the latest generation of load banks can be switched between
and software example projects for Cypress’ CapSense capacitive-sensing 10%, 55% and 100% of the maximum
customers to prototype and create technology. load, so that the transient response and
solutions for IoT applications. the quality of the control loop under
• Single- or dual-core PSoC 6 MCU, different load conditions can be tested.
• On-board ultra-low power ARM with an ARM Cortex-M4 and ARM
Cortex M4F MCU Cortex-M0+ core, 1 MB of Flash, • Two control card options: XMC1300
• No external debugger/emulator tools 288 KB of SRAM, 78 GPIO, 7 control card (ARM Cortex-M0) and
required programmable analog blocks, 56 XMC4200 control card (ARM Cortex-
• Small form factor (75 mm X 35mm) programmable digital blocks and M4F
• Multiple power options: USB, Bluetooth Low Energy (BLE) • Synchronous buck converter
Coincell, External and Li-Ion • 2.7” E-ink display shield board • 2 different control card options:
• Onboard peripherals: accelerometer, • Cypress EZ-PD CCG3 power delivery XMC1300 and XMC4200
temperature sensor system • High resolution PWM (150 ps) and
• Compatible with ADI RF daughter • For CapSense, baseboard comes smart analog comparators on
cards, and RF modules with 2 buttons, a 5-segment slider XMC4200
• Compatible with ADI application and a proximity sensor. • On board resistive load
add-on boards (gears) • On-board antenna to develop BLE • PMBus communication option
• Expansion connectors and jumpers designs. • Easy entry into digital power control
for providing external access to all • Software, documentation, design • Voltage mode control and peak
MCU signals and create solutions for files, and code examples current mode control (with slope
IoT applications. compensation) available
Cypress Semiconductor • Full software support
Analog Devices www.cypress.com
www.analog.com Infineon Technologies
www.infineon.com
 48
PRODUCT FOCUS CIRCUIT CELLAR • FEBRUARY 2018 #331

MAX32625 Development Eval Kit Facilitates Development Platform Supports NXP Kinetis
Platform is mbed Enabled for SAM D5x/E5x MCUs W Series MCUs with Bluetooth
The MAX32625MBED development Microchip Technology’s SAM E54 The FRDM-KW40Z from NXP
platform from Maxim Integrated Xplained Pro Evaluation Kit is available Semiconductors is a low-cost
provides a convenient platform for to kick-start development. The kit development platform enabled by
evaluating the capabilities of the incorporates an on-board debugger, the Kinetis W series KW40Z/30Z/20Z
MAX32625 microcontroller. The as well as additional peripherals, to (KW40Z) family built on the Arm
MAX32625MBED also provides a further ease the design process. All Cortex-M0+ processor featuring
complete, functional system ideal SAM D5x/E5x MCUs are supported an integrated 2.4 GHz transceiver
for developing and debugging by the Atmel Studio 7 Integrated supporting Bluetooth Smart/Bluetooth
applications. The MAX32625MBED Development Environment (IDE) as well Low Energy (BLE) v4.1 and/or IEEE
includes a MAX32625 ARM Cortex-M4 as Atmel START, a free online tool to 802.15.4-2011 standards.
microcontroller with FPU, prototyping configure peripherals and software that
area with adjacent access to precision accelerates development. • Supports MKW24D512 Kinetis MCUs
analog front end (AFE) connections, (up to 50 MHz Corte-M4 MCU, 512
I/O access through Arduino-compatible • ATSAME54P20A microcontroller KB Flash)
connectors, additional I/O access • Embedded debugger with USB • Full IEEE 802.15.4 compliant
through 100 mil x 100 mil headers, USB interface. wireless node
interface and other general-purpose • Digital I/O: Two mechanical buttons Software support: Thread, ZigBee Pro,
I/O devices. (user and reset button); One Atmel 802.15.4 MAC and SMAC and Kinetis
QTouch button. One yellow user LED; Software Development Kit (SDK)
• Arduino-compatible headers Three Xplained Pro extension headers. • Reference design area with small
and mbed support enable rapid • 256 Mb of QSPI Flash footprint, low-cost RF node
prototyping of low-power embedded • ATECC508 CryptoAuthentication device • Integrated PCB inverted F-type
systems • AT24MAC402 serial EEPROM with antenna and SMA RF port
• MAX32625 96 MHz ARM Cortex-M4 EUI-48 MAC address • Selectable power sources
microcontroller • Ethernet: 10Base-T/100Base-TX; • 32 MHz reference oscillator; 32 kHz
• Expansion connections: Arduino SD/SDIO card connector; Parallel clock oscillator; 2.4 GHz frequency
form-factor headers; MicroSD Card Capture Controller header and operation (ISM Band)
connector; Micro-USB connectors; ATA6561 CAN transceiver • OpenSDA debug interface
prototyping area • Debug connectors: 10-pin Cortex • Combo sensor, 6-axis sensor with
• Integrated peripherals: 4x user Debug Connector with SWD; 20-pin integrated linear accelerometer and
indicator LED; 2x user pushbutton Cortex Debug + ETM Connector with magnetometer
• Integrated DAPLink programming 4-bit trace
adapter • Supported with application NXP Semiconductors
examples in Atmel START www.nxp.com
Maxim Integrated
www.maximintegrated.com Microchip Technology
www.microchip.com
 circuitcellar.com 49

PRODUCT FOCUS
Wi-Fi Cloud Connectivity Kit Development Platform Covers MCU Platform Enables IoT
Supports RX65N MCU Whole STM32 MCU Line Application Development
Renesas Electronics’ RX65N Wi- STMCube from STMicroelectronics The SimpleLink MCU platform from
Fi Cloud Connectivity Kit provides an is the implementation of STMCube that Texas Instruments is a single development
easy-to-use platform for connecting covers the whole STM32 MCU portfolio. environment that delivers flexible
to the cloud, evaluating IoT solutions The package includes STM32CubeMX, a hardware, software and tool options for
and creating IoT applications through graphical software configuration tool that developers crafting IoT applications. With
cloud services and real-time workflows. allows the generation of C initialization a single software architecture, modular
The RX65N Wi-Fi Cloud Connectivity code using graphical wizards. It also development kits and free software tools
Kit integrates the high-performance comprises the STM32CubeH7 MCU for every point in the design life cycle,
Renesas RX65N microcontroller (MCU) Package composed of the STM32Cube the SimpleLink MCU ecosystem allows
and Medium One’s Smart Proximity hardware abstraction layer (HAL), plus a 100% code reuse across the portfolio of
demo with the data intelligence consistent set of middleware components MCUs, which supports a wide range of
featured in Renesas IoT Sandbox. (RTOS, USB, FAT file system, Graphics, connectivity standards and technologies
TCP/IP and Ethernet). All embedded including RS-485, Bluetooth low energy,
• 120 MHz RX65N MCU board software utilities are delivered with Wi-Fi, Sub-1 GHz, 6LoWPAN, Ethernet,
• GT202 Wi-Fi module with Qualcomm a full set of examples running on RF4CE and proprietary radio frequencies.
QCA4002 low-energy 801.11a/b/g/n STMicroelectronics boards. SimpleLink MCUs help engineers easily
SoC develop and seamlessly reuse resources
• Maxbotix ultrasonic range finder • Complete embedded software to expand their portfolio of connected
• USB to UART interface (with cable) package that frees the user from products.
• 4 Pmod connectors dependency issues
• Arduino shield socket • Maximized portability between • 100% code compatibility across
• E1/E2 Lite/J-Link header for external all STM32 Series supported by SimpleLink MCU portfolio
J-Link support STM32Cube • TI Drivers offers standardized set
• USB Type B connector (with cable) • Hundreds of examples for easy of functional APIs for integrated
• 5 VDC Power Jack understanding peripherals
• High quality HAL using CodeSonar • Integrated TI-RTOS, a robust,
Renesas Electronics static analysis tool intelligent kernel for complete, out-
www.renesas.com • STM32H7-dedicated middleware of-the-box development
including USB Host and Device, • POSIX-compatible APIs offer flexible
TCP/IP and Ethernet OS/kernels support
• Free user-friendly license terms • Encryption-enabled security
• Update mechanism that can be features
enabled by the user to be notified of • IoT stacks and plugins to add
new releases functionality to IoT designs

ST Microelectronics Texas Instruments

www.st.com www.ti.com
 50 CIRCUIT CELLAR • FEBRUARY 2018 #331

Embedded in Thin Slices

Internet of Things Security (Part 1)

Command Injection

In the first part of his new article series on IoT security, Bob
examines command injection. Command injection is a type of
attack that involves injecting and executing an unwanted shell
command or operating system command into your IoT system.
COLUMNS

By
Bob Japenga

F or more than 40 years I used old

mercury switch thermostats in my
homes. My argument was that they
were reliable and did everything I
needed. Then about 25 years ago, I upgraded
to a digital 7-day programmable thermostat.
and put in smart a Wi-Fi-enabled thermostat.
Guess what? The heating (and cooling) in my
home is now more stable than it was with my
cheap and very old digital thermostat. And the
anticipator algorithm is far more sophisticated
than the little variable resister in the mercury
It was great to be able to set different switch thermostat. But that’s not what we are
temperatures for night and day and for when talking about this month. What interested me
we were away. But I noticed that the house about this new thermostat was the End User
was not as comfortable as it was with the License Agreement (EULA) that I signed up to
old mercury switch thermostat (Photo 1). It with this thermostat. Among other things, I
would cycle from slightly cool to slightly warm agreed to the following:
during the coldest months of the year.
My best friend and business partner told Not to collect information from the
me that there were two problems with the thermostat using an automated software tool
new thermostat. First it had only 1 degree
of resolution. When the house reached 68°F, Not to capture the data stream to or from
the heat would go off. When it reached 67°F the thermostat (we call this sniffing)
the heat would come back on. A simple bang-
bang controller. The second problem was That got me thinking. What about the
that the control would often overshoot and systems that we design? Would I want to
the temperature would actually go to 69°F. prevent my users from doing this? This is
My old mercury switch thermostat had a exactly what hackers do maliciously. But
really neat feature called a heat anticipator many others are out trying to make a name
that prevented this (see sidebar “How the for themselves and demonstrate holes in the
Anticipator Works”). I never knew these security of devices. They show the world how
simple looking devices had this feature. clever they are and how “stupid” we are. But
As often happens in first- and second- in the process, they do us a great service.
generation electronics, my inexpensive digital They expose our faults. Typically, the good
thermostat didn’t work as well as the even ones report the problem to us and we solve it
cheaper electro-mechanical mercury switch. before it is hacked maliciously.
But I was so I cheap I kept it for 25 years. This Just recently, one of our designs was
month, I decided to enter the 21st century hacked into by a very smart researcher. He
 circuitcellar.com 51

first contacted our customer’s customer FIGURE 1

support but did not get a satisfactory The ICS-CERT coordinates control
systems-related security incidents
response. Customer support didn’t know how
and information sharing with
to handle this. We, the designers, were never
Federal, State, and local agencies
contacted. The result was that he wrote us and organizations, the intelligence
up in the Industrial Control Systems Cyber community, and private sector
Emergency Response Team (ICS-CERT) data constituents, including vendors,
base (Figure 1) for all the world to know owners and operators and
about our “stupidity.” Each vulnerability gets a international and private sector CERTs.
score and our score was very high. “Very high”
is not good—it means that the vulnerability is
a real serious threat to life on the planet (not
really). He did find the security hole by using
automated software tools and sniffing our data
stream to and from the unit. If our EULA would Weakness Enumeration Database referenced
have had the words from the thermostat’s in my article “The Internet of Things (Part 7):
EULA and he was honest, he would not have DoS Attacks with a Twist “ (Circuit Cellar 311,
done this. Hacker’s will not pay attention to June 2016) command injection is identified as:
EULAs, but serious researchers will. “CWE-77: Improper Neutralization of Special
Elements used in a Command.” Basically, a
WHAT HAPPENED command injection vulnerability means that
At the time of the attack, when new external to your IoT device, a shell command
software was sent down from the host, it was or operating system command can be executed
signed (preventing someone from sending that is not intended.
unauthorized software to our system) but it

COLUMNS
was not encrypted. This enabled any hacker COMMAND INJECTION EXAMPLE
to get access to the PHP code that handled Our security breach didn’t happen over
the HTTP interface. With code in hand, anyone Internet traffic. It happened through use of
could find an obvious and gaping security an installer accessible configuration screen
hole where we were taking input from the from an Ethernet port. When the configuration
HTTP interface and passing it to the Linux screen saved the settings, it created a URL
command line interpreter. We did not limit with all of the settings as parameters. These
or bound the input in any way. This enabled were sent to an XML parser. These parameters
the user to spoof the host and basically send were visible to someone sniffing the local
whatever commands he wished to the Linux communication which could then be modified
shell. He could create new user accounts. He to include any Linux command to be executed.
could read our symmetric keys. Ouch! The code snippet is shown in Listing 1.
This is a technique called “command cmdxmlin is an app that we wrote that
injection” which is a subset of “code injection.” parses xml input. Notice that we didn’t call
How did this happen? We know better. We the PHP shell_exec directly. A sophisticated
know what command injection is. We know hacker could still simulate the web browser
the dangers of command injection. We know and append his own commands by utilizing a
how to stop it and even exploit it. In my feature of the shell command called sequential
article “ The Internet of Things (Part 5): IoT execution. Or the hacker could take advantage
Security” (Circuit Cellar 307, February 2016) of many of the flexible features of the bash
I discussed how we used extremely clever shell to perform all sorts of nefarious attacks.
command injection to update some devices
remotely that were destined for RMAs. How
could this happen? Simple. Our systems if ($_GET[‘submit’])// when saving config
are more complex that we are capable of {
perfectly protecting. But that doesn’t mean $keys = array_keys($_POST); // get all the parameters
we don’t keep pushing for perfection. With $config_string = ‘’;
that in mind, let’s look a little more in depth foreach ($keys as $key)
at command injection. { // Fill config_string with the parameters on the URL
In my article “The Internet of Things (Part $config_string .= “\”$key=$_POST[$key]\” “;
8): Security for Web-Enabled Devices” (Circuit $response = `/apps/cmdxmlin set ${config_string}`;
Cellar 313, August 2016) I talked about code }
injection specifically with SQL which provided }
a simple mechanization for injecting unwanted
code into the system. Our failure made it even
easier to inject commands. Command Injection LISTING 1
is a subset of Code Injection. In the Common Code snippet that captures configuration settings.
 52 CIRCUIT CELLAR • FEBRUARY 2018 #331

When I first introduced the topic of IoT should be limited, but most are not. If your
For detailed article security in this magazine, I described it as web server doesn’t support this, then some
references and additional defending a castle where there are many sort of watchdog that monitors certain critical
resources go to: layers of protection including the moat; the files would be helpful.
www.circuitcellar.com/ bridge, the entrance gate, the wall and even Bound all input: Input from the web should
article-materials the boiling oil. I recommended that you use be limited to be valid only within the narrow
as many layers of protection as possible to range of what you expect. We must recognize
mitigate risks. Our security gap could have our inherent blind spots in this area. It is hard
been closed or mitigated through a number of for us to think of all of the possible ranges of
layers as listed here: input. I love the first example from the classic
“The Art of Software Testing” by Glenford
Encrypting all program updates: Without Myers called a “Self-Assessment Test.” In it,
being able to read the code, many forms of code he asks you to create a set of test cases for
and command injection security breaches can the following simple program:
be avoided or at least be physically impossible
to find by trial and error. A lot of web services The program reads three integer values from
code is interpreted rather than compiled. That an input dialog. The three values represent the
means the source code is sent down during an lengths of the sides of a triangle. The program
update. Sending your code down unencrypted displays a message that states whether the
is just asking for trouble. triangle is scalene, isosceles or equilateral.
Don’t provide root access to the web
interface: When we released our first IoT Put down this article and try this now.
device, one of our customer’s customers Write out every distinct test case you can
asked us if our applications ran as root. They think of. You will have to buy the book to see
did because we didn’t know better. They how many you got right. Or email me your
COLUMNS

refused to buy the product until we changed test cases and I will grade it. At the end of
all of our application code to run as non-root. the article are three of the fourteen that I
What would have been easy at the start of missed completely. This self-assessment test
the design was difficult after the design was demonstrates how difficult it is to plan for
complete. Without root access, the hacker every possible input.
could not have done much damage even with Never treat data from the web as a
the command injection security hole. command to the shell: Our engineer assigned
Limit write access to all critical files: This to this described his fix as following:
is similar to limiting root access. A careful
look at your permissions to your files is in We closed the hole by writing the “save
order. The web server app should not be configuration” data to a temporary file,
able to write any file without some sort of rather than passing them to the command
authentication. Ideally the web server itself line interpreter. The ‘cmdxmlin’ program

How the Anticipator Works

Before computers, electro-mechanical temperature controls
used to have some pretty cool features. In today’s era of very
cheap processing, we sometimes miss these kinds of solutions to
the problems we face. Mercury switch thermostats have a coil that
expands and contracts based on the temperature and rotates the
mercury switch which turns on or off the furnace. In addition, there
is a resistor in the thermostat through which the current flows
that drives the relay that controls the furnace. When the furnace is
running, current flows through the resistor. As the resistor warms
up, because it is close to the thermostat coil, it warms up the coil
(above the ambient temperature). That uncoils the spring and tilts
the mercury switch to shut off the furnace before the ambient
temperature reaches the setpoint thus preventing overshoot. The
resistor is adjustable and if not set right can early or late shut off.

PHOTO 1
Mercury switch thermostats had an electro-mechanical feature called a heat
anticipator that worked very efficiently.
 circuitcellar.com 53

that used to take the configuration data as make a name for themselves at our expense. It
command line parameters now reads the is really to our benefit.
configuration data from /tmp/set_args.txt.
This way the configuration items are treated CONCLUSION
as data and not evaluated by the command When you handle things in thin slices,
line interpreter. there is so much to say and so little space to
say it. IoT security is absolutely vital. We
Study every use of calls to the command need to get this as right as possible. And we
line interpreter (shell): Be very careful with need each other’s help. Software terrorism
the passthrough exec system in PHP, the has just begun. In my opinion we’ll only see
subprocess or os.system in Python, the it increase. Next time, more lessons learned
system in Ruby…and you get the idea. in IoT security.
Push hard to close vulnerabilities: We
knew about this security hole in 2012. It
was exposed in 2015 and embarrassed the
customer in 2016. The customer closed the ABOUT THE AUTHOR
vulnerability as soon as it was reported. We
Bob Japenga has been designing embedded
didn’t push hard enough to get this changed
systems since 1973. In 1988, along with his
as soon as we knew about it. We as developers
need to be more insistent about closing best friend, he started MicroTools, which
security holes. specializes in creating a variety of real-
An open EULA: We have come full circle from time embedded systems. MicroTools has a
our introduction. I would challenge our users to combined embedded systems experience
find our security holes. Let them use automated base of more than 200 years. They love
tools to find our holes. Let them sniff our data. to tackle impossible problems together.

COLUMNS
Then the EULA would ask them to report it to us Bob has been awarded 11 patents in many
before reporting it to a government watchdog areas of embedded systems and motion
agency. As I said earlier, the systems are more control. You can reach him at rjapenga@
complex than we are capable of protecting. We microtoolsinc.com.
need others help—especially those that want to

Verilog HDL
With the right tools
designing a microprocessor
can be easy.
Okay, maybe not easy, but certainly
less complicated. Monte Dalrymple
has taken his years of experience
designing embedded architecture and
microprocessors and compiled his
knowledge into one comprehensive guide
to processor design in the real world.

Monte demonstrates how Verilog

hardware description language (HDL)
enables you to depict, simulate, and
synthesize an electronic design so
you can reduce your workload and
increase productivity.

cc-webshop.com
 54 CIRCUIT CELLAR • FEBRUARY 2018 #331

The Consummate Engineer

Modulation Fundamentals

Modulation and demodulation are key techniques through

COLUMNS

which digital systems communicate with the analog

world. In this article, George looks at various modulation/
demodulation methods and discusses the advantages and
disadvantages of each.

By
George Novacek

M any systems must communicate

with the outside world. Often
their information-bearing
signal can be carried by wires,
but this may not always be practical or
even possible. Fortunately, the information-
to implement and simple to demodulate.
Figure 1 shows an idealized frequency
spectrum of an AM carrier. In North America,
the highest AM radio program frequency
is 5 kHz and should the carrier frequency
be 1 MHz, the required bandwidth will be
bearing signal can be altered—modulated— 995 kHz to 1005 kHz—10-kHz in total.
into another signal that is suitable for Therefore, broadcast AM station carriers are
communication via radio, fiber optics, long spaced by 10-kHz to avoid interference within
cable and so forth. We call the original the AM radio operating band of 525 kHz to
information the baseband and the modulated 1,705 kHz. The latest AM broadcast modulation
signal the carrier. Demodulation is a reverse can carry additional information such as
process for retrieval of the baseband from the stereo, but AM is rather inefficient in terms of
carrier. its power and bandwidth requirements. It is
In telephony, for example, every voice also subject to noise and interference.
channel modulates a sub-carrier. The sub- The interference could be reduced by
carriers are combined to modulate higher increasing the transmitting power, but there
frequency carriers and those once again may are practical as well as regulatory limits. The
modulate an even higher carrier that may be power inefficiency is caused by the carrier,
transmitted over fiber optics or microwave which consumes most of the power and
links. Consequently, much information— contains no information. And the bandwidth—
voice and data—can be carried by a single because it contains two mirror basebands—
transmission medium. requires double the maximum modulation
The oldest modulation technique is the frequency. Several methods have been
amplitude modulation (AM). It is simple implemented to reduce these inefficiencies.
 circuitcellar.com 55

The first method is the reduction of the

carrier amplitude—reducing it down to, in
some systems, its full suppression. Because
the carrier is needed for demodulation,
it can be restored or regenerated by the
receiver. The second method involves the
sidebands. Because both sidebands carry
identical information, one of them can also
be suppressed, cutting the bandwidth by FIGURE 1
half. These modulation techniques are called: Frequency spectrum of an AM modulated signal (not to scale)
reduced or suppressed carrier with double
sidebands (DSB) and a single sideband with
suppressed carrier (SSB). Vestigial sideband
modulation (VSB) is similar to SSB but requires
a)
greater bandwidth. It is used primarily in
TV transmission. The on-off keying (OOK) is
popular for simple data transmission, in key
fobs and remote control.

OOK MODULATION
OOK modulation results when the
baseband is a rectangular wave, such as
digital data. In many applications the OOK
modulation index is 100%—such as when
the carrier is fully on or off. In the days of

COLUMNS
Morse code communications, the continuous
wave (CW) transmission mode was a typical
OOK modulation. Some applications—
b)
namely the WWVB transmission for clock
synchronization—use 86% modulation index to
prevent receivers from losing synchronization
during transmission of logical 0s.
Three characteristics define the AM
modulation: the carrier frequency, the
bandwidth and the modulation index. Figure 2a
shows 100% and Figure 2b 50% modulation
index (depth). Amplitude modulators come
in many different configurations and are
quite simple to build. One of the early
implementations was the bridge modulator
shown in Figure 3. Figure 4 shows the WWVB,
86% depth modulator I built for my 60-kHz
carrier transmitter in the WWVB repeater. FIGURE 2
This was covered in my article “WWVB Clock In the top graph (a) a 100% modulation index is shown. The bottom one (b) shows a 50% modulation index.
Revisited” (Circuit Cellar 288, July 2014). In
this circuit the MOSFET Q1 operates in its
resistive region to modulate the gain of the
carrier amplifier U1A. 

Demodulation of the broadcast AM signal is
commonly performed by envelope detectors, +


+
which can be nothing more than a simple
rectifier diode followed by an RC network. The   .

time constant of this network must be much


larger than the carrier frequency period and
much smaller than the shortest baseband

period (the highest baseband frequency). FIGURE 3
Bridge AM modulator
This is generally not a problem in practical
systems.
Demodulation of DSB and SSB are more
complicated because the carrier needs to
be restored. A suppressed carrier can be For detailed article references and additional resources go to:
easily recovered by amplification. The fully www.circuitcellar.com/article-materials
 56 CIRCUIT CELLAR • FEBRUARY 2018 #331

suppressed carrier is regenerated by a stable

"
 

1
-


local oscillator as we can see in ham radio

2 
+
receivers. Another method for modulating
,
'
a carrier is by changing its frequency or
phase. Such modulation techniques can be
,
seen in four basic configurations: Frequency
,
modulation (FM) also used for commercial
broadcast, phase modulation (PM), frequency


shift keying (FSK) and phase shift keying
(PSK). Figure 5 shows the FM carrier in
.

frequency domain.


FM AND PM MODULATION
Similar to the AM, the main characteristics
FIGURE 4 of the FM and the PM modulation are the
Simplified diagram of the WWVB modulator carrier frequency, the required bandwidth
and the modulation index. The modulation
index is the frequency or phase deviation
of the carrier in response to the modulation
signal. PM is similar to the FM except that
instead of changing the carrier frequency,
which remains constant, only its phase is
modulated. In the time domain analysis, both
FM and PM look the same, just the deviation
COLUMNS

magnitudes are different. The FSK and the

PSK modulations are used for transmission of
logical data, because the frequency and the
  &0
phase change in discrete steps.
FM carriers often contain
/ multiple sub-
% !& '
carriers for additional information. Figure 6
shows the baseband
*)  spectrum of a typical FM
broadcast station. The stereo information is
modulated on a 38-kHz subcarrier generated
 
! 
"# 
$% !& '( )#*) 

$ from the 19-kHz pilot. Several other
information bands, originally designed for
FIGURE 5 quadraphonic music, can be transmitted on
Frequency modulated carrier additional subcarriers.
There are many ways to perform FM, PM,
FSK and PSK modulation of a carrier signal.
One of the original approaches was to utilize
varactor diodes (diodes whose capacitance
can be varied by voltage) in the carrier
generator. Nowadays many modulators use a
phase locked loop (PLL), which can include a
reference crystal oscillator to guarantee high
stability of the carrier (Figure 7).
PLLs are available as integrated circuits
and only a few external components need to be
added. A PLL is in fact an electronic feedback
servo system. A stable crystal-generated
carrier frequency is fed into the phase detector
which compares the frequency of the voltage
controlled oscillator (VCO) with the reference.
Because of the (optional) divider, the carrier
frequency may be a multiple of the reference.
The error signal from the phase detector to
adjusts the VCO frequency is modulated by
the baseband, causing the carrier frequency
or phase to deviate accordingly.
FIGURE 6 Quadrature amplitude modulation (QAM)
Multiple modulation of an FM broadcast carrier is a sophisticated modulation known by many
 circuitcellar.com 57

readers as the heart of the old “high-speed”

56k telephone modems. It is a combination
of AM and PM. Given the limited bandwidth
of the old analog telephone channels, QAM
pushed its information carrying ability almost
up to the theoretical limit.

ADVANTAGES FOR EACH

Each modulation technique has its
advantages, disadvantages and applications.
AM has been used in radio broadcasting
since the birth of radio. Its modulation
and demodulation are easy to implement
and the receivers are rather inexpensive
to build. DSB is used in instrumentation
systems utilizing carrier amplifiers and
modulating sensors, while SSB finds its
use in certain radio communications,
FIGURE 7
many by ham amateurs. Its derivative VSB
Principle of phase and/or frequency modulation by PLL
modulates television signals. FM provides
much better audio quality than the AM and,
therefore, is used in broadcasting (radio
and television audio). Its narrow bandwidth
version and PM rule point-to-point mobile
communications. FSK and PSK are employed

COLUMNS
for digital communications, while the
analog QAM carries the chrominance (color)
information in television broadcasting and
the OOK is commonly found in remote
control systems, key fobs and some digital
data transmitters.
For completeness we should mention
two special modulations: frequency hopping
and spread spectrum modulation. These
modulations do not carry information per
se. The former is intended to increase
communications security while the latter
improves electromagnetic compatibility
(EMC) of electronic systems.
Over the years numerous circuits have
been developed for demodulation of FM, PM FIGURE 8
and other modulations. Older demodulators PLL demodulator
used the slope of LC resonant circuits, then
came ratio detectors, PLLs, quadrature
demodulators and others. Nowadays PLLs
(Figure 8) are still used for both FM and PM
demodulation, but this is quickly changing.
Our present-day technology facilitates the
development of digital radio, which relies
on digitization of the carrier frequency. This
makes possible digital signal processing ABOUT THE AUTHOR
and may be followed by conversion of the
George Novacek is a retired president of an
digital data back to analog to recreate
aerospace company. He is a professional
the baseband. Whether data or voice
engineer with degrees in Automation and
communications are involved makes little
Cybernetics. George’s dissertation project was
difference. Digitization of 10 GHz carrier
is already a reality and once digitized, the a design of a portable ECG (electrocardiograph)
skies are the limits for further processing. with wireless interface. He’s been contributing
I intentionally omitted the pulse width articles to Circuit Cellar since 1999. Contact
modulation (PWM). This is a technique for him at gjnovacek@nexicom.net with “Circuit
conversion of digital signals to analog power Cellar”in the subject line.
and not fitting the current topic.
 58 CIRCUIT CELLAR • FEBRUARY 2018 #331

The Darker Side

Shannon and Noise

Putting the Theorem to Work

In his previous article on Information Theory, Robert explained

the Shannon–Hartley theorem as applied to the case of error-
COLUMNS

free transmissions. This time he applies the theorem to noise,

for which the theorem is even stronger and more impressive.

By
Robert Lacoste

W elcome back to The Darker

Side. My previous article
was
results
about the
established
Claude Shannon in 1948. In that article—
”Information Theory in a Nutshell” (Circuit
great
by
to appear—meaning that some symbols could
be sent more often than others. Assuming
that the source has some good statistical
properties (experts talk about “ergodic
source”), Shannon defined a value called the
entropy E of the source, calculated as:
Cellar 329, December 2017)—I dealt with
E = − p1 × log 2 (p1 ) − p 2 × log 2 (p 2 ) −
noise-free transmissions and I promised that
this month I’d talk about the more interesting p3 × log 2 (p3 ) − etc.
noisy channels. Well, here we go! Take a seat
and enjoy. As always, I will use as little math In that formula, log2 is the logarithm
as possible so you can grab the fundamentals. function calculated using base 2, easily
In case you’ve either missed my last article calculated as:
or you need a refresher, here’s a summary:
Information theory studies the transmission log( x )
of data between devices, through a given
log 2 ( x ) =
log(2)
transmission channel. Information theory is
based on math, so it provides very strong Ok, nothing exciting there…until you
and generic results. Thanks to its wide scope, know the first strong theorem established by
it has applications ranging from computer Shannon. It states that this entropy E is in
science to biology to cosmology and— fact closely linked to the minimum required
fortunately—electronics. channel capacity to transmit the data flow:
In my last article, I assumed that the
transmission channel was error free: Every CMINIMUM (bits / s) = E(entropy per symbol,
bit transmitted was supposed perfectly in bits) × S(symbols / s)
received. In that case, the so-called
Shannon’s “noiseless coding theorem” (also Here’s an example: If the source sends
called “source coding theorem”) allows you S = 1,000 symbols per second and if the
to calculate the minimum channel capacity calculated entropy of the source is E = 1.5 bits
in bits per seconds (bps), depending on the per symbol, then the minimum capacity of the
source. More exactly, Shannon assumes that channel is 1,500 bits per second. This means
the source generates on average S symbols that there is a way to correctly encode the
per second. Each symbol is taken from a set of data flow such that 1,500 bps are enough, on
N different symbols. Symbols could be groups average. Read again in my last article where I
of bits, English words or anything else. And showed that the so-called Hamming encoding
finally, each symbol has a given probability pi enables you to come as close as you want to
 circuitcellar.com 59

this limit. Conversely this theorem also states random source of binary bits.
that there isn’t any way to reduce it to less
than this limit—even if you are the cleverest SOME NOISE?
engineer on Earth! Okay, now let’s see what happen when there
In this article I will no longer assume is some noise. And there is always noise in a
that the channel is noise free. For simplicity, circuit or transmission. Trust me! First of all,
I will however restrict myself to the case noise introduces errors in the bit transmission.
of a binary data source (there are only two Secondly, noise will limit the capacity of the
symbols to transmit: 1 and 0). I will also channel, depending on its bandwidth. That
assume that the probability of 1s and 0s is second sentence may seem strange, but don’t
identical: 50% of the bits are 1s and 50% are worry. I will come back to it.
0s. It you do the calculation of the entropy of For the moment, I will simply assume
such a source, using the formula above, you that the noise introduces some errors on the

COLUMNS
will find of course that E = 1. This means that transmitted bits. Of course, the higher the
such a source needs a channel with a capacity noise, the higher the probability to receive a
of 1 bit per symbol: C = 1 x S = S. This simply wrong bit—as illustrated on Figure 1. By the
means that there isn’t any way to compress a way, I devoted an article on bit errors a while

Noise = 0.10 V (RMS) − Eb/No = 20 dB

5

0
−2 −1.5 −1 −0.5 0 0.5 1 1.5 2

Noise = 0.32 V (RMS) − Eb/No = 10 dB

2

0
−2 −1.5 −1 −0.5 0 0.5 1 1.5 2

Noise = 0.50 V (RMS) − Eb/No = 6 dB

1

0
−2 −1.5 −1 −0.5 0 0.5 1 1.5 2

1 Noise = 0.71 V (RMS) − Eb/No = 3 dB

0.5

0
−2 −1.5 −1 −0.5 0 0.5 1 1.5 2

Noise = 1.00 V (RMS) − Eb/No = 0 dB

0.5
FIGURE 1
When noise increases, the probability
0 of an error on a single bit also
increases. Here the noise is supposed
−2 −1.5 −1 −0.5 0 0.5 1 1.5 2
gaussian, which implies that there are
always some errors from time to time.
 60 CIRCUIT CELLAR • FEBRUARY 2018 #331

FIGURE 2
Error correction protocols always Without errors
reduce the available throughput, or
increase the required raw channel
capacity for the same useful Useful bit rate Useful bit rate Useful bit rate
throughput.

Same raw channel capacity

With risks of errors

Smaller Smaller Smaller

COLUMNS

useful bit rate useful bit rate useful bit rate

Error correction
overhead

ago called “Let’s Count Errors” (Circuit Cellar In either case, the addition of these error
295, February 2015). correcting protocols will inevitably increase
If we assume that the probability of a bit the number of bits to be transmitted. You
error p err is not null, then the transmission will will have to transmit not only the source
be deteriorated. Now, assume that you need to bits, but also additional bits like checksums,
design a reliable and error free transmission retransmissions, error correcting codes and
using such a channel. What would your so on (Figure 2). So, when noise introduces
options be? You could try to improve the some errors in the transmission, the actual
electronics with a better signal to noise ratio channel capacity must be higher to allow
(SNR), reducing the noise as much as you can error recovery. More exactly, this capacity
or try using stronger signals. Another way— (in bits per seconds) must be more than the
more interesting from an information science minimum capacity in the case of a noise free
point of view—would be to use an error channel, which is the entropy of the source
correction protocol instead of just sending times the symbol rate. But how much more?
the raw bits. Such a protocol would help to
recover the erroneous bits—as long as they’re FUNDAMENTAL THEOREM
not too numerous. For that, you could simply And here comes some magic again
add checksums to the transmitted data and with the fundamental Shannon theorem in
retransmit any wrongly received message. presence of noise. Shannon proved that the
You could also use forward error correction minimum channel capacity in the presence of
codes, as explained in another of my old such a noise must be:
articles: “ Living with Errors: An Introduction
to Forward Error Correction,” (Circuit Cellar CMINIMUM (bits / s) = E(entropy per symbol,
235, February 2010). S(symbols / s)
in bits) ×
R (reduction factor )

ABOUT THE AUTHOR or

Rob e r t L a c ost e li ve s in Fran ce, b e twe e n B(useful bit rate, bits / s)
Paris and Versailles. He has 30 years of expe- CMINIMUM (bits / s) =
rience in RF systems, analog designs, and high R (reduction factor)
speed electronics. Robert has won prizes in more
than 15 international design contests. In 2003 In this formula, R is called the reduction
he started a consulting company, ALCIOM, to factor, and can be easily calculated with the
share his passion for innovative mixed-signal following function:
designs. Robert’s bimonthly Darker Side column
has been published in Circuit cellar since 2007. R = 1 + p err × log 2 (p err ) + (1 − p err ) log 2 (1 − p err )
You can reach him at rlacoste@alciom.com.
As you can see, this number is only
dependent on the bit error rate. It is always
 circuitcellar.com 61

between 0 and 1. Look at the plot of this what this best error correction method is,
function on Figure 3. The capacity of a channel but simply that it exists. With that in mind,
in presence of noise is simply reduced by a thousands of researchers are working on
factor R, depending on the error probability. error correcting codes since 1948, in order
An example should help: Assume that you to find error correction codes as close as
send ten million binary symbols (bits) per possible to Shannon limit!
second and that 5% of them are corrupted by To summarize, the quite simple formula
noise. What would be the minimum channel given above enables you to calculate the
capacity for an error free transmission? Here Shannon limit or Shannon capacity of a
we have E = 1 (one bit per symbol), S = 10M communications channel, which is the
and R = 1+0.05.log2(0.05) + 0.95.log2(0.95). theoretical maximum error-free information
Do the calculation and you will find R = transfer rate of the channel for a particular
0.71. That means that the minimum channel noise level. Information simply cannot be

COLUMNS
capacity in that case is: guaranteed to be transmitted reliably at rates
beyond this channel capacity.
10M
CMINIMUM = 1 × = 14.1 Mbps
0.71 LIMITED BANDWIDTH
In my introduction, I told you that noise
Okay, but what does this actually also limits the capacity of the channel
mean? What did Shannon prove? First, he depending on its bandwidth. What’s that
demonstrated that if the raw channel capacity all about? To understand, we have to move
is lower than this value then there is absolutely from a theoretical transmission channel to
no way to invent an error correction protocol something closer to an actual channel—like
that will correct the transmission errors. a wire or radio link. It will for sure have a
You will always have a significant number of limited bandwidth W, expressed in Hertz.
errors, even if you are a genius. Conversely, Let’s assume W = 100 kHz, and for simplicity’s
Shannon also demonstrated that there exists sake consider that the channel is something
a solution to have an error rate as low as like a brick-wall filter: It transmits perfectly
you want, as long as the channel capacity is all frequencies from DC to 100 kHz, but stops
just slightly above that threshold. That result any signals above that threshold.
astonished the community in 1948—and is What’s the capacity of such a channel
still to this day nearly unbelievable. The bad in bits/s? First, a strange but true result: If
news is that the Shannon theorem is not a so there isn’t any noise, then this capacity is
called constructive proof. It doesn’t tell you infinite. Now you probably think I’m crazy. Hey

1.0

0.9

0.8

0.7

0.6
Channel
capacity 0.5
reduction
0.4

0.3

0.2

0.1 FIGURE 3
This plot shows you the reduction of
the channel capacity R, depending
0 on the probability of an error on
0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5
single bits: perr. Not surprisingly,
Probability the throughput is 100% when there
of bit error are no errors, and 0 when bits are
random (50% of bits wrong).
 62 CIRCUIT CELLAR • FEBRUARY 2018 #331

FIGURE 4
Here is the maximum useful error-free 7
bit rate Bmax for 1 Hz of bandwidth,
depending on the signal to noise ratio
6
SNR (here expressed in dB).

Error
free bits 3
per Hertz
COLUMNS

0
−20 −15 −10 −5 0 5 10 15 20
SNR (dB)

Robert, don’t you remember Nyquist limit? As

the channel bandwidth is W then one can B max = W × log 2 (1 + 1) = W
send only send 2xW independent samples
per second on the wire. It is the same rule In that case you can transmit 1000 error-
applies when you state that a 200 ksample/s free bits per second in a 1,000 Hz channel
analog-to-digital converter (ADC) can only bandwidth. However, if the signal to noise
manage signals up to 100 kHz. That is true, ratio is far better—say if the signal is 100
but if there is absolutely no noise then each times more powerful than noise (20 dB
sample can have theoretically an infinite ratio)—then:
resolution! You could for example group the
bits to be transmitted 100 per 100, convert B max = W × log 2 (1 + 100) = 6.65 × W
each group into an analog voltage with a
100-bit ADC (remember, there isn’t any noise In the same 1,000 Hz bandwidth, you could
at all so this is theoretically possible) and then transmit 6,650 bits per second without
send that voltage 200k times per second. error!
You would get 100 x 200k = 20 Mbps. If you
need more, just increase the ADC resolution. EB/N0?
This is exactly the idea behind what is called I have covered all the important aspects
pulse code modulation (PCM), invented in of Shannon’s theorem, but here’s some
1937 by A.H Reeves (French Patent 852,183). additional information for those who want to
So, you understood that the actual go a little deeper. Just jump over this section
capacity of a channel is in fact limited by if you’re feeling overloaded with math.
noise—or more exactly by the signal to noise If you open any book on signal processing or
ratio (SNR). Now let’s look at another form information theory, you will find the expression
of the Shannon limit formula, usually called “Eb/N0” in every page. What is this strange
the Shannon–Hartley theorem. It could be thing? It’s quite simple in fact. But I must admit
derived from the formulas above but just take that it took me some time to understand it and
it as granted. Assuming that the noise is a to link it to the formulas above. Here is my
“good” noise (gaussian), then the maximum personal summary: Eb is the energy per bit (in
number of useful error-free bits per second Joules), calculated for each useful transmitted
Bmax is: bit. It is then equal to the signal power S (in
Watts) divided by the useful bit rate B:
B max(bits / s) = W (Hertz) × log 2 (1 + SNR )
S(signal level)
For detailed article Eb =
references and additional Figure 4 shows you the behavior of B(useful bit rate, error free)
resources go to: this function but I am sure you want some
www.circuitcellar.com/ examples. If the signal to noise ratio is 1 Similarly, N0 is called the noise power
article-materials (same signal power as noise power), then: spectral density ratio. It is the noise power
 circuitcellar.com 63

FIGURE 5
16 The maximum achievable Eb/N0
performance is closely linked to H: the
number of useful error-free bits per
14
Hertz of bandwidth.

12

10

Eb⁄ No 8
minimum
(dB) 6

COLUMNS
4

−2
0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5 5.5 6 6.5 7 7.5 8
Error free bits per Hertz

in a 1 Hz bandwidth, measured in Watts per Read this last formula again. It provides
Hertz. N0 is then calculated as the total noise an absolute minimum on Eb/N0, depending
power N divided by the channel bandwidth W: only on the effective number of bits per Hertz
of bandwidth. This is illustrated on Figure 5.
N(noise level) If H is very small (large bandwidth), then Eb/
N0 =
W (channel bandwidth) N0 gets close to ln(2), which in decibels is
10log(ln(2)) = -1.59 dB. This often-quoted
You will notice that Eb and N0 are limit of Eb/N0 = −1.59 dB applies only to the
both expressed in Joules, so their ratio is very theoretical case of infinite bandwidth.
dimensionless. It can then be expressed For limited bandwidth, the absolute
in decibels if you wish. Of course, Eb/N0 is Eb/N0 limit is always higher. For example, if
closely related to the carrier-to-noise ratio: H = 2 (bandwidth twice more than the bit
rate), then the formulas shows that Eb/N0 is
(Eb × B)
SNR = S / N = = (Eb / N0) × (B / W ) always above 1.76 dB.
( N0 × W )
And finally, remember the Shannon WRAPPING UP
capacity limit? It is calculated as: I know that these two articles on
information theory were a little more math-
B max(bits / s) = W (Hertz) × log 2 (1 + SNR ) oriented than usual, but I am strongly
convinced that these results are far too
The useful bit rate B should stay below the important to be skipped by any electronic
threshold Bmax, so we must have: engineer, ham radio guy or
telecommunication enthusiast. I hope that
B < W × log 2 (1 + SNR ) or you have grabbed the essentials. If not, read
B / W < log 2 (1 + Eb / N0 × B / W ) these articles again and have a look on the
books and articles listed on Circuit Cellar’s
If we call H = B/W (useful bits per Hertz of article materials webpage. And finally, like
bandwidth), then this leads to: most of you, I’m far more of an electronic
designer than an information science expert,
H < log 2 (1 + Eb / N0 × H) or so don’t hesitate to contact me if I’ve said
2H < 1 + Eb / N0 × H something wrong or too simplified. Last but
not least, play with these formulas yourself
or finally: and have fun!
(2H − 1)
Eb / N0 >
H
 64 CIRCUIT CELLAR • FEBRUARY 2018 #331

From the Bench

Money Sorting Machines (Part 3)

Bill Validation

In this final article of his money sorting

machine series, Jeff wraps up his coin sorting
project and examines how a bill validator can
tell one bill’s denomination from another.
By
Jeff Bachiochi
COLUMNS

M ost of us connect Ben Franklin

with kites and lightning.
He was also a printer and
might be best known for Poor
Richard’s Almanack—a yearly publication
that he published from 1732 to 1758 under
Today every aspect of our paper currency
is controlled—from its design to its printing,
as well as its monitoring and destruction. The
paper (which is not paper) and ink (multiple
types and formulas) are fabricated for the
express use by the Department of Engraving.
the pseudonym of Richard Saunders. It was a That department is the Treasury bureau
best-seller and thanks to his wit and wisdom, responsible for paper money—as opposed to
his portrait was added to the cover of The the U.S Mint, which is the Treasury bureau
Old Farmer’s Almanac in 1851—appearing responsible for coinage. US currency consists
opposite the founder Robert B. Thomas. It of 25% linen and 75% cotton and contains
remains there today. small randomly disbursed red and blue
As a master printer and engraver, in 1730 security fibers embedded throughout the
Franklin began printing all paper money issued material. Depending on the denomination the
by Pennsylvania, New Jersey and Delaware. material is further enhanced by embedding
Paper money was first introduced in the security threads, ribbons and watermarks.
region in 1723, but it remained a hot political Since 1996, printing with colored and color
issue. That’s because it helped farmers and changing inks make the new currency pop.
tradesmen, while merchants and landowners While older black and green currency is rather
wanted it eliminated or limited in its circulation. drab in comparison, it is still legal tender and
Paper money printed from ordinary type was remains the target of most counterfeiters.
easy to counterfeit, but Ben’s ingenuity solved The previous two parts of this article series
that problem by printing pictures of leaves on centered around coinage. Before we look at bill
every piece of money. Counterfeiters could validation for paper money, I need to finish up
not duplicate—or even imitate—the fine lines with that project. I had purchased a few Coin
and irregular patterns. The process by which Acceptors and showed how they are used to
he made the printing plates was secret, but identify coinage, especially but not limited to
were probably cast in type metal from molds US coins. The acceptance and dispensing of
made by pressing leaves into plaster of Paris. money is presently used in many ways today,
There began the Feds vigilant effort to thwart including vending machines and ATMs. The
counterfeiters. discussion also included National Automatic
 circuitcellar.com 65

Merchandising Association (NAMA), the require two receivers for its configuration.
organization that developed the international The carrier board will have a MDB
specification for the Multi-Drop Bus/ connection on one end and a microcontroller
Internal Communication Protocol (MDB/CP) with the ability to interchange 9-bit data
released in July 2010. The MDB/ICP enables with the MDB. My original project, the slave
communication between a master controller interface, requires a standard 8-bit UART to
and any of the peripheral hardware like Coin connect with the coin acceptor. While all the
Acceptors and bill validators. By adhering functions of a master could be programmed
to these guidelines, any manufacturer’s into this microcontroller when the carrier
equipment is interchangeable. board is configured to emulate a master,
Turns out the Coin Acceptors I purchased a UART interface would enable a master
don’t have the MDB interface necessary interface to a PC. The PC could be used to
to communicate with a Vending Machine emulate the master and allow a user to
Controller (VMC). I reviewed the protocol and issue commands to the MDB. When used as
VMC/Peripheral Communication Specifications a spy device the UART interface allows all
required by the Coin Acceptor/Changer communication to be displayed on a PC, LCD
peripheral and began work on developing or even a printer! That’s the logic that has
an MDB interface that would bridge my Coin twisted this project’s circuitry into its present
Acceptor with the multi-drop bus. configuration.
The carrier board in last month’s
PROJECT CIRCUITRY installment contains a power supply front
If you need to review the MDB/ICP, please end for a master. Either an AC (transformer)
reread last month’s article (Circuit Cellar 330, or DC (power supply) input can be used for
January 2018) or get the specs from the NAMA input when the carrier board is configured as
website [1]. The communication protocol is a master. When used as a slave, the supply

COLUMNS
9600, 9, 1, N. There are two unusual things on the MDB is regulated into a 12 VDC supply
here. First, you’ll note the data size on the and a 5 VDC supply. Not only does this give
MDB is 9 bits—not standard with many UARTs. two additional voltage outputs for a slave/
The second thing here is that the multi- spy device, but it also divides the regulator
drop bus uses a 20 mA control current and drops over two regulators reducing the
peripherals are opto-isolated from the bus. power that must be dissipated by each.
The LED transmitter in each opto-coupled The microcontroller has a few configuration
device is easily turned on with 20 mA. The inputs and LEDs, enabling the application
master directly interfaces with the bus and it to be changed via jumpers. At present we’ll
must supply a minimum of 20 VDC with some be using three of the four possible jumper
hefty current in support of all connected settings for Mode 0:2—master, slave and spy.
peripherals. The MDB/ICP specs suggests
some typical bus interfacing circuitry. SPYING
If you review this, you’ll find four different The protocol for any MDB activity requires
circuits (a through d), a non-isolated that no slave send any response unless the
transmitter and receiver (master) and an master has asked that particular slave device
isolated transmitter and receiver (slaves). to respond to its command. This means that
There is a reason for presenting these as while the MDB has a transmission path to all
individual circuits (modules). This project slaves and a separate response path from all
requires emulating a slave device and, slaves, that communication will only take place
therefore, requires an isolated interface to the on one path at a time—either a command or a
MDB. If you wanted to emulate a VMC (master) response. You’ll note from the carrier board’s
you would need a non-isolated interface to circuitry that when two receivers are used for
the MDB. Using modules would allow a carrier
board to be configured for either a master or
a slave by substituting modules! In fact, it also
opens a third possibility—a configuration that ABOUT THE AUTHOR
might even be more useful in this project: an Jeff Bachiochi (pronounced BAH-key-AH-
MDB spy board! key) has been writing for Circuit Cellar
Without access to a complete system—like s i n c e 1 9 8 8 . H i s b a c kg ro u n d i n c l u d e s
a product vending machine—it will be difficult product design and manufacturing. You can
to know if the protocol is being sent correctly
reach him at:
unless we can monitor all MDB activity.
Producing a spy device that can attach to the jeff.bachiochi@imaginethatnow.com or at:
MDB and display both master transmissions www.imaginethatnow.com.
and slave responses will be indispensable for
assuring proper operation. A spy device will
 66 CIRCUIT CELLAR • FEBRUARY 2018 #331

PHOTO 1
Using RealTerm to display the SPY
boards output of MDB traffic, you can
see how the coin acceptor responds to
commands from the master.
COLUMNS

a spy device (Mode 2), we have separate serial additional input to the MCU to determine
communication channels. If we are going to when the command receiver was active. After
use one UART for peripheral communication, that, I figured as long as I was going to use
that only leaves one hardware UART left for an additional input, I might as well implement
the MDB communications. I figured I could a third UART via software. With the command
just wire OR them into that UART. Since receiver connected to the hardware UART and
communication only exists on one of the two the response receiver connected to a software
channels at a time, I could easily receive both UART, the problem would go away!
through the same UART. This turned out to Commands and responses are sent in
be a bigger issue than I expected. There groups. At 9600 baud, a data byte can
was no easy way to determine the end of the be sent in just over 1 ms. The maximum
command and the beginning of the response. interbyte delay can be no more than 1 ms.
Each command (or sub command) can have Any response to a command must be made
different lengths. After trying to predefine within 5 ms of a command. Remember how
this, it was turning into a difficult project. the format of the MDB data is 9-bits? Well,
I experimented a bit with using an this serves two purposes. First, the master

Denomination Security Security Bell in Water- Color Shifting Raised Magnetic Micro Linen/Cotton
Thread Ribbon the mark Denomination Printing Ink Printing w/red
Inkwell blue fibers
$100 X X X X X X X X X
$50 X X X X X X X X
$20 X X X X X X X X
$10 X X X X X X X X
$5 X X X X X X X
$2 X X X
$1 X X X

TABLE 1
High tech embedded technology helps to thwart counterfeiters. High value denominations include more technology that offsets the difficulty in reproductions.
 circuitcellar.com 67

sets the 9th bit of the first byte of every comes into a separate software UART—it can FIGURE 1
command as an indication of address data. now be displayed appropriately. Here we see the $5 dollar bill with
The data in this byte is monitored by all slave the visible security measures labeled.
devices to determine if it will respond to the UNIVERSAL MDB RECEIVER Validation looks for a combination of
these and other measures to identify
command or just ignore it. As we saw last While the carrier board configured with

COLUMNS
‘‘real‘’ currency.
month, each different slave device has its modules can only be used for a specific
own predefined address. For example, our configuration—master, slave or spy—the
Coin Acceptor/Changer has a base address of MCU’s application can support any of the
B’00001xxx’. Any address between 0x08 and Modes. Setting the jumpers is used to
0x0F should only be responded to by a Coin configure the Mode. In Mode 0 we’re emulating
Acceptor/Changer slave device. Each separate a master, while anything received from the
address may have a pre-defined command MDB will be a response from a slave. When in
specifically for that particular type of device. Mode 1, we’re emulating a slave and anything
If a command is issued for an address with no received from the MDB will be a command
pre-defined command, the slave device just from the master. Finally, when the Mode is 2,
does not respond. So, if the first byte of a
received string of data has the 9th bit set on
the first byte, it’s a command. Responses also
use the 9th bit. In that case, the last byte of a
received string will have its 9th bit set.
For the most part, all commands and
responses will have a checksum added as the
last character of the command string. This is
simply the least significant bit (LSB) of all the
proceeding bytes. There are three instances
of no checksum: ACK, NAK and RET. The ACK
response indicates the data is accepted. The
NAK response indicates a timeout. The RET
response is a request to resend the last data.
Note that while none of these responses have
checksums added, responses by the slave
must have the 9th bit set because it is the
last, and only, character!
So, as a slave device we can determine
when a command ends by looking for a
5 ms timer overflow after each command
character received. Once received, the slave
must determine if the command is using one
PHOTO 2
of the slave’s addresses and if so, what to do
Here I’ve exposed the main circuitry from two different bill validators. Optical sensors are used to measure
next. For a spy device, we can potentially see
physical parameters as well as spectrum components. These, along with magnetic signatures, help to
a response within 1 ms. However, now that assemble a digital representation of each bill. Validation occurs when this corelates to the prestored data
we can differentiate the response—because it for each denomination.
 68 CIRCUIT CELLAR • FEBRUARY 2018 #331

VMC Address VMC Data Response VMC ACK we’re spying on both the master’s commands
Command Data and any slave’s responses. Hardware UART2
RESET 0x30 - ACK - receives commands and software UART3
receives responses.
SETUP 0x31 - 27 bytes ACK As the coin acceptor slave device, once a
SECURITY 0x32 2 bytes ACK - command string has been received with an
address byte between 0x08 and 0x0F—and
POLL 0x33 - 16 bytes ACK
the checksum verified—the command can be
BILL ENABLE 0x34 4 byte ACK processed. This slave will respond to all legal
ESCROW 0x35 1 byte ACK commands, however only three are pertinent.
The Reset command 0x08 will reset the slave
STACKER 0x36 - 2 bytes ACK
device. The Setup command 0x09 response
EXPANSION 0x37 0x00 29 bytes ACK will indicate the coins that can be accepted.
The Poll command 0x0B response will indicate
TABLE 2 when a coin has been accepted. The Coin
The command/response formats for most devices are similar—either a command with data and an ACK
Type command 0x0C can enable and disable
returned by the slave, or a command/response by the slave and an ACK by the master.
the coin acceptor. The coin acceptor interface
includes UART1RX to receive the monetary
value of each coin accepted, 12 VDC power
regulated from the MDB interface and an
enable pin driven from one of the MCU’s I/Os.
As a spy device, command and responses
are sent at 115200 baud via UART1RX. The
data is formatted as ASCII text. The address
range of every command is used to determine
COLUMNS

the destination of the data and is formatted as

“Command to Coin Acceptor: 0x08 0x08”—in
this case Reset with a checksum of 0x08. The
data after the colon is the command string as
received. Any response from a slave will be
formatted as “Response from Coin Acceptor:
0x00”—in this case ACK. Photo 1 shows the
command/responses format the spy device
displays for the ‘Coin Acceptor’ device.
Like any good system, a power up sequence
will initialize everything into a known state.
The master must make contact with each
of its peripherals to insure communication
and to reset each into a known state. Once
all is marching in step, the master must
continuously poll each peripheral to find out
what’s going on. This input status enables it
to make decisions and request output when
necessary.
The master uses addressed commands to
communicate with each peripheral. The MDB/
ICP suggests an initialization sequence, or
list of specific commands for each individual
peripheral. Each command is a string of one
or more characters. When the carrier board is
configured for Mode 0, a master, it can send
any string of characters onto the MDB and wait
for a response for the addressed peripheral.
While we could use the MCU to handle all of
the duties of a VMC, in this application all data
comes from UART1RX (a PC). A peripheral’s
response is merely redirected out the
UART1TX after being received from the MDB.
In this project, the master is simply an 8-bit
PHOTO 3 to 9-bit translator. I’ll use a PC application
The bill validator communication, displayed by the SPY device, is similar to that of the coin acceptor output to form the commands and display a slave’s
in shown in Photo 1. response.
 circuitcellar.com 69

PHOTO 4
The total system comprised of
the master, SPY and slave boards
BILL MAKEOVER (top to bottom) are daisy chained
Let’s take a quick look at the present with the bill validator to complete
technologies implemented in the most the system. The coin acceptor
recent US currency by the Department of the attaches to the slave board. The
Treasury’s Bureau of Engraving and Printing, MDB is monitored via SPY’s AUX
which is issued and distributed by the Federal UART output. All commands are
Reserve. Table 1 shows a chart of the security sent to the master via its AUX
precautions and on which denominations they UART connection.

are used. Specific precautions are shown

for the $5 bill in Figure 1. Bill redesigns are
primarily for security reasons. The $1 bill—
and the $2 bill—aren’t often counterfeited,
therefore there are no plans to redesign those
bills. Interestingly, a recurring provision in
the annual Financial Services and General
Government Appropriations Act actually
prohibits the redesign of the $1 note!
Today’s bill validators use multiple optical
and magnetic readings to assure authenticity.
These sensors identify various features
unique to each denomination. In Photo 2
you can see the numerous and wavelength
specific optical devices that scan any item
inserted into the validator. These devices are
seen on the removable module that allows

COLUMNS
easy cleaning and access to the bill movement
mechanism. A magnetic head is buried on the
main unit and not easily accessed. Optical
sensors include reflective and transmissive
paths. The optical spectrum covers infrared
to ultraviolet.
Left and right alignment sensors send
information to the microprocessor on item
width. The center optic sensor informs the
microprocessor that an item has been inserted
and ready to be transported. The left and right
optic sensors perform various optical checks
on the bill. The magnetic sensor reports on any
magnetic properties of the item.
Once an item is inserted, the microcontroller
enables the movement mechanism to feed the
item back and forth across the sensors. The
MCU assembles a digital fingerprint of the item
and checks its data bank for a match to any
preloaded prints of valid currency. If no match
is made the item is rejected. A validated bill
is then advanced to the holding area where
its value can be used to purchase product
and stored or returned to the customer if the
transaction is canceled.
Like the coin acceptor discussed earlier,
the bill validator has its own set of commands
that must be recognized when connected
to the MDB. The address range for the bill
validator is 0x30-0x37. You’ll find the validator
commands in Table 2 to be similar to that of
the coin acceptor. When the bill validator is PHOTO 5
accessed via the master device, the spy device This Liberty Basic application enables each command string to be sent to the master. Responses are
shows the command/response format of the interpreted by the application and displayed in the center text box. This gives the user complete control over
bill validator as displayed using RealTerm each slave device. Once initialized, each device is polled periodically. When a device indicates it has validated
(Photo 3). The setup now consists of three receiving a coin or bill, the application increases that specific denomination and also displays a running total
boards: the master (command converter to of all currency.
 70 CIRCUIT CELLAR • FEBRUARY 2018 #331

MDB), the spy (displaying all traffic on the response timing.

MDB) and the slave (interfacing with the Since my master device is serving as a
coin acceptor). As shown in Photo 4, the bill translator between the AUX UART and the MDB
validator daisy chains to the MDB. UART, there is at least a one-character timer
So now what? Well, to really put the system lag introduced by this device. With the added
to the test we need to write an app to exercise lag in my Liberty Basic app to search for the
it. I used my old friend Liberty Basic to write a end of a reply, verify it is good and reply with
quick app to be able to send commands to the an ACK, I was exceeding the response time!
master via its AUX UART. The results are shown Hmm... The only way I could be assured the
in Photo 5. Tabs allow the user to select Review ACK was sent in time was to handle it in the
(command variables such as Bill Enables), master device. While this worked, it doesn’t
Initialize (reset and initialize all slave registers), make sense to put this one bit of “smarts” into
Polling (Start/Stop) and Coin Acceptor/Bill the master device. It probably should contain
Validator (send individual commands). a totally smart solution. The AUX input is
I set the app to keep track of any coins used to instruct the master which particular
or bills fed into the two slave devices. This command to send, instead of sending the
is accomplished via the periodic polling of actual command byte sequences.
these two slave devices. I initially saw the bill I’m going to end this project before it
validator continue to send the same response really gets out of control. The basic premise
as if my ACK wasn’t being heard. So, I needed to investigate coin and paper money has
to review the two basic timing parameters expanded into creating a slave interface
(not counting a RESET): interbyte timing and device for the MDB, creating a SPY device to
monitor MDB activity and a master device to
Additional materials from the author are available at: send and receive commands via MDB.
www.circuitcellar.com/article-materials Programming the master to be completely
COLUMNS

Reference [1] as marked in the article can be found there. autonomous—or even just “smart”—would
take this project beyond the bore factor for
RESOURCES some. If your input demands it, I’ll continue
Microchip Technology | www.microchip.com
this project in a later article. But next month
we’ll look at something different.

Circuit Cellar
2017 Archive

cc-webshop.com
Order yours today
 circuitcellar.com 71

PRODUCT NEWS

Multi-Service IoT Gateways are Automotive-Grade

Eurotech has expanded its range of Multi-service IoT power supply with transient protection and vehicle ignition
Gateways with the launch of the DynaGATE 10-12 and the sense, 2x protected RS-232/RS-485 serial ports, 2x CAN bus
announcement of the DynaGATE 10-06 (shown). Both systems interfaces, 3x noise and surge protected USB ports and 4x
are carrier pre-certified, with an integrated LTE Cat 1 cellular, isolated digital I/Os. The DynaGATE 10-12 is suitable for on-
GPS, Wi-Fi, BLE, E-Mark and SAE/J1455 certifications and a board applications, with a metal enclosure, high retention
-40 ºC to +85 ºC operating temperature. connectors and screw-flange terminal blocks.
The DynaGATE 10-12 is a low-power gateway based on The DynaGATE 10-06 (shown) is an IP67, heavy-duty IoT
the TI AM335X Cortex-A8 (Sitara) processor family, with gateway for Automotive applications. It features an internal
1 GB RAM and 4 GB eMMC. It features a 6 VDC to 36 VDC battery that provides minutes of uninterrupted operation
in case of power failure. Based on the NXP
i.MX 6UltraLite Cortex-A7 processor, with
512 MB RAM and 4GB eMMC, the DynaGATE
10-06 features a 6 V to 36 V power supply
with protections and vehicle ignition sense,
3x protected RS-232/RS-485 serial ports,
2x CAN bus interfaces, 1x noise and surge
protected USB port and 2x protected digital
I/O. All these interfaces are available through
a rugged AMPSEAL connector.

Eurotech
www.eurotech.com

PRODUCT NEWS
Qseven Module Sports Renesas RZ/G1M Processor
iWave has announced a System-On-Module (SOM) based on Renesas RZ/G1M
embedded processor. RZ/G1M SOM is Qseven R2.0 compatible industrial grade CPU
module. Called the iW-RainboW-G20M, this SOM module supports 1 GB DDR3 RAM,
4 GB eMMC Flash and 2 MB SPI NOR Flash. Expandable memory is optional. The
module also includes on SOM Gigabit Ethernet PHY, Micro SD slot and USB HUB.
Renesas’s RZG1M processor supports dual cortex A15 core operating at
1.5 GHz core and includes 64-bit DDR3 interface at 800 MHz. The high-speed on-
chip integrated USB 3.0, PCIe, Gbit Ethernet and SATA peripherals
allows easy expansion of functionality without the need for external
components. The RZ/G1M processor supports full HD hardware
encode and decode processing up to 1,080 at 60 frames/s, dual
display and three channel video input ports. The built-in PowerVR
SGX544MP2 Graphics core at 520 MHz allows the user to develop
highly effective user interfaces.
The RZ/G1M SOM is supported Linux 3.10 LTSI with Android BSP
support to come. To enable quick prototyping of RZG1M SOM, iWave
systems supports RZ/G1M development kit with comprehensive
peripheral support. This will help engineers save up to 60% of
their new product development cycle time using the RZ-G1M MPU.

iWave Systems Technologies

www.iwavesystems.com
 72 CIRCUIT CELLAR • FEBRUARY 2018 #331

PRODUCT NEWS

DC-DC Converter Boasts 4 A, 60 V Internal Switch

Analog Devices, acquired last year by Linear
Technology, has announced the Power by Linear
LT8364, a current mode, 2 MHz step-up DC/
DC converter with an internal 4 A, 60 V switch.
It operates from an input voltage range of
2.8 V to 60 V. The LT8364 can be configured as
either a boost, SEPIC or an inverting converter.
Its switching frequency can be programmed
between 300 kHz and 2 MHz, enabling designers
to minimize external component sizes and avoid
critical frequency bands, such as AM radio.
Furthermore, it offers over 90% efficiency while
switching at 2 MHz. Burst Mode operation reduces
quiescent current to only 9 μA while keeping
output ripple below 15 mVp-p. The combination
of a small 4 mm x 3 mm DFN or high voltage
MSOP-16E package and tiny externals ensures
a highly compact footprint while minimizing
solution cost.
The LT8364EDE is available in a 4 mm x 3 mm
DFN-12 package and the LT8364EMSE is available
in a high voltage MSOP-16E (4 pins removed for
high voltage spacing). Industrial temperature
(–40°C to 125°C) versions (LT8364IDE and
LT8364IMSE), and high temperature (–40°C to
150°C) versions (LT8364HDE and LT8364HMSE)
are also available. Pricing for the LT8364 in
1,100s starts at $3.25.
PRODUCT NEWS

Linear Technology
www.linear.com

Class I and II 500 W Configurable Medical Power Supplies

TDK has announced the XMS500 series of AC-DC power a 6-dB margin and has a low leakage current of less than
supplies, rated at 500 W output power, with a Class I and 150 µA. The high operating efficiency and mechanical design
Class II (no earth ground connection) construction. The series enables the XMS500 to operate at full load with airflow rates of
conforms to curve B conducted and radiated emissions, with just 1 m/s, reducing audible noise. Applications include home
healthcare, hospital, imaging and clinical
diagnostic systems in addition to industrial,
test and measurement and communications
equipment.
Designed as a configurable product,
engineers can select from multiple standard
options, to optimize both system performance
and cost, without incurring development
charges or minimum purchase quantities.
The options include case styles (including an
internal low speed fan), a choice of standby
voltage, a 12 V fixed or variable speed fan
supply, remote on/off, AC fail and single or dual
input fuses. 12 V, 24 V, 3 6V or 48 V nominal
outputs are offered, with other voltages upon
request.

TDK-Lambda Americas
www.us.tdk-lambda.com
 circuitcellar.com 73

PRODUCT NEWS

Skylake-Based SBC Runs on 15 Watts

Versalogic has released the Condor—a high-performance embedded computer that measures only 95 mm x 95 mm x 37 mm
and is built around Intel’s 6th generation “Skylake” Core processor and boasts power consumption as low as 15 W. The Condor’s
on-board TPM security chip can lock out unauthorized hardware and software access. It provides a secure “Root of Trust.”
Additional security is provided through built-in AES (Advanced Encryption Standard) instructions.
PR_EPU-4460_HICondor is the latest addition to Versalogic’s line of EPU (Embedded Processing Unit) format computers. EPUs
are designed around COM Express form factors, but are complete board-level computers. They provide all the future flexibility of
separate CPU and I/O modules, and are delivered
as complete fully assembled and tested units
(including heat plate), ready to bolt into a system.
On-board I/O includes two Gbit Ethernet ports
with network boot capability, two USB 3.0 ports,
four USB 2.0 host ports and two serial ports.
One SATA III interface supports high-capacity
rotating or solid-state drives. Eight digital I/O
lines, I 2C and SPI are also available. Two Mini PCIe
sockets (one with mSATA capabilities) provide
flexible solid-state drive (SSD) options. Systems
can be easily enhanced by leveraging the Mini
PCIe sockets with plug-in Wi-Fi modems, GPS
receivers, MIL-STD-1553, Ethernet, Firewire and
other mini cards. OEM quantity pricing starts at
$1,304 for the Core i3 model with 8 GB RAM.

Versalogic | www.versalogic.com

PRODUCT NEWS
Radiation-Tolerant MCU Family Meets Space Requirements
A new microcontroller that combines specified COTS device can be replaced with a pin-out compatible,
radiation performance with low-cost development radiation-tolerant version with the same functionality as
associated with Commercial Off-The-Shelf (COTS) the original device.
devices is now available from Microchip Technology.
The ATmegaS64M1 is the second 8-bit megaAVR MCU Microchip Technology | www.microchip.com
from Microchip that uses a development approach
called COTS-to-radiation-tolerant. This approach takes
a proven automotive-qualified device, the ATmega64M1
in this case, and creates pinout compatible versions in
both high-reliability plastic and space-grade ceramic
packages. The devices are designed to meet radiation
tolerances with the following targeted performances:

• Fully immune from Single-Event Latchup (SEL) up to

62 MeV.cm²/mg
• No Single-Event Functional Interrupts (SEFI) which
secure memory integrity
• Accumulated Total Ionizing Dose (TID) between 20 to
50 Krad(Si)
• Single Event Upset (SEU) characterization for all
functional blocks

The ATmega64M1 COTS device, along with its full

development toolchain including development kits and
code configurator, can be used to begin development of
hardware, firmware and software. When the final system
is ready for the prototype phase or production, the
 74 CIRCUIT CELLAR • FEBRUARY 2018 #331

PRODUCT NEWS

Stainless Steel Panel PCs Meet Food Industry Needs

Axiomtek has introduced the release of two new IP66/IP69K
stainless steel touch panel computers: the 15″ GOT815L-511
and 17″ GOT817L-511 (shown). These Intel Kaby Lake processor-
based stainless-steel touch panel PCs are especially designed
for use in extreme humidity, moist, dusty or wet environments.
The highly reliable stainless touch got817-511panel computers
adopt a high brightness LCD display with 420 nits (GOT815L-511)
and 350 nits (GOT817L-511) brightness to ensure visibility in
harsh environments with varying light intensity and come with
options for projected capacitive touch or 5-wire flat resistive
touchscreen display. The SUS316 stainless steel case can
prevent bacteria growth and rust brought on by prolonged
usage in moist and wet environments. Furthermore, the flat
panel design prevents accumulation of dust and moisture and
also makes cleaning easier.
The 15” XGA and 17” SXGA stainless steel panel computers
come with rich I/O interfaces with M12-type connectors
including two RS-232/422/485 ports, four USB 2.0 ports and
one gigabit Ethernet port. They both support one DDR4-2133
SO-DIMM slot with up to 16GB system memory, and one 2.5″
SSD or 2.5″ SATA HDD for storage.

Axiomtek
www.axiomtek.com
PRODUCT NEWS

Software Tool Aids STM32 MCU Programming

STMicroelectronics offers a new software tool, the STM32CubeProgrammer’s capabilities by adding
STM32CubeProgrammer, that provides device-programming programming access via microcontroller I 2C and CAN ports.
and firmware upgrades for STM32 microcontrollers in a
unified, multi-platform and user-configurable environment. STMicroelectronics
Ready to run on Windows, Linux or MacOS operating systems, www.st.com
the STM32CubeProgrammer can program the STM32
microcontroller’s on-chip Flash/RAM or
external memories using various file
formats. Further capabilities include whole-
memory or sector erase and programming
microcontroller option bytes. Users can
also generate encrypted files for secure
programming (Secure Firmware Install/
Update) to authenticate production and
protect intellectual property.
With this tool, users can program
STM32 microcontrollers through the
device’s SWD (Single-Wire Debug) or
JTAG debugging ports, or the bootloader
ports (such as UART and USB). Hence
the STM32CubeProgrammer brings
the individual capabilities of the ST
Visual Programmer, DFUse Device
Firmware Update tool, Flash Loader,
and ST-Link utility together within the
STM32Cube ecosystem. ST will extend
 circuitcellar.com 75

PRODUCT NEWS

Chipsets Provide Low Power LoRa Solution

Semtech has announced its next generation LoRa devices and
wireless radio frequency (RF) technology (LoRa Technology) chipsets
enabling innovative LPWAN use cases for consumers with its advanced
technology. Addressing the need for cost-effective and reliable sensor-to-
cloud connectivity in any type of RF environment, the new features and
capabilities will significantly improve the performance and capability of IoT
sensor applications that demand ultra-low power, small form factor and
long range wireless connectivity with a shortened product development
cycle.
The next generation LoRa radios extends Semtech’s industry leading
link budget by 20% with a 50% reduction in receiver current (4.5 mA) and
a high power +22 dBm option. This extends battery life of LoRa-based
sensors up to 30%, which reduces the frequency of battery replacement.
The extended connectivity range, with the ability to reach deep indoor
and outdoor sensor locations, will create new markets. Three new devices,
SX1262 (+22dBm), SX1261 (+15dBm) and SX1268 (+22dBm, China frequency
bands) are currently sampling to lead customers and partners and will be
available in full production in late Q1 2018. Development kits for various
regions and associated software will also be available at that time.

Semtech | www.semtech.com/iot

Bluetooth 5-Compliant ICs Boast -105 dBm Sensitivity

PRODUCT NEWS
Toshiba Electronic Devices & Storage has added two new need for external non-volatile memory. This also lowers
devices to its lineup of ICs that are compliant with the Bluetooth the part count, which reduces both the cost and mounting
low energy standard. The new TC35680FSG (featuring area. The TC35681FSG, which does not include a built-in
built-in flash memory) and TC35681FSG are well-suited to flash memory, operates in conjunction with an external non-
applications requiring long-range communication, including volatile memory or host processor. A wide operating range of
beacon tags, IoT devices and industrial equipment. The new -40° to +125°C makes it suitable for applications exposed to
communication ICs support the full spectrum of data rates high temperatures.
required for the high-speed features—2M PHY and Coded PHY
(500 kbps and 125 kbps)—found in the Bluetooth 5.0 standard. Toshiba Electronic Devices & Storage
The new devices also deliver an industry-leading receiver www.toshiba.semicon-storage.com
sensitivity level of -105 dBm (at 125 kbps) and a built-in high
efficiency power amplifier in the
transmission block that provides
up to +8 dBm transmission power.
Based on an ARM Cortex-M0
processor, the new ICs incorporate
a 256 KB Mask ROM to support
the Bluetooth baseband process,
and 144 KB of RAM for processing
Bluetooth baseband, stack and
data. Toshiba’s TC35680FSG and
TC35681FSG also feature 18-port
GPIOs as interfaces, which can be
set to 2 channels each for SPIs,
I2C, and UART.
The TC35680FSG includes 128
KB of flash memory for storing
user programs and various data
in stand-alone operations, making
it well-suited to a wide range of
applications and removing the
Have you
stopped by
the shop lately?

contest CDs
Circuit Cellar is always adding new items to
help with your design projects. Stop by often

books
for the latest deals.

audio
back issues
archive CDs

www.cc-webshop.com
 circuitcellar.com 77

IDEA BOX
The Directory of
PRODUCTS & SERVICES
AD FORMAT:
Advertisers must furnish digital files that meet our specifications (circuitcellar.com/mediakit).

All text and other elements MUST fit within a 2” x 3” format.

E-mail adcopy@circuitcellar.com with your file.

For current rates, deadlines, and more information contact

Hugh Heinsohn at 757-525-3677 or Hugh@circuitcellar.com.

Explore SENSORS
Learn C with hands-on tools that
inspire real world applications.

SENSORS
rn
EXPLORER KIT
In
lea ed c clud
es:
edd C CoCCS
emb n a mpil
o ! & er
mcu more
pic® !

sales@ccsinfo.com
262-522-6500 x 35

www.ccsinfo.com/cc218
PIC® MCU is a registered trademark of Microchip Technology, Inc.

Single Board Computer

CC Vault This pocket-sized vault comes fully loaded

with every issue of Circuit Cellar magazine
and serves as an unparalleled resource for
embedded hardware and software design TS-7250-V2
Unlock the power of tips, schematics, and source code.
*CC Vault is a 16-GB USB drive. 1GHz ARM Computer with
embedded design. Customizable FPGA-Driven
PC/104 Connector
and Several Interfaces
at Industrial Temp
www.embeddedARM.com
 78 CIRCUIT CELLAR • FEBRUARY 2018 #331

Answer 1—In a DLL, the input signal is fed both to the phase
comparator and to the input of the delay line. The output of
TEST YOUR EQ Contributed by David Tweed
the delay line feeds the second input of the phase comparator,
and the output of the phase comparator is filtered and used
to control the delay line. The end result is that the delay is
adjusted until it equals the period of the input signal, causing
the delayed edges of coming from the delay line to line up with period established by the delay line. A simple D flip-flop
the undelayed edges. can be used to discriminate between these two cases,
providing a direct digital copy of the original baseband
signal.

Answer 3—Since the digital baseband signal can be

recovered directly using a DFF, the need for analog
circuitry to amplify and “slice” the delay line control
voltage is eliminated. This makes the technique much
more amenable to implementation in a standard CMOS
process for minimum power consumption and maximum
compatibility with digital CMOS fabrication processes.
Note that this requires the type of phase detector whose
average output is zero when there is zero phase error between Answer 4—In order to keep the average frequency
its inputs—not a simple XOR gate, for example. being tracked by the DLL as close to the center as
possible, the baseband data should have an equal mix of
Answer 2—The control voltage of the delay line tracks the ones and zeros. Furthermore, there must be a limit on
average period of the input signal, within the bandwidth of the the number of contiguous ones or zeros in a row.
loop filter. There are a number of ways to accomplish these goals.
If the loop bandwidth is greater than the data rate, the control One way is to use 8-bit/10-bit encoding on the data,
voltage directly tracks the frequency changes associated with which was originally developed to support various kinds
the individual bits. This signal can be amplified and compared of digital audio recording. With this encoding scheme,
with a threshold in order to recover the original data. there are at most five ones or zeros in a row. Also, the
On the other hand, if the loop bandwidth is significantly less running “disparity” between ones and zeros is tracked,
than the data rate, the DLL tracks only the average frequency of and alternate codes are used where possible to keep the
a large number of bits. This means that at any given moment, overall mix balanced.
the incoming signal will either be at a higher frequency
(shorter period) or a lower frequency (longer period) than the
For more information:
circuitcellar.com/category/test-your-eq/
TESTS YOUR EQ
 circuitcellar.com 79

The Future of Industrial IoT

Gearing up for a
Post-3G, Sensors
Everywhere Era

T oday the Industrial Internet-of-Things

(IIoT) is leveraging a variety of technology
trends that are moving ubiquitous
monitoring closer to reality. These trends
include more efficient and more cost-effective cellular
networks, smaller embedded wireless sensing
By
Brent Ward
VP Business Development,
Device Solutions
devices with lower power consumption, improved
communication protocols covering greater distances
and maturing back-end analytic and operational
integration.
Many of the changes to the way IIoT is implemented
across numerous monitoring applications have been
driven by carriers migrating their equipment to
support 4G from 3G. This shift will drive greater
efficiency in the network while also allowing for
faster speeds, an increased number of users and
an increased capacity for bandwidth. Of these,
the increasing number of users/connections is of
particular interest. That’s because most IIoT future
predictions see everything of interest monitored with
sensors and transmitting the data continuously.
Carriers like Verizon have notified their users that
no new 3G devices will be allowed to be activated on the
network after mid 2018 and that 3G network support

TECH THE FUTURE

will be sunset at the end of 2019. That means that
most, if not all, new cellular devices require 4G. If you
consider the number of 2G/3G devices that are already
in the field and the time/effort that may be involved to
test, validate, and then swap out equipment—there is
very little time to make the switch.

SHRINKING WIRELESS DEVICES

Embedded wireless devices are aggressively
competing for pole position on parameters including:
decreasing size, increasing capability, decreasing
hardware price, reducing power consumption,
increasing data security, increasing transmission
distances and decreasing communication costs—just
to name a few.
At the most basic level, a single sensor device with
power supply and communication link all need to fit
inside the application’s physical constraints—and at
the lowest cost possible with the highest security
possible. Cell phones, smart watches and other
 80 CIRCUIT CELLAR • FEBRUARY 2018 #331

embedded wireless devices have continued to Most organizations seem keenly aware
drive miniaturization and increased computing that more data is likely going to result in
capabilities into very small form factors. Add more data-related jobs required in their
to the mix the desire for quicker installations, organizations to make sense of the data—
elimination of wires, lower cost deployments, possibly a large and ongoing expense.
quicker realization of value and expectations Ultimately, the corporate business owners are
to keep up with changing standards and the most interested in ecosystems that leverage
shift to 4G/5G seems like the perfect storm. the data for the purposes of driving action.
To further the efficiency and looking That means action towards their goals and
longer term, many embedded wireless objectives: increased efficiency, better
sensing devices may do some amount of utilization, higher throughput, increasing
data analytics in the field—thereby providing safety, improved forecasting, reducing risks,
business opportunities for managing the flow optimized logistics, predictive maintenance
and format of the data more efficiently. and many other ways to drive value to their
To realize the dream of sensors monitoring stakeholders and partners. But, data without
equipment wherever there is a chance to action is, well…just data.
improve outcomes and efficiency, not only The convergence of low cost sensors, low
do the sensor devices require a low capital cost embedded wireless devices and low-
cost, but also a low operating cost. To achieve cost communications is the perfect trifecta
both of these objectives simultaneously, the to driving sensors (across an enterprise)
ideal technology would be able to transmit into every nook and cranny of operations
great distances on low power locally while and equipment to identify opportunities for
also requiring an order of magnitude (or two improvements. Initially, many business cases
or three) less back-haul infrastructure—and may be based on optimistic expectations
ideally in an open spectrum. of results that will deliver a return in a
For many companies looking to the future, reasonable period of time. Soon however, the
Long Range low power technology (LoRa) is the devices and connections will be so ubiquitous
platform of choice upon which they are basing and easy to deploy that business owners may
their embedded designs. With the advent of speculatively place sensors in places they are
LoRaWAN there is increased interoperability, unsure if they will derive value—but use the
improved security options and an emerging data for modeling and evaluating alternatives.
public network to support untold numbers Should the creative, innovative and
of embedded wireless sensing devices at possibly lucky placement of sensors in novel
extremely low prices. If predictions are to be locations prove to be valuable it will naturally
believed, systems will emerge that require beg the question: “Where haven’t we put
only $1 of capital expense per device that is sensors that could give us even more insight?”
connected via LoRaWAN for just pennies a This is only half the story—the other half is
month. automatically using the data to control
equipment and processes throughout the
ALL ABOUT ACTIONABLE operation and supply chain. We’ll save that for
Data analysts love with the idea of another article.
TECH THE FUTURE

generating more data, cellular providers

love the idea of supporting more data from
more devices and embedded sensing device
manufacturers love the idea of selling more
devices that generate more data. However,
corporate customers are wary about collecting
more data on their operations just for the
privilege of having more data. In addition to
the capital expenses for infrastructure and
devices, there are the operating expenses for
connectivity, data hosting/analytics and for
ongoing maintenance.

Brent T. Ward is responsible for business and strategy development, marketing and sales activities. He has had experience working in multiple spin-offs
and start-up’s out of RTI, RTP, and Silicon Valley. Brent holds a bachelor’s degree in electrical engineering and psychology, a master’s degree in electrical
engineering from Duke University and an MBA from Fredericton University.
 Whether you are an
EMS, CM or OEM,
let our bare boards be the foundation
you build your reputation upon!
Technology: Materials:
Up to 50 Layers Fr4
Any Layer HDI Metal Core
Sequential Lamination Isola
Blind / Buried Vias Rogers
Laser Drilling / Routing Polyimide - Flex
Heavy Copper Magtron
We will make only what is needed,
when it’s needed,
and in the amount needed.
You no longer have to worry about long shelf life
or tie your capital in bare board inventory.

www.PCB4u.com sales@PCB4u.com
 AUTOMATED
SMART
INDUSTRIAL
INTERNET OF PRODUCTIVE THINGS
MESHED
LOW POWER
INTELLIGENT
CUSTOMIZED
LINKED
PERCEPTIVE
CONNECTED
SCRIPTED
HELPFUL
RUGGED
RELIABLE
WEARABLE
LIFE SAVING
BENEFICIAL
TS-7553-V2
Single Board
Single Computer
Board Computer Computer on Module Touch Panel PC
Technologic Systems introduces the TS-7553-V2, a single board computer
that is a low power, cost effective, Internet-of-Things (IoT) capable, and
ready-to-deploy OEM board with an emphasis on data integrity.

With the TS-7553-V2 connect to Ethernet, WiFi, Bluetooth, USB, RS-232,

RS-485, and CAN networks or devices. Built in module interfaces like the
XBee/NimbeLink socket and internal USB ports allow expansion to other
TS-7680 TS-4900
networks like Cellular, DigiMesh, ZigBee, Lora, and TS-TPC-7990
other proprietary or
Low Power Industrial Industrial High Performance 7” High End i.MX6 Mountable
Single Board Computer with
industry specific networks. This ability to communicate over a wide variety
i.MX6 Module with Wireless Panel PC with Dev Tools Such
WiFi and Bluetooth of wired and wirelessand
Connectivity interfaces puts the TS-7553-V2
Flash Storage as Debian GNU inand
an QTCreator
excellent
Starting at position to be an industria
Starting at IoT gateway. Starting at
$159 $89
For specifications goQty
to100
www.embeddedARM.com/TS-7553-V2
Qty 100
$299
Qty 100

Board Support Packages,

Source Code and Toolchains Available
FE

AL
D

EN
LI

IN
GG

@ts_embedded
G

OP

IG
N

RU

OR
LO