About Circuit Cellar Staff

Circuit Cellar's editorial team comprises professional engineers, technical editors, and digital media specialists. You can reach the Editorial Department at editorial@circuitcellar.com, @circuitcellar, and facebook.com/circuitcellar

Understanding Embedded Security

Protecting products and intellectual property (IP) from attackers is a fairly new concept that many engineers have not yet had to face. It is only a matter of time, though, until products—which are becoming more embedded and integrated with the real world—become targets for attacks leading to theft of service, loss of revenue, or a damaged corporate reputation. Consumer electronics, financial and medical technology, and network products are all at risk.

In this article, I’ll focus on the “why” and the “what” of embedded security, also known as secure hardware. Why does it matter? Why is it important to you, the designer? In what ways can someone attack your product? Because you can’t incorporate secure design methods without understanding what you are protecting and why, this article is a fitting introduction to the complexities of embedded security.

Reading this article won’t turn you into a security expert overnight. Nor will it provide all the answers to your secure hardware design needs. But, it will help you understand the major classes of attack and the mindsets of potential attackers. Actual secure hardware mechanisms come in all shapes and sizes, ranging from tamper-resistant enclosures to embedded IC dies in PCBs (to make them more difficult to probe). I’ll discuss these in a future Circuit Cellar article.

What embedded security typically comes down to is this: Is the cost of a successful attack greater than the value of what’s being protected? I’ll present some guidelines to help you make a determination.

UNDERSTAND YOUR RISK

As with everything in engineering, embedded security is all about trade-offs—risk management, as they say in the business world. Are there components or data in your system that need to be protected? If so, how much is it worth to protect them?

Forget what the glossy marketing material says about security products. There’s never a single answer and a single product to solve everybody’s product security needs. Every product has its own threat risks and is susceptible to certain types of attacks. Before being able to make an educated, informed decision, you need to understand the threat, the value of the contents being protected, and the reason for protecting such contents. Essentially, weaker, more vulnerable devices should contain less valuable secrets.

For example, a priceless family heirloom might be stored in a fireproof and tool-resistant safe. However, it wouldn’t make much financial sense to purchase such a safe to store an easily replaceable, inexpensive piece of jewelry. By the same token, it wouldn’t be feasible to implement an extremely secure, multilayered hardware solution just to protect a single password that is used to access undocumented features in a mobile phone; but, it would be in order to protect a financial institution’s cryptographic keys used for encrypted communications whose theft could result in the loss of millions of dollars.

When defining the security envelope of your product, there are three questions you should ask yourself (or your design team). First, what needs to be protected? Identify the critical components in your circuit that need to be protected before you start construction. It’s extremely difficult to implement proper security mechanisms after the fact. Such components to protect may include specific algorithms, device identifiers, digital media, biometrics, cryptographic keys, or product firmware. In addition to protecting discrete data contents, you may be interested in implementing a secure product boot sequence, secure field programmability, or a secure remote-management interface. Be aware that in some cases, even noncritical portions of your design can unknowingly compromise the security of the system, especially if they fail in an unanticipated way.

Second, why is it being protected? In most situations, critical data is being protected to prevent a specific attack threat. Ignoring or overlooking the possibility of attack can lead to a vulnerable product. In some countries, protecting certain content may be a legislative requirement. For example, a medical device containing confidential patient information must be secured in order to meet the U.S. Health Insurance Portability and Accountability Act (HIPAA) requirements.

Finally, whom are you protecting against? The types of attackers vary, ranging from a curious, harmless hardware hacker to an entire group of researchers backed by a competitor, organized crime, or government. As such, it’s important to attempt to properly identify the skill level and theoretical goals of the primary attackers against your product.

As a designer, you have the challenging task and responsibility of creating and ensuring your system’s security. You must understand every possible aspect of the design and are typically constrained by technical, financial, and political agendas. Attackers have an easier job, which is to exploit insecurities in the system. They need only to discover one vulnerable area of the design, and they typically have few constraints on their methods. They’ll likely choose the attack that yields the best results in the easiest and most repeatable fashion.

CLASSES OF ATTACK

No system will ever be 100% secure. “Secure” simply can be defined as when the time and money required to break the product is greater than the benefits to be derived from the effort. Given enough determination, time, and resources, an attacker can break any system.

At the highest level, four classes of security threat exist, as described by C.P. Pfleeger in Security in Computing. Through interception (or eavesdropping) an attacker can gain access to protected information without opening the product. With embedded systems, this can be achieved by monitoring the external interfaces of the device and by analyzing compromising signals within electromagnetic radiation or current fluctuations. On a computer network, this can be done by illicitly copying data or through promiscuous mode network monitoring. Although a loss may be discovered fairly quickly for certain attacks, like credit card theft or spoofed user authentication, a silent interceptor might not leave any traces.

Interruption (or fault generation) is a threat because an asset of a product becomes unavailable, unusable, or removed. An example is the malicious destruction of a hardware device, the intentional erasure of program or data contents, or a denial-of-service network attack. Fault generation consists of intentionally provoking malfunctions, such as operating the device under abnormal environmental conditions, which may lead to the bypassing of certain security measures.

The third type of threat is modification, which involves tampering with a product’s asset. Modification is typically an invasive technique for both hardware (e.g., circuit modifications or microprobing) and software/firmware (e.g., changing the values of data or altering a program so that it performs a different computation).

Lastly, fabrication creates counterfeit assets in a product or system. Fabrication can come in many forms, including adding data to a device, inserting spurious transactions into a bus or interface, and a man-in-the-middle attack on a network. Sometimes these additions can be detected as forgeries, but if skillfully done, they may be indistinguishable from the real thing.

TYPICAL ATTACK GOALS

When a product is targeted, the attacker usually has a goal in mind. This may be a simple goal, such as reverse engineering the circuitry in order to personalize or customize the device, or a more dedicated one, such as retrieving cryptographic keys or sensitive product trade secrets.

The specific goal of an attack tends to fit into one of four categories. The first is competition (or cloning), which is a scenario in which an attacker (usually a competitor) reverse engineers or copies specific IP in order to gain an advantage in the marketplace. The goal is to improve a product by using the stolen technology or to sell lower-priced knockoffs. Common target areas are circuit board features and product firmware.

Theft-of-service attacks aim to obtain a service for free that usually requires payment. Examples include mobile phone cloning, bypassing copy protection schemes on video game systems, and modifying cable boxes to receive extra channels.

User authentication (or spoofing) attacks are typically focused on products that are used to verify the owner’s identity, such as an authentication token, smartcard, biometric reader, or one-time-password generator. The attacker’s main goal is to gain access to personalized data and systems by spoofing the identity of the legitimate user.

Privilege escalation (or feature unlocking) attacks are aimed at accessing the hidden/undocumented features of a product and increasing the amount of control given to the user without having legitimate credentials. For example, using specialized circuitry to communicate with a mobile phone to gain access to phone diagnostics or acquiring administrator access on a network appliance.

Generally, an attack is achieved in one of three ways. In a focused attack, the adversary brings the target product into a private location to analyze and attack it on his or her own time with little risk of being discovered. A focused attack is probably the most familiar type of attack. Consider a curious student modifying a piece of hardware in his dorm room or a more determined criminal in a laboratory attempting to crack encryption routines.

Lunchtime attacks often take place during a small window of opportunity, such as a lunch or coffee break. Typically, the attack would need to be completed in a short period of time, ranging from a few minutes to a few hours. Lunchtime attacks are risky because they are easily detected if the target product is missing or has visibly been tampered with. For example, if you check your coat at a restaurant, an attacker could remove your PDA, retrieve the desired data, and return the PDA to your coat pocket within a matter of minutes and without being detected. Another example is an attacker copying data from a target’s authentication token or USB thumb drive that they left on their desk while attending a meeting.

Finally, there’s the insider attack, which may come in the form of run-on fraud by a manufacturer (producing additional identical units of a product to be sold on the gray market) or a disgruntled employee willing to sabotage the product or sell critical information such as system firmware or encryption keys. Many, but not all, insider threats can be thwarted with strict compartmentalization of critical data, access control, and chain-of-custody policies.

PRODUCT ACCESS

There are many ways an attacker can gain access to your product, but it often corresponds directly to the attack goal and usually involves one of four methods. In the first instance, the attacker purchases the product through a retail outlet, often with no means of detection (e.g., paying with cash). Multiple products could be purchased, with the first few serving as disposable units to aid in reverse engineering or to discover any existing tamper mechanisms. This scenario may be financially prohibitive for low-budget attackers but is typical for most focused attacks.

In the second instance, the attacker rents or leases the product from a vendor, distributor, or rental company, often on a monthly basis. Most attack types are possible in this instance, but because there is a high risk of detection when the product is returned, attackers will be cautious not to tamper with it.

In some cases, the attacker does not own the target product. The product is in active operation and may belong to a specific person (e.g., a mobile phone or smartcard), but the attacker may have physical access to the product. This is the most difficult type of attack because risk of detection is high.

In the final scenario, the attacker does not have access to the product, so all attacks are performed remotely (e.g., through a wired or wireless network). The attacker does not require special hardware tools and can easily mask his location. The risk of detection is low. Remote access attacks are common against computer networking equipment and appliances, such as routers, firewalls, access points, web servers, and storage area networks.

UNDERSTAND THE ATTACKER

“The only way to stop an attacker is to think like one.” That’s a favorite saying of mine. An FBI profiler tries to put himself in the mind of his subject. You must do the same when figuring out what, if any, security features you need to implement in our design. Today, because of advances in technology, the lower cost of products, and easy access to once-specialized tools, attacks against hardware are becoming more prevalent.

Attackers can be classified into three groups depending on their expected abilities and strengths: class I (clever outsiders), class II (knowledgeable insiders), and class III (funded organizations). This classification is essentially an industry standard for describing attackers in an academic fashion.[1]

Class I attackers are often extremely intelligent but might have insufficient knowledge of the system. They might have access to only moderately sophisticated equipment. They often try to take advantage of an existing weakness in the system rather than try to create one. Sometimes referred to as “script kiddies” in the computer security industry, these attackers run preprogrammed scripts to exploit known security vulnerabilities instead of finding their own.

Class II attackers have a substantial amount of specialized technical education and experience. They have a decent knowledge of the product or system, and often have highly sophisticated tools and instruments for analysis.

Class III attackers are teams of specialists with related and complementary skills backed by great funding. They are capable of performing in-depth system analysis, designing sophisticated attacks, and using the most advanced analysis tools. They may use Class II adversaries as part of the attack team.

Table 1 is comparison of each attacker class against available resources. The table may help to visualize the capabilities of the various attacker groups.

Table 1: Take a look at each attacker class compared to available resources. As you can see, each class has specific capabilities that will play a part in determining your product’s risk of attack.[2]

Table 1: Take a look at each attacker class compared to available resources. As you can see, each class has specific capabilities that will play a part in determining your product’s risk of attack.[2]

ADDING SECURITY

Security is a process, not a product. Security must be designed into your product during the conceptual design phase, and it should be considered for every portion of the design. It must be continually monitored and updated in order to have the maximum effect against attacks. Security can’t be added to a product and forgotten about. The product won’t remain secure forever.

Many times, an engineering change will be made to the product circuitry or firmware without a reevaluation of system security. Without a process in place to analyze changes throughout the design cycle, security that was properly implemented at the beginning of the design may become irrelevant by the time the product goes into production.

The primary concern is to incorporate risk analysis and security considerations into each step of your product’s development life cycle. Five principles, which are based on recommendations from the National Institute of Standards and Technology, serve as a good checklist. For more information, refer to “Engineering Principles for Information Technology Security (A Baseline for Achieving Security)” by G. Stoneburner et al. Let’s take a look at each one.

First, treat security as an integral part of your overall product design. It’s extremely difficult to implement security measures properly and successfully after a system has been developed.

Second, reduce risk to an acceptable level. Elimination of all risk is not cost-effective and likely impossible because nothing is 100% secure. A cost-benefit analysis should be conducted for each proposed secure hardware mechanism to ensure that it is performing its intended task at a desired cost.

Next, implement layered security. (Ensure no single point of failure.) Consider a layered approach of multiple security mechanisms to protect against a specific threat or to reduce overall vulnerability.

Fourth, minimize the system elements you’re relying on. Security measures include people, operations, and technology. The system should be designed so that a minimum number of elements need to be trusted in order to maintain protection. Put all your eggs in one basket by isolating all critical content in one secure area (physical or virtual) instead of having multiple secure areas throughout the design. This way, you can focus on properly securing and testing a single critical area of the product instead of numerous disparate areas.

Finally, don’t implement unnecessary security mechanisms. Every security mechanism should support one or more defined goals. Extra measures should not be implemented if they do not support a goal because they could add unneeded complexity to the system and are potential sources of additional vulnerabilities.

KEYS TO THE KINGDOM

Understanding and evaluating the risks and threats against your product is the first step toward a successful secure hardware design. There are many combinations of potential vulnerabilities, and it’s impossible to prevent against all of them. The good news is that vendors have recognized the need for embedded security, and we’re starting to see ICs and modules that reflect that. The more you can spread the word to your colleagues about making secure products, the safer all of us will be.

I’ve just started to scratch the surface of the embedded security topic. In a future article, I’ll take a no-nonsense look at a wide variety of practical secure hardware design solutions that you can implement in your product.


REFERENCES

[1] D.G. Abraham et al, “Transaction Security System,” IBM Systems Journal, vol. 30, no. 2, 1991, www.research.ibm.com/journal/sj/302/ibmsj3002G.pdf.

[2] P. Kocher, “Crypto Due Diligence,” RSA Conference 2000.

RESOURCES

C.P. Pfleeger, Security in Computing, 2nd ed., Prentice Hall, 2000.

G. Stoneburner et al., “Engineering Principles for Information Technology Security (A Baseline for Achieving Security),” NIST Special Publication 800-27, June 2001, csrc.nist.gov/publications/nistpubs/800-27/sp800-27.pdf.


AUTHOR

Joe Grand specializes in embedded system design, computer security research, and inventing new concepts and technologies. Joe holds a B.S.C.E. from Boston University. This article first appeared in Circuit Cellar 169, 2004.

Next-Generation 8-bit tinyAVR Microcontrollers

Microchip Technology recently launched a new generation of 8-bit tinyAVR microcontrollers. The four new devices range from 14 to 24 pins and 4 KB to 8 KB of flash memory. Furthermore, they are the first tinyAVR microcontrollers to feature Core Independent Peripherals (CIPs). The new devices will be supported by Atmel START, an innovative online tool for intuitive, graphical configuration of embedded software projects.Microchip 8bittinyAVR

The new ATtiny817/816/814/417 devices provide features to help drive product innovation including small, low pin count and feature-rich packaging in 4 or 8 KB of flash memory. Other integrated features include:

  • A CIP called Peripheral Touch Controller (PTC)
  • Event System for peripheral co-operation
  • Custom programmable logic blocks
  • Self-programming for firmware upgrades
  • Nonvolatile data storage
  • 20-MHz internal oscillator
  • High-speed serial communication with USART
  • Operating voltages ranging from 1.8 to 5.5 V
  • 10-bit ADC with internal voltage references
  • Sleep currents at less than 100 nA in power down mode with SRAM retention

CIPs allow the peripherals to operate independently of the core, including serial communication and analog peripherals. Together with the Event System, that allows peripherals to communicate without using the CPU and applications can be optimized at a system level. This lowers power consumption and increases throughput and system reliability.

Accompanying the release of the four new devices, Microchip is adding support for the new AVR family in Atmel START, the online tool to configure software components and tailor embedded applications. This tool is free of charge and offers an optimized framework that allows the user to focus on adding differentiating features to their application.

To help accelerate evaluation and development, a new Xplained Mini Kit is now available for $8.88 USD. The Xplained Mini Kit is also compatible with the Arduino kit ecosystem. The kit can be used for standalone development and is fully supported by the Atmel START and Atmel Studio 7 software development tools.

The new generation of 8-bit tinyAVR MCUs is now available in QFN and SOIC packaging. Devices are available in 4 KB and 8 KB Flash variants, with volume pricing starting at $0.43 for 10,000-unit quantities.

Source: Microchip Technology

Simplified Smart Home Device Creation with New Apple HomeKit Bluetooth Dev Kit

Dialog Semicondcutor’s new offering is the first SoC on the market with dedicated hardware acceleration for HomeKit security operations which ensures end-to-end application encryption, safeguarding personal information in transit. With the recent introduction of iOS 10, Apple HomeKit is now an integral part of iOS, including its dedicated app that creates an enhanced user experience. The Apple Home app is compatible not just with iPhone, but is also optimized for iPad and the Apple Watch running watchOS 3. With the app, an Apple TV or iPad can easily act as a smart home hub, enabling home control from anywhere.DialogSemi HomeKit521211

The SmartBond DA14681 supports Bluetooth 4.2 to provide seamless connectivity, and smartly balances power efficiency and performance, with an integrated ARM Cortex M0 processor and expandable flash memory. A Power Management Unit (PMU) provides three independent power rails, in addition to an on-chip charger and fuel gauge, allowing DA14681 to recharge batteries over a USB interface.

Its integrated topology streamlines development, minimizes BOM cost and enables the kit to consume less than five µA on standby. The development kit maximizes application space and flexibility, using a mere 170 KB of flash memory and provides 64 KB of RAM for apps to utilize, even allowing user defined profiles to further customize applications on top of pre-configured HomeKit profiles.

To give developers all of the tools they need to create next-generation IoT applications, the DA14681 development kit consists of the HomeKit SDK, Basic and Pro versions of the kit, and a flexible add-on board to interface with the separately available MFi chip. The new HomeKit development kit and add-on board are now available from Avnet, Digi-Key and Mouser.

Source: Dialog Semiconductor 

Battery-Free, Energy-Harvesting BLE Module Features nRF51822 SoC

EnOcean recently selected Nordic Semiconductor’s nRF51822 Bluetooth low energy SoC for its Dolphin PTM 215B pushbutton transmitter module, which is well suited for use in smart lighting applications. Using a miniaturize electro-dynamic energy transducer to convert motion, light, or temperature differences into electrical energy, the module is an excellent option for engineers designing flexible, energy-efficiency in smart building and IoT lighting applications.nordic nRF51822 EnOcean Dolphin

The nRF51822 was selected because harvested energy is sufficient to power wireless control of Bluetooth low energy peripherals such as smart light bulbs. A powerful multiprotocol SoC, nRF51822 is  built around a 32-bit ARM Cortex M0 CPU with 256/128 KB flash and 32/16 KB RAM. The embedded 2.4-GHz transceiver is fully compliant with Bluetooth 4.2.

Source: Nordic Semiconductor

New 40-A µModule Regulator with 3-D Stacked-Inductor Packaging

Linear Technology recently introduced the LTM4636, which is a 40-A step-down µModule switching regulator with 3D construction for quicker heat dissipation and cooler operation in a small package. By stacking its inductor on top of a 16 mm × 16 mm BGA package, the LTM4636 benefits from the exposed inductor as a heat sink, permitting direct contact with airflow from any direction to cool the device.Linear LTM4636

The LTM4636 features, specs, and benefits:

  • Stacked inductor acts as heatsink; exposed inductor on top of package (3D construction)
  • Scalable: two to six devices in parallel delivers 80-to-240-A load current
  • Delivers 40 W (12 VIN, 1 VOUT, 40 A, 200 LFM) with only 40°C rise over ambient temperature.
  • Full-power 40 W is delivered up to 83°C ambient; half-power 20 W is supported at 110°C ambient.
  • Operates at 92%, 90% and 88% efficiency, delivering 15 A, 30 A, and 40 A, respectively, to a 1-V load (12 VIN). Designed to uniformly disperse heat from the bottom of the package to the PCB with 144 BGA solder balls, with banks of them assigned to GND, VIN, and VOUT where high current flows.
  • Operates from a 4.7 to 15 V input supply and regulates an output voltage from 0.6 to 3.3 V.
  • Total DC output voltage accuracy is ±3% from –40°C to 125°C.

The LTM4636 costs $38.85 in 1,000-piece quantities.

Source: Linear Technology

Notable Crowdfunded Projects (Week of 11/21/16)

Here is a roundup of current crowdfunded projects that the Circuit Cellar team finds interesting. Check them out and let us know what you think.


RS-HFIQ 5W Software Defined Radio (SDR) Transceiver

HobbyPCB’s RS-HFIQ is a high-performance software-defined radio (SDR) 5-W transceiver for CW, SSB, AM, FM, and digital modes. As of 11/22/16, this project has nine days remaining.

Not just another SDR – The RS-HFIQ offers real RF performance for serious communications. Covering the 80-10M Amatuer Radio bands with excellent RX performance and 5 watts of TX power, using open-source SDR software for CW, SSB, AM, FM and digital modes, the RS-HFIQ sets a new standard for shortwave SDR communications.

Visit the Project Page.


QuadBot – Real Robotics, Made Accessible

EngiMake’s QuadBot is a 3-D-printable, programmable walking robot intended for DIYers/makers, aspiring roboticists, and experienced hackers. As of 11/22/16, this project has 47 days remaining.

QuadBot can walk, dance, light up and with sensors it can follow you, avoid obstacles, play songs… anything is possible! But the real value is the open-ness of QuadBot. Rather than limit you to only a few behaviours, we’ve opened up the entire code and design so you can hack it to do anything.  That means if you want to learn basic robotics, you can follow our standard guide, but when you’re ready to activate super maker mode, you can break-out and use QuadBot to explore robotics.


Visit the Project Page.


FiPy IoT Dev Board

Pycom’s FiPy is a five-network IoT development board. As of 11/22/16, this project has 30 days remaining.

Simply put, we give you a 5 networks in one simple small, perfectly formed, same-foot-print-as-WiPy-and-LoPy hardware module at a price squeezed right down to €33 (early bird) and €49 after Kickstarter.

Visit the Project Page.

New USB Micromodule Transceiver Protects Against High Voltages

Linear Technology Corp. recently introduced the LTM2894 USB µModule (micromodule) reinforced isolator that guards against ground-to-ground voltage differentials and large common-mode transients. With a rugged interface and internal isolation, the LTM2894 is well suited for implementing USB in harsh environments where protection from high voltages is needed.LTM2894

The LTM2894’s features, specs, and benefits:

  • Isolated USB Transceiver: 7,500 VRMS for 1 minute
  • USB 2.0 Full sspeed and low speed compatible
  • Auto-configuration of USB bus speed
  • 4.4-to-36 V VBUS and VBUS2 opperating range
  • 3.3-V LDO Output supply signal references: VLO, VLO2
  • 50-kV/µs Common mode transient immunity
  • ±20-kV HBM ESD on USB interface pins
  • 1414 VPEAK Maximum continuous working voltage
  • 17.4-mm Creepage distance
  • 22 mm × 6.25 mm BGA Package

Source: Linear Technology

Multi-Protocol Sub-GHz Wireless Transceiver Platform

NXP Semiconductors recently added the OL2385 family sub-GHz wireless transceivers to its low-power microcontroller and 2.4 GHz portfolio for Internet of Things (IoT) applications. Based on a PIN-to-PIN compatible, sub-GHz transceiver hardware platform, the OL2385 supports multiple wireless protocols  (e.g., Sigfox, W-MBus powered by Xemex, and ZigBee IEEE 802.15.4).

With a two-way RF channel and common modulation schemes for networking applicatios, the OL2385 transceivers cover a wide range of frequency bands from 160 to 960 MHz. In addition, extended range radio operation is enabled with high sensitivity up to –128 dBm. Operation in congested environments is enhanced with 60 dB at 1 MHz of blocking performance and 60 dB of image rejection.

Platform features include: 14-dBm Tx output power compliant with ETSI limits; typical 29-mA transmit power consumption at full output power; less than 11 mA receive power consumption; excellent phase noise of –127 dBc at 1 MHz in the 868- and 915-MHz band for flexibility with external power amplifiers; and Japanese ARIB T108 standard compliant.

The OL2385 platform samples and development boards with SIGFOX are currently available. Mass production of preprogrammed parts are scheduled for the end of Q4 2017.

Source: NXP Semiconductors

Ambiq Micro’s Apollo Platform Selected for Fossil Smartwatches

Ambiq Micro recently announced that its patented Apollo Platform with Subthreshold Power Optimized Technology (SPOT) was selected for Fossil Group’s hybrid smartwatches. According to Ambiq, the Apollo platform will manage smartwatch operations such as processing sensor inputs and controlling wireless communication.

The energy-efficient Apollo microcontroller is based on the 32-bit ARM Cortex M-4 with FPU. It provides a high level of performance per watt, which enables designers to extended a systems battery life, incorporate smaller or fewer batteries, and add new features. Furthermore, the Apollo Platform consumes  34 µA/MHz when executing instructions from flash memory, and it features Sleep mode currents as low as 140 nA.

Source: Ambiq Micro

Taking the “Hard” Out of Hardware

There’s this belief among my software developer friends that electronics are complicated, hardware is hard, and that you need a degree before you can design anything to do with electricity. They honestly believe that building electronics is more complicated than writing intricate software—that is, the software which powers thousands of people’s lives all around the world. It’s this mentality that confuses me. How can you write all of this incredible software, but a believe a simple 555 timer circuit is complicated?

I wanted to discover where the idea that “hardware is hard” came from and how I could disprove it. I started with something with which almost everyone is familiar, LEGO. I spent my childhood playing with these tiny plastic bricks, building anything my seven-year-old mind could dream up, creating intricate constructions from seemingly simplistic pieces. Much like the way you build LEGO designs, electronic systems are built upon a foundation of simple components.

When you decide to design/build a system, you want to first start by breaking down the system into components and functional sections that are easy to understand. You can use this approach for both digital and analog systems. The example I like use to explain this is a phase-locked loop frequency modulator demodulator/detector, a seemingly complicated device used to decode frequency modulated radio signals. This system sounds like it would be impossible to build, especially for someone who isn’t familiar with electronics. I can recognize that from experience. I remember the first year of my undergraduate studies where my lecturers would place extremely detailed circuit schematics up on a chalkboard and expect us to be able to understand high-level functionality. I recall the panic this induced in a number of my peers and very likely put them off electronics in later years. One of the biggest problems that an electronics instructor faces is teaching complexity without scaring away students.

This essay appears in Circuit Cellar 317, December 2016. Subscribe to Circuit Cellar to read project articles, essays, interviews, and tutorials every month!

 

What many people either don’t realize or aren’t taught is that most systems can be broken down into composite pieces. The PLL FM demodulator breaks into three main elements: the phase detector, a voltage controlled oscillator (VCO) and a loop filter. These smaller pieces, or “building blocks,” can then be separated even further. For example, the loop filter—an element of the circuit used to remove high-frequency—is constructed from a simple combination of resistors, capacitors, and operational amplifiers (see Figure 1).Figure 1

I’m going to use a bottom-up approach to explain the loop filter segment of this system using simple resistors (R) and capacitors (C). It is this combination of resistors and capacitors allows you to create passive RC filters—circuits which work by allowing only specific frequencies to pass to the output. Figure 2 shows a low-pass filter. This is used to remove high-frequency signals from the output of a circuit. Note: I’m avoiding as much math as possible in this explanation, as you don’t need numerical examples to demonstrate behavior. That can come later! The performance of this RC filter can be improved by adding an amplification stage using an op-amp, as we’ll see next.Figure 2

Op-amps are a nice example of abstraction in electronics. We don’t normally worry about their internals, much like a CPU or other ICs, and rather treat them like functional boxes with inputs and an output. As you can see in Figure 3, the op-amp is working in a “differential” mode to try to equalize the voltages at its negative and positive terminals. It does this by outputting the difference and feeding it back to the negative terminal via a feedback loop created by the potential divider (voltage divider) at R2 and R3. The differential effect between the op-amp’s two input terminals causes a “boosted” output that is determined by the values of R2 and R3. This amplification, in combination with the low-pass passive filter, creates what’s known as a low-pass active filter.Figure 3

The low-pass active filter would be one of a number of filtering elements within the loop filter, and we already built up one of the circuit’s three main elements! This example starts to show how behavior is cumulative. As you gain knowledge about fundamental components, you’ll start to understand how more complex systems work. Almost all of electronic systems have this building block format. So, yes, there might be a number of behaviors to understand. But as soon as you learn the fundamentals, you can start to design and build complicated systems of your own!

Alex Bucknall earned a Bachelor’s in Electronic Engineering at the University of Warwick, UK. He is particularily interested in FPGAs and communications systems. Alex works as a Developer Evangelist for Sigfox, which is offering simple and low-energy communication solutions for the Internet of Things.

New I/O-Rich Embedded Computing Solutions

Diamond Systems recently unveiled the Eagle family rugged ARM SBCs and carrier boards.  Intended to work with the Toradex Apalis family of ARM computer-on-modules (CoMs), the Eagle family comprises two models—the full-size, full-featured Eagle and the smaller low-cost Eaglet.DiamondEagle

You can purchase a fully-configured off-the-shelf solution comprsing a select ARM module and heatsink. Anoher option is to the baseboard and ARM module separately for greater configuration flexibility and lower unit cost. Development kits are available that include the fully configured SBC, preconfigured Linux OS on a microSD card, and a full cable kit.

The Eagle/Eaglet family units feature long product lifetimes, configuration flexibility, and a wide range of I/O. The Eagle/Eaglet family with the Toradex Apalis family of ARM modules provides a scalable platform for embedded computing applications with interchangeable processors similar to the CoM Express concept. All CoMs in the Apalis Family are pin-compatible to ensure seamless platform upgrades. With Eagle, you can extend a product’s lifecycle by upgrading to a new Apalis module and installing Eaglet compact ARM Baseboard new driver software.

The Eagle SBC with installed ARM module and heatsink starts at $650. The Eaglet SBC in a similar configuration starts at $420. The Eagle baseboard single unit pricing is $450. The Eaglet baseboard single unit prices is $220. Shipments are expected to begin in December 2016.

Source: Diamond Systems

New Isolated Buck Transformers

Wurth Electronics Midcom recently launched a new series of isolated buck transformers for Maxim Integrated’s MAX17681 converter.  Built on self-shielding packages, the pick-and-placeable transformers have a small form factor and losses. The high-efficiency MAX17681 converter eliminates the need for optocoupler feedback circuits, it can deliver up to 3 W of output power.Wurth MID-IMAXIB

You can use the transformers in wide variety of applications, such as isolated fieldbus interfaces, PLC input/output modules, smart meters, medical equipment, and floating power supply generation. Free samples are available at www.we-online.com/midcom.

Source: Wurth Electronics

IAR Workbench Supports Next-Generation AVR MCUs

IAR Systems recently announced that its Embedded Workbench now supports a new generation of Microchip Technology 8-bit AVR microcontrollers. You can use Workbench with AVR microcontrollers to develop a wide range of low-power systems.

IAR Embedded Workbench’s features, benefits, and specs:

  • The compiler and debugger toolchain IAR Embedded Workbench incorporates the IAR C/C++ Compiler, which can create compact code for Microchip’s 8-bit AVR MCUs
  • IDE tools (editor, project manager, and library tools)
  • Build tools (compiler, assembler, and linker)
  • C-SPY debugger (simulator driver, hardware debugging, power debgging, and RTOS plugins
  • IAR Embedded Workbench offers full-scale support for AVR 32-bit MCUs as well as Microchip’s ARM®-based and 8051-based MCUs families.

Source: IAR Systems

Siemens to Acquire Mentor Graphics for $4.5 Billion

Siemens announced it will acquire Oregon, US-based Mentor Graphics for $4.5 billion in an effort to expand its reach into the automation and industrial software market.

“Combining Mentor’s technology leadership and deep customer relationships with Siemens’ global scale and resources will better enable us to serve the growing needs of our customers, and unlock additional significant opportunities for our employees,” said Walden C. Rhines, chairman and CEO of Mentor, in a release posted on November 14, 2016.

Source: Siemens

Electrical Engineering Crossword (Issue 317)

317 grid (key)

Across

  1. ELEVENTH—Undenary
  2. POSITION—What does a linear sensor read?
  3. CALCULATOR—Herzstark’s Curta
  4. PETA—1015
  5. SHUNTREGULATOR—Stabilizes voltage fluctuations [two words]
  6. COPPER—Conductive trace material
  7. LUMEN—A lux is one of these per square meter
  8. MULTIPLIER—*
  9. ANNULUS—Little ring

Down

  1. VARISTOR—Often used to suppress AC line spikes
  2. CHANGE—Delta
  3. RECKONER—Leibniz’s digital mechanical calculator
  4. DUT—To what does a scope probe connect test equipment?
  5. KERNEL—Nucleus
  6. DUCKING—A system for controlling one audio signal’s level with another
  7. SEVENTH—Septenary
  8. RMS—Crest factor is the ratio of peak value to which value?
  9. LOCKOUT—Prevent operation
  10. ROOT—Top directory
  11. TEMPORARY—Temporary Foo file
  12. REQUEST—System call