The Future of Commodity Hardware Security and Your Data

The emergence of the smartphone industry has enabled the commodity hardware market to expand at an astonishing rate. Providers are creating cheap, compact, and widely compatible hardware, which bring about underestimated and unexplored security vulnerabilities. Often, this hardware is coupled with back end and front end software designed to handle data-sensitive applications such as mobile point-of-sale, home security, and health and fitness, among others. Given the personal data passed through these hardware devices and the infancy of much of the market, potential security holes are a unique and growing concern. Hardware providers face many challenges when dealing with these security vulnerabilities, foremost among them being distribution and consequent deprecation issues, and the battle of cost versus security.

The encryption chip for the Square Reader, a commodity hardware device, is located in the bottom right hand corner instead of on the magnetic head. This drastically reduces the cost of the device.

The encryption chip for the Square Reader, a commodity hardware device, is located in the bottom right hand corner instead of on the magnetic head. This drastically reduces the cost of the device.

An important part of designing a hardware device is being prepared for a straightforward hardware deprecation. However, this can be a thorn in a provider’s side, especially when dealing with widespread production. These companies create on the order of millions of copies of each revision of their hardware. If the hardware has a critical security vulnerability post-distribution, the provider must develop a way to not only deprecate the revision, but also fix the problem and distribute the fix to their customers. A hardware security vulnerability can be very detrimental to companies unless a clever solution through companion software is possible to patch the issue and avoid a hardware recall. In lieu of this, products may require a full recall, which can be messy and ineffective unless the provider has a way to prevent future, malicious use of the insecure previous revision.

Many hardware providers have begun opting out of conventional product payments and have instead turned to subscription or use-based payments. Hence, the provider may charge low prices for the actual hardware, but still maintain high yields, typically through back end or front end companion software. For example, Arlo creates a home security camera with a feature that allows users to save videos through their cloud service and view the videos on their smartphone. The price of the camera (their hardware) is mid-range when measured against their competitors, but they charge a monthly fee for extra cloud storage. This enables Arlo to have a continual source of income beyond their hardware product. The hardware can be seen as a hook to a more stable source of income, so long as consumers continue to use their products. For this reason, it is critical that providers minimize costs of their hardware, even down to a single dollar—especially given their large-scale production. Unfortunately, the cost of the hardware is typically directly related to the security of the system. For example, a recent vulnerability found by me and my colleagues in the latest model Square Reader is the ability to convert the Reader to a credit card skimmer via a hardware encryption bypass. This vulnerability was possible due to the placement of the encryption chip on a ribbon cable offset from the magnetic head. If the encryption chip and magnetic head had been mounted to the Reader as an assembly, the attack would not have been possible. However, there is a drastic difference in the cost, on the order of several dollars per part, and therefore security was sacrificed for the bottom line. This is the kind of challenging decision every hardware company has to make in order to meet their business metrics, and often it can be difficult to find a middle ground where security is not sacrificed for expense.

New commodity hardware will continue to integrate into our personal lives and personal data as it becomes cheaper, more compact, and universally compatible. For these reasons, commodity hardware continues to present undetermined and intriguing security vulnerabilities. Concurrently, hardware providers confront these demanding security challenges unique to their industry. They face design issues for proper hardware deprecation due to massive distribution, and they play a constant tug-of-war between cost constraints and security, which typically ends with a less secure device. These potential security holes will remain a concern so long as the smartphone industry and commodity hardware market advance.

Alexandrea Mellen is the founder and chief developer at Terrapin Computing, LLC, which makes mobile applications. She presented as a briefing speaker at Black Hat USA 2015 (“Mobile Point of Scam: Attacking the Square Reader”). She also works in engineering sales at The Mellen Company, which manufactures and designs high-temperature lab furnaces. She has previously worked at New Valence Robotics, a 3-D printing company, as well as The Dorm Room Fund, a student-run venture firm. She holds a BS in Computer Engineering from Boston University. During her undergraduate years, she completed research on liquid metal batteries at MIT with Group Sadoway. See for more information.

Q&A with Arduino-Based Skube Codesigner

The Arduino-based Skube

The Arduino-based Skube

Andrew Spitz is a Copenhagen, Denmark-based sound designer, interaction designer, and programmer. Among his various innovative projects is the Arduino-based Skube music player, which is an innovative design that enables users to find and share music.

Spitz worked on the design with Andrew Nip, Ruben van der Vleuten, and Malthe Borch. Check out the video to see the Skube in action. On his blog, Spitz writes: “It is a fully working prototype through the combination of using ArduinoMax/MSP and an XBee wireless network. We access the API to populate the Skube with tracks and scrobble, and using their algorithms to find similar music when in Discover mode.”

Skube – A & Spotify Radio from Andrew Nip on Vimeo.

The following is an abridged  version of an interview that appears in the December 2012 issue of audioXpress magazine, a sister publication of Circuit Cellar magazine..

SHANNON BECKER: Tell us a little about your background and where you live.

Andrew Spitz: I’m half French, half South African. I grew up in France, but my parents are South African so when I was 17, I moved to South Africa. Last year, I decided to go back to school, and I’m now based in Copenhagen, Denmark where I’m earning a master’s degree at the Copenhagen Institute of Interaction Design (CID).

SHANNON: How did you become interested in sound design? Tell us about some of your initial projects.

Andrew: From the age of 16, I was a skydiving cameraman and I was obsessed with filming. So when it was time to do my undergraduate work, I decided to study film. I went to film school thinking that I would be doing cinematography, but I’m color blind and it turned out to be a bigger problem than I had hoped. At the same time, we had a lecturer in sound design named Jahn Beukes who was incredibly inspiring, and I discovered a passion for sound that has stayed with me.

Shannon: What do your interaction design studies at CIID entail? What do you plan to do with the additional education?

Andrew: CIID is focused on a user-centered approach to design, which involves finding intuitive solutions for products, software, and services using mostly technology as our medium. What this means in reality is that we spend a lot of time playing, hacking, prototyping, and basically building interactive things and experiences of some sort.

I’ve really committed to the shift from sound design to interaction design and it’s now my main focus. That said, I feel like I look at design from the lens of a sound designer as this is my background and what has formed me. Many designers around me are very visual, and I feel like my background gives me not only a different approach to the work but also enables me to see opportunities using sound as the catalyst for interactive experiences. Lots of my recent projects have been set in the intersection among technology, sound, and people.

SHANNON: You have worked as a sound effects recordist and editor, location recordist and sound designer for commercials, feature films, and documentaries. Tell us about some of these experiences?

ANDREW: I love all aspects of sound for different reasons. Because I do a lot of things and don’t focus on one, I end up having more of a general set of skills than going deep with one—this fits my personality very well. By doing different jobs within sound, I was able to have lots of different experiences, which I loved! nLocation recording enabled me to see really interesting things—from blowing up armored vehicles with rocket-propelled grenades (RPGs) to interviewing famous artists and presidents. And, documentaries enabled me to travel to amazing places such as Rwanda, Liberia, Mexico, and Nigeria. As a sound effects recordist on Jock of the Bushvelt, a 3-D animation, I recorded animals such as lions, baboons, and leopards in the South African bush. With Bakgat 2, I spent my time recording and editing rugby sounds to create a sound effects library. This time in my life has been a huge highlight, but I couldn’t see myself doing this forever. I love technology and design, which is why I made the move...

SHANNON: Where did the idea for Skube originate?

Andrew: Skube came out of the Tangible User Interface (TUI) class at CIID where we were tasked to rethink audio in the home context. So understanding how and where people share music was the jumping-off point for creating Skube.

We realized that as we move more toward a digital and online music listening experience, current portable music players are not adapted for this environment. Sharing mSkube Videousic in communal spaces is neither convenient nor easy, especially when we all have such different taste in music.

The result of our exploration was Skube. It is a music player that enables you to discover and share music and facilitates the decision process of picking tracks when in a communal setting.

audioXpress is an Elektor International Media publication.

Pulse-Shaping Basics

Pulse shaping (i.e., base-band filtering) can vastly improve the behavior of wired or wireless communication links in an electrical system. With that in mind, Circuit Cellar columnist Robert Lacoste explains the advantages of filtering and examines Fourier transforms; random non-return-to-zero NRZ signaling; and low-pass, Gaussian, Nyquist, and raised-cosine filters.

Lacoste’s article, which appears in Circuit Cellar’s April 2014 issue, includes an abundance of graphic simulations created with Scilab Enterprises’s open-source software. The simulations will help readers grasp the details of pulse shaping, even if they aren’t math experts. (Note: You can download the Scilab source files Lacoste developed for his article from Circuit Cellar’s FTP site.)

Excerpts from Lacoste’s article below explain the importance of filtering and provide a closer look at low-pass filters:

I’ll begin with an example. Imagine you have a 1-Mbps continuous digital signal you need to transmit between two points. You don’t want to specifically encode these bits; you just want to transfer them one by one as they are.

Before transmission, you will need to transform the 1 and 0s into an actual analog signal any way you like. You can use a straightforward method. Simply define a pair of voltages (e.g., 0 and 5 V) and put 0 V on the line for a 0-level bit and put 5 V on the line for a 1-level bit.

This method is pedantically called non-return-to-zero (NRZ). This is exactly what a TTL UART is doing; there is nothing new here. This analog signal (i.e., the base-band signal) can then be sent through the transmission channel and received at the other end (see top image in Figure 1).

Note: In this article I am not considering any specific transmission channel. It could range from a simple pair of copper wires to elaborate wireless links using amplitude, frequency and/or phase modulation, power line modems, or even optical links. Everything I will discuss will basically be applicable to any kind of transmission as it is linked to the base-band signal encoding prior to any modulation.

Directly transmitting a raw digital signal, such as this 1-Mbps non-return-to-zero (NRZ) stream (at top), is a waste of bandwidth. b—Using a pulse-shaping filter (bottom) reduces the required bandwidth for the same bit rate, but with a risk of increased transmission errors.

Figure 1: Directly transmitting a raw digital signal, such as this 1-Mbps non-return-to-zero (NRZ) stream (top), is a waste of bandwidth. Using a pulse-shaping filter (bottom) reduces the required bandwidth for the same bit rate, but with a risk of increased transmission errors.

Now, what is the issue when using simple 0/5-V NRZ encoding? Bandwidth efficiency. You will use more megahertz than needed for your 1-Mbps signal transmission. This may not be an issue if the channel has plenty of extra capacity (e.g., if you are using a Category 6 1-Gbps-compliant shielded twisted pair cable to transmit these 1 Mbps over a couple of meters).

Unfortunately, in real life you will often need to optimize the bandwidth. This could be for cost reasons, for environmental concerns (e.g., EMC perturbations), for regulatory issues (e.g., RF channelization), or simply to increase the effective bit rate as much as possible for a given channel.

Therefore, a good engineering practice is to use just the required bandwidth through a pulse-shaping filter. This filter is fitted between your data source and the transmitter (see bottom of Figure 1).

The filter’s goal is to reduce as much as possible the occupied bandwidth of your base-band signal without affecting the system performance in terms of bit error rate. These may seem like contradictory requirements. How can you design such a filter? That’s what I will try to explain in this article….


A base-band filter is needed between the binary signal source and the transmission media or modulator. But what characteristics should this filter include? It must attenuate as quickly as possible the unnecessary high frequencies. But it must also enable the receiver to decode the signal without errors, or more exactly without more errors than specified. You will need a low-pass filter to limit the high frequencies. As a first example, I used a classic Butterworth second-order filter with varying cut-off frequencies to make the simulation. Figure 2 shows the results. Let me explain the graphs.

Figure 2: This random non-return-to-zero (NRZ) signal (top row) was passed through a second-order Butterworth low-pass filter. When the cut-off frequency is low (310 kHz), the filtered signal (middle row) is distorted and the eye diagram is closed. With a higher cutoff (410 kHz, bottom row), the intersymbol interference (ISI) is lower but the frequency content is visible up to 2 MHz.

Figure 2: This random non-return-to-zero (NRZ) signal (top row) was passed through a second-order Butterworth low-pass filter. When the cut-off frequency is low (310 kHz), the filtered signal (middle row) is distorted and the eye diagram is closed. With a higher cutoff (410 kHz, bottom row), the intersymbol interference (ISI) is lower but the frequency content is visible up to 2 MHz.

The leftmost column shows the signal frequency spectrum after filtering with the filter frequency response in red as a reference. The middle column shows a couple of bits of the filtered signal (i.e., in the time domain), as if you were using an oscilloscope. Last, the rightmost column shows the received signal’s so-called “eye pattern.” This may seem impressive, but the concept is very simple.

Imagine you have an oscilloscope. Trigger it on any rising or falling front of the signal, scale the display to show one bit time in the middle of the screen, and accumulate plenty of random bits on the screen. You’ve got the eye diagram. It provides a visual representation of the difficulty the receiver will have to recover the bits. The more “open” the eye, the easier it is. Moreover, if the successive bits’ trajectories don’t superpose to each other, there is a kind of memory effect. The voltage for a given bit varies depending on the previously transmitted bits. This phenomenon is called intersymbol interference (ISI) and it makes life significantly more difficult for decoding.

Take another look at the Butterworth filter simulations. The first line is the unfiltered signal as a reference (see Figure 2, top row). The second line with a 3-dB, 310-kHz cut-off frequency shows a frequency spectrum significantly reduced after 1 MHz but with a high level of ISI. The eye diagram is nearly closed (see Figure 2, middle row). The third line shows the result with a 410-kHz Butterworth low-pass filter (see Figure 2, bottom row). Its ISI is significantly lower, even if it is still visible. (The successive spot trajectories don’t pass through the same single point.) Anyway, the frequency spectrum is far cleaner than the raw signal, at least from 2 MHz.

Lacoste’s article serves as solid introduction to the broad subject of pulse-shaping. And it concludes by re-emphasizing a few important points and additional resources for readers:

Transmitting a raw digital signal on any medium is a waste of bandwidth. A filter can drastically improve the performance. However, this filter must be well designed to minimize intersymbol interference.

The ideal solution, namely the Nyquist filter, enables you to restrict the used spectrum to half the transmitted bit rate. However, this filter is just a mathematician’s dream. Raised cosine filters and Gaussian filters are two classes of real-life filters that can provide an adequate complexity vs performance ratio.

At least you will no longer be surprised if you see references to such filters in electronic parts’ datasheets. As an example, see Figure 3, which is a block diagram of Analog Devices’s ADF7021 high-performance RF transceiver.

This is a block diagram of Analog Devices’s ADF7021 high-performance transceiver. On the bottom right there is a “Gaussian/raised cosine filter” block, which is a key factor in efficient RF bandwidth usage.

Figure 3: This is a block diagram of Analog Devices’s ADF7021 high-performance transceiver. On the bottom right there is a “Gaussian/raised cosine filter” block, which is a key factor in efficient RF bandwidth usage.

The subject is not easy and can be easily misunderstood. I hope this article will encourage you to learn more about the subject. Bernard Sklar’s book Digital Communications: Fundamentals and Applications is a good reference. Playing with simulations is also a good way to understand, so don’t hesitate to read and modify the Scilab examples I provided for you on Circuit Cellar’s FTP site.  

Lacoste’s full article is in the April issue, now available for membership download or single issue purchase. And for more information about improving the efficiency of wireless communication links, check out Lacoste’s 2011 article “Line-Coding Techniques,” Circuit Cellar 255, which tells you how you can encode your bits before transmission.

Wireless Data Links (Part 2): Transmitters and Antennas

If you built your own ham radio “back in the day,” you’ll recall the frustration of putting it together with components that were basic at best.

But as columnist George Novacek points out in the second installment of his series examining wireless data links: “Today you can purchase excellent, reasonably priced low-power gear for data communications off the shelf.”

Transmitter and receiver

Photo 1: SparkFun Electronics’s WRL-10524 transmitter and WRL-10532 receiver are low cost, basic, and work well.

Part 2 of Novacek’s series, appearing in the March issue, looks at transmitters and antennas.

In one section, Novacek expands upon the five basic data-transmitter modules—a data encoder, a modulator, a carrier frequency generator, an RF output amplifier, and an antenna:

Low-power data transmitters often integrate the modulator, the carrier frequency generator, and the amplifier into one circuit. A single transistor can do the job. I’ll discuss antennas later. When a transmitter and a receiver are combined into one unit, it’s called a transceiver.

Modulation may not be needed in some simple applications where the mere presence of a carrier is detected to initiate an action. A simple push button will suffice, but this is rarely used as it is subject to false triggering by other transmitters working in the area in the same frequency band.

Digital encoder and decoder ICs are available for simple devices (e.g., garage door openers) or keyless entry where just an on or off output is required from the receiver. These ICs generate a data packet for transmission. If the received packet matches the data stored in the decoder, an action is initiated. Typical examples include Holtek Semiconductor HT12E encoders and HT12D decoders and Freescale Semiconductor MC145026, MC145027, and MC145028 encoder and decoder pairs. For data communications a similar but more advanced scheme is used. I’ll address this when I discuss receivers (coming up in Part 3 of this series).

Novacek’s column goes on to explain modulation types, including OOK and ASK modulation:

OOK modulation is achieved by feeding the Data In line with a 0-to+V-level  datastream. ASK modulation can be achieved by the data varying the transistor biasing to swing the RF output between 100% and typically 30% to 50% amplitude. I prefer to add a separate modulator.

The advantage of ASK as opposed to OOK modulation is that the carrier is always present, thus the receiver is not required to repeatedly synchronize to it. Different manufacturers’ specifications claim substantially higher achievable data rates with ASK rather than OOK.

For instance, Photo 1 shows a SparkFun Electronics WRL-10534 transmitter and a WRL-10532 receiver set for 433.9 MHz (a 315-MHz set is also available), which costs less than $10. It is a bare-bones design, but it works well. When you build supporting circuits around it you can get excellent results. The set is a good starting point for experimentation.

The article also includes tips on a transceiver you can purchase to save time in developing ancillary circuits (XBee), while noting a variety of transceiver, receiver, and transmitter modules are available from manufacturers such as Maxim Integrated, Micrel, and RF Monolithics (RFM).  In addition, the article discusses design and optimization of the three forms of antennas: a straight conductor (monopole), a coil (helical), and a loop.

“These can be external, internal, or even etched onto the PCB (e.g., keyless entry fobs) to minimize the size,” Novacek says.

Do you need advice on what to consider when choosing an antenna for your design?  Find these tips and more in Novacek’s March issue article.

Wireless Data Links (Part 1)

In Circuit Cellar’s February issue, the Consummate Engineer column launches a multi-part series on wireless data links.

“Over the last two decades, wireless data communication devices have been entering the realm of embedded control,” columnist George Novacek says in Part 1 of the series. “The technology to produce reasonably priced, reliable, wireless data links is now available off the shelf and no longer requires specialized knowledge, experience, and exotic, expensive test equipment. Nevertheless, to use wireless devices effectively, an engineer should understand the principles involved.”

Radio communicationsPart 1 focuses on radio communications, in particular low-power, data-carrying wireless links used in control systems.

“Even with this limitation, it is a vast subject, the surface of which can merely be scratched,” Novacek says. “Today, we can purchase ready-made, low-power, reliable radio interface modules with excellent performance for an incredibly low price. These devices were originally developed for noncritical applications (e.g., garage door openers, security systems, keyless entry, etc.). Now they are making inroads into control systems, mostly for remote sensing and computer network data exchange. Wireless devices are already present in safety-related systems (e.g., remote tire pressure monitoring), to say nothing about their bigger and older siblings in remote control of space and military unmanned aerial vehicles (UAVs).”

An engineering audience will find Novacek’s article a helpful overview of fundamental wireless communications principles and topics, including RF circuitry (e.g., inductor/capacitor, or LC, circuits), ceramic surface acoustic wave (SAW) resonators, frequency response, bandwidth, sensitivity, noise issues, and more.

Here is an article excerpt about bandwidth and achieving its ideal, rectangular shape:

“The bandwidth affects receiver selectivity and/or a transmitter output spectral purity. The selectivity is the ability of a radio receiver to reject all but the desired signal. Narrowing the bandwidth makes it possible to place more transmitters within the available frequency band. It also lowers the received noise level and increases the selectivity due to its higher Q. On the other hand, transmission of every signal but a non-modulated, pure sinusoid carrier—which, therefore, contains no information—requires a certain minimum bandwidth. The required bandwidth is determined by the type of modulation and the maximum modulating frequency.

“For example, AM radios carry maximum 5-kHz audio and, consequently, need 10-kHz bandwidth to accommodate the carrier with its two 5-kHz sidebands. Therefore, AM broadcast stations have to be spaced a minimum of 20 kHz apart. However, narrowing the bandwidth will lead to the loss of parts of the transmitted information. In a data-carrying systems, it will cause a gradual increase of the bit error rate (BER) until the data becomes useless. At that point, the bandwidth must be increased or the baud rate must be decreased to maintain reliable communications.

“An ideal bandwidth would have a shape of a rectangle, as shown in Figure 1 by the blue trace. Achieving this to a high degree with LC circuits can get quite complicated, but ceramic resonators used in modern receivers can deliver excellent, near ideal results.”

Figure 1: This is the frequency response and bandwidth of a parallel resonant LC circuit. A series circuit graph would be inverted.

Figure 1: This is the frequency response and bandwidth of a parallel resonant LC circuit. A series circuit graph would be inverted.

To learn more about control-system wireless links, check out the February issue now available for membership download or single-issue purchase. Part 2 in Novacek’s series discusses transmitters and antennas and will appear in our March issue.

Web-Based Remote I/O Control

The RIO-2010 is a web-based remote I/O control module. The Ethernet-ready module is equipped with eight relays, 16 photo-isolated digital inputs, and a 1-Wire interface for digital temperature sensor connection. The RIO-2010’s built-in web server enables you to access the I/O and use a standard web browser to remotely control the RIO-2010’s relay.

The RIO-2010 can be easily integrated into supervisory control and data acquisition (SCADA) and industrial automation systems using the standard Modbus TCP protocol. The I/O module also comes with RS-485 serial interface for applications requiring Modbus RTU/ASCII. Its built-in web server enables you to use standard web-editing tools and Ajax dynamic page technology to customize your webpage.

Contact Artila for pricing.

Artila Electronics Co., Ltd.

Multiband 4G LTE-Only Modules

The TOBY-L1 series is u-blox’s latest line of ultra-compact long-term evolution (LTE) modules. The TOBY-L100 and its European version, the TOBY-L110, are suitable for tablets, mobile routers, set-top boxes, and high-speed machine-to-machine (M2M) applications (e.g., digital signage, mobile health, and security systems).

Compared with multi-mode modules, LTE-only modules offer cost advantages. Therefore, the TOBY-L1 works well in networks with advanced LTE deployment applications.

The LTE modules are available in two versions: the TOBY-L100 for the US (bands 4 and 13 for Verizon) and the TOBY-L110 for Europe (bands 3, 7, and 20 for EU operators). Contained in a compact 152-pin LGA module, the TOBY-L1 series is layout-compatible with u-blox’s SARA Global System for Mobile (GSM) and LISA Universal Mobile Telecommunications System/Code Division Multiple Access (UMTS/CDMA) module series to facilitate easy product migration and low-cost regional end-device adaptation.

The TOBY-L1 modules are based on u-blox’s LTE protocol stack. The modules support smooth migration between 2G, 3G, and 4G technologies and feature small packaging and comprehensive support tools. The TOBY-L1 LGA modules measure 2.8 mm × 24.8 mm × 35.6 mm, which enables them to easily mount on any application board.

The modules support USB 2.0 and firmware update over the air (FOTA) technology. The TOBY-L1 series delivers ultra-fast data rates and operates from –40°C to 85°C. USB drivers for Windows XP and 7 plus Radio Interface Layer (RIL) software for Android 4.0 and 4.2 are available free of charge.

Contact u-blox for pricing.


Great Plains Super Launch 2013


Pella, IA — Spectators, visitors and participants alike all erupted into cheerful applause and exclamation after watching the weather balloons launch successfully from the launch site at Vermeer on Saturday. The onlookers observed these hydrogen/helium filled balloons rising into the air until they faded from sight, approaching extremely high altitudes.  The launch was the start of an hour and a half that the balloon spent ascending, all the way into the Earth’s ozone layer.  Another thirty five or forty minutes later the balloon popped and parachutes back to Earth.

The balloons enable us to explore the region of the atmosphere called “near space”, which is above 60,000 ft., but below the accepted altitude of space- 328,000 ft. Cosmic radiation of near space is 100 times greater than it is at sea level. The large balloons are attached to a payload, which contains GPS tracking and various sensors. The payloads contain beacons which emit radio signals. Many of the payloads in this year’s super launch were made by students dedicated to exploring near space.

This sort of active involvement is what PENS strives for. PENS is Pella’s Exploring Near Space program. Mike Morgan, the president of PENS, enjoys and commits to getting kids involved and interested in science and technologies.

“The only thing that goes higher than our balloons are astronauts and satellites. The launch of a radio balloon isn’t something you see or do every day,” Morgan said.
The payload of the balloon also includes a camera so that you can get the view from the edge of space, along with other valuable information that the payload and sensors give. They are used to test things such as barometer, pressure, temperature, UV radiation and humidity. All of these are important factors in the study of aero science.

Bill Brown, founding father of Amateur Radio, participated in the Great Plains Super Launch on Saturday. From Alabama, Brown flew the first high altitude balloon with an amateur radio and video camera in 1987. Brown has flown 400 balloons in 20 states, but each launch presents new information and stimulating challenges. Brown explains that from the edge of space, “You can see the black sky and the curve of the Earth”.

For Nick Stich, the balloon that he launched was his 188th balloon. Balloons from all over the country were launched last Saturday, including radio balloons from Nebraska Stratospheric Amateur Radio, Edge of Space Sciences, DePauw University, and Iowa High Altitude Balloon. PENS, coordinated by Jim Emmert, hosted the conference for near space explorers and enthusiasts.

By Renee Van Roekel
The Chronicle

For more information on the super launch or radio ballooning, visit .

This article was originally published by The Pella Chronicle on June 22, 2013, and is posted here with the permission of its publisher.

Embedded Sensor Innovation at MIT

During his June 5 keynote address at they 2013 Sensors Expo in Chicago, Joseph Paradiso presented details about some of the innovative embedded sensor-related projects at the MIT Media Lab, where he is the  Director of the Responsive Environments Group. The projects he described ranged from innovative ubiquitous computing installations for monitoring building utilities to a small sensor network that transmits real-time data from a peat bog in rural Massachusetts. Below I detail a few of the projects Paradiso covered in his speech.


Managed by the Responsive Enviroments group, the DoppelLab is a virtual environment that uses Unity 3D to present real-time data from numerous sensors in MIT Media Lab complex.

The MIT Responsive Environments Group’s DoppleLab

Paradiso explained that the system gathers real-time information and presents it via an interactive browser. Users can monitor room temperature, humidity data, RFID badge movement, and even someone’s Tweets has he moves throughout the complex.

Living Observatory

Paradiso demoed the Living Observatory project, which comprises numerous sensor nodes installed in a peat bog near Plymouth, MA. In addition to transmitting audio from the bog, the installation also logs data such as temperature, humidity, light, barometric pressure, and radio signal strength. The data logs are posted on the project site, where you can also listen to the audio transmission.

The Living Observatory (Source:


The GesturesEverywhere project provides a real-time data stream about human activity levels within the MIT Media Lab. It provides the following data and more:

  • Activity Level: you can see the Media Labs activity level over a seven-day period.
  • Presence Data: you can see the location of ID tags as people move in the building

The following video is a tracking demo posted on the project site.

The aforementioned projects are just a few of the many cutting-edge developments at the MIT Media Lab. Paradiso said the projects show how far ubiquitous computing technology has come. And they provide a glimpse into the future. For instance, these technologies lend themselves to a variety of building-, environment-, and comfort-related applications.

“In the early days of ubiquitous computing, it was all healthcare,” Paradiso said. “The next frontier is obviously energy.”

Embedded Wireless Made Simple

Last week at the 2013 Sensors Expo in Chicago, Anaren had interesting wireless embedded control systems on display. The message was straightforward: add an Anaren Integrated Radio (AIR) module to an embedded system and you’re ready to go wireless.

Bob Frankel demos embedded mobile control

Bob Frankel of Emmoco provided a embedded mobile control demonstration. By adding an AIR module to a light control system, he was able to use a tablet as a user interface.

The Anaren 2530 module in a light control system (Source: Anaren)

In a separate demonstration, Anaren electrical engineer Mihir Dani showed me how to achieve effective light control with an Anaren 2530 module and TI technology. The module is embedded within the light and compact remote enables him to manipulate variables such as light color and saturation.

Visit Anaren’s website for more information.

Microcontroller-Based Heating System Monitor

Checking a heating system’s consumption is simple enough.

Heating system monitor

Determining a heating system’s output can be much more difficult, unless you have this nifty design. This Atmel ATmega microcontroller-based project enables you to measure heat output as well as control a circulation pump.

Heating bills often present unpleasant surprises. Despite your best efforts to economise on heating, they list tidy sums for electricity or gas consumption. In this article we describe a relatively easy way to check these values and monitor your consumption almost continuously. All you need in order to determine how much heat your system delivers is four temperature sensors, a bit of wiring, and a microcontroller. There’s no need to delve into the electrical or hydraulic components of your system or modify any of them.

A bit of theory
As many readers probably remember from their physics lessons, it’s easy to calculate the amount of heat transferred to a medium such as water. It is given by the product of the temperature change ΔT, the volume V of the medium, and the specific heat capacity CV of the medium. The power P, which is amount of energy transferred per unit time, is:

P= ΔT × CV × V // Δt

With a fluid medium, the term V // Δt can be interpreted as a volumetric flow Vt. This value can be calculated directly from the flow velocity v of the medium and the inner diameter r of the pipe. In a central heating system, the temperature difference ΔT is simply the difference between the supply (S) and return (R) temperatures. This yields the formula:

P = (TS – TR) × CV × v × pr2

The temperatures can easily be measured with suitable sensors. Flow transducers are available for measuring the flow velocity, but installing a flow transducer always requires drilling a hole in a pipe or opening up the piping to insert a fitting.

Measuring principle
Here we used a different method to determine the flow velocity. We make use of the fact that the supply and return temperatures always vary by at least one to two degrees due to the operation of the control system. If pairs of temperature sensors separated by a few metres are mounted on the supply and return lines, the flow velocity can be determined from the time offset of the variations measured by the two sensors…

As the water flows through the pipe with a speed of only a few metres per second, the temperature at sensor position S2 rises somewhat later than the temperature at sensor position S, which is closer to the boiler.

An ATmega microcontroller constantly acquires temperature data from the two sensors. The time delay between the signals from a pair of sensors is determined by a correlation algorithm in the signal processing software, which shifts the signal waveforms from the two supply line sensors relative to each other until they virtually overlap.The temperature signals from the sensors on the return line are correlated in the same manner, and ideally the time offsets obtained for the supply and return lines should be the same.

To increase the sensitivity of the system, the return line sensor signals are applied to the inputs of a differential amplifier, and the resulting difference signal is amplified. This difference signal is also logged as a function of time. The area under the curve of the difference signal is a measure of the time offset of the temperature variations…

Hot water please
If the heating system is also used to supply hot water for domestic use, additional pipes are used for this purpose. For this reason, the PCB designed by the author includes inputs for additional temperature sensors. It also has a switched output for driving a relay that can control a circulation pump.

Under certain conditions, controlling the circulation pump can save you a lot of money and significantly reduce CO2 emissions. This is because some systems have constant hot water circulation so users can draw hot water from the tap immediately. This costs electricity to power the pump, and energy is also lost through the pipe walls. This can be remedied by the author’s circuit, which switches on the circulation pump for only a short time after the hot water tap is opened. This is detected by the temperature difference between the hot water and cold water supply lines…

Circuit description
The easiest way to understand the schematic diagram is to follow the signal path. It starts at the temperature sensors connected to the circuit board, which are NTC silicon devices.

Heating system monitor schematic

Their resistance varies by around 0.7–0.8% per degree K change in temperature. For example, the resistance of a KT110 sensor is approximately 1.7 kΩ at 5 °C and approximately 2.8 kΩ at 70 °C.

The sensor for supply temperature S forms a voltage divider with resistor R37. This is followed by a simple low-pass filter formed by R36 and C20, which filters out induced AC hum. U4a amplifies the sensor signal by a factor of approximately 8. The TL2264 used here is a rail-to-rail opamp, so the output voltage can assume almost any value within the supply voltage range. This increases the absolute measurement accuracy, since the full output signal amplitude is used. U4a naturally needs a reference voltage on its inverting input. This is provided by the combination of R20, R26 and R27. U5b acts as an impedance converter to minimise the load on the voltage divider…

Thermal power

PC connection
The circuit does not have its own display unit, but instead delivers its readings to a PC via an RS485 bus. Its functions can also be controlled from the PC. IC U8 looks after signal level conversion between the TTL transmit and receive lines of the ATmega microcontroller’s integrated UART and the differential RS485 bus. As the bus protocol allows several connected (peer) devices to transmit data on the bus, transmit mode must be selected actively via pin 3. Jumper JP3 must be fitted if the circuit is connected to the end of the RS485 bus. This causes the bus to be terminated in 120 Ω, which matches the characteristic impedance of a twisted-pair line…


Infrared Communications for Atmel Microcontrollers

Are you planning an IR communications project? Do you need to choose a microcontroller? Check out the information Cornell University Senior Lecturer Bruce Land sent us about inexpensive IR communication with Atmel ATmega microcontrollers. It’s another example of the sort of indispensable information covered in Cornell’s excellent ECE4760 course.

Land informed us:

I designed a basic packet communication scheme using cheap remote control IR receivers and LED transmitters. The scheme supports 4800 baud transmission,
with transmitter ID and checksum. Throughput is about twenty 20-character packets/sec. The range is at least 3 meters with 99.9% packet receive and moderate (<30 mA) IR LED drive current.

On the ECE4760 project page, Land writes:

I improved Remin’s protocol by setting up the link software so that timing constraints on the IR receiver AGC were guaranteed to be met. It turns out that there are several types of IR reciever, some of which are better at short data bursts, while others are better for sustained data. I chose a Vishay TSOP34156 for its good sustained data characteristics, minimal burst timing requirements, and reasonable data rate. The system I build works solidly at 4800 baud over IR with 5 characters of overhead/packet (start token, transmitter number, 2 char checksum , end token). It works with increasing packet loss up to 9000 baud.

Here is the receiver circuit.

The receiver circuit (Source: B. Land, Cornell University ECE4760 Infrared Communications
for Atmel Mega644/1284 Microcontrollers)

Land explains:

The RC circuit acts a low-pass filter on the power to surpress spike noise and improve receiver performance. The RC circuit should be close to the receiver. The range with a 100 ohm resistor is at least 3 meters with the transmitter roughly pointing at the receiver, and a packet loss of less then 0.1 percent. To manage burst length limitations there is a short pause between characters, and only 7-bit characters are sent, with two stop bits. The 7-bit limit means that you can send all of the printing characters on the US keyboard, but no extended ASCII. All data is therefore sent as printable strings, NOT as raw hexidecimal.

Land’s writeup also includes a list of programs and packet format information.

Electrostatic Cleaning Robot Project

How do you clean a clean-energy generating system? With a microcontroller (and a few other parts, of course). An excellent example is US designer Scott Potter’s award-winning, Renesas RL78 microcontroller-based Electrostatic Cleaning Robot system that cleans heliostats (i.e., solar-tracking mirrors) used in solar energy-harvesting systems. Renesas and Circuit Cellar magazine announced this week at DevCon 2012 in Garden Grove, CA, that Potter’s design won First Prize in the RL78 Green Energy Challenge.

This image depicts two Electrostatic Cleaning Robots set up on two heliostats. (Source: S. Potter)

The nearby image depicts two Electrostatic Cleaning Robots set up vertically in order to clean the two heliostats in a horizontal left-to-right (and vice versa) fashion.

The Electrostatic Cleaning Robot in place to clean

Potter’s design can quickly clean heliostats in Concentrating Solar Power (CSP) plants. The heliostats must be clean in order to maximize steam production, which generates power.

The robot cleaner prototype

Built around an RL78 microcontroller, the Electrostatic Cleaning Robot provides a reliable cleaning solution that’s powered entirely by photovoltaic cells. The robot traverses the surface of the mirror and uses a high-voltage AC electric field to sweep away dust and debris.

Parts and circuitry inside the robot cleaner

Object oriented C++ software, developed with the IAR Embedded Workbench and the RL78 Demonstration Kit, controls the device.

IAR Embedded Workbench IDE

The RL78 microcontroller uses the following for system control:

• 20 Digital I/Os used as system control lines

• 1 ADC monitors solar cell voltage

• 1 Interval timer provides controller time tick

• Timer array unit: 4 timers capture the width of sensor pulses

• Watchdog timer for system reliability

• Low voltage detection for reliable operation in intermittent solar conditions

• RTC used in diagnostic logs

• 1 UART used for diagnostics

• Flash memory for storing diagnostic logs

The complete project (description, schematics, diagrams, and code) is now available on the Challenge website.


CC269: Break Through Designer’s Block

Are you experiencing designer’s block? Having a hard time starting a new project? You aren’t alone. After more than 11 months of designing and programming (which invariably involved numerous successes and failures), many engineers are simply spent. But don’t worry. Just like every other year, new projects are just around the corner. Sooner or later you’ll regain your energy and find yourself back in action. Plus, we’re here to give you a boost. The December issue (Circuit Cellar 269) is packed with projects that are sure to inspire your next flurry of innovation.

Turn to page 16 to learn how Dan Karmann built the “EBikeMeter” Atmel ATmega328-P-based bicycle computer. He details the hardware and firmware, as well as the assembly process. The monitoring/logging system can acquire and display data such as Speed/Distance, Power, and Recent Log Files.

The Atmel ATmega328-P-based “EBikeMeter” is mounted on the bike’s handlebar.

Another  interesting project is Joe Pfeiffer’s bell ringer system (p. 26). Although the design is intended for generating sound effects in a theater, you can build a similar system for any number of other uses.

You probably don’t have to be coerced into getting excited about a home control project. Most engineers love them. Check out Scott Weber’s garage door control system (p. 34), which features a MikroElektronika RFid Reader. He built it around a Microchip Technology PIC18F2221.

The reader is connected to a breadboard that reads the data and clock signals. It’s built with two chips—the Microchip 28-pin PIC and the eight-pin DS1487 driver shown above it—to connect it to the network for testing. (Source: S. Weber, CC269)

Once considered a hobby part, Arduino is now implemented in countless innovative ways by professional engineers like Ed Nisley. Read Ed’s article before you start your next Arduino-related project (p. 44). He covers the essential, but often overlooked, topic of the Arduino’s built-in power supply.

A heatsink epoxied atop the linear regulator on this Arduino MEGA board helped reduce the operating temperature to a comfortable level. This is certainly not recommended engineering practice, but it’s an acceptable hack. (Source: E. Nisley, CC269)

Need to extract a signal in a noisy environment? Consider a lock-in amplifier. On page 50, Robert Lacoste describes synchronous detection, which is a useful way to extract a signal.

This month, Bob Japenga continues his series, “Concurrency in Embedded Systems” (p. 58). He covers “the mechanisms to create concurrently in your software through processes and threads.”

On page 64, George Novacek presents the second article in his series, “Product Reliability.” He explains the importance of failure rate data and how to use the information.

Jeff Bachiochi wraps up the issue with a article about using heat to power up electronic devices (p. 68). Fire and a Peltier device can save the day when you need to charge a cell phone!

Set aside time to carefully study the prize-winning projects from the Reneas RL78 Green Energy Challenge (p. 30). Among the noteworthy designs are an electrostatic cleaning robot and a solar energy-harvesting system.

Lastly, I want to take the opportunity to thank Steve Ciarcia for bringing the electrical engineering community 25 years of innovative projects, essential content, and industry insight. Since 1988, he’s devoted himself to the pursuit of EE innovation and publishing excellence, and we’re all better off for it. I encourage you to read Steve’s final “Priority Interrupt” editorial on page 80. I’m sure you’ll agree that there’s no better way to begin the next 25 years of innovation than by taking a moment to understand and celebrate our past. Thanks, Steve.

Autonomous Mobile Robot (Part 2): Software & Operation

I designed a microcontroller-based mobile robot that can cruise on its own, avoid obstacles, escape from inadvertent collisions, and track a light source. In the first part of this series, I introduced my TOMBOT robot’s hardware. Now I’ll describe its software and how to achieve autonomous robot behavior.

Autonomous Behavior Model Overview
The TOMBOT is a minimalist system with just enough components to demonstrate some simple autonomous behaviors: Cruise, Escape, Avoid, and Home behaviors (see Figure 1). All the behaviors require left and right servos for maneuverability. In general, “Cruise” just keeps the robot in motion in lieu of any stimulus. “Escape” uses the bumper to sense a collision and then 180 spin with reverse. “Avoid” makes use of continuous forward looking IR sensors to veer left or right upon approaching a close obstacle. Finally “Home” utilizes the front optical photocells to provide robot self-guidance to a strong light highly directional source.

Figure 1: High-level autonomous behavior flow

Figure 2 shows more details. The diagram captures the interaction of TOMBOT hardware and software. On the left side of the diagram are the sensors, power sources, and command override (the XBee radio command input). All analog sensor inputs and bumper switches are sampled (every 100 ms automatically) during the Microchip Technology PIC32 Timer 1 interrupt. The bumper left and right switches undergo debounce using 100 ms as a timer increment. The analog sensors inputs are digitized using the PIC32’s 10-bit ADC. Each sensor is assigned its own ADC channel input. The collected data is averaged in some cases and then made available for use by the different behaviors. Processing other than averaging is done within the behavior itself.

Figure 2: Detailed TOMBOT autonomous model

All behaviors are implemented as state machines. If a behavior requests motor control, it will be internally arbitrated against all other behaviors before motor action is taken. Escape has the highest priority (the power behavior is not yet implemented) and will dominate with its state machine over all the other behaviors. If escape is not active, then avoid will dominate as a result of its IR detectors are sensing an object in front of the TOMBOT less than 8″ away. If escape and avoid are not active, then home will overtake robot steering to sense track a light source that is immediately in front of TOMBOT. Finally cruise assumes command, and takes the TOMBOT in a forward direction temporarily.

A received command from the XBee RF module can stop and start autonomous operation remotely. This is very handy for system debugging. Complete values of all sensors and battery power can be viewed on graphics display using remote command, with LEDs and buzzer, announcing remote command acceptance and execution.

Currently, the green LED is used to signal that the TOMBOT is ready to accept a command. Red is used to indicate that the TOMBOT is executing a command. The buzzer indicates that the remote command has been completed coincident with the red led turning on.

With behavior programming, there are a lot of considerations. For successful autonomous operation, calibration of the photocells and IR sensors and servos is required. The good news is that each of these behaviors can be isolated (selectively comment out prior to compile time what is not needed), so that phenomena can be isolated and the proper calibrations made. We will discuss this as we get a little bit deeper into the library API, but in general, behavior modeling itself does not require accurate modeling and is fairly robust under less than ideal conditions.

TOMBOT Software Library
The TOMBOT robot library is modular. Some experience with C programming is required to use it (see Figure 3).

Figure 3: TOMBOT Library

The entire library is written using Microchip’s PIC32 C compiler. Both the compiler and Microchip’s 8.xx IDE are available as free downloads at The overall library structure is shown. At a highest level library has three main sections: Motor, I/O and Behavior. We cover these areas in some detail.

TOMBOT Motor Library
All functions controlling the servos’ (left and right wheel) operation is contained in this part of the library (see Listing1 Motor.h). In addition the Microchip PIC32 peripheral library is also used. Motor initialization is required before any other library functions. Motor initialization starts up both left and right servo in idle position using PIC32 PWM peripherals OC3 and OC4 and the dual Timer34 (32 bits) for period setting. C Define statements are used to set pulse period and duty cycle for both left and right wheels. These defines provide PWM varies from 1 to 2 ms for different speed CCW rotation over a 20-ms period and from 1.5 ms to 1 ms for CC rotation.

Listing 1: All functions controlling the servos are in this part of the library.

V_LEFT and V_RIGHT (velocity left and right) use the PIC32 peripheral library function to set duty cycle. The other motor functions, in turn, use V_LEFT and V_RIGHT with the define statements. See FORWARD and BACKWARD functions as an example (see Listing 2).

Listing 2: Motor function code examples

In idle setting both PWM set to 1-ms center positions should cause the servos not to turn. A servo calibration process is required to ensure center position does not result in any rotation. For the servos we have a set screw that can be used to adjust motor idle to no spin activity with a small Philips screwdriver.

TOMBOT I/O Library

This is a collection of different low level library functions. Let’s deal with these by examining their files and describing the function set starting with timer (see Listing 3). It uses Timer45 combination (full 32 bits) for precision timer for behaviors. The C defines statements set the different time values. The routine is noninterrupt at this time and simply waits on timer timeout to return.

Listing 3: Low-level library functions

The next I/O library function is ADC. There are a total of five analog inputs all defined below. Each sensor definition corresponds to an integer (32-bit number) designating the specific input channel to which a sensor is connected. The five are: Right IR, Left IR, Battery, Left Photo Cell, Right Photo Cell.

The initialization function initializes the ADC peripheral for the specific channel. The read function performs a 10-bit ADC conversion and returns the result. To faciliate operation across the five sensors we use SCAN_SENSORS function. This does an initialization and conversion of each sensor in turn. The results are placed in global memory where the behavior functions can access . SCAN_SENOR also performs a running average of the last eight samples of photo cell left and right (see Listing 4).

Listing 4: SCAN_SENOR also performs a running average of the last eight samples

The next I/O library function is Graphics (see Listing 5). TOMBOT uses a 102 × 64 monchrome graphics display module that has both red and green LED backlights. There are also red and green LEDs on the module that are independently controlled. The module is driven by the PIC32 SPI2 interface and has several control lines CS –chip select, A0 –command /data.

Listing 5: The Graphics I/O library function

The Graphics display relies on the use of an 8 × 8 font stored in as a project file for character generation. Within the library there are also cursor position macros, functions to write characters or text strings, and functions to draw 32 × 32 bit maps. The library graphic primitives are shown for intialization, module control, and writing to the module. The library writes to a RAM Vmap memory area. And then from this RAM area the screen is updated using dumpVmap function. The LED and backlight controls included within these graphics library.

The next part of I/O library function is delay (see Listing 6). It is just a series of different software delays that can be used by other library function. They were only included because of legacy use with the graphics library.

Listing 6: Series of different software delays

The next I/O library function is UART-XBEE (see Listing 7). This is the serial driver to configure and transfer data through the XBee radio on the robot side. The library is fairly straightforward. It has an initialize function to set up the UART1B for 9600 8N1, transmit and receive.

Listing 7: XBee library functions

Transmission is done one character at a time. Reception is done via interrupt service routine, where the received character is retrieved and a semaphore flag is set. For this communication, I use a Sparkfun XBee Dongle configured through USB as a COM port and then run HyperTerminal or an equivalent application on PC. The default setting for XBee is all that is required (see Photo 1).

Photo 1: XBee PC to TOMBOT communications

The next I/O library function is buzzer (see Listing 8). It uses a simple digital output (Port F bit 1) to control a buzzer. The functions are initializing buzzer control and then the on/off buzzer.

Listing 8: The functions initialize buzzer control

TOMBOT Behavior Library
The Behavior library is the heart of the autonomous TOMBOT and where integrated behavior happens. All of these behaviors require the use of left and right servos for autonomous maneuverability. Each behavior is a finite state machine that interacts with the environment (every 0.1 s). All behaviors have a designated priority relative to the wheel operation. These priorities are resolved by the arbiter for final wheel activation. Listing 9 shows the API for the entire Behavior Library.

Listing 9: The API for the entire behavior library

Let’s briefly cover the specifics.

  • “Cruise” just keeps the robot in motion in lieu of any stimulus.
  • “Escape” uses the bumper to sense a collision and then 180° spin with reverse.
  • “Avoid” makes use of continuous forward looking IR sensors to veer left or right upon approaching a close obstacle.
  • “Home” utilizes the front optical photocells to provide robot self-guidance to a strong light highly directional source.
  • “Remote operation” allows for the TOMBOT to respond to the PC via XBee communications to enter/exit autonomous mode, report status, or execute a predetermined motion scenario (i.e., Spin X times, run back and forth X times, etc.).
  • “Dump” is an internal function that is used within Remote.
  • “Arbiter” is an internal function that is an intrinsic part of the behavior library that resolves different behavior priorities for wheel activation.

Here’s an example of the Main function-invoking different Behavior using API (see Listing 10). Note that this is part of a main loop. Behaviors can be called within a main loop or “Stacked Up”. You can remove or stack up behaviors as you choose ( simply comment out what you don’t need and recompile). Keep in mind that remote is a way for a remote operator to control operation or view status.

Listing 10: TOMBOT API Example

Let’s now examine the detailed state machine associated with each behavior to gain a better understanding of behavior operation (see Listing 11).

Listing 11:The TOMBOT’s arbiter

The arbiter is simple for TOMBOT. It is a fixed arbiter. If either during escape or avoid, it abdicates to those behaviors and lets them resolve motor control internally. Home or cruise motor control requests are handled directly by the arbiter (see Listing 12).

Listing 12: Home behavior

Home is still being debugged and is not yet a final product. The goal is for the TOMBOT during Home is to steer the robot toward a strong light source when not engaged in higher priority behaviors.

The Cruise behavior sets motor to forward operation for one second if no other higher priority behaviors are active (see Listing 13).

Listing 13: Cruise behavior

The Escape behavior tests the bumper switch state to determine if a bump is detected (see Listing 14). Once detected it runs through a series of states. The first is an immediate backup, and then it turns around and moves away from obstacle.

Listing 14: Escape behavior

This function is a response to the remote C or capture command that formats and dumps (see Listing 15) to the graphics display The IR left and right, Photo left and Right, and battery in floating point format.

Listing 15: The dump function

This behavior uses the IR sensors and determines if an object is within 8″ of the front of TOMBOT (see Listing 16).

Listing 16: Avoid behavior

If both sensors detect a target within 8″ then it just turns around and moves away (pretty much like escape). If only the right sensor detects an object in range spins away from right side else if on left spins away on left side (see Listing 17).

Listing 17: Remote part 1

Remote behavior is fairly comprehensive (see Listing 18). There are 14 different cases. Each case is driven by a different XBee received radio character. Once a character is received the red LED is turned on. Once the behavior is complete, the red LED is turned off and a buzzer is sounded.

Listing 18: Remote part 2

The first case toggles Autonomous mode on and off. The other 13 are prescribed actions. Seven of these 13 were written to demonstrate TOMBOT mobile agility with multiple spins, back and forwards. The final six of the 13 are standard single step debug like stop, backward, and capture. Capture dumps all sensor output to the display screen (see Table 1).

Table 1: TOMBOT remote commands

Early Findings & Implementation
Implementation always presents a choice. In my particular case, I was interested in rapid development. At that time, I selected to using non interrupt code and just have linear flow of code for easy debug. This amounts to “blocking code.” Block code is used throughout the behavior implementation and causes the robot to be nonresponsive when blocking occurs. All blocking is identified when timeout functions occur. Here the robot is “blind” to outside environmental conditions. Using a real-time operating system (e.g., Free RTOS) to eliminate this problem is recommended.

The TOMBOT also uses photocells for homing. These sensitive devices have different responses and need to be calibrated to ensure correct response. A photocell calibration is needed within the baseline and used prior to operation.


The TOMBOT was successfully demoed to a large first-grade class in southern California as part of a Science, Technology, Engineering and Mathematics (STEM) program. The main behaviors were limited to Remote, Avoid, and Escape. With autonomous operation off, the robot demonstrated mobility and maneuverability. With autonomous operation on, the robot could interact with a student to demo avoid and escape behavior.

Tom Kibalo holds a BSEE from City College of New York and an MSEE from the University of Maryland. He as 39 years of engineering experience with a number of companies in the Washington, DC area. Tom is an adjunct EE facility member for local community college, and he is president of Kibacorp, a Microchip Design Partner.