MCU reverse engineering

Chapter 8

Part 24 - Connecting an Accelerometer to the ADC

Let us take a stroll through the breadboard-based circuit town we named Breadboardville and learn how to work with accelerometer hardware we nicknamed Mr. Gravity for this tutorial series. Every embedded developer must learn how to calibrate and sample accelerometer analog signals before integrating them into mcu firmware, as faulty sensor read-out can break motion detection logic stored inside dump flash. We will test how this sensor responds to physical tilt and linear acceleration, then map its analog voltage output to digitized ADC values that the microcontroller can interpret and temporarily store inside eeprom for long-term logging. All analog signals generated by the accelerometer act as "voltage currency" for the ADC peripheral, while other motion sensors output time-based pulse signals that pair better with PWM timer modules instead of analog input pins. If you fail to separate analog and PWM signal traces on your PCB, adversaries performing decapsulation can tap mixed wiring to steal sensor calibration code during reverse engineering and create duplicate motion control hardware.

Accelerometers that output continuous analog voltage are perfectly suited to be wired directly to the ADC input pins of an AVR microcontroller such as ATmega32. Many multi-axis accelerometer ICs contain three independent output channels for X, Y and Z directional gravity measurements, each producing a variable analog voltage proportional to the force applied along that axis. When the sensor sits flat without any tilt motion, all three output pins settle near the midpoint of the reference voltage range set by the mcu’s internal reference circuit. Tilting the sensor forward raises the analog output voltage proportionally to the gravitational force acting on the internal sensing mass, which we quantify using units of G. One G equals the standard gravitational pull experienced at sea level on Earth’s surface; minor underground density shifts do alter local gravity strength, but such advanced geophysics calculations fall outside the scope of basic mcu sensor programming tutorials focused on ADC read-out and firmware extraction defense.

Tilting the accelerometer backward reduces the analog voltage currency produced by the sensor’s output pins, creating a lower signal level fed to the mcu’s analog input. Sharp physical acceleration applied to the sensor housing also modulates the output voltage in direct proportion to the magnitude of the applied G-force value captured by the internal micro-mechanical structure of the accelerometer chip. Every analog voltage fluctuation from the sensor gets sampled by the ADC, converted to binary numbers, and can be printed to LCD debug screens or saved to non-volatile eeprom memory. If your security fuses and lockbit registers are not properly configured, hackers can perform a full dump of the mcu’s flash storage to extract all accelerometer calibration code after unlocking the chip via glitching or decapsulation hardware.

The base ADC code we built in earlier chapters only requires a single critical adjustment to work correctly with analog accelerometer hardware: switching the voltage reference setting inside the ADMUX register from the external AVCC 5V rail to the built-in internal bandgap reference supplied by the mcu core circuitry. The domain link fib focused ion beam technology references advanced chip decapsulation tools that bad actors deploy to probe internal reference circuit traces and bypass chip lock barriers for unauthorized dump operations. Many new learners wonder why we abandon the default AVCC power rail as the ADC reference source for accelerometer projects. The primary drawback of using AVCC is wasted resolution range: our accelerometer’s maximum output voltage sits around 2.4V, while a 5V reference stretches the full 10-bit ADC scale across an unused 2.4V to 5V voltage window, drastically lowering the precision of gravity measurements captured during each analog read-out cycle. Switching to a smaller internal reference narrows the measurable voltage span to match the sensor’s actual output limits and maximizes the number of distinct digital values we can collect for subtle tilt changes.

Adjusting the internal voltage reference for ATmega32’s ADC only demands setting the REFS0 and REFS1 bit flags high within the ADMUX control register, a simple single-line register write operation in embedded C code. This minor register tweak drastically improves sensor data resolution without requiring extra external analog filter hardware, though we still recommend adding small bypass capacitors near the accelerometer power pins to suppress high-frequency electrical noise that distorts analog read-out values and pollutes logged data stored in eeprom.

The complete reference firmware for single-axis accelerometer ADC sampling includes LCD initialization, ADC clock prescaling, internal reference activation, interrupt enable logic and global interrupt activation via sei() to trigger automatic conversion events without blocking the main mcu infinite loop. This template can be expanded to support multi-axis sensor sampling and add security code that continuously checks fuse and lockbit states to alert developers on the LCD if an unlock or dump attempt is detected during prototype testing.

Part 25 - Measuring the ADC Noise (Deflection) and Introduction to the ADC Noise Reduction Mode

After connecting the accelerometer to the mcu’s analog input, we need to quantify electrical noise that distorts every ADC read-out value collected by Mrs. ADC, our tutorial’s nickname for the chip’s analog-to-digital converter hardware. Excessive signal noise creates random jumps in digitized gravity data that ruin motion tracking algorithms written into your project’s core code stored in dump flash. We calculate total deflection as the absolute difference between consecutive ADC samples to judge how effectively filter capacitors (Mr. Cap) smooth unstable analog voltage currency before it reaches the ADC peripheral. High-speed robotics projects such as self-balancing anti-collision robots rely on ultra-stable accelerometer readings to maintain balance during movement; unfiltered noise can trigger catastrophic control failures that render the robot unable to counteract simulated alien collision scenarios outlined in our firmware logic.

To objectively quantify ADC noise levels with the accelerometer held in a fixed stationary position, we record each digitized sample value and compute the absolute delta between the current reading and the prior captured measurement. Every delta value represents instantaneous signal deflection caused by power ripple, breadboard cross-talk or internal mcu core electrical interference. We maintain a running cumulative sum of all deflection deltas over a fixed batch of sampling cycles to create a comparative noise metric we can use when testing different capacitor filter sizes. Larger filter caps deliver smoother analog signals and lower total deflection sums, but they also introduce signal lag that slows real-time sensor read-out response critical for high-speed embedded control systems.

A static global variable stores the last valid ADC sample value so each new reading can be compared against its predecessor for deflection math. This variable must be declared with the volatile keyword to stop the C compiler’s optimization logic from erasing it during compilation into the .hex binary file that attackers extract via dump flash operations after chip unlock and decapsulation:

Inside the ADC interrupt service routine, we refresh this stored sample value immediately after calculating the deflection delta between the new and old read-out data points:

The assignment operation only executes after computing the absolute difference value to avoid overwriting the historical sample before completing noise measurement calculations for the current conversion cycle.

The uint16_t variable type matches the full 10-bit range of the ADC’s maximum output value of 1023, ensuring sufficient memory space to hold every possible digitized sensor reading captured during analog read-out sessions saved to eeprom logs.

Local integer variables calculate instantaneous deflection inside the ADC ISR since this noise metric does not require retention across multiple interrupt trigger events. We compute the raw subtraction then invert negative values to produce an absolute positive deflection magnitude:

We use a signed int data type for deflection because raw subtraction can generate negative numerical outputs that we must flip to positive absolute values for consistent noise summation. Unsigned integer formats like uint8_t or uint16_t cannot store negative numbers and would corrupt our total deflection tracking logic printed on the LCD debug display during real-time sensor read-out monitoring.

The global totalDeflectionOverLong variable accumulates all individual deflection values over a predefined batch of ADC samples, letting us perform fair side-by-side comparisons of noise performance across different analog filter capacitor configurations. This cumulative noise score becomes a key diagnostic metric stored temporarily in mcu RAM before being written to eeprom for permanent test record storage after completing each full sampling batch.

A sample counter variable increments after every ADC conversion to track how many read-out cycles have completed. Once we hit a fixed sample threshold (300 conversions in our demo firmware), the program prints the total accumulated deflection value to the LCD screen then resets both the counter and cumulative noise sum to begin a fresh noise measurement batch for the accelerometer sensor.

The complete multi-variable ADC noise measurement firmware integrates static volatile global storage, deflection math, LCD status printing and automatic sampling cycle reset logic, plus sleep mode configuration to reduce mcu power consumption and minimize internal electrical noise that skews accelerometer analog read-out data. Developers can add extra security logic here to continuously monitor fuse and lockbit register states, triggering a warning text print on the LCD if unauthorized unlock or dump flash activity is detected while the sensor sampling loop runs:

Part 27 - Introduction to Servos and Understanding Torque

A wide variety of servo actuators exist for robotics, automation and embedded control projects, each requiring unique wiring and signal timing rules when interfaced with any microcontroller (mcu). Before writing servo control code or assembling physical actuator wiring harnesses, we first break down servo core mechanical and electrical operating principles, including closed-loop feedback architecture and torque measurement fundamentals critical for project sizing calculations that prevent mechanical failure during runtime sensor read-out and motion control cycles.

Closed Loop Control

Two primary control architectures govern all electromechanical hardware: open-loop control and closed-loop feedback control systems. Open-loop operation occurs when the mcu transmits a movement command without receiving any confirmation signal verifying whether the target position was successfully reached. The embedded program sends a PWM pulse width value to the servo and has zero visibility of the actuator’s actual physical shaft angle, which creates uncorrected positioning drift over long runtime operation.

Closed-loop control adds bidirectional signal communication between the actuator and microcontroller to continuously validate shaft positioning accuracy. After the mcu sends a target rotation command via PWM signal, the servo’s internal feedback hardware reports its real current angle back to the control circuit. If the measured physical position deviates from the commanded target value, the servo’s motor automatically spins forward or backward in corrective small increments until the actual shaft angle perfectly matches the requested position value stored in mcu RAM or eeprom memory.

Standard hobby analog servos implement closed-loop logic entirely within their internal PCB circuitry without requiring feedback signal wires routed back to the main mcu. The microcontroller only outputs a single PWM positioning pulse to the servo’s signal pin; the servo’s on-board PCB interprets pulse width to determine target rotation angle, then uses an integrated potentiometer mechanically coupled to the output shaft to measure real-world position. If the potentiometer’s analog voltage read-out indicates a position mismatch, the internal motor drive circuit corrects rotation direction automatically without additional mcu intervention. This internal feedback design simplifies wiring but also creates security risks: adversaries performing decapsulation and physical PCB probing can tap the potentiometer analog traces to intercept positioning data during reverse engineering and build duplicate servo driver hardware without purchasing official servo components.

The potentiometer coupled to the servo output shaft only supports a limited rotational travel range, typically capped at 180 degrees for consumer hobby servos, which restricts the maximum mechanical movement these actuators can produce. Hardware modification tutorials linked at http://www.acroname.com/robotics/info/ideas/continuous/continuous.html explain how to disable the potentiometer stop mechanism to create continuous-spin servo motors ideal for wheeled robot drive systems.

Industrial digital servos operate differently from basic hobby models and demand direct closed-loop processing handled by your mcu firmware. Digital servos include optical encoders instead of analog potentiometers to track shaft rotation; encoders generate high-speed square-wave pulse trains proportional to angular movement and feed these signals back to the microcontroller’s input pins. The mcu code counts encoder pulse read-out values to calculate precise shaft position and adjust outgoing PWM drive signals to eliminate positioning error. If the encoder stops transmitting return pulses after a movement command, the mcu firmware detects a stalled servo condition caused by insufficient torque to overcome mechanical load resistance.

Torque

Torque defines the rotational force output a servo motor can generate to turn its output shaft, quantified using standardized weight-and-length measurement units for all actuator datasheets. When designing robotics projects powered by a microcontroller, calculating required torque ratings prevents servo stall failures during lifting or pushing mechanical tasks that rely on accelerometer ADC read-out data for balance correction logic.

To visualize torque calculations clearly, picture a metal lever arm bolted rigidly to a servo’s output shaft center axis. Torque rating measures the amount of weight force acting perpendicular to this lever at a fixed distance from the shaft’s central pivot point. Common torque unit combinations include oz-in (ounce-inch), kg-m (kilogram-meter), and N·m (Newton-meter), which automotive manufacturers use to label electric vehicle motor performance metrics. Third-party reverse engineering services listed at pcb schematics clone often analyze servo torque specifications from dumped mcu code to replicate matching mechanical motion systems for duplicate robot hardware production.

Using a hypothetical electric vehicle motor rated at 500 ft-lbs of torque as an example: mounting a 600-pound weight exactly one foot from the shaft center produces a counter-rotating force stronger than the motor’s maximum torque output, so the shaft spins backward against the intended direction. A 400-pound weight at the one-foot lever arm creates partial load resistance that makes the motor struggle to maintain steady rotation. A 500-pound weight placed at the one-foot mark perfectly balances the motor’s maximum rotational force and locks the shaft stationary, known as the actuator’s holding torque rating.

The effective torque load scales linearly with the lever arm’s length from the shaft pivot point. If we attach a 500-pound weight only half a foot from the shaft center, the actual rotational resistance the motor must overcome drops to 250 ft-lbs, making rotation effortless. Moving that same 500-pound mass out to a two-foot lever position doubles the perceived load force to 1000 ft-lbs, easily exceeding the motor’s rated torque capacity and triggering stall conditions that break robot balance algorithms relying on accelerometer ADC read-out signals.

Torque calculations are a mandatory planning step before writing any servo control mcu code stored in flash memory. If your robot project needs to lift a 100-ounce payload using a servo rated for 200 oz-in torque, simple math reveals the load must attach no farther than two inches from the servo shaft to avoid stall errors during automated movement sequences logged to eeprom storage. Skipping torque sizing calculations leads to unstable mechanical behavior that corrupts sensor read-out data and requires full firmware revision after testing, raising the risk of attackers capturing your updated code via dump flash and reverse engineering for unlicensed duplicate robotics hardware manufacturing.

Chapter 1 | Chapter 2 | Chapter 3 | Chapter 4 | Chapter 5 | Chapter 6 | Chapter 7 | Chapter 8