HACKING OF ELECTRONIC EQUIPMENTS

CHAPTER 1

INTRODUCTION

1.1 Embedded Systems:

An embedded system is a combination of software and hardware to perform a

dedicated task. Some of the main devices used in embedded products are

Microprocessors and Microcontrollers. Microprocessors are commonly referred to as

general purpose processors as they simply accept the inputs, process it and give the

output. In contrast, a microcontroller not only accepts the data as inputs but also

manipulates it, interfaces the data with various devices, controls the data and thus finally

gives the result.

An embedded system can be defined as a computing device that does a specific

focused job. Appliances such as the air-conditioner, VCD player, DVD player, printer,

fax machine, mobile phone etc. are examples of embedded systems. Each of these

appliances will have a processor and special hardware to meet the specific requirement of

the application along with the embedded software that is executed by the processor for

meeting that specific requirement. The embedded software is also called “firm ware”.

The desktop/laptop computer is a general purpose computer. You can use it for a variety

of applications such as playing games, word processing, accounting, software

development and so on. In contrast, the software in the embedded systems is always fixed

listed below

Embedded systems do a very specific task they cannot be programmed to do

different things. Embedded systems have very limited resources, particularly the

memory. Generally, they do not have secondary storage devices such as the CDROM or

the floppy disk. Embedded systems have to work against some deadlines. A specific job

has to be completed within a specific time. In some embedded systems, called real-time

systems, the deadlines are stringent. Missing a deadline may cause a catastrophe-loss of

life or damage to property. As many embedded systems operate through a battery, the

power consumption has to be very low. Some embedded systems have to operate in

extreme environmental conditions such as very high temperatures and humidity.

ECE, SIETK 1

HACKING OF ELECTRONIC EQUIPMENTS

1.2Processor selection:

1.2.1 General factors that govern the selection are:

• Complexity of overall design

• Design reuse.

• Performance

• Power size

• Cost tools.

• OS Support and availability.

The design's complexity helps determine the CPU to use. If the design calls for

the deployment of a single state machine with interrupts from a small set of peripherals,

then a small CPU and/or micro controller such as the MCS51 or the Z80 could be the best

choice. Many systems such as industrial timer may fit this category, as the memory

footprint is small, the signal is slow and battery consumption must be extremely low. The

application and its interaction will dictate the design's complexity and may also determine

whether it requires a real-time operating system (RTOS). Typically, as the application

complexity increases, the need for a greater bit-width processor increases. The selection

of the CPU will greatly impact performance of the overall system. Specifically, features

like 8 / 16 / 24 / 32 bit architecture, RISC / CISC / DSP architecture, cache, MMU,

pipelining, branch prediction and super-scalar architecture, all affect the speed of a

system.Depending on system needs, these features may be necessary to achieve peak

performance of the system.

There are various benchmarking threshold data available for various 8/16/32 bit

processors like MIPS (Million Instructions per Second), EEMBC, Dhrystone, MIPS/MHz

etc, which can be taken as reference or comparison base.

CISC Vs RISC.

CISC is an acronym for Complex Instruction Set Computer and are chips that are

easy to program and which make efficient use of memory. Since the earliest machines

were programmed in assembly language and memory was slow and expensive, the CISC

philosophy made sense, and was commonly implemented in such large computers.

ECE, SIETK 2

HACKING OF ELECTRONIC EQUIPMENTS

Most common microprocessor designs such as the Intel 80x86 and Motorola 68K

series followed the CISC philosophy. But recent changes in software and hardware

technology have forced a re-examination of CISC and many modern CISC processors are

hybrids, implementing many RISC principles.

The design constraints that led to the development of CISC (small amounts of

slow memory and fact that most early machines were programmed in assembly language)

give CISC instructions sets some common characteristics:

A 2-operand format, where instructions have a source and a destination. Register

to register, register to memory, and memory to register commands.

Multiple addressing modes for memory, including specialized modes for indexing

through arrays

Variable length instructions where the length often varies according to the

addressing mode

Instructions which require multiple clock cycles to execute.

Most CISC hardware architectures have several characteristics in common:

Complex instruction-decoding logic, driven by the need for a single instruction to

support multiple addressing modes.

A small number of general purpose registers. This is the direct result of having

instructions which can operate directly on memory and the limited amount of chip

space not dedicated to instruction decoding, execution, and microcode storage.

Several special purpose registers. Many CTSC designs set aside special registers

for the stack pointer, interrupt handling, and so on. This can simplify the hardware

design somewhat, at the expense of making the instruction set more complex.

A 'Condition code" register which is set as a side-effect of most instructions. This

register reflects whether the result of the last operation is less than, equal to, or

greater than zero and records if certain error conditions occur.

At the time of their initial development, CISC machines used available

technologies to optimize computer performance.

Microprogramming is as easy as assembly language to implement, and much less

expensive than hardwiring a control unit.

ECE, SIETK 3

HACKING OF ELECTRONIC EQUIPMENTS

The ease of microcoding new instructions allowed designers to make CISC

machines upwardly compatible: a new computer could run the same programs as

earlier computers because the new computer would contain a superset of the

instructions of the earlier computers.

As each instruction became more capable, fewer instructions could be used to

implement a given task. This made more efficient use of the relatively slow main

memory.

Because microprogram instruction sets can be written to match the constructs of

high-level languages, the compiler does not have to be as complicated.

Designers soon realized that the CISC philosophy had its own problems,

including:

Earlier generations of a processor family generally were contained as a subset in

every new version - so instruction set & chip hardware become more complex

with each generation of computers.

So that as many instructions as possible could be stored in memory with the least

possible wasted space, individual instructions could be of almost any length - this

means that different instructions will take different amounts of clock time to

execute, slowing down the overall performance of the machine.

Many specialized instructions aren't used frequently enough to justify their

existence -approximately 20% of the available instructions are used in a typical

program.

CISC instructions typically set the condition codes as a side effect of the

instruction. Not only does setting the condition codes take time, but programmers

have to remember to examine the condition code bits before a subsequent

instruction changes them.

As memory speed increased, and high-level languages displaced assembly

language, the major reasons for CISC began to disappear, and computer designers began

to look at ways computer performance could be optimized beyond just making faster

hardware.One of their key realizations was that a sequence of simple instructions

produces the same results as a sequence of complex instructions, but can be implemented

ECE, SIETK 4

HACKING OF ELECTRONIC EQUIPMENTS

with a simpler (and faster) hardware design. (Assuming that memory can keep up.) RISC

(Reduced Instruction Set Computers) processors were the result. CISC and RISC

implementations are becoming more and more alike. Many of today’s RISC chips support

as many instructions as yesterday's CISC chips. And today's CISC chips use many

techniques formerly associated with RISC chips.

1.2.2 Application Areas:

Nearly 99 per cent of the processors manufactured end up in embedded systems.

The embedded system market is one of the highest growth areas as these systems are

used in very market segment- consumer electronics, office automation, industrial

automation, biomedical engineering, wireless communication, data communication,

telecommunications, transportation, military and so on.

1.2.3 Consumer appliances:

At home we use a number of embedded systems which include digital camera,

digital diary, DVD player, electronic toys, microwave oven, remote controls for TV and

air-conditioner, VCO player, video game consoles, video recorders etc. Today’s high-

tech car has about 20 embedded systems for transmission control, engine spark control,

air-conditioning, navigation etc. Even wrist watches are now becoming embedded

systems. The palmtops are powerful embedded systems using which we can carry out

many general-purpose tasks such as playing games and word processing.

1.2.4 Office automation:

The office automation products using embedded systems are copying machine,

fax machine, key telephone, modem, printer, scanner etc.

1.2.5 Industrial automation:

Today a lot of industries use embedded systems for process control. These include

pharmaceutical, cement, sugar, oil exploration, nuclear energy, electricity generation and

transmission. The embedded systems for industrial use are designed to carry out specific

tasks such as monitoring the temperature, pressure, humidity, voltage, current etc., and

then take appropriate action based on the monitored levels to control other devices or to

send information to a centralized monitoring station. In hazardous industrial environment,

ECE, SIETK 5

HACKING OF ELECTRONIC EQUIPMENTS

where human presence has to be avoided, robots are used, which are programmed to do

specific jobs. The robots are now becoming very powerful and carry out many interesting

and complicated tasks such as hardware assembly.

1.1.4.4 Medical electronics:

Almost every medical equipment in the hospital is an embedded system. These

equipments include diagnostic aids such as ECG, EEG, blood pressure measuring

devices, X-ray scanners equipment used in blood analysis, radiation, endoscopy etc.

Developments in medical electronics have paved way for more accurate diagnosis of

diseases.

1.2.6 Computer networking:

Computer networking products such as bridges, routers, Integrated Services

Digital Networks (ISDN), Asynchronous Transfer Mode (ATM), X.25 and frame relay

switches are embedded systems which implement the necessary data communication

protocols. For example, a router interconnects two networks. The two networks may be

running different protocol stacks. The router’s function is to obtain the data packets from

incoming pores, analyze the packets and send them towards the destination after doing

necessary protocol conversion. Most networking equipments, other than the end systems

(desktop computers) we use to access the networks, are embedded systems.

1.2.7 Telecommunications:

In the field of telecommunications, the embedded systems can be categorized as

subscriber terminals and network equipment. The subscriber terminals such as key

telephones, ISDN phones, terminal adapters, web cameras are embedded systems. The

network equipment includes multiplexers, multiple access systems, Packet Assemblers

Dissemblers (PADs), sate11ite modems etc. IP phone, IP gateway, IP gatekeeper etc. are

the latest embedded systems that provide very low-cost voice communication over the

Internet.

1.2.8 Wireless technologies:

Advances in mobile communications are paving way for many interesting

applications using embedded systems. The mobile phone is one of the marvels of the last

ECE, SIETK 6

HACKING OF ELECTRONIC EQUIPMENTS

decade of the 20’h century. It is a very powerful embedded system that provides voice

communication while we are on the move. The Personal Digital Assistants and the

palmtops can now be used to access multimedia services over the Internet. Mobile

communication infrastructure such as base station controllers, mobile switching centers

are also powerful embedded systems.

1.2.9 Insemination:

Testing and measurement are the fundamental requirements in all scientific and

engineering activities. The measuring equipment we use in laboratories to measure

parameters such as weight, temperature, pressure, humidity, voltage, current etc. are all

embedded systems.

Test equipment such as oscilloscope, spectrum analyzer, logic analyzer, protocol

analyzer, radio communication test set etc. are embedded systems built around powerful

processors. Thank to miniaturization, the test and measuring equipment are now

becoming portable facilitating easy testing and measurement in the field by field-

personnel.

1.2.10 Finance:

Financial dealing through cash and cheques are now slowly paving way for

transactions using smart cards and ATM (Automatic Teller Machine, also expanded as

Any Time Money) machines. Smart card, of the size of a credit card, has a small micro-

controller and memory; and it interacts with the smart card reader! ATM machine and

acts as an electronic wallet. Smart card technology has the capability of ushering in a

cashless society.

1.3 Overview of Embedded System Architecture:

Every embedded system consists of custom-built hardware built around a Central

Processing Unit (CPU). This hardware also contains memory chips onto which the

software is loaded. The software residing on the memory chip is also called the

‘firmware’. The operating system runs above the hardware, and the application software

runs above the operating system as shown in figure. The same architecture is applicable

to any computer including a desktop computer. However, there are significant

ECE, SIETK 7

HACKING OF ELECTRONIC EQUIPMENTS

differences. It is not compulsory to have an operating system in every embedded system.

For small appliances such as remote control units, air conditioners, toys etc., there is no

need for an operating system and you can write only the software specific to that

application. For applications involving complex processing, it is advisable to have an

operating system. In such a case, you need to integrate the application software with the

operating system and then transfer the entire software on to the memory chip. Once the

software is transferred to the memory chip, the software will continue to run for a long

time you don’t need to reload new software.

Fig 1.1 Embedded System Architecture

Now, let us see the details of the various building blocks of the hardware of an

embedded system.

As shown in Fig. the building blocks are;

· Central Processing Unit (CPU)

· Memory (Read-only Memory and Random Access Memory)

· Input Devices

· Output devices

· Communication interfaces

· Application-specific circuitry

ECE, SIETK 8

HACKING OF ELECTRONIC EQUIPMENTS

Fig 1.2 Building Blocks Embedded System

1.3.1 Central Processing Unit (CPU):

The Central Processing Unit (processor, in short) can be any of the following:

microcontroller, microprocessor or Digital Signal Processor (DSP). A micro-controller is

a low-cost processor. Its main attraction is that on the chip itself, there will be many other

components such as memory, serial communication interface, analog-to digital converter

etc. So, for small applications, a micro-controller is the best choice as the number of

external components required will be very less.

On the other hand, microprocessors are more powerful, but you need to use many

external components with them. D5P is used mainly for applications in which signal

processing is involved such as audio and video processing.

1.3.2 Memory:

The memory is categorized as Random Access 11emory (RAM) and Read Only

Memory (ROM). The contents of the RAM will be erased if power is switched off to the

ECE, SIETK 9

HACKING OF ELECTRONIC EQUIPMENTS

chip, whereas ROM retains the contents even if the power is switched off. So, the

firmware is stored in the ROM. When power is switched on, the processor reads the

ROM; the program is program is executed.

1.3.3 Input devices:

Unlike the desktops, the input devices to an embedded system have very limited

capability. There will be no keyboard or a mouse, and hence interacting with the

embedded system is no easy task. Many embedded systems will have a small keypad-you

press one key to give a specific command. A keypad may be used to input only the digits.

Many embedded systems used in process control do not have any input device for user

interaction; they take inputs from sensors or transducers 1’fnd produce electrical signals

that are in turn fed to other systems.

1.3.4 Output devices:

The output devices of the embedded systems also have very limited capability.

Some embedded systems will have a few Light Emitting Diodes (LEDs) to indicate the

health status of the system modules, or for visual indication of alarms. A small Liquid

Crystal Display (LCD) may also be used to display some important parameters.

1.3.5 Interfaces:

The embedded systems may need to, interact with other embedded systems at

they may have to transmit data to a desktop. To facilitate this, the embedded systems are

provided with one or a few communication interfaces such as RS232, RS422, RS485,

Universal Serial Bus (USB), IEEE 1394, Ethernet etc.

1.3.6 Application-specific circuitry:

Sensors, transducers, special processing and control circuitry may be required fat

an embedded system, depending on its application. This circuitry interacts with the

processor to carry out the necessary work. The entire hardware has to be given power

supply either through the 230 volts main supply or through a battery. The hardware has to

design in such a way that the power consumption is minimized.

ECE, SIETK 10

HACKING OF ELECTRONIC EQUIPMENTS

CHAPTER 2

HARDWARE COMPONENTS

2. 1 MEMS-Based Accelerometers:

The field of MEMS accelerometers can be segregated into two dominant

microsystem architectures: capacitive and piezoresistive.While both types of

accelerometers employ internal proof masses that are excited by acceleration, the

architectural differences are in the transduction mechanism used to correlate the

movement of the internal proof mass to acceleration. Capacitive accelerometers employ

a differential capacitor whose balance is disrupted by the movement of the proof mass.

Piezoresistive accelerometers generally rely on strain induced within a flexural element

that attaches the proof mass to the sensor housing for identification of the mass

movement. Capacitive-based MEMS accelerometers, such as the ADXL iMEMS series

from Analog Devices, have enjoyed more commercial success than piezoresistive

designs. This is a direct result of piezoresistive accelerometers having not been capable

of keeping pace with the reduced fabrication costs associated with capacitive

architectures (Maluf 2000). Problems associated with the temperature coefficients and

drift properties of piezoresistive materials have necessitated careful packaging and

compensation circuitry that have added to piezoresistive accelerometer costs.

Advances made in MEMS fabrication processes require a revisit of the

piezoresistive accelerometer. With new processes available and old processes improved,

a low-cost high-performance piezoresistive accelerometer is now possible. In particular,

deep reactive ion etching (DRIE) fabrication techniques could be used in the fabrication

of MEMS accelerometers. The low-noise property of piezoresistive accelerometers at

high frequencies, compared to those of capacitive accelerometers, is additional

motivation for a renewed interest in the piezoresistive accelerometer. While many

methods can be employed for the identification of damage in structures, the success of

these methods are limited to cases where damage is severe enough to result in significant

changes in the global modes of response of the structural system (Doebling et al. 1996).

ECE, SIETK 11

HACKING OF ELECTRONIC EQUIPMENTS

Most recently, researchers have explored the use of high-frequency local response

measurements of structural components to identify the onset of damage (Park et al.

2000). As a result, the success of these techniques will necessitate accelerometers that

exhibit superior performance in the high frequency bands of interest. With excellent

noise properties at high frequencies, the piezoresistive accelerometer can be applied to

this emerging class of damage detection problems.

2.2 Design of a Piezoresistive Accelerometer:

The use of piezoresistive materials in the design of MEMS-based accelerometers

was first proposed by Roylance and Angell (1979). Their design calls for a proof mass

attached to a silicon housing through a short flexural element. The implantation of a

piezoresistive material upon the upper surface of the flexural element was used for

measuring out-of-plane acceleration of the proof mass. The strain experienced by a

piezoresistive material causes a position change of its internal atoms resulting in the

change of its electrical resistance (Senturia 2001). Completing a Wheatstone bridge

around the piezoresistors of the accelerometer, a linear relationship between acceleration

and voltage can be derived.

A new approach to the design of piezoresistive accelerometers is explored.

Departing from the Roylance design, a lateral in-plane accelerometer that can exploit the

use of DRIE fabrication techniques is examined (Partridge et al. 2000). The design of the

planar accelerometer is straightforward. A pie-shaped proof mass, as shown in Fig. 1a, is

attached to the sensor housing through a slender cantilevering element. Acceleration in

the plane of the sensor will cause deflections in the proof mass and flexural element.

Implanted in the walls of the cantilevering element is a piezoresistive material that will

change resistance with strain. The flexural element is designed to concentrate strain in

the vicinity of the piezoresistive implant. The housing surrounding the proof mass is

instrumental in providing a lateral stop on the mass movement thereby setting the

maximum measurable acceleration (range). This housing is advantageous because it

prevents deflections that would result in nonlinear flexural responses in addition to

protection of the accelerometer from shock (exceedingly high accelerations such as those

above 1,000 g).

ECE, SIETK 12

HACKING OF ELECTRONIC EQUIPMENTS

The physical dimensions of the accelerometer, illustrated in Fig. 1b, can be varied

to deliver ideal performance specifications for a particular application. To maximize

sensor sensitivity (voltage per unit acceleration), the flexural width, w, is minimized

while the radial length, r, of the proof mass is maximized. The bandwidth of the

accelerometer is determined from the length of the flexure, l, with shorter flexural

elements increasing the lateral resonant frequency of the sensor. Since out-of-plane

vibrations of the proof mass are undesirable, the thickness, t, of the flexural element is

chosen to satisfy a 4 to 10 ratio between flexural thickness and width. In the process of

fabricating the piezoresistive accelerometers, different dimensions for the flexural

element and proof mass are selected.

Deep reactive ion etching (DRIE) and oblique ion implantation fabrication

processes are two enabling MEMS fabrication technologies chosen for the planar

piezoresistive accelerometer. Fabrication of the accelerometer begins with the creation of

a bonded etched silicon on insulator (BESOI) substrate created by oxidation and bonding

of standard wafer surfaces. An additional layer of low-temperature oxide (LTO) is grown

upon the top surface of the substrate in a pattern corresponding to the dimensions of the

flexural and proof mass elements. To precisely remove silicon exposed by the pattern in

the LTO layer, DRIE is used to remove substrate material until the internal oxide layer of

the substrate is reached. With the sides of the flexural element exposed, oblique ion

implantation is used to deposit a thin layer of boron within the sides of the flexural

element. One side is implanted with a moderate amount of boron to form a 4 kΩ

piezoresistor. A greater amount of boron is implanted on the opposite side of the flexural

element to yield a conduction return path of 200 Ω. Upon completion of implantation,

the LTO layer is removed and a thin layer of oxide is grown. Oxidation of silicon renders

silicon surfaces chemically and electronically stable (Lyshevski 2002). The backside of

the substrate is marked and DRIE etched to release the proof mass and flexural elements

of the accelerometer from the substrate. The sensor die is cut from the substrate and

placed in a ceramic package for sealing. Fig. 1c is a scanning electron microscope image

of the completed piezoresistive accelerometer.

The output of the accelerometer is a differential voltage signal linearly

proportional to acceleration. To provide an easy interface to low-cost microcontrollers, a

ECE, SIETK 13

HACKING OF ELECTRONIC EQUIPMENTS

differential voltage amplifier is used to convert the differential voltage to a single voltage

signal with amplification. Unlike some commercially produced accelerometers, an anti-

alias filter is not provided on-chip in the prototype accelerometer, necessitating a four-

pole Butterworth anti-alias filter to condition the accelerometer’s output before

interfacing to a data acquisition system

2.3 Micro-Electro-Mechanical Systems Inertial Measurement Units:

Introduction:

Tracking one’s location can be difficult without a spatial reference. However,

tracking can still be accomplished through dead reckoning. Dead reckoning is the process

of determining one’s position based on the direction, velocity, and time since the

previous position. To perform dead reckoning an Inertial Measurement Unit (IMU) can

be used. An IMU measures velocity, orientation, and gravitational forces. IMUs with

conventional gyroscopes and accelerometers have previously been out of reach for many

civilian and military uses due to bulky sizes and high costs; but with recent advances in

Micro-Electro-Mechanical Systems (MEMS) the prices and sizes have shrunk

significantly. MEMS IMUs can now be found in many systems—from smart phones for

the masses to smart munitions for the military.

Commercial Applications

Civilian:

In recent years the auto industry has adopted IMUs to aid anti-lock brake systems,

traction control schemes, and triggering air bags. Even entertainment systems such as the

Nintendo Wii now contain IMUs. The Wii system originally only used two ADXL330

accelerometers from Analog Devices; this system could not detect the rotation of the

controllers well. However, recently Nintendo added the Motion Plus, with the IDG-600

gyroscope from InvenSense , to implement a true IMU. The cost of the ADXL330 is less

than eight dollars when purchased in bulk and the IDG-600 is estimated to cost two

dollars. Personal GPS navigation companies have also started to integrate MEMS IMUs

into their products. When the GPS reception becomes temporarily unavailable, these

devices can revert to the IMU to calculate the approximate location and movement of the

ECE, SIETK 14

HACKING OF ELECTRONIC EQUIPMENTS

device . Tom Tom GO 920 is such a device and costs less than 200 dollars—only 30

dollars more compared to models without the IMU feature, such as the Tom Tom GO

720.

Military:

Honeywell, along with Rockwell Collins, produce an Integrated Guidance System

(IGS) for the future generation “projectiles, strike weapons, missiles and small unmanned

systems” of the military . This product combines GPS with an IMU to create a robust

system that has a spatial error of less than 4 meters, is difficult to jam, can withstand

more than 20,000 Gs, and weighs a little over half a kilogram . Honeywell also makes

MEMS IMUs for military dead reckoning without GPS integration. One example is the

HG1930 which weighs less than half a pound, measures two inches in diameter by one

and a half inches tall and can survive the shell shock of being fired out of an artillery gun

2.4 Analog-to-digital converter:

An analog-to-digital converter (abbreviated ADC, A/D or A to D) is a device that

converts a continuous quantity to a discrete time digital representation. An ADC may also

provide an isolated measurement. The reverse operation is performed by a digital-to-

analog converter (DAC).Typically, an ADC is an electronic device that converts an input

analog voltage or current to a digital number proportional to the magnitude of the voltage

or current. However, some non-electronic or only partially electronic devices, such as

rotary encoders, can also be considered ADCs.The digital output may use different

coding schemes. Typically the digital output will be a two's complement binary number

that is proportional to the input, but there are other possibilities. An encoder, for example,

might output a code. A/D converters for industrial applications are based on proprietary

Delta-Sigma technology and deliver high-precision analog-to-digital converter solutions

for industrial measurement applications, including industrial process control, analytical

instruments and consumer utility.

Features

• 12-bit resolution

• ± 1 LSB max DNL

ECE, SIETK 15

HACKING OF ELECTRONIC EQUIPMENTS

• ± 1 LSB max INL (MCP3204/3208-B)

• ± 2 LSB max INL (MCP3204/3208-C)

• 4 (MCP3204) or 8 (MCP3208) input channels

• Analog inputs programmable as single-ended or pseudo-differential pairs

• On-chip sample and hold

• SPI serial interface (modes 0,0 and 1,1)

• Single supply operation: 2.7V - 5.5V

• 100 ksps max. sampling rate at VDD = 5V

• 50 ksps max. sampling rate at VDD = 2.7V

• Low power CMOS technology:

- 500 nA typical standby current, 2 μA max.

- 400 μA max. active current at 5V

• Industrial temp range: -40°C to +85°C

• Available in PDIP, SOIC and TSSOP packages

Applications

• Sensor Interface

• Process Control

• Data Acquisition

• Battery Operated Systems

2.5 EEPROM:

Atmel is a leading supplier of Serial EEPROM devices and has shipped over 12

billion devices in the past decade. Because of the ability to alter single bytes of data,

Serial EEPROM devices are used to store personal preference and configuration data in a

wide spectrum of consumer, automotive, telecommunication, medical, industrial, and PC

applications. Atmel offers Serial EEPROM devices in I2C, Microwire and SPI compatible

protocols. The devices come in a number of industry-standard package types including

space saving DFN, VFBGA, SOT23, and WLCSP packages. Atmel Serial EEPROM

devices feature low pin count and are optimized for use in automotive and industrial

temperature applications where low-power and low-voltage operation are essential.

ECE, SIETK 16

HACKING OF ELECTRONIC EQUIPMENTS

EEPROM (electrically erasable programmable read-only memory) is user-

modifiable read-only memory (ROM) that can be erased and reprogrammed (written to)

repeatedly through the application of higher than normal electrical voltage. Unlike

EPROM chips, EEPROMs do not need to be removed from the computer to be modified.

However, an EEPROM chip has to be erased and reprogrammed in its entirety, not

selectively. It also has a limited life - that is, the number of times it can be reprogrammed

is limited to tens or hundreds of thousands of times. In an EEPROM that is frequently

reprogrammed while the computer is in use, the life of the EEPROM can be an important

design consideration.

Key Features

Broad Portfolio – Serial EEPROM devices are offered in 1-Kbit to 1-Mbit

densities in I2C, Microwire, and SPI compatible protocols available in voltages

from 1.7V to 5.5V.

Diverse packages options — The Serial EEPROM devices come in industry

standard PDIP, SOIC, and TSSOP package types, as well as space saving DFN,

VFBGA, SOT23, and WLCSP packages.

High performance — Atmel Serial EEPROM devices offer low active and

standby currents and operate at fast clock frequencies.

Easy migration — Atmel SPI Serial EEPROMs share the same I/O

configuration as Atmel’s AT25D Serial Flash family, allowing customers to

easily upgrade to the advanced, higher density Serial Flash devices.

Automotive designs — Atmel offers automotive-qualified Serial EEPROM

devices in environmentally friendly "green" versions designed to withstand broad

extended temperature ranges.

2.6 LCD

2.6.1 Introduction:

A liquid crystal display (LCD) is a thin, flat electronic visual display that uses the

light modulating properties of liquid crystals (LCs). LCs does not emit light directly.

ECE, SIETK 17

HACKING OF ELECTRONIC EQUIPMENTS

They are used in a wide range of applications including: computer monitors, television,

instrument panels, aircraft cockpit displays, signal, etc. They are common in consumer

devices such as video players, gaming devices, clocks, watches, calculators, and

telephones. LCDs have displaced cathode ray tube (CRT) displays in most applications.

They are usually more compact, lightweight, portable, less expensive, more reliable, and

easier on the eyes. They are available in a wider range of screen sizes than CRT and

plasma displays, and since they do not use phosphors, they cannot suffer image burn-in.

LCDs are more energy efficient and offer safer disposal than CRTs. Its low

electrical power consumption enables it to be used in battery-powered electronic

equipment.

It is an electronically-modulated optical device made up of any number of pixels

filled with liquid crystals and arrayed in front of a light source (backlight) or reflector to

produce images in color or monochrome. The earliest discovery leading to the

development of LCD technology, the discovery of liquid crystals, dates from 1888. By

2008, worldwide sales of televisions with LCD screens had surpassed the sale of CRT

units.

Each pixel of an LCD typically consists of a layer of molecules aligned between

two transparent electrodes, and two polarizing filters the axes of transmission of which

are (in most of the cases) perpendicular to each other. With no actual liquid crystal

between the polarizing filters, light passing through the first filter would be blocked by

the second (crossed) polarizer. In most of the cases the liquid crystal has double

refraction

Passive-matrix and active-matrix addressed LCDs:

Fig no :2.1 Visual view of LCD

ECE, SIETK 18

HACKING OF ELECTRONIC EQUIPMENTS

LCDs with a small number of segments, such as those used in digital watches and

pocket calculators, have individual electrical contacts for each segment. An external

dedicated circuit supplies an electric charge to control each segment. This display

structure is unwieldy for more than a few display elements.

The most commonly used Character based LCDs are based on Hitachi's HD44780

controller or other which are compatible with HD44580. In this tutorial, we will discuss

about character based LCDs, their interfacing with various microcontrollers, various

interfaces (8-bit/4-bit), programming, special stuff and tricks you can do with these

simple looking LCDs which can give a new look to your application.

2.6.2 Pin Description

The most commonly used LCDs found in the market today are 1 Line, 2 Line or 4

Line LCDs which have only 1 controller and support at most of 80 characters, whereas

LCDs supporting more than 80 characters make use of 2 HD44780 controllers.

Fig No:2.2 Pin diagram

Pin no. 1 VSS Power supply (GND)

Pin no. 2 VCC Power supply (+5V)

Pin no. 3 VEE Contrast adjust

Pin no. 4 RS 0 = Instruction input

1 = Data input

Pin no. 5 R/W 0 = Write to LCD module

1 = Read from LCD module

ECE, SIETK 19

HACKING OF ELECTRONIC EQUIPMENTS

Pin no. 6 EN Enable signal

Pin no. 7 D0 Data bus line 0 (LSB)

Pin no. 8 D1 Data bus line 1

Pin no. 9 D2 Data bus line 2

Pin no. 10 D3 Data bus line 3

Pin no. 11 D4 Data bus line 4

Pin no. 12 D5 Data bus line 5

Pin no. 13 D6 Data bus line 6

Pin no. 14 D7 Data bus line 7 (MSB)

2.6.3 Commands and Instruction set:

The instruction register (IR) and the data register (DR) of the LCD can be controlled

by the MCU. Before starting the internal operation of the LCD, control information is

temporarily stored into these registers to allow interfacing with various MCUs, which

operate at different speeds, or various peripheral control devices. The internal operation

of the LCD is determined by signals sent from the MCU. These signals, which include

register selection signal (RS), read/write signal (R/W), and the data bus (DB0 to DB7),

make up the LCD instructions (Table 3). There are four categories of instructions that:

Designate LCD functions, such as display format, data length, etc.

Set internal RAM addresses

Perform data transfer with internal RAM

Perform miscellaneous functions

Although looking at the table you can make your own commands and test them.

Below is a brief list of useful commands which are used frequently while working on the

LCD.

Instruction Hex Decimal

1.Function Set: 8-bit, 1 Line, 5x7 Dots 0x3048

2. Function Set: 8-bit, 2 Line, 5x7 Dots 0x3856

3. Function Set: 4-bit, 1 Line, 5x7 Dots 0x2032

4.Function Set: 4-bit, 2 Line, 5x7 Dot 0x2840

ECE, SIETK 20

HACKING OF ELECTRONIC EQUIPMENTS

Table No :2.1 Instruction And Command Set

ECE, SIETK 21

HACKING OF ELECTRONIC EQUIPMENTS

2.6.4Command Codes

Table no:2.2 LCD command codes

2.7 Crystal Oscillator

A crystal oscillator is a timing device that consists of a crystal and an oscillator

circuit, providing an output waveform at a specific frequency. When a crystal is placed

into an amplifier circuit (as shown in Figure 1), a small amount of energy is fed back to

the crystal, which causes it to vibrate. These vibrations act to stabilize the frequency of

the oscillator circuit.

ECE, SIETK 22

CODE(HEX) COMMAND TO LCD INSTRUCTION REGISTER

1 CLEAR DISPLAY SCREEN

2 RETURN HOME

4 DECREEMENT CURSOR (SHIFT CURSOR TO LEFT)

6 INCREEMENT CURSOR (SHIFT CURSOR TO RIGHT)

5 SHIFT DISPLAY RIGHT

7 SHIFT DISPLAY LEFT

8 DISPLAY OFF,CURSOR OFF

A DISPLAY OFF,CURSOR ON

C DISPLAY ON,CURSOR OFF

F DISPLAY ON,CURSOR BLINKING

10 SHIFT CURSOR POSIITION TO LEFT

14 SHIFT CURSOR POSIITION TO RIGHT

18 SHIFT THE ENTIRE DISPLAY TO THE LEFT

1C SHIFT THE ENTIRE DISPLAY TO THE RIGHT

C0 FORCE CURSOR TO BEGINNING OF SECOND LINE

38 2 LINES & 5X7 MATRIX

HACKING OF ELECTRONIC EQUIPMENTS

Target Frequency

The Target Frequency of an oscillator is the desired output frequency of an

oscillator, specified in MHz or kHz(megahertz or kilohertz) @ 25°C. A Frequency

Tolerance should be specified along with the Target Frequency.

Overall Frequency Tolerance

Overall Frequency Tolerance is the allowable frequency deviation from the Target

Frequency, specified as a maximum frequency deviation in ppm (parts per million). The

deviation is specified “inclusive” of a set of operating conditions such as Operating

Temperature Range, Supply Voltage, Output Load and Aging

Operating Temperature Range

The Operating Temperature Range is the specified range to which the device will

be exposed during oscillation. Allspecifications such as Overall Frequency Tolerance,

Symmetry and Supply Current will be met within the Operating Temperature Range and

is specified as a maximum and a minimum temperature in °C.

Storage Temperature Range

The Storage Temperature Range is the absolute limits of temperature to which the

device will be exposed in a nonoscillation state, without being damaged, and is specified

as a maximum and a minimum temperature in °C.

Supply Current (Icc)

Supply Current is the amount of current consumption by an oscillator from the

power supply, and is usually specified as a maximum current in milliamps (mA).

Supply Voltage (Vdd)

Supply Voltage is the DC input voltage range recommended for operation of an

oscillator, and is usually specified as a DC voltage with a percentage tolerance. For

example: 5.0 Vdc, ±10% is a typical specification. All specifications such as Overall

Frequency Tolerance, Symmetry and Supply Current will be met within the specified

Supply Voltage range.

ECE, SIETK 23

HACKING OF ELECTRONIC EQUIPMENTS

2.8 UART

UART (Universal Asynchronous Receiver Transmitter) or USART (Universal

Synchronous Asynchronous Receiver Transmitter) are one of the basic interfaces which

you will find in almost all the controllers available in the market till date. These

interfaces provide a cost effective simple and reliable communication between one

controller to another controller or between a controller and PC.

2.9 MAX 232

In telecommunications, RS-232 (Recommended Standard 232) is a standard for

serial binary single-ended data and control signals connecting between a DTE (Data

Terminal Equipment) and a DCE (Data Circuit-terminating Equipment). It is commonly

used in computer serial ports. The standard defines the electrical characteristics and

timing of signals, the meaning of signals, and the physical size and pin out of connectors.

Fig No:2.3Visual View Of MAX 232

Scope of the standard:

The Electronics Industries Association (EIA) standard RS-232 as of 1969 defines:

Electrical signal characteristics such as voltage levels, signaling rate, timing and

slew-rate of signals, voltage with stand level, short-circuit behavior, and

maximum load capacitance.

Interface mechanical characteristics, pluggable connectors and pin identification.

Functions of each circuit in the interface connector.

Standard subsets of interface circuits for selected telecom applications.

ECE, SIETK 24

HACKING OF ELECTRONIC EQUIPMENTS

The standard does not define such elements as Character (for example, ASCII,

Baudot code or EBCDIC)

Details of character format and transmission bit rate are controlled by the serial

port hardware, often a single integrated circuit called a UART that converts data from

parallel to asynchronous start-stop serial form. Details of voltage levels, slew rate, and

short-circuit behavior are typically controlled by a line-driver that converts from the

UART's logic levels to RS-232 compatible signal levels, and a receiver that converts

from RS-232 compatible signal levels to the UART's logic levels.

Role in modern personal computers:

In the book PC 97 Hardware Design Guide, Microsoft deprecated support for the

RS-232 compatible serial port of the original IBM PC design. Today, RS-232 has mostly

been replaced in personal computers by USB for local communications. Compared with

RS-232, USB is faster, uses lower voltages, and has connectors that are simpler to

connect and use. Both standards have software support in popular operating systems.

USB is designed to make it easy for device drivers to communicate with hardware.

However, there is no direct analog to the terminal programs used to let users

communicate directly with serial ports. USB is more complex than the RS-232 standard

because it includes a protocol for transferring data to devices. This requires more

software to support the protocol used. RS-232 only standardizes the voltage of signals

and the functions of the physical interface pins. Serial ports of personal computers are

also sometimes used to directly control various hardware devices, such as relays or

lamps, since the control lines of the interface can be easily manipulated by software. This

isn't feasible with USB, which requires some form of receiver to decode the serial data.

As an alternative, USB docking ports are available which can provide connectors

for a keyboard, mouse, one or more serial ports, and one or more parallel ports.

Corresponding device drivers are required for each USB-connected device to allow

programs to access these USB-connected devices as if they were the original directly-

connected peripherals. Devices that convert USB to RS-232 may not work with all

ECE, SIETK 25

HACKING OF ELECTRONIC EQUIPMENTS

software on all personal computers and may cause a reduction in bandwidth along with

higher latency.

Personal computers may use a serial port to interface to devices such as

uninterruptible power supplies. In some cases, serial data is not exchanged, but the

control lines are used to signal conditions such as loss of power or low battery alarms.

Many fields (for example, laboratory automation, surveying) provide a continued

demand for RS-232 I/O due to sustained use of very expensive but aging equipment. It is

often far cheaper to continue to use RS-232 than it is to replace the equipment.

Additionally, modern industrial automation equipment, such as PLCs, VFDs, servo

drives, and CNC equipment are programmable via RS-232. Some manufacturers have

responded to this demand: Toshiba re-introduced the DE-9M connector on the Tecra

laptop.

Voltage levels:

Fig No:2.4 : Different Voltage Level Wave Forms

Diagrammatic oscilloscope trace of voltage levels for an uppercase ASCII "K"

character (0x4b) with 1 start bit, 8 data bits, 1 stop bit.The RS-232 standard defines the

voltage levels that correspond to logical one and logical zero levels for the data

transmission and the control signal lines. Valid signals are plus or minus 3 to 15 volts; the

±3 V range near zero volts is not a valid RS-232 level. The standard specifies a maximum

ECE, SIETK 26

HACKING OF ELECTRONIC EQUIPMENTS

open-circuit voltage of 25 volts: signal levels of ±5 V, ±10 V, ±12 V, and ±15 V are all

commonly seen depending on the power supplies available within a device. RS-232

drivers and receivers must be able to withstand indefinite short circuit to ground or to any

voltage level up to ±25 volts. The slew rate, or how fast the signal changes between

levels, is also controlled.

For data transmission lines (TxD, RxD and their secondary channel equivalents)

logic one is defined as a negative voltage, the signal condition is called marking, and has

the functional significance. Logic zero is positive and the signal condition is termed

spacing. Control signals are logically inverted with respect to what one sees on the data

transmission lines. When one of these signals is active, the voltage on the line will be

between +3 to +15 volts. The inactive state for these signals is the opposite voltage

condition, between −3 and −15 volts. Examples of control lines include request to send

(RTS), clear to send (CTS), data terminal ready (DTR), and data set ready (DSR).

Because the voltage levels are higher than logic levels typically used by integrated

circuits, special intervening driver circuits are required to translate logic levels. These

also protect the device's internal circuitry from short circuits or transients that may appear

on the RS-232 interface, and provide sufficient current to comply with the slew rate

requirements for data transmission.

Because both ends of the RS-232 circuit depend on the ground pin being zero

volts, problems will occur when connecting machinery and computers where the voltage

between the ground pin on one end and the ground pin on the other is not zero. This may

also cause a hazardous ground loop. Use of a common ground limits RS-232 to

applications with relatively short cables. If the two devices are far enough apart or on

separate power systems, the local ground connections at either end of the cable will have

differing voltages; this difference will reduce the noise margin of the signals.

Balanced, differential, serial connections such as USB, RS-422 and RS-485 can

tolerate larger ground voltage differences because of the differential signaling.

Unused interface signals terminated to ground will have an undefined logic state.

Where it is necessary to permanently set a control signal to a defined state, it must be

connected to a voltage source that asserts the logic 1 or logic 0 level. Some devices

provide test voltages on their interface connectors for this purpose.

ECE, SIETK 27

HACKING OF ELECTRONIC EQUIPMENTS

2.10 RS 232

RS-232 devices may be classified as Data Terminal Equipment (DTE) or Data

Communication Equipment (DCE); this defines at each device which wires will be

sending and receiving each signal. The standard recommended but did not make

mandatory the D-subminiature 25 pin connector. In general and according to the

standard, terminals and computers have male connectors with DTE pin functions, and

modems have female connectors with DCE pin functions. Other devices may have any

combination of connector gender and pin definitions. Many terminals were manufactured

with female terminals but were sold with a cable with male connectors at each end; the

terminal with its cable satisfied the recommendations in the standard.

Presence of a 25 pin D-sub connector does not necessarily indicate an RS-232-C

compliant interface. For example, on the original IBM PC, a male D-sub was an RS-232-

C DTE port (with a non-standard current loop interface on reserved pins), but the female

D-sub connector was used for a parallel Centronics printer port. Some personal

computers put non-standard voltages or signals on some pins of their serial ports.

The standard specifies 20 different signal connections. Since most devices use

only a few signals, smaller connectors can often be used.

RS-232 WAVEFORM :

Fig No:2.5 TTL/CMOS Serial Logic Waveform

The diagram above shows the expected waveform from the UART when using the

common 8N1 format. 8N1 signifies 8 Data bits, No Parity and 1 Stop Bit. The RS-232

line, when idle is in the Mark State (Logic 1). A transmission starts with a start bit which

is (Logic 0). Then each bit is sent down the line, one at a time. The LSB (Least

Significant Bit) is sent first. A Stop Bit (Logic 1) is then appended to the signal to make

up the transmission.

ECE, SIETK 28

HACKING OF ELECTRONIC EQUIPMENTS

The data sent using this method, is said to be framed. That is the data is framed

between a Start and Stop Bit.

 RS-232 Voltage levels

1. +3to+25voltstosignify"Space"(Logic0)   

2. 2.  -3 to -25 volts for a "Mark" (logic 1).

 3.  Any voltage in between these regions (i.e. between +3 and -3 Volts) is undefined.

The data byte is always transmitted least-significant-bit first.

The bits are transmitted at specific time intervals determined by the baud rate of the

serial signal.  

This is the signal present on the RS-232 Port of your computer, shown below.

Fig No:2.6 RS-232 Logic Waveform

RS-232 LEVEL CONVERTER:

Standard serial interfacing of microcontroller (TTL) with PC or any  RS232C

Standard device , requires TTL to RS232 Level converter . A MAX232 is used for this

purpose. It provides 2-channel RS232C port and requires external 10uF capacitors. The

driver requires single supply of +5v.

Pin Diagram of MAX 232:

Fig no :2.7 Pin diagram of MAX 232

ECE, SIETK 29

HACKING OF ELECTRONIC EQUIPMENTS

2.11 ZIGBEE

ZigBee-style networks began to be conceived around 1998, when many installers

realized that both Wi-Fi and Bluetooth were going to be unsuitable for many applications.

In particular, many engineers saw a need for self-organizing ad-hoc digital radio

networks.The IEEE 802.15.4-2003 standard was completed in May 2003 and has been

superseded by the publication of IEEE 802.15.4-2006.In the summer of 2003, Philips

Semiconductors, a major mesh network supporter, ceased the investment. Philips

Lighting has, however, continued Philips' participation, and Philips remains a promoter

member on the ZigBee Alliance Board of Directors.

The ZigBee Alliance announced in October 2004 that the membership had more

than doubled in the preceding year and had grown to more than 100 member companies,

in 22 countries. By April 2005 membership had grown to more than 150 companies, and

by December 2005 membership had passed 200 companies.The ZigBee specifications

were ratified on 14 December 2004.The ZigBee Alliance announced availability of

Specification 1.0 on 13 June 2005, known as ZigBee 2004 Specification. In September

2006, ZigBee 2006 Specification is announced. In 2007, ZigBee PRO, the enhanced

ZigBee specification was finalized.

The first stack release is now called ZigBee 2004. The second stack release is

called ZigBee 2006, and mainly replaces the MSG/KVP structure used in 2004 with a

"cluster library". The 2004 stack is now more or less obsolete.ZigBee 2007, now the

current stack release, contains two stack profiles, stack profile 1 (simply called ZigBee),

for home and light commercial use, and stack profile 2 (called ZigBee Pro). ZigBee Pro

offers more features, such as multi-casting, many-to-one routing and high security with

Symmetric-Key Key Exchange (SKKE), while ZigBee (stack profile 1) offers a smaller

footprint in RAM and flash. Both offer full mesh networking and work with all ZigBee

application profiles.ZigBee 2007 is fully backward compatible with ZigBee 2006

devices: A ZigBee 2007 device may join and operate on a ZigBee 2006 network and vice

versa. Due to differences in routing options, ZigBee Pro devices must become non-

routing ZigBee End-Devices (ZEDs) on a ZigBee 2006 network, the same as for ZigBee

2006 devices on a ZigBee 2007 network must become ZEDs on a ZigBee Pro network.

The applications running on those devices work the same, regardless of the stack profile

ECE, SIETK 30

HACKING OF ELECTRONIC EQUIPMENTS

beneath them.The ZigBee 1.0 specification was ratified on 14 December 2004 and is

available to members of the ZigBee Alliance. Most recently, the ZigBee 2007

specification was posted on 30 October 2007. The first ZigBee Application Profile, Home

Automation, was announced 2 November 2007.

Radio hardware

The radio design used by ZigBee has been carefully optimized for low cost in

large scale production. It has few analog stages and uses digital circuits wherever

possible. Though the radios themselves are in expensive, the ZigBee Qualification

Process involves a full validation of the requirements of the physical layer. All radios

derived from the same validated semiconductor mask set would enjoy the same RF

characteristics. An uncertified physical layer that malfunctions could cripple the battery

lifespan of other devices on a ZigBee network. ZigBee radios have very tight constraints

on power and bandwidth. Thus, radios are tested to the ISO 17025 standard with

guidance given by Clause 6 of the 802.15.4-2006 Standard. Most vendors plan to

integrate the radio and microcontroller onto a single chip[15] getting smaller devices.

This standard specifies operation in the unlicensed 2.4 GHz (worldwide),

915 MHz (Americas and Australia) and 868 MHz (Europe) ISM bands. In the 2.4 GHz

band there are 16 ZigBee channels, with each channel requiring 5 MHz of bandwidth.

The 2.4 GHz band provides up to 250 kbit/s, 915 MHz provides up to 40 kbit/s and

868 MHz provides a data rate up to 20 kbit/s. The actual data throughput will be less than

the maximum specified bit rate due to the packet overhead and processing delays.

The radios use direct-sequence spread spectrum coding, which is managed by the

digital stream into the modulator. Binary phase-shift keying (BPSK) is used in the 868

and 915 MHz bands, and Offset quadrature phase-shift keying (OQPSK) that transmits

two bits per symbol is used in the 2.4 GHz band. The output power of the radios is

generally 0 dBm (1 mW).

Software

The software is designed to be easy to develop on small, inexpensive

microprocessors.

ECE, SIETK 31

HACKING OF ELECTRONIC EQUIPMENTS

Network layer

The main functions of the network layer are to enable the correct use of the MAC

sub layer and provide a suitable interface for use by the next upper layer, namely the

application layer. Its capabilities and structure are those typically associated to such

network layers, including routing. On the one hand, the data entity creates and manages

network layer data units from the payload of the application layer and performs routing

according to the current topology. On the other hand, there is the layer control, which is

used to handle configuration of new devices and establish new networks: it can determine

whether a neighboring device belongs to the network and discovers new neighbors and

routers. The control can also detect the presence of a receiver, which allows direct

communication and MAC synchronization.

The routing protocol used by the Network layer is AODV. In order to find the

destination device, it broadcasts out a route request to all of its neighbors. The neighbors

then broadcast the request to their neighbors, etc. until the destination is reached. Once

the destination is reached, it sends its route reply via unicast transmission following the

lowest cost path back to the source. Once the source receives the reply, it will update its

routing table for the destination address with the next hop in the path and the path cost.

Application layer

The application layer is the highest-level layer defined by the specification, and is

the effective interface of the ZigBee system to its end users. It comprises the majority of

components added by the ZigBee specification: both ZDO and its management

procedures, together with application objects defined by the manufacturer, are considered

part of this layer.

Main components

The ZDO is responsible for defining the role of a device as either coordinator or

end device, as mentioned above, but also for the discovery of new (one-hop) devices on

the network and the identification of their offered services. It may then go on to establish

secure links with external devices and reply to binding requests accordingly.The

application support sublayer (APS) is the other main standard component of the layer,

and as such it offers a well-defined interface and control services. It works as a bridge

ECE, SIETK 32

HACKING OF ELECTRONIC EQUIPMENTS

between the network layer and the other components of the application layer: it keeps up-

to-date binding tables in the form of a database, which can be used to find appropriate

devices depending on the services that are needed and those the different devices offer.

As the union between both specified layers, it also routes messages across the layers of

the protocol stack.

Communication models

Fig No:2.9 ZigBee high-level communication model

An application may consist of communicating objects which cooperate to carry

out the desired tasks. The focus of ZigBee is to distribute work among many different

devices which reside within individual ZigBee nodes which in turn form a network (said

work will typically be largely local to each device, for instance the control of each

individual household appliance).The collection of objects that form the network

communicate using the facilities provided by APS, supervised by ZDO interfaces. The

application layer data service follows a typical request-confirm/indication-response

structure.

ECE, SIETK 33

HACKING OF ELECTRONIC EQUIPMENTS

Within a single device, up to 240 application objects can exist, numbered in the

range 1-240. 0 is reserved for the ZDO data interface and 255 for broadcast; the 241-254

range is not currently in use but may be in the future.There are two services available for

application objects to use (in ZigBee 1.0):

The key-value pair service (KVP) is meant for configuration purposes. It enables

description, request and modification of object attributes through a simple

interface based on get/set and event primitives, some allowing a request for

response. Configuration uses compressed XML (full XML can be used) to

provide an adaptable and elegant solution.

The message service is designed to offer a general approach to information

treatment, avoiding the necessity to adapt application protocols and potential

overhead incurred on by KVP. It allows arbitrary payloads to be transmitted over

APS frames.

Addressing is also part of the application layer. A network node consists of an

802.15.4-conformant radio transceiver and one or more device descriptions (basically

collections of attributes which can be polled or set, or which can be monitored through

events). The transceiver is the base for addressing, and devices within a node are

specified by an endpoint identifier in the range 1-240.

Communication and device discovery

In order for applications to communicate, their comprising devices must use a

common application protocol (types of messages, formats and so on); these sets of

conventions are grouped in profiles. Furthermore, binding is decided upon by matching

input and output cluster identifiers, unique within the context of a given profile and

associated to an incoming or outgoing data flow in a device. Binding tables contain

source and destination pairs.Depending on the available information, device discovery

may follow different methods. When the network address is known, the IEEE address can

be requested using unicast communication. When it is not, petitions are broadcast (the

IEEE address being part of the response payload). End devices will simply respond with

the requested address, while a network coordinator or a router will also send the

addresses of all the devices associated with it.

ECE, SIETK 34

HACKING OF ELECTRONIC EQUIPMENTS

This extended discovery protocol permits external devices to find out about

devices in a network and the services that they offer, which endpoints can report when

queried by the discovering device (which has previously obtained their addresses).

Matching services can also be used.

The use of cluster identifiers enforces the binding of complementary entities by

means of the binding tables, which are maintained by ZigBee coordinators, as the table

must be always available within a network and coordinators are most likely to have a

permanent power supply. Backups, managed by higher-level layers, may be needed by

some applications. Binding requires an established communication link; after it exists,

whether to add a new node to the network is decided, according to the application and

security policies.

Communication can happen right after the association. Direct addressing uses

both radio address and endpoint identifier, whereas indirect addressing uses every

relevant field (address, endpoint, cluster and attribute) and requires that they be sent to

the network coordinator, which maintains associations and translates requests for

communication. Indirect addressing is particularly useful to keep some devices very

simple and minimize their need for storage. Besides these two methods, broadcast to all

endpoints in a device is available, and group addressing is used to communicate with

groups of endpoints belonging to a set of devices.

2.11.1 Zigbee Technology

Zigbee Technology is one of such progression in wireless technology. Wireless is

not a new technology as wireless networking and wireless internet are already in use; yet

Zigbee technology set a new aspect in wireless technology. That’s why it’s usually

referred as Zigbee Wireless Technology. Day by day advancement in technology is

introducing novel and supportive devices which are used to make life easier and Zigbee

Technology is one of them.The ZigBee standard uses small very low-power devices to

connect together to form a wireless control. webZigBee protocol is optimized for very

long battery life measured in months to years from inexpensive, off-the-shelf non-

rechargeable batteries, and can control lighting, air conditioning and heating, smoke and

ECE, SIETK 35

HACKING OF ELECTRONIC EQUIPMENTS

fire alarms, and other security devices.ZigBee is a low data rate, two-way standard for

home automation and data networks. Real usage examples of ZigBee includes home

automation tasks such as turning lights on, turn up the heat, setting the home security

system, or starting the VCR.

With ZigBee all these tasks can be done from anywhere in the homeat the touch

of a button. ZigBee also allows for dial-in access via the Internet for automation control.

ZigBee technology is a low data rate, low power consumption, low cost, wireless

networking protocol targeted towards automation and remote control applications. IEEE

802.15.4 committee started working on a low data rate standard a short while later. Then

the ZigBee Alliance and the IEEE decided to join forces and ZigBee is the commercial

name for this technology.ZigBee is expected to provide low cost and low power

connectivity for equipment that needs battery life as long as several months to several

years but does not require data transfer rates as high as those enabled by Bluetooth. In

addition, ZigBee can be implemented in mesh networks larger 2 than is possible with

Bluetooth. ZigBee compliant wireless devices are expected to transmit 10-75 meters,

depending on the RF environment and the power output consumption required for a given

application, and will operate in the unlicensed RF worldwide(2.4GHz global, 915MHz

Americas or 868 MHz Europe). The data rate is 250kbps at 2.4GHz, 40kbps at 915MHz

and 20kbps at 868MHz IEEE and ZigBee Alliance have been working closely to specify

the entire protocol stack. IEEE 802.15.4 focuses on the specification of the lower two

layers of the protocol(physical and data link layer).

On the other hand, ZigBee Alliance aims to provide the upper layers of the

protocol stack (from network to the application layer) for interoperable data networking,

security services and a range of wireless home and building control solutions, provide

interoperability compliance testing, marketing of the standard, advanced engineering for

the evolution of the standard. This will assure consumers to buy products from different

manufacturers with confidence that the products will work together.IEEE 802.15.4 is now

detailing the specification of PHY and MAC by offering building blocksfor different

types of networking known as ”star, mesh, and cluster tree”. Network routingschemes are

designed to ensure power conservation, and low latency through guaranteed timeslots. A

unique feature of ZigBee network layer is communication redundancy eliminating ”single

ECE, SIETK 36

HACKING OF ELECTRONIC EQUIPMENTS

point of failure” in mesh networks. Key features of PHY include energy and link quality

detection, clear channel assessment for improved coexistence with other wireless

networks.

2.11.2 TECHINICAL OVERVIEW

ZigBee is a low-cost, low-power, wireless mesh network standard. The low cost

allows the technology to be widely deployed in wireless control and monitoring

applications. Low power-usage allows longer life with smaller batteries. Mesh

networking provides high reliability and more extensive range. ZigBee chip vendors

typically sell integrated radios and microcontrollers with between 60 KB and 256 KB

flash memory.

ZigBee operates in the industrial, scientific and medical (ISM) radio bands;

868 MHz in Europe, 915 MHz in the USA and Australia, and 2.4 GHz in most

jurisdictions worldwide. Data transmission rates vary from 20 to 900 kilobits/second.

The ZigBee network layer natively supports both star and tree typical networks,

and generic mesh networks. Every network must have one coordinator device, tasked

with its creation, the control of its parameters and basic maintenance. Within star

networks, the coordinator must be the central node. Both trees and meshes allows the use

of ZigBee routers to extend communication at the network level.

Fig No:2.9 ZigBee protocol stack

ECE, SIETK 37

HACKING OF ELECTRONIC EQUIPMENTS

ZigBee builds upon the physical layer and medium access control defined in IEEE

standard 802.15.4 (2003 version) for low-rate WPANs. The specification goes on to

complete the standard by adding four main components: network layer, application layer,

ZigBee device objects (ZDOs) and manufacturer-defined application objects which allow

for customization and favor total integration.

Besides adding two high-level network layers to the underlying structure, the

most significant improvement is the introduction of ZDOs. These are responsible for a

number of tasks, which include keeping of device roles, management of requests to join a

network, device discovery and security.ZigBee is not intended to support powerline

networking but to interface with it at least for smart metering and smart appliance

purposes.Because ZigBee nodes can go from sleep to active mode in 30 ms or less, the

latency can be low and devices can be responsive, particularly compared to Bluetooth

wake-up delays, which are typically around three seconds.Because ZigBee nodes can

sleep most of the time, average power consumption can be low, resulting in long battery

life.

Trademark and alliance

The ZigBee Alliance is a group of companies that maintain and publish the

ZigBee standard. The term ZigBee is a registered trademark of this group, not a single

technical standard. The Alliance publishes application profiles that allow multiple OEM

vendors to create interoperable products. The relationship between IEEE 802.15.4 and

ZigBee is similar to that between IEEE 802.11 and the Wi-Fi Alliance.

License

For non-commercial purposes, the ZigBee specification is available free to the

general public. An entry level membership in the ZigBee Alliance, called Adopter,

provides access to the as-yet unpublished specifications and permission to create products

for market using the specifications.The requirements for membership in the Zigbee

Alliance causes problems for open-source developers because the annual fee conflicts

with the GNU General Public Licence. The requirement for the developer to join the

ZigBee Alliance similarly conflicts with most other free software licenses.

ECE, SIETK 38

HACKING OF ELECTRONIC EQUIPMENTS

2.11.3 Applications of Zigbee Technology

Applications of Zigbee Technology is not limited to a certain level but because of

being cost-effective, low-power battery and wireless connectivity, this Zigbee technology

is used in almost every appliance if not in all. Zigbee technology is programmed in a chip

form and is used in many devices to function automatically. For controlling and

monitoring a whole factory unit while sitting in one cabin is possible by using Zigbee

technology. It centralizes all the units in one place and enables the remote monitoring.

In a similar way, a home can be centralized by increasing the security aspect.

Many small equipments are coming with embedded Zigbee technology chips and really

works like a miracle.Zigbee technology is swiftly prevail the market by introducing

devices like smoke and heat sensor, medical and scientific equipments, control units of

home and industry and wireless communication devices.The revolutionize turn in the

field of technology with the introduction of zigbee technology; the near future of Zigbee

technology will prevail in almost every walk of life.

Uses

ZigBee protocols are intended for embedded applications requiring low data rates

and low power consumption. The resulting network will use very small amounts of

power — individual devices must have a battery life of at least two years to pass ZigBee

certification.

Protocols

The protocols build on recent algorithmic research (Ad-hoc On-demand Distance

Vector, neuRFon) to automatically construct a low-speed ad-hoc network of nodes. In

most large network instances, the network will be a cluster of clusters. It can also form a

mesh or a single cluster. The current ZigBee protocols support beacon and non-beacon

enabled networks.In non-beacon-enabled networks, an unslotted CSMA/CA channel

access mechanism is used. In this type of network, ZigBee Routers typically have their

receivers continuously active, requiring a more robust power supply. However, this

allows for heterogeneous networks in which some devices receive continuously, while

others only transmit when an external stimulus is detected.

ECE, SIETK 39

HACKING OF ELECTRONIC EQUIPMENTS

The typical example of a heterogeneous network is a wireless light switch: The

ZigBee node at the lamp may receive constantly, since it is connected to the mains

supply, while a battery-powered light switch would remain asleep until the switch is

thrown. The switch then wakes up, sends a command to the lamp, receives an

acknowledgment, and returns to sleep.

In such a network the lamp node will be at least a ZigBee Router, if not the

ZigBee Coordinator; the switch node is typically a ZigBee End Device.

In beacon-enabled networks, the special network nodes called ZigBee Routers

transmit periodic beacons to confirm their presence to other network nodes. Nodes may

sleep between beacons, thus lowering their duty cycle and extending their battery life.

Beacon intervals depend on data rate; they may range from 15.36 milliseconds to

251.65824 seconds at 250 kbit/s, from 24 milliseconds to 393.216 seconds at 40 kbit/s

and from 48 milliseconds to 786.432 seconds at 20 kbit/s. However, low duty cycle

operation with long beacon intervals requires precise timing, which can conflict with the

need for low product cost.

In general, the ZigBee protocols minimize the time the radio is on, so as to reduce

power use. In beaconing networks, nodes only need to be active while a beacon is being

transmitted. In non-beacon-enabled networks, power consumption is decidedly

asymmetrical: some devices are always active, while others spend most of their time

sleeping.

Except for the Smart Energy Profile 2.0, ZigBee devices are required to conform

to the IEEE 802.15.4-2003 Low-Rate Wireless Personal Area Network (LR-WPAN)

standard. The standard specifies the lower protocol layers—the (physical layer) (PHY),

and the (media access control) portion of the (data link layer (DLL)). The basic channel

access mode is "carrier sense, multiple access/collision avoidance" (CSMA/CA). That is,

the nodes talk in the same way that people converse; they briefly check to see that no one

is talking before they start. There are three notable exceptions to the use of CSMA.

Beacons are sent on a fixed timing schedule, and do not use CSMA. Message

acknowledgments also do not use CSMA. Finally, devices in Beacon Oriented networks

that have low latency real-time requirements may also use Guaranteed Time Slots (GTS),

which by definition do not use CSMA.

ECE, SIETK 40

HACKING OF ELECTRONIC EQUIPMENTS

2.12 Piezoelectronic Buzzers

FEATURES:

• The PS series are high-performance buzzers that employ unimorph piezoelectric

elements and are designed for easy incorporation into various circuits.

• They feature extremely low power consumption in comparison to electromagnetic units.

• Because these buzzers are designed for external excitation, the same part can serve as

both a musical tone oscillator and a buzzer.

• They can be used with automated inserters. Moisture-resistant models are also

available.

• The lead wire type(PS1550L40N) with both-sided adhesive tape installed easily is

prepared.

Application of Buzzers:

Electric ranges,

washing machines,

computer terminals,

various

devices that require speech synthesis output.

2.13 Keypad

Keyboards and LCDs are the most widely used input/output devices of the 8051,

and a basic understanding of them is essential. In this section, we first discuss keyboard

fundamentals, along with key press and key detection mechanisms, Then we show how a

keyboard is interfaced to an 8051.

Interfacing the Keyboard to the 8051

At the lowest level, keyboards are organized in a matrix of rows and columns.

The CPU accesses both rows and column through ports; therefore, with two 8-bit ports,

an 8*8 matrix of keys can be connected to a microprocessor. When a key pressed, a row

and column make a connect; otherwise, there is no connection between row and column.

In IBM PC keyboards, a single microcontroller (consisting of microprocessor, RAM and

ECE, SIETK 41

HACKING OF ELECTRONIC EQUIPMENTS

EPROM, and several ports all on a single chip) takes care of software and hardware

interfacing of keyboard. In such systems it is the function of programs stored in the

EPROM of microcontroller to scan the keys continuously, identify which one has been

activated, and present it to the motherboard. In this section we look at the mechanism by

which the 8051 scans and identifies the key.

Scanning and identifying the key

               

The below Figure shows a 4*4 matrix connected to two ports. The rows are connected to

an output port and the columns are connected to an input port. If no key has been pressed,

reading the input port will yield 1s for all columns since they are all connected to high

(Vcc) If all the rows are grounded and a key is pressed, one of the columns will have 0

since the key pressed provides the path to ground. It is the function of the microcontroller

to scan the keyboard continuously to detect and identify the key pressed. How it is done

is explained next.

Fig No:2.10 Grounding rows and reading columns

               

ECE, SIETK 42

HACKING OF ELECTRONIC EQUIPMENTS

To detect a pressed key, the microcontroller grounds all rows by providing 0 to

the output latch, and then it reads the columns. If the data read from the columns is D3-

D0=1111, no key has been pressed and the process continues until a key press is detected.

However, if one of the column bits has a zero, this means that a key press has occurred.

For example, if D3-D0=1101, this means that a key in the D1 column has been pressed.

After a key press is detected, the microcontroller will go through the process of

identifying the key. Starting with the top row, the microcontroller grounds it by providing

a low to row D0 only; then it reads the columns. If the data read is all1s, no key in that

row is activated and the process is moved to the next row. It grounds the next row, reads

the columns, and checks for any zero. This process continues until the row is identified.

After identification of the row in which the key has been pressed, the next task is to find

out which column the pressed key belongs to. This should be easy since the

microcontroller knows at any time which row and column are being accessed.

Assembly language program for detection and identification of key activation is

given below. In this program, it is assumed that P1 and P2 are initialized as output and

input, respectively. Program13.1 goes through the following four major stages:To make

sure that the preceding key has been released, 0s are output to all rows at once, and the

columns are read and checked repeatedly until all the columns are high. When all

columns are found to be high, the program waits for a short amount of time before it goes

to the next stage of waiting for a key to be pressed.To see if any key is pressed, the

columns are scanned over and over in an infinite loop until one of them has a 0 on it.

Remember that the output latches connected to rows still have their initial zeros

(provided in stage 1), making them grounded. After the key press detection, it waits 20ms

for the bounce and then scans the columns again. This serves two functions: (a) it ensures

that the first key press detection was not an erroneous one due to spike noise, and(b) the

20ms delay prevents the same key press from being interpreted as a multiple key press. If

after the 20-ms delay the key is still pressed, it goes to the next stage to detect which row

it belongs to; otherwise, it goes back into the loop to detect a real key press        

To detect which row the key press belongs to, it grounds one row at a time,

reading the columns each time. If it finds that all columns are high, this means that the

key press cannot belong to that row; therefore, it grounds the next row and continues until

ECE, SIETK 43

HACKING OF ELECTRONIC EQUIPMENTS

it finds the row the key press belongs to. Upon finding the row that the key press belongs

to, it sets up the starting address for the look-up table holding the scan codes (or the

ASCII value) for that row and goes to the next stage to identify the key.

2.14 Micro Conrollers:

Microprocessors and microcontrollers are widely used in embedded systems

products. Microcontroller is a programmable device. A microcontroller has a CPU in

addition to a fixed amount of RAM, ROM, I/O ports and a timer embedded all on a single

chip. The fixed amount of on-chip ROM, RAM and number of I/O ports in

microcontrollers makes them ideal for many applications in which cost and space are

critical.

The Intel 8052 is Harvard architecture, single chip microcontroller (µC) which

was developed by Intel in 1980 for use in embedded systems. It was popular in the 1980s

and early 1990s, but today it has largely been superseded by a vast range of enhanced

devices with 8052-compatible processor cores that are manufactured by more than 20

independent manufacturers including Atmel, Infineon Technologies and Maxim

Integrated Products.

8052 is an 8-bit processor, meaning that the CPU can work on only 8 bits of

data at a time. Data larger than 8 bits has to be broken into 8-bit pieces to be processed by

the CPU. 8052 is available in different memory types such as UV-EPROM, Flash and

NV-RAM.

The present project is implemented on Keil uVision. In order to program the device,

proload tool has been used to burn the program onto the microcontroller.

FEATURES:

• Compatible with MCS-51® Products

• 8K Bytes of In-System Programmable (ISP) Flash Memory

– Endurance: 1000 Write/Erase Cycles

• 4.0V to 5.5V Operating Range

• Fully Static Operation: 0 Hz to 33 MHz

• Three-level Program Memory Lock

• 256 x 8-bit Internal RAM

ECE, SIETK 44

HACKING OF ELECTRONIC EQUIPMENTS

• 32 Programmable I/O Lines

• Three 16-bit Timer/Counters

• Eight Interrupt Sources

• Full Duplex UART Serial Channel

• Low-power Idle and Power-down Modes

• Interrupt Recovery from Power-down Mode

• Watchdog Timer

• Dual Data Pointer

• Power-off Flag

Fig 2.11 AT89S52 Micro Controller

DESCRIPTION:

The AT89S52 is a low-power, high-performance CMOS 8-bit microcontroller

with 8K bytes of in-system programmable Flash memory. The device is manufactured

using Atmel’s high-density nonvolatile memory technology and is compatible with the

industry- standard 80C51 instruction set and pinout. The on-chip Flash allows the

program memory to be reprogrammed in-system or by a conventional nonvolatile

memory programmer. By combining a versatile 8-bit CPU with in-system programmable

Flash on a monolithic chip, the Atmel AT89S52 is a powerful microcontroller which

provides a highly-flexible and cost-effective solution to many embedded control

applications. The AT89S52 provides the following standard features: 8K bytes of Flash,

ECE, SIETK 45

HACKING OF ELECTRONIC EQUIPMENTS

256 bytes of RAM, 32 I/O lines, Watchdog timer, two data pointers, three 16-bit

timer/counters, a six-vector two-level interrupt architecture, a full duplex serial port, on-

chip oscillator, and clock circuitry. In addition, the AT89S52 is designed with static logic

for operation down to zero frequency and supports two software selectable power saving

modes.The Idle Mode stops the CPU while allowing the RAM, timer/counters, serial

port, and interrupt system to continue functioning. The Power-down mode saves the

RAM contents but freezes the oscillator, disabling all other chip functions until the next

interrupt or hardware reset.

2.13.1 PIN CONFIGURATION:

Fig 2.12 Pin diagram of AT89S52 Micro Controller

VCC:

Supply voltage.

GND:

Ground.

ECE, SIETK 46

HACKING OF ELECTRONIC EQUIPMENTS

Port 0:

Port 0 is an 8-bit open drain bidirectional I/O port. As an output port, each pin

can sink eight TTL inputs. When 1s are written to port 0 pins, the pins can be used as

high impedance inputs. Port 0 can also be configured to be the multiplexed low order

address/data bus during accesses to external program and data memory. In this mode, P0

has internal pullups. Port 0 also receives the code bytes during Flash programming and

outputs the code bytes during program verification. External pullups are required during

program verification.

Port 1:

Port 1 is an 8-bit bidirectional I/O port with internal pullups. The Port 1 output

buffers can sink/source four TTL inputs. When 1s are written to Port 1 pins, they are

pulled high by the internal pullups and can be used as inputs. As inputs, Port 1 pins that

are externally being pulled low will source current (IIL) because of the internal pullups.

In addition, P1.0 and P1.1 can be configured to be the timer/counter 2 external count

input (P1.0/T2) and the timer/counter 2 trigger input (P1.1/T2EX), respectively, as shown

in the following table. Port 1 also receives the low-order address bytes during Flash

programming and verification.

Port 2:

Port 2 is an 8-bit bidirectional I/O port with internal pull-ups. The Port 2

output buffers can sink/source four TTL inputs. When 1s are written to Port 2 pins, they

are pulled high by the internal pull-ups and can be used as inputs. As inputs, Port 2 pins

that are externally being pulled low will source current (IIL) because of the internal pull-

ups. Port 2 emits the high-order address byte during fetches from external program

memory and during accesses to external data memory that uses 16-bit addresses (MOVX

@ DPTR). In this application, Port 2 uses strong internal pull-ups when emitting 1s.

During accesses to external data memories that use 8-bit addresses (MOVX @ RI), Port 2

emits the contents of the P2 Special Function Register. Port 2 also receives the high-order

address bits and some control signals during Flash programming and verification.

ECE, SIETK 47

HACKING OF ELECTRONIC EQUIPMENTS

Table 2.3: Port 1 Pin Description

Port Pin Alternate Functions

P1.0 T2(external count input to timer/counter 2),

Clock out

P1.1 T2EX(timer/counter 2 capture/reload trigger

And direction control)

P1.5 MOSI(used for in-system programming)

P1.6 MISO(used for in-system programming)

P1.7 SCK (used for in-system programming)

Port 3:

Port 3 is an 8-bit bidirectional I/O port with internal pull-ups. The Port 3

output buffers can sink/source four TTL inputs. When 1s are written to Port 3 pins, they

are pulled high by the internal pull-ups and can be used as inputs. As inputs, Port 3 pins

that are externally being pulled low will source current (IIL) because of the pull-ups. Port

3 also serves the functions of various special features of the AT89S52, as shown in the

following table.

Table 2.4: Port 3 Pin Description

Port Pin Alternate FunctionsP3.0 RXD(Serial input port)

P3.1 TXD(Serial output port)

P3.2INT0(External interrupt 0)

P3.3INT1(External interrupt 1)

P3.4T0(Timer 0 external input)

ECE, SIETK 48

HACKING OF ELECTRONIC EQUIPMENTS

RST:

Reset input. A high on this pin for two machine cycles while the oscillator is

running resets the device. This pin drives High for 96 oscillator periods after the

Watchdog times out. The DISRTO bit in SFR AUXR (address 8EH) can be used to

disable this feature. In the default state of bit DISRTO, the RESET HIGH out feature is

enabled.

ALE/PROG:

Address Latch Enable (ALE) is an output pulse for latching the low byte of

the address during accesses to external memory. This pin is also the program pulse input

(PROG) during Flash programming. In normal operation, ALE is emitted at a constant

rate of 1/6 the oscillator frequency and may be used for external timing or clocking

purposes. Note, however, that one ALE pulse is skipped during each access to external

data memory. If desired, ALE operation can be disabled by setting bit 0 of SFR location

8EH. With the bit set, ALE is active only during a MOVX or MOVC instruction.

Otherwise, the pin is weakly pulled high. Setting the ALE-disable bit has no effect if the

microcontroller is in external execution mode.

PSEN:

Program Store Enable (PSEN) is the read strobe to external program memory.

When the AT89S52 is executing code from external program memory, PSEN is activated

twice each machine cycle, except that two PSEN activations are skipped during each

access to external data memory.

EA/VPP:

External Access Enable. EA must be strapped to GND in order to enable the

device to fetch code from external program memory locations starting at 0000H up to

FFFFH. Note, however, that if lock bit 1 is programmed, EA will be internally latched on

reset.EA should be strapped to VCC for internal program executions. This pin also

receives the 12-volt programming enable voltage (VPP) during Flash programming.

ECE, SIETK 49

HACKING OF ELECTRONIC EQUIPMENTS

XTAL1:

Input to the inverting oscillator amplifier and input to the internal clock

operating circuit.

XTAL2:

Output from the inverting oscillator amplifier.XTAL1 and XTAL2 are the

input and output, respectively, of an inverting amplifier that can be configured for use as

an on-chip oscillator, as shown in Figure. Either a quartz crystal or ceramic resonator

may be used. To drive the device from an external clock source, XTAL2 should be left

unconnected while XTAL1 is driven, as shown in the below figure. There are no

requirements on the duty cycle of the external clock signal, since the input to the internal

clocking circuitry is through a divide-by-two flip-flop, but minimum and maximum

voltage high and low time specifications must be observed.

ECE, SIETK 50

HACKING OF ELECTRONIC EQUIPMENTS

CHAPTER 3

SOFTWARE DESCRIPTION

3.1 KEIL SOFTWARE:

Keil compiler is a software used where the machine language code is written and

compiled. After compilation, the machine source code is converted into hex code which

is to be dumped into the microcontroller for further processing. Keil compiler also

supports C language code.

STEPS TO WRITE AN ASSEMBLY LANGUAGE PROGRAM IN KEIL AND

HOW TO COMPILE IT:

1. Install the Keil Software in the PC in any of the drives.

2. After installation, an icon will be created with the name “Keil uVision3”. Just

drag this icon onto the desktop so that it becomes easy whenever you try to write

programs in keil.

3. Double click on this icon to start the keil compiler.

4. A page opens with different options in it showing the project workspace at the

leftmost corner side, output window in the bottom and an ash coloured space for

the program to be written.

5. Now to start using the keil, click on the option “project”.

6. A small window opens showing the options like new project, import project, open

project etc. Click on “New project”.

7. A small window with the title bar “Create new project” opens. The window asks

the user to give the project name with which it should be created and the

destination location. The project can be created in any of the drives available. You

can create a new folder and then a new file or can create directly a new file.

8. After the file is saved in the given destination location, a window opens where a

list of vendors will be displayed and you have to select the device for the target

you have created.

ECE, SIETK 51

HACKING OF ELECTRONIC EQUIPMENTS

9. The most widely used vendor is Atmel. So click on Atmel and now the family of

microcontrollers manufactured by Atmel opens. You can select any one of the

microcontrollers according to the requirement.

10. When you click on any one of the microcontrollers, the features of that particular

microcontroller will be displayed on the right side of the page. The most

appropriate microcontroller with which most of the projects can be implemented

is the AT89C51. Click on this microcontroller and have a look at its features.

Now click on “OK” to select this microcontroller.

11. A small window opens asking whether to copy the startup code into the file you

have created just now. Just click on “No” to proceed further.

12. Now you can see the TARGET and SOURCE GROUP created in the project

workspace.

13. Now click on “File” and in that “New”. A new page opens and you can start

writing program in it.

14. After the program is completed, save it with any name but with the .asm

extension. Save the program in the file you have created earlier.

15. You can notice that after you save the program, the predefined keywords will be

highlighted in bold letters.

16. Now add this file to the target by giving a right click on the source group. A list of

options open and in that select “Add files to the source group”. Check for this file

where you have saved and add it.

17. Right click on the target and select the first option “Options for target”. A window

opens with different options like device, target, output etc. First click on “target”.

18. Since the set frequency of the microcontroller is 11.0592 MHz to interface with

the PC, just enter this frequency value in the Xtal (MHz) text area and put a tick

on the Use on-chip ROM. This is because the program what we write here in the

keil will later be dumped into the microcontroller and will be stored in the inbuilt

ROM in the microcontroller.

19. Now click the option “Output” and give any name to the hex file to be created in

the “Name of executable” text area and put a tick to the “Create HEX file” option

ECE, SIETK 52

HACKING OF ELECTRONIC EQUIPMENTS

present in the same window. The hex file can be created in any of the drives. You

can change the folder by clicking on “Select folder for Objects”.

20. Now to check whether the program you have written is errorless or not, click on

the icon exactly below the “Open file” icon which is nothing but Build Target

icon. You can even use the shortcut key F7 to compile the program written.

21. To check for the output, there are several windows like serial window, memory

window, project window etc. Depending on the program you have written, select

the appropriate window to see the output by entering into debug mode.

22. The icon with the letter “d” indicates the debug mode.

23. Click on this icon and now click on the option “View” and select the appropriate

window to check for the output.

24. After this is done, click the icon “debug” again to come out of the debug mode.

The hex file created as shown earlier will be dumped into the microcontroller with

the help of another software called Proload

3.2 PROLOAD

Proload is software which accepts only hex files. Once the machine code is

converted into hex code, that hex code has to be dumped into the microcontroller and this

is done by the Proload. Proload is a programmer which itself contains a microcontroller

in it other than the one which is to be programmed. This microcontroller has a program in

it written in such a way that it accepts the hex file from the Keil compiler and dumps this

hex file into the microcontroller which is to be programmed. As the Proload programmer

kit requires power supply to be operated, this power supply is given from the power

supply circuit designed above. It should be noted that this programmer kit contains a

power supply section in the board itself but in order to switch on that power supply, a

source is required. Thus this is accomplished from the power supply board with an output

of 12volts.

ECE, SIETK 53

HACKING OF ELECTRONIC EQUIPMENTS

Fig 3.1 Atmel 8051 device programmer

Features

Supports major Atmel 89 series devices

Auto Identify connected hardware and devices

Error checking and verification in-built

Lock of programs in chip supported to prevent program copying

20 and 40 pin ZIF socket on-board

Auto Erase before writing and Auto Verify after writing

Informative status bar and access to latest programmed file

Simple and Easy to use

Works on 57600 speed

Description

It is simple to use and low cost, yet powerful flash microcontroller programmer

for the Atmel 89 series. It will Program, Read and Verify Code Data, Write Lock Bits,

Erase and Blank Check. All fuse and lock bits are programmable. This programmer has

intelligent onboard firmware and connects to the serial port. It can be used with any type

of computer and requires no special hardware. All that is needed is a serial

communication ports which all computers have.All devices have signature bytes that the

programmer reads to automatically identify the chip. No need to select the device type,

just plug it in and go! All devices also have a number of lock bits to provide various

levels of software and programming protection. These lock bits are fully programmable

using this programmer. Lock bits are useful to protect the program to be read back from

microcontroller only allowing erase to reprogram the microcontroller. The programmer

ECE, SIETK 54

HACKING OF ELECTRONIC EQUIPMENTS

connects to a host computer using a standard RS232 serial port. All the programming

'intelligence' is built into the programmer so you do not need any special hardware to run

it. Programmer comes with window based software for easy programming of the devices.

PROGRAMMING SOFTWARE

Computer side software called 'Proload V4.1' is executed that accepts the Intel

HEX format file generated from compiler to be sent to target microcontroller. It auto

detects the hardware connected to the serial port. It also auto detects the chip inserted and

bytes used. Software is developed in Delphi 7 and requires no overhead of any external

DLL.

3.3 Advantages

Easy to implement

Low power consumption

Cost effective

Directions

ECE, SIETK 55

HACKING OF ELECTRONIC EQUIPMENTS

Fig no:3.2 Writing the Program bytes on to the Microcontroller

3.4APPLICATIONS

Asset tracking

Passports

Security and access control

Government library

Document , people tracking

Health care

Transportation payments

Supply chain management

Retailing

ECE, SIETK 56

HACKING OF ELECTRONIC EQUIPMENTS

CHAPTER 4

PROJECT IMPLEMENTATION

4.1Block Diagram of Transmitter:

Fig 4.1 Transmitter block diagram

The main parts in the Hacking of Electronics Equipments are

1. MEMS Sensor

2. ZIGBEE Module

ECE, SIETK 57

MICRO CONTROLLER

LCD

MAX 232 ZIGBEE MODULE

MEMS sensor ADC

EEPROM

CRYSTAL OSC

RESET

HACKING OF ELECTRONIC EQUIPMENTS

3. ADC

4. LCD

5. EEPROM

6. MAX232

7. Crystal oscillator

8. Keypad

9. Micro controller

10.Reset

Description:

The project Hacking of electronic equipments consists of MEMS Sensor, power

supply, and ZIGBEE module. If any body is going to theft any of the electronic

equipment like Pc, Mobile e.t.c. The MEMS Sensor will detect the vibration of that

equipment and sends the signal to microcontroller.ADC is present between MEMS sensor

and microcontroller which is used to convert voltage in to 0’s and 1’s.The controller

compares the voltages of the Signal and transmit through the Zigbee communication.

The output of the microcontroller is displayed on the LCD and MAX 232 acts as an

interfacing between microcontroller and Zigbee module. EPROM is used to store the data

and it is a non volatile memory. Here MEMS accelerometer, Serial EEPROM memory,

serial LCD display acts as Slave devices.

In this Project three Individual keys are used to perform operations like

1.City Road Guiding Equipment

2.Preventing Train Accident

3.Hacking of Electronic Equipments

1. City Road Guide Equipment

In city road guide equipment, the device aims at informing people about the City

Bus numbers for the places they wish to go. By pressing City road guiding key, the

system performs the respected operation.

2. Preventing Train Accidents

ECE, SIETK 58

HACKING OF ELECTRONIC EQUIPMENTS

In this operation if any damage occurs to bridge or Railway track the MEMS

sensor sends the voltage of signals and then send to ZIGBEE receiver and it displays on

the LCD.

4.2 Block Diagram of Receiver:

The zig bee

Fig 4.2 Receiver block diagram

Description

The ZIGBEE receiver receives the data and it will show on the

LCD.Microcontroller reads the status of LCD, if any moment in an unauthorized way,

ECE, SIETK 59

Zigbee Module

MAX 232

Micro controller

LCD

Keypad

RESET

Crystal Oscillator

Buzzer

HACKING OF ELECTRONIC EQUIPMENTS

intiates a sequence of events like audible alert through a buzzer, Disable further operation

of the system. After receiving the data system can easily lock through keypad by pressing

key. The system remains in this state until the remote control unit transmits an emergency

password.

4.3 REGULATED POWER SUPPLY:

Fig 4.3 Regulated power supply

The input to the circuit is applied from the regulated power supply. The a.c.

input i.e., 230V from the mains supply is step down by the transformer to 12V and is fed

to a rectifier. The output obtained from the rectifier is a pulsating d.c voltage. So in order

to get a pure d.c voltage, the output voltage from the rectifier is fed to a filter to remove

any a.c components present even after rectification. Now, this voltage is given to a

voltage regulator to obtain a pure constant dc voltage.

Transformer:

Usually, DC voltages are required to operate various electronic equipment and

these voltages are 5V, 9V or 12V. But these voltages cannot be obtained directly. Thus

the a.c input available at the mains supply i.e., 230V is to be brought down to the

required voltage level. This is done by a transformer. Thus, a step down transformer is

employed to decrease the voltage to a required level.

ECE, SIETK 60

Regulator FilterBridge

Rectifier

Step down

transformer

230V AC 50Hz

D.C

Output

HACKING OF ELECTRONIC EQUIPMENTS

Fig 4.4 Transformer

Rectifier:

The output from the transformer is fed to the rectifier. It converts A.C. into

pulsating D.C. The rectifier may be a half wave or a full wave rectifier. In this project, a

bridge rectifier is used because of its merits like good stability and full wave rectification.

Fig 4.5 Bridge rectifier circuit

The Bridge rectifier is a circuit, which converts an ac voltage to dc voltage

using both half cycles of the input ac voltage. The Bridge rectifier circuit is shown in the

figure. The circuit has four diodes connected to form a bridge. The ac input voltage is

applied to the diagonally opposite ends of the bridge. The load resistance is connected

between the other two ends of the bridge.For the positive half cycle of the input ac

voltage, diodes D1 and D3 conduct, whereas diodes D2 and D4 remain in the OFF state.

The conducting diodes will be in series with the load resistance RL and hence the load

current flows through RL.For the negative half cycle of the input ac voltage, diodes D2

and D4 conduct whereas, D1 and D3 remain OFF. The conducting diodes D2 and D4 will

be in series with the load resistance RL and hence the current flows through RL in the

same direction as in the previous half cycle. Thus a bi-directional wave is converted into

a unidirectional wave.

ECE, SIETK 61

HACKING OF ELECTRONIC EQUIPMENTS

Filter:

Capacitive filter is used in this project. It removes the ripples from the output

of rectifier and smoothens the D.C. Output received from this filter is constant until the

mains voltage and load is maintained constant. However, if either of the two is varied,

D.C. voltage received at this point changes.

CHAPERT 5

RESULT

5.1 Transmitter Section

The “HACKING OF ELECTRONIC EQUIPMENTS” consist of three modes of

operation and it perfoms remaining two operations by using switches ane reset button is

used to exit from one state to another and it automatically perfoms the first operation.

Fig No:5.1 Transmitter section

ECE, SIETK 62

HACKING OF ELECTRONIC EQUIPMENTS

The above figure perfoms the operation of hacking of electronic equipments.Here

the MEMS sensor senses the changes in the position of the device and sends the data to

the zigbee module through the interfacing i.e,MAX232.In LCD it displays the voltage of

the signals.

It perfoms another two operations along with hacking of electronic

equipments.The operation is perfoming “ CITY ROADGUIDING ” and another

operation is “ PREVENTION OF TRAIN ACCIDENTS “

Fig No:5.2 City road guiding

In city road guiding four switches are used and data is already stored by using the

keil software.By pressing the first key it displays the message on the LCD which is

already dumped into the program.Like this pressing the remaining keys it displays the

message related to that switch.

ECE, SIETK 63

HACKING OF ELECTRONIC EQUIPMENTS

Fig No 5.3:Prvention of train accidents

In prevention of train accidents,the message displays on the receiver section i.e,

the bridge is weak.It receives the information from the transmitter section.

5.2 Receiver Section

ECE, SIETK 64

HACKING OF ELECTRONIC EQUIPMENTS

Fig No 5.4: Receiver section

The above figure displays the output of the project.It means the Zigbee

receiver receives the data and it will show in the LCD.After receiving data th ststem

can lock through Keypad by pressing key and it produces a buzzer sound.

CONCLUSION

As modern electronic goods such as computers, mobile phones, portable players,

laptops and palmtops are becoming smaller and more sophisticated, they can be more

easily targeted for theft in the home and business environment.In existing system,the

devices used are bulkier and it cannot be easily integrated with the existing compact

electronic systems.

Our project overcomes the drawbacks of present systems. It takes advantage of

the dramatic advances in micro machined semiconductor product technology and

employs a tri axis micro machined accelerometer integrated on a chip which is mounted

into the system to be protected. MEMS accelerometer can sense motion on all the 3 axes.

The main advantage of our project is, The system remains in this state until the remote

control unit transmits an emergency password which must match the 10 digit device

identification number stored in the nonvolatile memory space.

Advantages

ECE, SIETK 65

HACKING OF ELECTRONIC EQUIPMENTS

• Automated operation.

• Easy to find out the thief , who was thefted our equipment.

• Costless.

• Alert a control unit at a remote location through a zigbee wireless modem.

• Inbuilt

• Small in size

Applications

• Office automation.

• Milatary.

• Security.

• Medical field.

• Finance.

• Prevention of accidents

• Public places

Future Scope

ECE, SIETK 66

HACKING OF ELECTRONIC EQUIPMENTS

BIBILOGRAPHY

ECE, SIETK 67

HACKING OF ELECTRONIC EQUIPMENTS

APPENDECIES

Microelectromechanical systems (MEMS)

The technology of very small mechanical devices driven by electricity; it merges

at the nano-scale into nanoelectromechanical systems (NEMS) and nanotechnology.

MEMS are also referred to as micromachines (in Japan), or micro systems technology –

MST (in Europe).

MEMS are separate and distinct from the hypothetical vision of molecular

nanotechnology or molecular electronics. MEMS are made up of components between 1

to 100 micrometres in size (i.e. 0.001 to 0.1 mm) and MEMS devices generally range in

size from 20 micrometres (20 millionths of a metre) to a millimetre. They usually consist

of a central unit that processes data, the microprocessor and several components that

interact with the outside such as microsensors.[1] At these size scales, the standard

constructs of classical physics are not always useful. Because of the large surface area to

ECE, SIETK 68

HACKING OF ELECTRONIC EQUIPMENTS

volume ratio of MEMS, surface effects such as electrostatics and wetting dominate

volume effects such as inertia or thermal mass.

The potential of very small machines was appreciated before the technology existed that

could make them—see, for example, Richard Feynman's famous 1959 lecture There's

Plenty of Room at the Bottom. MEMS became practical once they could be fabricated

using modified semiconductor device fabrication technologies, normally used to make

electronics. These include molding and plating, wet etching (KOH, TMAH) and dry

etching (RIE and DRIE), electro discharge machining (EDM), and other technologies

capable of manufacturing small devices. An early example of a MEMS device is the

resonistor – an electromechanical monolithic resonator.

Materials for MEMS manufacturing

The fabrication of MEMS derived from the process technology in semiconductor

device fabrication, i.e. the basic techniques are deposition of material layers, patterning

by photolithography and etching to produce the required shapes.

Silicon

Silicon is the material used to create most integrated circuits used in consumer

electronics in the modern world. The economies of scale, ready availability of cheap

high-quality materials and ability to incorporate electronic functionality make silicon

attractive for a wide variety of MEMS applications. Silicon also has significant

advantages engendered through its material properties. In single crystal form, silicon is an

almost perfect Hookean material, meaning that when it is flexed there is virtually no

hysteresis and hence almost no energy dissipation. As well as making for highly

repeatable motion, this also makes silicon very reliable as it suffers very little fatigue and

can have service lifetimes in the range of billions to trillions of cycles without breaking.

Polymers

ECE, SIETK 69

HACKING OF ELECTRONIC EQUIPMENTS

Even though the electronics industry provides an economy of scale for the silicon

industry, crystalline silicon is still a complex and relatively expensive material to

produce. Polymers on the other hand can be produced in huge volumes, with a great

variety of material characteristics. MEMS devices can be made from polymers by

processes such as injection molding, embossing or stereolithography and are especially

well suited to microfluidic applications such as disposable blood testing cartridges.

Metals

Metals can also be used to create MEMS elements. While metals do not have

some of the advantages displayed by silicon in terms of mechanical properties, when used

within their limitations, metals can exhibit very high degrees of reliability. Metals can be

deposited by electroplating, evaporation, and sputtering processes.

Ceramics

The nitrides of silicon, aluminium and titanium as well as silicon carbide and

other ceramics are increasingly applied in MEMS fabrication due to advantageous

combinations of material properties. AlN crystallizes in the wurtzite structure and thus

shows pyroelectric and piezoelectric properties enabling sensors, for instance, with

sensitivity to normal and shear forces.[5] TiN, on the other hand, exhibits a high electrical

conductivity and large elastic modulus allowing to realize electrostatic MEMS actuation

schemes with ultrathin membranes.[6] Moreover, the high resistance of TiN against

biocorrosion qualifies the material for applications in biogenic environments and in

biosensors.

MEMS basic processes

Deposition processes

One of the basic building blocks in MEMS processing is the ability to deposit thin

films of material with a thickness anywhere between a few nanometres to about 100

micrometres.

ECE, SIETK 70

HACKING OF ELECTRONIC EQUIPMENTS

Physical deposition

There are two types of physical deposition processes.They are as follows.

Physical vapor deposition (PVD)

Physical vapor deposition consists of a process in which a material is removed

from a target, and deposited on a surface. Techniques to do this include the process of

sputtering, in which an ion beam liberates atoms from a target, allowing them to move

through the intervening space and deposit on the desired substrate, and Evaporation

(deposition), in which a material is evaporated from a target using either heat (thermal

evaporation) or an electron beam (e-beam evaporation) in a vacuum system.

Chemical deposition

Chemical deposition techniques include chemical vapor deposition ("CVD"), in

which a stream of source gas reacts on the substrate to grow the material desired. This

can be further divided into categories depending on the details of the technique, for

example, LPCVD (Low Pressure chemical vapor deposition) and PECVD (Plasma

Enhanced chemical vapor deposition).

Oxide films can also be grown by the technique of thermal oxidation, in which the

(typically silicon) wafer is exposed to oxygen and/or steam, to grow a thin surface layer

of silicon dioxide.

Embedded C language

Embedded C is a set of language extensions for the C Programming language by

the C Standards committee to address commonality issues that exist between C

extensions for different embedded systems. Historically, embedded C programming

requires nonstandard extensions to the C language in order to support exotic features such

as fixed-point arithmetic, multiple distinct memory banks, and basic I/O operations.

ECE, SIETK 71

HACKING OF ELECTRONIC EQUIPMENTS

The C programming language is perhaps the most popular programming language for

programming embedded systems. We mentioned other popular programming languages).

Most C programmers are spoiled because they program in environments where not only

there is a standard library implementation, but there are frequently a number of other

libraries available for use. The cold fact is, that in embedded systems, there rarely are

many of the libraries that programmers have grown used to, but occasionally an

embedded system might not have a complete standard library, if there is a standard

library at all. Few embedded systems have capability for dynamic linking, so if standard

library functions are to be available at all, they often need to be directly linked into the

executable. Oftentimes, because of space concerns, it is not possible to link in an entire

library file, and programmers are often forced to "brew their own" standard c library

implementations if they want to use them at all. While some libraries are bulky and not

well suited for use on microcontrollers, many development systems still include the

standard libraries which are the most common for C programmers.

C remains a very popular language for micro-controller developers due to the

code efficiency and reduced overhead and development time. C offers low-level control

and is considered more readable than assembly. Many free C compilers are available for

a wide variety of development platforms. The compilers are part of an IDEs with ICD

support, breakpoints, single-stepping and an assembly window. The performance of C

compilers has improved considerably in recent years, and they are claimed to be more or

less as good as assembly, depending on who you ask. Most tools now offer options for

customizing the compiler optimization. Additionally, using C increases portability, since

C code can be compiled for different types of processors.

ECE, SIETK 72

HACKING OF ELECTRONIC EQUIPMENTS

Special Function Registers

A map of the on-chip memory area called the Special Function Register (SFR)

space is shown in the following table. It should be noted that not all of the addresses are

occupied and unoccupied addresses may not be implemented on the chip. Read accesses

to these addresses will in general return random data, and write accesses will have an

indeterminate effect.

User software should not write 1s to these unlisted locations, since they may be

used in future products to invoke new features. In that case, the reset or inactive values of

the new bits will always be 0.

Timer 2 Registers

Control and status bits are contained in registers T2CON and T2MOD for Timer

2. The register pair (RCAP2H, RCAP2L) is the Capture/Reload register for Timer 2 in

16-bit capture mode or 16-bit auto-reload mode.

Dual Data Pointer Registers

To facilitate accessing both internal and external data memory, two banks of 16-

bit Data Pointer Registers are provided: DP0 at SFR address locations 82H-83H and DP1

at 84H and 85H. Bit DPS = 0 in SFR AUXR1 selects DP0 and DPS = 1 selects DP1. The

user should ALWAYS initialize the DPS bit to the appropriate value before accessing the

respective Data Pointer Register.

ECE, SIETK 73

HACKING OF ELECTRONIC EQUIPMENTS

Memory Organization

MCS-51 devices have a separate address space for Program and Data Memory.

Up to 64K bytes each of external Program and Data Memory can be addressed.

Program Memory

If the EA pin is connected to GND, all program fetches are directed to external

memory. On the AT89S52, if EA is connected to VCC, program fetches to addresses

0000H through 1FFFH are directed to internal memory and fetches to addresses 2000H

through FFFFH are to external memory.

Data Memory

The AT89S52 implements 256 bytes of on-chip RAM. The upper 128 byte

occupy a parallel address space to the Special Function Registers. This means that the

upper 128 bytes have the same addresses as the SFR space but are physically separate

from SFR space.

When an instruction accesses an internal location above address 7FH, the address

mode used in the instruction specifies whether the CPU accesses the upper 128 bytes of

RAM or the SFR space. Instructions which use direct addressing access the SFR space.

UART

The Atmel 8051 Microcontrollers implement three general purpose, 16-bit timers/

counters. They are identified as Timer 0, Timer 1 and Timer 2 and can be independently

configured to operate in a variety of modes as a timer or as an event counter. When

operating as a timer, the timer/counter runs for a programmed length of time and then

issues an interrupt request. When operating as a counter, the timer/counter counts

negative transitions on an external pin. After a preset number of counts, the counter

issues an interrupt request. The various operating modes of each timer/counter are

described in the following sections.

A basic operation consists of timer registers THx and TLx (x= 0, 1) connected in

cascade to form a 16-bit timer. Setting the run control bit (TRx) in TCON register turns

the timer on by allowing the selected input to increment TLx. When TLx overflows it

ECE, SIETK 74

HACKING OF ELECTRONIC EQUIPMENTS

increments THx; when THx overflows it sets the timer overflow flag (TFx) in TCON

register. Setting the TRx does not clear the THx and TLx timer registers. Timer registers

can be accessed to obtain the current count or to enter preset values. They can be read at

any time but TRx bit must be cleared to preset their values, otherwise the behavior of the

timer/counter is unpredictable.

Since it takes 2 cycles (12 peripheral clock periods) to recognize a negative

transition, the maximum count rate is FPER / 12, i.e. FOSC / 24 in standard mode or

FOSC / 12 in X2 mode. There are no restrictions on the duty cycle of the external input

signal, but to ensure that a given level is sampled at least once before it changes, it should

be held for at least one full peripheral cycle. In addition to the “timer” or “counter”

selection, Timer 0 and Timer 1 have four operating modes from which to select which are

selected by bit-pairs (M1, M0) in TMOD. Modes 0, 1and 2 are the same for both

timer/counters. Mode 3 is different.

The four operating modes are described below. Timer 2, has three modes of

operation: ‘capture’, ‘auto-reload’ and ‘baud rate generator’.

Timer 0

Timer 0 functions as either a timer or event counter in four modes of operation.

Timer 0 is controlled by the four lower bits of the TMOD register and bits 0, 1, 4 and 5 of

the TCON register. TMOD register selects the method of timer gating (GATE0), timer or

counter operation (T/C0#) and mode of operation (M10 and M00). The TCON register

provides timer 0 control functions: overflow flag (TF0), run control bit (TR0), interrupt

flag (IE0) and interrupt type control bit (IT0). For normal timer operation (GATE0= 0),

setting TR0 allows TL0 to be incremented by the selected input. Setting GATE0 and TR0

allows external pin INT0# to control timer operation.

Timer 0 overflow (count rolls over from all 1s to all 0s) sets TF0 flag, generating

an interrupt request. It is important to stop timer/counter before changing mode.

Timer 1

Timer 1 is identical to timer 0, except for mode 3, which is a hold-count mode.

The following comments help to understand the differences:

ECE, SIETK 75

HACKING OF ELECTRONIC EQUIPMENTS

• Timer 1 functions as either a timer or event counter in three modes of operation. Timer

1’s mode 3 is a hold-count mode.

• Timer 1 is controlled by the four high-order bits of the TMOD register and bits 2, 3, 6

and 7 of the TCON register. The TMOD register selects the method of timer gating

(GATE1), timer or counter operation (C/T1#) and mode of operation (M11 and M01).

The TCON register provides timer 1 control functions: overflow flag (TF1), run control

bit (TR1), interrupt flag (IE1) and interrupt type control bit (IT1).

• Timer 1 can serve as the baud rate generator for the serial port. Mode 2 is best suited for

this purpose.

Timer 2

Timer 2 is a 16-bit Timer/Counter that can operate as either a timer or an event

counter. The type of operation is selected by bit C/T2 in the SFR T2CON. Timer 2 has

three operating modes: capture, auto-reload (up or down counting), and baud rate

generator. The modes are selected by bits in T2CON. Timer 2 consists of two 8-bit

registers, TH2 and TL2. In the Timer function, the TL2 register is incremented every

machine cycle. Since a machine cycle consists of 12 oscillator periods, the count rate is

1/12 of the oscillator frequency.

ECE, SIETK 76