PAN3101 OPTICAL MOUSE SENSOR HACKING TUTORIAL

[benji]

hello folks,,recently i did the code to hack this sensor,,,the code works perfectly,,the circuit is just perfect, all interface issues have been handled,
i still didnt play with the lenses to make the appropriate distance
but anyways if anyone is interested in this i would gladly post the code with little comments,,maybe it can be a tutorial
i did write the code in c but i did the write/read functions in assembly as its very important to handle timing so assembly is way more clear in timing issues
and hey admin,,can i get red bots if i post this?

let me know if anyone is interested

[superchiku]

sure good work do post the code and do tell us how u did it??

[JAy1st]

There's a guy on the Arduino forum who managed to do the same and send the "picture" by serial and have it displayed on his computer

[benji]

so , here is the butter

Code: [Select]

nclude <mega8.h>
#include <delay.h>


// Standard Input/Output functions
#include <stdio.h>

void writepan(void);
void readpan(void);

// Declare your global variables here
  unsigned char aval,address;
  signed char rddata;
  signed long int accu;

void main(void)
{
// Declare your local variables here
unsigned char i;
// Input/Output Ports initialization
// Port B initialization
// Func7=Out Func6=Out Func5=Out Func4=Out Func3=Out Func2=Out Func1=Out Func0=Out
// State7=0 State6=0 State5=0 State4=0 State3=0 State2=0 State1=0 State0=0
PORTB=0x00;
DDRB=0x3F;

// Port C initialization
// Func6=In Func5=In Func4=In Func3=In Func2=In Func1=In Func0=In
// State6=T State5=T State4=T State3=T State2=T State1=P State0=T
PORTC=0x02;
DDRC=0x2C;

// Port D initialization
// Func7=Out Func6=Out Func5=In Func4=In Func3=In Func2=In Func1=In Func0=In
// State7=1 State6=1 State5=T State4=T State3=T State2=T State1=T State0=T
PORTD=0xC0;
DDRD=0xC0;

// Timer/Counter 0 initialization
// Clock source: System Clock
// Clock value: Timer 0 Stopped
TCCR0=0x00;
TCNT0=0x00;

// Timer/Counter 1 initialization
// Clock source: System Clock
// Clock value: Timer 1 Stopped
// Mode: Normal top=FFFFh
// OC1A output: Discon.
// OC1B output: Discon.
// Noise Canceler: Off
// Input Capture on Falling Edge
// Timer 1 Overflow Interrupt: Off
// Input Capture Interrupt: Off
// Compare A Match Interrupt: Off
// Compare B Match Interrupt: Off
TCCR1A=0x00;
TCCR1B=0x00;
TCNT1H=0x00;
TCNT1L=0x00;
ICR1H=0x00;
ICR1L=0x00;
OCR1AH=0x00;
OCR1AL=0x00;
OCR1BH=0x00;
OCR1BL=0x00;

// Timer/Counter 2 initialization
// Clock source: System Clock
// Clock value: Timer 2 Stopped
// Mode: Normal top=FFh
// OC2 output: Disconnected
ASSR=0x00;
TCCR2=0x00;
TCNT2=0x00;
OCR2=0x00;

// External Interrupt(s) initialization
// INT0: Off
// INT1: Off
MCUCR=0x00;

// Timer(s)/Counter(s) Interrupt(s) initialization
TIMSK=0x00;

// USART initialization
// Communication Parameters: 8 Data, 1 Stop, No Parity
// USART Receiver: On
// USART Transmitter: On
// USART Mode: Asynchronous
// USART Baud rate: 9600
UCSRA=0x00;
UCSRB=0x18;
UCSRC=0x86;
UBRRH=0x00;
UBRRL=0x33;

// Analog Comparator initialization
// Analog Comparator: Off
// Analog Comparator Input Capture by Timer/Counter 1: Off
ACSR=0x80;
SFIOR=0x00;
rddata=0x10;
accu=0xAAAAAAAA;
checkagain:
if (PINC.1 == 1)
        goto checkagain;
delay_ms(4000);
aval=0b00001101;
address=0x1A;
writepan();
while (1)
      {
      // Place your code here
      address=0x41; //010xxxxx
      readpan();
      delay_ms(1000);
      address=0x16; // motion
      readpan();
      delay_ms(1000);
      address=0x01; //000xxxxx
      readpan();
      delay_ms(1000);
      address=0x44; // quality
      readpan();
      delay_ms(1000);
      PORTC.5=~PORTC.5;  //toggle led to check program flow
      };
}
void writepan(void)
{
#asm
RJMP writepan
delay5:
NOP
PUSH R16
CLZ
LDI R16,9
back:DEC R16
BRNE back
POP R16
ret
delay4:
NOP
PUSH R16
CLZ
LDI R16,7
back1:DEC R16
BRNE back1
POP R16
ret
writepan:
CBI 0x12,7
SBI 0x12,6
RCALL delay5
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,6
RJMP clearout11
SBI 0x12,6
RJMP cont11
clearout11:CBI 0x12,6
cont11:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,5
RJMP clearout21
SBI 0x12,6
RJMP cont21
clearout21:CBI 0x12,6
cont21:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,4
RJMP clearout31
SBI 0x12,6
RJMP cont31
clearout31:CBI 0x12,6
cont31:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,3
RJMP clearout41
SBI 0x12,6
RJMP cont41
clearout41:CBI 0x12,6
cont41:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,2
RJMP clearout51
SBI 0x12,6
RJMP cont51
clearout51:CBI 0x12,6
cont51:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,1
RJMP clearout61
SBI 0x12,6
RJMP cont61
clearout61:CBI 0x12,6
cont61:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,0
RJMP clearout71
SBI 0x12,6
RJMP cont71
clearout71:CBI 0x12,6
cont71:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R5,7
RJMP clearout81
SBI 0x12,6
RJMP cont81
clearout81:CBI 0x12,6
cont81:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R5,6
RJMP clearout91
SBI 0x12,6
RJMP cont91
clearout91:CBI 0x12,6
cont91:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R5,5
RJMP clearout101
SBI 0x12,6
RJMP cont101
clearout101:CBI 0x12,6
cont101:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R5,4
RJMP clearout111
SBI 0x12,6
RJMP cont111
clearout111:CBI 0x12,6
cont111:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R5,3
RJMP clearout121
SBI 0x12,6
RJMP cont121
clearout121:CBI 0x12,6
cont121:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R5,2
RJMP clearout131
SBI 0x12,6
RJMP cont131
clearout131:CBI 0x12,6
cont131:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R5,1
RJMP clearout141
SBI 0x12,6
RJMP cont141
clearout141:CBI 0x12,6
cont141:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R5,0
RJMP clearout151
SBI 0x12,6
RJMP cont151
clearout151:CBI 0x12,6
cont151:
RCALL delay4
SBI 0x12,7
RCALL delay5
#endasm
}
void readpan(void)
{
#asm
readpan:
CBI 0x12,7
CBI 0x12,6
RCALL delay5
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,6
RJMP clearout1
SBI 0x12,6
RJMP cont1
clearout1:CBI 0x12,6
cont1:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,5
RJMP clearout2
SBI 0x12,6
RJMP cont2
clearout2:CBI 0x12,6
cont2:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,4
RJMP clearout3
SBI 0x12,6
RJMP cont3
clearout3:CBI 0x12,6
cont3:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,3
RJMP clearout4
SBI 0x12,6
RJMP cont4
clearout4:CBI 0x12,6
cont4:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,2
RJMP clearout5
SBI 0x12,6
RJMP cont5
clearout5:CBI 0x12,6
cont5:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,1
RJMP clearout6
SBI 0x12,6
RJMP cont6
clearout6:CBI 0x12,6
cont6:
RCALL delay4
SBI 0x12,7
RCALL delay5

CBI 0x12,7
SBRS R4,0
RJMP clearout7
SBI 0x12,6
RJMP cont7
clearout7:CBI 0x12,6
cont7:
RCALL delay4
SBI 0x12,7
RCALL delay4

CBI 0x11,6
SBI 0x12,6
NOP
NOP
NOP
NOP

CBI 0x12,7
RCALL delay5
SBI 0x12,7
SBIS 0x10,6
RJMP clearb7
SBI 0x15,3
RJMP con7
clearb7:CBI 0x15,3
con7:
RCALL delay4

CBI 0x12,7
RCALL delay5
SBI 0x12,7
SBIS 0x10,6
RJMP clearb6
SBI 0x15,2
RJMP con6
clearb6:CBI 0x15,2
con6:
RCALL delay4

CBI 0x12,7
RCALL delay5
SBI 0x12,7
SBIS 0x10,6
RJMP clearb5
SBI 0x18,5
RJMP con5
clearb5:CBI 0x18,5
con5:
RCALL delay4

CBI 0x12,7
RCALL delay5
SBI 0x12,7
SBIS 0x10,6
RJMP clearb4
SBI 0x18,4
RJMP con4
clearb4:CBI 0x18,4
con4:
RCALL delay4

CBI 0x12,7
RCALL delay5
SBI 0x12,7
SBIS 0x10,6
RJMP clearb3
SBI 0x18,3
RJMP con3
clearb3:CBI 0x18,3
con3:
RCALL delay4

CBI 0x12,7
RCALL delay5
SBI 0x12,7
SBIS 0x10,6
RJMP clearb2
SBI 0x18,2
RJMP con2
clearb2:CBI 0x18,2
con2:
RCALL delay4

CBI 0x12,7
RCALL delay5
SBI 0x12,7
SBIS 0x10,6
RJMP clearb1
SBI 0x18,1
RJMP con1
clearb1:CBI 0x18,1
con1:
RCALL delay4

CBI 0x12,7
RCALL delay5
SBI 0x12,7
SBIS 0x10,6
RJMP clearb0
SBI 0x18,0
RJMP con0
clearb0:CBI 0x18,0
con0:
RCALL delay4

CBI 0x12,7
RCALL delay5
SBI 0x12,7
SBI 0x11,6

SBIS 0x15,3
RJMP clearr77
SET
RJMP contin7
clearr77:
CLT
contin7:
BLD R7,7 

SBIS 0x15,2
RJMP clearr76
SET
RJMP contin6
clearr76:
CLT
contin6:
BLD R7,6

SBIS 0x18,5
RJMP clearr75
SET
RJMP contin5
clearr75:
CLT
contin5:
BLD R7,5

SBIS 0x18,4
RJMP clearr74
SET
RJMP contin4
clearr74:
CLT
contin4:
BLD R7,4

SBIS 0x18,3
RJMP clearr73
SET
RJMP contin3
clearr73:
CLT
contin3:
BLD R7,3

SBIS 0x18,2
RJMP clearr72
SET
RJMP contin2
clearr72:
CLT
contin2:
BLD R7,2

SBIS 0x18,1
RJMP clearr71
SET
RJMP contin1
clearr71:
CLT
contin1:
BLD R7,1

SBIS 0x18,0
RJMP clearr70
SET
RJMP contin0
clearr70:
CLT
contin0:
BLD R7,0
#endasm
}

[benji]

to know how the code works you have to have the pan3101 datasheet /check serial communication protocol.
i did implement this protocol in assembly ,,the main program that calls the functions is in c

feel free to ask any questions

[superchiku]

whoa!!! thats a long program you have written.

[benji]

thats what it takes to hack that boy 

[Trumpkin]

GAHHHHHH!!!! THAT A LOT OF WORK JUST LOOKING AT THE PROGRAM!!!!!!  How long did it take to write that sucker?

[benji]

How long did it take to write that sucker?

about 3 days,,,,maybe 4

[benji]

hey folks,, anyone can link to some good website about the optics?
i did check some but couldnt find a website that explains theory,, i want to know how should the light be when comin to the camera surface(lens)
i know about lenses and focal length , juts need to know what the conditions are to make this sensor SEE

[brijesh]

I am also working on something similar. Have been looking for site that explains optical stuff. Found nothing better than wikipedia and links it has. Not only sites, its tough to find a source of inexpensive hobby grade lens and lens mounts.

 

[benji]

info about lenses are pretty much plenty but im lookin for the optical conditions to meet to make this sensor have good quality image

[brijesh]

info about lenses are pretty much plenty but im lookin for the optical conditions to meet to make this sensor have good quality image

http://www.exploratorium.edu/light_walk/

The link about does not directly answer your question, but its damn good in terms of helping one to better understand the optics. I found it very interesting.

[benji]

a link is laoded with pics, but talk general stuff, anywas thanks for mentioning that

i guess ill be doing a tutor with pics for this in the website

i just need to do a lil research about the optics ,,hope gets done by the time

if anyone gets info about optics hope to let me know

[Shubham]

I have been doing a project to make an odometry sensor using optical mouse sensor.
The following link will be very useful to all in designing a new lens system for the sensor(ie the specs of lens to use when sensor is at different height).
also read the NASA tech review paper which is referred in this link.

http://home.roadrunner.com/~maccody/robotics/croms-1/croms-1.html


I am myself looking for a mouse that is build around a sensor which can be programmed directly ie.PAN3101 or ADNS-2610 or ADNS-3060 or ADNS-2051 etc.
can somebody tell which optical mouse model of which company is build using these sensors ? so that i can use it for my hack.

While referring to the datasheet of ADNS-2610 , it said that Serial Port Clock Frequency should be fclk/12 , and the mouse circuit has a 24MHZ oscillator , so does that imply that I have to generate a clock signal from my microcontroller of frequency 2MHz ?
can the Serial Port Clock Frequency be less than that ?

generating a 2MHz clock using timer as well as writing or reading the SDIO pin during one half cycle (ie we complete writing to SDIO during the time clock is low)  would be a tricky part with ATMega8L that I use because ATMega8L can run max at 8MHz ?

[benji]

also read the NASA tech review paper which is referred in this link.

http://home.roadrunner.com/~maccody/robotics/croms-1/croms-1.html

can u tell us how did you choose the lenses?

can somebody tell which optical mouse model of which company is build using these sensors ? so that i can use it for my hack.

i did open an A4TECH made in china mouse and the sensor is the PAN3101

so does that imply that I have to generate a clock signal from my microcontroller of frequency 2MHz ?

YES

can the Serial Port Clock Frequency be less than that ?

YEA IT CAN

generating a 2MHz clock using timer as well as writing or reading the SDIO pin during one half cycle (ie we complete writing to SDIO during the time clock is low)  would be a tricky part with ATMega8L that I use because ATMega8L can run max at 8MHz ?

YOU CAN USE TIMERS AND YOU CAN USE OTHER WAYS,, check my code , it doesnt use timers and its made for the atmega8l ,,it runs at 8mhz

[benji]

by the way

PORTD.6 is data
PORTD.7 is clock

[Shubham]

For choosing lens , you need two parameters focal length and aperture.
Suppose you want that the height of the sensor should be above ground by 5 cm.
also fix a maximum speed of the robot suppose 1m/s.
Now according to the sensor choose a frame rate ie 2300fps( or 1500 fps) .
In one frame calculate the maximum distace the robot can move now, ie:           (max speed/time for 1 frame).
assume that this displacement has to match the 2 pixel displacement on the sensor, this will give us the magnification neede for the lens ie: magnification=
lenght of 2 pixels/max displacement of robot in 1 frame.
(this is assumed bcos the optical flow algo. that is used to calculate displacement will work fine then)

now we have formula : magnification= - focal length/distace(5 cm);
this gives us focal length.

now aperture value is needed to make sure that correct amount of light intensity is avaliable for sensor and also the aperture value changes the depth field .
According to the links and NASA paper I would go with a lens of aperture 10mm and us different aperture stop during testing.

I assumed height of 5 cm, max speed 1m/s , 2300 fps and focal length comes out to be around 14mm.

I have not actually done this , but will be doing this within a month .

[benji]

thanks a lot for mentioning this,,though i have some questions

magnification=
lenght of 2 pixels/max displacement of robot in 1 frame.

well i understand how you did calculate the max displacement in 1 frame but how do you know the length of 2 pixels??
is it from the center of 1 pixel to the center of the other?

now aperture value is needed to make sure that correct amount of light intensity is avaliable for sensor and also the aperture value changes the depth field .
According to the links and NASA paper I would go with a lens of aperture 10mm and us different aperture stop during testing.

doesnt it depend on how u are illuminating the sensor? how much light? how big is the led?
and how should the led be oriented?

thanks again ,,

[Shubham]

Well the 2 pixel is according to the NASA paper .
This value of 2 pixel is actually the requirement of optical flow algorithm that calculates the displacement between 2 frames(images) taken by the sensor.
and it is not from the centre.
this 2 pixel displacement is only used here to map the duisplacement on land over the sensor's pixel.

The illumination by led , and all that u mentioned affect the aperture stop diameter , i gues it has to be hit and trial.
take an aperture stop and then get the frame dump on PC and then fine tune the LED position etc.

The sensor should be facing the gound directly( but i have read research papers citing that they have worked with sensors at 45 degree).

 

[Shubham]

well benji i am not currently good with assembly , (i am still doing my btech )

can u post atleat a pseudo code of read function(or maybe write function)

i intented to do implement these by using delays
ie
loop()
{
wait tll clock goes high ;
read the data line;
wait till clock goes low;
}

something like this

[benji]

mm i will post in SOR a tutorial about optical mouse hacking(this is also will be in the contest)
the problem is that its not ready yet..
anyways there is the PAN3101 DATASHEET
there they explain the serial communication protocol,so its a great pseudo code
with drawn signals and timing...
i did this with assembly not because i love assembly,, i wanted to do it in C
but because the protocol need precise timing i needed assembly because i can easily know how much time each operation
will consume, and this way i implement the protocol perfectly ..
now you can tell me you can debug C programs ,i know,, but when doing such a thing assembly becomes easier to work with
,,by the way ,,its not a hard thing to learn , just get the atmega8 datasheet and they explain what each operation does
its easy,,

[benji]

and by the way ,, i did the main program in C , i just built the read / write sensor functions in assembly

and is this the NASA paper ur talkin about?
http://www.techbriefs.com/content/view/213/34/

if its another can u please post it

[bootstrap]

to know how the code works you have to have the pan3101 datasheet /check serial communication protocol.
i did implement this protocol in assembly ,,the main program that calls the functions is in c

feel free to ask any questions

Dear Benji could you please mail us the PAN3101 datasheet and the required circuit diagram to interface the sensor on the mouse with the atmega8.Also are you capturing the image from the sensor or you are taking the X1,X2, Y1,Y2 reading from the sensor.

[benji]

the PAN3101 is a low cost sensor , it doesnt provide ya registers to read the image it just has registers to inform ya of the change in (x , y)

the datasheet used to be in here

http://www.pixart.com.tw/
i did look for it now but couldnt see it,, i think they took it off
anyways i will send it but how do i mail a datasheet of pdf to SOR?


about the interface its only the PORTD.6 of the atmega8l to the data pin of the sensor
and the PORTD.7 of the atmega8l to the clock pin of the sensor
and a 8mhz external crystal with 2 caps of 22pf with ground
and of course the vcc and gnd pins
ill provide an image also in a while

[benji]

here is a schematic

you should provide 5 volts also to the pan vcc pin and gnd to the pan gnd pin

about powering th micro you provide 3.8 volts to vcc and gnd for gnd

so why 3.8? its just to make the VOH OF THE PAN AND VIH OF THE ATMEGA MATCH
(check both datasheets to see what i mean)
vih of the micro is 0.6*vcc=0.6*5=3 volts
while voh of the pan is 2.7

so sometimes when the pan outs a 1logic(2.7) the micro wont understand it as 1 logic and the byte is changed

so when you power the micro with 3.8 you get vih=0.6*3.8=2.28 
the low (0 logic ) would change a little but still be ok(in limits)

anyways i did write 5 volts in the schematic ,, you can try it i never did ,,cuz in the datasheet of the pan one of the charachteristics of the pan they say its 5 volts tolerant ,,so maybe it could work with 5volts power to the micro

 

[benji]

forgot to mention that you should power the  micro then the sensor

and forgot also to attach this,,

[Shubham]

The link to NASA paper is:

http://www.techbriefs.com/content/view/216/32/

[benji]

i did read it thanks, plenty of info,, still not sure about how much light it needs when u go further from the ground

[ac1006]

any idea about converting int to char?
 
enter: 1110
result: one thousand one hundred ten

more ideas will be appreciated..thanks