Most microcontrollers in this class are chosen for their core or their price. This group is frequently chosen for one block: a capacitive sensing unit in its second generation, which lets a product have a glass front panel with no moving parts.

That choice shapes the firmware. A touch design is not written as a collection of input handlers. It is written as data — a mask saying which electrodes exist, a table saying how sensitive each one is, and a set of baselines saying what each one reads when nothing is touching it — wrapped in a scan loop that keeps those baselines honest as the environment changes.

All of that survives into a recovered image, and it is usually the most legible part of it.

From capacitance to a number

The measurement is a count. An electrode has a capacitance to ground; a finger near it adds a small amount in parallel; the sensing block converts the difference into a digital value by counting charge-transfer cycles.

Self-capacitance measures each electrode against ground, which is simple and works through thick overlays. Mutual-capacitance drives one electrode and measures another, which needs two layers and is better at rejecting water films, because a water film couples to ground rather than between electrodes.

The mode is not visible as a flag in the image, but it is inferable from the channel counts: a design with twelve keys and twelve channels is self-capacitance; a design with twelve keys and eight channels is a matrix and therefore mutual.

The channel mask is a bitmap of the product

The sensing block is told which channels to scan by writing a bit pattern to a set of registers. Each bit corresponds to a physical channel, and setting it enables that channel for the next scan.

That bit pattern is, quite literally, a drawing of the product’s front panel. Ten bits set means ten electrodes. The positions of the set bits say which pins are used, and therefore which physical corner of the board each key occupies.

Reading it takes one pass through the initialisation code, and it answers the first question any customer asks about a touch product: how many keys does this firmware expect.

Thresholds and baselines are not the same thing

This distinction is the one that separates a working touch design from a flaky one, and both quantities appear in the image.

A threshold is a constant. It says how far a reading must deviate from its baseline before the firmware considers the key touched. It is set once, by the designer, and usually differs per channel because electrode sizes and overlay thicknesses differ.

A baseline is a variable. It is the reading the channel produces when untouched, and it drifts: temperature changes, humidity changes, the panel gains a fingerprint, the electronics age. The firmware maintains it continuously by tracking the reading slowly and only when no touch is present.

The last row is the one that is almost never documented and always important. A drift rate that is too fast makes the panel cancel slow touches; too slow and the panel drifts out of range in a warm room. Finding the constant that sets it tells you what the designer was worried about.

Debounce, which is a number rather than a technique

Between a reading that exceeds a threshold and a key press that the application believes in, there is a count. Firmware requires the condition to hold for several consecutive scans before accepting it, and for several more before releasing.

That count is a small integer in the image, and it is a direct statement of the design’s scan rate and its tolerance for noise. At a hundred scans per second, a count of three means thirty milliseconds of confirmation — fast enough to feel instant, slow enough to reject a spike.

The low-power loop

Touch products spend most of their lives waiting. This sensing block can run during a low-power mode and wake the core when a channel crosses its threshold, which is the reason the part appears in battery-powered panels.

That arrangement puts the scan where a recovery reader does not expect it: not in a timer interrupt, but in the wake-up path from a low-power state. Finding the block that configures the wake condition, then the handler that runs after it, is the shortest route to the application.

Reading the touch section out of an image

1. Locate the register writes that set the channel mask. The bit pattern is the electrode map.
2. Follow the pointer that the scan routine uses for its per-channel constants. That table holds thresholds and release thresholds, usually as an array of equal-length records.
3. Find where the baselines are initialised. The values are raw counts and they will be in a plausible band — non-zero, similar to each other, not full scale.
4. Look for the drift update. It is usually a slow filter: a subtraction, a shift, an addition, applied only when no channel is active.
5. Note the debounce count, and derive the scan rate from the timer configuration.

Steps one to three take an hour and produce a description of the product’s sensing surface that no other source provides.

What the deliverable contains

The return set is the code flash image, the data flash separately, the configuration words, the identification words as read, a disassembly with the vector table resolved, and the extracted touch parameters: channel mask, per-channel thresholds, initial baselines, drift constant and debounce count.

That parameter set is often the reason the job was commissioned. A customer rebuilding a panel needs to know what the old firmware expected, and those five items are the whole of that expectation.

The package limit on channel count is covered in R7FA2L1AB3CFM binary recovery. The array size that constrains how much of this fits is in R7FA2L1A93CFP binary recovery, and the wide supply range that matters on a battery-powered panel in R7FA2L1A92DFM program recovery.

FAQ

Can the number of keys be determined without the code? From the panel, by counting electrodes. From the image it is exact, from the channel mask.

Why do thresholds differ between channels? Because electrode area and overlay thickness differ. A uniform threshold makes some keys over-sensitive and others sluggish.

What happens if the baseline is wrong? The key reads as permanently pressed or never pressed, depending on the direction of the error. It is the most common field failure on touch products.

Conclusion

A touch panel is data before it is code. The channel mask draws the product, the threshold table sets its feel, and the drifting baseline keeps it honest. All three are in the image at known places, and extracting them gives a customer a specification for a panel they may have lost the drawings for.

Comments are closed.