Case Study
Secure Data Acquisition Platform
Bare-metal Cortex-M33 sensor platform with SD storage and authenticated encryption
Sole firmware developer on an embedded sensor-logging platform for a defense application. Brought the board up from first power-on (clock tree, peripheral init, runtime baseline) then built the full acquisition and storage path: register-level I2C drivers for inertial and thermal sensing, an SPI microSD driver written from scratch against a FAT filesystem, a self-describing wire format for the logged records, and authenticated encryption protecting data at rest. Validated through multi-hour continuous endurance runs.
Role
Sole firmware engineer –– bring-up, drivers, storage, encryption, validation
Timeline
In development — 2026
Status
Active development
Platform
ARM Cortex-M33, bare-metal C
Context
Stukes Defense
01
Overview
A bare-metal firmware platform that acquires inertial and thermal sensor data, encodes it into a self-describing record format, and writes it to removable storage under authenticated encryption. The system is built to log continuously for hours without intervention, survive interruption without corrupting the record, and make tampering with stored data detectable rather than silent.
I joined at first power-on and built the stack as the sole firmware developer: clock and peripheral configuration, sensor drivers written directly against register maps with explicit device validation and error handling, a block-level SPI storage driver implemented from scratch rather than pulled from a vendor example, the encoding and block-assembly pipeline, and the cryptographic layer. The architecture separates drivers, sensor abstraction, encoding, and application flow so the same firmware carries forward across hardware revisions.
02
Technical Design
Three design constraints shaped the system. Acquisition had to stay deterministic while storage writes contended for time on the same core, so the sampling path is decoupled from the write path rather than sharing a call stack. The record format had to be self-describing, so a reader can parse a session without out-of-band knowledge of what was logged or in what order. And storage had to be resilient to interruption, since a session that ends unexpectedly still has to leave a readable record behind rather than a truncated one.
- —Board bring-up from first power-on: clock configuration, peripheral initialization, validated runtime baseline
- —Register-level I2C drivers for inertial and thermal sensing with device identity checks and structured error handling
- —SPI block storage driver written from scratch against a FAT filesystem — initialization sequence, block read/write, session-based file management
- —Self-describing record encoding and block assembly against a formal wire-format specification
- —Authenticated encryption for data at rest, including nonce construction and key handling
- —Layered architecture separating drivers, sensor abstraction, encoding, and application flow
03
Outcomes
- —Verified end-to-end: real session data decrypts and parses correctly, and deliberately tampered records are rejected rather than silently accepted
- —Sustained continuous logging across multi-hour endurance runs with storage integrity and encryption reliability intact