Flir E4 Thermal imaging camera teardown

[tiagobaracho]

is it a possibility in the future to be able to get higher FPS ? or is it the sensor that only can make 9 fps ?... just out of curiosity ..

The sensor is apparently capable of outputting raw 60 FPS data, but so far nobody has found out how to extract useful information from it.

It is blindingly obvious  how to extract the 60fps stream - just needs a bit of work to implement it.

Anyone of you guys will try that ?

Sure. Right after I finish the other 43586534535 projects. I suspect that you have bad luck that quite a few of us on here have quite a bit of motivation for high resolution, but a who-the-hell-cares attitude about fps. As in 9 fps is quite enough for all the stuff I do with it. PCBs and assorted other electronics tend to stay put and in focus, soooo... 

I am more motivated to make a linux bootloader, and even that is fairly low on the list.

You probably would have better luck with that on an RC helicopter forum or some such. But then, who's going to put a $1k camera on a crashy copter.

Anyways, just watch Mike's video again to see how blindingly obvious the todo list is staring you in the face.

]
i was just asking.... i have no real need for high FPS.... resolution, YES !! i will use on PCB for troubleshooting.....

[tomas123]

some notes around eeprom and 9hz, but nothing new informations

Code: [Select]

./i2c.exe
Usage: i2c [2] {r|w} <address> <no of bytes if read> <data to write>
       i2c [2] f <filename>
Write example:  i2c w A0 11 22 33 - Write 11h 22h 33h to A0h
Read example 1: i2c 2 r A0 10     - Read 10h bytes from A0h on I2C2:
Read example 2: i2c r A0 10 80    - Write 80h and Read 10h bytes from A0h
Read example 3: i2c r A0 10 80 40 - Write 80h 40h and Read 10h bytes from A0h (16-bit addressing)
File example 1: i2c f vf.txt      - Read command from file


the address A0h is common to all Serial EEPROM devices (with hard-wired pins A2, A1 and A0 to low) 

I think I've now worked out all the I2C devices :
0x92 Temperature sensor
0xD0 Realtime clock
0xAE EEPROM
0xAA BQ27510 battery manager

eeprom address 0xA0

Hmmm. found code that looks for the string "T198389" from I2C address 0XA0, and if found "SB0801 detector   found " else "ULIS detector found"

don't write direct to eeprom...

I have tried changing E4 to E8 in the eeprom with no effect.
I have found code (100033AC for those following along) that reads 16 bytes from the EE, checksums it and if sums OK, stores the EEPROM values somewhere , and if not stores 80 and 60 in the same locations. Still looking at other eeprom related code. I think the 6 near the resoltion data is also significant - seems to correlate with the "downsampling setting" vales displayed at boot.
I only had a very quick try at changing the ee so could be I got the sum wrong.

..use rset or web frontend

> rset version.product.name E8

It is blindingly obvious  how to extract the 60fps stream - just needs a bit of work to implement it.

unfortunately Flir doesn't sale a Ex with higher frame frequency, so surely the firmware doesn't support frequency > 9Hz

for inspiration a snip from a rls -r -l

Flir E4

Code: [Select]

.image.sysimg.basicImgData.distrData: (15)
rw----------n- 0 root   root   <i> imageFreq                      9
Flir E40

Code: [Select]

.image.sysimg.basicImgData.distrData: (15)
rw----------0- 0 root   root   <i> imageFreq                     30
syntax for (rw)

Code: [Select]

rwcdrwcdrwcd0p*1 user group <a> resource_name "value" Explanation:
First rwcd = owner read,write,create,delete rights flags.
Second rwcd = group read,write,create,delete rights flags.
Third rwcd = other read,write,create,delete rights flags.
0p*1 = subscribers, persistance, not default, users counts and flags <a> = node type (ascii/integer/double/index/entry)
For resources with fixed string values, all alternatives are listed as well.
find string "imageFreq" in old FW 1.18

Code: [Select]

./appcore.exe
distrData.imageFreq
--
./appcore_dll.dll
imageFreq
--
./ProdApp.exe
.image.sysimg.basicImgData.distrData.imageFreq
found this post

Maybe it is a language thing, but I am confused right now:
I thought, modifing the 4 bytes at 0x001016ec from "05 00 a0 e1" to "01 00 a0 e3" will enable 30Hz but in your posting above you say 100ms between each frame = ~9 Hz. Did I miss something or did I understood something wrong? So no 30Hz by changing appcore.exe?

That hex will enable something and rls will report 30 for some values that were formerly at 9. but nontheless the effective framerate will stay under 10Hz.
Anyway the Ex is quick enough so one does not have to wait too long for a new image ... I don't have a big urge to investigate that further

[Taucher]

It is blindingly obvious  how to extract the 60fps stream - just needs a bit of work to implement it.

unfortunately Flir doesn't sale a Ex with higher frame frequency, so surely the firmware doesn't support frequency > 9Hz

I suggest re-considering this:
- take a look at the strings inside gethwtype.exe ...
- the fact that the firmware shows obvious similarity to Exx series firmware
- the sensor outputs at 60Hz as measured by Mike
- i2c was not used in our hacks except for cosmetic stuff, but it's removal obviously got much attention in new firm

[KTP]

Can anyone with one of these E4 modified cameras point it at a propane tank after some use and tell me if it lets you see the level of the liquid in the tank?  Very curious.

[SeanB]

That will not be a problem, as the liquid level will be quite different to the ambient ( unless you are in the frozen parts of the USA) and will show as a band across the metal. Pouring hot water across the tank will show it up better though.

[scientist]

- i2c was not used in our hacks except for cosmetic stuff, but it's removal obviously got much attention in new firm

Or maybe it's a distraction so you don't see the FPGA changes that make your camera brick itself if it detects an unauthorized RNDIS connection after a particular date.

[ericpi]

Can anyone with one of these E4 modified cameras point it at a propane tank after some use and tell me if it lets you see the level of the liquid in the tank?  Very curious.

I just tried with my upgraded E4: I was not able to see the level in the propane tank. The entire tank looked uniform color / temperature, with no obvious liquid line.

However, as SeanB notes, I am indeed in the frozen parts of the Northeastern USA (right around 32F / 0C), so this might be the explanation.  I can gladly try again in a few months when it warms up

[Monadnock]

Can anyone with one of these E4 modified cameras point it at a propane tank after some use and tell me if it lets you see the level of the liquid in the tank?  Very curious.

I just tried with my upgraded E4: I was not able to see the level in the propane tank. The entire tank looked uniform color / temperature, with no obvious liquid line.

However, as SeanB notes, I am indeed in the frozen parts of the Northeastern USA (right around 32F / 0C), so this might be the explanation.  I can gladly try again in a few months when it warms up

A propane tank that is sitting with its valve closed will have uniform temperature throughout equal to the ambient. It is only when gas is flowing and the liquid propane is vaporizing that you will see a temperature difference since it is the the state change from liquid to gas that is the cooling process.

[georges80]

For propane, the trick is to pour some HOT water down the the side of the tank (that's how the LCD indicators work) and the metal tank part above the liquid will stay hotter for longer.

cheers,
george.

[tomas123]

I suggest re-considering this:
- take a look at the strings inside gethwtype.exe ...

What do you mean?
With 9Hz/30Hz Flir describes only known cameras like "Thermacam E2" = E40 (see /FlashBFS/system/web/images/E2.jpg)
our Flir E4 = "Z3 - ASCO camera"
see below

Code: [Select]

$ strings gethwtype.exe
...
Z3 - ASCO camera
...
Ex - T-Cam, unknown subtype (remote)
E4 - T-Cam, BACT2 AND ULIS detector
E3B- T-Cam, BACT2 AND SB0601 30 Hz detector
E3A- T-Cam, BACT2 AND SB0601 9 Hz detector
E2B- T-Cam, BACT AND SB0601 30 Hz detector
E2A- T-Cam, BACT AND SB0601 9 Hz detector
E1B- T-Cam, BACE rev 04-07 AND SB0401 30 Hz
E1A- T-Cam, BACE rev 04-07 AND SB0401 9 Hz
...


- the fact that the firmware shows obvious similarity to Exx series firmware

I see some differences in firmware/hardware...

info from E4 = FLIR Astra Z3:
/FlashFS/tmp/prod.log

Code: [Select]

2013-12-03 14:58:01 Found detectortype SB320 ISC0901, selecting detector S
2013-12-03 14:58:01 Lens leExFOL7
2013-12-03 14:58:01 Found osimgkit ASCO OS image, selecting Cameratype Z, Web-Addon Z3
2013-12-03 14:58:01 \FlashBFS\system/web/inc is updated for Z3
...
2013-12-03 14:58:07  14 Preparation:Image frequency 9
compare with E40 (Thermacam E2)

Code: [Select]

2013-06-15 01:40:37 Found detectortype SB320 ISC0601, selecting detector S
2013-06-15 01:40:37 Lens leE
2013-06-15 01:40:37 Found osimgkit SLCO OS image, selecting Cameratype E, Web-Addon E2
2013-06-15 01:40:37 /FlashFS/system/web/inc is updated for E2
...
2013-06-15 01:40:43  10 Preparation:Image frequency 30

[OrBy]

I would really find it quite funny if the 9Hz limit was actually being imposed by the WinCE side of things and the FPGA was actually outputting 30Hz the whole time... Given the slowness of the UI it's almost feasible but others have mentioned that the use of ?QT? was the most probable cause of the lag there.

*edit - why would the lcdc.dll driver care about the "C.a.m.e.r.a. .F.P.S.:" ?

[Sensor Geek]

Can anyone with one of these E4 modified cameras point it at a propane tank after some use and tell me if it lets you see the level of the liquid in the tank?  Very curious.

Yes, it's very evident. I've used against little 1lb (454g) camping tanks up to 3000gal (11k L) delivery trucks. Pictured here are three 100lb (45kg) tanks on my porch. On left is one in use (or had been in the last hour), in the middle a full spare, and on the right another full spare that got some sun earlier in the day. Clearly the one on the left will be replaced soon as it's down to ~20%. Outside temp is about -1C. Picture from a modified E4.

Edit 20140209: Added 2nd propane image. This image was taken a few minutes after heating the two full tanks on the right and middle with a torch. The center tank appears to have slightly more than the right.

[Taucher]

- i2c was not used in our hacks except for cosmetic stuff, but it's removal obviously got much attention in new firm

Or maybe it's a distraction so you don't see the FPGA changes that make your camera brick itself if it detects an unauthorized RNDIS connection after a particular date.

yeah, "hardware error, please contact support, error code: HKR"

Hm, if I had my E4 already open then I'd probably give it a try and completely disable/desolder the EEprom - just to see if the bootprocess would still work (ftp/telnet).

[Taucher]

Just a small bump for reference

Note on the sensor-naming ( ISC0901B0 ):
I'm pretty sure the first two numbers (09) are the sensor's generation year - deduced from some documents found online where that # went form 98 to 00 to 05 and 09 now... the next pair of numbers beeing the resolution/model and then followed by special features.
Unfortunately "our" ROIC isn't listed here: http://www.flir.com/cvs/cores/view/?id=51948

[KTP]

SensorGeek, thank you for the test!

We had been having a discussion on a rv forum about ways to accurately measure the level of propane left in a tank if you could not weigh it and I thought about this camera.

Adding that to the long list of reasons a modded E4 would be cool to own. 

[scientist]

- i2c was not used in our hacks except for cosmetic stuff, but it's removal obviously got much attention in new firm

Or maybe it's a distraction so you don't see the FPGA changes that make your camera brick itself if it detects an unauthorized RNDIS connection after a particular date.

yeah, "hardware error, please contact support, error code: HKR"

Hm, if I had my E4 already open then I'd probably give it a try and completely disable/desolder the EEprom - just to see if the bootprocess would still work (ftp/telnet).

I'd open it if I were you -- the disassembly process is well documented and it's just a SO-8 or SO-6 if I remember correctly.

[hgg]

Hi,

Just received the E4 unit!     Serial Number : 639121xx

Hackable, right  ?       

[Taucher]

Hi,

Just received the E4 unit!     Serial Number : 639121xx

Hackable, right  ?     

  (use brain - check firmware version)

[hgg]

(use brain - check firmware version)

How?  I don't have the unit in my hands.  It is in the US...

[mrflibble]

Hi,

Just received the E4 unit!     Serial Number : 639121xx

Hackable, right  ?     

  (use brain - check firmware version)

The correct answer would have been "yeah, sure!  ".

That'll teach 'm to engage brain.

[hgg]

Great!

[mrflibble]

(use brain - check firmware version)

How?  I don't have the unit in my hands.  It is the US...

Just received the E4 unit!     Serial Number : 639121xx

Different kind of "received" then? But never mind, the brain is active now so all will be fiiiiine.

[Fraser]

@hgg

And from my archive of serial numbers it look to have been Calibrated between 7 Jan and 16 Jan. Firmware 1.19.8 fitted.E4 V1.1 Hardware.

Extract from my records:
6391 17xx              07 Jan 14        1.19.8 E4 V1.1
6391 23xx              16 Jan            1.19.8 E4 V1.1
6391 25xx              18 Jan            1.19.8 E4 V1.1


This post may be of interest to you (your question is the reason that I compiled the data) :

https://www.eevblog.com/forum/reviews/flir-e4-the-useful-information-thread/msg332428/#msg332428

[hgg]

Hello Aurora,

Yes, I've checked your post first, but I just wanted to be sure...
That was close ...   

[Scutarius]

Finally I decided to make my tripod adapter, I hope you find it useful.

STL files and Links

mikeselectricstuff, I have no problem in sending you one, PM me.