Flir E4 Thermal imaging camera teardown

[mikeselectricstuff]

The new FW is out! It is version 2.1.0 ! A new protection has been added to protect against menu hack!
But not against resolution hack, I think!  The menu files are now crc protect, CRC ??
The update adds the advertised new features (manual scale, two new image modes: blending and alignment) for the E8 (only for E8?).

I think, for the menu hack, crc protection must be deleted from applaunch.dat. But question is, this file can be changed? It looks like a protection in applaunch.sgn ... 
Who wants to test it? 

@Mike: You should add it to the first post.

Here we go again.... I'd be surprised if there wasn't something to counter resolution hacks on production units with this firmware.

Maybe they just got bored and wanted to stir things up to push the post count here over the 5000 mark... 

[CFH]

Special thanks to freak_ge for the help and for everyone else who commented on helping me on my way. All was successful. Great forum.

[Ed.Kloonk]

Maybe they just got bored and wanted to stir things up to push the post count here over the 5000 mark... 

Nearly there...

[mikeselectricstuff]

Post #5000
That is all.

[miguelvp]

Post #5000
That is all.

That would be reply #5000, the post #5000 was the "Nearly there"

The counter doesn't count the OP, not that you don't count, cuz you do

[Mr-Beamer]

Mike, I took a screen cap of your tear down film and put the ball array layout from the datasheet on top of it.

Following the traces I think I fond the JTAG connections.
Is it useful to investigate this further?


PS I found a good clamp for the Flir.
http://www.ebay.com/itm/221191232238?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649

[Rainer]

is there any link to the new firmware-package? or can someone post a zip of the new filesystem?

If there is any possibility to decode, it could be a good idea, to extract the new overlay options...

[mikeselectricstuff]

Mike, I took a screen cap of your tear down film and put the ball array layout from the datasheet on top of it.

Following the traces I think I fond the JTAG connections.
Is it useful to investigate this further?

Not really, unless you fancy writing completely new FPGA code, and firmware to drive it

[edavid]

PS I found a good clamp for the Flir.
http://www.ebay.com/itm/221191232238?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649

Are the teeth inside the clamp soft or hard?  Do they indent the E4 handle?

Update: Thanks, I ordered one!

[Fraser]

@freak_ge

I just read your post, the following new file looks ominous ! .......  fpga_lepton.bin

I thought the Lepton low resolution core was in the FLIR One iphone add-on ...... could this mean an fpga centric  resolution lockdown I wonder ?  If so, say goodbye to an easy resolution upgrade unless you fancy re-writing the fpga. There is also the possibility that the E4 hardware has been revised as it is the most likely to be bought and 'hacked' by a consumer on a budget. Could it be that the next generation of E4 to be released will look like previous models but contain a Lepton core ? That would permanently solve FLIR's problem of users hacking the E4. The next cheapest platform to 'hack' would then be the more expensive E5 or E6.

There is, of course, the possibility that the new firmware release incorporated Lepton related files to support the FLIR One of future Lepton based FLIR products. As has been said my Mike. We should expect future low resolution cameras from FLIR to contain a Lepton core as this is FLIR's new 'baby' for consumer grade cameras at 80x60 resolution. Datasheet attached. It is certainly a neat core, a pity it is only 80x60 though. I wonder if higher resolution cores will be release in the same compact format ? Could the Lepton be 320x240 core with E4 style hobbling on the video processing side of the core ? Time will tell 

Aurora

[Fraser]

@freak_ge

As has been said by knowledgeable people on this Forum, reverse engineering an fpga .bin file is not something that may be bone easily, especially if you do not have the required proprietary software tools for the particular fpga chip family. If FLIR have placed protection inside the fpga, it will be down to whether the code may be circumvented between it and the OS and that very much depends upon the nature of the protection employed. The E4 may still produce the full resolution on the two digital outputs from the micro-bolometer but building a new image processing section to turn such into a decent image appears to not be trivial. Better to buy an old stock E4 or E5 and upgrade it   

[Zucca]

I have the hack 1.19.8 FW with Taucher Beta3 Menus and Zoom activated. To me all those new FW are a try to contain the hack rather than to fix or implement new functions.
So unless a new killer function will be released, I will NOT upgrade my E4 with the risk to go back to 2x4 pixel resolution forever.

(manual scale, two new image modes: blending and alignment)

what the heck are exactly those ones? Do we have more details? I can just imagine something.. but no idea if they will be really useful.

[Taucher]

I have the hack 1.9.8 FW with Taucher Beta3 Menus and Zoom activated. To me all those new FW are a try to contain the hack rather than to fix or implement new functions.

Well, actually Flir has realized that the hidden "manual scale" function could cause people to buy the E8... so they enabled it for E8 ... turning an already built-in feature into a premium simply requires such steps like intentionally crippling hardware in order to satisfy some marketing formula for market segmentation.

Seems to be a trend and not only confined to some industries.

[TinyScooby]

I have the hack 1.9.8 FW with Taucher Beta3 Menus and Zoom activated. To me all those new FW are a try to contain the hack rather than to fix or implement new functions.

Well, actually Flir has realized that the hidden "manual scale" function could cause people to buy the E8... so they enabled it for E8 ... turning an already built-in feature into a premium simply requires such steps like intentionally crippling hardware in order to satisfy some marketing formula for market segmentation.

Seems to be a trend and not only confined to some industries.

I have a question related to this as well.

I was wondering if Mike could tear down a surveillance camera that might have a similar firmware cripple as the E4.

Basically, I want to know if the Acti E77 camera can be allowed to have higher frame rates if not bound by the firmware?

The Acti E77 is a new 4K resolution surveillance camera that has 30 frames per second at 1080p resolutions, but then dips to only 6 frames per second at all other higher resolutions.

From the Acti E77 spec sheet:

6 fps at 3648 x 2736; 6 fps at 3648 x 2160; 6 fps at 2592 x 1944; 6 fps at 2048 x 1536;
30 fps at 1920 x 1080

How can this camera only get 6 frames per second at all these other resolutions if it gets 30 frames at 1920 x 1080?

Shouldn't 2048 x 1536 produce a much higher frame rate than 3648 x 2736?

I thought this might be a firmware lock like the E4 had. How can I tell? Would Mike ever be able to do something similar on the E4 to the Acti E77?  I know they are different types of camera's but it still seems like to me that the firmware of the E77 is limiting the framerates. Any ideas?  thanks

[mikeselectricstuff]

Basically, I want to know if the Acti E77 camera can be allowed to have higher frame rates if not bound by the firmware?
The Acti E77 is a new 4K resolution surveillance camera that has 30 frames per second at 1080p resolutions, but then dips to only 6 frames per second at all other higher resolutions.

From the Acti E77 spec sheet:

6 fps at 3648 x 2736; 6 fps at 3648 x 2160; 6 fps at 2592 x 1944; 6 fps at 2048 x 1536;
30 fps at 1920 x 1080

How can this camera only get 6 frames per second at all these other resolutions if it gets 30 frames at 1920 x 1080?

Bandwidth limitation and/or processing capacity for compression.

[TinyScooby]

Basically, I want to know if the Acti E77 camera can be allowed to have higher frame rates if not bound by the firmware?
The Acti E77 is a new 4K resolution surveillance camera that has 30 frames per second at 1080p resolutions, but then dips to only 6 frames per second at all other higher resolutions.

From the Acti E77 spec sheet:

6 fps at 3648 x 2736; 6 fps at 3648 x 2160; 6 fps at 2592 x 1944; 6 fps at 2048 x 1536;
30 fps at 1920 x 1080

How can this camera only get 6 frames per second at all these other resolutions if it gets 30 frames at 1920 x 1080?

Bandwidth limitation and/or processing capacity for compression.

Thanks Mike.

Is this a limitation of the hardware itself?

I'm curious if the hardware is capable of higher frame rates at say, 2048 x 1536, for example? Could a firmware change allow this camera to do 2048 x 1536 at greater than 6 frames?

Acti has a whole new line of 4K cameras that all have this same exact limitation. (6 fps at 3648 x 2736  and 2048 x 1536 at 6 fps). Usually framerates drop exponentially with higher resolutions, but all these resolutions at the same exact frame rate seems odd to me. Guess there is a key element I don't understand about how this works.

With a video card for instance, every bump in resolution usually costs more frames per second. Maybe its different with camera hardware or something.

[Taucher]

Those CCTV cameras are limited by computational power for encoding the video and limited by data-bus throughput.
Usually they are developed on a SoC according to a reference design (~1000 USD - just enough to keep private people out).
The SoC has a finite computation power, so take it as "bytes/sec" limited ... either many bytes per image -> few MPIX images per second .. or few bytes per image and many images per second.
Overall data/bitrate ... more or less constant

[TinyScooby]

Those CCTV cameras are limited by computational power for encoding the video and limited by data-bus throughput.
Usually they are developed on a SoC according to a reference design (~1000 USD - just enough to keep private people out).
The SoC has a finite computation power, so take it as "bytes/sec" limited ... either many bytes per image -> few MPIX images per second .. or few bytes per image and many images per second.
Overall data/bitrate ... more or less constant

Thanks. I'm trying to grasp this but I'm not quite there yet.

For instance, how many frames per second could this camera do at 1920 x 1081 for instance?

At that resolution, would it be able to do closer to 30 frames per second, or closer to 6 frames per second? (if that resolution was available)

Presently, that camera can do 1920 x 1080 at 30 frames per second, but at 1920 x 1081, does it drop all the way down to only 6 frames per second as well?


I'm just trying to understand where the limitation is. For instance, on a PC, if you have a sata device that can do 6Gb/s, you can hook up a drive that can do 9Gb/s but it will be limited to the sata interface of only 6Gb/s and not be able to run the drive any faster than that because of the sata interface is only capable of exactly 6Gb/s and nothing more. Is it similar with the SoC?

So, in a similar comparison, this SOC is somehow limited to exactly 1920 x 1080 at 30 frames, and 1 more pixel in resolution bumping brings it down to 6 frames per second, is that correct?

So does that mean the only way this camera can get above 30 frames at 1920 x 1081 is by swapping out that SoC which is limiting the camera frames that could be achieved if a faster SOC was available?

This camera, the E77, costs $266. However, the cameras that can do 3840 x 2160 and greater cost $1000. Is that because of the SoC you are referring to?

[miguelvp]

pixel clock alone will reduce the frame rate to 7.5 fps when you quadruple the resolution in raw mode, but then it needs to process the image which is limited by the internal bandwidth, reducing the frame rate more and it has to be synched to the host so 6fps sounds actually pretty impressive for a 4K sensor.

As for the 1081 mode, the chip might not let you use arbitrary resolutions, just some predetermined ones.

Just think that at higher res, you are quadrupling the work load, upping the clock 4 times to compensate might fry it,I mean you are talking 400% overclocking

[TinyScooby]

pixel clock alone will reduce the frame rate to 7.5 fps when you quadruple the resolution in raw mode, but then it needs to process the image which is limited by the internal bandwidth, reducing the frame rate more and it has to be synched to the host so 6fps sounds actually pretty impressive for a 4K sensor.

As for the 1081 mode, the chip might not let you use arbitrary resolutions, just some predetermined ones.

Just think that at higher res, you are quadrupling the work load, upping the clock 4 times to compensate might fry it,I mean you are talking 400% overclocking

See, I completely understand why 3840 x 2160 would be limited to 6 frames per second. That makes perfect sense to me.

Because, it is 4 times the resolution of 1080p (1920 x 1080).

But, I don't understand why the 2048 x 1536 resolution is limited to only 6 frames per second, because I think that resolution should be able to handle at least 10 to 12 frames per second since its only about 500 pixel difference from 1080p.

But, if there is a bandwidth cap in between that is similar to a sata interface limiting drives to 6Gb per second, then I think I understand it a little better. But, as it is today, you can get a 4K surveillance camera for $266 that can do 3840 x 2160 at only 6 frames. If you want the 3840 x 2160 at 30 fps, the price jumps to $1000, unless you are talking something like the new Hero 4 which can do 3840 x 2160 at 30 fps for closer to $500. But the soon to be released Hero4 is not designed to be a surveillance camera, but instead a home movie camera.

So, it seems like these $266 3648x2160 surveillance cameras at 6 fps are the best we can do at the moment due to a low cost SoC that is limiting the bandwidth on these cameras? Is that correct?  Sorry if I am confusing anyone here I'm just really trying to understand the fps limitations for 4K surveillance cameras and presently I don't understand them. I was hoping this Acti E77 could somehow get around this crazy 6fps limitation @ 2048 x 1536 but if it's similar to the sata interface example, then it sounds like they can't.

[miguelvp]

I'm guessing that it uses the full 3648 x 2736 sensor in other modes and it's limited by how it's hardwired as in it either it uses half the rows and columns or it uses it all.

simplified math because there is more to it that this:
(1920x1080)x60Hz / (3648x2736) = 6.232687 Hz

[Taucher]

I'm guessing that it uses the full 3648 x 2736 sensor in other modes and it's limited by how it's hardwired as in it either it uses half the rows and columns or it uses it all.

simplified math because there is more to it that this:
(1920x1080)x60Hz / (3648x2736) = 6.232687 Hz

Hint: open up a new thread - this is going way off-topic.

[Mr-Beamer]

PS I found a good clamp for the Flir.
http://www.ebay.com/itm/221191232238?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649

Are the teeth inside the clamp soft or hard?  Do they indent the E4 handle?

soft rubber, so no indentation.

[nvana]

First of all many thanks to all the tweakers here on the forum!  The resolution hack of our E4 works great 

Does anyone know how to just enable the 'Manual Temperature Range' setting in the menus ? After downloading the Addmenu3 pack and reading the changelist, it seems that so many settings are tweaked at once. For my usage the 'Manual Temperature Range' menu option would be sufficient.

Kind regards

[heavybarrel]

That's an easy one! Just don't use the other features if there's no need for them. It would probably be more work to try and remove all but the manual temp than to just live with it.

Don't remember who asked about the blend mode but there is a brief you tube video showing what it does on a non ex series camera. It basically allows you to control how much thermal information is shown over the top of the background image. It would be useful if you were looking at a warm-hot object with everything in the background not being drowned out by the temp range.
Very similar to how we use manual temp mode to display more information without it being too dark to make out the details of the objects surroundings.

Edit: It appears that the mode allows you to control the thermal info based on temp, by that i mean you can turn off the thermal info based on the temp. Starting at the coldest moving to hottest, when a temp is "turned off" you see a grayscale image very similar to the condensation palate.