Mystery Thermal IP camera(Now identified as Yoseen Infrared X384D) - Teardown :)

[Fraser]

I recently purchased a specialist thermal imaging camera setup that contained a very nice thermal imaging IP camera. The original systems specifications state that the camera resolution is 384 x 288 pixels so the thermal camera is worth some effort to bring to life. It certainly looks nicely designed and constructed. The build date is 2020 so it is quite modern.

The thermal camera is the subject of this thread because I have my suspicions that it comes from DALI but I have been unable to positively identify it. I am also without the IP address and login credentials for the unit. Whilst the IP address is not a problem, finding the correct credentials to login in and use the camera might be. The camera also provides a number of connections on its rear and these are currently unidentified. The BNC connector was likely for composite video output but it is not connected in this example.

Upon investigation of the cameras PCB's I managed to pull together some clues that may help identify the OEM and possible default login credentials. Better still, a manual telling me how to set the camera to factory defaults !

From the teardown I found the following potentially identifying information

1. "XALL-D 20200127 V07" Rearmost PCB with connections to the outside world.
2. "XALL-C 20200127 V07" Processor PCB
3. "XALL-B 20200127 V07" ADC PCB
4. "DM1716A, DL1740, x160B-A, 20200226" Microbolometer PCB
5. "E4418CORE-YS5038-M182 5038A0108A1100F4160"  On the processor pcb on a large metal screening can

From the above I suspected the camera ID was one of the following:

"XALL"
"DL1740"
"X160B"
"E4418"
"YS5038"

The DM1716A printed on the microbolometer PCB appears to reference the DALI microbolometer of the same name but that provides a resolution of 160 x 120 pixels whereas this camera is spec'd as 384 x 288 pixels. Wit this in mind I believe the microbolometer is likely the DALI DM1738A. As to whether the camera is made by DALI or just uses a DALI microbolometer, I cannot say. "DL" is used by DALI in their camera model numbers so "DL1740" could potentially be a DALI model number.

I am providing plenty of pictures taken during the teardown to assist in identifying this camera/core

Any suggestions of who makes this camera or how best to approach accessing it via the ethernet port is welcomed.

I am including the major chipset details below:

Altera Cyclone IV EP4CE6E22I7N : Processor
EPCS4N : 4MBit Flash memory
AD9240ASZ: ADC - 14 Bit, 10MSPS
AD8608: Amplifiers
AD5625: Nano DAC - 12 Bit
ADUM1412: 4 channel digital isolator

[Fraser]

The teardown begins...

[Fraser]

Continued...

[Fraser]

Continued...

[Fraser]

The microbolometer, lens and FFC flag assembly....

[Fraser]

Reassembling the PCB stack....

[Fraser]

The DALI microbolometer information page and pictures of the DALI DM series microbolometer...

[ArsenioDev]

Fraser, reached out to a contact at Dali, they may have answers.
Interesting that the E4418CORE is used, it's a A9 Samsung linux unit, may be able to get pinouts and try poking the serial port to see if it's straight up root already.

[Fraser]

Thank you 

I did not know that the E4418 was the identity of a Samsung Linux module 

That is useful information already 

Thanks again

Fraser

[Fraser]

E4418CORE-5038 briefing document, part English, part Chinese !

So that module is the "Brains" of the IP part of the camera.

[ArsenioDev]

Fraser, 4 pin header on the right side in DSC06086.jpg on the rear by the power port.
That's a serial header, slap a converter on and see how it talks!

[Fraser]

Brilliant, will do 

[ArsenioDev]

I'd even bet there is more than likely a video output somewhere that is just not populated or soldered.

[Fraser]

The boot log happily pours out of the cameras serial port. It contains lots of detail of the E4418CORE starting and configuring

A brief scan of the boot log did not reveal an OEM for the camera or a useful model name.

The log did reveal an identity of "X384" and a build date in 2016 plus what looks like a name, or names, of "Hong Wai Jian Yi"

Nothing very helpful though. I will look for a video output tomorrow.

I attach the complete boot log.

Fraser

[Fraser]

After a lot of searching for "X384 thermal camera" I believe I have found the OEM of the mystery thermal camera. I believe it was built by Yoseen Infrared of Wuhan, China. I found the bi-spectrum camera system from which I removed the mystery camera and it is an exact match. Sadly it looks like the Yoseen Infrared site has a lot of pages that no longer work. It is a starting point though.

As confirmation that I am on the right track, take a look at the attached image that I took from the Yoseen web site. It shows the PC interface used with the Bi-Spectrum camera.... note the file name shown "HWJY0306" ....HWJY correlates with Hong Wai Jian Yi  The bi-focal camera in the attachments is the Yoseen Infrared DS-CS-2007-X384 and every detail of it matches the unit I have (no model number on my unit though)

Fraser

[Fraser]

The Wayback machine has helped confirm the origin of the mystery camera..... There is a page that details and shows my camera 

I attach a screen print in PDF format and a picture capture from the same page. Now to try and get my hands on a manual for the camera.

Wayback machine page:

https://web.archive.org/web/20201025073020/https://www.yoseeninfrared.com/product/product-43.html

Fraser

[Fraser]

It would appear that the camera is also known as a Wuhan Gewu Youxin X384D

https://detail.1688.com/offer/675650389887.html&idx=12

Nice imagery 

Fraser

[Fraser]

I have read the FAQ section on the Yoseen Infrared web site and learnt about the cameras control. They use an SDK in partnership with the cameras firmware so I really need to get my hands on that if I want access to the cameras full capabilities. There is RS485 for remote control of the camera functions but I do not have the command set yet. It looks to be a decent camera so I will write to Yoseen Infrared and see if they are still in business and willing to help.

The mystery of who made the camera is solved anyway 

Fraser

[Fraser]

Useful information taken from the FAQ's that I will park here in case of use to anyone in the future......

Common external interface, Ethernet, relay, analog video, power etc
(1) Ethernet: 100/1000m is supported, which can transmit video stream and temperature stream. The video stream only displays the characteristic temperature, which cannot be used for temperature analysis. The temperature stream can display the global temperature, which can be used for temperature analysis. (2) Relay: one relay output is only used as a switch (no voltage output) to connect the acousmo-optic alarm device. When the monitoring target reaches the alarm temperature, the relay closes and emits an acousmo-optic alarm. (3) Analog video: No network is needed and the display can be directly connected. Only the infrared picture and characteristic temperature are displayed, not the temperature of each point. (4) Serial ports: supports RS485, can do simple configuration and control of equipment, such as switch palette, capture, video and other commands, and analog video, general industrial equipment, with more to stability requirement is higher, Ethernet has a time delay, industrial less, a serial port can be extended many devices (such as WiFi). (5) Power supply: support 9-15V power supply, generally use 12V power adapter, can be customized 5V.

Is there an interface for data access?
A Based on network SDK to control and access device data, the dual-lights thermal camera with cradle head provided by us supports dual-channel RTSP and infrared RTSP, including only infrared images. (no need to use SDK to access) infrared temperature data, including temperature and image. (Must be accessed using the SDK).

IP setting for direct connection between thermal camera and computer
A (1) Direct connection: After connecting the thermal imager with the computer, the IP of thermal camera should be found in the software selection tool of thermal camera, and then the IPV4 of the computer should be set as the IP of the same network segment with the thermal camera, but not repeated with the default IP address of the thermal camera. (2) Router: under the premise of ensuring that thermal camera, router and computer are in the same IP segment, or all three are dynamically allocated IP, they can be directly connected via wireless or wired channels.

What is the device port number?
A The network protocol provided by the device: ports are as follows Control port 55502 Temperature flow port 55503 Single frame temperature port 55505 Video streaming port 55506 Mixed flow port 55507 (card machine specific) RTSP port 554 #SDK is a device-side + client, 2-side structure. Our devices are not cloud devices. Its just a network device. # Device access issues across networks. There can be a server in the middle or a simple port mapping. Not supported by the SDK # Use device data and follow SDK documentation; You need to look at ports for external access.

Does the SDK support C# language?
A Support C# (Sharp), C++, C language, JAVA.

Fraser

[Fraser]

For anyone wondering whether the PCB markings were a clue... well yes, if you knew what they meant ! A hint to the camera model ID was actually hidden in plain sight !

I already guessed that DM1716A referred to a DALI microbolometer. My camera actually has the higher resolution DM1738A fitted because the PCB's are the same. The "XALL" marking means, quite literally, that the PCB is used in all of the Yoseen Infrared "X" series cameras ! The "X160B" on the microbolometer PCB is the name of the lowest resolution model in the "X" series. As already stated, the same PCB is used for my X384D. This is possible because the X160B and X384D microbolometer pinouts are identical. This information without the all important makers name was a bit of a needle in a haystack situation for Google though. "X160B" certainly did not get any useful hits, yet "X384" (from the boot log listing) did eventually lead me to the correct web site.

All part of the fun when collecting unusual thermal cameras

Fraser

[Fraser]

Update:

Yoseen Infrared sent me the X series user manual and SDK manual overnight.

Superb support and response time from this company 

This little camera appears very versatile and capable.

Fraser

[Fraser]

I have now got access to the software download pages. Happy days 

Fraser

[Fraser]

I love companies like Yoseen Infrared who make all there software tools and manuals available on the Internet for free and easy access 

The original web site that I was using was English and all the links to downloads failed with a 500 error, file not found. Now that I am working on the Chinese page I have gained access to what I need. Most documents and programs are in Chinese so Google translate, PDF translators and my phones inage translator will be kept busy !

It will be interesting to explore the capabilities of this camera.

Fraser

[ArsenioDev]

Fantastic news Fraser! Glad my gremlinry was able to be of assistance in breadcrumbing you onto the path you needed

[Fraser]

ArsenioDev,

Your help was invaluable as the RS232 port download provided the hints I needed to discover this cameras heritage. I also would never have known about the E4418. I rarely work on IP cameras and needed the motivation to start digging into this one. With no login details I half expected the camera to be a paperweight. It appears to not be plug-and-play so the documentation and software from the OEM will hopefully get this camera running again. The user manual details how to reset the camera to factory defaults and I would never have guessed the process. You short two of the I/O pins together, on the rear of the camera, for 6 seconds.

Thank you so much for being the motivation for me to investigate this camera. Once you said about the serial port, I had to test it as I valued your input and wanted to report my findings. Sometimes I need that little push to dig into a project

I still have to locate the video output on the PCB’s but it should not take long. The video signal has to be enabled in the control software as it is disabled by default and, in my case, disconnected as well ! There is a 2 pin empty connector above the Ethernet port that looks a likely candidate. It has no other use that I can see. The camera has the PCB pads for a micro SD card as well, but other, associated, components may be absent as well.

I am also pleasantly surprised that over the last couple of days, I have had two major thermal imaging OEM’s taking the time to engage with me when I asked for help. These were Yoseen Infrared and GuideIR (for another camera I am working on). I have become used to OEM’s ignoring me unless I am wishing to buy thousands of parts from them. This was a very good experience though and I was given all the assistance that I had requested without hesitation or demands for business details etc.

Best Wishes

Fraser