Flir E4 Thermal imaging camera teardown

[mikeselectricstuff]

Now heres a question for you all......
There are a lot of FLIR i3's out there........Hmmmmm I wonder if they can be upgraded in a similar manner ? i3's should be being discounted soon, and cheaper on the used marketplace due to the E4's arrival. We know the i7 can be hacked.

AFAIUI the i3 can be made into an i7, which was the subject of the lost email, but even the i7 is only 120x120

[Fraser]

Oh Poo. That idea squashed then 

[mikeselectricstuff]

If you want one, you might better hurry up to get one. I ordered my E4 this night which is (luckily) already on its way.
I just checked the supplier again: the E4 suddenly is out of stock at this supplier and also at another supplier - both had them on stock this night.
Either the E4 are now sold out quickly because of this thread or Flir is pulling the stock back for implementing a new firmware.

hard to tell as not many online dealers have any in-stock indication - tester/Pass are showing stock, but I couldn't see any product that wasn't, which is always suspect

There are currently two from dealers Buy It Now on Ebay UK.
shopflir.com ni US  are showing 2 ready to ship


Oddly the E series doesn't seem to have hit RS or Farnell yet, though Farnell have 8 i3s left to shift
ticameras have a big splash screen for the i3 on their home page - also probably trying to shift old stock. Showing E4 in stock

I doubt they would bother trying to pull stock - would probably cause them more hassle and reputation damage than any  loss through hacks.

[firewalker]

A recap video for the hack would be awesome!

 

Alexander.

[mikeselectricstuff]

It doesn't seem to like having the conf.cfg file edited, so may be checking the CRC, probably tricky to enable other features 

[TopLoser]

Oddly the E series doesn't seem to have hit RS or Farnell yet, though Farnell have 8 i3s left to shift

Farnell have taken the decision to no longer supply FLIR equipment, they are concentrating on Fluke as their supplier of thermal imaging equipment.

The 8 i3s they have left are open to offers to clear them out.

[mrflibble]

It doesn't seem to like having the conf.cfg file edited, so may be checking the CRC, probably tricky to enable other features 

Just add a comment with appropriately crafted text at the end of file, to end up with the same CRC as the original. Easy enough with that 16-bit CRC I'd think.

Edit: the only real sport would be to make it an ascii art comment, and then still try to end up with the correct CRC. Regular comment would just be too easy. 

[mikeselectricstuff]

Oddly the E series doesn't seem to have hit RS or Farnell yet, though Farnell have 8 i3s left to shift

Farnell have taken the decision to no longer supply FLIR equipment, they are concentrating on Fluke as their supplier of thermal imaging equipment.

The 8 i3s they have left are open to offers to clear them out.

I'll give 'em a Monkey for the lot..

[mrflibble]

I'll give 'em a Monkey for the lot..

You sure about that? Have you checked the pricing on those monkeys lately?  I mean, come on!

[Monkeh]

I'll give 'em a Monkey for the lot..

You sure about that? Have you checked the pricing on those monkeys lately?  I mean, come on!

We don't come cheap.

[mikeselectricstuff]

Correction to connector pinout :

BTW updated connector pinout
Starting from end nearest to the unpopulated FFC connector

1 Power - Vbattery during run and charge - possibly via a FET switch as I didn't see continuity to bat terminal
2 On/Off switch (to ground)
3 Console RXD
4 Console TXD
5 Debug  RXD
6 Debug TXD

7 /Reset
8 0V
9
10
11
12
14 I2C SDA
15 I2C SCL
16 0V

Pins 10-13 look like they may be build option resistors - two have 10K to +3.3v, two have 1K to ground.

the connector will take a standard 16 way 0.5mm jumper cable, e.g. Molex 0210200165 available from Digikey amongst others

[mikeselectricstuff]

I'll give 'em a Monkey for the lot..

You sure about that? Have you checked the pricing on those monkeys lately?  I mean, come on!

You missed the Cockney accent - a Monkey is five 'undred quid guv'nor

[Noize]

I'll give 'em a Monkey for the lot..

You sure about that? Have you checked the pricing on those monkeys lately?  I mean, come on!

Cockney Slang
Tenner:
£10

Pony:
£25

Half a Ton:
£50

Ton:
£100

Monkey:
£500

Grand:
£1000

[Nermash]

Only if Monkey Harris is selling them

[aargee]

That's like a Funky Gibbon, right?

Mike (and others) thanks for the excellent work and great reading in this thread 

[mikeselectricstuff]

I'll give 'em a Monkey for the lot..

You sure about that? Have you checked the pricing on those monkeys lately?  I mean, come on!

Cockney Slang
Tenner:
£10

Pony:
£25

Half a Ton:
£50

Ton:
£100

Monkey:
£500

Grand:
£1000

also : MGarrett £50 (from Hawaii 5-0), Score £20, Carpet £30, Archer £2000

[nixxon]

What may limit the FLIR E-series attractiveness for certain applications are the lack of:
* manual Temperature Span
* manual Temperature Level

And, of course, the non manual focus...

But a possible 16x resolution (pixel count) is of course a killer asset

What is the big deal about this possible hack for hobbyist use?

(don't get me wrong; I love the hacking as such, but otherwise? I guess the only downside for FLIR is that their sales will boost bigtime, just like Rigol's sales did after the DS1052E-hack)

[mikeselectricstuff]

What may limit the FLIR E-series attractiveness for certain applications are the lack of:
* manual Temperature Span
* manual Temperature Level

You can lock to the current range, and if you're really keen you can set range and span via the console interface or over RNDIS

And, of course, the non manual focus...
The lens can be adjusted in-situ with the right tool - am investigating how to make one.

What is the big deal about this possible hack for hobbyist use?

A previously £4K+ camera for £800

[nixxon]

What may limit the FLIR E-series attractiveness for certain applications are the lack of:
* manual Temperature Span
* manual Temperature Level

You can lock to the current range, and if you're really keen you can set range and span via the console interface or over RNDIS

And, of course, the non manual focus...
The lens can be adjusted in-situ with the right tool - am investigating how to make one.

What is the big deal about this possible hack for hobbyist use?

A previously £4K+ camera for £800

IR for the masses !

[mikeselectricstuff]

Dave, willing to do some tests on the E8 for us?  I can see you watching.

Please - someone find the magic keypresses so Dave can dump the eeprom and config files without opening it!

[mikeselectricstuff]

Is this useful for Electronics... you tell me...?
This is with the lens screwed out a couple of turns for close focus

The track is a 12.5mil carrying 1 amp.

The nice thing about looking at PCBs is there are plenty of shiny things to give contrast so you can see very clearly where you are, even when it isn't hot. Lack of MSX close-up is just not an issue.

[mikeselectricstuff]

TL;DR : Summary of Hack

Update 27/10 - some info in this post  is wrong - the conf.cfg file is specific to the serial number so the one (removed) in this zip won't work.  You need to get your own by entering service mode via RNDIS, and copying the \temp\appcore.d\config.d\conf.cfg file it generates into \flashifs\hack
(Note I have sometimes seen flashifs getting renamed during service mode so it may be flashifs2)

This hack puts the E4 permanently into service mode. This gives full 320x240 resolution, hotspot/coldspot measuring mode and some more palette options.
The hack can be removed or hidden as desired via the USB interface.
It has only been tested with Firmware V1.18.8 It seems likely that 1.18.7 may be also OK looking at the update files.
WARNING There is a risk of bricking if you do stupid things. It may be possible to recover via USB bootloader menu but it is not known if this works with standard firmware files or FLIR tools. 
In particular, if the applaunch.dat doesn't get to cmd /R, you may not be able to get back to a console prompt to fix any file problems, which would be bad, m'kay
Hack at your own risk.


Power up and plug USB into PC.

Copy all files from attatched zip to a new folder called hack in the root of the USB drive

Unplug USB.

Connect to serial console using Hyperterminal or similar  (38400 baud)
Press enter a few times - you should see the \> prompt
At prompt type :
cd \flashbfs\system
copy \flashifs\hack\applaunch.dat
  (Hit 'Y' at the confirmation prompt )
 type applaunch.dat ** to check this file looks correct as a bad copy could brick the unit!

Power down (remove battery), and restart
Enjoy!


Notes :

If hack folder or  files deleted or renamed, unit will start as normal E4. Will revert to hacked when folder replaced.

Make sure unit is not plugged into PC USB when cold booting - PC prevents bootup accessing hack files - unit will start as normal E4. Will start as hacked next time cold-booted without USB plugged in.
Quick way to tell if hack active - hotspot/coldspot measurement modes available
--------------------------------------------------------------------
Optional :
copy rndis_rndis.rsc over rndis.rsc to make USB work as RNDIS instead of mass storage+USB Video
copy rndis_MSD_UVC.rsc over rndis.rsc to restore to mass storage+USB video
This allows console access via telnet, file transfer via FTP and web access to service functions

FTP and web username flir, password 3lvig
Default IP 192.168.0.2 ( check using ipconfig)
You can do this at any time, cold reboot afterwards.

--------------------------------------------------------------------------

Changing startup screen (cold boot only)
Replace \flashbfs\system\bootlogo_legal.bmp ( copy from USB filesystem as per other files)
Original is 8 bpp windows bitmap.
Beware of changing format, as if progressap crashes it may not run the console prompt

--------------------------------------------------------------------------

Pinout for serial console

FFC connector accessable under label on front of lens housing
Looking at lens side with handle down


<left edge> <pin 16>....<pin 1>
Contacts are on bottom side (towards handle)
Pin 3 RXD
Pin 4 TXD
Pin 7 ground

Use 3.3v TTL level interface, e.g. FTDI TTL-232-3v3 cable

TTL232 Pin 1 (0v) to ground
TTL232 Pin 4 (TXD) to RXD
TTL232 Pin 5 (RXD) to TXD

Suggested FFC jumper cable molex Molex 0210200165 or similar.
--------------------------------------------------------------
De-hacking
Removing the hack folder will make it start as per normal E4.
If desired you can replace the hacked applaunch.dat with a copy of the applaunch_original.dat
This should return it to full factory condition.

This hack will be overwritten by a firmware update, as applaunch.dat will be overwritten.

See pic for FFC for position to access with just the 2 front screws - you may need to push away some rubber padding to get to it, and will need to tape your FFC cable to some rigid PCB to push it in.

Next time I get some PCBs done I'll do some FFC breakouts - PM me if interested

[mikeselectricstuff]

PS one thing I've not yet checked is whether battery charging works properly - this involves different bootup modes so could plausibly be issues - if there are issues, worst-case you may need to move hack files via USB when charging.
Need to let my battery run down a bit to check.
 

[Psi]

Mike is awesome and making us spend money   


New phone + Oculus rift   or   a Flir E4
3rd world problems


I do agree with what someone said a while back. With the 320x240 hardware now costing $995 including the profits for Flir and the distributor it seems likely that they're only going to get cheaper.
There's an opportunity for a new company to start selling official 320x240 TIC for <$1000

The only possible exception to this is if the lens or sensor in the E4 was bin'ed as reject, which would otherwise be thrown away.

[Stonent]

Ok if we ever have a need for a real world A-Team. I'm calling dibs on Mike.