Question about FLIR One for Android

[tomas123]

@Ben321
da-nie wrote a special driver for the Flir One, which writes proprietary RAW files.
Your problem ist not the russian language the viewer software, rather the connecting of a Flir One with your PC and getting the raw files ;-)
Please read the previous posts of da-nie for more informations

@da-nie
thanks for sharing your work
Some years ago I wrote a php script, which can transform your RAW images in Flir Radiometric JPG files (for Flir Tools etc.):
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg348715/#msg348715

[da-nie]

1) It doesn't come with a driver installer (or text file explaining how to install), only the driver files, so I don't know exactly how to install it.

I don't know, how to do it install.exe for drivers... 

2) It is a driver designed only for XP, which doesn't work on newer versions of Windows, including Windows 10. My current PC has Windows 10, and I don't want to downgrade it to XP.

Sorry, but Windows XP is single Operation System with i can create drivers. In Windows 7 (In Windows 10,i think, also) Flir One Gen 2 not separate for 3 device - drivers not find.

3) The software itself is not written in English, and is not written for an English locale, so all the text on user interface is just a bunch of question marks.

No problem.  I created version for english language.

P.S. My RAW-format:

Code: [Select]

//RAW-Header
struct SHeader
 {
  unsigned long Width;
  unsigned long Height;
  double PlanckR1;
  double PlanckB;
  double PlanckF;
  double PlanckO;
  double PlanckR2;
  double TempReflected;
  double Emissivity;
};
//RAW-DATA
unsigned short RAW14[160*120];


[Vipitis]

I wanted to know if the custom tools for four one also work for the cat S60, because it is the same module

[ruzze]

Hi everyone,

first of all thanks for this beautiful thread about flir one software teardown!
For my personal project i needed to disable automatic FFC (shutter) and do FFC only a couple of times a day. I tried to reverse enginnering the command packet and the string for disable automatic FFC through flirone android sdk, but i  encountered some troubles and i tried to sniff the packet using USBMON with wireshark plugin. Now i can disableAutomaticFFC and do FFC calibration when i want 

In order to send a command you need to send a command packet and subsequently a string packet (JSON format).

For disable automatic shuttering FFC you must send
- command packet : CC 01 00 00 01 00 00 00 3F 00 00 00 57 64 17 8b;
- string packet: {"type":"setOption","data":{"option":"autoFFC","value":false}}

If you want to do a FFC calibration you must send:
- command packet: CC 01 00 00 01 00 00 00 3C 00 00 00 B9 CB A2 99
- string packet: {"type":"setOption","data":{"option":"doFFC","value":true}}

I hope this will be useful to someone

[da-nie]

Thank you! 

[tomas123]

@ruzze
Thank you for clarification. 
I posted the corresponding code snippets some times ago, but this thread is a bit confusing.

Please post your enhanced code here. The original code was a proof of concept and we need some improvements.
Thank you
 

and here the tune command "doFFC" (Flat-field correction)
{"type":"setOption","data":{"option":"doFFC","value":true}}

Code: [Select]

data = {byte[16]@21106}
0 = -52 (0xCC)
1 = 1 (0x1)
2 = 0 (0x0)
3 = 0 (0x0)
4 = 1 (0x1)
5 = 0 (0x0)
6 = 0 (0x0)
7 = 0 (0x0)
8 = 60 (0x3C)
9 = 0 (0x0)
10 = 0 (0x0)
11 = 0 (0x0)
12 = -71 (0xB9)
13 = -53 (0xCB)
14 = -94 (0xA2)
15 = -103 (0x99)
protocolType = {UsbCommunicator$ProtocolType@20957} "CONFIGURATION"

{"type":"setOption","data":{"option":"doFFC","value":true}}
data = {byte[60]@21045}
0 = 123 (0x7B)
1 = 34 (0x22)
2 = 116 (0x74)
3 = 121 (0x79)
4 = 112 (0x70)
5 = 101 (0x65)
6 = 34 (0x22)
7 = 58 (0x3A)
8 = 34 (0x22)
9 = 115 (0x73)
10 = 101 (0x65)
11 = 116 (0x74)
12 = 79 (0x4F)
13 = 112 (0x70)
14 = 116 (0x74)
15 = 105 (0x69)
16 = 111 (0x6F)
17 = 110 (0x6E)
18 = 34 (0x22)
19 = 44 (0x2C)
20 = 34 (0x22)
21 = 100 (0x64)
22 = 97 (0x61)
23 = 116 (0x74)
24 = 97 (0x61)
25 = 34 (0x22)
26 = 58 (0x3A)
27 = 123 (0x7B)
28 = 34 (0x22)
29 = 111 (0x6F)
30 = 112 (0x70)
31 = 116 (0x74)
32 = 105 (0x69)
33 = 111 (0x6F)
34 = 110 (0x6E)
35 = 34 (0x22)
36 = 58 (0x3A)
37 = 34 (0x22)
38 = 100 (0x64)
39 = 111 (0x6F)
40 = 70 (0x46)
41 = 70 (0x46)
42 = 67 (0x43)
43 = 34 (0x22)
44 = 44 (0x2C)
45 = 34 (0x22)
46 = 118 (0x76)
47 = 97 (0x61)
48 = 108 (0x6C)
49 = 117 (0x75)
50 = 101 (0x65)
51 = 34 (0x22)
52 = 58 (0x3A)
53 = 116 (0x74)
54 = 114 (0x72)
55 = 117 (0x75)
56 = 101 (0x65)
57 = 125 (0x7D)
58 = 125 (0x7D)
59 = 0 (0x0)
protocolType = {UsbCommunicator$ProtocolType@20949} "CONFIGURATION"



Code: [Select]

            //--------- write string: {"type":"setOption","data":{"option":"autoFFC","value":false}}
            length = 16;
            unsigned char my_string4[16]={0xcc,0x01,0x00,0x00,0x01,0x00,0x00,0x00,0x3f,0x00,0x00,0x00,0x57,0x64,0x17,0x8b};
            printf("\nEP 0x02 to be sent Hexcode: %i Bytes[",length);
            for (i = 0; i < length; i++) {
                printf(" %02x", my_string4[i]);

            }
            printf(" ]\n");

            r = libusb_bulk_transfer(devh, 2, my_string4, length, &transferred, 0);
            if(r == 0 && transferred == length)
            {
                printf("\nWrite successful!");
            }
            else
                printf("\nError in write! res = %d and transferred = %d\n", r, transferred);

            strcpy(  my_string,"{\"type\":\"setOption\",\"data\":{\"option\":\"autoFFC\",\"value\":false}}");
            length = strlen(my_string)+1;
            printf("\nEP 0x02 to be sent %i Bytes: %s", length, my_string);

            // avoid error: invalid conversion from ‘char*’ to ‘unsigned char*’ [-fpermissive]
            my_string1 = (unsigned char*)my_string;

            r = libusb_bulk_transfer(devh, 2, my_string1, length, &transferred, 0);
            if(r == 0 && transferred == length)
            {
                printf("\nWrite successful!");
                printf("\nSent %d bytes with string: %s\n", transferred, my_string);
            }
            else
                printf("\nError in write! res = %d and transferred = %d\n", r, transferred);

[ruzze]

@tomas123

I am pleased to hear your gratitude.

This is my implementation of two functionalities..

Code: [Select]

void disableAutomaticFFC()
{
    printf("\ndisable AutomaticFFC \n");
    time_t now = time(0); // Get the system time
    printf("\n: %s", ctime(&now));

    int transferred = 0;
    int r;
    char stringCommand[128];

    //--------- write string: {"type":"openFile","data":{"mode":"r","path":"CameraFiles.zip"}}
    int startCommandLength = 16;
    unsigned char startCommand[16] = {0xcc, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x3f, 0x00, 0x00, 0x00, 0x57, 0x64, 0x17, 0x8b};
    printf("\nEP 0x02 to be sent Hexcode: %i Bytes[", startCommandLength);
    int j;
    for (j = 0; j < startCommandLength; j++)
    {
        printf(" %02x", startCommand[j]);
    }
    printf(" ]\n");

    r = libusb_bulk_transfer(devh, 2, startCommand, startCommandLength, &transferred, 0);
    if (r == 0 && transferred == startCommandLength)
    {
        printf("\nWrite successful!");
    }
    else
    {
        printf("\nError in write! res = %d and transferred = %d\n", r, transferred);
    }

    strcpy(stringCommand, "{\"type\":\"setOption\",\"data\":{\"option\":\"autoFFC\",\"value\":false}}");

    startCommandLength = strlen(stringCommand) + 1;
    printf("\nEP 0x02 to be sent: %s", stringCommand);

    // avoid error: invalid conversion from ‘char*’ to ‘unsigned char*’ [-fpermissive]
    unsigned char *stringCommandUns = (unsigned char *)stringCommand;
    //my_string1 = (unsigned char*)my_string;

    r = libusb_bulk_transfer(devh, 2, stringCommand, startCommandLength, &transferred, 0);
    if (r == 0 && transferred == startCommandLength)
    {
        printf("\nWrite successful!");
        printf("\nSent %d bytes with string: %s\n", transferred, stringCommandUns);
    }
    else
    {
        printf("\nError in write! res = %d and transferred = %d\n", r, transferred);
    }
}

void doFFC()
{
    printf("\n doFFC \n");
    time_t now = time(0); // Get the system time
    printf("\n: %s", ctime(&now));

    int transferred = 0;
    int r;
    char stringCommand[128];

    int startCommandLength = 16;
    unsigned char startCommand[16] = {0xcc, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x3C, 0x00, 0x00, 0x00, 0xB9, 0xCB, 0xA2, 0x99};
    printf("\nEP 0x02 to be sent Hexcode: %i Bytes[", startCommandLength);
    int j;
    for (j = 0; j < startCommandLength; j++)
    {
        printf(" %02x", startCommand[j]);
    }
    printf(" ]\n");

    r = libusb_bulk_transfer(devh, 2, startCommand, startCommandLength, &transferred, 0);
    if (r == 0 && transferred == startCommandLength)
    {
        printf("\nWrite successful!");
    }
    else
        printf("\nError in write! res = %d and transferred = %d\n", r, transferred);

    strcpy(stringCommand, "{\"type\":\"setOption\",\"data\":{\"option\":\"doFFC\",\"value\":true}}");

    startCommandLength = strlen(stringCommand) + 1;
    printf("\nEP 0x02 to be sent: %s", stringCommand);

    // avoid error: invalid conversion from ‘char*’ to ‘unsigned char*’ [-fpermissive]
    unsigned char *stringCommandUns = (unsigned char *)stringCommand;
    //my_string1 = (unsigned char*)my_string;

    r = libusb_bulk_transfer(devh, 2, stringCommandUns, startCommandLength, &transferred, 0);
    if (r == 0 && transferred == startCommandLength)
    {
        printf("\nWrite successful!");
        printf("\nSent %d bytes with string: %s\n", transferred, stringCommandUns);
    }
    else
    {
        printf("\nError in write! res = %d and transferred = %d\n", r, transferred);
    }
}

Now you can call this functions wherever you want in your state machine.

If someone else need to discover other functionalities of flirone i can try to help you in my spare time. I owe so much to this thread

[MDC]

@da-nie

I am having trouble getting a thermal image on my PC using FlirOneControl. I am attempting to install the FLIR One for Android on an Acer Aspire One ZG5 Netbook which is running Windows XP SP3. After inserting the FLIR One device in a USB port, each of the 3 drivers required a file WdfCoInstaller01009.dll (link supplied by tomas123; I assume for x86), which I had to place in the "Driver for FLIR One Gen 2 for XP" folder. In Device Manager, under "FlirOne Gen 2 FileIO", there are 3 devices listed and another under "Universal Serial Bus controllers" called "USB Composite Device". In the "Image" folder, I am getting .tga files, but they are blank, because the screen is blank. The FLIR One when fully charged is supposed to run for 30 minutes. When I first turn it on, the power button turns orange, then red, then blinks green, which indicates that it is ready. I have attached an image of the Device Manager and an image of the English version of FlirOneControl. I would appreciate your help.

[da-nie]

Hm... Images are not collected - data image is lost.
Version of the program with saving all data from the Flir One.
If data is received, a file is "flir_data.txt" created.

[da-nie]

Now I connected it to the computer on the front of the system unit - there is also no image. I connected it from the back of the system unit - the image appeared. Try different USB connectors. Try to turn on the program, and then Flir One. Or vice versa. Try another cable (maybe your cable is low-frequency).

[MDC]

@ Da-nie

Thanks for your timely response. I tried all 3 USB ports, turning on the FlirOneControl program before and after starting FLIR One (still no image displayed). I only have one cable, so I can't test another (the length is only 5 inches long; I assume the quality is good). I ran your test program "FlirOneControl-english (test).zip" which produced the "flir_data.txt" file attached (I only ran FLIR One for about 1 second to keep the data file under 1MB, because the file grew very quickly). Hopefully you can find a problem in this data file.

[da-nie]

CRC in line error.  Hm...
Here is the program without CRC and your image in .txt file (in file 8 images).

By the way, try to change in the BIOS USB 1.0 or USB 2.0 Legacy.

Code: [Select]

00 50 - header
df 5a - crc=5adf

Data line:
fb 1f fc 1f
02 20 fa 1f 05 20 09 20 ff 1f 00 20 04 20 fe 1f
0e 20 06 20 0a 20 07 20 0b 20 16 20 11 20 08 20
08 20 04 20 08 20 09 20 0d 20 0b 20 0a 20 00 20
06 20 02 20 04 20 08 20 10 20 08 20 0d 20 09 20
07 20 0b 20 14 20 09 20 0c 20 09 20 08 20 0b 20
11 20 0f 20 10 20 ff 1f 0c 20 08 20 0a 20 0e 20
04 20 11 20 03 20 0e 20 ff 1f 0b 20 09 20 02 20
0f 20 06 20 0b 20 02 20 0e 20 0c 20 05 20 05 20
03 20 07 20 05 20 06 20 0c 20 08 20 12 20 0d 20
11 20 13 20 16 20 13 20 12 20 16 20

CRC=f583 (header=0x00 0x00 and CRC in package=0x00 0x00 - in Lepton 3 manual page 39).

The CRC is calculated over the entire packet, including the ID and CRC fields. However, the four most-significant bits of the ID and all sixteen bits of the CRC are set to zero for calculation of the CRC. There is no requirement for the host to verify the CRC. However, if the host does find a CRC mismatch, it is recommended to re-synchronize the VoSPI stream to prevent potential misalignment.

Code: [Select]

unsigned char byte_array[164]=
{
 0x00,0x00,//header (with mask 0x0FFF)
 0x00,0x00,//CRC in package =0
 0xfb,0x1f,0xfc,0x1f,0x02,0x20,0xfa,0x1f,0x05,0x20,0x09,0x20,0xff,0x1f,0x00,0x20,
 0x04,0x20,0xfe,0x1f,0x0e,0x20,0x06,0x20,0x0a,0x20,0x07,0x20,0x0b,0x20,0x16,0x20,
 0x11,0x20,0x08,0x20,0x08,0x20,0x04,0x20,0x08,0x20,0x09,0x20,0x0d,0x20,0x0b,0x20,
 0x0a,0x20,0x00,0x20,0x06,0x20,0x02,0x20,0x04,0x20,0x08,0x20,0x10,0x20,0x08,0x20,
 0x0d,0x20,0x09,0x20,0x07,0x20,0x0b,0x20,0x14,0x20,0x09,0x20,0x0c,0x20,0x09,0x20,
 0x08,0x20,0x0b,0x20,0x11,0x20,0x0f,0x20,0x10,0x20,0xff,0x1f,0x0c,0x20,0x08,0x20,
 0x0a,0x20,0x0e,0x20,0x04,0x20,0x11,0x20,0x03,0x20,0x0e,0x20,0xff,0x1f,0x0b,0x20,
 0x09,0x20,0x02,0x20,0x0f,0x20,0x06,0x20,0x0b,0x20,0x02,0x20,0x0e,0x20,0x0c,0x20,
 0x05,0x20,0x05,0x20,0x03,0x20,0x07,0x20,0x05,0x20,0x06,0x20,0x0c,0x20,0x08,0x20,
 0x12,0x20,0x0d,0x20,0x11,0x20,0x13,0x20,0x16,0x20,0x13,0x20,0x12,0x20,0x16,0x20
};

int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevstance,LPSTR lpstrCmdLine,int nCmdShow)
{
 unsigned short crc=0x0000;
 unsigned short *ptr=reinterpret_cast<unsigned short*>(byte_array);
 for(long m=0;m<164/2;m++)
 {
  unsigned short word=ptr[m];
  crc^=word;
  for(unsigned char n=0;n<16;n++)
  {
   if (crc&0x8000) crc=(crc<<1)^0x1021;
              else crc<<=1;
  }
 }
 char str[255];
 sprintf(str,"CRC:%04x",crc);
 MessageBox(NULL,str,"Ok",MB_OK);
 return(0);
}


Why your Flir One CRC=f583 and CRC in package=5adf - i don't know.  Lepton error? 
My Flir One CRC is equivalent. 

[MDC]

@Da-nie

There is no option in BIOS to change the USB version. However, I tried your program "FlirOneControl-english-no_crc.zip", and it works. Excellent job! Thanks for your help. If you need anymore testing, just let me know.

[da-nie]

Great! 
Unknow error CRC... 

[da-nie]

My scanning of Hause.

[da-nie]

I create device with STM32F4Discovery board (this board have USB-HOST). Flir One Gen 2 connected with USB. I created project for CubeMX with STM32F407VGT. Flir One connects, reports parameters, completes enumeration, opens pipes, but does not transmit data. Commands for stopping and starting interfaces are not executed.

I attached main.c file. Maybe someone will tell me what I did wrong.   Thank you.

[da-nie]

Hm. Flir One FFC control with programm for STM32F4. But no data with restart interface...

--------------------------------------------------------------------
I am surprised. I read descriptor of interface. bAlternateSetting=1 means that the interface does not have end points! The  bAlternateSetting=0 means that there are endpoints.

SetConfiguration( bInterfaceNumber=1, bAlternateSetting=0) - EP=0x83, 0x04;
SetConfiguration( bInterfaceNumber=1, bAlternateSetting=1) - No EP!!!

SetConfiguration( bInterfaceNumber=2, bAlternateSetting=0) - EP=0x85, 0x06;
SetConfiguration( bInterfaceNumber=2, bAlternateSetting=1) - No EP!!!

But initialize Flir One is:
1) SetConfiguration( bInterfaceNumber=1, bAlternateSetting=0)
2) SetConfiguration( bInterfaceNumber=2, bAlternateSetting=0)
3) SetConfiguration( bInterfaceNumber=2, bAlternateSetting=1) - No EP.
4) SetConfiguration( bInterfaceNumber=1, bAlternateSetting=1) - No EP.

How can this be? 

In Linux

Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    240
      bInterfaceProtocol      1
      iInterface              6 com.flir.rosebud.fileio
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               1

In STM32F wMaxPacketSize=64. 

And:

Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       1
      bNumEndpoints           0
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    240
      bInterfaceProtocol      1
      iInterface              6 com.flir.rosebud.fileio

    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    240
      bInterfaceProtocol      1
      iInterface              6 com.flir.rosebud.fileio
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               1

[da-nie]

tomas123, please tell me how you intercepted the USB excange?

[tomas123]

Da-nie, currently I don't work with Flir One and Raspberry Pi. All steps for the usb handshakes are documented in our c code. This are the exact replays of the original Flir One App communication. 
Look there...

[da-nie]

The device startup sequence is known. I'm curious, how did you intercept the exchange via USB? I want to see what STM32F4 is requesting and what Flir One is responsible for.
---------------------------------------------------------------
Updated.

I change in function OpenPipe 512 ?? 64 byte. I receive data!!!

[tomas123]

The usb communication is tricky, because there are some influences of the chipset.
So far, I have not understood the logic behind the usb block length of my rapsberry pi.
I'm glad about all the incoming data and build the data together.
After all there are frequently drops inside the steam (we get a broken frame)

[da-nie]

Size of block i know:
1) Full Speed and Low Speed = 64 bytes ma.
2) High Speed = 512 bytes max.

My STM32F4 is Full Speed. => 64 bytes.

[tomas123]

yes, this is the buffer size of the "hardware" buffer

While a bulk read from endpoint you get larger packets from the "usb driver" buffer.
I wrote about the packet size from driver buffer...

[kerio]

Hi, has anyone figured out the exact details on how the MSX algorithm works, at least regarding the coordinate transform between the visible and the thermal? I'm trying to figure out how to go from visible to thermal, and the extracted calib.rsc has a whole bunch of parameters, none of which seems to work fine as a simple scaling factor.

[tomas123]

Look at my footer.
There is a php script with two samples for MSX with Imagemagick