Author Topic: Tips on reverse engineering pinout of undocumented chips  (Read 8678 times)

0 Members and 1 Guest are viewing this topic.

Offline madmaxbryanTopic starter

  • Contributor
  • Posts: 36
  • Country: us
Tips on reverse engineering pinout of undocumented chips
« on: September 06, 2014, 08:03:31 am »
lately, Mike (Mikeselectricstuff) has been working on a thermal imaging camera, and that got me inspired to blow the dust off my imager to see if i can get it to work. What i have is just the thermal imaging module itself, none of the control circuitry. I have sent 4 emails and 1 phone call to the manufacture with no luck, probably because im an end user and this imager is ITAR export controlled.

What would be a good starting point to try to reverse engineer the pinout? The imager i have is a DRS U6010, 640x480 25um VOx microbolometer FPA. It has 38 pins split into 2 rows and has NTSC output on one of the pins. I found some documentation for different microbolometer from a different company, but has the same number of pins, so i have a general idea of what mine might have, which is a ground for analog and digital, serial data and clock, 6 digital video outputs, and 4-5 input voltages. Any help is appreciated.
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 8526
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #1 on: September 06, 2014, 10:14:12 am »
If you could get an image of the die, it would probably help identifying the ground/power since that's usually quite obvious from the bondout.

I wonder if it's related to the Flir ISC0601B?
 

Offline madmaxbryanTopic starter

  • Contributor
  • Posts: 36
  • Country: us
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #2 on: September 06, 2014, 10:33:40 am »
An image of the die would definitely help. This microbolometer is fully sealed in a metal can under vacuum, so I would have to essentially destroy it to expose the goodness inside. im guessing x-rays wouldn't be able to penetrate the metal can either.
 

Offline madmaxbryanTopic starter

  • Contributor
  • Posts: 36
  • Country: us
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #3 on: September 06, 2014, 11:01:37 pm »
I have started taking resistance readings on every pin in every possible combination, which is close to 800 combinations. im about half way done and i have found any patterns of short that might help identify multiple grounds or any other useful info.
 

Offline T3sl4co1l

  • Super Contributor
  • ***
  • Posts: 22436
  • Country: us
  • Expert, Analog Electronics, PCB Layout, EMC
    • Seven Transistor Labs
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #4 on: September 07, 2014, 01:04:19 am »
Ohms is tricky, but volts (diode test) can tell you which pins have ESD/substrate diodes to which ground(s) and supply/ies.  Once you figure out the supplies, you can start by trying a little voltage on each, and see which ones are inputs/outputs, active/inactive, etc.  Between inputs, you'll have to make some lucky guesses if you have to figure out SPI / I2C / etc....

Tim
Seven Transistor Labs, LLC
Electronic design, from concept to prototype.
Bringing a project to life?  Send me a message!
 

Offline madmaxbryanTopic starter

  • Contributor
  • Posts: 36
  • Country: us
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #5 on: September 07, 2014, 04:13:10 am »
Maybe i don't fully understand how my meter gets its data, but isn't the resistance setting and the diode setting basically the same test, just one gives you a resistance value and one simply gives you a tone if its below a certain resistance?

I was thinking i could take the resistance of every pin combination, and any combination that was below about 1 ohm, i could reasonably assume is shorted together.
 

Offline c4757p

  • Super Contributor
  • ***
  • Posts: 7799
  • Country: us
  • adieu
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #6 on: September 07, 2014, 04:23:09 am »
Maybe i don't fully understand how my meter gets its data, but isn't the resistance setting and the diode setting basically the same test, just one gives you a resistance value and one simply gives you a tone if its below a certain resistance?

Many meters combine the diode test and continuity test modes. Diode test mode is like resistance, but it directly reads the voltage developed across the DUT rather than computing the resistance. Continuity test mode screams at you if the resistance is low.
No longer active here - try the IRC channel if you just can't be without me :)
 

Offline T3sl4co1l

  • Super Contributor
  • ***
  • Posts: 22436
  • Country: us
  • Expert, Analog Electronics, PCB Layout, EMC
    • Seven Transistor Labs
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #7 on: September 07, 2014, 08:30:35 am »
Yeah.  And the main downside to resistance is, you don't know what kind of current they're testing with, so you can't really estimate what voltage some oddball resistance corresponds to.

Example: my non-auto-ranging VTVM :) might measure a 1N4148 as 10 ohms (1x range), 20 (10x), 100 (100x), and so on.  I happen to know it uses a resistor divider (calibrated meter movement accounts for the curve).

It wouldn't take much checking to characterize a DMM though.

Tim
Seven Transistor Labs, LLC
Electronic design, from concept to prototype.
Bringing a project to life?  Send me a message!
 

Offline madmaxbryanTopic starter

  • Contributor
  • Posts: 36
  • Country: us
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #8 on: September 07, 2014, 01:38:35 pm »
Took all night to do it, but i retested all possible pin combinations using the diode mode. I believe my meter outputs 2 volts when testing, so anything above 2 volts is an open and 0 volts is a dead short. Of the pins that had a reading, i'm ranging from 0.5 volts all the way up to 1.9 volts.

At this point about 25% of the pin combinations have a reading, and most are fairly close to each other in voltage (0.5-0.9). I'm still not seeing anything that stands out as to power pins or output pins.

I'll keep pressing DRS on Monday for info on this microbolometer.
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 8526
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #9 on: September 07, 2014, 01:43:17 pm »
I'll keep pressing DRS on Monday for info on this microbolometer.
I would be careful, since this is a high-end ITAR-regulated sensor, lest they start considering you as a terrorist.
 

Offline madmaxbryanTopic starter

  • Contributor
  • Posts: 36
  • Country: us
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #10 on: September 07, 2014, 01:48:24 pm »
I'm an American citizen, so the government already considers me a terrorist. Add the fact that im prior service military, and that pushes me right to the top of their list. :-//

If nobody hears from me after Monday, send help!
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 14117
  • Country: gb
    • Mike's Electric Stuff
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #11 on: September 07, 2014, 05:29:09 pm »
Without access to a working system it will be very hard to figure much out, especially as sensors like this will probably have one or more funky analogue supply voltages.
It is actually illegal for manufacturers to give out any technical info on ITAR controlled items.
« Last Edit: September 07, 2014, 06:00:06 pm by mikeselectricstuff »
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline madmaxbryanTopic starter

  • Contributor
  • Posts: 36
  • Country: us
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #12 on: September 07, 2014, 08:40:01 pm »
It is actually illegal for manufacturers to give out any technical info on ITAR controlled items.

Being just a sensor and not a complete working system, some company has to build the electronics to run it. How does that company go about getting the technical documents if its illegal?
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 14117
  • Country: gb
    • Mike's Electric Stuff
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #13 on: September 07, 2014, 09:06:11 pm »
It is actually illegal for manufacturers to give out any technical info on ITAR controlled items.

Being just a sensor and not a complete working system, some company has to build the electronics to run it. How does that company go about getting the technical documents if its illegal?
I don't know how it works in practice - in that situation there would be NDAs and probably also whatever registration/regulation that governs companies making ITAR-regulated stuff.  The restriction is on making info publically available
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline madmaxbryanTopic starter

  • Contributor
  • Posts: 36
  • Country: us
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #14 on: November 16, 2014, 10:37:31 pm »
Well it only took a month to convince the government i was a citizen and not a terrorist, but i managed to get the datasheet and pinouts for the microbolometer. Now that i have the documentation i have run into a new problem. The sensor is 640X480, 30hz frame rate. Which means it needs a 12.5MHz clock and around 15.734kHz line clock. The 12.5MHz is beyond the capabilities of my signal gen. Does anyone have a recommendation for producing all these signals? I've never worked with CPLD's or FPGA's, but would it be easiest to have one output all three clocks or is there a better solution short of buying a new sig gen?
 

Offline marshallh

  • Supporter
  • ****
  • Posts: 1462
  • Country: us
    • retroactive
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #15 on: November 16, 2014, 10:40:41 pm »
an FPGA + sdram would be ideal for this.

Pick up a DE0-nano board, or if you want to spend more money, you can do that also.
Verilog tips
BGA soldering intro

11:37 <@ktemkin> c4757p: marshall has transcended communications media
11:37 <@ktemkin> He speaks protocols directly.
 

Offline madmaxbryanTopic starter

  • Contributor
  • Posts: 36
  • Country: us
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #16 on: November 16, 2014, 11:28:15 pm »
I kinda figured and FPGA was the ideal way to go, guess this project is on hold now while i want for a DE0-nano to come in the mail, then i have to learn how to program and FPGA. Thanks marshallh!
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 14117
  • Country: gb
    • Mike's Electric Stuff
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #17 on: November 17, 2014, 10:11:21 am »
A microcontroller that has a camera interface may be another option
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Alexei.Polkhanov

  • Frequent Contributor
  • **
  • Posts: 684
  • Country: ca
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #18 on: November 19, 2014, 07:46:33 am »
I just got an idea!

What if we create a website like Kickstarter where people can donate money to get something professionally re-engineered and publicly documented. I am sure there are plenty of good labs that can do pretty good job at reverse engineering something like this.


 

Offline sswcharlie1

  • Newbie
  • Posts: 4
  • Country: nz
Re: Tips on reverse engineering pinout of undocumented chips
« Reply #19 on: July 01, 2019, 07:17:58 am »
Hi Alexei


Did anything happen in getting your Kickstarter idea going.

Thanks

Charles Harris
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf