Flir E4 E5 E6 E8 -any, unbrick repair. NEED Flash dump!

[smaultre]

Hey guys, I bought it on eBay with my fortune. And it didn't work 
I received a flooded motherboard and some less damaged peripherals. After washing in alcohol
The board is in good condition, the tracks were not damaged.
But the 3V battery on the board was completely dead.
When I connect it to a Windows 10 PC, i see a new "SE Blank SENNA" device with the impossibility of installing drivers.

The board loads take ~5 0,2 seconds. This can be seen from the change in current consumption. After 2-3 minutes, looks like the board goes into reboot cycle (when USB powered).

Using an oscilloscope, I see that the RTC and MCIMX257 https://www.nxp.com/docs/en/reference-manual/IMX25RM.pdf
are working, and there are attempts to boot from the bootloader IC TC58BVG1S3HTA00 https://www.mouser.com/datasheet/2/1034/tosc_s_a0007398910_1-2295726.pdf

But Altera Cyclone IV,
1Gb DDR RAM W94AD6KB https://www.winbond.com/resource-files/w94adxkb_datasheet_pkg_a01-005_20141002.pdf
 
and his DDR  RAM IC IS43LR32800G-6BL  https://www.issi.com/WW/pdf/43-46LR32800G.pdf
remain without power.

Who knows the POST procedure for it?  boot up procedure?

There is DA9021 https://pdf1.alldatasheet.com/datasheet-pdf/download/1010316/DIALOG/DA9021.html
System PMIC with high efficiency USB power manager

General description from PDF:
The DA9021 is a highly integrated PMIC subsystem with supply domains to support a wide
range of application processors, associated peripherals, and user interface functions. Combining a
switched-mode USB compatible charger, full power-path management, three bucks, five linear
regulators and support for multiple sleep modes..
Some secondary  power line's of it is 0V, like a VDD MEM line??

How can i check bootloader IC content? MCIMX257 make only two short attempts to access for it.

[RoGeorge]

Bricked means no software response whatsoever.  Since the PC can read an ID from the USB, it means the PC engaged a conversation with your board, and the board was able to listen and reply with a name.  It means the firmware of your board is OK, and most probably fully functional.

The board is not bricked, so it doesn't require any flush dump or any unbrick.
What for did you buy it, or what do you expect that board to do, yet it doesn't?

[smaultre]

New investigation shows that it was not "loading".
It starting to read the bootloader chip, but then some of the data lines "stucks" on high level.
It looks like a corrupted data or bad flash IC.
And  "SE Blank SENNA" device is the native ID of MCIMX257 CPU to access to its flash.

I need a full dump of the bootloader IC TC58BVG1S3HTA00 (my module is "new" with gray plastic frame)!

[fzabkar]

If none of the RAMs are powered, then how does the boot process even get started? I would have thought that the kernel code inside the main MCU would unpack the flash code into RAM before transferring control to it.

Are you sure that the third buck converter in the Dialogic PMIC is not shorted to ground?

[smaultre]

BTW updated connector pinout
Starting from end nearest to the unpopulated FFC connector

1 On/Off switch (to ground)
2 Power - Vbattery during run and charge - possibly via a FET switch as I didn't see continuity to bat terminal
3 Console TXD always high
4 Console RXD always high
5 Debug  TXD always high
6 Debug RXD always high
7 0V
8 /Reset
9  Output
10 Input
11 Output
12 Input
13 Input
14 I2C SDA
15 I2C SCL
16 0V

Pins 10-13 look like they may be build option resistors - two have 10K to +3.3v, two have 1K to ground.

I add some info from the data lines of bootloader IC.
Some lines goes stuck to high levels add initial boot process stuck too.
Or maybe data in flash ic or ic itself is corrupt.

The third buck converter in the Dialogic PMIC have ~ 580 Ohm to ground

[smaultre]

I found an update firmware files flir_ex_pn639_v3.16.0_update_pack , but i didn't know how to move it to the flash.

1st picture file structure on the .fif file
And maybe .bin file, with start address to flash it in to??

2nd picture contains and address ??

3rd picture FPGA.bin to start "picture processing"
load after POST and start to logging over serial diagnostics port (mine serial does not even start).

[smaultre]

If none of the RAMs are powered, then how does the boot process even get started? I would have thought that the kernel code inside the main MCU would unpack the flash code into RAM before transferring control to it.

Are you sure that the third buck converter in the Dialogic PMIC is not shorted to ground?

I think the load process goes in that  way:
cpu read bootloader taking control of perihelial devices (volt regulator maybe) 
make some kind of POST ?,
than start to log on serial, boots OS, programming FPGA ? e.t.c.

We need a working -one device to measure the Voltage from  Dialogic PMIC,
does they appears at the same time?

[indeterminate]

It is far more likely that there is sum gunk under a BGA that is stuffing things up.
Lookup the voltage requirements for the CPU, RAM, Flash  and make shore all the required rails are active.
connect the battery up , it wouldn't be the first device that i have seen that will not boot without a charged battery.

[smaultre]

It is far more likely that there is sum gunk under a BGA that is stuffing things up.
Lookup the voltage requirements for the CPU, RAM, Flash  and make shore all the required rails are active.
connect the battery up , it wouldn't be the first device that i have seen that will not boot without a charged battery.

Trying with charged battery -with no success. 
On my first post, the second picture has Dialog DA9021 power manager with at least one abnormal power line coil on corner marked "0??" But how this dialog is configured here, i don't know maybe this voltage line need to be programmed via CPU with data from the boot flash?

And what is VDD_A on the datasheet?

Prior to de-solder flash chip, i need to know is there a time lag.
Between the green and yellow  points, on the working device.

[smaultre]

I read the  flash it works, and contains some information. I didn't know that data is ok.
I need  at least the boot block part (first ~1-2Mb) from the working-one to compare.

And when i test the board datalines without Flash IC, some of them goes on high "1" state.
But them seems to be ok by the resistance tests.
It is normal?

Additional while trying to re-program the flash 5 bad blocks are found, the first-one is #170

[smaultre]

The new flash chip is arrived ! I need working dump! Please!

[uuksik]

I have E4 1.22.0, Could you assist me, how to get Flash dump.

[smaultre]

Hello you need to de-solder the flash IC and make a dump via programmer. If you ask "how?", i understand that you don't have such ability.

[Bud]

I think you should have investigated the no power issue. If the device was flooded chances are power lines may be damaged.

Regarding the boot chip, i briefly looked at the CPU manual and it mentions a recommendation for NAND type of boot memory to have two copies of boot code in block0 and block1. What you can do is get the block size from the boot IC datasheet and check the data dump you made to compare the content of those two blocks if they are identical. Even if both have corrupt cells you may work something out of two copies and construct a good one, since you also know which cells are bad in each copy.

[smaultre]

I think you should have investigated the no power issue. If the device was flooded chances are power lines may be damaged.

Regarding the boot chip, i briefly looked at the CPU manual and it mentions a recommendation for NAND type of boot memory to have two copies of boot code in block0 and block1. What you can do is get the block size from the boot IC datasheet and check the data dump you made to compare the content of those two blocks if they are identical. Even if both have corrupt cells you may work something out of two copies and construct a good one, since you also know which cells are bad in each copy.

The board looks good and cleaned perfectly. The resistance of DDR memory power lines, ~500 Ohm looks acceptable (not shorted).
I haven't soldering station to re-solder and check BGA chips, like a power IC or DDR memory chip's.
I trying to make things, that i can make right now.
That's why i ask for a flash IC memory dump, this chip was a most flooded.
I think if this device can't complete booting stage, it has corrupted whole Block0 and Block1 boot areas.

[Bud]

The first thing boot code does after being read is initialize the DDR,  next thing it does is initialize the FPGA, before loading the kernel, so DDR and FPGA have to be powered on at boot stage.

[smaultre]

In the power supervisor IC datasheet says, that it need to be configured by processor. Maybe config data stored on the Flash IC and was corrupted?

[Bud]

Before unsoldering the boot flash- did you capture the output of the debug serial console?

[smaultre]

There's nothing on the console, i can't get DDR memory to be powered. Boot-up process stuck after several bites was read-out from flash.

[Bud]

The imx25 reference manual gives a command that can be sent over serial USB to read the status code for failed boot. A table of status codes should be in the manual somewhere. It will return a specific status code if the boot failed due to signature verification or corrupted boot code.