Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
241 (26.5%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
427 (46.9%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
43 (4.7%)
No, but am looking out for a cheap i3 to hack
42 (4.6%)
Not yet, but probably will if now that a closed-box hack becomes is possible
158 (17.3%)

Total Members Voted: 751

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 2668447 times)

_Wim_ and 3 Guests are viewing this topic.

Offline tiagobaracho

  • Regular Contributor
  • *
  • Posts: 66
Re: Flir E4 Thermal imaging camera teardown
« Reply #3525 on: February 07, 2014, 06:01:10 pm »
is it a possibility in the future to be able to get higher FPS ? or is it the sensor that only can make 9 fps ?... just out of curiosity ..

The sensor is apparently capable of outputting raw 60 FPS data, but so far nobody has found out how to extract useful information from it.
It is blindingly obvious  how to extract the 60fps stream - just needs a bit of work to implement it.
Anyone of you guys will try that ?
Sure. Right after I finish the other 43586534535 projects. ;) I suspect that you have bad luck that quite a few of us on here have quite a bit of motivation for high resolution, but a who-the-hell-cares attitude about fps. As in 9 fps is quite enough for all the stuff I do with it. PCBs and assorted other electronics tend to stay put and in focus, soooo...  :-//

I am more motivated to make a linux bootloader, and even that is fairly low on the list.

You probably would have better luck with that on an RC helicopter forum or some such. ;) But then, who's going to put a $1k camera on a crashy copter. :scared:

Anyways, just watch Mike's video again to see how blindingly obvious the todo list is staring you in the face. ;)
]
i was just asking.... i have no real need for high FPS.... resolution, YES !! i will use on PCB for troubleshooting.....
 

Offline tomas123

  • Frequent Contributor
  • **
  • Posts: 832
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #3526 on: February 07, 2014, 06:16:10 pm »
some notes around eeprom and 9hz, but nothing new informations


Code: [Select]
./i2c.exe
Usage: i2c [2] {r|w} <address> <no of bytes if read> <data to write>
       i2c [2] f <filename>
Write example:  i2c w A0 11 22 33 - Write 11h 22h 33h to A0h
Read example 1: i2c 2 r A0 10     - Read 10h bytes from A0h on I2C2:
Read example 2: i2c r A0 10 80    - Write 80h and Read 10h bytes from A0h
Read example 3: i2c r A0 10 80 40 - Write 80h 40h and Read 10h bytes from A0h (16-bit addressing)
File example 1: i2c f vf.txt      - Read command from file
the address A0h is common to all Serial EEPROM devices (with hard-wired pins A2, A1 and A0 to low)  :)

I think I've now worked out all the I2C devices :
0x92 Temperature sensor
0xD0 Realtime clock
0xAE EEPROM
0xAA BQ27510 battery manager

eeprom address 0xA0
Hmmm. found code that looks for the string "T198389" from I2C address 0XA0, and if found "SB0801 detector   found " else "ULIS detector found"

don't write direct to eeprom...
I have tried changing E4 to E8 in the eeprom with no effect.
I have found code (100033AC for those following along) that reads 16 bytes from the EE, checksums it and if sums OK, stores the EEPROM values somewhere , and if not stores 80 and 60 in the same locations. Still looking at other eeprom related code. I think the 6 near the resoltion data is also significant - seems to correlate with the "downsampling setting" vales displayed at boot.
I only had a very quick try at changing the ee so could be I got the sum wrong.

..use rset or web frontend
> rset version.product.name E8




It is blindingly obvious  how to extract the 60fps stream - just needs a bit of work to implement it.
unfortunately Flir doesn't sale a Ex with higher frame frequency, so surely the firmware doesn't support frequency > 9Hz

for inspiration a snip from a rls -r -l

Flir E4
Code: [Select]
.image.sysimg.basicImgData.distrData: (15)
rw----------n- 0 root   root   <i> imageFreq                      9

Flir E40
Code: [Select]
.image.sysimg.basicImgData.distrData: (15)
rw----------0- 0 root   root   <i> imageFreq                     30

syntax for (rw)
Code: [Select]
rwcdrwcdrwcd0p*1 user group <a> resource_name "value" Explanation:
First rwcd = owner read,write,create,delete rights flags.
Second rwcd = group read,write,create,delete rights flags.
Third rwcd = other read,write,create,delete rights flags.
0p*1 = subscribers, persistance, not default, users counts and flags <a> = node type (ascii/integer/double/index/entry)
For resources with fixed string values, all alternatives are listed as well.

find string "imageFreq" in old FW 1.18
Code: [Select]
./appcore.exe
distrData.imageFreq
--
./appcore_dll.dll
imageFreq
--
./ProdApp.exe
.image.sysimg.basicImgData.distrData.imageFreq

found this post
Maybe it is a language thing, but I am confused right now:
I thought, modifing the 4 bytes at 0x001016ec from "05 00 a0 e1" to "01 00 a0 e3" will enable 30Hz but in your posting above you say 100ms between each frame = ~9 Hz. Did I miss something or did I understood something wrong? So no 30Hz by changing appcore.exe?
That hex will enable something and rls will report 30 for some values that were formerly at 9. but nontheless the effective framerate will stay under 10Hz.
Anyway the Ex is quick enough so one does not have to wait too long for a new image ... I don't have a big urge to investigate that further :)
« Last Edit: February 07, 2014, 11:00:15 pm by tomas123 »
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #3527 on: February 07, 2014, 06:28:21 pm »
It is blindingly obvious  how to extract the 60fps stream - just needs a bit of work to implement it.
unfortunately Flir doesn't sale a Ex with higher frame frequency, so surely the firmware doesn't support frequency > 9Hz

I suggest re-considering this:
- take a look at the strings inside gethwtype.exe ...
- the fact that the firmware shows obvious similarity to Exx series firmware
- the sensor outputs at 60Hz as measured by Mike
- i2c was not used in our hacks except for cosmetic stuff, but it's removal obviously got much attention in new firm

Offline KTP

  • Frequent Contributor
  • **
  • Posts: 515
Re: Flir E4 Thermal imaging camera teardown
« Reply #3528 on: February 07, 2014, 06:59:18 pm »
Can anyone with one of these E4 modified cameras point it at a propane tank after some use and tell me if it lets you see the level of the liquid in the tank?  Very curious.
 

Offline SeanB

  • Super Contributor
  • ***
  • Posts: 15093
  • Country: za
Re: Flir E4 Thermal imaging camera teardown
« Reply #3529 on: February 07, 2014, 07:06:13 pm »
That will not be a problem, as the liquid level will be quite different to the ambient ( unless you are in the frozen parts of the USA) and will show as a band across the metal. Pouring hot water across the tank will show it up better though.
 

Offline scientist

  • Frequent Contributor
  • **
  • Banned!
  • Posts: 317
  • Country: 00
  • User banned.
Re: Flir E4 Thermal imaging camera teardown
« Reply #3530 on: February 07, 2014, 08:03:27 pm »
- i2c was not used in our hacks except for cosmetic stuff, but it's removal obviously got much attention in new firm

Or maybe it's a distraction so you don't see the FPGA changes that make your camera brick itself if it detects an unauthorized RNDIS connection after a particular date.
 

Offline ericpi

  • Newbie
  • Posts: 2
Re: Flir E4 Thermal imaging camera teardown
« Reply #3531 on: February 07, 2014, 09:55:44 pm »
Can anyone with one of these E4 modified cameras point it at a propane tank after some use and tell me if it lets you see the level of the liquid in the tank?  Very curious.

I just tried with my upgraded E4: I was not able to see the level in the propane tank. The entire tank looked uniform color / temperature, with no obvious liquid line.

However, as SeanB notes, I am indeed in the frozen parts of the Northeastern USA (right around 32F / 0C), so this might be the explanation.  I can gladly try again in a few months when it warms up ;)
 

Offline Monadnock

  • Contributor
  • Posts: 30
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #3532 on: February 07, 2014, 10:02:54 pm »
Can anyone with one of these E4 modified cameras point it at a propane tank after some use and tell me if it lets you see the level of the liquid in the tank?  Very curious.

I just tried with my upgraded E4: I was not able to see the level in the propane tank. The entire tank looked uniform color / temperature, with no obvious liquid line.

However, as SeanB notes, I am indeed in the frozen parts of the Northeastern USA (right around 32F / 0C), so this might be the explanation.  I can gladly try again in a few months when it warms up ;)

A propane tank that is sitting with its valve closed will have uniform temperature throughout equal to the ambient. It is only when gas is flowing and the liquid propane is vaporizing that you will see a temperature difference since it is the the state change from liquid to gas that is the cooling process.
 

Offline georges80

  • Frequent Contributor
  • **
  • Posts: 806
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #3533 on: February 07, 2014, 10:33:23 pm »
For propane, the trick is to pour some HOT water down the the side of the tank (that's how the LCD indicators work) and the metal tank part above the liquid will stay hotter for longer.

cheers,
george.
 

Offline tomas123

  • Frequent Contributor
  • **
  • Posts: 832
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #3534 on: February 07, 2014, 11:07:15 pm »
I suggest re-considering this:
- take a look at the strings inside gethwtype.exe ...

What do you mean?
With 9Hz/30Hz Flir describes only known cameras like "Thermacam E2" = E40 (see /FlashBFS/system/web/images/E2.jpg)
our Flir E4 = "Z3 - ASCO camera"
see below

Code: [Select]
$ strings gethwtype.exe
...
Z3 - ASCO camera
...
Ex - T-Cam, unknown subtype (remote)
E4 - T-Cam, BACT2 AND ULIS detector
E3B- T-Cam, BACT2 AND SB0601 30 Hz detector
E3A- T-Cam, BACT2 AND SB0601 9 Hz detector
E2B- T-Cam, BACT AND SB0601 30 Hz detector
E2A- T-Cam, BACT AND SB0601 9 Hz detector
E1B- T-Cam, BACE rev 04-07 AND SB0401 30 Hz
E1A- T-Cam, BACE rev 04-07 AND SB0401 9 Hz
...


- the fact that the firmware shows obvious similarity to Exx series firmware

I see some differences in firmware/hardware...

info from E4 = FLIR Astra Z3:
/FlashFS/tmp/prod.log
Code: [Select]
2013-12-03 14:58:01 Found detectortype SB320 ISC0901, selecting detector S
2013-12-03 14:58:01 Lens leExFOL7
2013-12-03 14:58:01 Found osimgkit ASCO OS image, selecting Cameratype Z, Web-Addon Z3
2013-12-03 14:58:01 \FlashBFS\system/web/inc is updated for Z3
...
2013-12-03 14:58:07  14 Preparation:Image frequency 9

compare with E40 (Thermacam E2)
Code: [Select]
2013-06-15 01:40:37 Found detectortype SB320 ISC0601, selecting detector S
2013-06-15 01:40:37 Lens leE
2013-06-15 01:40:37 Found osimgkit SLCO OS image, selecting Cameratype E, Web-Addon E2
2013-06-15 01:40:37 /FlashFS/system/web/inc is updated for E2
...
2013-06-15 01:40:43  10 Preparation:Image frequency 30
« Last Edit: February 07, 2014, 11:34:41 pm by tomas123 »
 

Offline OrBy

  • Regular Contributor
  • *
  • Posts: 220
Re: Flir E4 Thermal imaging camera teardown
« Reply #3535 on: February 07, 2014, 11:47:55 pm »
I would really find it quite funny if the 9Hz limit was actually being imposed by the WinCE side of things and the FPGA was actually outputting 30Hz the whole time... Given the slowness of the UI it's almost feasible but others have mentioned that the use of ?QT? was the most probable cause of the lag there.

*edit - why would the lcdc.dll driver care about the "C.a.m.e.r.a. .F.P.S.:" ?
« Last Edit: February 08, 2014, 01:36:51 am by OrBy »
 

Offline Sensor Geek

  • Contributor
  • Posts: 15
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #3536 on: February 08, 2014, 01:10:17 am »
Can anyone with one of these E4 modified cameras point it at a propane tank after some use and tell me if it lets you see the level of the liquid in the tank?  Very curious.

Yes, it's very evident. I've used against little 1lb (454g) camping tanks up to 3000gal (11k L) delivery trucks. Pictured here are three 100lb (45kg) tanks on my porch. On left is one in use (or had been in the last hour), in the middle a full spare, and on the right another full spare that got some sun earlier in the day. Clearly the one on the left will be replaced soon as it's down to ~20%. Outside temp is about -1C. Picture from a modified E4.

Edit 20140209: Added 2nd propane image. This image was taken a few minutes after heating the two full tanks on the right and middle with a torch. The center tank appears to have slightly more than the right.
« Last Edit: February 10, 2014, 02:15:58 am by Sensor Geek »
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #3537 on: February 08, 2014, 02:02:04 am »
- i2c was not used in our hacks except for cosmetic stuff, but it's removal obviously got much attention in new firm

Or maybe it's a distraction so you don't see the FPGA changes that make your camera brick itself if it detects an unauthorized RNDIS connection after a particular date.
yeah, "hardware error, please contact support, error code: HKR" ;)

Hm, if I had my E4 already open then I'd probably give it a try and completely disable/desolder the EEprom - just to see if the bootprocess would still work (ftp/telnet).

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #3538 on: February 08, 2014, 02:32:56 am »

Just a small bump for reference

Note on the sensor-naming ( ISC0901B0 ):
I'm pretty sure the first two numbers (09) are the sensor's generation year - deduced from some documents found online where that # went form 98 to 00 to 05 and 09 now... ;) the next pair of numbers beeing the resolution/model and then followed by special features.
Unfortunately "our" ROIC isn't listed here: http://www.flir.com/cvs/cores/view/?id=51948

Offline KTP

  • Frequent Contributor
  • **
  • Posts: 515
Re: Flir E4 Thermal imaging camera teardown
« Reply #3539 on: February 08, 2014, 04:13:00 am »
SensorGeek, thank you for the test!

We had been having a discussion on a rv forum about ways to accurately measure the level of propane left in a tank if you could not weigh it and I thought about this camera.

Adding that to the long list of reasons a modded E4 would be cool to own.  :D
 

Offline scientist

  • Frequent Contributor
  • **
  • Banned!
  • Posts: 317
  • Country: 00
  • User banned.
Re: Flir E4 Thermal imaging camera teardown
« Reply #3540 on: February 08, 2014, 05:06:42 am »
- i2c was not used in our hacks except for cosmetic stuff, but it's removal obviously got much attention in new firm

Or maybe it's a distraction so you don't see the FPGA changes that make your camera brick itself if it detects an unauthorized RNDIS connection after a particular date.
yeah, "hardware error, please contact support, error code: HKR" ;)

Hm, if I had my E4 already open then I'd probably give it a try and completely disable/desolder the EEprom - just to see if the bootprocess would still work (ftp/telnet).

I'd open it if I were you -- the disassembly process is well documented and it's just a SO-8 or SO-6 if I remember correctly.
 

Offline hgg

  • Frequent Contributor
  • **
  • Posts: 898
  • Country: gr
Re: Flir E4 Thermal imaging camera teardown
« Reply #3541 on: February 08, 2014, 07:22:07 am »
Hi,

Just received the E4 unit!     Serial Number : 639121xx

Hackable, right  ?  ???     
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #3542 on: February 08, 2014, 07:26:53 am »
Hi,

Just received the E4 unit!     Serial Number : 639121xx

Hackable, right  ?  ???   

 |O |O |O |O |O |O |O |O (use brain - check firmware version)

Offline hgg

  • Frequent Contributor
  • **
  • Posts: 898
  • Country: gr
Re: Flir E4 Thermal imaging camera teardown
« Reply #3543 on: February 08, 2014, 07:32:44 am »
Quote
(use brain - check firmware version)

How?  I don't have the unit in my hands.  It is in the US...
« Last Edit: February 08, 2014, 08:07:56 am by hgg »
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 1945
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #3544 on: February 08, 2014, 07:37:09 am »
Hi,

Just received the E4 unit!     Serial Number : 639121xx

Hackable, right  ?  ???   

 |O |O |O |O |O |O |O |O (use brain - check firmware version)
The correct answer would have been "yeah, sure!  :-+".

That'll teach 'm to engage brain. ;)
 

Offline hgg

  • Frequent Contributor
  • **
  • Posts: 898
  • Country: gr
Re: Flir E4 Thermal imaging camera teardown
« Reply #3545 on: February 08, 2014, 07:47:58 am »
Great!
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 1945
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #3546 on: February 08, 2014, 07:53:13 am »
Quote
(use brain - check firmware version)

How?  I don't have the unit in my hands.  It is the US...

Quote
Just received the E4 unit!     Serial Number : 639121xx

Different kind of "received" then? But never mind, the brain is active now so all will be fiiiiine. ;)
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 8538
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #3547 on: February 08, 2014, 11:49:17 am »
@hgg

And from my archive of serial numbers it look to have been Calibrated between 7 Jan and 16 Jan. Firmware 1.19.8 fitted.E4 V1.1 Hardware.

Extract from my records:
6391 17xx              07 Jan 14        1.19.8 E4 V1.1
6391 23xx              16 Jan            1.19.8 E4 V1.1
6391 25xx              18 Jan            1.19.8 E4 V1.1


This post may be of interest to you (your question is the reason that I compiled the data) :

https://www.eevblog.com/forum/reviews/flir-e4-the-useful-information-thread/msg332428/#msg332428
« Last Edit: February 08, 2014, 11:50:58 am by Aurora »
 

Offline hgg

  • Frequent Contributor
  • **
  • Posts: 898
  • Country: gr
Re: Flir E4 Thermal imaging camera teardown
« Reply #3548 on: February 08, 2014, 12:30:52 pm »
Hello Aurora,

Yes, I've checked your post first, but I just wanted to be sure...
That was close ...  :) 
 

Offline CesarEscudero

  • Regular Contributor
  • *
  • Posts: 91
  • Country: 00
Re: Flir E4 Thermal imaging camera teardown
« Reply #3549 on: February 08, 2014, 05:15:57 pm »
Finally I decided to make my tripod adapter, I hope you find it useful.








STL files and Links



mikeselectricstuff, I have no problem in sending you one, PM me.

« Last Edit: February 08, 2014, 06:26:06 pm by ee.jcesar »
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf