Author Topic: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors  (Read 1163 times)

0 Members and 1 Guest are viewing this topic.

Offline zxase258

  • Contributor
  • Posts: 22
  • Country: cn
Recently I got a damaged FLIR TAU320. And working 9Hz VUE 336 and a 30/60Hz VUE 336 PRO. I made some measurements on the circuit and timing of the detector. The relevant information is included in the attachment.

Notes:
    1.The circuit of the detector is drawn on FLIR TAU320. This camera uses FLIR ISC0601B detector, which is also used in products such as NV2, E40, A320. The effective resolution of the detector may be 324*256px and 25um pixel pitch.
    2.The detector timing is measured on FLIR VUE, and the camera's detector "maybe" ISC0901. This detector is used in NV3, E4, QUARK, etc. in CSP package. However, the FLIR TAU2 336 (equivalent to VUE 336) of the ceramic vacuum packaged detector, the die inside the detector is very similar to the CSP packaged ISC0901. I used another thermal imager to observe the die inside the ceramic vacuum package through the silicon window. The PAD on the die and the surrounding test points are the same as the detector in the CSP package. I don’t have a CSP packaged detector, so I can’t know if the internal structure is the same. As an assumption here, it is believed that FLIR uses the same die to produce two different packaged detectors.
    3. FLIR TAU2 (VUE) and TAU320 have the same detector peripheral circuit and the same pin definition. But the flexible circuit board connecting the detector to the main board is slightly different. There is an additional thermistor socket on the TAU2 flexible circuit board, which is used to measure the temperature of the lens mount.
    4.I measured some detector waveforms and attached them to google drive. These waveforms include the detector's readout timing, power-on timing, power-down timing, and camera soft reset timing. I use TLA5202B to measure the timing of the detector, regardless of whether the 9Hz or 30/60Hz camera detector works at the same clock speed. You need to install TEKTRONIX TLA v6.1 software to open these files. The software can be downloaded for free and can run without TLA hardware. At present, I do not fully understand the functions of these signals. Some of the functions have been analyzed and I marked them on the schematic.

https://drive.google.com/drive/folders/1Y86siS_A-smqSURbPRdMCSJpgdKCVOX4?usp=sharing

   Have fun. BI4LBK 73

« Last Edit: August 09, 2020, 01:47:10 pm by zxase258 »
 
The following users thanked this post: oPossum, Fraser, zbqpig, VGN, nikitasius

Offline zxase258

  • Contributor
  • Posts: 22
  • Country: cn
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #1 on: August 06, 2020, 01:56:53 pm »
Here are some interesting pictures, using a thermal imager to observe the internal die through the silicon (germanium) window of the detector.
 
The following users thanked this post: Fraser, zbqpig

Online Fraser

  • Super Contributor
  • ***
  • Posts: 9728
  • Country: gb
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #2 on: August 06, 2020, 02:33:12 pm »
Very interesting. Thank you  :-+

Fraser
 

Online VGN

  • Regular Contributor
  • *
  • Posts: 56
  • Country: am
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #3 on: August 06, 2020, 03:15:09 pm »
Wow! This is a great!  :-+

Thank you, zxase258! I was looking for ISC0601B pinout and power supply scheme.

I have a lot of experience with ISC0901 sensor. Follow the neighboring thread: https://www.eevblog.com/forum/thermal-imaging/openirv-isc0901b0-(autoliv-nv3-flir-e4568)-based-opensource-thermal-camera/

    The detector timing is measured on FLIR VUE, and the camera's detector "maybe" ISC0901.
Checked out the timing waveforms, this is definitly ISC0901  ;)
For those, who would like to watch this waveforms, you should download TLA V6.1.127 (lower vertions will not open the files)

BTW the last your attached image QUARK_336.png is actually FLIR MUON core. Looks like this is the same ISC0901 sensor.
« Last Edit: August 06, 2020, 03:34:11 pm by VGN »
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 9728
  • Country: gb
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #4 on: August 06, 2020, 03:43:55 pm »
The schematic was just what I wanted as well. I am currently working on the Seek Thermal Reveal Pro Fast Frame microbolometer PCB that uses a 2.8V LDO regulator. The unit I have just repaired had a failed MLCC on the LDO output. The noise levels on the 2.8V supply rail still seem a little high for its intended use so I wondered how other OEM's configure their supply rails to a microbolometer. I can now see how FLIR do it on the TAU :) This saved me reverse engineering one of my TAU cores  :-+

Thanks again. This sort of information is like gold dust to us thermal camera experimenting hobbyists as very little is published with deep technical detail of designs.

I will have a look at the waveforms that you have captured and see if I recognise them.

Fraser
 

Offline zxase258

  • Contributor
  • Posts: 22
  • Country: cn
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #5 on: August 08, 2020, 04:35:09 pm »
Wow! This is a great!  :-+

Thank you, zxase258! I was looking for ISC0601B pinout and power supply scheme.

I have a lot of experience with ISC0901 sensor. Follow the neighboring thread: https://www.eevblog.com/forum/thermal-imaging/openirv-isc0901b0-(autoliv-nv3-flir-e4568)-based-opensource-thermal-camera/

    The detector timing is measured on FLIR VUE, and the camera's detector "maybe" ISC0901.
Checked out the timing waveforms, this is definitly ISC0901  ;)
For those, who would like to watch this waveforms, you should download TLA V6.1.127 (lower vertions will not open the files)

BTW the last your attached image QUARK_336.png is actually FLIR MUON core. Looks like this is the same ISC0901 sensor.

Thank you for correcting the information. I haven't checked the QUARK information carefully. I treat them as the same product. I have several NV2 cameras, and one of the FPGA is damaged. I removed the FPGA and found the external connection of the JTAG IO. At the same time, I replaced the original XA3S1200E with XC3S1200E, which can also complete the configuration and work normally. I just found the key from the ROM and haven't tested the CAN communication. The inactive camera only generates a 75MHz clock on the detector socket without a readout signal. I will use my free time to test CAN communication and try to activate the camera. Once there is progress, I will perform ISC0601B timing measurements.
In addition, some of the captured ISC0901B waveforms contain an analog channel. I forgot to describe it clearly in the file: This signal measures the voltage of the 14-pin of the detector. I think this voltage is related to the detector bias (gain). The voltage can be adjusted in two steps by a MOSFET (T1 on schematic) on the LT1761 feedback resistor.

BI4LBK 73.
 
The following users thanked this post: Fraser, VGN

Offline zxase258

  • Contributor
  • Posts: 22
  • Country: cn
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #6 on: August 08, 2020, 04:45:56 pm »
The schematic was just what I wanted as well. I am currently working on the Seek Thermal Reveal Pro Fast Frame microbolometer PCB that uses a 2.8V LDO regulator. The unit I have just repaired had a failed MLCC on the LDO output. The noise levels on the 2.8V supply rail still seem a little high for its intended use so I wondered how other OEM's configure their supply rails to a microbolometer. I can now see how FLIR do it on the TAU :) This saved me reverse engineering one of my TAU cores  :-+

Thanks again. This sort of information is like gold dust to us thermal camera experimenting hobbyists as very little is published with deep technical detail of designs.

I will have a look at the waveforms that you have captured and see if I recognise them.

Fraser

Hope this information is useful to you, ISC0601B requires three voltages which are 3.3V/2.8V and one adjustable voltage at 9/11V. 3.3V and 2.8V are obtained from 5V power supply through LDO. The 11V voltage is generated by a BOOST converter near the FPGA. The voltage is boosted from 5V to 12V and is stepped down by LDO to 9/11V on the flexible circuit board.

BI4LBK 73.
 
The following users thanked this post: Fraser

Online VGN

  • Regular Contributor
  • *
  • Posts: 56
  • Country: am
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #7 on: August 08, 2020, 11:26:18 pm »
In addition, some of the captured ISC0901B waveforms contain an analog channel. I forgot to describe it clearly in the file: This signal measures the voltage of the 14-pin of the detector. I think this voltage is related to the detector bias (gain). The voltage can be adjusted in two steps by a MOSFET (T1 on schematic) on the LT1761 feedback resistor.
This mosfet switch that changes the bias voltage reference (I also think that this is related to the detector bias) was news to me. There is no such kind of switch at NV3. I also don't have it in current hardware revision, but will add this feature too. Special thanks for this!  :-+
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 9728
  • Country: gb
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #8 on: August 09, 2020, 12:15:17 am »
FLIR cameras can have a high and low sensitivity mode of operation selected through their configuration. Tau has this capability. Multi range thermal cameras such as those used for fire fighting use different bias voltages for each range.

Fraser
« Last Edit: August 09, 2020, 12:23:31 am by Fraser »
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 9728
  • Country: gb
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #9 on: August 09, 2020, 12:22:42 am »
Some information on high and low sensitivity (gain) modes.......

https://gulffire.mdmpublishing.com/thermal-imaging-understanding-high-low-sensitivity/

https://www.flir.ca/support-center/Instruments/what-does-high--and-low-gain-mode-mean-on-my-flir-ax5/

The bias on the Microbolometer may be ‘tuned’ to the particular application and required sensitivity vs temperature measurement capability.

Fraser
 

Online VGN

  • Regular Contributor
  • *
  • Posts: 56
  • Country: am
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #10 on: August 09, 2020, 10:15:00 am »
Some information on high and low sensitivity (gain) modes.......

The bias on the Microbolometer may be ‘tuned’ to the particular application and required sensitivity vs temperature measurement capability.
Thanks! I will try to test this feature. The only thing I don't understand is why only two fixed states for bias voltages (9v and 11v) are implemented? Is it worth adding some kind of 8-bit DAC for more accurate voltage adjustment?
 

Offline Bill W

  • Frequent Contributor
  • **
  • Posts: 511
  • Country: gb
    • Fire TICS
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #11 on: August 09, 2020, 12:11:22 pm »
Some information on high and low sensitivity (gain) modes.......

The bias on the Microbolometer may be ‘tuned’ to the particular application and required sensitivity vs temperature measurement capability.
Thanks! I will try to test this feature. The only thing I don't understand is why only two fixed states for bias voltages (9v and 11v) are implemented? Is it worth adding some kind of 8-bit DAC for more accurate voltage adjustment?

Usually the gain adjustment is coarse, so the gain might be a factor of 2 or 4 between those two states.
No real need to have finer steps, and then you'd run the risk of higher noise compared to a good low noise LDO like the LT1761

Bill
 
The following users thanked this post: VGN

Online VGN

  • Regular Contributor
  • *
  • Posts: 56
  • Country: am
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #12 on: August 09, 2020, 12:53:51 pm »
Usually the gain adjustment is coarse, so the gain might be a factor of 2 or 4 between those two states.
No real need to have finer steps, and then you'd run the risk of higher noise compared to a good low noise LDO like the LT1761
Of course, DAC will produce higher noise, that is unacceptable. We could use digial potentiometer in the feedback path of LDO, but this a headache too with no warranty of low output noise level. I agree that there is no need for fine gain adjustment. Thank you!
 

Offline zxase258

  • Contributor
  • Posts: 22
  • Country: cn
Re: Hardware reverse engineering on FLIR ISC0601B and ISC0901 detectors
« Reply #13 on: August 10, 2020, 03:16:10 am »
Usually the gain adjustment is coarse, so the gain might be a factor of 2 or 4 between those two states.
No real need to have finer steps, and then you'd run the risk of higher noise compared to a good low noise LDO like the LT1761
Of course, DAC will produce higher noise, that is unacceptable. We could use digial potentiometer in the feedback path of LDO, but this a headache too with no warranty of low output noise level. I agree that there is no need for fine gain adjustment. Thank you!

The detector has a 14/16-bit A/D converter, so I don’t think fine adjustment is needed. Only need to switch between two larger ranges, the dynamic range of ADC is enough.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf