EEVblog Electronics Community Forum
Products => Thermal Imaging => Topic started by: falcom on March 15, 2020, 02:13:29 am
-
I have a fairly expensive circuit board from a thermal imager (BAE MIM500). It is a processor board that worked until recently and then suddenly stopped.
It is several thousand $ and a long wait for the manufacturer to replace it.
I have another working circuit board that has the wrong software/firmware installed.
I want to copy the software /firmware from the non working board and program the working board with it.
The board has a JTAG port and I can read the Xilinx XCR3032XL CPLD using Platform USB Cable and the check sum matches the one printed on the CPLD. The CPLDs on both boards have matching check sums. I cannot go any further. (I don't know how)
I am new enough to JTAG to not fully understand it.
The board has:
NEC VR4131 microprocessor ,
Intel 28F128J3 Strata flash memory,
Xilinx XCR3032XL ,
and a Micron MT48LC4M16A2 SDR SDRAM dram.
How should I proceed?
..
If programming is not feasible how about desoldering the BGA chips and soldering them to the working board???
(https://i.imgur.com/2ai3R6i.jpg)
(https://i.imgur.com/VssTw64.jpg)
-
Bump for hepl from really smart people.
-
If it is indeed the CPLD you want to read, not the flash. I think I was told by a VHDL person at work one time that the manufacturers of CPLDs make it not possible to read back the program (at least via their software) because the people who use the parts don't want others to be able to copy their designs. I was going to suggest that you try asking on the FPGA board, but I see you already did that. Seems like there ought to be someone on this forum who knows the answer more definitely than I.
-
Falcom,
The problem with your request is the lack of knowledge pertaining to your BAE core. I own several of them but have not had to reverse engineer one yet as they are generally reliable. These were originally designed for deployment in weapon sights and IR seeker missiles ! They found use in civilian applications such as fire fighting cameras.
You state that the donor unit has the wrong firmware. It might help to expand upon why the firmware version is important. Sadly in these troubled times people with knowledge of thermal camera design have to be careful what they release on a public forum, especially when cores originally designed for military applications are involved.
In a thermal camera non-volatile memory system you will find the system firmware, FPGA or CPLD configuration, factory calibration, Identity details and any stored user specific settings/configuration. The user settings are normally accessible for change but the factory settings are often placed beyond user access by some means to deter tampering with system critical or restricted settings.
I do not think you will get very far trying to transfer all non-volatile memory content from the faulty core to the donor core as the OEM should have locked-out full access to the CPLD. The flash memory chip is a different matter and it may be possible to clone its contents onto another cores flash IC. The problem is you would likely need to remove the flash memory chips to achieve this and it requires a suitable programmer. If going as far as BGA rework, you may as well swap the flash memory chips. BGA rework on these PCB’s is not for the faint hearted and requires appropriate tools and experience to avoid a destroyed chip, Burnt PCB, collateral damage or just failed rework.
Will swapping just the Flash Memory solve your problem ? I have no idea. Much depends upon how the Flash memory contents are married to the other IC’s on the original PCB. There may be a need for the CPLD ID to match with an ID stored in the Flash Memory ? The only way to know for sure is to try the swap and cross your fingers.
You might want to consider standard fault tracing techniques on the faulty board using the donor as a reference for voltages etc. The chip datasheets will show you the various pin outs. Such is not always a simple task, but then neither is BGA rework that could result in two dead cores. I first check fir the obvious issues such as power and reset lines being correct, followed by some reverse engineering and targeted analysis. Have you monitored and compared the current consumption of your faulty core when fitted with the good and faulty PCB ? That can sometimes tell you what is, and is not happening, in the core.
Sadly a corrupted Flash chip is not unheard of and that will really spoil your day !
Fraser
-
Can you share the fault symptoms with us ?
Fraser
-
Fraser already mentioned to consider troubleshooting of the dead board. I want to strongly double on that.
The reason is that everything on this board is close to each other and BGA swap is risky. Also, speaking in general, it is not good idea to heat up flash memory if something else is possible. I have seen cases, when heating caused bit flip. Or if not - you still shortening its life.
Go for voltage checks, probe on SDRAM with a scope, see what is going on. Maybe board has UART debug output - try to investigate. You can also use thermal imaging to compare good board with a dead one. Lots of ideas, espeacially when you have an identical working board.