Hikvision DS-2TP31 series Thermal Camera Teardown

[Fraser]

The Patient : Hikvision DS-2TP31 series, working but subject of a Teardown

The Task : To teardown the camera and assess its design, quality and potential for reconfiguration.

Will there be pictures ? .... you bet there will 

Can the Fever Detection camera version be changed to the standard model with greater temperature measurement capability ? ..... Maybe, we will have to see.


Background:

I recently highlighted that a chap on eBay is selling the Hikvison DS-2TP31B Fever Detection cameras for an excellent price of around £60 plus £10 postage. (he is still selling them) So for £70 you get a camera that normally retails at around £1K ! A bargain ? Well that very much depends upon whether the camera still provides what you need. It has to be a good fit to your tasking otherwise it would be better to buy something like a UTi260B or the lower resolution but lower cost UTi120S. More about what the Hikvision camera offers in terms of temperature measurement later.

I was interested in the DS-2TP31B camera as I wanted to know how the claimed measurement accuracy of +/-0.5C between 30C and 45C had been achieved. I was also interested to know what imaging core the camera contained as its 160 x 120 pixel resolution did not seem to fit the current market favourites from Infiray (IRAY) or Guide Sensmart. I doubted that the core was a FLIR Lepton and some investigation suggested that it is most likely a Hikvision 'in-house' core.

I now have the opportunity to look inside the DS-2TP31B camera and the owner has given me permission to document the teardown on this forum  I am pessimistic with regard to reconfiguring the cameras firmware as I suspect this Fever Detection camera may differ in hardware to that of the standard DS-2TP31 model in order to achieve the greater measurement accuracy. I will see what I can discover in the OS though. This camera needs to still be working when I return it to its owner so I am limited in how far I can go with a teardown and changes to the firmware. I need to be careful with it !

So without further comment, lets get to the teardown.

The first question asked by many who look at this and the Uni-T cameras is "how do I open the casing ?" The answer is... with care and patience ! These cameras usually have a number of hidden screws securing the case halves. There are normally at least two screws in the bottom of the handle, hidden behind rubber covers, and a number of screws hidden behind the LCD display window. The display window is normally attached to the cameras case with the same sort of strong double sided tape used on mobile phone screens. To remove the plastic display screen you need to warm its perimeter with a hair dyer whilst taking great care to not overheat and warp the screen plastic or camera casing. A screen removal sucker is then used to pull on the plastic screen to lift part of it away from the camera casing. A plastic screen separator (looks like a guitar plectrum) is then inserted between the plastic screen and camara case. Another separator is then used to move along the perimeter of the screen, lifting it away from the casing. Reheating of the adhesive will be needed as you go to allow it to release its grip. The whole plastic screen will come away without damage and the case securing screws will be revealed behind. Place the plastic screen on some 'easy release non stick paper' as found on the rear of shipping labels etc. the adhesive tape will then be re-useable 

In the pictures that follow, you will see the hidden screw locations on the Hikvision DS-2TP31B camera and the locations will likely be similar on the Uni-T and Infray cameras. There were no plastic case clips on the Hikvision camera which was nice to see as such can be a pain to release.

To the pictures now and I will comment on the design at the end.

Fraser

[Fraser]

The teardown begins.......

[Fraser]

Continued.....

[Fraser]

Continued.....

[Fraser]

Continued......

[Fraser]

Continued.....

[Fraser]

So what do I think of the build quality ?

I am pleased to say that this is a nicely made camera and I was especially pleased to see extensive use of brass screw inserts in the plastic casing as these are often deleted from a design at the cost reduction phase. The trigger design is well thought through and well engineered. There is a complex rubber cover over the trigger switch to protect it from moisture and dust ingress. Nce to see 
The PCB quality is excellent and I see no evidence of cost reduction being applied to the quality of electronic components used in the camera. Note the use of quality Coilcraft inductors. The main processor is not easily identified from its markings but may be an original part of a cheaper Chinese clone.

The microbolometer assembly is a bespoke Hikvision part and is not a 3rd party core. The microbolometer is securely mounted on a quality PCB within a two part metal chassis that also acts as a heatsink via a metal 'finger' projection that contacts the rear of the microbolometer via thermal transfer paste. There is a temperature sensor IC mounted on the front of the metal microbolometer module chassis adjacent to the FFC shutter. The close proximity of this sensor to the FFC shutter assembly is intended to provide an accurate measurement of the FFC shutter temperature for calibration of the the cameras temperature measurement system. An accurate measurement of the FFC shutter temperature is essential in a Fever Detection thermal camera that produces accurate measurements of the target. Any error at this point will be introduced into the measurements of the camera as the FFC shutter behaves like a Blackbody temperature reference in this camera.

The metal microbolometer modele chassis is clearly designed to be used in different configurations as it can accomodate a laser marker and a different type of FFC shutter that uses a rotary solenoid actuator rather than than the linear movement type used in this Fever Detection camera. The standard DS-2TP31 camera model incorporates a laser pointer that could not be accommodated with the tall linear FFC shutter design. To fit a laser pointer assembly, the rotary solenoid type FFC shutter would be needed. So why use the linear shutter design on the Fever Detection camera version ? I can only assume that the temperature reference accuracy of the enclosed FFC shutter is superior to that of the free air FFC flag. There is definitely some technical thought and drive behind this design 

In precis, I cannot fault the design of this camera. It is a joy to dismantle and has a feel of qaulity engineering about it. Granted it is not in the same class as high end thermal imaging cameras, but compared to the Uni-T thermal cameras, it is a superior design.

Fraser
   

[Fraser]

For comparison purposes, the Uni-T UTi220A Pro (Believed to be the UTi260B under a different number). Note the lack of brass inserts in the casing plastics  Compare the PCB's as well.


Just some points to note about the UTi220A Pro :

1. The Lithium Battery is a 2 wire connection so no thermal monitoring, unlike the DS-2TP31 design which is 4 wire.
2. The Trigger acts on a main PCB mounted switch rather than on a separate PCB as in the DS-2TP31 design. Not a big deal.
3. The thermal window is not fixed into the casing. I prefer the window to be well sealed to the casing.
4. I cannot see a metal chassis temperature sensor in the images so the sensor is likely mounted on the PCB for simplicity of build.
5. I am not a fan of the visible light camera being mounted on the microbolometers heatsink as these cameras can produce heat that effectively transfers to the microbolometer assembly.

The Uni-Trend UTi220A Pro appears to have had an effective cost reduction process applied to it that has reduced the cost of the cameras production. That does NOT mean that the UTi220A Pro is not a good camera ! This is just a comparison of the two camera designs... one oozes good engineering whilst the other is more typical of what to expect at the budget end of the market as production cost reduction is key to low retail price and being competitive in the marketplace.

Fraser

Note:- These images are borrowed from this thread....
https://www.eevblog.com/forum/thermal-imaging/uti220a-pro(uti260b)-disassembly/
These pictures are the property of "c1400700226" and this is acknowledged.

[Fraser]

So back to the Hikvision DS-2TP31B camera.......

What about its firmware ?

From what I can tell from my brief examination of the firmware it has been 'tweaked' to offer the following for Fever Detection.....

1. The measurement range is specified as +30C to +45C but the camera actually measures from +25C to +50C
2. Measurement accuracy is stated as +/-0.5C compared to the +/-2C of the standard DS-2TP31 model.
3. The image displays <+25C or >=50C when out of measurement range but the image is correctly spanned to cover the full temperature range present in the scene between -20C and +150C.
4. The saved images contain the full radiometric data of the scene within the -20C to +150C
5. Saved images may be analyzed in the free Hikvision iVMS-4800 image analysis software without the Fever Detection measurement limitations.
6. The low sensitivity range providing 0C to +550C measurement is not active on the Fever Detection version of the camera.
7. There appears to be some form of thermal image stacking being used in the fever Detection camera to improve performance. This impacts frame rate and is very obvious if the camera i panned across a scene.
8. The firmware may be upgraded by adding the "Digicap.dav" firmware file to the Micro SD card root. The camera finds the file at boot, installs the update and then deletes the file from the card. The update file is of approximately 5MB in size.
9. The firmware file for the standard and Fever Detection versions of the camera are the same but the behaviour of the firmware is defined by other means. This is likely an ID check upon installation of new firmware or fixed configuration files on the camera.
10. Access to the OS is not possible via the USB port as that is configured as a bulk memory device.
11. There appears to be an engineering port on the cameras main PCB (JD3) This may be an UART serial port and will be investigated. If it is a UART port, OS access may be possible. JD3 may indicate a Diagnostic role for the connector ?
12. I expect the camera to be running a compact embedded system version of Linux.

Fraser

[Fraser]

The chipset used in the DS-2TP31 B camera:

1. HK 2015- 6 : SOC of unknown ID. Likely an ARM Cortex based SOC (Possibly a Amberella SOC as Hikvision use their IC’s in IP cameras)

2. Trion T20F169 : Advanced FPGA IC

3. Winbond 25M512JVE : 512Mb (2x256Mb) Serial NOR MCP Flash Memory

4. BQ24295 : I2C controlled 3A single Lithium Ion cell charger

[Fraser]

I have captured the cameras boot sequence via the serial port 

As hoped, the 4 pin connector, marked JD3, is a UART Serial port. From top down, the pinout is +3V3, UART Serial In (3V3), UART Serial Out (3V3), 0V. The data settings are 115200 Baud 8,n,1.

The UART Serial output presents the boot process and then repeatedly reports that it is looking for an IP Address 

The boot sequence reveals that the unknown SoC IC is the Huawei Hi3518 HD IP Camera SoC. 

https://cdn.hackaday.io/files/19356828127104/Hi3518%20DataSheet.pdf

The OS is Huawei LiteOS Linux.

A cursory look at the boot listing did not reveal any obvious accessing of configuration files that could configure the camera for Fever Detection duties. What did surprise me was how untidy the boot sequence is. Just look at all the errors that are reported. Many appear to be due to missing hardware of software. A bit like a standard generic Linux build that was set up for a task but the unused boot elements were left in place. 

I attach the boot record in PDF and .txt format in case it is of interest.

The beginning of the Boot sequence is reproduced here:

System startup

U-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)

SPI Nor:"W25M512JV", Block:64KB, Chip:64MB

Hit Ctrl+u to stop autoboot:  0

booting from pri part...
Load kernel to 0x81800000 ... Done!
## Booting kernel from Legacy Image at 81800000 ...
   Image Name:   LiteOS-0.1.0-e2
   Image Type:   ARM Linux Kernel Image (lzma compressed)
   Data Size:    5074736 Bytes = 4.8 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Fraser

[Flukav]

Hello Fraser,
Thank you very much for this teardown and the log file.
By any chance, can you identify the connector and protocol used for the screen?

[tisher]

Any news with configuration file unlock?
Other Hikvision thermal camera use ftp for access
http://ftp.hikvision.ru/01.%20Firmware/01.%20Hikvision/10.%20Thermal/2.%20How%20to/07%20System/

And...
http://ftp.hikvision.ru/01.%20Firmware/01.%20Hikvision/10.%20Thermal/2.%20How%20to/07%20System/How%20to%20get%20thermal%20information%20by%20serial%20port.pdf

Or we can try to repack firmware with some changes
https://ipcamtalk.com/threads/hikvision-firmware-tools-change-language-extract-files-and-create-own-firmware.2664/

[Fraser]

Flukav,

The connector is a standard ZIF type and the boot record includes the ID of the LCD controller IC within the LCD panel. IIRC the protocol was MIPI but I will need to check.

I will add the LCD connector pin count and internal controller ID here later as I do not have it to hand.

Fraser

[Fraser]

Tisher,

The other firmware access that you detail is for IP cameras that naturally have an easy access port into the cameras OS. The handheld camera does not offer network connectivity and the firmware fails to find network connectivity hardware in its boot sequence.

I was thinking the same regarding modifications to the firmware and uploading a modified version to the camera. I have not tried the firmware modification tool yet. The issue will be whether the firmware in the handheld camera is close enough to that used in the IP cameras to be compatible with the firmware tools.

Note that it is not a special firmware version that sets the characteristics of the camera. The standard ‘non Fever Detection’ camera firmware will install on the Fever Detection Camera but once installed, it’s configuration is set for Fever Detection. Either the firmware installation process configures the update as it is being installed, or the firmware is standard and reads something inside the camera as it boots to configure it for Fever Detection duties. This is why I studied the boot log but nothing to configure the camera was found. I suspect there is an ID somewhere in the camera that is read by the firmware but I do not know where yet. To revert the Fever Detection camera to a standard configuration may require editing of the Cameras internal ID, if such exists, or editing of the firmware to set standard firmware operation when it sees a Fever Detection Camera ID.

The standard camera firmware was not on the Hikvision web site but I found it in the Hikmicrotech site. The cameras true hardware platform name is “E1L”

https://www.hikmicrotech.com/en/download/5

Fraser

[Fraser]

The LCD display COG controller is an ST7789V. The boot log makes reference to a MIPI interface protocol so the LCD protocol could be MIPI ?

https://www.newhavendisplay.com/appnotes/datasheets/LCDs/ST7789V.pdf

Fraser

[tisher]

and here
http://ftp.hikvision.ru/01.%20Firmware/01.%20Hikvision/10.%20Thermal/1.%20Firmware/
"2TP Handheld Series" ?

[Fraser]

Tisher,

Interesting, that firmware link you just shared is for a 2TP31 with a hardware ID of “E2L” That firmware is also older than the Fever Detection camera firmware that was loaded on my test camera. 2019 vs 2020

I shall have to investigate.

[tisher]

Any good news?
i try to decrypt digicap.dav file with know tools but no success for now

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

[Fraser]

With regret other tasking has taken priority and I have Not had time to look further into the firmware side of this camera yet.

Fraser

[knedit]

Anything new on being able to give these units more capabilities? they seem identical physically and with more of them showing up on ebay this is likely going to have more demand.

[Fraser]

Sadly nothing to report on the firmware front. From what I understand of the design, it is using Busybox with Hikvision specific code overlayed. Hikvision are not the tidiest of programmers so the camera firmware may be vulnerable to modification, but Hikvision have made life difficult by using encryption

These cameras are currently locked into a fever detection specification and image processing mode, with no easy way to change that configuration. Installing the standard firmware package does nothing as the firmware just configures itself as a fever detection version   I would need to spend a lot of time reverse engineering the accessible code in the camera and sadly I am engaged in higher priority tasking at the moment. I will PM you the current situation for me.

[daisizhou]

Hi Do you have a plan to recompile the firmware to make the measurement range larger, suitable for maintenance and inspection PCB or other plans?
If it can be turned into infrared detection use, it will be a cheap test tool

[Fraser]

Sadly no plans at the moment. Decompiling the firmware is likely beyond my skill set as I am a hardware tech and not a coder

You are quite correct though… this would make a bargain purchase if it can be reverted to the standard DS-2TP31 version with twin temperature ranges and disablement of the image stacking feature.

As supplied, the fever detection version is a very accurate at Radiometric thermal camera covering the measurement range 25C to 50C. Such would be useful to a Veterinary practitioner and wayyyy cheaper than dedicated Vet cameras  The displayed and saved images are not temperature range limited and will show all temperatures in the range -20C to +150C. It is only the on-board measurement feature that is limited in this respect. To measure the pixel temperatures outside the Fever range, you have to look at ten saved image using the free image analysis software. At £70, delivered, I still find this well made thermal camera to be a bargain  It’s measurement accuracy without the use of a fixed temperature reference is truly impressive. Hikvision clearly put Some decent thought into how to achieve better accuracy through a combination of temperature calibration , hardware and firmware improvements.

Fraser

[daisizhou]

This kind of tester for measuring temperature, the most critical indicators are temperature drift and interference.
Is it out of range especially when measuring in sunlight and when measuring in an air-conditioned room.
The experience of using Uni-T is very poor.
Now many places are using infrared thermometers to test body temperature due to new virus testing, but there is a big error in this measurement.They're just there to get the job done, not to measure everyone's temperature accurately。looks like a scam.
Only through a lot of long-term use, see how the stability works.
If it is indeed stable and accurate, it is meaningful to improve