FLIR SC640 Thermal Camera power up / software / firmware issue - Page 1
Forum section: electronics / general

author: radioorizont
author_rank: Regular Contributor
timestamp: September 11, 2021, 05:53:37 pm
content: Hi All,I own a FLIR SC640 thermal camera which does not seem to fully boot.The camera lens seems to "home" and the viewfinder flashes on for a split second but that's it.The camera gets recognised as thermacam on the PC and i can browse to the internal memory in read-only mode regardless of the user/password combination i use (shared on this forum).I can not write, edit files.I tried flashing the new firmware with official files from FLIR but that didn't help., nothing seemed to be happening.Does anyone know what might be wrong here? it does seem like it's a software issue and not hardware.Thanks!

author: Fraser
author_rank: Super Contributor
timestamp: September 12, 2021, 12:02:17 am
content: The only hint that I can give you is to connect to the cameras internal engineering serial port and see what the cameras Firmware reports as it boots. I regret that I cannot provide the location of the engineering port on your SC640 but you should be able to find it by looking for the communications driver ICFraser

author: Ismsanmar
author_rank: Regular Contributor
timestamp: September 12, 2021, 11:23:09 pm
content: May I ask you what firmware have you tried to install? And where did you get it? Because in my case I have been searching on the Internet and I haven't found any mention of a possible firmware update for the SC6XX series.When you connect with the camera, are you using Thermacam Connect 3, the web interface or a FTP client program? What combination of user / password do you use? On my camera they are flir / 3vlig. My SC660 has a firmware version 11.3.3 and a hardware revision 404.Quote from: Fraser on September 12, 2021, 12:02:17 amI thought it was the connector next to the RTC button cell.

author: radioorizont
author_rank: Regular Contributor
timestamp: September 13, 2021, 08:23:40 am
content: Hi Ismsanmar,The firmware is now available of FLIR's official website after i asked for it for a few months, you just need to log in / create an account then search for it.It's called "FLIR P6xx/SC6xx Update Pack 11.5.3" and it's 15.4MbI hope that helps.I am using thermacam connect that provides an IP address then browse to the internal memory with a ftp client (Total Commander)I tried flir / 3vlig but that only allows read-only mode.You are correct the connector is next to the cell battery, it's a 12 pin connector, attached the photo i just need to figure out the pinout... If anyone knows it your help would be appreciated.Thanks all

author: Fraser
author_rank: Super Contributor
timestamp: September 14, 2021, 08:07:30 pm
content: What we have here is a failure to communicate ! This does not look like firmware corruption to me but rather a failure in hardware communication leading to system errors and controller halting. I would be looking at the I2C communications.Fraser

author: radioorizont
author_rank: Regular Contributor
timestamp: November 28, 2021, 01:55:50 pm
content: Before looking at the I2C error i think i need to look at the first error that shows up when attempting boot:OALIoCtlHalGetRndisMacAddr: ERROR reading MAC address from EEPROM!!!There might be something either with eeprom, although it does get correct voltages, or an error with eeprom communicating further with main CPUI will be getting a breadboard and will try to hook up the eeprom and read the data on it, any suggestions what device to buy to read the IC?It's a 9515a eeprom.The full boot sequence is below:*****************************BALTHAZAR P BOOTLOADERCompiled For: BACPVersion: 1.16Date: Sep 26 2006Time: 14:55:06********************************Flash Launch Mode Selected***nPress  to launch image stored in flash or  to cancel.Initiating flash resident image launch in 1 seconds. ...........0 seconds. copyNKImageFromFlash: Flash start 0xAA800000, Image start 0x80100000, Image length 18125712System ready!Preparing for download...Failed to read MAC address from EE, using (deleted mac address)INFO: Using device name: 'BACP60'Launching Windows CE Kernel for ARM (Thumb Enabled) Built on Aug 4 2008 at 18:38:38ProcessorType=0411 Revision=7sp_abt=ffff5000 sp_irq=ffff2800 sp_undef=ffffc800 OEMAddressTable = 80106830OEMInit Time 3106128 MB CPU boardSp=ffffc7ccOALIoCtlHalGetRndisMacAddr: ERROR reading MAC address from EEPROM!!!WLAN: ++MPInitWLAN: SCKT_VERS 0.92WLAN: --MPInit (0xc0000001)OALIoCtlHalGetRndisMacAddr: ERROR reading MAC address from EEPROM!!!I2C: failed to send address for write (AA)I2C: unit reset used because of controller hangupIntel NOR FLASH foundFLASH file system size 43008 kBNumber of blocks:.168Block size:..256 kBSectors/Block:.508Sector size:..512 BVFS: Initializing VSB with membase addr 0xAA700000 and offset 0x1600000Flash status failure  0x00800000Unrecoverable failure encountered while erasing flash.Error|FMD_EraseBlock|DoErase() failed.Flash status failure  0x00800000flash write retry  (0x01)Flash status failure  0x00800000flash write failure  (-4)VFS: VSB initialiation:Couln't find a spareblock, format neededVFS: Format needed!!!I2C: failed to send address for write (54)I2C: unit reset used because of controller hangupI2C: failed to send address for write (54)I2C: unit reset used because of controller hangupI2C: failed to send address for write (56)I2C: unit reset used because of controller hangupI2C: failed to send address for write (54)I2C: unit reset used because of controller hangupI2C: failed to send address for write (56)I2C: unit reset used because of controller hangupI2C: failed to send address for write (54)I2C: unit reset used because of controller hangupI2C: failed to send address for write (56)I2C: unit reset used because of controller hangupI2C: failed to send address for write (54)I2C: unit reset used because of controller hangupI2C: failed to send address for write (56)I2C: unit reset used because of controller hangupI2C: failed to send address for write (AE)I2C: unit reset used because of controller hangupI2C: failed to send address for write (AA)I2C: unit reset used because of controller hangupI2C: failed to send address for write (E6)I2C: unit reset used because of controller hangupI2C: failed to send address for write (A4)I2C: unit reset used because of controller hangupCAM_Init: Loading camera MCB882PI2C: failed to send address for write (76)I2C: unit reset used because of controller hangupI2C: failed to send address for write (76)I2C: unit reset used because of controller hangupI2C: failed to send address for write (98)I2C: unit reset used because of controller hangupI2CSERIAL: I2C read error 0x5B4Activating FVD from dispdrvrActivate FVD failed (2). Waiting for filesystem.I2C: failed to send address for read (72)I2C: unit reset used because of controller hangupI2C: failed to send address for read (74)Activate FVD failed (2). Waiting for filesystem.I2C: unit reset used because of controller hangupActivate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.OALIoCtlHalGetRndisMacAddr: ERROR reading MAC address from EEPROM!!!RndisFn!ReadConfigurationValues: Mac Address. (deleted mac address)ATSVC: Event is successfully created e7bb89feActivate FVD failed (2). Waiting for filesystem.I2C: failed to send address for write (AE)Activate FVD failed (2). Waiting for filesystem.I2C: unit reset used because of controller hangupActivate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2)258048 bytes SRAM free after dispdrvr allocI2C: failed to send address for write (A2)I2C: unit reset used because of controller hangupI2C: failed to send address for write (A2)I2C: unit reset used because of controller hangupI2C: failed to send address for write (64)I2C: unit reset used because of controller hangupI2C: failed to send address for write (64)I2C: unit reset used because of controller hangupI2C: failed to send address for write (60)I2C: unit reset used because of controller hangupI2C: failed to send address for write (C0)I2C: unit reset used because of controller hangupI2C: failed to send address for write (E6)I2C: unit reset used because of controller hangupI2C: failed to send address for write (C0)I2C: unit reset used because of controller hangupI2C: failed to send address for write (E6)I2C: unit reset used because of controller hangupAUTOLOADCHECK: No autoinstall file foundI2C: failed to send address for write (E6)I2C: unit reset used because of controller hangupI2C: failed to send address for write (E6)I2C: unit reset used because of controller hangupI2C: failed to send address for write (E6)I2C: unit reset used because of controller hangupI2C: failed to send address for write (E6)I2C: unit reset used because of controller hangupI2C: failed to send address for write (E6)I2C: unit reset used because of controller hangupI2C: failed to send address for write (E6)I2C: unit reset used because of controller hangup

author: Fraser
author_rank: Super Contributor
timestamp: November 28, 2021, 02:54:44 pm
content: Interesting boot detail there. As you say, the obvious next move is to see whether the eeprom has or issues. An inability to read or write would normally mean either a problem with the I2C bus or the chip and the chip is relatively easy to test. Have yo got the right component identified as the EEPROM though ? A 9515A is normally the PCA9515A I2C bus repeater IC.https://www.nxp.com/docs/en/data-sheet/PCA9515A.pdfIf that is the case and that IC is faulty….. your I2C bus fault may be explainedFraser

author: Fraser
author_rank: Super Contributor
timestamp: November 28, 2021, 04:50:59 pm
content: I have just had a “light bulb” moment ! In the FLIR PM series cameras, if the RTC module has a failed battery or a failure in the RTC module itself, the camera will not behave normally. In the case of the failed battery, the camera cannot find the Region configuration data that it expected in the Dallas/Maxim RTC module so uses a default USA factory configuration. It tries to write the correct Region data to the RTC memory ready for the next cold boot when that data will be read out at boot. Because the battery is dead, the data is not maintained and the system still finds invalid data at the next boot. This cycle repeats and the camera stays in a default ‘factory settings mode’ that configures the camera for NTSC operation. On a European market camera, the PAL viewfinder is not multi-standard so does not display an image. With a failed RTC module I have seen I2C errors caused by it as it does not response when the processor tries to access it. This causes a subsystem hang situation at boot but I think your camera completed boot OK.It may be worth looking at the cameras RTC/ Configuration memory section to see whether that is the EEPROM of which the Boot log speaks. In the PM series cameras a Dallas Timekeeper chip is co-located with a static RAM chip in the same module with a Powerhat battery cap on it. It is not an EEPROM but this may be an avenue worthy of investigation ? Your camera may just be loading defaults that are for a USA configuration on a European configuration camera.Fraser

author: radioorizont
author_rank: Regular Contributor
timestamp: December 06, 2021, 06:52:17 pm
content: Hi Fraser,Very useful information i had no knowledge of, thanks.The camera has an actual coin cell battery (photo in a post above) which i did swap to eliminate as possible issue, i also tried a VGA cable attached to the camera to see if it displays an NTSC/ PAL image on an external source, but no joy.It does not have such a chip as the one in your photos. I will try to take some higher resolution photos of the IC'sI probably did not identify the correct EEPROMFrom what i read EEPROM IC's of this day and age are prone to failure after 10 years or so, this cam is from 2009 so 2 years overdueI bought"CH341A Programmer adapter+SOIC8 adapter+ SOP8 clip with cable+1.8V adapter CH341A EEPROM Flash BIOS USB programmer ZIF adapter"to help diagnose, copy data, etc, just in case i need it.Thanks.

author: radioorizont
author_rank: Regular Contributor
timestamp: December 18, 2021, 02:55:35 pm
content: I swapped 2 9515A IC's and still same fault, i'm not blaming 9515A now but rather the Flash IC which is a EPCS16N SOP16, if i identified it correctly, to the bottom side of the Altera Cyclone ii IC in Image 1186.I attached high resolution photos of the 2 boards in question, each has a 9515A IC, those are the 2 components i swapped around, i have a few of those on order just in case any of the 2 are indeed faulty.When the camera boots i get:Preparing for download...Failed to read MAC address from EE, using (deleted mac address)From the boot sequence of the working camera, I get:Preparing for download...Using MAC address from EE (deleted mac address)Other errors further down in the boot sequence through Putty tend to indicate a flash failure...VFS: Initializing VSB with membase addr 0xAA700000 and offset 0x1600000Flash status failure  0x00800000Unrecoverable failure encountered while erasing flash.Error|FMD_EraseBlock|DoErase() failed.Flash status failure  0x00800000flash write retry  (0x01)Flash status failure  0x00800000flash write failure  (-4)VFS: VSB initialiation:Couln't find a spareblock, format neededVFS: Format needed!!!I ordered a few EPCS16N SOP16, i will replace that component and hope to get further, in case this Flash IC is faulty.

author: radioorizont
author_rank: Regular Contributor
timestamp: December 18, 2021, 03:01:01 pm
content: 2nd pic...

author: radioorizont
author_rank: Regular Contributor
timestamp: December 18, 2021, 03:01:43 pm
content: 3rd pic

author: radioorizont
author_rank: Regular Contributor
timestamp: December 18, 2021, 03:02:32 pm
content: 4th pic, they wouldn't all upload in single post....

author: Fraser
author_rank: Super Contributor
timestamp: December 18, 2021, 04:00:06 pm
content: I have circled the system FLASH chips on your pictures. These FLASH IC’s contain the operating system related firmware. There are two in the PM series, one for the main processor board and one for the video processor board. I note that your camera contains two FLASH IC’s as well but the design topology may differ to that of the PM series. The FLASH IC nearest to the main processor likely carries the OS firmware.The FLASH IC’s are the Intel 28F256P30Fraser

author: radioorizont
author_rank: Regular Contributor
timestamp: December 18, 2021, 05:23:46 pm
content: Hi FraserI suspected that might be the flash chip but got confused when i saw 2 of the same.Would that assume the eeprom role too?The first error on boot is reading the MAC from EEThanks

author: Fraser
author_rank: Super Contributor
timestamp: December 18, 2021, 06:57:59 pm
content: No, my comment was just for information. The eeprom you identified is the FPGA configuration memory so could well be the eeprom that your are searching for. I regret I do not have enough knowledge of this camera to be much help. What you will normally see in such a system at boot is the main processor and video processor Firmware being loaded into their respective RAM and the FPGA being configured either by the main processor system or it’s own dedicated eeprom. In this case, it would appear that the FPGA uses its own dedicated eeprom. Failure of the FPGA configuration will definitely throw up some errors at boot as the system checks for FPGA presence and operational state (no errors)Fraser

author: radioorizont
author_rank: Regular Contributor
timestamp: August 24, 2023, 06:54:29 am
content: Along time has passed and i decided to give this project another go.I suspected the Intel CPU was faulty and i resoldered a new CPU i was able to source.Guess what, now with the new CPU, and the other camera's power board, i don't get that i2c error any more, but Flash status failure  0x00800000*****************************BALTHAZAR P BOOTLOADERCompiled For: BACPVersion: 1.16Date: Sep 26 2006Time: 14:55:06********************************Flash Launch Mode Selected***nPress  to launch image stored in flash or  to cancel.Initiating flash resident image launch in 0 seconds. copyNKImageFromFlash: Flash start 0xAA800000, Image start 0x80100000, Image length 18125716System ready!Preparing for download...Using MAC address from EE 00:40:7F:07:24:F5INFO: Using device name: 'BACP9461'Launching Windows CE Kernel for ARM (Thumb Enabled) Built on Aug 4 2008 at 18:38:38ProcessorType=0411 Revision=7sp_abt=ffff5000 sp_irq=ffff2800 sp_undef=ffffc800 OEMAddressTable = 80106830OEMInit Time 3079128 MB CPU boardSp=ffffc7ccOALIoCtlHalGetRndisMacAddr: Fetched MAC address from EEPROM: 00:40:7F:07:24:F5WLAN: ++MPInitWLAN: SCKT_VERS 0.92WLAN: --MPInit (0xc0000001)OALIoCtlHalGetRndisMacAddr: Fetched MAC address from EEPROM: 00:40:7F:07:24:F5Intel NOR FLASH foundFLASH file system size 43008 kBNumber of blocks: 168Block size: 256 kBSectors/Block: 508Sector size: 512 BVFS: Initializing VSB with membase addr 0xAA700000 and offset 0x1600000Flash status failure  0x00800000Unrecoverable failure encountered while erasing flash.Error|FMD_EraseBlock|DoErase() failed.Flash status failure  0x00800000flash write retry  (0x01)Flash status failure  0x00800000flash write failure  (-4)VFS: VSB initialiation:Couln't find a spareblock, format neededVFS: Format needed!!!CAM_Init: Loading camera MT9M111I2CSERIAL: I2C read error 0x45DActivating FVD from dispdrvrActivate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.OALIoCtlHalGetRndisMacAddr: Fetched MAC address from EEPROM: 00:40:7F:07:24:F5RndisFn!ReadConfigurationValues: Mac Address 00 40 7F 07 24 F5Activate FVD failed (2). Waiting for filesystem.ATSVC: Event is successfully created 47ba4fdaActivate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2). Waiting for filesystem.Activate FVD failed (2)258048 bytes SRAM free after dispdrvr allocAUTOLOADCHECK: Wait for system to start 30sAUTOLOADCHECK: Showing splash screen for 30sI know there's also an issue on the BAPP board which manages power delivery, so i transplanted this SC640 main board into my P640 camera to see if It would show signs of life.The result is making me smile... a bitThe camera boots to the splash screen on display, this has never happened before, so looks like the CPU was indeed faulty (short found probing the board)I need to see what else i can test to look at this flash failure , but at least there's some progress

author: radioorizont
author_rank: Regular Contributor
timestamp: August 24, 2023, 06:59:05 am
content: camera showing signs of life