Tips on reverse engineering pinout of undocumented chips - Page 1
Forum section: electronics / projects

author: madmaxbryan
author_rank: Contributor
timestamp: September 06, 2014, 08:03:31 am
content: lately, Mike (Mikeselectricstuff) has been working on a thermal imaging camera, and that got me inspired to blow the dust off my imager to see if i can get it to work. What i have is just the thermal imaging module itself, none of the control circuitry. I have sent 4 emails and 1 phone call to the manufacture with no luck, probably because im an end user and this imager is ITAR export controlled.What would be a good starting point to try to reverse engineer the pinout? The imager i have is a DRS U6010, 640x480 25um VOx microbolometer FPA. It has 38 pins split into 2 rows and has NTSC output on one of the pins. I found some documentation for different microbolometer from a different company, but has the same number of pins, so i have a general idea of what mine might have, which is a ground for analog and digital, serial data and clock, 6 digital video outputs, and 4-5 input voltages. Any help is appreciated.

author: amyk
author_rank: Super Contributor
timestamp: September 06, 2014, 10:14:12 am
content: If you could get an image of the die, it would probably help identifying the ground/power since that's usually quite obvious from the bondout.I wonder if it's related to the Flir ISC0601B?

author: madmaxbryan
author_rank: Contributor
timestamp: September 06, 2014, 10:33:40 am
content: An image of the die would definitely help. This microbolometer is fully sealed in a metal can under vacuum, so I would have to essentially destroy it to expose the goodness inside. im guessing x-rays wouldn't be able to penetrate the metal can either.

author: madmaxbryan
author_rank: Contributor
timestamp: September 06, 2014, 11:01:37 pm
content: I have started taking resistance readings on every pin in every possible combination, which is close to 800 combinations. im about half way done and i have found any patterns of short that might help identify multiple grounds or any other useful info.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: September 07, 2014, 01:04:19 am
content: Ohms is tricky, but volts (diode test) can tell you which pins have ESD/substrate diodes to which ground(s) and supply/ies. Once you figure out the supplies, you can start by trying a little voltage on each, and see which ones are inputs/outputs, active/inactive, etc. Between inputs, you'll have to make some lucky guesses if you have to figure out SPI / I2C / etc....Tim

author: madmaxbryan
author_rank: Contributor
timestamp: September 07, 2014, 04:13:10 am
content: Maybe i don't fully understand how my meter gets its data, but isn't the resistance setting and the diode setting basically the same test, just one gives you a resistance value and one simply gives you a tone if its below a certain resistance?I was thinking i could take the resistance of every pin combination, and any combination that was below about 1 ohm, i could reasonably assume is shorted together.

author: c4757p
author_rank: Super Contributor
timestamp: September 07, 2014, 04:23:09 am
content: Quote from: madmaxbryan on September 07, 2014, 04:13:10 amMany meters combine the diode test and continuity test modes. Diode test mode is like resistance, but it directly reads thevoltagedeveloped across the DUT rather than computing the resistance. Continuity test mode screams at you if the resistance is low.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: September 07, 2014, 08:30:35 am
content: Yeah. And the main downside to resistance is, you don't know what kind of current they're testing with, so you can't really estimate what voltage some oddball resistance corresponds to.Example: my non-auto-ranging VTVMmight measure a 1N4148 as 10 ohms (1x range), 20 (10x), 100 (100x), and so on. I happen to know it uses a resistor divider (calibrated meter movement accounts for the curve).It wouldn't take much checking to characterize a DMM though.Tim

author: madmaxbryan
author_rank: Contributor
timestamp: September 07, 2014, 01:38:35 pm
content: Took all night to do it, but i retested all possible pin combinations using the diode mode. I believe my meter outputs 2 volts when testing, so anything above 2 volts is an open and 0 volts is a dead short. Of the pins that had a reading, i'm ranging from 0.5 volts all the way up to 1.9 volts.At this point about 25% of the pin combinations have a reading, and most are fairly close to each other in voltage (0.5-0.9). I'm still not seeing anything that stands out as to power pins or output pins.I'll keep pressing DRS on Monday for info on this microbolometer.

author: amyk
author_rank: Super Contributor
timestamp: September 07, 2014, 01:43:17 pm
content: Quote from: madmaxbryan on September 07, 2014, 01:38:35 pmI would be careful, since this is a high-end ITAR-regulated sensor, lest they start considering you as a terrorist.

author: madmaxbryan
author_rank: Contributor
timestamp: September 07, 2014, 01:48:24 pm
content: I'm an American citizen, so the government already considers me a terrorist. Add the fact that im prior service military, and that pushes me right to the top of their list.If nobody hears from me after Monday, send help!

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: September 07, 2014, 05:29:09 pm
content: Without access to a working system it will be very hard to figure much out, especially as sensors like this will probably have one or more funky analogue supply voltages.It is actually illegal for manufacturers to give out any technical info on ITAR controlled items.

author: madmaxbryan
author_rank: Contributor
timestamp: September 07, 2014, 08:40:01 pm
content: Quote from: mikeselectricstuff on September 07, 2014, 05:29:09 pmBeing just a sensor and not a complete working system, some company has to build the electronics to run it. How does that company go about getting the technical documents if its illegal?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: September 07, 2014, 09:06:11 pm
content: Quote from: madmaxbryan on September 07, 2014, 08:40:01 pmI don't know how it works in practice - in that situation there would be NDAs and probably also whatever registration/regulation that governs companies making ITAR-regulated stuff. The restriction is on making info publically available

author: madmaxbryan
author_rank: Contributor
timestamp: November 16, 2014, 10:37:31 pm
content: Well it only took a month to convince the government i was a citizen and not a terrorist, but i managed to get the datasheet and pinouts for the microbolometer. Now that i have the documentation i have run into a new problem. The sensor is 640X480, 30hz frame rate. Which means it needs a 12.5MHz clock and around 15.734kHz line clock. The 12.5MHz is beyond the capabilities of my signal gen. Does anyone have a recommendation for producing all these signals? I've never worked with CPLD's or FPGA's, but would it be easiest to have one output all three clocks or is there a better solution short of buying a new sig gen?

author: marshallh
author_rank: Unknown
timestamp: November 16, 2014, 10:40:41 pm
content: an FPGA + sdram would be ideal for this.Pick up a DE0-nano board, or if you want to spend more money, you can do that also.

author: madmaxbryan
author_rank: Contributor
timestamp: November 16, 2014, 11:28:15 pm
content: I kinda figured and FPGA was the ideal way to go, guess this project is on hold now while i want for a DE0-nano to come in the mail, then i have to learn how to program and FPGA. Thanks marshallh!

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 17, 2014, 10:11:21 am
content: A microcontroller that has a camera interface may be another option

author: Alexei.Polkhanov
author_rank: Frequent Contributor
timestamp: November 19, 2014, 07:46:33 am
content: I just got an idea!What if we create a website like Kickstarter where people can donate money to get something professionally re-engineered and publicly documented. I am sure there are plenty of good labs that can do pretty good job at reverse engineering something like this.

author: sswcharlie1
author_rank: Newbie
timestamp: July 01, 2019, 07:17:58 am
content: Hi AlexeiDid anything happen in getting your Kickstarter idea going.ThanksCharles Harris