Flir E4 Thermal imaging camera teardown - Page 1
Forum section: electronics / general

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 13, 2013, 09:18:10 am
content: TL;DR :26 Dec 2016Updated method for firmware V2.11( no need to downgrade to 2.3)10 Jan 2016 There is a new firmware, V2.8, which needs to be downgraded to 2.3 for the hack to work. Instructions inThis post30 Mar 2015Link to step-by-step guide for 2.3 firmware12th Jan 2015Link to hack instructions for 2.3 firmware24th Oct 2014It appears that V2.3 firmware has now been successfully hacked, but only for increased resolution - seeThis postand the few that follow for more details.13th July 2014New units are shipping with firmware V2.3, which appears to have an encrypted config file. Details of how this version it affects hackability are not yet established - check the end of the thread for updates.(An earlier version, 2.1 appeared briefly but was reported to have connectivity issues.)One userhas reported that an old unit sent back for repair was upgraded to 2.3 during repair, but was still hackable afterwards. See follow-ups to this post for more info.1.2x has countermeasures against the original hack, however 1.21 and 1.22 have now been successfully hacked.This post will be updated with any important developments, howeveralwayscheck the end of the thread for latest infonewbie Q&A thread- please post questions about implementing existing hacks there and not in this threadMarphy's TIConfig utility for one-click upgrade of all current firmware versions1.21/1.22 firmware hack infoDaveWB's video tutorials for old and new firmware versionsLink to old firmware hack info for all 1.19.x versions bLink to Taucher's menu hacks (Beta - for advanced users)These enable extra features not even available on the E8 like manual temperature mode, additional pallettes and measure modes, and digital zoom.check the end of the thread for any very recent updates.Info on hacking E30 to E60Link to Nersut's detailed guide to hacking the i seriesLink to older i3 hack infoTomas123's links on post- processing and measurements using E4 imagesJolly's raspberry Pi E4 video recorderLinks to useful files and documents :Aurora's Useful information thread, including log of versions and serial numbersFlir Toolshttp://www.flir.com/thermography/americas/us/view/?id=54865Direct (non-registration required) link to Flir RNDIS driverhttp://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exeTech notes documenting network modes using RNDIShttp://www.imc-store.com.au/v/vspfiles/assets/images/flir%20a310%20technical%20notes.pdfInfo on console commands etc.http://support.flir.com/DocDownload/Assets/75/English/T559504$A.pdfThere is lots of other useful info in this thread so well worth a read.Yes, it has a 320x240 60fps sensor - same as the £4700 E8 model and even more expensive Ex0 series

author: mrflibble
author_rank: Super Contributor
timestamp: October 13, 2013, 09:24:14 am
content: Perfect timing sir!I just got me some tea + fresh banana bread!*watches*

author: Fraser
author_rank: Super Contributor
timestamp: October 13, 2013, 09:51:35 am
content: Thanks Mike,Something interesting to watch on a Sunday morning, rather than 'Sunday Brunch' on Channel 4 !FraserUPDATE:I have posted a UK supplier recommendation herehttps://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg328110/#msg328110Message #1109The company is willing to offer a discount to EEVBlog members.UPDATE:I have created an E4 'Useful information' thread here:https://www.eevblog.com/forum/reviews/flir-e4-the-useful-information-thread/

author: niflheimer
author_rank: Contributor
timestamp: October 13, 2013, 10:14:49 am
content: Just watched it - impressive how they've managed to reduce both the BOM and the cost of the sensor. I wouldn't be surprised if the only things different on the other models are the add-on boards for wifi/BT and a slightly different firmware and caps table.The X-ray is new though - film type ?

author: M. András
author_rank: Super Contributor
timestamp: October 13, 2013, 10:52:51 am
content: another software locked hardware i seewonder what it actually cost to sell the same thing for cheaper than the advanced optioned ones

author: Fraser
author_rank: Super Contributor
timestamp: October 13, 2013, 11:04:35 am
content: Mike,Another excellent video. thank you. I have commented in the other thread but I noted the 2009 micro-bolometer date. The FLIR TAU engine is looking like a more likely candidate than ever. It's relatively old, so development costs have likely been recovered, and this is just stripping it back to basics for usage in consumer grade products. Sadly I cannot find any internal pictures of the TAU.

author: Hypernova
author_rank: Unknown
timestamp: October 13, 2013, 11:23:31 am
content: Oh man, imagine if we can change the limitation just by rewriting the EEPROM!

author: amyk
author_rank: Super Contributor
timestamp: October 13, 2013, 12:14:39 pm
content: Excellent video!I would've pulled on the various different-coloured parts of the "snout" first before putting more force into the button. The x-ray didn't reveal those screws behind the snout?At 30:08 you can see Mg marked on the frame so it very clearly is magnesium. The exposed bond wires were unexpected and disturbingly fragile; I'm a little surprised they didn't encapsulate them with epoxy like a COB, although that might have something to do with the thermal requirements.The CPU has an Ethernet interface - maybe it's broken out on one of the pads.

author: Unknown
author_rank: Unknown
timestamp: October 13, 2013, 02:11:19 pm
content: Mike commented on this the first time he discussed the PCB.

author: mrflibble
author_rank: Super Contributor
timestamp: October 13, 2013, 02:14:17 pm
content: Quote from: StevenWhitney on October 13, 2013, 01:24:47 pmThermal sensor.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 13, 2013, 03:38:46 pm
content: Quote from: Aurora on October 13, 2013, 11:04:35 amI'd love to know how much the cheapest Tau costs - could be some scope for hacking there - chances are it has the same datastream inside

author: mos6502
author_rank: Frequent Contributor
timestamp: October 13, 2013, 10:47:18 pm
content: The Tau 640 is around 10k ... maybe you can interpolate from that.Problem with the Tau is that they fall under the ITAR regluations ... dunno if they even talk to you unless you're an international corporation.BTW, excellent videos Mike. I love 'em.

author: zapta
author_rank: Super Contributor
timestamp: October 13, 2013, 10:47:44 pm
content: Dave, have you considered to include great teardown videos like this one in your official eevblog?You can have a short introduction and summary as a host and have the guest's contributed video in between.

author: Noize
author_rank: Regular Contributor
timestamp: October 13, 2013, 11:10:25 pm
content: Is the x-ray machine from the luggage scanner that you had? I thought that you had sold it? Love to have one of those!

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 13, 2013, 11:12:12 pm
content: Quote from: Noize on October 13, 2013, 11:10:25 pmNo it's a mailroom x-ray I picked up a while ago. Have shot half a teardown but not got round to finishing

author: Hypernova
author_rank: Unknown
timestamp: October 14, 2013, 07:11:21 am
content: Maybe someone who know more about this can chime in but doesn't exposing the die present a major failure point from corrosion?

author: Stonent
author_rank: Super Contributor
timestamp: October 14, 2013, 08:10:49 am
content: Quote from: mikeselectricstuff on October 13, 2013, 11:12:12 pmI had just figured you scrapped as much of the metal as you could and condensed the unit, but now that I think about it, the luggage xray was made to be in motion and this one was still.

author: l3iggs
author_rank: Newbie
timestamp: October 14, 2013, 04:25:42 pm
content: Hey Mike, thanks for taking the time to put together a very interesting tear down. Have you attempted to coax the data stream out of the sensor module without the main board attached?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 14, 2013, 05:09:30 pm
content: Quote from: l3iggs on October 14, 2013, 04:25:42 pmNo but may look at some point -My guess is FPGA could be generating some of the timing signals. Will probably need to make a riser adapter to get at the pins though - need to see if I can ID and obtain the board-board connectors.

author: firewalker
author_rank: Super Contributor
timestamp: October 14, 2013, 08:06:53 pm
content: X-raing the sensor could reveal something?Alexander.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 14, 2013, 08:08:39 pm
content: Quote from: firewalker on October 14, 2013, 08:06:53 pmYes but unfortunately my x-ray doesn't have the resolution.

author: Stonent
author_rank: Super Contributor
timestamp: October 15, 2013, 07:23:25 am
content: Quote from: mikeselectricstuff on October 14, 2013, 08:08:39 pmIt would be interesting to xray it while it was on and capture the video from the flir.

author: algorath
author_rank: Contributor
timestamp: October 15, 2013, 01:36:27 pm
content: great video as always. and yes, your trigger torturing really did hurt hehe

author: tesla500
author_rank: Regular Contributor
timestamp: October 15, 2013, 05:16:26 pm
content: Can you try using another thermal camera to look through the top window of the E4's sensor?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 15, 2013, 05:18:15 pm
content: Quote from: tesla500 on October 15, 2013, 05:16:26 pmI did try but close-focus on my other TIC isn't good enough to see anything