Flir E4 E5 E6 E8 -any, unbrick repair. NEED Flash dump! - Page 1
Forum section: electronics / repair

author: smaultre
author_rank: Regular Contributor
timestamp: January 07, 2024, 01:26:33 am
content: Hey guys, I bought it on eBay with my fortune. And it didn't workI received a flooded motherboard and some less damaged peripherals. After washing in alcoholThe board is in good condition, the tracks were not damaged.But the 3V battery on the board was completely dead.When I connect it to a Windows 10 PC, i see a new "SE Blank SENNA" device with the impossibility of installing drivers.The board loads take~50,2 seconds. This can be seen from the change in current consumption. After 2-3 minutes, looks like the board goes into reboot cycle (when USB powered).Using an oscilloscope, I see that the RTC and MCIMX257https://www.nxp.com/docs/en/reference-manual/IMX25RM.pdfare working, and there are attempts to boot from the bootloader IC TC58BVG1S3HTA00https://www.mouser.com/datasheet/2/1034/tosc_s_a0007398910_1-2295726.pdfBut Altera Cyclone IV,1Gb DDR RAM W94AD6KBhttps://www.winbond.com/resource-files/w94adxkb_datasheet_pkg_a01-005_20141002.pdfand his DDR RAM IC IS43LR32800G-6BLhttps://www.issi.com/WW/pdf/43-46LR32800G.pdfremain without power.Who knows the POST procedure for it? boot up procedure?There is DA9021https://pdf1.alldatasheet.com/datasheet-pdf/download/1010316/DIALOG/DA9021.htmlSystem PMIC with high efficiency USB power managerGeneral description from PDF:The DA9021 is a highly integrated PMIC subsystem with supply domains to support a widerange of application processors, associated peripherals, and user interface functions. Combining aswitched-mode USB compatible charger, full power-path management, three bucks, five linearregulators and support for multiple sleep modes..Some secondary power line's of it is 0V, like a VDD MEM line??How can i check bootloader IC content? MCIMX257 make only two short attempts to access for it.

author: RoGeorge
author_rank: Super Contributor
timestamp: January 07, 2024, 12:47:49 pm
content: Bricked means no software response whatsoever. Since the PC can read an ID from the USB, it means the PC engaged a conversation with your board, and the board was able to listen and reply with a name. It means the firmware of your board is OK, and most probably fully functional.The board is not bricked, so it doesn't require any flush dump or any unbrick.What for did you buy it, or what do you expect that board to do, yet it doesn't?

author: smaultre
author_rank: Regular Contributor
timestamp: January 07, 2024, 08:58:35 pm
content: New investigation shows that it was not "loading".It starting to read the bootloader chip, but then some of the data lines "stucks" on high level.It looks like a corrupted data or bad flash IC.And "SE Blank SENNA" device is the native ID of MCIMX257 CPU to access to its flash.I need a full dump of the bootloader IC TC58BVG1S3HTA00 (my module is "new" with gray plastic frame)!

author: fzabkar
author_rank: Super Contributor
timestamp: January 07, 2024, 09:35:47 pm
content: If none of the RAMs are powered, then how does the boot process even get started? I would have thought that the kernel code inside the main MCU would unpack the flash code into RAM before transferring control to it.Are you sure that the third buck converter in the Dialogic PMIC is not shorted to ground?

author: smaultre
author_rank: Regular Contributor
timestamp: January 07, 2024, 11:03:14 pm
content: BTW updated connector pinoutStarting from end nearest to the unpopulated FFC connector1 On/Off switch (to ground)2 Power - Vbattery during run and charge - possibly via a FET switch as I didn't see continuity to bat terminal3 Console TXD always high4 Console RXD always high5 Debug TXD always high6 Debug RXD always high7 0V8 /Reset9 Output10 Input11 Output12 Input13 Input14 I2C SDA15 I2C SCL16 0VPins 10-13 look like they may be build option resistors - two have 10K to +3.3v, two have 1K to ground.I add some info from the data lines of bootloader IC.Some lines goes stuck to high levels add initial boot process stuck too.Or maybe data in flash ic or ic itself is corrupt.The third buck converter in the Dialogic PMIC have ~ 580 Ohm to ground

author: smaultre
author_rank: Regular Contributor
timestamp: January 07, 2024, 11:58:04 pm
content: I found an update firmware files flir_ex_pn639_v3.16.0_update_pack , but i didn't know how to move it to the flash.1st picture file structure on the .fif fileAnd maybe .bin file, with start address to flash it in to??2nd picture contains and address ??3rd picture FPGA.bin to start "picture processing"load after POST and start to logging over serial diagnostics port (mine serial does not even start).

author: smaultre
author_rank: Regular Contributor
timestamp: January 08, 2024, 12:06:24 am
content: Quote from: fzabkar on January 07, 2024, 09:35:47 pmI think the load process goes in that way:cpu read bootloader taking control of perihelial devices (volt regulator maybe)make some kind of POST ?,than start to log on serial, boots OS, programming FPGA ? e.t.c.We need a working -one device to measure the Voltage from Dialogic PMIC,does they appears at the same time?

author: indeterminate
author_rank: Regular Contributor
timestamp: January 08, 2024, 02:13:17 am
content: It is far more likely that there is sum gunk under a BGA that is stuffing things up.Lookup the voltage requirements for the CPU, RAM, Flash and make shore all the required rails are active.connect the battery up , it wouldn't be the first device that i have seen that will not boot without a charged battery.

author: smaultre
author_rank: Regular Contributor
timestamp: January 08, 2024, 05:45:50 am
content: Quote from: indeterminate on January 08, 2024, 02:13:17 amTrying with charged battery -with no success.On my first post, the second picture has Dialog DA9021 power manager with at least one abnormal power line coil on corner marked "0??" But how this dialog is configured here, i don't know maybe this voltage line need to be programmed via CPU with data from the boot flash?And what is VDD_A on the datasheet?Prior to de-solder flash chip, i need to know is there a time lag.Between the green and yellow points, on the working device.

author: smaultre
author_rank: Regular Contributor
timestamp: January 09, 2024, 11:18:15 pm
content: I read the flash itworks, and contains some information.I didn't know thatdata isok.I need at least the boot block part (first ~1-2Mb) from the working-one to compare.And when i test the board datalines without Flash IC, some of them goes on high "1" state.But them seems to be ok by the resistance tests.It is normal?Additional while trying to re-program the flash 5 bad blocks are found, the first-one is #170

author: smaultre
author_rank: Regular Contributor
timestamp: January 15, 2024, 07:59:43 am
content: The new flash chip is arrived ! I need working dump! Please!

author: uuksik
author_rank: Newbie
timestamp: January 22, 2024, 12:44:28 am
content: I have E4 1.22.0, Could you assist me, how to get Flash dump.

author: smaultre
author_rank: Regular Contributor
timestamp: January 25, 2024, 10:28:38 pm
content: Hello you need to de-solder the flash IC and make a dump via programmer. If you ask "how?", i understand that you don't have such ability.

author: Bud
author_rank: Super Contributor
timestamp: January 26, 2024, 01:40:04 am
content: I think you should have investigated the no power issue. If the device was flooded chances are power lines may be damaged.Regarding the boot chip, i briefly looked at the CPU manual and it mentions a recommendation for NAND type of boot memory to have two copies of boot code in block0 and block1. What you can do is get the block size from the boot IC datasheet and check the data dump you made to compare the content of those two blocks if they are identical. Even if both have corrupt cells you may work something out of two copies and construct a good one, since you also know which cells are bad in each copy.

author: smaultre
author_rank: Regular Contributor
timestamp: January 27, 2024, 11:43:21 pm
content: Quote from: Bud on January 26, 2024, 01:40:04 amThe board looks good and cleaned perfectly. The resistance of DDR memory power lines, ~500 Ohm looks acceptable (not shorted).I haven't soldering station to re-solder and check BGA chips, like a power IC or DDR memory chip's.I trying to make things, that i can make right now.That's why i ask for a flash IC memory dump, this chip was a most flooded.I think if this device can't complete booting stage, it has corrupted whole Block0 and Block1 boot areas.

author: Bud
author_rank: Super Contributor
timestamp: January 28, 2024, 12:29:15 am
content: The first thing boot code does after being read is initialize the DDR, next thing it does is initialize the FPGA, before loading the kernel, so DDR and FPGA have to be powered on at boot stage.

author: smaultre
author_rank: Regular Contributor
timestamp: January 28, 2024, 01:05:29 am
content: In the power supervisor IC datasheet says, that it need to be configured by processor. Maybe config data stored on the Flash IC and was corrupted?

author: Bud
author_rank: Super Contributor
timestamp: January 28, 2024, 03:20:31 pm
content: Before unsoldering the boot flash- did you capture the output of the debug serial console?

author: smaultre
author_rank: Regular Contributor
timestamp: January 29, 2024, 06:51:37 am
content: There's nothing on the console, i can't get DDR memory to be powered. Boot-up process stuck after several bites was read-out from flash.

author: Bud
author_rank: Super Contributor
timestamp: January 29, 2024, 06:33:35 pm
content: The imx25 reference manual gives a command that can be sent over serial USB to read the status code for failed boot. A table of status codes should be in the manual somewhere. It will return a specific status code if the boot failed due to signature verification or corrupted boot code.