Snagging CVBS out of an ex-fire service core - Page 1
Forum section: electronics / general

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: June 06, 2019, 05:29:40 pm
content: I recently acquired two Scott thermal cameras for under a hundred each, knowing they used a 320*240 30hz core inside. Did not want to keep them in the fire housings, so quick disassembly showed it was an older not quite as recent core, appears to be a BAE MicroIR core, though lacking the documentation and model number. I thought I'd have to tap the RGB parallel output to the display via FPGA but taking a quick look on the main board showed a Conexant chip, which tapping the CVBS pins resulted in a nice output without needing too many mods. Still need to figure out how to get rid of needing the LEMO connectors to the battery board and supply system there.

author: Bill W
author_rank: Super Contributor
timestamp: June 07, 2019, 12:30:13 pm
content: That is a Lockheed / BAe 200 or 205.Used on a few Argus3's which used this core. I can therefore reverse engineer the Argus3 and say:Video out on the 80 way connector pin 75, ground on pin 74.Power is the 20 way, a Harwin M80, which was presented as 'battery' and a switch control. A direct power in was deemed 'factory use only' - to me it implies unprotected and unfiltered.Pinout1/2/3 battery +4/5/6 battery -17 / 19 the switch.My test lead has red on pin 1, black on pin 5 and then pins 17 & 19 joined, the core then simply turns on.It is a bit annoying that despite the 20 way presenting a 5V out for a display, you had to connect to the 80 way just to get analogue video out. Less of an issue in Argus3 as we were after the digital video and other controls.Bill

author: Wendy_Preston
author_rank: Contributor
timestamp: June 14, 2019, 08:23:02 am
content: Probably completely unnecessary for what you are trying to achieve, but the Harwin M80 connectors are most likely these, from what I can see in the image:-M80-8882005(if 24 to 28AWG) orM80-8892005(if 22AWG) for the female cable connector;-M80-8512042for the male PCB horizontal connector.We do sell a tool, Z80-299, that will help ease apart the latches on the male connector without breaking them. But if you want to do it by hand, just try not to bend the latches any further than absolutely necessary to extract the female connector. Overbending will weaken the latches and break them.If you do break the latches, we sell spare ones, part numberM80-001, but they are tricky to get the broken one off and the new one on - they were never designed with replacement in mindCan't help on the rest of the unit I'm afraid, but feel free to contact me if you need anything mroe on the Harwin connector.

author: oddbondboris
author_rank: Contributor
timestamp: June 15, 2019, 07:25:36 pm
content: Do you happen to have any docs on this core specifically pinouts of the 80 way or any interface docs? i also bought one of these cameras probably from the same lot of ex washington dc fire cameras and was wondering what i could get out of it besides analog video.

author: Bill W
author_rank: Super Contributor
timestamp: June 16, 2019, 07:35:26 pm
content: The BAe / Lockeed documentation for the 200 was confidential and probably meant to be US EAR controlled.Best of luck finding it - I think even Fraser has not found it 'in the wild'.The internal interfaces of an Argus3 however were released by EEV/E2V and are not UK/Wassenaar controlled.There is 10 bit digital data (corrected image) there for a start, I'd have to look up what timings go with it.Bill

author: oddbondboris
author_rank: Contributor
timestamp: June 18, 2019, 08:13:49 pm
content: yeah i was more just wondering if you had a diagram of some camera using this core. this is definitely dual use tech proven in the field and i'd be surprised to find full docs for it.seems like what i need is an argus3 schematic i'll go looking, that is unless you have a linkeither way, thanks

author: oddbondboris
author_rank: Contributor
timestamp: June 19, 2019, 01:54:55 pm
content: did some more work on this, if you just want cvbs out of the entire camera as shown, j2 on the battery pcb has composite video buffered on the pins for the white wire + and the green wire returnbasically find the maxim video amplifiers that are used as video buffers and splitters and trace the signaltheres one on the interconnect board and one on the battery board in both cases video in goes to in+ on both channels, and the circuit is exactly as in the datasheet.video can be grabbed in the camera:Code:80pin-> interface board -> max buffer --> camera to handle connector -> battery board -> max buffer --> some chip -> programming connector?\_fpc connector \_ p2 -> transmittertheres one other place i haven't traced out on the battery board, probably the programming connector in the handle but it goes into some chip i havent had time to id, probably a protection chip or another bufferalso the display is not digital at all it' only uses the cvbs input as far as i can tell.it definitely doesn't have an interface for digital video

author: oddbondboris
author_rank: Contributor
timestamp: June 21, 2019, 12:49:13 pm
content: more fun in the world of the scott eagle imager II or fireflir 130cvbs buffered and tvs protected is present on the handle connector as is a power input directly connected to the battery connector.i'm pretty sure the handle connector also has a rs232 interface on it will have to test today at work.the rs422 interface from the camera to the interposer board is 9600 8n1 standard serial and can be intercepted at low voltage off the maxim level translator theres some startup diag info and commands sent back and forth to enable radiometry.as far as i can tell theres no easily sniffable command to trigger the shutter.next step is to dump the parallel flash on the camera board and go digging in the dsp code for commands

author: oddbondboris
author_rank: Contributor
timestamp: June 27, 2019, 06:09:31 pm
content: got flash dumped, it's probably not a great idea to post the dump hereit's pretty heavily byte swapped but from what i can see there should be a serial console like interfacenear the boot message i found some strings that look like command responsesCode:Uncooled MicroIR(R) Camera SIM-205 S/W P/N 21100869-604(C)Copyright BAE Systems 2001 ***Cmd UnknownNo of ArgsOut of RangeTimeout1 2 3------------------Coarse Pot:Fine Pot:Heat Comp:DetectBias:FineCounts:FineCenter:FPA Setup:Avg Coarse:Avg Gain:Subs: Yes NoAutoshutTWS ShutVideo PolXmtr ChanXmtr Nos.Pot Video2-ChannelWarm Shut Batt Life TEC Status VP Status Narrow Ovrd Coords Off TWS Coords RetAutoSave Weapon On Standby Event Log Ext Ovrheat Clip at 85F Centigrade Auto Iris Auto Plat White PixelClk PolClk FreqHorz FlipFOVSwitchGainw/FOVAlt BBox(unused)I-ShutterBatt on ADC7 Sys Monitor Industrial Auto-CenterOvrd Shutr 2 512 LUT CTI Number Clr Palette Special 0 Special 1 (unused) (unused) (unused) (unused) (unused) (unused): 0 : 1i'm pretty sure my camera has a dead peltier control circuit since whenever the camera attempts to use it the sensor goes into thermal runaway and overheatsalso found this block of commandsCode:00000000: 0000 0000 0000 0000 0000 0000 5f44 4154 4120 002f 015f 454e 4420 20 ............_DATA ./._END0000001b: 002f 0241 4543 2020 2000 8004 414c 4320 2020 0080 0541 534f 4646 20 ./.AEC ...ALC ...ASOFF00000036: 0080 b141 534f 4e20 2000 80f1 424c 4b48 4f54 0080 da43 4c52 4241 52 ...ASON ...BLKHOT...CLRBAR00000051: 0080 cb45 4d45 5220 2000 80fa 4741 494e 5447 0080 2047 4149 4e4f 4e ...EMER ...GAINTG.. GAINON0000006c: 0080 a047 4149 4e4f 4600 80e0 4842 4f46 4620 0080 9548 424f 4e20 20 ...GAINOF...HBOFF ...HBON00000087: 0080 d548 424f 544d 2000 801f 4842 4f54 5020 0080 1e48 4254 4f47 20 ...HBOTM ...HBOTP ...HBTOG000000a2: 0080 1548 4c45 4654 4d00 8007 484c 4546 5450 0080 0648 5249 5445 4d ...HLEFTM...HLEFTP...HRITEM000000bd: 0080 0f48 5249 5445 5000 800e 4854 4f50 4d20 0080 1748 544f 5050 20 ...HRITEP...HTOPM ...HTOPP000000d8: 0080 164d 4c43 5020 2000 8009 4d4c 434d 2020 0a ...MLCP ...MLCM .

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: June 28, 2019, 12:53:19 am
content: >Weapon onHmmmm that's an interesting flag

author: Fraser
author_rank: Super Contributor
timestamp: June 28, 2019, 08:57:42 am
content: The BAE cores were designed for use in Military systems, including weapon sights and thermal guidance on missilesFraser

author: oddbondboris
author_rank: Contributor
timestamp: June 28, 2019, 02:41:01 pm
content: Quote from: Fraser on June 28, 2019, 08:57:42 amyeah thats pretty much why i'm not gonna post this firmware dump in public.these things are still very much useful for that purpose as a super cheap (relatively) imager to toss on any number of systems that could benefit from high framerate 320x240 imaging.

author: angelortega
author_rank: Contributor
timestamp: July 04, 2019, 01:36:49 am
content: i have the same camera in your pictures, i got out of a scott eagle imager 2 .you show what pins to apply power to but you didnt say what voltage and how much amperage to use.can you add some close up pictures of where you taped in the composite video and the power wires so i can do the samething on mine.thank you

author: oddbondboris
author_rank: Contributor
timestamp: July 04, 2019, 04:39:37 pm
content: Quote from: angelortega on July 04, 2019, 01:36:49 amdo you want to use it bare or with some or all of the boards still connected,i personally use all the boards and input power on the battery contacts since there's a lot of protection circuitry on that board.at the contacts you basically emulate a nimh 7.2v battery pack so 9v at max and ~7v minimumif you want to tap the video on the battery board it's present on p2, just power up the camera and measure voltage, 2 of the pins are ground 1 is vcc to the transmitter one is video out.i'll see if i can get some pictures up tomorrow when i'm back in town

author: zxase258
author_rank: Contributor
timestamp: September 15, 2019, 05:43:02 am
content: Hello!I have a same detector that was disassembled from the BULLARD Fire Thermal Imager. Currently I have found a few control commands, dumped the firmware, and found the configuration information storage area in the firmware. But the camera has a verification mechanism. When I modify the firmware, it does not load the configuration. Instead, it starts with the default configuration and loses some functions.