Flir Lepton reverse-engineering
Info on using the Flir Lepton thermal image sensor used in the Flir One Iphone add-on.
See videos for more info
30 Aug 2014 Initial version
5 Sep 2014 misc links added
Misc resources
24 pin socket to make into 32 pin Molex 47337-0001 RS (UK) Mouser
Digikey
32 pin socket Molex (105028-1001 Drawing ) Mouser
Digikey
Flir patents US20130329054 WO2012170946 US20130258111 US20140139685
Flir Lepton product page
Some dumps of I2C activity
Info from IR-Scout project by students at UC Santa Barbara :
IR-Scout
poster Presentation
user
manual
Confirms the pinouts I found, interestingly they don't appear to use I2C
Pureengineering Lepton page
- Arduino and RasPi code, breakout boards, module group-buy
Note I have a suspiction that the Lepton modules in the Flir one have different firmware
than the one use for the examples on this page, as many of the I2C commands don't appear
to behave the same
Pinouts
| 1 |
0V |
|
| 2 |
GPIO3 |
Input - suggest 10K pulldown |
| 3 |
GPIO2 |
Input- suggest 10K pulldown |
| 4 |
GPIO1 |
Outputs high, pulses low for 27uS, 850mS after reset |
| 5 |
GPIO0 |
Input- suggest 10K pulldown |
| 6 |
0V |
|
| 7 |
+1.2V supply |
80mA current draw |
| 8 |
0V |
|
| 9 |
0V |
|
| 10 |
0V |
|
| 11 |
SPI Din |
Appears unused, can be tied low. |
| 12 |
SPI Dout |
|
| 13 |
SPI Clock |
Driven at 16MHz on Flir One. Seems happy at 24MHz
Data is output after the falling edge, to be clocked in on the rising edge |
| 14 |
SPI /Chip Select |
|
| 15 |
0V |
|
| 16 |
IO supply 2.5-3.1v |
2.5mA current draw |
| 17 |
No connect |
Not connected on Flir One. Looks like an output. |
| 18 |
0V |
|
| 19 |
+2.8V supply |
13.6mA current draw. Doesn't seem to be too sensitive to noise - appears
happy to share with digital 2.8v stuff. |
| 20 |
0V |
|
| 21 |
I2C SCL |
Device address 0x54 write 0x55 read |
| 22 |
I2C SDA |
|
| 23 |
/Powerdown |
Device powers down when low, needs reset to recover |
| 24 |
/Reset |
Active low |
| 25 |
0V |
|
| 26 |
25MHz clock input |
Vio level. Can be overclocked up to about 35MHz but current draw increases
significantly so could be risky! Can also be underclocked down to about 15MHz. |
| 27 |
0V |
|
| 28 |
MIPI CLKN |
Not connected on Flir One |
| 29 |
MIPI CLKP |
Not connected on Flir One |
| 30 |
0V |
|
| 31 |
MIPI DN |
Not connected on Flir One |
| 32 |
MIPI DP |
Not connected on Flir One |
Basic interfacing :
It is possible to get images out with no I2C setup. I2C is still under investigation
(see examples above from Pure Engineering).
Take reset low, then high (say 100uS)
Wait 950mS before doing anything else. This seems rather critical. I've been told that the
module needs a delay, with clock active, between powering up and reset going high.
Still testing to establish figures. It may also be necessary/helpful to have a delay
between /CS going low and the first clock.
Read 164 bytes from SPI. It is essential to read exactly 164
(decimal) bytes!
If bits 0-3 of first byte are clear, it's an image packet, otherwise it's a status
packet
Sample image packet, line 4 (note 32 bit SPI transfers - can be 8 or 16) . Gaps in SPI
clock are due to host DMA activity - not relevant to protocol
| Image data packet format |
| Offset |
|
|
| 0 |
X0 |
X is often, but not always zero |
| 1 |
Line |
0x00-0x3B line number, always sent in sequence, so can be ignored |
| 2 |
CRC |
CRC format not known, but can be ignored |
| 3 |
CRC |
|
| 4 |
|
First Pixel MSbyte (14 bit value) |
| 5 |
|
First Pixel LSByte |
| |
|
|
| 163 (dec) |
|
Last pixel LSbyte |
Sample status packet
| Status packet format |
| Offset |
|
|
| 0 |
xF |
|
| 1 |
FF FF FF |
|
| 4 |
DC D0 DC AD DC D2 DC AD DC D4 DC AD DC D6 |
Can be used to detect loss of sync |
| 0x14 |
00 00 00 00 00 00 00 00 00 |
|
| 0x1D |
11 bytes of status info - some counts etc. meaning unknown |
|
| 0x27-end |
00 |
|
Depending on timing between reset and first SPI access, packet contents will be out of
sync. If bytes 4-7 of a status packet are not DC D0 DC AD, wait ~200mS before any further
SPI access. This will generally get you back in sync. Once in sync it will stay there
forever.
It is important to read all 164 bytes in a packet, and also to read the whole frame in
less than 32mS.
Frames occur every 38.4mS, but the image only changes every third frame
Pixel data is 14 bit, with some automatic flat-field correction. Room temperature is
around 0x2000.
FlirOne Linux boot text
RomBOOT
RomBOOT
Start AT91Bootstrap version svn-r5279 ...
Init FULL drive strength DDR... BOARD_ConfigureDdram()
DDRSDRC->DDRSDRC_LPR: 0x12001
SW_WAKE = 0x0, SW_CAL = 0x1, mode = 0x1
Done!
Downloading image...
Trying to load uboot...
nandflash_hw_init()
reset_nandflash()
AT91F_NandReadID()
ManufacturerID: 0x2c DeviceID: 0xa1
chip id: 0x2ca1
Copy 0x50000 bytes from 0x40000 to 0x23f00000
nandflash_cfg_8bits_dbw_init()
switch(sNandInfo.uDataNbBytes) 2048:
read_nandflash: while (1)
read_nandflash: while (1)
read_nandflash: while (1)
read_nandflash(): return 0;
Done!
Returning jump to 0x0x23f00000
U-Boot 2010.06-svn5279 (Jul 11 2014 - 19:36:45)
DRAM: 64 MiB
NAND: nand->ecc.bytes 28
nand->ecc.steps 1
nand->ecc.layout = pmecc_oobinfo_2048
host->mm 13
host->nn 8191
host->tt 4
host->sector_size 512
host->sector_number 4
host->ecc_bytes_per_sector 7
host->alpha_to 0x10C000
host->index_of 0x108000
128 MiB
*** Warning - bad CRC or NAND, using default environment
In: serial
Out: serial
Err: serial
Net: macb0, macb1
macb0: No PHY present
macb1: No PHY present
Watchdog enabled.
Hit CTRL-C to stop autoboot: 0
Data (writethrough) Cache is ON
boot operational
Loading from nand0, offset 0xe00000
Image Name: Linux-2.6.39+
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 5732476 Bytes = 5.5 MiB
Load Address: 20008000
Entry Point: 20008000
Bit flip in data area, byte_pos: 1031, bit_pos: 5, 0x3b -> 0x1b
Automatic boot of image at addr 0x22000000 ...
## Booting kernel from Legacy Image at 22000000 ...
Image Name: Linux-2.6.39+
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 5732476 Bytes = 5.5 MiB
Load Address: 20008000
Entry Point: 20008000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
[ 0.090000] AT91: CM rev B and higher
[ 0.100000] AT91: EK rev B and higher
load ehci module
done
mknod: /dev/null: File exists
Populating /dev using udev: done
Starting watchdog...done
mounting jffs2 READ-ONLY...done
start battery charge control
Starting battery_charge: OK
done
Initializing random number generator... read-only file system detected...done
Formatting /tmp/versions: OK
Starting network...
Starting dropbear sshd: OK
[ 2.360000] lepton_init
[ 2.360000] lepton_init_cdev()
[ 2.370000] cdev_add() succeeded: 0
[ 2.370000] lepton_probe
[ 2.370000] lepton.ko: init rx_buf.
[ 2.380000] lepton.ko: init tx_buf.
Welcome to Rosebud (Operational)
AT91SAM9 login:
Welcome to Rosebud (Operational)
AT91SAM9 login: RomOT
Start AT91Bootstrap version svn-r5279 ...
Password:
DDRSDRC>DDRSDRC_LPR: 0x12001
SW_WAKE = 0, SW_CAL = 0x1, mode = 0x1
Done!
Downloading image.
Trying to load uboot...
nandflash_hw_init()
reset_nandflash()
AT91F_NandReadID()
ManufacturerID: 0x2c DeviceID: 0xa1
hip id: 0x2ca1
Coy 0x50000 bytes from 0x40000 to 0x23f00000
nandsh_cfg_8bits_dbw_init()
switch(sNandIo.uDataNbBytes) 2048:
read_nandflash: ile (1)
read_nandflash: while1)
read_nandflash: while (1)
read_nandflash(): return 0;
Done!
Returning jump to 0x0x23f00000
U-Bt 2010.06-svn5279 (Jul 11 2014 - 19:36:45)
DRAM: 64 MiB
NAND: nand->ecc.bs 28
nand->ecc.steps 1
nand->ecc.layout = pmecc_binfo_2048
host->mm 13
host->nn 8191
host->tt 4
host->sector_size 512
ht->sector_number 4
host->_bytes_per_sector 7
host->alphto 0x10C000
host->index_of 108000
128 MiB
*** Warning - bad CRC oNAND, using default environment
In: serial
Out: serial
Err: serial
Net: macb0, macb1
mab0: No PHY present
macb1: PHY present
Watchdog enaed.
Hit CTRL-C to s autoboot: 0
Data (writethrough) che is ON
boot operational
Loading from nand0, offset 0xe000
Image Name: Linux-2.6.39+
Image Type: ARM Linux Kernel Image (uompressed)
Data Size: 573247Bytes = 5.5 MiB
Load Address: 20008000
Entry nt: 20008000
Bit flip in ta area, byte_pos: 1031, bit_pos: 5, 0x3b ->x1b
Automatic boot of image addr 0x22000000 ...
## Booting kernel from Legacymage at 22000000 ...
Image Name: Linux-2.6.39+
Image Type: ARM Linux Keel Image (uncompressed)
Data Se: 5732476 Bytes = 5.5 MiB
Load Address: 20008000
Entry Point: 20008000
Verifying Checksum ... OK
Lding Kernel Image ... OK
OK
Starting kernel ..
Uncompressing Linux... donbooting the kernel.
[ 0.090000] AT91: rev B and higher
[ 0.100000] AT91: EK rev B and higher
load ehci modul
done
nod: /dev/null: File exists
Populag /dev using udev: done
Starting watchdog...done
mounting jffs2 D-ONLY...done
start battery chrge control
Starting battery_chargeK
done
Initializing random number generor... read-only file system detected...done
Formatting /tmp/versions: OK
Starting twork...
tarting dropbear sshd: OK
[ 2.360000] lepton_init
[ 2.3000] lepton_init_cdev()
[ 2.37000] cdev_add() succeeded: 0
[ 2.370000] len_probe
[ 2.370000] leptoko: init rx_buf.
[ 2.380000] lepton.ko:it tx_buf.
Welcome to Rosebud (Operational)
AT91SAM9 login:Login incorrect
AT91SAM9 login:
|
