Flir Lepton reverse-engineering Info on using the Flir Lepton thermal image sensor used in the Flir One Iphone add-on. See videos for more info 30 Aug 2014 Initial version

5 Sep 2014 misc links added Misc resources 24 pin socket to make into 32 pin Molex 47337-0001 RS (UK) Mouser Digikey

32 pin socket Molex (105028-1001 Drawing ) Mouser Digikey Flir patents US20130329054 WO2012170946 US20130258111 US20140139685 Flir Lepton product page Some dumps of I2C activity Info from IR-Scout project by students at UC Santa Barbara :

IR-Scout poster Presentation user manual

Confirms the pinouts I found, interestingly they don't appear to use I2C Pureengineering Lepton page - Arduino and RasPi code, breakout boards, module group-buy

Note I have a suspiction that the Lepton modules in the Flir one have different firmware than the one use for the examples on this page, as many of the I2C commands don't appear to behave the same Pinouts 1 0V 2 GPIO3 Input - suggest 10K pulldown 3 GPIO2 Input- suggest 10K pulldown 4 GPIO1 Outputs high, pulses low for 27uS, 850mS after reset 5 GPIO0 Input- suggest 10K pulldown 6 0V 7 +1.2V supply 80mA current draw 8 0V 9 0V 10 0V 11 SPI Din Appears unused, can be tied low. 12 SPI Dout 13 SPI Clock Driven at 16MHz on Flir One. Seems happy at 24MHz

Data is output after the falling edge, to be clocked in on the rising edge 14 SPI /Chip Select 15 0V 16 IO supply 2.5-3.1v 2.5mA current draw 17 No connect Not connected on Flir One. Looks like an output. 18 0V 19 +2.8V supply 13.6mA current draw. Doesn't seem to be too sensitive to noise - appears happy to share with digital 2.8v stuff. 20 0V 21 I2C SCL Device address 0x54 write 0x55 read 22 I2C SDA 23 /Powerdown Device powers down when low, needs reset to recover 24 /Reset Active low 25 0V 26 25MHz clock input Vio level. Can be overclocked up to about 35MHz but current draw increases significantly so could be risky! Can also be underclocked down to about 15MHz. 27 0V 28 MIPI CLKN Not connected on Flir One 29 MIPI CLKP Not connected on Flir One 30 0V 31 MIPI DN Not connected on Flir One 32 MIPI DP Not connected on Flir One Basic interfacing : It is possible to get images out with no I2C setup. I2C is still under investigation (see examples above from Pure Engineering). Take reset low, then high (say 100uS)

Wait 950mS before doing anything else. This seems rather critical. I've been told that the module needs a delay, with clock active, between powering up and reset going high. Still testing to establish figures. It may also be necessary/helpful to have a delay between /CS going low and the first clock.

Read 164 bytes from SPI. It is essential to read exactly 164 (decimal) bytes! If bits 0-3 of first byte are clear, it's an image packet, otherwise it's a status packet Sample image packet, line 4 (note 32 bit SPI transfers - can be 8 or 16) . Gaps in SPI clock are due to host DMA activity - not relevant to protocol Image data packet format Offset 0 X0 X is often, but not always zero 1 Line 0x00-0x3B line number, always sent in sequence, so can be ignored 2 CRC CRC format not known, but can be ignored 3 CRC 4 First Pixel MSbyte (14 bit value) 5 First Pixel LSByte 163 (dec) Last pixel LSbyte Sample status packet Status packet format Offset 0 xF 1 FF FF FF 4 DC D0 DC AD DC D2 DC AD DC D4 DC AD DC D6 Can be used to detect loss of sync 0x14 00 00 00 00 00 00 00 00 00 0x1D 11 bytes of status info - some counts etc. meaning unknown 0x27-end 00 Depending on timing between reset and first SPI access, packet contents will be out of sync. If bytes 4-7 of a status packet are not DC D0 DC AD, wait ~200mS before any further SPI access. This will generally get you back in sync. Once in sync it will stay there forever. It is important to read all 164 bytes in a packet, and also to read the whole frame in less than 32mS.

Frames occur every 38.4mS, but the image only changes every third frame Pixel data is 14 bit, with some automatic flat-field correction. Room temperature is around 0x2000. FlirOne Linux boot text RomBOOT

RomBOOT

Start AT91Bootstrap version svn-r5279 ...

Init FULL drive strength DDR... BOARD_ConfigureDdram()

DDRSDRC->DDRSDRC_LPR: 0x12001

SW_WAKE = 0x0, SW_CAL = 0x1, mode = 0x1

Done!

Downloading image...

Trying to load uboot...

nandflash_hw_init()

reset_nandflash()

AT91F_NandReadID()

ManufacturerID: 0x2c DeviceID: 0xa1

chip id: 0x2ca1

Copy 0x50000 bytes from 0x40000 to 0x23f00000

nandflash_cfg_8bits_dbw_init()

switch(sNandInfo.uDataNbBytes) 2048:

read_nandflash: while (1)

read_nandflash: while (1)

read_nandflash: while (1)

read_nandflash(): return 0;

Done!

Returning jump to 0x0x23f00000





U-Boot 2010.06-svn5279 (Jul 11 2014 - 19:36:45)



DRAM: 64 MiB

NAND: nand->ecc.bytes 28

nand->ecc.steps 1

nand->ecc.layout = pmecc_oobinfo_2048

host->mm 13

host->nn 8191

host->tt 4

host->sector_size 512

host->sector_number 4

host->ecc_bytes_per_sector 7

host->alpha_to 0x10C000

host->index_of 0x108000

128 MiB

*** Warning - bad CRC or NAND, using default environment



In: serial

Out: serial

Err: serial

Net: macb0, macb1

macb0: No PHY present

macb1: No PHY present

Watchdog enabled.

Hit CTRL-C to stop autoboot: 0

Data (writethrough) Cache is ON

boot operational



Loading from nand0, offset 0xe00000

Image Name: Linux-2.6.39+

Image Type: ARM Linux Kernel Image (uncompressed)

Data Size: 5732476 Bytes = 5.5 MiB

Load Address: 20008000

Entry Point: 20008000

Bit flip in data area, byte_pos: 1031, bit_pos: 5, 0x3b -> 0x1b

Automatic boot of image at addr 0x22000000 ...

## Booting kernel from Legacy Image at 22000000 ...

Image Name: Linux-2.6.39+

Image Type: ARM Linux Kernel Image (uncompressed)

Data Size: 5732476 Bytes = 5.5 MiB

Load Address: 20008000

Entry Point: 20008000

Verifying Checksum ... OK

Loading Kernel Image ... OK

OK



Starting kernel ...



Uncompressing Linux... done, booting the kernel.

[ 0.090000] AT91: CM rev B and higher

[ 0.100000] AT91: EK rev B and higher

load ehci module

done

mknod: /dev/null: File exists

Populating /dev using udev: done

Starting watchdog...done

mounting jffs2 READ-ONLY...done

start battery charge control

Starting battery_charge: OK

done

Initializing random number generator... read-only file system detected...done

Formatting /tmp/versions: OK

Starting network...

Starting dropbear sshd: OK

[ 2.360000] lepton_init

[ 2.360000] lepton_init_cdev()

[ 2.370000] cdev_add() succeeded: 0

[ 2.370000] lepton_probe

[ 2.370000] lepton.ko: init rx_buf.

[ 2.380000] lepton.ko: init tx_buf.



Welcome to Rosebud (Operational)

AT91SAM9 login:

Welcome to Rosebud (Operational)

AT91SAM9 login: RomOT

Start AT91Bootstrap version svn-r5279 ...

Password:

DDRSDRC>DDRSDRC_LPR: 0x12001

SW_WAKE = 0, SW_CAL = 0x1, mode = 0x1

Done!

Downloading image.

Trying to load uboot...

nandflash_hw_init()

reset_nandflash()

AT91F_NandReadID()

ManufacturerID: 0x2c DeviceID: 0xa1

hip id: 0x2ca1

Coy 0x50000 bytes from 0x40000 to 0x23f00000

nandsh_cfg_8bits_dbw_init()

switch(sNandIo.uDataNbBytes) 2048:

read_nandflash: ile (1)

read_nandflash: while1)

read_nandflash: while (1)

read_nandflash(): return 0;

Done!

Returning jump to 0x0x23f00000





U-Bt 2010.06-svn5279 (Jul 11 2014 - 19:36:45)



DRAM: 64 MiB

NAND: nand->ecc.bs 28

nand->ecc.steps 1

nand->ecc.layout = pmecc_binfo_2048

host->mm 13

host->nn 8191

host->tt 4

host->sector_size 512

ht->sector_number 4

host->_bytes_per_sector 7

host->alphto 0x10C000

host->index_of 108000

128 MiB

*** Warning - bad CRC oNAND, using default environment



In: serial

Out: serial

Err: serial

Net: macb0, macb1

mab0: No PHY present

macb1: PHY present

Watchdog enaed.

Hit CTRL-C to s autoboot: 0

Data (writethrough) che is ON

boot operational



Loading from nand0, offset 0xe000

Image Name: Linux-2.6.39+

Image Type: ARM Linux Kernel Image (uompressed)

Data Size: 573247Bytes = 5.5 MiB

Load Address: 20008000

Entry nt: 20008000

Bit flip in ta area, byte_pos: 1031, bit_pos: 5, 0x3b ->x1b

Automatic boot of image addr 0x22000000 ...

## Booting kernel from Legacymage at 22000000 ...

Image Name: Linux-2.6.39+

Image Type: ARM Linux Keel Image (uncompressed)

Data Se: 5732476 Bytes = 5.5 MiB

Load Address: 20008000

Entry Point: 20008000

Verifying Checksum ... OK

Lding Kernel Image ... OK

OK



Starting kernel ..



Uncompressing Linux... donbooting the kernel.

[ 0.090000] AT91: rev B and higher

[ 0.100000] AT91: EK rev B and higher

load ehci modul

done

nod: /dev/null: File exists

Populag /dev using udev: done

Starting watchdog...done

mounting jffs2 D-ONLY...done

start battery chrge control

Starting battery_chargeK

done

Initializing random number generor... read-only file system detected...done

Formatting /tmp/versions: OK

Starting twork...

tarting dropbear sshd: OK

[ 2.360000] lepton_init

[ 2.3000] lepton_init_cdev()

[ 2.37000] cdev_add() succeeded: 0

[ 2.370000] len_probe

[ 2.370000] leptoko: init rx_buf.

[ 2.380000] lepton.ko:it tx_buf.



Welcome to Rosebud (Operational)

AT91SAM9 login:Login incorrect

AT91SAM9 login:

