Troubleshooting Circuitry in Old SD49225T-HN PTZ Cameras

Did two experiments today.

1. Test what happens if you power up the camera without an EEPROM in place? Is there a copy of the firmware in the battery backed up RAM?

Result - Camera powers up and then the PTZ system does its horizontal and vertical motion motions. However, the camera does not appear at any IP address. So, no it cannot boot up without the EEPROM. The EEPROM carries the active copy of the firmware. Whatever is in battery backed up RAM does not act as an extra copy of the firmware. This also suggests that one cannot install a blank EEPROM into the camera. It has to be programmed with the firmware.

I suspect they DO install the EEPROM and then program it in circuit at the factory, but none of us knows how to access the UART (assuming there is such an access for programming)

With the XGecu T48, I should be able to clone the old EEPROM to a new chip before soldering in the new one. At least, that is my plan.


2. Verify XGecu T48 functionality. Since, I don't have a TSOP 48 adapter for this programmer, I needed another format EEPROM to test the programmer. Desoldered a M25P10 8 pin EEPROM from a dead hard drive board. Got it onto a TSOP 16 adapter and YES! The T48 programmer can read, erase and program the M25P10 EEPROM. The programmer works.

Going to be a LONG wait for the right TSOP48 to T48 programmer adapter to arrive.
 
Did two experiments today.

1. Test what happens if you power up the camera without an EEPROM in place? Is there a copy of the firmware in the battery backed up RAM?

Result - Camera powers up and then the PTZ system does its horizontal and vertical motion motions. However, the camera does not appear at any IP address. So, no it cannot boot up without the EEPROM. The EEPROM carries the active copy of the firmware. Whatever is in battery backed up RAM does not act as an extra copy of the firmware. This also suggests that one cannot install a blank EEPROM into the camera. It has to be programmed with the firmware.

I suspect they DO install the EEPROM and then program it in circuit at the factory, but none of us knows how to access the UART (assuming there is such an access for programming)

With the XGecu T48, I should be able to clone the old EEPROM to a new chip before soldering in the new one. At least, that is my plan.


2. Verify XGecu T48 functionality. Since, I don't have a TSOP 48 adapter for this programmer, I needed another format EEPROM to test the programmer. Desoldered a M25P10 8 pin EEPROM from a dead hard drive board. Got it onto a TSOP 16 adapter and YES! The T48 programmer can read, erase and program the M25P10 EEPROM. The programmer works.

Going to be a LONG wait for the right TSOP48 to T48 programmer adapter to arrive.
PROGRESS!!! Take the little wins, Who knows, a year from now you might be running Guykuo's P.T.Z. repair services. :winktongue: Working on circuits with no schematics can suck, frustration, but very satisfying when you gain some insight. This is really Groundbreaking stuff because there is very little known about the Inner workings of these cameras. So you did really learn something, Someplace there has to be a embedded Rom for doing its first POST and running the presets? Those commands have to come from someplace.
Once it passes those (I'm Guessing now)it goes out and looks for the Operating system. Hopefully its all on the EEPROM. Hopefully you will get a good image from it and gain Insight in the workings from it. I'm really rooting for ya.
 
Going to be a LONG wait for the right TSOP48 to T48 programmer adapter to arrive.
You seem like someone who could solder some tiny wires to an eeprom and wire wrap them to a dip socket that drops into the ZIF socket.