GE Medical Flashpad Digital Xray Detector - Revision history

Gamerpaddy: /* Teardown / Internal Pictures / Hardware analysis */ typo

2026-06-12T15:09:45Z

Teardown / Internal Pictures / Hardware analysis: typo

Gamerpaddy: /* Overview */

2026-06-11T12:29:00Z

Overview

Gamerpaddy: /* Sequence Counter Rules */

2026-06-11T12:27:12Z

Sequence Counter Rules

Gamerpaddy: /* Communication Protocol */

2026-06-11T12:23:50Z

Communication Protocol

Gamerpaddy at 12:22, 11 June 2026

2026-06-11T12:22:07Z

Gamerpaddy: /* Purpose and Motivation */

2026-06-11T12:21:28Z

Purpose and Motivation

Gamerpaddy: /* Purpose and Motivation */

2026-06-11T12:15:58Z

Purpose and Motivation

Show changes

Gamerpaddy: added the main script to read & set data

2026-06-11T12:13:36Z

added the main script to read & set data

Show changes

Gamerpaddy: /* FlashPad Detector: Internal Flash Dump and Data Files */

2026-06-11T12:00:53Z

FlashPad Detector: Internal Flash Dump and Data Files

Gamerpaddy: /* Status of Reverse Engineering */

2026-06-11T11:59:52Z

Status of Reverse Engineering

@@ Line 863: / Line 863: @@
 File:GE Flashpad under the hood.jpg|the Carbon fiber sleeve is held by 9 screws and can taken off without force.
 File:Ge flashpad powersupply pcb in handle.jpg|Power supply PCB
-File:Ge flashpad uwb board pcb.jpg|UWB PCB for Wireless USB using a RTU2705
+File:Ge flashpad uwb board pcb.jpg|UWB PCB for Wireless USB using a RTU7105
 File:Ge flashpad uwb pcb backside.jpg|Backside of UWB PCB
 File:Ge flashpad power supply pcb backside.jpg|Backside of Power supply PCB

@@ Line 11: / Line 11: @@
 {{Note|AI assistance was used in writing this page for improved formatting and readability, as well as in the process of finding information, testing, and analyzing firmware dumps and backups.}}
 ==Purpose and Motivation==
@@ Line 327: / Line 330: @@
 *The detector silently drops any packet with a SeqId it has already processed, so never reuse one.
-== Script Download ==
+==Script Download==
 The detector does not have fixed acquisition commands. Instead the host
@@ Line 337: / Line 340: @@
 example IDC_URP_SE_2200.xml for single energy, 2048 by 2048).
-=== The GENERIC_SCRIPT command ===
+===The GENERIC_SCRIPT command===
 A script is sent to the detector with the GENERIC_SCRIPT command, cmd_type 5.
@@ Line 353: / Line 356: @@
 {| class="wikitable"
-! Offset !! Size !! Field !! Meaning
+!Offset!!Size!!Field!!Meaning
 |-
-| 0 || 2 LE || scriptID || the slot the script is stored in
+|0||2 LE||scriptID||the slot the script is stored in
 |-
-| 2 || 2 LE || repeatCount || 0 = run once, 65535 = loop forever
+|2||2 LE||repeatCount||0 = run once, 65535 = loop forever
 |-
-| 4 || 4 LE || repeatEvent || event ID that breaks an infinite loop (0 if unused)
+|4||4 LE||repeatEvent||event ID that breaks an infinite loop (0 if unused)
 |}
@@ Line 366: / Line 369: @@
 header is exactly 8 bytes.
-=== Packed command primitives ===
+===Packed command primitives===
 Each command inside the script starts with a one byte DETECTORCODE that selects
@@ Line 372: / Line 375: @@
 {| class="wikitable"
-! DETECTORCODE !! Command !! Size !! Layout (after the code byte)
+!DETECTORCODE!!Command!!Size!!Layout (after the code byte)
 |-
-| 1 || Acquisition || 17 || typeMode:1, imageId:1, noScrubs:1, scrubDuration:4 LE, maxExposeTime:4 LE, tailTime:4 LE, transferMode:1
+|1||Acquisition||17||typeMode:1, imageId:1, noScrubs:1, scrubDuration:4 LE, maxExposeTime:4 LE, tailTime:4 LE, transferMode:1
 |-
-| 2 || ROE command || 14 || responseFlag:1, timerValue:4 LE, roeCmd:4 LE, roeData:4 LE
+|2||ROE command||14||responseFlag:1, timerValue:4 LE, roeCmd:4 LE, roeData:4 LE
 |-
-| 3 || Send host event || 5 || eventId:4 LE
+|3||Send host event||5||eventId:4 LE
 |-
-| 4 || Wait for host event || 9 || eventId:4 LE, timeout:4 LE
+|4||Wait for host event||9||eventId:4 LE, timeout:4 LE
 |-
-| 5 || Delay || 5 || delayMicroseconds:4 LE
+|5||Delay||5||delayMicroseconds:4 LE
 |}
@@ Line 388: / Line 391: @@
 Acquisition command triggers the actual exposure window and image readout.
-=== Download sequence ===
+===Download sequence===
-# The host sends the GENERIC_SCRIPT packet for a given scriptID.
+#The host sends the GENERIC_SCRIPT packet for a given scriptID.
-# The detector replies with a bare acknowledgement carrying the same sequence ID. (It may also send a GENERIC_SCRIPT status reply with a status byte; status 0 means accepted.)
+#The detector replies with a bare acknowledgement carrying the same sequence ID. (It may also send a GENERIC_SCRIPT status reply with a status byte; status 0 means accepted.)
-# The host repeats this for each script it wants resident on the detector.
+#The host repeats this for each script it wants resident on the detector.
-# When ready, the host sends EXECUTE_SCRIPT, cmd_type 6, which runs the stored scripts. During and after execution the detector sends status notifications, and finally EXECUTION_COMPLETE, cmd_type 0x10000.
+#When ready, the host sends EXECUTE_SCRIPT, cmd_type 6, which runs the stored scripts. During and after execution the detector sends status notifications, and finally EXECUTION_COMPLETE, cmd_type 0x10000.
 Scripts are persistent for the session: once downloaded they can be executed
 without resending.
-=== The standard script set ===
+===The standard script set===
 The single energy mode downloads four scripts in order. The scriptID in the
@@ Line 404: / Line 407: @@
 {| class="wikitable"
-! scriptID !! Purpose !! Notes
+!scriptID!!Purpose!!Notes
 |-
-| 7 || ROE initialization || Scan setup plus a sequence of zero pulses, ends by sending host event 17
+|7||ROE initialization||Scan setup plus a sequence of zero pulses, ends by sending host event 17
 |-
-| 8 || Standby loop || repeatCount 65535, broken by event 41; keeps the panel idle between acquisitions
+|8||Standby loop||repeatCount 65535, broken by event 41; keeps the panel idle between acquisitions
 |-
-| 0 || Standard acquisition || Requires a real X-ray exposure to complete
+|0||Standard acquisition||Requires a real X-ray exposure to complete
 |-
-| 1 || Dark / offset acquisition || Completes with no X-ray; used to test the full flow
+|1||Dark / offset acquisition||Completes with no X-ray; used to test the full flow
 |}
@@ Line 419: / Line 422: @@
 EXECUTION_COMPLETE in a few seconds.
-=== Inspecting the encoded scripts ===
+===Inspecting the encoded scripts===
 See [[#Main test py script: Usage and Parameters|Main test py script]]
 The exact wire bytes of every built script can be printed without touching the

← Older revision		Revision as of 12:27, 11 June 2026
Line 327:		Line 327:
	*The detector silently drops any packet with a SeqId it has already processed, so never reuse one.		*The detector silently drops any packet with a SeqId it has already processed, so never reuse one.

		+	== Script Download ==
		+
		+	The detector does not have fixed acquisition commands. Instead the host
		+	downloads small programs, called scripts, that the detector stores by ID and
		+	then runs on command. A script is a sequence of primitive operations: program
		+	the ROE (readout electronics) registers, wait, acquire an image, signal an
		+	event. The acquisition behavior of the panel is defined entirely by these
		+	downloaded scripts, which are taken from the application mode XML files (for
		+	example IDC_URP_SE_2200.xml for single energy, 2048 by 2048).
		+
		+	=== The GENERIC_SCRIPT command ===
		+
		+	A script is sent to the detector with the GENERIC_SCRIPT command, cmd_type 5.
		+	The wire format is:
		+
		+	[cmd_type : 4 LE] = 5
		+	[length : 4 LE] = 8 + sum(command sizes) + 2
		+	[script header : 8 bytes]
		+	[packed command 1]
		+	[packed command 2]
		+	...
		+	[terminator : 2 bytes] = 00 00
		+
		+	The 8 byte script header is:
		+
		+	{\| class="wikitable"
		+	! Offset !! Size !! Field !! Meaning
		+	\|-
		+	\| 0 \|\| 2 LE \|\| scriptID \|\| the slot the script is stored in
		+	\|-
		+	\| 2 \|\| 2 LE \|\| repeatCount \|\| 0 = run once, 65535 = loop forever
		+	\|-
		+	\| 4 \|\| 4 LE \|\| repeatEvent \|\| event ID that breaks an infinite loop (0 if unused)
		+	\|}
		+
		+	Note: the application mode XML lists a fourth header value, ROEdata. This is a
		+	substitution source for the script's commands, not a field on the wire. The wire
		+	header is exactly 8 bytes.
		+
		+	=== Packed command primitives ===
		+
		+	Each command inside the script starts with a one byte DETECTORCODE that selects
		+	its type and length:
		+
		+	{\| class="wikitable"
		+	! DETECTORCODE !! Command !! Size !! Layout (after the code byte)
		+	\|-
		+	\| 1 \|\| Acquisition \|\| 17 \|\| typeMode:1, imageId:1, noScrubs:1, scrubDuration:4 LE, maxExposeTime:4 LE, tailTime:4 LE, transferMode:1
		+	\|-
		+	\| 2 \|\| ROE command \|\| 14 \|\| responseFlag:1, timerValue:4 LE, roeCmd:4 LE, roeData:4 LE
		+	\|-
		+	\| 3 \|\| Send host event \|\| 5 \|\| eventId:4 LE
		+	\|-
		+	\| 4 \|\| Wait for host event \|\| 9 \|\| eventId:4 LE, timeout:4 LE
		+	\|-
		+	\| 5 \|\| Delay \|\| 5 \|\| delayMicroseconds:4 LE
		+	\|}
		+
		+	For example, a ROE command sets a readout register (roeCmd, roeData) and an
		+	Acquisition command triggers the actual exposure window and image readout.
		+
		+	=== Download sequence ===
		+
		+	# The host sends the GENERIC_SCRIPT packet for a given scriptID.
		+	# The detector replies with a bare acknowledgement carrying the same sequence ID. (It may also send a GENERIC_SCRIPT status reply with a status byte; status 0 means accepted.)
		+	# The host repeats this for each script it wants resident on the detector.
		+	# When ready, the host sends EXECUTE_SCRIPT, cmd_type 6, which runs the stored scripts. During and after execution the detector sends status notifications, and finally EXECUTION_COMPLETE, cmd_type 0x10000.
		+
		+	Scripts are persistent for the session: once downloaded they can be executed
		+	without resending.
		+
		+	=== The standard script set ===
		+
		+	The single energy mode downloads four scripts in order. The scriptID in the
		+	header is the slot; the XML refers to them by a separate DETECTOR_SCRIPT_ID.
		+
		+	{\| class="wikitable"
		+	! scriptID !! Purpose !! Notes
		+	\|-
		+	\| 7 \|\| ROE initialization \|\| Scan setup plus a sequence of zero pulses, ends by sending host event 17
		+	\|-
		+	\| 8 \|\| Standby loop \|\| repeatCount 65535, broken by event 41; keeps the panel idle between acquisitions
		+	\|-
		+	\| 0 \|\| Standard acquisition \|\| Requires a real X-ray exposure to complete
		+	\|-
		+	\| 1 \|\| Dark / offset acquisition \|\| Completes with no X-ray; used to test the full flow
		+	\|}
		+
		+	For a no X-ray test, download script 7 then script 1 and execute. The detector
		+	runs the ROE init, performs the dark acquisition, and reports
		+	EXECUTION_COMPLETE in a few seconds.
		+
		+	=== Inspecting the encoded scripts ===
		+	See [[#Main test py script: Usage and Parameters\|Main test py script]]
		+	The exact wire bytes of every built script can be printed without touching the
		+	detector:
		+
		+	python flashpad_acquire.py --dump-scripts
		+
		+	This shows the full GENERIC_SCRIPT encoding (header, packed commands, and
		+	terminator) as hex, which is useful for verifying the format against the XML.

	==Sensor Readout and Host Registration==		==Sensor Readout and Host Registration==

@@ Line 101: / Line 101: @@
 ==Communication Protocol==
-This section documents the URP/PDAP protocol used by the GE Flashpad (codename '''Apollo''') to communicate with a host over Ethernet. All findings are based on live capture tests, configuration files, and reverse-engineering of the GE SuperBee software stack.
+This section documents the URP/PDAP protocol used by the GE Flashpad (codename '''Apollo''' (Or FeiTian, Mammo, Gryphon etc.) to communicate with a host over Ethernet. All findings are based on live capture tests, configuration files, and reverse-engineering of the GE SuperBee software stack.
 {{Note|All findings are based on a single unit and may not be fully accurate.}}

@@ Line 26: / Line 26: @@
 The intended beneficiaries are:
-*Hobbyists, researchers, and engineers who want a high quality flat panel detector for their own imaging projects.
+*Hobbyists, researchers, and engineers who want a high quality flat panel detector for their own imaging projects.  for example studying the fluid movement in plants. https://www.youtube.com/watch?v=j-FHbHoiwNk (Xray timelapse by Ben Krasnow / Applied Science using a GE Flashpad)
 *Veterinary practices, which can put surplus human grade detectors to good use at a fraction of the cost of new equipment.
 *Clinics and hospitals in countries and regions where a complete commercial system is unaffordable, allowing serviceable detectors to keep providing diagnostic imaging instead of being scrapped.
 [[File:Xray current clamp multimeter.png|thumb|xray of a current clamp multimeter using a different detector]]

@@ Line 17: / Line 17: @@
 system, with the goal of freeing these detectors for independent use.
 [[File:Xray capture pcb.png|thumb|Xray capture of a PCB for Reverse Engineering using a different detector]]
-Large numbers of these detectors reach the used market, but each one is
+Large numbers of these detectors reach the used market, but each one is bound to its original Optima 220 AMX
 console. Once separated from that console, or once the console is
 decommissioned, the detector is effectively useless even though the hardware is
-fully functional. The aim of this work is to remove that artificial barrier so
+fully functional. There is a Windows software but it is not obtainable. The aim of this work is to remove that artificial barrier so
 that a standalone FlashPad can be paired, configured, and read out by any host,
 without the half million dollar console it was sold with.
@@ Line 30: / Line 29: @@
 *Veterinary practices, which can put surplus human grade detectors to good use at a fraction of the cost of new equipment.
 *Clinics and hospitals in countries and regions where a complete commercial system is unaffordable, allowing serviceable detectors to keep providing diagnostic imaging instead of being scrapped.
 [[File:Xray current clamp multimeter.png|thumb|xray of a current clamp multimeter using a different detector]]

@@ Line 752: / Line 752: @@
 correction, and the firmware image (the live, deployed build) is more complete
 than the partial firmware files shipped on the recovery media.
@@ Line 772: / Line 775: @@
 ;Image data streaming automatically after EXECUTE_SCRIPT
 :Frames may not push during execution at all. The detector may require an explicit IMAGE_RETRIVAL_REQUEST (cmd_type=0x41) and IMAGE_RETRIVAL (cmd_type=0x98) after the 0x30000 notification before it streams anything. Not yet tested.
 ==Teardown / Internal Pictures / Hardware analysis==

@@ Line 79: / Line 79: @@
 |EXECUTE_SCRIPT||Works
 |-
-|EXECUTION_COMPLETE (dark acquisition)||Works
+|EXECUTION_COMPLETE (dark acquisition)||Works but without image readout its speculation.
 |-
 |EXECUTION_COMPLETE (standard acquisition)||Needs real X-ray trigger to test
 |-
-|Image data on port 6660||Does not work yet, under investigation. Will not send Imagedata yet.
+|Image data on port 6660||Does not work yet, under investigation. Will not send Imagedata...
 |}