123
edits
Changes
GE Medical Flashpad Digital Xray Detector (view source)
Revision as of 12:13, 11 June 2026
, Yesterday at 12:13added the main script to read & set data
==Overview==
{{Note|UNFINISHED Project, it was not yet possible to retrieve a exposure or dark frame in my testing, further investigation needed. any help is appreciated on recessim discord.}}
The '''GE Flashpad''' is a Digital Radiography image sensor from approximately 2010, originally used in the '''GE Optima 220AMX''' mobile X-ray unit. It was designed to replace analog film in radiology, dramatically reducing image acquisition time from hours to seconds.
{{Note|All findings on this page are based on a single unit and the time spent working on it. Information is subject to speculation and may not be fully accurate.}}
{{Note|[[Artificial intelligence|AI]] assistance was used in writing this page for improved formatting and readability, as well as in the process of finding information, testing, and analyzing firmware dumps and backups.}}
==Purpose and Motivation==
(0x0E / 0x0F / 0x10).
===Reading the Drop and Shock Event Log===
The detector contains an accelerometer based shock watchdog that records drop
in the small onboard EEPROM on the detector PCB.
====How to read it====
The shock log is exposed as data category 0x72 on the upload (read) interface.
(32 KB I2C part) for anyone reading the hardware directly.
====Example output====
The following is the actual log read from detector serial UA45829-7. The file
157804584600183, 149266438700135 }
====Interpreting the records====
The record key encodes the event time and the peak axis values (an epoch style
|}
====Reading the summary fields====
{| class="wikitable"
== Teardown / Internal Pictures / Hardware analysis ==
<gallery mode="packed" heights="200">
File:GE Flashpad under the hood.jpg|the Carbon fiber sleeve is held by 9 screws and can taken off without force.
File:Ge flashpad powersupply pcb in handle.jpg|Power supply PCB
File:Ge flashpad uwb board pcb.jpg|UWB PCB for Wireless USB using a RTU2705
File:Ge flashpad uwb pcb backside.jpg|Backside of UWB PCB
File:Ge flashpad power supply pcb backside.jpg|Backside of Power supply PCB
File:Ge flashpad main pcb closeup1.jpg|Main area of the PCB with its Altera Cyclone 3 FPGA
File:Ge flashpad main pcb closeup2.jpg|AD7892 is a 600ksps 12bit ADC, SN74LVC8T245 a 8bit bus transceiver and DG9408EDN a 8ch MUX
File:Ge flashpad bottom connector ethernet isolation pcb.jpg|Isolation PCB for bottom connector
File:Ge flashpad main pcb powersupply section.jpg|Powersupply section for FPGA and ROIC
File:Ge_flashpad_main_pcb_closeup_3.jpg|AD9764AR 14-Bit, 125 MSPS DAC and DS1682 integrated elapsed-time recorder
File:Ge flashpad main pcb closeup 4.jpg|Accelerometer is a 834-0500 500G 3 Axis unit, and TJ500AE SPDT gigabit LAN switch
File:Ge flashpad bottom connector.jpg|bottom connector for docking stand
File:Ge flashpad main pcb closeup 5.jpg|Ethernet transformers and ADM34 RS-485/RS-422 Transceiver
File:Ge flashpad main pcb closeup 6.jpg|Altera EPM570f100c5n CPLD
File:Ge flashpad main pcb closeup 7.jpg|Spansion GL512P10FF1R1 512 Mbit NOR flash IC holding everything
File:Ge flashpad main pcb closeup 8.jpg|24LC256I 32k EEPROM for storing the accelerometer events
</gallery>
== Main test py script: Usage and Parameters == current iteration found here: https://pastebin.com/vEfAresk flashpad_acquire.py is a single file Python 3 tool that speaks the FlashPadURP/PDAP protocol over UDP. It implements discovery, the control handshake,script download and execution, sensor readout, full data backup, and the hostregistration (pairing) write. It requires only the Python standard library. === Default network configuration === These defaults match the values in ConnectionPoint.cfg and can be overridden onthe command line. {| class="wikitable"! Setting !! Default !! Meaning|-| Detector IP || 192.168.1.30 || the panel; listens for all commands on UDP 8100|-| Host IP || 192.168.1.1 || this machine, announced in SYSTEM_STARTUP|-| Detector port || 8100 || where commands are sent|-| Host command port || 5550 || where the detector returns protocol replies|-| Host image port || 6660 || where pixel data would stream|-| Discovery port || 4500 || where the detector sends its beacons|} === Connection and general options === {| class="wikitable"! Option !! Default !! Effect|-| --detector-ip IP || 192.168.1.30 || detector address|-| --host-ip IP || 192.168.1.1 || host address sent in SYSTEM_STARTUP|-| --output-dir DIR || . || where raw images are written|-| --timeout SECONDS || 5.0 || UDP receive timeout|-| --exec-timeout SECONDS || 60 || how long to wait for EXECUTION_COMPLETE|-| --skip-discovery || off || send SYSTEM_STARTUP once and proceed, skipping the discovery loop|-| --quiet || off || suppress the verbose per packet log|} === Read and diagnostic modes (non destructive) === These only read from the detector. None of them write anything. {| class="wikitable"! Option !! What it does !! What to expect|-| --sensors || Reads the full 32 entry sensor table using cmd 0x7902 (converted) and 0x7900 (raw), side by side. || A decoded table of supply rails in volts. Temperatures show as railed. Unimplemented sensors (accelerometer DEM id, battery, grid) are flagged as stale.|-| --no-roe-init || With --sensors, skips the Script7 ROE init before reading. || Slightly faster sensor read, marginally less reliable.|-| --probe-data || Reads DetectorInfo, the HostList (registration state), and cal results via the upload protocol (cmd 0x13/0x14). || A hexdump and text decode of each. Shows whether any host is registered and which HostId the detector expects.|-| --backup [DIR] || Sweeps all upload IDs 0x00 to 0xFF and saves every readable blob to DIR/detector_backup_timestamp/. || A manifest plus one .bin per readable ID, including the full 64 MB flash image and the calibration maps. Do this before any write. Large blobs take a few minutes each.|-| --backup-range LO-HI || Limits the --backup sweep, for example 0x40-0xA0. || Faster, partial backup.|-| --dump-scripts || Prints the wire bytes of all built scripts as hex and exits. || No network activity; useful for inspecting the script encoding.|-| --listen || Passively listens on the host command port for 30 seconds. || Prints any packets the detector sends; useful for watching beacons.|} === Acquisition modes === The default invocation (no mode flag) runs a standard acquisition, whichrequires an actual X-ray exposure to complete. {| class="wikitable"! Option !! What it does !! What to expect|-| (no flag) || Standard acquisition (Script 0). || Needs an X-ray exposure to reach EXECUTION_COMPLETE.|-| --dark || Runs the dark/offset acquisition (Script 1) before the standard one. || Two acquisitions; the dark one needs no X-ray.|-| --dark-only || Runs only the dark acquisition (Script 1). || Completes in a few seconds with no X-ray. The detector acquires and holds an 8 buffer image. Best way to test the full flow.|-| --no-standby || Omits the Script 8 standby loop. || Use if the standby loop blocks acquisition.|-| --two-exec || Executes Script 7 alone, waits, then Script 1. Only with --dark-only. || Tests the two stage execution hypothesis.|-| --parallel || Answers the detector status query (0x30000) with the cmd 0x99 ParallelImageTransfer reply instead of cmd 9. || Experiment to see if the parallel reply triggers a pixel push. (Result so far: it does not.)|-| --sweep-acq || Sweeps the dark acquisition across type_mode and transfer_mode values, watching for a 0x0F pixel push. || Non destructive experiment; reports which combination, if any, makes the detector stream.|-| --preview || Single dark acquisition on the preview path (transfer_mode 2, 4 buffer image). Watches port 6660 for a push. || One clean connection; run a packet capture on the detector address in parallel.|} Note: at present the detector acquires and holds an image but does not push the0x0F pixel frames. The acquisition modes complete the handshake and acquisition,but image streaming is still being investigated. === Registration and write operations === These can write to the detector's flash. Every write is a dry run by default andonly takes effect when --commit is added. Always run --backup first. {| class="wikitable"! Option !! What it does|-| --register-self || Adds this host to the detector HostList and sets it as the primary host, so the detector should stream images to it. Appends an entry, sets IndexToPrimaryHost, recomputes the CRC, and writes via id 0x71. Dry run unless --commit.|-| --host-mac MAC || The MAC of the interface talking to the detector, used to derive this host's HostId for --register-self. Default 00:6f:00:01:0a:3a.|-| --smoke-test-write || Reads the HostList and writes back the identical bytes to validate the write and commit path without changing anything. Dry run unless --commit.|-| --restore-hostlist FILE || Writes a saved HostList blob (for example detector_backup_*/upload_0x71_504.bin) back to the detector. This is the undo button. Dry run unless --commit.|-| --commit || Arms the actual flash write for the operations above. Without it they only print what they would do. This writes the detector's flash and is irreversible at the chip level, although the HostList region can be restored from a backup.|} === Typical workflow === # Read the current state: <code>python flashpad_acquire.py --probe-data</code># Make a full backup: <code>python flashpad_acquire.py --backup</code># Check sensors and power rails: <code>python flashpad_acquire.py --sensors</code># Dry run the registration: <code>python flashpad_acquire.py --register-self --host-mac YOUR:MAC</code># When satisfied, commit it: add <code>--commit</code># If needed, undo: <code>python flashpad_acquire.py --restore-hostlist detector_backup_*/upload_0x71_504.bin --commit</code> ==Known Dead Ends===
Things that were tried and did not work or led nowhere:
;Image data streaming automatically after EXECUTE_SCRIPT
:Frames may not push during execution at all. The detector may require an explicit IMAGE_RETRIVAL_REQUEST (cmd_type=0x41) and IMAGE_RETRIVAL (cmd_type=0x98) after the 0x30000 notification before it streams anything. Not yet tested.