When a trail camera reverts back to its default settings, and won’t take a firmware update, it likely means that the EEPROM has failed. This small, inexpensive part, holds the firmware for the camera. In this post, I show how I have been able to repair a failed EEPROM. I also provide pointers to EEPROM images necessary to initialize new parts for various Browning trail camera models. This is a relatively high “degree of difficulty” repair, as it involves some specialized equipment and skills.

Trail camera companies, like Browning, likely don’t do this repair because of its cost, choosing instead to offer newer cameras. I have made the repair easier by publishing working EEPROM images.

You can also check out the video version of this post on my YouTube channel

Thanks to DanP for inspiring the post, and letting me use his camera.

What is an EEPROM Anyway?

EEPROM stands for Electrically Erasable Programmable Read Only Memory. That’s quite a mouth full. It’s a device that can store data, such as the firmware necessary to boot a trail camera, even when power is not applied. Critically, it can also be electrically erased on a block by block basis, and rewritten with new data.

In a trail camera, EEPROMs are used to store the camera firmware, which is loaded from the device every time the camera is turned on, or wakes up to take a photo or video. The EEPROM is also used to store couple of small file systems. These file systems contain an assortment of read-only configuration files, but they also store any new configuration data.

The EEPROM on Browning cameras is an 8-PIN wide SOIC package. Photo below shows location for Patriot-FHD model. Exact location on the circuit board varies by camera model.

How do EEPROMs Fail?

Each “electrical erasing” and reprogramming of an EEPROM does a tiny amount of damage to the EEPROM device. Typical EEPROM parts used in trail cameras are rated for a minimum number of write cycles in the range of 100,000 cycles. That is, the damage done on each write is so small that the device can be safely rewritten at least 100,000 times.

100,000 cycles should be plenty to keep a trail camera going for decades of normal use. After all, we don’t change the parameters *that* often and the camera firmware is careful not to write to the EERPOM device unless it really needs to.

I suspect that some devices do not meet this spec, and fail after a smaller number of cycles. But this explains why we typically see this failure in older cameras.

No New Data

In principle, a failed EEPROM could fail in many different ways. For example, it could fail by “forgetting” some or all of the data stored. If this happened, it would most likely prevent the firmware from booting.

However, in my expereince, EEPROMs in these trail cameras fail by not accepting any new data. The software can try to write new data by erasing blocks, and writing new data, but in a typically failing EEPROM, the old data is never erased, and the new data never written.

Symptoms of EEPROM Failure

EEPROM failure can be diagnosed in a trail camera is the camera reverts back to some earlier set of configuration parameters, even after you just set new ones. Sometimes this problem can be caused by a corrupted parameter file. In this case, reloading the firmware can fix the problem. If the camera will not accept a new firmware image, then the EEPROM has failed.

Replacing the EEPROM

Replacing the EEPROM in these cameras requires the following steps.

1. Get a new EEPROM device
2. Get a valid firmware image
3. Program the Device with a valid firmware image
4. Remove the failed EERPOM from the main circuit board on the camera
5. Solder down the new EEPROM

Get a New EEPROM Device

Easiest step. These parts are readily available from electronics distributors. Browning uses a number of different parts from different suppliers, optimized for each camera model, and possibly determined by supply chain agreements. I have had success replacing all these different capacity and maker’s EEPROM device with a 16 Mbyte device from Macronix — MX25L12835FM2I-10G. This part is available from multiple suppliers, including DigiKey.

Get A Valid Firmware Image

Unfortunately, Browning does not publish EEPROM images for their cameras. Fortunately, as part of a larger reverse engineering projected (See New Features for Browning Recon Force and SpecOps Cameras) I had to create EEPROM images for a number of different trail camera models. You can find them here.

You might think that it would be easy to get an EEPROM image — just copy the image from the failed EEPROM. After all, it can still be read. Unfortuately, I was not able to read the device “in situ” on the board, likely because of the way it is connected to other parts in the design. I also found that the heat required to remove the device almost always erases some or all of the data.

Instead, I found that I was able to generate an EERPOM image based on the firmware update images Browning does provide, a little bit of data that I was able to “snoop” off the EEPROM while it was booting with a logic analyzer, and a couple of software tools to glue it all back together.

Active EEPROM Probe

I have a low cost USB logic analyzer (Kingst LA5016). This analyzer is spec’ed at 500 Mega-samples/second (500 MHz), which might seem plenty fast enough to capture the 100 MHz signals on the EEPROM pins. Unfortunately, the “pickup probe” for this logic analyzer is not very sophisticated. It’s just a bunch of wires going from the device to the probe. At signals speeds of 100 MHz, the load of these wires and the logic analyzer input pins on the original signals is significant. Indeed, I found that simply placing more than a couple of leads on the EEPROM device prevents the firmware from properly loading, and prevents the camera from booting.

To work around this problem, I built a small “active probe” into the test clip that crimps over the SOIC-8 EEPROM. The active probe contains 6 high speed buffer circuits (one for each signal on the 8-pin EEPROM). These buffers effectively isolate the EEPROM from the logic analyzer. The load on the original device is very small, and the buffer can easily drive. The active probe uses the power and ground pins on the SOIC to power the buffers.

With this active probe, I was able to use the Kingst LA5016 to extract a a full trace of the boot from the EEPROM, which includes all of the data required to boot the camera.

Packaging the Bits into an EEPROM Binary

As part of my earlier reverse engineering effort, I wrote a bunch of software tools. The include:

• An EEPROM protocol analyzer which takes the trace from the logic analyzers, extracts the data transfers, and then puts together a binary file for including in the final EEPROM image
• A Firmware Image parser, which unpacks the contents of a Browning firmware update file, makes a few small (but necessary changs), integrates the necessary sections from the logic analyzer trace, and spits out a binary file suitable for programming an actual EEPROM device.

The result is a series of binary images for different firmware images which you can find here on my GitHub site.

Program Device With a Valid Firmware Image

This step requires that you have an EEPROM programmer. I use the USB-based RevelProg IS, but any will do. The SOIC ZIFF socket on the Revelprog IS is too narrow for our trail camera EEPROMs, so I had to build my own, which attaches to the programmer via ribbon cable.

Once the EEPROM is installed in the programmer, it’s only necessary to load the binary file into the RevelProg PC app and press the “Save File to Device” button.

Remove the Failed EEPROM

The EEPROM is an 8-Pin SOIC soldered directly to the main PCB. One must carefully remove this part without damaging the delicate circuit board traces. Ideally, this is done with a complete rework station. But this is not strictly necessary. I get by with a Weller soldering station, an anti-static silicon mat, a 10x binocular dissecting microscope. A stand to hold the PCB still in the microscope field is also a big help.

I remove the solder from the device pins with some “solder braid” (0.050 inch), my soldering iron, and repeated wipes from a “no clean” flux pen. I pressed the braid down with the soldering iron tip onto the device lead and pad. When the solder on the pin and pad melt, the solder braid “wicks” the solder off of the board and into the braid based on surface tension.

I don’t have a video of me doing this because I don’t have a good setup for capturing video from my dissecting microscope. Chemtronics, the maker of Solder-Wick brand solder braid has some good videos on using solder braid here. 

There are few things that make this tricky. The ground and +3.3V power pins are connected to large traces on the PCB. Large traces dissipate a lot of heat, and thus getting these pins hot enough to melt solder is noticeably more difficult than the other pins.

It is very easy to lift one of the small pads right off the circuit board. I’ve done this a couple of times, and in these cases, have had to improvise a solution to restore the correct electric connectivity. The photo below includes one such example where I was able to bypass the damaged pad and PCB trace with a (very) small wire and a steady hand.

Practice

Desoldering and soldering the tiny pins of SOIC devices is a skill that takes some practice to develop. If you don’t have these skills already, I recommend spending some time with YouTube and some disposable PCB boards before operating a device you care about. It’s relatively easy to permanently damage the PCB, which effectively wrecks the camera.

Installing the new EEPROM

The next step is to install the new, and correctly programmed EEPROM part into the spot where the faulty one was removed. Note that this device has a polarity — a small circular indentation (or sometimes just a white dot) marks pin 1 on the device and circuit board.

If you’ve been careful removing the old part, and the pads are in good shape, this is pretty straightforward. It is important not to overheat the new part, as it is possible to damage the contents if not the device.

The EEPROM can be tricky to place – especially if your hands are shaky like mine.  Here’s the technique I use:

• I start by removing as much solder as possible from the PCB pads.  
• Then, I melt a small dab of solder onto the pad for pin 5.  
• Next, I use a pair of tweezers, and carefully set the EEPROM on the PCB, near the pad footprint.  
• I try to put the EEPROM in place, then press it down from the top with the tweezers.  
• Then I melt the solder on Pin 5, til it flows onto the pin.  
• Next I inspect the the placement, to make sure all the pins are centered on all the pads.  
• When they’re not, I use the tweezers to very slightly slide the EEPROM into place as I melt pin 5 with the soldering iron.  

To keep things from moving around, I use a stand with a clamp to anchor the PCB. To reduce hand shaking, I brace my hands and fingers up against something solid — like the stand, or microscope frame.

Post-Repair Inspection and Checks

Before applying power, I suggest the following “tests”: 

• Visually inspect all solder joints under magnification.  Look for places where solder does not flow seamlessly from pad to pin.  If you find any gaps, fill them in with a little more solder. 
• With a multimeter, verify that there are no shorts between adjacent pins. These can be caused by “solder bridging” between pins.  If this happens, use the solder braid to remove excess solder.
• With the sharp tips of the multipeter leads, check for continuity (zero resistance) beween each pin on the SOIC and the pad that it should be soldered onto.   Occasionally, a solder joint that looks ok, can still be marginal. Pins 4 and 8 (ground and +3.3V respectively) can be particularly tricky to solder.  If you find an open, carefully re-heat the problem pin/pad and apply a little more solder. 

Powering Back On

With the new EEPROM installed, time to turn on the camera. If all went well, the camera will boot as normal. If things did not go well the camera will not boot. If the camera boots, it is almost guaranteed that the underlying symptoms are fixed — the camera should retain settings now. But it’s always good to test.

If camera does not boot, go back to “Post-Repair Inspection and Checks” above.

Comments

I write this post knowing that this fix is not for everyone. If you have just one camera with this problem, it’s probably easier to just buy a new one. But if you have several, or a lot, that have lost their capacity for new settings, learning how to fix them may be worth your while. If you do try, let us know how you made out in comment section, below.

Resources

• Solder/Rework Training: SolderTraining.com has a wide collection of “training kits” for practicing your rework skills. The “Through Hole and Surface Mount Soldering Assessment Kit” includes a 16-pin SOIC, which is a good stand-in for a n 8-pin SOIC.
• Solder Braid: Chemtronics has a wealth of information and products for solder removal and PCB rework.