EOS Lens protocol analyse - anybody intresting?

[ASalina]

thanks ! It looks like the battery grip uses 2*6 of 2*8 pins.

If someone has a BG-E3 and a volt meter they could trace out which pins are connected to the buttons on the grip. The ones that are not should be the serial debug port pins. You can buy cheap replicas of the BG-E3 on Ebay, etc. Running test leads out from the pins on one of those should be fairly easy. Then they can be monitored with an oscilloscope or DVM.

[_MAG_]

Like for me pins in BG-E3 and others directly connected to pins in main CPU.
In service manual from 300D i dont found info about that contacts

[ruevs]

Well the battery compartment contacts in the 5D 20D 30D 40D must be be a LOT more than just a simple RS232 debugging/service port. Look at this:
Jenis battery grip adds more than just power  - Digital Cameras - Crave - CNET Asia

A betery grip with extra CompactFlash compartments!

[roli_bark]

Hi,
This is a nice project ! Many kudos to the OP.

The real challenge is to reverse engineer the Lens Chipset (controller) Registers Address Map. Some registers (among other) contain the lens Calibration Parameters.

Many of us, avid photograper hobbies, are aware of frequent Canon Lens focus accuracy issues. If the protocol is reversed, lens re-calibration may be done as a home project.

[victor]

Would you please to share the log you collected by the NULL cable with us? It will be very useful.

I found some info about lens request. They transmit:
lens name (255 symbols)    - example "Canon 28-80" (i not fully sure about example but lens name transmited first)
----- i not sure about order of this info-------
minimal focus distance        - example "28"         from 00 00 to FF FF
maximax focus distance      - example "80"
current  focus distance        - example "35"
minimal aperture (on this angle???) - "3,5"   maybe from 1 to 64 in dec. 2 bytes. (for transmit aperture like 5,6)
maximal aperture

if minimal focus distance = maximax focus distance = current  focus distance - lens determines like fix focal. Else like zoom
if minimal aperture = maximal aperture - body dont send command for close or open aperture

[_MAG_]

all this info i got from IXBT forum. I not sure about safety of my cable. I dont use him.
I close my seaching becouse Seklth say me:
focus and focus confirmation - it is stand-alone module. All info to this stand-alone module transfered by digits. All what firmware do - send comand to this module. What this command do, their lenght.. and all others  is uknown.

Now i working to remowe all unwanted parts from my kit. yesterday i found small part - their closing contacts and limits maximal aperture while you use zoom.
So if remove this part and close contact manualy you  receive zoom with maximal stable aperture 3,5.
Maybe canon do this becouse  80 zoom and 3,5 aperture give big cromation and distorsium - i dont know, i cant re-assemble my kit lens.

[hash]

Hello all, I also want to decrypt canon's eos lens protocol for the sole purpose of mounting non-af lenses over special adapters (like M42-EOS). I think that activating the AF-assist via firmware or chdk is the best option because emulating a real lens is very hard (even sigma had problems with some early lenses because of bad reverse engineering).

For some days now I've been trying to get a good look of how the protocol works, but unfortunately hadn't had the necessary tools. I'm probing a 'dandelion' chip from a russian M42-EOS adapter with focus assist which i've connected to a very basic logic analyser.

The analyser is microchip's PicKit 2 uC programmer and it's very limited, with only 1000 samples. From the data I've collected so far (basically pictures of the waveforms since it doesn't have the advanced data-saving and analysing capabilities of REAL logic analysers) it seems that there's an initial chatter between the lens and the body when they're first connected and also when the shutter button is half-pressed. The communication lasts for a couple of SECONDS (at least when the shutter is half pressed), so I can't fully record it.

If any of you are interested to see some of these waveforms... I'll post them, but frankly I don't see how they'll help anyone. As I've stated before, the activation of AF over firmware seems to be the best option given the complexity of doing a hardware emulation.

Cheers

[_MAG_]

Try to connect OLD canon lens if you have it. Old lens have older protocol with smaller speed.
I sink you see something like "respond".
Analyse this chip this chip is easier way becouse this chip emulate fix-focal lens (45 mm??) with  constant apperture (1.4 ??) in manual focus mode.
I sink need big digital analyser becouse need measure 3 pins simultaneously.
Example (i sink happen somthing like this):
data clock set some value (it is command to chip ready to get data (lens))
data thasfer from body to lens (request id?)
data clock set another value (ready to  get data from lens)
data thasfer from lens to body (lens name, id and outher)
body activate focus confirm

[hash]

Well, the logic analyzer has 3 inputs but the problem is that its buffers is not large enough. I'm attaching the output from the lens-body comm when the shutter button is half-pressed.

The waveforms are in this order:

LENS->BODY
BODY->LENS
CLOCK

As you can see, the logic levels are inverted (they stay on 5V all the time) and when something happens, the body signals the lens to begin communication. I don't know what protocol is this, the clock signal is somewhat weird, but it does transmit 8bit commands. Sometimes the body and the lens transmit at the same time... I don't know why is that. These images would be useful for someone who has experience in this area, but again, they're only a fraction of the data sent.

There are 4 windows in this image (I used the 'delay sampling' command, thus the data is continous) and each one is 4ms long, sampled at 250KHz (there is some aliasing present, this would be prevented by sampling at 1MHz or more).

Hope this helps

[victor]

hash, would you please to share with us on how did you connect the logic analyser and the mount? I have a high-end logic anaylzer to record the large amount of samples, and try to capture the data communications between a Canon 300D body and a EF-S lens.

[hash]

[_MAG_]

If you have broken lens you can dismount rear part and connect directly to pins by cable (see eos_adapter.jpg). Original canon lens have small holes (for debug?) in pins (rear part of lens)

[dzsemx]

The analyser is microchip's PicKit 2 uC programmer and it's very limited, with only 1000 samples. From the data I've collected so far (basically pictures of the waveforms since it doesn't have the advanced data-saving and analysing capabilities of REAL logic analysers) it seems that there's an initial chatter between the lens and the body when they're first connected and also when the shutter button is half-pressed. The communication lasts for a couple of SECONDS (at least when the shutter is half pressed), so I can't fully record it.

last year i made an aquisition board type application with the pickit2 programmer,
using CDC mode (serial port emulated), with transfer rate of around 12000 samples/sec on two channels.
needs no external components if you work within 0-5 volts on the inputs.
the pc application can only shows the waveform at (almost) realtime, but it's quite easy to write a funtion to save the transfer bufffer into a file... do you need it?

[hash]

What's the sample data rate on that? If it's equal to the transfer rate, then I'm afraid 12000 samples/sec won't do the job. The waveforms I posted are at 250Ks/s and there's some aliasing on those so I reckon a minimum of 500k-1Ms/s will be needed.

[dzsemx]

well with analogic data i reached this transfer/sample rate (internal ADC has about max 60 ksample/sec)
with external ADC theoretically i can reach above 200ksample/sec with reduced resolution.
with digital inputs 500 ksample is posssible but never tried (need to write really lightweigth interrupt routine)