Tales of a modern life: 2013-12

This is the second time I fried 2 FMD2749A stepper drivers on my TravelCNC.

Made 2 giant Hackcenter calls at the 30C3 hacker congress stink of fried electronics while the people from CCCfr ripped out all power cables they could find, called me and got a fire extinguisher.

The drivers are advertised to be operated at up to 50V.

The first one had a 5V DC converter (LM2576S-5.0) inside that is only rated up 45V instead of an " LM2576HVS-5.0" rated up to 60V.

I'm using them with a common 48V power supply. Well within the rating of the dealer.

Now, after 3 fried stepper drivers the dealer "Thomas Wu" answered that the drivers where actually only good for 45V!!!

I wouldn't ever but any power electronics from this Thomas Wu guy on Aliexpress again!

I turned down the power supply to 44.5V (can't go lower then that on the potentiometer)

and am waiting for some new 5A drivers with over-current, over-heating, under-current,... protection.

One of these drivers is working fine at 48V driving the super-strong 4th axis, so I hope they will hold up.

Based on the work of Lasse Bayer, who modified an Olympus lens to attach a logic analyser,
I'm trying to reverse engineer the rest of the Micro 4/3 lens protocol.

I found an interesting macro adapter that sits between mft camera and mft lens and has electrical contacts.
Thus I'm trying to modify this adapter and analyze not only one lens but a large number of combinations of lenses and cameras.

I'm currently working on this.

This blog-posting will be updated all the time!
Here are the logs!

Setup

Pinout:

VDD=microcontroller power (goes low on lens-release button)
VCC=battery power (possibly for AF-motor,...)

preliminary MFT pinout:

signal	logic analyser cable	logic analyser channel	position

ACK?	BROWN	CH4	Right when Facing the Sensor
ACK?	RED	CH2
Clock	ORANGE	CH3
Data	YELLOW	CH1
Lens2Body?	GREEN	CH0
Body2Lens	BLUE	CH5
	GREY	CH7
???	PINK	CH6
	WHITE	GND
	BLACK	GND
FEHLER(N/C)	---	---	Left when facing the sensor

Quote about the 2 additional contacts (from here):

In addition, the lens mount of the Micro Four Thirds System is equipped with two additional signal contacts for smoother Live View shooting with shorter time lags, faster higher communication speeds between the lens and body, and, of course, reduced lens and camera size.
These two contacts will also be used in high-speed data processing required for the movie handling capability expected in the future.

(Image again taken from Lasse Bayer)

SPI seems to be used at 500KHz with 8 bits LSB. Lens2Body and Body2Lens are pulled high by lens or body respectively to indicate that they are ready to receive/send the next byte and pulled low again to acknowledge the receipt.

The camera seems to pull the lines low (including clock) to pause communication.

when the shutter is pressed

when exposure has finished

(confirmed for MFT)

General protocol

Everything seems to start with 4 byte commands sent by the camera to the lens,
followed by the lens answering.

Initial communication

FT:  B0 F0 00 00  (first command on switch-on)

MFT: B0 F0 00 00

FT:

Followed by 2 values: A0 00

MFT:

Followed by 2 values: 00 00

Command: request lens data (MFT)

MFT: 80 ED 01 00

TODO: followed by some yet unknown data

Command: request lens data (FT)

FT:  C0 F0 20 00

There is quite a lengthy answer in 26 blocks:

Block 0

lens Id
lens designation(ASCII)
lens serial number
lens firmware version
number and length of the following blocks

TODO : details

Block 1

May be a list of all focal lengthes in mm - 1

Block 2

unknown

Block 3

unknown

Block 4

unknown

Block 5

unknown

Block 6

unknown

Block 7

unknown

Block 8

unknown

Block 9

unknown

Block 10

unknown

Block 11

unknown

Block 12

unknown

Block 13

unknown

Block 14

unknown

Block 15

unknown

Block 16

unknown

Block 17

unknown

Block 18

unknown

Block19

unknown

Block20

unknown

Block21

unknown

Block22

unknown

Block23

unknown

Block24

unknown

Block24

unknown

Block25

unknown

Block26

unknown

Regular polling (MFT)

TODO: MFT seems to use multiple, regular polls.

81 E3 04 03
followed by yet unknwn data that does change while not touching the camera.

Regular polling (FT)

C0 F1 0 0

Apparently the camera polls the lens every 104ms sending these 4 bytes.
The lens answers with 14 bytes including information on the current focus, focus mode, zoom distance, and a checksum.

(I'll insert details here)

Here is what Lasse found out:

 Byte Number:

 1 ,  2 ,  3 ,  4 ,  5 ,  6 ,  7 ,  8 ,  9 ,  10,  11,  12,  13,  14,  15,  16,  17,  18
----------------------------------------------------------------------------------------

    Infinity focus:

192, 241,   0,   0, 177,  11,   0, 160,   0,  31, 255, 255,   2,   5,   0,   0,   0, 196

    Focusing closer:

192, 241,   0,   0, 177,  11,   0, 128,   0,  31,  43,   1,   2,   5,  11,   2,   0, 223
192, 241,   0,   0, 177,  11,   0, 128,   0,  31, 155,   0,   2,   5,  85,   3,   0, 153
192, 241,   0,   0, 177,  11,   0, 128,   0,  31,  87,   0,   2,   5, 121,   5,   0, 123

    Close focus:

192, 241,   0,   0, 177,  11,   0, 144,   0,  31,  78,   0,   2,   5, 254,   5,   0,   7

----------------------------------------------------------------------------------------

Byte 8:   0 - 0000 0000 - Single Autofocus active
        160 - 1010 0000 - Manual Focus @ infinity
        144 - 1001 0000 - Manual Focus @ close-up
        128 - 1000 0000 - Manual Focus in between

Byte 10: Changes linearly while zooming from 31 @ 45mm to 0 @ 14mm

Bytes 11 + 12: FF FF - 65535 - infinity focus
               4E 00 -    78 - close focus
               Focus distance ?

Bytes 13 + 14: Seem to depend on the zoom position at switch-on.
               Do not change while zooming or focusing manually.

Bytes 15 + 16: 00 00 -     0 - infinity focus
               FE 05 -  1534 - close focus
               Focus mechanism position ?

Byte 18: Checksum of Bytes 8 to 17, maybe 7 to 17

The first 4 Bytes are sent from Body to Lens, the remaining 14 from Lens to Body.

Command: Start/Stop exporure (FT)

A0 B0 FE  0  ? stop of exposure ?
A0 B1  0  0  ? start of exposure ?

TODO: different on MFT

Command: Change Aperture (FT)

Like the polling is a 4 byte sequence, this seems to be 4 byte too.

close aperture: 176  210 xxx xxx
open aperture:  176  215 0   0

TODO: verify list of epertures

Aperture values as determined by Lasse:

aperture         command
value               data
                   
estimated
                   
1.0               0    0
1.1              85    0
1.2             170    0
1.4               0    1
1.6              85    1
1.8             170    1
2                 0    2
2.2              85    2
2.5             170    2
2.8               0    3
3.2              85    3
3.5             170    3
                   
determined                my own notes:

4                 0    4  (base value for comparison) 
4.5              85    4   (+85 )
5.0             170    4   (+170)
5.6               0    5   (+256)
6.3              85    5
7.1             170    5
8                 0    6
9                85    6
10              170    6
11                0    7
13               85    7
14              170    7
16                0    8
18               85    8
20              170    8
22                0    9

 determined
                   
3.5             157  131     my own notes:
3.6             171  131
3.7             198  131
3.8             211  131
3.9             236  131
4.0             248  131     (base value for comparison) 
4.1              17  132
4.2              28  132
4.3              51  132
4.4              62  132
4.5              84  132     (+77 instead of +85 =-10%)
4.6             106  132
4.7             116  132
4.8             137  132
4.9             156  132
5.0             166  132     (+162 instead of +170 =-5%)
5.1             176  132
5.2             195  132
5.3             213  132
5.4             222  132
5.5             231  132
5.6             249  132     (+257 instead of +256 =+0,4%)

Quote from a camera manufacuter I recently got:

"The electronic feedback from the lens tells the camera where it is in 
regards to f-stop, and the camera then interprets that information."

Command: shutdown (MFT)

Sadly the shutdown sequence seems to use different commands.
No clear command sequence to see yet.

-->

14-42PZ	14-42PZ	14-42PZ	14mm	14mm	14mm	14mm


23,89ms	12,32ms	32,09ms	14,06ms	29,83ms	21,92ms	23,86ms
SDO: A1 D7 00 00 11 05 7D 07	SDO: F1 CF 00 00 11 05 7D 07	SDO: B1 D7 00 00 11 05 7D 07	SDO: 31 CF 00 00 08 04 3F 02	SDO: 31 C7 00 00 08 02 BF 00	SDO: 21 9E 00 00 00 00 3F 00	SDO: F0 9E 00 00 80 00 BE 06
SDI: A1 D7 00 00 11 05 7D 07	SDI: F1 CF 00 00 11 05 7D 07	SDI: B1 D7 00 00 11 05 7D 07	SDI: 31 CF 00 00 08 04 3F 02	SDI: 31 C7 00 00 08 02 BF 00	SDI: 21 9E 00 00 00 00 3F 00	SDI: F0 9E 00 00 80 00 BE 06

lens folding up...	lens folding up...	lens folding up...
716,8ms	705,43ms	725,16ms	336,96ms	352,76ms	344,85ms	346,89ms
SDO: 42 FF 07 00 C6 16 02 00	SDO: 62 FD 03 00 C6 16 02 00	SDO: 42 FF 03 00 C6 16 02 00	SDO: E2 FF 07 00 60 08 00 00	SDO: 62 FF 03 00 C2 12 00 00	SDO: 42 FE 07 00 C0 10 00 00	SDO: E0 FF 07 00 C0 10 00 00
SDI: 42 FF 07 00 C6 16 02 00	SDI: 62 FD 03 00 C6 16 02 00	SDI: 42 FF 03 00 C6 16 02 00	SDI: E2 FF 07 00 60 08 00 00	SDI: 62 FF 03 00 C2 12 00 00	SDI: 42 FE 07 00 C0 10 00 00	SDI: E0 FF 07 00 C0 10 00 00


790,6ms	761,32ms	794,78ms	393,21ms	414,12ms	370,9ms	384,84ms
SDO: 7C 31 10	SDO: 7C 31 10	SDO: 7C 31 10	SDO: E0 00 08	SDO: C0 00 0C	SDO: E0 00 18	SDO: E0 00 18
SDI: 7C 31 10	SDI: 7C 31 10	SDI: 7C 31 10	SDI: E0 00 08	SDI: C0 00 0C	SDI: E0 00 18	SDI: E0 00 18

VDD going low	VDD going low	VDD going low	VDD going low	VDD going low	VDD going low	VDD going low

I also looked at this on the Blackmagic Pocket Cinema Camera...
not only does the #BMPCC not send the proper lens shutdown sequence, it also has some really bad noise on the VDD line while being switched off.

Command: prepare for shutdown (FT)

176 160   0   0         prepare for shutdown

 TODO: verify

Command: focus

176 161 xxx xxx  change focus to/by value
176 173   0   0  start single autofocus

 TODO: verify

Other commands

192 241   0   0  poll
192 246   0   0  ?(sent after initial command and before requesting the full lens data))

192 250 xxx xxx  ?
192 251   0   0  ?

TODO: analyse these

Previous work
30C3 project page
Arduino SPI library (Master only)
Existing thread about the pinout (photo)
Photos (coming soon)
Similar adapter for Canon EF
Attempt to decode Canon EF (German)
Magic Lantern lens.h (for comparison to identify similarly coded values)
Microcontroller rig to mount Canon lenses to Sony cameras

2013-12-29

Fried 2 other FMD2740A stepper drivers

2013-12-11

Reverse Engineering (Micro) Four Thirds lens protocol

Setup

Pinout:

preliminary MFT pinout:

<!-- br {mso-data-placement:same-cell;}

General protocol

Initial communication

Command: request lens data (MFT)

Command: request lens data (FT)

Block 0

Block 1

Block 2

Block 3

Block 4

Block 5

Block 6

Block 7

Block 8

Block 9

Block 10

Block 11

Block 12

Block 13

Block 14

Block 15

Block 16

Block 17

Block 18

Block19

Block20

Block21

Block22

Block23

Block24

Block24

Block25

Block26

Regular polling (MFT)

Regular polling (FT)

Command: Start/Stop exporure (FT)

Command: Change Aperture (FT)

Command: shutdown (MFT)

<!-- br {mso-data-placement:same-cell;}

Command: prepare for shutdown (FT)

Command: focus

Other commands