Reverse Engineering (Micro) Four Thirds lens protocol

Based on the work of Lasse Bayer, who modified an Olympus lens to attach a logic analyser,
I'm trying to reverse engineer the rest of the Micro 4/3 lens protocol.

I found an interesting macro adapter that sits between mft camera and mft lens and has electrical contacts.
Thus I'm trying to modify this adapter and analyze not only one lens but a large number of combinations of lenses and cameras.

I'm currently working on this.

This blog-posting will be updated all the time!
Here are the logs!

Setup 

 

 

 

Pinout:

VDD=microcontroller power (goes low on lens-release button)
VCC=battery power (possibly for AF-motor,...)

preliminary MFT pinout:

signal	logic analyser cable	logic analyser channel	position
ACK?	BROWN	CH4	Right when Facing the Sensor
ACK?	RED	CH2
Clock	ORANGE	CH3
Data	YELLOW	CH1
Lens2Body?	GREEN	CH0
Body2Lens	BLUE	CH5
	GREY	CH7
???	PINK	CH6
	WHITE	GND
	BLACK	GND
FEHLER(N/C)	---	---	Left when facing the sensor

 

Quote about the 2 additional contacts (from here):

In addition, the lens mount of the Micro Four Thirds System is equipped with two additional signal contacts for smoother Live View shooting with shorter time lags, faster higher communication speeds between the lens and body, and, of course, reduced lens and camera size.
These two contacts will also be used in high-speed data processing required for the movie handling capability expected in the future.

(Image again taken from Lasse Bayer)


SPI seems to be used at 500KHz with 8 bits LSB. Lens2Body and Body2Lens are pulled high by lens or body respectively to indicate that they are ready to receive/send the next byte and pulled low again to acknowledge the receipt.

The camera seems to pull the lines low (including clock) to pause communication.

• when the shutter is pressed
• when exposure has finished 

(confirmed for MFT)

General protocol

Everything seems to start with 4 byte commands sent by the camera to the lens,
followed by the lens answering.

Initial communication 

FT:  B0 F0 00 00  (first command on switch-on)

MFT: B0 F0 00 00 

FT: 

Followed by 2 values: A0 00 

MFT:

Followed by 2 values: 00 00 

Command: request lens data (MFT)

MFT: 80 ED 01 00

TODO: followed by some yet unknown data

Command: request lens data (FT)

FT:  C0 F0 20 00

There is quite a lengthy answer in 26 blocks: 

 Block 0

lens Id
lens designation(ASCII)
lens serial number
lens firmware version
number and length of the following blocks

 TODO : details

Block 1

 May be a list of all focal lengthes in mm - 1

Block 2

unknown

Block 3

unknown

Block 4

unknown

Block 5

unknown

Block 6

unknown

Block 7

unknown

Block 8

unknown

Block 9

unknown

Block 10

unknown

Block 11

unknown

Block 12

unknown

Block 13

unknown

Block 14

unknown

Block 15

unknown

Block 16

unknown

Block 17

unknown

Block 18

unknown

Block19

unknown

Block20

unknown

Block21

unknown

Block22

unknown

Block23

unknown

Block24

unknown

Block24

unknown

Block25

unknown

Block26

unknown

Regular polling (MFT)

 TODO: MFT seems to use multiple, regular polls.

81 E3 04 03
followed by yet unknwn data that does change while not touching the camera.

Regular polling (FT)

C0 F1 0 0 

Apparently the camera polls the lens every 104ms sending these 4 bytes.
The lens answers with 14 bytes including information on the current focus, focus mode, zoom distance, and a checksum.

(I'll insert details here)

Here is what Lasse found out:

 Byte Number:

 1 ,  2 ,  3 ,  4 ,  5 ,  6 ,  7 ,  8 ,  9 ,  10,  11,  12,  13,  14,  15,  16,  17,  18
----------------------------------------------------------------------------------------

    Infinity focus:

192, 241,   0,   0, 177,  11,   0, 160,   0,  31, 255, 255,   2,   5,   0,   0,   0, 196

    Focusing closer:

192, 241,   0,   0, 177,  11,   0, 128,   0,  31,  43,   1,   2,   5,  11,   2,   0, 223
192, 241,   0,   0, 177,  11,   0, 128,   0,  31, 155,   0,   2,   5,  85,   3,   0, 153
192, 241,   0,   0, 177,  11,   0, 128,   0,  31,  87,   0,   2,   5, 121,   5,   0, 123

    Close focus:

192, 241,   0,   0, 177,  11,   0, 144,   0,  31,  78,   0,   2,   5, 254,   5,   0,   7

----------------------------------------------------------------------------------------

Byte 8:   0 - 0000 0000 - Single Autofocus active
        160 - 1010 0000 - Manual Focus @ infinity
        144 - 1001 0000 - Manual Focus @ close-up
        128 - 1000 0000 - Manual Focus in between

Byte 10: Changes linearly while zooming from 31 @ 45mm to 0 @ 14mm

Bytes 11 + 12: FF FF - 65535 - infinity focus
               4E 00 -    78 - close focus
               Focus distance ?

Bytes 13 + 14: Seem to depend on the zoom position at switch-on.
               Do not change while zooming or focusing manually.

Bytes 15 + 16: 00 00 -     0 - infinity focus
               FE 05 -  1534 - close focus
               Focus mechanism position ?

Byte 18: Checksum of Bytes 8 to 17, maybe 7 to 17

The first 4 Bytes are sent from Body to Lens, the remaining 14 from Lens to Body.

Command: Start/Stop exporure (FT)

A0 B0 FE  0  ? stop of exposure ?
A0 B1  0  0  ? start of exposure ?

 TODO: different on MFT

Command: Change Aperture (FT)

Like the polling is a 4 byte sequence, this seems to be 4 byte too.

close aperture: 176  210 xxx xxx
open aperture:  176  215 0   0

 TODO: verify list of epertures

Aperture values as determined by Lasse:

aperture         command
value               data
                   
estimated
                   
1.0               0    0
1.1              85    0
1.2             170    0
1.4               0    1
1.6              85    1
1.8             170    1
2                 0    2
2.2              85    2
2.5             170    2
2.8               0    3
3.2              85    3
3.5             170    3
                   
determined                my own notes:

4                 0    4  (base value for comparison) 
4.5              85    4   (+85 )
5.0             170    4   (+170)
5.6               0    5   (+256)
6.3              85    5
7.1             170    5
8                 0    6
9                85    6
10              170    6
11                0    7
13               85    7
14              170    7
16                0    8
18               85    8
20              170    8
22                0    9

 determined
                   
3.5             157  131     my own notes:
3.6             171  131
3.7             198  131
3.8             211  131
3.9             236  131
4.0             248  131     (base value for comparison) 
4.1              17  132
4.2              28  132
4.3              51  132
4.4              62  132
4.5              84  132     (+77 instead of +85 =-10%)
4.6             106  132
4.7             116  132
4.8             137  132
4.9             156  132
5.0             166  132     (+162 instead of +170 =-5%)
5.1             176  132
5.2             195  132
5.3             213  132
5.4             222  132
5.5             231  132
5.6             249  132     (+257 instead of +256 =+0,4%)

Quote from a camera manufacuter I recently got:

"The electronic feedback from the lens tells the camera where it is in 
regards to f-stop, and the camera then interprets that information." 

Command:  shutdown (MFT)

Sadly the shutdown sequence seems to use different commands.
No clear command sequence to see yet.

-->

14-42PZ	14-42PZ	14-42PZ		14mm	14mm	14mm	14mm
23,89ms	12,32ms	32,09ms		14,06ms	29,83ms	21,92ms	23,86ms
SDO: A1 D7 00 00 11 05 7D 07	SDO: F1 CF 00 00 11 05 7D 07	SDO: B1 D7 00 00 11 05 7D 07		SDO: 31 CF 00 00 08 04 3F 02	SDO: 31 C7 00 00 08 02 BF 00	SDO: 21 9E 00 00 00 00 3F 00	SDO: F0 9E 00 00 80 00 BE 06
SDI: A1 D7 00 00 11 05 7D 07	SDI: F1 CF 00 00 11 05 7D 07	SDI: B1 D7 00 00 11 05 7D 07		SDI: 31 CF 00 00 08 04 3F 02	SDI: 31 C7 00 00 08 02 BF 00	SDI: 21 9E 00 00 00 00 3F 00	SDI: F0 9E 00 00 80 00 BE 06
lens folding up...	lens folding up...	lens folding up...
716,8ms	705,43ms	725,16ms		336,96ms	352,76ms	344,85ms	346,89ms
SDO: 42 FF 07 00 C6 16 02 00	SDO: 62 FD 03 00 C6 16 02 00	SDO: 42 FF 03 00 C6 16 02 00		SDO: E2 FF 07 00 60 08 00 00	SDO: 62 FF 03 00 C2 12 00 00	SDO: 42 FE 07 00 C0 10 00 00	SDO: E0 FF 07 00 C0 10 00 00
SDI: 42 FF 07 00 C6 16 02 00	SDI: 62 FD 03 00 C6 16 02 00	SDI: 42 FF 03 00 C6 16 02 00		SDI: E2 FF 07 00 60 08 00 00	SDI: 62 FF 03 00 C2 12 00 00	SDI: 42 FE 07 00 C0 10 00 00	SDI: E0 FF 07 00 C0 10 00 00
790,6ms	761,32ms	794,78ms		393,21ms	414,12ms	370,9ms	384,84ms
SDO: 7C 31 10	SDO: 7C 31 10	SDO: 7C 31 10		SDO: E0 00 08	SDO: C0 00 0C	SDO: E0 00 18	SDO: E0 00 18
SDI: 7C 31 10	SDI: 7C 31 10	SDI: 7C 31 10		SDI: E0 00 08	SDI: C0 00 0C	SDI: E0 00 18	SDI: E0 00 18
VDD going low	VDD going low	VDD going low		VDD going low	VDD going low	VDD going low	VDD going low

 

I also looked at this on the Blackmagic Pocket Cinema Camera...
not only does the #BMPCC not send the proper lens shutdown sequence, it also has some really bad noise on the VDD line while being switched off. 

Command: prepare for shutdown (FT)

176 160   0   0         prepare for shutdown

 TODO: verify 

Command: focus

176 161 xxx xxx  change focus to/by value
176 173   0   0  start single autofocus

 TODO: verify 

 Other commands

192 241   0   0  poll
192 246   0   0  ?(sent after initial command and before requesting the full lens data))

192 250 xxx xxx  ?
192 251   0   0  ?

  TODO: analyse these

• Previous work
• 30C3 project page  
• Arduino SPI library (Master only) 
• Existing thread about the pinout (photo)
• Photos (coming soon)
• Similar adapter for Canon EF
• Attempt to decode Canon EF (German)
• Magic Lantern lens.h (for comparison to identify similarly coded values) 
• Microcontroller rig to mount Canon lenses to Sony cameras