FAQ FAQ  Forum Search   Events   Register Register  Login Login

Discovering the flash protocol (long)

Author
sebi View Drop Down
Newbie
Newbie

Joined: 26 September 2006
Location: Germany
Status: Offline
Posts: 20
Post Options Post Options   Quote sebi Quote  Post ReplyReply Direct Link To This Post Topic: Discovering the flash protocol (long)
    Posted: 14 November 2006 at 12:59
Hello,

as I wrote on some topics, Iīm about to develop an adaptor to use older non-D flashes with digital cameras. Doing so I discovered parts of the digital protocol used to communicate between flash and body. However, some parts still remain strange to me. So I will share my findings and hope some of you can contribute or make suggestions for the interpretation of the bytes.

1) General protocol informations

Note: all signals are TTL-compatible (5V)

The protocol uses a unidirectional clock line (signal F3 in service manuals) which is always driven by the cam. This line selects the command mode and clocks out/in the data bits. The data line (signal F2) is bidirectional. Mode is selected by various high-times of the high-active clock signal:

- data bit clock puse: 40us high, 40us low
- read command/preflash: 90us high, 300us low
- write command: 170us high, 300us low
- announce flash: 270us high, >= 13ms low

The protocol consists of 9 (analog) or 11 (digital) bytes. Each read/write sequence is started by a read or write clock cycle. After each byte thereīs a pause of 200us. Bytes are sent LSB first, 8 bits. A complete read transmission looks like this:
- clock high for 90us
- clock low for 300us -> cam will now read on data line
- clock high for 40us, then low for 40us; the data is sampled on the high->low edge
- previous step is repeated 8 times to get 8 bits
- clock is held low for 200us
- next byte is transmitted by setting clock high/low for 40us each
- ...steps 3 to 5 repeated 9(analog) or 11(digital) times to get the data bytes

Write cycle is the same, but it starts with clock high for 170us, the cam then drives data line to put out data.

The cam will send a read sequence first to get information about the flash. The flash indicator only lights when a compatible flash is detected.

The preflash is triggered when the flash receives a "announce flash" (270us high) and then a "read command" (90us high) within 13ms. Main flash is triggered by pulling flash fire (signal F1) low. For exact timing there has to be a "announce flash" command within some ms before the firing (time not critical). Flash is stopped by setting clock high. Minimum flash time is about 30ms on 5400 series flashes - enough for pre-flash (about 140ms before main flash).

2) Data bytes sent by flash
1. byte - flash capabilities
values: 0x0f, 0x2f, 0x3f
0x0f is sent by 5400xi flash and indicates no HSS (bit 5) and no ADI (bit 4, unsure) capabilities
0x2f is sent by 5400HS - HSS (+), ADI (-)
0x3f - sent by 5600, HSS (+), ADI (+)

2. byte - ?
The value is always 0xf9. If changed, the flash is no longer recognized by cam.

3.-5. byte - zoom reflector position (?)
If the reflector is in bounce position, the bytes are 0xff each. For various zoom settings youīll get:
0xe3, 0xe2, 0xce - 17mm (5600HS with wide angle diffusor)
0xea, 0xe9, 0xd5 - 24mm
0xeb, 0xea, 0xd6 - 28mm
0xec, 0xeb, 0xd7 - 35mm
0xee, 0xed, 0xd9 - 50mm
0xef, 0xee, 0xda - 70mm on 5600HS, 85mm on 5400HS
0xe0, 0xff, 0xdb - 105mm on 5400HS

6. byte
always 0xff

7. byte
Seems to be a exposure correcting value; setting to wrong value will lead to overexposed pictures. This is different on 5400/5600 flashes
5600:
0x94 - 17mm
0x97 - 24mm
0x98 - 28mm
0x99 - 35mm
0x9b - 85mm
0xbf - bounce
5400hs:
0xae - 24mm
0xb0 - 28mm
0xb1 - 35mm
0xb3 - 50mm
0xb4 - 70mm
0xb5 - 85mm
0xb6 - 105mm
0xbf - bounce

The 5600 values have bits 0-5 shiftet right compard to the 5400. Donīt know why...

8. byte
0xf7 - mounted on cam, no bounce reflector position
0xf3 - not mounted on cam
0xff - bounce position

9. byte
0x50 - default value on 5600HS
0x52 - default value on 5400HS
Bits 3 and 4 contain the wireless channel: 00: ch 1, 01: ch 2, 10: ch 3, 11: ch 4)
Meaning of bit 1 not discovered so far.

10.byte
0x3f - 5400hs, always
5600:
0x04 - 17mm
0x05 - 24mm
0x07 - 35mm
0x08 - 50mm
0x09 - 70mm
0x09 - 85mm
0x3f - bounce

11. byte
0x7b - 5600HS
0x8a - 5400hs

3) Data bytes sent by cam
1.-3. byte
As Matthias Paul discovered, these bytes contain aperture, ISO/program mode and zoom setting. The values are described on this page (sorry, german only, but the tables contain numbers only ;-)) The encoding is the same used for lens rom data.

4.-7. byte
0xff, 0xae, 0x7d, 0x40 - no changes, unclear

[edit]5. byte - af illuminator
0xae - illuminator off
0xbe - illuminator on
6. byte HSS
0x7d - no HSS
0xfd - hss
This byte is used by cam to tell the flash if the pending flash should be normal or HSS.
[/edit]


8. byte
0xc0 - Dynax 7D
0x80 - Sony Alpha, Dimage
unclear

9. byte
0xff / 0xef, appears random, unclear

10. byte
after fired preflash: flash duration
DSLR set bits 7&6, Dimage clears 7&6
Bits 0-6 contain time information. Upper and lower 32 values are swapped:
shortest - 0x20...0x3f, 0x00...0x1f - longest
(values given with 6 & 7 cleared, if set, gives 0xe0...0xff, 0xc0...0xdf)

Bytes not sent directly after preflash are
0x00 - Sony alpha, Dimage
0x7c - Dynax 7D, 5D


[edit]
11. byte - shutter speed
0xc0 - Dynax, after preflash (i.e., with valid time info)
0x80 - Dimage, "shutter speed donīt care"
no-HSS:
0xc0 - >=2s, 0xc1 - 1,6s, 0xc2 - 1,3s, 0xc4 - 1s, 0xc5 - 0,8s, 0xc6 - 0,6s, 0xc8 - 0,5s....0xde - 1/100s, 0xe0 - 1/125s, 0xe1 - 1/160s

HSS:
0x61 - 1/160s, 0x62 - 1/200s, 0x64 - 1/250s....0x74 - 1/4000s
[/edit]


Well, thatīs all I decoded so far. If youīre intrested in building the adaptor, see www.voitzsch.net/flashconv.html for further details. Youīll find a schematic based on ATtiny13 and the actual source code to program it. Adaptor works best with 7D in combination with either 5400HS or XI flash. Thereīs basic support for 5D, alpha and Dimage (i.e., pre- and mainflash is fired, but exposure may vary and not always accurate).

Hope we can discover the complete protocol to build adaptors for complete support for all cameras.

Cheers,
Sebi

Edited by sebi - 16 November 2006 at 20:40
 



Back to Top
Remko View Drop Down
Senior Member
Senior Member

Joined: 25 June 2006
Country: Netherlands
Location: ZH
Status: Offline
Posts: 797
Post Options Post Options   Quote Remko Quote  Post ReplyReply Direct Link To This Post Posted: 16 November 2006 at 16:13
Hi Sebi :)

I appreciate the wonderful work you did in this so far. ;) I hope to acquire an adapter kit from you some day.
But at the moment, how can we help you getting more data? Is there an easy way, for example through EXIF-readings, or do we have to take our flashes apart?

I have some of the Minolta system flashes (3/5600, 5200i and a 3500xi), a wireless flash controller (which doesnot work on the newer Dynax (d) bodies), and a few older bodies (700si, 8000i), next to my 5d.
As I drew the right conclusion, your kit should already work with the 3500xi? For the 3/5600 the adaptor is not needed, and for the 5200i something should be done concerning TTL-signalling, right?

Is there anyway to help you?
Minolta / Dynax / Sony Alpha / NEX
A creative mind.
Back to Top
sebi View Drop Down
Newbie
Newbie

Joined: 26 September 2006
Location: Germany
Status: Offline
Posts: 20
Post Options Post Options   Quote sebi Quote  Post ReplyReply Direct Link To This Post Posted: 16 November 2006 at 20:31
Hi Remko,

as for the 3500xi: donīt know. When working with various flashes (5400HS/XI, 5200i so far) I learned that Minolta always changed a little bit to make work little more difficult. For instance, 7D sends flash time info with 5400 series without any modification; with 5D/Dimage/Alpha you have to change some bits in the flash output to make it work. Never had a 3500xi to test out.

To log the data youīll have to connect the four contacts of the hot shoe to either the parallel port (a) or a special data logger (b). As the flash has to be mounted too the best way is indeed to open up the flash and solder wires to the hot shoe contacts.

a) Parallel connection
First I simply connected the three signals (and GND) to the parallel port of my computer and took "the fabulous logic analyzer" tfla-01 to log the data. Unfortunately tfla-01 isnīt able to convert lows and highs to data bytes, so it means counting then... Now I only use this connection to get an idea of the timing (read/write distinction, preflash, announce signals).

b) data logger
So I needed to have a proper logger. I took an ATmega8 and programmed it so it can be connected to the flash direclty. On the other side you connect a PC via RS232 (38400 bauds). All data between cam and flash will be sent to a console terminal. The logger will capture 22 bytes (11 flash->cam, 11 cam->flash), converts them to hex and prints them out comma-separated. Identical packets are ignored.

Schematics
Software source

The schematics is just a ATmega8 connected to a MAX232, with direct connection to the flash/cam.

Best help would be a combination of logs and ideas on how to interpret the data. Some things are obvious (when turning from P->A and back a byte toggles - not difficult to guess...), some not. Some things are cam or flash specific...

Sebi
Back to Top
Fuzzphoto View Drop Down
Senior Member
Senior Member

Joined: 04 April 2006
Country: Netherlands
Status: Offline
Posts: 2429
Post Options Post Options   Quote Fuzzphoto Quote  Post ReplyReply Direct Link To This Post Posted: 17 November 2006 at 08:35
You did great work, sebi. I love this kind of stuff. I wish I had the time to assist.

But have you considered what Sony thinks about this? You're publishing a (probably proprietary) protocol they own, and if they're not happy about that, which I think is the case, they could issue a "cease and desist" order.

Reverse engineering is completely legal (Sigma does it to their great advantage), but publishing the results is probably pushing it...
Joris' Fuzzphoto gallery | A700+VG, NEX-5 and other gear
Back to Top
sebi View Drop Down
Newbie
Newbie

Joined: 26 September 2006
Location: Germany
Status: Offline
Posts: 20
Post Options Post Options   Quote sebi Quote  Post ReplyReply Direct Link To This Post Posted: 17 November 2006 at 10:00
Hi Fuzzbass,

considered this but donīt think itīs too risky to publish the informations. First, I have no contract with Sony or (Konica-)Minolta telling me I must not discover their protocols (this is a big difference from software, most software producers have such prohibitions in their EULAs). Second, I did not use any software or tools from these firms nor am I disassembling flash or camera firmware. Iīm only sharing my knowledge and no confidential papers Sony gave to me. So I think itīs completely legal, both discovering and publishing the informations.

Furthermore, there are other sites dealing with similiar topics (see lens rom thread herein, Michael Hohners site about wireless protocol and flash timings - which btw. helped a lot, thanks to Michael!) and to my knowledge nobody ever had trouble with at least Minolta so far. Pete Ganzel sold complete service manuals...

Thanks for your warning as well.

Sebi
Back to Top
MojoRick View Drop Down
Senior Member
Senior Member

Joined: 16 December 2005
Location: United States
Status: Offline
Posts: 589
Post Options Post Options   Quote MojoRick Quote  Post ReplyReply Direct Link To This Post Posted: 31 December 2006 at 07:13
Sebi,

Interesting work you have figured out. Kind of like a puzzle. Keep us up to date on your progress.

Have a Happy New Year,

Thanks,

Rick
Rick
 



Back to Top
sebi View Drop Down
Newbie
Newbie

Joined: 26 September 2006
Location: Germany
Status: Offline
Posts: 20
Post Options Post Options   Quote sebi Quote  Post ReplyReply Direct Link To This Post Posted: 31 December 2006 at 12:18
Rick,

just to keep you up-to-date:

the software works with 5D and 7D, flashes are 5400HS, 5400XI, 5200i (without wireless, found no suitable receiver so far), 3500xi. Best support is for 7D - as thatīs the cam I have. Alpha may come soon.

The next step will be to use the HSS-mode preflash for HS models, I expect one version to work with all cams then. Maybe HSS support is added too, donīt know.

For now there are about 30 modified flashes "in the wild" (mostly 5400, some 5200i and one 3500xi), all operating correctly. Some minor exposure glitches with 5D, but all within the +/- 2EV correction.

Cheers,
Sebastian

Back to Top
Tony View Drop Down
Newbie
Newbie

Joined: 08 January 2007
Status: Offline
Posts: 1
Post Options Post Options   Quote Tony Quote  Post ReplyReply Direct Link To This Post Posted: 09 January 2007 at 01:58
Dear Sebi,
             Thanks for your work.
      I like this DIY work very much.
      My 5400HS will be reborn soon.
      

Tony
Back to Top
martt View Drop Down
Newbie
Newbie

Joined: 19 February 2007
Status: Offline
Posts: 1
Post Options Post Options   Quote martt Quote  Post ReplyReply Direct Link To This Post Posted: 28 February 2007 at 16:57
Hi Sebi! Anythink new in your work? What about HSS for 5400HS? The same program for 5D and 7D will be also super.
Back to Top
Alain View Drop Down
Senior Member
Senior Member

Joined: 14 October 2005
Location: Belgium
Status: Offline
Posts: 354
Post Options Post Options   Quote Alain Quote  Post ReplyReply Direct Link To This Post Posted: 17 March 2007 at 21:56
Hi

Have you thought about making a flash trigger which "automagicaly" ignores the 7(?) preflashes and also does dat when using wireless.

See

Cheap secondary wireless flash

for some background.

BTW. It could be made as a nice kit, either with a simple classic hotshoe or with a pc-sync contact.


ALain
Back to Top
sebi View Drop Down
Newbie
Newbie

Joined: 26 September 2006
Location: Germany
Status: Offline
Posts: 20
Post Options Post Options   Quote sebi Quote  Post ReplyReply Direct Link To This Post Posted: 17 March 2007 at 22:33
Hi Alain,

I never thought about that, however it will be possible using the adaptor. But you need a suitable wireless receiver.

Think an adjustable optical flash trigger would be a better solution.

Sebi
Back to Top
Alain View Drop Down
Senior Member
Senior Member

Joined: 14 October 2005
Location: Belgium
Status: Offline
Posts: 354
Post Options Post Options   Quote Alain Quote  Post ReplyReply Direct Link To This Post Posted: 17 March 2007 at 22:41
Originally posted by sebi sebi wrote:

Hi Alain,

I never thought about that, however it will be possible using the adaptor. But you need a suitable wireless receiver.

Think an adjustable optical flash trigger would be a better solution.

Sebi


"an adjustable optical flash trigger" --> Already seen one? Maybe it's simpler than decoding, let's hope the one that sooter found works.


Alain
Back to Top
Alain View Drop Down
Senior Member
Senior Member

Joined: 14 October 2005
Location: Belgium
Status: Offline
Posts: 354
Post Options Post Options   Quote Alain Quote  Post ReplyReply Direct Link To This Post Posted: 18 March 2007 at 00:34
Originally posted by sebi sebi wrote:

Hi Alain,

I never thought about that, however it will be possible using the adaptor. But you need a suitable wireless receiver.

Think an adjustable optical flash trigger would be a better solution.

Sebi


See Cheap flash trigger for some...
Back to Top
Dyxum main page >  Forum Home > Equipment forums > Lighting

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.094 seconds.

Monitor calibration strip

Dyxum.com - Home of the alpha system photographer

Find us on Google+

Feel free to contact us if needed.

Links monetized by viglink VigLink