Discovering the flash protocol (long)

Hello,

as I wrote on some topics, I´m about to develop an adaptor to use older non-D flashes with digital cameras. Doing so I discovered parts of the digital protocol used to communicate between flash and body. However, some parts still remain strange to me. So I will share my findings and hope some of you can contribute or make suggestions for the interpretation of the bytes.

1) General protocol informations

Note: all signals are TTL-compatible (5V)

The protocol uses a unidirectional clock line (signal F3 in service manuals) which is always driven by the cam. This line selects the command mode and clocks out/in the data bits. The data line (signal F2) is bidirectional. Mode is selected by various high-times of the high-active clock signal:

- data bit clock puse: 40us high, 40us low
- read command/preflash: 90us high, 300us low
- write command: 170us high, 300us low
- announce flash: 270us high, >= 13ms low

The protocol consists of 9 (analog) or 11 (digital) bytes. Each read/write sequence is started by a read or write clock cycle. After each byte there´s a pause of 200us. Bytes are sent LSB first, 8 bits. A complete read transmission looks like this:
- clock high for 90us
- clock low for 300us -> cam will now read on data line
- clock high for 40us, then low for 40us; the data is sampled on the high->low edge
- previous step is repeated 8 times to get 8 bits
- clock is held low for 200us
- next byte is transmitted by setting clock high/low for 40us each
- ...steps 3 to 5 repeated 9(analog) or 11(digital) times to get the data bytes

Write cycle is the same, but it starts with clock high for 170us, the cam then drives data line to put out data.

The cam will send a read sequence first to get information about the flash. The flash indicator only lights when a compatible flash is detected.

The preflash is triggered when the flash receives a "announce flash" (270us high) and then a "read command" (90us high) within 13ms. Main flash is triggered by pulling flash fire (signal F1) low. For exact timing there has to be a "announce flash" command within some ms before the firing (time not critical). Flash is stopped by setting clock high. Minimum flash time is about 30ms on 5400 series flashes - enough for pre-flash (about 140ms before main flash).

2) Data bytes sent by flash
1. byte - flash capabilities
values: 0x0f, 0x2f, 0x3f
0x0f is sent by 5400xi flash and indicates no HSS (bit 5) and no ADI (bit 4, unsure) capabilities
0x2f is sent by 5400HS - HSS (+), ADI (-)
0x3f - sent by 5600, HSS (+), ADI (+)

2. byte - ?
The value is always 0xf9. If changed, the flash is no longer recognized by cam.

3.-5. byte - zoom reflector position (?)
If the reflector is in bounce position, the bytes are 0xff each. For various zoom settings you´ll get:
0xe3, 0xe2, 0xce - 17mm (5600HS with wide angle diffusor)
0xea, 0xe9, 0xd5 - 24mm
0xeb, 0xea, 0xd6 - 28mm
0xec, 0xeb, 0xd7 - 35mm
0xee, 0xed, 0xd9 - 50mm
0xef, 0xee, 0xda - 70mm on 5600HS, 85mm on 5400HS
0xe0, 0xff, 0xdb - 105mm on 5400HS

6. byte
always 0xff

7. byte
Seems to be a exposure correcting value; setting to wrong value will lead to overexposed pictures. This is different on 5400/5600 flashes
5600:
0x94 - 17mm
0x97 - 24mm
0x98 - 28mm
0x99 - 35mm
0x9b - 85mm
0xbf - bounce
5400hs:
0xae - 24mm
0xb0 - 28mm
0xb1 - 35mm
0xb3 - 50mm
0xb4 - 70mm
0xb5 - 85mm
0xb6 - 105mm
0xbf - bounce

The 5600 values have bits 0-5 shiftet right compard to the 5400. Don´t know why...

8. byte
0xf7 - mounted on cam, no bounce reflector position
0xf3 - not mounted on cam
0xff - bounce position

9. byte
0x50 - default value on 5600HS
0x52 - default value on 5400HS
Bits 3 and 4 contain the wireless channel: 00: ch 1, 01: ch 2, 10: ch 3, 11: ch 4)
Meaning of bit 1 not discovered so far.

10.byte
0x3f - 5400hs, always
5600:
0x04 - 17mm
0x05 - 24mm
0x07 - 35mm
0x08 - 50mm
0x09 - 70mm
0x09 - 85mm
0x3f - bounce

11. byte
0x7b - 5600HS
0x8a - 5400hs

3) Data bytes sent by cam
1.-3. byte
As Matthias Paul discovered, these bytes contain aperture, ISO/program mode and zoom setting. The values are described on this page (sorry, german only, but the tables contain numbers only ;-)) The encoding is the same used for lens rom data.

4.-7. byte
0xff, 0xae, 0x7d, 0x40 - no changes, unclear

[edit]5. byte - af illuminator
0xae - illuminator off
0xbe - illuminator on
6. byte HSS
0x7d - no HSS
0xfd - hss
This byte is used by cam to tell the flash if the pending flash should be normal or HSS.
[/edit]


8. byte
0xc0 - Dynax 7D
0x80 - Sony Alpha, Dimage
unclear

9. byte
0xff / 0xef, appears random, unclear

10. byte
after fired preflash: flash duration
DSLR set bits 7&6, Dimage clears 7&6
Bits 0-6 contain time information. Upper and lower 32 values are swapped:
shortest - 0x20...0x3f, 0x00...0x1f - longest
(values given with 6 & 7 cleared, if set, gives 0xe0...0xff, 0xc0...0xdf)

Bytes not sent directly after preflash are
0x00 - Sony alpha, Dimage
0x7c - Dynax 7D, 5D


[edit]
11. byte - shutter speed
0xc0 - Dynax, after preflash (i.e., with valid time info)
0x80 - Dimage, "shutter speed don´t care"
no-HSS:
0xc0 - >=2s, 0xc1 - 1,6s, 0xc2 - 1,3s, 0xc4 - 1s, 0xc5 - 0,8s, 0xc6 - 0,6s, 0xc8 - 0,5s....0xde - 1/100s, 0xe0 - 1/125s, 0xe1 - 1/160s

HSS:
0x61 - 1/160s, 0x62 - 1/200s, 0x64 - 1/250s....0x74 - 1/4000s
[/edit]


Well, that´s all I decoded so far. If you´re intrested in building the adaptor, see www.voitzsch.net/flashconv.html for further details. You´ll find a schematic based on ATtiny13 and the actual source code to program it. Adaptor works best with 7D in combination with either 5400HS or XI flash. There´s basic support for 5D, alpha and Dimage (i.e., pre- and mainflash is fired, but exposure may vary and not always accurate).

Hope we can discover the complete protocol to build adaptors for complete support for all cameras.

Cheers,
Sebi

Edited by sebi - 16 November 2006 at 20:40

Hi Remko,

as for the 3500xi: don´t know. When working with various flashes (5400HS/XI, 5200i so far) I learned that Minolta always changed a little bit to make work little more difficult. For instance, 7D sends flash time info with 5400 series without any modification; with 5D/Dimage/Alpha you have to change some bits in the flash output to make it work. Never had a 3500xi to test out.

To log the data you´ll have to connect the four contacts of the hot shoe to either the parallel port (a) or a special data logger (b). As the flash has to be mounted too the best way is indeed to open up the flash and solder wires to the hot shoe contacts.

a) Parallel connection
First I simply connected the three signals (and GND) to the parallel port of my computer and took "the fabulous logic analyzer" tfla-01 to log the data. Unfortunately tfla-01 isn´t able to convert lows and highs to data bytes, so it means counting then... Now I only use this connection to get an idea of the timing (read/write distinction, preflash, announce signals).

b) data logger
So I needed to have a proper logger. I took an ATmega8 and programmed it so it can be connected to the flash direclty. On the other side you connect a PC via RS232 (38400 bauds). All data between cam and flash will be sent to a console terminal. The logger will capture 22 bytes (11 flash->cam, 11 cam->flash), converts them to hex and prints them out comma-separated. Identical packets are ignored.

Schematics
Software source

The schematics is just a ATmega8 connected to a MAX232, with direct connection to the flash/cam.

Best help would be a combination of logs and ideas on how to interpret the data. Some things are obvious (when turning from P->A and back a byte toggles - not difficult to guess...), some not. Some things are cam or flash specific...

Sebi

Hi Fuzzbass,

considered this but don´t think it´s too risky to publish the informations. First, I have no contract with Sony or (Konica-)Minolta telling me I must not discover their protocols (this is a big difference from software, most software producers have such prohibitions in their EULAs). Second, I did not use any software or tools from these firms nor am I disassembling flash or camera firmware. I´m only sharing my knowledge and no confidential papers Sony gave to me. So I think it´s completely legal, both discovering and publishing the informations.

Furthermore, there are other sites dealing with similiar topics (see lens rom thread herein, Michael Hohners site about wireless protocol and flash timings - which btw. helped a lot, thanks to Michael!) and to my knowledge nobody ever had trouble with at least Minolta so far. Pete Ganzel sold complete service manuals...

Thanks for your warning as well.

Sebi

Rick,

just to keep you up-to-date:

the software works with 5D and 7D, flashes are 5400HS, 5400XI, 5200i (without wireless, found no suitable receiver so far), 3500xi. Best support is for 7D - as that´s the cam I have. Alpha may come soon.

The next step will be to use the HSS-mode preflash for HS models, I expect one version to work with all cams then. Maybe HSS support is added too, don´t know.

For now there are about 30 modified flashes "in the wild" (mostly 5400, some 5200i and one 3500xi), all operating correctly. Some minor exposure glitches with 5D, but all within the +/- 2EV correction.

Cheers,
Sebastian

Hi Sebi! Anythink new in your work? What about HSS for 5400HS? The same program for 5D and 7D will be also super.

Hi Alain,

I never thought about that, however it will be possible using the adaptor. But you need a suitable wireless receiver.

Think an adjustable optical flash trigger would be a better solution.

Sebi

sebi wrote: Hi Alain, I never thought about that, however it will be possible using the adaptor. But you need a suitable wireless receiver. Think an adjustable optical flash trigger would be a better solution. Sebi

See Cheap flash trigger for some...