Messages

Try to start it without memory card and connected to PC before start.

Did you try connect camera to USB when Err70 is appears?
Sometimes its worked.

Usually (a lot of cases on this model), it's a camera eeprom corruption, rare cases is mpu flash data corruption, or props corruption in digital part, but no errors about props in your's log, for test need to wrote a good one dump, but backup original before. If it helps, need to extract important data from corrupted eeprom and build a new good one and wrote back. Is camera able to connect to computer? If its detected by USB, its recoverable without disassembly, if not - uart and disassemble required.

Also 50/50 chance is repair it with Service Firmware, and update flag.

So only our RXMPU pins differ. Mine meight be wrong.

how do you know that RXMPU is on pin 7? Do you get any response from MPU when sending something there?

Its easy, first i search the Tx pin using needle and looking for some readable output, when i fount it, i solder the Tx and seach for Rx with same scheme, but i send data and waiting answer.

Thanks for the findings. The connector meight be the same as on RP but as an angled version, so dev kit plus flex pcb meight also work on R6.
Are you sure with the pinout?

It should be:

Code Select Expand


1:
2: RXICU (1v8)
3: TXICU (1v8)
4: GND
5: Maybe RXMPU (3v3)
6: TXMPU (3v3)
7:
8:


But yours is:

Code Select Expand


1:
2: RXICU (?)
3: TXICU (?)
4: GND
5:
6: TXMPU (?)
7: RXMPU (?)
8:


Did you also note the voltage levels on each pin?

No error here, i always check many times.

ICU - Tx -> PC - Rx
ICU - Rx <- PC - Tx

Same for MPU

ICU levels is 1.8V, but i use 3.3V levels bridge, so no problems.
MPU levels is 3.3V

Working on Tornado EOS and Tornado SCF big update, that add all new cameras. Sometimes shit happens, it's normal process, yesterday I broke EOS R6.
Uart, service firmware, not helped for me, so finaly i restore it with memory programmer. Found uart pinout, maybe, helped for somebody.

I think, the connector on board is JST 08FZC-SM1-GAN-TB

http://www.jst-mfg.com/product/detail_e.php?series=638

Pinout is same on all cameras with this connector, 5D4, 200D, R, RP, 250D, etc... now im working on 250D with 3.3 Levels, it's ok, no plain to die

Quality of your fpcs is pretty good, where you print it? and what about costs?

also looks like powerline problems. Try to temporary unsolder two capacitors near fpc connector on dial board.

OK what about Factory Reset ?

It's been in this state for a couple of months; no idea what the issue is.

1. First cold boot (after battery out): usually everything fine. Sometimes starting directly into state 2 or 3, with low probability.
2. Second (warm) boot: almost everything working, except rear dial.
3. Third (warm) boot: DryOS fully booting, GUI on the screen, but camera locked up. No reaction to buttons or card/battery door. Of course, the defect was also present without card, after clearing all Canon settings etc.

Before writing the above message, I've disassembled it a few times, reassembled, but there were no signs of getting better. I could, however, isolate the defect to the rear dial PCB (the one with a black ring on it). If I started the camera without that PCB, it worked fine (no lockups). If I started the camera without the back cover, but just with that PCB attached, the defect was present. There were no signs of damage of that PCB. On that PCB there is a small IC, 7147 ACPZ, talking to the rest of the camera (guess: to the MPU) via SPI. Image annotated by Danieel.



At some point I've started to probe the UART to look for interesting messages. Usually, I turn the camera off from the card cover, as it's faster than from the power switch. With the debug wire attached, I found it easier to use the main switch. After a few reboots I've noticed it no longer locks up. It was working again - that's when I wrote the previous message to document the UART pins.

Reassembled everything, but after putting back the last screws... the problem occured again. Oops! I still had the debug connector accessible, so I've tried to power-cycle it and see if there's anything interesting on the UART pins. While the camera was locked up, I've noticed the MPU restarting itself (printing MON>>> and E1OFF in a loop). Normally, the first message is printed at startup and the last one at shutdown.

Pressed the power switch / mode dial assembly a bit harder, I think, and it's back to life. Will see for how long.

Also found some factory routine that appears to check or calibrate the rear scrollwheel. They didn't seem to help or hurt, except at some point I've got scrollwheel events without any user input (as if the sensitivity was too high). They were gone at next reboot.




Not yet sure whether it was the scrollwheel PCB, or the power switch, or something else. I'm not yet able to get diagnostic logs from the MPU.



Edit: after typing this, the defect is back. One update: from the "completely locked up" state, I can turn off the camera by applying some force on the power switch. Just actuating it normally keeps the camera powered on and locked up, i.e. no reaction at all.

Edit: alive again. Go figure...

I fix a few cameras with this issue by firmware update, did you try this?

A factory routine that you've found is used to adjust this dial in service centers.

1) I think it's not a problem using PC with Windows and wrote some sync software.
2) it may be some device on microcontroller or complete board like arduino, but this is more complicated.

You are not considering these options at all ?

You mean connecting two cameras without PC ?

I'll add here
- LV is taking so many resources, that it's loosing input on UART. Going into menu makes it reliable + camera output is a few times faster.

For adventurous (as it need's 1v8 UART or 3v3 with voltage divider on TX), simple bootloader dumper:

Code Select Expand

import serial
import sys

start = int('0xE0000000',16)
end = int('0xE0040000',16)
step = int('0x1000',16)
current = start

with serial.Serial('/dev/ttyS6', 115200, timeout=1) as ser, open("dump2.log", 'w', encoding='utf-8') as logfile:
  while True:
    line = ser.readline()
    if line is not b'':     #skip timeouts
      decoded = line.replace(b'\r\n',b'').decode("UTF-8") #bytes to string
      print(decoded)
      logfile.write(decoded + '\n')

    if b"Mode ON" in line:       #enter interactive shell
      ser.write(b'akashimorino\r\n')
    elif b"K424[1]>" in line:    #prompt, start data dump
      if current > end:
        sys.exit(0)
      ser.write(str.encode("d " + hex(current) + " " + hex(step) + "\r\n"))
      current += step

Of course you need to reassemble this data into binary form yourself.

UART location/pinout is here.

Yup. Fortunately with bootflag enabled, now RX is sufficient.

Did you try sht_memoryread2 B:/K424_00.bin 0xE0000000 0x00040000 ?

So you have MPU (camera subsystem) is worked, but ICU (digital subsystem is dead). I think there are generic issue for EOS 70D.

EOS 70D have a serious issue with digic cooling, especially in video recording mode.

This issue is accepted by Canon and they started free main pcb exchange programm.

Check yours camera serial number if it's 00xxxxxxxxxx - 22xxxxxxxxxxxx you have affected camera.
Go to autorized service center for free replacement (no active warranty is required, this a Canon problem not yours).

More info: https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/service%20notice%20eos%2070d%20error%2070%20or%20error%2080/

If you for some reasons can't to to canon service, there is a some ways to extract calibrations from dead board and write it to a new board, which you may buy in some place like ali or ebay, but, you must buy only new revision with new cooling.

[jonas.svidras]

There are no schematics in free access, authorized service centers also don't have it, for new models. Only block digrams and component placing.

jonas.svidras upload parts of EOS 5D service manual, you may easy google it.

if you need newer google EOS 40D (Digic 3 platform).

Or ask questions, i have some parts of schematics for new models , but can't upload it.

Hello, I'm the author of Tornado EOS and Tornado NKN. I'm from Russia. My russian name is Slava but is very difficult for non russian peoples, so my international name is Mike.

Opened the software in VirtualBox. I own two Canon 6D. One with Japense/Chinese/English languages and one with international languages. I unlocked the language lock. Now I have two 6D with international languages 

Possible to change WiFi/GPS, possible to turn on/off C-log on 5D IV. Dumped 1024 Kb MPU as a bin file. No idea what to do with it.

Thank you for good review, yes, software is really works, but for now many antiviruses have false positive detection of my program, because i use my custom protection system.
Unfortunately, it's very difficult for a single developer to influence huge corporations. So use virtual machine is not a problem.

For now i'm working on big update of Tornado EOS, when I finish it, I do the free shutter counter reader programm, also i have working methods to enable / disable the BootDisk Flag over USB and Downgrade firmware so, I think I can do installations of Magic Lantern little easy, and able for users with cameras with newer firmware, like EOS 5D Mark III with firmware 1.3.5

Yes i have knowledge about the firmware bug in 1000D and how to repair it, for now I have prototype, that will later become a part of Tornado EOS

You did not need this software to change the language restriction.
PROP 0x01000012 -> http://magiclantern.wikia.com/wiki/Properties/550D
Just compare in qemu with the second 6D.

Yes that's true, but sometimes easy just pay $20 and do it in one click. And for this sum do another features like calibrations backup, read error log ang clear it and etc.