Battery grip pins / UART

[frantony]

Here is the image of Canon EOS 600D battery slot and the image of top part of Canon BG-E8:



You can see that camera body has 16 connection points for grip pins, but battery grip has  only 12 pins. The 4 central connection points are unused by grip.

Does anybody know how this 4 central connection points on the camera body can be used?

I have examinied Canon EOS 1100D camera, the situation is the same --- the camera body has the connection points unused by the grip.

[1%]

hehe, 4 pins only? USB I hope?

50D has extra pins the grip doesn't go to.

[frantony]

hehe, 4 pins only? USB I hope?

50D has extra pins the grip doesn't go to.

Hmm, camera body already has one USB connector.
More over USB uses point-to-point channels, so you can't easely duplicate the USB connector pins in the battery slot.

Moreover in this situation there is no need of 4 pins for USB as there is no need to use USB interface for power supply.

[1%]

Well I found 40D service manual. I'm going to see what it says about grip pins there.

WFT connects through the grip. Either the camera or it is the USB host for externals. That HDD thing has to work somehow.

[SDX]

Aren't some of them plain serial for debugging purposes? I mean to have heard something like that a long time ago.

[1%]

Yea, maybe serial.. service manual doesn't mention it. 50D has another port for WFT that looks like an HDMI connector. So maybe that is serial console.. or does the battery grip already send the buttons this way?

[SDX]

The inner electronics of a no-name battery grip:




It doesn't look very much like serial right there. A few multiplexers and MOSFETs.

I'm still curious. Any ideas on how to connect to these connectors without disassembling the camera?

[1%]

Its the ribbon cable to those pins?

3 mosfets on the back but what are #2? Power controlers? PMICs?

[SDX]

It's a MC14066BCP in it's TSSOP–14 casing. It's a quad analog switch / quad multiplexer. All ribbon cables go to the button panels.

[g3gg0]

the 5D repair manual says its pins are those:

(middle two rows, maybe meant for grip)
BATDOOR
AFSEL
LGSEL
SW1
SW2
DIAL1
DIAL2
VCHKON
AELOCK
BATSEL1
BATSEL0

(outer rows, maybe debug)
TXDMPU RXDICU
TXDICU RXDMPU
MON1 MON3
MON0 MON2

[SDX]

Wow, this sounds really interesting. Especially the fact that there is a RX line.

[1%]

So you'd have to solder to those pins, they are there in my grip making contact.

Wonder what the MON are for, the tx/rx look like serial (probably low voltage not PC voltage) to ICU + MPU.

ICU - Arm?
MPU - TX19A?

[frantony]

the 5D repair manual says its pins are those:

(middle two rows, maybe meant for grip)
BATDOOR
AFSEL
LGSEL
SW1
SW2
DIAL1
DIAL2
VCHKON
AELOCK
BATSEL1
BATSEL0

(outer rows, maybe debug)
TXDMPU RXDICU
TXDICU RXDMPU
MON1 MON3
MON0 MON2

Thanks a lot! Now I see that 5D middle row pins are used by the grip, and outer rows (with smaller contact point) are unused by the grip.

[frantony]

So you'd have to solder to those pins, they are there in my grip making contact.

Hmm. Moreover this RX-TX signals go to the battery slot from main board, so may be soldering to the mainboard (e.g. near the appropriate connector) would be easier. But I don't want to solder to the cameras pcb.

Please correct me if I'm wrong, you write that you have the grip that has the middle contacts missed in the original Canon grip?

[SDX]

I do have the LCD version of the BG-E8.

It has 12 (of 18 possible) pins and they are all somehow connected to something on the board. The board has nothing advanced on it, so no serial there.

I assume the remaining 4 are serial to MPU and ICU. Alternatively it's MON (whatever that is).

I checked how to add these 4 pins. It's not possible to do so from the inside, since the board for the others is mounted to the plastic there.
If I could find some very small springs they could be glued next to the others.

[bunker2]

Very interested in the Pinout. Help who can know everything about the subject. I also have this for the 600D, but what contacts for what answer? There are even pens with the monitor which shows the number of shots and battery life, but it is fine the power supply circuit and information on the Pinout. I would be very grateful for any information.
Can anyone have information on the Pinout of the contacts of the USB, sound, Etc. ON the SIDE PANEL to the LEFT

[a1ex]

Got 2 pictures from a 600D:

TXDMPU RXDICU
TXDICU RXDMPU

These are likely the UART ports for the main CPU (ICU) and the MPU.

The first one should reveal the DryOS shell (aka DrySh or Dry-shell). There should be also some activity from the bootloader (e.g. "Now jump to AUTOEXEC.BIN").

No idea about the second one.

If anyone could hook up an Arduino/RPi/whatever to these pins and log the UART activity, it will be very appreciated.

[g3gg0]

one with e.g. a battery grip could use a logic analyzer like this one here with sigrok
and check whats going on on the "standard" pins.
and maybe modify it to connect to other pins too.

[t3r4n]

Hi all,
has anyone ever got this to work? Here are my findings on the 750D.
I tried to use a cheap battery grip on my 750D and soldered a wire to all twelve pins and the two battery pins to get an outside connection.
Then I tried to hook up a buspirate http://dangerousprototypes.com/docs/Bus_Pirate and get a serial connection. To get a potential reaction I used a bootable card without the autoexec.bin file. But after probing all pins I get no connection. So if no-one has a good idea that I should try I will get rid of the wires and start using the grip again.

[Ant123]

Make sure you are using proper speed and signal levels.
FYI, diagnostic uart has 1.8v levels on Digic 6 Powershots.

[t3r4n]

thanks ant123
I measured some pins to be 3.3 V so assumed that to be the right level... Two resistors later I'm back in the game.
So I think I have to pins which have some communication going on.
- the first is on the battery itself (BAT1), which seems to be logic as Canon can identify fake and third party batteries
- the second is the one I call Pin4 in the picture. Here I find something that could be like the output in qemu but at incorrect baud rate and bits have to investigate further...

[aprofiti]

Here are some photos of the 50D battery grip:



Didn't go further with disassembly as there was something I cannot find out that was blocking.
Tried with multimeter to find some of the connection on the test pad of the pcb, but only a couple was beeping...

On rear of the small pcb (camera side) there are only GND (most off) and VCC (2 or 3 near red cable) test pads

I appears to have all the connection and maybe also UART.
Does anyone know the pinout?

[a1ex]

No idea what the pinout is, but I'd expect the camera to print a lot of things on the TXDICU pin (what you see on the serial console in QEMU), and maybe fewer things (no idea what) on TXDMPU.

I'd start by probing these pins with an oscilloscope / logic analyzer / Arduino board / anything else with an ADC, to figure out the voltage levels and baud rate.

Ant123 successfully identified both the TX and RX pins on EOS M3: https://chdk.setepontos.com/index.php?topic=12542.msg129346#msg129346

[a1ex]

600D - one of these extra pins (i.e. not present in a regular grip) is indeed UART showing Canon's debug messages from main CPU. Details from Daniel Rozsnyo:



Sample log: 600d-okay-sensor.txt (camera running vanilla firmware, without ML)

3.3V, baud 115200. A USB to TTL serial cable (e.g. like this) should be enough for getting this log.

You can get a much more complete log with the startup-log and startup-log-mpu builds (saved to card), but this log (from the UART pin) also covers messages from Canon's bootloader, and can be very useful for troubleshooting cameras that do not boot.

[a1ex]

Daniel just found the UART pins on the EOS M:




The 1.8V TXDICU pin worked out of the box with the 3.3V FTDI dongle. For RXDICU, Daniel used 2 resistors (470 ohm) as voltage divider.



Also, @kitor found the TXDMPU pin on the EOS R here (TXDICU not yet confirmed). Same voltage levels as on the M.