Lens firmware, serial communication, Dandelion, etc...

Wifi, USB, GPS, Grips, Mics, Ext Power, Lens, Flash

Lens firmware, serial communication, Dandelion, etc...

Postby ztan » Tue Jan 29, 2013 3:39 pm

I'm new to this, having finally moved to digital from film recently. I have been wondering about the body-lens interface.

I installed the latest Dandelion chip onto some of my Zeiss ZF lenses, chip sourced from:
http://store.tagotech.com/product_info.php?products_id=527&osCsid=77e07380d341e05dff1b1cd3f0c08d6e

A good description of the pinout for the interface and use of a TC16a has been written by Olivier Peralis http://www.foolography.com/free-stuff/modify-tc-16a/ with the MCU specified as PD7554

Robert Rottmerhusen has gotten lens data from multiple lenses at: http://www.rottmerhusen.com/objektives/lensid/thirdparty.html
It looks to me that the 8 byte lens ID is coded the following way:
1: Lens ID
2: Number of stops to minimum aperture
3. Focal length at wide end
4. Focal length at tele end
5. Max aperture at wide end
6. Max aperture at tele end
7. MCU version
8. Lens type (00=non-D, 02=AF-D, 06=AF-G, 0A=AF-D,VR, 0E=AF-G,VR)

Installing the Dandelion chip on my ZF lenses allows the following behaviour on my D800:
With aperture control in the lens (default) and AF on (default), the lens works in G type mode and allows focus trapping with the body set to focus priority release. The aperture control ring controls the minimum aperture but does not communicate with the body. I realize some people like using the command dial to control aperture, but I prefer using the aperture ring on the lens.
With the aperture control in the body (Dandelion menu 60), the lens works in D type mode and AF is not able to be activated for focus trapping. I cannot go back to a G type lens without resetting the chip.

The chip defaults to a 45mm f/2.8 lens, looking at EXIF file data, the lens emulates the AF-S 50mm f/1.4 G behaviour by default (lens type A0). When the lens is switched to pass control back to the camera body (option 60 on the Dandelion menu), the lens emulates a 45/2.8 AI-P (lens type 72).

As I'd like to have focus trap enabled by switching AF on as well as controlling my aperture with the aperture ring, I was wondering if it would be possible to modify the Dandelion chip to do this.

Pinout of 5 pin f mount connector is:
a: Vdd
b: P1/P2
c: Serial Clock
d: Serial Data
e: Vss GND

Regarding body-lens communication, there is a serial protocol with some command codes available:

Looking at Nikon F mount patent 4,896,181:
$00: send back focal length (X=0)
$01: send back full aperture (X=1)
$02: send back lens ID of zoom position (X=2)
$0F: send back data (X=F) of zoom position
$10-$FB: undefinded, send back $FF
$FC: send back 2 byte conversion coefficient
$FD: send back 8 byte AF data
$FE: send back 8 byte AE data
$FF: send back data set from X=0 to X=F of zoom position

Looking at Nikon AF-S patent 5,727,241:
$27: send back lens data (40 byte)
$29: send back lens drive limit data (6 byte)
$30: zooming drive
$31: zooming inhibit
$32: af drive
$33: af inhibit
$34: motion compensation drive
$35: motion compensation inhibit

Anyone willing to help out?
ztan
 
Posts: 4
Joined: Tue Jan 29, 2013 1:08 pm
Been thanked: 0 time

Re: Lens firmware, serial communication, Dandelion, etc...

Postby leegong » Wed Jan 30, 2013 5:27 am

ztan wrote:I have been wondering about the body-lens interface...

Hi , ztan ,
Very nice info , which is sure to help us to find out how lens communicates with camera body and hack lens serial interface .
I'll trace lens serial interface code , hacking lens serial interface could feed help back to you .
Best regards
Leegong
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Lens firmware, serial communication, Dandelion, etc...

Postby leegong » Wed Jan 30, 2013 6:48 pm

ztan wrote:It looks to me that the 8 byte lens ID is coded the following way:
1: Lens ID
2: Number of stops to minimum aperture
3. Focal length at wide end
4. Focal length at tele end
5. Max aperture at wide end
6. Max aperture at tele end
7. MCU version
8. Lens type (00=non-D, 02=AF-D, 06=AF-G, 0A=AF-D,VR, 0E=AF-G,VR)

1,3,4,5,6 are found in FR firmware by Siemon , 2,7,8 add more important info ,thanks .
ztan wrote:Regarding body-lens communication, there is a serial protocol with some command codes available:

Any description of commandcode 0xE7 , 0xD5 , 0xC3 ?
Edit : patent 4896181 is too old , lots of new commandcodes sent from camera body to lens , 0xE7 , 0xD5 , 0xC3 ,0xF1 ... , commandcode 00 01 0F ... are
not used now , only 0xFD is remained , any new patent for the new commandcodes ?
Edit :US patent 2012/0066539 is too new . http://www.google.com.hk/patents/US2012 ... BODY&hl=en
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Lens firmware, serial communication, Dandelion, etc...

Postby leegong » Mon Mar 11, 2013 11:12 pm

Is mapping LENS responses to data stru which is sent to EXPEED , could anybody give me more description of Lens commands specification ?
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Lens firmware, serial communication, Dandelion, etc...

Postby ubmtdc » Fri Mar 29, 2013 10:35 am

Some more background can be found under the follwoing URL: http://forum.nikonpassion.com/index.php?topic=1640.0 (It is french but google may help).

Furthermore there is a code snippet under the following URL: http://roboforum.ru/post82969.html?hilit=nikon#p82969.

I would like to have a dandelion chip which supports autofocus at a TC16A!

Any informations about the codes?
ubmtdc
 
Posts: 10
Joined: Fri Mar 29, 2013 10:30 am
Been thanked: 0 time

Re: Lens firmware, serial communication, Dandelion, etc...

Postby Vicne » Sat Mar 30, 2013 8:51 am

ubmtdc wrote:Some more background can be found under the follwoing URL: http://forum.nikonpassion.com/index.php?topic=1640.0 (It is french but google may help).

I read that full thread. Here's my summary :
The beginning of the thread speaks about transplanting the chip from one lens to another, and is mostly about mechanic considerations.
It seems that interesting sections begin at this post where he is sniffing the protocol between a body (left, connected to the ring from a dead lens where he soldered one end of the wires) and a lens (right, connected to a dead body where he soldered the other end of the wires).
One post links to the following website which lists Lens IDs.
The real fun begins with this post, that contains interesting links.
Important: Many posts (including the above) link to a dead aol.com URL. Thanks to the wayback machine, we can accesss this list of documents: http://web.archive.org/web/200703192057 ... ot/nbuddy/
It also contains the information about byte meanings, that will be fixed down below.
One post mentions extracting lens ID from exif data as follows:
064: 0x0098(00152): MAKER_NOTES (9): LensDataBytes_Type9 : 30 31 30 30 22 50 63 48 2b 44 24 24 68 16 24 07 49 1d 53 00
099: 0xfffb(65531): SPECIAL (0): LensID_Type0 : Nikon AF-S Nikkor 17-35mm f/2.8D IF-ED

In this post, the guy tested just powering a lens and reading what it sends and it is an alternate 1 during 625 us, 0 during 4500 us. He then programmed a source to provide the same pulse train and the camera replied with 0x22. It seems the lens sends its id and state in a loop.
Several articles have been published by the member "gazalou" but the links are dead. Here again, the wayback machine comes to the rescue, but unfortunately the images are missing:
http://web.archive.org/web/200901312242 ... ?itemid=83
http://web.archive.org/web/200901312243 ... ?itemid=84
Summary:
There is a "RW1" pin that tells the protocol direction (lens to body or body to lens). The data itself is carried by the SI/O pin and clocked by the CLK pin. Most of that information is in this patent (see drawings at bottom).
(according to my understanding, RW1 has a pull up resistor attached).
Byte from body to lens:
Body forces RW1 to 0. If lens is ready to receive, it also forces to 0 and switches to reception mode.
After a small timeout (1500 us), the body releases RW1.
- If it rises back to 1 via the pull-up, it means the lens rejected the request (or is missing, broken, or AI(S)). The body will retry after 30ms.
- If it stays at 0, it means the lens asserts it and is ready to receive. The lensEdit:body then generates the clock and sends its byte. After the lens has received, decoded and validated the byte, it releases RW1 to 1. Done.
Byte from lens to body:
The lens forces RW1 to 0. The body generates the clock (CLK, 64us/bit) and the lens sens its byte. Then the lens releases the RW1 to 1. Done.
Of course, timeouts have to be finely adjusted. Communication will be abruptly interrupted when the user releases the shutter press.
So what are the bytes transmitted ?
The first to speak is the body that sends 0x22 (bytes are sent LSB first). Then the lens replies with a 26-byte frame. (unfortunately, the sniffed table was a jpg image that goes missing :-(. I'll try to ask the original author.)

This post in English about bytes sent from lens to body is worth a read and complements speculation from a post above.

After that point, the thread switches back to mechanic and replacement considerations, and the only interesting information would be from images that are missing unfortunately...

It seems the main developer who had succeeded in programming a "lens emulator" chip has sent its source code to a russian member of roboforum that never came back, and one year later the Dandelion chip popped up.
http://filmprocess.ru/nikon_spec.htm

So all this is just a summary of what I read. Hope this helps...

Vicne
Vicne
Core Developer
 
Posts: 1728
Joined: Tue Nov 29, 2011 2:30 pm
Been thanked: 167 times

Re: Lens firmware, serial communication, Dandelion, etc...

Postby leegong » Sun Mar 31, 2013 6:16 pm

Vicne , very nice help , thanks .I have to spend some time digging in lens serial interface , my gut feeling is that hacking lens serial interface in A FW could
add more functions support for ZF lens with the Dandelion chip , a long term goal of course since we have to understand more commands
and responses between lens and camera body .
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Lens firmware, serial communication, Dandelion, etc...

Postby ubmtdc » Sun Apr 07, 2013 10:45 am

...
Several articles have been published by the member "gazalou" but the links are dead. Here again, the wayback machine comes to the rescue, but unfortunately the images are missing:
http://web.archive.org/web/200901312242 ... ?itemid=83
http://web.archive.org/web/200901312243 ... ?itemid=84
...

I do have copies of the sites above. But I do not know how to add attachements...
ubmtdc
 
Posts: 10
Joined: Fri Mar 29, 2013 10:30 am
Been thanked: 0 time

Re: Lens firmware, serial communication, Dandelion, etc...

Postby leegong » Mon Apr 08, 2013 1:58 am

Vicne wrote:So what are the bytes transmitted ?
The first to speak is the body that sends 0x22 (bytes are sent LSB first). Then the lens replies with a 26-byte frame. (unfortunately, the sniffed table was a jpg image that goes missing :-(. I'll try to ask the original author.)

Yes , it's confirmed , got 0x22 and 26 in the following code of FirmWare A , but no idea about what does 0x22 and 26 bytes response mean yet .
Code: Select all
  1. ROM:BFC42420                 lui     $v0, 0xFFFF

  2. ROM:BFC42424                 lbu     $v0, SC1_RX_header0  # read FFFF7056

  3. ROM:BFC42428                 cmpi    $v0, 0x22  # '"'

  4. ROM:BFC4242A                 btnez   return1

  5. ROM:BFC4242E                 lui     $v0, 0xFFFF

  6. ROM:BFC42432                 lbu     $v0, SC1_RX_size  # read FFFF7055

  7. ROM:BFC42436                 cmpi    $v0, 26

  8. ROM:BFC42438                 btnez   return1

  9. ROM:BFC4243C                 li      $s0, 0

  10. ROM:BFC4243E                 b       fun_ret

leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Lens firmware, serial communication, Dandelion, etc...

Postby leegong » Tue Apr 09, 2013 12:59 am

ubmtdc wrote:...
Several articles have been published by the member "gazalou" but the links are dead. Here again, the wayback machine comes to the rescue, but unfortunately the images are missing:
http://web.archive.org/web/200901312242 ... ?itemid=83
http://web.archive.org/web/200901312243 ... ?itemid=84
...
I do have copies of the sites above. But I do not know how to add attachements...

Hi , ubmtdc , i couldn't see the article after i open URLs above .
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Next

Return to External Hacks

Who is online

Users browsing this forum: No registered users and 1 guest