2013-12-29

Fried 2 other FMD2740A stepper drivers

This is the second time I fried 2 FMD2749A stepper drivers on my TravelCNC.
Made 2 giant Hackcenter calls at the 30C3 hacker congress stink of fried electronics while the people from CCCfr ripped out all power cables they could find, called me and got a fire extinguisher.

The drivers are advertised to be operated at up to 50V.
The first one had a 5V DC converter (LM2576S-5.0) inside that is only rated up  45V instead of an " LM2576HVS-5.0" rated up to 60V.
I'm using them with a common 48V power supply. Well within the rating of the dealer.
Now, after 3 fried stepper drivers the dealer "Thomas Wu" answered that the drivers where actually only good for 45V!!!
I wouldn't ever but any power electronics from this Thomas Wu guy on Aliexpress again!

I turned down the power supply to 44.5V (can't go lower then that on the potentiometer)
and am waiting for some new 5A drivers with over-current, over-heating, under-current,... protection.
One of these drivers is working fine at 48V driving the super-strong 4th axis, so I hope they will hold up.


 
 

2013-12-11

Reverse Engineering (Micro) Four Thirds lens protocol

Based on the work of Lasse Bayer, who modified an Olympus lens to attach a logic analyser,
I'm trying to reverse engineer the rest of the Micro 4/3 lens protocol.

I found an interesting macro adapter that sits between mft camera and mft lens and has electrical contacts.
Thus I'm trying to modify this adapter and analyze not only one lens but a large number of combinations of lenses and cameras.

I'm currently working on this.
This blog-posting will be updated all the time!
Here are the logs!

Setup 


 
 


 

Pinout:

VDD=microcontroller power (goes low on lens-release button)
VCC=battery power (possibly for AF-motor,...)

preliminary MFT pinout:


signallogic analyser cablelogic analyser channelposition




ACK?BROWNCH4Right when Facing the Sensor
ACK?REDCH2
ClockORANGECH3
DataYELLOWCH1
Lens2Body?GREENCH0
Body2LensBLUECH5

GREYCH7
???PINKCH6

WHITEGND

BLACKGND
FEHLER(N/C)------Left when facing the sensor

 

Quote about the 2 additional contacts (from here):
In addition, the lens mount of the Micro Four Thirds System is equipped with two additional signal contacts for smoother Live View shooting with shorter time lags, faster higher communication speeds between the lens and body, and, of course, reduced lens and camera size.
These two contacts will also be used in high-speed data processing required for the movie handling capability expected in the future.




(Image again taken from Lasse Bayer)


SPI seems to be used at 500KHz with 8 bits LSB. Lens2Body and Body2Lens are pulled high by lens or body respectively to indicate that they are ready to receive/send the next byte and pulled low again to acknowledge the receipt.

The camera seems to pull the lines low (including clock) to pause communication.
  • when the shutter is pressed
  • when exposure has finished 
(confirmed for MFT)

General protocol

Everything seems to start with 4 byte commands sent by the camera to the lens,
followed by the lens answering.

Initial communication 

FT:  B0 F0 00 00  (first command on switch-on)
MFT: B0 F0 00 00 
 
FT: 
Followed by 2 values: A0 00 
 
MFT:
Followed by 2 values: 00 00 


Command: request lens data (MFT)

MFT: 80 ED 01 00
 
TODO: followed by some yet unknown data

Command: request lens data (FT)

FT:  C0 F0 20 00
There is quite a lengthy answer in 26 blocks: 

 Block 0

lens Id
lens designation(ASCII)
lens serial number
lens firmware version
number and length of the following blocks

 TODO : details

Block 1

 May be a list of all focal lengthes in mm - 1

Block 2

unknown

Block 3

unknown

Block 4

unknown

Block 5

unknown

Block 6

unknown

Block 7

unknown

Block 8

unknown

Block 9

unknown

Block 10

unknown

Block 11

unknown

Block 12

unknown

Block 13

unknown

Block 14

unknown

Block 15

unknown

Block 16

unknown

Block 17

unknown

Block 18

unknown

Block19

unknown

Block20

unknown

Block21

unknown

Block22

unknown

Block23

unknown

Block24

unknown

Block24

unknown

Block25

unknown

Block26

unknown

Regular polling (MFT)

 TODO: MFT seems to use multiple, regular polls.

81 E3 04 03
followed by yet unknwn data that does change while not touching the camera.

Regular polling (FT)


C0 F1 0 0 
Apparently the camera polls the lens every 104ms sending these 4 bytes.
The lens answers with 14 bytes including information on the current focus, focus mode, zoom distance, and a checksum.

(I'll insert details here)

Here is what Lasse found out:
 Byte Number:

 1 ,  2 ,  3 ,  4 ,  5 ,  6 ,  7 ,  8 ,  9 ,  10,  11,  12,  13,  14,  15,  16,  17,  18
----------------------------------------------------------------------------------------

    Infinity focus:

192, 241,   0,   0, 177,  11,   0, 160,   0,  31, 255, 255,   2,   5,   0,   0,   0, 196

    Focusing closer:

192, 241,   0,   0, 177,  11,   0, 128,   0,  31,  43,   1,   2,   5,  11,   2,   0, 223
192, 241,   0,   0, 177,  11,   0, 128,   0,  31, 155,   0,   2,   5,  85,   3,   0, 153
192, 241,   0,   0, 177,  11,   0, 128,   0,  31,  87,   0,   2,   5, 121,   5,   0, 123

    Close focus:

192, 241,   0,   0, 177,  11,   0, 144,   0,  31,  78,   0,   2,   5, 254,   5,   0,   7

----------------------------------------------------------------------------------------

Byte 8:   0 - 0000 0000 - Single Autofocus active
        160 - 1010 0000 - Manual Focus @ infinity
        144 - 1001 0000 - Manual Focus @ close-up
        128 - 1000 0000 - Manual Focus in between

Byte 10: Changes linearly while zooming from 31 @ 45mm to 0 @ 14mm

Bytes 11 + 12: FF FF - 65535 - infinity focus
               4E 00 -    78 - close focus
               Focus distance ?

Bytes 13 + 14: Seem to depend on the zoom position at switch-on.
               Do not change while zooming or focusing manually.

Bytes 15 + 16: 00 00 -     0 - infinity focus
               FE 05 -  1534 - close focus
               Focus mechanism position ?

Byte 18: Checksum of Bytes 8 to 17, maybe 7 to 17

The first 4 Bytes are sent from Body to Lens, the remaining 14 from Lens to Body.

Command: Start/Stop exporure (FT)

A0 B0 FE  0  ? stop of exposure ?
A0 B1  0  0  ? start of exposure ?
 TODO: different on MFT

Command: Change Aperture (FT)

Like the polling is a 4 byte sequence, this seems to be 4 byte too.
close aperture: 176  210 xxx xxx
open aperture:  176  215 0   0
 TODO: verify list of epertures

Aperture values as determined by Lasse:
aperture         command
value               data
                   
estimated
                   
1.0               0    0
1.1              85    0
1.2             170    0
1.4               0    1
1.6              85    1
1.8             170    1
2                 0    2
2.2              85    2
2.5             170    2
2.8               0    3
3.2              85    3
3.5             170    3
                   
determined                my own notes:
4                 0    4  (base value for comparison) 
4.5              85    4   (+85 )
5.0             170    4   (+170)
5.6               0    5   (+256)
6.3              85    5
7.1             170    5
8                 0    6
9                85    6
10              170    6
11                0    7
13               85    7
14              170    7
16                0    8
18               85    8
20              170    8
22                0    9

 determined
                   
3.5             157  131     my own notes:
3.6             171  131
3.7             198  131
3.8             211  131
3.9             236  131
4.0             248  131     (base value for comparison) 
4.1              17  132
4.2              28  132
4.3              51  132
4.4              62  132
4.5              84  132     (+77 instead of +85 =-10%)
4.6             106  132
4.7             116  132
4.8             137  132
4.9             156  132
5.0             166  132     (+162 instead of +170 =-5%)
5.1             176  132
5.2             195  132
5.3             213  132
5.4             222  132
5.5             231  132
5.6             249  132     (+257 instead of +256 =+0,4%)
 
 
Quote from a camera manufacuter I recently got:
"The electronic feedback from the lens tells the camera where it is in 
regards to f-stop, and the camera then interprets that information." 

Command:  shutdown (MFT)

Sadly the shutdown sequence seems to use different commands.
No clear command sequence to see yet.

-->
14-42PZ14-42PZ14-42PZ
14mm14mm14mm14mm
















23,89ms12,32ms32,09ms
14,06ms29,83ms21,92ms23,86ms
SDO: A1 D7 00 00 11 05 7D 07 SDO: F1 CF 00 00 11 05 7D 07 SDO: B1 D7 00 00 11 05 7D 07
SDO: 31 CF 00 00 08 04 3F 02 SDO: 31 C7 00 00 08 02 BF 00 SDO: 21 9E 00 00 00 00 3F 00 SDO: F0 9E 00 00 80 00 BE 06
SDI: A1 D7 00 00 11 05 7D 07 SDI: F1 CF 00 00 11 05 7D 07 SDI: B1 D7 00 00 11 05 7D 07
SDI: 31 CF 00 00 08 04 3F 02 SDI: 31 C7 00 00 08 02 BF 00 SDI: 21 9E 00 00 00 00 3F 00 SDI: F0 9E 00 00 80 00 BE 06








lens folding up...lens folding up...lens folding up...




716,8ms705,43ms725,16ms
336,96ms352,76ms344,85ms346,89ms
SDO: 42 FF 07 00 C6 16 02 00 SDO: 62 FD 03 00 C6 16 02 00 SDO: 42 FF 03 00 C6 16 02 00
SDO: E2 FF 07 00 60 08 00 00 SDO: 62 FF 03 00 C2 12 00 00 SDO: 42 FE 07 00 C0 10 00 00 SDO: E0 FF 07 00 C0 10 00 00
SDI: 42 FF 07 00 C6 16 02 00 SDI: 62 FD 03 00 C6 16 02 00 SDI: 42 FF 03 00 C6 16 02 00
SDI: E2 FF 07 00 60 08 00 00 SDI: 62 FF 03 00 C2 12 00 00 SDI: 42 FE 07 00 C0 10 00 00 SDI: E0 FF 07 00 C0 10 00 00
















790,6ms761,32ms794,78ms
393,21ms414,12ms370,9ms384,84ms
SDO: 7C 31 10 SDO: 7C 31 10 SDO: 7C 31 10
SDO: E0 00 08 SDO: C0 00 0C SDO: E0 00 18 SDO: E0 00 18
SDI: 7C 31 10 SDI: 7C 31 10 SDI: 7C 31 10
SDI: E0 00 08 SDI: C0 00 0C SDI: E0 00 18 SDI: E0 00 18








VDD going lowVDD going lowVDD going low
VDD going lowVDD going lowVDD going lowVDD going low

 

I also looked at this on the Blackmagic Pocket Cinema Camera...
not only does the #BMPCC not send the proper lens shutdown sequence, it also has some really bad noise on the VDD line while being switched off. 

Command: prepare for shutdown (FT)

176 160   0   0         prepare for shutdown
 TODO: verify 

Command: focus

176 161 xxx xxx  change focus to/by value
176 173   0   0  start single autofocus
 TODO: verify 

 Other commands

192 241   0   0  poll
192 246   0   0  ?(sent after initial command and before requesting the full lens data))

192 250 xxx xxx  ?
192 251   0   0  ?
  TODO: analyse these