from now broken freehabr website
translated from russian:
Preamble
Somehow, my colleagues and I needed to control the Canon EF 200 lens without a camera (and then the Canon EF 85 also appeared).
The task at first glance is simple, but in reality everything turned out to be not so simple.
After a long search on the Internet, only a control ring offered for 1 thousand “green” was found, connected to a computer via RS-232 (naturally, this was immediately rejected); pinout of the connector with which the lens is connected to the camera; as well as small hints that the SPI interface is used to control the lens.
SPI is so SPI. Of the available ones, a microcontroller with an “on-board” SPI (PIC16F873a) was chosen, and on its basis, control electronics were assembled on the breadboard knee (an RS-232 level converter, the microcontroller itself and a 4 MHz quartz resonator - there was no other at hand). Other colleagues begged for a digital oscilloscope with the ability to record measurement results on a USB flash drive and work began.
Bullying of iron
First of all, my colleague removed the connector from the lens and soldered wires instead, and the wires were soldered to the connector so as not to screw the camera. Through these conductors, the lens was connected to the camera, three channels of the oscilloscope were connected to the SPI bus (CLC - clock pulses, DLC - data from the lens to the camera, DCL - data from the camera to the lens), and three channels of the oscilloscope were connected and experiments began on controlling the lens with the registration of all data, passing through the bus.
There was a lot of data, so I had to tinker hard before any matches were found in the sequences of commands from the camera to the lens. What the lens answered was generally impossible to structure. In addition, the camera periodically checked whether the lens was in place by sending a lot of messages.
In general, I suffered with the processing of this data, and I spat on this ungrateful process. "We'll go the other way," I decided. (for everything about everything, by the way, at least a week was killed)
Patience and work will grind everything
The microcontroller was connected with its SPI to the SPI line from the camera to the lens. A simple wiretapping program was written, and I began to "spy". He killed another week, but received only fragments of commands: the controller’s memory was not enough to store large sequences of codes, and he did not have time to transfer it to the computer in real time (since the controller’s quartz resonator had a frequency of 4 MHz, I had to limit myself to a rather slow RS-232 speed - 19.2 kbps).
But these efforts were not in vain: some codes sent by the lens to the camera were received, as well as some response codes. Moreover, they no longer needed to be deciphered - here they are, on a silver platter.
The next stage was already closer to reality: the lens was directly connected to the microcontroller, without any cameras. The SPI interface of the controller was set to a baud rate of fosc/64 (62.5kHz). SPI worked in the third mode (high CLK level, information transfer to the falling edge of CLK, reception in the middle of the cycle - to the rising edge of CLK), registers:
SSPCON=0x32; TRISC=0xD0; CKE = 0; SSPIE=1; SMP=0;
The correct mode of operation was partly peeped on the Internet, partly obtained from waveforms, and then brought to mind through trial and error.
To analyze the messages sent by the camera to the lens, SPI switched to passive
mode:
SSPCON=0x35; TRISC=0xD8; CKE = 0; SSPIE=1; SMP=0;
To select commands that cause a change in the focal length of the lens, a decision was made
send in turn to the lens a non-zero one-byte message, followed by eight
zero messages (from the analysis of oscillograms, it was determined that zero messages are used by the camera to read information from the lens).
The main control commands were determined by the method of sequential enumeration of all possible commands from 1 to 255.
The time intervals between successive unrelated commands can be quite large. If the lens needs to respond to some request, and no messages were sent after the request, the lens will wait for the next messages to give the requested data.
Without commands from the camera, the lens is simply silent.
Therefore, each command "just in case" ended with a sequence of eight zero messages.
Canon EF200
So, by trial and error, the main commands we need to control the Canon EF 200 lens were determined. I will list them here in plain text (there will still be a summary plate at the end).
So, some commands do not require a response from the lens, so they can not be terminated with zeros,
however, some requests require quite a long response, requiring up to eight
subsequent null messages.
Command 94 or its equivalent 30 is used to switch to manual control mode (all commands are written here in decimal notation).
This command must be followed by one or two nulls.
Some commands for changing the focal length require prior
switch to manual control mode.
The following commands are used to change the focal length of the lens
(lens EF 200, for EF 85 speeds do not change):
5 smooth increase in focal length (if it is not followed by other commands).
37 fast transition to infinity, this parcel should be followed by two zeros.
To reduce the focal length, use the commands
6 smooth movement to the mark of 2.5m.
22 fast transition to the 2.5m mark. This command is followed by two
zero. This command has full equivalents: 38, 70, 86.
68 rotate the lens drive to a given angle. The angle is given by the following two
bytes (short int, high byte first).
You can find out the current angular position with the command 192.
Command 4 is used to stop. Thus, by manipulating commands 5/6
and 4 you can achieve a gradual change in focal length. Beyond waiting
to change the focal length to the desired value after commands 5 or 6
you can send null messages.
In response to command 128, the lens always sent the same stream of information. Perhaps this command is asking for the characteristics (model) of the lens.
In addition, some obscure commands were found, to which the lens answered something.
Canon EF85
After the EF 200, we got our hands on the EF 85, with which the same experiments were performed (but without the oscilloscope and unnecessary analyzes - I immediately got down to business). I must say that by that time the EF 200 had already “left” along with the spectrograph (where this lens was used as a camera), so the protocols were refined based on the EF 85.
It was found that, unlike the EF 200, this lens is rather "wayward": without the command
initialization 10, it is simply "silent".
Command 194 lets you know the focus distance (in centimeters). The answer is four bytes. The first two of them are the current distance, the second two are the previous position. In a pair of numbers, we multiply the first by 250cm and add it to the second.
192 allows you to find out more useful information - the angular position of the limb (from some conditional zero). The answer is two bytes (short int, high byte first).
Aperture control is performed by sending byte 18 (the command itself) twice and a non-zero byte containing information about how much the current state of the aperture needs to be changed (signed char): a positive number to decrease the relative aperture, a negative number to increase it.
All commands can be conditionally divided into two halves: if the most significant bit of the command is zero, the lens performs certain actions. When the most significant bit of the command is equal to one, certain data is requested from the lens.
The focus commands are similar (except for the word length of the response). The lower 4 bits take on the values 0100 (stop), 0101 (F+), 0110 (F-), the most significant bit is always 0.
Bits 4-6 take on any value except 110, 011, and 111.
With a small change in the state of the diaphragm, each command 2 or 3 repeats this change. In addition, the lens enters the step-by-step focus adjustment mode. The exit from this mode is command 8 (or its equivalents 11, 27, 43, 75).
Command Summary
So, I will give a summary list of commands for controlling these two lenses.
Teams whose purpose has not been identified will not be given in the table.
If the action of a command is similar to another command, this command is written in the description.
By F is meant the value of the distance to the object whose image
clearly focused. The letter "o" in the description means that the purpose of the command
unknown, but it leads to the disengagement of the manual control F.
If there are entries separated by a slash in the answers, it means that at different points in time
one or the other of the above commands appears with no apparent dependence.
Explanation of column designations:
cmd - command;
N is the minimum response length in bytes;
ans - answer (in case of changing answer - range);
desc is a short description of the command.
cmdNansdesc
010 "dummy" for receiving a response from the lens
212repeat previous aperture change, short step mode
414stop changing F
4 1 4 stop changing F
5 1 5 increase F
6 1 6 decrease F
7 1 7 o
8 2 255/0, 170 cancel command 2
9 1 9 o
10 1 10 EF85 lens initialization (without this command, it will not wake up from sleep mode)
18 2 18, 18 gate control, the second byte (signed char) sends the degree of change
hole diameter (positive values correspond to a decrease in diameter)
23 2 23, 23 about
25 2 25, 25 o
30 2 30, 30 (EF~200 equivalent to command 94)
39 2 39, 39 o
41 2 41, 41 o
68 3 68, 68, 68 move the lens by the specified number of steps (2 bytes, int16, hi-low)
71 3 71, 71, 71 o
73 3 73, 73, 73 o
78 3 78, 78, 78 (EF~200 equivalent to command 94)
87 2 87, 87 o
89 2 89, 89 o
94 2 94, 94 enable manual control F
128 6 129, 239, 0.85, 0.85 lens model ?
144 2 0/32, X most significant bit X - switch value "AF / MF" (zero corresponds to AF)
192 2 short int angular position of F dial, first byte is high, zero is relative
194 4 X1, X2, Y
1, Y2 F value in meters; X - current F, Y - previous F; F(meter) = 2.5 X1 + X2/100
Vladmir's website
留言
張貼留言