No Script, No Fear, All Opinion
RSS icon Home icon
  • EEVblog #297 – Canon LANC Bus Reverse Engineering

    Posted on June 24th, 2012 EEVblog 18 comments


    Dave does some initial investigation into reverse engineering the (Sony) LANC wired remote control bus protocol on his Canon HF G10 video camera.

    Be Sociable, Share!
    • Anatol

      One of the best videos! Well done

    • Anatol

      Hmm.. I suggest you to capture the command 0x3A (rec) in byte 1 that remote conrol generates itself instead of listening to status byte. The change of this byte has not been demonstrated

    • Niklas Jansson

      Does the last 3 bytes of the message, the ones with the presumed time code, change when the recording is off? If not, then perhaps this could be used to detect recording. Some filtering might be needed, but the basic idea:

      Copy the last 3 message bytes to ThisTimeStamp

      if(ThisTimeStamp != LastTimeStamp)
      Record = 1;
      else
      Record = 0;

      LastTimeStamp = ThisTimeStamp;

    • Krishna Chaitanya

      Hello dave,

      Maybe a USB Logic Analyzer will be a better option for capturing the states.

      I suppose you could capture the data bytes properly when you press individual buttons and then compare against the previous and next bytes.
      (Of course excluding the constant stream of data that the camera sends to the remote)

      all the best dave.
      Hope you find a solution.

    • Qno

      Hi Dave,

      Why not go for the low tech solutions like placing a small mirror next to the camera to see the record indicator on the screen….

    • Derek

      Hi Dave

      You could try the segmented memory capture so that you can look at the last three bytes in more depth, this is a nice feature of these scopes.

      Dere

    • f4eru

      usually while doing this, i put two diodes in antiparalell in series wih the line. This lifts the ouput logic level of one side some 600mV, which does not influence communication, bu shows you live and clearly on the scop which side is transmiting a specific bye. Very usfull, and works on almost any bus type, including CAN, I2C …

    • kyndal

      i would use my usb logic analyzer..
      hard if not imposible to judge anything from “running” data like that..

      Also i would split the bus so
      there is no doubt which side is TX’in..

      haven’t tried the diode approach mentioned. feel like trying it right now.. sounds really useful..

      /Kyndal

    • kyndal

      i would use my usb logic analyzer..
      hard if not impossible to judge anything from “running” data like that..

      Also i would split the bus so
      there is no doubt which side is TX’in..

      haven’t tried the diode approach mentioned. feel like trying it right now.. sounds really useful..

      /Kyndal

    • fox

      what if you convert record button on your remote to turn on recording and light at the same time.
      i think that is the simplest possible idea.

    • Worf

      LANC code spec:
      http://www.boehmel.de/lanc.htm

      Looks like the last three bytes are not JUST a timecode, but a rolling summary of a lot of bits. Including – recording record/pause mode!

      The data’s encoded on there.

      In other words – Dave gave up too soon!

      • Alex

        Perhaps I am misreading the spec posted, but where do you see bits for recording record/pause mode in the last three bytes?

        As for the video, great content with great hook for community feedback – these are the kind of videos I’d love to see more of!

        • Worf

          Byte 4 – status code from connected device.

          0x04 – record
          0x14 – record/pause
          also
          0xA4 – Camera rec
          0xB4 – Camera standby

    • Jimbo

      Great Investigation

      I have been doing this exact investigation at work to remotely control the HFG10 via RS232. Unfortunately I came up with exactly the same result, no status bit. I also checked out the LANC stream on an older SONY camera we have and the status bit does change relative to the camera function. As far as I am aware LANC is really a SONY protocol that Canon also implements but without support for all commands. You can see this when you connect up a LANC remote, some features just don’t work such as the photo button – if you need these features then IR emulation is the only way. I didn’t have any luck decoding any discernable pattern in the last couple of data bytes either, but hopefully someone else will.

      As far as a recording indicator goes the SD card access light at the back of the camera does flash at irregular intervals during recording, I was looking at a system that monitors that to indicate the condition of the camera. Alternatively, I you could measured the current draw from the AC adaptor, there is increase when recording so you could potentially use that……

      Or just switch the sign on yourself!

      • http://www.eevblog.com EEVblog

        Thanks for the confirmation. Probably not worth me doing any further investigation then :-(

    • Kenny

      Hi Dave

      These guys (see link below) seem to have already hacked it, most of what you are looking for is probably burried in the source code.
      from what i remember of sony P2 (like LANC but over RS422 for broadcast machines) the web page makes sense.

      http://www.esac.org.uk/SonyLancControl.asp

    • http://www.nursebob.org Bob Dunlop

      Interesting, with some useful resources. I have the HG10 and have been playing with a “dead bug” soldering hack using an msp430 activate the switch for the IR control make a poor man’s time-lapse control to start-stop recording (worked for my short-term needs). But, given what I’ve read, while it might be a useful learning exercise, I don’t see any other profit in building an IR MSP430 PCB to accomplish a similar task, or replicate other IR remote functions.

      Bob

    • Russ

      Really brilliant video. You make it look so easy. I guess that is what talented people do. I have always wanted to see the details of how this is approached and hope to see more things like this.
      Thanks
      Russ