Teardown reveals ‘overheating timer’ chip inside Canon EOS R6


At Kolari Imaginative and prescient, we like to tear into the most recent digital camera gear to learn the way they work and if they are often modified for infrared images, full spectrum images, or different issues. We’re actually excited concerning the R5/R6 launch, and plan so as to add some cooling modes and switch it into a correct video digital camera.

report from eoshd That Canon makes use of an overheat timer as an alternative of an precise temperature studying left us a bit dissatisfied, and questioned whether or not bodily cooling the digital camera might actually present extra capturing time.

Andrew Reid was in a position to bypass this timer by utilizing a screw to override the protection shutoff change within the battery door compartment and carry out a tough shutdown throughout recording, but it surely appears to deprave video information. The “Math class” on Baidu lately confirmed that eradicating the clock’s battery may bypass this timer. A firmware replace on the R5 by Canon additionally lately elevated capturing size arbitrarily, indicating that software program can have an effect on shutdown occasions altogether.

These knowledge thus far present that the digital camera retains inner time, retains time when the digital camera is turned off, and makes use of these values ​​to affect when capturing is resumed. A tough shutdown corrupts some knowledge being written, stopping a time restrict from being established. Clock Battery Elimination means that with out clock protecting time whereas the digital camera is off, there is no such thing as a solution to arrange a countdown timer, and the digital camera defaults to zero when capturing.

With this information, we needed to research how the digital camera works with out the clock battery, whether or not we might determine the bodily clock chip on the board, and whether or not there was a extra superior modification that could possibly be performed to permit clock timer communication with out date/time. It may be performed to interrupt by affecting the time. Adjustment. Proper now we solely have R6 to work with, however we suspect R5 works in an identical method. If anybody has R5, please contact us.

So first, let’s begin with the watch’s battery. It may be discovered on the again of the principle circuit board.

The very first thing we needed to test was, how does lacking the battery have an effect on the overall efficiency? The clock has positively been reset, however on different Canon cameras it has stopped saving capturing settings and customized settings, which might be a deal breaker.

So we arrange some customized menus, modified some capturing values ​​and a few menu settings, after which proceeded to empty the watch’s battery. Leaving the board fully off with none battery supply for about half-hour, we reassembled the digital camera with out battery and examined it. We acquired the anticipated sign for time/date, however had been pleasantly shocked to seek out that the remainder of our settings had been nonetheless there. Good!

We additionally discovered that the digital camera retains time so long as the principle battery is on, even when turned off.

Subsequent, can we work out the place the battery connects. Upon visible checking, the leads from the battery instantly moved right into a center layer on the underside of the board, so we could not hint them visually. Oh properly, we now have a multimeter!

Checking continuity from the leads, I used to be in a position to instantly hint the proper result in widespread floor. The left constructive lead was a bit tight, however the hint should come out someplace, so I circled the testing parts throughout the board on either side. A bit tedious, however I used to be solely in a position to determine one chip that the battery feeds on.

We wanted a microscope to learn the chip, however we had been in a position to determine it because the RX8130 Actual Time Clock with a 59-page documentation PDF. Bingo. That is what retains time.

The wiring diagram for the RX8130 appears like this (see under). I used to be in a position to detect the clock battery feed into pin 10 by way of the 470 ohm resistor. Pin 7 additionally connects to floor. Curiously, pins 6, 2, and three both connect with nothing, or join on to one thing that goes underneath the board. To see extra definitively we have to take away the chip, however presumably they don’t seem to be used.

From the documentation pin 4 is used for frequency out, and this pin 6 connects to the chip instantly to the proper which solely reads pQ on it, hopefully somebody has extra data on this chip. Pin 5 results in elsewhere on the board that we can’t determine. Pin 1 connects to a distant BGA mounted chip in what appears like a smoothing capacitor connection to floor. Pins 8 and 9 additionally join someplace we will not hint but and now have smoothing capacitors.

Thus far, we now have made the identical progress. We prefer to be clear in our mods, so we determined to open up our analysis right here.

Primarily based on the documentation of this chip, our primary understanding is that this chip first will get energy from the principle board, and if there is no such thing as a energy, it will get energy from the backup button cell battery. The chip is able to protecting time, and may output time knowledge, in addition to different saved knowledge, with some room for regular bit storage. The chip can also be able to sending again interrupt and knowledge indicators, however thus far it would not seem that these pins are getting used. Canon is just not utilizing the interior interrupt and timer capabilities, and could also be utilizing this chip solely as a timekeeper elsewhere.

Our subsequent plan is to confirm this with R5, and take the chip out and see if we will measure any sign in a scope in the course of the precise overheating occasion. In the meantime, with how the settings storage is dealt with, it looks as if we must always be capable to take away the watch battery, or put the watch battery on a separate toggle change. Additionally we will in fact bypass the onerous reset screw method performed by Andrew Reid, and energy on a tough change resulting in the principle board. We are able to additionally management these switches from the microcontroller and pressure a tough reset by way of software program if wanted, say one thing like, the digital camera cycles a tough shutdown after quarter-hour after hitting file, or a The coordinated shutdown is mixed with the clock reset as a coordinate. Competitors.

We additionally wish to take a look at how the digital camera behaves when the clock is just not powering on, even when the digital camera is on. I think a tough error, however who is aware of! However we’d like an R5 to start out. Web please. You may mortgage or promote us when you have one, we’ll share every thing we discover publicly and offer you entry to our Frankenstein Bypass Final R5 Mod first.

one final necessary notice:Whereas it appears sure that Canon is utilizing a timer circuit to show off the R5 in overheating, we will solely speculate as to why for now. It is potential that that is to “cripple” the digital camera, but it surely’s nonetheless fairly potential that there are some overheating issues for this weather-sealed physique, they usually’re going off based mostly on longer timer schedules. .

I’d method any of those bypass ways with excessive warning, as they’ll in all probability not solely void your guarantee, however probably fry your digital camera from prolonged capturing. We nonetheless plan to open up R5 and add a heatsink that’s thermally related to the overheating chips and card slot, and enclose this heatsink in an aluminum cage for dissipation, plus an energetic fan . On this chilly context, we anticipate the R5 to be very cool for prolonged capturing, however this may require bypassing the timer shutdown.

So tell us what you suppose and when you have any chip insights! What would you want us to attempt subsequent?

In regards to the Writer: Ilija Melentijevic is a scientist/photographer and proprietor of Collari Imaginative and prescient, an infrared digital camera conversion enterprise based mostly in New Jersey. The views expressed on this article are these of the writer solely. You may be taught extra concerning the firm’s service on its web site. This text was additionally revealed right here.


Supply hyperlink