The index page.
A page about a ring-flash I am working on.
My old old page about the flash connector.

The E-TTL Protocol

Ever since I got my Canon Powershot G3 I have tried to find some documentation on the protocol used on the "hot shoe" flash connector. Fortunately, I was recently able to borrow a Speedlite 550EX flash unit and an EOS 50 (non-digital) camera from colleagues at work, so documenting at least parts of the protocol was simply a matter of hooking up a camera and the flash to an oscilloscope and monitoring the data. Note that the following text only applies to what I observed in the communications between the 550EX and either the PS G3 or the EOS 50, Canon is notorious for changing something with each new camera version with odd behavior in 3rd party flash units as a result.

The connector


There is a small switch on the right hand side, below the spring below the rail. Pushing it down turns the internal flash off, and changes the flash- settings scale in manual mode. The preferred point for connecting to ground seems to be the insides of the "rails". The small hole is for a locking pin (The speedlite implements this).

Pinout:
           (X)
    
   (STSPC)     (EFIDO)
   
   (AVEFI)      (CCC)

The electrical interface

X signal is used for trigging the main flash, the high level is 3-5V, the low level is ground. When using 1st curtain sync X remains low while the shutter is open.

CCC (or whatever) is, as far as I can tell only used for enabling the pilot lamp in the flash unit. Keeping it at ground seems fine (the PS G3 does this), the EOS 50 keeps it at about 1.25V idle and raises it to about 3.2V to turn on the pilot lamp.

The remaining 3 pins (STSPC, AVEFI, EFIDO) are used for data transfer, the low level of all 3 pins is about 2.2V (ie, the do _not_ go to ground during normal signaling), with high levels of 5V, 3.7V and 3.3V respectively.
The exception is STSPC which is driven to ground by the PS G3 when trigging the preflash (the EOS 50 only drives it "low", but instead twice, see command B4). Apparently the protocol (the B4 command with some argument?) instructs the flash to interpret the next transition on STSPC as a trigger. The EOS 50 pulls STSPC low slightly before X (when it physically releases the shutter?), the PS G3 keeps STSPC high during the main flash.

AVEFI is driven by the flash and EFIDO by the camera. The presence of a E-TTL flash is recognized by a "high" level on AVEFI (the idle state), otherwise the camera (G3) keeps STSPC high and EFIDO low, (their idle states), without attempting to transmit any data.

Data is driven on falling edges and latched on rising edges, MSB is sent first on both lines. Clock rates seem to be in the order of 50 to 100kHz.

A byte:

Blue: STSPC, red: AVEFI and green: EFIDO.

Note that the flash keeps AVEFI low for a while (usually about 100us), presumably to indicate "busy" on a link level. In case the last bit on AVEFI is 1, the AVEFI line goes low about 10us after the last rising edge. This agrees well with the camera never tries to clock any data when no voltage is applied at AVEFI (i.e, a non-E-TTL flash is connected).

EFIDO is driven high a few us before the transmission of a byte, even if the first byte on EFIDO is 0. If the last bit on EFIDO is 1 the camera holds that state for about 40us after the last rising edge before returning EFIDO low.

Note that the flash occasionally interprets STSPC going low or ground (trigging a preflash) as a clock transition and outputs the first bit of a pending data byte. This error is handled somehow (timeout between bit clks?), i.e, when clock later has gone back high and the camera starts clocking everything works fine. Also, only the PS G3 keeps all lines at their idle states at all times, and only when the display is on, otherwise all lines except X are kept at ground and rises to their idle levels when the camera becomes active (when taking a picture or otherwise activating it in a way that makes it reasonable to transfer new settings), then returning the lines to ground. Consecutive bytes are usually separated by 500us or more.

Taking a picture with the EOS 50:

Blue: STSPC, red: AVEFI, green: EFIDO and black: CCC.
The pilot lamp is used in two pulses. The X signal is not shown in this figure, but should almost coincide with STSPC going to ground. The whole figure is about 2.8s.

Another picture with the EOS 50:

Blue: STSPC, red: AVEFI, green: EFIDO and black: X.
Note STSPC going low slightly before X (and going high some time before X goes high). The whole figure is about 2.2s and the shutter is 1/5s. Also note that the camera keeps repeating a small set of commands while focusing etc, and keeps doing this until the trigger is pressed fully.

The protocol

The camera controls clocking and sends commands/data, the flash sends the reply when the camera clocks the next command.

There seems to be two categories of commands: Setting stuff (0xBn and reading stuff 0xFn, in the following text Bn commands are assumed to take one byte arguments and Fn command no arguments, unless a number of bytes is stated explicitly (thus, numbers in the "descriptions" refers to these argument bytes and replies, respectively).


Setting stuff (all numbers except those in brackets are in HEX):


B0: set desired flash intensity, the EOS uses A0 for preflash and the PS G3 90, 
    full intensity seems to be C0
    
    reply: 86, 86 (i.e. 86 is clocked out when the intensity is sent and
           86 is clocked out during the next (whatever) command
    
B1: unknown, PS G3:
           05 usually, sent before the preflash
           2C seen when using HS-flash in manual mode

         EOS 50: 
           AF: shutter time selected to less than 1/125
           FE: shutter time of some number of seconds
           5C: high speed sync (HS), 1/4000
           67: HS, 1/750
           f6: "normal" shutter times
              
    reply: 86-86           
              
B2: only seen with the PS G3, when IR-master mode is selected on the flash.
    (not investigated further)
  
B3: unknown, 2 _or_ 3 bytes of data:
             PS G3: 02-06-03 or 02-46-03 sent now and then, 
                 06-02 sent shortly before main flash (in auto mode)
    
         EOS 50: 02-00 sent now and then
                 22-00 sent after preflash
                 26-00 sent before main flash

    reply 00-00(-00)
  
B4: set trigger/enable flash? always sent before a preflash or a main flash
    is triggered, 1D often sent when not preparing for trigging.
    typical sequence: many 1D's, 3 before selecting intensity of the
    preflash and reading F2, 23 before trigging the preflash with STSPC, 
    1D again after the preflash, followed by 3D before trigging the main
    flash.
    
    This is modified when HS flash is enabled: 05 while idle, 03 before
    setting preflash intensity and checking F2. 23 before preflash, 
    25 before main flash.

    Note that the EOS 50 pulses STSPC low twice about when the preflash is
    expected. I have not verified which of them triggers the preflash, 
    but my guess is the later, based on the protocol.
    
    With the PS G3 in manual mode the sequence becomes:
    19 before command F2 (max avail flash?), followed by 39 before trigging 
    the main flash.
    
    reply: 86-86
    
B5: sent first in each "batch" of commands, 4D on the PS G3, 48 on the EOS 50
    (protocol version/camera features?)
    
    reply: c6-86
    
    
B7: aperture, 00 sent by the PS G3 in manual mode, otherwise:
    18->F2.0 1A->F2.2 23->F3.2 28->F4.0 2D->5.0
    30->F5.6 33->F6.1 34->F6.7 35->F7.1 38->F8.0
    3c->F9.5 40->F11  44->F13  48->F16 4c->F19 50->F22  
    
    reply: 86-86

B8: shutter time, examples:
    2B->3.2s 38->1s 4a->1/5 60->1/30 68->1/60 
    6A->1/80 6F->1/125 78->1/320 96->1/4000

B9: camera mode, always 80 with the PS G3, with the EOS 50:
    bit 7: Manual mode
    bit 6: Aperture priority
    bit 5: Time priority
    bit 3: fast shooting mode enabled
    bit 1: auto-focus enabled

    "P" mode results in neither of bits 5-7 being set

    reply byte 0: flash exposure compensation set in the flash: 
    00-> +-0, 04->-0.5, 8->-1.0, FC->+0.5
    reply byte 1: 86
    

BB: ISO/sensitivity, with the EOS 50 these numbers are modified up 4 for a 
    flash exposure compensation (either camera or flash) of -0.5, 
    down 4 for positive compensations.
    
    40->ISO 50, 48->ISO 100, 4B->ISO 125, 50->ISO 200, 55-> ISO 320, 
    58->ISO 400, 78->ISO 6400

BD: set zoom, usually 2 data bytes, but on the EOS 50 a 3rd byte follows
    the first time the command in a sequence. Byte 0 is always 00.
    Byte 1: zoom in millimeters (or something very close).
    Byte 2, when present: 28
    
    reply:
    18-69- if the zoom is changing,
    aa-59-00 if the zoom didn't change. 
   
One can speculate that 86 returned by most commands is some type of status.



Reading stuff:
F2:  Max available flash intensity? (max C0 for main, A0 for preflash), 
         
F5:  
     PS G3: Up to 4 bytes (read using FF) (ok to read less)
         53-41-14-00 normal
         53-40-14-00 with flash in manual mode
         57-         with flash in HS-mode
         53-41-15-00 if IR-master enabled
         
         
     EOS 50: Up to 3 bytes read
         53-01-00 normal,
         57-01-00 with HS
         other combinations not tested
     
F7: checked by the PS G3 before command B0, reply: 7B
    
F8: directly after preflash, actual intensity used?
    typical numbers around 4B to 55, ff when IR-master enabled.                 
    Affected by charge status but not by covering the flash.
             
F9: status?
    55 normal with the flash head pointing straight forward (or 7deg down)
    5d normal if pointing in any other direction (only tested on PS G3)
    54 not enough energy to flash
    57 2nd curtain sync selected on the flash (only tested on PS G3)
    75 if the flash changing the zoom (busy)

FB: flash mode: 02 if normal, 00 if manual or strobe

FF: Dummy command for reading more reply bytes from other commands
    This command is also sent after STSPC has been pulsed low once
    (to trig a preflash), by the EOS 50. (The PS G3 continues with a F8)



Example files:

Ascii byte lists, first column is the byte clocked out of the flash, the second is the command sent by the camera. As explained earlier, replies appear one byte later.
Taking a picture with the PS G3, Av mode. annotated Ascii plain ascii binary
Taking a picture with the PS G3, manual mode, (1/50,F3.5). plain ascii Zooming in with the PS G3. plain ascii Taking a picture with the EOS 50. plain ascii binary
Taking a picture with the EOS 50 with high speed sync (HS). plain ascii
Taking 3 pictures in "rapid" mode with the EOS 50, flash only firing on the first 2. plain ascii

I have several more files which I will consider making available to individuals on request. Most files are quite boring variations designed to find out the scales of things like aperture. Please state which condition you are interested in and I'll check if I have anything relevant.


joborg,"at",gmail,com
(

The standard disclaimer apply, if you break things, you get to keep both halves. Do not assume that "keeping" both halves is trivial. This is especially true in (but not limited to) cases such as gaseous products (blue smoke), and matter annihilation. The owner of this site will definitely not help you put the parts back together, but feel free to contact him in advance if you expect annihilation of substantial amounts of matter to take place. Canon, Powershot, Speedlite, EOS, E-TTL, etc are trademarks property of their receptive owners.