Difference between revisions of "Canon PowerShot G9"

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
VisualWikitext
(added parts identification)
(moved description of JTAG/UART connector to Hacking section)
 
(6 intermediate revisions by the same user not shown)
Line 1: Line 1:
 
Teardown of the Canon PowerShot G9 point-and-shoot camera.
 
Teardown of the Canon PowerShot G9 point-and-shoot camera.
  
−
12.1 MP CMOS with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].
+
12.1 MP, 1/1.7" CCD image sensor with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].
 +
 
 +
Technical details, including firmware dumps, on the [https://chdk.fandom.com/wiki/G9 CHDK Wiki].
  
 
==Teardown Pictures==
 
==Teardown Pictures==
Line 16: Line 18:
 
The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.
 
The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.
  
−
=== Main PCB ===
+
===Main PCB===
  
−
==== CPU/DSP ====
+
====CPU/DSP====
 
IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)
 
IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)
  
 
IC1002, IC1003 JRC '''NJM2877''' LDO
 
IC1002, IC1003 JRC '''NJM2877''' LDO
  
−
* Marking 7 14 71, 5-pin package
+
*Marking 7 14 71, 5-pin package
  
 
IC1004 marking FA, 5-pin package, LDO?
 
IC1004 marking FA, 5-pin package, LDO?
Line 29: Line 31:
 
IC1005 Seiko S-817 series LDO?
 
IC1005 Seiko S-817 series LDO?
  
−
* Marking G8X, 4-pin package
+
*Marking G8X, 4-pin package
  
 
IC1006 Seiko S-817 series LDO?
 
IC1006 Seiko S-817 series LDO?
  
−
* Marking B9O, 4-pin package
+
*Marking B9O, 4-pin package
  
 
IC1007 Seiko Epson '''RX-4571LC''' real time clock
 
IC1007 Seiko Epson '''RX-4571LC''' real time clock
  
−
* Marking E4571
+
*Marking E4571
  
 
SR1001 Landscape/portrait orientation sensor?
 
SR1001 Landscape/portrait orientation sensor?
Line 43: Line 45:
 
Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors
 
Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors
  
−
* Marking 6B, 6-pin package
+
*Marking 6B, 6-pin package
  
 
Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors
 
Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors
  
−
* Marking XB, 6-pin package
+
*Marking XB, 6-pin package
  
 
Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors
 
Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors
  
−
* Marking 6D, 6-pin package
+
*Marking 6D, 6-pin package
  
 
D1001 Panasonic '''MA2S111''' Switching Diode
 
D1001 Panasonic '''MA2S111''' Switching Diode
  
−
* Marking A, 2-pin package    (silver)
+
*Marking A, 2-pin package    (silver)
  
 
D1002 Panasonic '''MA3S132E''' Dual Switching diodes
 
D1002 Panasonic '''MA3S132E''' Dual Switching diodes
  
−
* Marking MU, 3-pin package
+
*Marking MU, 3-pin package
  
 
CN1001 flat flex to DC/DC PCB
 
CN1001 flat flex to DC/DC PCB
Line 65: Line 67:
 
CN1002 flat flex to jog dial unit, TOP_M FPC
 
CN1002 flat flex to jog dial unit, TOP_M FPC
  
−
CN1003 unpopulated/undocumented -> JTAG/Serial?
+
CN1003 unpopulated/undocumented -> JTAG/Serial? (see below)
−
 
 
−
* Located near to SD card holder
 
−
* Multiple pads connected to test points
 
  
 
CN1004 USB/digital
 
CN1004 USB/digital
Line 76: Line 75:
 
SW1001 switch, battery cover open detect
 
SW1001 switch, battery cover open detect
  
−
==== CCD Interface ====
+
====CCD Interface====
 
IC2002, IC2003 JRC '''NJM2877''' LDO
 
IC2002, IC2003 JRC '''NJM2877''' LDO
  
−
* 5-bin package
+
*5-bin package
  
 
IC2004 marking 11 77 41, 6-pin package
 
IC2004 marking 11 77 41, 6-pin package
Line 89: Line 88:
 
IC2008 JRC '''NJM2877''' LDO
 
IC2008 JRC '''NJM2877''' LDO
  
−
* 5-pin package
+
*5-pin package
  
 
IC2009 not populated
 
IC2009 not populated
  
−
* 5-pin package
+
*5-pin package
  
 
CN2001 connector for image sensor assembly  
 
CN2001 connector for image sensor assembly  
  
−
==== Lens Motor Driver ====
+
====Lens Motor Driver====
 
IC3001 Toshiba '''TB6609FL''' motor driver?
 
IC3001 Toshiba '''TB6609FL''' motor driver?
  
Line 104: Line 103:
 
CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)
 
CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)
  
−
==== Image Stabilization ====
+
====Image Stabilization====
 
IC3201 Renesas(?) '''R2J30504''' 725104
 
IC3201 Renesas(?) '''R2J30504''' 725104
  
−
* CK4-1105: Canon part number?
+
*CK4-1105: Canon part number?
−
* Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS
+
*Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS
  
 
SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors
 
SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors
  
−
* 1x ENC-03RC-R and 1x ENC-03RD-R
+
*1x ENC-03RC-R and 1x ENC-03RD-R
  
−
==== LCD Driver ====
+
====LCD Driver====
 
IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?
 
IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?
  
Line 121: Line 120:
 
CN4002 LCD backlight
 
CN4002 LCD backlight
  
−
==== Audio/Video ====
+
====Audio/Video====
 
IC4501 Wolfson '''WM1400G''' Audio driver/Codec
 
IC4501 Wolfson '''WM1400G''' Audio driver/Codec
  
 
IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF
 
IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF
  
−
* Marking A51, 6-pin package
+
*Marking A51, 6-pin package
  
 
IC4503 unpopulated
 
IC4503 unpopulated
Line 134: Line 133:
 
CN4502 A/V out
 
CN4502 A/V out
  
−
==== Mystery ====
+
====Mystery====
 
[[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]
 
[[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]
 
The function of this section, and its main chip IC502 is unclear.  
 
The function of this section, and its main chip IC502 is unclear.  
Line 140: Line 139:
 
IC501 JRC '''NJM2877''' LDO
 
IC501 JRC '''NJM2877''' LDO
  
−
* marking 7 12 62, 5-pin package
+
*marking 7 12 62, 5-pin package
  
 
IC502 the Mystery IC
 
IC502 the Mystery IC
  
−
* Transparent package
+
*Transparent package
  
−
* The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.
+
*The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.
  
 
Q501 SOT23-6 marking FM
 
Q501 SOT23-6 marking FM
Line 152: Line 151:
 
ZD501 marking R, reverse biased
 
ZD501 marking R, reverse biased
  
−
=== DC/DC PCB ===
+
===Power PCB===
 
IC601 FE '''7761R''' multi-output DC-DC power management controller
 
IC601 FE '''7761R''' multi-output DC-DC power management controller
  
 
IC691 Seiko S-817 series LDO?
 
IC691 Seiko S-817 series LDO?
  
−
* Marking CUW, 4-pin package
+
*Marking CUW, 4-pin package
  
 
BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery
 
BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery
Line 165: Line 164:
 
CN651 flat flex to main PCB
 
CN651 flat flex to main PCB
  
−
=== Top_M FPC ===
+
===Top Camera Control FPC===
  
−
==== Button controls ====
+
====Button controls====
 
CN251 to TOP_I FPC
 
CN251 to TOP_I FPC
  
 
D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes
 
D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes
  
−
* Marking M1B, 4-pin package
+
*Marking M1B, 4-pin package
  
 
D253 Panasonic '''MA3S132E''' Dual Switching diodes
 
D253 Panasonic '''MA3S132E''' Dual Switching diodes
  
−
* Also 4x on rotary dial FPC
+
*Also 4x on rotary dial FPC
−
* Marking MU, 3-pin package (silver)
+
*Marking MU, 3-pin package (silver)
  
 
D? Panasonic '''MA2S111''' Switching Diode
 
D? Panasonic '''MA2S111''' Switching Diode
  
−
* 1x rotary dial FPC
+
*1x rotary dial FPC
−
* Marking A, 2-pin package (silver)
+
*Marking A, 2-pin package (silver)
  
−
==== Power ====
+
====Power? Flash?====
 
Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors
 
Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors
  
−
* Marking 6D, 6-pin package
+
*Marking 6D, 6-pin package
  
 
Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET
 
Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET
 +
[[File:Canon PowerShot G9 debug header.jpg|thumb|Unpopulated connector CN1003, probably for JTAG and UART]]
  
−
<br />
+
== Hacking ==
 +
Unpopulated connector CN1003 located on back of main board
 +
 
 +
* Candidate for JTAG and/or UART
 +
* Located near to SD card holder
 +
* Multiple pads connected to test points
 +
* Pin-out likely same as documented [https://web.archive.org/web/20200302085303/https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/ here].
 +
<syntaxhighlight lang="c">
 +
      TX  -  _  RX
 +
    GND  -  _  3.3V
 +
    SHDN  -  _  N/C
 +
    N/C  -  _  HALF_BAUD
 +
      PD  -  _  ALT_BOOT
 +
      PD  -  _  /TRST
 +
    TDI  -  _  TMS
 +
    TCK  -  _  TDO
 +
    /OFF  -
 +
</syntaxhighlight>

Latest revision as of 00:02, 9 October 2023

Teardown of the Canon PowerShot G9 point-and-shoot camera.

12.1 MP, 1/1.7" CCD image sensor with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007

Canon PowerShot G9

A service manual with assembly diagram, but no schematic, can be found on the internet.

Technical details, including firmware dumps, on the CHDK Wiki.

Teardown Pictures

Main PCB, top view
Main PCB, bottom view
Power PCB, top view
Power PCB, bottom view
Top camera control PCB (mode selection, shutter button, power button, flash control)
Back camera control PCB (jog-wheel, various buttons)
12.1 MP CMOS image sensor

Parts Identification

Assembly diagram of main PCB with component designators

The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.

Main PCB

CPU/DSP

IC1001 Canon Digic III, and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)

IC1002, IC1003 JRC NJM2877 LDO

  • Marking 7 14 71, 5-pin package

IC1004 marking FA, 5-pin package, LDO?

IC1005 Seiko S-817 series LDO?

  • Marking G8X, 4-pin package

IC1006 Seiko S-817 series LDO?

  • Marking B9O, 4-pin package

IC1007 Seiko Epson RX-4571LC real time clock

  • Marking E4571

SR1001 Landscape/portrait orientation sensor?

Q1003, Q1010, Q1011 Toshiba RN4982FE NPN PNP Transistors with 10K Bias Resistors

  • Marking 6B, 6-pin package

Q1005, Q1007, Q1008 Toshiba RN1902FE Dual NPN Transistors with 10K Bias Resistors

  • Marking XB, 6-pin package

Q1012 Toshiba RN4984FE NPN PNP Transistors with 47K Bias Resistors

  • Marking 6D, 6-pin package

D1001 Panasonic MA2S111 Switching Diode

  • Marking A, 2-pin package (silver)

D1002 Panasonic MA3S132E Dual Switching diodes

  • Marking MU, 3-pin package

CN1001 flat flex to DC/DC PCB

CN1002 flat flex to jog dial unit, TOP_M FPC

CN1003 unpopulated/undocumented -> JTAG/Serial? (see below)

CN1004 USB/digital

CN1005 SD card holder

SW1001 switch, battery cover open detect

CCD Interface

IC2002, IC2003 JRC NJM2877 LDO

  • 5-bin package

IC2004 marking 11 77 41, 6-pin package

IC2005 Sony D4807GA analog frontend

IC2006 marking AED3, 5-pin package

IC2008 JRC NJM2877 LDO

  • 5-pin package

IC2009 not populated

  • 5-pin package

CN2001 connector for image sensor assembly

Lens Motor Driver

IC3001 Toshiba TB6609FL motor driver?

IC3002 Toshiba TB6552FNG Dual-Bridge Driver for DC Motors

CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)

Image Stabilization

IC3201 Renesas(?) R2J30504 725104

  • CK4-1105: Canon part number?
  • Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS

SR3201, SR3202 Murata ENC-03 series, angular rate sensors

  • 1x ENC-03RC-R and 1x ENC-03RD-R

LCD Driver

IC4001 15019GB 7CR0G 070 LCD power? Driver?

CN4001 LCD panel

CN4002 LCD backlight

Audio/Video

IC4501 Wolfson WM1400G Audio driver/Codec

IC4502 JRC NJM2571 Low Voltage Video Amplifier with LPF

  • Marking A51, 6-pin package

IC4503 unpopulated

CN4501 Microphone

CN4502 A/V out

Mystery

Low resolution die image of mystery IC502

The function of this section, and its main chip IC502 is unclear.

IC501 JRC NJM2877 LDO

  • marking 7 12 62, 5-pin package

IC502 the Mystery IC

  • Transparent package
  • The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.

Q501 SOT23-6 marking FM

ZD501 marking R, reverse biased

Power PCB

IC601 FE 7761R multi-output DC-DC power management controller

IC691 Seiko S-817 series LDO?

  • Marking CUW, 4-pin package

BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery

CN601 battery connector

CN651 flat flex to main PCB

Top Camera Control FPC

Button controls

CN251 to TOP_I FPC

D251, D252, 254, D255 Panasonic MA4Z159 Dual Switching Diodes

  • Marking M1B, 4-pin package

D253 Panasonic MA3S132E Dual Switching diodes

  • Also 4x on rotary dial FPC
  • Marking MU, 3-pin package (silver)

D? Panasonic MA2S111 Switching Diode

  • 1x rotary dial FPC
  • Marking A, 2-pin package (silver)

Power? Flash?

Q581 Toshiba RN4984FE NPN PNP Transistors with 47K Bias Resistors

  • Marking 6D, 6-pin package

Q582 ROHM 2SK2715 10V drive N-Ch MOSFET

Unpopulated connector CN1003, probably for JTAG and UART

Hacking

Unpopulated connector CN1003 located on back of main board

  • Candidate for JTAG and/or UART
  • Located near to SD card holder
  • Multiple pads connected to test points
  • Pin-out likely same as documented here.
      TX  -  _  RX
     GND  -  _  3.3V
    SHDN  -  _  N/C
     N/C  -  _  HALF_BAUD
      PD  -  _  ALT_BOOT
      PD  -  _  /TRST
     TDI  -  _  TMS
     TCK  -  _  TDO
    /OFF  -
Retrieved from "https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&oldid=2034"