@@ Line 1: / Line 1: @@
 Teardown of the Canon PowerShot G9 point-and-shoot camera.
-.1 MP CMOS with 6x IS optical zoom
+.1 MP, 1/1.7" CCD image sensor with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].
-Released in Oct 2007, PCB date code 29th week of 2007
+Technical details, including firmware dumps, on the [https://chdk.fandom.com/wiki/G9 CHDK Wiki].
-[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9]]
 ==Teardown Pictures==
 [[File:Canon PowerShot G9 Main PCB Top.jpg|thumb|Main PCB, top view|alt=|none]]
-<br />
 [[File:Canon PowerShot G9 Main PCB Back.jpg|thumb|Main PCB, bottom view|alt=|none]]
 [[File:Canon PowerShot G9 Power PCB Top.jpg|thumb|Power PCB, top view|alt=|none]]
@@ Line 16: / Line 14: @@
 [[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]
-== Parts Identification ==
+==Parts Identification==
-<br />
+[[File:Canon PowerShot G9 Main PCB Assembly Diagram.png|thumb|Assembly diagram of main PCB with component designators]]
+The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.
+===Main PCB===
+====CPU/DSP====
+IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)
+IC1002, IC1003 JRC '''NJM2877''' LDO
+*Marking 7 14 71, 5-pin package
+IC1004 marking FA, 5-pin package, LDO?
+IC1005 Seiko S-817 series LDO?
+*Marking G8X, 4-pin package
+IC1006 Seiko S-817 series LDO?
+*Marking B9O, 4-pin package
+IC1007 Seiko Epson '''RX-4571LC''' real time clock
+*Marking E4571
+SR1001 Landscape/portrait orientation sensor?
+Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors
+*Marking 6B, 6-pin package
+Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors
+*Marking XB, 6-pin package
+Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors
+*Marking 6D, 6-pin package
+D1001 Panasonic '''MA2S111''' Switching Diode
+*Marking A, 2-pin package     (silver)
+D1002 Panasonic '''MA3S132E''' Dual Switching diodes
+*Marking MU, 3-pin package
+CN1001 flat flex to DC/DC PCB
+CN1002 flat flex to jog dial unit, TOP_M FPC
+CN1003 unpopulated/undocumented -> JTAG/Serial? (see below)
+CN1004 USB/digital
+CN1005 SD card holder
+SW1001 switch, battery cover open detect
+====CCD Interface====
+IC2002, IC2003 JRC '''NJM2877''' LDO
+*5-bin package
+IC2004 marking 11 77 41, 6-pin package
+IC2005 Sony '''D4807GA''' analog frontend
+IC2006 marking AED3, 5-pin package
+IC2008 JRC '''NJM2877''' LDO
+*5-pin package
+IC2009 not populated
+*5-pin package
+CN2001 connector for image sensor assembly
+====Lens Motor Driver====
+IC3001 Toshiba '''TB6609FL''' motor driver?
+IC3002 Toshiba '''TB6552FNG''' Dual-Bridge Driver for DC Motors
+CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)
+====Image Stabilization====
+IC3201 Renesas(?) '''R2J30504''' 725104
+*CK4-1105: Canon part number?
+*Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS
+SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors
+*1x ENC-03RC-R and 1x ENC-03RD-R
+====LCD Driver====
+IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?
+CN4001 LCD panel
+CN4002 LCD backlight
+====Audio/Video====
+IC4501 Wolfson '''WM1400G''' Audio driver/Codec
+IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF
+*Marking A51, 6-pin package
+IC4503 unpopulated
+CN4501 Microphone
+CN4502 A/V out
+====Mystery====
+[[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]
+The function of this section, and its main chip IC502 is unclear.
+IC501 JRC '''NJM2877''' LDO
+*marking 7 12 62, 5-pin package
+IC502 the Mystery IC
+*Transparent package
+*The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.
+Q501 SOT23-6 marking FM
+ZD501 marking R, reverse biased
+===Power PCB===
+IC601 FE '''7761R''' multi-output DC-DC power management controller
+IC691 Seiko S-817 series LDO?
+*Marking CUW, 4-pin package
+BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery
+CN601 battery connector
+CN651 flat flex to main PCB
+===Top Camera Control FPC===
+====Button controls====
+CN251 to TOP_I FPC
+D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes
+*Marking M1B, 4-pin package
+D253 Panasonic '''MA3S132E''' Dual Switching diodes
+*Also 4x on rotary dial FPC
+*Marking MU, 3-pin package (silver)
+D? Panasonic '''MA2S111''' Switching Diode
+*1x rotary dial FPC
+*Marking A, 2-pin package (silver)
+====Power? Flash?====
+Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors
+*Marking 6D, 6-pin package
+Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET
+[[File:Canon PowerShot G9 debug header.jpg|thumb|Unpopulated connector CN1003, probably for JTAG and UART]]
+== Hacking ==
+Unpopulated connector CN1003 located on back of main board
+* Candidate for JTAG and/or UART
+* Located near to SD card holder
+* Multiple pads connected to test points
+* Pin-out likely same as documented [https://web.archive.org/web/20200302085303/https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/ here].
+<syntaxhighlight lang="c">
+      TX  -  _  RX
+     GND  -  _  3.3V
+    SHDN  -  _  N/C
+     N/C  -  _  HALF_BAUD
+      PD  -  _  ALT_BOOT
+      PD  -  _  /TRST
+     TDI  -  _  TMS
+     TCK  -  _  TDO
+    /OFF  -
+</syntaxhighlight>

Canon PowerShot G9: Difference between revisions