Difference between revisions of "Canon PowerShot G9"

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
VisualWikitext
m (remove extra line break)
(moved description of JTAG/UART connector to Hacking section)
 
(7 intermediate revisions by the same user not shown)
Line 1: Line 1:
 
Teardown of the Canon PowerShot G9 point-and-shoot camera.
 
Teardown of the Canon PowerShot G9 point-and-shoot camera.
  
−
12.1 MP CMOS with 6x IS optical zoom
+
12.1 MP, 1/1.7" CCD image sensor with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].
  
−
Released in Oct 2007, PCB date code 29th week of 2007
+
Technical details, including firmware dumps, on the [https://chdk.fandom.com/wiki/G9 CHDK Wiki].
−
[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9]]
 
  
 
==Teardown Pictures==
 
==Teardown Pictures==
Line 15: Line 14:
 
[[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]
 
[[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]
  
−
== Parts Identification ==
+
==Parts Identification==
−
<br />
+
[[File:Canon PowerShot G9 Main PCB Assembly Diagram.png|thumb|Assembly diagram of main PCB with component designators]]
 +
The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.
 +
 
 +
===Main PCB===
 +
 
 +
====CPU/DSP====
 +
IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)
 +
 
 +
IC1002, IC1003 JRC '''NJM2877''' LDO
 +
 
 +
*Marking 7 14 71, 5-pin package
 +
 
 +
IC1004 marking FA, 5-pin package, LDO?
 +
 
 +
IC1005 Seiko S-817 series LDO?
 +
 
 +
*Marking G8X, 4-pin package
 +
 
 +
IC1006 Seiko S-817 series LDO?
 +
 
 +
*Marking B9O, 4-pin package
 +
 
 +
IC1007 Seiko Epson '''RX-4571LC''' real time clock
 +
 
 +
*Marking E4571
 +
 
 +
SR1001 Landscape/portrait orientation sensor?
 +
 
 +
Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors
 +
 
 +
*Marking 6B, 6-pin package
 +
 
 +
Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors
 +
 
 +
*Marking XB, 6-pin package
 +
 
 +
Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors
 +
 
 +
*Marking 6D, 6-pin package
 +
 
 +
D1001 Panasonic '''MA2S111''' Switching Diode
 +
 
 +
*Marking A, 2-pin package    (silver)
 +
 
 +
D1002 Panasonic '''MA3S132E''' Dual Switching diodes
 +
 
 +
*Marking MU, 3-pin package
 +
 
 +
CN1001 flat flex to DC/DC PCB
 +
 
 +
CN1002 flat flex to jog dial unit, TOP_M FPC
 +
 
 +
CN1003 unpopulated/undocumented -> JTAG/Serial? (see below)
 +
 
 +
CN1004 USB/digital
 +
 
 +
CN1005 SD card holder
 +
 
 +
SW1001 switch, battery cover open detect
 +
 
 +
====CCD Interface====
 +
IC2002, IC2003 JRC '''NJM2877''' LDO
 +
 
 +
*5-bin package
 +
 
 +
IC2004 marking 11 77 41, 6-pin package
 +
 
 +
IC2005 Sony '''D4807GA''' analog frontend
 +
 
 +
IC2006 marking AED3, 5-pin package
 +
 
 +
IC2008 JRC '''NJM2877''' LDO
 +
 
 +
*5-pin package
 +
 
 +
IC2009 not populated
 +
 
 +
*5-pin package
 +
 
 +
CN2001 connector for image sensor assembly
 +
 
 +
====Lens Motor Driver====
 +
IC3001 Toshiba '''TB6609FL''' motor driver?
 +
 
 +
IC3002 Toshiba '''TB6552FNG''' Dual-Bridge Driver for DC Motors
 +
 
 +
CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)
 +
 
 +
====Image Stabilization====
 +
IC3201 Renesas(?) '''R2J30504''' 725104
 +
 
 +
*CK4-1105: Canon part number?
 +
*Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS
 +
 
 +
SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors
 +
 
 +
*1x ENC-03RC-R and 1x ENC-03RD-R
 +
 
 +
====LCD Driver====
 +
IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?
 +
 
 +
CN4001 LCD panel
 +
 
 +
CN4002 LCD backlight
 +
 
 +
====Audio/Video====
 +
IC4501 Wolfson '''WM1400G''' Audio driver/Codec
 +
 
 +
IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF
 +
 
 +
*Marking A51, 6-pin package
 +
 
 +
IC4503 unpopulated
 +
 
 +
CN4501 Microphone
 +
 
 +
CN4502 A/V out
 +
 
 +
====Mystery====
 +
[[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]
 +
The function of this section, and its main chip IC502 is unclear.
 +
 
 +
IC501 JRC '''NJM2877''' LDO
 +
 
 +
*marking 7 12 62, 5-pin package
 +
 
 +
IC502 the Mystery IC
 +
 
 +
*Transparent package
 +
 
 +
*The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.
 +
 
 +
Q501 SOT23-6 marking FM
 +
 
 +
ZD501 marking R, reverse biased
 +
 
 +
===Power PCB===
 +
IC601 FE '''7761R''' multi-output DC-DC power management controller
 +
 
 +
IC691 Seiko S-817 series LDO?
 +
 
 +
*Marking CUW, 4-pin package
 +
 
 +
BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery
 +
 
 +
CN601 battery connector
 +
 
 +
CN651 flat flex to main PCB
 +
 
 +
===Top Camera Control FPC===
 +
 
 +
====Button controls====
 +
CN251 to TOP_I FPC
 +
 
 +
D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes
 +
 
 +
*Marking M1B, 4-pin package
 +
 
 +
D253 Panasonic '''MA3S132E''' Dual Switching diodes
 +
 
 +
*Also 4x on rotary dial FPC
 +
*Marking MU, 3-pin package (silver)
 +
 
 +
D? Panasonic '''MA2S111''' Switching Diode
 +
 
 +
*1x rotary dial FPC
 +
*Marking A, 2-pin package (silver)
 +
 
 +
====Power? Flash?====
 +
Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors
 +
 
 +
*Marking 6D, 6-pin package
 +
 
 +
Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET
 +
[[File:Canon PowerShot G9 debug header.jpg|thumb|Unpopulated connector CN1003, probably for JTAG and UART]]
 +
 
 +
== Hacking ==
 +
Unpopulated connector CN1003 located on back of main board
 +
 
 +
* Candidate for JTAG and/or UART
 +
* Located near to SD card holder
 +
* Multiple pads connected to test points
 +
* Pin-out likely same as documented [https://web.archive.org/web/20200302085303/https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/ here].
 +
<syntaxhighlight lang="c">
 +
      TX  -  _  RX
 +
    GND  -  _  3.3V
 +
    SHDN  -  _  N/C
 +
    N/C  -  _  HALF_BAUD
 +
      PD  -  _  ALT_BOOT
 +
      PD  -  _  /TRST
 +
    TDI  -  _  TMS
 +
    TCK  -  _  TDO
 +
    /OFF  -
 +
</syntaxhighlight>

Latest revision as of 00:02, 9 October 2023

Teardown of the Canon PowerShot G9 point-and-shoot camera.

12.1 MP, 1/1.7" CCD image sensor with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007

Canon PowerShot G9

A service manual with assembly diagram, but no schematic, can be found on the internet.

Technical details, including firmware dumps, on the CHDK Wiki.

Teardown Pictures

Main PCB, top view
Main PCB, bottom view
Power PCB, top view
Power PCB, bottom view
Top camera control PCB (mode selection, shutter button, power button, flash control)
Back camera control PCB (jog-wheel, various buttons)
12.1 MP CMOS image sensor

Parts Identification

Assembly diagram of main PCB with component designators

The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.

Main PCB

CPU/DSP

IC1001 Canon Digic III, and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)

IC1002, IC1003 JRC NJM2877 LDO

  • Marking 7 14 71, 5-pin package

IC1004 marking FA, 5-pin package, LDO?

IC1005 Seiko S-817 series LDO?

  • Marking G8X, 4-pin package

IC1006 Seiko S-817 series LDO?

  • Marking B9O, 4-pin package

IC1007 Seiko Epson RX-4571LC real time clock

  • Marking E4571

SR1001 Landscape/portrait orientation sensor?

Q1003, Q1010, Q1011 Toshiba RN4982FE NPN PNP Transistors with 10K Bias Resistors

  • Marking 6B, 6-pin package

Q1005, Q1007, Q1008 Toshiba RN1902FE Dual NPN Transistors with 10K Bias Resistors

  • Marking XB, 6-pin package

Q1012 Toshiba RN4984FE NPN PNP Transistors with 47K Bias Resistors

  • Marking 6D, 6-pin package

D1001 Panasonic MA2S111 Switching Diode

  • Marking A, 2-pin package (silver)

D1002 Panasonic MA3S132E Dual Switching diodes

  • Marking MU, 3-pin package

CN1001 flat flex to DC/DC PCB

CN1002 flat flex to jog dial unit, TOP_M FPC

CN1003 unpopulated/undocumented -> JTAG/Serial? (see below)

CN1004 USB/digital

CN1005 SD card holder

SW1001 switch, battery cover open detect

CCD Interface

IC2002, IC2003 JRC NJM2877 LDO

  • 5-bin package

IC2004 marking 11 77 41, 6-pin package

IC2005 Sony D4807GA analog frontend

IC2006 marking AED3, 5-pin package

IC2008 JRC NJM2877 LDO

  • 5-pin package

IC2009 not populated

  • 5-pin package

CN2001 connector for image sensor assembly

Lens Motor Driver

IC3001 Toshiba TB6609FL motor driver?

IC3002 Toshiba TB6552FNG Dual-Bridge Driver for DC Motors

CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)

Image Stabilization

IC3201 Renesas(?) R2J30504 725104

  • CK4-1105: Canon part number?
  • Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS

SR3201, SR3202 Murata ENC-03 series, angular rate sensors

  • 1x ENC-03RC-R and 1x ENC-03RD-R

LCD Driver

IC4001 15019GB 7CR0G 070 LCD power? Driver?

CN4001 LCD panel

CN4002 LCD backlight

Audio/Video

IC4501 Wolfson WM1400G Audio driver/Codec

IC4502 JRC NJM2571 Low Voltage Video Amplifier with LPF

  • Marking A51, 6-pin package

IC4503 unpopulated

CN4501 Microphone

CN4502 A/V out

Mystery

Low resolution die image of mystery IC502

The function of this section, and its main chip IC502 is unclear.

IC501 JRC NJM2877 LDO

  • marking 7 12 62, 5-pin package

IC502 the Mystery IC

  • Transparent package
  • The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.

Q501 SOT23-6 marking FM

ZD501 marking R, reverse biased

Power PCB

IC601 FE 7761R multi-output DC-DC power management controller

IC691 Seiko S-817 series LDO?

  • Marking CUW, 4-pin package

BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery

CN601 battery connector

CN651 flat flex to main PCB

Top Camera Control FPC

Button controls

CN251 to TOP_I FPC

D251, D252, 254, D255 Panasonic MA4Z159 Dual Switching Diodes

  • Marking M1B, 4-pin package

D253 Panasonic MA3S132E Dual Switching diodes

  • Also 4x on rotary dial FPC
  • Marking MU, 3-pin package (silver)

D? Panasonic MA2S111 Switching Diode

  • 1x rotary dial FPC
  • Marking A, 2-pin package (silver)

Power? Flash?

Q581 Toshiba RN4984FE NPN PNP Transistors with 47K Bias Resistors

  • Marking 6D, 6-pin package

Q582 ROHM 2SK2715 10V drive N-Ch MOSFET

Unpopulated connector CN1003, probably for JTAG and UART

Hacking

Unpopulated connector CN1003 located on back of main board

  • Candidate for JTAG and/or UART
  • Located near to SD card holder
  • Multiple pads connected to test points
  • Pin-out likely same as documented here.
      TX  -  _  RX
     GND  -  _  3.3V
    SHDN  -  _  N/C
     N/C  -  _  HALF_BAUD
      PD  -  _  ALT_BOOT
      PD  -  _  /TRST
     TDI  -  _  TMS
     TCK  -  _  TDO
    /OFF  -
Retrieved from "https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&oldid=2034"