RECESSIM

Canon PowerShot G9: Difference between revisions

← Older edit
VisualWikitext
added parts identification
moved description of JTAG/UART connector to Hacking section
 
(6 intermediate revisions by the same user not shown)
Line 1: Line 1:
Teardown of the Canon PowerShot G9 point-and-shoot camera.
Teardown of the Canon PowerShot G9 point-and-shoot camera.


12.1 MP CMOS with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].
12.1 MP, 1/1.7" CCD image sensor with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].
 
Technical details, including firmware dumps, on the [https://chdk.fandom.com/wiki/G9 CHDK Wiki].


==Teardown Pictures==
==Teardown Pictures==
Line 16: Line 18:
The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.
The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.


=== Main PCB ===
===Main PCB===


==== CPU/DSP ====
====CPU/DSP====
IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)
IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)


IC1002, IC1003 JRC '''NJM2877''' LDO
IC1002, IC1003 JRC '''NJM2877''' LDO


* Marking 7 14 71, 5-pin package
*Marking 7 14 71, 5-pin package


IC1004 marking FA, 5-pin package, LDO?
IC1004 marking FA, 5-pin package, LDO?
Line 29: Line 31:
IC1005 Seiko S-817 series LDO?
IC1005 Seiko S-817 series LDO?


* Marking G8X, 4-pin package
*Marking G8X, 4-pin package


IC1006 Seiko S-817 series LDO?
IC1006 Seiko S-817 series LDO?


* Marking B9O, 4-pin package
*Marking B9O, 4-pin package


IC1007 Seiko Epson '''RX-4571LC''' real time clock
IC1007 Seiko Epson '''RX-4571LC''' real time clock


* Marking E4571
*Marking E4571


SR1001 Landscape/portrait orientation sensor?
SR1001 Landscape/portrait orientation sensor?
Line 43: Line 45:
Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors
Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors


* Marking 6B, 6-pin package
*Marking 6B, 6-pin package


Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors
Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors


* Marking XB, 6-pin package
*Marking XB, 6-pin package


Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors
Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors


* Marking 6D, 6-pin package
*Marking 6D, 6-pin package


D1001 Panasonic '''MA2S111''' Switching Diode
D1001 Panasonic '''MA2S111''' Switching Diode


* Marking A, 2-pin package    (silver)
*Marking A, 2-pin package    (silver)


D1002 Panasonic '''MA3S132E''' Dual Switching diodes
D1002 Panasonic '''MA3S132E''' Dual Switching diodes


* Marking MU, 3-pin package
*Marking MU, 3-pin package


CN1001 flat flex to DC/DC PCB
CN1001 flat flex to DC/DC PCB
Line 65: Line 67:
CN1002 flat flex to jog dial unit, TOP_M FPC
CN1002 flat flex to jog dial unit, TOP_M FPC


CN1003 unpopulated/undocumented -> JTAG/Serial?
CN1003 unpopulated/undocumented -> JTAG/Serial? (see below)
 
* Located near to SD card holder
* Multiple pads connected to test points


CN1004 USB/digital
CN1004 USB/digital
Line 76: Line 75:
SW1001 switch, battery cover open detect
SW1001 switch, battery cover open detect


==== CCD Interface ====
====CCD Interface====
IC2002, IC2003 JRC '''NJM2877''' LDO
IC2002, IC2003 JRC '''NJM2877''' LDO


* 5-bin package
*5-bin package


IC2004 marking 11 77 41, 6-pin package
IC2004 marking 11 77 41, 6-pin package
Line 89: Line 88:
IC2008 JRC '''NJM2877''' LDO
IC2008 JRC '''NJM2877''' LDO


* 5-pin package
*5-pin package


IC2009 not populated
IC2009 not populated


* 5-pin package
*5-pin package


CN2001 connector for image sensor assembly  
CN2001 connector for image sensor assembly  


==== Lens Motor Driver ====
====Lens Motor Driver====
IC3001 Toshiba '''TB6609FL''' motor driver?
IC3001 Toshiba '''TB6609FL''' motor driver?


Line 104: Line 103:
CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)
CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)


==== Image Stabilization ====
====Image Stabilization====
IC3201 Renesas(?) '''R2J30504''' 725104
IC3201 Renesas(?) '''R2J30504''' 725104


* CK4-1105: Canon part number?
*CK4-1105: Canon part number?
* Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS
*Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS


SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors
SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors


* 1x ENC-03RC-R and 1x ENC-03RD-R
*1x ENC-03RC-R and 1x ENC-03RD-R


==== LCD Driver ====
====LCD Driver====
IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?
IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?


Line 121: Line 120:
CN4002 LCD backlight
CN4002 LCD backlight


==== Audio/Video ====
====Audio/Video====
IC4501 Wolfson '''WM1400G''' Audio driver/Codec
IC4501 Wolfson '''WM1400G''' Audio driver/Codec


IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF
IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF


* Marking A51, 6-pin package
*Marking A51, 6-pin package


IC4503 unpopulated
IC4503 unpopulated
Line 134: Line 133:
CN4502 A/V out
CN4502 A/V out


==== Mystery ====
====Mystery====
[[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]
[[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]
The function of this section, and its main chip IC502 is unclear.  
The function of this section, and its main chip IC502 is unclear.  
Line 140: Line 139:
IC501 JRC '''NJM2877''' LDO
IC501 JRC '''NJM2877''' LDO


* marking 7 12 62, 5-pin package
*marking 7 12 62, 5-pin package


IC502 the Mystery IC
IC502 the Mystery IC


* Transparent package
*Transparent package


* The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.
*The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.


Q501 SOT23-6 marking FM
Q501 SOT23-6 marking FM
Line 152: Line 151:
ZD501 marking R, reverse biased
ZD501 marking R, reverse biased


=== DC/DC PCB ===
===Power PCB===
IC601 FE '''7761R''' multi-output DC-DC power management controller
IC601 FE '''7761R''' multi-output DC-DC power management controller


IC691 Seiko S-817 series LDO?
IC691 Seiko S-817 series LDO?


* Marking CUW, 4-pin package
*Marking CUW, 4-pin package


BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery
BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery
Line 165: Line 164:
CN651 flat flex to main PCB
CN651 flat flex to main PCB


=== Top_M FPC ===
===Top Camera Control FPC===


==== Button controls ====
====Button controls====
CN251 to TOP_I FPC
CN251 to TOP_I FPC


D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes
D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes


* Marking M1B, 4-pin package
*Marking M1B, 4-pin package


D253 Panasonic '''MA3S132E''' Dual Switching diodes
D253 Panasonic '''MA3S132E''' Dual Switching diodes


* Also 4x on rotary dial FPC
*Also 4x on rotary dial FPC
* Marking MU, 3-pin package (silver)
*Marking MU, 3-pin package (silver)


D? Panasonic '''MA2S111''' Switching Diode
D? Panasonic '''MA2S111''' Switching Diode


* 1x rotary dial FPC
*1x rotary dial FPC
* Marking A, 2-pin package (silver)
*Marking A, 2-pin package (silver)


==== Power ====
====Power? Flash?====
Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors
Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors


* Marking 6D, 6-pin package
*Marking 6D, 6-pin package


Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET
Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET
[[File:Canon PowerShot G9 debug header.jpg|thumb|Unpopulated connector CN1003, probably for JTAG and UART]]


<br />
== Hacking ==
Unpopulated connector CN1003 located on back of main board
 
* Candidate for JTAG and/or UART
* Located near to SD card holder
* Multiple pads connected to test points
* Pin-out likely same as documented [https://web.archive.org/web/20200302085303/https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/ here].
<syntaxhighlight lang="c">
      TX  -  _  RX
    GND  -  _  3.3V
    SHDN  -  _  N/C
    N/C  -  _  HALF_BAUD
      PD  -  _  ALT_BOOT
      PD  -  _  /TRST
    TDI  -  _  TMS
    TCK  -  _  TDO
    /OFF  -
</syntaxhighlight>
Retrieved from "https://wiki.recessim.com/view/Canon_PowerShot_G9"