| |
Disclaimer: This description is completely unofficial. Most of
the information presented here is discovered by me,
Eugene Crosser, while
snooping the serial line and by trial and error. I never had an
official protocol description, have never seen any related software
source code, and have never done reverse engineering of any related
software. This description may be incomplete, inaccurate or completely
wrong. You are warned.
Some information is taken from `camediaplay' package by Jun-ichiro Itoh
<itojun@itojun.org>, from the findings of Thierry Bousch
<bousch%linotte.uucp@topo.math.u-psud.fr> TsuruZoh Tachibanaya
<tsuruzoh@butaman.ne.jp> and from other (open) sources and not
checked by me.
Serial Protocol of Some Digital Cameras
Several models of digital cameras, namely Epson, Sanyo, Agfa and Olympus
cameras, seem to use the same protocol for communication with the host.
Follows the description of the high-level protocol they use over the
serial line.
Protocol Basics
The host and the camera exchange with data packets and individual bytes.
Serial line paramaters used are: 8bit, no parity. No flow control is
used. All arithmetic data is transmitted least significant byte first
("little endian").
Protocol Elements
The elementary units of the protocol are:
| Initialization Byte | NUL | 0x00 |
| Action Complete Notification | ENQ | 0x05 |
| Positive Achnowledgement | ACK | 0x06 |
| Unable to Execute Command | DC1 | 0x11 |
Negative Acknowledgement, also Camera Signature | NAK | 0x15 |
| Packet | Variable length sequence of bytes |
| Termination Byte |
| 0xff |
Packet structure
The packet has the following structure:
| Offset | Length | Meaning |
| 0 | 1 | Packet type |
| 1 | 1 | Packet subtype/sequence |
| 2 | 2 | Length of data |
| 4 | variable | Data |
| -2 | 2 | checksum |
Known packet types are:
| Type | Description |
| 0x02 | Data packet that is not last in sequence |
| 0x03 | Data packet that is last in sequence |
| 0x1b | Command packet |
Data packets that are sent in responce to a single command are numbered
starting from zero. If all requested data fits in one packet, it has
type 0x03 and sequence 0.
Command packet has subtype 0x43 or 0x53. Only the first command packet
in a session has subtype 0x53.
Maximum length of data field in a packet is 2048 bytes, which yields in
2054 total packet length.
Checksum is a simple 16 bit arithmetic sum of all bytes in the data field. As
already mentioned above, length and checksum values are transmitted least
significant byte first.
Flow of Control
A communication session flow is as follows:
| Host | Camera |
| Port speed set to 19200 baud |
| Host sends init byte 0x00 | |
| Camera responds with signature 0x15 |
| Host sends command packet with subtype 0x53 and "set speed" command | |
| Camera sends ACK 0x06 |
| Port speed set to the new value |
| Host sends command | |
| Camera responds with either ACK plus optionally "action taken" notifier or data packet sequence |
| Host sends ACK to every data packet | |
| ... Command - reply cycle repeated ... |
| Camera sends 0xff and resets after a few seconds (value is model-dependant) of inactivity |
If the camera does not respond to a command in reasonable time, or
responds with a NAK, the command can be resent. If the camera does not
provide a complete data packet in reasonable time, or the data packet is
corrupt (checksum does not match), the host can request resending of the
packet by sending NAK instead of ACK.
Command format and codes
Command is a sequence of bytes sent in the data field of a command packet.
Command format is as follows:
| Offset | Length | Description |
| 0 | 1 | Command code |
| 1 | 1 | Register number or subcode |
| 2 | variable | Optional argument |
Five command codes are known:
| Code | Argument | Description |
| 0 | int32 | Set value of integer register |
| 1 | none | Read value of integer register |
| 2 | vdata | Take action unrelated to registers |
| 3 | vdata | Set value of vdata register |
| 4 | none | Read value of vdata register |
Commands 0 and 3 are replied with a single ACK 0x06. Command 2 is
replied with an ACK 0x06 followed by an "action complete" notifier
0x05. Commands 1 and 4 are replied with a sequence of data packets,
each of them must be ACK'ed by the host.
Command 0 must be issued with a 4 byte argument containg the new value
for the register (bytes in "LSB first" order). Command 2 typically is
issued with a single zero byte as an argument. Command 3 is issued with
an argument of variable number of bytes. If this is a printable string,
it should not include the trailing zero byte.
Camera replies to the command 1 with a single data packet containing 4
bytes of a 32bit integer (in "LSB first" order). Camera replies to the
command 4 with a sequence of data packets with variable number of data
bytes. Note that if a printable string is returned, it is
terminated with a zero byte, and thus may be safely printed or otherwise
treated as a normal C language character string.
Registers
The following registers are known (read/writablity info is inaccurate):
| No. | Type | R/W | Description |
| 1 | int32 | R/W | Resolution: 1 - Std, 2 - Hi, 3 - Ext, other values possible |
| 2 | int32 | R/W | Clock in UNIX time_t format |
| 3 | int32 | R/W | Shutter speed (microseconds), 0 - auto |
| 4 | int32 | W | Current frame number (or animation number if hi order byte is 0xff) |
| 5 | int32 | R/W | Aperture: 0 - Auto, 1 - Low, 2 - Med, 3 - ?, 4 - Hi |
| 6 | int32 | R/W | Color mode: 1 - Color, 2 - B/W |
| 7 | int32 | R/W | Flash mode: 0 - Auto, 1 - Force, 2 - Off, 3 - Anti RedEye, 4 - Slow sync |
| 8 | int32 | R/W | Unknown (128) |
| 9 | int32 | R/W | Unknown (128) |
| 10 | int32 | R | No. of frames in current folder |
| 11 | int32 | R | No. of frames left |
| 12 | int32 | R | Length of current frame * |
| 13 | int32 | R | Length of current thumbnail * |
| 14 | vdata | R | Current frame data * |
| 15 | vdata | R | Current thumbnail data * |
| 16 | int32 | R | Battery capacity percentage |
| 17 | int32 | R/W | Communication speed 1 - 9600 .. 5 - 115200, 6 - 230400, 256 - 9600 .. 264 - 911600 (sync?) |
| 18 | int32 | R | Unknown (1) |
| 19 | int32 | R/W | Bright/Contrast: 0 - Normal, 1 - Contrast+, 2 - Contrast-, 3 - Brightnes+, 4 - Brightnes- |
| 20 | int32 | R/W | White balance: 0 - Auto, 1 - Sunny, 2 - Incandescent, 3 - Fluorescent, 5 - Flash, 6- White preset, 255 - Cloudy |
| 21 | vdata | R/W | Unused |
| 22 | vdata | R/W | Camera I.D. |
| 23 | int32 | R/W | Autoshut on host timer (seconds) |
| 24 | int32 | R/W | Autoshut in field timer (seconds) |
| 25 | vdata | R/W | Serial No. (string) |
| 26 | vdata | R | Version |
| 27 | vdata | R/W | Model |
| 28 | int32 | R | Available memory left |
| 29 | vdata | R/W | Upload image data to this register |
| 30 | int32 | W | LED: 0 - Off, 1 - On, 2 - Blink |
| 31 | vdata | R | Unknown ("\0") |
| 32 | int32 | R | Put "magic spell" 0x0FEC000E here before uploading image data |
| 33 | int32 | R/W | Focus mode: 1 - Macro, 2 - Normal, 3 - Infinity/fisheye |
| 34 | int32 | R | Operation mode: 1 - Off, 2 - Record, 3-Play, 6-Thumbnail |
| 35 | int32 | R/W | LCD brightness 1 to 7 |
| 36 | int32 | R | Unknown (3) |
| 37 | vdata | R | Unknown ("\0") |
| 38 | int32 | R | LCD autoshut timer (seconds) |
| 39 | int32 | R | Protection state of current frame * |
| 40 | int32 | R | True No. of frames taken |
| 41 | int32 | R/W | LCD date format: 1 - 'YY MM DD, 2 - DD MM 'HH |
| 42 | vdata | R | Unknown ("") |
| 43 | vdata | R | Audio data description block *
0: expanded .wav length
1: compressed .wav length
3: Unknown (0)
4: Unknown (0)
5: Unknown (0)
6: Unknown (0)
7: Unknown (0)
|
| 44 | vdata | R | Audio data * |
| 45 | vdata | R | Unknown ("") |
| 46 | vdata | R | Camera summary data: 32 bytes with copies of 8 other registers
0: Reg 1 (Resolution)
1: Reg 35 (LCD brightness) or Reg 7 (Flash mode)
2: Reg 10 (Frames taken) or Unknown
3: Unknown (0) or Unknown
4: Unknown (0) or Reg 16 (Battery capacity)
5: Unknown (0) or Reg 10 (Frames taken)
6: Unknown (0) or Reg 11 (Frames left)
7: Number of animations taken
|
| 47 | vdata | R | Picture summary data: 32 bytes or 8 int32's *
0: Hi order byte: unknown, next 3 bytes: Length of current image
1: Length of current thumbnail
2: Audio data length (expanded)
3: Resolution
4: Protection state
5: TimeDate
6: Unknown (0)
7: Animation type: 1 - 10ms, 2 - 20ms
|
| 48 | vdata | R | Manufacturer |
| 49 | vdata | R | Unknown ("") |
| 50 | int32 | R | Unknown (0) |
| 51 | int32 | R/W | Card detected: 1 - No, 2 - Yes |
| 52 | vdata | R/W | Unknown ("") |
| 53 | int32 | R/W | Language: 3 - english, 4 - french, 5 - german, 6 - italian, 8 - spanish, 10 - dutch |
| 54-59 | vdata | R | Unknown ("") |
| 60 | int32 | R | True No. of frames taken |
| 61-68 | vdata | R | Unknown ("") |
| 69 | vdata | R | Exposure Compensation 8 bytes
0: compensation value -20 to +20
1: 0
2: 0
3: 0
4: 10
5: 0
6: 0
7: 0
|
| 70 | int32 | R/W | Exp. meter: 2 - Center weighted, 3 - Spot, 5 - Multi element matrix |
| 71 | vdata | R/W | Effective zoom in tenths of millimeters: 8 bytes
0: LSB
1: MSB
2: 0
3: 0
4: 10
5: 0
6: 0
7: 0
|
| 72 | int32 | R/W | Bitmap: 1 - AEL/WBL, 2 - Fisheye, 4 - Wide, 8 - Manual zoom, 16 - B/W, 256 - 1.25x, 512 - 1.6x, 768 - 2.0x, 1024 - 2.5x, 1280 - off |
| 73-76 | vdata | R | Unknown ("") |
| 77 | int32 | W | Size of data packet from camera
(default 0x800)
|
| 78 | vdata | R | Unknown ("") |
| 79 | vdata | R | Filename of current frame * |
| 80-81 | vdata | R | Unknown ("") |
| 82 | int32 | W | Unknown (enable folder features? Write 60 here) |
| 83 | int32 | R/W | Folder navigation
When read, return number of folders on the card.
When written without data, reset folder system (?)
Or select current folder by its number
|
| 84 | vdata | R/W | Current folder name (may read or set)
|
| 85 | vdata | R | Unknown ("") |
| 86 | int32 | R/W | Digital zoom; 0 - 1X, otherwise zoom factor x 100 (i.e. in percent) |
| 87-90 | vdata | R | Unknown ("") |
| 91 | vdata | R | Current folder I.D. and name |
* Note: Marked registers only become useful for reading after
setting register 4. If value of 0 assigned to register 4 after doing
action 5, subsequent retrieval of picture data gives the "live preview".
For command 2, the second byte is action code not register number.
The following action codes are known:
| Code | Argument | Description |
| 0 | single zero byte | Erase last picure |
| 1 | single zero byte | Erase all picures (but not animations) |
| 2 | single zero byte | Take picture |
| 4 | single zero byte | Finish session immediately |
| 5 | single zero byte | Take preview snapshot (retreivable as frame zero) |
| 6 | single byte | Calibration / testing. Arg value:
1 Calibrate autofocus
3 Test zoom/exposure
4-6 Store 0 in Reg 32
9 Load LCD Brightness (0-31) from Reg 32
10 Load LCD size (25 for Nikon Coolpix 950) from Reg 32
11 LCD Saturation (0-32) from Reg 32
13 LCD Red-Green (0-32) from Reg 32
14 LCD Blue (0-32) from Reg 32
15 Store -1 in Reg 32
16 Multi shot (locks up if lcd is on)
17 Take picture
18 Store -1 in Reg 32
20-23 locks up if lcd is on
24-255 Store -1 in Reg 32
|
| 7 | single zero byte | Erase current frame * |
| 8 | single byte | Switch LCD mode. Arg value:
1 - Off
2 - Record
3 - Play (show current frame fullscreen)
4 - preview thumbnails (?)
5 - Thumbnail view (smaller?)
6 - Thumbnail view (larger?)
7 - Next
8 - Previous
|
| 9 | single byte | Set protection state of current frame to the value of parameter (binary 0 or 1)* |
| 11 | single zero byte | Store freshly uploaded image into NVRAM (see appendix A) |
| 12 | single byte | LCD test. Arg value:
0 - white
1 - gray
2 - black
3 - red
4 - green
5 - blue
6 - test pattern
|
* Note: actions 7 and 9 only useful after setting register 0x04.
Appendix A
Date: Sun, 14 Jul 2002 01:28:39 +0200 (CEST)
From: =?iso-8859-1?Q?Peter_=C5strand?= <astrand(at)lysator.liu.se>
To: allyn(at)fratkin.com, <wolfgang(at)charlotte.wsrcc.com>, <crosser(at)average.org>
Subject: Upload on Olympus C-860L
FYI.
Tonight, I've been struggling with uploading arbitrary pictures to my
Olympus C-860L. I've finally found out that for the camera to accept the
picture, to two conditions must be met:
1) The subsampling must be 2x1, 1x1, 1x1
2) The EXIF info must be just like the pictures the camera itself
produces.
So, I've made a small script to fix this. Feel free to include it in FAQs
and/or photopc dists.
/more/data/pics/olympus-reference-pic.jpg is just some picture taken with
the camera.
photopc-upload-all:
#!/bin/sh
TMPFILE=`mktemp /tmp/photopc-upload.XXXXXX` || exit 1
for file in $@; do
echo Converting $file...
djpeg $file | cjpeg -sample 2x1 > $TMPFILE
jhead -te /more/data/pics/olympus-reference-pic.jpg $TMPFILE
echo Uploading $file...
photopc upload $TMPFILE
sleep 2;
done
rm -f $TMPFILE
--
/Peter Åstrand <astrand(at)lysator.liu.se>
Appendix B
Some Nikon models support an extension to the protocol described above,
specifically designed for remote control units. This protocol allows
to control zoom, emulate half-depress of the shutter release button,
bulb operation and possibly more.
<vladimir.vyskocil(at)wanadoo.fr> compiled a partial
description of this protocol, available
here.
Please mail your corrections/additions to
<crosser at average dot org>
See
http://photopc.sourceforge.net/
for possible updates.
|
|
|