The E-TTL Protocol
Ever since I got my Canon Powershot G3 I have tried to find some
documentation on the protocol used on the "hot shoe" flash connector.
Fortunately, I was recently able to borrow a Speedlite 550EX flash unit and
an EOS 50 (non-digital) camera from colleagues at work, so documenting at
least parts of the protocol was simply a matter of hooking up a camera and
the flash to an oscilloscope and monitoring the data. Note that the following
text only applies to what I observed in the communications between the 550EX
and either the G3 or the EOS 50, Canon is notorious for changing something
with each new camera version with odd behavior in 3rd party flash units as
There is a small switch on the right hand side, below the spring below the
rail. Pushing it down turns the internal flash off, and changes the flash-
settings scale in manual mode. The preferred point for connecting to ground
seems to be the insides of the "rails". The small hole is for a locking pin
(The speedlite implements this).
The electrical interface
X signal is used for trigging the main flash, the high level is 3-5V, the
low level is ground. When using 1st curtain sync X remains low while
the shutter is open.
ID (or whatever) is, as far as I can tell only used for enabling the pilot
lamp in the flash unit. Keeping it at ground seems fine (the G3 does this),
the EOS 50 keeps it at about 1.25V idle and raises it to about 3.2V to turn
on the pilot lamp.
The remaining 3 pins (CLK,D1,D2) are used for data transfer, the low level
of all 3 pins is about 2.2V (ie, the do _not_ go to ground during normal
signaling), with high levels of 5V, 3.7V and 3.3V respectively.
The exception is CLK which is driven to ground by the G3 when trigging the
preflash (the EOS 50 only drives it "low", but instead twice, see command B4).
Apparently the protocol (the B4 command with some argument?) instructs the
flash to interpret the next transition on CLK as a trigger. The EOS 50 pulls
CLK low slightly before X (when it physically releases the shutter?), the G3
keeps CLK high during the main flash.
D1 is driven by the flash and D2 by the camera. The presence of a E-TTL
flash is recognized by a "high" level on D1 (the idle state), otherwise
the camera (G3) keeps CLK high and D2 low, (their idle states), without
attempting to transmit any data.
Data is driven on falling edges and latched on rising edges, MSB
is sent first on both lines. Clock rates seem to be in the order of 50 to
Blue: CLK, red: D1 and green: D2.
Note that the flash keeps D1 low for a while (usually about 100us),
presumably to indicate "busy" on a link level. In case the last bit on
D1 is 1, the D1 line goes low about 10us after the last rising edge.
This agrees well with the camera never tries to clock any data when
no voltage is applied at D1 (i.e, a non-E-TTL flash is connected).
D2 is driven high a few us before the transmission of a byte, even if the
first byte on D2 is 0. If the last bit on D2 is 1 the camera holds that
state for about 40us after the last rising edge before returning D2
Note that the flash occasionally interprets CLK going low or ground (trigging a
preflash) as a clock transition and outputs the first bit of a pending data
byte. This error is handled somehow (timeout between bit clks?), i.e, when
clock later has gone back high and the camera starts clocking everything works fine.
Also, only the G3 keeps all lines at their idle states at all times, and only
when the display is on, otherwise all lines except X are kept at ground and
rises to their idle levels when the camera becomes active (when taking a picture
or otherwise activating it in a way that makes it reasonable to transfer new
settings), then returning the lines to ground. Consecutive bytes are usually
separated by 500us or more.
Taking a picture with the EOS 50:
Blue: CLK, red: D1, green: D2 and black: ID.
The pilot lamp is used in two pulses. The X signal is not shown in this
figure, but should almost coincide with CLK going to ground.
The whole figure is about 2.8s.
Another picture with the EOS 50:
Blue: CLK, red: D1, green: D2 and black: X.
Note CLK going low slightly before X (and going high some time before X goes
high). The whole figure is about 2.2s and the shutter is 1/5s.
Also note that the camera keeps repeating a small set of commands while
focusing etc, and keeps doing this until the trigger is pressed
The camera controls clocking and sends commands/data, the flash sends the
reply when the camera clocks the next command.
There seems to be two categories of commands: Setting stuff (0xBn and reading
stuff 0xFn, in the following text Bn commands are assumed to take one byte
arguments and Fn command no arguments, unless a number of bytes is stated
explicitly (thus, numbers in the "descriptions" refers to these argument
bytes and replies, respectively).
Setting stuff (all numbers except those in brackets are in HEX):
B0: set desired flash intensity, the EOS uses A0 for preflash and the G3 90,
full intensity seems to be C0
reply: 86, 86 (i.e. 86 is clocked out when the intensity is sent and
86 is clocked out during the next (whatever) command
B1: unknown, G3:
05 usually, sent before the preflash
2C seen when using HS-flash in manual mode
AF: shutter time selected to less than 1/125
FE: shutter time of some number of seconds
5C: high speed sync (HS), 1/4000
67: HS, 1/750
f6: "normal" shutter times
B2: only seen with the G3, when IR-master mode is selected on the flash.
(not investigated further)
B3: unknown, 2 _or_ 3 bytes of data:
G3: 02-06-03 or 02-46-03 sent now and then,
06-02 sent shortly before main flash (in auto mode)
EOS 50: 02-00 sent now and then
22-00 sent after preflash
26-00 sent before main flash
B4: set trigger/enable flash? always sent before a preflash or a main flash
is triggered, 1D often sent when not preparing for trigging.
typical sequence: many 1D's, 3 before selecting intensity of the
preflash and reading F2, 23 before trigging the preflash with CLK,
1D again after the preflash, followed by 3D before trigging the main
This is modified when HS flash is enabled: 05 while idle, 03 before
setting preflash intensity and checking F2. 23 before preflash,
25 before main flash.
Note that the EOS 50 pulses CLK low twice about when the preflash is
expected. I have not verified which of them triggers the preflash,
but my guess is the later, based on the protocol.
With the G3 in manual mode the sequence becomes:
19 before command F2 (max avail flash?), followed by 39 before trigging
the main flash.
B5: sent first in each "batch" of commands, 4D on the G3, 48 on the EOS 50
(protocol version/camera features?)
B7: aperture, 00 sent by the G3 in manual mode, otherwise:
18->F2.0 1A->F2.2 23->F3.2 28->F4.0 2D->5.0
30->F5.6 33->F6.1 34->F6.7 35->F7.1 38->F8.0
3c->F9.5 40->F11 44->F13 48->F16 4c->F19 50->F22
B8: shutter time, examples:
2B->3.2s 38->1s 4a->1/5 60->1/30 68->1/60
6A->1/80 6F->1/125 78->1/320 96->1/4000
B9: camera mode, always 80 with the G3, with the EOS 50:
bit 7: Manual mode
bit 6: Aperture priority
bit 5: Time priority
bit 3: fast shooting mode enabled
bit 1: auto-focus enabled
"P" mode results in neither of bits 5-7 being set
reply byte 0: flash exposure compensation set in the flash:
00-> +-0, 04->-0.5, 8->-1.0, FC->+0.5
reply byte 1: 86
BB: ISO/sensitivity, with the EOS 50 these numbers are modified up 4 for a
flash exposure compensation (either camera or flash) of -0.5,
down 4 for positive compensations.
40->ISO 50, 48->ISO 100, 4B->ISO 125, 50->ISO 200, 55-> ISO 320,
58->ISO 400, 78->ISO 6400
BD: set zoom, usually 2 data bytes, but on the EOS 50 a 3rd byte follows
the first time the command in a sequence. Byte 0 is always 00.
Byte 1: zoom in millimeters (or something very close).
Byte 2, when present: 28
18-69- if the zoom is changing,
aa-59-00 if the zoom didn't change.
One can speculate that 86 returned by most commands is some type of status.
F2: Max available flash intensity? (max C0 for main, A0 for preflash),
G3: Up to 4 bytes (read using FF) (ok to read less)
53-40-14-00 with flash in manual mode
57- with flash in HS-mode
53-41-15-00 if IR-master enabled
EOS 50: Up to 3 bytes read
57-01-00 with HS
other combinations not tested
F7: checked by the G3 before command B0, reply: 7B
F8: directly after preflash, actual intensity used?
typical numbers around 4B to 55, ff when IR-master enabled.
Affected by charge status but not by covering the flash.
55 normal with the flash head pointing straight forward (or 7deg down)
5d normal if pointing in any other direction (only tested on G3)
54 not enough energy to flash
57 2nd curtain sync selected on the flash (only tested on G3)
75 if the flash changing the zoom (busy)
FB: flash mode: 02 if normal, 00 if manual or strobe
FF: Dummy command for reading more reply bytes from other commands
This command is also sent after CLK has been pulsed low once
(to trig a preflash), by the EOS 50. (The G3 continues with a F8)
Ascii byte lists, first column is the byte clocked out of the flash,
the second is the command sent by the camera. As explained earlier,
replies appear one byte later.
Taking a picture with the G3, Av mode. annotated
Ascii plain ascii binary
Taking a picture with the G3, manual mode, (1/50,F3.5).
Zooming in with the G3. plain ascii
Taking a picture with the EOS 50. plain ascii binary
Taking a picture with the EOS 50 with high speed sync (HS). plain ascii
Taking 3 pictures in "rapid" mode with the EOS 50, flash only firing on the first 2.
I have several more files which I will consider making available to
individuals on request. Most files are quite boring variations designed
to find out the scales of things like aperture. Please state which condition
you are interested in and I'll check if I have anything relevant.
The standard disclaimer apply, if you break things, you get to keep both
halves. Do not assume that "keeping" both halves is trivial. This
is especially true in (but not limited to) cases such as gaseous products
(blue smoke), and matter annihilation. The owner of this site will definitely
not help you put the parts back together, but feel free to contact him in
advance if you expect annihilation of substantial amounts of matter to take
place. Canon, Powershot, Speedlite, EOS, E-TTL and probably trademarks
are property of their receptive owners.