The E-TTL Protocol

Ever since I got my Canon Powershot G3 I have tried to find some documentation on the protocol used on the "hot shoe" flash connector. Fortunately, I was recently able to borrow a Speedlite 550EX flash unit and an EOS 50 (non-digital) camera from colleagues at work, so documenting at least parts of the protocol was simply a matter of hooking up a camera and the flash to an oscilloscope and monitoring the data. Note that the following text only applies to what I observed in the communications between the 550EX and either the G3 or the EOS 50, Canon is notorious for changing something with each new camera version with odd behavior in 3rd party flash units as a result.

The connector


There is a small switch on the right hand side, below the spring below the rail. Pushing it down turns the internal flash off, and changes the flash- settings scale in manual mode. The preferred point for connecting to ground seems to be the insides of the "rails". The small hole is for a locking pin (The speedlite implements this).

Pinout:
        ((X))
    
   (CLK)     (D2)
   
   (D1)      (ID)

The electrical interface

X signal is used for trigging the main flash, the high level is 3-5V, the low level is ground. When using 1st curtain sync X remains low while the shutter is open.

ID (or whatever) is, as far as I can tell only used for enabling the pilot lamp in the flash unit. Keeping it at ground seems fine (the G3 does this), the EOS 50 keeps it at about 1.25V idle and raises it to about 3.2V to turn on the pilot lamp.

The remaining 3 pins (CLK,D1,D2) are used for data transfer, the low level of all 3 pins is about 2.2V (ie, the do _not_ go to ground during normal signaling), with high levels of 5V, 3.7V and 3.3V respectively.
The exception is CLK which is driven to ground by the G3 when trigging the preflash (the EOS 50 only drives it "low", but instead twice, see command B4). Apparently the protocol (the B4 command with some argument?) instructs the flash to interpret the next transition on CLK as a trigger. The EOS 50 pulls CLK low slightly before X (when it physically releases the shutter?), the G3 keeps CLK high during the main flash.

D1 is driven by the flash and D2 by the camera. The presence of a E-TTL flash is recognized by a "high" level on D1 (the idle state), otherwise the camera (G3) keeps CLK high and D2 low, (their idle states), without attempting to transmit any data.

Data is driven on falling edges and latched on rising edges, MSB is sent first on both lines. Clock rates seem to be in the order of 50 to 100kHz.

A byte:
Blue: CLK, red: D1 and green: D2.

Note that the flash keeps D1 low for a while (usually about 100us), presumably to indicate "busy" on a link level. In case the last bit on D1 is 1, the D1 line goes low about 10us after the last rising edge. This agrees well with the camera never tries to clock any data when no voltage is applied at D1 (i.e, a non-E-TTL flash is connected).

D2 is driven high a few us before the transmission of a byte, even if the first byte on D2 is 0. If the last bit on D2 is 1 the camera holds that state for about 40us after the last rising edge before returning D2 low.

Note that the flash occasionally interprets CLK going low or ground (trigging a preflash) as a clock transition and outputs the first bit of a pending data byte. This error is handled somehow (timeout between bit clks?), i.e, when clock later has gone back high and the camera starts clocking everything works fine. Also, only the G3 keeps all lines at their idle states at all times, and only when the display is on, otherwise all lines except X are kept at ground and rises to their idle levels when the camera becomes active (when taking a picture or otherwise activating it in a way that makes it reasonable to transfer new settings), then returning the lines to ground. Consecutive bytes are usually separated by 500us or more.

Taking a picture with the EOS 50:
Blue: CLK, red: D1, green: D2 and black: ID.
The pilot lamp is used in two pulses. The X signal is not shown in this figure, but should almost coincide with CLK going to ground. The whole figure is about 2.8s.

Another picture with the EOS 50:
Blue: CLK, red: D1, green: D2 and black: X.
Note CLK going low slightly before X (and going high some time before X goes high). The whole figure is about 2.2s and the shutter is 1/5s. Also note that the camera keeps repeating a small set of commands while focusing etc, and keeps doing this until the trigger is pressed fully.

The protocol

The camera controls clocking and sends commands/data, the flash sends the reply when the camera clocks the next command.

There seems to be two categories of commands: Setting stuff (0xBn and reading stuff 0xFn, in the following text Bn commands are assumed to take one byte arguments and Fn command no arguments, unless a number of bytes is stated explicitly (thus, numbers in the "descriptions" refers to these argument bytes and replies, respectively).


Setting stuff (all numbers except those in brackets are in HEX):


B0: set desired flash intensity, the EOS uses A0 for preflash and the G3 90, 
    full intensity seems to be C0
    
    reply: 86, 86 (i.e. 86 is clocked out when the intensity is sent and
           86 is clocked out during the next (whatever) command
    
B1: unknown, G3:
           05 usually, sent before the preflash
           2C seen when using HS-flash in manual mode

         EOS 50: 
           AF: shutter time selected to less than 1/125
           FE: shutter time of some number of seconds
           5C: high speed sync (HS), 1/4000
           67: HS, 1/750
           f6: "normal" shutter times
              
    reply: 86-86           
              
B2: only seen with the G3, when IR-master mode is selected on the flash.
    (not investigated further)
  
B3: unknown, 2 _or_ 3 bytes of data:
             G3: 02-06-03 or 02-46-03 sent now and then, 
                 06-02 sent shortly before main flash (in auto mode)
    
         EOS 50: 02-00 sent now and then
                 22-00 sent after preflash
                 26-00 sent before main flash

    reply 00-00(-00)
  
B4: set trigger/enable flash? always sent before a preflash or a main flash
    is triggered, 1D often sent when not preparing for trigging.
    typical sequence: many 1D's, 3 before selecting intensity of the
    preflash and reading F2, 23 before trigging the preflash with CLK, 
    1D again after the preflash, followed by 3D before trigging the main
    flash.
    
    This is modified when HS flash is enabled: 05 while idle, 03 before
    setting preflash intensity and checking F2. 23 before preflash, 
    25 before main flash.

    Note that the EOS 50 pulses CLK low twice about when the preflash is
    expected. I have not verified which of them triggers the preflash, 
    but my guess is the later, based on the protocol.
    
    With the G3 in manual mode the sequence becomes:
    19 before command F2 (max avail flash?), followed by 39 before trigging 
    the main flash.
    
    reply: 86-86
    
B5: sent first in each "batch" of commands, 4D on the G3, 48 on the EOS 50
    (protocol version/camera features?)
    
    reply: c6-86
    
    
B7: aperture, 00 sent by the G3 in manual mode, otherwise:
    18->F2.0 1A->F2.2 23->F3.2 28->F4.0 2D->5.0
    30->F5.6 33->F6.1 34->F6.7 35->F7.1 38->F8.0
    3c->F9.5 40->F11  44->F13  48->F16 4c->F19 50->F22  
    
    reply: 86-86

B8: shutter time, examples:
    2B->3.2s 38->1s 4a->1/5 60->1/30 68->1/60 
    6A->1/80 6F->1/125 78->1/320 96->1/4000

B9: camera mode, always 80 with the G3, with the EOS 50:
    bit 7: Manual mode
    bit 6: Aperture priority
    bit 5: Time priority
    bit 3: fast shooting mode enabled
    bit 1: auto-focus enabled

    "P" mode results in neither of bits 5-7 being set

    reply byte 0: flash exposure compensation set in the flash: 
    00-> +-0, 04->-0.5, 8->-1.0, FC->+0.5
    reply byte 1: 86
    

BB: ISO/sensitivity, with the EOS 50 these numbers are modified up 4 for a 
    flash exposure compensation (either camera or flash) of -0.5, 
    down 4 for positive compensations.
    
    40->ISO 50, 48->ISO 100, 4B->ISO 125, 50->ISO 200, 55-> ISO 320, 
    58->ISO 400, 78->ISO 6400

BD: set zoom, usually 2 data bytes, but on the EOS 50 a 3rd byte follows
    the first time the command in a sequence. Byte 0 is always 00.
    Byte 1: zoom in millimeters (or something very close).
    Byte 2, when present: 28
    
    reply:
    18-69- if the zoom is changing,
    aa-59-00 if the zoom didn't change. 
   
One can speculate that 86 returned by most commands is some type of status.



Reading stuff:
F2:  Max available flash intensity? (max C0 for main, A0 for preflash), 
         
F5:  
     G3: Up to 4 bytes (read using FF) (ok to read less)
         53-41-14-00 normal
         53-40-14-00 with flash in manual mode
         57-         with flash in HS-mode
         53-41-15-00 if IR-master enabled
         
         
     EOS 50: Up to 3 bytes read
         53-01-00 normal,
         57-01-00 with HS
         other combinations not tested
     
F7: checked by the G3 before command B0, reply: 7B
    
F8: directly after preflash, actual intensity used?
    typical numbers around 4B to 55, ff when IR-master enabled.                 
    Affected by charge status but not by covering the flash.
             
F9: status?
    55 normal with the flash head pointing straight forward (or 7deg down)
    5d normal if pointing in any other direction (only tested on G3)
    54 not enough energy to flash
    57 2nd curtain sync selected on the flash (only tested on G3)
    75 if the flash changing the zoom (busy)

FB: flash mode: 02 if normal, 00 if manual or strobe

FF: Dummy command for reading more reply bytes from other commands
    This command is also sent after CLK has been pulsed low once
    (to trig a preflash), by the EOS 50. (The G3 continues with a F8)



Example files:

Ascii byte lists, first column is the byte clocked out of the flash, the second is the command sent by the camera. As explained earlier, replies appear one byte later.
Taking a picture with the G3, Av mode. annotated Ascii plain ascii binary
Taking a picture with the G3, manual mode, (1/50,F3.5). plain ascii Zooming in with the G3. plain ascii Taking a picture with the EOS 50. plain ascii binary
Taking a picture with the EOS 50 with high speed sync (HS). plain ascii
Taking 3 pictures in "rapid" mode with the EOS 50, flash only firing on the first 2. plain ascii

I have several more files which I will consider making available to individuals on request. Most files are quite boring variations designed to find out the scales of things like aperture. Please state which condition you are interested in and I'll check if I have anything relevant.

The standard disclaimer apply, if you break things, you get to keep both halves. Do not assume that "keeping" both halves is trivial. This is especially true in (but not limited to) cases such as gaseous products (blue smoke), and matter annihilation. The owner of this site will definitely not help you put the parts back together, but feel free to contact him in advance if you expect annihilation of substantial amounts of matter to take place. Canon, Powershot, Speedlite, EOS, E-TTL and probably trademarks are property of their receptive owners.