Testing done using a Canon EOS 600D and a Canon EF-S18-55mm f/3.5-5.6 IS II.

1. VBAT
2. DET (common with P-GND on lens side)
3. P-GND
4. VDD
5. DCL
6. DLC
7. LCLK
8. D_GND

VDD is nominally 5V. VBAT seems to also be ~5V (others report 6V).

VDD is always active (even with the camera off, if it has been powered on at least once) when a lens is connected (DET = low). When the camera turns on, VDD increases slightly (standby power vs. active regulator?)

The data lines are idle high and weakly pulled up by the camera. However, the drivers are not open drain (to get better rise times).

The signal levels are 5V. Driving 3.3V on DCL does not work - you need 5V, the lens seems to consider 3.3V as logic low. 3.3V on LCLK does seem to work.

The protocol is basically a variant of SPI with CPOL=1,CPHA=1. There is no framing or CS signal, which complicates parsing, and there is an additional variable length ACK clock pulse driven by the lens (kind of like I²C clock stretching).

Default clock period is 13µs (6.5µs per half cycle) = 77 kHz (80 kHz) This decreases to 2µs for nwer lenses (1µs per half cycle) = 500 kHz Intended duty cycle seems to be 50% (fast mode seems to be 0.8µs low / 1.2µs high, but this is likely just an analog effect).

Power-on timing:

• 1µs low glitch on DCL (?)
• 42µs delay (?)
• Single 6.5µs low pulse on DCL (does this serve a purpose?)
• 103µs delay
• First three byte cycles:
  • C 00 L ff [TX 89us ACK 14us BUSY 2165us] <- note long BUSY period
  • C 0a L aa [TX 89us ACK 14us BUSY 4us]
  • C 00 L aa [TX 89us ACK 14us BUSY 4us] <- VBAT turned on by camera during the lens ACK/BUSY pulse

Command byte timing:

• Camera drives DCL at a random value for ~18µs (slow mode) or ~4µs (fast mode)
  • This seems to usually be whatever the last bit of the previous command was, but not always consistent.
• Each bit is driven (by both camera and lens) on the falling edge of LCLK, and sampled on the rising edge.
• Camera drives DCL high (or stops driving?) and stops driving LCLK 1µs after the last rising edge of LCLK (this is half a cycle in fast mode, but much shorter than half a cycle in slow mode).
• Lens releases DLC ~4.3µs after the last rising edge of LCLK
• Lens drives LCLK low ~14µs after the last rising edge of LCLK (ACK/BUSY)
• ACK/BUSY pulse seems to last at least 4µs but may be much longer
• Gap between bytes (rising edge of LCLK ACK/BUSY to first falling edge of LCLK) is at least 120µs in slow mode and at least 18µs in fast mode.

Note that slow/fast mode only changes the camera timings. The lens always behaves the same way.

Holding DCLK low for >700µs seems to reset the lens. The lens will then itself hold DCLK low until ready (~300us, sometimes longer).

Pulsing DCLK low (e.g. shifting in one bit) then waiting causes the lens to time out. After 740µs, it will reset itself and hold DCLK low for ~300-400µs. This may effectively be the same situation as the above (holding DCLK low).

Command 08 powers down the lens (sent by the camera). After this, the next command sent by the camera is ignored, and the lens will hold BUSY low for ~2ms during that command as it powers up.

Lens commands opcodes are one byte, and may have a number of arguments and reply bytes. The lens replies to a command starting on the next byte cycle. Commands may be pipelined: the last response byte from the lens may be transferred at the same time as the next command from the camera.

When the lens receives an unknown command, it will echo it back to the camera on the next cycle.

There is no explicit framing, therefore keeping sync with the protocol requies knowledge of all command lengths. There are no implicit timeouts. You can send a command, wait one second, then send the argument, and it will be interpreted as such, not a new command. Commands have both fixed argument and response byte counts (i.e. a fixed overall length); the camera cannot interrupt an information retrieval command by sending another command. The lens ignores dummy data from the camera while it is replying to a command. Canon cameras send 00 as dummy padding bytes during such read cycles.

The command codes follow certain patterns:

• 00-0f: commands 0-f with zero arguments
• 10-1f: commands 0-f with one argument
• 20-2f: commands 0-f with one argument
• 30-3f: information commands
• 40-4f: commands 0-f with two arguments
• 50-5f: commands 0-f with one argument
• 60-6f: more info commands
• 70-7f: unused/unimplemented
• 80-ff: largely more info commands

These range 0x, 1x, 2x, 4x, 5x encode the same operations. Additional arguments are ignored, missing arguments either are interpreted as 0 or cause the command to fail. However, not all commands alias the same way (e.g. 12 is aliased to 22, but 13 is not aliased to 23).

This table exhaustively lists all commands and what they return on this lens. The lengths can be used to build a table for a protocol analyzer (or a modchip). The busy time may help determine which commands are unimplemented/no-ops and which actually do something.

CMD         RET         TIME        Brief description
00          00          4
01          01          4
02          00          9
03          00          10
04          04          8
05          05          7
06          06          7
07          07          10
08          (ff)        298         Power down
09          09          11
0a          aa          10          Sync
0b          0b          16
0c          XX          4           Repeat last response byte
0d          0d          8
0e          0e          11
0f          0f          12

10 --       10 10       7, 3
11 --       11 11       8, 4
12 YY       12 YY       9, 14+      Aperture
13 YY       13 YY       9, 14+      Aperture
14 --       14 14       7, 4
15 --       15 15       7, 4
16 --       16 16       7, 4
17 --       17 17       7, 4
18 --       18 (ff)     8, 297      (Power down)
19 --       15 15       7, 5
1a --       1a aa       7, 4        (Sync)
1b --       1b 1b       7, 9
1c --       1c 1c       7, 3        (Repeat last response byte)
1d --       1d 1d       7, 4
1e --       1e 1e       7, 3
1f --       1f 1f       7, 4

20 --       20 20       4, 4
21 --       21 21       4, 3
22 YY       22 YY       4, 8+       (Aperture)
23 --       23 00       4, 7
24 --       24 24       4, 4
25 --       25 25       4, 4
26 --       26 26       4, 4
27 --       27 27       4, 4
28 --       28 (ff)     4, 296      (Power down)
29 --       29 29       3, 4
2a --       2a aa       4, 3        (Sync)
2b --       2b 2b       4, 8
2c --       2c 2c       4, 4        (Repeat last response byte)
2d --       2d 2d       4, 4
2e --       2e 2e       4, 3
2f --       2f 2f       4, 4

30 ?? ?? ?? 30 30 30 30 4, 4, 4, 6  ?
31 ?? ??    31 31 31    3, 3, 35    ?
32 ??       08 03       7, 4        ?
33 ?? ?? ?? 07 0a 0a 4a 6, 6, 3, 3  ?
34 ?? ??    34 34 34    5, 4, 12    ?
35          00          5           ?
36          36          3
37          37          5
38          38          4
39          39          4
3a          3a          4
3b          3b          5
3c          3c          4
3d          3d          5
3e          3e          4
3f          3f          5

40 -- --    40 40 40    8, 4, 4
41 -- --    41 41 41    7, 4, 4
42 YY --    42 42 YY    7, 3, 9+    (Aperture)
43 -- --    43 43 00    8, 3, 9
44 -- --    44 44 44    7, 4, 4
45 -- --    45 45 45    7, 4, 5
46 -- --    46 46 46    8, 4, 4
47 -- --    47 47 47    8, 3, 6
48 -- --    48 48 (ff)  7, 4, 316   (Power down)
49 -- --    49 49 49    8, 3, 6
4a -- --    4a 4a aa    7, 3, 4     (Sync)
4b -- --    4b 4b 4b    7, 4, 10
4c -- --    4c 4c 4c    7, 4, 7     (Repeat last response byte)
4d -- --    4d 4d 4d    8, 4, 5
4e -- --    4e 4e 4e    7, 4, 5
4f -- --    4f 4f 4f    7, 3, 5

50 --       50 50       4, 4
51 --       51 51       4, 4
52 --       52 00       4, 9
53 --       53 00       4, 9
54 --       54 54       4, 3
55 --       55 55       4, 4
56 --       56 56       4, 4
57 --       57 57       4, 4
58 --       58 (ff)     4, 298      (Power down)
59 --       59 59       4, 5
5a --       5a aa       4, 4        (Sync)
5b --       5b 5b       4, 9
5c --       5c 5c       4, 4        (Repeat last response byte)
5d --       5d 5d       4, 3
5e --       5e 5e       4, 5
5f --       5f 5f       4, 5

60          60          4
61          61          4
62          62          4
63          63          4
64          64          4
65          65          4
66          06          12          ?
67          67          4
68          30          4           ?
69 -- -- -- -- --
    23 09 00 00 00 00
        9, 69, 4, 4, 4, 6           ?
6a -- -- -- -- --
    23 09 00 00 00 00
        11, 65, 4, 3, 4, 6          ?
6b --       f1 9f       11, 4       ?
6c --       f2 b8       12, 4       ?
6d --       f1 9f       12, 4       alias of 6b?
6e --       f2 b8       12, 3       alias of 6c?
6f --       54 2a       6, 4

70..7f      70..7f      4           this range is unused

80..ff                              TODO, these are mostly get info commands