Reverse engineer Cannon printer control panel - Page 1
Forum section: electronics / general

author: kevinateev
author_rank: Regular Contributor
timestamp: April 23, 2022, 08:20:24 pm
content: I've seen a number of people asking about this display. No specs available. It has a nice 40x50mm LCD and controls. From inside, it looks like a generic CPU is driving the LCD panel and brokering button presses back to another CPU.With the Cannon board and panel connected, the board starts up and generally works (vid link below). The button presses and LED signals, I got, they are srial Tx/Rx at 19200 baud.https://youtu.be/7dj8Rzvtl2AThe display driving signals, they look different. SPI? sdio? Kind of looks like SDIO but there is no clock signal. Also, there is this wierd 20ns blip. Almost looks like scan lines but still not quite. Any ideas?The controller is marked mb87m8260Overview:Screen Shot 2022-04-23 at 4.17.31 PM.png(52.32 kB. 991x381 - viewed 152 times.)First burst:Screen Shot 2022-04-23 at 4.18.23 PM.png(71.13 kB. 1010x370 - viewed 78 times.)Detailed lines?:Screen Shot 2022-04-23 at 4.18.40 PM.png(56.99 kB. 1016x371 - viewed 85 times.)That blue trace, is either 20 or 40ns. It always leads or lags with one edge matching either the yellow signal or the green signal exactly. Some kind of framing signal?The yellow trace looks like four bytes then some kind of framing high whilst the green line sends a response byte? It goes on like that but that blue trace is all over the place. Later on, the pattern changes.Think it just may be UART in two directions at an odd bit rate (53000 bits/s).Hmm, so, for the boot sequence in the video, there are about 1248 bytes of data transmitted from control board to the panel processor. That certainly isn't enough for raw image data. There appears to be a higher level protocol at play here. There are fonts, shading, a dialog box with a paragraph of text. There is 1Meg DRAM on the control panel. There is no eeprom so if there is pre-loaded forms/fonts etc. then they are in a OTP part of that processor. Not looking good. If it is OTP with pre-set text etc. it is toast. If it is something like OpenGL, then it may be usable. Real shame as the buttons are all streightforward to decode. The action wheel works quite nicely too.

author: kevinateev
author_rank: Regular Contributor
timestamp: April 24, 2022, 12:59:19 pm
content: So here are the initial encodings with send and receive to display MCU. this would be initialization at boot along the splash screen showing "Cannon" in a nice font with shading at top and bottom of screen.** Also, I looked at that third blue line above on the scope, it is RMS 1.25V with a bit of jitter. It carries no data information. Not sure what it is for right now. Brightness maybe? Something to verify later.Code:IdTime0:UART: TXResponse09630716031965081202429670908003969100400970950808649730976035975107201D697711640117979126009F9809720086898305720399850668001098707600011989085608299093200861299303880313995048408E149970580001599906760310009152086161003020403171005030000F1810070396001910090492082101089640862010129800032110149896090221016999200F23101900880FF10208592086241022939603251024949209526102695880EF271028968408710308220086281032899203291034908801130103691840803110389280079104078840A63210429028033310449124096341046922000351048931603105079400A6361052884803371054894401738105690400039105891360EF106077120864010628664034110648760014421066885602743106889520851070748808644107282600345107483560994610768452004710788548001080708808648108278560349108479520350108680480051108881440010906712086521092789203531094798808454109680840055109881800A011006712086561102771203571104780405581106790008259110879960BF1110650408660111273080361111474000662111674960063111875920821120610408664112269040365112469960876611267092020671128718800113057480866811326720036911346816088701136691208271113870080BF114056120A6721142653603731144663209A741146672800751148682400115054680A6761152657203771154666801B78115667640F8791158686009F1160547608680116266120381116467080828211666804008311686900001170550408684117264280385117465240A68611766620008711786716001180533608688118330920389118531880829011873284009111893380061191188808692119556520393119757480829411995844009512015940001193430007120344160869612056132039712076228082981209632400991211642005121348960861215622407121755120311001217759200C10112197688027122161800612235488012122549240A012274192030122936320A610212316056031031233615208210412356244001051237634000123948960861061241719600C10712437292027124558000612475112012124944840A012513784030125332200A6108125552160310912575312027110125954080011112615504024126340520861121266055603113126806520821141270074800115127208440612739380086127607360711612781792031171280188808211812821984001191284208000128605680861201288183203121129019280821221292202400123129421160512960576086129820720271300142803113041812061241300306800C125130231640271306106801213080508080130998080301311909208612613140204031271316030008212813180396001291320049200132190600861301324046400C13113260560027132791960613298456012133178240A013337236010133565280861321337782403133133979200271341341801600135134381120241345660808613614061084031371408118008213814101276001391412137206141399760A6140141617840314114181880082142142019760014314222072061424056408614261796071441428258003145143026760821461432277200147143428680014361444086148143830600314914403156082150144232480015114443344084144619640A617601036071521762246803153176425640821541766266000155176827560017701232086End of initial splash screen

author: DavidAlfa
author_rank: Super Contributor
timestamp: April 24, 2022, 03:16:06 pm
content: Seems the display might be a standalone system, receiving simple commands to load the screens.OpenGL over UART?Disassemble the screen and make pictures!

author: kevinateev
author_rank: Regular Contributor
timestamp: April 24, 2022, 04:18:51 pm
content: Here is a link to the same LCD display. This person has maybe slightly different version but all of the components and layout are the same. I'd bet this is a common interface for Cannon. I'd even bet this is a standard system they are using.https://twitter.com/sandarkr/status/909745508406542342By translation of the above chat, I'd gleaned that he has already taken apart the LCD fully and found no other controller. The listed CPU is doing the higher level application stuff and the low level signals needed for LCD scanning etc.If it is a standard system, there will be 3rd party documentation for it, just gotta find that.I am seeing that there is a category of Intelligent LCD systems out there that manufacturers use.Like this onehttps://www.mouser.ca/new/futaba/futaba-lc-series-modules/or this onehttps://www.lcd-module.com/produkte/edip.htmlmaybe these guyshttps://www.stoneitech.com/civil-type/This one looks promising, they have one in the 2" size range (this one is 2.6")https://macnicadisplays.com/ortustech/ortustech-blanview-technology/. Actually, this source is only raw displays, no intelligence.However, now this is looking close, they show a printer as an example use case!https://macnicadisplays.com/macnica-displays/

author: DavidAlfa
author_rank: Super Contributor
timestamp: April 24, 2022, 09:20:20 pm
content: Seems a controller-less display, running over 4-lane mipi-dsi, you can see them in right side of the connector.Not for DIY, it's a constant high-speed flow of data, similar to HDMI or DisplayPort.

author: kevinateev
author_rank: Regular Contributor
timestamp: April 25, 2022, 11:49:49 am
content: Here is a photo of my actual device. A controller-less display with a dedicated MCU? Hence the high level signals. The rom for this thing is likely in this baked in chip isn't it. Question is, is it a general purpose kind of rom or is it filled with specific forms and content just for this Cannon printer.

author: DavidAlfa
author_rank: Super Contributor
timestamp: April 25, 2022, 05:49:57 pm
content: That controller does everything and looks like a custom design for Canon, no datasheet whatsoever.

author: free_electron
author_rank: Super Contributor
timestamp: April 25, 2022, 05:58:22 pm
content: That controller is made by Fujitsi. Borged by Oki.Dirt cheap silver paste via technology... can't even bother to use true through-hole plating. probably a phenolic board.

author: amyk
author_rank: Super Contributor
timestamp: April 26, 2022, 12:22:56 am
content: Quote from: DavidAlfa on April 25, 2022, 05:49:57 pmProbably based on other Fujitsu microcontrollers. Datasheet will likely be in Japanese if you could find one.