Canon RC-1 IR remote control reverse-engineered
This article describes how the Canon RC-1 infrared remote control communicates with the camera. To figure out the protocol I used an IR photo-diode first. Because of the bad signal quality I decided then to disassemble the RC-1 and measure the IR-LED voltage directly. I used the occasion and took some pics of the circuit.
To all appearances the circuit is build around a quartz-controlled microcontroller with an additional transistor to switch the IR-LED. The supply capacitor is large enough to maintain the function of the remote control for a few shots with removed batteries.
To the hobbyist's delight there is no communication protocol like the RC-5 code which most TV remote controls use. The signal send by the remote control consists of two identical bursts of pulses as shown on the pics below. To distinguish between the two possible modes of operation of the Canon RC-1, the delay between the bursts is changed. The signal shown in the oscilloscope screenshots below was captured directly at the IR-LED of the circuit. The overlaid noise in some plots is due to an internal oscilloscope problem.
Timing for instant trigger mode
Timing for 2s delayed trigger mode
Pulse burst Timing
Timing and Tolerances
The signal timing of the original Canon RC-1 is listed in the table below. Having build my own remote control I could also find out the tolerance for each parameter. I used the Canon EOS 400D for testing.
|Num. of pulses||16||9 - 22|
|Burst frequency||32700 Hz||29800 - 35500 Hz|
|Delay for immediate trigger||7.33 ms||7.0 - 7.7 ms|
|Delay for 2 s delayed trigger||5.36 ms||5.1 - 5.7 ms|
The clock frequency is very close to the standard watch crystal frequency of 32768 Hz. The experiments were made from a very short distance. I didn't test the sensitivity reduction for the deviating parameters and didn't test them in combination.
I found that on my EOS 450D remote trigged only works if I send 20 pulses. Maybe this helps somebody ;)