Digital Photography Tips and Techniques

It is difficult to determine when the accessory shoe first appeared on Nikon SLR cameras. The very early ones might be a simple “cold shoe”, which could hold a flash but the triggering signal was sent via additional cable between flash and camera. You could fine one like that on a Nikkorex F (1962). Later, the electrical connections were made within the shoe. That’s when it became “hot” and was called “hot shoe”.

On the Nikormat EL (introduced 1973), the first Nikon SLR with fully automatic exposure, there was a single contact that looks like the X-sync contact. It worked with the SB-2 and SB-3 that were introduced a year earlier. The legendary Nikon F3 added a extra contact for flash ready light. The current Nikon hot shoe interface was probably first seen on Nikon FG (1982) and later on Nikon F4 when TTL flash function was implemented. Even though the physical dimensions and contact arrangements remained the same, the functions of the contacts have changed over time. The function description of the contacts for old Nikonos and Nikon film SLR cameras can be found here. On fairly recent flashes such as the Nikon SB-800 and SB-600, the old cameras are still supported but when the flash is mounted on the latest digital SLR camera, the signals going through the contacts are quite different.

After decoding the optical communication protocol of Nikon’s Advanced Wireless Lighting (AWL), I simply followed my curiosity and tried to decode the electrical communication between a Nikon D200 and Nikon SB-800.

First, by measuring the voltages of the contacts on flash and on camera, I found them either near 0 or at ~3.6-5V. So the Nikon camera/flash system operates with standard TTL voltages. To capture the communication, I need to physically tap into the hot shoe connections. I could have cut a TTL cord for that but I found the Pixel TF-322 hot shoe converter a nice fit for the purpose. I removed the PC sync port and soldered a few fires through the hole to the contacts.

It worked quite well and I was able to understand a good portion of the communication going on between the camera and flash. Before going further, here is the the Nikon TTL flash shoe interface. Symbols in parentheses are for old TTL functions.

The following is an example of a Nikon D200 talking to SB-800 captured using a logic analyzer. The flash was in idle mode sitting on the hot shoe. Then the camera was turned on, which woke the flash from idle mode. After some unique initial data communication sequences, the same data communication sequence starts to get repeated every ~50 milliseconds until the camera and flash goes into idle mode again.

Here is the zoomed-in view of the details.

On the Clock line, there are bunches of very regular pulse groups. In each of them, the signal goes to logic low 8 times. Each clock period is 32 microseconds. On the Handshake line, the signal remains low during the entire time period of the 8 pulses on the Clock line. The Data line has irregular pulses that appear to be the actual data. Obviously this is some form of serial communication, probably a 3-wire SPI.

To decode the actual data on the Data line, I needed to know if the data is sent least significant bit (LSB) first or most significant bit (MSB) first. The former assumption makes most sense because the last byte of the transmission string appears to be a simple checksum that only only adds up if LSB is sent first.

When the camera and flash start to talk, the communication always follows this pattern.

0xA1 + 18 bytes, 0XB1 + 10 bytes,

0xB0 + 15 bytes, 0xA0 + 22 bytes, 0xA2 + 46 bytes,

0xB0 + 15 bytes, 0xA0 + 22 bytes,

... Repeat of "0xB0 + 15 bytes, 0xA0 + 22 bytes" every ~50ms.

Different data show up when the settings on flash or camera are changed. Extra data show up when a photo is taken. By observing each data change corresponding to each settings change or photo-taking process, the meaning of the bytes and bits can be decoded to a certain degree. There are some values that do not change no matter what I did on the camera or flash. The meaning of those bytes cannot be decoded. Basically, the bytes that follow 0xB0 are communication from camera to flash and the bytes after 0xA0 are communication from flash to camera. The bytes after 0xA1 and 0xA2 are specific to the flash unit and the bytes after 0xB1 are specific to the camera. Perhaps the camera and flash are exchanging some basic informations that are not user changeable since they were sent only once at startup or wakeup. SB-600 has a different set of data after 0xA1 and 0xA2. Quantaray QDC 900WA is a cheap flash that is Nikon iTTL compatible. It has the exact same bytes after 0xA1 and 0xA2 as Nikon SB-800. Perhaps Quantarary simply cloned the information from Nikon SB-800 since there is no easy way to decode the data.

Other interesting information can also be easily obtained. For example, “0xD7″ is the command to do the pre-flash. “0XD8, 0×18″ is the 2nd pre-flash (High) command. The amount of the flash output is sent in the format of “0xD3, 0xMM, 0xNN, 0xD3″. The flash still fires upon lowering of the X-sync contact to 0 but it doesn’t stop by waiting on the Quench (now Data) contact to go to 0.

For me, the ultimate goal is to create some DIY wireless flash triggers because the available options are either too expensive or feature-limited. So I need to create a wireless receiver that can control the flash by pretending it is a compatible camera and a wireless transmitter device that can emulate a flash when sitting on top of the camera. In order to do that, a deeper understanding of the Nikon camera-flash communication is required. Since the communication is half-duplex, it is not obvious which side toggles the logic levels of each contacts at any given time by examining with a logic analyzer. There are some tricks I had to use and time consuming tests I had to perform to figure it out. Those details are more related to The Art of Electronics than the Art of Photography so I will not include them here on a photography blog.