Hacking Canon PG40

Powder and inkjet printing
Post Reply
erhancm
Posts: 7
Joined: Tue May 23, 2017 11:35 am

Hacking Canon PG40

Post by erhancm » Thu May 25, 2017 10:00 pm

Hello everyone.

This is my first time posting here, but I thought I'd share my progress if anyone is interested.
So I'm currently trying to get a PG40 cartridge to print. Some interesting specifications of the cartridge:

320 nozzles in two parallel lines. Slightly offset to each other.
30 picoliter droplets.
Runs on 24V for the heating elements and 3.3V for the control lines.

What the cartridge looks like:
Image

Pinout:
Image

First thing I did was measure the signals going towards the cartridge. So I slightly dissasembled a pixma ip1200 and soldered a bunch of wires to each spring contact behind the carriage. I only hooked up the black cartridge b.t.w. and completely ignored the c/m/y cartrigde.
For clarification:
Image

Now the fun part. The measurements. All of this was measured with a Logic 16 clone.
Image

A little zoomed in:
Image

Channel discription:
Image

I grouped the channels together to keep it somewhat organized.
Channel; 14 and 15 was in no way connected to the printhead. I measured the DC motor connected to the carriage so I could discern when it would start printing and know where to look at. At startup, the carriage would move left and right a couple of times to check the encoder ribbon I guess. Then wipe the nozzles to clean them. Next a swipe across the page to print the text. And lastly it cleans itself again two times by wiping across the spunges.

If anyone is interested in looking through the data. Here are the measurements.
https://www.dropbox.com/s/7kdnqt72vxkhj ... cdata?dl=0

More to come.

**EDIT**
Updated the images
Last edited by erhancm on Sat May 27, 2017 8:44 pm, edited 1 time in total.

erhancm
Posts: 7
Joined: Tue May 23, 2017 11:35 am

Re: Hacking Canon PG40

Post by erhancm » Sat May 27, 2017 5:52 pm

Hello. Thank you for approving this thread. Appreciate it ;)

Now, apparently I figured out I'm a bit of a klutz.
I already thought the signals going to the printhead didn't make much sense. Alot of noise and muddy waters to go through so to speak. Today I figured out why. I grounded the logic analyzer and oscilloscope incorrectly :( Took me a long time to realise this untill I finally redid the measurement.

Because of this. Ignore the measurements made in the first post.

Here are the correct measurements.
Image

So I printed a capical i (I) in the middle of the page. Just to keep it basic. The following image is some annotations with what I think is going on.
Image

A little bit zoomed in.
Image

New pinout
Image

Now, I know there is a chip in there that monitors the inklevel. Channel 9, 10 and 11 seem like SPI. I'm just gonna assume those are in control of the rom monitoring the inklevel.
I dont know which groups of signals control the addressing of the nozzles. But it seems likely that channel 1, 3, 7 and 8 are in control of the nozzles.

I'll figure that out as I go.

'Till next time.

Oh, and also ; link with the correct signal timings for those who are interested.
https://www.dropbox.com/s/euf7bxpz8g0yn ... cdata?dl=0

**edit**
Updated the images
Last edited by erhancm on Sat May 27, 2017 8:47 pm, edited 1 time in total.

User avatar
dragonator
Site Admin
Posts: 412
Joined: Fri Aug 14, 2015 4:48 pm
Location: The Nethelands
Contact:

Re: Hacking Canon PG40

Post by dragonator » Sat May 27, 2017 7:32 pm

Not a problem. I only block spam, all others go through. Sadly, this is required because I get around 5 spam posts and topics a day. Approving works better.

Also, welcome to the forum I am curious to see if Canon printheads also can be hacked. The specs do look interesting. Any knowledge on the Actual DPI? How big a line do the 320 nozzles make? How much do these heads cost and how much ink do they contain.

Does the Chip actually monitor the ink level or is it just an EEPROM that remembers how many droplets the printer said were deposited. That is to my knowledge how most printers keep the ink level.

I do want to ask you to either attach your images or make them public on Dropbox. They way you have them now, All I see is "Image" and when I try to open said image I get redirected to the dropbox login.

erhancm
Posts: 7
Joined: Tue May 23, 2017 11:35 am

Re: Hacking Canon PG40

Post by erhancm » Sat May 27, 2017 9:25 pm

I fixed the images. Gonna start using imgur from this point on.

Regarding the cartridge. I started off with these because they are cheap and refillable. (after drilling a hole) And if it starts failing you can just buy a new one. Depending on the cartridge it can hold between 16 and 19 ml of ink.

Now, finding technical documents for these things are kinda hard. I could extract a little bit of information out of the service manual. But not much.https://www.manualslib.com/manual/69753 ... p1200.html

I don't know how many dots per inch it can print, but I can approximate. The image below is what the printer expells in one of its cleaning cycles. The paper and printhead were static in this case.
Image

Lastly, I dont have a original cartridge. Everytime I print, the printer notifies me that the ink is empty. Luckily I can just click print again and the printer would happily oblige. Unlike modern printers these days :roll:.
So I dont exactly know how the inklevel is monitored. All I know is what I can measure and then make assumptions.

Next post I'll share more.

"Till then

erhancm
Posts: 7
Joined: Tue May 23, 2017 11:35 am

Re: Hacking Canon PG40

Post by erhancm » Sun May 28, 2017 8:50 pm

Alright then. More progress.

So, Awhile ago I've made some pcb's for making an electrical connection with the contacts behind the cartridge.

Image
Usually, I order 10 pcb's that are 10x10cm. So instead of ordering and having 90 pcbs, (could fit 9 on each pcb) I opted to share some space with a little breakout/development board I made in my spare time.

So. Next is the holder for the cartridge. To make it easy, I've uploaded it to thingiverse. So here you go.
https://www.thingiverse.com/thing:2350737

What it looks like when it is assembled:
Image

What it looks like from the bottom:
Image
Note, the cartridge has been nuked by applying the wrong voltage on the wrong pin. It did eject ink so that was what I was aiming for. However, the control aspect was left out and it sputtered an angry mess.

Test setup.
Image
Note, when I tested it, the cartridge was connected to the breadboard. To illustrate the test setup, I've put it roughly back together for a quick pic.
So. Continuing, first I tested this thing with the cartridge in the printer. (after changing the cartridge) I confirmed the cartridge was functional by printing the word "test" on that blue paper. Then, in order to test the custom cartridge holder, I jerry-rigged it to the printer. The cartridge expelled ink and seems to be working correctly. If I could move my hand fast enough, I could make out the letters. So the data is received. Meaning, all the pins make good contact.


So, this is it for today. I've been posting here in quick succession. In reality, this work actually took months. Divided over the time I could spare for this project. From now on these little raports is gonna slow down considerably. The hardest part right now is figuring out the protocol and having individual control over each nozzle. This is where i got stuck, so therefore I've decided to share what I got right now and maybe get some good tips in return.

O well,
'Till next time.

david
Posts: 57
Joined: Wed Sep 21, 2016 8:43 pm

Re: Hacking Canon PG40

Post by david » Thu Sep 14, 2017 9:46 am

that's cool. the advantage with an asic inside the head is that you don't need to worry about a driver; while the problem is you don't know what the asic is doing.

erhancm
Posts: 7
Joined: Tue May 23, 2017 11:35 am

Re: Hacking Canon PG40

Post by erhancm » Mon Dec 25, 2017 11:24 am

Hello again.

I had put the project aside for some months and restarted it again. Some more findings to share if anyone is interested.
First thing I did was dissasemble my sacrificial printhead to see what makes it tick.

The flexible contacts :
Image
Image

The cartridge cut in half:
Image

The business end:
Image
Image
Image

A little zoomed in:
Image
Image

The album can be found here if people are interested : https://imgur.com/a/6yxdf

That was it with the dissasembly.
Also, I made some assumptions on the first couple of posts that turned out wrong. I will correct those in the next post.

erhancm
Posts: 7
Joined: Tue May 23, 2017 11:35 am

Re: Hacking Canon PG40

Post by erhancm » Mon Dec 25, 2017 6:43 pm

Ok.

Next update.

Throw away old assumptions. First off, there is no ink monitoring present on the cartridge whatsoever. Remember this old image ?
Image

Well, I took precautions. But there is still ALLOT of noise present in here. Where? Well...
Image

And here I am connecting each and every relevant (in my mind) dataline to an arduino due, taking the time to learn a little bit of assembly, and manually program each byte for each sample within some sections in the above mentioned image. Total waste of time? Well, maybe, or maybe not because I learned some things. Mainly that if you think that the signal is too incomprehensible it probably is.

After measuring and verifying with an oscilloscope I came to this conclusion.
Channel 0, 7, 8, logic HIGH, no data. -> Power.
Channel 4, 12, logic LOW, no data. -> Grounded.

Relevent channels for controlling the nozzles:
Channel 1, data_1.
Channel 11, data_2.
Channel 9, clock.
Channel 10, some sort of data, looks like an enable of some sort.
Channel 3, some sort of data, always the same.

Image of what I'm talking about.
Image

So, I'm getting a good idea now. Connect all the relevant power/supply lines to my arduino due, and JUST those 5 data signals, ch 1, 3, 9, 10 and 11, connect those to the detached printhead. Image of my latest test setup:

Image

I enabled the requisite power/supply lines with the arduino due through a serial interface with the pc. Then I manually started a deep cleaning cycle with the printer. Not the best solution but I needed to know if it works. Luckily It did. The detached printhead spewed out ink like I hoped it did. I managed to get a reasonable snapshot with the logic analyzer.

What I got :
Image
Zoomed in :
Image

It is very similar to SPI, but both datalines (now ch3 and ch7) go from the printer to the printhead though. No bidirectional communications.

The file if anyone wants to peruse through this data for themselves.
https://www.dropbox.com/s/xok5f60mvybf5 ... cdata?dl=0

Ok. That was it. Next I'm going to try to get ink to eject with JUST the arduino due.

My finishing thoughts.
I know I'm bumbling through this and progress is a bit slow. If canon would be so kind to send me the protocol, datasheets or anything relevant to make this easier, then I'd appreciate it very much !

That was it for now.
'Till next time.

Wonko
Posts: 85
Joined: Sat Aug 15, 2015 8:13 pm

Re: Hacking Canon PG40

Post by Wonko » Mon Dec 25, 2017 11:11 pm

Thanks! This was a really great read! I am really looking forward to your next findings ;-)

erhancm
Posts: 7
Joined: Tue May 23, 2017 11:35 am

Re: Hacking Canon PG40

Post by erhancm » Wed Jan 17, 2018 9:54 pm

Alright then.

I am going to keep this one short since this approach was unsuccessful unfortunately.

I'm still learning. A bit by bit but still, nonetheless....
Manually programming each and every bit with the correct timings in between can be a bit tedious. Take that from me.
Having no success in this approach, I've chosen to make it a little bit easier.

So, what I've done instead was create a little program that would do it for me.

The first step is to export the data that I want to replay. Lucky for me, that is possible.
Image
(not the actual settings I used to export)

Great, then I've got a text file. The following is a piece I've actually tried to reproduce.
Image

Ok. now the hard part. Not really a programmer kind of guy, but I could get the basics up and running. Atleast, that was the general idea.
What I've managed to put together.
Image
Image
Image

I've chosen to work with c#, since I'm familiar with C. The Idea was to input a text file, select the appropriate output channels, and perfectly replay the data. You could just paste the output text in the arduino, compile and then upload it. And it actually works ! But not efficiently enough.

There are two main problems.

1) IT TAKES TOO MUCH TIME ! no kidding.
I've got a i7 6700k with 16gb ram, fully decked desktop pc. And still it takes forever to get to output everything.
The text file I used in this instance is just a few milliseconds long. Just as a test, and already it has 27000+ lines. Not nearly all the data I actually want to output.
This took about 10 minutes to finish the run through. The real deal consists of more than 3.5 MILLION lines. And thats just about 218 milliseconds. So already, this is a bit bothersome. Also, the longer its working, the slower it becomes, since it stores everything in ram.
This could somewhat be remedied by implementing a couple of improvements. Things like :
- Append the output to a text file so that the ram doesn't fill up. Easy enough to implement, but I didn't get around to it.
- Use multiple cores. (this is hard, I've tried and had no real success)
- Increase the efficienty in the algorithm i'm using.

2) Takes up all the memory on the due. It really has 512KB of memory. Really, this is the main reason.
Maybe I could implement another approach to compress the data. It would need to look for recurring patterns, and put that pattern in its own routine. Then I'd just need to call that routine every time that pattern shows up. It would be crazy work however trying to get that to function.

I've thought of new ideas of getting this approach to work, but I've started to deviate from my original project. I'd need to create a programmable multiple channel pattern generator, which would consist of atleast an fpga with external ram. Kinda similar to a logic analyzer. But I need to stay focussed on this project, atleast for now.


So... What am I going to do ? Well, I've already started on another approach which I will be certain will work. More on that later on the next post.

'till then.

Post Reply