Here at Kolari Vision, we love tearing into the newest camera gears to learn how they work and if they can be modded for infrared photography, full spectrum photography, or other things. We’ve been really excited about the R5/R6 release, and had plans to add some cooling mods and overhaul it into a proper video camera. Reports from EOSHD that Canon uses an overheat timer rather than actual temperature readings left us a bit disappointed, and calls into question whether physically cooling down the camera can actually give any more shooting time. Andrew Reid was able to bypass this timer by using a screw to override the safety shutoff switch in the battery door compartment and do a hard shutdown during recording, but this seems to corrupt video files. “Math Class” on Baidu recently showed that removing the clock battery can also bypass this timer. Firmware update by Canon on the R5 has also recently extended the shooting length by a seemingly arbitrary time, showing that software can absolutely affects shutdown times. These data so far suggest that the camera keeps internal time, keeps time when the camera is off, and uses these values to influence if shooting can resume. A hard shutdown corrupts some data being written, preventing a time limit from being established. The clock battery removal suggests that without a clock keeping time while the camera is off, there is no way to establish a countdown timer, and the camera defaults to zero on the shooting time. With this knowledge, we wanted to investigate how the camera functions without a clock battery, could we identify a physical clock chip on the board, and is there a more advanced modification that could be made to interrupt the clock timer communication without affecting date/time settings. Right now we only have the R6 to work with, but we suspect the R5 works similarly. If anyone has an R5, please contact us.
So first, let’s start with the clock battery. It can be found on the back of the main circuit board.
The first thing we wanted to check was, how does missing the battery affect general performance? The clock is of course reset, but on other Canon cameras it has prevented saving shooting settings and custom settings, which would be deal breaker. So we set some custom menus, changed some shooting values, and some menu settings, and then proceeded to remove the clock battery. Leaving the board completely powered off without any battery source for about 30 minutes, we re-assembled the camera sans battery and checked it out. We received the expected prompt for time/date, but were pleasantly surprised to find the rest of our settings were still there. Nice! We also found that the camera keeps time as long as the main battery is in place, even when turned off.
Next up, could we trace out where the battery leads connect to. Visually checking, the leads from the battery immediately go down into the board to a middle layer, so we could not visually trace them out. Oh well, we have a multimeter! Running a continuity check from the leads, I was able to trace the right lead to the common ground right away. The left positive lead was a bit harder, but the trace must come out somewhere, so I went around testing components throughout the board on both sides. A bit tedious, but I was able to identify only one chip that the battery feeds into.
We needed a microscope to read the chip, but were able to identify it as the RX8130 Real Time Clock, complete with a 59 page documentation PDF. Bingo. This is what keeps time.
The wiring diagram for the RX8130 looks like this, page 7. I was able to identify the clock battery feeds into pin 10 through a 470 ohm resister. Pin 7 also connects to ground. Interestingly, pin 6, 2, and 3 either connect to nothing, or connect to something directly going down under the board. We need to remove the chip to see more definitively, but potentially they are not used.
Pin 4 from the documentation is used for the frequency out, and this connects to a 6 pin chip immediately to the right that reads only pQ on it, hopefully someone has more insight on this chip. Pin 5 leads elsewhere on the board we can’t identify. Pins 1 connects to a distant BGA mounted chip with what looks like a smoothing capacitor connection to ground. Pins 8 and 9 also connect elsewhere we can’t trace yet and also feature smoothing capacitors.
So far, that’s all the progress we made. We like to be transparent in what our mods do, so we decided to open up our research here as we go. Based on this chip’s documentation, our basic understanding is that this chip receives power from the main board first, and if there is no power there, it draws power from the backup button cell battery. The chip is able to keep time, and can output time data, as well as other stored data, there is some room for general bit storage. The chip is also able to send interrupt and data signals back out, but so far it doesn’t look like those pins are necessarily being used. Canon may not be using the internal interrupt and timer functions, and may be doing that elsewhere using this chip as only a timekeeper.
Our next plan is to verify this with an R5, and pop the chip out and see if we can measure any signals on a scope during the actual overheat event. In the meantime, from how the settings storage is handled, it looks like we should be able to just remove the clock battery, or put the clock battery on a separate toggle switch. Also, we can of course bypass the hard reset screw approach Andrew Reid did, and just put a hard switch on the power leads to the main board. We can even control these switch with a microcontroller and force a hard reset through software if needed, say something like, after you hit record the camera cycles a hard shutdown after 15 minutes, or cycles an ordered shutdown paired with a clock reset as a coordinated event. We also want to check how the camera behaves if there is no clock power even when the camera is on. I suspect a hard error, but who knows! BUT WE NEED AN R5 to start. Please, internet. If you have one you can loan or sell us, we’ll share what we find publicly and give you first access to our Frankenstein bypassed ultimate R5 mod.
Also, one important comment. While it seems definitive that Canon is using a timer circuit to shut down the R5 in overheating, we can only speculate as to why for now. It is possible that it is just to cripple the camera, but it’s still very possible that there is still some overheating concerns for this weather sealed body, and they are shutting down based on a timer schedule for now for longevity. I would approach any of these bypass strategies with extreme caution, as they will probably not only void your warranty, but potentially fry your camera from extended shooting. We still plan to open up the R5 and add a heatsink that’s thermally fused to the overheating chips and card slots, and attach this heatsink to an aluminum cage for dissipation, as well an active fan. In this cooled context, we expect to keep the R5 very cool for extended shooting, but it would require the timer shutdown to be bypassed.
So let us know what you think and if you have any chip insight! What would you like us to try next?
