My Saleae Logic 8 logic analyzer has tapped into the communication lines between main board and control panel of a Canon Pixma MX340 multi-function inkjet. The asynchronous serial data decoder is now configured to 250000 baud 8E1 to match. (Or if it's not 250000 baud, it's at least close enough.) It's time to get some data to analyze!

First I started with power cycle scenarios:

  1. Plug in the power cable, watching the power-up sequence transitioning to standby state. From earlier oscilloscope traces I know the NEC K13988 chip on the control panel is briefly enabled by the mainboard. This should be a relatively short sequence to analyze, and hopefully enough to understand the minimum required sequence to start the K13988. There is no visible activity on the LCD screen during this sequence so that's not expected to be part of this picture.

  2. Push the power button, watch transition from standby to on. This enables the K13988 and displays several different things on the LCD screen in rapid succession. I expect to see the K13988 initialization again, plus a lot more to initialize the rest of the control panel. There should be a LCD initialization sequence here, and several screen frame buffer updates. This is expected to be the longest and most complex sequence to analyze.

  3. Push the power button again, watch transition from on to standby. This should be a slightly shorter sequence. There's one LCD screen update to show "Ending..." as the printer goes to standby, then the screen and K13988 drops off to sleep.

Then I added the following scenarios:

  1. While in on state and at the home menu, I pushed four buttons in sequence: "OK", which gave me an error beep and no screen update. "Right", which did trigger a screen update, incrementing the number of copies. "Left", which was another update decrementing the number. Finally "Back", which is again an error beep and no screen update. This gives me activity for four different button presses, two of which triggered screen updates but two did not.

  2. While in on state and at the home menu, I left the machine alone until it put the LCD screen to sleep. Then I pushed a button to wake the screen back up. This capture should have the commands to deactivate the LCD while still keep K13988 active, followed by commands to wake up the LCD. I will be curious to see if a full LCD screen update frame buffer is sent as well.

  3. While in standby state, I lifted the scanner imaging head off of its track then pushed the power button. This will cause a failure of its homing sequence and trigger an error display screen, toggling LCD text between "Printer error has occurred" and "5011". Capturing this sequence will show LCD screen update without any noise from user input.

If anyone else is curious, these logic analyzer capture files are up on my GitHub. As a first pass, I don't expect the these captures to answer all the questions I have. Heck, I'm not even confident they'll make sense. But I can always come back to capture different activity. For now, they're good enough to serve as a starting point and establish a baseline.

This teardown ran far longer than I originally thought it would. Click here for the starting point.