I'm looking over data sent between control panel and main board of a Canon Pixma MX340 multi-function inkjet, and there were many mystery bytes sent during its power-up sequence. I hoped there wouldn't be as many new things in the process of going from "On" to "Standby".

Pressing the power button itself is absent from this logic analyzer capture file, because the power button is wired directly to the main board and not part of the button matrix reported every 9.2ms. But I could see activity in response. All transmission from the main board was acknowledged with 0x20 from the control panel, who also continued sending button matrix status every 9.2ms until the chip was put into standby.

  1. 0x0E 0xFD

  2. (4ms)

  3. LCD screen update to show the user "Ending..."

  4. (2136ms)

  5. 0x0E 0xFD

  6. (27ms)

  7. 0x04 0x75 and 0x04 0xB4.

  8. (59ms)

  9. 0x04 0x34

  10. (19ms)

  11. 0x04 0x14

  12. (19ms)

  13. 0x04 0x0E

  14. (109ms)

  15. 0x04 0xEE and 0x0E 0xDC

  16. Chip enable pin drops to ground, putting the control panel's NEC K13988 chip to sleep.

Comparing these bytes against what I've seen to date, I noticed 0x0E 0xFD shows up a lot. It was among the initialization sequence when the chip is powered up from standby, and sent again after the initial LCD screen update. Here it is sent both before and after the screen update. Other than that, the only repeat I noticed is 0x04 0x34. It was the final element in the power-up initialization burst of 13 two-byte sequences. However, none of its adjacent neighbors showed up again here.

I didn't expect to find much commonality between powering up and shutting down. If something does show up in both (0x0E 0xFD), I will tentatively infer its purpose as more general than these specific events. Other than that, I really couldn't draw much in the way of conclusions on what these bytes mean. I expected this kind of frustration when I started this project, but it still doesn't feel great. Fortunately, I have an easier one to help make me feel a little better: the LCD "screen saver" blank state.

This teardown ran far longer than I originally thought it would. Click here to rewind back to where this adventure started.