Canon EOS R5 / R6 overheating timers, workarounds, and Magic Lantern

[Andrew Reid]

EOSHD articles

Canon must come clean, new firmware update findings and PR spin by DPReview / Jordan Drake / CameraLabs
https://www.eoshd.com/news/canon-firmware-update-fails-to-meaningfully-change-eos-r5-timer-for-honour-canon-must-come-clean/

Recording 8K video for 50 minutes until battery dies
https://www.eoshd.com/news/this-is-my-canon-eos-r5-recording-8k-video-50-minutes-straight-until-empty-battery-video-evidence/

Horshack battery pull / Magic screw workaround to reset timer
https://www.eoshd.com/news/canon-eos-r5-so-called-overheat-timer-defeated-by-a-single-screw-in-battery-door/

Internal battery pull resets timer (Baidu user)
https://www.eoshd.com/8k/removing-internal-battery-resets-eos-r5-overheat-timer-are-canons-pants-now-completely-down/

Overheating in my fridge after just 60 photos
https://www.eoshd.com/news/canon-eos-r5-overheated-in-my-fridge-after-just-60-jpegs-4-c-ambient/

EOSHD testing finds fake artificial timers to lock out video mode, CDA-TEK API / Wifi Android app findings
https://www.eoshd.com/news/eoshd-testing-finds-canon-eos-r5-overheating-to-be-fake-with-artificial-timers-deployed-to-lock-out-video-mode/

Teardown on Baidu, Chinese user modifies EOS R5 with thermal paste, infrared thermometer measurements, still bumps up against firmware timer
https://www.eoshd.com/news/chinese-user-modifies-canon-eos-r5-to-improve-heat-management-but-finds-artificial-firmware-time-limit/

EOSHD testing finds EOS R5 overheats sitting idle in menus
https://www.eoshd.com/news/i-bought-a-canon-eos-r5-and-it-overheated-in-the-wifi-menu-also-a-look-at-potential-solutions/

DPReview dubious overheating test - Real world limit is 2 minutes of 4K HQ on EOS R5
https://www.eoshd.com/news/the-real-world-4k-hq-overheating-limit-is-2-minutes-on-the-canon-eos-r5-say-dpreview/

Opinion on DPReview test results
https://www.eoshd.com/news/opinion-on-dpreviews-canon-eos-r5-overheating-test-in-4k/

An early round-up of EOS R5 overheating field-tests (with benefit of what we know now, take with pinch of salt)
https://www.eoshd.com/news/a-round-up-of-all-canon-eos-r5-r6-overheating-timings-and-field-tests/

Gerald Undone review and finding that it overheats after just 1 hour of photo shooting
https://www.eoshd.com/news/canon-eos-r5-overheating-warning-occurs-after-0-minutes-following-1-hour-photo-shoot-of-30-photos-says-gerald-undone/

Canon promise firmware update for C-LOG 3 and C-RAW Lite
https://www.eoshd.com/news/canon-eos-r5-to-get-firmware-update-for-canon-log-3-and-lower-bitrates-in-8k-raw/

Original stories / official Canon overheating times (firmware 1.0)

https://www.eoshd.com/news/canon-eos-r5-has-serious-overheating-issues-in-both-4k-and-8k/

https://www.eoshd.com/news/the-canon-eos-r5-overheating-impact-on-different-types-of-filmmaking/

Industry talk

Recall rumours
https://www.eoshd.com/news/silence-of-the-recall-is-canon-turning-around-shipments-of-eos-r5/

Canon marketing EOS R5 as comfortable on pro video shoot with C300 Mark III
https://www.eoshd.com/news/canon-said-eos-r5-shoots-comfortably-on-high-end-production-sets-ideal-partner-to-c300-mark-iii-why-overheating-is-not-on-purpose/

Will Canon recall the EOS R5?
https://www.eoshd.com/news/will-canon-recall-the-eos-r5-i-asked-retailers-today-and-the-picture-is-grim/

Dire Canon financial results
https://www.eoshd.com/opinion/severe-canon-financials-profits-drop-94-and-recalling-eos-r5-would-be-the-ethical-thing-to-do/

All previous forum topic threads

 

 

 

 

 

[EduPortas]

After all the drama about the R5 I've surmised some things:

• The "R" line is more of a toy for video than anything else. Time and time again we've seen the company push users to dedicated (and expensive) video solutions.
• Beggining with Canon's 5DM2 we lived through different models with some kind of video crippling: lower resolution, noisy mic inputs, and a hard recording limit. Despite all this, people bought a Canon DSLR for reliabilty and lens selection.
• Lens selection was adressed quickly for RF users with good and expensive glass. However, they are losing their "trustworthyness". The R5 wil NEVER replace the tank-like 5D. Never, not 5 or 10 years from now. The damage is done.
• Was it Canon's true intention to replace the 5D with the R5 by way of an "umbrella effect"? I'm having doubts. No manager worth his salt would have released this fiasco product. Especially not a Japanese one working at Canon. Not one that damn well knows the brand represents (boring) reliabilty.
• Maybe the "R" line is more of a "moonshot product". Aim high. Fail fast. Ride the mirroless wave, but always differenciate between the photo and cinema lines.

[EduPortas]

As someone said in another thread, as of this moment the 1DXM3 is the company's flaghship photo camera for video, not some MILC feature-happy product. That's logical: 1DXM3 is worth $6,500!

[Andrew Reid]

It's just that Canon knew they couldn't get away with overheating bullshit on the 1D X M3 which is sold on the premise of cast iron reliability to news organisations, sports photographers, agencies and journalists.

[horshack]

I've just published a utility that allows for the automation of camera functions on newer Canon cameras like the R5/R6. It can be used to automate the thermal tests. Here's my thread on Dpreview with all the details:

https://www.dpreview.com/forums/post/64307212

[mechanicalEYE]

After testing v1.0 along with the new firmware, still says what we all know... Timer limited.

[Hanriverprod]

Dan Watson "If you didn't think this was controlled by a timer, this is definitely controlled by a timer."

I guess now that a big youtuber has said it outloud it's finally become real.

[Coffe]

Suggestion to Canon: try a business model such as Tesla runs it: Sell product at a base price. If the buyer wants higher reach, he has to unlock it by paying for it.

So for another 500 squid you get 10 minutes more recording time.

Or 10 USD /Euro /Pounds for instant recovery.

 

[Avenger 2.0]

22 hours ago, Andrew Reid said:

It's just that Canon knew they couldn't get away with overheating bullshit on the 1D X M3 which is sold on the premise of cast iron reliability to news organisations, sports photographers, agencies and journalists.

But why do this to the 5DIV successor? I know some wedding photographers that will not buy the R5 just because they heart it is unreliable and overheating. Since there is no upcoming 5DV, they will lose those customers to Sony or Nikon. 

[horshack]

13 hours ago, Hanriverprod said:

Dan Watson "If you didn't think this was controlled by a timer, this is definitely controlled by a timer."

I guess now that a big youtuber has said it outloud it's finally become real.

Canon admitted to Gordon Laing the camera uses a timer in coordination with its temperature sensors https://www.youtube.com/watch?v=3bOeoYI6EYs#t=51s

[Tim Sewell]

Pretty honest take:

 

[blackmagic]

My respect for Andrew just went up a notch.

Thanks for the work you are doing on the R5 issues.

[danieleciraolo]

Today I shot all morning in a wine cellar .. with temperatures around 12 degrees ... surely they changed something since I always shot at 100 frame takes of 2/3 minutes and when I stopped it always gave me the maximum time (7 min  and 30 sec).  No time offer available.  So I implemented the temperature control on the new firmware ... I modified mine that I withdrew yesterday from the cps in addition to replacing the circuit that controls the power supply that was gone

[Marcio Kabke Pinheiro]

Dunno if PetaPixel is banner here also, but they have an article for a infrared conversion company in New Jersey that tore down a R6 and found a real time chip controller that is attached to the internal battery (they credited EOSHD there). Not much new info, but an interesting investigation path.

https://petapixel

[Andrew Reid]

2 hours ago, Márcio Kabke Pinheiro said:

Dunno if PetaPixel is banner here also, but they have an article for a infrared conversion company in New Jersey that tore down a R6 and found a real time chip controller that is attached to the internal battery (they credited EOSHD there). Not much new info, but an interesting investigation path.

Petapixel did not do the teardown.

So please link to the source! It ain't hard!! One click more!

https://kolarivision.com/eos-r5-and-r6-overheating-timer-chip/

It is very interesting.

Magic Lantern want to probe the chip on a scope too.

[Avenger 2.0]

The RX8130 chip is a more advanced RTC clock and has timer function and user ram, so maybe canon uses this in some way for the overheating control.

[visionrouge]

I found crazy that the RTC is a dedicated chip place in the middle of nothing and so easy to access.
I have a simple question.
The RTC holds the time and day and can be access by the I2C bus. Either to program the time and the alarm and countdown.
But when a alarm is set up, Pin 6 is the IRQ line. Usually, the IRQ ask the processor to check what is happening by reading the I2C but and read the value in this chip.
Either to go from nothing to waring (and reprogram a new 5mn timer) or cut off the recording if they were already at this stage.

Is simply cutting the pin 6 signal enough for not triggering the IRQ signal and shoot forever? (and keep time of the day and date active?)

This is the easy and simple way of programming a chip. They could also have periodic check and do not use /IRQ pin. But according to the bad design previous saw here, I'm strongly suggesting this is a last minute design and so IRQ is used for overheat timer.
You need to have this pin a High level with a pull up resistor linked to pin 8 if it's not already the case (low level is IRQ Active)



 

[mechanicalEYE]

 

R6 Timer Chip... SMH

 

[horshack]

17 hours ago, Avenger 2.0 said:

The RX8130 chip is a more advanced RTC clock and has timer function and user ram, so maybe canon uses this in some way for the overheating control.

I doubt Canon's thermal management logic relies on the interval timer/interrupt functionality of the RTC. Nearly all SoCs like DIGIC have extensive internal timer functionality, including programmable interval timers and interrupts. Every embedded design I've worked on only uses the RTC to keep time in between power-on sessions; at start-of-day firmware reads the RTC to establish real time and then uses the SoC's timers to maintain time for the duration of the power-on session. The RTC's programmable interval timers are mostly used to trigger wakeup logic on devices that need to periodically power-up to do useful work.

[visionrouge]

11 hours ago, horshack said:

I doubt Canon's thermal management logic relies on the interval timer/interrupt functionality of the RTC

Ye, I also think so.
There are other parameters that are rested when removing the Battery cell, there is another chip righ aside this one and I will guess it's a tiny eeprom as usual.

If you put some fact together:
-Removing the battery cell reset the fake overheat timer, reset the time and date and few shooting parameters, but keep others as custom functions. So a memory is also powered with this battery. This is very common and few RTC chip also have internal memory to do 2 functions in one (RTC+limited amount of parameters)
This RX8130 do not have a memory register. So it have to be another chip somewhere to do so.

-The amount of chip powered by the 3.3V cell have to be as limited as possible and more likely close to the cell area. This is to keep backup, the power usage should be as tiny as possible. It uses 300 Nano Ampere in sleep mode as reference.

-If it was only a countdown with an IRQ, removing the battery during during the recording and putting back should not affect the countdown. The counter should keep running as soon as the "power good" is restored. So again, it points out to another memory that hold the counter flag.

I still believe a solution as magic lantern is the best way to go.
Either the counter inside the RTC is used for the fake overheat warning, Either it's just a RTC for the time and date.
A chip with a memory along the power line coming from the cell battery is more likely to have a register that can be access and changed by a side software. This software is extremely simple and write time to time a 0 flag in the fake overheat register.

The fake overheat timer starts during the full power state and write a flag when a normal internal timer is reached. This is more likely than using a specific chip for that. Only because the flag is written at the end of the count that removing the battery during shooting allows to restart. So finding this flag and overwriting it will solve this.
I don't see a use of this RTC for overheating purpose as it have very limited alarm feature. (The overheating have 2 steps for example)
I really see a register powered by the 3.3V, so a unique chip alone, not part of any large IC, that holds the key.
That should be also easier to access as it's a dedicated chip, ore likely from a generic brand more than from Canon, so the way to access it should be in a pdf somehow.