[Starhawk] is a man with a problem. More accurately, he’s a man whose mother has a problem, but ultimately that ends up being the same thing. Her wide-format Canon printer recently stopped working after better than a decade of reliable service, and he wants to know why. Rather than spend the money on buying a new printer, he’s determined to find out if she’s been the victim of planned obsolescence by reverse engineering the Canon i9900 to see what makes it tick (or stop ticking, as the case may be).
In the absence of any obvious hardware faults, [Starhawk] has suspicions that the machine’s QY6-0055 printhead has run over some internal “odometer” and simply turned itself off. We’ve all seen similar trickery at play when trying to use third party ink cartridges in our printers, so it’s certainly not outside the realm of possibility that the Canon i9900 is designed to reject heads once they’ve seen enough usage. Perhaps the biggest clue is that the QY6-0055 has a Seiko S93C56BR EEPROM on the board that’s keeping track of…something.
Right now, [Starhawk] is devoting his energies on trying to make sense of the data he pulled from the EEPROM using his TL866A programmer. But that’s no easy feat with a sample size of just one, which is why he’s looking for help. He’s hoping that other hackers with similar printers (and ideally ones that use the same QY6-0055 head) could submit their own EEPROM dumps and the community could get to work trying to decipher what’s stored on the chips. He’s really hoping that somebody at Canon might be willing to sneak him a couple tips on what he should be looking for, but at this point we think he’ll take whatever assistance he can get.
Now to be fair, there’s really no way to know definitively if there’s some flag stored on the EEPROM that’s keeping the printer from working. It could just be good old fashioned hardware failure, which would hardly be a surprise for a piece of consumer electronics from 2005. But even if the effort to understand the Canon’s EEPROM doesn’t get him any closer to a working printer, we still think it’s a fascinating example of real-world reverse engineering that’s worth it for the experience alone.
There’s a long history of hackers doing battle with their printers, from emulating an ink cartridge with a microcontroller to reinking the ribbon of a vintage 1980s behemoth. We’re interested in seeing where this project takes [Starhawk], but no matter what happens there are likely to be some interesting discoveries made along the way.
Well, if he suspects the head, the first step could be to replace the head. Then, if the printer started working again he would know a lot more than what he does now, and would have another source of eeprom reads to compare …
.. and if the print head is more expensive than replacing the printer he should just replace the printer… after all we wouldn’t want to steal the bread from the mouth of those poor starving sales executives at Canon.
Nope. This is Hackaday. Even if the replacement printhead was available for free, inquiring minds want to know if there is some skulduggery afoot, and we don’t want to find out, by relying on the manufacturer providing a replacement.
Maybe. But if he has a good head and the printer works with it, then he has a parameter to compare. With just one head, he doesn´t know if the problem is with the head or in other part.
And if the printer sits unused for a long time, as he said, it could be clogged /burnt jets , like in Epson printers.
Oh, and if the Resume buttons are wonky, as he said, replacing them could maybe even solve the issue. I have seen a good number of HP inkjet printers when we had to replace their “panel” ( actually, just to buttons, like this Canon ) because of problemas.
Our standard testing kit contained a couple panels from different models, just to rule out those kind of problems before starting with more complex procedures in the equipment.
Interesting point… if it’s also a pause button, like the ol’ online/offline buttons, pressing it may bounce an even number of times, putting it right back offline.
It costs $60-$80 on eBay or amazon to get a replacement QY6-0055 print head that will give a point of comparison to help solve the mystery and possibly repair the printer.
And if a HaD reader has a dead one and mails it to him (non-International) it will be what, maybe $3?
There is a quite comprehensive service manual for this model, which mentions how the EEPROM should be initialized.
It also possible that the EEPROM worn out, and it tries to write to it which fails. I have seen similar for LCD monitors where the power on hours is tracked. Replacing the EEPROM and writing the contents to the new one solved the problem.
The first Apple LaserWriter used an EEPROM as an odometer. It would simply keep writing the bits until the EEPROM location “wore outl and failed with a 1 in that location. However, it didn’t stop, it’s just that the print count would be maxed out.
Where can get one these information?
Which?
The service manual is easy to find: google -> canon I9900 service manual.
https://elektrotanya.com/canon_i9900_i9950_sm.pdf/download.html
The LCD monitor EEPROM wear out is from personal experience.
I second this approach. EEPROM death could be a likely cause. Only hope that the data isn’t corrupt too.
I’d run the EEPROM dump through something like Binwalk or one of the similar firmware analysis tools, just to see if it picks up anything…
This is a 256 byte EEPROM. For data, not firmware. I don’t think this is a candidate for binwalk.
See I would get Mom a new printer, put new electronics in the old printer and replace the print head with a frickin laser but thats just me
It’s too bad he didn’t get an earlier dump. He could likely just ‘roll back’ to a count that worked.
Ink jet printer? Most commonly, the reason those shut down “mysteriously” is due to the ink cleaning pads being “full”. There’s no sensor, so there’s a counter somewhere that guesses the amount of cleaning that’s been done, and kills the printer when it guesses the pads are full.
Sometimes there’s a way to reset the counter, and if that works, it’s time to clean those pads or get an external waste ink tank.
*update* I finally read the guy’s page, and he did try the waste ink reset to no avail. I’ve actually had an HP printer with a similar vague “problem with head” message when there was nothing wrong with the head. I’m interested to know if he can pin this down.
i honestly dont know how canon makes money on their printers. the inkjet model is supposed to make money on consumables while pretty much giving away the printer. mom had one ran it through 2 sets of cartridges before it died. got another and same problem. we have gotten into the habit of buying dirt cheap printers on clearance, use them till their cartridges die, and throw them out and get a new one as its cheaper than buying overpriced carts. but anyway i gutted those machines for parts and both had fully saturated ink pads. its like its intentionally dumping ink to make you buy more consumables, but the plan backfired due to lack of space for wasted ink.
All printers are literally designed to fail. cannon and HP do share many parts.
I would not doubt for even a second that it was designed to turn itself off.
best bet is to take pictures of the board and upload it then see if anyone can get a dump from the eeprom
Canon (with one n) and HP sharing parts? Care to elaborate on this? They shared parts in the 90s for laser printers, but their Inkjet printers are very different in construction and parts. I see absolutely nothing in common in them.
I’m very interested in the subject at hand. Replacing the head is the eaay way out… Hardware Hackers UNITE! Got to find out. It would be nice to have a working unit to compare to. I would research the head first and look for spec sheet, patents etc. Look for weakness. All in all compare good data against the nonworking unit data. Maybe get a tip from Joe Grand… Good luck. Publish results please.
The guy is “lucky” that it is stopped working completely, because it should make him less hesitant to “not tinker because it may stop working”.
A naive approach could be to dump the EEPROM contents so that they can later be restored, and then methodically changing each EEPROM value to 0x00 in turn to see if you’ve reset a counter.
Epson used to have a limit on prints you could do as it assumed the ink drip(?) tray/sponge was full, even if it wasn’t. This was ~10yrs ago when it happened to me so no idea if they do it now.
I’m amazed the hacker community hasn’t done an open-source 2D printer, or openWRT-style OS firmware for popular printers, or that no-one’s run a kickstarter for a basic non-evil 2D printer…
Seems like a glaring open goal to me.
+1 would buy one
I see a problem: The cartridges (the things where the ink is inside). You need to be able to buy them for a (really) long time, so your business needs to survive a really long time. Difficult with a Kickstarter. Or you use cartridges from some popular manufacturer, but how long will they be available? I suppose the big companies will change cartrigdes often to make people buy more / new cartridges for every new printer. And this is also a problem with hacking a printer: When you finished writing the firmware the device will be no longer supported by mfg -> no more cartridges.
I hope i am wrong… An FOSS printer (or printer firmware) sounds interesting. However beware of law, iirc there is some need to insert a unique signature inside each print, at least for color laser. The eletronic frontier foundation published some research on this.
Meanwhile, just buy a decent laser printer and it will be ok.
I wonder how the protocol (I2C i assume?) on these EEPROMs work. Do you read them entirely or can you read/write single bytes? In this case it could be really interesting to sniff the communication between the EEPROM and the printer to see which bytes are read and when and how often etc. Maybe you can figure out something.
For the hardware, if you don’t have a scope or a logic analyser just go to your favourite (chinese) seller and ask for 24MHz logic analyser. They are cheap (<10$) and work (most of the time) with FOSS Sigrok with is a really great project. It might even have a decoder for I2C-EEPROM-communication.
I used to work for a company that reverse engineered chips in ink and toner cartridges so we could sell replacements to cartridge reloaders. I never heard of an artificial limit in a print head, but if there is one, it’s probably implemented in a similar manner to the cartridges.
The cartridges varied from extremely simple with the EEPROM storing the printer model number plus page and pixel counts (often in triplicate) to heavily encrypted data. One interesting variation stored the data in an encrypted EEPROM device. We got the key out of that one by decapping the chip, repairing the lock fuse with an ion beam, and then reading the part!
I can say with certainty there is no printhead kill switch. Everyone reading HaD knows electronics burn out over time/use, paints (and inks) dry out, and when the ink cools the heater to prevent it from overheating, dried ink results in burned out nozzles.
starhawk herem, with a small PSA. Read the comments on the linked [dot]IO page. That directive applies to everyone who is discussing clogged jets or an otherwise misfiring printhead. The problem is a communications issue and is electronic in nature rather than mechanical, as you would know if you would read.
I have a Canon Maxify MB2320 with an QY6-0087 head. It was printing fine then started printing like it was running out of black ink. Changed Ink, print head. I just bought a new ribbon cable for the print head carriage. I have looked for a new motherboard to no avail. I am going to throw a scope on it to try and find the source of the problem. Anyone else seen this problem.
I have, what might be the strangest problem I’ve seen, in more than 75 years of working with electrons. I still have six Canon printers and I like the I9900 best of all. Mine was one of the first ones. It was printing just fine and suddenly it stopped with the message, ” Your printer needs operator intervention.” The error lamp was “ON.” I pushed the error lamp button and it went “OFF.” I pushed the power button. “NOTHING” happened. Of course, I started usual trouble-shooting. I checked throughout for fuses, etc. After a few days trying, I decided to buy a new I9900. None are available. MicroCenter has many empty printer shelves; but, are “OUT of Stock’ on all shelves. I bought a used on Ebay. I plugged it in and had it working in five minutes. I printed a few pages and then installed the cartridges from the other I9900. I had cleaned the print-head. I closed the cover, listened for the tray to go home, and turned away. In a moment or two, I heard the printer cycling through some motions. and the power lamp went “OFF”. Now this machine is in the same condition as the first one. Disconnecting it from the computer is no help. The machine seems dead., or is rendered INOP, maybe through a bug via USB.
Hello, How is your i9900? I have an i9900 that was purchased before 2010, not sure when exactly. It stopped working when a Canon tech directed me to do something that he shouldn’t have. Canon went out of their way to make the situation right. Those were the days. One of their backroom techs repaired it.
Today after not using it since last week, the yellow ink is not appearing. Everything else is working. I figure, given that you have six Canon printers, that you would know what to do. I only have three, the i9900, my favorite and the only one that I can print certain graphics on, and two Pro9000’s. I tried a newer Canon two years or so ago. The colors were not good for my work, so I returned it.
Do you have suggestions? Please help!
Thank you!