dataflash-re

Reverse-engineering the original Lightwave Research / High End Systems "Dataflash" xenon-strobe control link — the proprietary "LWR" protocol, not the later DMX-native AF1000 — and building an ESP32 + RS-485 bridge so the fixtures can be driven from modern controllers (DMX / Art-Net / sACN / TouchOSC).

Status: protocol decoded and wire-confirmed against the original controller — after a hard-won lesson: every early OEM capture was polarity-inverted, and for a week the project confidently documented a broadcast protocol that doesn't exist. The corrected decode (2026-07-03) is framing-perfect and matches the firmware and patent exactly. See Status and captures/POLARITY-ADJUDICATION.md.

Why this project

Lightwave Research & High End Systems

In 1985, a few people in Austin, Texas — Richard Belliveau, Lowell Fowler, David Blair, and Bob Schacherl — started building lighting that would reshape what a club, a stage, and a festival could look like. Lightwave Research was Belliveau's engineering-and-manufacturing arm; High End Systems was the name on the front of the box. Together they did things first:

• They built the entertainment industry's first optical thin-film coating lab to make their own dichroic glass — color that punched hard and didn't fade.
• The Color Pro (1987) was their first fixture. The Intellabeam (1989) moving-mirror scanner put automated lighting on club ceilings, and by 1991 it was on Dire Straits' world tour — the business was never the same.
• A relentless run followed — Cyberlight, Studio Color, Trackspot, Technobeam, Showgun — and in 2000 the Catalyst media server helped invent the entire digital-lighting / media-server category.
• They merged with Flying Pig Systems (the Wholehog console) in 1999, were acquired by Barco in 2008, and finally by ETC in 2017, where the legacy lives on.

Richard Belliveau's list of inventions reads like a history of modern entertainment lighting. The Dataflash is on it.

The Dataflash

The Dataflash is a xenon strobe — a real flashtube, not an LED panel imitating one. It throws a hard, brilliant, instantaneous burst that an LED simply cannot reproduce: the crack of white that cuts through fog and pins a whole dancefloor for a single frame. Daisy-chain up to 256 of them, give each a 4-bit intensity and a DIP address, and you can run waves of light across a room over the proprietary "LWR" control link this project decodes. Onboard thermal/cooldown protection keeps the tubes alive — these were built to be driven hard, and they've survived decades of exactly that.

Keeping them running

That survival is the whole point. These fixtures are beautiful, overbuilt, and increasingly orphaned — the original controllers are scarce and the proprietary link locks them out of modern rigs. The objective here is simple: keep Dataflashes firing, on modern control. Decode the protocol, build a bridge (DMX / Art-Net / sACN / TouchOSC → the original 9-bit/375k link), and put these strobes back in a contemporary show.

That's the spirit of Radiant Atmospheres, the anarchist lighting collective this work belongs to — a hodgepodge of lighting nerds from around the California Bay Area (and well beyond), brought together to share the beauty of the lights at underground parties and festivals. We keep legacy lighting alive not behind museum glass but out in the world: still blowing minds, still making the kind of moments only real, physical, gorgeously-engineered light can make. Old lights, new tricks, same magic.

How the protocol was reconstructed

Triangulated from three independent, agreeing sources. Every claim in protocol/dataflash-protocol-spec.md is tagged [C] firmware-confirmed · [P] patent · [S] schematic · [?] needs live capture.

1. US Patent 5,078,039 (Tulk & Belliveau, Lightwave Research, 1992) — protocol semantics. Public domain (expired).
2. Fixture firmware Rev 2.82 — 8051 disassembly of the strobe-head EPROM confirms the bit-level mechanism (firmware-analysis/).
3. Original schematics — CPU, baud, transceiver, and connector pinout (firmware-analysis/03-schematic-findings.md).

Protocol at a glance

• Physical: RS-422/485 differential (DS8921), 3-pin — Pin 1 = GND, Pin 2 = Data−, Pin 3 = Data+ (DMX convention — but ohmmeter-verify: the OEM controller's XLR is nonstandard, and a silent A/B swap cost this project a week). Each fixture is an active repeater with a power-off relay bypass.
• Serial: 375000 baud nominal (375,427 measured), 9 data bits (8051 UART Mode 2, SMOD=1, 12 MHz). No DMX break.
• 9th bit = control/data flag (1 = control, 0 = data). Markers — all confirmed on the wire: 0x55=ARM, 0x7F=START, 0x00=HEARTBEAT (one per frame ≈ 120 Hz), 0xF7=STOP/FIRE (one flash per 0xF7). Firmware-only (never yet observed live): 0xFF=CLEAR, 0x12+key = authenticated remote reset.
• Frame (120 Hz, AC-line locked, 8.334 ms): ARM → START → 128 data bytes (~51 µs pacing) → STOP/FIRE → heartbeat → idle. Each data byte carries two fixtures × 4-bit intensity (byte = addr ÷ 2; even addr = low nibble). Even the 8-head controller sends the full 128-byte packet — unused addresses ride as 0x00.
• Dead end, documented: for a week this repo described a "55 40 + 8-byte broadcast with a heartbeat-only control plane." That entire model was an artifact of polarity-inverted captures (the defining bytes were 100% framing errors). The full adjudication and post-mortem live in captures/POLARITY-ADJUDICATION.md and firmware-analysis/04-control-timing.md — kept as a case study in how confident wrong protocols get built.

Full detail and the bridge implementation note (9-bit TX is done with the ESP32 RMT peripheral, since classic UART can't hold a constant 9th bit) are in the spec and bridge/README.md.

Repository layout

dataflash-re/
├── protocol/            dataflash-protocol-spec.md   ← the reconstructed spec (source of truth)
├── firmware-analysis/   8051 disassembly notes + dis51.py (the OEM image itself is not included)
├── bridge/              ESP32 firmware: RMT 9-bit/375k TX, Art-Net/sACN/OSC in, WiFi STA+AP, web UI
│   ├── src/             inputs/osc/patterns/dataflash_tx/net/webui
│   ├── platformio.ini   envs: esp32-poe-iso · esp32-s3-eth · esp32-c3
│   ├── PATTERNS.md  CONTROL-TOUCHOSC.md  BENCH-VALIDATION.md
├── tools/               dataflash_frame.py (golden framing); sniff_sampler.py + pattern_catalog.py (program-library capture, auto-naming, web preview)
├── captures/            logic-analyzer / serial captures + capture guide (raw dumps gitignored)
└── assets/              MANIFEST.md (provenance). OEM firmware/manuals/schematics NOT included — see below.

The bridge (ESP32 firmware)

An Art-Net / sACN target and a TouchOSC-driven controller that re-emits a DMX universe (or an on-device strobe pattern) as the Dataflash 9-bit/375k RS-485 link.

cd bridge
pio run -e esp32-s3-eth -t upload        # or -e esp32-poe-iso (production) / -e esp32-c3
pio device monitor -e esp32-s3-eth

First boot with no saved Wi-Fi raises a config AP (dataflash-bridge / dataflash, http://192.168.4.1); set your network from the Wi-Fi card and it joins as a station thereafter. Output test modes (All-on / Chase / Single) validate the wire without a controller. Pin map and board notes are in bridge/README.md; hardware bring-up steps in bridge/BENCH-VALIDATION.md.

Tools

tools/dataflash_frame.py — host-side, no hardware needed to self-test:

python3 tools/dataflash_frame.py                       # print golden vectors + run framing self-test
python3 tools/dataflash_frame.py --capture <port>      # decode a live USB-RS485 capture (8-data+parity)

It mirrors the bridge's sendRefresh() exactly, round-trip self-tests, and decodes a capture against the golden vectors. The capture path uses the 8-data + parity trick to read this 9-bit protocol on an ordinary USB-serial adapter (the 9th bit lands in the parity slot, keeping the frame aligned). See captures/README.md.

Program-library tools (used with the esp32-s3-sniff 9-bit sniffer):

python3 tools/sniff_sampler.py                         # hit a program on the controller, Enter to record each
python3 tools/pattern_catalog.py                       # auto-name every program + build captures/sniff/preview.html

sniff_sampler.py records the controller's output per program over the sniffer's USB-CDC; pattern_catalog.py extracts each program's distinct strobe states, auto-classifies the motion (chase / bounce / ramp / sparkle / wash / …), and emits a self-contained web visualizer (preview.html) with a legend, per-fixture readout, and rename/export. (Captures are local/gitignored.)

⚠ The existing sniff-era program library is polarity-inverted (see the adjudication) — the visualized states are misdecodes and the library needs a re-capture with a corrected hookup before its content can be trusted (ISC-59).

Status

• Assets identified; EPROM extracted & disassembled (8051, Rev 2.82)
• Prior art found (US Patent 5,078,039); schematic read (CPU, 12 MHz, DS8921, pinout)
• Protocol spec drafted from firmware + patent + schematic (protocol/)
• Bridge firmware (5 build targets); RMT 9-bit/375k TX, Art-Net/sACN/OSC, WiFi STA+AP, web UI
• TX chain wire-verified in loopback on ESP32-S3-ETH via MAX485 → USB-RS485 (frames decoded byte-exact — proves the bridge emits what it intends; loopback can't catch a shared wiring error, as the next chapter proved)
• Real OEM controller captured — FTDI, 9-bit bit-bang sniffer (esp32-s3-sniff), and Saleae Logic 8; baud 375000 confirmed; all 99 programs + 3 function previews recorded
• The broadcast-model era (2026-06-25→27) — a documented dead end. Those captures decoded as a "55 40 + 8-byte broadcast, heartbeat-only control plane, 8-bit per fixture, frame-relative addressing," and the repo confidently documented all of it. Every one of those conclusions was a capture artifact: the hookup had Data+/Data− swapped.
• Polarity adjudicated (2026-07-03) — Saleae re-decode with inversion corrected: 0 framing errors in 17,160 words (vs 780 before, including 100% of the "broadcast" marker bytes), 130/130 frames = ARM 0x55 → START 0x7F → 128 data bytes → 0xF7 FIRE → 0x00 heartbeat at 120 Hz AC-locked. Wire, firmware, and patent finally agree. Full write-up: captures/POLARITY-ADJUDICATION.md; post-mortem in firmware-analysis/04-control-timing.md.
• Spec promoted to draft v1.0 — marker packet as the operating protocol, measured timing table, per-0xF7 firing model, corrected nibble map (even addr → low nibble), TMR/EMI-hardening section, 0x12 = authenticated remote reset
• Polarity ground truth (ISC-58, 2026-07-03) — pin identity verified by the idle-level procedure (A/Data+ = the leg that idles HIGH); direct-tap OEM captures re-confirm the marker packet with 0 framing errors in every capture. Procedure documented in the spec's "Polarity — read this first".
• Bridge TX restored to the marker packet + 🎆 FIRST LIGHT (ISC-60, 2026-07-03) — the bridge fires a real fixture (captures/saleae-bridge-fixture-firing.sal); marker packet @120 Hz with one heartbeat per frame confirmed sufficient
• Direct-tap session findings folded into the spec — heartbeat = constant 120 Hz clock, refreshes state-change-driven (17.1/40/120 Hz measured); Fire button = all-0xFF refresh; master intensity = linear 4-bit clamp; prog 7 proves even→LOW nibble on the wire; thermal lockout hardware-confirmed (the strobe idiom is a hardware requirement)
• Re-capture the program library with corrected polarity; re-derive per-program content under the 2×4-bit mapping (ISC-59 — the sniff-era decodes are lossy and can't be inverted offline)
• Duty/thermal envelope characterization (ISC-39 burst tool — see bridge/PATTERNS.md → Thermal envelope)
• Full fixture validation matrix (addressing walk across DIP addresses, multi-fixture chain; deliberate 0xFF/0x12 tests)

Assets & provenance

The original firmware image, user/AF1000 manuals, and schematics are copyrighted by Lightwave Research / High End Systems / ETC and are not included in this repository (they are git-ignored). assets/MANIFEST.md documents each file and its original source (ETC's legacy High End Systems download archive) so anyone with a legitimate copy can drop them into assets/ and reproduce the analysis. US Patent 5,078,039 is public domain.

This is interoperability reverse-engineering of independently-owned hardware, kept documented and reproducible.

Safety (you read this far, so)

If you've gone deep enough into a repo about reverse-engineering a strobe to reach the bottom of the README, you probably already know this — but for the record: xenon strobes are blindingly bright and flash hard, so anyone photosensitive or prone to seizures should give them room (or sit a session out). And these are high-voltage devices — that's how you fire a flashtube — so don't go poking around inside one unless you know exactly what you're doing. Be careful, have fun, don't cook yourself or your friends.

Acknowledgments

• ETC (Electronic Theatre Controls) for keeping the legacy High End Systems downloads alive — the manuals, schematics, and firmware that made this reconstruction possible are still out there because they've kept the archive up.
• Richard Belliveau, Steve Tulk, and the Lightwave Research / High End Systems crew, for building lights worth keeping running.

Built by Alex Moening for Radiant Atmospheres.

License

MIT — covers the reconstructed spec, bridge firmware, tools, and analysis here. Third-party OEM materials are not covered and not redistributed.