Nikon Flash Analysis
Nikon uses two proprietary communication protocols to operate flash units from their DSLRs. If the flash is mounted to the hot shoe, iTTL is used. If the flash is to be actuated remotely, CLS is used. I have a need to understand and decipher both of these communication methods. What I am sharing is may not be 100% correct. This is what I have figured out after data analysis. Over at DPTnT.com, picmax has been working on the same thing in a series about hacking Nikon flash.
iTTL is Nikon's hot shoe system. This is a bi-directional serial, logic level protocol. I removed the shoe from a Quantaray flash unit and soldered test leads on the shoe, then reassembled the unit. When mounted on one of my Nikon DSLRs, I was able to use an oscilloscope to capture the data transfers. With the signals captures I could decode iTTL data.
The flash trigger is that same as it has always been; the flash provides a positive voltage and the camera pulls the voltage to ground to trigger a flash. The important data is passed on the other three points. When the camera and flash begin
communication, the camera toggles the handshake low, and the flash responds by pulsing (low) 8 bits on the clock line; these are 32us each. The bytes are sent big-endian. The camera sets data high for 1's and low for 0. This is read on the rising edge of the clock. There is bidirectional talk including identifying camera and flash models and zoom information passed. But I concentrated on the ability to send flash commands to the flash unit.
The basic flash routine has two preflashes (first at lowest power, second at 30%) then the flash power command, finally the flash trigger to fire the flash.
The minimum power preflash is 0xD7, 30% preflash is 0xD8,0x18. Then the power command is 0xD3, 0x10, 0xPP, 0xD3. The PP is anything from 0x58 to ox7F, with 0x58 being minimum and 127 being full power. I do not know what the 0x10 is.
Here is the entire thing captured on the oscope. The yellow is the clock from the flash. Green is data from camera. The handshake is not shown. Handshake is high in normal state, then goes low when the camera is ready for the flash to clock a byte, the returns to high. The two extraneous lows shown on the clock line, are the preflashes. When the flash fires, clock goes low for an length of time directly correlated to the power of the flash.
This is a zoomed in capture of the 30% preflash. Remember the rising edge of the clock is the read time, so the data line being high at the beginning of both bytes, does not count.
If the flash does not receive a valid byte it will not send the clock for the next byte. If the flash power command sends a value lower than 88 or higher than 127, the flash will not fire. The exact timing requirements are a bit tricky. Through a bit of experimentation I was able to get an Atmel AVR to fire the flash at any power level.
CLS is Nikon's Creative Lighting System. A wireless (ir) method of firing three groups of flashes at precise power levels. The basic part of the communication is IR pulses sent from the camera and received by the flash. There are four channels to choose from, so multiple photographers could use their flash setups in the same room. Each channel has three groups of flashes, each operates independently of the others. I used a photo-transistor to capture and amplify the IR pulses with my oscope. Using the computer and a whiteboard I was able to decode Nikon CLS commands.
The channel identification will be the first three pulses of the packet. If you clock bits at 75us the channel ID is easily decoded. Assuming MSB is the first (little-endinan) you would decode Channel 1 as 0b10100100, Chan 2 is 0b10010100, Chan 3 is 0b10010010, and 4 is 0b10010001.
The first packet identifies which Group (A,B,C) is used and what function that group will complete (Aperture mode, TTL mode, or manual power). After the three pulses for the channel, follows two bytes with 150us bit timing. The first nibble identifies the packet as the mode command packet. The next nibble is the A group, followed by the B nibble and C nibble. Each group nibble will start with a 1 to mark that group the other three bits determine the mode for that group.
Above is the command for group A to use aperture, B is using TTL, and C is on manual. If A is the only group used the nibbles for B and C will be omitted. If A is not used but B is used, the marker bit for A will be a 1 and the remaining three bits will be zeros. After the mode command, the camera will send pre-flash commands for each
group used. There will be the three channel pulses (same as above) followed by the group identifier. The groups are identified using 150us spaced bits with group A being 0b1001, B= 0b1010 and C= 0b1011. Following the channel
and group identification will be the pre-flashes. These are commanded by two pulses 225us leading edge to leading edge. TTL mode will have two pre-flashes (minimum power and 30% power), Aperture will only have the 30%(?), and manual mode has no pre-flashes. If you are using more than one group, the next group ID will follow with the appropriate pre-flashes. Before the final optically trigger main flash will be a power level command. The command starts with
the channel ID like the others. The power command is made of 7 nibbles or three and one half bytes. The first nibble identifies the packet as the power level packet. (0b0010) The next two nibbles are group A. The first bit is a place marker similar to the mode packet earlier. The following 7 bits are the power level value is you are using aperture or TTL mode. For manual power mode, only the middle 5 bits are used. These values will step through the standard 23 manual power settings from 1/1 (Full power) to 1/128 (minimum) starting with 0b1000 0000 being 1/1 power and 0b1010 1010 being 1/128. The 1 in the MSB spot is the group marker. The underlined five bits are the bits used to set the power level. If you get into 'High Shutter Speeds' things get more complex. Now the first two nibbles (first byte) identify the mode as 0b11011011 and the next three bytes are the power levels for the flash. I have not researched this function any further.
I am working on an AVR project that will decode and encode all of this data and put it to good use. You can expect Part II soon.
**NOTE: CLS and iTTL are property of Nikon. The use of their protocols in a commercial product may require licenses. Please do not infringe on Nikon's intellectual property.
******Warning!! Flash units contain very high voltages! DO NOT open a flash unit unless you are trained to handle HV circuits. I am NOT responsible if you cook yourself or your flash/camera.
