An I/O controller for virtual pinball machines: accelerometer nudge sensing, analog plunger input, button input encoding, LedWiz compatible output controls, and more.

Dependencies:   mbed FastIO FastPWM USBDevice

Fork of Pinscape_Controller by Mike R


This is Version 2 of the Pinscape Controller, an I/O controller for virtual pinball machines. (You can find the old version 1 software here.) Pinscape is software for the KL25Z that turns the board into a full-featured I/O controller for virtual pinball, with support for accelerometer-based nudging, a real plunger, button inputs, and feedback device control.

In case you haven't heard of the concept before, a "virtual pinball machine" is basically a video pinball simulator that's built into a real pinball machine body. A TV monitor goes in place of the pinball playfield, and a second TV goes in the backbox to serve as the "backglass" display. A third smaller monitor can serve as the "DMD" (the Dot Matrix Display used for scoring on newer machines), or you can even install a real pinball plasma DMD. A computer is hidden inside the cabinet, running pinball emulation software that displays a life-sized playfield on the main TV. The cabinet has all of the usual buttons, too, so it not only looks like the real thing, but plays like it too. That's a picture of my own machine to the right. On the outside, it's built exactly like a real arcade pinball machine, with the same overall dimensions and all of the standard pinball cabinet hardware.

A few small companies build and sell complete, finished virtual pinball machines, but I think it's more fun as a DIY project. If you have some basic wood-working skills and know your way around PCs, you can build one from scratch. The computer part is just an ordinary Windows PC, and all of the pinball emulation can be built out of free, open-source software. In that spirit, the Pinscape Controller is an open-source software/hardware project that offers a no-compromises, all-in-one control center for all of the unique input/output needs of a virtual pinball cabinet. If you've been thinking about building one of these, but you're not sure how to connect a plunger, flipper buttons, lights, nudge sensor, and whatever else you can think of, this project might be just what you're looking for.

You can find much more information about DIY Pin Cab building in general in the Virtual Cabinet Forum on Also visit my Pinscape Resources page for more about this project and other virtual pinball projects I'm working on.


  • Pinscape Release Builds: This page has download links for all of the Pinscape software. To get started, install and run the Pinscape Config Tool on your Windows computer. It will lead you through the steps for installing the Pinscape firmware on the KL25Z.
  • Config Tool Source Code. The complete C# source code for the config tool. You don't need this to run the tool, but it's available if you want to customize anything or see how it works inside.


The new Version 2 Build Guide is now complete! This new version aims to be a complete guide to building a virtual pinball machine, including not only the Pinscape elements but all of the basics, from sourcing parts to building all of the hardware.

You can also refer to the original Hardware Build Guide (PDF), but that's out of date now, since it refers to the old version 1 software, which was rather different (especially when it comes to configuration).

System Requirements

The new config tool requires a fairly up-to-date Microsoft .NET installation. If you use Windows Update to keep your system current, you should be fine. A modern version of Internet Explorer (IE) is required, even if you don't use it as your main browser, because the config tool uses some system components that Microsoft packages into the IE install set. I test with IE11, so that's known to work. IE8 doesn't work. IE9 and 10 are unknown at this point.

The Windows requirements are only for the config tool. The firmware doesn't care about anything on the Windows side, so if you can make do without the config tool, you can use almost any Windows setup.

Main Features

Plunger: The Pinscape Controller started out as a "mechanical plunger" controller: a device for attaching a real pinball plunger to the video game software so that you could launch the ball the natural way. This is still, of course, a central feature of the project. The software supports several types of sensors: a high-resolution optical sensor (which works by essentially taking pictures of the plunger as it moves); a slide potentionmeter (which determines the position via the changing electrical resistance in the pot); a quadrature sensor (which counts bars printed on a special guide rail that it moves along); and an IR distance sensor (which determines the position by sending pulses of light at the plunger and measuring the round-trip travel time). The Build Guide explains how to set up each type of sensor.

Nudging: The KL25Z (the little microcontroller that the software runs on) has a built-in accelerometer. The Pinscape software uses it to sense when you nudge the cabinet, and feeds the acceleration data to the pinball software on the PC. This turns physical nudges into virtual English on the ball. The accelerometer is quite sensitive and accurate, so we can measure the difference between little bumps and hard shoves, and everything in between. The result is natural and immersive.

Buttons: You can wire real pinball buttons to the KL25Z, and the software will translate the buttons into PC input. You have the option to map each button to a keyboard key or joystick button. You can wire up your flipper buttons, Magna Save buttons, Start button, coin slots, operator buttons, and whatever else you need.

Feedback devices: You can also attach "feedback devices" to the KL25Z. Feedback devices are things that create tactile, sound, and lighting effects in sync with the game action. The most popular PC pinball emulators know how to address a wide variety of these devices, and know how to match them to on-screen action in each virtual table. You just need an I/O controller that translates commands from the PC into electrical signals that turn the devices on and off. The Pinscape Controller can do that for you.

Expansion Boards

There are two main ways to run the Pinscape Controller: standalone, or using the "expansion boards".

In the basic standalone setup, you just need the KL25Z, plus whatever buttons, sensors, and feedback devices you want to attach to it. This mode lets you take advantage of everything the software can do, but for some features, you'll have to build some ad hoc external circuitry to interface external devices with the KL25Z. The Build Guide has detailed plans for exactly what you need to build.

The other option is the Pinscape Expansion Boards. The expansion boards are a companion project, which is also totally free and open-source, that provides Printed Circuit Board (PCB) layouts that are designed specifically to work with the Pinscape software. The PCB designs are in the widely used EAGLE format, which many PCB manufacturers can turn directly into physical boards for you. The expansion boards organize all of the external connections more neatly than on the standalone KL25Z, and they add all of the interface circuitry needed for all of the advanced software functions. The big thing they bring to the table is lots of high-power outputs. The boards provide a modular system that lets you add boards to add more outputs. If you opt for the basic core setup, you'll have enough outputs for all of the toys in a really well-equipped cabinet. If your ambitions go beyond merely well-equipped and run to the ridiculously extravagant, just add an extra board or two. The modular design also means that you can add to the system over time.

Expansion Board project page

Update notes

If you have a Pinscape V1 setup already installed, you should be able to switch to the new version pretty seamlessly. There are just a couple of things to be aware of.

First, the "configuration" procedure is completely different in the new version. Way better and way easier, but it's not what you're used to from V1. In V1, you had to edit the project source code and compile your own custom version of the program. No more! With V2, you simply install the standard, pre-compiled .bin file, and select options using the Pinscape Config Tool on Windows.

Second, if you're using the TSL1410R optical sensor for your plunger, there's a chance you'll need to boost your light source's brightness a little bit. The "shutter speed" is faster in this version, which means that it doesn't spend as much time collecting light per frame as before. The software actually does "auto exposure" adaptation on every frame, so the increased shutter speed really shouldn't bother it, but it does require a certain minimum level of contrast, which requires a certain minimal level of lighting. Check the plunger viewer in the setup tool if you have any problems; if the image looks totally dark, try increasing the light level to see if that helps.

New Features

V2 has numerous new features. Here are some of the highlights...

Dynamic configuration: as explained above, configuration is now handled through the Config Tool on Windows. It's no longer necessary to edit the source code or compile your own modified binary.

Improved plunger sensing: the software now reads the TSL1410R optical sensor about 15x faster than it did before. This allows reading the sensor at full resolution (400dpi), about 400 times per second. The faster frame rate makes a big difference in how accurately we can read the plunger position during the fast motion of a release, which allows for more precise position sensing and faster response. The differences aren't dramatic, since the sensing was already pretty good even with the slower V1 scan rate, but you might notice a little better precision in tricky skill shots.

Keyboard keys: button inputs can now be mapped to keyboard keys. The joystick button option is still available as well, of course. Keyboard keys have the advantage of being closer to universal for PC pinball software: some pinball software can be set up to take joystick input, but nearly all PC pinball emulators can take keyboard input, and nearly all of them use the same key mappings.

Local shift button: one physical button can be designed as the local shift button. This works like a Shift button on a keyboard, but with cabinet buttons. It allows each physical button on the cabinet to have two PC keys assigned, one normal and one shifted. Hold down the local shift button, then press another key, and the other key's shifted key mapping is sent to the PC. The shift button can have a regular key mapping of its own as well, so it can do double duty. The shift feature lets you access more functions without cluttering your cabinet with extra buttons. It's especially nice for less frequently used functions like adjusting the volume or activating night mode.

Night mode: the output controller has a new "night mode" option, which lets you turn off all of your noisy devices with a single button, switch, or PC command. You can designate individual ports as noisy or not. Night mode only disables the noisemakers, so you still get the benefit of your flashers, button lights, and other quiet devices. This lets you play late into the night without disturbing your housemates or neighbors.

Gamma correction: you can designate individual output ports for gamma correction. This adjusts the intensity level of an output to make it match the way the human eye perceives brightness, so that fades and color mixes look more natural in lighting devices. You can apply this to individual ports, so that it only affects ports that actually have lights of some kind attached.

IR Remote Control: the controller software can transmit and/or receive IR remote control commands if you attach appropriate parts (an IR LED to send, an IR sensor chip to receive). This can be used to turn on your TV(s) when the system powers on, if they don't turn on automatically, and for any other functions you can think of requiring IR send/receive capabilities. You can assign IR commands to cabinet buttons, so that pressing a button on your cabinet sends a remote control command from the attached IR LED, and you can have the controller generate virtual key presses on your PC in response to received IR commands. If you have the IR sensor attached, the system can use it to learn commands from your existing remotes.

Yet more USB fixes: I've been gradually finding and fixing USB bugs in the mbed library for months now. This version has all of the fixes of the last couple of releases, of course, plus some new ones. It also has a new "last resort" feature, since there always seems to be "just one more" USB bug. The last resort is that you can tell the device to automatically reboot itself if it loses the USB connection and can't restore it within a given time limit.

More Downloads

  • Custom VP builds: I created modified versions of Visual Pinball 9.9 and Physmod5 that you might want to use in combination with this controller. The modified versions have special handling for plunger calibration specific to the Pinscape Controller, as well as some enhancements to the nudge physics. If you're not using the plunger, you might still want it for the nudge improvements. The modified version also works with any other input controller, so you can get the enhanced nudging effects even if you're using a different plunger/nudge kit. The big change in the modified versions is a "filter" for accelerometer input that's designed to make the response to cabinet nudges more realistic. It also makes the response more subdued than in the standard VP, so it's not to everyone's taste. The downloads include both the updated executables and the source code changes, in case you want to merge the changes into your own custom version(s).

    Note! These features are now standard in the official VP releases, so you don't need my custom builds if you're using 9.9.1 or later and/or VP 10. I don't think there's any reason to use my versions instead of the latest official ones, and in fact I'd encourage you to use the official releases since they're more up to date, but I'm leaving my builds available just in case. In the official versions, look for the checkbox "Enable Nudge Filter" in the Keys preferences dialog. My custom versions don't include that checkbox; they just enable the filter unconditionally.
  • Output circuit shopping list: This is a saved shopping cart at with the parts needed to build one copy of the high-power output circuit for the LedWiz emulator feature, for use with the standalone KL25Z (that is, without the expansion boards). The quantities in the cart are for one output channel, so if you want N outputs, simply multiply the quantities by the N, with one exception: you only need one ULN2803 transistor array chip for each eight output circuits. If you're using the expansion boards, you won't need any of this, since the boards provide their own high-power outputs.
  • Cary Owens' optical sensor housing: A 3D-printable design for a housing/mounting bracket for the optical plunger sensor, designed by Cary Owens. This makes it easy to mount the sensor.
  • Lemming77's potentiometer mounting bracket and shooter rod connecter: Sketchup designs for 3D-printable parts for mounting a slide potentiometer as the plunger sensor. These were designed for a particular slide potentiometer that used to be available from an seller but is no longer listed. You can probably use this design as a starting point for other similar devices; just check the dimensions before committing the design to plastic.

Copyright and License

The Pinscape firmware is copyright 2014, 2021 by Michael J Roberts. It's released under an MIT open-source license. See License.

Warning to VirtuaPin Kit Owners

This software isn't designed as a replacement for the VirtuaPin plunger kit's firmware. If you bought the VirtuaPin kit, I recommend that you don't install this software. The VirtuaPin kit uses the same KL25Z microcontroller that Pinscape uses, but the rest of its hardware is different and incompatible. In particular, the Pinscape firmware doesn't include support for the IR proximity sensor used in the VirtuaPin plunger kit, so you won't be able to use your plunger device with the Pinscape firmware. In addition, the VirtuaPin setup uses a different set of GPIO pins for the button inputs from the Pinscape defaults, so if you do install the Pinscape firmware, you'll have to go into the Config Tool and reassign all of the buttons to match the VirtuaPin wiring.



File content as of revision 86:e30a1f60f783:

// USB Message Protocol
// This file is purely for documentation, to describe our USB protocol
// for incoming messages (host to device).  We use the standard HID setup 
// with one endpoint in each direction.  See USBJoystick.cpp and .h for
// the USB descriptors.
// Our incoming message protocol is an extended version of the protocol 
// used by the LedWiz.  Our protocol is designed to be 100% backwards
// compatible with clients using the original LedWiz wire protocol, as long 
// as they only send well-formed messages in the original protocol.  The
// "well-formed" part is an important condition, because our extensions to
// the original protocol all consist of messages that aren't defined in the
// original protocol and are meaningless to a real LedWiz.
// The protocol compatibility ensures that all original LedWiz clients can
// also transparently access a Pinscape unit.  Clients will simply think the
// Pinscape unit is an LedWiz, thus they'll be able to operate 32 of our
// ports.  We designate the first 32 ports (ports 1-32) as the ones accessible
// through the LedWiz protocol.
// In addition the wire-level protocol compatibility, we can provide legacy
// LedWiz clients with access to more than 32 ports by emulating multiple
// virtual LedWiz units.  We can't do this across the wire protocol, since
// the KL25Z USB interface constrains us to a single VID/PID (which is how
// LedWiz clients distinguish units).  However, virtuall all legacy LedWiz
// clients access the device through a shared library, LEDWIZ.DLL, rather
// than directly through USB.  LEDWIZ.DLL is distributed by the LedWiz's
// manufacturer and has a published client interface.  We can thus provide
// a replacement DLL that contains the logic needed to recognize a Pinscape
// unit and represent it to clients as multiple LedWiz devices.  This allows
// old clients to access our full complement of ports without any changes
// to the clients.  We define some extended message types (SBX and PBX)
// specifically to support this DLL feature.

// General note: 16-bit and 32-bit fields in our reports are little-endian
// unless otherwise specified.
// 1. Joystick reports
// In most cases, our outgoing messages are HID joystick reports, using the
// format defined in USBJoystick.cpp.  This allows us to be installed on
// Windows as a standard USB joystick, which all versions of Windows support
// using in-the-box drivers.  This allows a completely transparent, driverless,
// plug-and-play installation experience on Windows.  Our joystick report
// looks like this (see USBJoystick.cpp for the formal HID report descriptor):
//    ss     status bits:  
//              0x01 -> plunger enabled
//              0x02 -> night mode engaged
//              0x04,0x08,0x10 -> power sense status: meaningful only when
//                      the TV-on timer is used.  Figure (ss>>2) & 0x07 to
//                      isolate the status bits.  The resulting value is:
//                         1 -> latch was on at last check
//                         2 -> latch was off at last check, SET pin high
//                         3 -> latch off, SET pin low, ready to check status
//                         4 -> TV timer countdown in progress
//                         5 -> TV relay is on
//                         6 -> sending IR signals designated as TV ON signals
//              0x20 -> IR learning mode in progress
//              0x40 -> configuration saved successfully (see below)
//    00     2nd byte of status (reserved)
//    00     3rd byte of status (reserved)
//    00     always zero for joystick reports
//    bb     joystick buttons, low byte (buttons 1-8, 1 bit per button)
//    bb     joystick buttons, 2nd byte (buttons 9-16)
//    bb     joystick buttons, 3rd byte (buttons 17-24)
//    bb     joystick buttons, high byte (buttons 25-32)
//    xx     low byte of X position = nudge/accelerometer X axis
//    xx     high byte of X position
//    yy     low byte of Y position = nudge/accelerometer Y axis
//    yy     high byte of Y position
//    zz     low byte of Z position = plunger position
//    zz     high byte of Z position
// The X, Y, and Z values are 16-bit signed integers.  The accelerometer
// values are on an abstract scale, where 0 represents no acceleration,
// negative maximum represents -1g on that axis, and positive maximum
// represents +1g on that axis.  For the plunger position, 0 is the park
// position (the rest position of the plunger) and positive values represent
// retracted (pulled back) positions.  A negative value means that the plunger
// is pushed forward of the park position.
// Status bit 0x40 is set after a successful configuration update via special
// command 65 6 (save config to flash).  The device always reboots after this
// command, so if the host wants to receive a status update verifying the 
// save, it has to request a non-zero reboot delay in the message to allow
// us time to send at least one of these status reports after the save.
// This bit is only sent after a successful save, which means that the flash
// write succeeded and the written sectors verified as correct.
// NOTE: older firmware versions didn't support this status bit, so clients
// can't interpret the lack of a response as a failure for older versions.
// To determine if the flag is supported, check the config report feature
// flags.
// 2. Special reports
// We subvert the joystick report format in certain cases to report other 
// types of information, when specifically requested by the host.  This allows
// our custom configuration UI on the Windows side to query additional 
// information that we don't normally send via the joystick reports.  We
// define a custom vendor-specific "status" field in the reports that we
// use to identify these special reports, as described below.
// Normal joystick reports always have 0 in the high bit of the 2nd byte
// of the report.  Special non-joystick reports always have 1 in the high bit 
// of the first byte.  (This byte is defined in the HID Report Descriptor
// as an opaque vendor-defined value, so the joystick interface on the
// Windows side simply ignores it.)
// 2A. Plunger sensor status report
// Software on the PC can request a detailed status report from the plunger
// sensor.  The status information is meant as an aid to installing and
// adjusting the sensor device for proper performance.  For imaging sensor
// types, the status report includes a complete current image snapshot
// (an array of all of the pixels the sensor is currently imaging).  For
// all sensor types, it includes the current plunger position registered
// on the sensor, and some timing information.
// To request the sensor status, the host sends custom protocol message 65 3
// (see below).  The device replies with a message in this format:
//    bytes 0:1 = 0x87FF
//    byte  2   = 0 -> first status report packet
//    bytes 3:4 = number of pixels to be sent in following messages, as
//                an unsigned 16-bit little-endian integer.  This is 0 if 
//                the sensor isn't an imaging type.
//    bytes 5:6 = current plunger position registered on the sensor.  This
//                is on the *native* scale for the sensor, which might be
//                different from joystick units.  By default, the native
//                scale is the number of pixels for an imaging sensor, or
//                4096 for other sensor types.  The actual native scale can
//                be reported separately via a second status report message
//                (see below).
//    byte  7   = bit flags: 
//                   0x01 = normal orientation detected
//                   0x02 = reversed orientation detected
//                   0x04 = calibration mode is active (no pixel packets
//                          are sent for this reading)
//    bytes 8:9:10 = average time for each sensor read, in 10us units.
//                This is the average time it takes to complete the I/O
//                operation to read the sensor, to obtain the raw sensor
//                data for instantaneous plunger position reading.  For 
//                an imaging sensor, this is the time it takes for the 
//                sensor to capture the image and transfer it to the
//                microcontroller.  For an analog sensor (e.g., an LVDT
//                or potentiometer), it's the time to complete an ADC
//                sample.
//    bytes 11:12:13 = time it took to process the current frame, in 10us 
//                units.  This is the software processing time that was
//                needed to analyze the raw data read from the sensor.
//                This is typically only non-zero for imaging sensors,
//                where it reflects the time required to scan the pixel
//                array to find the indicated plunger position.  The time
//                is usually zero or negligible for analog sensor types, 
//                since the only "analysis" is a multiplication to rescale 
//                the ADC sample.
// An optional second message provides additional information:
//    bytes 0:1 = 0x87FF
//    byte  2   = 1 -> second status report packet
//    bytes 3:4 = Native sensor scale.  This is the actual native scale
//                used for the position report in the first status report
//                packet above.
//    bytes 5:6 = Jitter window lower bound, in native sensor scale units.
//    bytes 7:8 = Jitter window upper bound, in native sensor scale units.
//                The jitter window bounds reflect the current jitter filter
//                status as of this reading.
//    bytes 9:10 = Raw sensor reading before jitter filter was applied.
//    bytes 11:12 = Auto-exposure time in microseconds
// If the sensor is an imaging sensor type, this will be followed by a
// series of pixel messages.  The imaging sensor types have too many pixels
// to send in a single USB transaction, so the device breaks up the array
// into as many packets as needed and sends them in sequence.  For non-
// imaging sensors, the "number of pixels" field in the lead packet is
// zero, so obviously no pixel packets will follow.  If the "calibration
// active" bit in the flags byte is set, no pixel packets are sent even
// if the sensor is an imaging type, since the transmission time for the
// pixels would intefere with the calibration process.  If pixels are sent,
// they're sent in order starting at the first pixel.  The format of each 
// pixel packet is:
//    bytes 0:1 = 11-bit index, with high 5 bits set to 10000.  For 
//                example, 0x8004 (encoded little endian as 0x04 0x80) 
//                indicates index 4.  This is the starting pixel number 
//                in the report.  The first report will be 0x00 0x80 to 
//                indicate pixel #0.  
//    bytes 2   = 8-bit unsigned int brightness level of pixel at index
//    bytes 3   = brightness of pixel at index+1
//    etc for the rest of the packet
// Note that we currently only support one-dimensional imaging sensors
// (i.e., pixel arrays that are 1 pixel wide).  The report format doesn't
// have any provision for a two-dimensional layout.  The KL25Z probably
// isn't powerful enough to do real-time image analysis on a 2D image
// anyway, so it's unlikely that we'd be able to make 2D sensors work at
// all, but if we ever add such a thing we'll have to upgrade the report 
// format here accordingly.
// 2B. Configuration report.
// This is requested by sending custom protocol message 65 4 (see below).
// In reponse, the device sends one report to the host using this format:
//    bytes 0:1 = 0x8800.  This has the bit pattern 10001 in the high
//                5 bits, which distinguishes it from regular joystick
//                reports and from other special report types.
//    bytes 2:3 = total number of configured outputs, little endian.  This
//                is the number of outputs with assigned functions in the
//                active configuration.
//    byte  4   = Pinscape unit number (0-15), little endian
//    byte  5   = reserved (currently always zero)
//    bytes 6:7 = plunger calibration zero point, little endian
//    bytes 8:9 = plunger calibration maximum point, little endian
//    byte  10  = plunger calibration release time, in milliseconds
//    byte  11  = bit flags: 
//                 0x01 -> configuration loaded; 0 in this bit means that
//                         the firmware has been loaded but no configuration
//                         has been sent from the host
//                 0x02 -> SBX/PBX extension features: 1 in this bit means
//                         that these features are present in this version.
//                 0x04 -> new accelerometer features supported (adjustable
//                         dynamic range, auto-centering on/off, adjustable
//                         auto-centering time)
//                 0x08 -> flash write status flag supported (see flag 0x40
//                         in normal joystick status report)
//    bytes 12:13 = available RAM, in bytes, little endian.  This is the amount
//                of unused heap (malloc'able) memory.  The firmware generally
//                allocates all of the dynamic memory it needs during startup,
//                so the free memory figure doesn't tend to fluctuate during 
//                normal operation.  The dynamic memory used is a function of 
//                the set of features enabled.
// 2C. Device ID report.
// This is requested by sending custom protocol message 65 7 (see below).
// In response, the device sends one report to the host using this format:
//    bytes 0:1 = 0x9000.  This has bit pattern 10010 in the high 5 bits
//                to distinguish this from other report types.
//    byte 2    = ID type.  This is the same ID type sent in the request.
//    bytes 3-12 = requested ID.  The ID is 80 bits in big-endian byte
//                order.  For IDs longer than 80 bits, we truncate to the
//                low-order 80 bits (that is, the last 80 bits).
//                ID type 1 = CPU ID.  This is the globally unique CPU ID
//                  stored in the KL25Z CPU.
//                ID type 2 = OpenSDA ID.  This is the globally unique ID
//                  for the connected OpenSDA controller, if known.  This
//                  allow the host to figure out which USB MSD (virtual
//                  disk drive), if any, represents the OpenSDA module for
//                  this Pinscape USB interface.  This is primarily useful
//                  to determine which MSD to write in order to update the
//                  firmware on a given Pinscape unit.
// 2D. Configuration variable report.
// This is requested by sending custom protocol message 65 9 (see below).
// In response, the device sends one report to the host using this format:
//   bytes 0:1 = 0x9800.  This has bit pattern 10011 in the high 5 bits
//               to distinguish this from other report types.
//   byte  2   = Variable ID.  This is the same variable ID sent in the
//               query message, to relate the reply to the request.
//   bytes 3-8 = Current value of the variable, in the format for the
//               individual variable type.  The variable formats are
//               described in the CONFIGURATION VARIABLES section below.
// 2E. Software build information report.
// This is requested by sending custom protocol message 65 10 (see below).
// In response, the device sends one report using this format:
//   bytes 0:1 = 0xA000.  This has bit pattern 10100 in the high 5 bits
//               (and 10100000 in the high 8 bits) to distinguish it from 
//               other report types.
//   bytes 2:5 = Build date.  This is returned as a 32-bit integer,
//               little-endian as usual, encoding a decimal value
//               in the format YYYYMMDD giving the date of the build.
//               E.g., Feb 16 2016 is encoded as 20160216 (decimal).
//   bytes 6:9 = Build time.  This is a 32-bit integer, little-endian,
//               encoding a decimal value in the format HHMMSS giving
//               build time on a 24-hour clock.
// 2F. Button status report.
// This is requested by sending custom protocol message 65 13 (see below).
// In response, the device sends one report using this format:
//   bytes 0:1 = 0xA1.  This has bit pattern 10100 in the high 5 bits (and
//               10100001 in the high 8 bits) to distinguish it from other 
//               report types.
//   byte 2    = number of button reports
//   byte 3    = Physical status of buttons 1-8, 1 bit each.  The low-order
//               bit (0x01) is button 1.  Each bit is 0 if the button is off,
//               1 if on.  This reflects the physical status of the button
//               input pins, after debouncing but before any logical state
//               processing.  Pulse mode and shifting have no effect on the
//               physical state; this simply indicates whether the button is
//               electrically on (shorted to GND) or off (open circuit).
//   byte 4    = buttons 9-16
//   byte 5    = buttons 17-24
//   byte 6    = buttons 25-32
//   byte 7    = buttons 33-40
//   byte 8    = buttons 41-48
// 2G. IR sensor data report.
// This is requested by sending custom protocol message 65 12 (see below).
// That command puts controller in IR learning mode for a short time, during
// which it monitors the IR sensor and send these special reports to relay the
// readings.  The reports contain the raw data, plus the decoded command code
// and protocol information if the controller is able to recognize and decode
// the command.
//   bytes 0:1 = 0xA2.  This has bit pattern 10100 in the high 5 bits (and
//               10100010 in the high 8 bits to distinguish it from other 
//               report types.
//   byte 2    = number of raw reports that follow
//   bytes 3:4 = first raw report, as a little-endian 16-bit int.  The
//               value represents the time of an IR "space" or "mark" in
//               2us units.  The low bit is 0 for a space and 1 for a mark.
//               To recover the time in microseconds, mask our the low bit
//               and multiply the result by 2.  Received codes always
//               alternate between spaces and marks.  A space is an interval
//               where the IR is off, and a mark is an interval with IR on.
//               If the value is 0xFFFE (after masking out the low bit), it
//               represents a timeout, that is, a time greater than or equal
//               to the maximum that can be represented in this format,
//               which is 131068us.  None of the IR codes we can parse have
//               any internal signal component this long, so a timeout value 
//               is generally seen only during a gap between codes where 
//               nothing is being transmitted.
//   bytes 4:5 = second raw report
//   (etc for remaining reports)
//   If byte 2 is 0x00, it indicates that learning mode has expired without
//   a code being received, so it's the last report sent for the learning
//   session.
//   If byte 2 is 0xFF, it indicates that a code has been successfully 
//   learned.  The rest of the report contains the learned code instead
//   of the raw data:
//   byte 3 = protocol ID, which is an integer giving an internal code
//            identifying the IR protocol that was recognized for the 
//            received data.  See IRProtocolID.h for a list of the IDs.
//   byte 4 = bit flags:
//            0x02 -> the protocol uses "dittos"
//   bytes 5:6:7:8:9:10:11:12 = a little-endian 64-bit int containing
//            the code received.  The code is essentially the data payload 
//            of the IR packet, after removing bits that are purely
//            structural, such as toggle bits and error correction bits.
//            The mapping between the IR bit stream and our 64-bit is 
//            essentially arbitrary and varies by protocol, but it always
//            has round-trip fidelity: using the 64-bit code value +
//            protocol ID + flags to send an IR command will result in
//            the same IR bit sequence being sent, modulo structural bits 
//            that need to be updates in the reconstruction (such as toggle
//            bits or sequencing codes).
// The HID report system was specifically designed to provide a clean,
// structured way for devices to describe the data they send to the host.
// Our approach isn't clean or structured; it ignores the promises we
// make about the contents of our report via the HID Report Descriptor
// and stuffs our own different data format into the same structure.
// We use this hacky approach only because we can't use the standard USB
// HID mechanism for varying report types, which is to provide multiple
// report descriptors and tag each report with a type byte that indicates 
// which descriptor applies.  We can't use that standard approach because
// we want to be 100% LedWiz compatible.  The snag is that some Windows
// LedWiz clients parse the USB HID descriptors as part of identifying a
// USB HID device as a valid LedWiz unit, and will only recognize the device
// if certain properties of the HID descriptors match those of a real LedWiz.
// One of the features that's important to some clients is the descriptor 
// link structure, which is affected by the layout of HID Report Descriptor 
// entries.  In order to match the expected layout, we can only define a 
// single kind of output report.  Since we have to use Joystick reports for 
// the sake of VP and other pinball software, and we're only allowed the 
// one report type, we have to make that one report type the Joystick type.  
// That's why we overload the joystick reports with other meanings.  It's a
// hack, but at least it's a fairly reliable and isolated hack, in that our 
// special reports are only generated when clients specifically ask for 
// them.  Plus, even if a client who doesn't ask for a special report 
// somehow gets one, the worst that happens is that they get a momentary 
// spurious reading from the accelerometer and plunger.

// For LedWiz compatibility, our incoming message format conforms to the
// basic USB format used by real LedWiz units.  This is simply 8 data
// bytes, all private vendor-specific values (meaning that the Windows HID
// driver treats them as opaque and doesn't attempt to parse them).
// Within this basic 8-byte format, we recognize the full protocol used
// by real LedWiz units, plus an extended protocol that we define privately.
// The LedWiz protocol leaves a large part of the potential protocol space 
// undefined, so we take advantage of this undefined region for our 
// extensions.  This ensures that we can properly recognize all messages 
// intended for a real LedWiz unit, as well as messages from custom host 
// software that knows it's talking to a Pinscape unit.

// The real LedWiz protocol has two message types, "SBA" and "PBA".  The
// message type can be determined from the first byte of the 8-byte message
// packet: if the first byte 64 (0x40), it's an SBA message.  If the first
// byte is 0-49 or 129-132, it's a PBA message.  All other byte values are
// invalid in the original protocol and have undefined behavior if sent to
// a real LedWiz.  We take advantage of this to extend the protocol with
// our new features by assigning new meanings to byte patterns that have no 
// meaning in the original protocol.
// "SBA" message:   64 xx xx xx xx ss 00 00
//     xx = on/off bit mask for 8 outputs
//     ss = global flash speed setting (valid values 1-7)
//     00 = unused/reserved; client should set to zero (not enforced, but
//          strongly recommended in case of future additions)
// If the first byte has value 64 (0x40), it's an SBA message.  This type of 
// message sets all 32 outputs individually ON or OFF according to the next 
// 32 bits (4 bytes) of the message, and sets the flash speed to the value in 
// the sixth byte.  The flash speed sets the global cycle rate for flashing
// outputs - outputs with their values set to the range 128-132.  The speed
// parameter is in ad hoc units that aren't documented in the LedWiz API, but
// observations of real LedWiz units show that the "speed" is actually the
// period, each unit representing 0.25s: so speed 1 is a 0.25s period, or 4Hz,
// speed 2 is a 0.5s period or 2Hz, etc., up to speed 7 as a 1.75s period or
// 0.57Hz.  The period is the full waveform cycle time.
// "PBA" message:  bb bb bb bb bb bb bb bb
//     bb = brightness level, 0-49 or 128-132
// Note that there's no prefix byte indicating this message type.  This
// message is indicated simply by the first byte being in one of the valid
// ranges.
// Each byte gives the new brightness level or flash pattern for one part.
// The valid values are:
//     0-48 = fixed brightness level, linearly from 0% to 100% intensity
//     49   = fixed brightness level at 100% intensity (same as 48)
//     129  = flashing pattern, fade up / fade down (sawtooth wave)
//     130  = flashing pattern, on / off (square wave)
//     131  = flashing pattern, on for 50% duty cycle / fade down
//     132  = flashing pattern, fade up / on for 50% duty cycle
// This message sets new brightness/flash settings for 8 ports.  There's
// no port number specified in the message; instead, the port is given by
// the protocol state.  Specifically, the device has an internal register
// containing the base port for PBA messages.  On reset AND after any SBA
// message is received, the base port is set to 0.  After any PBA message
// is received and processed, the base port is incremented by 8, resetting
// to 0 when it reaches 32.  The bytes of the message set the brightness
// levels for the base port, base port + 1, ..., base port + 7 respectively.

// All of our extended protocol messages are identified by the first byte:
// 65  -> Miscellaneous control message.  The second byte specifies the specific
//        operation:
//        0 -> No Op - does nothing.  (This can be used to send a test message on the
//             USB endpoint.)
//        1 -> Set device unit number and plunger status, and save the changes immediately
//             to flash.  The device will automatically reboot after the changes are saved.
//             The additional bytes of the message give the parameters:
//               third byte = new unit number (0-15, corresponding to nominal unit numbers 1-16)
//               fourth byte = plunger on/off (0=disabled, 1=enabled)
//        2 -> Begin plunger calibration mode.  The device stays in this mode for about
//             15 seconds, and sets the zero point and maximum retraction points to the
//             observed endpoints of sensor readings while the mode is running.  After
//             the time limit elapses, the device automatically stores the results in
//             non-volatile flash memory and exits the mode.
//        3 -> Send pixel dump.  The device sends one complete image snapshot from the
//             plunger sensor, as as series of pixel dump messages.  (The message format
//             isn't big enough to allow the whole image to be sent in one message, so
//             the image is broken up into as many messages as necessary.)  The device
//             then resumes sending normal joystick messages.  If the plunger sensor 
//             isn't an imaging type, or no sensor is installed, no pixel messages are 
//             sent.  Parameters:
//               third byte = bit flags:
//                  0x01 = low res mode.  The device rescales the sensor pixel array
//                         sent in the dump messages to a low-resolution subset.  The
//                         size of the subset is determined by the device.  This has
//                         no effect on the sensor operation; it merely reduces the
//                         USB transmission time to allow for a faster frame rate for
//                         viewing in the config tool.
//               fourth byte = extra exposure time in 100us (.1ms) increments.  For
//                  imaging sensors, we'll add this delay to the minimum exposure 
//                  time.  This allows the caller to explicitly adjust the exposure
//                  level for calibration purposes.
//        4 -> Query configuration.  The device sends a special configuration report,
//             (see above; see also USBJoystick.cpp), then resumes sending normal 
//             joystick reports.
//        5 -> Turn all outputs off and restore LedWiz defaults.  Sets all output 
//             ports to OFF and LedWiz brightness/mode setting 48, and sets the LedWiz
//             global flash speed to 2.
//        6 -> Save configuration to flash.  This saves all variable updates sent via
//             type 66 messages since the last reboot, then optionally reboots the
//             device to put the changes into effect.  If the flash write succeeds,
//             we set the "flash write OK" bit in our status reports, which we 
//             continue sending between the successful write and the delayed reboot.
//             We don't set the bit or reboot if the write fails.  If the "do not
//             reboot" flag is set, we still set the flag on success for the delay 
//             time, then clear the flag.
//               third byte = delay time in seconds.  The device will wait this long
//               before disconnecting, to allow the PC to test for the success bit
//               in the status report, and to perform any cleanup tasks while the 
//               device is still attached (e.g., modifying Windows device driver 
//               settings)
//               fourth byte = flags:
//                 0x01 -> do not reboot
//        7 -> Query device ID.  The device replies with a special device ID report
//             (see above; see also USBJoystick.cpp), then resumes sending normal
//             joystick reports.
//             The third byte of the message is the ID index to retrieve:
//                 1 = CPU ID: returns the KL25Z globally unique CPU ID.
//                 2 = OpenSDA ID: returns the OpenSDA TUID.  This must be patched
//                     into the firmware by the PC host when the .bin file is
//                     installed onto the device.  This will return all 'X' bytes
//                     if the value wasn't patched at install time.
//        8 -> Engage/disengage night mode.  The third byte of the message is 1 to
//             engage night mode, 0 to disengage night mode.  The current mode isn't 
//             stored persistently; night mode is always off after a reset.
//        9 -> Query configuration variable.  The second byte is the config variable
//             number (see the CONFIGURATION VARIABLES section below).  For the array
//             variables (button assignments, output ports), the third byte is the
//             array index.  The device replies with a configuration variable report
//             (see above) with the current setting for the requested variable.
//       10 -> Query software build information.  No parameters.  This replies with
//             the software build information report (see above).
//       11 -> TV ON relay manual control.  This allows testing and operating the
//             relay from the PC.  This doesn't change the power-up configuration;
//             it merely allows the relay to be controlled directly.
//                 0 = turn relay off
//                 1 = turn relay on
//                 2 = pulse the relay as though the power-on delay timer fired
//       12 -> Learn IR code.  The device enters "IR learning mode".  While in 
//             learning mode, the device reports the raw signals read through 
//             the IR sensor to the PC through the special IR learning report 
//             (see "2G" above).  If a signal can be decoded through a known 
//             protocol, the device sends a final "2G" report with the decoded 
//             command, then terminates learning mode.  If no signal can be 
//             decoded within a timeout period, the mode automatically ends,
//             and the device sends a final IR learning report with zero raw 
//             signals to indicate termination.  After initiating IR learning 
//             mode, the user should point the remote control with the key to 
//             be learned at the IR sensor on the KL25Z, and press and hold the 
//             key on the remote for a few seconds.  Holding the key for a few
//             moments is important because it lets the decoder sense the type
//             of auto-repeat coding the remote uses.  The learned code can be
//             written to an IR config variable slot to program the controller
//             to send the learned command on events like TV ON or a button
//             press.
//       13 -> Get button status report.  The device sends one button status 
//             report in response (see section "2F" above).
//       14 -> Manually center the accelerometer.  This sets the accelerometer
//             zero point to the running average of readings over the past few
//             seconds.
//       15 -> Set up ad hoc IR command, part 1.  This sets up the first part 
//             of an IR command to transmit.  The device stores the data in an
//             internal register for later use in message 65 16.  Send the
//             remainder of the command data with 65 16.
//               byte 3 = IR protocol ID
//               byte 4 = flags (IRFlagXxx bit flags)
//               byte 5-8 = low-order 32 bits of command code, little-endian
//       16 -> Finish and send an ad hoc IR command.  Use message 65 15 first
//             to set up the start of the command data, then send this message 
//             to fill in the rest of the data and transmit the command.  Upon
//             receiving this message, the device performs the transmission.
//               byte 3-6 = high-order 32 bits of command code, little-endian
// 66  -> Set configuration variable.  The second byte of the message is the config
//        variable number, and the remaining bytes give the new value for the variable.
//        The value format is specific to each variable; see the CONFIGURATION VARIABLES
//        section below for a list of the variables and their formats.  This command
//        only sets the value in RAM; it doesn't write the value to flash and doesn't 
//        put the change into effect.  To save the new settings, the host must send a 
//        type 65 subtype 6 message (see above).  That saves the settings to flash and
//        reboots the device, which makes the new settings active.
// 67  -> "SBX".  This is an extended form of the original LedWiz SBA message.  This
//        version is specifically designed to support a replacement LEDWIZ.DLL on the
//        host that exposes one Pinscape device as multiple virtual LedWiz devices,
//        in order to give legacy clients access to more than 32 ports.  Each virtual
//        LedWiz represents a block of 32 ports.  The format of this message is the
//        same as for the original SBA, with the addition of one byte:
//            67 xx xx xx xx ss pp 00
//               xx = on/off switches for 8 ports, one bit per port
//               ss = global flash speed setting for this bank of ports, 1-7
//               pp = port group: 0 for ports 1-32, 1 for ports 33-64, etc
//               00 = unused/reserved; client should set to zero
//        As with SBA, this sets the on/off switch states for a block of 32 ports.
//        SBA always addresses ports 1-32; SBX can address any set of 32 ports.
//        We keep a separate speed setting for each group of 32 ports.  The purpose
//        of the SBX extension is to allow a custom LEDWIZ.DLL to expose multiple
//        virtual LedWiz units to legacy clients, so clients will expect each unit
//        to have its separate flash speed setting.  Each block of 32 ports maps to
//        a virtual unit on the client side, so each block needs its own speed state.
// 68  -> "PBX".  This is an extended form of the original LedWiz PBA message; it's
//        the PBA equivalent of our SBX extension above.
//            68 pp ee ee ee ee ee ee
//               pp = port group: 0 for ports 1-8, 1 for 9-16, etc
//               qq = sequence number: 0 for the first 8 ports in the group, etc
//               ee = brightness/flash values, 6 bits per port, packed into the bytes
//        The port group 'pp' selects a group of 8 ports.  Note that, unlike PBA,
//        the port group being updated is explicitly coded in the message, which makes
//        the message stateless.  This eliminates any possibility of the client and
//        host getting out of sync as to which ports they're talking about.  This
//        message doesn't affect the PBA port address state.
//        The brightness values are *almost* the same as in PBA, but not quite.  We
//        remap the flashing state values as follows:
//            0-48 = brightness level, 0% to 100%, on a linear scale
//            49   = brightness level 100% (redundant with 48)
//            60   = PBA 129 equivalent, sawtooth
//            61   = PBA 130 equivalent, square wave (on/off)
//            62   = PBA 131 equivalent, on/fade down
//            63   = PBA 132 equivalent, fade up/on
//        We reassign the brightness levels like this because it allows us to pack
//        every possible value into 6 bits.  This allows us to fit 8 port settings
//        into six bytes.  The 6-bit fields are packed into the 8 bytes consecutively
//        starting with the low-order bit of the first byte.  An efficient way to
//        pack the 'ee' fields given the brightness values is to shift each group of 
//        four bytes  into a uint, then shift the uint into three 'ee' bytes:
//           unsigned int tmp1 = bri[0] | (bri[1]<<6) | (bri[2]<<12) | (bri[3]<<18);
//           unsigned int tmp2 = bri[4] | (bri[5]<<6) | (bri[6]<<12) | (bri[7]<<18);
//           unsigned char port_group = FIRST_PORT_TO_ADDRESS / 8;
//           unsigned char msg[8] = {
//               68, pp, 
//               tmp1 & 0xFF, (tmp1 >> 8) & 0xFF, (tmp1 >> 16) & 0xFF,
//               tmp2 & 0xFF, (tmp2 >> 8) & 0xFF, (tmp2 >> 16) & 0xFF
//           };
// 200-228 -> Set extended output brightness.  This sets outputs N to N+6 to the
//        respective brightness values in the 2nd through 8th bytes of the message
//        (output N is set to the 2nd byte value, N+1 is set to the 3rd byte value, 
//        etc).  Each brightness level is a linear brightness level from 0-255,
//        where 0 is 0% brightness and 255 is 100% brightness.  N is calculated as
//        (first byte - 200)*7 + 1:
//               200 = outputs 1-7
//               201 = outputs 8-14
//               202 = outputs 15-21
//               ...
//               228 = outputs 197-203
//        This message is the way to address ports 33 and higher.  Original LedWiz
//        protocol messages can't access ports above 32, since the protocol is
//        hard-wired for exactly 32 ports.
//        Note that the extended output messages differ from regular LedWiz commands
//        in two ways.  First, the brightness is the ONLY attribute when an output is
//        set using this mode.  There's no separate ON/OFF state per output as there 
//        is with the SBA/PBA messages.  To turn an output OFF with this message, set
//        the intensity to 0.  Setting a non-zero intensity turns it on immediately
//        without regard to the SBA status for the port.  Second, the brightness is
//        on a full 8-bit scale (0-255) rather than the LedWiz's approximately 5-bit
//        scale, because there are no parts of the range reserved for flashing modes.
//        Outputs 1-32 can be controlled by EITHER the regular LedWiz SBA/PBA messages
//        or by the extended messages.  The latest setting for a given port takes
//        precedence.  If an SBA/PBA message was the last thing sent to a port, the
//        normal LedWiz combination of ON/OFF and brightness/flash mode status is used
//        to determine the port's physical output setting.  If an extended brightness
//        message was the last thing sent to a port, the LedWiz ON/OFF status and
//        flash modes are ignored, and the fixed brightness is set.  Outputs 33 and
//        higher inherently can't be addressed or affected by SBA/PBA messages.
//        (The precedence scheme is designed to accommodate a mix of legacy and DOF
//        software transparently.  The behavior described is really just to ensure
//        transparent interoperability; it's not something that host software writers
//        should have to worry about.  We expect that anyone writing new software will
//        just use the extended protocol and ignore the old LedWiz commands, since
//        the extended protocol is easier to use and more powerful.)

// Message type 66 (see above) sets one configuration variable.  The second byte
// of the message is the variable ID, and the rest of the bytes give the new
// value, in a variable-specific format.  16-bit values are little endian.
// Any bytes at the end of the message not otherwise specified are reserved
// for future use and should always be set to 0 in the message data.
// Variable IDs:
// 0  -> QUERY ONLY: Describe the configuration variables.  The device
//       sends a config variable query report with the following fields:
//         byte 3  -> number of scalar (non-array) variables (these are
//                    numbered sequentially from 1 to N)
//         byte 4  -> number of array variables (these are numbered
//                    sequentially from 256-N to 255)
//       The description query is meant to allow the host to capture all
//       configuration settings on the device without having to know what
//       the variables mean or how many there are.  This is useful for
//       backing up the settings in a file on the PC, for example, or for
//       capturing them to restore after a firmware update.  This allows
//       more flexible interoperability between unsynchronized versions 
//       of the firmware and the host software.
// 1  -> USB device ID.  This sets the USB vendor and product ID codes
//       to use when connecting to the PC.  For LedWiz emulation, use
//       vendor 0xFAFA and product 0x00EF + unit# (where unit# is the
//       nominal LedWiz unit number, from 1 to 16).  If you have any
//       REAL LedWiz units in your system, we recommend starting the
//       Pinscape LedWiz numbering at 8 to avoid conflicts with the 
//       real LedWiz units.  If you don't have any real LedWiz units,
//       you can number your Pinscape units starting from 1.
//       If LedWiz emulation isn't desired or causes host conflicts, 
//       use our private ID: Vendor 0x1209, product 0xEAEA.  (These IDs
//       are registered with, a registry for open-source 
//       USB devices, so they're guaranteed to be free of conflicts with
//       other properly registered devices).  The device will NOT appear
//       as an LedWiz if you use the private ID codes, but DOF (R3 or 
//       later) will still recognize it as a Pinscape controller.
//         bytes 3:4 -> USB Vendor ID
//         bytes 5:6 -> USB Product ID
// 2  -> Pinscape Controller unit number for DOF.  The Pinscape unit
//       number is independent of the LedWiz unit number, and indepedent
//       of the USB vendor/product IDs.  DOF (R3 and later) uses this to 
//       identify the unit for the extended Pinscape functionality.
//       For easiest DOF configuration, we recommend numbering your
//       units sequentially starting at 1 (regardless of whether or not
//       you have any real LedWiz units).
//         byte 3 -> unit number, from 1 to 16
// 3  -> Enable/disable joystick reports.  
//         byte 2 -> 1 to enable, 0 to disable
//       When joystick reports are disabled, the device registers as a generic HID 
//       device, and only sends the private report types used by the Windows config 
//       tool.  It won't appear to Windows as a USB game controller or joystick.
//       Note that this doesn't affect whether the device also registers a keyboard
//       interface.  A keyboard interface will appear if and only if any buttons
//       (including virtual buttons, such as the ZB Launch Ball feature) are assigned 
//       to generate keyboard key input.
// 4  -> Accelerometer settings
//        byte 3 -> orientation:
//           0 = ports at front (USB ports pointing towards front of cabinet)
//           1 = ports at left
//           2 = ports at right
//           3 = ports at rear
//        byte 4 -> dynamic range
//           0 = +/- 1G (2G hardware mode, but rescales joystick reports to 1G 
//                   range; compatible with older versions)
//           1 = +/- 2G (2G hardware mode)
//           2 = +/- 4G (4G hardware mode)
//           3 = +/- 8G (8G hardware mode)
//        byte 5 -> Auto-centering mode
//           0      = auto-centering on, 5 second timer (default, compatible 
//                    with older versions)
//           1-60   = auto-centering on with the given time in seconds
//           61-245 = reserved
//           255    = auto-centering off; manual centering only
// 5  -> Plunger sensor type.
//        byte 3 -> plunger type:
//           0 = none (disabled)
//           1 = TSL1410R linear image sensor, 1280x1 pixels, serial mode, edge detection
//           3 = TSL1412R linear image sensor, 1536x1 pixels, serial mode, edge detection
//           5 = Potentiometer with linear taper, or any other device that
//               represents the position reading with a single analog voltage
//           6 = AEDR8300 optical quadrature sensor, 75lpi
//          *7 = AS5304 magnetic quadrature sensor, 160 steps per 2mm
//           8 = TSL1401CL linear image sensor, 128x1 pixel, bar code detection
//           9 = VL6180X time-of-flight distance sensor
//       * The sensor types marked with asterisks (*) are reserved for types
//       that aren't currently implemented but could be added in the future.  
//       Selecting these types will effectively disable the plunger.  Note
//       that sensor types 2 and 4 were formerly reserved for TSL14xx sensors
//       in parallel wiring mode, but support for these is no longer planned,
//       as the KL25Z's single ADC sampler makes it incapable of gaining any
//       advantage from the parallel mode offered by the sensors.  Those slots
//       could be reassigned in the future for other sensors, since they were
//       never enabled in any version of the firwmare.
// 6  -> Plunger pin assignments.
//         byte 3 -> pin assignment 1
//         byte 4 -> pin assignment 2
//         byte 5 -> pin assignment 3
//         byte 6 -> pin assignment 4
//       All of the pins use the standard GPIO port format (see "GPIO pin number
//       mappings" below).  The actual use of the four pins depends on the plunger
//       type, as shown below.  "NC" means that the pin isn't used at all for the
//       corresponding plunger type.  "GPIO" means that any GPIO pin will work.
//       AnalogIn and InterruptIn means that only pins with the respective 
//       capabilities can be chosen.
//         Plunger Type              Pin 1            Pin 2             Pin 3           Pin 4
//         TSL1410R/1412R/1401CL     SI (GPIO)        CLK (GPIO)        AO (AnalogIn)   NC
//         Potentiometer             AO (AnalogIn)    NC                NC              NC
//         AEDR8300                  A (InterruptIn)  B (InterruptIn)   NC              NC
//         AS5304                    A (InterruptIn)  B (InterruptIn)   NC              NC
//         VL6180X                   SDA (GPIO)       SCL (GPIO)        GPIO0/CE (GPIO) NC
// 7  -> Plunger calibration button pin assignments.
//         byte 3 -> features enabled/disabled: bit mask consisting of:
//                   0x01  button input is enabled
//                   0x02  lamp output is enabled
//         byte 4 -> DigitalIn pin for the button switch
//         byte 5 -> DigitalOut pin for the indicator lamp
//       Note that setting a pin to NC (Not Connected) will disable it even if the
//       corresponding feature enable bit (in byte 3) is set.
// 8  -> ZB Launch Ball setup.  This configures the ZB Launch Ball feature.
//         byte 3    -> LedWiz port number (1-255) mapped to "ZB Launch Ball" in DOF
//         byte 4    -> key type
//         byte 5    -> key code
//         bytes 6:7 -> "push" distance, in 1/1000 inch increments (16 bit little endian)
//       Set the port number to 0 to disable the feature.  The key type and key code
//       fields use the same conventions as for a button mapping (see below).  The
//       recommended push distance is 63, which represents .063" ~ 1/16".
// 9  -> TV ON relay setup.  This requires external circuitry implemented on the
//       Expansion Board (or an equivalent circuit as described in the Build Guide).
//         byte 3    -> "power status" input pin (DigitalIn)
//         byte 4    -> "latch" output (DigitalOut)
//         byte 5    -> relay trigger output (DigitalOut)
//         bytes 6:7 -> delay time in 10ms increments (16 bit little endian);
//                      e.g., 550 (0x26 0x02) represents 5.5 seconds
//       Set the delay time to 0 to disable the feature.  The pin assignments will
//       be ignored if the feature is disabled.
//       If an IR remote control transmitter is installed (see variable 17), we'll
//       also transmit any IR codes designated as TV ON codes when the startup timer
//       finishes.  This allows TVs to be turned on via IR remotes codes rather than
//       hard-wiring them through the relay.  The relay can be omitted in this case.
// 10 -> TLC5940NT setup.  This chip is an external PWM controller, with 32 outputs
//       per chip and a serial data interface that allows the chips to be daisy-
//       chained.  We can use these chips to add an arbitrary number of PWM output 
//       ports for the LedWiz emulation.
//          byte 3 = number of chips attached (connected in daisy chain)
//          byte 4 = SIN pin - Serial data (must connect to SPIO MOSI -> PTC6 or PTD2)
//          byte 5 = SCLK pin - Serial clock (must connect to SPIO SCLK -> PTC5 or PTD1)
//          byte 6 = XLAT pin - XLAT (latch) signal (any GPIO pin)
//          byte 7 = BLANK pin - BLANK signal (any GPIO pin)
//          byte 8 = GSCLK pin - Grayscale clock signal (must be a PWM-out capable pin)
//       Set the number of chips to 0 to disable the feature.  The pin assignments are 
//       ignored if the feature is disabled.
// 11 -> 74HC595 setup.  This chip is an external shift register, with 8 outputs per
//       chip and a serial data interface that allows daisy-chaining.  We use this
//       chips to add extra digital outputs for the LedWiz emulation.  In particular,
//       the Chime Board (part of the Expansion Board suite) uses these to add timer-
//       protected outputs for coil devices (knockers, chimes, bells, etc).
//          byte 3 = number of chips attached (connected in daisy chain)
//          byte 4 = SIN pin - Serial data (any GPIO pin)
//          byte 5 = SCLK pin - Serial clock (any GPIO pin)
//          byte 6 = LATCH pin - LATCH signal (any GPIO pin)
//          byte 7 = ENA pin - ENABLE signal (any GPIO pin)
//       Set the number of chips to 0 to disable the feature.  The pin assignments are
//       ignored if the feature is disabled.
// 12 -> Disconnect reboot timeout.  The reboot timeout allows the controller software
//       to automatically reboot the KL25Z after it detects that the USB connection is
//       broken.  On some hosts, the device isn't able to reconnect after the initial
//       connection is lost.  The reboot timeout is a workaround for these cases.  When
//       the software detects that the connection is no longer active, it will reboot
//       the KL25Z automatically if a new connection isn't established within the
//       timeout period.  Set the timeout to 0 to disable the feature (i.e., the device
//       will never automatically reboot itself on a broken connection).
//          byte 3 -> reboot timeout in seconds; 0 = disabled
// 13 -> Plunger calibration.  In most cases, the calibration is set internally by the
//       device by running the calibration procedure.  However, it's sometimes useful
//       for the host to be able to get and set the calibration, such as to back up
//       the device settings on the PC, or to save and restore the current settings
//       when installing a software update.
//         bytes 3:4 = rest position (unsigned 16-bit little-endian)
//         bytes 5:6 = maximum retraction point (unsigned 16-bit little-endian)
//         byte  7   = measured plunger release travel time in milliseconds
// 14 -> Expansion board configuration.  This doesn't affect the controller behavior
//       directly; the individual options related to the expansion boards (such as 
//       the TLC5940 and 74HC595 setup) still need to be set separately.  This is
//       stored so that the PC config UI can store and recover the information to
//       present in the UI.  For the "classic" KL25Z-only configuration, simply set 
//       all of the fields to zero.
//         byte 3 = board set type.  At the moment, the Pinscape expansion boards
//                  are the only ones supported in the software.  This allows for
//                  adding new designs or independent designs in the future.
//                    0 = Standalone KL25Z (no expansion boards)
//                    1 = Pinscape expansion boards
//         byte 4 = board set interface revision.  This *isn't* the version number
//                  of the board itself, but rather of its software interface.  In
//                  other words, this doesn't change every time the EAGLE layout
//                  for the board changes.  It only changes when a revision is made
//                  that affects the software, such as a GPIO pin assignment.
//                  For Pinscape expansion boards (board set type = 1):
//                    0 = first release (Feb 2016)
//         bytes 5:8 = additional hardware-specific data.  These slots are used
//                  to store extra data specific to the expansion boards selected.
//                  For Pinscape expansion boards (board set type = 1):
//                    byte 5 = number of main interface boards
//                    byte 6 = number of MOSFET power boards
//                    byte 7 = number of chime boards
// 15 -> Night mode setup.  
//       byte 3 = button number - 1..MAX_BUTTONS, or 0 for none.  This selects
//                a physically wired button that can be used to control night mode.
//                The button can also be used as normal for PC input if desired.
//                Note that night mode can still be activated via a USB command
//                even if no button is assigned.
//       byte 4 = flags:
//                0x01 -> The wired input is an on/off switch: night mode will be
//                        active when the input is switched on.  If this bit isn't
//                        set, the input is a momentary button: pushing the button
//                        toggles night mode.
//                0x02 -> Night Mode is assigned to the SHIFTED button (see Shift
//                        Button setup at variable 16).  This can only be used
//                        in momentary mode; it's ignored if flag bit 0x01 is set.
//                        When the shift flag is set, the button only toggles
//                        night mode when you press it while also holding down
//                        the Shift button.                        
//       byte 5 = indicator output number - 1..MAX_OUT_PORTS, or 0 for none.  This
//                selects an output port that will be turned on when night mode is
//                activated.  Night mode activation overrides any setting made by
//                the host.
// 16 -> Shift Button setup.  One button can be designated as a "Local Shift
//       Button" that can be pressed to select a secondary meaning for other
//       buttons.  This isn't the same as the PC keyboard Shift keys; those can
//       be programmed using the USB key codes for Left Shift and Right Shift.
//       Rather, this applies a LOCAL shift feature in the cabinet button that
//       lets you select a secondary meaning.  For example, you could assign
//       the Start button to the "1" key (VP "Start Game") normally, but have
//       its meaning change to the "5" key ("Insert Coin") when the shift
//       button is pressed.  This provides access to more control functions
//       without adding more physical buttons.
//       byte 3 = button number - 1..MAX_BUTTONS, or 0 for none
//       byte 4 = mode (default is 0):
//          0 -> Shift OR Key mode.  In this mode, the Shift button doesn't
//               send its assigned key or IR command when initially pressed.
//               Instead, we wait to see if another button is pressed while
//               the Shift button is held down.  If so, this Shift button 
//               press ONLY counts as the Shift function, and its own assigned
//               key is NOT sent to the PC.  On the other hand, if you press
//               the Shift button and then release it without having pressed
//               any other key in the meantime, this press counts as a regular
//               key press, so we send the assigned key to the PC.
//          1 -> Shift AND Key mode.  In this mode, the Shift button sends its
//               assigned key when pressed, just like a normal button.  If you
//               press another button while the Shift key is pressed, the
//               shifted meaning of the other key is used.
// 17 -> IR Remote Control physical device setup.  We support IR remotes for
//       both sending and receiving.  On the receive side, we can read from a 
//       sensor such as a TSOP384xx.  The sensor requires one GPIO pin with 
//       interrupt support, so any PTAxx or PTDxx pin will work.  On the send 
//       side, we can transmit through any IR LED.  This requires one PWM 
//       output pin.  To enable send and/or receive, specify a valid pin; to
//       disable, set the pin NC (not connected).  Send and receive can be
//       enabled and disabled independently; it's not necessary to enable
//       the transmit function to use the receive function, or vice versa.
//       byte 3 = receiver input GPIO pin ID.  Must be interrupt-capable.
//       byte 4 = transmitter pin.  Must be PWM-capable.
// 18 -> Plunger auto-zeroing.  This only applies to sensor types with
//       relative positioning, such as quadrature sensors.  Other sensor
//       types simply ignore this.
//       byte 3 = bit flags:
//                0x01 -> auto-zeroing enabled
//       byte 4 = auto-zeroing time in seconds
// 19 -> Plunger jitter filter.  This sets a hysteresis window size, to
//       reduce jitter in the plunger reading.  Most sensors aren't perfectly
//       accurate: consecutive readings at the same physical plunger position
//       vary slightly, wandering in a range near the true reading.  Over time,
//       the readings will usually average the true value, but that's not much
//       of a consolation to us because we want to display the position in
//       real time.  To reduce the visible jitter, we can apply a hysteresis
//       filter that hides sensor reading variations within a chosen window.
//       This sets the window size.  The window is in joystick units; we
//       report the joystick position on a scale of -4095..+4095, and the
//       physical plunger travels about 3" overall, so each joystick unit
//       represents about 1/10000" of physical travel.  Setting this to zero
//       (the default) disables the filter.
//       byte 3:4 = window size in joystick units, little-endian
// SPECIAL DIAGNOSTICS VARIABLES:  These work like the array variables below,
// the only difference being that we don't report these in the number of array
// variables reported in the "variable 0" query.
// 220 -> Performance/diagnostics variables.  Items marked "read only" can't
//        be written; any SET VARIABLE messages on these are ignored.  Items
//        marked "diagnostic only" refer to counters or statistics that are
//        collected only when the diagnostics are enabled via the diags.h
//        macro ENABLE_DIAGNOSTICS.  These will simply return zero otherwise.
//          byte 3 = diagnostic index (see below)
//        Diagnostic index values:
//          1 -> Main loop cycle time [read only, diagnostic only]
//               Retrieves the average time of one iteration of the main
//               loop, in microseconds, as a uint32.  This excludes the
//               time spent processing incoming messages, as well as any
//               time spent waiting for a dropped USB connection to be
//               restored.  This includes all subroutine time and polled
//               task time, such as processing button and plunger input,
//               sending USB joystick reports, etc.
//          2 -> Main loop message read time [read only, diagnostic only]
//               Retrieves the average time spent processing incoming USB
//               messages per iteration of the main loop, in microseconds, 
//               as a uint32.  This only counts the processing time when 
//               messages are actually present, so the average isn't reduced
//               by iterations of the main loop where no messages are found.
//               That is, if we run a million iterations of the main loop,
//               and only five of them have messages at all, the average time
//               includes only those five cycles with messages to process.
//          3 -> PWM update polling time [read only, diagnostic only]
//               Retrieves the average time, as a uint32 in microseconds,
//               spent in the PWM update polling routine.
//          4 -> LedWiz update polling time [read only, diagnostic only]
//               Retrieves the average time, as a uint32 in microseconds,
//               units, spent in the LedWiz flash cycle update routine.
// ARRAY VARIABLES:  Each variable below is an array.  For each get/set message,
// byte 3 gives the array index.  These are grouped at the top end of the variable 
// ID range to distinguish this special feature.  On QUERY, set the index byte to 0 
// to query the number of slots; the reply will be a report for the array index
// variable with index 0, with the first (and only) byte after that indicating
// the maximum array index.
// 250 -> IR remote control commands - code part 2.  This stores the high-order
//        32 bits of the remote control for each slot.  These are combined with
//        the low-order 32 bits from variable 251 below to form a 64-bit code.
//          byte 3 = Command slot number (1..MAX_IR_CODES)
//          byte 4 = bits 32..39 of remote control command code
//          byte 5 = bits 40..47
//          byte 6 = bits 48..55
//          byte 7 = bits 56..63
// 251 -> IR remote control commands - code part 1.  This stores the protocol
//        identifier and low-order 32 bits of the remote control code for each
//        remote control command slot.  The code represents a key press on a
//        remote, and is usually determined by reading it from the device's
//        actual remote via the IR sensor input feature.  These codes combine
//        with variable 250 above to form a 64-bit code for each slot.
//        See IRRemote/IRProtocolID.h for the protocol ID codes.
//          byte 3 = Command slot number (1..MAX_IR_CODES)
//          byte 4 = protocol ID
//          byte 5 = bits 0..7 of remote control command code
//          byte 6 = bits 8..15
//          byte 7 = bits 16..23
//          byte 8 = bits 24..31
// 252 -> IR remote control commands - control information.  This stores
//        descriptive information for each remote control command slot.
//        The IR code for each slot is stored in the corresponding array
//        entry in variables 251 & 250 above; the information is split over
//        several variables like this because of the 8-byte command message 
//        size in our USB protocol (which we use for LedWiz compatibility).
//          byte 3 = Command slot number (1..MAX_IR_CODES)
//          byte 4 = bit flags:
//                     0x01 -> send this code as a TV ON signal at system start
//                     0x02 -> use "ditto" codes when sending the command
//          byte 5 = key type; same as the key type in an input button variable
//          byte 6 = key code; same as the key code in an input button variable
//        Each IR command slot can serve three purposes:
//        - First, it can be used as part of the TV ON sequence when the 
//          system powers up, to turn on cabinet TVs that don't power up by 
//          themselves.  To use this feature, set the TV ON bit in the flags.  
//        - Second, when the IR sensor receives a command in a given slot, we 
//          can translate it into a keyboard key or joystick button press sent
//          to the PC.  This lets you use any IR remote to send commands to the
//          PC, allowing access to additional control inputs without any extra
//          buttons on the cabinet.  To use this feature, assign the key to
//          send in the key type and key code bytes.
//        - Third, we can send a given IR command when a physical cabinet
//          button is pressed.  This lets you use cabinet buttons to send IR 
//          commands to other devices in your system.  For example, you could 
//          assign cabinet buttons to control the volume on a cab TV.  To use
//          this feature, assign an IR slot as a button function in the button
//          setup.
// 253 -> Extended input button setup.  This adds on to the information set by 
//        variable 254 below, accessing additional fields.  The "shifted" key
//        type and code fields assign a secondary meaning to the button that's
//        used when the local Shift button is being held down.  See variable 16 
//        above for more details on the Shift button.
//          byte 3 = Button number (1..MAX_BUTTONS)
//          byte 4 = shifted key type (same codes as "key type" in var 254)
//          byte 5 = shifted key code (same codes as "key code" in var 254)
//          byte 6 = shifted IR command (see "IR command" in var 254)
// 254 -> Input button setup.  This sets up one button; it can be repeated for each
//        button to be configured.  There are MAX_EXT_BUTTONS button slots (see
//        config.h for the constant definition), numbered 1..MAX_EXT_BUTTONS.  Each
//        slot can be configured as a joystick button, a regular keyboard key, or a
//        media control key (mute, volume up, volume down).
//        The bytes of the message are:
//          byte 3 = Button number (1..MAX_BUTTONS)
//          byte 4 = GPIO pin for the button input; mapped as a DigitalIn port
//          byte 5 = key type reported to PC when button is pushed:
//                    0 = none (no PC input reported when button pushed)
//                    1 = joystick button -> byte 6 is the button number, 1-32
//                    2 = regular keyboard key -> byte 6 is the USB key code (see below)
//                    3 = media key -> byte 6 is the USB media control code (see below)
//          byte 6 = key code, which depends on the key type in byte 5
//          byte 7 = flags - a combination of these bit values:
//                    0x01 = pulse mode.  This reports a physical on/off switch's state
//                           to the host as a brief key press whenever the switch changes
//                           state.  This is useful for the VPinMAME Coin Door button,
//                           which requires the End key to be pressed each time the
//                           door changes state.
//          byte 8 = IR command to transmit when unshifted button is pressed.  This
//                   contains an IR slot number (1..MAX_IR_CODES), or 0 if no code
//                   is associated with the button.
// 255 -> LedWiz output port setup.  This sets up one output port; it can be repeated
//        for each port to be configured.  There are 128 possible slots for output ports, 
//        numbered 1 to 128.  The number of ports atcually active is determined by
//        the first DISABLED port (type 0).  For example, if ports 1-32 are set as GPIO
//        outputs and port 33 is disabled, we'll report to the host that we have 32 ports,
//        regardless of the settings for post 34 and higher.
//        The bytes of the message are:
//          byte 3 = LedWiz port number (1 to MAX_OUT_PORTS)
//          byte 4 = physical output type:
//                    0 = Disabled.  This output isn't used, and isn't visible to the
//                        LedWiz/DOF software on the host.  The FIRST disabled port
//                        determines the number of ports visible to the host - ALL ports
//                        after the first disabled port are also implicitly disabled.
//                    1 = GPIO PWM output: connected to GPIO pin specified in byte 5,
//                        operating in PWM mode.  Note that only a subset of KL25Z GPIO
//                        ports are PWM-capable.
//                    2 = GPIO Digital output: connected to GPIO pin specified in byte 5,
//                        operating in digital mode.  Digital ports can only be set ON
//                        or OFF, with no brightness/intensity control.  All pins can be
//                        used in this mode.
//                    3 = TLC5940 port: connected to TLC5940 output port number specified 
//                        in byte 5.  Ports are numbered sequentially starting from port 0
//                        for the first output (OUT0) on the first chip in the daisy chain.
//                    4 = 74HC595 port: connected to 74HC595 output port specified in byte 5.
//                        As with the TLC5940 outputs, ports are numbered sequentially from 0
//                        for the first output on the first chip in the daisy chain.
//                    5 = Virtual output: this output port exists for the purposes of the
//                        LedWiz/DOF software on the host, but isn't physically connected
//                        to any output device.  This can be used to create a virtual output
//                        for the DOF ZB Launch Ball signal, for example, or simply as a
//                        placeholder in the LedWiz port numbering.  The physical output ID 
//                        (byte 5) is ignored for this port type.
//          byte 5 = physical output port, interpreted according to the value in byte 4
//          byte 6 = flags: a combination of these bit values:
//                    0x01 = active-high output (0V on output turns attached device ON)
//                    0x02 = noisemaker device: disable this output when "night mode" is engaged
//                    0x04 = apply gamma correction to this output
//        Note that the on-board LED segments can be used as LedWiz output ports.  This
//        is useful for testing a new installation with DOF or other PC software without
//        having to connect any external devices.  Assigning the on-board LED segments to
//        output ports overrides their normal status/diagnostic display use, so the normal
//        status flash pattern won't appear when they're used this way.

// In USB messages that specify GPIO pin assignments, pins are identified by
// 8-bit integers.  The special value 0xFF means NC (not connected).  All actual
// pins are mapped with the port number in the top 3 bits and the pin number in
// the bottom 5 bits.  Port A=0, B=1, ..., E=4.  For example, PTC7 is port C (2)
// pin 7, so it's represented as (2 << 5) | 7.

// For regular keyboard keys, we use the standard USB HID scan codes
// for the US keyboard layout.  The scan codes are defined by the USB
// HID specifications; you can find a full list in the official USB
// specs.  Some common codes are listed below as a quick reference.
//    Key name         -> USB scan code (hex)
//    A-Z              -> 04-1D
//    top row 1!->0)   -> 1E-27
//    Return           -> 28
//    Escape           -> 29
//    Backspace        -> 2A
//    Tab              -> 2B
//    Spacebar         -> 2C
//    -_               -> 2D
//    =+               -> 2E
//    [{               -> 2F
//    ]}               -> 30
//    \|               -> 31
//    ;:               -> 33
//    '"               -> 34
//    `~               -> 35
//    ,<               -> 36
//    .>               -> 37
//    /?               -> 38
//    Caps Lock        -> 39
//    F1-F12           -> 3A-45
//    F13-F24          -> 68-73
//    Print Screen     -> 46
//    Scroll Lock      -> 47
//    Pause            -> 48
//    Insert           -> 49
//    Home             -> 4A
//    Page Up          -> 4B
//    Del              -> 4C
//    End              -> 4D
//    Page Down        -> 4E
//    Right Arrow      -> 4F
//    Left Arrow       -> 50
//    Down Arrow       -> 51
//    Up Arrow         -> 52
//    Num Lock/Clear   -> 53
//    Keypad / * - +   -> 54 55 56 57
//    Keypad Enter     -> 58
//    Keypad 1-9       -> 59-61
//    Keypad 0         -> 62
//    Keypad .         -> 63
//    Mute             -> 7F
//    Volume Up        -> 80
//    Volume Down      -> 81
//    Left Control     -> E0
//    Left Shift       -> E1
//    Left Alt         -> E2
//    Left GUI         -> E3
//    Right Control    -> E4
//    Right Shift      -> E5
//    Right Alt        -> E6
//    Right GUI        -> E7
// Due to limitations in Windows, there's a limit of 6 regular keys
// pressed at the same time.  The shift keys in the E0-E7 range don't
// count against this limit, though, since they're encoded as modifier
// keys; all of these can be pressed at the same time in addition to 6
// regular keys.

// Buttons mapped to type 3 are Media Control buttons.  These select
// a small set of common media control functions.  We recognize the
// following type codes only:
//   Mute              -> E2
//   Volume up         -> E9
//   Volume Down       -> EA
//   Next Track        -> B5
//   Previous Track    -> B6
//   Stop              -> B7
//   Play/Pause        -> CD