Renault "Tuner List" Head Unit/CD changer hacking - Controls

**Vicne** · 02-26-2006, 08:49 AM

Hi,
Following the suggestion of pippolippi in post #183, I found that a scope is not needed to determine if it's voltage or current-based.
What I did (log below) was this :
1) disconnect pin 14 at the head-unit (open circuit at switch A in circuit of post #197) and power on the HU. The spying circuit logs "BOOTING" messages over and over from the CDC (it can read them even if there's no load to terminate the circuit, so it's voltage based), but no acknowledge of course as the HU doesn't receive the messages. It also doesn't allow to switch source to CDC of course.
2) reconnect pin 14 to the HU, but this time, disconnect pin 13 at the CDC (open circuit at switch B in circuit of post #197) and power on the HU. In this case, the spying circuit logs "BOOTING" messages from the CDC and acknowledges from the HU (acknowledges can be read even if there's no load to terminate the circuit), but the CDC sends "BOOTING" over and over as it doesn't receive an acknowledge, so it doesn't switch to the "STANDBY" message which (seemingly) would allow to change source to the CDC.

Conclusion : the communication is voltage based in both directions.

Here's the detailed "script" and associated logs :
-- normal operation
0 : start capture
15 : turn HU on (tuner)
30 : switch source to CDC
45 : switch source to tuner
60 : turn HU off
75 : open circuit in A
90 : turn HU on
105 : try to switch source to CDC (refused)
120 : turn HU off
135 : close circuit in A
150 : open circuit in B
165 : turn HU on
180 : try to switch source to CDC (refused)
... misc operations on tuner position.

**Vicne** · 02-26-2006, 09:14 AM

Thanks for the feedback.

Originally Posted by Ale

It's ok for the side HUTX -> PCRX only if HUTX isn't an open collector, becouse with an open line the output level is unknown (can be 0 or +12v).

Well, I guess in that case we'd just have to put a pull up... but the tests I made in my previous post seem to show I can read trafic in both directions so it probably isn't an open collector or the MAX's internal 5K would have dragged the voltage down to 0 all the time, right ?

For the side PCTX-> HURX i'am not sure it will work becouse when the tx line goes negative with the resistor divider 1K-5.8K the input V- of opamp will be exposed to a negative voltage causing a malfunctioning of the output. (from datasheet Note 6: This input current will only exist when the voltage at any of the input leads is driven negative. It is due to the collector-base junction of the input PNP
transistors becoming forward biased and thereby acting as input diode clamps. In addition to this diode action, there is also lateral NPN parasitic transistor action on the IC chip. This transistor action can cause the output voltages of the op amps to go to the V+voltage level (or to ground for a large overdrive) for the time duration
that an input is driven negative. This is not destructive and normal output states will re-establish when the input voltage, which was negative, again returns to a value greater than −0.3V.)

True... I'd be tempted to put a diode but well, you might end up thinking I have a stock of diodes I absolutely want to use :-).
I could also let both the MAX and the LM324, but I want it to be as simple as possible.

What would you suggest ?

**Vicne** · 02-26-2006, 09:28 AM

Originally Posted by pippolippi

from the 232 to the HU I think that you could safely leave the threshold at 0 (i.e. connect pin 9 directly to ground)

You're right that with 2V hysteresis (isn't it too much ?), I should probably put the threshold a bit lower. However, the Op Amps don't have a dual (-12/+12) supply, so they're unable to compare "negative" and "zero", and as Ale says, maybe they won't support negative voltage at all, so I think 0 is unsuitable

for the other threshold either it's not critical or if it turns out to be you need a stabilized reference, I don't know where you're going to take the 12v but I doubt that if they come from the car battery they're stable

I have a few solutions for the 12V :
- direct car 12V, this one isn't stable for sure
- 12V coming out of the HU (as either permanent or better, "remote"). No idea if it's regulated, but that's what Connects2 use...
- 12V coming from the PC's PSU. This one is regulated for sure, so it's probably the best choice.
Anyway, I should probably put 2 capacitors (on pins 2 and 9) to stabilize the comparison value.

the bridges 1-6-4 and 7-8 in the rs232 connecor are unnecessary, after all you're writing your own software so you can ignore those signals. Connecting 2, 3 and 5 is enough (probably using one of 6-DSR or 8-CTS for the remote signal)

True. However, reusing these signals isn't the "main" project, so I'll do that only after everything else works :-)

**pippolippi** · 02-26-2006, 09:43 AM

I just repeated without success

my test with no interface (just a divider network on input and a diode on output, I tried even without a diode).
The only thing I can say is that I have steady 9V on pin 14 even with nothing connected.
I'm pretty sure of the numbering since I can read the remote signal on pin 17 (however I suspect it's left floating when the HU is switched off since it's not always reliable in detecting that the HU is off).

**Ale** · 02-26-2006, 09:56 AM

Originally Posted by Vicne

What would you suggest ?

I think that becouse the PC RS232 has already an interface like max232, we can design a very simple circuit, without max232 and only one PNP transistor. I assume that the high level +9V that out on PCTX will be enough to drive the HURX to high level. Or we can use an NPN with a pullup and the diode protection for the negative level. See my attachement... Edit (we need to be sure that a value of 5K for R1 can draw to level 0 the HURX pin 14, or we can use a lower value)

Now I have a USB->RS232 cable and i'm looking for the miniISO connector to build my interface, as soon as i found it i will test this circuit.
Bye
Ale
Edit : I removed this schematic becouse after a check with datasheet general purpose transistor can't sustain reversal voltage emitter-base greater than 5V, and i don't like to add a lot of diode protection...
So I changed it with a more functional version using max3232 receiver inverter (output is ttl level) and a NPN inverter for shifting to 12v level(open collector if pin 14 already has pullup).

**Vicne** · 02-26-2006, 11:53 AM

I did the last few tests I had in mind, regarding behaviour when the CD tray has some empty slots, and automatic track change (at the end of the previous one and not manually forced).
Here's the "script" :
(removed CDs #1 & 3 from tray)
0 : start capture
15 : start HU
30 : switch to CDC (CD2 plays)
45 : press CD3 (displays NO CD)
60 : press CD4
75 : press CD1 (NO CD)
90 : press CD2
105 : press and hold NEXT (FFWD begins)
140 : release NEXT (FFWD stops)
365 : (track reaches the end and changer switches to track 2)
420 : go to last track of CD and cue it near the end
480 : (track reaches the end and changer switches to TR1 CD4)
540 : press and hold CD1 (random on, skips to track 9)
570 : cue to end of track
620 : (track reaches the end and CD switches to track 5)
670 : turn HU off

What do we learn ?

- CD change requests are sent to the changer even though the CD is not present. The changer then replies with a few messages to the head unit which cause "NO CD" to be displayed for a few seconds

- When a track reaches the end, several TRACK_CHANGE (27h) messages are sent by the CDC to the HU. In the simplest case (playing continues from track 1 to track 2), we get two TRACK_CHANGE with the following data :
20h 01h 22h for "end of track 1"
10h 02h 22h for "start of track 2"

**Vicne** · 02-26-2006, 11:59 AM

Originally Posted by pippolippi

I'm pretty sure of the numbering since I can read the remote signal on pin 17 (however I suspect it's left floating when the HU is switched off since it's not always reliable in detecting that the HU is off).

It wouldn't be surprising that it's floating when HU is off. You could just put a resistor to the ground to make sure, but with a simple voltmeter you should see the voltage drop to zero when off

**pippolippi** · 02-26-2006, 12:15 PM

Originally Posted by Vicne

It wouldn't be surprising that it's floating when HU is off. You could just put a resistor to the ground to make sure, but with a simple voltmeter you should see the voltage drop to zero when off

Well, yes, but this doesn't bother me. What bothers me is the steady 9V on pin 14.

**Vicne** · 02-26-2006, 12:20 PM

Originally Posted by Ale

I think that becouse the PC RS232 has already an interface like max232, we can design a very simple circuit, without max232 and only one PNP transistor. I assume that the high level +9V that out on PCTX will be enough to drive the HURX to high level

Well, *if* the PC's high level is +9V, yes, but strict RS232 only needs +5V if I'm not mistaken, and I wouldn't like that interface to work "sometimes"...

Or we can use an NPN with a pullup and the diode protection for the negative level. See my attachement... Edit (we need to be sure that a value of 5K for R1 can draw to level 0 the HURX pin 14, or we can use a lower value)

I like that :-). I think I'll go that way.

I think the first try I'll make is transform the spying circuit to just replace it by 2 resistors and check how it works.

Now I have a USB->RS232 cable and i'm looking for the miniISO connector to build my interface, as soon as i found it i will test this circuit.

Great.
As I said, I have found (and tested) two ways of getting one : full Blaupunkt extender (useful for me to get both M and F plugs) for 16 EUR or eBay. The connector (+ contacts) costs 5 EUR (+4 EUR S/H for Belgium) at http://stores.ebay.de/ADAPTERSHOP (search on "blau"). Others sell it under the name "mini-iso" but some don't include the contacts.