Renault "Tuner List" Head Unit/CD changer hacking - Controls

**Vicne** · 02-13-2006, 05:58 AM

Originally Posted by Putput

Could this perhaps be the answer to the 3D - 3F phenomenon?

Don't think so. The spy circuit should take care of the 3V 12V input. The adaptation I talked about is only needed on the output side...

Question about wiring, can you tell me what to connect to pin 17? I found this URL http://perso.wanadoo.fr/sebire.phili...hargeur_cd.htm explaining all details except if pin 17 is in or out and what voltage it carries? I assume that its an input for the CDC telling that the HU is active but I have to be sure before I fry my HU.

Well, it's called "Remote out" so most probably it's an indication from the head unit indeed.

Pin 16 is permanent 12V, and that allows e.g. for CD tray ejection even if the head unit is OFF, while Pin 17 would tell the CDC to get ready and start sending its "I'm alive" frames once the HU is switched on.

OTOH, on the other pinout I found (see here), Pin 17 was called "Antenne +" which is rather strange *but* is the same label as a pin of the big iso power connector of the head unit, so that could mean it's a "forwarded" ACC indicator... Some measures of its voltage could confirm that.

Anyway, I would advise not to connect anything to it. This is for sure less risky than putting it on 220V :-).

Mox, can you check on your connects2 if pin 17 is connected to something ? Maybe you have hi-res pictures of the PCB ?

By the way, it would be very interesting to know if the connects2 follows the same "3V/12V" convention. It would be easier to do 0V/12V if it's compatible, but if connects2 bothered making 3V/12V, it's probably a requirement...

**pippolippi** · 02-13-2006, 06:47 AM

Originally Posted by Vicne

Never heard of that. Funny hack. I'll try tonight and see the results.
Where did you learn that, if not confidential ? Maybe the source of this trick also knows much more about this damn head unit :-)

It's not confidential, I found it here.
It's an ongoing thread and probably more tricks are coming, but I've been following that forum for a while and, though there's some nice hack there, nobody ever told he knew the protocol

Anyway I'll ask
For those that don't understand spanish, the tricks are:

Press 1 and 6 at once to see the frequency and the signal quality (from 0=bad to F=very good).

Press 3 while turning on the unit for a key test (what I explained earlier)

Press 1 and 2 to see the total running time (TU tuner, TA tape, CD cd, TO total)

**slimmegane** · 02-13-2006, 09:33 AM

Hi all,
I've found this post only now, my ideas is to send the mp3 track title to the original display, someone have news about this? How can I help you? I've carpc already installed but I'vent the HU. My car is the Megane2

Bye,
Antonio
Italy

**Vicne** · 02-13-2006, 10:18 AM

Originally Posted by slimmegane

Hi all,
I've found this post only now, my ideas is to send the mp3 track title to the original display, someone have news about this?

That was the Holy Grail indeed, but unfortunately preliminary decoding of the protocol seems to show that the CD changer sends informations to the head unit in the form of numbers (track #, cd #, time) and not in alphanumeric form. It's a pity because the display is alphanumeric (to show RDS information for example)... (*)

How can I help you? I've carpc already installed but I'vent the HU. My car is the Megane2

Well, you can help in numerous ways, but if you haven't the head unit anymore, one of the hottest topic is to understand the protocol, so you can download the latest dumps from post #51 above and try to find a reliable way of decoding frames.

Vicne

(*)Maybe after we finish this project, we can try to hack the yellow connector between head unit and stalk + display :-)

**pippolippi** · 02-13-2006, 01:17 PM

Breaking news

The serial interface of the changer (so probably the HU too) can be connected directly to an rs232 port.
See the second post (by CristianC) in this page.
Not that I understand romanian, but it seems this folk connected directly the changer to a pc rs232 port and saw this: 3D 01 FE FD 3D 01 FE FD 3D 01 FE FD.
Sounds familiar?

**pippolippi** · 02-13-2006, 01:31 PM

OTOH here mox says that the connects2 uses an ba8270f to interface to the head unit and I don't see how this chip could be used if HU interface is compatible with a simple rs232

**Vicne** · 02-13-2006, 02:58 PM

Originally Posted by pippolippi

Not that I understand romanian, but it seems this folk connected directly the changer to a pc rs232 port and saw this: 3D 01 FE FD 3D 01 FE FD 3D 01 FE FD.

Well, directly seems a bit risky to me, but it could work.
The official RS232 standard states, if I'm not mistaken, that positive level must be between 5 and 15 and negative between -5 and -15 for emission, and accepted with positive between 3 and 25 and negative between -3 and -25 for reception devices.
So normally, any voltage received between -3 and +3 volt falls into the "unspecified" range and should be avoided.
This being said, many PCs place their threshold at a positive voltage (e.g. 2.5V), so that devices that cannot produce negative voltage can be received too.
Some PCs (notably laptop) even *send* 0V for "negative", to avoid the hassle of a voltage pump to provide the negative voltage (the main goal of the MAX232).
So with a divider, I easily believe the MAX232 is not really needed on input, but seeing its price, I prefer to keep it and be on the safe side - theoretically at least :-)

**Ale** · 02-13-2006, 04:26 PM

Hi, I wish to share my analisys of start-sequence data exchange of HU-CDC in Excel.
There is also the useful column CrcCheck that can help to correct rx errors.
The errors can be due to some noise in power supply, or the resistor divider mounted too far from max232 pin. Try to filter +5V of max232 with a couple of capacitor 10uF+0.1uF.

Best Regards
Ale

**Vicne** · 02-13-2006, 05:47 PM

Originally Posted by Ale

The errors can be due to some noise in power supply, or the resistor divider mounted too far from max232 pin. Try to filter +5V of max232 with a couple of capacitor 10uF+0.1uF.

Well, I completely agree that it looks more like a periodic spike than a threshold problem, and I'd really like to get rid of it first. Regarding my power supply, well it's err... a 4.5V battery, so I guess it's rather stable, but maybe I'm mistaken. I have a 0.1uF but I could add a 10uF if you think i would improve something - obviously you have much more experience than I do :-)

Here's a picture of my test breadboard. Well, OK, I'm a bit ashamed of the look, but it helps changing the values around :-)

**pippolippi** · 02-13-2006, 06:11 PM

Originally Posted by Vicne

Well, directly seems a bit risky to me, but it could work.

I agree that sending from the pc to the head unit may be riskier if the HU cannot accept the negative voltages, but just spying should be no problem: the pc serial port has no problem with those levels, the worst that can happen is that it won't decode the incoming characters. OTOH it's your car so you've every right to be cautious

Thread: Renault "Tuner List" Head Unit/CD changer hacking - Controls

LinkBack

Thread Tools

Search Thread

Display

Bookmarks

Bookmarks

Posting Permissions