pcp

Hi everyone,

Here's a new thread to keep this work separate from Vicne's overflowing Tuner List thread. I got hold of a Philips RC026 CD changer. I snooped at communications between the changer and my Renault Radiosat 6010 aka. Philips 22/dc461 (or some other number, can't remember out of my head).
This one is in Renaults prior to 2000. After 2000, Tuner List and Update list are the radios of choice. Please refer to Vicne's thread here.

The Renault Radiosat 6010 is quite basic. When playing CDs, it displays only CD and track number, no run time info. Other Philips branded HUs display run time info. I used one for testing, and found data traffic on the D2B bus is massively increased compared to the 6010.
While I have quite a batch of data from the Philips branded radio (I don't have the model right now), I probably won't bother analysing it, as that particular radio has a setting to toggle between Aux in and cd changer on that port, so no need to emulate.

Basics
Basic communication is dual-rail asyncronous.
After power on, the voltage of the two pins rises to about 2.48V. Data is encoded as 0 = ca. 250mV voltage difference (125mV per rail), or 1 = 0 voltage difference plus a spike. So a zero would be mostly 250mV, plus a short return-to-0 pulse at the end. A one would be a short start spike, then return to 0. This ensures several zeros or ones are separable. If there is a 1-0 or 0-1 transition, then the short spikes are merged/ omitted.
Current flowing on the bus is between 0 and 2.5mA (from CD to HU) or -1mA (from HU to CD), which seems too low for current mode signaling. [Thanks for the suggestion, Theo!]
The basic protocol consists of init-recipient-sender-message_start-message

init is 0 [270us] 1 [60us] 0 [20us] 1 [120us]
recipient is a 13 bit address, sent at different timing than the rest of the message. 0=250mV,30us;0mV,20us or 1=250mV pulse (2us); 0mV,40us. Total length of 0 is 50us, 1 is 40us.
sender is 14 bits, the 13 bit address to be used for response plus one bit that I haven't made sense of (maybe odd parity). From now on, a faster timing is used. 0=250mV,24us;0mV,4-6us 1=250mV,6us;0mV,20us.
message_start is 11100
message is sent in 10 bit chunks, with either a pause or an ack pulse between each. (this one needs tbc as well)

Addresses
I tested with two head units, one Renault one Philips [Thanks again for lending me the radio, Theo!]. HU address was constant in both cases.
Address 13'b1 seems to be used by the HU to send a message to advertise its address. Assumed to be "to all"
HU to CD changer will send 13'b0000111001000 (recipient) and 14'b10001100100000 (sender)
CD to HU = 13'b0000110010000 (recipient) and 14'b00001110010001 (sender)


Messages
Message split in 10 bit chunks - 8 bits of data, 1 bit "end of message", 1 bit odd parity. After each chunk, recipient responds with '1' as ack.

1st chunk = number of chunks in message (including this one)
2nd chunk seems to depend on sender
3rd chunk = ?
4th chunk command / previous command (when responding)
5th chunk parameter 1
6th chunk parameter .
....

More random info
commands start with 1100, status reports with 0100 (tbc)
Data/ parameters seem to have constant first four bits (0011) and then payload encoded as binary coded decimal, with each digit in a separate data chunk.


Further reading/ files
cd1-tr1->tr2.zip - sample raw waveform exported to CSV&EPS, directly from 'scope. Command executed was 'next track'.
Channel 1 = d2b to ground (plus or minus, I can't remember)
Channel 2 = d2b+ to d2b- (or vice versa)

data_spreadsheet.zip - transcribed data, as in ODS (open document spreadsheet). Some annotations.

The ugly further reading: If you understand patent-eze, here are some. Google patents is your friend and will give you full text + images:
5187708 -- has quite similar message structure to what I found
4429384 -- fundamental patent on d2b, shows some circuits and message structure
I found those two the most useful, as they have concrete circuits/ message description.

Any help and comments greatly appreciated!

Attached Files

	cd1-tr1-tr2.zip (23.8 KB, 361 views)
	data_spreadsheet.zip (22.9 KB, 292 views)

Titiben

Hi,
Did you success to create your cd changer emulator?

I have a Peugeot 406coupe MY97 with a Philips radio and cd changer. Some years ago I begin to analyse the cd changer protocol to design an emulator and replace it by MP3 player. Finally I renounced because I had not success to understood its protocol.

During my protocol analysis, I did same observations as you about voltage and timing.
To record messages, I used a RS485 device to convert low dual voltage signals to TTL, connected to a laptop by LPT port, from software side, I used a small program, like data logger, running in kernel mode under Linux to save signal state and timing transition with better accuracy possible.
Next I tried to recognise a protocol, here I failed!!!

So, I will re analyse my logs with your informations. I hope I will able to identify cmd and so on... And give a feedback...

pcp

Hi Titiben,

great to hear that there are more people wanting to use such an emulator.

The current status is that I have written some PIC code that should be working, but I got a bit lazy and haven't de-bugged it nor have I compled the driver circuit for the radio. It isn't too far off completion, but I got busy first, then lazy. I will let you know when I give it the final push!

PCP

pcp

Oh.. and also - what radio do you use?
Does it look like the Renault one? Does it show you minutes + seconds when playing cds?
I tested another Philips radio that required the cd changer to report the timing, which I haven't implemented in my variant. That radio had a basic setting which allowed the Aux in to be enabled, even without a cd changer, so I figured it would be wasted effort.

Titiben

Hi PCP,

Which kind of driver do you use between your PIC and cd changer bus?
Is my RS485 hypothesis valid?

I try to re analyse my data next week-end.

Titiben

pcp

Hi Titiben,

I was going to use a simple two transistor circuit and some resistors. I found a diagram in one of the patent documents. HOWEVER, I haven't tested it to check that it gives appropriate voltage levels, nor that it is fast enough. Basically the resistances are known (and the values I measured were the same as in that patent document), so adding some transistors to switch should work, if a bit crudely.

I haven't explored the RS485 direction, so I can't say whether it works.

I won't have time myself this weekend, but might after that. It is good that I have a reason to complete the task that has been lying around for so long!

PCP

Titiben

Hi PCP,

My radio is 4050 and my CD changer is DC012. The radio display is not include in radio but located in dashboard and this radio does not display cd time information just track and cd number.
In fact it is a quite basic system!

Titiben