Renault "Tuner List" Head Unit/CD changer hacking - Controls - Page 10

Ale · 02-19-2006, 02:49 PM

Quote: Originally Posted by Vicne

Let me try to do this as a homework and correct me if I'm wrong, OK ? :-)

yes that is all correct, almost all rs232 threshold shuold be near 1.5-2V, so our buffered out 0/12V should work well.

Quote: Originally Posted by Vicne

A question : If the HU TX is terminated with a transistor and a pull-up resistor, don't you fear the 22k resistor will drag the voltage down too much ?

Yes, we can choose a higher value like 47K, but i think that HU-TX line to guarantee the noise immunity doesn't has a high impedance value.
The R1 and R2 protect the buffer from negative voltage of rs232, thanks to the internal diodes protection, limiting the negative input current to -12v/47K=255uA.

I want to use my notebook for the test but it has only a IRDA interface on COM3, so i looking for an adapter RS232-IRDA that i will connect to my interface so i don't have to worry about spike or short circuit with the notebook.
My first goal will be to test the emulator protocol, I have found a MSCOMM32.OCX that i want to use with VBA & EXCEL.
The second goal will be to build an hardware interface for AUX input.
When i have a well working sw i will think how to port it to a PIC (but i haven't experience with PIC).
It will be very interesting to find a Analog/SPDIF small module becouse assembling a test board will be very difficult without a industrial printed-circuit.

Vicne · 02-19-2006, 02:53 PM

Quote: Originally Posted by pippolippi

Yes, an usb one (my laptop doesn't have an integrated serial port)

OK, I see.

Quote:

I thought about putting a divider (like CristianC), but until next weekend I don't think I'll have time to tinker with it

(edit: btw, I put a diode in the tx line, in order to avoid to inject negative voltages to the hu, but I didn't connect it. Oh, and since I don't have a blue mini iso connector I just used 2.8mm fastons with a little tape to avoid contact between adjacent pins

)

Better avoid that indeed :-) .

Quote:

I don't have a cdc, so my little program is an attempt at an emulator.

Oh, yes, that's true !
But in this case, don't despair. I myself never saw anything coming from the HU while the CDC was in "remote off" mode (see this post and the attached log.
Only CristianC said he saw data coming from the headunit when no CDC was connected... So either he doesn't have the exact same HU as me, or he made a certain operation on the head unit that I didn't do to get data on there (try to change source maybe ?)...

In my case, it' always the CDC that does the first step, so I guess you'll have to do actual emulation before you receive anything...

Quote:

and I doubt MTTTY would work under Linux

Yes, that's a "detail" I missed :-)

Vicne · 02-19-2006, 03:01 PM

Quote: Originally Posted by Ale

Yes, we can choose a higher value like 47K, but i think that HU-TX line to guarantee the noise immunity doesn't has a high impedance value.

That's where experience speaks :-)

Quote:

The R1 and R2 protect the buffer from negative voltage of rs232, thanks to the internal diodes protection, limiting the negative input current to -12v/47K=255uA.

OK, I see.

Quote:

I want to use my notebook for the test but it has only a IRDA interface on COM3, so i looking for an adapter RS232-IRDA that i will connect to my interface so i don't have to worry about spike or short circuit with the notebook.

Yes, that'd be super safe indeed... If you put it at one meter or so behind plexiglass, the adapter can even explode without your PC being endangered :-)

Quote:

My first goal will be to test the emulator protocol, I have found a MSCOMM32.OCX that i want to use with VBA & EXCEL.
The second goal will be to build an hardware interface for AUX input.
When i have a well working sw i will think how to port it to a PIC.

With a little bit of chance, we'll soon have :
- A delphi emulator
- A python emulator
- A visual basic emulator
- A pic emulator
- An mp3 player speaking directly to the head unit

Wow, I like that :-). I'm rethinking of Visual C, because it'd be so coooool to have one emulator more :-). Then we can make a contest and distribute prizes :-)

Quote:

(but i haven't experience with PIC).
It will be very interesting to find a Analog/SPDIF small module becouse assembling a test board will be very difficult without a industrial printed-circuit.

I think you might team up with mox who had the same idea from the beginning.
As for the Analog/SPDIF, here is the Connects2 solution :

Quote: Originally Posted by mox

Analog-to-SPDIF:
TL064 (stereo AF amp), linked to a 5331AKS (stereo A/D converter with serial output), linked to a CS8405A (SPDIF encoder), linked to the HU's SPDIF input.

(see http://www.mp3car.com/vbulletin/show...1&postcount=13 )

Vicne · 02-19-2006, 07:30 PM

OK, here's an Excel file summarizing the status of the decoding.
The second sheet is the data from the last two logs, formated thanks to Putput's decoder and interleaved along with the "script". Operations and results come in the first few columns, then data coming from the head unit and finally on the right data coming from the cd changer.

As usual, take care that due to multithreading issues and my own imprecision in executing commands, some lines may be swapped between the three sets (acknoledgements before command, etc).

The first sheet summarizes the general frame format, as well as all frames encountered in the (rather comprehensive) logs, a tentative explanation, a symbolic name and an example. Note that most of the HU > CDC part was directly taken from Ale's decoding. The CDC > HU was where I put the most work, but is still far from complete. The first column of this sheet represents my estimation of the reliability of our decoding (V = ok, I = incomplete, ? = speculation)

Of course, we don't need 100% completeness to write a successful emulator, but the more we understand, the easier troubleshooting will be.

Side note about CRC errors and re-synchronization (Putput) :
These logs didn't have any error except that the head unit was once turned off while CDC was sending a frame. In that case, Putput's parser read the following bytes as if they were an actual frame, found what he thought was the "CRC", and dropped the whole "frame" as CRC was wrong, starting with the next byte and propagating the de-synchronisation. A more robust approach would probably be that if the first byte of a frame isn't 3Dh, we just skip that *byte* and go on with the next one *without dropping any frame*. The XLS version attached has been fixed manually in that regard

Feel free to check, complete, enhance, document or correct this information, of course.

**OUT OF DATE. AN UPDATE OF THE ROSETTA STONE IS AVAILABLE IN A POST FURTHER BELOW **

CristianC · 02-20-2006, 02:52 AM

Hello

My HU is Philips 22DC229/62

When I start the HU, I see on the PC terminal screen: 3D 01 FE FD 3D 01 FE FD 3D 01 FE FD

!!! The terminal was set to display hex format

CristianC

Vicne · 02-20-2006, 03:30 AM

Quote: Originally Posted by CristianC

My HU is Philips 22DC229/62

When I start the HU, I see on the PC terminal screen: 3D 01 FE FD 3D 01 FE FD 3D 01 FE FD

!!! The terminal was set to display hex format

That's really strange. I'll have to check my exact model number tonight - I should have given it from the start in fact.

pippolippi · 02-20-2006, 12:02 PM

Quote: Originally Posted by Vicne

That's really strange. I'll have to check my exact model number tonight - I should have given it from the start in fact.

The tuner list is made by VDO, not philips. It's possible that the protocol is the same.
Anyway, I repeated my experiment with a divider (18k/18k, what I had at hand, so half the voltage) and still nothing: the receive led doesn't light up this time, but the level is critical, since if I touch the connector it will light up and stay lit until I turn off the HU.
I also tried to connect the tx line (with a diode) to send the start sequence with no success. I think that the usb adapter gives too low a voltage, with a compliant serial port it works but not with the HU (since it probably needs the full 12V). Either that or I fried my HU

So I'll have to wait until someone comes up with a proper conversion circuit.

Putput · 02-20-2006, 12:48 PM

Quote: Originally Posted by pippolippi

The tuner list is made by VDO, not philips. It's possible that the protocol is the same.

The Tuner List models are indeed made by VDO Dayton but VDO Dayton took over the car stereo business from Philips a few years ago. And the inside of the Tuner List and Update List is still filled with Philips components. I know because I opened my Update List HU and saw the inside. The DSP used is a SAA7709H from Philips.

Vicne · 02-20-2006, 03:16 PM

Well, there seems to be multiple head units called "Tuner List" :
- The 22DC229/62 that CristianC has
- The 22DC259/62 mentioned on this page
- Mine, which has none of the above indications, but rather RENRDW131-10, from a 2005 Scénic II. See pictures below.

It would probably be interesting to list all of our head-unit models (with car model and year, and pictures maybe).

But the fact is that different models could explain the differences in the protocol. Although I think we can find a common emulator, because as far as I know, the same CD changers can be used on multiple, if not all Tuner List head units.

Ale · 02-20-2006, 05:49 PM

Quote: Originally Posted by Vicne

It would probably be interesting to list all of our head-unit models (with car model and year, and pictures maybe).

I have found this table at RueDuCommerce

CristianC · 02-20-2006, 11:55 PM

HU: 22DC229/62

Vicne · 02-21-2006, 01:57 AM

Quote: Originally Posted by Ale

I have found this table at RueDuCommerce

Very interesting.

So for the ones who speak zero-french, the information above is the compatibility table for the VDO/Dayton CHM 604 MP3 CD changer. Please note that this changer is configurable as digital or analog output. As you can see, it works on "all references" for Renault cars of 2004 and 2005, while it is limited to the given models for previous years.

Please note that CristianC's DC229 is indeed referenced as compatible for Twingo II of 2002 and 2003...

Pippolippi, is your model referenced as compatible ?

peppuz79 · 02-21-2006, 02:43 AM

My HU 22DC277/62..

bye
pep

mox · 02-21-2006, 05:15 AM

22DC278/62H (2003 Clio)

Putput · 02-21-2006, 06:47 AM

Mine is a RDW240-00.