Renault "Tuner List" Head Unit/CD changer hacking - Controls - Page 15

Ale · 02-26-2006, 12:20 PM

See my change in schematics at post #205.

pippolippi · 02-26-2006, 01:08 PM

Quote: Originally Posted by Ale

Now I have a USB->RS232 cable and i'm looking for the miniISO connector to build my interface, as soon as i found it i will test this circuit.

For testing you can use normal 2.8mm fastons (non insulated, like these

, note that the picture is the 4.8mm one) with some tape to prevent shorts.
I didn't test with the insulated one

, I don't think it will fit.

pippolippi · 02-26-2006, 01:08 PM

Quote: Originally Posted by Ale

can you check the voltage at pin 14, with a pulldown resistor of 1K, so we can know the value of the internal pullup (if exist) (sould be near 1V)?

Not today, maybe tomorrow.

Vicne · 02-26-2006, 02:42 PM

Quote: Originally Posted by Vicne

I think the first try I'll make is transform the spying circuit to just replace it by 2 resistors and check how it works.

And the answer is : pretty well :-)

So I just threw it all away and only left the two 10k resistors inline between the Rx/Tx of the HU and the serial ports, and all looks well. The only glitch I had was while powering up the Head Unit : the first byte I received was a 0x00000000, so I guess a spike came along the line and was considered a start bit, then 8 data bits were all at zero. The parser should take care of discarding that.

And indeed, the fact that the input impedance is between 3K and 7K is part of the RS232 specification (see http://www.rs485.com/rs485spec.html for example), so putting a 10K resistor in series actually creates a 3:1 divider which makes sure "low" voltage is under the input threshold... but a 5K or even lower could most probably work

I'll try to wire the active part tomorrow.

Vicne · 02-26-2006, 02:52 PM

Quote: Originally Posted by pippolippi

I just repeated without success

my test with no interface (just a divider network on input and a diode on output, I tried even without a diode).

After my few tests with open wires, I see that the original CDC doesn't want to go further if its "BOOTING" messages are not acknowledged. Conversely, maybe the HU doesn't want to acknowledge anything until it has received this first "BOOTING" message...
So what you could try, instead of sending "PLAYING" frames, would be to send "BOOTING" frames and see if they get acknowledged. As they are the first frames sent, you can send the following fixed bytes and see if you get an answer :

3Dh 01h 03h 11h 60h 06h 48h

My tests show that they get repeated by the CDC (without the frame ID being incremented) until he gets an acknowledge, and that the HU ackowledges them all (once again, even though they have the same frame ID), so that looks like a bulletproof test to do.

pippolippi · 02-26-2006, 03:07 PM

Quote: Originally Posted by Vicne

After my few tests with open wires, I see that the original CDC doesn't want to go further if its "BOOTING" messages are not acknowledged. Conversely, maybe the HU doesn't want to acknowledge anything until it has received this first "BOOTING" message...
So what you could try, instead of sending "PLAYING" frames, would be to send "BOOTING" frames and see if they get acknowledged. As they are the first frames sent, you can send the following fixed bytes and see if you get an answer :

3Dh 01h 03h 11h 60h 06h 48h

My tests show that they get repeated by the CDC (without the frame ID being incremented) until he gets an acknowledge, and that the HU ackowledges them all (once again, even though they have the same frame ID), so that looks like a bulletproof test to do.

That's what my test program (in post #132, though I made some changes since then) tries to do, alas without receiving an acknowledgment, so I cannot go further. Mmmh I actually send 00 as sequence, I'll try with 01.

Ale · 02-26-2006, 05:20 PM

After all i'am thinking that the best solution is to use a chip made for rs232, like MC145406 it has already pullup and pulldown resistor, ESD protection etc. We supply only VCC +5V for the digital section (78L05 may be) and VDD+12V from the HU, the negative VSS not used and tied to GND, so we can use the cascaded inverter configuration used till now in the spy circuit, for both direction PCTX->HURX and HUTX->PCRX. Max3232 can't be used becouse of its max V+ of only 7V.

mox · 02-26-2006, 06:15 PM

Quote: Originally Posted by Vicne

So I just threw it all away and only left the two 10k resistors inline between the Rx/Tx of the HU and the serial ports, and all looks well.

A mere glimpse of all the schematics we've seen passing by.

The upcoming weekend appears to be a good time for a trip to Brussels, if that is convenient for you. Sunday, to be more specific, but subject to change. We'll exchange details by PM later this week.

Vicne · 02-27-2006, 03:17 AM

Quote: Originally Posted by Ale

After all i'am thinking that the best solution is to use a chip made for rs232

Agreed.

Quote:

like MC145406 it has already pullup and pulldown resistor, ESD protection etc. We supply only VCC +5V for the digital section (78L05 may be)

Simpler : we have the PC's 5V :-)

Quote:

and VDD+12V from the HU

...or PC too :-)

Quote:

the negative VSS not used and tied to GND, so we can use the cascaded inverter configuration used till now in the spy circuit, for both direction PCTX->HURX and HUTX->PCRX. Max3232 can't be used becouse of its max V+ of only 7V.

Yes.
Although, I asked my local dealer and he has a 15-days delay to order it (and it's 4.6 EUR a unit).
So I'd try to do something with MAX3232 and a few transistors like you proposed in post 205.

Vicne · 02-27-2006, 03:33 AM

Quote: Originally Posted by mox

A mere glimpse of all the schematics we've seen passing by.

Indeed.

By the way, I just thought about something (for the only one of us who has a CDC :-)). I think I'll leave the "reading" part always connected so that even when on CDC position, I can do a special combination (e.g. press pause twice quickly) that would make the PC take the control or release it...

Quote:

The upcoming weekend appears to be a good time for a trip to Brussels, if that is convenient for you. Sunday, to be more specific, but subject to change. We'll exchange details by PM later this week.

Sunday would be fine indeed.

Vicne · 02-27-2006, 06:32 AM

Ale,

Correct me if I'm wrong, but I think we can conclude the CDC output isn't an open collector, because if it was one, I couldn't have read the frames it sent when opening the circuit at point A (as I myself am dragging the output down with the divider).
So if it's not in open collector configuration, then I have to add a pull-up resistor to 12V above the 2N2222 right ?
Problem is : I don't know how much to put there... 5K ?

Circuit building is on its way...

Ale · 02-27-2006, 08:33 AM

[quote=Vicne]Ale,
So if it's not in open collector configuration, then I have to add a pull-up resistor to 12V above the 2N2222 right ?
Problem is : I don't know how much to put there... 5K ?
QUOTE]
First try connecting only a resistor to HURX and verify if with 5K the voltage level is near 12V if not you can lower it to 1K.

Vicne · 02-27-2006, 08:55 AM

Quote: Originally Posted by Ale

First try connecting only a resistor to HURX and verify if with 5K the voltage level is near 12V if not you can lower it to 1K.

OK. Thanks for the advice.
I'll have difficulties testing it as I don't have the scope anymore and most of the time, voltage is low, but I guess if it doesn't work, I'll lower it just in case. After all, it will just consume more power (150 mW instead of 30).

Circuit is done. Now who wants to try it ?

...

Nobody ? Tsss.

OK, then I'll test it tonight. Until then, I have to wake my little boy up :-)

pippolippi · 02-27-2006, 01:31 PM

Quote: Originally Posted by Vicne

Circuit is done. Now who wants to try it ?

Send it to me and I'll try it for you

No, seriously, could you check the voltage on pin 14 with nothing connected? (note that the 9V I saw may well be 12V, due to the "high quality" of my tester).
Just to know if I fried my HU

Vicne · 02-27-2006, 04:07 PM

Quote: Originally Posted by pippolippi

Send it to me and I'll try it for you

No, seriously, could you check the voltage on pin 14 with nothing connected? (note that the 9V I saw may well be 12V, due to the "high quality" of my tester).
Just to know if I fried my HU

Well, I have indeed around 11.3V on this input when nothing's connected to it, so it seems there's an internal pull-up. Moreover, when connecting this input to GND through a 4.7K resistor, I'm getting a 5.7V on the input (almost exactly 11.3 / 2) , so the internal pull-up's value is around 4.7 too. So probably the external pull up isn't really needed, but it shouldn't do harm I think