Renault "Tuner List" Head Unit/CD changer hacking - Controls - Page 5

Vicne · 02-13-2006, 05:58 AM

Quote: Originally Posted by Putput

Could this perhaps be the answer to the 3D - 3F phenomenon?

Don't think so. The spy circuit should take care of the 3V 12V input. The adaptation I talked about is only needed on the output side...

Quote:

Question about wiring, can you tell me what to connect to pin 17? I found this URL http://perso.wanadoo.fr/sebire.phili...hargeur_cd.htm explaining all details except if pin 17 is in or out and what voltage it carries? I assume that its an input for the CDC telling that the HU is active but I have to be sure before I fry my HU.

Well, it's called "Remote out" so most probably it's an indication from the head unit indeed.

Pin 16 is permanent 12V, and that allows e.g. for CD tray ejection even if the head unit is OFF, while Pin 17 would tell the CDC to get ready and start sending its "I'm alive" frames once the HU is switched on.

OTOH, on the other pinout I found (see here), Pin 17 was called "Antenne +" which is rather strange *but* is the same label as a pin of the big iso power connector of the head unit, so that could mean it's a "forwarded" ACC indicator... Some measures of its voltage could confirm that.

Anyway, I would advise not to connect anything to it. This is for sure less risky than putting it on 220V :-).

Mox, can you check on your connects2 if pin 17 is connected to something ? Maybe you have hi-res pictures of the PCB ?

By the way, it would be very interesting to know if the connects2 follows the same "3V/12V" convention. It would be easier to do 0V/12V if it's compatible, but if connects2 bothered making 3V/12V, it's probably a requirement...

pippolippi · 02-13-2006, 06:47 AM

Quote: Originally Posted by Vicne

Never heard of that. Funny hack. I'll try tonight and see the results.
Where did you learn that, if not confidential ? Maybe the source of this trick also knows much more about this damn head unit :-)

It's not confidential, I found it here.
It's an ongoing thread and probably more tricks are coming, but I've been following that forum for a while and, though there's some nice hack there, nobody ever told he knew the protocol

Anyway I'll ask
For those that don't understand spanish, the tricks are:

Press 1 and 6 at once to see the frequency and the signal quality (from 0=bad to F=very good).

Press 3 while turning on the unit for a key test (what I explained earlier)

Press 1 and 2 to see the total running time (TU tuner, TA tape, CD cd, TO total)

slimmegane · 02-13-2006, 09:33 AM

Hi all,
I've found this post only now, my ideas is to send the mp3 track title to the original display, someone have news about this? How can I help you? I've carpc already installed but I'vent the HU. My car is the Megane2

Bye,
Antonio
Italy

Vicne · 02-13-2006, 10:18 AM

Quote: Originally Posted by slimmegane

Hi all,
I've found this post only now, my ideas is to send the mp3 track title to the original display, someone have news about this?

That was the Holy Grail indeed, but unfortunately preliminary decoding of the protocol seems to show that the CD changer sends informations to the head unit in the form of numbers (track #, cd #, time) and not in alphanumeric form. It's a pity because the display is alphanumeric (to show RDS information for example)... (*)

Quote:

How can I help you? I've carpc already installed but I'vent the HU. My car is the Megane2

Well, you can help in numerous ways, but if you haven't the head unit anymore, one of the hottest topic is to understand the protocol, so you can download the latest dumps from post #51 above and try to find a reliable way of decoding frames.

Vicne

(*)Maybe after we finish this project, we can try to hack the yellow connector between head unit and stalk + display :-)

pippolippi · 02-13-2006, 01:17 PM

Breaking news

The serial interface of the changer (so probably the HU too) can be connected directly to an rs232 port.
See the second post (by CristianC) in this page.
Not that I understand romanian, but it seems this folk connected directly the changer to a pc rs232 port and saw this: 3D 01 FE FD 3D 01 FE FD 3D 01 FE FD.
Sounds familiar?

pippolippi · 02-13-2006, 01:31 PM

OTOH here mox says that the connects2 uses an ba8270f to interface to the head unit and I don't see how this chip could be used if HU interface is compatible with a simple rs232

Vicne · 02-13-2006, 02:58 PM

Quote: Originally Posted by pippolippi

Not that I understand romanian, but it seems this folk connected directly the changer to a pc rs232 port and saw this: 3D 01 FE FD 3D 01 FE FD 3D 01 FE FD.

Well, directly seems a bit risky to me, but it could work.
The official RS232 standard states, if I'm not mistaken, that positive level must be between 5 and 15 and negative between -5 and -15 for emission, and accepted with positive between 3 and 25 and negative between -3 and -25 for reception devices.
So normally, any voltage received between -3 and +3 volt falls into the "unspecified" range and should be avoided.
This being said, many PCs place their threshold at a positive voltage (e.g. 2.5V), so that devices that cannot produce negative voltage can be received too.
Some PCs (notably laptop) even *send* 0V for "negative", to avoid the hassle of a voltage pump to provide the negative voltage (the main goal of the MAX232).
So with a divider, I easily believe the MAX232 is not really needed on input, but seeing its price, I prefer to keep it and be on the safe side - theoretically at least :-)

Ale · 02-13-2006, 04:26 PM

Hi, I wish to share my analisys of start-sequence data exchange of HU-CDC in Excel.
There is also the useful column CrcCheck that can help to correct rx errors.
The errors can be due to some noise in power supply, or the resistor divider mounted too far from max232 pin. Try to filter +5V of max232 with a couple of capacitor 10uF+0.1uF.

Best Regards
Ale

Vicne · 02-13-2006, 05:47 PM

Quote: Originally Posted by Ale

The errors can be due to some noise in power supply, or the resistor divider mounted too far from max232 pin. Try to filter +5V of max232 with a couple of capacitor 10uF+0.1uF.

Well, I completely agree that it looks more like a periodic spike than a threshold problem, and I'd really like to get rid of it first. Regarding my power supply, well it's err... a 4.5V battery, so I guess it's rather stable, but maybe I'm mistaken. I have a 0.1uF but I could add a 10uF if you think i would improve something - obviously you have much more experience than I do :-)

Here's a picture of my test breadboard. Well, OK, I'm a bit ashamed of the look, but it helps changing the values around :-)

pippolippi · 02-13-2006, 06:11 PM

Quote: Originally Posted by Vicne

Well, directly seems a bit risky to me, but it could work.

I agree that sending from the pc to the head unit may be riskier if the HU cannot accept the negative voltages, but just spying should be no problem: the pc serial port has no problem with those levels, the worst that can happen is that it won't decode the incoming characters. OTOH it's your car so you've every right to be cautious

Ale · 02-13-2006, 06:14 PM

I have added some suggestion onto your breadboard photo...

Ale · 02-13-2006, 06:25 PM

Quote: Originally Posted by pippolippi

Breaking news

it seems this folk connected directly the changer to a pc rs232 port and saw this: 3D 01 FE FD 3D 01 FE FD 3D 01 FE FD.
Sounds familiar?

I think that something go wrong with level 0 threshold becouse the recalculated CRC of the frame 3D 01 FE FD isn't correct (3F instead of 0).

pippolippi · 02-13-2006, 06:55 PM

Quote: Originally Posted by Ale

I think that something go wrong with level 0 threshold becouse the recalculated CRC of the frame 3D 01 FE FD isn't correct (3F instead of 0).

Right, but that's just a start sequence (CristianC calls it connection attempt, repeated 3 times) and you can also see that there aren't 254 (FE) bytes in these packets.
Next frame is 3D 01 01 93 AE C5 and that has the correct checksum (plus the confirmation=C5, probably to the connection attempt).

Putput · 02-14-2006, 01:52 AM

You probably took care of everything but make sure that you connect all 0V 's together. I've seen strange things happen when using multiple power sources not grounded to the same level.

Vicne · 02-14-2006, 03:35 AM

Quote: Originally Posted by Ale

I have added some suggestion onto your breadboard

Thanks for your help. As I said, I once knew electronics theory but never put it in practice.

So OK for the clips at the power source.

Just to be sure of the other changes you propose, let me first explain my photograph (hopefully also useful for others) :
- the power are the two black/red lines on the top left. Black is currently not plugged, so the circuit is not powered. When connected, black goes to the top row of the breadboard, which is the ground. Red immediately goes to the Vcc of the MAX3232 while the ground pin of the MAX3232 is linked to the top row via the thin red (

) wire
- the grey shielded cable above comes from the hu/cdc connection. As you can see, shield (ground) is immediately connected to the top row too, while red (Rx) and black (Tx) go through the 18k resistors, then to the MAX3232 through resp. white and grey wires
- the grey shielded wire below goes to the PC serial ports. The shield (ground) is connected to the top row via a white wire and red and black (Rx of resp. COM1 and COM2) are linked to outputs of the MAX3232 via resp. green and yellow wires
- the 2 red bridges at the bottow right connect the output of the TTL/RS buffers to the input of the TTL/RS buffers.

From your edited drawing I guess what you mean is :
- secure power lines connections with a clip
- put the resistors just before the MAX3232 pins
- add a 10 uF capacitor in parallel with the 0.1uF one.

Is that correct ?

Thanks again for your help. It's much appreciated.

User Name		Remember Me?
Password