Finding logic levels of a one wire bus

Go To Last Post
25 posts / 0 new
Author
Message
#1
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Hello all,

I'm currently working on reverse engineering the protocol that my Subaru uses to control its cd-changer from the head unit. From the information I've gathered, the changer and head unit communicate via a 1 wire serial interface, however I haven't found anyone who has actually attempted to log the data being transmitted between the two devices.

My problem is, I'm not sure of what logic levels are being used for communication. I am hoping that the serial line is pulled high until one device want's to talk, I could easily measure the voltage then. Does anyone have any ideas on how to measure the voltages being used? I've got a pretty basic multimeter, a logicport logic analyzer, and random components to work with. Unfortunately I don't have access to an o-scope. Also, I'd rather not take the radio apart since it is expensive.

Attached is the connector for the cd-changer. BUS LINE is the serial interface. +B is the battery, and ACC is accessory power.

Also, if anyone knows what type of connector that is, or how to figure it out, I'd love to know!

EDIT: I just did a search and found the part of the service manual for the radio.

http://eshop-manuals.com/product...

According to this, it's labeled CN702 16P Connector.

Thanks in advance!

Mikael

Attachment(s): 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

So I figured I would just buy the service manual for the radio from the site I linked to above. The good thing is, it has the complete radio schematic in it. From what I've seen, the voltage levels should be 5 volt logic. I might need some help deciphering what is happening in the circuit.

Not only that, but it included part #'s for the connectors I need.

Thanks to anyone who read my post!

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Sure it isn't the M-Bus protocol? That is what I have on my 2000 Honda Accord.

Here is a backup of a site that had an AVR interface:

http://www.jevinskie.com/mbus/

Math is cool.
jevinskie.com

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

The radio is made by Panasonic, so I don't believe it is using that protocol. Also from looking over the radio schematic, it appears to use 5 volt logic. I'll try to post the relevant portion of the schematic tonight and see what others have to say.

Thanks!

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Ok, I cleaned up the schematic a bit so only the cd changer portion interface is shown. I'm not the greatest with circuits when transistors are thrown into the mix, but from what it looks like to me, the output is held high @ 5v. Can anyone figure out what's happening for CD-CH.IN or CD-CH.OUT?

Thanks a ton!

Attachment(s): 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Looks like some kind of open-collector type bus.

When bus is idle, there is a 22k resistor to keep it floating at 5V.

CH.OUT is an output from a CPU to drive the bus, when CH.OUT is high, the bus is pulled low to 0V by the transistor, when CH.OUT is low, the bus is allowed to float at 5V. Think it like an inverted open collector buffer, out=high bus=low, out=low bus=high.

CH.IN is a buffered (twice inverted) input from the bus line to a CPU. When bus floats high at 5V, both transistors are off, and CH.IN is logic 5V also. When bus is pulled low to 0V, both transistors are on, so CH.IN is pulled low.

Other random components are there to protect from overvoltage or overcurrent and to limit transition times. 1K in series limits current flowing from outside world to output transistor, the diodes are there to clamp overvoltage to 5V plus two diode drops, capacitor from bus to GND limits rise time and the capacitors at transistor bases limit fall time too.

So, basically, you could just connect a 5V AVR IO pin there without any components and you could talk to that bus, at least electronically meaning. You would then just need to find out how some messages are transmitted. In reality some protection components would propably be in order, maybe even a similar driving/receiving circuit.

- Jani

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Jani,

WOW... Thank you so much! I suspected that is how it worked, but it's been years since I've looked at circuits like that. I'll keep you all up to date with how this is going. If the weather isn't horrible this weekend, I'll try taking a logic analyzer to it and see what I can get. I might try cracking open the radio to monitor CH.IN and CH.OUT directly.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

I'm not that good in monitoring open-collector buses in reality, but I've got a few tricks you could try, so you don't have to open up your car stereo to monitor the lines. I've thought about these when thinking how to monitor I2C bus or PS/2 bus.

Basically it all boils down to inserting a device with a voltage drop over it to know which way is pulling low. Simply a 100R resistor will do, if you have a scope handy. Just measure voltages over the resistor, and the one with lower voltage is pulling the bus low.

It might even work with two diodes back-to-back.

If no scope is available, you could build a circuit with one or two comparators to see which one pulls low with logic analyzer.

-Jani

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

I bet there's a pull-up in the radio to hold the line high. This is common on car-style connections, though ISO9141 is more common which pulls to 12v and works to 10%/90% of the rail rather than half rail.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

barnacle wrote:
I bet there's a pull-up in the radio to hold the line high. This is common on car-style connections, though ISO9141 is more common which pulls to 12v and works to 10%/90% of the rail rather than half rail.

There is; it's right in the posted schematic about CD changer interface portion of the radio.

- Jani

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Jani (or anyone else)

Do you have any recommendations for the NPN and PNP transistors to use to build a microcontroller interface with? The transistors listed in the schematic are a bit expensive to buy from what I've seen. I'm working out a schematic at the moment and figured I would test out making a similar interface to the microcontroller.

Also if anyone knows, I'm assuming that it would be a bad idea to have the radio turned on without speakers attached? I'm assuming I would want to have the output of the power amp attached to a load if it is going to have power. I'm going to probably ask a car stereo installer but figured I would ask here.

Thanks A LOT!

Mikael

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Just wondering? Would an "old fashioned" logic probe have worked here to determine logic levels??

John

Just some guy

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

As far as I know, not really. You could figure out the threshold for a 1 or a 0 I suppose, but a logic analyzer (at least not the one that I have) won't tell you the voltage levels of a signal. You would want to use a scope for that.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Mikael: Probably any small-signal transistor will do. However before making any circuitry, you will want to check if you can use the serial port (USART) to listen and transmit traffic on the bus (my ex-coworker's BMW worked with serial data), because that will affect if you wish to transmit to data bus in inverted or uninverted format. If USART, you definitely don't want the inverted operation the schematic has - not unless you do a software UART to transmit stuff.

John: Depends on your old-fashioned logic probe. The bus happened to have 0V/5V logic, which can be fed to almost any device. It might have had +12V/-12V levels too like serial ports, I don't know how your logic probe handles that without breaking.

- Jani

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

myk - probably something like a bc548/bc558 should work - depends on your location as to whether these types are readily avaiable. for the u.s, try 2n2222 and 2n3904 at a guess.

As for an oscilloscope - use the pc's sound card and cooledit2000 or other software. Whilst it's vertical (voltage) accuracy is not good, the horizontal (time) accuracy is very good and as long as the signal is reasonably slow, you'll be able to sample hours of data if you wish

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Be sure to check your soundcard's maximum Vin for the audio inputs... Not sure they can handle 5v... (PCI bus is 3.3v on most recent PC's...)

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

PCI bus data lines might be 3.3V, but still even +12V and -12V are available via the PCI bus, so the sound cards can regulate their own voltages.

- Jani

Edit: but anyway, 5V might be too much, lower it down with resistors to 0.5V for example.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Hey everyone!

Just wanted to drop in for a little update.

So today I took the radio and cd changer out of my car and got it running from the power supply of an old external hard drive enclosure I had. I tapped into the cd changer bus and started logging some data. Unfortunately I haven't had a lot of time to go through it yet because I've got a winter party for work tonight (a bunch of engineers trying to dress nice, this should be fun lol). Anyway thought I'd show some pictures

http://web.mac.com/mikaelnelson/MikaelNelson.com/Projects.html

Also, I did have a bit of time and figured out this, when the radio is not in "cd player mode" it sends (I'm assuming it's the radio, I'm not sure yet) 12 bit long "pings."

The bit waveforms look like this:

-|_|---- = 1 (I'm assuming this means 1, it might be 0)
-|___|-- = 0

I will try to upload some logged data from my logic analyzer later. The logic port can save the captured data as a text file, so I'll probably work on a perl script to parse through it and give me some easy to read values.

Thanks for ALL of your help!

Mike

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Hey can you post a screenshot of the logic signal, or even the Logicport data file (I have the SW installed).

I'd like to see the captured data, if I could be of assistance.

12 bit transmissions might sound like Sony SIRCS protocol, but we'll have to see.

- Jani

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Hey Jani!

Sure thing, let me take a few readings and I'll post them up. I've just been messing around with with the radio/changer and taking a few test readings and converting them to binary to see if I can spot any patterns. I'll post the text of my notes with this.

Currently I'm not sure which section of data is from the radio and which is from the changer. Also, I'm not sure if the bits for either should be inverted or if either should be MSB/LSB first. The good part is, just reading the data straight from the line shows some patterns in the data.

For example, on the 12 bit sentences, the middle nibble is almost always 0111b. The only time I've seen it change is the 12 bit sentence directly before a longer than 12 bit sentence, it then turns into a 0110b.

I tried 3 conditions, no cds, 1 cd, and 2 cds in the changer. All recordings were with the radio "off" as in the power button was pressed off on the radio so nothing was playing or anything.

I'll take a few readings and post the actual file for them.

Thanks

Attachment(s): 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

I think I can officially say, w00t!

I've been taking a few readings to post of the cd playing and I am pretty sure I figured out the message format for the currently playing song. Attached is a bitmap. I havent figured out what everything means, but I'm pretty sure I have Track, CD, and Time figured out. It looks like messages from the Changer are MSB first and inverted. Also, instead of saying 11 seconds as 0100(Remember MSB first, inverted) its broken up into ones and tens place, so 1110 1110.

I'll post the logic port files in a little bit.

Attachment(s): 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Ok here are the files I made with the LogicPort software. I've also included a hand decoded txt file of each logicport file. I removed the first partial sentence in each recording in the txt file because it wouldn't be of much use.

Let me know if you guys have any questions or figure something out. I'm going to bed, have a great night!

Attachment(s): 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Ok I lied about bed, I wanted to figure out what the 12 bit sentence was all about.

It appears that:

0001 0111 1000
1000 0111 1111
1101 0111 0100
1100 0111 0011
1011 0111 0010
1010 0111 0001
1001 0111 0000

this pattern keeps looping ( I guess some kind of "hey I'm still here" ping ) over and over. Time messages and those 6 sentence idle strings are just injected onto the serial ports at the correct time. I dont think the pings and the messages are really related to each other as far as order of being sent goes.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Ok, well I believe I've extracted a few Radio commands from the mix after a couple hours of testing. It seems like there is a lot going on at the same time on the serial bus. There is the looping pattern of sentences, the changer is sending out a time message every second, and the radio can send out these commands.

Pause or Toggle Source (Switches between Radio and Changer, Pauses/Plays changer)

1001 1110 1110 1011 1111 1101 1110

----------------------------------

Fast Forward Start

1001 1110 1110 1111 1010 1101 1101

----------------------------------

Fast Forward Stop

1001 1110 1110 1111 1110 1101 1001

----------------------------------

Rewind Start

1001 1110 1110 1111 0110 1101 0001

----------------------------------

Rewind Stop

1001 1110 1110 1111 1110 1101 1001

----------------------------------

Skip (Command followed by time)

1001 1110 1100 1111 1111 1100 1110 1000

Followed by the time message specifiying where to skip to (it sends two, almost identical ones)

Time Message Format
AAAA BBBB CCCC DDDD EEEE FFFF GGGG HHHH IIII JJJJ KKKK LLLL MMMM NNNN OOOO PPPP

AAAA - Address (?) 1001 is radio, 0001 is changer

BBBB - Command 0, 0110 for a time message

CCCC - Command 1, 1001 for update time message, 1011 for first skip time message, 1010 for second skip time message

DDDD - Track Tens position

EEEE - Track Ones position

FFFF - CD # Tens position

GGGG - CD # Ones position

HHHH - Minutes Tens position

IIII - Minutes Ones position

JJJJ - Seconds Tens position

KKKK - Seconds Ones position

LLLL - No idea, always 1111

MMMM - No idea, always 1111

NNNN - No idea, always 1111

OOOO - either status bits, or checksum

PPPP - either status bits, or checksum

Let me know if that is confusing or anything, I typed it up quick.

Also, attached are more decoded data notes.

Attachment(s): 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Jevin wrote:
Sure it isn't the M-Bus protocol? That is what I have on my 2000 Honda Accord.

Here is a backup of a site that had an AVR interface:

http://www.jevinskie.com/mbus/

So I just took a look at your site again after a few days on the logic analyzer and wow, that looks like exactly the same protocols besides the voltage levels are different. Even the checksums and addresses appear to be similar. It looks like (I've only tried it with a few different sentences i've recorded and it appears that I have to invert the bits for the checksum to turn out, but so far it looks like it works)

Anyway, thanks a ton!

EDIT: I just tried downloading the protocol spread sheet but it can't be found on the server. Can you please repost it for me? Thanks!