Smart car radio

My setup to go deeper in the system:

- the original Renault Update List car radio (I will replace it with an Alpine unit in my car, that's why I want to know the display protocol)

- AFFA2 canbus display

- logic analyzer with canbus interpreter

- canbus sniffer with Arduino Uno & canbus shield (cf. previous log)

On the PCB of the display, I discovered a PCA82C250 canbus driver on which I probed the canRx and canTx pins (1 & 3) with the logic analyzer and sniffed the CANL and CANH pins (6 & 7):

To display some text on the screen, four 0x121 Can packets are sent from the head unit to the display. For example, the radio named "Europe 2" on the first preset (button "1" of the head unit, "P1" in the frame) I probed this:

Corresponding data frames:

msg11[8] = {0x10, 0x19, '~', 'q', 0x01, 'E', 'U', 'R'};
msg12[8] = {0x21, 'O', 'P', 'E', ' ', '2', 0x10, ' '}; 
msg13[8] = {0x22, 'E', 'U', 'R', 'O', 'P', 'E', ' '};
msg14[8] = {0x23, '2', ' ', 'P', '1', 0x00, 0x81, 0x81};

The first byte is used as a sort of numbering and follows a sequence: 0x10 -> 0x21 -> 0x22 -> 0x23. The text "Europe 2" is repeated (I don't know why, maybe legacy reasons...) 2 times and spread between the 4 frames.

The first packet (0x10) starts by a fixed sequence of 5 bytes (0x10, 0x19, ~, q, 0x01) followed 3 bytes of text.

The second packet starts with 0x21, then the remaining 5 bytes of text (spaces are inserted if less than 8 characters to display) then 0x10 and space.

The third packets starts with 0x22 followed by 7 chars (spaces are inserted if less than 8 characters to display)

The fourth packet starts with 0x23 followed by the 8th char (or space), a space, 'P' for preset, one char as preset number ('1' in this example). The frame is ended by 3 bytes 0x00, 0x81, 0x81

It seems that, whatever the text is in packets 0x10 & 0x11, it is the text that is in packets 0x22 and 0x23 that is displayed.

I got curious about this display after browsing the web. Many people are having trouble between two versions (the previous one was a i2c display) and the "Update List" display which implements a canbus interface. This is a simple 8 characters display with great contrast. 2 integrated features: a clock and the external temperature.

This is an AFFA2 model, ref 8200380298

On different forums, I got the pinout of the display:

1 - Autoradio {green} [3]
2 - Autoradio {brown} [1]
3 - NC
4 - NC
5 - NC
6 - NC
7 - Steering wheel remote control {violet}
8 - Steering wheel remote control {green}
9 - Steering wheel remote control {brown}
10- Steering wheel remote control {yellow}
11- Steering wheel remote control {pink}
12- Steering wheel remote control {grey}
13- NC
14- NC
15- ? Power ( + protected left light ) {blue}
16- Autoradio {grey} [5]
17- 12V (After contact) {yellow}
18- Signal 0V External temparature probe {brown}
19- Probe {green}
20- Rheostat {violet}
21- 12V Permanent {red}
22- NC
23- GND (0V) {black}
24- ?
 

The useful ones are pins 1 (canbus CANH), 2 (canbus CANL), 17 (+12V after contact), 21 (+12V permanent from battery) and 23 (GND).

As a side note, the pins 7 to 12 are used to decode the steering wheel remote control matrix 3x3 keypad. I'm not gonna use that for my bluetooth HID smartphone remote control. One reason for that: I want to be able to detect multiple key presses, which is not supported on the original car radio. So, I will have to decode the matrix keypad on an ecternal microcontroller.

I probed the canbus line (with the original car radio) with a logic analyzer and checked some useful frames. For example, when the screen displays FM 106.2:

Fortunately, this is plain ASCII, it uses some CAN ID's and it is possible to start hacking.

The CAN Id is 11 bits, and the baudrate is 500kpbs.

In order to check how many CAN ID's are useful, I made a sniffer with an Arduino Uno and a seedstudio Canbus shield. A python script updates the datas in a table mode (one line per ID):

Link to the Github page of the author of this very useful script: https://github.com/alexandreblin/python-can-monitor

and the corresponding Arduino sketch: https://github.com/alexandreblin/arduino-can-reader

In my setup, the constants are:

// CS pin for CAN bus shield
const int CS_PIN = 9;
// CAN bus data rate
const byte CAN_SPEED = CAN_500KBPS;

We can see that there's only about 10 Can ID's in the protocol. Obviously, the 0x121 is used to send text on the display. As a CAN data frame is only 8 bytes and the display is 8 characters, I hoped that a single 0x121 frame could prints the entire text on the display, but it is not easy as that.

Each time text changes, four 0x121 frames are send... More on that later.

I push my initial sketches for Arduino on my github page: https://github.com/manu-t/autoradio-interface

UpdateListDisplay.ino is the initial sketch to drive the canbus Renault display. It has a serial interpreter for commands. The displaySong() function gets the song title from the serial stream and displays it (scrolls text if more than 8 characters). I intend to use a bluetooth bee (spp bt module in xbee format) instead of the serial uart USB, but haven't tested it yet.

HID_rn42_dpad.ino takes inputs from the Renault steering wheel remote control, the C&K dpad and send it to the smartphone as key inputs.

I have to tidy up this code to keep the essential part (some stuff has to be removed), but as it is it is functional.