vwcdpic v2 firmware for v3 boards

I do not know why it take me so long o realize that i can change pins in v2 firmware to make it works on v3 boards. But better later then never, here it is.

audi chorus - concert: how to recover password

what you need:

motorola cracker :

for serial connection I used cp2102 based adapter from ebay, it has wired RTS signal:

Software part is motorola cracker version 6.x (7 didn't work!!!). It has support for com port from 1 to 4, so change this in advance settings for your usb2UART adapter, then just boot MCU and read eeprom, here is a actual eeprom dump, with code 1790, you can see its on 3 places:

number in eeprom, directly after code (from my observation) can be:

06 - SAFE2 mode, you need to wait 1hour(info from here) to be able to enter pin
08 - SAFE1 mode, you can enter pin code to unlock
A0 - no code required

locked for 1 hour

no code required

standard SAFE mode

UPDATE: I have Motorola MCU with fixed volume problem, so I dump eeprom of this MCU as it has fixed problem, it didn't store volume value in eeprom and so this dump is "clean" of garbage. I try to load this dump to one of affected MCU, just to test how long it take to have volume issue back. For now it's looks ok.

EDIT: it didn't fix it radio volume is garbage at low temperatures, of corse. But I have to try :)

any data are on my github including eeprom dumps.

UPDATE: based on this blogpost: http://www.realitytech.co.uk/rich/?p=192

I try it, it's works kind of. communication was really unstable, but it works for reading eeprom directly after booting CPU, or write simple byte of data, in my case It take 3times to boot CPU and each time write simple byte (0xA0) on positions 3,33 and 63, to disable code protection.

!!1important note!!!  you must connect only 12V and ground on main connector of radio. In my first attempts I have illumination connected to 12V and this makes pin 22 go Low so my additional pull-up did not work.

here are some pictures:

RESET LINE (18)

RX/TX/+12V/pullups on 22,9,11

only 12V and ground is connected in main connector of radio

RX,TX,RTS and ground on UART2USB

openbox x-810 won't boot

another bad caps story with PSU, this time openbox x-810, won't boot, stoped with double dot ":" on display. Measuring on 3.3V rail showed 2V with load. Changing 1000uf and 470uf caps on this rail fix problem, just to be on safe side, I changed all caps on secondary side of psu.

audi FIS 3-line protocol update

   Finaly got time to grab on working configuration, so now I know how cluster tell radio its there and have 2nd display capability.

   Each 5s cluster make 3ms 5V pulse on enable line. after while radio respond with update.

cluster enable signal delay/timing

cluster enable signal

cluster enable signal

S3860M-S breadboard adapter

kicad files

foto:

updated version:
- with reset button and on/off button (MFB)
- 2leds
- option to select between XS3868 and S3860M-S module
- made by dirtyPCB.com
- will be sold on tindie.com after test with 0402 resistors and jack (hard to find this in low quantity)

check my store on tindie:

SOYO-BT24G03 kicad lib and module

finaly I have time to make package module for kicad of SOYO bluetooth module SOYO-BT24G03:

lib files:
SOYO-BT24G03.dcm SOYO-BT24G03.lib

and module:
SOYO-BT24G03.kicad_mod

also one new smt jack PJ320B (stereo, 3.5mm) I found in my pile of scrap parts:

3.5mm_stereo_jack_PJ320B.kicad_mod

new kicad libraries and modules

on project of bluetooth support for old vw group head units I have to try more bt modules, so I made kicad files needed to make breadbord adapter , SOYO-BT24G03 is in queue also...

MB-CM15113.kicad_mod - old module which has no uart, I made Fritzing file for this module, I try this module one more time
(library files: MB-CM15113.lib, MB-CM15113.dcm)

BLK-MD-SPK-B.kicad_mod - module mentioned on this blog, no call posible with this module or I'm lame :)
(library files: BLK-MD-SPK-B.lib, BLK-MD-SPK-B.dcm)

XS3868.kicad_mod - new module I will try, breadbord adapter files here
(library files: XS3860.dcm, XS3860.lib) 


am1d.kicad_mod - DC - DC convertor 5V->+-12V i have planes to use it for galvanic insulation audio part for low noise in amlifier, which is realy needed....
(library files: aimtec.dcm, aimtec.lib)

also I made some kicad modules for 3.5mm jack from ebay ....

3.5mm_stereo_jack_PJ-313C.kicad_mod

3.5mm_stereo_jack_PJ242.kicad_mod

 

3.5mm_stereo_jack_PJ3026.kicad_mod

 

 3.5mm_stereo_jack_PJ306M.kicad_mod

 

 

 

 

 

 

vwcdpic for avr (arduino) and attiny

Porting to arduino's or AVR?

while back I read on hackaday forums about guy who ported some C code for avr (for seeduino mega) originaly ported from k9spud vwcdpic ...

back then I was really bad in arduinos or any coding for mcus, so I was unable to make it work on normal *duino .... 

then i find this post of shyd version of emulator 

and now i'm less lame so I did it :)

Problem

for protocol read shyd post, it preaty explain everything about pulses etc ....

problem of porting avr vwcdpic code to arduino:

- ICP pin need to be accesible
- one 16bit timer (attiny hase 2x8bit timer)
- two timers with CTC (atmega8 does not have ctc)

ICP pin

basicaly external logical change interupt on pin called ICP which is directly "wired" to timer1( ICP as INPUT CAPTURE PIN), this pin is not wired on ATMEGA arduino boards (mega1280 and 2560). This is why guy on hackaday use seeduino...
On normal arduino duemilanove or UNO is ICP1 on digital pin 8, so this will work perfectly on duemilanove/uno and also old atmega8 chips.

Also its posible to reprogram code to use standard INTx interupr as I use in attinyx5 version of this code.

16bit timer

this timer is used to measuring pulses length of data send by head unit, more in post here and here.

In original code is set to tick every 0.5us, its 16bit timer, max value of 65536 which corespod to 32000something ms ~ 32second, which is fine, perfect resolution, we can surely set input buffer to zero if this timer overflow (no logical change on ICP pin for 32 seconds...)

but if we have 8bit timer like in attiny85 (255tics to overflow which is 128us if I'm not mistaken) and want to have same resolution as with 16bit timer, to avoid recalculation of tics per pulse.... we must catch overflows and count them, then just calculate pulse lenght as 255*overflows+actual timer

2 timers for timing output packets

next challenge was timing for output to head unit, lets call it packet of 8 bytes, with this timing:

50ms between pakets
at last 700us between bytes in packets (in vwcdpic is note that same head units cant store it if timing was 350us, in some other sources on net, timing is 874us ... but 700us works for me...)

in original code timer0 and timer2 are 8bit timers, in original code used for:

- 700us timing between bytes
- 50ms timing between packets and to cound seconds ... (20x50ms = 1000ms = 1s)

this is no problem on atmega168/328 but its problem on atmega8 and attiny85

atmega8 has no compare register for timer0, attiny85 hase just two 8bit timers/counters

Timer0 on atmega8

atmega has timer0 without CTC mode, no compare possible , so we must make it work other way around, we have overflow:
-  so I set OVF bit to allow execution of OVF runtime routine
- set timer to 4us tics, this make it overflow each 1024us
- initialize timer with value of 6 which make it overflow after 1000us
- in overflow routine  timer is initialize with 6 to overflow again after 1000us

Attiny85 and two 8-bit timers

timer1 is used for input capture with combination on int0 external interrupt and counting overflows... no big deal

timer0 must be used to timing of 1ms tics for seconds count and for output packets timing, so what I did was really easy, and I go to rewrite all code also for atmegax chips to use it. I set timer to tic every 1us, set compare register to be 100, so its fire compare routine every 100us. In this routine I do counting, 50 count to make original code happy ...
and to count to 7 or to 50 to make output packets timing work ...

second timing for output packets is set directly in code which handle sending packet, if it reach end, it will set 50 to wait 50ms between packets, if it just sent less then eirhts byte it set 7, so next byte is flush out after 7 overflows of timer0 = 700us

Output to headunit

output to head-unit is SPI, it's nothing new, but this didn't work for 16Mhz arduinos (simply it's to fast), so software handling of this is used. I like crystal version more over internal RC oscillators becose this is in car application where external crystal should by better, but I do not test or read any paper on this, so correct me please if I'm wrong.

also attiny has no SPI dedicated pins, it it's capable of use some internal magic to have SPI by HW but it use pin which is also INT0, and this we need... so using software here is only option

Serial comunication

Original vwcdpic used 9600bauds serial communication for PJRC player, which I do not know if it is around anymore, but it was also in avr code, so I leave it there just make it fully backward compatible, with "in compile time" configurable #define PJRC, becose this make emulator constantly send "mode" on serial line, which may toggle  "mode" on mpd  each second or so ...

also add option to support shyd version of serial communicaton to control mpd over serial with mpc and python, and receive info from mpd like mode, disc and track number. This is configurable in compile time with  uncommenting #define DISC_TRACK_NUMBER_FROM_MPD, #define JUST_HEX_TO_SERIAL and commenting out #define PJRC

attiny85 use TinyDebugSerial library which is oneway library but it didn't use any timer, so I can use both(timers).

 Mpd control

I made some changes of shyd python script to control mpd both with just hex and pjrc commands , this are on github. Also mpd_control_vwcdpic.py should support original pic version of vwcdpic, but I have no time to check it.

I make this pythons script handle next/previos CD which are send (as I know) only from audi chorus 1 with enabled CD input and audi concert 1.

video of all of this is here:

how to wire it?

arduino duemilanove/uno or atmega8
RADIO PIN -> arduino pin (chip pin) <- computer
     DataOut -> digital 8      (14)
       DataIn -> digital 13    (19)
         Clock -> digital 12    (18)
                        digital 0      (2)  <------------ serial TX
                        digital 1      (3)  <------------ serial Rx
 
attiny85:
RADIO PIN -> attiny pin <- computer
     DataOut -> 7
       DataIn -> 6
         Clock -> 5
                        2  <------------- serial RX

Future

 Bluetooth... clearly, I made it here, with blk-md-spk-b module, but it has problem handling calls, so I ordered xs3868 and made kicad module and library. So next to make some breakout boards and try it.

 Next stage is implementing SOYO-BT24G03 (made kicad library, module, get AT command set ) which has support of more profiles (also address book ;) ) and also has support of sdcard and usb :) 

BM20 it will be ;)

Links 

arduino,atmegaX8,atmega8 port of  k9spud vwcdpic
port of k9spud vwcdpic with two 8-bit timers (attiny85)
mpd_control.py
mpd_control_vwcdpic.py 
 

vwcdpic port for arduinos

I have a time to study vwcdpic AVR port for arduino mega which was ported by guy vti on hackaday.com forums and make changes to run it on arduino deumilanove/uno/nano. Code is on github. This is full software based, no hw SPI is used, so is easy to port. Future planes are atmega8 port, which is little diferent in speak of timers.. and attiny85 port of corse, cose I have nothing better to do :D

then headphone support emulating pushbuttons, and bluetooth...

to make it easy to test I clean/tuneup/fixed radio emulator
 

vwcdpic boards

vwcdpic boards are for sale (1Euro for board + shipping)

preprogramed pic +2E

asembled emulators + simple cable with jack or cinches (tested wvcdpic + audio cable = 10euros + shipping )

contact me on email if you are interested


 

list of materials

C10,2  - 100n,1206
R1       - 10k,  1206
R5,6,7 - 3k3,  1206
U1       - PIC12F629-I/SN, SW: VWCPIC v3, 8SOIC
U2       - AMS-1117-5.0 (5V) SOT-223

 assemble plan: 

 

 

schematics in PDF

finished emulators:

for audi concert2

audi concert1/chorus1

this version of firmware is know to work with VW RCD300 units

to make cost as low as posible, 2.54 pin socket is used:

RCD300 version

RCD300 version

how to connect this pic based emulator

breadboard adapter for blk-md-spk-b

simple breadboard adapter for cheap BLK-MD-SPK-B module from ebay based on OVC3860 with 3.5mm jack adapter, here is it in action:

 schematics/board are on my github

few pictures:

kicad library for BLK-MD-SPK-B is also on github

copy of pdf with OVC3860 AT commans used in video (AT#MD AT#ME....)