Confused about how this I2C read works

[Chet T16]

Ok well that makes perfect sense then. I will try requesting 6 bytes (max is normally 5) and see if that satisfies the slave. Aside from it causing the slave to reattempt a send (i.e. pull the line low to start a read) there is no negative affect on what i'm trying to do. Once i have completed a read i can ignore the others in code or pull it low myself which should stop it.

At this point i don't see a need to bit-bang. There is a couple of software i2c libraries about - i have been able to write to the display using an Attiny85

[man-x86]

It seems that I'm very late on this topic, but there's not much information available on this kind of hardware. I'd like to thank Chet T16 for showing that it is possible to write some user text on the LCD .

I also have a Tuner List radio, and it required some reverse engineering to understand how the display works:
https://imgur.com/gallery/AlMld

And here's an obvious proof that it worked:

I still have to figure out how to read the data from buttons under the steering wheel, but that shouldn't be too hard once the this step has been made.

[Chet T16]

It seems that I'm very late on this topic, but there's not much information available on this kind of hardware. I'd like to thank Chet T16 for showing that it is possible to write some user text on the LCD .

I also have a Tuner List radio, and it required some reverse engineering to understand how the display works:
https://imgur.com/gallery/AlMld

And here's an obvious proof that it worked:

I still have to figure out how to read the data from buttons under the steering wheel, but that shouldn't be too hard once the this step has been made.

Good to see this still doing the rounds.

From what I recall to read the buttons you must do an i2c read from the display and the first byte tells you if there are any further bytes to be read. If it's non zero the following bytes tell you what button is pressed. Using the arduino ide you must send the number of bytes to read first but as the length varies I sent a fixed value, 5 I think, and discarded the data if the first byte was zero.

I may still have access to my old notes

Sent from my SM-G925F using Tapatalk

[Chet T16]

Actually I see I covered some of this above now that I reread!

Sent from my SM-G925F using Tapatalk

[Chet T16]

From my notes:

Code: [Select]

Volume Up Press: 0x47 0x01 0x10 0x49 0x10 0x00 0x06
Volume Up Hold: 0x47 0x01 0x10 0x49 0x10 0x00 0x86
Volume Down Press: 0x47 0x01 0x10 0x49 0x10 0x00 0x08
Volume Down Hold: 0x47 0x01 0x10 0x49 0x10 0x00 0x88
Pause Press: 0x47 0x01 0x10 0x49 0x10 0x00 0x0A
Pause Hold: 0x47 0x01 0x10 0x49 0x10 0x01 0x0A
Source Right Press: 0x47 0x01 0x10 0x49 0x10 0x00 0x02
Source Right Hold: 0x47 0x01 0x10 0x49 0x10 0x01 0x02
Source Left Press: 0x47 0x01 0x10 0x49 0x10 0x00 0x04
Source Left Hold: 0x47 0x01 0x10 0x49 0x10 0x01 0x04
Bottom Button Press: 0x47 0x01 0x10 0x49 0x10 0x00 0x00
Bottom Button Hold: 0x47 0x01 0x10 0x49 0x10 0x01 0x00
Scroll Up: 0x47 0x01 0x10 0x49 0x10 0x04 0x82
Scroll Down: 0x47 0x01 0x10 0x49 0x10 0x04 0x02

[man-x86]

It seems that I'm very late on this topic, but there's not much information available on this kind of hardware. I'd like to thank Chet T16 for showing that it is possible to write some user text on the LCD .

I also have a Tuner List radio, and it required some reverse engineering to understand how the display works:
https://imgur.com/gallery/AlMld

And here's an obvious proof that it worked:
[img]https://i.imgur.com/7FzgPls.jpg[/img_]
I still have to figure out how to read the data from buttons under the steering wheel, but that shouldn't be too hard once the this step has been made.

Good to see this still doing the rounds.

From what I recall to read the buttons you must do an i2c read from the display and the first byte tells you if there are any further bytes to be read. If it's non zero the following bytes tell you what button is pressed. Using the arduino ide you must send the number of bytes to read first but as the length varies I sent a fixed value, 5 I think, and discarded the data if the first byte was zero.

I think I'll figure out by myself during the next rainy weekend, reverse engineering is still plenty of fun.

I see that you also used the Arduino IDE. Did you also had to tweak the Wire library (TWBR = 0xff and TWSR = 0x01) for the unusually slow bitrate?

From my notes:

Code: [Select]

Volume Up Press: 0x47 0x01 0x10 0x49 0x10 0x00 0x06
Volume Up Hold: 0x47 0x01 0x10 0x49 0x10 0x00 0x86
Volume Down Press: 0x47 0x01 0x10 0x49 0x10 0x00 0x08
Volume Down Hold: 0x47 0x01 0x10 0x49 0x10 0x00 0x88
Pause Press: 0x47 0x01 0x10 0x49 0x10 0x00 0x0A
Pause Hold: 0x47 0x01 0x10 0x49 0x10 0x01 0x0A
Source Right Press: 0x47 0x01 0x10 0x49 0x10 0x00 0x02
Source Right Hold: 0x47 0x01 0x10 0x49 0x10 0x01 0x02
Source Left Press: 0x47 0x01 0x10 0x49 0x10 0x00 0x04
Source Left Hold: 0x47 0x01 0x10 0x49 0x10 0x01 0x04
Bottom Button Press: 0x47 0x01 0x10 0x49 0x10 0x00 0x00
Bottom Button Hold: 0x47 0x01 0x10 0x49 0x10 0x01 0x00
Scroll Up: 0x47 0x01 0x10 0x49 0x10 0x04 0x82
Scroll Down: 0x47 0x01 0x10 0x49 0x10 0x04 0x02

Wow, thanks a lot.

[Chet T16]

For some reason I copied the wire library and made a new version to suit the 7kHz speed, not sure why i done that!

I just found this in a text file called notes.txt, may be of use to you

Code: [Select]

When idle - radio writes 0x01 0x11

Reads controls - if no input it receives 0x01 0x01

[man-x86]

I fixed it in a terribly ugly way for the 1st tests, by calling a function after every call to the Wire library (at least every call that I suspect to overwrite those registers).

void conf() {
  TWBR = 0xff;
  TWSR = 0x01;
  //TWCR &= ~(1<<TWEA); // ignore ACK, bad idea
}


I already noticed the constant {0x01, 0x11} writes and {0x01, 0x01} reads, but thanks for adding that.

[man-x86]

Interesting, I noticed different values for the controls on my car:

Code: [Select]

    *  Source R: 0x04, 0x82, 0x91, 0x00, 0x01 (press)
    *  Source R: 0x04, 0x82, 0x91, 0x00, 0x81 (hold), but sending 0x41 works as well
    *  Source L: 0x04, 0x82, 0x91, 0x00, 0x02 (press)
    *  Source L: 0x04, 0x82, 0x91, 0x00, 0x82 (hold), but sending 0x42 works as well
    * 
    *  Volume +: 0x04, 0x82, 0x91, 0x00, 0x03 (press)
    *  Volume +: 0x04, 0x82, 0x91, 0x00, 0x43 (hold)
    *  Volume -: 0x04, 0x82, 0x91, 0x00, 0x04 (press)
    *  Volume -: 0x04, 0x82, 0x91, 0x00, 0x44 (hold)
    * 
    *  Pause   : 0x04, 0x82, 0x91, 0x00, 0x05 (press) apparently, no hold feature
    *  OK      : 0x04, 0x82, 0x91, 0x00, 0x00 (press)
    *  OK      : 0x04, 0x82, 0x91, 0x00, 0x40 (hold)
    *
    *  Wheel UP: 0x04, 0x82, 0x91, 0x01, 0x41
    *  Wheel DN: 0x04, 0x82, 0x91, 0x01, 0x01
I didn't check if the values from your car work on my radio, but I assume it would be compatible.

I can manage to capture the keypresses with an MCU although it's a bit messy (it's not the goal anyways).

My final goal is replace the display by a raspi (media center + navigation), and keep the original steering wheel buttons to control the raspi and the original radio (only the volume/pause + forcing the source on AUX).

I managed to go a bit further by controlling the radio from the MCU, but now I got most of the things working, I'll definitely have to rewrite the code properly (I'm adding nops to time properly the MRQ line).


I noticed that some other cars (Renault Laguna 1, Scenic 1) were sold with an early GPS navigation system (Carminat). Thankfully, they reused the same layout on the other cars of that era (Megane 1, perhaps the Clio 2 as well), even though there was no option for a factory navigation system. So that gives plenty of room under the console/dashboard for a raspi + a 5" touchscreen to fit.

[bson]

HD6433834822H

This is probably some variant of the Renesas H8 series uC.

[ptijoss]

hi everybody,

i have a problem ! I have read your topic but it's impossible for me to send a frames for radio.
However I did everything that you have say !!

please HELP !!!