Mazda 3 radio protocol

[djkoshea]

Hi,

I've been playing with the factory Mazda 3 head unit and I've discovered some interesting things about the protocol that it uses to communicate between the various modules. The eventual plan is to connect an old laptop up and have it controlled from the radio controls, display text on the screen and play MP3s. See http://mazda.davidoshea.homelinux.net/radio for what I've managed to figure out so far. I'm currently playing with some PIC code to try and simulate a CD deck as a starting point.

My problem is that I only have the single disc CD deck, and that doesn't support CD text, so my bus snooping options are a bit limited.

Does anyone have a minidisc/mp3/changer deck that they could snoop the bus and text pins (see my website) and provide additional details?

Please let me know if you're interested in helping out.

Cheers,

David.

 

[Dexter]

Interesting post. I believe the Protege headunit uses the same connector between modules...

 

[Captain KRM P5]

very cool

 

[Super Matty P]

i have a 6-disk MP3 player in my 3S but it doesn't do text naming.....wait, maybe I don't have the mp3 option...

 

[Dexter]

Hi,

I've been playing with the factory Mazda 3 head unit and I've discovered some interesting things about the protocol that it uses to communicate between the various modules. The eventual plan is to connect an old laptop up and have it controlled from the radio controls, display text on the screen and play MP3s. See http://mazda.davidoshea.homelinux.net/radio for what I've managed to figure out so far. I'm currently playing with some PIC code to try and simulate a CD deck as a starting point.

My problem is that I only have the single disc CD deck, and that doesn't support CD text, so my bus snooping options are a bit limited.

Does anyone have a minidisc/mp3/changer deck that they could snoop the bus and text pins (see my website) and provide additional details?

Please let me know if you're interested in helping out.

Cheers,

David.

David,
I've been doing some snooping on the RX-8 navigation controls. They appear to use the same bus as defined on your page. For example:

Joystick Up - 1000 0001 0101 0111 1100 0000 0011 1111

appears to be sending a message to the navigation unit

Sending data FROM module (1) to Navigation unit (000? whereas CD is 011)
send command 0001 followed by 20 bits of data. Subcommand 0101 and then 0111-AAAA-0000-BBBB where a and b are different nybles. then the checksum (which always seems to be 1111?)

When starting a scan on the bus, the bus line goes low for ~9ms and then back to high for ~4.45ms, then the data comes. Does this happen for you also? I did not count those edges when making the nybles, because they dont fall into any pattern. Perhaps this is to signify a transfer will occur on the bus and the master should begin listening?

I know this info doesnt help you directly but I figured you wouldn't mind if I shared

 

[djkoshea]

Hi,

David,
I've been doing some snooping on the RX-8 navigation controls. They appear to use the same bus as defined on your page. For example:

Joystick Up - 1000 0001 0101 0111 1100 0000 0011 1111

appears to be sending a message to the navigation unit

Sending data FROM module (1) to Navigation unit (000? whereas CD is 011)
send command 0001 followed by 20 bits of data. Subcommand 0101 and then 0111-AAAA-0000-BBBB where a and b are different nybles. then the checksum (which always seems to be 1111?)

When starting a scan on the bus, the bus line goes low for ~9ms and then back to high for ~4.45ms, then the data comes. Does this happen for you also? I did not count those edges when making the nybles, because they dont fall into any pattern. Perhaps this is to signify a transfer will occur on the bus and the master should begin listening?

I know this info doesnt help you directly but I figured you wouldn't mind if I shared

Hmm, interesting. Strange that the checksum always is 1111. Do you have the codes for all the keys? Even though it's not directly related, I'll add the info to my message decoder page - the more details on this protocol the better!

I didn't notice that 9ms/4.45ms pulse in my system, but will check again to be sure as I haven't done raw snooping for a while.

I have managed to get the timing right on a PIC, so now it's slightly easier on the computer as it gets each nybble on a plate. Next job is to try feeding some data in, if I can get that timing right... my page is updated with the PIC code if you're interested.

Thanks for the info - if you send on the key codes I'll credit you on the page.

Cheers,

David.

 

[Dexter]

Hey,
yeah ive decoded all the keys and movements:

Control	 
/-------------------------------------------------------------|
|Menu Button         - 1000 0001 0101 0111 0011 0000 1100 1111|
|Voice Button	     - 1000 0001 0101 0111 0111 0000 1000 1111|
|Ret Button          - 1000 0001 0101 0111 1001 0000 0110 1111|
|Pos Button          - 1000 0001 0101 0111 1011 0000 0100 1111|
|Zoom-in Button	     - 1000 0001 0101 0111 1101 0000 0010 1111|
|Zoom-out Button     - 1000 0001 0101 0111 0101 0000 1010 1111|
|Enter Button	     - 1000 0001 0101 0111 0001 0000 1110 1111|
|Joystick Up	     - 1000 0001 0101 0111 1100 0000 0011 1111|
|Joystick Down	     - 1000 0001 0101 0111 0000 0000 1111 1111|
|Joystick Left	     - 1000 0001 0101 0111 0100 0000 1011 1111|
|Joystick Right	     - 1000 0001 0101 0111 1000 0000 0111 1111|
|Joystick Up+Left    - 1000 0001 0101 0111 0110 0000 1001 1111|
|Joystick Up+Right   - 1000 0001 0101 0111 1110 0000 0001 1111|
|Joystick Down+Left  - 1000 0001 0101 0111 1010 0000 0101 1111|
|Joystick Down+Right - 1000 0001 0101 0111 0010 0000 1101 1111|
\-------------------------------------------------------------/

I hope I decoded them correctly. Give me a second and I will post screencaps of my waveforms.

 

[djkoshea]

Control	 
/-------------------------------------------------------------|
|Menu Button         - 1000 0001 0101 0111 0011 0000 1100 1111|
|Voice Button	     - 1000 0001 0101 0111 0111 0000 1000 1111|
|Ret Button          - 1000 0001 0101 0111 1001 0000 0110 1111|
|Pos Button          - 1000 0001 0101 0111 1011 0000 0100 1111|
|Zoom-in Button	     - 1000 0001 0101 0111 1101 0000 0010 1111|
|Zoom-out Button     - 1000 0001 0101 0111 0101 0000 1010 1111|
|Enter Button	     - 1000 0001 0101 0111 0001 0000 1110 1111|
|Joystick Up	     - 1000 0001 0101 0111 1100 0000 0011 1111|
|Joystick Down	     - 1000 0001 0101 0111 0000 0000 1111 1111|
|Joystick Left	     - 1000 0001 0101 0111 0100 0000 1011 1111|
|Joystick Right	     - 1000 0001 0101 0111 1000 0000 0111 1111|
|Joystick Up+Left    - 1000 0001 0101 0111 0110 0000 1001 1111|
|Joystick Up+Right   - 1000 0001 0101 0111 1110 0000 0001 1111|
|Joystick Down+Left  - 1000 0001 0101 0111 1010 0000 0101 1111|
|Joystick Down+Right - 1000 0001 0101 0111 0010 0000 1101 1111|
\-------------------------------------------------------------/

That looks suspiciously like the nybble before the 1111 is the checksum...

 

[Dexter]

Here is a screen cap...did I decode it correctly or have I inverted it accidentally?

I see you posted PIC code on your site. Awesome! dude you rule! I was up last night trying to think up some code to get this to PC. This is awesome.

 

[djkoshea]

Here is a screen cap...did I decode it correctly or have I inverted it accidentally?

Ah, proper oscilloscope software, cool!

This looks a bit different - on the radio the low+high timings for each pulse were the same, regardless if they were 0 or 1 - 0 is .5ms low and 2.5ms high whereas 1 is 1.7ms low and 1.3ms high. Here the 1s seem longer. There seems to be a fixed length low pulse and then a high pulse whose length varies based on whether it's a 1 or a 0.

I see you posted PIC code on your site. Awesome! dude you rule! I was up last night trying to think up some code to get this to PC. This is awesome.

Thanks! The code will probably need some tweaking to work with this variation! But it beats trying to get it coded on the PC alone as the timing is difficult when interrupts mess you up.

David.

 

[mistered]

It seems David no longer has his Mazda 3, but I'm interested in continuing to look into this as I recently got a 2003 Protege. Is anyone interested in collaborating on figuring out the rest of the protocol and designing an audio + control interface for pc / ipod?

 

[Zero Cool]

I am very interested in this subject but dont have the data skills required. Maybe we can talk David into continuing. I would be willing to donate some $$$ for him to continue.

While we are at it. I have another project i need to talk with him about.


Zc

 

[mistered]

I am very interested in this subject but dont have the data skills required. Maybe we can talk David into continuing. I would be willing to donate some $$$ for him to continue.

While we are at it. I have another project i need to talk with him about.
Zc

I'm buying Superprotege's old stock radio so that I can work on this without taking my car apart The hardware for this project will be trivial; the only trick will be for me to find or borrow a changer / MD / one of the Alpine changer converters etc. to snoop on the data traffic to/from it.

 

[Zero Cool]

I might be willing to finance the hardware if needed. If there is something that is needed maybe i can buy it and send it to whomever for testing with the agreement that its sent back or other arriangments made etc.

I sent an email to the email address listed on djkoshea web page but i have not had a response thus far.


Zc