Trying to hack a digital audio input to my old car head unit

December 10, 2020, 07:12:29 pm

Hi everyone. This is my first time really messing around with hardware at the bus level. Am a genetics researcher by training, so I do a little bit of bioinformatics coding, but nothing like this at all.

Background story: I upgraded the sound system in my car, but retained the factory head unit. It uses a proprietary fiber optic signal (MOST) to send audio from the head unit to the amplifier. The new system sounds great with CDs, but the aux input sounds like total garbage. I want to add in either an I2S or an SPDIF input to this thing so that I know I am getting a high-quality audio input.

Step 1: Tear the radio apart and look at the chips. Radio is a 2007 BMW CD73 head unit.

After inspecting the chips on the front and back of the device, the SAA7706H seemed like the chip I wanted to hack into.
https://www.nxp.com/docs/en/data-sheet/SAA7706H.pdf

The chip has an I2S input from the CD drive and two SPDIF inputs.
It also has an I2C bus. The bus is used to select which audio input signals are used (I think).

My goal(s):
1) Input a digital audio signal
2) make it as seamless as possible - Ideal solution is when the aux input option is selected, another chip I solder in there intervenes and activates either the CD I2C signal or one of the two SPDIF inputs.

To accomplish goal 1:
I have already soldered wires and quick disconnects to the two SPDIF inputs pins, the CD I2S pins, and the I2C pins directly on the chip. At this time, I am unable to test any of the inputs without changing the way the audio is output from the head unit through BMW settings. Cable to do this is on its way in the mail. I also ordered a breakout board (CM6631A) that streams digital audio over usb to I2S/SPDIF for 25 bucks on ebay.

To accomplish goal 2:
I want to do the following
1. Sniff and record messages sent on the I2C bus while switching input options on the head unit. This will help me identify what I2C signals are send when inputs are selected.
2. Practice writing to the I2C bus using my bus pirate v3.

I am currently messing around interfacing with the I2C bus using the bus pirate, and I am having some trouble. I want to do something simple like read the status register of the DSP2 in the SAA7706H (p33 of the datasheet).

I have the USB plugged in to my bus pirate. I connected to the bus pirate and can interface with it.
I also have the bus pirate hooked to the I2C bus with the following connections
1) BP Ground to the metal case of the head unit
2) BP MOSI to SDA
3) BP CLK to SCL

Pins are correct and tested with a cheap clone logic analyzer.
I connect to the I2C bus using 400Khz (found on p9 of datasheet)

I am not sure how to go from here. I want to read Register 1FFEH <- (I assume H means hex and is not included for the register address)

So, I tried entering this command based on what I read from pp31-32 of the datasheet:

Code: [Select]

[  00111001 0x1FFE ]

which I think should send the message START, and then read register 0x1FFE... ? I could be totally wrong here.

Sometimes I get ACK as a response for each of the two commands, sometimes I get a NACK have to restart the head unit power and bus pirate to get an ACK.
Sometimes I get a warning that the pull-up wire is not connected. (It's not... Does it need to be connected? Where?)

Here is some of my log trying to mess with the I2C interface. Note how it warns about no pull up and suddenly stops responding with ACK.

Code: [Select]

I2C>[0x5c 0x5c [ 0xFFF r:8]
Warning: *Short or no pull-up
I2C START BIT
WRITE: 0x5C ACK
WRITE: 0x5C ACK
Warning: *Short or no pull-up
I2C START BIT
WRITE: 0xFF ACK
READ: 0x00  ACK 0x00  ACK 0x00  ACK 0x00  ACK 0x00  ACK 0x00  ACK 0x00  ACK 0x00
NACK
I2C STOP BIT
I2C>[0x5c 0x5c [ 0xfff]   
Warning: *Short or no pull-up
I2C START BIT
WRITE: 0x5C ACK
WRITE: 0x5C ACK
Warning: *Short or no pull-up
I2C START BIT
WRITE: 0xFF ACK
I2C STOP BIT
I2C>[0x5c 0x5c [ 0xfff ]
I2C START BIT
WRITE: 0x5C NACK
WRITE: 0x5C NACK
I2C START BIT
WRITE: 0xFF NACK
I2C STOP BIT
I2C>

I'm going to keep plugging away at this but if anyone has comments or suggestions, please let me know!

Thanks!
Alex

Re: Trying to hack a digital audio input to my old car head unit

Reply #1 – December 11, 2020, 06:13:32 am

Sorry for the double post, I could not figure out how to edit my first post.

Figured it out. One of my wires fell off and I had soldered it to the wrong pin. Retracing my steps with the logic analyzer helped me diagnose.
No need to worry about pull up settings (I think)

Check it out. I can read the 24 bit (memory address?) using the 16 bit Selector register 0x1F 0xF7!
As I switch between radio and CD input, the third byte changes from 0x80 to 0x81! Nice!

Code: [Select]

(1)>4
Set speed:
 1. ~5KHz
 2. ~50KHz
 3. ~100KHz
 4. ~400KHz

(1)>4
Ready
I2C>(1)
Searching I2C address space. Found devices at:
0x22(0x11 W) 0x38(0x1C W) 0x39(0x1C R) 

I2C>[0x38 0x1f 0xFE [0x39 r:3 ]
I2C START BIT
WRITE: 0x38 ACK 
WRITE: 0x1F ACK 
WRITE: 0xFE ACK 
I2C START BIT
WRITE: 0x39 ACK 
READ: 0x88  ACK 0x1F  ACK 0x41 
NACK
I2C STOP BIT
I2C>[0x38 0x1f 0xf7 [0x39 r:3 ]
I2C START BIT
WRITE: 0x38 ACK 
WRITE: 0x1F ACK 
WRITE: 0xF7 ACK 
I2C START BIT
WRITE: 0x39 ACK 
READ: 0x20  ACK 0x04  ACK 0x80 
NACK
I2C STOP BIT
I2C>[0x38 0x1f 0xf7 [0x39 r:3 ]
I2C START BIT
WRITE: 0x38 ACK 
WRITE: 0x1F ACK 
WRITE: 0xF7 ACK 
I2C START BIT
WRITE: 0x39 ACK 
READ: 0x20  ACK 0x04  ACK 0x80 
NACK
I2C STOP BIT
I2C>[0x38 0x1f 0xf7 [0x39 r:3 ]
I2C START BIT
WRITE: 0x38 ACK 
WRITE: 0x1F ACK 
WRITE: 0xF7 ACK 
I2C START BIT
WRITE: 0x39 ACK 
READ: 0x20  ACK 0x24  ACK 0x81 
NACK
I2C STOP BIT
I2C>[0x38 0x1f 0xf7 [0x39 r:3 ]
I2C START BIT
WRITE: 0x38 ACK 
WRITE: 0x1F ACK 
WRITE: 0xF7 ACK 
I2C START BIT
WRITE: 0x39 ACK 
READ: 0x20  ACK 0x24  ACK 0x81 
NACK
I2C STOP BIT
I2C>[0x38 0x1f 0xf7 [0x39 r:3 ]
I2C START BIT
WRITE: 0x38 ACK 
WRITE: 0x1F ACK 
WRITE: 0xF7 ACK 
I2C START BIT
WRITE: 0x39 ACK 
READ: 0x20  ACK 0x24  ACK 0x81 
NACK
I2C STOP BIT
I2C>[0x38 0x1f 0xf7 [0x39 r:3 ]
I2C START BIT
WRITE: 0x38 ACK 
WRITE: 0x1F ACK 
WRITE: 0xF7 ACK 
I2C START BIT
WRITE: 0x39 ACK 
READ: 0x20  ACK 0x04  ACK 0x80 
NACK
I2C STOP BIT
I2C>