CDC Protocols

This page contains informations, links and descriptions about various CD
changer protocols.
Choose your brand:

Blaupunkt DMS	Kenwood	Pioneer	Panasonic	Alpine M-Bus
Volkswagen VW	Clarion	Ford ACP	Renault	Toyota
Chrysler/Jeep/Dodge

---

Blaupunkt ( DMS ?? )

Here some source code for controlling a Blaupunkt car radio.

It is basically a 2 wire (rx/tx) async. serial protocol with 9 bits of data
where the 8th bit is used for synchronisation.

That made it easy to interface it to a player or PC because you can use the
serial port.

The only documents that’re left is one sheet of paper containing the initial
communication between a cd changer and the radio and

the source code.

Here is the protocol cut:

radio	direction,info	changer
	baudrate 4800
0×17B	(3 times ) ->	no response
0×17C	(3 times ) ->	no response
0×17D	(3 times ) ->	no response
0×17E	(3 times ) ->	no response
0×17F	(3 times ) ->	no response
0×180	->	0×180
0×48	->	0×48
0×02	->	0×02
0×14F	->, change in baudrate to 9600	no response
0×180	->	0×180
0×9F	->	0×9F
0×14F	->	no response
0×180	->	0×180
0xA1	->	0xA1
0×14F	->	no response
0×180	->	0×180
0xAD	->	0xAD
0×14F	->	no response
0×180	->	0×180
0×48	->	0×48
0×01	->	0×01
0×14F	->	no response
0×10F	<-	0×10F
0×48	<-	0×48
0×01	<-	0×01
0×14F	<-	0×14F
0×103	<-	0×103
0×20	<-	0×20
0×09	<-	0×09
0×20	<-	0×20
0×00	<-	0×00
0×14F	<-	0×14F
0×10B	<-( text info ??? )	0×10B
0×20	<- (8 times space )	0×20
0×14F	<-	0×14F
0×101	<-( disc / track info ??? )	0×101
0×09	<-	0×09
0×01	<-	0×01
0×14F	<-	0×14F
0×10D	<- ( disc / track / time info ( BCD ) ?? )	0×10D
0×01	<-	0×01
0×09	<-	0×09
0×43	<-	0×43
0×57	<-	0×57
0×14F	<-	0×14F

---

Kenwood

Recommended links:

Patrick Loef’s Page with AVR
based Kenwood CD changer emulator (KECANI)

The protocoll used here is a synchron serial protocoll.

First let us start with the connector pinout.

The pins have a 2.54mm distance, so you can simply build a plug using some
prototyping board ………

New connector pin-out (for head units >’99?) Thanks to Patrick Loef for this
information.

pin	direction	description
1	O	CH-REQH – Request output to changer; “Low” : Request
2	-	Ground
3	-	Vcc +12V
4	O	CH-CON – Changer control; “High” : Operation mode “Low” : Standby
5	I	CH-MUTE – Mute request from changer; “High” : Mute
6	-	AGND – Audio Ground
7	O	CH-RST – Reset output to changer
8	I	Audio right channel
9	I	CH-REQC – Request input from changer; “Low” : Request
10	I	CH-DATAC – Data input from changer
11	O	CH-DATAH – Data output to changer
12	I	Audio left channel
13	I/O	CH_CLK – Clock input/output for changer

The following works only with newer kenwood radios.

Older models have the same pinout but use some more simple protocol …

The clock low and high periods had a length of 4us.

The data is transfered in bytes ( 8 bits … MSB first ), data is valid at
the rising clock edge..

The data transfer is initiated either by the radio or the changer, the initiator
just pulls its fs line low.

When the changer starts the communication it gets 40 clocks from the radio
( 4 bytes addr + 1byte data size ).

The radio then sets its fs to low if it accepts the transfer.

When a transfer is initiated by the radio by setting its fs low it waits for
the changer to answer with a low fs,

then it sends the 4 byte addr header, the size byte for the data and the data.

Packet header, direction: both
byte	log value ( r->cdc)	description
0	0×29	destination address
1	0×10	destination address
2	0×1E	own address
3	0×00	own address
4	x	data size in bytes
5	x	first data byte
4+data size	x	last data byte

From this point I only write the data part of a packet

initialisation handshake answer, direction: cdc->r
byte	log value	description
0	0×11	command identifier
1	0xA4	cycle numer of the above packet
2	0×00	??
3	0×01	??
4	0×02	??

send after above packet, maybe radio identification and caps, direction: r->cdc
byte	log value	description
0	0×20	command identifier
1	0×00
2	0×11
3	0×01
4	0×03
5	0×0B
6	0×0B
7	0×07
8	0×05
9	0×83
10	0×84
11	0xC0
12	0xC1
13	0xC2
14	0xC3
15	0xC4
16	0xC5
17	0xC6

send after above packet, maybe init ack from radio, direction: r->cdc
byte	log value	description
0	0×20	command identifier
1	0×01
2	0×11
3	0×29	changer address
4	0×10	changer address
5	0×00	maybe last bytes of cmd 0×11(cdc->r)
6	0×01	maybe last bytes of cmd 0×11(cdc->r)
7	0×02	maybe last bytes of cmd 0×11(cdc->r)

changer caps info, send after above packet, direction: cdc->r
byte	log value	description
0	0×70	command identifier
1	0×02
2	0×0A	maybe disc count
3	0×3F
4	0×03
5	0×0C
6	0×02

play position info, direction: cdc->r
byte	log value	description
0	0×60	command identifier
1	0×02	maybe sub command id
2	0×00
3	0×00
4	0×00	error code, 0 is no error
5	0×00	changer status ( load, eject, ….. )
6	0×02	play status (1 – play, 2 – pause )
7	0×00
8	0×01
9	0×00	track order mode ( normal 0, tscan 1, dscan 2,random 6, …)
10	0×04
11	0xBB	some bcd number field, displayed when field 3 != 0
12	0×01
13	0×0B	track number
14	0×07	disc number
15	0×01	min ( bcd )
16	0×22	sec ( bcd )
17	0×62	min disc ( bcd )
18	0×26	sec disc ( bcd )
19	0×09	min remain ( bcd )
20	0×30	sec remain ( bcd )

text info request, direction: r->cdc
byte	log value	description
0	0×42	command identifier
1	0×02
2	0×07	disc number
3	0×0A	track number
4	0×00	text section number, sections had 12 bytes size here
5	0×00
6	0×80	text id ( 0×80 -> name 0×81 -> artist )

text info send after request, direction: cdc->r
byte	log value	description
0	0×62	command identifier
1	0×02
2	0×07	disc number
3	0×02
4	0×0A	track number ( 0 -> disc title transfer )
5	0×00	text section number, sections had 12 bytes size here
6	0×09
7	0×00
8	0×80	text id ( 0×80 -> name 0×81 -> artist )
9..20	x	text

commands send when keys on the radio were pressed, direction: r->cdc
byte	log value (play)	fwd(toggle)	bwd(toggle)	disc-(toggle)	disc+(toggle)	description
0	0×50	0×50,0×50	0×50,0×50	0×50,0×50	0×50,0×50	command identifier
1	0×02	0×01,0×04	0×01,0×04	0×02,0×00	0×02,0×00	maybe event id ( 0 all up, 01 down, 02 toggle, 04 up, 06 hold )
2	0×02	0×02,0×02	0×02,0×02	0×02,0×02	0×02,0×02
3	0×00	0×02,0×02	0×02,0×02	0×00,0×00	0×00,0×00
4	0×07	0×01,0×01	0×02,0×02	0×04,0×00	0×02,0×00	key id
5	0×00	0×05,0×05	0×06,0×06	0×00,0×00	0×00,0×00

Using the information above you should have some starting point if you are
intrested in doing your own project, it is simple to build

a converter to send and receive these commands using a pc so you can find
out the meaning of other commands and fields if you need.

---

Pioneer

The pioneer IP bus uses a 2 wire differential signal for communication.

An equal level on both lines is a logical low while a high is encoded as a
voltage difference of some 100mV.

I think a CANbus tranceiver should work here.

The data transfer is initiated by either the cd changer or the radio.The initiator
generates a high pulse ( ca. 170us ) and a following low pulse ( ca 20us ).

Then the data transfer starts, a 1 is encoded as a high-low sequence with
a duration of ap. 20us for both levels and a 0 consists of a 33us high and
a 7us low pulse.

The data is now transfered in bytes with MSB first, the 8th bit is an odd
parity bit.At the end of the 3rd and all following Bytes there is an additional
bit inserted after the parity where the receiver acknowledges the transfer.

This is done by holding the data lines in a high state after the initiator
sets them low.If this ack is missing the transfer is stopped.

The timings may vary because the real data is encoded in the pulse to space
length relation.

The first 3Bytes seem to be some kind of device address.The changer I used
transfered a 0×88,0×68,0×00 here while the radio sended 0×88,0×08,0×06.

The next 4 bits were always high. After that a size byte and then size bytes
were transfered. The last byte in the transfer is a checksum generated adding
the values of all data beginning with the 4bit sequence ( = 0×0F ).

In the following part I only will write the raw data excluding size and cheksum
field.

Each command transfered was first answered by some acknowledge packet consisting
of a single 0xA1.

(which looks like: 0×88 0×08 0×06 0xF 0×02 0xA1 0xB2 -> 0xB0 is the checksum
).

For now I just figured out some very basic things like the fields where time,
track and disc number are encoded and also some

key codes the radio sends. There are many more fields in the packets where
i still don’t know the meaning of.

(I just got the radio from a friend for some days and so I couldn’t do so
much more on it … however .. if somebody is intrested in some

more information and is wiling giving me a radio and a changer for some weeks
I’ll try to do some more …. )

I have also designed a small circuit using a AT90S2313 controller which can
be used for logging the transfer through the pc serial port and also

to send commands.

The following packet sended by the changer contained the time disc and track
information.

Byte

0

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

Info

command

modus

mcd

disc

min

sec

track

cdt

Data

0×61

0×10

0×06

0×01

0×20

0×04

0×16

0×01

0×06

0×01

0×00

0×00

0×01

0×00

0×3F

0×00

0×00

0×00

0xC0

0×48

modus:

Value	0×02	0×07	0×08	0×10	0×11	0×13	0×14	0×15	0×16
Info	ready	track blink	pause	ready and disc blink	disc blink	load and disc blink	eject and disc blink	load	eject

cdt: bit0: (1:cdtext),(0:normal)

The text information was encoded within this packet

Byte

0

1

2

3

4

5

6

7

8

9

10

11

12

13-22

Info

command

modus

disc

track

text seqence number

text

Data

0×61

0×10

0×06

0×01

0×20

0×04

0×38

0×09

0×00

0×06

0×00

0×00

0×00

0×00

Recommend link: Vitaliy’s Page @ http://www.vitat.spb.ru/
with IP bus interface on AVR basis and more IP bus informations

Possibly pinout of Pioneer headunit in Renault Espace III

---

Panasonic

The protocol panasonic uses is of the serial sync. type. There is one data
line, a clock line and a sync line the changer uses to send data to the radio.

The radio to changer communication is done by some signals known from standard
IR remote controls (without a carrier) using one dataline.

This remote control signal is pulse width modulated,the dataline is active
high.

After an initail high(9ms) low(4.5ms) there follows a 32 bit sequence with
a 0 encoded as 550us high,550us low and a 1 as 550us high,1.7ms low.

If the low pulse in the init phase is only 2.25ms long it is just a signal
send periodical when a key is hold down and there are no data bits.

The data is transfered lsb first, the 1st byte is 0xFF-0th byte and the 3rd
byte is 0xFE-2nd byte.The 2nd byte is the command.

The changer to radio communication transfers the data in bytes msb first,
the data is valid at the falling clock edge and a low pulse of one half clock
period is sent after the first and the last byte of the transfer on the sync
line..The clock period is arround 8us.

There was only one packet containing state, time, disc and track information.

Byte	0	1	2	3	4	5	6	7
Info		disc(b0-b3)	track	min	sec	state
Data	0xCB	0×42	0×09	0×02	0×56	0×00	0×30	0xC3

state:

Value	0×00	0×10	0×20	0×04	0×08
Info	normal	scan	random	random	repeat

Recommended links:

Panasonic CD Changer
Emulator – PIC 16F84A controlled

Homepage
by Matthias Klumpp – Descripting an Atmel based Panasonic CDC simulator
for VW and Audi car radios.
(Languages: German, English and Portuguese)

---

Alpine M-Bus

For informations about the Alpine M-Bus protocol see this page:

http://kiora.ath.cx/alpine/

---

Volkswagen VW

VWCDPIC

Pre-assembled boards that let people use the VW CD Changer connector
for auxilary audio inputs.

Schematic diagrams and firmware source code under GNU GPL available.

Ed Schlunder’s VWCDPIC
- VW CD changer emulator / audio interface

---

Clarion

This should be the pinout for the Clarion 13-pin DIN connector which is used
for Clarion C-Bus.

---

Ford ACP

The following informations are taken from Andy Hammonds Yampp3/USB MP3 player
firmware with ACP protocol support.

Ford ACP is a network protocol used by the Head Unit to communicate with
and control audio devices such as the Ford 6 disc CD Changer and the Nokia
integrated cell phone or Ford Telematics units.

It is based on RS485 with 9 bit character data at 9600 baud.

A MAX-481 low power RS485 transceiver will work as interface between a serial
USART and ACP bus.

Pin Function

1 ACP +

2 ACP Shield

3 GND

4 n/c

5 Audio Left +

6 Audio Right +

7 ACP -

8 CDENABLE

9 +12V Power (unfused)

10 Audio Shield

11 Audio Left -

12 Audio Right +

You will need an AMP plug to connect to the head unit.

AMP Multilock Series 40 cable connector housing with 12 pins or sockets.

The CDENABLE line is 0V when the radio is off and +10V when it is on and
can be used as a standby switch for the yampp.

It is not a power supply and can’t drive a relay directly.

Communication

* a delay of 1642us (16 Bit times) will indicate a start of new message

* the 9th bit in a byte must be set in the last byte of message to indicate
the end of message

* Acknowledge is given with 0×06

Byte 0 – Medium/Priority, should be 0×71

Byte 1 – Changer functional address, should be 0×9A or 0×9B

Byte 2 – Head unit address, 0×80 on receive, 0×82 on transmit

Byte 3 – Command control byte

• 0xE0 – Handshake 1, byte 4 should be 0×04
• 0xFC – Handshake 2, byte 4 must be the same for transmit and receive
• 0xC8 – Handshake 3, byte 4 must be the same for transmit and receive
• 9xFF – Current disc status in byte 4
  • • Byte 4 – 0×00 Disk OK
    • Byte 4 – 0×01 No disc in current slot
    • Byte 4 – 0×02 No disc at all
    • Byte 4 – 0×03 Check current disk
    • Byte 4 – 0×04 Check all disc
• 0xC2 and 0xD0 – Change or request current disc
  • • Byte 1 – 0×9A – command to change disc
    • Byte 1 – not 0×9A – request current disc
    • Byte 4 – disc number
• 0xC1 – Control command
  • • Byte 4
      • Bit 0 – Fast search
      • Bit 1
      • Bit 3
      • Bit 4 – change Random status
      • Bit 5 – change Loudness status
      • Bit 6 – change Play/Stop status
      • Bit 7
    • Send back byte 4 with actual mode
• 0xC3 – Next track
  • • Byte 4 – Track number
• 0×43 – Previous track
  • • Byte 4 – Track number

The last byte in all message is a checksum of all previous bytes. Simply add
all bytes of message to calculate the checksum.

Message examples

To display current play time, disc and track number:

Byte 0	1	2	3	4	5	6	7	8
0×71	0×9B	0×82	0xD0	Disc No	Track No	Minutes	Seconds	Checksum

No disc message:

Byte 0	1	2	3	4	5
0×71	0×9B	0×82	0xFF	0×01	Checksum

All informations are given without guarantee. Please mail for update or change
requests.

---

Renault (Tuner
List / Update List)

This project aims at PC emulation of a VDO/Dayton CD changer (CDC) compatible,
among others, with the factory “Tuner List” head units of Renault
and Dacia cars since 2000. Higher-end “Update List” models, although
they provide an analog auxiliary input, can still enjoy some benefits using
this project, including improved sound quality thanks to SPDIF.

The emulator site: http://tlcdcemu.sourceforge.net/

The protocol description: http://tlcdcemu.sourceforge.net/protocol.html

---

Toyota AVCLan

Interesting site about the Toyota AVCLan protocol for multimedia devices
including protocol details and emulator hardware to access the AUX-In input
on Toyota car audio units.
http://www.softservice.com.pl/corolla/avc/

---

Chrysler / Jeep / Dodge

The given informations are only valid for Chrysler / Jeep OEM radio with J1850 VPW (PCI) bus connection between radio and CD changer. (most radios before 2005)

Example: or

Communication between radio and CD changer works over the cars J1850 VPW bus system. This bus is in accordance with specification SAE J1850, the protocol uses one byte header frames in accordance with SAE J2178.

The radio will poll the changer with the following frame:

Frame header	0×8D	CD Changer control frame
Data byte 1	0×0F	Poll to CD changer
Date byte 2	0×00	Actual Radio mode 0×01 = Radio off 0×10 = Internal CD drive 0×20 = Mode MW or LW 0×21 = Mode FM 0×24 = Mode CD changer
CRC

The following frame is the poll response if changer is in idle mode or changing disc/track:

Frame header	0×8D	CD Changer control frame
Data byte 1	0×93	Response to frame 8D 0F – Pong from CD changer when in idle status
Data byte 2	0×01	Actual disc, range 0-0xFF, Hex coded 0-9 = numbers 0-9 A = ‘:’ B = ‘;’ C = ‘<’ D = ‘=’ E = ‘>’ F = ‘?’
Data byte 3	0×01	Actual track, range 0-0xFF, Hex coded 0-9 = numbers 0-9 A = ‘:’ B = ‘;’ C = ‘<’ D = ‘=’ E = ‘>’ F = ‘?’
Data byte 4	0×80	Display control 0×02 = Blinking “SCAN” text 0×04 = “RND” activated 0×30 = “NO MAG” text 0×60 = “NO DISC” text 0×70 = “–:–” steady 0×80 = Disc number + radio clock 0×90 = Disc number + track number + radio clock 0xA0 = Disc number + track number + “00:00″ 0xB0 = Disc number + track number + song play time
CRC

The following frame is the poll response if changer is playing a track:

Frame header	0×8D	CD Changer control frame
Data byte 1	0×94	Response to frame 8D 0F – Pong from CD changer while playing
Data byte 2	0×00	Actual minutes of play time, range 0-99, BDC coded If byte is 0×9x the time is displayed like “-0:00″, remaing time
Data byte 2	0×00	Actual seconds of play time, range 0-99, BCD coded
CRC

This frame must be send before the first 0×8D 0×94… frame, otherwise time update is not possible:

Frame header	0×8D	CD Changer control frame
Data byte 1	0xE1	Command to activate time display Required before 8D 94 Otherwise play time update not possible
Data byte 2	0×01	???
Data byte 3	0×10	???
CRC

The following frame will be send from radio to the changer, if a changer related button was pressed:

Frame header	0×3D	CD Changer control frame, button press
Data byte 1	0×12	???
Data byte 2	0×81 0×83 0×84	??? With “TUNE” and “SEEK” button ??? With “DISC” button ??? With “RND” button
Data byte 3	0×26	Key ID 0×23 = Button “TUNE FF” pressed 0×24 = Button “TUNE RW” pressed 0×25 = Button “TUNE” released 0×26 = Button “SEEK UP” pressed 0×27 = Button “SEEK DOWN” pressed 0×35 = Button “RND” pressed 0xF1 = Button “DISC UP” pressed 0xF2 = Button “DISC DOWN” pressed
CRC

To activate the CD changer audio inputs you simply answer the poll frame 0×8D 0×0F with response frame 0×8D 0×93.

Be aware that the CD changer bus (J1850/PCI) is the same bus where all other control boxes are connected together, like ECU, RKE or SKIM module. So be carefull while handling the bus, mistakes can lead to serious damage on your car.

Radio connector pinout:

Valid for this type of connector.

Radio Connector
Pin	Layout Code	Description
1	BATT	Fused B+ (IOD)
2	AC	Fused Ignition Switch Output (run-acc)
3	P-LAMP	Panel Lamp Driver
4	Side-M	???
5	NC	No Connection
6	NC	No Connection
7	RF-	Right Front Speaker +
8	RF+	Right Front Speaker -
9	LF-	Left Front Speaker +
10	LF+	Left Front Speaker -
11	GND	Ground
12	BATT	Fused B+ (IOD)
13	P-ANT	Ant/Amp Remote (12V Output during Radio ON)
14	J1850	PCI Bus
15	EVA-MUTE	Speaker Mute Input (Low active)
16	NC	No Connection
17	NC	No Connection
18	LR-	Left Rear Speaker -
19	LR+	Left Rear Speaker +
20	RR-	Right Rear Speaker -
21	RR+	Right Rear Speaker +
22	GND	Ground
CD Changer Connector
Pin	Layout Code	Description
1	CDC R	CD-Changer Audio Input Right
2	S-GND	Shield Ground
3	GND	Ground
4	J1850	PCI Bus
5	CDC ACC	CD-Changer Ignition Switch Output (run-acc)
6	CDC L	CD-Changer Audio Input Left
7	GND	Ground
8	NC	No Connection
9	RDW	???
10	CDC BATT	CD-Changer B+ Output

Chrysler/Jeep CD changer emulator

Hardware schematic and layout:

Firmware file: