CD changer control protocol
We continue what we have begun . This time I will talk about what is contained in the payload of the I / K-bus frame, briefly about the device of the BMW e38, e39, e46, e53 infotainment system, and consider the protocol operation in more detail using the example of the CD changer.
According to the logic of things, the data link layer contains higher level protocols in its data. This is exactly what happens in I / K-bus, only there are no network and transport layer protocols similar to TCP / IP. There is no information about the network address anywhere in the frame, but interworking is possible. It is performed by means of a gateway, which is made in the unit of the instrument cluster. The essence of the gateway is simple - it knows in which network one or another block is located, in accordance with this, it sends the frame to another network if the sender and receiver are in different ones. This provides interworking at the data link layer as if it were a single network segment. The figure below illustrates the connection of networks in a common system of interaction between control units.
It should be clarified that the left scheme is valid for bodies e38 and e39, e53 with a block of a combination of devices of increased functionality (IKE high). In e39, e53 with the instrument cluster base unit (KOMBI), as well as in e46, the I-bus and K-bus are physically combined into one.
D-bus is a diagnostic bus (k-line). It connects diagnostic equipment. This bus does not have a physical connection to all control units, but through the gateway in IKE / KOMBI the interaction task is fully provided. For example, the navigation unit is connected only to the I-bus, but with the help of the service / diagnostic equipment, we can read service information, errors and encode.
What is contained in the payload of the I / K-bus frame, I will call the application layer protocol. At its core, it consists of two parts. MSG ID - message identifier, takes one character. MSG DATA - information supplementing the message, may be absent altogether or occupy up to 32 characters. The following figure shows how it looks:
Since the character consists of 8 bits, it turns out possible variations of commands (CMD ID) 256. A lot, probably even with a margin, and not all are known to me. But I will focus on some key ones.
Message with MSG ID = 01- request the status of the device. Before interacting with any device, you must make sure of its availability and serviceability. This command is sent to the device, the state of which must be verified. In this case, the MSG DATA field is not filled. To keep device status information up to date, the command is repeated periodically. Consider this type of message using the example of frame 68 03 18 01 72 (hereinafter, the contents of the frame will be indicated by numbers in hexadecimal notation). The frame is sent from the radio (device identifier 68 ) to the CD changer ( 18 ) with a status request (message identifier MSG ID = 01) The CD changer, if present and operational, responds with a message confirming the status of readiness (MSG ID = 02 ). A complete fragment of the response frame 18 04 FF 02 00 E1 . The answer is broadcast to everyone on the local network, since the recipient address is FF . Here, in addition to the message identifier, additional data is transmitted - MSG DATA = 00 . If the data value is 01 , then this means that the device has just turned on and this is its first readiness message. This type of dialogue is observed between many control units.
You can control the playback of music tracks, radio stations or change the volume level both from the steering wheel and from the center console. These controls transmit information to the radio via the same I-bus. The volume control messages are identified by number 32 , and the data contains control information. The structure of this message is given below.
The data consists of one byte, in which the blue bit is responsible for the direction of the level change: 0 - decrease, 1 - add. And the green bits show the strength of the relative change from 1 to 15 discrete levels. For example, a frame sent when you press the + button on the steering wheel looks like this 50 04 68 32 11 1F. This message causes the radio to increase the volume by 1 discrete level. If you turn the volume control knob on the center console clockwise, then frame C0 04 68 32 91 0F will be sent to the bus . Here, a multi-information display indicates the demand to increase the volume by 9 discrete levels.
Three types of messages are characteristic of button control: the button is pressed, the button is held for a long time and the button is released. In the message data, in addition to the state of the button, its identifier is transmitted. For example, a message with MSG ID = 3Bmeans that information is transmitted about the state change of the buttons on the steering wheel that are responsible for controlling the radio and telephone. MSG DATA consists of a single character and contains information about the button that has been exposed.
In blue bits, a button is indicated. If this is the 0th bit, then there was an effect on the "search up" button. If the 1st bit, then the "R / T" button. If the 3rd bit, then the "search down" button. In the green bit area, the status of the button is indicated. If all bits are 0, then this means that the button is pressed. If the 4th bit is 1, then there was a long hold of the button. If 5-bit is 1, then the button has been released. Consider the situation when we switch the music track to the next when you press a button on the steering wheel. Two frames will be sent to the bus at a small interval: 50 04 68 3B 01 06 and50 04 68 3B 21 26 . The first frame reports that the "search up" button has been pressed. The second reports that the search up button has been released.
For push-button control on the center console, whether it is a multi-information display or an on-board monitor, the approach is the same - information about the button ID and its status is transmitted. But the message structure is structured differently.
Now let’s take a look at how the infotainment system works on e38, e39, e53 cars. Namely, that part of it that is responsible for playing music and radio. In the figure below, I schematically presented the device of this part of the system.
The central role here is played by the radio (RAD). The fact is that in addition to the functions of receiving broadcast stations, this unit performs the functions of an amplifier. If the car is not equipped with an on-board monitor, then a cassette or CD player is located in the body of the radio receiver. In this embodiment, it is located in the center console. If the car is equipped with an on-board monitor, then the radio is located in the luggage compartment and is equipped with an audio input for a cassette player. The cassette player is mounted in the on-board monitor.
The speaker system can be in three versions: a simple stereo system, Hi-Fi or Top Hi-Fi. In the first case, the radio is directly connected to the speakers. In the Hi-Fi speaker system there are more speakers and they are connected to the radio through an additional amplifier. Such an amplifier, in addition to increasing the power of the audio signal, performs the functions of active equalization for car speakers and divides the sound into ranges for the respective speakers. The top hi-fi system is even cooler. In addition to all of the above, there is a subwoofer in it, and the amplifier performs equalization depending on the speed of the car, thereby compensating for the noise of the cabin. The system is also complemented by surround sound effect.
Information on the selected playback source, track number, frequency of the radio station, etc. is displayed, as well as control is performed on the center console via the on-board monitor or multi-information display or something else. In order not to be distracted from driving, audio playback control can be performed on the multi-function steering wheel (MFL) mentioned above.
The CD changer (CDC) is designed as an addition to the radio. Management commands and answers are exchanged only between the radio and the CD changer. This is done on the I-bus, like wine on the scheme. The audio signal in analog form is transmitted to the linear input of the radio receiver, where it is amplified and then fed to the speaker system. If the speaker system is top Hi-Fi, then the signal from the CDC is sent directly to the amplifier in digital form.
Now let’s take a closer look directly at the dialogue between the CD changer and the radio via the I / K-bus. As described earlier, the radio periodically sends out requests for the status of a CD changer. If this is present in the car and it is serviceable, then a presence response will be sent immediately to the bus. Having received the answer, the radio sets up an additional playback mode in the menu on the center console, in which the source is a CD changer. The driver only needs to press the appropriate button so that the radio starts playback from the CD changer, receives information about the loaded CD, track number and displays this information on the center console.
The control of the playback of the CD-chandelier is performed by a message with the identifier MSG ID = 38. The structure of the message is as follows:
As you can see, the message is simple in structure and contains two key parameters: CMD and ARG. The code of the required playback mode is transmitted to the CMD, and additional data to the ARG. For clarity and ease of understanding, the table below summarizes the well-known commands:
In this way, the CD changer is controlled, and this in turn supports feedback with messages with identifier 39:
In this message, the status of the CD changer and its playback mode are transmitted . More details about each message symbol in the following table:
It should be noted that there are control commands from the radio to which the CD changer should send an immediate response, as confirmation of the acceptance of the command, otherwise the commands will be sent again after a timeout of 500 ms. Such commands include: “start playback”, “stop playback”, “rewind”, “random track selection mode” and “track scan mode”. Having received a command with the corresponding CMD identifier, the CD changer changes the status indicator to the required request and sends a message to the radio receiver. In the case of the “rewind” command, the indicator remains in the simple playback mode, only the status changes to “FAST FORWARD” or “REWIND”. The radio calms down that the team has been accepted successfully and stops bombing with repeated messages.
Next, I want to bring the I / K-bus traffic log, where three devices are connected to the bus: a multi-information display, a radio receiver and a software emulator of a CD changer. I gathered this simple network on my desk in order to analyze how the control units interact and debug the software CD changer.
The color here highlights the CD changer control messages and the responses to them.
To summarize, I want to say that by applying this protocol to the simplest hardware and software solution, you can "legally" wedge into the car’s standard infotainment system. As the simplest example, create your own functional media player by modern standards, which will receive control commands from the steering wheel, center console and make sound using a standard speaker system.
Used sources:
According to the logic of things, the data link layer contains higher level protocols in its data. This is exactly what happens in I / K-bus, only there are no network and transport layer protocols similar to TCP / IP. There is no information about the network address anywhere in the frame, but interworking is possible. It is performed by means of a gateway, which is made in the unit of the instrument cluster. The essence of the gateway is simple - it knows in which network one or another block is located, in accordance with this, it sends the frame to another network if the sender and receiver are in different ones. This provides interworking at the data link layer as if it were a single network segment. The figure below illustrates the connection of networks in a common system of interaction between control units.
It should be clarified that the left scheme is valid for bodies e38 and e39, e53 with a block of a combination of devices of increased functionality (IKE high). In e39, e53 with the instrument cluster base unit (KOMBI), as well as in e46, the I-bus and K-bus are physically combined into one.
D-bus is a diagnostic bus (k-line). It connects diagnostic equipment. This bus does not have a physical connection to all control units, but through the gateway in IKE / KOMBI the interaction task is fully provided. For example, the navigation unit is connected only to the I-bus, but with the help of the service / diagnostic equipment, we can read service information, errors and encode.
What is contained in the payload of the I / K-bus frame, I will call the application layer protocol. At its core, it consists of two parts. MSG ID - message identifier, takes one character. MSG DATA - information supplementing the message, may be absent altogether or occupy up to 32 characters. The following figure shows how it looks:
Since the character consists of 8 bits, it turns out possible variations of commands (CMD ID) 256. A lot, probably even with a margin, and not all are known to me. But I will focus on some key ones.
Message with MSG ID = 01- request the status of the device. Before interacting with any device, you must make sure of its availability and serviceability. This command is sent to the device, the state of which must be verified. In this case, the MSG DATA field is not filled. To keep device status information up to date, the command is repeated periodically. Consider this type of message using the example of frame 68 03 18 01 72 (hereinafter, the contents of the frame will be indicated by numbers in hexadecimal notation). The frame is sent from the radio (device identifier 68 ) to the CD changer ( 18 ) with a status request (message identifier MSG ID = 01) The CD changer, if present and operational, responds with a message confirming the status of readiness (MSG ID = 02 ). A complete fragment of the response frame 18 04 FF 02 00 E1 . The answer is broadcast to everyone on the local network, since the recipient address is FF . Here, in addition to the message identifier, additional data is transmitted - MSG DATA = 00 . If the data value is 01 , then this means that the device has just turned on and this is its first readiness message. This type of dialogue is observed between many control units.
You can control the playback of music tracks, radio stations or change the volume level both from the steering wheel and from the center console. These controls transmit information to the radio via the same I-bus. The volume control messages are identified by number 32 , and the data contains control information. The structure of this message is given below.
The data consists of one byte, in which the blue bit is responsible for the direction of the level change: 0 - decrease, 1 - add. And the green bits show the strength of the relative change from 1 to 15 discrete levels. For example, a frame sent when you press the + button on the steering wheel looks like this 50 04 68 32 11 1F. This message causes the radio to increase the volume by 1 discrete level. If you turn the volume control knob on the center console clockwise, then frame C0 04 68 32 91 0F will be sent to the bus . Here, a multi-information display indicates the demand to increase the volume by 9 discrete levels.
Three types of messages are characteristic of button control: the button is pressed, the button is held for a long time and the button is released. In the message data, in addition to the state of the button, its identifier is transmitted. For example, a message with MSG ID = 3Bmeans that information is transmitted about the state change of the buttons on the steering wheel that are responsible for controlling the radio and telephone. MSG DATA consists of a single character and contains information about the button that has been exposed.
In blue bits, a button is indicated. If this is the 0th bit, then there was an effect on the "search up" button. If the 1st bit, then the "R / T" button. If the 3rd bit, then the "search down" button. In the green bit area, the status of the button is indicated. If all bits are 0, then this means that the button is pressed. If the 4th bit is 1, then there was a long hold of the button. If 5-bit is 1, then the button has been released. Consider the situation when we switch the music track to the next when you press a button on the steering wheel. Two frames will be sent to the bus at a small interval: 50 04 68 3B 01 06 and50 04 68 3B 21 26 . The first frame reports that the "search up" button has been pressed. The second reports that the search up button has been released.
For push-button control on the center console, whether it is a multi-information display or an on-board monitor, the approach is the same - information about the button ID and its status is transmitted. But the message structure is structured differently.
Now let’s take a look at how the infotainment system works on e38, e39, e53 cars. Namely, that part of it that is responsible for playing music and radio. In the figure below, I schematically presented the device of this part of the system.
The central role here is played by the radio (RAD). The fact is that in addition to the functions of receiving broadcast stations, this unit performs the functions of an amplifier. If the car is not equipped with an on-board monitor, then a cassette or CD player is located in the body of the radio receiver. In this embodiment, it is located in the center console. If the car is equipped with an on-board monitor, then the radio is located in the luggage compartment and is equipped with an audio input for a cassette player. The cassette player is mounted in the on-board monitor.
The speaker system can be in three versions: a simple stereo system, Hi-Fi or Top Hi-Fi. In the first case, the radio is directly connected to the speakers. In the Hi-Fi speaker system there are more speakers and they are connected to the radio through an additional amplifier. Such an amplifier, in addition to increasing the power of the audio signal, performs the functions of active equalization for car speakers and divides the sound into ranges for the respective speakers. The top hi-fi system is even cooler. In addition to all of the above, there is a subwoofer in it, and the amplifier performs equalization depending on the speed of the car, thereby compensating for the noise of the cabin. The system is also complemented by surround sound effect.
Information on the selected playback source, track number, frequency of the radio station, etc. is displayed, as well as control is performed on the center console via the on-board monitor or multi-information display or something else. In order not to be distracted from driving, audio playback control can be performed on the multi-function steering wheel (MFL) mentioned above.
The CD changer (CDC) is designed as an addition to the radio. Management commands and answers are exchanged only between the radio and the CD changer. This is done on the I-bus, like wine on the scheme. The audio signal in analog form is transmitted to the linear input of the radio receiver, where it is amplified and then fed to the speaker system. If the speaker system is top Hi-Fi, then the signal from the CDC is sent directly to the amplifier in digital form.
Now let’s take a closer look directly at the dialogue between the CD changer and the radio via the I / K-bus. As described earlier, the radio periodically sends out requests for the status of a CD changer. If this is present in the car and it is serviceable, then a presence response will be sent immediately to the bus. Having received the answer, the radio sets up an additional playback mode in the menu on the center console, in which the source is a CD changer. The driver only needs to press the appropriate button so that the radio starts playback from the CD changer, receives information about the loaded CD, track number and displays this information on the center console.
The control of the playback of the CD-chandelier is performed by a message with the identifier MSG ID = 38. The structure of the message is as follows:
As you can see, the message is simple in structure and contains two key parameters: CMD and ARG. The code of the required playback mode is transmitted to the CMD, and additional data to the ARG. For clarity and ease of understanding, the table below summarizes the well-known commands:
In this way, the CD changer is controlled, and this in turn supports feedback with messages with identifier 39:
In this message, the status of the CD changer and its playback mode are transmitted . More details about each message symbol in the following table:
It should be noted that there are control commands from the radio to which the CD changer should send an immediate response, as confirmation of the acceptance of the command, otherwise the commands will be sent again after a timeout of 500 ms. Such commands include: “start playback”, “stop playback”, “rewind”, “random track selection mode” and “track scan mode”. Having received a command with the corresponding CMD identifier, the CD changer changes the status indicator to the required request and sends a message to the radio receiver. In the case of the “rewind” command, the indicator remains in the simple playback mode, only the status changes to “FAST FORWARD” or “REWIND”. The radio calms down that the team has been accepted successfully and stops bombing with repeated messages.
Next, I want to bring the I / K-bus traffic log, where three devices are connected to the bus: a multi-information display, a radio receiver and a software emulator of a CD changer. I gathered this simple network on my desk in order to analyze how the control units interact and debug the software CD changer.
The color here highlights the CD changer control messages and the responses to them.
- Yellow is a switch to the previous track.
- Green - turn on / off the rewind
- Blue - turn on and off the mode of performing tracks in random order.
To summarize, I want to say that by applying this protocol to the simplest hardware and software solution, you can "legally" wedge into the car’s standard infotainment system. As the simplest example, create your own functional media player by modern standards, which will receive control commands from the steering wheel, center console and make sound using a standard speaker system.
Used sources:
- Bus System Troubleshooting, 2001
- I-BUS Inside, Franck Touanen, 2002