Question about using an e380 as a stand alone device

[Neilsproject]

As the title suggests, I am looking to set up an e380 as a stand alone device. Quick background...I am building a Lamborghini Aventador replica and the Audi MMI button pad (e380 from 2011 S4) is a close match to what is used for the Aventador center console. (Since oem Aventador parts are usually excessively expensive, it's much better to find cost effective alternatives). My prototype center console uses a simple Android touch screen system for the radio, navigation, etc, but I want to use the e380 for the buttons where possible. I am using an Arduino as an interface where needed; the e380 will talk to the Arduino, which will then interface with the Android unit (screen).

However, I don't have a j794 (mmi control head). I won't need it for the ultimate setup since all of its functions are done by the Android unit. Of course, the downside is while hacking the e380 I don't have access to the communication from the j794.

The connection between the e380 and the j794 is a simple rs232 serial connection. Based on research, my current "testing rig" has pin 8 (of the e380) grounded, 12v to pin 7, and 6v to pin 6 (wake up signal). Pin 16 is the serial data from the e380, and pin 15 is the serial data to the e380. (For diagnostic purposes, I can read the data stream on my
laptop connected to the Arduino). I setup the rs232 serial connection at 19200 baud, but I'll need confirmation that this is correct.

When I power up the e380, none of the leds light up. I do get a what appears to be a polling signal from the e380...7 bytes of data. This data stream is then repeated 20 (?) times with a 1 second delay between groups of 7 bytes. Afterwards, it stops Transmitting until I push the power button (the e380 volume knob), which makes the e380 repeat the data stream. Pushing other buttons does not result in any data output.

So... can anyone help me with this? Has anyone scanned the data going from the j794 to the e380? I'm guessing something else is needed other than just a constant 6v signal to the wake up wire, I.e an answer to the poll. Once the e380 is properly woken up, what responses are required after buttons are pushed? Again, I'm guessing that the j794 normally tells the e380 which leds to light up.

Any help would be appreciated!

Neil

[Neilsproject]

A quick update.

I've been doing some "bit-banging" and have made a little progress. First off, I have verified that the connection does run at 19200 baud. Also, I stated it was 7 bytes of data, but it is actually 11 bytes. If I transmit a "0x5a" (decimal 90) periodically (in this case every 50ms), it keeps the e380 on. From the 11 bytes, it appears that the first 3 bytes (0x00, 0xE0, 0x18) are static (i.e. they don't change). The next 4 appear to hold data. The last 4 start with 0xE0, and then have 3 bytes that could be acting as a checksum. From the 4 data bytes, the second byte seems to correspond to the two dials.

0x9E = volume +
0x98 = volume -
0x86 = wheel +
0xE6 = wheel -

I also get 0x80, 0x78 for the first 2 data bytes whenever the joystick is moved (though no information as to the direction).

Next step will be to see if I can find another code that triggers data from the buttons, and code that turns the lights on and off.

I'm still hoping someone has done something similar before, and is able to guide me with their insight.

Neil

[Neilsproject]

Another quick update. Unfortunately, it's not as complete an update as I would have liked. I did find the codes for the joystick but still can't get any buttons or lights to respond.

As mentioned in the last post, the 0x80 and 0x78 (4th & 5th data bytes) indicate the joystick has been moved. The position of the joystick is indicated with the last two bytes of the data string:

0x18 0xFE Down
0xF8 0xE6 Up
0x00 0xF8 Right
0x60 0xFE Left
0xE6 0xE6 Centered

0x06 0xFE Right Down
0x1E 0xF8 Left Down
0xFE 0x86 Right Up
0x?? 0x?? Left Up

The diagonal joystick detection was a little dicey. It's there, but getting the joystick in the right spot seemed tricky. I also couldn't seem to get it to point in the Left-Up position. For my purposes this shouldn't be a problem as the basic four directions are sufficient. But I don't like not being complete.

I'm still stuck on getting the buttons to respond. If anyone has the ability to read the rs232 stream coming from the MMI head unit (J794) to the e380, I'd appreciate if they could post it here to give me a clue as to where to go with it. Of course, there is also a possibility that my e380 is damaged and hence unable to respond.

Neil

[Neilsproject]

Ok.... so here's the fun update where I get to admit that I made a mistake and everything that I've written before now is incorrect....

Let me rephrase that. It's correct if you set your rs232 communications to 19200 baud. You will be able to read the codes as I've documented. However, my unit is actually operating at 9600 baud. I had found a thread from someone who posted the communication protocol, but I didn't realize that it was for a 3g+. The 2g and 3g apparently run at 9600 baud by default. After discovering this, I hooked up my oscilloscope and confirmed that it was indeed only running at 9600 baud. Of course you can read the data at 19200 baud (twice the true rate) but the results will be off. Effectively, you are reading each bit twice, and the start, stop and parity bits shift it all up.

So. 3g. 9600 baud. Let's try again.

The data stream is now down to 7 bytes. The first 2 bytes are static; 0x10 and 0x02. The next 2 bytes are data. Then 2 more static bytes; 0x10 and 0x03. The 7th byte is a checksum, which is the sum of the first 6 bytes.

The data byte(s) translate to:

0x40 = Vol+
0x41 = Vol-
0x50 = Wheel+
0x51 = Wheel-

0x38, 0x00 = joystick centered
0x38, 0x01 = joystick up
0x38, 0x02 = joystick up-right
0x38, 0x03 = joystick right
0x38, 0x04 = joystick down-right
0x38, 0x05 = joystick down
0x38, 0x06 = joystick down-left
0x38, 0x07 = joystick left
0x38, 0x08 = joystick up-left

The second data byte for the two wheels was either 0x01 or 0x02, but I couldn't figure out what this corresponded to. Possibly a single click versus multiple clicks, but I'll need to play with it more to confirm that.

Transmitting a 0x30 periodically, kept the e380 turned on.

Ok. Lots of new info to correct my previous mistake, but I'm still back to not knowing what to do with the buttons and leds.

The research continues...

Neil

[Neilsproject]

So I decided to purchase a J794 so that I can continue with the reverse engineering. Unfortunately, no one here jumped in with any info about the rs232 communications. I'll set up a mini loop to see what else is needed to get the buttons to respond (or determine if the e380 is damaged). Unfortunately, now I've got to wait at least 3 weeks for it to arrive...

[Neilsproject]

I received the J794 today and use it to set up my little two component network. I was worried that it would complain about not having a screen connected, but it seemed happy enough. I used a MOST bypass loop on the J794 and made a harness for the E380 with external connections on the two data lines. These connections went to an Arduino Mega through a couple of rs232 interfaces. Once everything was turned on, the buttons lit up when pushed and I received a nice stream of data from the J794. For some reason I'm not getting any data from the E380 now. It's obviously sending data, since the J794 respond and the lights on the E380 change appropriately. I'm guessing I have a bad connection to one of the rs232 interfaces, but I didn't have time to track it down yet. Unfortunately, I'm going to be away for the next few weeks so this will have to wait until then. But all in all, I'll consider this great progress. One thing I did notice... the polling response from the J794 is sent every 10 seconds. It's also about 10 bytes long. I look forward to decoding everything once I get back.

Neil