Creating AUX input for Kenwood GX806EF2 radio with i2c bus grab

The hero of the note, the Kenwood GX806EF2 radio cassette player, is famous for being installed in a very large number of export Japanese cars (take at least the Subaru Forester) and has no AUX input for connecting external sound sources, nor the ability to play MP3 files from CDs (with external drives too). The tape recorder came out quite utilitarian for its time (2004-2007), despite the CD changer on 6 CDs. CD audio, FM / AM tuner, and everything, but the cassette receiver, by the way, no longer exists.

But still make it an AUX input without damage to the appearance and functionality.

I got this radio along with the car. Having mounted an Android 7 tablet in the navigation booth, I began to look for ways to get the sound from the tablet to the radio tape recorder, but I didn’t want to buy a new “head” for this.
It turned out that many people disconnect the internal CD changer and connect serially produced emulators with the ability to play MP3 via USB, for example , but it seemed to me excessive vandalism with excessive costs.
')
The transmission of sound from an external device can also be solved with the help of an FM transmitter, but the sound quality with this option is very poor and there is also a link with an extra cost to the FM transmitter and its placement in the cabin.

In some places I found mentioning about cutting the AM tuner line from the radio tape recorder and using its remainder for external sound, but this is not feasible with this particular radio tape recorder, in any modes of the tuner the signals go in the same line. It was decided to analyze the entire scheme of the radio tape recorder for "vulnerable" places.

You can see the glued scheme of the main board here . Here is the interesting part of the scheme:



The sought-for is located next to the TDA7406 audio processor (IC203 in the diagram) from STMicroelectronics. In red, I circled the i2c bus, which connects the main controller with the IC203 chip, the blue one — the unused audio inputs MD and TAPE. As it turns out from the datasheet on this chip, it has 4 separate stereo audio inputs and 4 separate mono audio inputs. However, they are not used all, and unused “plugged” capacitors on the ground (C233-C236 example).

Having studied the principle of operation of the TDA7406, I realized that you can try to hook into the control of the main controller and use unused audio inputs when necessary. I soldered the wires SDA and SCL (resistors R855, R857) and connected a logic analyzer to them:



It turned out that during normal operation the controller requests the TDA7406 status on the i2c bus every half second. There is nothing interesting in this request for us - there are TDA7406 status flags. There are no control commands at rest:




The most interesting thing on the bus occurs at the time of switching modes CD / BAND and when the volume changes. In such cases, the controller gives a long burst for the TDA7406 control registers. This package contains settings for almost all available registers. Here is an example of a package (its small initial part):



Consider this package:
0x8C (chip address) - the address of the TDA7406 chip with the R / W bit reset (the controller is going to write to the registers).
0x60 (subaddress) is the address of the first register from which the recording of the parcel will begin and some settings of the recording order (in this case, the recording will be made from the zero address, as indeed always when the controller configures the TDA7406: it always records the configuration starting from register 0).
0x0E (register 0) - the configuration for register 0, what we need, judging by the documentation: this is the Input Selector register. It indicates what input of the audio mixer should now be selected and what gain (volume) this channel should have:



When selecting a tuner channel and further working with it (raising / lowering the volume), the controller sends bits 110 to the Source Selector field of the zero register. This is very good, because in order to use the AUX input, MD must transfer bits 010 to this field. For reference: the i2c bus has braces to the supply voltage and is always free, and the bus active level is zero, i.e. management is conducted by an open collector (open drain). At any given time, any i2c bus line can be “pulled” to zero without affecting all devices on this bus.

You can hook into the communication between the controller and the audio mixer at the right time and turn the FM mode into MD mode. The only thing required is to accurately track the right time for the impulse so that the “110” turns into a “010”. And this should be done every time the controller talks to the TDA7406. Here is the moment we need in the diagram, at the moment of the SCL line highlighted in red, the SDA line should be set to zero:



I drew and made a small handkerchief with an Attiny13 microcontroller, with pin connectors on all pins for ease of programming and further connection to i2c and power:



I intentionally made the bottom layer of the board flat, without bulging the pins, so that you can glue the board onto the TDA7406 head without any problems.



It remains a small matter: solder to the board with ATTiny13 power wires, i2c, wires from the 3.5 mm external connector ("mother") and wiring for the motherboard radio to the MD lines (after removing the C233, C234 capacitors):


_{I apologize for the quality of the photo, I was fascinated more by the process of creation, and not by documentation.}

The blue wire going up in the photo goes to the News button on the front panel of the radio. That it is used to enable the interception control audio mixer. By pressing the button, we activate interception, by another pressing - we deactivate. Important: after pressing the News button, you will need to decrease or increase the volume, since alone, as we remember, the audio mixer does not control, and the ATTiny13 microcontroller itself does not send any messages to the bus.

The program for the microcontroller was very simple; Basically this is a solution to the problem "in the forehead," without interruptions. I will return to the program below.

So, for those who decide to use this method to create the AUX input of this radio tape recorder:
1. Disassemble the radio, remembering the types of screws and their place.
2. Get to the main board and find the TDA7406 chip.
3. Make and program a board with ATTiny13 (nominal values ​​of capacitors C1-C3 0.1 microfarad):

4. Glue the board to the TDA7406 chip.
5. Vypayat from the main board C233, C234. Solder the wiring from the main board to the ATTiny13 board according to the scheme:

Food for ATTiny13 near TDA7406 is not, because The TDA7406 is powered by 8 V, and we need 5. We pull to XP2: 1 wire from pin 8 of the IC803 memory chip (24C02), body SO-8, see photo above.
The wire from the News button (it has two contacts, we need the one that sits on the power supply, and not on the ground) pull to XP1: 2 (PB3).
6. Solder the AUX output itself (I have a factory 3.5mm jack "mother" with a wire from the headphone extension) to the board: XP1: 5 left channel, XP2: 5 right channel and common wire on XP1: 4. We get the wire from the connector in front of it from where it is more convenient.
7. Connect the speakers to the radio, check.
8. The soldering of wires is well checked and we fix the wires to the board with elastic glue of the “Moment” type.

This modification has been working for me for almost a month without any complaints. The only inconvenience is the two-step switching on and off of AUX. First, press the button News, and then we move a little volume. This could have been avoided by adding the program in such a way that ATTiny itself sent the configuration to the audio mixer registers at the moment the button was pressed, but I considered this to be an unnecessary intervention complicating the program. But with proper experience working with microcontrollers, such a function is not long to attach.

A few words about the program. It does not use interrupts, and the tracking of clock cycles (fronts) on the SCL line is carried out using GIFR flags in cycles. With each SCL clock cycle, the program evaluates the state of the SDA bus and if it satisfies the sequence 0x8C 0x60 0x0E, then log.0 is set on the SDA line in the right place. And so in a circle. When using interrupts, ATTiny13 spends a lot of clocks on entering and processing an interrupt and does not keep up with the clocks; i2c frequency for him is tall: 160 kHz.

PCB P-CAD 2006 PCB format here .
ATTiny13 firmware in Intel hex format here .

UPD: at the request of users add information about "fyyuzy".
From production ATTniy13 comes with a programmed CKDIV8 bit in Fuse Low Byte. It must be removed by writing bit 1 in its field. For example, if the ATTiny13 has a value of 0x6A from Fuse Low Byte from the factory, then it should be made equal to 0x7A. Thus, we make the clock frequency maximum (9.6 MHz); with another clock frequency, the program will not work properly.