4 March 2011 9 Comments
I’m keen on reverse engineering at least some aspects of the Clarion CeNET bus in order to hook other gadgets to my car stereo. CeNET is a proprietary interconnect used by Clarion on many of their car audio products over the last ten years.
It uses a proprietary 13-pin square DIN style connector that is not available off the shelf. The pinout is shown below (this was taken from a Clarion service manual).
Electrically, CeNET appears to be a form of asymmetric serial bus. There is some discussion online that suggests a 38400 baud rate. The same person also says that it appears to use some form of encryption which may make it difficult to hack.
My experience with CeNET stereos is that the display will flash SYS or SYSTEM if the battery is disconnected or a CeNET device is inserted or removed. They do this until the stereo is powered on. Perhaps an encryption key is negotiated during that period?
On the hardware side, closer inspection reveals the bus consists of a transceiver IC (CA0008AM) connected to one of UARTs in the host devices microprocessor as shown in the simplified diagram below. Note that there are also some pull-down resistors on the Tx and Rx pins, as well as a 68 Ohm termination resistor across the Bus+ and Bus- pins. I’m unable to find data on the bus transceiver but I guess it’s possible that other generic ICs could be used here. The bus itself floats at 2.5v and swings +/- 200mV during signalling.
I have capture some data samples from a stereo connected to a EA-1251B iPod adapter that emulates a 6 disc changer. I haven’t yet studied them in detail but you can download the capture files below.
- No device connected via CeNET (sample 1)
- No device connected via CeNET (sample 2)
- EA-1251B connected (sample 1)
- EA-1251B connected (sample 2)
- EA-1251B connected (sample 3)
- EA-1251B connected (sample 4)
You will need to download Saleae Logic to view the capture files (it’s free). The cables were connected according to the colours in the diagram below:
In all captures I powered on the stereo from cold (no battery) immediately, then switched the unit on after about 3 flashes on the display (4-5 seconds). With the EA-1251 samples I switched from radio to the CD changer at about 7-9 seconds. From here the stereo waits for the iPod to wake up (it thinks the CD changer is loading) before it starts playing the first track of the first ‘disc’ (playlist) at about 14-15 seconds. The song then continues to play until the end of the capture.
Update: I’ve also grabbed a couple of samples of a TV tuner and display.
When the TV tuner is selected via the TV display it places the head unit into aux mode (it displays Aux on the screen). This could be a very useful hack; to make a ‘proper’ CeNet aux input. In the samples above, all units were powered up from cold (no battery) immediately after beginning the capture. The head unit is switched on at about 4 seconds, then there is a bit of wait for the display unit to boot up. Once this is done I’ve switched to the TV tuner at about 27 seconds. Shortly after (about 35 seconds) I switch back to the head unit’s internal FM radio.
It turns out trying to capture the bus pins was a waste of time as they normally float at 2.5V. I haven’t been able to look into that side of things any further as my only oscilliscope died before I could check it.
Hopefully somebody else finds this useful. I’ll keep working on it as I get time, and post any updates to the site if i come up with anything.