Clarion C-Bus protocol
======================

This describes part of the C-Bus protocol used to communicate between
a Clarion tuner/tape head unit and a remote CD changer. It's probably
considered by Clarion to be obsolete, since the latest units
(especially those with more advanced functions, like the AutoPC) use a
protocol called CE-Net. However, C-Bus is still used on low-end
devices sold to match factory-fitted head units : the best known of
these are the CDC-634 and CDC-635 changers (but note the comments
about the units I tested - I don't yet know whether the 634 and 635 use
the same protocol as the changer I examined).

The description of the command protocol was originally a set of notes
that I made and extended as I guessed functionality and extended test
software to cope with it. I've now added some more explanatory notes
describing the lower levels of the protocol and some summary
commments. As a result, there is some duplication of the content, and
may even be contradictions as a result of initial guesses that turned
out to be wrong. I'll develop this document further as I find out
more, and hope to clean it up and make it more readable as I go.


I haven't been able to find any public documentation on C-Bus, have
not agreed to any NDAs and have no knowledge of any private Clarion
documents. All the information presented was therefore guessed or
inferred by measuring the signals on connecting wires or by examining
the components inside parts of the system. Reverse-engineering for
interoperability in this way is permitted under European and US law.

Note that I have only examined the interchange of messages between a
Clarion 3035 tuner/tape unit as fitted to a 1998 Peugeot 306, and a
Clarion-manufactured Rover-badged CD changer marked XQE 10009 of
uncertain age (possibly about 1990). Peugeot use the description
'Audio 3035' in the user's manual, but the radio itself is marked 
'PU 1570C'.


The documented protocol may be completely wrong for any other
combination or even for any other specific unit. I'd welcome the
opportunity to test other combinations but don't currently intend to
make any commercial use of this information so I'm not about to buy
units specifically for the purpose. I'd particularly like to
investigate a pair of units that offer text labelling of CDs, as it
may give a clue to the commands for putting arbitrary text on the
radio display.  At present, I've only been able to control numeric
fields in the track/time mode but the radio is capable of displaying
an 8-character alphanumeric (14-segment) message for some fixed
messages and for arbitrary text in RDS station idents.

The information is offered for any person to use without charge, and
without any guarantee that it is correct in any way. Equipment
connected to a Clarion unit without Clarion's approval may void any
warranty for that unit and I can accept no responsibility for any
damage or loss that occurs as a result of the use of this information.

Software related to this documentation and published with it is also
offered without warranty of any kind, and may be used and distributed
in accordance with the conditions of the General Public License (known
as the GNU GPL) as described by the Free Software Foundation. The
conditions of this license are described more fully in the file
COPYING.


Clarion, C-Bus and CE-Net are presumably registered trademarks of
Clarion Car Audio Ltd. or associated companies.


Connections
===========

The connections between head and changer are via a multi-core cable
connected using 13-pin DIN connectors. Not all the pins were used
in the example I've looked at. Some of the descriptions are taken
from the silkscreen of the PCB used in the changer.

The DIN connector is numbered like this (looking at the holes in
a socket on either changer or head).

                indent
             ______ ______
            /      U      \       (Despite this diagram, the
             4   3   2   1         connector is actually circular
             8   7   6   5
             12  11  10  9         It's the same connector once
                  13               used for some Atari ST peripheral)
            \_____________/


pin	name 		description

1	SOI	Data, Open-collector, 5V, driven by changer and head, 
		pulled up by head

2	SCK	5V, driven by head, clocks data on SDA. Data changes at
		falling edge, may be sampled on rising edge.

3	REL	Open-collector, 5V, driven by head, pulled up by changer.
		No idea what this does - the head/changer combinaion I
		tested works normally with it disconnected.
		REL is pulled ow when the changer is inactive and
		is pulled up when selected by the head unit.

4	SRQ	Open-collector, 5V, driven by changer, pulled up by 
		head. active-low requests the head to poll the changer

5	Ill	Illumination. +12V enables panel light (this is a 
		logic signal only, the panel light is powered by 
		the main power line)

6	AGND	Audio gnd
	
7	Left	Audio left, looks about 0db level

8	Right	Audio right, 0db

9	N/C

10	B/U 	12V Power provided by head unit but unswitched

11	AC	Changer power enable. Open-collector, 5V, driven by head, 
		pulled up by changer, active low turns changer on.

12	GND	Power ground, keep separate from audio ground.

13	N/C

Note that pins shown unconnected (N/C) in this list may actually be
connected on other implementations, and may be connected in
the head unit : I only examined the changer.





Line protocol
=============

This section describes the bitwise protocol used for the lowest level
of data transfer. This could best be done with a clocked serial port,
but the timing doesn't seem too critical and I've been able to emulate
serial port hardware using a microcontroller capable of an interrupt
response in about 2us (and repeated every 7us).

Most of the action takes place on the SCK (clock) and SDA (data)
lines. The head unit is always the clock master, but the data line is
passively pulled up by the head unit and may be pulled down by an
open-collector driver in the changer. In the changer I looked at, this
open-collector driver is outside the microcontroller used for the
serial port, and the control of the output driver is handled via a
different pin to that used to read the state of the line. Although it
would normally be difficult to determine which end was controlling the
bidirectional data line (and hence which way the data was flowing),
picking up these lines separately meant I could determine which end
was asserting zero data (clock the data from both lines into separate
receivers : when the values are equal, the changer is sending
data. When they're different, the head is sending). This is still
ambiguous when all-ones are sent, but this only occurs within the data
packets described later - no commands have the value FF as far as I
can tell. If they did, the context of surrounding commands would
probably indicate the direction but I think FF is specifically banned
as it would be impossible to determine whether the changer had
echoed it or was missing.



The clock and data lines both rest at 5V, and the data line normally
changes only on a falling edge of the clock (regardless of whether the
head or changer are driving it). However, when the head is trying to
re-establish communication with the changer (at power-up or after a
protocol error) it will hold the clock high while cycling the data
line. This is similar to part of a synchronous serial protocol
supported by the NEC microcontroller used in this changer, and
although that protocol doesn't seem to be used for the data handshake,
I think it's a deliberate violation used here to indicate that a bus
reset should be performed. In the NEC controller, the violation is
simply that the data line changes while the clock is low, but this is
sensitive to noise and poorly-propagated signals on the long cable
between head and boot-mounted changer. It's probably OK to implement
this reset more conveniently by detecting a relatively long period
during which the data line is low, and when no clock edges are seen.


Each byte referred to in later sections is transferred in a distinct
burst of clocks. This burst typically lasts about 2ms (though it could
vary widely) and there's usually a 2ms rest before another burst
occurs.  Therefore, the bus only transfers about 1 byte every 4ms and
so is equivalent to about 2400 baud if no flowcontrol information
were required. The clocks themselves are very regular with a 
duty cycle close to 50% and a period of just over 7us.

Data is transferred on the first 8 clocks of the burst, and I've
assumed most significant bit is sent first in the descriptions below
(this seems to be reasonable given that numeric values such as track
numbers tie up as expected .. not bit-reversed).  The first edge of
the clock burst is obviously falling, so this can be used to shift the
most significant data bit onto SDA. It's value is then available in
time to be sampled by the receiver on the rising edge.

After the first 8 clocks, the data line stays high while several
hundred more clocks occur. This seems to hold the head off for as long
as the changer wants, though there may be a maximum permitted
time. Towards the end of the clock burst, the data line goes low,
again for a variable (but short) number of clocks - sometimes as few
as 1 - and finally goes high. The head stops clocking after receiving
that final 1, and the transfer is complete.

The actual number of clocks in high and low handshake states could be
significant, and is fairly repeatable on the measurements I made.
However, I hoped that it's irrelevant and indicated only how long the
changer took to process the command. This seems correct, as the
protocol seems to work correctly even in my implementation where the
number of clocks in the handshake are always the same.

It's possible that the handshake could be made faster by reducing the
number of busy clocks per byte. However, this might outrun the head
unit's ability to read response data and I haven't experimented with
this .. I've used about 148 high clocks or 1.3ms followed by 3 low
clocks.




Byte protocol
=============

The commands and responses in the next section are presented as 
<Cmd #> and a variable length response. Actually, it's a bit more
verbose - this syntax is summarised to make it easier to read.

All serial commands are initiated by the head unit and consist of a
command byte transmitted to the changer, a response byte from the
changer, and then some optional further data. In almost every case,
the initial response byte is an echo of the command byte and is
followed by a short message. This message is formatted as <length>
<data> <data> ... where <length> is the count of bytes following. A
zero length message is quite common, and consists only of the length
zero.

Each byte of the message (including the length) is actually sent
twice, the second occurrence being the complement of the first. Thus
the message in the example listed below as

<Cmd 09> <Rlen 03> 00 01 00

is actually transmitted as

	09 	command from head to changer
	09 	echo from changer to head
	03 	length from changer
	FC 	complement of length from changer
	00 	first data byte from changer
	FF 	complement of first data byte from changer
	01 	second data byte from changer
	FE 	complement of second data byte from changer
	00 	third data byte from changer
	FF 	complement of first data byte from changer


There are a couple of exceptions to this format, related to
an interrupt mechanism. 

This mechanism uses an additional line in the cable for the changer to
request service by the head unit. The line (SRQ) is pulled to ground
and the head unit then issues a command 00. 00 is not echoed -
instead, the changer sends F7 on all occasions I've logged. Given the
line protocol it would be possible for multiple units to modify this
value, so it's possible that clearing a single bit in the response to
00 is really a response indicating a single station requesting service
(this would be similar to a parallel poll in the IEEE-488 protocol).

The head unit then sends F7. This command is echoed normally,
but there's no additional message : not even a 00 length byte.
The SRQ line is released at this time. So the sequence appears
to be that the changer requests service with SRQ, is polled
with 00 and has the service request acknowledged with F7.

After the SRQ handshake is complete, the head always sends 
<Cmd 11>. This operates as a normal command (it results in the usual
length-and-data response) but the actual contents of the response vary
rather more widely than do most of the other responses logged, and
have a variety of effects on the head unit. Some change the track/time
display, one enables the audio from the changer, etc. <Cmd 11>
therefore appears to be a higher-level poll from the head (made in
response to a succesful SRQ) that permits the changer to send the head
an 'unsolicited' message. This is particularly noticeable in the 
'10 xx yy' response mentioned below - every second, the changer performs 
an SRQ and sends 10 xx yy in response to the <Cmd 11>.  This results in
the head updating its display to show xx minutes and yy seconds on the
track progress display. The first byte of the response to <Cmd 11> can
probably be considered as a command to the head, rather than data
as in a normal response.


Thus the message listed later as

<SRQ> <Cmd 11> <Rlen 02>  32 01

is actually transmitted as 

	SRQ goes low
	00	command from head to changer
	F7	response from changer to head
	F7	command from head to changer
	SRQ rises
	F7 	echo from changer to head
	11 	command from head to changer
	11 	echo from changer to head
	02 	length from changer
	FD 	complement of length from changer
	32 	first data byte from changer
	CD 	complement of first data byte from changer
	01 	second data byte from changer
	FE 	complement of second data byte from changer




F7 is also sent as part of the powerup / reset sequence and again 
is only echoed, there's no command tail. In this case, no <Cmd 11>
follows F7.

If this protocol fails (a transfer times out, or a command is echoed
inaccurately, or true/complement data doesn't match) the head will
sometimes retry the command and if unsuccessful fall back to resetting
the bus using the F7 command. It then carries on with the command
sequence in progress. It doesn't normally start from scratch just to
repair a protocol failure, but if the changer doesn't respond to the
protocol reset the head will give up, reporting 'CONNECT' on the
display. Re-selecting the changer from the head unit front panel will
start the reset sequence up from scratch - it isn't necessary to power
cycle for the head unit to recognise that a changer is present.



At powerup, there's another possible variation. If the head fails to
get a sensible response from the changer (it has about 4 attempts to
send F7, and if the changer isn't present will receive FF in response
due to the lack of any active pulldown), it will try 7D instead (again
for 4 attempts). The safest response to this is FF, which looks like a
not-present. The head will then (perhaps on another occasion) send F7
and the protocol described can then be followed. My guess is that this
head unit is willing to talk to at least two distinct changer units
and attempts to find the right protocol by attempting a different reset
message. There's some need for experimentation here to see if this or
another changer will accept the 7D command, and what the head unit
will do if it's accepted.





Command protocol
================

This section describes the commands and responses sent during a
series of about 20 recorded operations, referred to as 'log xx'
where individual logs show specific behaviour.

Although I have very little understanding of the meaning of
some of these messages, simply copying their response seems to
work pretty well. A few are more critical - mostly those to
do with track selection and magazine status.


<Cmd 00>

Sent in response to SRQ. Always the same operation - SRQ goes active,
and 00 is sent. 00 is not echoed - the changer sends F7. The head then
sends the F7 command which is echoed and clears the SRQ. The head then
performs a command 11, which has many different contents. It appears
that the head is the bus master but the changer may want to initiate
an operation : it does this by performing the poll sequence and then
responding to a Cmd 11.


<Cmd 01>

Generally sent as last command of deselect, but also appears in
power-up-select sequence (log 19). Always gets zero-length response,
i.e. an echo of the command followed by a 00 tail - length byte.


<Cmd 09>

Sent as first command of select sequence. Always a 3-byte response,
with only the last byte apparently changing.

  00 01 1A	Always seen when magazine is empty, but also appears
		when disc is present, not yet loaded (log 06). The 
		disc was then loaded and it ran, without another Cmd 09.
  00 01 1B	No magazine
  00 01 00	Always the response when a disc is ready to go.
		Log 19 has Cmd 09 sent twice.


<Cmd 11>

Sent only after an interrupt has been serviced (see Cmd 00). A wide 
selection of responses may occur, all either 2 or 3 byte. Apparently
a poll for a changer-initiated command which are mostly display updates.

  00 04		log 13, after failed attempt to change discs

  00 01 01	Required before track (3x yy) and time (10 xx yy) will work

  00 01 08	enables audio and causes head to issue cmd 5C

  00 01 05	associated with disc change

  00 01 0C	only in log 13, as disc load failed
  00 01 19
  00 01 1B

  10 xx yy	is the most common. Appears to be sent every
		second while playing, and updates the display
		to read track timing xx minutes and yy seconds.

  3x yy		x matches disc number, yy matches track number, commonly 
		sent as play starts. yy value is AA at end of disc (i.e.
		no more tracks), and causes a head-controlled change of 
		disc or restart of a single disc.

  32 11 03	log 26

  33 11 03	log 6, 27

  42 03 01	log 26

  43 03 01	log 6, 27



<Cmd 3E>

  00 01 05	associated with start play when CD is present
  00 01 07	associated with start play when CD reloaded

<Cmd 41>

  1A 55 55 55	no discs in magazine
  1A 55 55 45	disc 2 in magazine
  1A 55 51 11	discs 2, 3 and 4 in magzine
  1A 55 55 51	disc 2 in drive, none in magazine
  1A 55 55 05	disc 3 loaded, 4 in magazine
  1A 55 50 00   disc 1 loaded, 2,3,4,5 and 6 in magazine
  1A FF FF FF	no magazine

				It appears that 2 bits are assigned per disc
				in the 6-disc changer. This only uses 12 out
				of a possible 24 bits, and other bits may well be
				significant in a 10 or 12-disc changer.
				However, the head unit I have seems to only
				handle 6 discs and ignores attempts to 
				enable more than 6 discs in the emulated changer.

<Cmd 44>

  00 01 xx	sent at deselection. xx is 00 if discs are present,
		1B if magazine is empty. Similar to Cmd 09, but 
		deselect with no discs in magazine hasn't been logged.

<Cmd 45>

  00 01 xx	Same status as Cmd 09

<Cmd 46>

  00 01 01	log 22, 27

<Cmd 47>

  00 81 02	log 22, 27

<Cmd 49>

  00 01 03	log 22

<Cmd 4A>

  00 01 02	log 22, 27

<Cmd 4C>

  00 00		

<Cmd 50>

  00 01 xx	Same status as Cmd 09

<Cmd 51>

  00 01 xx	Same status as Cmd 09

<Cmd 56>

  00 01 01	log 16 - repeat mode off

<Cmd 58>

  00 11  01	log 16 - repeat mode on

<Cmd 59>

  00 01 xx	Same status as Cmd 09, except in failed change where
		xx = 0C. This coincided with 00 01 0C in Cmd 11.

<Cmd 5B>

  00 01 04	Associated with Cmd 3E, and mutually exclusive with
		5C (5C more common in logs).

<Cmd 5C>

  00 01 04


		all these have zero-length response (single byte of 00)

<Cmd 6x>
		set disc number

<Cmd 7x>
		set track 0x (x is 0 to 9) - zero length response

<Cmd 8x>
		set track x1 (x is 0 to 9) - zero length response


<Cmd Ex>

  4x 03 01	x indicates current disc - possibly when selected
  4x FF FF	possibly not yet ready, eventually followed by 4x 03 01
		This string also sent as one of the <Cmd 11> responses

<Cmd Fx>

  3x 11 03	x indicates current disc - possibly when selected
  3x FF FF	possibly not yet ready, eventually followed by 4x 03 01
		This string also sent as one of the <Cmd 11> responses


		Above responses where recorded with only a 3-track
		CD present. If FF FF is returned, the head permits
		track selection 1 - 99. If the other responses are
		returned, the head selects only tracks 1 - 3.
		It's not yet clear what the 01 / 11 part does,
		nor which (or both) actually limits the selection.



<Cmd F7>

Sent at power-up and as part of SRQ response. Possibly clears interrupt.
Has no response tail - i.e. F7 is echoed but no count or data follows.




Example
=======

Select CD operation and run a disc already loaded from slot 2.
The head has already recognised the changer in a previous operation,
so there's no F7 command as an initial reset.

Unknown initial comamnds .. 00 01 00 seems a common response

      <Cmd 09> <Rlen 03>  00 01 00
      <Cmd 4C> <Rlen 02>  00 00

Determine magazine loading

      <Cmd 41> <Rlen 04>  1A 55 55 51

Several commands all appear to provoke the same response
from the changer. 

      <Cmd 45> <Rlen 03>  00 01 00
      <Cmd 50> <Rlen 03>  00 01 00
      <Cmd 51> <Rlen 03>  00 01 00

Start playing at disc 2, track 01

      <Cmd 62> <Rlen 00> 
      <Cmd 70> <Rlen 00> 
      <Cmd 81> <Rlen 00> 
      <Cmd 3E> <Rlen 03>  00 01 05

Changer responds with disc number

	<SRQ> <Cmd 11> <Rlen 02>  32 01

Changer causes audio to turn on

	<SRQ> <Cmd 11> <Rlen 03>  00 01 08
	      <Cmd 5C> <Rlen 03>  00 01 04

Changer reports disc 2, track 1

	<SRQ> <Cmd 11> <Rlen 02>  32 01

Changer starts displaying

	<SRQ> <Cmd 11> <Rlen 03>  00 01 01

1 second updates to track time

	<SRQ> <Cmd 11> <Rlen 03>  10 00 00
	<SRQ> <Cmd 11> <Rlen 03>  10 00 01
	<SRQ> <Cmd 11> <Rlen 03>  10 00 02
	<SRQ> <Cmd 11> <Rlen 03>  10 00 03
	<SRQ> <Cmd 11> <Rlen 03>  10 00 04
	<SRQ> <Cmd 11> <Rlen 03>  10 00 05
	<SRQ> <Cmd 11> <Rlen 03>  10 00 06
	<SRQ> <Cmd 11> <Rlen 03>  10 00 07
	<SRQ> <Cmd 11> <Rlen 03>  10 00 08
	<SRQ> <Cmd 11> <Rlen 03>  10 00 09            



