SID Ver 12.0

SW Ver 02.2 is the latest and the last units was produced in 2005

Hardware

MCU: MC9S12DJ256B

CANbus

RDS Icons at bottom

Bit 7	Bit 6	Bit 5	Bit 4	Bit 3	Bit 2	Bit 1	Bit 0
RDS	No TP	REG	TP	PTY	??	??	No RDS

To set "NO RDS" active send 0F 00 81 00 00 00 00 00 to 380h over CANbus

LCD

Counted from the speaker to the connector

Display:
01: Bias voltage 1 (Neg ~5.2v)
02: Bias voltage 2 (Neg ~3.5v)
03: Bias voltage 3 (Neg ~1.8v)
04: 1.6v
05: 3.3v
06: Ground
07: 5v

08: ADDR7/DATA7/PB7 (23)
09: ADDR6/DATA6/PB6 (22)
10: ADDR5/DATA5/PB5 (21)
11: ADDR4/DATA4/PB4 (20)
12: ADDR3/DATA3/PB3 (19)
13: ADDR2/DATA2/PB2 (18)
14: ADDR1/DATA1/PB1 (17)
15: ADDR0/DATA0/PB0 (16)

16: IOC7/PT7        (14) (/RD)
17: LSTRB/TAGLO/PE3 (37) (/WR)
18: MODB/IPIPE1/PE6 (25) (Data/_command_)
19: ECLK/PE4        (27) (Enable)
20: MODA/IPIPE0/PE5 (26) (Reset)

Two font sizes:
7 x 8?
8 x 12?


cog size: ~15 x ~3 mm


Display row: b8
Display ofs 0x10 + nn

  1-2--
 8     3
 |--9--|
 7     4
  --6-5

01: Timer icon
02: "AM" icon
03: "PM" icon
04: Heat2 icon
05: "NO"(rds) icon
06: "RDS" icon
20: "PTY" icon
38: "NO"(tp) icon
39: "TP" icon
4b: "REG" icon
5e: "AS" icon
92: "RDM" icon
9c: dolby icon
9d: "B" icon
9e: "C" icon
b3: "NO"(tele) icon
bc: "TELE" icon
c7: mail icon

00: Clock 3, seg 6
07: Clock 3, seg 5
08: Clock 3, seg 4
09: Clock 3, seg 9
0a: Clock 3, seg 3
0b: Clock 3, seg 2
0c: Clock 3, seg 1
0d: Clock 3, seg 8
0e: Clock 3, seg 7

0f: Clock 2, Seg 6
10: Clock 2, Seg 5
11: Clock 2, Seg 4
12: Clock 2, Seg 9
13: Clock 2, Seg 3
14: Clock 2, Seg 2
15: Clock 2, Seg 1
16: Clock 2, Seg 8
17: Clock 2, Seg 7

18: Colon between digits

19: Clock 1, Seg 6
1a: Clock 1, Seg 5
1b: Clock 1, Seg 4
1c: Clock 1, Seg 9
1d: Clock 1, Seg 3
1e: Clock 1, Seg 2
1f: Clock 1, Seg 1
21: Clock 1, Seg 8
22: Clock 1, Seg 7

23: Clock 0, Seg 6
24: Clock 0, Seg 5
25: Clock 0, Seg 4
26: Clock 0, Seg 9
27: Clock 0, Seg 3
28: Clock 0, Seg 2
29: Clock 0, Seg 1
2a: Clock 0, Seg 8
2b: Clock 0, Seg 7

Clock 0
0: 
1: 
2: 
3: 
4: 
5: 
6: 
7: x 25
8: 
9: 

Clock 1
0: 
1: 
2: 
3: 
4: 
5: 
6: 
7: 
8: 
9: 

Clock 2
0: 
1: 
2: 
3: 
4: 
5: 
6: 
7: 
8: 
9: 

Clock 3
0: 
1: 
2: 
3: 
4: 
5: 
6: 0
7: 
8: 
9: 

Icons:
no:
tp:

Weird command
one 1 and ten 0
1
0
0
0
0
0
0
0
0
0
0

Referenced string at:
00e76b

Max Length x1e (30)

st7789 (right size, some ins seem ok. wrong lcd type)
st7528 (wrong ins)
st7529 (wrong ins)

http://www.tvielectronics.com/ocart/download/controller/ST7586.pdf
Too new but it has a few quirks and commands in common (perhaps something older from the same manufacturer?)

1. Read clock: They use another pin for that with this one too.
2. Found another function very early one that does this:
Clock out hex 01, wait a while and then clock out an insane amount of zeroes.
These two correspond to "software reset" and "nop" respectively for several of their controllers

cog size: ~15 x ~3 mm

LCD Commands

Display on/off:  1010 111x
0: (ae) Off
1: (af) On

X direction:     1010 000x
0: (a0) Right to left
1: (a1) Left to right

Y direction:     1100 x000
0: (c0) Bottom to top
1: (c8) Top to bottom

Window scroll Y: 01xx xxxx    (40 - 7f)

Multibyte commands:

Start address:   1011 0000    (b0 - bf?)
Y start block | b0
X start block   (For this display, start from x10 + block)
((unknown byte)) often 0
*send data bytes*

Unknown:

01
e1
ee
ab
28

a4
a6
a2
e4

b7

Weird:
29 drive strength related? It looks a lil funky

Pins

80-pin qfp

 <: Input
 >: Output
<>: Both

ADC:
0: (<) Internal Temp    (PAD00/AN00         (51))
1: (<) Light sensor     (PAD01/AN01         (52)) (It also has a temp sensor to decrease output in case of overheating)
2: (x) ((Grounded))     (PAD02/AN02         (53))
3: (<) Coolant level sw (PAD03/AN03         (54))
4: (<) Lamp monitor sig (PAD04/AN04         (55))
5: (<) Wheel buttons    (PAD05/AN05         (56))
6: (<) Rheostat (light) (PAD06/AN06         (57))
7: (<) External Temp    (PAD07/AN07/ETRIG0  (58))

PortA
0: (<) "Night Panel"    (PA0/ADDR8/DATA8    (41))
1: (<) "+" / "Plus"     (PA1/ADDR9/DATA9    (42))
2: (<) "-" / "Minus"    (PA2/ADDR10/DATA10  (43))
3: (<) "Set"            (PA3/ADDR11/DATA11  (44))
4: (<) "Clear"          (PA4/ADDR12/DATA12  (45))
5: (<) "Minute"         (PA5/ADDR13/DATA13  (46))
6: (<) "Hour"           (PA6/ADDR14/DATA14  (47))
7: (<) Ignition (+15)   (PA7/ADDR15/DATA15  (48))

PortB
A: (<>) LCD Data        (ADDR_/DATA_/PB_ (16-23))

PortE
0: (x) Tied to vddx etc
1: (<) Button interrupt (All except Night Panel) and ignition switch on interrupt. 
2: (>) TLE4278G:"Watchdog input"
3: (>) LCD
4: (>) LCD
5: (>) LCD
6: (>) LCD
7: (>) Enable LCD 5v (active low)

PortE1 note:
When ignition is on, this one is always dragged low so button interrupts are only active when the unit is in sleep mode. (interrupt is edge triggered)


PortJ
6: (x) ((Unused))
7: (x) ((Grounded))

PortM
0: (<) CAN "Rx"
1: (>) CAN "Tx"
2: (>) CAN "Standby"
3: (>) Amplifier "Mode"
4: (>) Amplifier "Up/Down"
5: (x) ((Grounded))

PortP
0: (>) Likely LCD contrast signal out (No DS for that chip): SMD marking "saru"
1: (x) ((Grounded))
2: (>) Main backlight drv "set" Regular gpio
3: (>) Main backlight drv "pwm" (using pwm 2 and 3 in combined mode)
4: (>) Button backlight
5: (>) Audio On / Off
7: (>) Audio PWM

PortS
0: (>) Horn1 2.2K to S1
1: (<) Horn2
2: (>) Park1 2.2k to s3
3: (<) Parking heater

PortT
0: (>) Board heating. Active high
1: (>) Darlington > 1.5  KOhm > TCM something (external pin 16)
2: (>) Darlington > 4.42 KOhm > TCM something (external pin 16)
3: (>) Darlington > 8.25 KOhm > TCM something (external pin 16)
4: (x) ((Grounded))
5: (x) ((Grounded))
6: (<) Washer fluid level
7: (>) LCD

Notes:
Watchdog must be toggled while the LCD is powered!