Jeep Bluetooth Radio Hack for a TJ Jeep

I have been working on my old 1999 TJ Jeep and I always wanted to have Bluetooth connectivity in for the stereo. I could have bought an after market head unit but I never really liked the look of them and they tend to be easily stolen out of the Jeep (softtop!). The stock head unit matches the dash and is less likely to be taken. Thus the solution was to hack in a Bluetooth module into the radio!

First I bought a used radio on ebay. Part number for the radio was P56038933AB and I was able to pick one up for $25 as I wanted to keep my radio functional in the Jeep till I got the Bluetooth working. Then I picked this module on amazon. I chose this module as it had a wide input voltage, every single connection and signal was brought out to a header, and it had good reviews.

Next I opened the radio. It had T15 Torx (jeep thing :| ) machine screws that held it all together. Took it apart all the way to the bare radio.

Next to figure out how to get the Bluetooth signal injected into the radio! Most people that do these kind of hacks just blindly poke around the radio till they find and audio signal and then inject there. This is fine but I wanted to make sure I was getting the best audio quality out of my cheap Bluetooth module and early 90’s designed, base model head unit. I also wanted to keep the volume knob on the radio functional. This meant injecting the Bluetooth signal in the circuit before the power amplifiers and before it was gained for volume.

To figure out where to inject the audio. I first wrote down all the IC Manufactures, Part numbers, and Package size. Clicking the links will show an image of the IC.

Part Number Manufacture Package
SC433377CB 04827914AB Motorola DIP-42
4652138 022AZ9836 ST Microelectronics DIP-42
04744263 Motorola DIP-28
04231192AA Philips TO-220-13

Next I started searching for stuff like “ST Audio DIP42” into google. After finding promising datasheets, I then verified their pinouts buy tracing the power and ground sources in the radio. Here is the cross reference of what I was able to find. I also found this interesting PDF which is a early 90’s listing for ST Micro parts. I was able to find the TDA7340S IC with it.

Part Number I/C Cross Reference
SC433377CB 04827914AB Probably a 6800 series MCU
4652138 022AZ9836 TDA7340S
04744263 MC13022A
04231192AA TDA8947J

The IC that does the sound muxing, volume, and tone control is the TDA7340S and I figured this would be the best place to inject the Bluetooth audio signal.

Above is the block diagram. After the audio mux the signal travels to an external effects loop which consists of in series 1uF electrolytic capacitors. Then the audio signal travels into the volume and tone control parts. Perfect! If I inject the audio right before the capacitors I will retain the volume and tone control of the radio.

I thought about using the unused PHONE IN and then using a MCU to sniff the I2C buss and inject the right commands to switch it to that input but figured that would be more work then just injecting in the effects loop.

The next part is to make sure the signal from the Bluetooth adapter is compatible with what the TDA7340S is expecting. At max volume on my phone the Bluetooth adapter outputs a ~50mV DC offset signal with a ~1.7V to ~1.9V Pk-Pk. The signal in the effects loop was 4.65V DC offset signal with a 800mV Pk-Pk.

Bluetooth Module output at max volume.
Output of the TDA7340S effects loop. This would need to be matched to ensure compatibility.

Since these signals are different I needed to adjust the signal of the Bluetooth adapter. I would need to apply a DC offset and then negative gain the signal from the Bluetooth signal. The opamp circuit below should do the trick. The feedback circuit is set to half gain and by applying half of VCC (via a voltage divider) to the other input of the opamp we can DC offset the signal.

I tested it by having my phone play a tone via a tone generator app called “Frequency Sound Generator”. Signal below.

The input is in red and the output is in yellow. Signal now matches closely to what the TDA7340S expects their to be in the effects loop!

Then to switch between the TDA7340S signal and the Bluetooth signal I found an analog switch IC made by Maxim, MAX4544CSA+. The opamp I decided to use was a AZ4558C. I decided to use it because it is a decent audio amp and fairly inexpensive. Lastly, since its stereo we need to double everything. Below is the schematic and layout I did in Eagle.

The files for the board can be found on my github. I uploaded the files to MacroFab and ordered the board.

I then soldered the board into the radio. I desoldered one leg of the the effects loop 1uF caps which are designators C112 and C113, then soldered hook up wire on the legs of the capacitors and into the hole in the PCB. The power for the Bluetooth module is pulled from the bottom of the radio. To switch the audio from the TDA7340S to the Bluetooth the input of the MAX4544CSA+ is pulled up. A switch on the dash will be used for this. See image below for how everything is hooked up.

Power for the Bluetooth module.

Then I tested the radio and made a video.

And then installed it into the Jeep!

Spooky Sound System PT. 2

Routing the audio amp. Since this is going to be made in 500+ QTY of units I decided 4 layer was the way to go as the budget allowed for it. For the layers I will be using the top and bottom side as signals and the two inner planes as the GND and “virtual” GND of the system. Power will be on the bottom layer. Everything is pretty much routed but I need to clean up the traces now.


Spooky Sound System

I have been working on this amplifier for pinball machines. It is a simple 2.1 system with volume control, tone control, sub cutoff, and sub volume. The main lifting is done by a 4 channel TDA7387 which is mainly for low cost car stereos. It can do 41W so it should be plenty powerful for a pinball machine. For opamps I am using the AZ4558C. This is a generic audio opamp in a dual package.

It is a single supply design so easy integration and makes it able to use low cost switcher style power supplies. I run the power though an opamp set to half gain to create a “virtual ground”. This is the middle bias point for all the filtering. After filtering it then gets DC blocked with in series capacitors and shoved into the TDA7387.


After I route this and organize the schematic I will post a link to the files.

Prop based Fan Controller for Jeep


Working on this fan controller for my Jeep. All the files are on github. Uses a 4×40 character VFD. Has an onboard E-compass module that will show inclination and direction. Part number is FXOS8700CQR1.

I am still working on the Gameboy VGA driver. You can see the code and hardware working on the BenHeck Show. I have to get some other projects done before I can finish the Gameboy :)

Gameboy DMG-01 VGA Adapter

This is the project that the DE0 Digital IO Wing is for. I will use the IO wing to level shift the signals from the Gameboy’s LCD screen so my DE0 can capture the data. The Gameboy is a 5V device and the DE0 does not have 5V tolerant IO. I am using a SN74LVC8T245PWR 8-bit directional level shifter to do the translation on the IO wing board.

Gameboy DMG-01
Gameboy DMG-01.

Purchased a Gameboy DMG-01 off eBay for $20. Needed some cleaning but it worked and had the battery cover!

Taking apart the Gameboy DMG-01.
Taking apart the Gameboy DMG-01.

The Gameboy DMG-01 uses triwing screws. Kidna like philips heads but with 3 “wings” instead of 4. Tool can be found on eBay or Amazon.

Front board and LCD connector for the Gameboy DMG-01.
Front board and LCD connector for the Gameboy DMG-01.

The connector between the front and back of the Gameboy is where I will tap into the signals to sneak a peak. Pinout is the following

Pin 12 – V-Sync
Pin 14 – Pixel Clock
Pin 15 – LCD Data 0
Pin 16 – LCD Data 1
Pin 17 – H-Sync
Pin 21 – Ground

V-Sync should be 60Hz, Pixel Clock 4Mhz, and H-Sync 9.2kHz.

Wires to sniff the connector.
Wires to sniff the connector.
Open Bench Logic Sniffer connected to Gameboy DMG-01.
Open Bench Logic Sniffer connected to Gameboy DMG-01.

Connected up the Open Bench Logic Sniffer and powered up the Gameboy with a game in it then ran the capture. I had the trigger set to wait for the V-Sync signal.

Entire V-Sync frame. Hard to see much detail.
Entire V-Sync frame. Hard to see much detail.
Frame zoomed in a bit to see the individual horizontal lines.
Frame zoomed in a bit to see the individual horizontal lines.
Complete horizontal frame.
Complete horizontal frame.

Then using my DE0_VGA_Driver I started writing the code take data from RAM on the FPGA and output it on the VGA monitor. I wrote a bitmap to .mif format (memory initialization file) convertor to display some Gameboy screenshots on the VGA Monitor. Link to that repo is here.

Gameboy DMG-01 screenshot displayed from DE0 FPGA RAM. Simulating original Gameboy "yellow-green" pallet.
Gameboy DMG-01 screenshot displayed from DE0 FPGA RAM. Simulating original Gameboy “yellow-green” pallet.
Gameboy DMG-01 screenshot displayed from DE0 FPGA RAM. Using B/W color scheme.
Gameboy DMG-01 screenshot displayed from DE0 FPGA RAM. Using B/W color scheme.

Currently working on getting the SN74LVC8T245PWR level shifters working and I will be able to pull live data from the Gameboy LCD data bus.

Robotics, Pinball, Hacking, Portables