GNS TMC Protocol (partly) disclosed

Aus Wiki
Wechseln zu: Navigation, Suche

Inhaltsverzeichnis

http://www.china-rns.com/blogs/zoulou/68-gns-tmc-protocol-partly-disclosed.html

This page is a mirror of the website linked above. It was originally written by zoulou on 03.05.2011 at 21:53.

The GNS TMC protocol is a proprietary, undisclosed communication protocol for transfering RDS TMC information from a TMC receiver to a Navigation software. Following information has not been approved by GNS ("GNS GmbH") and may be inaccurate.

The GNS TMC protocol is a byte-oriented binary protocol (in contrary to a text based protocol, like GPS NMEA 0183)

The protocol is used in two type of products:

  1. Combined GPS/TMC receivers Here the GNS TMC protocol responses are contained within the stream of GPS NMEA sentences. TMC protocol messages may interrupt the GPS sentences at any(!) position. Example product: GNS 9830 TMC
  2. Pure TMC receivers Support only the GNS TMC protocol. Example product: GNS Trafficbox FM9

The protocol typically is used over a serial line communication (UART, USB Serial). Mostly the baudrate is 38400 bps, but may vary between products.

The protocol exists in several versions: 2.0 and 3.0 (at least). I am guessing(!) that 9830 implements version 2.0, while FM9 implements version 3.0. It seems that GNS TMC receivers are backwards compatible to older protocol versions. Thus, new TMC receivers may operate with an old Navigation SW, but my experience shows that the opposite may not be true.

The protocol contains commands and responses. Commands are sent from Navigation software to TMC receiver. Responses are sent from TMC receiver to Navigation software.

The commands and responses can ge grouped into:

  1. Enable/Disable RDS/TMC
  2. Tuning to FM frequency
  3. Scanning for RDS/TMC messages
  4. TMC message transfer
  5. "Authentication"
  6. Error handling

A command is fixed in length: 5 bytes Byte 1:

0xFF

Byte 2: command identifier Byte 3+4: command data Byte 5: command identifier

A response is fixed in length: 10 bytes Byte 1,10:

3F

Byte 2-9: depends on the response message

Enable/Disable RDS/TMC

Enable RDS/TMC (0x56)

Command:

FF 56 78 78 56

This command seems to be fix. I never seen any other data than "78 78".

Response:

3F 00 00 56 aa bb cc dd ee 3F

where the bytes aa to ee seem to carry information about the protocol version. Example:

  • FM9:
3F 00 00 56 05 13 2D 05 05 3F
  • 9830:
3F 00 00 56 06 06 30 09 01 3F

Disable (0x53)

Command:

FF 53 78 78 53

This command seems to be fix. I've never seen any other data than "78 78".

Response:

NONE

Tuning to FM frequency (0x46 or 0x73)

Command:

  • FM9:
FF 73 aa bb 73 
  • 9830:
FF 46 aa bb 46

where aa contains an FM frequency within 87.5 and 108.0 MHz.

  • aa = 0x00: 87.5 MHz (also means "OFF")
  • 0x01: 87.6 MHz
  • 0x02: 87.7 MHz
  • ...
  • 0xCC: 107.90 MHz
  • 0xCD: 108.00 MHz

bb seems to carry no important information. I always see 0x05, but logs of other people contain 0x78 here.

Response:

3F 00 00 46/73 aa bb cc 00 00 3F

where aa contains the requested frequency (same coding scheme as above)

  • bb,cc is either "00 00" : No RDS reception
  • or "01 55" : RDS reception

Example:

  • FM9:
3F 00 00 73 00 00 00 00 00 3F 
  • 9830:
3F 00 00 46 09 01 55 00 00 3F

Scanning FM frequencies for RDS/TMC messages (0x79 or 0x59, 0x66)

Command:

  • FM9:
FF 59 aa bb 59
  • 9830:
FF 79 aa bb 79

where aa contains the start frequency (same coding scheme as above)

  • bb: 0x01: Scan up starting from frequency aa
  • 0x00: Scan down starting from frequency aa

Immediate response:

  • FM9:
3F 00 00 59 00 6F 6B 00 00 3F
  • 9830:
3F 00 00 79 00 6F 6B 00 00 3F

Note: 6F 6B are the ASCII codes for "ok"

Successive response(s):

3F 00 00 66 aa bb cc 00 00 3F

where

  • aa: the currently scanned FM frequency
  • bb,cc is either "00 00" : No RDS reception
  • or "01 55" : RDS reception

Example:

3F 00 00 66 17 00 00 00 00 3F
3F 00 00 66 25 00 00 00 00 3F
...
3F 00 00 66 35 01 55 00 00 3F

TMC message transfer

No command/response handling. The TMC receiver sends these messages unsolicitedly, typically after a "01 55" scanning response message.

  • Byte 1,10:
0x3F
  • Byte 2-9 : RDS message blocks 1-4. Each block is 16 bits.
  • Block 1: contains the PI code of the FM station.
  • Block 2, first 4 bits: contains RDS group type
  • for remaining bits, see RDS and TMC specifications (find link below)

Example:

3F D3 13 25 52 61 72 64 20 3F
3F D3 13 05 48 EB 65 42 41 3F
3F D3 13 85 43 87 0A 4E 9D 3F
3F D3 13 E5 45 3B 69 D3 14 3F

"Authentication"

Now it gets really cloudy ...this section is just a wild guess!!!

My assumption is: GNS has implemented a kind of Authentication mechanism, in order to prevent others from (ab)using their protocol. The mechanism could be a challenge/response algorithm: Navigation software gives some "challenge" to the TMC receiver. The receiver calculates the "response" and returns it back. The Navigation software then verifies the "response" by using same algorithm as the receiver.

Manufacturer information (0x43)

Command:

FF 43 aa bb 43
  • where aa: ??? (ranges from 0x00 to 0x0F)
  • bb: always 0x00

Example:

FF 43 03 00 43 

Response:

3F 47 4E 53 20 47 6D 62 48 3F

Note: These are the ASCII codes for "GNS GmbH"

currently unknown command (0x41, only seen with FM9)

Command:

FF 41 aa bb 41
  • where aa: ??? (ranges from 0x00 to 0xFE)
  • bb: ??? (ranges from 0x00 to 0xFE)

Example:

FF 41 D7 A3 41

Response:

3F 00 00 41 aa bb cc dd 00 3F
  • where aa, bb, cc, dd: ???

Example:

3F 00 00 41 49 81 FF 4D 00 3F

Basic open question

What is the algorithm that takes aa,bb from command message 0x41 (and maybe even aa from command message 0x43) and outputs aa,bb,cc,dd for the response message 0x41 ??

A practical response to the question above: One can create a "database" of all possible responses by iteration through all possible command combinations. Note: FF is not allowed for aa or bb in Command: FF 41 aa bb 41. So the maximum number of commands is 65.025 * 16.

Error handling

The TMC receiver can send an error message back to the Navigation software if needed. How the Navigation software reacts on an error message from the TMC receiver is fully up to the Navigation software.

Response:

3F 00 00 00 45 72 72 00 00 3F

Note: These are the ASCII codes for "Err"

Example communication (Navigon PNA 7.4.3)

GNS Trafficbox FM9

FF 56 78 78 56 
3F 00 00 56 05 13 2D 05 05 3F
FF 43 03 00 43 
3F 47 4E 53 20 47 6D 62 48 3F
FF 41 D7 A3 41 
3F 00 00 41 49 81 FF 4D 00 3F
FF 73 00 05 73 
3F 00 00 73 00 00 00 00 00 3F
FF 59 00 01 59 
3F 00 00 59 00 6F 6B 00 00 3F
3F 00 00 66 03 01 55 00 00 3F
FF 59 03 01 59 
3F 00 00 59 00 6F 6B 00 00 3F
3F 00 00 66 09 01 55 00 00 3F
...
FF 59 58 01 59 
3F 00 00 59 00 6F 6B 00 00 3F
3F 00 00 66 62 00 00 00 00 3F
3F 00 00 66 62 01 55 00 00 3F
3F D3 13 85 42 46 04 14 00 3F
FF 73 62 05 73 
3F 00 00 73 62 01 55 00 00 3F
3F D3 13 25 52 61 72 64 20 3F
3F D3 13 05 48 EB 65 42 41 3F
3F D3 13 85 43 87 0A 4E 9D 3F
3F D3 13 25 53 72 6F 63 6B 3F
3F D3 13 E5 45 3B 69 D3 14 3F
...

GNS 9830 TMC

FF 56 78 78 56 
3F 00 00 56 06 06 30 09 01 3F
FF 46 00 05 46 
3F 00 00 46 00 00 00 00 00 3F
FF 79 00 01 79 
3F 00 00 79 00 6F 6B 00 00 3F
3F 00 00 66 09 01 55 00 00 3F
...
FF 46 0F 05 46 
3F 00 00 46 0F 01 55 00 00 3F
FF 79 0F 01 79 
3F 00 00 79 00 6F 6B 00 00 3F
3F 00 00 66 14 01 55 00 00 3F
3F D3 12 80 E1 92 BD 32 39 3F
3F D3 12 00 F0 EB 1E 42 41 3F
3F D3 12 20 F8 61 79 65 72 3F
3F D3 12 E0 E5 36 84 D3 11 3F
3F D3 12 00 F1 30 1E 59 45 3F
3F D3 12 60 E2 00 00 0B 72 3F
...

References

RDS-TMC specification:

Meine Werkzeuge
Namensräume
Varianten
Aktionen
Navigation
Werkzeuge