This project emulates the Volkswagen Premium 5 car radio made by Delco. Built on k0emu and k0dasm, it runs all known versions of the radio's original firmware without patches. Its purpose is to aid in continued reverse engineering of the radio and to help test firmware mods.
The radio's microcontroller and peripheral chips on the board are emulated at a low level, i.e. at the register level and with accurate timing. Emulated components include the undocumented Renesas (NEC) µPD78F0831Y microcontroller (which turned out to be a subset of the µPD78F0833Y), the µPD16432B LCD controller (SPI), and the STMicroelectronics M24C04 EEPROM (I2C). Connections between the major components in the radio are modeled as discrete digital signals.
To test the radio's interaction with other vehicle systems, high-level emulations of the steering wheel controls (MFSW), instrument cluster display (FIS), and 6-disc CD changer (CDC) are also included. Although these are behavioral models rather than emulations of real devices, the radio's interfaces to these systems are emulated faithfully as digital signals with accurate timing.
Watch it run in this video. The emulator can:
- Boot and run the original firmware without patches
- Interact with the faceplate (buttons and pixel-perfect LCD)
- Debug using live disassembly and source listing views
- Inspect registers, memory, and EEPROM contents
- Test interaction with related vehicle systems (MFSW, FIS, CDC)
- Step through instructions, run slowly, or emulate in real-time
Note that the emulator does not produce audio, nor does it emulate the tape deck.
The emulator consists of a backend written in Python and a web-based frontend. The backend does all of the emulation work and streams updates to the frontend. To emulate the radio at its original 4.19 MHz speed, PyPy and a modern CPU with strong single-threaded performance are required. Install premium5 under PyPy with:
pypy3 -m pip install git+https://github.com/mnaberez/premium5.git
Run the premium5 executable and open the indicated URL in a browser:
$ premium5 <firmware.bin>
Premium 5 emulator
http://localhost:8080
A firmware binary is required. One can be built, byte-for-byte identical to the original, from this disassembly.
For more options, run premium5 with no arguments.
When the radio powers up, it prompts for the SAFE code by displaying 1000. The preset buttons 1 through 4 are used to toggle in the code. The default EEPROM data has 1000 as the SAFE code, so no toggling is needed. Hold down SEEK > or TUNE > for a couple seconds to unlock the radio.