Aisin Warner AW-4 TCU Datastream

Here is my reverse engineering work on the Aisin Warner AW-4 Transmission Control Unit found in 86-90 Renix Jeeps and 91-95.5 OBD1 Jeeps. This self contained unit is in charge of controlling the vehicles Automatic Transmission and has a data stream output that we can use for data and diagnostics.

TX output is found on Pin C4 of the TCU which connects to Pin D2-15 in the 15 pin Renix Diagnostic Adapter found in the engine bay. This may be some kind of inverted and protected open collector output circuit to vehicle ground, but the Receiver pulls the line high and the TCU will pull the line low to transmit. This gives us a signal that can be read with standard UART.

Data Protocol:

This TCU unit uses a Data Protocol which is as follows:
– Protocol: UART, Standard Logic
– Baud: 500
– Frame Length: 7 Bytes
– Frame Start: 70ms delay after last byte
– Special Case: data bytes are sent every 30ms

Data Framing

Byte OrderMT2500 ReadingMathDump
Byte 0Module IDDEC1
Byte 1TPS StepsDEC0
Byte 2Output RPM# * 340
Byte 3Brake
PRNDL
Mode
Bit 0
Bit 4, 5
Bit 7
113
Byte 4Solenoid 1
Solenoid 2
Solenoid 3
Current Gear
Bit 5
Bit 6
Bit 7
Bit 5, 6, 7
192
Byte 5700 Solenoid 1 Fault (Stored)
700 Solenoid 2 Fault (Stored)
700 Solenoid 3 Fault (Stored)
700 Solenoid 1 Fault (Current)
700 Solenoid 2 Fault (Current)
700 Solenoid 3 Fault (Current)
Bit 1
Bit 2
Bit 3
Bit 5
Bit 6
Bit 7
0
Byte 6705 Throttle Position Sensor FaultBit 00

Notes:
– Most Bit values use Inverted Logic (0 = True)
– Occasionally during bench tests, Byte 6 will have many bits active

Bit Logic Breakdowns

Byte 3 (Inputs)FALSETRUE
Bit 0C10 Brake Switch OnC10 Brake Switch Off
Bit 100
Bit 2C5 Shift Point Logic GroundC5 Shift Point Logic Open
Bit 300
Bit 4C9 NSS 3rd Switch OnC9 NSS 3rd Switch Off
Bit 5C8 NSS 1-2 Switch OnC8 NSS 1-2 Switch Off
Bit 6C12 Mystery OnC12 Mystery Off
Bit 7C11 Power Mode Switch OnC11 Power Mode Switch Off

NOTES:
Bench testing a 90 tcu shows bit 2 as true, but it is false on vehicle.
Bench testing a 92 tcu, bit 0 is false since C10 is held at 12v. Grounding reads true.
Bench testing a 92 tcu shows bit 7 as false

Byte 3 PRNDL
Bit 4 FALSEBit 4 TRUE
Bit 5 FALSE???1-2
Bit 5 TRUE3PRND
Byte 4 (Outputs)FALSETRUE
Bit 000
Bit 100
Bit 200
Bit 300
Bit 400
Bit 5Solenoid 1 OnSolenoid 1 Off
Bit 6Solenoid 2 OnSolenoid 2 Off
Bit 7Solenoid 3 OnSolenoid 3 Off
Byte 4 Current GearBit 5 FALSEBit 5 TRUE
Bit 6 FALSE2nd3rd
Bit 6 TRUE1st*4th

NOTE:
– * 1st gear will read as “???” if Torque Converter Bit 7 is FALSE

Byte 5FALSETRUE
Bit 000
Bit 1700 S1 Fault Stored
Bit 2700 S2 Fault Stored
Bit 3700 S3 Fault Stored
Bit 400
Bit 5700 S1 Fault Current
Bit 6700 S2 Fault Current
Bit 7700 S3 Fault Current
Byte 6FALSETRUE
Bit 0705 TPS Fault
Bit 1705 TPS Fault?
Bit 2705 TPS Fault?
Bit 3705 TPS Fault?
Bit 4705 TPS Fault?
Bit 5705 TPS Fault?
Bit 6705 TPS Fault?
Bit 7705 TPS Fault?

NOTES:
Bench testing a 92 tcu, bit 0 starts as false if TPS ground is left disconnected. Connecting it will trigger bit 0 true. TPS reads 6 before, and 3 after.

Fun Facts:

– Although the RPM Byte has a full range, the TCU will not report values slower the 300 RPM.

– The Frame Timing comes out to a 1/4 second update time.

– Due to the oddly slow Baud Rate, Teensy Microcontrollers can’t read slow enough unless UART Serial 3 is used or the clock speed is reduced to 48MHz.

– There is a Jumper J2 that changes the module ID. On 2.5L, the Jumper is present and Module ID reads “2” instead of “1.”

– There is an unused Jumper next to J2 that changes the Module ID as well.
– Grounding unused changes the “2” to “1” on a 2.5L TCU.
– Grounding unused changes “1” to a “3” on 4.0L TCU. Grounding J2 makes it read “1” again.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.