Aisin Warner AW-4 TCU Datastream

Here is my reverse engineering work on the Aisin Warner AW-4 Transmission Control Unit found in 86-90 Renix Jeeps and 91-95.5 OBD1 Jeeps. This self contained unit is in charge of controlling the vehicles Automatic Transmission and has a data stream output that we can use for data and diagnostics.

TX output is found on Pin C4 of the TCU which connects to Pin D2-15 in the 15 pin Renix Diagnostic Adapter found in the engine bay. This may be some kind of inverted and protected open collector output circuit to vehicle ground, but the Receiver pulls the line high and the TCU will pull the line low to transmit. This gives us a signal that can be read with standard UART.

Data Protocol:

This TCU unit uses a Data Protocol which is as follows:
– Protocol: UART, Standard Logic
– Baud: 500
– Frame Length: 7 Bytes
– Frame Start: 70ms delay after last byte
– Special Case: data bytes are sent every 30ms

Data Framing

Byte OrderMT2500 ReadingMathDump
Byte 0Module IDDEC1
Byte 1TPS StepsDEC0
Byte 2Output RPM# * 340
Byte 3Brake
Bit 0
Bit 6, 7
Bit 4, 5
Byte 4Solenoid 1
Solenoid 2
Solenoid 3
Current Gear
Bit 5
Bit 6
Bit 7
Bit 5, 6, 7
Byte 5700 Solenoid 1 Fault (Stored)
700 Solenoid 2 Fault (Stored)
700 Solenoid 3 Fault (Stored)
700 Solenoid 1 Fault (Current)
700 Solenoid 2 Fault (Current)
700 Solenoid 3 Fault (Current)
Bit 1
Bit 2
Bit 3
Bit 5
Bit 6
Bit 7
Byte 6705 Throttle Position Sensor FaultBit 00

– Most Bit values use Inverted Logic (0 = True)
– Occasionally during bench tests, Byte 6 will have many bits active

Bit Logic Breakdowns

Byte 3 BrakeBit 0 FALSEBit 0 TRUE
Brake PressedBrake Released
Byte 3 PRNDL
Bit 5 FALSE???1-2
Byte 3 ModeBit 6 FALSEBit 6 TRUE
Bit 7 FALSEComfortPower
Bit 7 TRUEComfortComfort

– Bit 6 doesn’t change in Park

Bit 5Solenoid 1 OnSolenoid 1 Off
Bit 6Solenoid 2 OnSolenoid 2 Off
Bit 7Solenoid 3/L OnSolenoid 3/L Off
Byte 4 Current GearBit 5 FALSEBit 5 TRUE
Bit 6 FALSE2nd3rd
Bit 6 TRUE1st*4th

– * 1st gear will read as “???” if Torque Converter Bit 7 is FALSE

Bit 0
Bit 1700 S1 Fault Stored
Bit 2700 S2 Fault Stored
Bit 3700 S3 Fault Stored
Bit 4
Bit 5700 S1 Fault Current
Bit 6700 S2 Fault Current
Bit 7700 S3 Fault Current
Bit 0705 TPS Fault
Bit 1705 TPS Fault
Bit 2705 TPS Fault
Bit 3705 TPS Fault
Bit 4705 TPS Fault
Bit 5705 TPS Fault
Bit 6705 TPS Fault
Bit 7705 TPS Fault

Fun Facts:

– Although the RPM Byte has a full range, the TCU will not report values slower the 300 RPM.

– The Frame Timing comes out to a 1/4 second update time.

– Due to the oddly slow Baud Rate, Teensy Microcontrollers can’t read slow enough unless UART Serial 3 is used or the clock speed is reduced to 48MHz.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.