Here is my reverse engineering work on the Aisin Warner AW-4 Transmission Control Unit found in 86-90 Renix Jeeps and 91-95.5 OBD1 Jeeps. This self contained unit is in charge of controlling the vehicles Automatic Transmission and has a data stream output that we can use for data and diagnostics.
TX output is found on Pin C4 of the TCU which connects to Pin D2-15 in the 15 pin Renix Diagnostic Adapter found in the engine bay. This may be some kind of inverted and protected open collector output circuit to vehicle ground, but the Receiver pulls the line high and the TCU will pull the line low to transmit. This gives us a signal that can be read with standard UART.
Data Protocol:
This TCU unit uses a Data Protocol which is as follows:
– Protocol: UART, Standard Logic
– Baud: 500
– Frame Length: 7 Bytes
– Frame Start: 70ms delay after last byte
– Special Case: data bytes are sent every 30ms
Data Framing
Byte Order | MT2500 Reading | Math | Dump |
Byte 0 | Module ID | DEC | 1 |
Byte 1 | TPS Steps | DEC | 0 |
Byte 2 | Output RPM | # * 34 | 0 |
Byte 3 | Brake PRNDL Mode | Bit 0 Bit 4, 5 Bit 7 | 113 |
Byte 4 | Solenoid 1 Solenoid 2 Solenoid 3 Current Gear | Bit 5 Bit 6 Bit 7 Bit 5, 6, 7 | 192 |
Byte 5 | 700 Solenoid 1 Fault (Stored) 700 Solenoid 2 Fault (Stored) 700 Solenoid 3 Fault (Stored) 700 Solenoid 1 Fault (Current) 700 Solenoid 2 Fault (Current) 700 Solenoid 3 Fault (Current) | Bit 1 Bit 2 Bit 3 Bit 5 Bit 6 Bit 7 | 0 |
Byte 6 | 705 Throttle Position Sensor Fault | Bit 0 | 0 |
Notes:
– Most Bit values use Inverted Logic (0 = True)
– Occasionally during bench tests, Byte 6 will have many bits active
Bit Logic Breakdowns
Byte 3 (Inputs) | FALSE | TRUE |
Bit 0 | C10 Brake Switch On | C10 Brake Switch Off |
Bit 1 | 0 | 0 |
Bit 2 | C5 Shift Point Logic Ground | C5 Shift Point Logic Open |
Bit 3 | 0 | 0 |
Bit 4 | C9 NSS 3rd Switch On | C9 NSS 3rd Switch Off |
Bit 5 | C8 NSS 1-2 Switch On | C8 NSS 1-2 Switch Off |
Bit 6 | C12 Mystery On | C12 Mystery Off |
Bit 7 | C11 Power Mode Switch On | C11 Power Mode Switch Off |
NOTES:
Bench testing a 90 tcu shows bit 2 as true, but it is false on vehicle.
Bench testing a 92 tcu, bit 0 is false since C10 is held at 12v. Grounding reads true.
Bench testing a 92 tcu shows bit 7 as false
Byte 3 PRNDL | Bit 4 FALSE | Bit 4 TRUE |
Bit 5 FALSE | ??? | 1-2 |
Bit 5 TRUE | 3 | PRND |
Byte 4 (Outputs) | FALSE | TRUE |
Bit 0 | 0 | 0 |
Bit 1 | 0 | 0 |
Bit 2 | 0 | 0 |
Bit 3 | 0 | 0 |
Bit 4 | 0 | 0 |
Bit 5 | Solenoid 1 On | Solenoid 1 Off |
Bit 6 | Solenoid 2 On | Solenoid 2 Off |
Bit 7 | Solenoid 3 On | Solenoid 3 Off |
Byte 4 Current Gear | Bit 5 FALSE | Bit 5 TRUE |
Bit 6 FALSE | 2nd | 3rd |
Bit 6 TRUE | 1st* | 4th |
NOTE:
– * 1st gear will read as “???” if Torque Converter Bit 7 is FALSE
Byte 5 | FALSE | TRUE |
Bit 0 | 0 | 0 |
Bit 1 | – | 700 S1 Fault Stored |
Bit 2 | – | 700 S2 Fault Stored |
Bit 3 | – | 700 S3 Fault Stored |
Bit 4 | 0 | 0 |
Bit 5 | – | 700 S1 Fault Current |
Bit 6 | – | 700 S2 Fault Current |
Bit 7 | – | 700 S3 Fault Current |
Byte 6 | FALSE | TRUE |
Bit 0 | – | 705 TPS Fault |
Bit 1 | – | 705 TPS Fault? |
Bit 2 | – | 705 TPS Fault? |
Bit 3 | – | 705 TPS Fault? |
Bit 4 | – | 705 TPS Fault? |
Bit 5 | – | 705 TPS Fault? |
Bit 6 | – | 705 TPS Fault? |
Bit 7 | – | 705 TPS Fault? |
NOTES:
Bench testing a 92 tcu, bit 0 starts as false if TPS ground is left disconnected. Connecting it will trigger bit 0 true. TPS reads 6 before, and 3 after.
Fun Facts:
– Although the RPM Byte has a full range, the TCU will not report values slower the 300 RPM.
– The Frame Timing comes out to a 1/4 second update time.
– Due to the oddly slow Baud Rate, Teensy Microcontrollers can’t read slow enough unless UART Serial 3 is used or the clock speed is reduced to 48MHz.
– There is a Jumper J2 that changes the module ID. On 2.5L, the Jumper is present and Module ID reads “2” instead of “1.”
– There is an unused Jumper next to J2 that changes the Module ID as well.
– Grounding unused changes the “2” to “1” on a 2.5L TCU.
– Grounding unused changes “1” to a “3” on 4.0L TCU. Grounding J2 makes it read “1” again.
Hi Nick, great blog and posts! I am fan (show me who isn’t :)) of AW-4 (V4AW3 on my Mitsubishi P2) and researching for ability to tune and may be reflash its TCU. You found that it has data out on C4, but my though my TCU is made by Aisin as well it has different pinout so i would like to know which microcontroller pin goes your C4. Do you have a chance to make a photo of microcontroller on PCB (to compare if they are the same)? and check which pin routed to C4?
I’ve actually got a lot of stuff on my facebook page from a while back when i did a deep dive. Maybe I’ll make a website page at some point. I’ve got PCB trace outlines and even main chip pinouts! Check these 2 posts for the bulk of my findings though.
https://www.facebook.com/nickintimefilms/posts/2564383410292216
https://www.facebook.com/nickintimefilms/posts/2768485073215381