Bendix Jeep 4.0L ECU Datastream

Here is my reverse engineering work on the Bendix 4.0L Electronic Control Unit found in 87-90 Renix Jeeps. This self contained unit is in charge of running the engines Renix Multi-Point Fuel Injection System as well as other engine Sub-Systems. The ECUs data stream output is available which we can use for datalogging and diagnostics.

TX output is found on Pin C12 of the ECU which connects to Pin D2-1 in the 15 pin Renix Diagnostic Adapter found in the engine bay. This is an open collector output circuit to vehicle ground, so the Receiver pulls the line high and the ECU will pull the line low to transmit. This gives us an inverted signal that will need to be flipped to be read with standard UART.

Data Protocol:

This ECU unit uses a standard Bendix Data Protocol which is as follows:
– Protocol: UART, Inverted Logic
– Baud: 62,500
– Frame Length: 33 Bytes
– Frame Start: value 0 is sent
– Frame End: value 255 is sent
– Special Case: data bytes must send duplicate 255 value to differentiate from Frame End. Duplicate value must be discarded to maintain proper framing.

Data Framing

Byte Order	Reading	Math	Dump
Start Byte			0
Byte 0	Program Version	HEX B0 = old program B1 = new program	177
Byte 1	Vehicle Calibration	HEX Bit 2, 7	20
Byte 2	PROM 3	HEX	63
Byte 3	MAP Sensor	# / 51 = [0 – 5V] # / 9.13 + 3.1 = [3.1 – 31″hg]	118
Byte 4	CTS Sensor	# * 1.125 – 40 = [-40 – 247F]	110
Byte 5	IAT Sensor	# * 1.125 – 40 = [-40 – 247F]	106
Byte 6	Battery Voltage	# / 16.24 = [0 to 15.7V]	222
Byte 7	o2 Sensor	# / 51.2 = [0 – 4.98V]	255
Byte 8	RPM Low Byte	20,000,000 / # = [20,000 – 305]	90
Byte 9	RPM High byte	16 bit Number = (#9, #8)	92
Byte 10	Injector Short Flags	Bits 2 – 7	253
Byte 11	Injector Open Flags	Bits 2 – 7	254
Byte 12	TPS Sensor	# / 51.2 = [0 – 4.98V] # / 2.55 = [0 – 100%]	40
Byte 13	Spark Advance ºBTDC	DEC	15
Byte 14	M1? Idle Mode Flags		0
Byte 15	M2? Offset related to CTS		110
Byte 16	Baro Pressure Manifold Vacuum	# / 51.2 = [0 – 4.98V] # / 9.13 + 3.1 [3.1 – 31″hg] Baro – Byte 3	248
Byte 17	M3? Engine Bit Values Engine Run Flag?	Bit 2	0
Byte 18	Loop Status EGR Solenoid Exhaust Mixture	Bit 1, 6 Bit 3 Bit 7	16
Byte 19	Injector Pulse Width	# * 0.128 [0 – 32.6ms]	100
Byte 20	M4? Possibly Error Flags CTS Simulation Mode	Bit 1	0
Byte 21	Throttle Switch Distributor Sync Signal Copy	Bit 1, 3 Bit 4	72
Byte 22	Spark Adv Knock Mask Knock Detect Spark Retard	DEC (Bit 0 – 6 ONLY) Bit 7 Knock Mask – Byte 13	15
Byte 23	Cold Enrichment Offset	# * 0.128 [0 – 32.6ms]	39
Byte 24	Short Term Fuel Trim	DEC	128
Byte 25	M7? Offset related to IAT		116
Byte 26	Long Term Fuel Trim	DEC	160
Byte 27	Knock Sensor	DEC	0
Byte 28	M8? Possibly Error Flags		0
Byte 29	Distributor Sync Signal Starter Signal A/C Switch A/C Request NSS Drive Gear	Bit 2 Bit 4 Bit 5 Bit 6 Bit 7	10
Byte 30	Output Error Flags	Bits 0, 2 – 6	243
Stop Byte			255

NOTES:
– Most of the Math was Reverse Engineered from the MT2500 1099 Cartridge
– Mystery Bytes are marked with an M#?, these are not listed on tested scan tools

Bit Logic Breakdowns

NOTE:
– ” ? “ = Unknown Values that have been observed to change
– “1 or 0” = Unknown Values that have not been observed to change, normal Value shown
– “(Letter/Numbers)” = Values that have been confirmed to corrosponding ECU Pin

Byte 1	FALSE	TRUE
Bit 0	0	0
Bit 1	0	0
Bit 2	Old Program	New Program
Bit 3	0	0
Bit 4	1	1
Bit 5	0	0
Bit 6	0	0
Bit 7	Auto Trans Program	Manual Trans Program

NOTES:
– These are the only values I have noticed so far but seem to align with other tested units

Byte 10	False	True
Bit 0	Injector 12V Hot	OK
Bit 1	0	0
Bit 2	Injector 1 Short	OK
Bit 3	Injector 5 Short	OK
Bit 4	Injector 3 Short	OK
Bit 5	Injector 6 Short	OK
Bit 6	Injector 2 Short	OK
Bit 7	Injector 4 Short	OK

NOTES:
– These seem to be Power-On Diagnostic Faults that take place when KO-EF
– If the Power On Diagnostic Tests were not run, this and other extra PROM bytes will read 255
– If an Injector has a 12v Hot short, Byte 10 will read 252.
– FF: The Injectors are listed in firing order instead of sequentially

Byte 11	False	True
Bit 0	0	0
Bit 1	Injector 12V Hot	OK
Bit 2	Injector 1 Open	OK
Bit 3	Injector 5 Open	OK
Bit 4	Injector 3 Open	OK
Bit 5	Injector 6 Open	OK
Bit 6	Injector 2 Open	OK
Bit 7	Injector 4 Open	OK

NOTES:
– These seem to be Power-On Diagnostic Faults that take place when KO-EF
– If the Power On Diagnostic Tests were not run, this and other extra PROM bytes will read 255
– If there is no 12v Supply to ECU Injector Feed, Byte 11 will read 255
– If there is no Injector Ground, Byte 11 will read 0.
– If an Injector has a 12v Hot short, Byte 11 will read 252.
– FF: The Injectors are listed in firing order instead of sequentially

Byte 14	FALSE	TRUE	Notes
Bit 0	Load Idle Comp Off?	Load Idle Comp On?	NSS based load flag?
Bit 1	A/C Idle Comp Off ?	A/C Idle Comp On ?	true w/ 29 b5 & b6
Bit 2	– ?	A/C Clutch Turning Off?	pulses on B1 falling
Bit 3	– ?	A/C Clutch Turning On?	pulses on B1 rising
Bit 4	IAC not Moving	IAC Moving	sum of 5 & 6
Bit 5	IAC not Opening	IAC Opening
Bit 6	IAC not Closing	IAC Closing
Bit 7	0	0

NOTES:
– I consider this Mystery Byte 1 as it is undocumented
– Bit 1 generally follows the NSS switch, but tends to be true sometimes even when in neutral or park. Not entirely sure what it shows beyond just transmission load idle compensation.
– Bit 2 generally follows the A/C Request gauge, but only seems to update state when TPS reads closed. Otherwise it will stick at last state when driving regardless of A/C Select or Request states.
– Bit 4, 5, & 6 show IAC valve operation, stepper motor command and direction
– Bit 4 is sum of 5 and 6
– Number of actual stepper pulses does not align to the amount of trues, generally showing more true frames then actual pulses. Inferred that IAC is only active when true.
– An up/down counter divided by 10 roughly equals actual IAC revolutions, but there is no easy way to track when fast, continuous pulses are sent.

Byte 17	FALSE	TRUE
Bit 0	0	0
Bit 1	0	0
Bit 2	Engine Off False?	Engine Off True?
Bit 3	?	?
Bit 4	ECU Cruise Mode False?	ECU Cruise Mode True?
Bit 5	Closed Loop Not Attempted?	Closed Loop Attempted?
Bit 6	ECU Crank Mode False	ECU Crank Mode True
Bit 7	0	0

NOTES:
– I consider this Mystery Byte 3 as it is undocumented
– Seems to be different engine or ECU Mode  flags
– During crank no start, Bit 2 and 3 are steady True
– Bit 4 is related to RPM and MAP, above 1100 RPM adjusting the MAP will change the rpm trigger point. This shows up on an Auto ECU without Upshift wire so can’t fully confirm if upshift or cruise.
– Bit 6 is true when cranking, but only after data rate picks up. False after 500+ RPM. Maybe Engine Cranking Mode?

Byte 18	FALSE	TRUE
Bit 0	?	?
Bit 1	Bit 6	Decel LP
Bit 2	?	?
Bit 3	EGR Off	EGR On
Bit 4	?	?
Bit 5	?	?
Bit 6	Open LP	Closed LP
Bit 7	Lean	Rich

NOTES:
– Decel takes priority over Bit 6
– Bit 2 closely follows Bit 7

Byte 20	FALSE	TRUE
Bit 0	0	0
Bit 1	–	CTS Not Detected
Bit 2	0	0
Bit 3	0	0
Bit 4	0	0
Bit 5	0	0
Bit 6	0	0
Bit 7	0	0

NOTES:
– Mystery Byte 4, Possible Error Flags
– When bench probing with bare minimum pins, Bit 1 is true.

Byte 21	FALSE	TRUE
Bit 0	?	?
Bit 1	TPS Partial	TPS WOT
Bit 2	Sync Signal Duplicate +	Sync Signal Duplicate –
Bit 3	TPS Partial	TPS Closed
Bit 4	Starter Off Duplicate	Starter On Duplicate
Bit 5	?	?
Bit 6	?	?
Bit 7	0	0

NOTES:
– Partial takes priority if Bit 1 and 3 are equal, usually in false state
– Similar to Byte 29 when rpm is detected except Bit 6 is true
– Bit 2 is a duplicate* of Byte 29, Bit 2 when Engine is Running (*See FF)
–

Byte 28	FALSE	TRUE
Bit 0	0	0
Bit 1	0	0
Bit 2	0	0
Bit 3	0	0
Bit 4	0	0
Bit 5	0	0
Bit 6	0	0
Bit 7	?	?

NOTES:
– Mystery Byte 8, Possible Error Flags
– When bench probing with bare minimum pins, Bit 7 is true.

Byte 29	FALSE	TRUE
Bit 0	0	0
Bit 1	1	1
Bit 2	C5 Sync Signal Low	C5 Sync Signal High
Bit 3	TPS Partial	TPS Closed
Bit 4	C3 Starter Signal Low	C3 Starter Signal High
Bit 5	D2 A/C Select Off	D2 A/C Select On
Bit 6	C2 A/C Request No	C2 A/C Request Yes
Bit 7	C4 NSS Park	C4 NSS Drive

NOTES:
– Bench testing confirms labeled pinouts, will change even with engine off
– Bits 2, 3, and 4 nearly mirror the same bits from Byte 21
– During crank no start, Bit 1 and 2 will alternate in a Sync pattern, but byte 21 does not move
– Bit 3 is active when RPM is detected, has instant pulses while also following Byte 21

Byte 30	FALSE	TRUE
Bit 0	ICM Fault	OK
Bit 1	1	1
Bit 2	EGR Solenoid Fault	OK
Bit 3	0	0?
Bit 4	B+ Latch Relay Fault	OK
Bit 5	o2 Heater Relay Fault	OK
Bit 6	AC Relay Fault	OK
Bit 7	System Not Primed?	OK

NOTES:
– PROM 6, Output / Relay Error Flags
– When the Fuel Pump Relay/Injector Feed is unplugged, ECU doesn’t report voltage and Prom 4,5,6 read FF
– If the ECU is quickly cycled on and off, it does not run it’s 3 second priming routine and bit 7 is true. Only Bit 0 consistently reports correctly in this mode.
– Messing with 12v Hot short on Injectors and some other relay combo testing occasionally shows bits 1-6 go true for some reason. Some kind of soft fault for relay testing for this byte?

Other Failure Notes

• MAP Disconnected: MAP reads 0, Baro reads 0
• CTS Disconnected: CTS copies IAT at start, M2 reads 255, M4 Bit 2 reads true
• IAT Disconnected: IAT reads 255, M7 reads 255
• TPS Disconnected: TPS reads 0, o2 reads 0 (See FF)

Fun Facts

• The data stream is not sent in a single packet, but rather it is sent each byte individually. The byte spacing is closely related to engine rpm so it is possible there are less available loops to send a byte when it’s trying to process data faster?
• On top of this weird delay, the output stream is also sent “Live.” Instead of the computer taking a snapshot of all readings and loading them into a buffer to be sent out, each byte is sampled right before it is sent for minimum lag time. But this means that longer byte gaps will cause data to be farther “out of sync” with previously read in bytes of the same data frame.
• If CTS is not detected, it will mirror the IAT reading until start up, then slowly increase based on Engine Revolutions
• With Engine Off, o2 reading is instead approximately scaled to TPS reading from 0 – 7
• The RPM reading is actually the amount of time between 2 spark pulses in Microseconds. This can be converted like so: 1,000,000 * 60 / Pulses per Rotation(Cyl/2) / Pulse Gap = RPM. 
• The reported Battery Voltage is read from Injector Feed C11/D10 which comes from the Fuel Pump Relay. This explains why it shows 0v with engine off.

ECU Pinout Breakdown

Connector Cavity	ECU Circuit	Data Stream Relation
A1	Injector 3
A2	Injector 6
A3	Injector 2
A4	Injector 4
A5	Fuel Pump Relay Ground
A6	–
A7	Oxygen Relay Ground
A8	Upshift Lamp – Manual
A9	B+ Latch Relay Ground
A10	EGR Control
A11	–
A12	A/C Clutch Control

Connector Cavity	ECU Circuit	Data Stream Relation
B1	Injector 1
B2	Injector 5
B3	AIS Motor (A)
B4	AIS Motor (D)
B5	AIS Motor (C)
B6	AIS Motor (B)
B7	Battery
B8	Ignition
B9	–
B10	B+ Latched
B11	Ground
B12	Ground

Connector Cavity	ECU Circuit	Data Stream Relation
C1	Engine Speed Input
C2	A/C Request	Byte 29, Bit 6
C3	Start Signal (+)	Byte 29, Bit 4
C4	Start Signal (-)	Byte 29, Bit 7
C5	Sync Signal	Byte 29, Bit 2
C6	MAP Input	Byte 3
C7	TPS Input	Byte 12
C8	Air Temp Input	Byte 5
C9	–
C10	Coolant Temp Input	Byte 4
C11	Injector Feed	Byte 6
C12	TX Serial Data Output
C13	_
C14	MAP 5 Volt Supply
C15	TPS 5 Volt Supply
C16	Sync 7.1 Volt Supply

Connector Cavity	ECU Circuit	Data Stream Relation
D1	Engine Speed Input
D2	A/C Select	Byte 29, Bit 5
D3	Sensor Ground
D4	–
D5	–
D6	–
D7	–
D8	Knock Sensor Ground
D9	Oxygen Sensor Input	Byte 7
D10	Injector Feed	Byte 6
D11	RX Serial Data Input
D12	–
D13	Timing Output	Bytes 9 , 8
D14	–
D15	–
D16	Knock Sensor Input	Byte 27