Hi guys,
I got my hands on a set of 2 ECUs, 1 TCM and 1 Airbag module from a 1998/1998 3.5L 300M, euro specs. As a hacker I couldn't resist taking them appart, as well as an OTIS and an EVIC (not pictured tho). It might be useful for some people so I decided to write a few posts about that.
What got me into these teardowns is the fact that my Chinese witech pod clone isn't able to update the TCM on my 2000 PHP, so this thread might evolve a bit in the future based on discoveries I might be able to make on the modules...
First thing first, the Airbag module. I will include the part number later as I'm at work typing this and I only have the pictures I took this weekend.
The brain of this module is a Motorola microcontroller. Its part number starts with SC so this is a custom design. Based on the packaging tho I guess this is a MC68HC07 or similar.
In the upper left corner next to the MC68HCxx there are two little chips... The upper one marked H3539AA (this is a Chrysler partnumber unfortunately) is used to "adapt" the PCI bus voltage down to something the microcontroler could handle. More on this later
Because the MC68HC07 doesn't have a J1850 transceiver embedded in it, the chip marked 04745748 (again, custom partnumber) is required. It communicates with the microcontroller over its SPI bus.
Based on electrical diagram and on the connector pinout there isn't any outside sensor for module to detect a crash. So I guess the big metal-encased component is an acceleratometer (a G-sensor).
The huge diode in the lower right corner is here to protect the module against reverse polarity.
A thin coat of laquer covers the whole board, probably to avoid corrosion and humidity induced failure, but also to prevent hackers from desoldering any components too easily

I spent a lot of time searching for information about how MC68HCxx chips interpret J1850 signals from the car PCI bus. There are two, depending on the chip used. MC68HC05, MC68HC07 and MC68HC11 don't have J1850 capabilities on their own and require the use of the two components I just talked about. MC68HC08 however can handle J1850 natively and only require a voltage level shifter.
If you look closely at the H3539AA chip, right above it sit 2 CMS resistors, a 10 ohms resistor on the output, and 15k ohms on the input. The two resistors are connected to the PCI bus. Probing the board from this junction to the PCI bus pin on the module conenctor show a perfect continuity. Resistors values are also close from what states the wiring diagram on my computer.


I got my hands on a set of 2 ECUs, 1 TCM and 1 Airbag module from a 1998/1998 3.5L 300M, euro specs. As a hacker I couldn't resist taking them appart, as well as an OTIS and an EVIC (not pictured tho). It might be useful for some people so I decided to write a few posts about that.
What got me into these teardowns is the fact that my Chinese witech pod clone isn't able to update the TCM on my 2000 PHP, so this thread might evolve a bit in the future based on discoveries I might be able to make on the modules...
First thing first, the Airbag module. I will include the part number later as I'm at work typing this and I only have the pictures I took this weekend.
The brain of this module is a Motorola microcontroller. Its part number starts with SC so this is a custom design. Based on the packaging tho I guess this is a MC68HC07 or similar.
In the upper left corner next to the MC68HCxx there are two little chips... The upper one marked H3539AA (this is a Chrysler partnumber unfortunately) is used to "adapt" the PCI bus voltage down to something the microcontroler could handle. More on this later

Because the MC68HC07 doesn't have a J1850 transceiver embedded in it, the chip marked 04745748 (again, custom partnumber) is required. It communicates with the microcontroller over its SPI bus.
Based on electrical diagram and on the connector pinout there isn't any outside sensor for module to detect a crash. So I guess the big metal-encased component is an acceleratometer (a G-sensor).
The huge diode in the lower right corner is here to protect the module against reverse polarity.
A thin coat of laquer covers the whole board, probably to avoid corrosion and humidity induced failure, but also to prevent hackers from desoldering any components too easily


I spent a lot of time searching for information about how MC68HCxx chips interpret J1850 signals from the car PCI bus. There are two, depending on the chip used. MC68HC05, MC68HC07 and MC68HC11 don't have J1850 capabilities on their own and require the use of the two components I just talked about. MC68HC08 however can handle J1850 natively and only require a voltage level shifter.
If you look closely at the H3539AA chip, right above it sit 2 CMS resistors, a 10 ohms resistor on the output, and 15k ohms on the input. The two resistors are connected to the PCI bus. Probing the board from this junction to the PCI bus pin on the module conenctor show a perfect continuity. Resistors values are also close from what states the wiring diagram on my computer.


Null, M-Pressive liked this
1999 300M - "Black Girl" - RIP