Deep dive into the PCI bus and SBEC modules...

[remi]

Hi guys,

I got my hands on a set of 2 ECUs, 1 TCM and 1 Airbag module from a 1998/1998 3.5L 300M, euro specs. As a hacker I couldn't resist taking them appart, as well as an OTIS and an EVIC (not pictured tho). It might be useful for some people so I decided to write a few posts about that.
What got me into these teardowns is the fact that my Chinese witech pod clone isn't able to update the TCM on my 2000 PHP, so this thread might evolve a bit in the future based on discoveries I might be able to make on the modules...


First thing first, the Airbag module. I will include the part number later as I'm at work typing this and I only have the pictures I took this weekend.
The brain of this module is a Motorola microcontroller. Its part number starts with SC so this is a custom design. Based on the packaging tho I guess this is a MC68HC07 or similar.
In the upper left corner next to the MC68HCxx there are two little chips... The upper one marked H3539AA (this is a Chrysler partnumber unfortunately) is used to "adapt" the PCI bus voltage down to something the microcontroler could handle. More on this later
Because the MC68HC07 doesn't have a J1850 transceiver embedded in it, the chip marked 04745748 (again, custom partnumber) is required. It communicates with the microcontroller over its SPI bus.
Based on electrical diagram and on the connector pinout there isn't any outside sensor for module to detect a crash. So I guess the big metal-encased component is an acceleratometer (a G-sensor).
The huge diode in the lower right corner is here to protect the module against reverse polarity.
A thin coat of laquer covers the whole board, probably to avoid corrosion and humidity induced failure, but also to prevent hackers from desoldering any components too easily


I spent a lot of time searching for information about how MC68HCxx chips interpret J1850 signals from the car PCI bus. There are two, depending on the chip used. MC68HC05, MC68HC07 and MC68HC11 don't have J1850 capabilities on their own and require the use of the two components I just talked about. MC68HC08 however can handle J1850 natively and only require a voltage level shifter.
If you look closely at the H3539AA chip, right above it sit 2 CMS resistors, a 10 ohms resistor on the output, and 15k ohms on the input. The two resistors are connected to the PCI bus. Probing the board from this junction to the PCI bus pin on the module conenctor show a perfect continuity. Resistors values are also close from what states the wiring diagram on my computer.

[remi]

Now, the ECU... This one is labeled P04606970AL. Based on WiTech resources this part number correspondes to "99 LH 3.5L A4 BUX". BUX stands for European Specs. There is an update available with the revised part number AQ.
The module is filled with some silicone putty, removal is a pain... Ask how I know! There are some chemicals more or less available depending on local laws that could dissolve the silicone but they would also melt some components... Mechanical action is safer but longer.
Let's play folks! There's a thermistor in there... Where it is?



Let's have a closer look at the microcontroller area... Any hacker will spot J16 and J311 headers at the edge of the board! I wasn't able to guess any pinout tho.
The brain, again, is a Motorola chip with a custom part number. On its left stands two chips that I couldn't identify. The ST branded one might be a multiplexer to extend the number of inputs and outputs.
However the big M28F220 flash memory chip from ST is very interesting... It's a 2 megabits flash memory, that's 256 kilobytes of data. And guess what? The AQ update file IS 256 KB! What a coincidence...


Now we can see a bunch of transistors or mosfets on the side. A metal spring has been removed, used to clamp the resistor against the ECU case to act as a heatsink. I bet they control the injectors and ignition coils


On the other side now, we can see 3 strange components with more than 3 pins each. I guess they are voltage regulators and provide 5 volts to the board itself, 8 or 9 volts to the sensors, etc...


If you haven't found it, the thermistor is labeled R584 in the middle of the board, closer to the connector than the microcontrollers... So the ECU is also monitoring its temperature!
I wasn't able to spot the usual chips for the J1850 signals but it makes sense. J1850 require a master node to operate and I bet the ECU acts as a master, so it must have different components compared to the slave nodes.

[remi]

Next, what dragged me into all this mess: the TCM. Part number is P04606082AK and stands for "98 LH EATXIIIA WITH AUTOSTICK". This is the last revision for this part number.


The silicone putty in here is easier to remove compared to the ECU, it is a lot softer to the touch but will stick to anything! Don't get some on your clothes! The transistors or mosfets are hidden by some clamps on the top.


Oh what a surprise... there's a custom Motorola microcontroller in there! But also a ST M28F102 1 megabits flash memory chip, understand 128 kilobytes... And of course, the update file available is also 128 KB.


The two J1850-related chips are visible close to the microcontroller, however the resistors might be o nthe other side... Let's probe the resistance between the PCI bus pin on the TCM connector and the pins on the voltage shifter then! If I'm right, we should get 10 ohms on pin 7 and 15k ohms on pin 5... Ok we get 13.9k, close enough!



In the coming months I will get a universal memory programmer, desolder the flash chips from the TCM and ECU, read them, and compare the content with the update files from Chrysler. I wonder if the 2000 TCM could get updated this way. If update files are basic binary files, it would work

[remi]

The instrument cluster isn't different... A custom Motorola microcontroller and the usual two J1850 transceiver and voltage shifter. Probing the board and the connector shows continuity, as expected.

[remi]

Even if locations of the chips differ, OTIS are based on the same hardware, no surprise... Don't mind the wires, I've used this OTIS to hack the VFD display a while ago.

[remi]

For now, EVIC are the only modules that stand aside! First of all the Motorola microcontroller is a "regular" MC68HC908AS60. AS series are J1850 ready, AZ series are CAN ready. There's still a voltage shifter to handle the "physical" part of the bus, it's the 8 pins chip made by Philips between the microcontroller and the plug.




The MC68HC908AS60 is protected against illegal readings. There's a safety feature that blanks the chip if an unrecognized "password" is used while dumping its content.

Why is the EVIC different? I don't know... Maybe it's a "year" thing? I wish I had a NGC PCM or BCM to teardown...

[remi]

Some more update!

Santa was kind enough to bring a GQ-4x4 EEPROM programmer for Christmas, with some adapters in order to plug the 28F102 and 28F220 EEPROM from the ECU and TCM.

So after powering the good old hot air gun station up, I started heating the chip on the TCM motherboard and... I pulled too much on the chip thinking the silicone in there was keeping it stuck on the board! I ended up ripping off the contact pads from the PCB... Damn! A TCM down the trashbag...

Anyway, I dumped the content from the chip and compared that dump with the flash file from an old DRBIII update ISO file. At first I thought the files were completely different. The flash files has one readable text starting on line 300 while the dump looks corrupted.
Hang on... What if we swap high and low bytes for each word? E.g. at blocks 310 to 317, we have 4F 43 59 50 49 52 48 47 as hexadecimal values, which converts to OCYPIRHG in ASCII. If we swap high and low bytes we get 43 4F 50 59 52 49 47 48 which converts to COPYRIGH (the T and the space after the T comes in blocks 318 and 319).


Now let's swap bytes for the entire dump and compare that to the flash file... Only two words (two blocks) now differ between the two files:


Why such a difference, and why one only? I have no idea.
I was expecting to see more differences, like CVI and such but nop... I know the calibration ID aka part number (04606082AK here) is not the only thing identifying the flash level, there is also a calibration validation index or checksum IIRC... However I wasn't able to communicate with the TCM before unsoldering the EEPROM because of the way the PCI bus works.
I'm still waiting for an adapter before unsoldering the EEPROM from the ECU, so there will be more on this later.

Btw it looks like I can't upload pictures to Fotki, so I'm using another hosting service for now. I'll switch back to Fotki when possible.

[snstr_auto]

Are you needing more modules to dissect? I have like 3 TCM's sitting on a shelf and a few ECM's as well and can probably harvest others from the parts cars I have

[remi]

Oh I would LOVE to A BCM would be awesome, and of course another TCM as this one is fried... Do you know the part numbers?

[snstr_auto]

TCM's I can check tonight when I get home. A BCM may be a bit harder to get a part number from as they would still be in the cars presently. I DO also have a couple SKIM modules kicking around as well

[remi]

And some update

While playing with the J1850 adapter I built (more information here for hardware and software) I was able to have some fun with the Dodge Intrepid cluster... The following information are provided as-is, in bulk, and might (ok, will!) be useless to many people here

Using this source and this one as well I was able to send some data to the cluster.
It's hard to say if the J1850 protocol used on our cars is based on a 1 or 3 bytes headers... And because the Mictronic J1850 firmware is kinda buggy I had a lot of troubles figuring it out... It happens that using this interface I had to set the header as 3 bytes then switch to 1 byte mode because setting a 1 byte header directly on one command simply doesn't work.
On top of that the cluster fails back to a "NO BUS" mode after like 15 seconds so it has to be reset every once in a while if all the following is done off the car.

Let's take the example of RPM on DI.net forum:
0x10: RPM/MAP?
- [1..2] (Engine/Transmission Input)? RPM (*4)
- [3..4] Transmission Output RPM (*4)
- [5] MAP (kPa)?
- [6] CRC-8
::Example:
:: 10 26 84 0D 80 2C 6E
:: Input RPM = 0x2684 / 4 = 2465.00
:: Output RPM = 0x0D80 / 4 = 864.00
:: MAP = 0x2C (44)
The J1850 and all ELM27 chips are handling the CRC at the end so we don't really care about that last byte (as a reminder one byte is made of 2 characters from 0 to 9 and A to F, so 0x01 = 1 in decimal form, and 0xFF = 256 in decimal form).
In order to display 2465 rpm on the cluster we have to send the identification header 10 (that's the PCM), then the 2 first bytes 0x2684 that translates to 2465 rpm at the engine or transmission input shaft, and finally 3 bytes of useless data because the cluster doesn't display transmission output rpm and MAP value...

So what has to be done (after connecting the J1850 interface to the cluster and to the computer of course) is:
- Set header to 10 (pretend to be the ECM or PCM)
- Switch to 1 byte header mode
- Send 0x2684 for the RPM and 0xffffff for uesless data
Which for the J1850 turns into:
- ATSH10ffff (because it's buggy we have to fill some ff in there but pay attention to that it's irrelevant)
- ATO1 (1 byte header mode
- 2684ffffff
And the needle jumps to 2465 rpm !!!! I was able to crank it up to 8000 rpm but not up to 8500, there might be a value in between that would work but well...


Ok so on DI.net forum they are talking about the seat belt:
::Examples:
:: 33 01 B6 = Seatbelt Fastened! Good Job!
:: 33 00 AB = Seatbelt *NOT* Fastened. CLICK-IT OR TICKET B****
33 is the ID header, 00 or 01 is the status of the seat belt, and then comes the CRC that we don't have to worry about.
Again, let's type:
- ATSH33ffff
- ATO1
- 00
At this point the seat belt light indicator on the cluster lights up! Let's type 01 right away, and the indicator goes down


Mileage? No problem...
Message 0x72 Odometer
Example : 72 08 90 40 F9 50
[0] = message type (72 in this example)
[1] …[4] = odometer units = 1/8000 miles, example 0x089040F9 = 143671545 / 8000 = 17958 miles
17958 *1.609 = 28895 km
[5] = CRC
So onece again let's type:
- ATSH72ffff
- ATO1
- 089040F9
And the odometer now reads 17958 miles! Don't panic, it's temporary. The BCM is actually broadcasting this message with its real mileage in it... This WON'T program your mileage in any way


I tried an unknown command from Kolumbus.fi (http://www.kolumbus.fi/~ks9292/J1850/Je ... otocol.rtf)
Message 0xC0 ???
C0 DC 64 85 51 C7
C0 DD 64 85 51 5A
C0 DD 64 84 4E 60
Again the last byte is the CRC that will be generated by the interface.
- ATSHC0ffff
- ATO1
- DC648551
This time the engine coolant gauge jumps about half way! While I have no idea about the formula used to translate the actual temperature to this, it looks like the 2 last bytes (8551) are linked to the temperature and make the needle move. Changing the value of the first 2 bytes doesn't do anything.


What's next... Let's see... Transmission status?
From Kolumbus.fi logs:
Message 0x37 shifter position
37 05 00 32
[0] = message type
[1] = Shifter position, known bit masks 0x01=P, 0x02=R, 0x03=N, 0x05=D, 0x06=2, 0x07=1
[2] = unknown
[5] = CRC
And from MWisBest on DI.net:
0x37: Shifter Position
- [1] Gear: P (0x01), R (0x02), N (0x03), D (0x05), AutoStick (0x06)
- [2] AutoStick Status?: 0x80 = AS Present? Gears Bitmask?
- [3] CRC-8
Let's send some bytes over the bus:
- ATSH37ffff
- ATO1
- 0100 (the gear selection display on the cluster now has the P encircled)
- 0700 (Autostick 1 is now encircled)
- 0200 (Reverse is encircled)
One important thing to note... Keeping sending these messages to the cluster prevented it to fail back to NO BUS mode. I was able to keep it alive for how long as I wanted this time.


Unfortunately I wasn't able to send any other information to the cluster. I have no idea how to talk to the speedometer gauge, and the fuel level messages provided by MWisBest and Kolumbus.fi don't work.
That's sad because it could be used to calibrate the needles in case of a rebuild or after swapping needles on our clusters with red Intrepid ones! I'll keep working on it

[00R/T]

Hey Remi, awesome work!

In your experimenting, have you managed to decode any other messages?

These are the ones I’m going to need to figure out, and I don’t want to do work that someone else already has:

VIN #
Ignition Switch Status
Engine running or not
Dash light dimmer setting and on/off state
Shifter position
Outside temperature
Steering wheel switch state
Heated seat switch state
Heated seat state
Everything that goes in and out of the ATC head

I think many of those others have figured out on other models, so I’m hoping I can use that info. I know you’ve already covered a few here as well. Some things I might be able to infer also, like engine running state from RPM.

[remi]

Thank you Steve!

Well I was able to get the VIN and thanks to the ELM327 documentation. IIRC you have to send 0902 (hex) and it will output the VIN in ASCII hexadecimal codes with 3 byte headers, on multiple lines (the first line contains the number of lines on which the VIN is being encoded).

If you are familiar with programming you may want to have a look there: https://github.com/laszlodaniel/DRBDBReader which is the DI.Net guy's github DRB3 database parser. This dude is skilled... And this RDB Database Reader is awesome even if it is lacking documentation!
You would have to build his code (with Visual Studio) and get your hands on a DRB emulator installer to get the database.mem file. You can then start the DRBDBReader executable, load the database, list ALL the supported modules or even search for a specific module (like EATX or PCM or LH, whatever keyword you want to use), display the list of ALL commands sent by the DRB to a specific module (see previous step), basically everything when you want to get a status from a module can be listed. It also tells you how to interpret the response and has an embedded "converter" (you can send a raw hex message and it tells you the value and unit of thesaid message depending on the command id).
It is missing the "configuration" commands tho... Or maybe I didn't understand that from the code. Basically you can see that there is a command for "Volume Up" (let's pretend there's one), but it doesn't tell you how to send data. It will tell you how to know if the button is being pressed but not how to send the "Volume Up" command to the radio. Same for the easy exit feature on the seat, you can see the command for enabling/disabling that feature, but it doesn't tell you what to send to the seats computer to actually trigger the configuration change.

It may sound horrible but when you get used to it well it gets easy. I can help you to understand how it works, I've managed to get the full list of commands for our TCMs... I thought I had saved that file somewhere...

[00R/T]

I’ll have to read through that thread.

Right now I’m primarily focused on the run-time messages and not the diagnostic stuff, but that may change.

I know most (hopefully all) of the logic for the ATC lives in the BCM and the head is just that interface. That should mean it’s theoretically possible to replace it with something else.

[remi]

Are you sure the logic lives in the BCM and not the ATC?

Anyway this is what DRBDBReader will give you as commands for the TCM (it should work on NGC too):
ENGINE RPM: J1850; xmit: 24-18-21-03-01-00; sc: Transmission; 0x80002972
TCC BREAK IN FEATURE: J1850; xmit: 24-18-21-24-01-00; sc: Transmission; 0x8000298b
OUTPUT RPM: J1850; xmit: 24-18-21-05-01-00; sc: Transmission; 0x8000298e
INPUT RPM: J1850; xmit: 24-18-21-04-01-00; sc: Transmission; 0x800029a9
TPS: J1850; xmit: 24-18-22-32-00-00; sc: Transmission; 0x800029ac
C4: J1850; xmit: 24-18-22-32-01-00; sc: Transmission; 0x800029ae
LR CL VOL INDEX: J1850; xmit: 24-18-21-0B-01-00; sc: Transmission; 0x800029b0
OD CL VOL INDEX: J1850; xmit: 24-18-21-0D-01-00; sc: Transmission; 0x800029b2
2-4 CL VOL INDEX: J1850; xmit: 24-18-21-0C-01-00; sc: Transmission; 0x800029b4
UD CL VOL INDEX: J1850; xmit: 24-18-21-0E-01-00; sc: Transmission; 0x800029b6
C3: J1850; xmit: 24-18-22-32-03-00; sc: Transmission; 0x800029b9
IGNITION FEED: J1850; xmit: 24-18-22-32-02-00; sc: Transmission; 0x800029bb
SWITCHED BATTERY: J1850; xmit: 24-18-22-32-04-00; sc: Transmission; 0x800029bd
MINIMUM TPS: J1850; xmit: 24-18-21-0A-01-00; sc: Transmission; 0x80002ad2
TRANS TEMP VOLTS: J1850; xmit: 24-18-21-29-01-00; sc: Transmission; 0x80002ad5
TRANS TEMP STATE: J1850; xmit: 24-18-21-0F-01-00; sc: Transmission; 0x80002ae4
LEVER: J1850; xmit: 37-00-FF; sc: Transmission; 0x80002b07
LEVER: J1850; xmit: 37-00-FF; sc: Transmission; 0x80002b08
AUTOSTICK LEVER: J1850; xmit: 37-00-FF; sc: Transmission; 0x80002b0b
AUTOSTICK LEVER: J1850; xmit: 37-00-FF; sc: Transmission; 0x80002b0c
Shift Lever: CCD; xmit: 00; sc: Transmission; 0x80002b0d
Clutch Test: CCD; xmit: 00; sc: Transmission; 0x80002b0e
TRD Link: CCD; xmit: 00; sc: Transmission; 0x80002b0f
Elec PRNODL: CCD; xmit: 00; sc: Transmission; 0x80002b10
LR PRESSURE SWITCH: J1850; xmit: 24-18-22-36-00-00; sc: Transmission; 0x80002b24
2-4 PRESSURE SWITCH: J1850; xmit: 24-18-22-36-00-00; sc: Transmission; 0x80002b27
OD PRESSURE SWITCH: J1850; xmit: 24-18-22-36-00-00; sc: Transmission; 0x80002b29
C1 (T41/NS1): J1850; xmit: 24-18-22-36-00-00; sc: Transmission; 0x80002b46
C2 (T42/NS2): J1850; xmit: 24-18-22-36-00-00; sc: Transmission; 0x80002b48
C3 (T3/RL1): J1850; xmit: 24-18-22-36-00-00; sc: Transmission; 0x80002b4a
C4 (T1/RL2): J1850; xmit: 24-18-22-36-00-00; sc: Transmission; 0x80002b4c
AUTOSTICK UP SW: J1850; xmit: 24-18-22-36-00-00; sc: Transmission; 0x80002b50
AUTOSTICK DN SW: J1850; xmit: 24-18-22-36-00-00; sc: Transmission; 0x80002b52
LAST SHIFT: J1850; xmit: 24-18-21-12-01-00; sc: Transmission; 0x80002b55
FAIL SAFE TIME: J1850; xmit: 24-18-21-1F-01-00; sc: Transmission; 0x80002b76
FAIL SAFE TIME 0: J1850; xmit: 24-18-21-1F-01-00; sc: Transmission; 0x80002b78
FAIL SAFE TIME 1: J1850; xmit: 24-18-21-1F-05-00; sc: Transmission; 0x80002b79
FAULT COUNT: J1850; xmit: 24-18-21-20-01-00; sc: Transmission; 0x80002b7b
WRITE MEMORY: J1850; xmit: 24-18-A1-00-00-00-00-00; sc: Transmission; 0x80002b7d
SLP: J1850; xmit: 24-18-22-36-00-00; sc: Transmission; 0x80002b84
SLP: J1850; xmit: 24-18-22-36-00-00; sc: Transmission; 0x80002b85
Reverse Gear Test: J1850; xmit: 24-18-31-14-00-00; sc: Transmission; 0x80002bcc
2 Prime Gear Test: J1850; xmit: 24-18-31-15-00-00; sc: Transmission; 0x80002bd0
1st Gear Test: J1850; xmit: 24-18-31-11-00-00; sc: Transmission; 0x80002bd1
2nd Gear Test: J1850; xmit: 24-18-31-12-00-00; sc: Transmission; 0x80002bd2
3rd Gear Test: J1850; xmit: 24-18-31-13-00-00; sc: Transmission; 0x80002bd3
READ SYS STAT FLAG: J1850; xmit: 24-18-21-19-05-00; sc: Transmission; 0x80002c00
EATX MODIFYABLE: J1850; xmit: 24-00-00-00-00-00-00; sc: Transmission; 0x80002c01
READ GENERAL REG FLAG A: J1850; xmit: 24-18-21-18-05-00; sc: Transmission; 0x80002c03
Trans Overhauled/Replaced: CCD; xmit: 00; sc: Transmission; 0x80002c3b
EATX TCM Has Been Changed: CCD; xmit: 00; sc: Transmission; 0x80002c3c
Pinion Factor: CCD; xmit: 00; sc: Transmission; 0x80002c3f
Memory Monitor: CCD; xmit: 00; sc: Transmission; 0x80002c42
Battery Disconnect: CCD; xmit: 00; sc: Transmission; 0x80002c43
Quicklearn: CCD; xmit: 00; sc: Transmission; 0x80002c44
EATX DTC Event Data: CCD; xmit: 00; sc: Transmission; 0x80002c46
BATTERY DISCONNECT: J1850; xmit: 24-18-11-01-03-00; sc: Transmission; 0x80002ca6
QUICK LEARN: J1850; xmit: 24-18-B4-1A-01-00; sc: Transmission; 0x80002cad
PINION FACTOR ADDRESS: J1850; xmit: 24-18-21-1D-05-00; sc: Transmission; 0x80002d08
GEAR: J1850; xmit: 24-18-21-11-01-00; sc: Transmission; 0x80002d0c
APPLYING: J1850; xmit: 24-18-21-08-01-00; sc: Transmission; 0x80002d0e
TCC P-EMCC: J1850; xmit: 24-18-21-08-01-00; sc: Transmission; 0x80002d10
TCC Unlock: J1850; xmit: 24-18-21-08-01-00; sc: Transmission; 0x80002d11
TCC Full Lock: J1850; xmit: 24-18-21-09-01-00; sc: Transmission; 0x80002d14
TCC TIME IN PEMCC: J1850; xmit: 24-18-21-37-01-00; sc: Transmission; 0x80002dce
TCC BREAK-IN PROCESS: J1850; xmit: 24-18-21-1B-01-00; sc: Transmission; 0x80002dd1
TCC BREAK-IN MILEAGE: J1850; xmit: 24-18-21-1C-01-00; sc: Transmission; 0x80002dd4
SNAP SHOT POINTER ADDRESS: J1850; xmit: 24-18-21-2D-05-00; sc: Transmission; 0x80002e07
READ J1850 MEMORY: J1850; xmit: 24-18-A4-00-00-00-00; sc: Transmission; 0x80002e09
Trigger DTC Hex: J1850; xmit: 01-00-00-74-00-00; sc: Transmission; 0x80002e55
Starts Since prev DTC: J1850; xmit: 01-00-00-74-00-00; sc: Transmission; 0x80002e56
TPS Deg: J1850; xmit: 01-00-00-74-00-00; sc: Transmission; 0x80002e57
TRS T1: J1850; xmit: 01-00-00-74-00-00; sc: Transmission; 0x80002e58
TRS T3: J1850; xmit: 00-00-00-74-00-00; sc: Transmission; 0x80002e59
TRS T42: J1850; xmit: 00-00-00-74-00-00; sc: Transmission; 0x80002e5a
TRS T41: J1850; xmit: 00-00-00-74-00-00; sc: Transmission; 0x80002e5b
TRS Code: J1850; xmit: 00-00-00-74-00-00; sc: Transmission; 0x80002e5d
SLP Schedule in Use: J1850; xmit: 01-00-00-74-00-00; sc: Transmission; 0x80002e5f
Engine RPM: J1850; xmit: 02-00-00-74-00-00; sc: Transmission; 0x80002e60
Input Speed: J1850; xmit: 02-00-00-74-00-00; sc: Transmission; 0x80002e61
Output RPM: J1850; xmit: 02-00-00-74-00-00; sc: Transmission; 0x80002e62
Engine Coolant Temp: J1850; xmit: 01-00-00-74-00-00; sc: Transmission; 0x80002e63
Trans Oil Temp: J1850; xmit: 01-00-00-74-00-00; sc: Transmission; 0x80002e64
L/R Pressure Switch: J1850; xmit: 01-00-00-74-00-00; sc: Transmission; 0x80002e65
2/4 Pressure Switch: J1850; xmit: 00-00-00-74-00-00; sc: Transmission; 0x80002e66
OD Pressure Switch: J1850; xmit: 00-00-00-74-00-00; sc: Transmission; 0x80002e67
Present Gear: J1850; xmit: 01-00-00-74-00-00; sc: Transmission; 0x80002e81
Target Gear: J1850; xmit: 01-00-00-74-00-00; sc: Transmission; 0x80002e82
Output Tooth CNT: J1850; xmit: 02-00-00-74-00-00; sc: Transmission; 0x80002e83
Sec. Since Shifted: J1850; xmit: 02-00-00-74-00-00; sc: Transmission; 0x80002e84
TPS Open/Short: J1850; xmit: 01-00-00-71-00-00; sc: Transmission; 0x80002e85
TPS Intermittent: J1850; xmit: 01-00-00-61-00-00; sc: Transmission; 0x80002e86
Speed Ratio: J1850; xmit: 01-00-00-71-00-00; sc: Transmission; 0x80002e87
Pressure Switch: J1850; xmit: 01-00-00-71-00-00; sc: Transmission; 0x80002e89
Cruise Control: J1850; xmit: 01-00-00-74-00-00; sc: Transmission; 0x80002e8a
SSV Stuck in LR: J1850; xmit: 00-00-00-72-00-00; sc: Transmission; 0x80002e8c
TRS Data Err Matured: J1850; xmit: 00-00-00-72-00-00; sc: Transmission; 0x80002e8d
BRAKE: J1850; xmit: 00-00-00-74-00-00; sc: Transmission; 0x80002e8e
SSV Stuck in TCC: J1850; xmit: 00-00-00-72-00-00; sc: Transmission; 0x80002e90
Autostick: J1850; xmit: 00-00-00-74-00-00; sc: Transmission; 0x80002e91
Therm. Invalid: J1850; xmit: 00-00-00-72-00-00; sc: Transmission; 0x80002e92
Ratio Limp-In: J1850; xmit: 00-00-00-72-00-00; sc: Transmission; 0x80002e93
LR Pressure Switch: J1850; xmit: 01-00-00-71-00-00; sc: Transmission; 0x80002e94
2/4 Pressure Sw FC: J1850; xmit: 01-00-00-71-00-00; sc: Transmission; 0x80002e95
OD Pressure Switch: J1850; xmit: 01-00-00-71-00-00; sc: Transmission; 0x80002e96
2/4 Errs in 1/3: J1850; xmit: 01-00-00-71-00-00; sc: Transmission; 0x80002e98
T2/4 Pr Errs in R/N: J1850; xmit: 01-00-00-71-00-00; sc: Transmission; 0x80002e9b
2/4 Pr Failed On in 1/3: J1850; xmit: 00-00-00-72-00-00; sc: Transmission; 0x80002e9d
TRS Invalid: J1850; xmit: 00-00-00-72-00-00; sc: Transmission; 0x80002e9f
TRS Code Error: J1850; xmit: 00-00-00-72-00-00; sc: Transmission; 0x80002ea0
A/S Up Input: J1850; xmit: 00-00-00-74-00-00; sc: Transmission; 0x80002ea1
A/S Dn Input: J1850; xmit: 00-00-00-74-00-00; sc: Transmission; 0x80002ea2
Lst Valid TRS T1: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002ea3
Lst Valid TRS T3: J1850; xmit: 00-00-00-24-00-00; sc: Transmission; 0x80002ea4
Lst Valid TRS T42: J1850; xmit: 00-00-00-24-00-00; sc: Transmission; 0x80002ea5
Lst Valid TRS T41: J1850; xmit: 00-00-00-24-00-00; sc: Transmission; 0x80002ea6
Lst Valid TRS Code: J1850; xmit: 00-00-00-24-00-00; sc: Transmission; 0x80002ea7
TRS T1 7ms Ago: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002ea8
TRS T3 7ms Ago: J1850; xmit: 00-00-00-24-00-00; sc: Transmission; 0x80002ea9
TRS T42 7ms Ago: J1850; xmit: 00-00-00-24-00-00; sc: Transmission; 0x80002eaa
TRS T41 7ms Ago: J1850; xmit: 00-00-00-24-00-00; sc: Transmission; 0x80002eab
TRS Code 7ms Ago: J1850; xmit: 00-00-00-24-00-00; sc: Transmission; 0x80002eac
SLP Sch. 14 ms ago: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002ead
Ambient Temp: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002eae
Clutch Applying LR/CC: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002eaf
Clutch Applying 2/4: J1850; xmit: 00-00-00-24-00-00; sc: Transmission; 0x80002eb0
Clutch Applying OD: J1850; xmit: 00-00-00-24-00-00; sc: Transmission; 0x80002eb1
Clutch Applying UD: J1850; xmit: 00-00-00-24-00-00; sc: Transmission; 0x80002eb2
Last Shift From/To: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002eb3
UD CVI: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002eb4
OD CVI: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002eb5
24 CVI: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002eb6
LR CVI: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002eb7
Sec. Since Start: J1850; xmit: 02-00-00-24-00-00; sc: Transmission; 0x80002eb8
Switched Batt: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002eb9
Thermistor Volts: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002eba
Tps Volts: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002ebb
A/S Mux Volts: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80002ebc
Loss of Fluid Prime: J1850; xmit: 00-00-00-72-00-00; sc: Transmission; 0x80002ec1
Num. Ratio Limp-Ins: J1850; xmit: 01-00-00-71-00-00; sc: Transmission; 0x80002ec6
2-4 SOLENOID: J1850; xmit: 24-18-30-71-8A-00; sc: Transmission; 0x800034c0
LR SOLENOID: J1850; xmit: 24-18-30-70-8A-00; sc: Transmission; 0x800034c6
OD SOLENOID: J1850; xmit: 24-18-30-73-8A-00; sc: Transmission; 0x800034cd
UD SOLENOID: J1850; xmit: 24-18-30-72-8A-00; sc: Transmission; 0x800034d4
TRANS TEMP DEG: J1850; xmit: 24-18-21-10-01-00; sc: Transmission; 0x80003a16
P_TCM_NOC_EATX_MODIFYABLE__23: J1850; xmit: 24-FD-FD-FD-FD-FD-FD; sc: Transmission; 0x80004930
P_TCM_NOC_EATX_PART_FULL_L: J1850; xmit: 24-18-21-09-01-00; sc: Transmission; 0x80004932
P_TCM_NOC_EATX_TFLT: J1850; xmit: 24-18-21-30-01-00; sc: Transmission; 0x80004934
P_TCM_NOC_END_ACTUATOR_J18: J1850; xmit: 24-FD-FD-FD-FD-FD; sc: Transmission; 0x8000493b
Enough Good Trip Time Neut: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x8000493d
Enough Good Trip Time Rev: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x8000493f
Enough Good Trip Time 1st: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80004941
Enough Good Trip Time 2nd: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80004943
Enough Good Trip Time 3rd: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80004945
Enough Good Trip Time 4th: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80004947
Good Trip This Drive Cycle: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80004a3c
P_TCM_NOC_IN_GEAR_ADDR_98L_7C: J1850; xmit: 24-18-21-11-05-00; sc: Transmission; 0x80004a3d
P_TCM_NOC_LIMP_POINTER_J18: J1850; xmit: 24-18-21-2D-05-00; sc: Transmission; 0x80004a7e
L_TCM_NOC_LIMPINSTATUS: J1850; xmit: 24-18-21-06-01-00; sc: Transmission; 0x80004a81
Requested MIL State: J1850; xmit: 24-18-21-2E-01-00; sc: Transmission; 0x80004aaf
P_TCM_NOC_STOP_TEST_98LH_J_7A: J1850; xmit: 24-18-32-10-00-00; sc: Transmission; 0x80004ac3
Global Good Trip Counter: J1850; xmit: 24-18-21-27-01-00; sc: Transmission; 0x80004ba4
VEHICLE SPEED: J1850; xmit: 10-00-FF; sc: Transmission; 0x80004c1c
Warm-up Cycle Counter: J1850; xmit: 24-18-21-26-01-00; sc: Transmission; 0x80004c1e
WithSpeed Abov 10 MPH: J1850; xmit: 24-18-21-31-01-00; sc: Transmission; 0x80004c20
T2/4 Pr Err in R/N: J1850; xmit: 01-00-00-72-00-00; sc: Transmission; 0x80004f9c
CLEAR J1850 FAULT CODES: J1850; xmit: 24-18-14-FF-00-00; sc: Transmission; 0x800053cc
OD OVERRIDE: J1850; xmit: 24-18-22-36-00-00; sc: Transmission; 0x800053f5
Enough Time From Start: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x800058cc
Torque Management OK: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x800058d0
EMCC OK: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x800058d3
AUTOSTICK MUX: J1850; xmit: 24-18-22-32-05-00; sc: Transmission; 0x800058d6
ACT TEST STATUS: J1850; xmit: 24-18-33-00-00-00; sc: Transmission; 0x80005940
FAULT CODE 0 (J1850): J1850; xmit: 24-18-22-2E-00-00; sc: Transmission; 0x80005e92
FAULT CODE 1 (J1850): J1850; xmit: 24-18-22-2E-01-00; sc: Transmission; 0x80006008
FAULT CODE 2 (J1850): J1850; xmit: 24-18-22-2E-02-00; sc: Transmission; 0x80006009
FAULT CODE 3 (J1850): J1850; xmit: 24-18-22-2E-03-00; sc: Transmission; 0x8000600a
FAULT CODE 4 (J1850): J1850; xmit: 24-18-22-2E-04-00; sc: Transmission; 0x8000600b
FAULT CODE 5 (J1850): J1850; xmit: 24-18-22-2E-05-00; sc: Transmission; 0x8000600c
FAULT CODE 6 (J1850): J1850; xmit: 24-18-22-2E-06-00; sc: Transmission; 0x8000600d
FAULT CODE 0 (J1850): J1850; xmit: 24-18-22-2E-00-00; sc: Transmission; 0x800061a7
FAULT CODE 1 (J1850): J1850; xmit: 24-18-22-2E-01-00; sc: Transmission; 0x800061a8
FAULT CODE 2 (J1850): J1850; xmit: 24-18-22-2E-02-00; sc: Transmission; 0x800061a9
FAULT CODE 3 (J1850): J1850; xmit: 24-18-22-2E-03-00; sc: Transmission; 0x800061aa
FAULT CODE 4 (J1850): J1850; xmit: 24-18-22-2E-04-00; sc: Transmission; 0x800061ab
FAULT CODE 5 (J1850): J1850; xmit: 24-18-22-2E-05-00; sc: Transmission; 0x800061ac
FAULT CODE 6 (J1850): J1850; xmit: 24-18-22-2E-06-00; sc: Transmission; 0x800061ad
FAULT CODE 0 (J1850): J1850; xmit: 24-18-22-2E-00-00; sc: Transmission; 0x80006c77
FAULT CODE 1 (J1850): J1850; xmit: 24-18-22-2E-01-00; sc: Transmission; 0x80006c78
FAULT CODE 2 (J1850): J1850; xmit: 24-18-22-2E-02-00; sc: Transmission; 0x80006c79
FAULT CODE 3 (J1850): J1850; xmit: 24-18-22-2E-03-00; sc: Transmission; 0x80006c7a
FAULT CODE 4 (J1850): J1850; xmit: 24-18-22-2E-04-00; sc: Transmission; 0x80006c7b
FAULT CODE 5 (J1850): J1850; xmit: 24-18-22-2E-05-00; sc: Transmission; 0x80006c7c
FAULT CODE 6 (J1850): J1850; xmit: 24-18-22-2E-06-00; sc: Transmission; 0x80006c7d
TPS DEGREES: J1850; xmit: 24-18-21-07-01-00; sc: Transmission; 0x80006c8f
CURRENT PINION FACTOR: J1850; xmit: 24-18-21-1D-01-00; sc: Transmission; 0x80007370
FAULT CODE 0 (J1850): J1850; xmit: 24-18-22-2E-00-00; sc: Transmission; 0x8000744d
FAULT CODE 1 (J1850): J1850; xmit: 24-18-22-2E-01-00; sc: Transmission; 0x8000744e
FAULT CODE 2 (J1850): J1850; xmit: 24-18-22-2E-02-00; sc: Transmission; 0x8000744f
FAULT CODE 3 (J1850): J1850; xmit: 24-18-22-2E-03-00; sc: Transmission; 0x80007450
FAULT CODE 4 (J1850): J1850; xmit: 24-18-22-2E-04-00; sc: Transmission; 0x80007451
FAULT CODE 5 (J1850): J1850; xmit: 24-18-22-2E-05-00; sc: Transmission; 0x80007452
FAULT CODE 6 (J1850): J1850; xmit: 24-18-22-2E-06-00; sc: Transmission; 0x80007453
FAULT CODE 7 (J1850): J1850; xmit: 24-18-22-2E-07-00; sc: Transmission; 0x8000745c
EMCC OK: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80007bc7
Enough Good Trip Time 1st: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80007bc8
Enough Good Trip Time 2nd: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80007bc9
Enough Good Trip Time 3rd: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80007bca
Enough Good Trip Time 4th: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80007bcb
Enough Good Trip Time Neut: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80007bcc
Enough Time From Start: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80007bcd
Good Trip This Drive Cycle: J1850; xmit: 24-18-21-28-01-00; sc: Transmission; 0x80007bce
P_TCM_FXD_RESET_CNT_J1850_89: J1850; xmit: 24-18-22-2E-07-00; sc: Transmission; 0x80007bd3
P_TCM_FXD_RESET_CNT_J1850_89: J1850; xmit: 24-18-22-2E-08-00; sc: Transmission; 0x80007bd4
Act. Line Pressure: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80007f43
Des. Line Pressure: J1850; xmit: 01-00-00-24-00-00; sc: Transmission; 0x80007f44
VFS Duty Cycle: J1850; xmit: 02-00-00-24-00-00; sc: Transmission; 0x80007f45

And this is a log file from the DRB Emulator asking for the TCM part number on my car (04606517AE) :
14:05:39 Tx (1420) 00 14 05 8c 03 01 00 00 00 00 00 00 00 00 24 18 21 01 01 00
14:05:39 Rx (193) 00 1a 00 c1 28 01 00 01 00 f6 c6 a4 00 1e 1b 85 00 06 00 00 26 18 61 04 60 65
14:05:39 MESSAGE DATA ch=1 user_data=0xf6c6a4 length=6 flags=0x00 timestamp=1973125
14:05:39 RX: 26186104606502
14:05:39 S: 0000-Ok
14:05:39 TX: 241821020100
14:05:39 TRANSMIT ch=1 user_data=0x000000 flags=0x00 retry=0 data_len=6
14:05:39 Tx (1421) 00 14 05 8d 03 01 00 00 00 00 00 00 00 00 24 18 21 02 01 00
14:05:39 Rx (193) 00 1a 00 c1 28 01 00 01 00 f6 c6 a4 00 1e 20 9a 00 06 00 00 26 18 61 65 17 41
14:05:39 MESSAGE DATA ch=1 user_data=0xf6c6a4 length=6 flags=0x00 timestamp=1974426
14:05:39 RX: 26186165174102
14:05:39 S: 0000-Ok
14:05:39 TX: 2418212F0100
14:05:40 TRANSMIT ch=1 user_data=0x000000 flags=0x00 retry=0 data_len=6
14:05:40 Tx (1422) 00 14 05 8e 03 01 00 00 00 00 00 00 00 00 24 18 21 2f 01 00
14:05:40 Rx (193) 00 1a 00 c1 28 01 00 01 00 f6 c6 a4 00 1e 25 ae 00 06 00 00 26 18 61 41 45 a0
14:05:40 MESSAGE DATA ch=1 user_data=0xf6c6a4 length=6 flags=0x00 timestamp=1975726
14:05:40 RX: 2618614145A002
14:05:40 S: 0000-Ok


And as a final note I selected a few commands and ran the "dumpconverter" instruction on DRBDBReader providing the command ID, and this is what it looks like.
TRANS TEMP STATE: J1850; xmit: 24-18-21-0F-01-00; sc: Transmission; 0x80002ae4
> dumpconverter 0x80002ae4
TYPE: STATE
REC: 20-20-06-64-08-04
DSREC: 06-64-00-00-02-02-53-0A

DFLT: UNDEFINED
0x01: COLD TRANS
0x02: WARM TRANS
0x04: HOT TRANS
0x08: SUPER COLD TRANS
0x10: EXTR COLD TRANS
GEAR: J1850; xmit: 24-18-21-11-01-00; sc: Transmission; 0x80002d0c
> dumpconverter 0x80002d0c
TYPE: STATE
REC: 20-20-1F-9E-01-CD
DSREC: 1F-9E-00-00-02-02-53-0A

DFLT: UNDEFINED
0x01: NEUTRAL
0x02: REVERSE
0x04: 1st GEAR
0x08: 2nd GEAR
0x10: 3rd GEAR
0x20: 4th GEAR
TCC P-EMCC: J1850; xmit: 24-18-21-08-01-00; sc: Transmission; 0x80002d10
> dumpconverter 0x80002d10
TYPE: BINARY_STATE
REC: 00-00-01-B9-01-01
DSREC: 01-B9-00-00-00-1D-00-00-00-1E

FALSE: NO
TRUE: YES

MASK: 0x40
OP: MASK_NOT_ZERO
TCC Unlock: J1850; xmit: 24-18-21-08-01-00; sc: Transmission; 0x80002d11
> dumpconverter 0x80002d11
TYPE: BINARY_STATE
REC: 00-00-01-B9-01-00
DSREC: 01-B9-00-00-00-1D-00-00-00-1E

FALSE: NO
TRUE: YES

MASK: 0x80
OP: MASK_NOT_ZERO
TCC Full Lock: J1850; xmit: 24-18-21-09-01-00; sc: Transmission; 0x80002d14
> dumpconverter 0x80002d14
TYPE: BINARY_STATE
REC: 00-00-01-B9-00-9A
DSREC: 01-B9-00-00-00-1D-00-00-00-1E

FALSE: NO
TRUE: YES

MASK: 0x04
OP: MASK_NOT_ZERO

[00R/T]

@remi, I’m not sure that the logic lives in the BCM. In fact, the more I dig in, the more I think it’s in the ATC head. That means that if I want to figure out that the ATC head is showing, I might need to do it indirectly.

I wonder what the odds are that the VFD uses the same driver as the cluster.