PCB version (reads next to OBD2 connector): POD2103 REV2
Symptom: no communication over J1850 VPW bus (PCI-bus), affecting engine diagnostics, etc.
Explanation: PCB design/manufacturing error, certain chip is powered off due to its ground pin floating.
Verify: copper plane near the chip marked "27TI MAP" or "55TI MAP" not touching its ground pin.
Proposed fix: extend chip’s ground pin next to the large ceramic capacitor’s ground side using a piece of insulated wire. I recommend 0.4 mm diameter winding wire (copper).
The old v1 design went through a series of upgrades and it became more powerful than ever.
Chrysler Scanner v2.1.0
The main ATmega2560 microcontroller has been replaced with ESP32-PICO-D4.
Its wireless capabilities are not developed yet.
Official LCD support has been withdrawn from the latest firmware but I2C-pins are still broken out to a 6-pin connector for future use. I2C logic voltage is 3.3V.
The UART protocol provided by ESP32 has a built-in logic inverter feature. This means that the SCI-bus of SBEC2 PCMs can be supported with a simple adapter cable.
PCI-bus transceiver has been added to support diagnostics with PCI/SCI-bus equipped PCMs.
With the v2 hardware it’s now possible to reprogram SBEC3 PCM flash memory via SCI-bus.
SBEC3 PCM reprogramming
Note that this scanner does not comply with J2534 standards, so it’s not a passthru device. The demo video above shows the simplicity of writing a new flash file to an SBEC3 PCM. This comes with the disadvantage that the flash file compatibility is not checked. Therefore the user needs to decide whether the selected flash file is compatible with their PCM or not. As a precaution the GUI makes backups of the current flash memory / EEPROM content in case they need to be restored.
Tuners are going to enjoy this feature the most because they can upload their modified flash files easily without hassle.
The prerequisite of re-programming an SBEC3 PCM is to be able to put the PCM in bootstrap mode. This is fairly simple. All you need to do is to jump battery voltage to the SCI-RX pin while key is off, turn key on and remove jumper wire.
GitHub repository for bootstrap and bootloader source files and more technical information: SBEC3Library
Before attempting to follow the examples below make sure that the scanner firmware and GUI versions are up to date.
Chrysler engineers were on a roll when they left all kinds of backdoors in the PCM firmware. In this post I walk you through this simple yet powerful method to change RAM values in SBEC3 engine controller units.
Keep in mind that other running subroutines constantly update RAM values and overwrite bogus data rather quickly. Nevertheless the opportunity is given.
Warning: changing RAM values that are important for ignition calculation can and will adversely influence engine performance. In the worst case it could damage the engine!
In this post we take a step back from the PCM re-flashing and concentrate on the small EEPROM area only. This is where the part number and VIN are stored, among other important settings.
By default the ROM and EEPROM are read only with the 26 and 28 commands, respectively, via SCI-bus low-speed mode (7812.5 baud). The 27 command is less known but it is used for writing EEPROM values. Without proper security clearance these writing attempts are blocked by the PCM. Unless we tell the PCM that it can trust us to know what we are doing.
There is a way to gain writing access to the EEPROM by solving a random security seed challenge generated by the PCM.
And above all, before/after solving the challenge there is no need to apply 20V programming voltage to the SCI_RX pin! Any kind of regular SCI-bus transceiver will work just fine, like the one in the Chrysler CCD/SCI Scanner.
I present you the disassembled and reverse engineered parts of the PCM firmware to understand the inner workings and a VIN write example at the end of the post.
In this post I will discuss the re-flashing procedure of SBEC3 PCMs on the lowest communication level (SCI-bus) and present disassembled source code of the various functions used during the process.
The following codes and descriptions come from a detailed log file created automatically during an actual re-flashing procedure, sent to me by one of my customers.
I will update this post while making progress with the reverse engineering.
After sending the communication speed change command (12) the table header doesn’t update immediately and new messages are displayed only when a second message is sent. It’s like the table is always one step behind.
I can’t imagine when it went wrong. Update coming soon.
It turns out the table refresh rate workaround is the main cause of this issue. Doesn’t matter anymore, the GUI is being revised. No more workarounds. Diagnostics tables no longer flicker, update rate can be arbitrarily high (within reasonable limits) and scrolling through the lines is seamless even at high refreshing rate.
The user interface is more user friendly than ever:
Many vehicle-independent engine parameters have been added to the SCI-bus (PCM) section. Selecting the right parameters is still bumpy, the message list has to be manually filled with request messages to be sent (even repeatedly). Vehicle profiling should be a next step in the future.
Basic LCD operation is implemented with selectable bus-source (CCD and PCM). 20×4 and 16×2 character LCDs are supported. Vehicle speed, engine speed, map value, coolant temperature, battery and charging voltages and odometer value is displayed, depending on the LCD size.
Documentation is long overdue. I’m working on a general user’s guide and a more technical UART frame description that explains how a third party software can talk to the scanner and thus to the vehicle.
Chrysler Scanner 