• NAXJA is having its 18th annual March Membership Drive!!!
    Everyone who joins or renews during March will be entered into a drawing!
    More Information - Join/Renew
  • Welcome to the new NAXJA Forum! If your password does not work, please use "Forgot your password?" link on the log-in page. Please feel free to reach out to [email protected] if we can provide any assistance.

'96 up Auto trans gear control: Montana Fab

tbburg

NAXJA Forum User
Location
Scottsdale AZ
Montana Auto & Fabrication - AW-4 Transmission Override.
http://www.montanafab.com/aw4_trany_overide.php
aw4_override.jpg

This is exactly how it comes, all parts included.

First, how it performs: Exactly as it says. 1-2 shift control without engine codes. It does almost the same thing as a manual override switch installed in the early models. There is a difference. This controller doesn't shut down the TCU like the manual switches we normally use. The switch pulls power from the TCU harness, but doesn't shut power off to the computer when it's engaged. It also won't override the transmission in Drive or 3rd gear. I tried it in 3rd from about 40 - no reaction.(I didn't check to see if the trans would shift normally, I just wanted to see if there was going to be a safety issue if it was accidentally engaged on the highway

At $150.00, it's a little on the pricy side, so the obvious question: Is it worth the price? This is kind of like having a Lawyer write a letter for you. He'll charge you 500 bucks to write the letter, and the price breakdown is something like: write letter: $5.00. Knowing what to put in letter: $495.00. These guys pulled down a late model Cherokee and figured out what signals needed to be mimicked, or whatever it does, and put together a unit that does it. So there's probably 30-50 bucks of hardware in the controller, and I paid 100 - 120 bucks for their time in figuring out how to do it.

My installation is on a '00 XJ sport.

Some of this was already posted in another thread:
http://www.naxja.org/forum/showthread.php?t=1007683&highlight=Montana+fab
I included all of the info here for people who didn't see the first thread.

When I talked to them on the phone, they said they keep them in stock,(that's a good sign!)and ship out same day. Purchased on Thursday, sitting in the office on Monday('had 'em ship it to where I work) It came in a priority mail box(USPS) with a $4.95 stamp on it. They charged me 5 bucks for S+H, so that seems pretty fair.

First impressions out of the box: Very good documentation, 4 pages of instructions including early and late model hookup, as well as for the '93 ZJ Grand Cherokee, which also had the AW-4. Another page containing diagrams and charts for pin-out on the early and late computer connector plugs. Also paper templates for drilling/installation.

The harness/controller is high quality construction, and looks a little more complex then the average 1-2 switch. As I understand it, a wired switch is usually 6 wires(3in, 3 out) on a DP/DT switch. This rotary switch appears to be a Quad pole/Triple Throw. It also has 10 wires coming out of the base of the board. It's also lighted and dim-able with the dash lights(might explain a few of those wires)
I was a little surprised when I tore into the Jeep. I've read that the ECU in the OBD-2 systems controls the transmission, however, there was a separate TCU mounted just above and to the side of the Gas pedal. Just as well, I wasn't thrilled about hacking into the engine control harness.

Tools I used:
wire cutters
wire strippers
crimping pliers
Philips screw driver
3/8" driver bit(radio removal)
Drill
1/16" drill bit
#4 Irwin Unibit
Multi-tester(to track down dash light circuit)
Sand paper
Sharpie ink marker.
Razor knife
Pop rivet puller


Install: I followed the instructions almost to the letter, except for one cosmetic item, and everything went smoothly. I only came across 2 minor problems, which I'll discuss in the text.

I shouldn't have to say it, but disconnect the battery before you start.

Noob tec:
If you've never pulled the dash apart on a late-model.
Order of disassembly:
Radio/heat control bezel: Put the truck in neutral, gently pull/pry the bottom ends of the bezel out(snaps in place) then work your way up to sides. One snap lock at each corner.
Lower dash cover: Under column, three screws across bottom. Top edge snaps out.
Steel plate(under cover): 2 screws at the top on either side of the column, the bottom has 2 tabs that fit slots in the bottom of the dash.
Light switch knob. There is a small button on the right side of the otherwise smooth switch body. Hold the button down and pull on the knob(might have to twist a little also) until you feel the button move under your finger. Release the button, and the knob will slide the rest of the way out.
Dash surround: Four screws around the radio/upper AC ducts. Here's a pic
Dash1-1.png

The instrument cluster surround snaps out. There is a glove/boot around the column, attached to the dash. This separates at the bottom and comes off with the dash surround. Put the column in it's lowest position, hold it down and pull the column adjust lever toward the steering wheel. This will give enough clearance to pull the dash surround up and away from the dash.
Radio removal(after the trim bezel is off): 2 hex screws (3/8")and it slides out. (Radio comes out later.)

Uni-bits come in handy for drilling the holes. If you've never used one, they have a straight flute(no spiral)and don't grab and pull through when drilling like a conventional bit. This works great in plastic and thin aluminum sheet. They also self de-bur the hole as you finish drilling. The next step chamfers the hole nicely Conveniently, the #4 Irwin uni-bit goes clear up to 7/8", and covers all the drilling needed. If you don't already have them, save yourself some money and buy the multipack(3 bits) You'll find a lot of uses for these.

Back to work:
Couple pics of the controller:
IMG_0624.jpg
IMG_0619.jpg

To the people who wanted high res photos of the board: As you can see there's white goop on both sides of the board, and on closer inspection, it appears there are components under there. It seems to be for insulation.

I decided to mount the controller on the dash very close to the location shown in the pics on their web site. I moved mine lower because I intend to have a GPS mounted above that area later on. I put it about 1/16" above the bottom edge of the of the panel next to the instrument cluster.
Here's their mount:
tranny_in_dash.jpg

Here's mine:
IMG_0658.jpg


First problem: while preparing to drill the dash, I noticed the supplied template was a little off. Might be a printing or scaling error. It would probably have worked anyway, but I market the holes using the switch mounting plate with a sharpie. Center drilled all the holes 1/16", checked against the faceplate, then drilled everything out with a Unibit.
My newly butchered dash:
Dashdrilled.jpg

Because of the location of the resistors,(mount on the metal plate under the dash cover) I just set them on the panel and marked the holes rather then use the supplied template. 'Center drilled all the holes with a 1/16' bit, checked against the mount plate, then drilled to size with a 1/8th.
'Used 320 grit sandpaper to clean the resistor mounting surface, then used the supplied pop rivets to secure the resistors to the plate.
IMG_0643.jpg

A small container of thermal compound is supplied with the kit, and the backs of the resistors get covered with a thin coat before final install. Careful with the thermal compound. It appears to have some of the same mess inducing characteristics as anti-seize, and the small amount contained in the kit may be enough to paint your whole car.

I spliced in the control harness following the instructions included. Very complete instructions. You have to be a bit of a contortionist to do this part. There's only a couple inches of slack on the late model harness, so you have to splice it all in under the dash. Unfortunately, this also makes it impossible to get really good pics.
Here's the TCU and harness:
TCUunderdash-1.png

Four cut wires on the TCU harness. and a total of 6 splices are made
pin 12(white wire) solenoid I control. It's cut and routed to the controller, and a wire back from the controller is spliced into the harness
pin 13(orange/white)solenoid 2 control. Same as above, cut and routed to the controller, and a wire back from the controller is spliced into the harness
pin 24(black/tan) Ground wire.
pin 26(blue/white). Ignition switch output (power to the computer, I assume)
There are 2 blue/white wires on the connector, and it's well covered in the instructions which one to use.
That's the first and second wires from the bottom of the plug on the outside of the connector, and the first and 3rd from the bottom on the inside. The second wire on the inside is pink. Don't cut the pink wire.
Here's the finished work:
IMG_0647.jpg

Interestingly, there is no connection to the speed sensors.(pins 1,2,3,&4 on the plug)
There are 3 wires in the controller harness that route to the resistors, and this is where I ran into the second problem. There are female spade connectors already crimped onto the resistors. Male spade terminals are included in the kit. You're supposed to cut the harness to length, then crimp and plug in the wires. Two of the three spade terminals wouldn't connect. They don't appear to be crushed, and I'm not sure what the problem was, but they wouldn't seat more then 1/8th inch. I had a box of connectors in the garage, so I just replaced them. I haven't talked to Montana Fab about this yet, and I'm not worried or upset, but I will let them know about the problem in case they got a box of faulty connectors.
 
The only really "hard' part where I had to think was finding a wire on the dash lighting circuit. This is the only place the instructions let me down(not really). They recommended using a feed from the radio circuit, but couldn't give the wire color. I guess it changes from year to year. They said it was probably yellow. Anyway, I removed the transfer case shifter cover and looked at the lighting wire to it.
IMG_0654.jpg

It was orange. :rof:
(Here's where you pull the radio out)Then I went to the back of the radio, and found an orange wire. I confirmed this was the face lighting circuit by reconnecting the battery, turning the parking lights on, then checking the voltage at that pin on the connector as I dimmed the lights. So for a '00, the dash light circuit is orange. On the radio, it's the 3rd pin down on the grey connector. Here's a pic of the finished splice on the plug:
IMG_0652.jpg


My cosmetic change: I'm using small countersunk oval head screws to mount the switch plate instead of the supplied pop rivets. The 2 screws in the pic are temporary. I don't like the stainless finish, and I'm going to paint the faceplate grey to match the dash.
IMG_0657.jpg

From the driver's seat, it's hidden by the steering wheel:
Driversseat.jpg

This pic didn't come out(best I could manage) The green light just right of center is the controller with the dash lights on. As you can see, it's brighter then the dash lights, although at the lower end of the scale on the dimmer, it's about the same. It doesn't show in this pic, but it's also morre of a green/yellow instead of green/blue like the dash lights. I',going to try putting a piece of green plastic under the face-plate to make it match better.
IMG_0661.jpg

'Few more pictures here:
http://s544.photobucket.com/albums/hh338/tbburg/Montana Fab/
 
nicely done, be sure to check back in now and then to leave some feedback on your usage.

road driving, trails, where ever you use it, would be handy to know what your overall thoughts are.
 
Considering that up until now, my thoughts have mainly been, "SECOND GEAR, you piece of S***! Second! It's not hard. It's been possible for decades! %#&#*%:gonnablow#$ #$%@ engineers and their @^*#$#(%$% better ideas!":explosion
My future thoughts are bound to be better.

We'll see,....
 
Good write up. Now some feedback on how well it works would seal the deal for me. Definitely the 1-2 split was an major oversite by Jeep.
 
I'm curious to see if this triggers a check-engine light. If it doesn't that implies that the trans computer is simply looking at the solenoid current draw to decide if its bad. If that's the case, a DYI version of this is very easily to replicate.

Up to now, I had been thinking that it looked at the input/output rpms to decide if it was in the wrong gear or not locking up (which made sense as those codes started at the same time they added a front input speed sensor).
 
Minor update: Talked to the guys at Montana Fab this morning. They think the template mis-match might have been caused when they changed the print file to a PDF, which may have thrown in a scaling error. They're looking into it. As for the spade connectors, everybody's shaking their heads about that one. I'm apparently the first person who had this problem, or at least the first one to report back about it. Funny thing is, I have the stupid things in front of me, and can't determine what's wrong with them. Anyway, they said they were going to check their stock.
I'm curious to see if this triggers a check-engine light. If it doesn't that implies that the trans computer is simply looking at the solenoid current draw to decide if its bad. If that's the case, a DYI version of this is very easily to replicate.
Sorry, maybe I was unclear on the point.
First, how it performs: Exactly as it says. 1-2 shift control without engine codes. It does almost the same thing as a manual override switch installed in the early models. There is a difference. This controller doesn't shut down the TCU like the manual switches we normally use. The switch pulls power from the TCU harness, but doesn't shut power off to the computer when it's engaged. It also won't override the transmission in Drive or 3rd gear. I tried it in 3rd from about 40 - no reaction.(I didn't check to see if the trans would shift normally, I just wanted to see if there was going to be a safety issue if it was accidentally engaged on the highway
This paragraph wasn't a description of how it's supposed to work. That's what I experienced when I test-drove the Jeep after my install. I put that up at the top so anyone interested in how it worked would know the result before reading 2 pages of my drivel. I've been tooling around for a couple days now, playing with it. No codes, no check engine light. Works great. Sorry about the confusion.
Up to now, I had been thinking that it looked at the input/output rpms to decide if it was in the wrong gear or not locking up (which made sense as those codes started at the same time they added a front input speed sensor).
That's what I thought too. I think that's what everybody thought. I think the trick is to smoothly transition from the trans load to the dummy load. It might just be a timing thing, but there appears to be a little more to it then then just resistors. There are a couple of small chips on the board other then diodes. Not sure what they do.
 
Okay, so if I understand correctly, if I am in 3rd or 4th gear selections, moving the switch does not do anything, tranny just works like it normally would, correct?

Now if I was to leave the switch on the #2 selection with the gear shift in D or OD and then move the shifter into the 1/2 spot, it would go into 2nd gear and stay there until I either move the switch to #1 (first gear) OR back up into D which would allow it to upshift to 3rd gear, correct?

Basically I am trying to find out if I can shift between D and 2nd gears, without worrying that it will downshift into 1st. I normally don't need to use first once moving and would be nice to stay in 2nd and be able to go between 2nd and 3rd gear on the fly, only having to move the shifter from D to 2/1 and back to D.

Hope that was clear enough to figure out. Thanks!
 
Correction: Aparently the other night while I was testing the controller on the street, I didn't have it going fast enough to shift up into 3rd, so the controller wasn't forcing a gear change from the "3rd" position on the shifter. In response to XJ Mike's question I took it out today and played with it. The override works in any gear selector position.

Okay, so if I understand correctly, if I am in 3rd or 4th gear selections, moving the switch does not do anything, tranny just works like it normally would, correct?
That's what I thought, but I was wrong. My mistake, sorry,..
Now if I was to leave the switch on the #2 selection with the gear shift in D or OD and then move the shifter into the 1/2 spot, it would go into 2nd gear and stay there until I either move the switch to #1 (first gear) OR back up into D which would allow it to upshift to 3rd gear, correct?
What I have to do for this is put the shifter in "3rd", then use the controller to shift from "D" to "2" and back. It works fine in this mode. It'll also do it from 4th, but doing a 4-2 shift is a little harsh.
Basically I am trying to find out if I can shift between D and 2nd gears, without worrying that it will downshift into 1st,...
That'll work, except for this: In "1-2", if you're traveling slower the 20 mph and put the controller in "D", it'll downshift immediately into 1st gear, because below 20mph, the TCU calls for 1st gear.

I drove out for a haircut and breakfast this morning. Put it in "3rd" and shifted manually using the controller all the way out and back. Still no engine codes. I didn't like the rotary switch to begin with, but it's starting to grow on me. It has pretty noticeable detentes, and it hard to "over-shoot" and miss the center ( 2 ) position. I don't even have to look at it.

Just for kicks I tried a 2nd gear start. Talk about SLOW acceleration!

I failed to mention in the writeup post: The wiring harness that comes with the controller is long enough to mount it just about anywhere on the dash in front of the driver, and anywhere on the console back down to the last cup holder. It might be a little short to get it up on the arm rest(didn't check that)

My impressions so far are that it's good for a daily driver, dual use rig, or trail rig. It might be a little fiddly for a rock rig or a full on race truck. Anything but a positive detente shifter would be hard to use when your getting thrown around like that.
 
I've never given the whole shifter thing a lot of thought until now, but for the people who want to improvise/home-brew, or build a competition rig from a late model:

What would happen it you swapped the slushbox ECU out for an ECU from a standard trans rig, then used the stand-alone harness and computer from a Renix rig to control the transmission? The computer wouldn't care what the trans is doing. Then you could hack the TCU harness and use a home-brew switch, something like the Baja Shifter, or anything else that works on the Renix rig. Probably be more expensive then the Montana Fab override. Anybody see any reason why this wouldn't work?

For that matter, you wouldn't even need a computer if you used the Baja Shifter. Just drive it like an in-line manual shift. Thoughts?
 
I've never given the whole shifter thing a lot of thought until now, but for the people who want to improvise/home-brew, or build a competition rig from a late model:

What would happen it you swapped the slushbox ECU out for an ECU from a standard trans rig, then used the stand-alone harness and computer from a Renix rig to control the transmission? The computer wouldn't care what the trans is doing. Then you could hack the TCU harness and use a home-brew switch, something like the Baja Shifter, or anything else that works on the Renix rig. Probably be more expensive then the Montana Fab override. Anybody see any reason why this wouldn't work?

Or based on how this works and that it appears the TCU is only looking at current draw, just splice in load resistors instead of the solenoids. Leave the TCU and ECM as is.
 
Awesome! I'd been hoping you'd post this much detail. Those two small chips on the board have me confused, they look like SC70-6 packages but I'm not sure what their actual function is, since you can get anything from dual MOSFETs to a few gates worth of SSI to really compact microcontrollers in that package.

I'm curious to see if this triggers a check-engine light. If it doesn't that implies that the trans computer is simply looking at the solenoid current draw to decide if its bad. If that's the case, a DYI version of this is very easily to replicate.

Up to now, I had been thinking that it looked at the input/output rpms to decide if it was in the wrong gear or not locking up (which made sense as those codes started at the same time they added a front input speed sensor).
That's what I kinda-sorta guessed at - my bet is that it's just looking for current draw in the right ranges. Next time I'm at the junkyard I think I'll pull a TCU from a pre-97 and see how far I can get reverse engineering it, I don't have quite enough projects on my plate just yet... At least reverse engineering the solenoid drivers will tell us whether the TCU can monitor current draw or not.

As for a full "manual" shift of the AW4, that would be a lot of fun to try out IMO - would have to look at a chart of solenoid usage and figure out the sequence they'd need before trying to do anything, and my transmission understanding is pretty weak anyways... I would think any chance of accidentally going into overdrive-reverse would be best avoided, among other combinations :scared:
 
As for a full "manual" shift of the AW4, that would be a lot of fun to try out IMO - would have to look at a chart of solenoid usage and figure out the sequence they'd need before trying to do anything, and my transmission understanding is pretty weak anyways... I would think any chance of accidentally going into overdrive-reverse would be best avoided, among other combinations :scared:
The Baja Shifter gives full manual control, if you could figure out how to integrate the resistors(on a late model, the Renix doesn't care)
 
Thanks, I'll have to take a look at it... the resistor switchover to prevent a CEL might be as simple as using a make-before-break type rotary switch instead of the more standard break-before-make switch.

Curious - does the header connector on the back of the board (each pin covered in what appears to be yellow heat-shrink tubing) connect to anything when the mod is installed, or is it entirely unused? I can't quite tell how many of the wires from it go to the small chips, I suspect it may be an in-circuit programming header for them if they're microcontrollers of some sort.
 
Nothing plugs into the connector. It's not mentioned at all in the instructions. On their web page, they talk about the possibility of a torque converter control switch as an add-on that may be available later on(in development maybe?) I kind of assumed that was the reason for the plug. A programming interface never occurred to me.
 
Thanks, I'll have to take a look at it... the resistor switchover to prevent a CEL might be as simple as using a make-before-break type rotary switch instead of the more standard break-before-make switch.

Curious - does the header connector on the back of the board (each pin covered in what appears to be yellow heat-shrink tubing) connect to anything when the mod is installed, or is it entirely unused? I can't quite tell how many of the wires from it go to the small chips, I suspect it may be an in-circuit programming header for them if they're microcontrollers of some sort.

I don't think I'd use a make-or-break since you could potentially pull twice the current and blow the driver in the TCU. On the solenoids, its pretty simple. Two solenoids control whether it's in 1,2,3, or 4. The FSM has the sequence listed, as I recall its both on for 1st, and both off for 4th. I forget which is on for 2nd and 3rd. is listed. The third solenoid controls lockup. Reverse is still manually controlled by the shifter itself. So worse case, you command 1st gear at 50 mph. :}

I was actually thinking that it wouldn't be hard to give the manual switch a bit of brains by looking at what solenoids are being commanded. For example if the TCU is not commanding either solenoid, then the TCU thinks it should be in 4th gear and you don't want to force 1st gear. You could also look at the NSS switch signals, and have your setup force either 1st or 2nd only when the shifter was in the 1-2 position? Got lots of potential here.
 
Yeah, I'll definitely agree there... the momentary double-current spike (or worse, really high current spike from the solenoid inrush current when switching from dummy load to solenoid) could probably pop the drivers. I have added a TCU out of a junker to my list of stuff to get at the junkyard before work tomorrow (assuming I wake up early enough), if I have any time on lunch break I'll probably tear into it and at least post a part number list / BOM and some driver transistor specs.
 
Well, I have my 97+ victim TCU. Will start hacking it up in ~3 hours, pictures and findings to be posted - think I should start another thread to avoid distracting this one too much?
 
(note: if any of this breaks rules, go ahead and kill it and let me know. I'm not sure where the line on reverse engineering subassemblies is...)

Specs: TCU part number 56041386AB, stamped 98M, internal chip datecodes indicate a date of manufacture in late 1998, probably used in a 98 or 99 XJ.

BOM:
1x Custom AW microcontroller - AW part number 99324-00842, Fujitsu base part number MB89665, 16k mask ROM, 512B RAM.
1x Philips/NXP part with custom numbering scheme. part number is 04833637, 20-lead SOIC. Appears to be the CCD bus level changer/transceiver.
2x 4049BF hex inverting/non inverting buffer/level converter
1x National Semiconductor 24C02 2kbit I2C EEPROM, probably for storing shift points / config, as the microcontroller only contains mask ROM
3x Sanken SI-5154 high-side power switch IC (with diagnostic function for open/short!)
1x Siemens TLE4261G 5 volt LDO regulator (20-lead SOIC)
1x LARGE square SMT rectifier, number 27844D
1x mystery manufacturer part number C177, 14-lead SOIC, probably an NEC quad comparator.
1x Toshiba TC7W14F, SOP8-P-1.27 package (narrow body 8 lead SOP), triple high-hysteresis schmitt trigger inverter


CCD bus leads are on pins 6&7 and pass through 100 ohm resistors, bypassed with SMT caps marked "N2" to ground*, limited by SOT23 diode packs to either ground or VCC, and passed to the NXP chip on pins 7 and 9.

It appears that the Sanken power switch ICs (which I suspect drive the shift solenoids, unsurprisingly) are driven on their input via a 1k resistor. On their diagnostic output pin they have an 8.2k pull-up resistor to microcontroller VCC followed by a 1k resistor to the microcontroller. One diag pin goes to CPU#53 (P32/TO2) but I have not managed to trace the others as they use inner layers and go under the microcontroller. I'm pretty sure the Toshiba triple schmitt trigger inverter has something to do with the solenoid drivers also due to its placement but I haven't traced it yet.

Personal notes: WOW! They completely redesigned this since the pre-97 years. Previously the box was nearly twice as big, all major components were through hole, and the board was a simple two layer I could strip and fully reverse engineer in under a day. This one is tiny (about the size of a post-it note), almost entirely SMT except for some capacitors and power components, and at least a four or six layer board. It's going to be a long project, I may have to drop another ten bucks on a second one so I can strip the parts off this one to trace the important stuff.

Anyone have any idea if the TCU will attempt to run without a CCD bus connection? I'd like to power this sucker up and sandbox it, give it some fake inputs/loads and watch what it does.

Further, anyone have any experience with this series microcontroller? I'd love to probe out the I/O pins and figure out what each drives, then give reverse engineering the firmware a shot (there are only 16k words of ROM available, so once I learn the instruction set it'll probably be around a one week project), but I have no idea how to pull the firmware image off the controller. I know it'll appear as if it's a 27C256 EPROM if properly attached to an EPROM burner but I don't know the wiring for the adapter, you're supposed to order them from Fujitsu and I suspect it'll cost me a boatload of cash. If anyone has a line on a Fujitsu ROM-64QF-28DP-8L adapter for less than say $50 I would LOVE to get one. I've asked for a quote from an obsolete parts clearinghouse but I don't expect them to really take me seriously trying to buy only one :roflmao:

More to come, I don't have a DMM at my desk and didn't bring a logic probe and that was about as far as I could get while eating lunch...

* EDIT: apparently code N2 means 3300pF, see http://www.solarbotics.net/library/pieces/parts_elect_pass_cap_code.html
 
Last edited:
Back
Top