Welcome on Joakim "Roffe" Karlsson

Donate

Wed, 04 Nov 2026 00:00:00 +0000

Most of the stuff on here is free and built on my spare time. If it saved you a trip to the dealer or a bricked ECU, buy me a coffee (or a new adapter) :)

paypal.me/roffe84

Or pick an amount: €5 · €10 · €25 · €50 · €100 · €150

Every donation goes back into hardware for the bench and keeps the projects going. Thanks 💕

Tech3Win

Mon, 02 Nov 2026 00:00:00 +0000

A full Tech2 emulator, written from scratch in Rust. It runs the unmodified Tech2 PCMCIA card images (SAAB, Opel, GM, GM NAO, Isuzu, Cadillac) just like a real Tech2. Windows, Linux & macOS.

Tech3Win does not contain any code from the original Tech2Win. It's its own emulator built from the ground up, not a patched or repackaged Tech2Win.

What it does

Runs the card images unmodified. You need your own card image, the .bin from a Tech2 PCMCIA card
Talks to the car through any J2534 adapter that has SWCAN, HSCAN and K-line, or a €3 VAG-COM KKL cable for the K-line cars (OG9-3/OG9-5 pre 2006)
Your Tech2Win .conf files work as they are
Data display window with the same names and values as on the Tech2 screen. Hit Record, then Save CSV and you have a log for a spreadsheet
RS-232 port for TIS: a PTY on Linux and macOS, a virtual COM port on Windows
A simulated car to try it out without a car
Start it without anything and you get the setup. Pick the card and the adapter and hit Start

Download

It's in beta. The latest Windows nightly is attached to the first post in the Tech3Win thread on TrionicTuning, post bugs and logs there.

Open Source

Mon, 14 Sep 2026 14:57:12 +0000

My github page

SAAB & CAN bus

ArduBDM – Open source BDM adapter for SAAB Trionic 5/7/8 ECUs on an Arduino Nano. Firmware and KiCad PCB.

bdmtool – Read and write SAAB Trionic 5/7/8 and Volvo CEM flash and SRAM over BDM (Background Debug Mode). A Go/Fyne port and extension of Janis Silins’ BDM Tool with support for CombiAdapter, USB BDM and ardubdm.

canmonitor – Small CAN bus monitor built on gocan. Live per-ID view, chronological trace with candump-compatible recording, and single-shot or periodic frame transmit.

ArduBDM

Mon, 14 Sep 2026 00:00:00 +0000

A BDM (Background Debug Mode) adapter for the CPU32 family (MC68332/MC68376) found in SAAB Trionic 5, 7 and 8 ECUs. It runs on an Arduino Nano with the ATmega328P/PB, bit-bangs the BDM protocol and talks to the host over USB serial. Together with BDMTool it reads, erases and flashes the ECU.

Download firmware · Source on GitHub

Features

Reset into BDM, run, stop and single step the target
Read and write memory and registers
Fast block dumps: a full 512 KB Trionic 7 read takes about 7 seconds
RAM-resident flash drivers for AMD 29Fxxx (Trionic 7/8) and 28F010 (Trionic 5) chips; a full 512 KB erase, write and verify takes about 30 seconds with BDMTool
Simple ASCII serial protocol at 1 Mbaud, easy to script
Target voltage monitoring

Hardware

The PCB is a small hat for the Arduino Nano with a shrouded 2x5 IDC box header for the BDM cable. No other components are needed, the ECU supplies the pull-ups and everything runs at 5 V. The KiCad project is in the repository.

BDM Tool 3

Sun, 13 Sep 2026 00:00:00 +0000

Reads and writes SAAB Trionic (and Volvo CEM) ECU flash and SRAM over BDM (Background Debug Mode). An extended Go/Fyne version of Janis Silins' BDM Tool.

Download · Source on GitHub

Supported adapters

CombiAdapter (incl. MkII and STM32 clones)
USB BDM
USB BDM MkII
ardubdm (ATmega328PB over USB serial)

Supported ECUs

Trionic 5.2
Trionic 5.5 (28F010 chips)
Trionic 5.5 (AM29F010 chips)
Trionic 7
Trionic 8
Volvo CEM

BDM connector hookup

Interactive 3D view of where the 10-way BDM plug goes on the ECU board. Switch between Trionic 7 and Trionic 5, lift the plug to see which hole lands on which pin, drag to orbit. Open full screen (Trionic 5).

Contact

Sun, 13 Sep 2026 00:00:00 +0000

Instagram: @saabroffe
TrionicTuning: roffe84

SID Ver 12.0

Thu, 02 Jul 2026 07:53:16 +0000

SW Ver 02.2 is the latest and the last units was produced in 2005

Hardware

MCU: MC9S12DJ256B

CANbus

CTL1=0x84: CANE=1, CLKSRC=0 (oscillator), WUPM=1 BTR0=0xC3, BTR1=0xCF: SJW=4, BRP=4 (prescaler), Tseg1=16, Tseg2=5 → 22 Tq/bit, sample point ~77% (this is the classic Saab I-bus 47.619 kbps timing) IDAC=0x20: IDAM=0b10 → eight 8-bit acceptance filters Filters IDAR0-7 = 40 60 68 84 A0 C0 D4 E4, masks IDMR0-7 = 1D 17 17 1B 1D 0E 01 00

txbridge beta firmware

Sun, 28 Jun 2026 00:00:00 +0000

Hajfena

Fri, 02 Jan 2026 21:09:12 +0000

Utskrift av Hajfena 300 ink frakt inom Sverige.

Dessa tar 5 timmar styck att producera då jag använder tunnast möjliga lager och “fuzzy skin” för att dom inte ska se 3d printade ut.

Endast det bästa åt våra SAAB’ar!

Utskriven i ABS plast

För att beställa: hajfena (a) roffe.nu

T8 CPID

Sun, 21 Dec 2025 16:07:24 +0000

T8 CPID's
CPID	Description
0x16	ResetECU
0x60	Security code input
0x65	Send Powertrain challenge frame
0x6E	Reset ICM3 function in ECM
0x6F	Activation of the ICM3 function in ECM
0x7A	Reset oil life
0x7F	Deactivation of the ICM3 function in ECM
0xEC	BusOffCounterReset
0xEE	LocalOverrunCounterReset

Green giants t5

Wed, 10 Dec 2025 22:35:50 +0000

19 constant

battery corrections on my T5 maps for green giants 465cc:

5V- 3.73
6V- 3.73
7V- 3.73
8V- 2.32
9V- 1.85
10V- 1.5
11V- 1.28
12V- 0.94
13V- 0.78
14V- 0.77
15V- 0.59

OG9-3 & OG9-5 blower motor resistor repair

Wed, 19 Nov 2025 13:15:59 +0000

Parts needed:

Transistor: BC547B
Mosfet: IRFP3206 (Original: IRFP054)

IRFP3206 runs cooler and consumes less power and is a excellent upgrade part compared to the original IRFP054

txbridge

Sat, 08 Nov 2025 00:00:00 +0000

Package contents

txbridge dongle
USB-C cable
1m WBL extension cable

Setup

Bluetooth setup guide

Default wifi password is: 123456789

Firmware recovery

CH340 serial driver for Windows: CH341SER_WINDOWS.zip

Firmware installer powered by ESP Web Tools.

CIM Tool Nano

Mon, 13 Oct 2025 14:33:25 +0000

Github: roffe/cimtool: Saab CIM Tool

USB Serial Driver: CH341SER.zip

Cim Tool Software 64-bit or 32-bit

I build kits on request. order (a)t roffe.nu €60 + shipping

txbridge Protocol Documentation

Sun, 27 Jul 2025 21:06:45 +0000

The txbridge uses a binary protocol to communicate with the host over a TCP/IP connection.

Binary protocol format

Command (1 byte)	Size (1 byte)	Payload (n bytes)	Checksum (1 byte)
0xXX	0xYY	0xZZ, …	0xAA

cmd: The command byte that specifies the action to be performed.
command size: The size of the payload in bytes.
payload: The data to be sent with the command, which can vary in size.
checksum: A single byte checksum that is the sum of all bytes in the payload, modulo 256.

Checksum

The checksum is a single byte that is the sum of all bytes in the payload, modulo 256.

txbridge firmware update over WiFi

Tue, 06 May 2025 00:00:00 +0000

Follow these steps to update the firmware on your device using WiFi.

1. Open txbridge firmware updater

2. Press Update

3. Update completed

You can now start using the updated dongle.

txbridge Bluetooth setup

Tue, 17 Dec 2024 00:00:00 +0000

Put the device in pairing mode

This is done by holding the button 2 seconds and can be done when plugged in to either USB-C power or the OBD connector

1. Open Bluetooth settings

2. Press Add device

3. Add Bluetooth device

4. Select txbridge & press Done

5. Find "More Bluetooth settings" and click it

6. Select the COM Ports tab

7. Remember the Outgoing COM port number

8. Configure txlogger

Click on the settings tab
Select "txbridge" as adapter
Select the "Outgoing COM port" from the Bluetooth settings
Select 2mbit speed

Lööf!

Wed, 11 Dec 2024 16:03:57 +0000

Roffe vill ha:

NG900 94-97

SRS modul, samma placering som på 9-5
Motorstyrdon ( Om det är en turbo )
ABS styrdon
VSS ( Endast om det finns nyckel ) (Sitter på samma ställe som TWICE)
Läder inredning + Säten

OG9-3 1998-2003

SRS Moduel samma placering som på 9-5
Motorstyrdon (om det är en turbo)
ABS styrdon
TWICE (Endast med nyckel)
AERO front i bra skick
Läder inredning + Säten

NG9-3 2003-

CIM (Endast om nycklar finns )
Rattlås ( Klumpen på rattstången )
Tändningslås
Motorstyrdon
Dörrlås
Dörrmoduler ( Knapparna för att köra rua upp /ner )

T5/T7 flashing cable

Mon, 09 Sep 2024 13:17:44 +0000

Seen from above with the locking handle to the left

T7 pins:
+ 23, 43
- 25
CAN L 19
CAN H 66

T5
+ 1, 60, 65
- 25
CAN L 63
CAN H 62

Parts Flow

Fri, 19 Jul 2024 15:57:19 +0000

Original IC SAAB 9-4 = 26.4L
ALU IC Hirsch 9-5 54.1L

T7 head flow 234.8 cfm/in 224.6 cfm/out
T5 head flow 222.3 cfm/in 119.7 cfm/out

Original cobra b205/b235e = 328.7 cfm
King cobra b205/b235 = 565.2 cfm

T7 cam = 228' 8.8 in
T7 cam = 230' 8.9 out
T5 cam = 240' 9.2 in/out

Trionic 7 pi area

Sun, 10 Dec 2023 00:03:55 +0000

PI Area id's
ID	Description
0x08	Filename
0x16	Builder ID
0x0A	Build Date
0x0C	EngineTypeT8
0x0D	Crypt Checksum
0x0F	Build Filename
0x1D	Calibration ID
0x1E	New Checksum Calc
0xCB	End model Part No
0xDB	End model Part No Ac
0xC1	AppSw Part No
0xD1	AppSw Part No Ac
0x90	VIN no.
0x91	Part Nr Alpha Code
0X92	Delco HW no
0x93	Delco HW version no.
0x94	Saab SW version no.
0x95	Software version no.
0x97	Engine Type
0x98	Tester Serial Nr
0x99	Software Date
0x9A	ECU Diag DataID
0x9B	Calibrationdata Offset
0x9C	SRAM offset (symbol list)
0xF2	Coded Checksum
0xF3	OBDWorstCaseType
0xF4	OBDHistCountType
0xF5	Security access key level 3
0xF6	Security access seed level 3
0xF7	Security access key level 1
0xF8	Security access seed level 1
0xF9	EOL programming completed succesfully
0xFA	Production tracability test flag
0xFB	ROM checksum
0xFC	Top off Flash address
0xFD	Bottom off Flash address
0xFE	Top Of Program address

Trionic7 Seed Key

Sat, 29 Jul 2023 00:08:53 +0000

Search for

 addi.w #-$2356,d0

 ROM:0004E6DC move.w #$8142,d1  ; Move Data from Source to Destination
 ROM:0004E6E0 eor.w d1,d0  ; Exclusive-OR Logical
 ROM:0004E6E2 addi.w #-$2356,d0  ; Add Immediate

UEC 9-3

Wed, 08 Feb 2023 22:35:57 +0000

IBUS 33.333 Kbp/S PBUS 500 Kbp/s

Listening on: 0x24F Responds on: 0x64F

ping: 0x24F 01 20 00 00 00 00 00 00
resp: 0x64F 01 60 00 00 00 00 00 00

Saab 9-3 CIM Column Integrated Module

Sun, 05 Feb 2023 19:35:33 +0000

MCU: M306NAFGTFP
RAM: 10k
ROM: 256k

Starting it in bench

 ____________________________________________
 | +B PH PL +15 |
 | 17 18 19 20 21 22 23 24 25 |
 | |
 | 1 2 3 4 5 6 7 8 9 11 12 14 15 |
 |+30 GND GND |
 |____________________________________________|

PH P-bus CAN High
PL P-bus CAN Low

Power

12v to pin 1, 18 and 23, ground on pin 3 & 7

Saab 9-5 Radio virginization

Sun, 11 Dec 2022 07:19:53 +0000

Eeprom is 93c56B

The stereos in the 9-5's has a eeprom memory like the CIM that holds the radio pairing with a car. This pairing is very simple and can be recreated or erased if you open the stereo and get access to the eeprom

you can go about it in a few different ways:

1. Erase the eeprom ( write FF to all sectors )

this will factory reset the stereo and allow it to be married to any car

T7 pbus

Wed, 11 May 2022 15:07:58 +0000

No matter which interface you are/will be using to connect to your Trionic 7 ECU/ECM, you will need to tap into the Powertrain Bus somewhere.
Note: 9-5 Model years 2008-2010 should have the P-Bus connected to OBD socket already, check if Pin 6 & 14 are populated in your car.

The P-BUS is a Highspeed CAN bus, which lets the different powertrain computers in the car talk to each other.

Immo off trionic 7

Sun, 10 Apr 2022 21:59:51 +0000

The immobilizer number is listed on the Twice unit. if you don't have a tech 2, and don't mind removing the seat you can simply read it from there!
Starter relay is activated by TWICE, grounding relay pin 85. If you make permanent connection between relay pin 85 and ground, Car will start if IMMO is disabled in ECU software

Below Mirrored from TrionicTuning so it never gets lost

F40

Tue, 29 Mar 2022 12:10:33 +0000

Shifter cables NG9-3

Tue, 29 Mar 2022 12:04:50 +0000

Shifter Cables NG9-3
Part number	Gearbox	Years	Engine
55558113	F23	04-07	Z18XE
12785900	F35	03-05	B207
55560641	F35	06-08	B207
55556847	F40	03-04	D223L
12788238	F40	03-04	B207
55557022	F40	05-08	B207
55568907	F40	09-14	B207/A20NFT
55557395	F40	05-12	Z19DTx, A19DTR
55559077	F40	06-12	B284

Camshafts Saab 16V h-engine

Tue, 29 Mar 2022 11:57:37 +0000

Saab 9000, NG900, OG9-3 Alarm removal

Tue, 29 Mar 2022 08:24:12 +0000

NG900: 1996, 1997, 1998, OG9-3: 1998, 1999, 2000, 2001, 2002, 2003

4737615 Cable Harness without anti theft alarm

Yellow 25pin, Green cables: Pin22 bridge with Pin10; Pin21 bridge with Pin9; Pin20 bridge with Pin8

Saab 9000 VSS bypass dongle 1-13

Saab 9000 VSS bypass dongle 14-25

9000: 1995 (Ch. S1002068--), 1996, 1997, 1998

4665733 Cable Harness without anti theft alarm

Yellow 25pin, black cables: Pin23 bridge with Pin15; Pin22 bridge with Pin10; Pin21 bridge with Pin9

Note On 9000 you also need the bridge another 2pin connector located somewhere around the glovebox

Saab 9000 central locking relay repair

Wed, 09 Mar 2022 22:56:19 +0000

SAAB 9000 Central Locking Repair

CLM location

On top the older model PCB 5359_03 weight 87g with V23072-C1059-A203 relays
On the bottom the newer less reliable model PCB 5359_04 weight 77g with V23083-C1002-A303 relays

The older model can usually be fixed by reflowing solder joints, while the new one usually requires reflow and or new relays

Old CLM solder points

[1] Below is Mirrored from the now defunct Fairway Academy

If you’ve owned or currently own a Saab 9000 you’ve no doubt experienced issues with the central locking system. There seem to be two main failure characteristics: fuse blowing, or intermittent operation. A central locking system that blows the fuse consistently generally has a bad motor someplace. Since all 5 motors (doors plus the gas filler door) are wired in parallel there is no simple way to find the culprit. Fortunately the doors all disconnect easily where the cables go into the A and B pillars. It’s getting the connectors back on that’s a pain. But a “divide and conquer” approach is the only way to find the culprit. There are many sources of info on the web, and plenty of FUD as well. Bad wiring is not normally an issue in the 9000. Note that the radio receiver for the key fob is not part of the central locking “controller”. All that the central locking controller does is provide a timed 0.7 second pulse of current one way or the other through all of the central locking motors to either lock or unlock all doors. Input comes from the key fob radio receiver, a switch in the driver’s door activated by the key, and the lock/unlock switch on the center console. If the lights flash in response to the key fob then all of that is probably working. If the central locking responds properly to the console switch but not the driver’s door key then the problem is most likely in the door. Note also that all of the doors must be closed for the central locking system to activate.

Saab 9000 Central locking wiring

Wed, 09 Mar 2022 22:45:26 +0000

Saab 9000 Central Locking Wiring

Component key, description of operation and fault finding

22a Main fuse board behind the access panel in the glove box.
175 Control module, central locking system, on a bracket under the dashboard on the left-hand side.
184D Motor, central locking system, in the driver's door.
184P Motor, central locking system, in the passenger's door.
184RL Motor, central locking system, in the rear left-hand door.
184RR Motor, central locking system, in the rear right-hand door.
208 Door lock indication, in the locking mechanism inside each door.
213 Pictogram, in the main instrument display panel.
230 Distribution terminal (+30 circuit) in main fuse box behind the glove box.
274 Microswitch, beside the lock cylinder in the driver's door.
289 Control module, anti-theft alarm, on the right-hand side under the dashboard behind the knee shield.
434 Motor, central locking system, fuel filler flap, adjacent to the fuel filler flap.
435 Microswitch, beside the lock cylinder in the front passenger's door.
514a Switch, simultaneous actuation of the central locking system, in window lift switch assembly (386) on the center console.
583 Control module, anti-theft alarm with immobilizer, under the dashboard on the right-hand side behind the knee shield.

2-Pin Connectors

H2-14 In the right-hand front door, beside the locking mechanism.
H2-16 Beside the locking mechanism inside the right-hand front door.
H2-30 In the right-hand rear door, beside the locking mechanism.
H2-34 Beside the locking mechanism inside the left-hand front door.
H2-36 In the left-hand rear door, beside the locking mechanism.
H2-73 Beside the locking mechanism in the driver's door.
H2-74 On the right-hand side in the luggage compartment beside the central locking motor for the fuel filler flap.

4-Pin Connectors

H4-13 In the left-hand front door, adjacent to the microswitch.
H4-19 In the passenger's door beside the locking mechanism.

10-Pin Connectors

H10-14 In the luggage compartment to the left beside the rear filament monitor.
H10-22 In the right-hand B pillar.
H10-24 In the left-hand B pillar. 22-Pin Connectors
H22-1 Behind the cable entry in the left-hand A pillar.
H22-2 Behind the cable entry in the right-hand A pillar.

Anti-theft with VSS

Grounding Points

G6 Grounding point, negative distribution terminal, in the main fuse box (22B) behind the glove box.
G8 Grounding point, dashboard, by the left-hand front loudspeaker socket.
G14 Grounding point, left-hand front seat member.

DESCRIPTION OF OPERATION

With the key in the driver's door or front passenger's door, all the car's doors and fuel tank filler cap can be locked and unlocked centrally.
Control module 175 for the central locking system is continuously supplied with current via fuse 16.
The control module is controlled from microswitch 274 in the driver's door, microswitch 435 in the passenger's door or from a switch in switch unit 386 in the centre console.
When the doors are locked, terminal 2 of the control module is grounded and current is supplied for 0.7 seconds to all actuating motors, closing the locks. The motors are grounded via terminal 8.
When switch 514a (LOCK) on the centre console is activated, terminal 5 of the control module is grounded and current is supplied for 0.7 seconds to all actuating motors, closing the locks. The motors are grounded via terminal 8.
When the driver's or passenger's door is unlocked, terminal 1 of the control module is grounded and current is supplied for 0.7 seconds to all actuating motors, opening the locks. The motors are grounded via terminal 7.
When the switch on the centre console is activated (by pressing the part of the switch with no symbol), terminal 6 of the control module is grounded and current is supplied for 0.7 seconds to all actuating motors, opening the locks. The motors are grounded via terminal 7.
If the driver's door is not completely closed and an attempt is made to use the central locking system from this door or from the switch on the centre console, it will not be possible to lock the doors.
If an attempt is made to use the central locking system from the passenger's door when the driver's door is not completely closed, the control module will lock the doors, only to unlock them again shortly afterwards.

Trionic 5 CANbus

Thu, 17 Feb 2022 00:56:50 +0000

CAN messages

Vanilla T5 ( not in bootloader )

Set address for uploading bootloader ( only byte 3 & 4 useable until bootloader is running )

 Byte 0 1 2 3 4 5 6 7
 Data A5 ADR_HH ADR_HL ADR_LH ADR_LL LENGTH 0x00 0x00

ECU will answer on 0xC with `A5 00 00 00 00 00 00 00`

MyBooty

Erase ECU

 Byte 0 1 2 3 4 5 6 7
 Data C0 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Send Boot Vector Address SRAM

 Byte 0 1 2 3 4 5 6 7
 Data C1 ADR_HH ADR_HL ADR_LH ADR_LL 0x00 0x00 0x00

Read memory by address

This request returns 6 bytes from starting address

Transmission control module for Saab 9-3 & 9-5

Sun, 13 Feb 2022 11:52:09 +0000

MCU: Renesas sh7055r, Datasheet

Part numbers

55355004
5448113

Internal memory layout

Calibration saved @ 0x70000 - 0x80000
SRAM address when talking over CAN 0x00040000, in code 0xff8000
requestDownload (write) only accepts sram addresses and there's only one service 0x42.

SAAB Help

Tue, 21 Dec 2021 14:19:17 +0000

I have the whole range of hardware and software necessary for ECU flashing, recovery and cloning for the following systems

Trionic 5.2
Trionic 5.5
Trionic 7
Trionic 8
ME9.2
BDM recovery on Volvo CEM ECU

I do NOT offer tuning, you can supply a custom bin to flash to the ECU but I cannot be held responsible for any engine failure or damage to your vehicle as a result of this