Docs on Joakim "Roffe" Karlsson

SID Ver 12.0

Thu, 02 Jul 2026 07:53:16 +0000

SW Ver 02.2 is the latest and the last units was produced in 2005

Hardware

MCU: MC9S12DJ256B

CANbus

CTL1=0x84: CANE=1, CLKSRC=0 (oscillator), WUPM=1 BTR0=0xC3, BTR1=0xCF: SJW=4, BRP=4 (prescaler), Tseg1=16, Tseg2=5 → 22 Tq/bit, sample point ~77% (this is the classic Saab I-bus 47.619 kbps timing) IDAC=0x20: IDAM=0b10 → eight 8-bit acceptance filters Filters IDAR0-7 = 40 60 68 84 A0 C0 D4 E4, masks IDMR0-7 = 1D 17 17 1B 1D 0E 01 00

T8 CPID

Sun, 21 Dec 2025 16:07:24 +0000

T8 CPID's
CPID	Description
0x16	ResetECU
0x60	Security code input
0x65	Send Powertrain challenge frame
0x6E	Reset ICM3 function in ECM
0x6F	Activation of the ICM3 function in ECM
0x7A	Reset oil life
0x7F	Deactivation of the ICM3 function in ECM
0xEC	BusOffCounterReset
0xEE	LocalOverrunCounterReset

Green giants t5

Wed, 10 Dec 2025 22:35:50 +0000

19 constant

battery corrections on my T5 maps for green giants 465cc:

5V- 3.73
6V- 3.73
7V- 3.73
8V- 2.32
9V- 1.85
10V- 1.5
11V- 1.28
12V- 0.94
13V- 0.78
14V- 0.77
15V- 0.59

OG9-3 & OG9-5 blower motor resistor repair

Wed, 19 Nov 2025 13:15:59 +0000

Parts needed:

Transistor: BC547B
Mosfet: IRFP3206 (Original: IRFP054)

IRFP3206 runs cooler and consumes less power and is a excellent upgrade part compared to the original IRFP054

txbridge Protocol Documentation

Sun, 27 Jul 2025 21:06:45 +0000

The txbridge uses a binary protocol to communicate with the host over a TCP/IP connection.

Binary protocol format

Command (1 byte)	Size (1 byte)	Payload (n bytes)	Checksum (1 byte)
0xXX	0xYY	0xZZ, …	0xAA

cmd: The command byte that specifies the action to be performed.
command size: The size of the payload in bytes.
payload: The data to be sent with the command, which can vary in size.
checksum: A single byte checksum that is the sum of all bytes in the payload, modulo 256.

Checksum

The checksum is a single byte that is the sum of all bytes in the payload, modulo 256.

T5/T7 flashing cable

Mon, 09 Sep 2024 13:17:44 +0000

Seen from above with the locking handle to the left

T7 pins:
+ 23, 43
- 25
CAN L 19
CAN H 66

T5
+ 1, 60, 65
- 25
CAN L 63
CAN H 62

Parts Flow

Fri, 19 Jul 2024 15:57:19 +0000

Original IC SAAB 9-4 = 26.4L
ALU IC Hirsch 9-5 54.1L

T7 head flow 234.8 cfm/in 224.6 cfm/out
T5 head flow 222.3 cfm/in 119.7 cfm/out

Original cobra b205/b235e = 328.7 cfm
King cobra b205/b235 = 565.2 cfm

T7 cam = 228' 8.8 in
T7 cam = 230' 8.9 out
T5 cam = 240' 9.2 in/out

Trionic 7 pi area

Sun, 10 Dec 2023 00:03:55 +0000

PI Area id's
ID	Description
0x08	Filename
0x16	Builder ID
0x0A	Build Date
0x0C	EngineTypeT8
0x0D	Crypt Checksum
0x0F	Build Filename
0x1D	Calibration ID
0x1E	New Checksum Calc
0xCB	End model Part No
0xDB	End model Part No Ac
0xC1	AppSw Part No
0xD1	AppSw Part No Ac
0x90	VIN no.
0x91	Part Nr Alpha Code
0X92	Delco HW no
0x93	Delco HW version no.
0x94	Saab SW version no.
0x95	Software version no.
0x97	Engine Type
0x98	Tester Serial Nr
0x99	Software Date
0x9A	ECU Diag DataID
0x9B	Calibrationdata Offset
0x9C	SRAM offset (symbol list)
0xF2	Coded Checksum
0xF3	OBDWorstCaseType
0xF4	OBDHistCountType
0xF5	Security access key level 3
0xF6	Security access seed level 3
0xF7	Security access key level 1
0xF8	Security access seed level 1
0xF9	EOL programming completed succesfully
0xFA	Production tracability test flag
0xFB	ROM checksum
0xFC	Top off Flash address
0xFD	Bottom off Flash address
0xFE	Top Of Program address

Trionic7 Seed Key

Sat, 29 Jul 2023 00:08:53 +0000

Search for

 addi.w #-$2356,d0

 ROM:0004E6DC move.w #$8142,d1  ; Move Data from Source to Destination
 ROM:0004E6E0 eor.w d1,d0  ; Exclusive-OR Logical
 ROM:0004E6E2 addi.w #-$2356,d0  ; Add Immediate

UEC 9-3

Wed, 08 Feb 2023 22:35:57 +0000

IBUS 33.333 Kbp/S PBUS 500 Kbp/s

Listening on: 0x24F Responds on: 0x64F

ping: 0x24F 01 20 00 00 00 00 00 00
resp: 0x64F 01 60 00 00 00 00 00 00

Saab 9-3 CIM Column Integrated Module

Sun, 05 Feb 2023 19:35:33 +0000

MCU: M306NAFGTFP
RAM: 10k
ROM: 256k

Starting it in bench

 ____________________________________________
 | +B PH PL +15 |
 | 17 18 19 20 21 22 23 24 25 |
 | |
 | 1 2 3 4 5 6 7 8 9 11 12 14 15 |
 |+30 GND GND |
 |____________________________________________|

PH P-bus CAN High
PL P-bus CAN Low

Power

12v to pin 1, 18 and 23, ground on pin 3 & 7

Saab 9-5 Radio virginization

Sun, 11 Dec 2022 07:19:53 +0000

Eeprom is 93c56B

The stereos in the 9-5's has a eeprom memory like the CIM that holds the radio pairing with a car. This pairing is very simple and can be recreated or erased if you open the stereo and get access to the eeprom

you can go about it in a few different ways:

1. Erase the eeprom ( write FF to all sectors )

this will factory reset the stereo and allow it to be married to any car

T7 pbus

Wed, 11 May 2022 15:07:58 +0000

No matter which interface you are/will be using to connect to your Trionic 7 ECU/ECM, you will need to tap into the Powertrain Bus somewhere.
Note: 9-5 Model years 2008-2010 should have the P-Bus connected to OBD socket already, check if Pin 6 & 14 are populated in your car.

The P-BUS is a Highspeed CAN bus, which lets the different powertrain computers in the car talk to each other.

Immo off trionic 7

Sun, 10 Apr 2022 21:59:51 +0000

The immobilizer number is listed on the Twice unit. if you don't have a tech 2, and don't mind removing the seat you can simply read it from there!
Starter relay is activated by TWICE, grounding relay pin 85. If you make permanent connection between relay pin 85 and ground, Car will start if IMMO is disabled in ECU software

Below Mirrored from TrionicTuning so it never gets lost

F40

Tue, 29 Mar 2022 12:10:33 +0000

Shifter cables NG9-3

Tue, 29 Mar 2022 12:04:50 +0000

Shifter Cables NG9-3
Part number	Gearbox	Years	Engine
55558113	F23	04-07	Z18XE
12785900	F35	03-05	B207
55560641	F35	06-08	B207
55556847	F40	03-04	D223L
12788238	F40	03-04	B207
55557022	F40	05-08	B207
55568907	F40	09-14	B207/A20NFT
55557395	F40	05-12	Z19DTx, A19DTR
55559077	F40	06-12	B284

Camshafts Saab 16V h-engine

Tue, 29 Mar 2022 11:57:37 +0000

Saab 9000, NG900, OG9-3 Alarm removal

Tue, 29 Mar 2022 08:24:12 +0000

NG900: 1996, 1997, 1998, OG9-3: 1998, 1999, 2000, 2001, 2002, 2003

4737615 Cable Harness without anti theft alarm

Yellow 25pin, Green cables: Pin22 bridge with Pin10; Pin21 bridge with Pin9; Pin20 bridge with Pin8

Saab 9000 VSS bypass dongle 1-13

Saab 9000 VSS bypass dongle 14-25

9000: 1995 (Ch. S1002068--), 1996, 1997, 1998

4665733 Cable Harness without anti theft alarm

Yellow 25pin, black cables: Pin23 bridge with Pin15; Pin22 bridge with Pin10; Pin21 bridge with Pin9

Note On 9000 you also need the bridge another 2pin connector located somewhere around the glovebox

Saab 9000 central locking relay repair

Wed, 09 Mar 2022 22:56:19 +0000

SAAB 9000 Central Locking Repair

CLM location

On top the older model PCB 5359_03 weight 87g with V23072-C1059-A203 relays
On the bottom the newer less reliable model PCB 5359_04 weight 77g with V23083-C1002-A303 relays

The older model can usually be fixed by reflowing solder joints, while the new one usually requires reflow and or new relays

Old CLM solder points

[1] Below is Mirrored from the now defunct Fairway Academy

If you’ve owned or currently own a Saab 9000 you’ve no doubt experienced issues with the central locking system. There seem to be two main failure characteristics: fuse blowing, or intermittent operation. A central locking system that blows the fuse consistently generally has a bad motor someplace. Since all 5 motors (doors plus the gas filler door) are wired in parallel there is no simple way to find the culprit. Fortunately the doors all disconnect easily where the cables go into the A and B pillars. It’s getting the connectors back on that’s a pain. But a “divide and conquer” approach is the only way to find the culprit. There are many sources of info on the web, and plenty of FUD as well. Bad wiring is not normally an issue in the 9000. Note that the radio receiver for the key fob is not part of the central locking “controller”. All that the central locking controller does is provide a timed 0.7 second pulse of current one way or the other through all of the central locking motors to either lock or unlock all doors. Input comes from the key fob radio receiver, a switch in the driver’s door activated by the key, and the lock/unlock switch on the center console. If the lights flash in response to the key fob then all of that is probably working. If the central locking responds properly to the console switch but not the driver’s door key then the problem is most likely in the door. Note also that all of the doors must be closed for the central locking system to activate.

Saab 9000 Central locking wiring

Wed, 09 Mar 2022 22:45:26 +0000

Saab 9000 Central Locking Wiring

Component key, description of operation and fault finding

22a Main fuse board behind the access panel in the glove box.
175 Control module, central locking system, on a bracket under the dashboard on the left-hand side.
184D Motor, central locking system, in the driver's door.
184P Motor, central locking system, in the passenger's door.
184RL Motor, central locking system, in the rear left-hand door.
184RR Motor, central locking system, in the rear right-hand door.
208 Door lock indication, in the locking mechanism inside each door.
213 Pictogram, in the main instrument display panel.
230 Distribution terminal (+30 circuit) in main fuse box behind the glove box.
274 Microswitch, beside the lock cylinder in the driver's door.
289 Control module, anti-theft alarm, on the right-hand side under the dashboard behind the knee shield.
434 Motor, central locking system, fuel filler flap, adjacent to the fuel filler flap.
435 Microswitch, beside the lock cylinder in the front passenger's door.
514a Switch, simultaneous actuation of the central locking system, in window lift switch assembly (386) on the center console.
583 Control module, anti-theft alarm with immobilizer, under the dashboard on the right-hand side behind the knee shield.

2-Pin Connectors

H2-14 In the right-hand front door, beside the locking mechanism.
H2-16 Beside the locking mechanism inside the right-hand front door.
H2-30 In the right-hand rear door, beside the locking mechanism.
H2-34 Beside the locking mechanism inside the left-hand front door.
H2-36 In the left-hand rear door, beside the locking mechanism.
H2-73 Beside the locking mechanism in the driver's door.
H2-74 On the right-hand side in the luggage compartment beside the central locking motor for the fuel filler flap.

4-Pin Connectors

H4-13 In the left-hand front door, adjacent to the microswitch.
H4-19 In the passenger's door beside the locking mechanism.

10-Pin Connectors

H10-14 In the luggage compartment to the left beside the rear filament monitor.
H10-22 In the right-hand B pillar.
H10-24 In the left-hand B pillar. 22-Pin Connectors
H22-1 Behind the cable entry in the left-hand A pillar.
H22-2 Behind the cable entry in the right-hand A pillar.

Anti-theft with VSS

Grounding Points

G6 Grounding point, negative distribution terminal, in the main fuse box (22B) behind the glove box.
G8 Grounding point, dashboard, by the left-hand front loudspeaker socket.
G14 Grounding point, left-hand front seat member.

DESCRIPTION OF OPERATION

With the key in the driver's door or front passenger's door, all the car's doors and fuel tank filler cap can be locked and unlocked centrally.
Control module 175 for the central locking system is continuously supplied with current via fuse 16.
The control module is controlled from microswitch 274 in the driver's door, microswitch 435 in the passenger's door or from a switch in switch unit 386 in the centre console.
When the doors are locked, terminal 2 of the control module is grounded and current is supplied for 0.7 seconds to all actuating motors, closing the locks. The motors are grounded via terminal 8.
When switch 514a (LOCK) on the centre console is activated, terminal 5 of the control module is grounded and current is supplied for 0.7 seconds to all actuating motors, closing the locks. The motors are grounded via terminal 8.
When the driver's or passenger's door is unlocked, terminal 1 of the control module is grounded and current is supplied for 0.7 seconds to all actuating motors, opening the locks. The motors are grounded via terminal 7.
When the switch on the centre console is activated (by pressing the part of the switch with no symbol), terminal 6 of the control module is grounded and current is supplied for 0.7 seconds to all actuating motors, opening the locks. The motors are grounded via terminal 7.
If the driver's door is not completely closed and an attempt is made to use the central locking system from this door or from the switch on the centre console, it will not be possible to lock the doors.
If an attempt is made to use the central locking system from the passenger's door when the driver's door is not completely closed, the control module will lock the doors, only to unlock them again shortly afterwards.

Trionic 5 CANbus

Thu, 17 Feb 2022 00:56:50 +0000

CAN messages

Vanilla T5 ( not in bootloader )

Set address for uploading bootloader ( only byte 3 & 4 useable until bootloader is running )

 Byte 0 1 2 3 4 5 6 7
 Data A5 ADR_HH ADR_HL ADR_LH ADR_LL LENGTH 0x00 0x00

ECU will answer on 0xC with `A5 00 00 00 00 00 00 00`

MyBooty

Erase ECU

 Byte 0 1 2 3 4 5 6 7
 Data C0 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Send Boot Vector Address SRAM

 Byte 0 1 2 3 4 5 6 7
 Data C1 ADR_HH ADR_HL ADR_LH ADR_LL 0x00 0x00 0x00

Read memory by address

This request returns 6 bytes from starting address

Transmission control module for Saab 9-3 & 9-5

Sun, 13 Feb 2022 11:52:09 +0000

MCU: Renesas sh7055r, Datasheet

Part numbers

55355004
5448113

Internal memory layout

Calibration saved @ 0x70000 - 0x80000
SRAM address when talking over CAN 0x00040000, in code 0xff8000
requestDownload (write) only accepts sram addresses and there's only one service 0x42.