Today, we’re tearing down a 2019 BMW 440i Seat Module – called an “SMFA” by BMW (Which stands for “Sitzmodul Fahrerseite”, or “Seat Module Driver’s Side” in German)
What is it??
In the vehicle, this module lives under the car’s driver seat. It is responsible for controlling the various seat adjustment motors, as well as heated or cooled seat functionality. Each motor within the seat has a hall effect sensor attached, allowing this module to know the absolute limits of each adjustment and detect when faults in seat adjustment occur.
A roughly-estimated block diagram of this module is as follows:
Why tear it apart?
The high amount of connectivity the module has makes it somewhat interesting to reverse engineer – it can store faults, trigger seat motors, and converse via the vehicle’s CAN bus!
Additionally, seats are one of the first items which are replaced when turning a vehicle into a race car – this module is a perfect example of something that could throw fault codes or cause other headaches when removed from a race car. If we’re able to reverse engineer and understand this module better, perhaps it could allow others to build a replacement control unit which is able to silence any fault codes or errors when using an aftermarket bucket seat in the car! (Note: If you’re modifying safety devices in a vehicle such as seats, airbags, or steering wheels, always be sure to consult a professional and follow all relevant traffic laws when making modifications. This blog post is not professional advice!)
Outside the Module
This here is the module we’re playing with – somewhat water damaged, it was removed from my car due to the previous owner spilling some unknown liquid under the driver’s seat. Did they drop a pop? Leave a window rolled down? Who knows!
Despite this, when the module was removed from the vehicle, it was working well – the harness it was connected to had a short, but the module was still able to store faults, trigger seat motors, etc.
For those following along at home, the part number of the module we’ll be disassembling today is 61.35 9 459 681.9 01.
Inside the Module
To start with, let’s pop the module open and take a look at the PCB inside. With no visible fasteners on the module, this means we’re cracking it open with a screwdriver!
Ah yes, a nice and surprisingly-clean PCB (given the state of the exterior). Lets dive in!
PCB Component Analysis
The main processor of the module is an NXP/Freescale MC9S12XEG384CAL – the datasheet of this process can be found here. This microcontroller supports a number of interesting technologies – I2C, SPI, DBG, 5 separate MSCAN transceivers, PWM output, and more! Due to the MCU’s LQFP physical chip packaging (this MCU uses the 112-pin variant, for those who are curious), this processor should also be extremely easy to attach test probes to. This will allow for the interception of various messages and serial communications transmitted to or from the chip. I’ve attached a photo of the MCU’s pin-out extracted from the datasheet below.
As for the rest of the PCB, we have a number of Nexem EX2-series automotive relays (datasheet here), ON Semiconductor voltage regulators (datasheet here) and multiplexers (datasheet here), and a few other miscellaneous odds and ends.
Overall, a surprisingly basic PCB!
Future Reverse Engineering Work
With the exposed nature of the MCU’s LQFP packaging, I think it would be interesting to attach a signal analyzer to the processor to log and interact with a few different interfaces. In particular, analyzing all of the CAN traffic sent to and from the module during normal operation could show how certain features like seat adjustment motors, heating, or fault code reading could be triggered remotely via the CAN bus.
Keep an eye out for future blog posts diving deeper into this module!
Additional Information
For those playing along at home, I figured it may be useful to include a full transcript of the information from this module’s label. Hopefully this helps someone fix an issue with their own module!
BMW 61.35 9 459 681.9 01
SM BA/M-H-HS
A2-C731-7031-6-00
SN-Nr. [redacted]
| SGBM-IDs | |||||
| HWEL | 01 | 00 00 0A | B2 | 02 | 00 00 |
| HWAP | 02 | 00 00 0A | B0 | FF | FF FF |
| BTLD | 06 | 00 00 17 | 99 | 01 | 00 00 |
| SWFL | 08 | 00 00 0C | DD | 02 | 16 02 |
| DIAG.-INDEX | Datum | ||||
| 0F 19 60 | 14/06/18 | ||||
Every Medium 
Leave a comment