Toyota ECU + EEPROM Swap + ELM327 Issues

by solara70 in Workshop > Cars

2061 Views, 1 Favorites, 0 Comments

Toyota ECU + EEPROM Swap + ELM327 Issues

IMG_20210228_164906.jpg

This ECU swap was for a Toyota 4ZZ-FE engine.

The engine ran fine after identifying and replacing a faulty coil pack. However, the check engine light would come ON, but no fault code could be found. OBD connectivity was also patchy.

I wanted to rule out ECU damage from the faulty coil pack, by swapping it out.

Find the ECU

IMG_20210301_130406.jpg
IMG_20210228_141648.jpg
On this car the ECU is in a stupid place, under the lower centre dash console.

Removing the panels and lower centre console should have been a half hour job. However i had to contend with a 2p coin tightly wedged in one of the receseed fixing holes.
It deserved a photo after all my cursing !

Once the ecu is accessible take a photo of the ecu part no as the new must match exactly.

Immobiliser Hack

IMG_20210228_164456.jpg
IMG_20210228_164405.jpg
IMG_20210228_164419.jpg
IMG_20210302_133112.jpg

Unfortunately, an ECU swap with a used one, is not a simple plug and play affair. Thats because the ECU is. paired with the original keys for the immobiliser.

If you try starting it as is, the engine will crank but not fire due to the immobiliser keycode mismatch.

There's an EEPROM chip soldered on the ECU which holds the paired key immobiliser data.

3 possible approaches:

1. Reprogram all your old keys to new ecu. This hack involves placing a jumper wire between pins 4 and 13 on the obd connector and leaving the key in for half an hour. This didnt work on this ecu.

2. You can read your original EEPROM and overwrite the new. Binary virgin EEPROM files also exist for viirginizing the immobiliser for use with new keys. But I didnt have an eeprom flasher, and it could still involve desoldering.

3. If all else fails, you can desolder and solder the eeprom from old ECU to new.

I went for the latter approach.

The EEPROM is an SMT 8 pin 24C02 chip, with memory arranged as 256 X 8 bit. This was desoldered and soldered using a hot air gun.

Get a Replacement ECU

IMG_20210228_164911.jpg

Calling up a well known ECU repair and refurb outfit wasnt a cost viable option. They didnt have a swapout in stock, and I was quoted £300 minimum for repair + extra for testing.

Ebay had an identical part number ECU (used working) going for £16. Cheaper than most sensors! Bought it.

Fire Her Up!

On this Toyota, the dash security LED stops flashing when a valid key is inserted into the ignition slot.

If alls well, on turning the key, engine should crank and fire up.

Job done.

OBD ELM327 Connectivity Issues

Screenshot_20210315_114156_com.ebay.mobile.jpg
Screenshot_20210315_114320_com.ebay.mobile.jpg
IMG_20210309_091551.jpg
Screenshot_20210315_125229_com.microsoft.office.onenote.jpg
Screenshot_20210227_202952_de.kai_morich.serial_bluetooth_terminal.jpg
Screenshot_20210304_190125_com.ovz.carscanner.jpg

Unfortunately, I was still experiencing connectivity issues with my OBD adapters.

I had two cheap chinese bluetooth ELM 327 clones (serves me right?). One was to replace a lost one, but then found. So I had two of different ELM327 chine clone adapters. One completely refused to connect (blue/orange adapter), the other (black adapter) was flaky at best. The black one worked well with CAN BUS cars. The blue/orange adapter failed to work on both cars. These tests were using Torque and Car Scanner android apps.

I didn't fancy the idea of buying yet another chinese clone (Toyota Techstream) which may or may not work with this 20+ year old car due to chinese clone firmware differences. I didn't need any of the Toyota Techstream fancy features, I just needed to be able to read fault codes, monitor sensors, and clear fault codes. All this is supported by ODB2 out of the box, so just needed to get one of my existing clones working. After all its just a serial connection!

Seeing as this ECU was 20+ years old, it was before the time of CAN BUS on cars (2006+), it just about made it to OBD2 in 2001. After replacing this ECU, I was more adamant to get one of these working with this ECU.

Looking at the internals of both clones, they were wired up for the J bus pins (J1840+/-), K &L bus bins, and CAN LO/HI pins, power and ground pins.

Measuring voltages on the OBD DLC connector from this cars ECU with a scope, read 6V on the K&L Pins, 12v on the CAN Bus pins (yikes!). I was pretty sure this ECU used the K&L lines. I thought I would try and get the blue/orange OBD adapter working with this car. I started by disconnecting all wires inside the adaptor the the DLC connector, except the +12v, GROUND and K line.

To avoid any software compatibility issues, I ran a bluetooth serial terminal session direct with the ELM 327, sending command 0101 to fetch a pid. This gave a BUS Ierror.

I then tried the ATSP command to switch between iso9141-2 and KWP protocols (which both used the K& L pins, same baud rate, just use a different handshake reply sequence). However, got the same BUS error.

I then put a scope on the k line using a breakout box, with the adapter plugged in. I could see the 5-baud initilization sequence being sent by the adapter, but no response from the ECU. I suspect it also needed the L line connected to wake up the CPU to respond to this request. On wiring up both K & L lines, the LEDs started flashing away, and I got a response back from the ECU with a PID value for 0101 command. After which it started working with the android Car Scanner app (my preferred tool).

So what made it work? A combination of the following:

  • disconnect unused OBD connections. In this case J bus and Can bus wires disconnected inside the adapter.
  • Setting the protocol using ATSP3 command in a terminal session. I suspect it was set to CAN bus mode by default. It retains the settings once changed, even after power down.
  • Using both K & L lines, not just the K line.

I was inquisitive as to why the black adapter didn't work, so measured some resistances to ground from the K & L pins. This measured 10 kohm, The OBD adapters uses a voltage divider setup with 2 resistors to split the voltage from 12v to a 5v level for the ELM327 microcontroller input. I suspect they used a poor combination of resistors as ELM tech spec guide used a 22k+47k pair to split the voltage (as used by blue/orange adapter), hence the flaky connection with the black adapter.

So now I have two working chinese clone ELM327 adapters. One is kept for K&L cars, the other is for CAN bus cars. They both also work with the "Car Scanner" app which is pretty cool, and worth paying the 2-3 quid for the features it provides. eg support for all the can bus modules on a wide range of car makes and models. Torque is for novices, and crap in comparison.

Running the "Elm Identifier" app against both adapters reported v1.4 of ELM327.

Hope this helps someone geting their cheap ELM clone working.

If you do buy one, buy the blue/orange as its easier to work on soldering wise rather than the smaller miniaturised versions.