MR2 SpyderChat banner

1 - 20 of 31 Posts

·
Registered
Joined
·
16 Posts
Discussion Starter · #1 ·
I have been messing with my MR2 for a few years now, but what holds back my dreams is the factory engine management, or more importantly the option to mess with the original engine management without going standalone. This first world problem has kept me awake at night for quite some time now.

My MR2 has the ECU part number 89661-17730 on the box and inside it contains the cpu 151815-5431 97CW42AF-3448.
Which is a LQFP120 Toshiba TLCS-900 series, with 128k ROM and 6k RAM, and unfortunately it is a Masked ROM so no reflashing is possible.
I have bought a few different standard ecu's from different global markets, but they all have the same chip. Too many hours I've wasted on finding a solution to this problem, it is unfeasible to develop a daughter board for this original ECU, although possible as it has been done by some of the Japanese big name tuning companies.

Anyway, I have found an ECU from a USA spec corolla ZZE130, which very handily comes with the 1zz-fe engine too, but it has a wildly different ECU. The part number I have is a 89666-02140, and the best bit is, it is based on a Hitachi 76F0004 microprocessor, which can be easily re flashed with some widely available tools thought the OBD2 port on the K line. It can even be "updated" with techstream, but other aftermarket tools include PCMflash with "Module 35" which also does checksum correction too, and there are many others that support this ECU.

Now I have mapped out all the pinouts for both the original MR2 ecu, and the ZZE130 ecu, and it all looks pretty compatible, except for some of the dashboard functions like the temp gauge, and the knock sensor.

So my next step is to build a conversion harness from the connector from a spare MR2 ecu, and the plugs from a ZZE130 corolla, and give this idea a shot to see if it will even run on it firstly, then start mapping out the fuel and ignition tables.

I'm putting this post out there to see if anyone else fancies coming along for the journey? Does this sound like something that would float your boat?
73173
 

·
Registered
Joined
·
4,555 Posts
ok coupla things.

The later ECU you have is a J2534 Can-bus ECU. The J2534 standard was mandated by the EPA for all cars beginning in 2005. It requires that the ECU be reflashable and that the manufacturer provide tools for reflashing the ECU.

As you've mentioned, there are various third party tools available for downloading the binary and editing it and flashing it back. There is a body of knowledge being gathered independently on the structure of the binary and If you're interested we can talk more about that. Maybe you've seen the various threads here and elsewhere that I and others have devoted to this subject. We owe a lot to Marc Labranche (Gouky) who has been one of the pioneers in advancing our understanding of Toyota ECUs in general and the 2GR and 2AR ecus in particular.

That's the good news.

The not so good news is that all these 1zz ECUs from later years run a Electronic Throttle Control System aka drive by wire and many if not all have an immobilizer on board. These are not insurmountable obstacles but they do affect the usability of this ECU for non-native applications. Also being CANbus there is no possibility of communication with the dash without a conversion - the dash runs on the proprietary Toyota BEAN protocol.

Also if choosing an ECU to toy with you want one from a M/T car not an A/T and fortunately there are plenty of M/T Corolla 1zz's 2005 and later.

One of the exceptions to the ETCS is the 2zz ECU and this one was sold very briefly for one or two years as a J2534/Canbus cable throttle ECU and this ECU in fact has more useful potential than any 1zz ECU.

I am very pleased to see someone else taking an interest in this and I always try to offer as much support and encouragement along with sharing of information with anyone entering this area.
 

·
Registered
Joined
·
16 Posts
Discussion Starter · #4 ·
The later ECU you have is a J2534 Can-bus ECU. The J2534 standard was mandated by the EPA for all cars beginning in 2005. It requires that the ECU be reflashable and that the manufacturer provide tools for reflashing the ECU.
The corolla ECU is from 2003 and is not CAN, it uses ISO 9141 which is K line and L line.
The MR2 ECU is from 2002 and is also not CAN, it also used K and L.


The not so good news is that all these 1zz ECUs from later years run a Electronic Throttle Control System aka drive by wire and many if not all have an immobilizer on board. These are not insurmountable obstacles but they do affect the usability of this ECU for non-native applications. Also being CANbus there is no possibility of communication with the dash without a conversion - the dash runs on the proprietary Toyota BEAN protocol.
Neither of these have electronic throttle body.
The Corolla ECU doesn't have a transponder immobiliser. But the MR2 does, so it is not a problem.
The MR2 uses MPX1/MPX2, but only for the temp gauge, oil pressure light, and charge light.
The CEL is directly connected, and so is the tacho.

Please please tell me more about who is or how to dump these 76F00xx units, the only think I can find is "virtual reads" which pull the software from Toyota calibration files. If someone can actually read it, that would save some work.
 

·
Registered
Joined
·
4,555 Posts
These ECU's that you are working with have some features that I am not familiar with. Possibly they are transitional ECU's before the full J2534 rollout. I'm not sure if my info corresponds exactly to the ECU's that you are working with.

On the 2005 and later ECU's there is a 20-pin jtag port on the board. You can either solder a connector to the board or use a BDM frame with a compatible adapter. Then you can use a device like the Toyota-Lexus Flasher to dump the binary. The flasher, connectors, and adapters, are available here:

Obviously this is not cheap, but it is affordable if you are dedicated to this hobby.

Last year I found a good quality affordable BDM frame on aliexpress and it's even more affordable now:

If you are good at soldering you don't need this.

Besides the TLF you can use a Kess/Ktag clone or if you have the money you can spring for the real thing from Alientech.

For editing the binary and generating definitions, you can use WinOlS software or you can use TunerPro RT (only $39) or the hex editor of your choice.
 

·
Registered
Joined
·
16 Posts
Discussion Starter · #7 ·
I have genuine Ktag and kess already, and BDM frame. I specialise in Automotive control units for a living :) thus I have reworking stations and all sort of trickery at my finger tips.

But this early Corolla ECU does not have the jtag port on board :(

I am tempted to buy a later ECU with Jtag connector, then move the processor over to the later board and try to dump it like that.
 

·
Registered
Joined
·
4,555 Posts
Yeah I was afraid of that I couldn't see the port in your pictures. Probably you know more about this than I do but it appears that every one of these CPU's is slightly different and even thought there is some general documentation available for some of the CPU's in this series, there is no documentation available for the specific CPU's used by Toyota so transporting a CPU from one motherboard to another may not be as straightforward as that. Anyway if you have the skills and the means to do it, it's worth a try, I'll be very interested to see what you can pull off. Ha ha. Meanwhile I suggest that you do a 2zz swap and use the J2534 2zz ECU. Seriously.

PS. More seriously, since we have the ability to edit most of the functional maps, the 2zz ECU should be able to run a 1zz engine perfectly fine, with just some wiring.

PPS. In case you're interested, the two flashable 2zz cable throttle ECUs are 89661-02C50 or 89661-02F80 (Found in the 05-06 Corolla/Matrix XRS).
 

·
Registered
Joined
·
4,555 Posts
Quick photoshoot for reference with the flashable 2zz ECU. Obviously it's a four-row connector ECU. If using this in the Spyder I would make a patch harness. You can see the layout. I'm not able to make out the smaller letters on the CPU. Maybe with some image enhancement? I haven't counted the pins to compare with yours. I have a frame adapter from Russia that is compatible with both Alientech and TLF cables, which I thought it was pretty cool of them to make that.

73183


73184


73185


73186


73187


73188
 

·
Registered
Joined
·
16 Posts
Discussion Starter · #11 · (Edited)
I cleaned the CPU off with neat acetone and a tooth brush to get a good picture of the CPU details, you could use nail varnish remover etc.

But earlier you said to forget this 1zz stuff, and maybe you are right. I do have a complete 2zz-ge corolla which I bought to convert my MR2, maybe I should pull my finger out and get it done.

Then I could move over to one of these later type ECU's no problem.

Have you dumped that ECU yet with your new frame etc? What have you got, Ktag?
 

·
Registered
Joined
·
4,555 Posts
I don't know whether my 2zz ECU has an immobilizer or not. But regardless, for the immobilizer I have found a hardware solution that bypasses the immobilizer at the board level. In principle, this solution will work with any ECU of any generation - this includes all CANbus and K-line ECU's. It has been deployed in the field on a large number of different ECU's. It does require that you send your ECU to a technician to fit it with a immobilizer intercept/bypass. Here is what the implementation looks like on my Camry 2GR-FE ECU.

73191


There is an alternative solution that relies on flashing the immobilizer chip with the content from a non-immobilized ECU. This solution has been proven only on a very small number of ECU's. Potentially, in principle, it could be applied to other ECU's that are available in both immo and non-immo versions, but to my knowledge nobody has tried that.
 

·
Registered
Joined
·
16 Posts
Discussion Starter · #14 · (Edited)
So I aquired a corolla verso 1zz-fe ECU, part number 89661-0f030 which has the later board type.

Unfortunately this one seems to be from a car with electronic throttle body, but from research Toyota made the Avensis with the 1zz-fe using the mechanical throttle body but the later ecu type. I am going to try to find one of those.

Here is the ECU from the corolla verso 1zz-fe :-

73251



73252



73253



73254



73255



I have successfully dumped the flash off it with Ktag, and wrote a flash back to it, and ktag sorts out the checksum so if they maps were to be edited it would work fine.

73256


73258


73257


If anyone is interest or for reference and research purposes, here is the flash file from the microprocessor, the L56R eeprom on the back which normally contains the key transponder data appears blank, I have removed it and read it manually but still is blank. http://www.filedropper.com/toyotacorollaversomanual1zzfe896610f030board2750367341

So really what I need to find, is a late type flash-able ECU, from a 1zz-fe car, with a mechanical throttle body, and an immobiliser system that we can overcome.

Who fitted that immo emmulator board in your camry ecu?
 

·
Registered
Joined
·
4,555 Posts
Nice work. I've quickly checked the file. Everything looks ok. It has many of the characteristic maps of other ECU's. For reference, the calibration ID is 89663-0F030-C. This is a 512K file. Later files for other vehicles are 736K and more recent files are even larger. I have a 2011 file which is 992K. I don't know what are the features that require a larger binary.

The immobilizer board was done by Yury Baranov at All4swap. He develops engine swap supporting products including MPX/Bean translators, transmission emulators, and other mostly focused on UZ and JZ swaps. You can find his product descriptions and info in his facebook group:

Working with the immobilizer chip directly is beyond my technical ability. It's my understanding that you can "use a low voltage programming mode to avoid powering up the rest of the ECU without needing to desolder that chip."

The only 2005+ vehicle that I know of with a cable throttle is the 2zz Matrix/Corolla.
 

·
Registered
Joined
·
16 Posts
Discussion Starter · #16 ·
I have joined his facebook group, I think he has a flash software solution to the immo instead of the old emulator board solution like yours.

So a 2004 Avensis uses this board:-

top (1).jpg


Which comes in this case:-

73260


And the wiring diagrams for these pre 2004 Avensis 1zz-fe show there is no electronic throttle, but when I look at the later ones post 2004 they have electric throttle and that component is present inside the ECU. I think it is some kind of motor driver or something, but I will have to pin and probe it out to see where it hooks upto.

Here are the pinout tables and wiring diagrams for the pre 2004 Avensis system:-
 

Attachments

·
Registered
Joined
·
16 Posts
Discussion Starter · #18 ·
The labels point to the device, look at the wiring diagram on the 3rd page.
For example s13 is the brake pedal switch, you will then find it on the list.
 

·
Registered
Joined
·
4,555 Posts
I'm surprised that your immobilizer chip turned out blank. There's some useful info about the Spyder immobilizer chip here:


This has a different architecture from the 2005+ which have an external key transponder ECU, so I don't know if it is directly relevant.
 
1 - 20 of 31 Posts
Top