Toyota BEANs, Multiplex etc

[wilbo666]

I'm trying to update my knowledge into the 97+ age...

Anyone have any more details information on Toyota's mulitplex system, in particular BEANs?

What happens if the ECU doesn't see certain components connected?

What things sit on the BEAN bus in say a JZS161? lol (AC ECU etc)

i.e. MPX1, MPX2.

I know that it is designed to be a daisy chained network, single wire, 10kbps max, 11 bytes max...
http://www.autoshop101.com/forms/Hybrid18.pdf

Or in slightly more detail:
Bit encoding: NRZ
Media Access: Contention
Error Detection: 8-bit CRC
Header Length: 25bits
Data length: 1-11bytes
Overhead: 28%
In-message response: NO
Bit rate: 10Kb/s
Maximum Bus Length: Not Specified
Maximum Nodes: 20
u Needed?: YES
Sleep / Wakeup: NO
H/W Avail?: YES (?)
Cost: Low

http://www.systemconnection.com/down...Whitepaper.pdf

[Norbie]

I have a bunch of technical docs for the Century, I think it covers some of this. I'll burn you a copy next time you're over.

[cambelt]

I can tell you what pin the C bus is on that ecu , not much help i know
Dave

[wilbo666]

I have a bunch of technical docs for the Century, I think it covers some of this. I'll burn you a copy next time you're over.

That'd be great

I can tell you what pin the C bus is on that ecu , not much help i know
Dave

I don't think there is CAN bus on the JZS161...

There is ISO9141-2, but that isn't CAN...



Cheers
Wilbo

[Mos]

It isn't daisy chain, or not my understanding of daisy chain - it's just a "bus" in mostly a ring formation - as in MPX1 and MPX2 pins are shorted together inside the ECU - but you have to have all the components connected for the bus to be complete. If you remove one component it usually will still work, but if you remove two non-consecutive ECUs it breaks the ring.

On the IS200 it's engine, cluster, air con, body, theft deterrant, double locking, driver's side power window switch. The car still ran without a cluster, and everything else worked without the engine ECU.

On the 97+ LS400 it's body, engine, multi display, air con, cluster, tilt and telescopic, front passenger door, rear door lh, rear door rh, power seat, driver's door, moon roof control.

Norbie, I'd be interested in that info too....

Mos.

[wilbo666]

It isn't daisy chain, or not my understanding of daisy chain - it's just a "bus" in mostly a ring formation - as in MPX1 and MPX2 pins are shorted together inside the ECU - but you have to have all the components connected for the bus to be complete. If you remove one component it usually will still work, but if you remove two non-consecutive ECUs it breaks the ring.

On the IS200 it's engine, cluster, air con, body, theft deterrant, double locking, driver's side power window switch. The car still ran without a cluster, and everything else worked without the engine ECU.

On the 97+ LS400 it's body, engine, multi display, air con, cluster, tilt and telescopic, front passenger door, rear door lh, rear door rh, power seat, driver's door, moon roof control.

Norbie, I'd be interested in that info too....

Mos.

I've got a Toyota document that says "The body electrical system uses the BEAN. The ECUs are connected to the gateway ECU like a daisy chain."

I agree tho, it doesn't sound like daisy chain to me either based on what you have told me




Some very handy info there, thanks!

Do you know what happens if you disconnect the ECU from the BEAN network?! (If the car has a theft deterrent ECU this might not work?)

In the IS200 where there is a theft deterrent ECU, does it only need that plugged in to start? What happens if you unplug the theft deterrent ECU when the car is running?

Cheers
Wilbo

[Mos]

I've got a Toyota document that says "The body electrical system uses the BEAN. The ECUs are connected to the gateway ECU like a daisy chain."

That could be a sort of mental shortcut - *like* a daisy chain.

I agree tho, it doesn't sound like daisy chain to me either based on what you have told me

My understanding of a daisy chain is that each connection between two nodes is separate from every other connection - ie node A sends something to node B, node B receives it, processes it and decides if it should send it on to node C. In the toyota MPX setup, any information that any node puts on the bus becomes visible to every other node on the bus. I would call this a bus in a ring format rather than a daisy chain, but then again my understanding of the term "daisy chain" might be flawed.

Some very handy info there, thanks!

No probs, but this isn't even the tip of the iceberg (and it's pretty much all I've got ).

Do you know what happens if you disconnect the ECU from the BEAN network?! (If the car has a theft deterrent ECU this might not work?)

I wish people wouldn't just say "the ECU" .. if you remove the *engine* ECU the remainder of the network appears to function correctly, obviously anything that's related to the engine ECU stops functioning.
For instance, the components that won't work or won't work correctly are:
water temp gauge
ambient temp display
fuel consumption gauge
oil pressure light
oil level light
charge light
fuel level gauge
air con triple pressure switch
air con compressor
auto selector lights
snow and power switches
And unrelated to MPX, traction control, immobiliser, cruise control.

The following things still work:
remote central locking
alarm (theft deterrent)
power windows
defog (air con ECU tells body ECU to turn it on)
etc

Disconnecting the instrument cluster from an otherwise complete system obviously removes all the display functions, but everything else still works.

Disconnecting the MPX pins from the engine ECU I have not tried, but I would expect the same scenario as removing the engine ECU. I would expect the engine to still run, because nothing that the engine ECU receives from the MPX is critical to engine running. Traction control, immobiliser and cruise control would be expected to still work.
Provided the immobiliser components are installed, there's no reason you couldn't run an IS200 engine in a non-MPX car (air con idle up, electrical load idle up, ECT snow and power mode won't work, but the engine will run).

In the IS200 where there is a theft deterrent ECU, does it only need that plugged in to start? What happens if you unplug the theft deterrent ECU when the car is running?

The theft deterrent ECU is not part of the immobiliser - the immobiliser is built into the engine ECU - the engine ECU interrogates the key transponder directly via the key amplifier and key coil. 94-97 LS400s (and other cars) had a separate immobiliser ECU which did the key interrogation and told the engine ECU to mobilise. In the 97+ LS400 this function was built into the engine ECU.
Hmm the door switches are displayed on the immobiliser diagram
(through body ECU and MPX) - wonder why... possibly the key reprogramming needs the door switches, but I'm too lazy to open the other manuals...

Mos.

[wilbo666]

My definition of daisy chain is the same as yours.

e.g.
http://www.maxim-ic.com/appnotes.cfm/an_pk/3947
http://www.users.bigpond.com/pbhanda...l/busdaisy.htm

Anyway I think we are both on the same page to how it works, so that is good (It's a bus ).

No probs, but this isn't even the tip of the iceberg (and it's pretty much all I've got ).

I wish people wouldn't just say "the ECU" .. if you remove the *engine* ECU the remainder of the network appears to function correctly, obviously anything that's related to the engine ECU stops functioning.

Well the *engine* ECU is the main one as far as I'm concerned And the only one I'm really interested in So I was going to refer to ECU by default mean to "engine ECU', and if I was talking about another ECU to describe it correctly... but I'll call it *engine* ECU all the time to make you happy tho

Disconnecting the instrument cluster from an otherwise complete system obviously removes all the display functions, but everything else still works.

Pretty well as expected, the dash would be a read only component of the bus as far as I can see.

Disconnecting the MPX pins from the engine ECU I have not tried, but I would expect the same scenario as removing the engine ECU. I would expect the engine to still run, because nothing that the engine ECU receives from the MPX is critical to engine running. Traction control, immobiliser and cruise control would be expected to still work.

Provided the immobiliser components are installed, there's no reason you couldn't run an IS200 engine in a non-MPX car (air con idle up, electrical load idle up, ECT snow and power mode won't work, but the engine will run).

The key quantifying word in use here is 'expect'! lol

I'm trying to decide if I source a JZS161 ECU for my vvti 2jzgte, or go after market from the get go...

I'll try and make a list of things that I know the JZS161 2jzgte vvti ECU gets via the BEAN, that could actually interest the engine ECU...
>Pwr, ecco, snow auto switch (Body ECU)
>AC On / Off (AC ECU)
>???

None of these look mission critical, and I'd hope the engine ECU wouldn't go into limp mode...but I need / would like to know more I think!

Auto position is done via a switch from the look of the JZS161 diagram, with the engine ECU having P, R, N, D, 3, 2, L inputs. Not that this matters to me as I'll be going manual.

The theft deterrent ECU is not part of the immobiliser - the immobiliser is built into the engine ECU - the engine ECU interrogates the key transponder directly via the key amplifier and key coil. 94-97 LS400s (and other cars) had a separate immobiliser ECU which did the key interrogation and told the engine ECU to mobilise. In the 97+ LS400 this function was built into the engine ECU.
Hmm the door switches are displayed on the immobiliser diagram
(through body ECU and MPX) - wonder why... possibly the key reprogramming needs the door switches, but I'm too lazy to open the other manuals...

Mos.

Now we get to a major area of interest for me!

I've heard talk that JDM engine ECUs don't have immobilisers in the engine ECU, or as part of the system. i.e. The cars will start without 'coded' keys...

This talk came from Draven, JP, and I think someone else talking about 1ZZ's?

But regardless, if I plan for the worst case, which would be the JZS161 engine ECU requiring a coded key, readed etc.


Now, to start with I'm not too sure on the configuration of the Key -> engine ECU immobilise system. i.e. The flow of data from the key to the engine ECU....

The theft deterrent ECU is not part of the immobiliser - the immobiliser is built into the engine ECU - the engine ECU interrogates the key transponder directly via the key amplifier and key coil. 94-97 LS400s (and other cars) had a separate immobiliser ECU which did the key interrogation and told the engine ECU to mobilise. In the 97+ LS400 this function was built into the engine ECU.
Hmm the door switches are displayed on the immobiliser diagram
(through body ECU and MPX) - wonder why... possibly the key reprogramming needs the door switches, but I'm too lazy to open the other manuals...

Mos.

OK, so say there is an immobiliser built into the engine ECU, you say that "the engine ECU interrogates the key transponder directly"...

I don't see any pins on the diagrams I have (madmonts) that relate, or go to a key transponder! This maybe because the JZS161 doesn't have one...or its listed on a diagram I don't have I've found IMDL on a xZZ wiring diagram tho...


Regardless, in engine ECUs that interrogate the key transponder directly-what engine ECU pins do they use to do this? Does the engine ECU simply interrogate the key once-on start up, or periodically?


I've seen mention of door open / close sequences before in regards to reprogramming keys, so that is likely.

Also this website is useful for me:
http://www.automam.net/toyotakey.htm



Another question, does the engine ECU care if the ambient air temperature sensor isn't connected?

Anyway sounds like a JDM ECU wont cause me any immobiliser dramas so that is good!

I might start another thread for my other off topic questions...

Cheers
Wilbo

[Mos]

I'm trying to decide if I source a JZS161 ECU for my vvti 2jzgte, or go after market from the get go...

JZA80 supras didn't have BEAN... Has Draven sold his ECU? I'm pretty sure he's not using it anymore

>Pwr, ecco, snow auto switch (Body ECU)
>AC On / Off (AC ECU)

Power and snow on IS200 go to A/C ECU.

Auto position is done via a switch from the look of the JZS161 diagram, with the engine ECU having P, R, N, D, 3, 2, L inputs. Not that this matters to me as I'll be going manual.

Yep, like IS200 and LS400. MPX used for display on cluster (and maybe other things).

I've heard talk that JDM engine ECUs don't have immobilisers in the engine ECU, or as part of the system. i.e. The cars will start without 'coded' keys...

Yes, general gist is that they don't, but some lucky cars do (like LS400). Check the JDM EPC for the key amplifier - if it doesn't have one it won't have the key immobiliser.

This talk came from Draven, JP, and I think someone else talking about 1ZZ's?

Sideshow

But regardless, if I plan for the worst case, which would be the JZS161 engine ECU requiring a coded key, readed etc.

You'd need the matched key otherwise it will cost to unlock/reprogram.

Now, to start with I'm not too sure on the configuration of the Key -> engine ECU immobilise system. i.e. The flow of data from the key to the engine ECU....

No idea what the flow of data is.

I don't see any pins on the diagrams I have (madmonts) that relate, or go to a key transponder! This maybe because the JZS161 doesn't have one...or its listed on a diagram I don't have I've found IMDL on a xZZ wiring diagram tho...

They're normally listed on the engine diagram, so if it's not there you might be in luck.
Should be IMLD - Immobiliser LED.

Regardless, in engine ECUs that interrogate the key transponder directly-what engine ECU pins do they use to do this?

RXCK, CODE, TXCT between the key amplifier and ECU. +B and GND to key amplifier. KSW to ECU - switches on when key inserted into barrel, disarms immobiliser instantly.

Does the engine ECU simply interrogate the key once-on start up, or periodically?

I don't know for sure, but I would expect that it only checks once prior to start up, given that it disables the immobiliser (as evident by the IMLD) upon key insertion. I don't know if it periodically checks after that.

I've seen mention of door open / close sequences before in regards to reprogramming keys, so that is likely.

It's definitely used for the keyless entry programming but I'm not sure about the immobiliser.
It seems 98-02 doesn't need doors for immobiliser, 02+ does...

Also this website is useful for me:
http://www.automam.net/toyotakey.htm

Hmm, cool, might be worthwhile to open up that 1UZ ecu again

Another question, does the engine ECU care if the ambient air temperature sensor isn't connected?

Not that I can tell.

Anyway sounds like a JDM ECU wont cause me any immobiliser dramas so that is good!

Check JDM EPC as that might surprise you - I made the same hypothesis for the 1UZ....

Mos.

[wilbo666]

JZA80 supras didn't have BEAN... Has Draven sold his ECU? I'm pretty sure he's not using it anymore

This was the first thing that came to my mind ages ago

He sold it...

He did mention that you had wiring diagrams for JZA80 tho that you could send me... (he hasn't found them again yet I don't think ).

Emanage shows the same direct cable harness for JZS161 and JZA80 vvti so from that a JZA80 engine ECU should work. And then I can then get a manual engine ECU too!

So a JZA80 VVTi 6spd engine ECU would be lovely, but they don't seem to come up anywhere near as often as JZA161 (In fact I haven't even seen 1 JZA80 VVTI 6spd ECU come up on yahoo...)

I didn't realise that JZA80 VVTi didn't have BEAN...

madmont has scanned some more pages from the wiring book for me so I'll have a look at them! (I really, really need to thank him, he has been a great help!)
--> Update, had a quick look at madmonts other diagrams.. doesn't look good I'm afraid.

Yes, general gist is that they don't, but some lucky cars do (like LS400). Check the JDM EPC for the key amplifier - if it doesn't have one it won't have the key immobiliser.

As above, JZS161 looks to have immobiliser...

You'd need the matched key otherwise it will cost to unlock/reprogram.

Going off that website that shows the serial EEPROM IC, I like to look into loading a known key into that, and faking the input signal. The parts to reverse engineer is the main problem

RXCK, CODE, TXCT between the key amplifier and ECU. +B and GND to key amplifier. KSW to ECU - switches on when key inserted into barrel, disarms immobiliser instantly.

Ta.

I don't know for sure, but I would expect that it only checks once prior to start up, given that it disables the immobiliser (as evident by the IMLD) upon key insertion. I don't know if it periodically checks after that.

Maybe I need to use this as an excuse to by an IS200 or something? Or find someone to check things like this

Cheers
Wilbo

[cambelt]

Find me a JZA 80 auto in melb to plug my JZS161 engine ECU and i,ll tell you if it has security .
Dave

[wilbo666]

Well had a bit of a chance to have a closer look at it...

0007-0204 and 0204- have Amplifier, Key Transponder.

Pre 0007 doesn't

All the engine ECUs that seems to come up on yahoo jp are pre 2000-07 so that is OK

Cheers
Wilbo

[cambelt]

MyJZS 161 engine ECU no is 89666-30180 , Im not sure what year it is tho .
Dave

[wilbo666]

MyJZS 161 engine ECU no is 89666-30180 , Im not sure what year it is tho .
Dave

That engine ECU is JZS161 0007-

So by the looks of it will have an engine immobiliser built into it...

Cheers
Wilbo

[cambelt]

Maybe so , if i get a chance i will plug it into my manual VVti engine and see if it starts ,
Just found the date is 3/2001 .
I,ll pull the cover off it but do you have the mpx 1 and 2 pinouts handy
I will check if they go anywhere inside
Dave