FZJ80 won't start - help!

[sbman]

The thing with the late 90's early 2000's vehicles is that they contain just enough electronics that servicing them becomes impossible without factory documentation, or finding someone that knows them inside and out which becomes increasingly difficult. At least they aren't so bad like the modern cars where you can't do much of anything without a wiring diagram, a special diagnostic computer, and technical skills to run all of that. If this is a vehicle you want to keep long term, you'll want to find those manuals.

The dealer should be able to get them for you, or tell you where to get them. HOWEVER. I've been on the 'notify' list for an EWD from Helm (the official source for Toyota manuals in the U.S.) for my 97 FZJ 80 for 3 years, simply can't get one. I've scrounged a few various ones off the internet in PDF format but really want to have the real thing. It simply isn't available.

If you do manage to find factory manuals through any source, PM me as I'd love to acquire copies of at least the systems that are unique to your model.

 

[Paul D63]

Well... just as I was beginning to think this thread was as dead as my truck, my 80 lives!!! YEEEHAAA!!!

I'm still in the tunnel as yet, but a lot closer to the end now, and at least the light I can see from here isn't simply from the headlights of an oncoming train!

For those that may be interested, I'll relate what's happened since my last post. Without access to any meaningful info on the immobiliser system, it looked like my only realistic options were either: A) find an expert on these models and pay them to figure out what's going on, or; B) find some known-to-be-working immobiliser parts and swap them into my truck to establish once and for all if the immobiliser is indeed my problem.

Well, I didn't fancy 'A', because, apart from the money aspect, it's admitting defeat isn't it? I hate being beaten by inanimate objects. Also, experts on the 80 Series (especially the petrol model) are seemingly pretty rare in these parts.

So, 'B' it was then. Now all I had to do was find those parts - no easy feat in itself when you consider the 24V 4.5 petrol LC was only sold here for around three years ('95 - '98). And during that period, diesels probably outsold petrols by at least three to one simply due to the cost of fuel here and a petrol 80 doing less than 20 to the gallon. So, they're not exactly commonplace - of the handful of 80s I still see regularly in my local area, I think they're all diesels.

An eBay search revealed one immobiliser ECU, but with no matched key, and other than that, nothing. Then I thought of a local company that prepares 4x4s for off-roading, and I remembered that they have stripped a few 80s for parts over the years, so as they're only about five miles away, I took a trip over on the off-chance. And lady luck smiled on me (about time!), as they had an old off-road racer based on a '96 petrol 80 that has been sitting there for some time - and I was welcome to remove whatever parts I needed to try them on mine. So I took the immobiliser ECU, the transponder coil + amplifier and also his matching transponder key.

Returned home and connected them all on my truck. I didn't fit the coil around the ignition barrel, but left it hanging so I could insert the matching key into it whilst using my non-chip key to crank the engine. And, as you've all probably guessed by my opening line, the truck fired up first time and kept running. I left it running for a few minutes while I had a dance around the yard! Switched off and tried again - fired up again no problem. So I took the opportunity to move it up to my workshop in readiness for work to begin. Very kindly, the owner of the borrowed parts said I can keep them until I get to the bottom of what's wrong with my own parts - which means I can keep the truck mobile now should I need to move it again.

So, it was my immobiliser at fault all along. I'd like to thank all those who stuck with it over the last week or so - without your support, I think I'd probably still be fumbling around wondering what to check next. And a gold star to everyone who supported me in my belief that it was indeed immobiliser related - without others willing to believe it could have been that, I may well have gone off up several blind alleys looking for other faults.

Of course, I'm not out of the woods yet, as now I have to try and figure out exactly which component of my original system is the culprit. But at least I know that it can only be one of four things:

1) Faulty transponder coil.
2) Faulty coil amplifier.
3) Faulty immobiliser ECU.
4) The locksmith f***ed up the new key or didn't synchronise it with the ECU correctly.

As I don't really believe in coincidences very often, then I tend to think it's unlikely that a part on my truck has failed at the same time as my transponder key died, so this makes me tend to think that #4 may end up being the answer. I'm assuming the transponder coil & amp aren't coded to the key, as it would be a bit redundant to have a system that required the key to be recognised by both the coil/amp AND the ECU wouldn't it? Unless they do that to provide another layer of security? But surely the locksmith would at least have known that much if that was the case, as surely he's had to make keys for other Toyotas of this period that use the same basic system, and if he had, none of them would have worked if the coil/amp needed re-coding as well and he didn't do that. Anyway, I'm going to swap my original coil & amp back into the truck, one at a time, and see if it still starts OK. If it does, then that obviously rules them out as the culprit, leaving only #3 or #4. At that point, it get's trickier, because I can't test the key or ECU without the specialist knowledge & equipment, and it's a bit awkward to go back to the locksmith and accuse him of getting it wrong, when it's possible my ECU is the culprit.

Going to have to give that one some thought...

 

[flintknapper]

Please provide follow ups as you make further progress. It's got to feel pretty good at this juncture...just having it start and run.

 

[Paul D63]

It's got to feel pretty good at this juncture...just having it start and run.

That's an understatement! I was well chuffed, if that makes sense over there? Extremely pleased, shall we say.

I will, of course, update my findings once I get to the bottom of exactly what was the culprit - may help someone else in the future.

 

[cruiserdan]

OK then, progress.

In theory the transponder coil and amplifier should not care what they are hooked up to. My guess is the "married" components are the key and the ECU. Try putting back your original components, one at a time, (as you have outlined) and see when it quits.

 

[sbman]

Well... just as I was beginning to think this thread was as dead as my truck, my 80 lives!!! YEEEHAAA!!! ....

That's great! I'll be really interested to see what the final result is with this. I'd lean towards #4 also, seems like your original transponder key died for whatever reason (I wonder if a clothes dryer could kill them?) and the locksmith didn't get the replacement key programmed up as well as he believed. That, or your immobilizer parts died at the same time as the key which does seem unlikely.

I've done some more research on these types of immobilizers and the company ILCO makes a type 4 transponder key duplicator, as well as programmable keys. I'm sure there are others that make them as well. So basically the locksmith could read your original key, get the code and make a duplicate. This type of device didn't exist as far as I know back in '96 and programmable keys didn't exist then either. In your situation, since your key is dead, you'd need to be able to read the stored code out of the immobilizer ECU and then create a duplicate key matching that code. I believe there are systems that will do that as well.

This has been a really interesting thread!

 

[Paul D63]

Some more developments today. As Cruiserdan suggested, and I was in agreement, neither the transponder coil nor the amplifier are coded. First of all, I removed the borrowed coil and refitted my original one - still started and ran fine. Next, did the same with the amp - still ran.

So now we know the fault has to lie with either my ECU or the new key. I'm still leaning towards the key, as sbman said, because I'm still not ready to buy the coincidence idea. It does seem very unlikely to me that I would have two simultaneous faults within the immobiliser system. This is a Land Cruiser after all, not a Range Rover!

To that end, I've been back to the locksmith today to see if they have any ideas. When I told them that it fired up no problem with the borrowed parts, they seemed open to the idea that possibly their key wasn't working, and after doing a little research, they discovered that there are three different formats to which the chip in the key can be programmed. They reprogrammed the key with the second possibility, which still didn't start the engine, and sadly, neither did the third! They've been pretty much OK about it so far, but I can't say too much because there is always the possibility that my ECU is at fault. The question is: how the hell do I find out?

sbman - yes, what you said seems to be the case, insofar as I had to take the ECU to the locksmith and he opened it up and read a chip inside which gave him the info he needed to program a key to suit. He said that nothing inside the ECU is changed or altered, they simply read the chip. By the way, that photo you posted of an immobiliser ECU is, I believe, the actual item that I've found for sale on eBay here, as it looks like the same photo. The problem is - even though I can buy it for £40, which isn't too bad - as it comes without a paired key, it doesn't really get me any closer to a solution, because if the locksmith can't pair a key with my ECU (assuming it is OK), then he won't be able to pair one with any other ECU either. So this would only work if my ECU was bad, but I'd have to buy it to find out.

I have thought of another, definitive way to prove if it's the key or the ECU once and for all, but the locksmith won't like it! But as he said that he doesn't change any of the settings in the ECU, and as I have a known-to-be-working ECU, then I could ask him to program another chip to the known good ECU, without altering anything that would prevent it from working on the original vehicle (with the original key) from which I borrowed it. Then, if my truck still starts with the borrowed key that matches that ECU, but won't start with his key, this surely proves beyond any doubt that it's his keys that aren't communicating with the ECU, for whatever reason. But that could prove to be a little awkward if that's how it pans out...

 

[sbman]

Yes, the chip inside of the immobilizer is called an EEPROM. There are entire forums/sites dedicated to immobilizers and how to read/write/decode the contents of those and produce working key/ECU combinations using special tools that are generally available from electronic hobbyist shops.

Your theory on having the locksmith produce a key for the known good ECU seems sound and should tell you if he is actually able to produce a key with his tools. If he is, then an ebay replacement and key reprogram should finish the job for you. There is of course somewhat of a risk that his process could damage the known good ECU which might put you in a bit of a bind since it seems you'll need to return that ECU and key to it's owner.

Can you post a good picture of the inside of the 'bad' immobilzier ECU? I'd like to see what chips are in it. Also, if you can point out which chip he was reading if you know or not.

The interesting thing to me is that the immobilizer ECU isn't paired with the EFI computer and you are able to swap it freely. That surprises me. It leads me to believe that the a fake immobilizer ECU could be created and put into place to bypass the entire system, however that depends on exactly what kind of communications happen between the two. It could be something as simple as a 'relay type' connection that just opens/closes all the way up to a two way, encrypted conversation over multiple data paths. If I had the time and a truck with the hardware, this would be an fun task to take up and get the dust off my logic analyzer and firmware programming skills.

 

[Paul D63]

There is of course somewhat of a risk that his process could damage the known good ECU which might put you in a bit of a bind since it seems you'll need to return that ECU and key to it's owner.

Yes, that's what worries me. He assures me that nothing he does alters anything inside the ECU, and that he simply reads the chip. I saw the tool he used to read the chip - it just looks to piggy-back onto the chip and connect to its pins. I do know which chip he read, and I'll post a photo of the inside of the ECU and point it out to you tomorrow.

But that's the nightmare scenario I'm worried about: if I let him have a go at the other ECU, and afterwards it no longer runs from that one either, then I've got real problems - not least of all having to explain to the owner of borrowed parts that they no longer work!

 

[Paul D63]

Thinking about that previous post... maybe it's not such a good idea to let him near the borrowed ECU. If you think there's a chance something he's doing could be causing my problems, then I certainly don't want to let him do the same thing second time around. At least, as things stand, I can start my truck on the borrowed parts to move it in or out of my workshop, and I definitely don't want to return to the situation where I can't get it to run, apart from the complications of having to have 'that conversation' with the guy I borrowed the parts from.

So I think maybe I'm leaning towards seeing what else he comes up with to try (but without letting him at the second ECU), and if that comes to nothing, then maybe I'll have to get the specialist automotive locksmith involved. When I spoke to him last week, he did tell me I was wasting my time with an ordinary locksmith for this particular problem. Perhaps he was right? Maybe I should have listened to him, but I knew it would be quicker (and cheaper) if the local guy could sort it, so I thought it was worth a try. If I have to call the specialist out to look at it at my place, it will probably cost at least double, possibly more.

 

[sbman]

Once I see what chip he is connecting to, I can tell you a little more. It's possible that it's a read only ROM that can't be changed. I'll need to be able to read the part number printed on it.

 

[cruiserdan]

My experience with the early immobilizer systems is that if you do not have an already recognized master key the ECU needs to be replaced.

If you can't keep the borrowed ECU you may need to buy a new one.

 

[Paul D63]

sbman - photo of the ECU internals below. This is the borrowed one, but I imagine they're identical from a hardware perspective, the only difference being how the chip is programmed? The chip he read was the one in position 'IC2' on the board, the one to the top left of the much larger chip at 'IC1'.

The numbers on it, should they not be clear, are:

93LC66
I/P SEW
9545

cruiserdan - if what you said is true about the absence of a master key meaning a new ECU is needed, then I'm screwed again aren't I? Yet I hear stories of people who've lost keys being able to get sorted with the aid of a specialist. Or maybe that's only on later models? But I tend to think there must be people out there with the knowledge to find a solution to such problems. If another key can be made from a master, then surely there's a way to make a key without a master if you know what parameters the master was made to? Maybe I'm over-simplifying things?

 

[cruiserdan]

I can only speak from my experience as a Toyota Dealer Parts Manager. Regarding early immobilizer vehicles if no recognized master keys were available the ECU had to be replaced.

 

[sbman]

sbman - photo of the ECU internals below. This is the borrowed one, but I imagine they're identical from a hardware perspective, the only difference being how the chip is programmed? The chip he read was the one in position 'IC2' on the board, the one to the top left of the much larger chip at 'IC1'.

The numbers on it, should they not be clear, are:

93LC66
I/P SEW
9545

View attachment 2153740

IC1 is the main CPU chip (single chip computer) and it may be a specialty part made for/by the immobilizer company so no documents available on it of course, they keep it mysterious on purpose. IC2 is an EEPROM that is read/write memory storage, intended to be semi permanent and it is where the key codes are stored. IC3 looks to be the RF chip that handles energizing the coil and reading signals from it through the 'amplifier'. The item TR15 is probably related to that as well. The rest of the parts are various basic electrical parts for circuit protection and hardening against the automotive environment. The blue one X11? is a crystal oscillator, probably for the CPU's master clock.

If you search 93C66 key programmer on google, you'll get a lot of hits, such as this one, and many others.:

How to use Toyota 4D G chip key programmer

As for official Toyota support, @cruiserdan is of course correct. The Toyota sanctioned fix for this is to buy a new immobilizer ECU with a key already paired up. Toyota never offered any support for reprogramming the 'master key' or reflashing the immobilzer ECU, only the aftermarket took up that cause. The issue isn't the technology can't do it, it's Toyota saying no. On the cars with this system built into the EFI computer, you have to replace the entire EFI computer.

The aftermarket didn't accept this and figured out how to read (and write) the little EEPROM chips in both the stand alone and integrated immobilizers. As each new system has come online, the aftermarket has created solutions to duplicate keys, fix/change/flash ECUs and generally get around it all.

As for getting a new key for your existing immobilizer, that is going to come down to the tools and skills that your locksmith has. I tend to doubt the ECU is bad. It's possible but seems unlikely to me, I think your key just went bad for whatever reason. I don't know that I'd want to have the locksmith that has failed to make a key multiple times have a go with the working ECU/Key system, since the EEPROM IS a read/write device, it is possible that if he doesn't know what he is doing and his tool is capable of writing that he could brick that system.

OK. So here's what I would do, if all this was in my hands.

1. Ask this existing locksmith if he can duplicate the transponder key, from the working KEY.... NOT from the working ECU. Have him try that and if he succeeds, that's great! If he fails, find another locksmith until you find one that can do it. Now you have two working keys that both work with the one working ECU, with one of them physically cut for your lock cylinder.
2. Next I'd buy an EEPROM programmer device for my computer. USB E-Eprom programmer - 24xx, 93xx, 25xx, 95xx eeproms for $20 although I might have one around here somewhere....
3. For each of the next two steps, I would de-solder the EEPROM chips from their ECU circuit boards. This ensures that I don't damage the other circuits on the immobilizer and that I get clean reads/writes from the EEPROM chips. This requires a certain level of skill and tools to do so without damage.
4. Now, I'd wire up the programmer to the working ECU's EEPROM and read the data out of it, getting a complete image of it's data and save that to my computer. Solder the EEPROM back into place. This gives me an image of the working ECU on my computer.
5. Finally, I'd wire up the programmer to the 'dead' ECU's EEPROM and flash the image onto it that I saved in the previous step. Then read it to verify it. Solder it back in place.

By doing all that, I've effectively duplicated the 'working' immobilizer and both trucks use the same transponder code. I'd finish off with getting another duplicate transponder key made that is cut for my truck so I have a spare, because this whole scenario sucks and I wouldn't want to repeat it. I understand if that series of steps isn't something you'd want to do, but it's what the super expensive 'key programmers' are doing sort of automatically. I have a background in MCU programming and electronics assembly / testing and troubleshooting so I'd be comfortable doing it and if it didn't work, only the effort is lost.

EDIT: I think on newer vehicles the immobilizer can be reset through the OBD2 port with special dealer tools not sure though.

 

[Paul D63]

Wow! That is a very comprehensive post, and I really do appreciate you taking the time with this.

I kind of understand the theory of what you're talking about there, but I'm not confident of my ability to successfully carry out that process. Those pins on the chip are pretty small, and with the soldering equipment I have, I wouldn't be confident of getting them soldered back in individually without either dry joints or shorting one or more of them together. I've also never erased or programmed a chip before, so I'd be a total beginner with that, and my guess is that I'd probably need plenty of hand-holding throughout the operation to have much chance of success!

I did think about having the locksmith copy the existing (borrowed) key onto a chip and putting that in the key he's already made for the original ECU. If that worked, then, as you say, I would have a key that could start my truck both physically and electronically. But it would only prove to me that the locksmith can copy an existing key - it still doesn't tell us if he has the knowledge to make a key from scratch when no working key exists. Also, would this only work if the borrowed key is the master? I don't know if it is, and also don't know how to tell.

Something I don't really understand is what differs between making a key from the ECU and making one from an existing key. Isn't it the case that, if you're making a key when only the ECU is available, you're probing the chip to find out what signal it expects from the key? Whereas, when making a key from an existing key, you're probing the key to see what signal it's sending to the ECU? So isn't it really the same thing, but looked at from different perspectives? You're either looking at what one part is expecting to receive, or you're looking at what the other part is transmitting. Or is it the case that, when you only have the ECU, there may be more to discovering exactly what it expects to see from the key, or how it expects it to be transmitted, whereas if you have a working key, it's much simpler to just scan its transmission and simply copy that to another chip?

We're getting into areas I don't really understand here, so excuse my ignorance! Give me something I can take apart and figure out how it works and I'm fine...

 

[sbman]

The type 4 key contains a 128 bit numeric value, just a big number. Duplicating it only involves reading the number and then writing that same number into a new key. Programmable keys didn't exist as far as I know when the original transponder systems were created, they were set at the factory and had no ability to write them after that. That has obviously changed since then.

Making a key from the ECU requires reading the code out of the EEPROM chip and the coding the number you find into the new, programmable key. There are several ways to store the code, and it can be put in different locations depending on how the software in the immobilizer works. The EEPROM will contain values for multiple keys. The device the locksmith is using would need to know exactly what part of the memory in the EEPROM holds the key value and what format it is stored in. If the device isn't reading the EEPROM correctly or is looking in the wrong place or the surrounding circuitry is interfering with the reading process.... there are a lot of variables to it. Basically if the locksmith's tool is assuming that it's the same as some other toyota immobilizer, and it happens that it's not, then it won't work but you won't be able to tell until you try the key. It's possible its the same as others, but it might not be. This same EEPROM chip was used in lots of immobilizers., and I'm sure they don't all use the same identical software to store the key values, in fact we know they aren't all the same as the locksmith has already tried three different methods.

The scheme I outlined above doesn't care about the specifics, it duplicates the entire chip so nothing is missed and you don't have to know where the key is stored or what format it was. It's more like taking a photo of it and then etching the photo into the other device so it's the exact same. It's very possible it can be read without removing it, but there's no way to know if injecting the signals to do so might damage the other parts on the circuit board. The locksmith seemed to think it would work OK reading it in place and maybe that's common place when working with the immobilizers, but I would personally not do that on a device that is so hard to replace if it gets damaged.

You are correct that you need specialist soldering equipment to remove an I.C. without damage. The very minimum is a good temperature regulated solder station with flux and wick. Some experience helps too. A hot air gun works well for surface mount chips and is mostly necessary for them, but I'd be using a good pencil iron in this case. You need to be careful not to overheat stuff.

If you have the key duplicated it should work the same as the existing key, master or not. The master concept with the immobilizer is simply which key was stored first. You were allowed to have some extra keys that could be added to the system later, as long as you had the master key to enable the system.

 

[sbman]

Also, if I did all of the above, I"d probably put sockets to plug the chip into the immobilizers instead of soldering them directly into place, just in case I had to do some of that work again in the future.

 

[BILT4ME]

Also, if I did all of the above, I"d probably put sockets to plug the chip into the immobilizers instead of soldering them directly into place, just in case I had to do some of that work again in the future.

I, too, am.ignorant, but wanted to ask a similar question as before, based on the previous post you made.

If the EEPROM chip is read/write capable, can you write to it to accept no signal? Basically bypassing it internally through programming.

Otherwise, can you rewrite it to match the new ECU, but I guess you'd have to take apart both to attempt that.... Not a good scenario.

 

[sbman]

I, too, am.ignorant, but wanted to ask a similar question as before, based on the previous post you made.

If the EEPROM chip is read/write capable, can you write to it to accept no signal? Basically bypassing it internally through programming.

Otherwise, can you rewrite it to match the new ECU, but I guess you'd have to take apart both to attempt that.... Not a good scenario.

You could write all zeros, but that won't change the functionality, it would just be looking for a key that was programmed with all zeros and that might not even be a valid number to use.

The operational workings are in computer code that is stored in the main CPU. I do think it would be possible to replace the entire unit with a 'fake' unit that didn't connect to a key at all and just told the EFI computer that all is well, keep running. However, this would require reverse engineering the communications between the immobilizer and the EFI computer which ranges from fairly simple to incredibly complex or even impossible.

I didn't understand what you meant about matching the new ECU? What I proposed above is basically duplicating the key codes in the working ECU into the non working one, that should be possible, but it does involve messing with the working one and running the risk of damaging it.

A new ECU with three keys and an ignition lock cylinder was part number 89703-60020 and listed for 424 euros. I'm not even sure this part is available from Toyota any longer.