Hey all. I have a P0325 code that has been pestering me for weeks now with absolutely no end in sight. To give a very quick recap;
-Started with P0171 and sometimes P0420
-Changed my MAF sensor, code switched to P0325
-Spliced my knock harness together to go around the code; code is still thrown
-Replaced the harness altogether. Nothing.
-Replaced BOTH knock sensors and double-checked the harness wasn't pinched. No luck. (even though one of the sensors was shot)
-check the knock sensors with an oscilloscope to ensure they are functioning.
-Replaced my ECU with a fresh unit. Didn't make a difference.
(everything was replaced with OEM Denso parts)
Anybody have any guesses as to what it could possibly be? My next guess is there's a gremlin in the ECU harness, which in that case I'll just send this limp-mode POS to the crusher.

Edit: '00 SR5 auto @ 283k, specifically

Well you've replaced all the items the FSM would indicate. There aren't many things listed, just open, short between right side sensor to ecm and the parts themselves.

Checked for continuity on the new wire? (gremlin)

Assuming ecm was reset with a 30 min or so disconnect from batt?

Engine starts, idles OK despite full timing retardation?

Assuming you mean continuity in the harness, I have not. If you mean the wire running from the harness to the ECU, I'm currently trying to find a pinout to show me which lead that would be and on which pin it ends up, but seemingly the only one in existence is that 1998 pinout which is vastly different than both ECU's I'm in possession of currently - for example the only plug they have in common is E11, which is an empty spot for me
Battery was disconnected during the entirety of the install - was the first thing I did before I was even ready to work and was forgotten about while attempting to turn over the engine (oops). Overall left disconnected for much longer than 30 mins.
Engine is very long to turn over (3-4 seconds) and idles high at nearly 2000RPM. When cleared it starts right up and idles at maybe 600RPM. Fuel economy is abysmal, too.

Edit: the ECU i swapped in has part number 89666-35140 whereas my OEM one is 89666-35170. Not sure what the exact difference is, if any at all, but thought I should note it.

Re the oscilloscope: do you know if the wavelength you were seeing was the correct or proper one?

I had one once in a Silverado that was a BWD replacement that on the scope produced a wavelength but the output signal was too long, and ended up throwing two knock sensor codes. A new AC Delco one was installed and all was then good to go.

I actually do not now that you mention it, at the time we were getting A wavelength but it dawned on us we didn't check what we should be looking for, and called that good enough and proceeded to continue reassembling before it got dark. That's really interesting and helpful information, thank you, I'll think on that

Just found my TSM which has the oscope info in there, gonna start testing and probing around tomorrow. Fun stuff!

Just got done checking and the wavelengths looks totally fine compared to the TSM, and were reading roughly 8-9kHz at 3500-4000rpm (compared to the stated ~7kHz @ 4000rpm in the manual, so pretty spot on). Also checked continuity between the sensors, the harness, and from the harness to the ECU - no shorts or impedance found anywhere. On the offchance there is a nominal amount of carbon build up in the cylinders that's messing with things, I went ahead and put a bottle of Gumout multi system in my tank - also plan on getting some electrical cleaner tomorrow since the plug to the harness IS pretty dirty

What was truly strange is when testing the waveforms, the CEL turned off at some point, which doesn't make much sense seeing as the knock sensor harness was disconnected from the ECU and should've thrown a code as a result - what's DOUBLE strange is it stayed off while I drove to the gas station, but once I filled up and turned my car on, the code came back within the first 10 seconds of idle as opposed to when the car reaches a certain RPM range

Truly the definition of a gremlin, and one that does not want to be caught

So the ECM was seeing the signal from the knock sensors even though the harness was unplugged?

How dirty is the throttle body?

I'm not exactly sure, neither of us noticed the CEL went out until we unplugged the oscope/reconnected the harnesses and went to turn the car off. Whether or not it was out while the signal was broken is beyond me (I highly doubt it but who knows), but the code was definitely present prior to testing. Either way, I tried to replicate it again with no luck. Throttle body is sparking clean; cleaned the TB, plenum and manifold when I had them apart. It was filthy as hell originally. Used some MAF cleaner (just compressed iso) to clean off the connections between harnesses and no dice either. Only thing I haven't cleaned is the MAF itself, but that's because it was replaced with a freshly sealed unit 2-3 weeks ago when this whole debacle started. I know they're partial to P0171, but will they cause P0325? Willing to try damn near anything at this point.

For what it's worth I used Matsu knock sensors instead of Denso like most people, but the ones that came out were 100% indentical and looked nothing like the Denso ones (lacked the grey polymer piece with the logo)

If you have the old MAF sensor, or can get ahold of a known good working one, I would start there and see what happens. As my mechanic friend says, today there are good knock off parts and then there are bad ones. Do all the pids for live data with the MAF look ok?

I personally have never changed the knock sensors in the 4Runner but have on a Lexus RX300. New sensors and harness but still was getting the PO325. Known for having a dirty TB and IAC, I cleaned both along with the MAF and the code hasn’t come back in seven years.

I doubt it is the sensors if they tested correctly, nor the harness.

Have a new IAC and MAF coming in the mail, currently. Now that I recall, the IAC wasn't removed to be cleaned and I'm sure it's properly ****ed up like the rest of the TB was. I was just gonna buy a gasket and clean the preexisting one, but since you can order them online for 50-75% of what NAPA charges I figured why not. Old MAF was thrown out long ago unfortunately. Debating tackling O2 sensors just so that's off the table as well, but I've thrown out nearly $1000 tackling this issue already.

That is a lot of money for the parts cannon. IACs for Yotas can be real finicky once they get dirty.

Per the O2 sensors: my sister’s best friend drove a 06 Highlander with the 2.4 in it. It would throw the money light on now and then. Called for the ECU to be replaced. The stealership replaced the ECU and upstream 02 sensor to the tune of $1850. Money light came back on. After another $1000 spent at the dealer, she asked me to look at it. Nothing consistent in different freeze frame data times. Turns out that just by moving the rear 02 sensor wire after at least one drive cycle, it would die, then come back to life. Replaced it with a Denso and all was good.

How are the fuel trims, especially long term?

Terminal 14 and 15 on your E7 plug are the knock sensors. What do you mean when you say you spliced the harness together? The knock signal is just one wire, other conductors in it are grounded shielding. Unless Toyota changed something for the 3rd gens vs all earlier models, which I doubt, the knock code is only thrown when your ECU isn't receiving a signal, not when you engine is knocking. If this is still the case as I would strongly suspect, nothing that would potentially cause a knock would have any effect as it's strictly an electrical issue. Would be a good idea to confirm that one way or the other before potentially wasting time on MAF sensor etc.

You replaced the harness, including both plugs with new? My first though with intermittent real world continuity but positive bench continuity would be that the terminals in one of your plugs loosened or corroded and you're not getting a good connection.

Attached Images

 

Toyotas came off the factory floors with the Matsu knock sensors so you picked the OEM brand. DENSO started making the sensors later for other models, which also happen to work for the 5VZ-FE. I currently have NGK knock sensors since they were 1/3 of the price...

After reading this, you've got a wiring gremlin, that's my conclusion. You don't need a wiring diagram though, just match the wire colors. Pull back the sheathing on the ECU side of the pigtail connector and make note of the two colors and stripes. Then go to your ECU and find the plug with those two colored wires, unplug them, and use a multimeter to test resistance in the wires. You will probably need to buy some longer probe wires though to go from ECU plugs to engine bay.

Also, not sure if this was mentioned but re-do all your grounds. That means removing the ground wires, sanding or scrubbing the metal until it is bare (that also means stripping off the paint if it's a painted surface) and then clean it up with rubbing alcohol or similar degreaser. The ones to do are ECU ground, Battery negative cable to fender, Diagnostic port to upper intake manifold ground (in the engine bay), and Passenger cylinder head to firewall ground.

According to the 2000 SR5 TSM it's pins 27 and 28 at terminal E9 - those plugs don't match the TSM or either of my ECUs whatsoever. We tested continuity with everything installation and it checks out. Yes, everything was replaced with new OEM units
As for the splice YouTube
I'll have to check and get back to you
I've already taken a multimeter to it like you've suggested but I took your advice on cleaning the grounds. My only problem is, where is this damn ECU ground?? Can't find it for the life of me. While I was poking around I did find a disconnected vacuum line...