Class Participation Time!

[BlackWorksInc]

So today I figured I'd do something a little different for you guys. This is a vehicle we have in the shop at the moment that I am working on, just to give you an idea of some of the weird stuff that I see as a technician. I will update the thread later with how I approached the vehicle (and hopefully fixed it, as I'm still working on it); right now I just wanted to leave this as a sort of "case study" for people to play technician and post how they'd go about diagnosing the vehicle.

Think of it as a thought experiment to hone your thought process towards diagnosis and repair of a vehicle. The thread is open to everyone and there are no wrong answers, its more or less just a thought experiment to let people pretend to be a technician and develop their diagnostic skills in a no risk environment.

Here's the http://www.toyota-4runner.org/4th-gen-t4rs/132953-toolbox-how-use.html in case you want to read through that.

2008 Toyota 4Runner 1GR-FE 2WD

Story:
Customer purchased vehicle from Toyota Dealership in Anaheim with VSC & Traction warning lamps on; requests diagnosis of issue.

Notes:

~DTCs were found in ABS/VSC/TRAC module as follows:

C1203- Engine Control System Communication Circuit [Current DTC]
C1336- Zero Point Calibration Learned Value Undone [Current DTC]
C1340- Open Center Differential Lock Signal Circuit (During Center Differential Lock On) [Current DTC]​

~DTCs will not clear via TIS Techstream 2.0 scantool and remain "Current" (meaning the problems are happening right now.)

~No TSB (Technical Service Bulletins) and/or Recalls for this condition can be found.

~BST (Brake Safety Technology) Recall has been performed on this vehicle.

~A KARR Brand aftermarket alarm system is wired into the vehicle under the driver's side dash.

~Aside from the Alarm System, the vehicle is stock

Vehicle History:

-Used Vehicle inspection, VSC & Trac lights were on at time of inspection and vehicle was sold with lights on to current owner

-Minor maintenance on vehicle history (has about 55k on it right now)

-BST recall was performed on the vehicle 1 month prior to this visit

 

[BlackWorksInc]

Its been very interesting to see everyone's unique approaches to diagnosis and critical thinking. So I think I'll share with you guys finally what my approach was to this vehicle and where I ultimately ended up. I will warn you though, the following is a bit technical and I wish I had pictures to post for it; but I wasn't able to. I won't blame you if you skip the technical story below and I even put a simplified bullet-point list for those "TL;DR" people.

WARNING! TECHNICAL NERDY CRAP BELOW!

After pulling the DTCs I did the easy stuff first, I tried to perform a Zero Point Calibration on the vehicle; unfortunately the system will not let you perform a ZPC until the other DTCs in the Skid Control ECU are cleared. I then tried resetting the memory of the Skid Control ECU via the Techstream which also resulted in no change, this was followed by a forced hard reset by disconnecting the battery for about 10-20minutes while I took a break to gather my thoughts. After all the easy stuff that didn't take any effort was exhausted I got authorization from the customer to remove the alarm system and recheck the vehicle to see if that corrected the issue (it didn't but its a KARR brand system, so I did the customer a favor there.)

The service history on the vehicle shows that the dealership who did the BST was aware of the issue (this is the same dealership that did the vehicle inspection and sold it to the customer.) My first thought was that somehow the previous technician had installed a 4WD ECM flash instead of a 2WD flash, cross referencing the calibration IDs showed that the vehicle had the correct ECM flash for a 2WD vehicle. At this point I chose to focus on the C1203-Engine Control System Communication Circuit, because it was a data communication error and there was a slim chance it could have contributed to the C1340-Open in CDL Signal Circuit (During CDL On) issue.

A quick look on TIS showed that the C1203 is set when there is too great a variation in the data packet sent from the ECM to the Skid Control ECU. The easiest example I can make is Person A saying to Person B, "Hello;" but when Person B hears the word, it sounds like, "Hallo." Essentially there's scrambling going on between what the ECM is saying and what is actually being read by/reaching the Skid Control ECU. So I decided to start by verifying that the CAN Bus is functioning correctly.

Now Toyota likes to set their ABS/VSC/TRAC related items on their own CAN Bus network that is separate from the rest of the vehicle except for the ECM. This is partially why a generic OBDII code reader/scantool typically cannot communicate with ABS on Toyotas, because its actually on an entirely separate network and thus separate pins on the OBDII connector. Toyota actually has a resistance check for their CAN lines. If you did a resistance check with the key off, from CAN-Hi to Can-Lo it should read 60ohm if its good and 120ohm if the circuit is open. There's also some checks to determine if the communication lines are shorted to ground or power, which I also performed and found to be okay. At this point I've determined that the CAN Bus communications lines are in good working condition (if there was too much resistance and/or anomalies it could explain the "data scrambling" that the C1203 DTC indicates) and am now pointed towards a potential module issue; I decided to look at the ECM because the C1203 is set because data coming FROM the ECM has too much variation. A quick check to determine if the ECM is correctly communicating with the Skid Control ECU is to simply create a DTC; which is what I did when I disconnected the MAF sensor. This created two DTCs a P0102 (MAF low-input voltage) and a C1201 (this is the DTC that disables the VSC/TRAC when the MIL is turned on.) I then plugged the MAF back in and was able to clear the DTCs I created, but not the original C1203,C1336, C1340; this meant that the ECM and Skid Control ECU were communicating properly and responding to commands. So at this point while I hadn't found the source of the C1203, I could safely rule out the ECM and CAN Bus from the equation.

Of course I could have probably ruled the ECM out and saved myself some time if I had looked into the C1340 a bit more. The C1340 is basically set when there's an open in the CDL signal circuit when it expects a voltage more than twice (like say a non-existent CDL in a 2WD vehicle?) The triggering criteria wasn't that important to me, what I was really looking for was which circuits are being monitored for the DTC. Which interestingly enough ended up being the 4WD ECU and the Skid Control ECU (no ECM in the CDL Signal Circuit.) After quickly verifying that there is in fact no wiring for the 4WD ECU, save for a the red/blue stripe wire coming from the Skid Control ECU and ending at junction connector IC2 under the dash (if it was a 4WD model the male end of connector IC2 would have had a wire as well and continued to the 4WD ECU.) I could only reason that the C1203 & C1340 are a logic issue caused inside of the Skid Control ECU, which means that there is an internal issue with the Skid Control ECU mounted on the side of the Master Cylinder Unit. Why it one day decided to wake up and think it had a 4WD option I couldn't tell you, based on the history the unit doesn't seem to have ever been replaced. There's also no Calibration ID for the unit for me to cross-reference and when I tried to cross reference the part number on the module it didn't show up in our system (which could be a issue on Toyota's side and not an indication that the wrong part is in the vehicle.)

At this point I opened up a TAS case with Toyota looking for more information on how to deal with the issue and if we can re-flash the module vs. replacing the entire master cylinder assembly (because Toyota wants you to buy it as a single unit.) So basically there's an issue with the Skid Control ECU and I'm waiting to hear back from Toyota on what their thoughts are in regards to repairing the vehicle.

End of Evil Wall of Text

Simplified List of Operations:

-Tried to perform ZPC (can't do ZPC if you have other DTCs in the Skid Control ECU)
-Tried resetting the Skid Control ECU memory (failed)
-Tried Disconnecting the battery for 10-20min (failed)
-Removed Aftermarket Alarm System and rechecked (failed, not causing issue)
-Double checked ECM Calibration ID to make sure 2WD software was installed when BST Recall was done and not 4WD by accident (Ccorrect 2WD software was installed)
-Checked CAN Bus Network (checked out okay)
-Created DTCs by unplugging MAF Sensor to double check function of ECM & Skid Control ECU (verified proper function, but did not correct original complaint)
-Inspected vehicle for 4WD ECU and related wiring (did not find any as expected for 2WD model
-Determined issue must be internal to Skid Control ECU, opened a TAS case with Toyota HQ for more information on how they want to repair the issue.

Invites to the fun:
[MENTION=66316]1engineer[/MENTION] [MENTION=83083]rigtec[/MENTION] [MENTION=78273]Jeremy556[/MENTION] [MENTION=84120]nevada[/MENTION]

 

[Jeremy556]

First, I would remove the alarm system and look for any obviously wire harness butchery, then break out the multimeter.

A little extra info for those without a FSM handy...

DTC CODE: C1340
DTC DETECTION CONDITION: An open circuit is detected in the EXI circuit of the skid control ECU.
TROUBLE AREA: Harness or connector, Transfer system, Master cylinder solenoid (Skid control ECU)

DTC CODE: C1336
DTC DETECTION CONDITION: Zero point calibration of the acceleration sensor is incomplete.
TROUBLE AREA: Zero point calibration incomplete, Sensor installation, Yaw rate and acceleration sensor, Master cylinder solenoid (Skid control ECU)

DTC CODE: C1203
DTC DETECTION CONDITION: The engine/drivetrain specification and/or destination information from the ECM does not match the skid control ECU data.
TROUBLE AREA: ECM

 

[Jeremy556]

Wait, 2WD you say? Really shouldn't be throwing a 1340. Would check part numbers on ECM and Skid Control ECU.

 

[BlackWorksInc]

Wait, 2WD you say? Really shouldn't be throwing a 1340. Would check part numbers on ECM and Skid Control ECU.

I did lead with "Weird Stuff!" lol

 

[lelandr]

First, I would remove the alarm system and look for any obviously wire harness butchery, then break out the multimeter.

This. I'm new to Toyota electronics, but have spent lots of time on my German cars. I'd be looking to see if the grounds are good & not looped or that something isn't incorrectly tied into the ground.

 

[rigtec]

Hi [MENTION=66389]BlackWorksInc[/MENTION],

Okay, since I'm not there to see it I'll need to ask some pertinent questions regarding current vehicle status. (1) Does the truck have any additional weight inside, on top of it, or heavy steel aftermarket bumpers? (2) Has any work been done to it's suspension system e.g., UCA's, lift kit, longer or stiffer springs? "Hope I'm playing fair(?)!" I always gather as much info as possible before drawing a conclusion.

 

[RAWTAZ]

I will take a shot at it.

Is there any other mod, Lift Kit, Wheels and Tires?

I would start with a general inspection of the ABS and wheel sensors looking for any issues or anomalies.

If nothing is found there, I would start to suspect some electrical issue, bad fuse, which should reveal the aftermarket alarm.

After reviewing the wiring diagram for the Skid control circuit from the Service manual I would start to trace down that circuit for power, ohms, ground.

I am suspecting from your post that some Asshat at the local BestBuy is using the power source for the ABS/Skid control for the Alarm system?

TAZ

 

[BlackWorksInc]

[MENTION=66389]Hi BlackWorksInc[/MENTION],

Okay, since I'm not there to see it I'll need to ask some pertinent questions regarding current vehicle status. (1) Does the truck have any additional weight inside, on top of it, or heavy steel aftermarket bumpers? (2) Has any work been done to it's suspension system e.g., UCA's, lift kit, longer or stiffer springs? "Hope I'm playing fair(?)!" I always gather as much info as possible before drawing a conclusion.

It is a stock 2008 SR5 with no other modifications besides the KARR Alarm System.

*Updated the first post to reflect additional information requested.

I will take a shot at it.

Is there any other mod, Lift Kit, Wheels and Tires?

I would start with a general inspection of the ABS and wheel sensors looking for any issues or anomalies.

If nothing is found there, I would start to suspect some electrical issue, bad fuse, which should reveal the aftermarket alarm.

After reviewing the wiring diagram for the Skid control circuit from the Service manual I would start to trace down that circuit for power, ohms, ground.

I am suspecting from your post that some Asshat at the local BestBuy is using the power source for the ABS/Skid control for the Alarm system?

TAZ

Unknown who installed the KARR System, some dealerships have used these and Guardian systems as "Dealer Installed Options" so it is possible this was done from the dealership who originally sold the 4Runner.

A small bit of information regarding the C1203 DTC. It indicates that there is too much variation in data from what the ECM sent over the CAN Hi/CAN Lo network lines and what was received by the ABS module (at least this is what the FSM details the DTC as.)

 

[1engineer]

If I had it and know only what is in this thread, I would:

1. Disconnect the alarm and fix any butchered wiring and recheck the codes
2. Put it on the lift and run checks on all wheel sensor control wires, fix if needed and recheck codes.
3. Do a ZPC and recheck codes.

4. After these three items are done and if codes were still there I would proceed to the next step of checking the ECU first. If it checks out (no evidence of change out, water, etc) I would
5. Proceed to check other aux sensors.

After that I need all data from previous tests to direct my next step.

 

[toyo]

One of the 1st things I would do is educate myself on any and all previous repairs/issues that could be a determining factor to these problems. What does Toyota have in the database for previous repairs? Rub the VIN on CarFax. It is amazing what information they can get.

 

[BlackWorksInc]

One of the 1st things I would do is educate myself on any and all previous repairs/issues that could be a determining factor to these problems. What does Toyota have in the database for previous repairs? Rub the VIN on CarFax. It is amazing what information they can get.

Toyota's Vehicle Inquiry shows that this vehicle had a used vehicle inspection done (where it was noted and sold with the VSC & Trac lights on), a BST Recall (this recall is a reflash of the ECM with an updated calibration to include new braking technology http://www.toyota-4runner.org/4th-gen-t4rs/154651-b1t-bst-campaign-warning.html) a performed, and some minor maintenance (it has about 55k on it.)

Nothing else stands out in the history, updated first post to reflect inquiry.

 

[gm350reratliff]

Is the alarm just an alarm, or does it have remote start as well? If it does have remote start, it should have an immobilizer bypass on it. Some of these use the CAN hi/low wires. I would check the gounds on the vehicle, including the alarm system, check battery voltage, inspect the easy stuff- wheel sensors, wiring harnesses.

Is there a way to check that the correct calibration was performed for the BST update?

I would possibly disconnect the alarm or at least make sure the connections were correct and secure.

 

[cmoore50]

My thoughts are that the aftermarket alarm system install (which I'm assuming isn't installed correctly, but that is an assumption) has caused the ECM reflash to cause all of DTC's.

 

[Gatafly]

I have no clue, but am guessing the alarm has nothing to do with this issue.

 

[88mustanggt]

Wait, 2WD you say? Really shouldn't be throwing a 1340. Would check part numbers on ECM and Skid Control ECU.

on that code this is some tests but again normaly for 4wd

1. Check for battery voltage on the Violet wire (from the 20 amp 4WD fuse) at terminal 6 of connector A at the 4WD control unit with the key ON.

2. Check the ground for the 4WD control unit on the White/Black wire at terminal 1 of connector A - look for 0.05 volts or less to be ok.

3. See if the 4WD control unit is trying to operate the transfer case motors as turning the switch from 2H to 4H to 4L. The High/Low motor has the Blue/Red wire from terminal 1 of connector B and the Yellow wire from terminal 4 of connector B. The 2-4 center differential lock motor has the Green wire from terminal 2 of connector B and the Blue wire from terminal 5 of connector B.

4. Can try jumping power and ground to operate the transfer case motors and see if they operate and see if the position switch voltages change.

on the code C1203

Tests/Procedures:
1. Attempt to perform zero point calibration if scanner is able to communicate with the ECM.

2. If you cannot communicate with the ECM, check powers and ground to ECM.

3. Powers for ECM are pin E3 Blue wire, E7 Grey wire, and E9 Black/Orange wire. Check powers KOEO, they should light a test light.

4. Grounds for ECM are pins C1, A6 and A7 Brown wires and B3, B4, B6 and B7 White/Black wires.

5. If powers and grounds are ok, check CAN lines to the PCM. CAN-low is D34 Red wire, CAN-high is D33 White wire. CAN-low should have about 2.5-2.3 V KOEO, CAN-high should have about 2.5-2.7 KOEO. CAN voltages can be checked again at the DLC. CAN-low at DLC is pin 14 Violet wire, CAN-high at DLC is pin 6 Pink wire. If the voltages are the same at the ECM and DLC and the ECM cannot communicate, the ECM is likely damaged.

 

[nevada]

I appreciate the mention...but this is way outside my area of expertise/experience.

that said, my initial thought is to suspect the alarm. then the ZPC.

altho, due to its ease, I would do the ZPC first.

 

[BlackWorksInc]

Its been very interesting to see everyone's unique approaches to diagnosis and critical thinking. So I think I'll share with you guys finally what my approach was to this vehicle and where I ultimately ended up. I will warn you though, the following is a bit technical and I wish I had pictures to post for it; but I wasn't able to. I won't blame you if you skip the technical story below and I even put a simplified bullet-point list for those "TL;DR" people. :biggrin1:

WARNING! TECHNICAL NERDY CRAP BELOW!

After pulling the DTCs I did the easy stuff first, I tried to perform a Zero Point Calibration on the vehicle; unfortunately the system will not let you perform a ZPC until the other DTCs in the Skid Control ECU are cleared. I then tried resetting the memory of the Skid Control ECU via the Techstream which also resulted in no change, this was followed by a forced hard reset by disconnecting the battery for about 10-20minutes while I took a break to gather my thoughts. After all the easy stuff that didn't take any effort was exhausted I got authorization from the customer to remove the alarm system and recheck the vehicle to see if that corrected the issue (it didn't but its a KARR brand system, so I did the customer a favor there.)

The service history on the vehicle shows that the dealership who did the BST was aware of the issue (this is the same dealership that did the vehicle inspection and sold it to the customer.) My first thought was that somehow the previous technician had installed a 4WD ECM flash instead of a 2WD flash, cross referencing the calibration IDs showed that the vehicle had the correct ECM flash for a 2WD vehicle. At this point I chose to focus on the C1203-Engine Control System Communication Circuit, because it was a data communication error and there was a slim chance it could have contributed to the C1340-Open in CDL Signal Circuit (During CDL On) issue.

A quick look on TIS showed that the C1203 is set when there is too great a variation in the data packet sent from the ECM to the Skid Control ECU. The easiest example I can make is Person A saying to Person B, "Hello;" but when Person B hears the word, it sounds like, "Hallo." Essentially there's scrambling going on between what the ECM is saying and what is actually being read by/reaching the Skid Control ECU. So I decided to start by verifying that the CAN Bus is functioning correctly.

Now Toyota likes to set their ABS/VSC/TRAC related items on their own CAN Bus network that is separate from the rest of the vehicle except for the ECM. This is partially why a generic OBDII code reader/scantool typically cannot communicate with ABS on Toyotas, because its actually on an entirely separate network and thus separate pins on the OBDII connector. Toyota actually has a resistance check for their CAN lines. If you did a resistance check with the key off, from CAN-Hi to Can-Lo it should read 60ohm if its good and 120ohm if the circuit is open. There's also some checks to determine if the communication lines are shorted to ground or power, which I also performed and found to be okay. At this point I've determined that the CAN Bus communications lines are in good working condition (if there was too much resistance and/or anomalies it could explain the "data scrambling" that the C1203 DTC indicates) and am now pointed towards a potential module issue; I decided to look at the ECM because the C1203 is set because data coming FROM the ECM has too much variation. A quick check to determine if the ECM is correctly communicating with the Skid Control ECU is to simply create a DTC; which is what I did when I disconnected the MAF sensor. This created two DTCs a P0102 (MAF low-input voltage) and a C1201 (this is the DTC that disables the VSC/TRAC when the MIL is turned on.) I then plugged the MAF back in and was able to clear the DTCs I created, but not the original C1203,C1336, C1340; this meant that the ECM and Skid Control ECU were communicating properly and responding to commands. So at this point while I hadn't found the source of the C1203, I could safely rule out the ECM and CAN Bus from the equation.

Of course I could have probably ruled the ECM out and saved myself some time if I had looked into the C1340 a bit more. The C1340 is basically set when there's an open in the CDL signal circuit when it expects a voltage more than twice (like say a non-existent CDL in a 2WD vehicle?) The triggering criteria wasn't that important to me, what I was really looking for was which circuits are being monitored for the DTC. Which interestingly enough ended up being the 4WD ECU and the Skid Control ECU (no ECM in the CDL Signal Circuit.) After quickly verifying that there is in fact no wiring for the 4WD ECU, save for a the red/blue stripe wire coming from the Skid Control ECU and ending at junction connector IC2 under the dash (if it was a 4WD model the male end of connector IC2 would have had a wire as well and continued to the 4WD ECU.) I could only reason that the C1203 & C1340 are a logic issue caused inside of the Skid Control ECU, which means that there is an internal issue with the Skid Control ECU mounted on the side of the Master Cylinder Unit. Why it one day decided to wake up and think it had a 4WD option I couldn't tell you, based on the history the unit doesn't seem to have ever been replaced. There's also no Calibration ID for the unit for me to cross-reference and when I tried to cross reference the part number on the module it didn't show up in our system (which could be a issue on Toyota's side and not an indication that the wrong part is in the vehicle.)

At this point I opened up a TAS case with Toyota looking for more information on how to deal with the issue and if we can re-flash the module vs. replacing the entire master cylinder assembly (because Toyota wants you to buy it as a single unit.) So basically there's an issue with the Skid Control ECU and I'm waiting to hear back from Toyota on what their thoughts are in regards to repairing the vehicle.

End of Evil Wall of Text

Simplified List of Operations:

-Tried to perform ZPC (can't do ZPC if you have other DTCs in the Skid Control ECU)
-Tried resetting the Skid Control ECU memory (failed)
-Tried Disconnecting the battery for 10-20min (failed)
-Removed Aftermarket Alarm System and rechecked (failed, not causing issue)
-Double checked ECM Calibration ID to make sure 2WD software was installed when BST Recall was done and not 4WD by accident (Ccorrect 2WD software was installed)
-Checked CAN Bus Network (checked out okay)
-Created DTCs by unplugging MAF Sensor to double check function of ECM & Skid Control ECU (verified proper function, but did not correct original complaint)
-Inspected vehicle for 4WD ECU and related wiring (did not find any as expected for 2WD model
-Determined issue must be internal to Skid Control ECU, opened a TAS case with Toyota HQ for more information on how they want to repair the issue.

[Updated First Page with my Post]

 

[BlackWorksInc]

A big thank you for the following people for indulging my insanity:
[MENTION=66316]1engineer[/MENTION] [MENTION=83083]rigtec[/MENTION] [MENTION=78273]Jeremy556[/MENTION] [MENTION=84120]nevada[/MENTION] [MENTION=85344]88mustanggt[/MENTION] [MENTION=108337]lelandr[/MENTION] [MENTION=112450]RAWTAZ[/MENTION] [MENTION=632]toyo[/MENTION] [MENTION=32290]gm350reratliff[/MENTION]f [MENTION=28436]CMoor50[/MENTION] [MENTION=70181]Gatafly[/MENTION]

If you guys liked this type of thread, I can maybe make a better case study in the future that's more structured and is a bit easier for everyone to participate in; I know this one was very out there for most people (hell it was challenging for me!)

Like this post if you want more "Class Participation Time" in the future!

Post Note-

People are still welcome to post how they would have approached this vehicle from a diagnostic perspective and/or what they would do differently.

 

[gm350reratliff]

I liked it. I've always enjoyed working on vehicles too. I don't get to work on them much anymore though. Thanks for melting our brains!