P0325 will NOT go away (knock sensor)

[Devbot]

Hey all. I have a P0325 code that has been pestering me for weeks now with absolutely no end in sight. To give a very quick recap;
-Started with P0171 and sometimes P0420
-Changed my MAF sensor, code switched to P0325
-Spliced my knock harness together to go around the code; code is still thrown
-Replaced the harness altogether. Nothing.
-Replaced BOTH knock sensors and double-checked the harness wasn't pinched. No luck. (even though one of the sensors was shot)
-check the knock sensors with an oscilloscope to ensure they are functioning.
-Replaced my ECU with a fresh unit. Didn't make a difference.
(everything was replaced with OEM Denso parts)
Anybody have any guesses as to what it could possibly be? My next guess is there's a gremlin in the ECU harness, which in that case I'll just send this limp-mode POS to the crusher.:gun5:

Edit: '00 SR5 auto @ 283k, specifically

 

[jgue467]

Well you've replaced all the items the FSM would indicate. There aren't many things listed, just open, short between right side sensor to ecm and the parts themselves.

Checked for continuity on the new wire? (gremlin)

Assuming ecm was reset with a 30 min or so disconnect from batt?

Engine starts, idles OK despite full timing retardation?

 

[Devbot]

Assuming you mean continuity in the harness, I have not. If you mean the wire running from the harness to the ECU, I'm currently trying to find a pinout to show me which lead that would be and on which pin it ends up, but seemingly the only one in existence is that 1998 pinout which is vastly different than both ECU's I'm in possession of currently - for example the only plug they have in common is E11, which is an empty spot for me
Battery was disconnected during the entirety of the install - was the first thing I did before I was even ready to work and was forgotten about while attempting to turn over the engine (oops). Overall left disconnected for much longer than 30 mins.
Engine is very long to turn over (3-4 seconds) and idles high at nearly 2000RPM. When cleared it starts right up and idles at maybe 600RPM. Fuel economy is abysmal, too.

Edit: the ECU i swapped in has part number 89666-35140 whereas my OEM one is 89666-35170. Not sure what the exact difference is, if any at all, but thought I should note it.

 

[LittleCaesar]

Re the oscilloscope: do you know if the wavelength you were seeing was the correct or proper one?

I had one once in a Silverado that was a BWD replacement that on the scope produced a wavelength but the output signal was too long, and ended up throwing two knock sensor codes. A new AC Delco one was installed and all was then good to go.

 

[Devbot]

I actually do not now that you mention it, at the time we were getting A wavelength but it dawned on us we didn't check what we should be looking for, and called that good enough and proceeded to continue reassembling before it got dark. That's really interesting and helpful information, thank you, I'll think on that

 

[Devbot]

Just found my TSM which has the oscope info in there, gonna start testing and probing around tomorrow. Fun stuff!

 

[Devbot]

Just got done checking and the wavelengths looks totally fine compared to the TSM, and were reading roughly 8-9kHz at 3500-4000rpm (compared to the stated ~7kHz @ 4000rpm in the manual, so pretty spot on). Also checked continuity between the sensors, the harness, and from the harness to the ECU - no shorts or impedance found anywhere. On the offchance there is a nominal amount of carbon build up in the cylinders that's messing with things, I went ahead and put a bottle of Gumout multi system in my tank - also plan on getting some electrical cleaner tomorrow since the plug to the harness IS pretty dirty

What was truly strange is when testing the waveforms, the CEL turned off at some point, which doesn't make much sense seeing as the knock sensor harness was disconnected from the ECU and should've thrown a code as a result - what's DOUBLE strange is it stayed off while I drove to the gas station, but once I filled up and turned my car on, the code came back within the first 10 seconds of idle as opposed to when the car reaches a certain RPM range

Truly the definition of a gremlin, and one that does not want to be caught

 

[LittleCaesar]

So the ECM was seeing the signal from the knock sensors even though the harness was unplugged?

How dirty is the throttle body?

 

[Devbot]

I'm not exactly sure, neither of us noticed the CEL went out until we unplugged the oscope/reconnected the harnesses and went to turn the car off. Whether or not it was out while the signal was broken is beyond me (I highly doubt it but who knows), but the code was definitely present prior to testing. Either way, I tried to replicate it again with no luck. Throttle body is sparking clean; cleaned the TB, plenum and manifold when I had them apart. It was filthy as hell originally. Used some MAF cleaner (just compressed iso) to clean off the connections between harnesses and no dice either. Only thing I haven't cleaned is the MAF itself, but that's because it was replaced with a freshly sealed unit 2-3 weeks ago when this whole debacle started. I know they're partial to P0171, but will they cause P0325? Willing to try damn near anything at this point.

For what it's worth I used Matsu knock sensors instead of Denso like most people, but the ones that came out were 100% indentical and looked nothing like the Denso ones (lacked the grey polymer piece with the logo)

 

[LittleCaesar]

If you have the old MAF sensor, or can get ahold of a known good working one, I would start there and see what happens. As my mechanic friend says, today there are good knock off parts and then there are bad ones. Do all the pids for live data with the MAF look ok?

I personally have never changed the knock sensors in the 4Runner but have on a Lexus RX300. New sensors and harness but still was getting the PO325. Known for having a dirty TB and IAC, I cleaned both along with the MAF and the code hasn’t come back in seven years.

I doubt it is the sensors if they tested correctly, nor the harness.

 

[Devbot]

Have a new IAC and MAF coming in the mail, currently. Now that I recall, the IAC wasn't removed to be cleaned and I'm sure it's properly ****ed up like the rest of the TB was. I was just gonna buy a gasket and clean the preexisting one, but since you can order them online for 50-75% of what NAPA charges I figured why not. Old MAF was thrown out long ago unfortunately. Debating tackling O2 sensors just so that's off the table as well, but I've thrown out nearly $1000 tackling this issue already.

 

[LittleCaesar]

That is a lot of money for the parts cannon. IACs for Yotas can be real finicky once they get dirty.

Per the O2 sensors: my sister’s best friend drove a 06 Highlander with the 2.4 in it. It would throw the money light on now and then. Called for the ECU to be replaced. The stealership replaced the ECU and upstream 02 sensor to the tune of $1850. Money light came back on. After another $1000 spent at the dealer, she asked me to look at it. Nothing consistent in different freeze frame data times. Turns out that just by moving the rear 02 sensor wire after at least one drive cycle, it would die, then come back to life. Replaced it with a Denso and all was good.

How are the fuel trims, especially long term?

 

[jbtvt]

Terminal 14 and 15 on your E7 plug are the knock sensors. What do you mean when you say you spliced the harness together? The knock signal is just one wire, other conductors in it are grounded shielding. Unless Toyota changed something for the 3rd gens vs all earlier models, which I doubt, the knock code is only thrown when your ECU isn't receiving a signal, not when you engine is knocking. If this is still the case as I would strongly suspect, nothing that would potentially cause a knock would have any effect as it's strictly an electrical issue. Would be a good idea to confirm that one way or the other before potentially wasting time on MAF sensor etc.

You replaced the harness, including both plugs with new? My first though with intermittent real world continuity but positive bench continuity would be that the terminals in one of your plugs loosened or corroded and you're not getting a good connection.

 

[gamefreakgc]

For what it's worth I used Matsu knock sensors instead of Denso like most people, but the ones that came out were 100% indentical and looked nothing like the Denso ones (lacked the grey polymer piece with the logo)

Toyotas came off the factory floors with the Matsu knock sensors so you picked the OEM brand. DENSO started making the sensors later for other models, which also happen to work for the 5VZ-FE. I currently have NGK knock sensors since they were 1/3 of the price...

After reading this, you've got a wiring gremlin, that's my conclusion. You don't need a wiring diagram though, just match the wire colors. Pull back the sheathing on the ECU side of the pigtail connector and make note of the two colors and stripes. Then go to your ECU and find the plug with those two colored wires, unplug them, and use a multimeter to test resistance in the wires. You will probably need to buy some longer probe wires though to go from ECU plugs to engine bay.

Also, not sure if this was mentioned but re-do all your grounds. That means removing the ground wires, sanding or scrubbing the metal until it is bare (that also means stripping off the paint if it's a painted surface) and then clean it up with rubbing alcohol or similar degreaser. The ones to do are ECU ground, Battery negative cable to fender, Diagnostic port to upper intake manifold ground (in the engine bay), and Passenger cylinder head to firewall ground.

 

[Devbot]

Terminal 14 and 15 on your E7 plug are the knock sensors. What do you mean when you say you spliced the harness together? .... You replaced the harness, including both plugs with new? My first though with intermittent real world continuity but positive bench continuity would be that the terminals in one of your plugs loosened or corroded and you're not getting a good connection.

According to the 2000 SR5 TSM it's pins 27 and 28 at terminal E9 - those plugs don't match the TSM or either of my ECUs whatsoever. We tested continuity with everything installation and it checks out. Yes, everything was replaced with new OEM units
As for the splice YouTube

How are the fuel trims, especially long term?

I'll have to check and get back to you

The ones to do are ECU ground, Battery negative cable to fender, Diagnostic port to upper intake manifold ground (in the engine bay), and Passenger cylinder head to firewall ground.

I've already taken a multimeter to it like you've suggested but I took your advice on cleaning the grounds. My only problem is, where is this damn ECU ground?? Can't find it for the life of me. While I was poking around I did find a disconnected vacuum line...:flame:

 

[Devbot]

 

[jbtvt]

A quick search seems to show that nothing has changed since the old code 52 days, and PO325 is strictly an electrical issue - P0325 OBD-II Trouble Code: Knock Sensor Malfunction (Sensor 1, Bank 1)

Unless you can find a reliable source otherwise I wouldn't spend any time on fuel trims or anything else outside the circuit.

According to the 2000 SR5 TSM it's pins 27 and 28 at terminal E9 - those plugs don't match the TSM or either of my ECUs whatsoever. We tested continuity with everything installation and it checks out. Yes, everything was replaced with new OEM units
As for the splice

I've got another one showing 22 and 23 on E9, but oh well, as long as you're getting continuity they're most likely the right ones (there's your ground point, BTW). Did you check for continuity between each wire-run terminal end at ECU, while disconnected, and a known ground? If it's there, you have a short. Easy fix, just splice in some new wire near sensors, preferably shielded but not critical and then splice to ECU ends. Just noticed the note about crushing it if fault was in ECU harness. Is that main engine harness run what you're referring to as ECU harness?

Scotchlock trick seems like it'd work in some cases, like if you have one bad sensor, although if you do it over a shielded portion you'd short the signal to ground, and if there's a ground short elsewhere in the wiring, further downstream etc, it seems like you'd just short out both signals.

I'd start with depinning both wires from ECU plug, clamp them together and test for continuity between them at other plug end (one prong on each spade), and then test for continuity between each wire and ground. Continuity on first test =pass , on second test= fail.

When you say you tested continuity with everything installed, you back probed the end of the KS pigtail, on the KS side, and tested that to the ECU terminal? Good for you if so, but not commonly done, and I've seen loose and corroded female spades cause issues several times before. Not likely to be your issue if it's all new though.
Attached Images

 

[gamefreakgc]

I've already taken a multimeter to it like you've suggested but I took your advice on cleaning the grounds. My only problem is, where is this damn ECU ground?? Can't find it for the life of me. While I was poking around I did find a disconnected vacuum line...:flame:

Good find on the vacuum line, that couldn't help at all!

The ECU ground is inside near the passenger's side kick panel I believe. Been a while since I've looked for it. If it's not easy to get to, don't worry about it too much unless that's your last resort.

You'll find that problem wire, it's in there somewhere.

 

[Devbot]

So an update: Code cleared itself so I went for a drive. Couldn't seem to trigger it until, again, turning her off and back on again. So i decided to hook up the scanner to it and got a surprise. The code has now switched from P0325 to P0135 (O2 sensor heater), and while browsing with the OBD, one O2 sensor shows the voltage is roughly half of what it should be... Think that might be the problem

 

[jbtvt]

No, but sounds like you have a damaged wiring harness

Look for melted or pinched loom