Bump-Starts and runs great, won't start with key - P0335 - ECU replacement fixed

Hello!
Brief intro:
I finally opened an account for this virgin post on this forum.
I usually find what I need from previous content and advice online.
Let me know how I could've done better, always room for improvement, feel free to criticize.

The problem (ongoing):
When turning the key everything is as it should, except spark and/or fuel are being withheld (at the engine head, i assume) due to issues with the crankshaft position sensor (CKPS) signal. When bump-starting (i.e. moving the truck and releasing the clutch in 2nd gear) it starts great and runs just like in the past.

The background:
My manual trans 07' 4WD Tacoma started taking longer to crank until it just wouldn't.
*Happened right after I patched a large hole in my muffler, which made the engine run noticeably more smoothly (keeping RPM between gears), but maybe just coincidence.

Then from a dishonest mechanic who eventually gave up, the truck spent an other 2 weeks at an official Toyota dealership (the Tech I bumped into by chance was young and didn't seem too savvy). They eventually gave up as well telling me it's likely the ECU/ECM but can't be sure. They don't have one available, so sent me to get one online and the truck's with me since.

Perhaps worth mentioning too: I tried replacing my AC compressor about a month before this all started. After failed attempt of breaking the bolts inside, I took it to a mechanic who used concerningly brute force to literally "tear" the old compressor out along with the broken bolts (then using a torch he released the stuck parts from the casing and all ran fine, for a while). Guess what's right behind that compressor - the crankshaft position sensor.

My failed attempt to PicosScope and diagnose:
Just out of curiosity I got a picoscope to check for CKPS signal.
I got nothing when key cranking.
Bumped started - engine running - connected probe and engine stalls!
Tried again on CAM shaft position sensor, engine kept running but no signal. (Tried both DC and AC as well as auto on the program).
Using multimeter when engine off (will maybe check again when ON) and key turned I get about 0.4V on the "live" wire going to the sensors (NE-), that seems wrong.

My theory and ask for advice:
I can't get my head around it except that maybe when one of the mechanics fiddled, they managed to damage the ECU somehow, since the engine runs great once started. I'm hoping the used ECU I ordered from a salvaged wreck on E-Bay will solve this saga. Should arrive in a week or so and will update. Still pondering why I couldn't get a reading on the picoscope also. Is it known that you can't connect while engine running? Could my truck be running without CPS and CKPS signals?

Please if there's anyone with wisdom on this and can make my truck start I'd appreciate it. It's a real pain having to limit your freedom, or occasionally take the risk and park on downslopes. Maybe it will become useful to others too.

 

I'm assuming your getting a P0335 code?

I highly doubt it's an ECM issue, that's the typical "we don't know what it is so it must be the computer" and Toyota ECMs don't fail very often.

Certainly possible it got damaged.

This is good, we should be able to easily figure this out with a scope.

Where are you checking at?
What model Pico do you have?

I really doubt it's the ECM but since you already bought one you can try it.

We need to see what kind of settings your using, also are you using Pico 6.x or Pico 7.x software?

If your making connections correctly it doesn't matter, a scope/meter has enough impedance to not affect the circuit in any meaningful way.

I know 100% it will not run without a Crank signal, I know the 4.0L will run without Cam signals but I'm not sure about the 2.7L.

I have a theory about this but I would need to see the waveforms from the crank sensor to see if I'm right about it or not. My theory is being the crank sensor is a VR type that makes it's own signal is that it is either weak, is rust jacked/not seated properly in the block, or the signal wire is partially grounded because the amplitude (strength) of a VR sensor signal increases as the RPM of the tone wheel it reads off of increases so bump starting it may just give it that little bit of extra RPM for it to generate a good enough signal for the ECM to read.

 

I don't have the device to read the error, but I'm pretty sure my engine light reads P0335 or less likely a P0339 code.

Using the newest "stable" Picoscope 7 software from their website.
I got the PicoScope 2204A, I'm hooking up one probe from AWG (right most on the pico) to Battery Negative (-) terminal, and the other probe from channel A to the "sensors signal" wire: the NE+ (CKPS) and G2 (CPS) on the diagram below.

I assume the NE- is supposed to give a constant 5V or something similar, but both with Engine Running and Off (ACC), I'm getting a negligible -0.3V. Maybe this is where the problem lays , or did I misunderstand the sensor?

I'm back probing at the ECU, because it's easy and to be sure it's getting there.
Here's are diagrams for my 2TR-FE, I'm pretty sure they're right since I've done continuity checks on NE+ and NE-.

Can't get my head around it, I checked again today, this time making sure I got good ground to negative battery terminal (before, I probed to any metal for convenience). The same happened: no signal from G2 (CAM sensor), and when probing NE+ (Crankshaft) the engine dies immediately.

Are you sure despite the fact the engine runs fine, no different than long before, in all RPMs including low idling conditions and high-gear @ low velocities?

Would appreciate any help, did I get the Pico setting wrong? Is the NE- (green wire) supposed to have a constant voltage? (if so, how is my engine running once bump started?) Any recommendations forward?

 

You need to use the sensor ground, not the battery ground.
NE- and NE+

 

So you don't have a scan tool?
Well your ahead of the game with a scope but kinda need a scan tool as well to see what the ECM is seeing.

I'm not very good with Pico 7, I stayed on 6 as it's much simpler to navigate and supports custom probes.
I can make 7 work but it takes me alot longer to find stuff.

I think I know what's going on, the AWG port is a signal generator. It's not used unless you want to generate a signal to inject into something so leave it disconnected.

You want your Channel A ground lead hooked up to battery negative (or a known good ground) and the Channel A signal lead connected to NE+

NE- is sensor ground, it is internally grounded in the ECM so there should be no voltage on it.

That's good, that's where we want to be checking.

It's a plausible scenario, this is from my 4.0L which uses the same design crank sensor. As you can see on initial cranking the signal is much smaller (around 5v peak to peak), once the engine start's (RPMs increase) the amplitude goes up to over 20v peak to peak. If the amplitude is too low (which could happen at low RPM if the sensor is weak or too far way from the tone wheel) the ECM won't "see" the signal.

I would have to see a screenshot of your scope settings to tell you that.

Not on Toyota's, it is sensor Ground.

Battery ground is fine to use, NE- is referenced to ground anyway.

 

Your right, I got one.
I get the following 2 codes:
- "P0335 #07E8 CKPS sensor A circuit"
- "P0340 #07E8 CPS sensor A circuit bank 1 or single sensor"

I feel silly, didn't read the instructions thoroughly, thank you for pointing that out!
Finally got a reading, here's a snip of the NE- (ground) with NE+ and G2 while engine running warm & idling:

Me neither I'm new to this, will try to get it to record without losing data to post a fig of cranking. Should I use a trigger? Any recommendations on how to get a nice image like yours?

Man I think you've got superpowers.
Comparing my reading to yours, I'm getting a really low amplitude/signal.
Do you think replacing the Crank Shaft Position Sensor might be the solution?
I got a new one online today (just in case) and could possibly give it a try tomorrow.

PS: Today I killed the engine at a stop sign while it was warm and it fired right up with the key. Maybe just luck or is temperature a factor?

 

Not sure what you were trying to say but your message didn't come out?

 

Sorry, sticky fingers posted the post while writing too early...
I'll take this opportunity to thank you, I really appreciate your help.
So far I've been learning a lot and feel we're close to cracking this!

 

No problem, I'd sure like to make sure that's what it is before replacing it though. Quite a chore to get at it.

Have you tried getting captures with the connections I mentioned above?

 

I edited the post above and added a capture of the signal I got when idling. Still not sure how to work the Pico software, but can get you a capture while cranking with the help of a someone to turn the key while I make sure the image isn't lost

 

I'll check it out when I get a few min, with Pico you can put alot of time on the screen, get your capture, then hit the spacebar to pause, then you can zoom into any area in the frame. Also it records multiple frames so you can jump between them.

If you can grab Pico 6 I can help you alot better with setting it up and manipulating waveforms.

 

I don't have a known good for a 2nd gen 2TR but I did find one for a 3rd gen 2TR in the Pico waveform library which uses the same sensor and yea that amplitude looks low (about 9v peak to peak vs about 12v peak to peak on the known good).

Put alot of time on the screen by increasing your time/division, 1-2 seconds is typically a pretty good range when your trying to acquire a capture. Roll your scope, crank it a few seconds then pause it and zoom in.

Nope just 10 years of teaching myself automotive electrical and drivability (really more closer to 5 as far as scope stuff) and learning from the guys I have linked in my sig (among others) and I'm nowhere close to being an expert at scope stuff, I know enough to use it effectively for alot of testing but I'm not an expert at it.

It does, although comparing it to the 2.7L I found it's not super low but I would really like to see it cranking.

With a hot engine and battery it probably cranks just slightly faster which is likely all it needs being the signal is a little weak, minimum amplitude for the ECM to "see" the signal is typically around 1v peak to peak so +0.5v on the high and -0.5v on the low. Remember the lower the speed the weaker the signal with a VRS design, a weak signal like that is most often caused by an airgap issue (sensor is too far away from the tone wheel). In areas where heavy rust is an issue it's typically caused by rust jacking or if the sensor is removed and not seated properly when it is reinstalled.

 

Got these snips of cold cranking and obviously no start, I'm pretty sure I connected the wired correctly since I just did it yesterday. But these make me question since I can't understand them. Practically a mirror image of each other, (I expected the CAM [Channel B in red] to pulse as when engine is running.



What would you recommend next?
Could it be somewhere in the CAM sensing and wiring this whole time?
My ECU just arrived, and I got the new CKPS already.
Wondering whether worth giving them a try before the weekend, maybe with Toyota again or a different mechanic...

Seems the CKPS is seated snug and assuming the dealership was telling the truth, they also replaced it with a factory one after an aftermarket one was put by the former mechanic.

*Another thing I thought maybe worth mentioning:
I'm really due a regular oil change, have been postponing until I fix this key-start issue.
But maybe that dirty oil is obscuring the signal? Is it even in the same place as the CKPS or other related sensors?

 

That is weird, almost like your scope ground was missing or something or something wonky is going on with PCM grounds maybe?
I think lets reference the scope ground to battery negative at the battery, Channel A on NE+ and Channel B on NE- and see what we get.

Something is off here, I can't see the cam sensor generating that kind of signal cranking but a perfectly good signal running.

I'm not convinced that will fix it at this point but I guess you could swap the ECM and see as that's pretty easy.

Nah dirty oil won't affect the signal at all, not good for the engine but won't affect cam and crank signals.

 

Man you're special, I tried again and I guess my connections weren't good at first, here's a cold crank turning - no start (Red line is G2, Blue line is NE+ and negatives to NE-):


Here's the same only connecting negative sides of probes straight to battery terminal (I realize I misunderstood your instruction, should I still try probing to NE- instead of G2?):



Maybe this!?
Correct me if I'm wrong but seems that the CKPS signal over battery negative is much much weaker than over PCU's NE- wire.

Is it a simple plug & play? No risk involved?

 

Interesting, that signal looks perfect (I'd have to find a known good to see if cam timing is on).

That is weird, I'm almost certain when I checked mine I got the exact same waveform when I referenced my ground to NE- as I did when I referenced it to battery -. Maybe some new tests are in order, I'll investigate if I have time today.

Meanwhile I think unplug the connector at the ECM and check resistance between NE+ and a known good ground and see what we get.

If the part numbers match and your truck doesn't have an Immobilizer (which US spec 2.7L trucks do not) it should be plug and play.
The VIN in the ECM won't match the truck's VIN but that won't affect it running.

 

Can confirm on mine the signal looks identical wheather ground is referenced to battery ground or NE-

 

I don't have a known good 2TR-FE reading either but according to Toyota's manual for P0335 image below I figure my CAM signal is about 20ms late, or 8 "teeth"/peaks of the CKPS. But the engine is running fine just like the day I got it, perhaps despite that this could be the source of the issue?

Did that and got infinite resistance, (no reading on multimeter).
I then tried key-starting while jumping my negative battery terminal to the NE-, still the same symptom.

I gave the used ECU a try, same issue again: cranking and turning strong but no start (funny, I think my bump-starting is much weaker than the starter at this point). As if my issue is magically bypassed by the marvels of stick-shift jump starting, WHY?!!

Will give it another try again soon, this time I'll take extra care to make sure everything is grounded/wired well.

Hoping some ideas will come around soon! Will appreciate any insight

 

You 2 may find the site below of interest.
It's where I pulled this scope.

https://rotkee.com/en/waveform-library

2TR Waveforms - https://rotkee.com/en/waveform-library?brand=202&model=2359&engine=1548&system=51&subsystem=73




2.7 2TR

 

So this time I made sure I got good connections which apparently wasn't the case last time and it seems the readings from negative leads to battery are the same as to NE-:


here's a snip of an attempt while bridging battery negative terminal and NE-, only CKPS here - I notice a slightly lower amplitude:


and here's another snip while hooking the probe negatives to NE- (entirely ECU hookup, still lower than direct battery hookup):

Thanks this is a great resource!
When looking at those it seems my readings are in tune.
What seems off is that when cranking I get about +/-2V Amplitudes which seems like half of the desired +/-4V in the diagrams (I do get those 4V once engine is running though).

Anyone thing it's worth trying a the new CKPS sensor I got (again)?
I'm doubting it's the issue but can't think of what to try next.