When you click on links to various merchants on this site and make a purchase, this can result in this site earning a commission. Affiliate programs and affiliations include, but are not limited to, the eBay Partner Network.
It is essentially a network hub that takes all of the different networks in the car (AVC-LAN, BEAN, OBD, etc..) and ties them together. This allows all the various ECUs in the car to talk to each other. This allows things such as the sliding roof ECU to roll up/down the windows, and the trip computer to display fuel economy data, and is even used to transmit data to your gauges in the cluster. Basically, this is the heart of the integration of all the systems in the car.
The OBD port goes directly into this gateway and this is how Techstream can talk to, program, monitor, and control various parts of the car.
I have several projects I've talked about here, but all of them always come down to integration. There are two ways to do it. One is to run tons of wiring all over the car, hacking into various harnesses. The other is to master this bus and take control via a couple of wires.
So, this is where I am today. I ordered a spare Network Gateway ECU off eBay and just received it today. And now the adventure begins to unlock its secrets.
I'm going to have a challenge in store for me, as the main processor is a custom Denso part with no documentation. All I have is the pinout and my experience with electronics to work with here.
Through some fairly heavy researching online, it has been mentioned more than once that RS232 (standard serial) was one of the standards the network gateway was designed to support. So my first task is to see if I can find this connection, which could make the rest of the reverse engineering a lot less painful.
I am particularly interested in finding out what is missing on the board. Second, I am interested in the connections that do come out to the connector but which are not documented in any of the drawings I have found.
Those are my immediate targets.
(Note, the board is covered in a protective coating which makes it harder to read the IC part numbers. I will be removing this coating and posting some pictures for those sleuths out there.)
Pin 12 appears to be another supply isolated with diodes from pin 2. I am not sure what its purpose would be yet, unless it was intended as some backup supply perhaps. None of the diagrams show anything connected to it.
Pins 8 and 19 as a pair are routed out into the circuit, but also not represented on any diagrams. This leads to a missing choke which would be pretty hefty and then to the missing IC701. Looking at the footprint around it, I *think* it might be an RS485 or RS232 interface. It is connected to a rather hefty (also missing) capacitor. All of which can give me some clues as to it's pinout, and then possibly function.
Not sure what the function of the missing IC801 is. The AVC-LAN bus goes directly to the pads for this chip. IC801 has it's own crystal which would make me think it would be a microcontroller of sorts.
Now that I have some theories to explore, my next step is to find out if I can power it up on the bench and get it sending out signals outside of the car.
For now, I won't be moving that information over here. Instead, I am working to digest it and will post a much clearer presentation of the research. I am also going to start up a blog instead of loading down this forum, and possibly reach a larger audience.
Anyway, a quick summary of where I stand right now:
1. I found the serial port and am trying to decode the output.
2. To do #1, I am building up a 'testbench' using components from the car which will allow me to more tightly control the test environment. Lots of wiring involved.
3. To support #1, I have purchased the technical papers from SAE that describe the format of the BEAN bus and the operation of a Toyota/Lexus Gateway ECU.
4. I will be working to build analyzers for the Bus Pirate from Dangerous Prototypes. This will allow me to better monitor all the various buses.
5. Once the testbench is set up, I can actually connect the Techstream cable to it. By using the active test feature of Techstream, I should be able to send specific commands and hopefully amass a ton of data about the various systems.
To keep the eye on the goal - the entire purpose of this activity is to attempt to determine the physical addresses of the various ECUs in the system, then the logical addresses of their subsystems, and finally the commands. This is the data that is missing from research. To my knowledge nobody has yet hacked the BEAN bus and figured out how to control things such as the doors, windows, etc... A success here would open an entirely new world of possibilities not just for the SC, but most Lexus and Toyota vehicles. New 'dealer option' ECUs could be developed. A system like the Luxlink would be much easier to install.
Here's a quick rundown of some jargon:
SAE J2534 - This is an ECU programming API (Application Protocol Interface) which is a layer over the OBD interface. It is the API used by the Techstream software and cable to program customization options, and flash the engine ECU.
SAE J1962 is the OBD-II (on-Board Diagnostics) interface. This mostly describes the physical interface.
ISO 9141-2 is the OBD protocol used in the Lexus SC430 and most other Lexus and Toyota Vehicles. With some more recent models using CAN
BEAN (Body Electronics Area Network) is a single wire multiplexed network protocol and interface designed to carry switches, sensors, and analog data between the many ECUs in the car.
AVC-LAN is an extension of the NEC IE-BUS. IE-BUS describes the networking interface to carry high-bandwidth data among the entertain ECUs such as Navigation, amplifier, radio, telephone, and CD changers. The AVC-LAN extension just describes the audio and video interfaces bundled with the IE-BUS.
CAN is a much better documented and capable bus, but unfortunately most pre-2005 Lexus/Toyota vehicles do not have this bus.
The entire system is quite complex, but thankfully pretty much all networks comply with some 7-Layer model established long ago which helps to document and represent them in a way that is more easily understandable. I will be applying my research to that model and hopefully it can provide the spark for others to join in the fun.
Great information, my head is spinning. It’s going to take me more than one read to even begin to understand everything. Fortunately it is hotter than hell up here right now so I’m not going outside anytime soon.
02-16-16, 11:47 AM
Reverse engineering the Newtork Gateway ECU
