Originally Posted by lobuxracer

There are many tables in the Toyota ECM. Some are base parameters like A/F ratio and ignition timing. Other tables contain target values for sensor readings under specific conditions to ensure the engine is operating as designed. Some of the tables are required to be "open" for updates by EPA and DOT/NHTSA. Toyota only allows access to the tables required by law and burns hard values into the rest of the parameters. So changing something like cam timing is impossible because once the tables are loaded, the ability to reprogram them is severed physically on the CPU. The Denso processor is full custom including the instruction set, and there is no documentation available to the public to understand what is going on with which pins and how to address any change to the system. Add to this all the memory is physically resident on the CPU die, and you have set a pretty high bar for anyone who would like to directly access the device.

Years ago, it was possible to purchase the CPUs and install a daughterboard with a separate CPU and memory. A company called G-Force in SoCal was doing this for Supras a long time ago. G-Force is now Technosquare. Their top tech at the time, a guy they called Tadashi, had the ability to see the maps, but because no one outside of Toyota had access to the source code or instruction set, it was nearly impossible to decode most of the engine operating parameters. Fuel and timing maps, rev limits, and speed limits were relatively simple to fix. Anything outside that was a much bigger challenge, and in fact, they weren't able to remove the speed limiter, only adjust it to a value the system was unlikely to ever see. Toyota's code has become far more complex in the last 22 years with drive by wire throttles, VVTi, and ECTi, deeper integration with VDIM, and a small host of other features intended to reduce parts count and harness weight.

The original Supra ECMs didn't allow any reflashing at all, and if Toyota had their way, it would be no different today. Write once memory (ROM) is common in embedded systems, and including EEPROM/flash capability is something Toyota did only by force of law.

To ice the cake, they have physically removed the normal routes of access to their CPU, and used an encryption scheme built on its own standard since they have no compelling reason to follow any conventional scheme in applying encryption.

Originally Posted by MileHIFcar

That sounds like some heavy stuff! Sounds like some of the fortune 500 companies that get hacked into need to hire some engineers from Toyota and utilize their encryption techniques.

Originally Posted by Helo58

Lastly, why do other manufacturer's make ECU tuning less difficult? Or are they just as difficult, but volumes justify the work involved? My last car, genesis coupe turbo, had limited tuning solutions as well and it is my thought that this will become more common as car systems become more integrated and connected.

Originally Posted by lobuxracer

There are many tables in the Toyota ECM. Some are base parameters like A/F ratio and ignition timing. Other tables contain target values for sensor readings under specific conditions to ensure the engine is operating as designed. Some of the tables are required to be "open" for updates by EPA and DOT/NHTSA. Toyota only allows access to the tables required by law and burns hard values into the rest of the parameters. So changing something like cam timing is impossible because once the tables are loaded, the ability to reprogram them is severed physically on the CPU. The Denso processor is full custom including the instruction set, and there is no documentation available to the public to understand what is going on with which pins and how to address any change to the system. Add to this all the memory is physically resident on the CPU die, and you have set a pretty high bar for anyone who would like to directly access the device.

Years ago, it was possible to purchase the CPUs and install a daughterboard with a separate CPU and memory. A company called G-Force in SoCal was doing this for Supras a long time ago. G-Force is now Technosquare. Their top tech at the time, a guy they called Tadashi, had the ability to see the maps, but because no one outside of Toyota had access to the source code or instruction set, it was nearly impossible to decode most of the engine operating parameters. Fuel and timing maps, rev limits, and speed limits were relatively simple to fix. Anything outside that was a much bigger challenge, and in fact, they weren't able to remove the speed limiter, only adjust it to a value the system was unlikely to ever see. Toyota's code has become far more complex in the last 22 years with drive by wire throttles, VVTi, and ECTi, deeper integration with VDIM, and a small host of other features intended to reduce parts count and harness weight.

The original Supra ECMs didn't allow any reflashing at all, and if Toyota had their way, it would be no different today. Write once memory (ROM) is common in embedded systems, and including EEPROM/flash capability is something Toyota did only by force of law.

To ice the cake, they have physically removed the normal routes of access to their CPU, and used an encryption scheme built on its own standard since they have no compelling reason to follow any conventional scheme in applying encryption.

Originally Posted by PDP180180

I still feel the best and most likely option will be something from the SYVECS family.

Funnily enough my F is going on holiday next week to a company called SRD here in the UK. They need my car to help iron out the issues they are having with a Supra that has been fitted with our 8-spd gearbox.

The guys are fitting my coilovers, RR-Racing USRS and giving the car a full alignment free of charge!

The car will be on a dyno most of the week with a guy called Ryan. Ryan is a real ECU guru, and runs 2 bar tuning over here. He also happens to be a SYVECS god, so I'm going to ask if he can take a look whilst they have my F to see what he thinks.

I'll update everyone once I hear anything from him for sure.

Originally Posted by lobuxracer

Their top tech at the time, a guy they called Tadashi, had the ability to see the maps

Originally Posted by pilsner

The tuner offered dyno before and after with custom map tuning..for free. I did some research and it seems that the magic word is MAGICMOTORSPORT tools. Stay tuned.
http://www.magicmotorsport.com/tag/lexus-denso-896xx/

Originally Posted by juanmedina

So when is this happening?

Originally Posted by ISF2NV

Sorry to break the news to you , but even SYVECS Didnt touch the engine ecm, all they played with was the transmission computer .