Reading and Writing Immobilizer EEPROMs in Circuit
Sometimes when working with immobilizer EEPROMs, the ideal way of programming the EEPROM is by doing it while it is in the circuit, as removing it, programming, and resoldering it back to the circuit adds a bit more effort and time to complete the job.
Doing it “in-circuit” can be accomplished in many ECMs (not all) by using the SOIC-8 clip or 8 separate SMD pincers and connecting any of those two solutions over the EEPROM chip while it is in the circuit, but sometimes, some inconveniences are present. Some of those inconveniences are; the need of cleaning the EEPROM leads from any protecting silicon, glue, or resin/flux coating the ECM might have in the circuit covering the individual components. Another problem (for the clip) is if the EEPROM in question has a too low profile, making it impossible to have enough grip on the chip body to keep the clip in place.
Possible problems of using this appoach
Above all inconveniences of programming an EEPROM in an “in-circuit” fashion is the possible situation that the microcontroller (MCU) in the ECM circuit could be sensitive to voltages that the EEPROM programmer uses for reading and writing the EEPROM chip. This happens very often because working voltages of the MCU jumped from 5 volts to 3.3 volts and nowadays, to as low as 1.8 volts. In these cases, the problem is that the microcontroller receives enough current from the EPROM programmer that it actually attempts to start (run) its internal program. This situation will vary from ECM to ECM and from programmer to programmer, but when it happens, it will interfere with the data we are working with and will corrupt it. When this happens we will end up with an incorrect image of the EEPROM if we are in the reading process or will program the wrong data to the EEPROM if we are writing to it.
For this, we can try the common solution of disabling the crystal oscillator of the MCU to prevent it from running, or at least attempt to prevent it, as this does not work in all cases. It is accomplished by simply jumping the crystal oscillator by running either a relatively large capacitor, in this example a 0.1uf capacitor, or a small jumper wire across the crystal (in parallel to it). In the picture below, it is shown how a 0.1uf capacitor was temporarily soldered across the crystal terminals to disable it.
Other Solution
In the event that you don’t have a SOIC-8 SMD clip to read and write the immobilizer EEPROM or you simply don’t like that method for being somewhat unreliable, below is pictured another approach for doing it. For this, you will need to construct the harness or buy it already assembled, as it is already available to be ordered online.
The mentioned wires are made of 8 micro clips and an 8-connections dual pin header (4 + 4) for connecting it to the programmer. Once constructed, you will be able to use it over and over and will even have a larger lifespan than the SOIC clip itself. If you decide to construct it yourself, be as neat as possible and use high-quality materials so you end up making a durable tool and don’t just make a prototype like the one shown here 🙂
There are online stores that sell some of the equipment used for this job. For example, you may get the SOIC-8 SMD clip complete with its harness and ready to use from stores over the Internet, on eBay for example.
On a final note, please be always careful when working with static sensitive electronics. Always use an ESD (Electro Static Discharge) protection to avoid unrepairable damage to the circuits and/or devices, especially if you live in cold-dry weather.
Hi
When i open my car speedometer i didnt see 93c56 chip, i can only see a chip with c56 d910 writing on it
If you interested in this car chip i can send you the picture
Please tell me how do i read and write data to this chip
Thanks
I cant.clip using the pomona clip
Because the chip too small
8pin chip but smaller.than the pomona.clip
Please help how to program this chip
Hello Calvin. When that happens, the solutions are two; take out the chip (desolder) and grab it with the clip, or use 8 wires with micro-pincers at one end and a DIL-9 terminal at the other. The solution is here in the blog, but looks like images are not showing for some reason after an update of the software. We are working to have the website back to normal, so you may visit us at a later time to see if the contents is restored.
Hello I have one question what is safer reding and writing the EEPROM un circuit or resoldering the chip thanks.
Hello Josue. Obviously it is safer to desolder the EEPROM, but the in-circuit approach is tried first as a way of saving time and sometimes, saving the circuit if you don’t have the needed tools to work with surface-mount devices. Depending on the ECM circuit -AND- on the device programmer, you will be able to do it in circuit in some models, but there will be others that no matter what you try, the EEPROM will need to be out of circuit to be read correctly.
I have a 2002 Toyota Sienna XLE of which I damaged the chip in the key.
If I erase all the keys stored in IC900 in the ECU (89661-08070), will the first blank key inserted into the ignition be programmed and paired with the ECU?
Hello. You will need a virgin file for that model. The virgin file does exactly that, it erases all the key codes in that chip, but also leaves a pattern for the ECM to detect it as “no keys and ready to accept new ones”.
Erasing all the keys alone will not do the trick as there are other variables in that chip, like a key counter.
On the other hand, if the chip is not full, a maximum of 8 keys or so are allowed depending on the model, there is a process for registering new keys. It is there for the Rav4 and Corolla and I am positive it is there for the Sienna, but I will need to look it up to check the process. In the mentioned models it is about a sequence of depressing the accelerator and the brake pedals in a certain pattern and timing.
I have a FMI question, when keys are “Programmed” is information actually stored or changed on the rfid chip in the key? Or is it more of a pairing?
Is the immobilizer eeprom (IC900) in the in the ECU (89661-08070) only for key information?
Aside from the ignition systems needed to “immobilize” does it effect other systems?
At least, in these Toyota models and all makes that use the same RFID chip type, the information is stored in the ECM or in the Immobox if present. The key is only read.
I would have to check because on some models, it is only for storing the key codes and keeping a key count, and other things for managing the immobilizer. But in some other models, if it is an automatic vehicle, it does the same in the upper half of the memory and in the lower half, it stores the automatic transmission codes for the shift points.
You are my Main Man Zilog, I am going to give you “My First Born Male Child” for your help.
There is only one caveat, “SHE” is a 38 year old and gets out of a supermax prison for the criminally insane.
A top rated MM artist, ex special force captain, top rated sniper and hand gun tactical course.
Her parole officer will deliver her to your door in a straight jacket, chained to a hand truck, wearing a steel face grill, he will be accompanied by four guards, two with taser prods and two with fire arms.
Hope you know how to make lemonade.
It’s me again Zilog,
I am hearing two different things. I suspect that both are true but are dependent on the year of the vehicle.
One say that I must get a Virgin File from somewhere and upload it to the eeprom and another say that I must reset the reset the eeprom to a virgin state by zeroie the values of certain data in the eeprom.
I have a 2002 Toyota Sienna XLE
ECU: 89661-08070
IC 900: 93C56
Which is the correct method for my ECU?
Sorry, I asked the same question twice.
I gather that virgin files are bin files of a few lines of code?
As with everything in the western world, someone will sell you anything if they can get away with it, can I find safe virgin files to download free of charge?
Both, getting a virgin file or resetting the eeprom to a virgin state will do the same. Any of those two procedures will leave the same binary file in the eeprom.
Yes, in these models the virgin files are from 256 bytes (93C56 eeprom) or 512 bytes (93C66, 25040 eeproms). Yes, you may get it free of charge in some forums where members share things. You just have to ask them in a forum thread.
I can not promise anything, but if you can read the eeprom of your ECM and email to info@TechnicalDomain.net, I can check by comparison if I have the proper virgin file for that model. If I have it, I will email it to you at no cost. You would need to write it in the eeprom (IC900) with an eeprom programmer, using some sort of interface to connect the small device to the eeprom programmer. The most commonly used is the SOIC-8 eeprom clip.
About the forums if you wish to look further information, I can recommend you two of them:
https://www.digital-kaos.co.uk/forums/
https://mhhauto.com/
Cheers
Zilog, I am getting a little bit exasperated. I got a CH341A mini programmer and am having a time trying to get it to work on a Windows 10 laptop.
It seemed to be for XP. Also GitHub say that the software for the CH341A is dangerous.
I need to find programm software that works well with Windows 10 and/or get a better eeprom programmer.
Do you have any ideas?