Speed sensor defeat - a modified approach

I'd be interested in trying to build a similar board.

My experience with PIC is that I have MPLAB, a PICkit 2, and several chips (16F690, 16F550, and 16F88). Other than fiddling with their sample programs, I've never actually written something for PIC. My intention is to use a PIC board to adopt a standard remote start unit for my Prius. A nav/radio speed interrupt would probably be a better project to start with.

 

I am a professional PIC programmer and hardware designer. I would be willing to answer a few questions to help out.

Tom

 

Tom,

Thanks for the offer.

Apparently the PIC can output a signal adequate to drive the NAV speed line. But what should I use to emulate the Power & keyfob insertion switches? They are both double switches that drive the control line to ground. And then there is the brake light switch. It is 12V at enough power to run the brake lights.

The Freescale 33888 is really interesting, but it only comes in a SMD package. Is there something similar in a DIP package? What was used before there were things like high-side/low-side switches?

I understand things like a CK722, but these quad switches are a bit too space age for my ancient knowledge...

/Rob

 

The I/O pins on a PIC can handle only a few mA; enough to drive a small LED, but that's about it. There is also a total package limit on input current. For something like you describe, it's often easy to use a small transistor driven by the PIC output. I've used a lot of 2N2222As over the years. They are cheap and effective. If you want to be a bit more elegant, there are a number of solid state realy ICs made for just this purpose.

If you restrict yourself to DIP packages, your options are going to be limited. Surface mount is fairly easy to work with once you get the hang of it. I routinely hand solder TQFP80 packages. If I can do that with my shakey hands, a person can hand solder almost anything.

Tom

 

Can you breadboard a SMD device without the appropriate circuit board? Or do you have a bunch of stock circuit boards with SMD pads just for breadboarding?

 

I usually design a new board, but it is possible to breadboard SMD devices. There are a number of stock adapters, which are really tiny PC boards with solder pads and connection points. You attach the SMD device to the tiny board, then solder wires to the breakout pads.

Tom

 

I did it! I now have a homebrew bypass on my 2012 Prius v (with 2016 head unit). Apologies for leaving this in the regular Prius forum but it really is a continuation of the ideas of this thread. If you think it needs to be moved to the Prius v forum, please do so.

I really liked the stealth install requiring no extra buttons but this was also a learning challenge for me. A more efficient approach would have been to purchase a bypass kit but I couldn't stand the tacky switches they came with.

Since I do not have microcontroller programming hardware, development software, years of experience programming, the surface mount components or skill to solder them, I needed to find a different way. I opted for a Digispark knock off development board that can be purchased for about 1 $ on Aliexpress and programmed in the Arduino environment. This gave me a small board that was prebuilt with most of the things I needed (AVR microconroller, capacitors, linear regulator). Then I made a small board to add the resistors. At the end of the day, my board is comparable in size to b11101100's but a lot thicker as it is 2 boards, one on top of the other.
Digispark board

For the geeks in the audience, the Digispark is an Attiny85 board with 6 I/O, a USB connector and comes with the micronucleus bootloader. The bootloader is able to bit bang USB and for the first few seconds after power-up will try to connect to special drivers in Arduino software to load any new sketch waiting in the Arduino software. If it doesn't find a new sketch in waiting, it just loads and runs whatever program is already in the controller. These are a little more fragile than an Arduino board. Do not connect them to USB while getting power from an external source. For the price, I bought a couple of them in case the magic smoke got let out.

Like b11101100, I didn't go to the trouble of creating a proper automotive power conditioning circuit. Also, the capacitors on the 12V side aren't rated for major spikes. My hope is that the 12V system in Prius is not going to have the same noise as a regular car. If the board gets cooked, I`ll invest more effort on the power supply and program up and install another board I guess. Side note is that it has survived a jump start when my better half killed the battery while taking a break from skiing.

My bypass is activated when a person gives a long press on the "On Hook" steering wheel button. This seemed to be the best button as I could press and hold it down without causing some action in the car. The only downside I can see is you will hang up on someone who is providing an address, when you go to bypass so your co-pilot can punch it into the GPS.

All connections for the Bypass were made in the L38 main connector to the head unit. I do not like cutting factory wires or T-crimps on factory wires to facilitate the physical installation of the nav lockout bypass, so I de-pinned some sockets from a spare main connector I got with a spare head unit to make my tie ins. I would not do this again. Instead I would order a jumper plug like this one from Auto Harness House and make T-crimps and connections to these wires so the whole setup could be easily changed back to factory. AutoHarnessHouse

L38 Pins Used for Nav Lockout Bypasss (2014 and older/2015 and newer, colour change only)

• SPD 17 (L)
• SWG 23 (P)/(W-B)
• SW2 22 (SB)
• Ignition Power (10 Amp) 1 (B)

Digispark Connections

• Tap into SWG (ground), SW2 (steering wheel "On hook" switch), Ignition Power
• Interrupt SPD

Vin (12v) = Ignition Power
Gnd=SWG
P2=SW2
P0=SPD from Car
P1=SPD to head unit


Once installed, test the system by entering the setup screen on the head unit: With the car on, hold down the SETUP button on the head unit, and click your parking lights on and off three times. Go to the screen showing the Speed and after activation of your bypass look for something 2 km/hr or less. You can enter and exit this mode at any time by repeating the sequence.


Digispark Setup

1. Install Arduino
2. Enter this URL in the File>Preferences> Additional Boards Manager URLs
   https://raw.githubusercontent.com/ArminJo/DigistumpArduino/master/package_digistump_index.json
3. Go to board manager and select Type: "Contributed". Find Digispark and Select Install. This will install the Arduino core for Didgspark from ArminJo's repository who seems to be maintaining a current version of the micronucleus bootloader for digisparks. One advantage of this core is that it will allow you to update the bootloader of your digispark over USB.
4. The USB drivers for the micronucleus bootloader used to be installed automatically when the Digispark boards were added but this was deemed a security risk. You must download and install these drivers to interact with the micronucleus USB bootloader. Download from here, unpack to a location on your local drive and run InstallDrivers.exe:
   https://github.com/digistump/DigistumpArduino/releases/download/1.6.7/Digistump.Drivers.zip
   You may want to check at this repository for a more recent version. If you are using Windows 10 a more involved process may be required to install the drivers as they are unsigned. Google?
5. The first time you upload a new sketch the drivers might take a bit to sort out. Cancel any attempt to get updated drivers and try again if the time window is missed for getting the new code onto the digispark.

Photos and code to come.

 

L38 connector- Note that Pin 1is marked by a small dot on the plastic

L38 Connector by MrZap posted Jan 31, 2021 at 5:31 PM

A crude schematic - Note the power is Not connected to Vcc but to the power in Vin pin on the digispark

IMG_20210131_170719 by MrZap posted Jan 31, 2021 at 5:31 PM

The digispark board - You could saw off the usb connection if you were confident enough in your code

IMG_20201215_213730 by MrZap posted Jan 31, 2021 at 5:31 PM

IMG_20201215_213738 by MrZap posted Jan 31, 2021 at 5:31 PM

My board to add the resistors.

• The header sockets are "Swiss machined sockets" and the pins on the digispark are just copper wire from network cable that has been straightened. These work well together.
  
• I added a couple of jumper pins so that I could remove the digispark and jump the SPD input to the output if needed. These had to be clipped down to fit between the boards.
• Note also that this is not a plain protobaord. It was an Arduino proto board that had traces already built in and I tactfully reused what I needed. This is why you do not see wiring connections as I am using the existing traces. This could be done with standard protoboard wiring techniques.
  
• There are two extra sockets without pins to support the digispark board when pushed together. These are strictly mechanical.
• I used hot glue to provide some strain relief to the wires connected to the board. This is not shown in the photo.
• From the L38 connection, the wires run to the cavity to the left of the upper glovebox where I stashed the microcontroller. This way, I could yank the upper glove box and access or defeat the device without using any tools.

IMG_20201215_213746 by MrZap posted Jan 31, 2021 at 5:31 PM

IMG_20201215_213753 by MrZap posted Jan 31, 2021 at 5:31 PM

Note the top wire is extra and unused. I thought I would connect it just incase I figured out an additional use. The pin sockets on the left are the extra ones for mechanical support.

IMG_20201215_224434 by MrZap posted Jan 31, 2021 at 5:31 PM

My rats nest of wiring to replace the pins in the L38 connector to make the tie ins. I would not do this again. See the previous post.

IMG_20201215_224536 by MrZap posted Jan 31, 2021 at 5:31 PM

 

Here is my Arduino code. My timing calculations may be a bit wrong but it has been tweeked here and the code below works.

Code:

//********************************************
//This code is designed to send a false speed signal to
//a Prius v navigation system when speedSimulated is true
//to allow a co-pilot to use the navigation system.
//A long press (4 sec) of the OnHook buton will activate
//this mode. An additional long press will deactivate.
//It will also self deactivate after about 3-4 minutes.
//It was installed and used in a 2012 Prius v with a
//head unit upgraded to a 2016 model.  It should work
//equally well in the orginal head unit.
//
//Copyright S.Spearing, 2020
//I don't know much about licensing but you are free to
//use this to copy or modify as you see fit.  It would be nice
/if you would give me any feedback on any improvements.
//NO WARRANTY IS GIVEN OR IMPLIED FOR ANY PURPOSE WHATSOEVER.
//USE AT YOUR OWN RISK.


// ATMEL ATTINY 25/45/85 / ARDUINO
// Pin 1, PB5 is /RESET
// On Digispark, PB3 is USB+
// On Digispark, PB4 is USB-

//                       +-\/-+
// RESET/Ain0 (D5) PB5  1|    |8  VCC
//  USB- Ain3 (D3) PB3  2|    |7  PB2 (D2) INT0/Ain1 - default TX Debug output for ATtinySerialOut
//  USB+ Ain2 (D4) PB4  3|    |6  PB1 (D1) MISO/DO/AIN1/OC0B/OC1A/PCINT1/PWM1 - (Digispark) LED
//                 GND  4|    |5  PB0 (D0) OC0A/AIN0/PWM0
//                       +----+

//  USB+ and USB- are each connected to a 3.3 volt Zener to GND and with a 68 Ohm series resistor to the ATtiny pin.
//  On boards with a micro USB connector, the series resistor is 22 Ohm instead of 68 Ohm.
//  USB- has a 1.5k pullup resistor to indicate a low-speed device.              
//  USB+ and USB- are each terminated on the host side with 15k to 25k pull-down resistors.

//Project Pins
//  PB0, spdIn
//  PB1, spdOut
//  Ain1, btnIn

//Setup global variables for use in Interrupts
//Timing values are based on 10 ms per timer tick see Timer 1 below
  const int btnPressTicks = 300;     //time in ticks to press button to change mode
  volatile int btnPressCount = 0;    //track time pressed in ticks
  const int simulatedTicks = 18000;   //time in ticks to use sim speed before auto reset (3 minutes)
  volatile int simulatedCount = 0;    //track time simulate On in ticks
//           ________                     ________
//___________|       |____________________|
//
//                   |-------off time-----|
//           |--------period--------------|
// assume off time of about 50%

  const int slowSpeedTicks = 60;     //period in ticks for slow speed
  const int slowSpeedOffTicks = 25 ;  //off ticks for slow speed
  volatile int slowSpeedCount = 0;   //track time for slow speed output
 
  volatile boolean speedSimulated = false;   //mode of operation, when true, a simulated speed signal will be sent

  int btnVolt = 0;                   //storage of analog read of button voltage in counts
  const int btnPressVLower = 51;     //lower voltage for OnHook button 0.25V/5.0V*1024counts=51counts
  const int btnPressVUpper = 153;    //upper voltage for OnHook button 0.75V/5.0V*1024counts=153counts

  const int spdInPin = 0;              // chip pin 5
  const int spdOutPin = 1;             // chip pin 6
  const int btnPressPin = 2;           // chip pin 7 = AnalogIn 1 = D2

//******************************************************************
//  Timer1 Interrupt Service is invoked by hardware Timer 1 every 10 ms = 100 Hz
//  16MHz / 1024 / 156 = 100.16 Hz = 9.984 ms
//  16.5MHz / 1024 / 161 = 100.08 Hz = 9.992 ms
//  see settings in setup()
//    good reference on Timer Interupt
//    https://arduino.stackexchange.com/questions/18954/creating-a-library-for-attiny85-out-of-working-program


ISR(TIMER1_COMPA_vect)
  {
  onTick();
  //  ***digitalWrite (4, ! digitalRead (4));  //toggle D4 (pin 3 on chip) from previous
  }

//******************************************************************
//  Port Change Interrupt Service
//
//good reference on Interupts
//https://gammon.com.au/interrupts

ISR(PCINT0_vect)
  {
  if(!speedSimulated)
      {
      digitalWrite(1, digitalRead(0));
      }
  }

void setup()
  {
  pinMode (spdInPin, INPUT);
  pinMode (spdOutPin, OUTPUT);
  pinMode (btnPressPin, INPUT);
 
  cli();                   // stop Interupts during interrupt setup
 
  // Timer 1 Interrupt Registers Setup
  TCCR1 = bit (CTC1);     // clear Timer/Counter on Compare Match
  TCCR1 |= bit (CS10) | bit (CS11) | bit (CS13);  // prescaler of 1024
  OCR1C = 161;            // what to count to (zero-relative)
  TIMSK = bit (OCIE1A);   // interrupt on compare

  // Pin Change Interrupt Registers Setup
  PCMSK  |= bit (PCINT0);  // want pin D0 / chip pin 5
  GIFR   |= bit (PCIF);    // clear any outstanding interrupts
  GIMSK  |= bit (PCIE);    // enable pin change interrupts
 
  sei();                    // restart interupts after setup

  }  // end of setup
 
 
void loop()
  {
  // Do nothing.
  }

void onTick()
  {
  btnVolt = analogRead(1);  //read analog1, button signal line
  if ((btnPressVLower < btnVolt) && (btnVolt < btnPressVUpper))
    {
    if (++btnPressCount > btnPressTicks)
      {
      speedSimulated = !speedSimulated;
      btnPressCount = 0;
      slowSpeedCount = 0;
      simulatedCount = 0;
      digitalWrite(spdOutPin, LOW);
      }
    }
  else
    btnPressCount = 0;
  if (speedSimulated)
    {
    if (slowSpeedCount == slowSpeedOffTicks)
      digitalWrite(spdOutPin, HIGH);
    if (slowSpeedCount > slowSpeedTicks)
      {
      digitalWrite(spdOutPin, LOW);
      slowSpeedCount = 0;
      }
    if (simulatedCount++ > simulatedTicks)
      speedSimulated = !speedSimulated;
    slowSpeedCount++;
    }
  }

 

Here is a much better schematic.
Note that everything except the stuff at the top right is already on the digispark board. one component that is missing from my solution that was in the original is the capacitor on the 12v input. Time will tell.

Schematic by MrZap posted Feb 1, 2021 at 8:34 AM

 

When are you going to build for retail sale? I have always used the old school voice command method instead on my v but might be interested.

 

I have a 2013 v with a 2016 510057 MFD. It would be really great if this works. I was thinking that Toyota got wise to the slow speed simulator solution for SLO, and made it impossible in later MFDs. Most posts about SLO indicate that a simulated speed of 3-4MPH will work, but on my MFD, the screens lock out when the speedometer reads above zero MPH.

However I am handy with a soldering iron. It has been a while, but I have played with Arduinos before. Maybe I could build a few in January 2022.

 

I have purchased five ATtiny 85 boards, and I got the Arduino environment to load the code into the boards. I plan to build at least 2 of these for my two Prius v cars.

I plan to make minor tweaks to @MrZap's code. First I will provide two status LEDs to make troubleshooting easier. Second, I will have the "Simulated" mode triggered by either the "On Hook" or "Off Hook" buttons being pressed for three seconds.
Next step: build resistor board, and wire it up! The most expensive component is the $25 harness adapter:
AutoHarnessHouse

I am willing to make more of them for sale, but the harness cost makes it difficult justify building five of them, with the hope I can sell the other three.

Reply to this thread if you are interested in purchasing one of these (or message me directly if that works). I haven't totaled up what the final cost of the parts. That makes the final price I would be willing to sell them difficult to determine. I would assume the cost is going to be at least $50 because of the cost of harness adapter.

 

Will this work on the early 57011 mfds or just the newer versions?

 

Should work on 57011. Since I have an unused 57011, I should be able to test if it works.

 

Today I ordered the parts, including 3 of the Harnesses from AutoHarnessHouse (the most expensive single part). This commits me to making 3 units.

I have done similar projects before, and they worked out OK. However these projects were for myself. When I broke something, I could fix it.

This project is different, since I am building a kit for someone else to install. I have to assume the installer will be someone who has less electronics skills than I do. That is why I went with the AutoHarnessHouse harness to eliminate the end user from having to perform any soldering. I can test the kits on my own car.

 

I have all the parts, including the AutoHarnessHouse harness:


Can anyone help me with the Toyota wire color indicators?

From Mr. Zap's post:

SPD 17 (L) - I assume SPD is Speed; where (L) is what color?
SWG 23 (P)/(W-B) - SWG Signal Wire Ground? Color (P) == pink? with (W/B) white & black stripe?
SW2 22 (SB) - SW2 Signal Wire #2?; where (SB) is what color?
Ignition Power (10 Amp) 1 (B) - Pin 1 is black, I can verify which corner is Pin 1 using a multi-meter.​

 

I found a PDF I had that explains two of the colors for me:
P == Pink
SB == Light Blue ("Sky Blue"?)

Still don't know what color "L" is, and that is the wire that requires cutting.

The PDF also verifies SWG and SW2.

 

Why, bLue, of course (Black was already taken).

 

So all of this just does the same thing as the coastal systems Basic Lockpick or the manual diagnostic ode that you can do without a Lockpick device?