Speed sensor defeat - a modified approach

My plan is to use a PIC microcontroller to monitor the steering wheel buttons and controlling the speed sensor signals. Whenever someone presses and holds the off hook button for 2-3 seconds the system will activate and send a false phone speed signal. This will fool the computer into thinking the car is only going 2-4 MPH and allow full controls for my passenger. When the on hook button is pressed it will turn off and allow the signal to pass through as normal. The same will be done for the navigation with the map button.

If this works the parts count will be minimal. The most expensive part will be the PIC microcontroller and it should only be 2-3 dollars. Total part cost should be around $10-$15. See below for a schematic of the proposed circuit.

I think all the needed connections can be found in the same place where the normal bypass switches would be tapped at. I have a few free hours this week and should be able to put something together. I’ll provide updates as I go.

 

I have actually seen that schematic before. I was thinking about going that route but I don't have all the parts on hand. If this works it will only require on 14 pin chip, a voltage regulator, three capacitors and a few resistors. (and the abilty to program the PIC microcontroller)

I could set it up so it only requires a tap of the off hook switch. I guess there isn't a down side to doing so. I was just trying to set it up so it wouldn't get activated in normal operation.

Not quite as elegant as the Brosnan circuit, but should do what i need it to. One difference is I'm not planning on connecting to the MFD switches so all inputs are from the steering wheel controls.

 

I too would have preferred to use a 18F controller, but I didn't have any extra of those laying around. The choice of a 16F688 was just because I have a bunch left over from another project.

 

I’ve got the circuit put together. I’ve also identified the wires I’ll need to tap into and have verified them with an oscilloscope. To test things out I’ve loaded some test firmware to simulate slow speed driving. It appears to work. The navigation diagnostic screen indicates 3 mph even with the vehicle parked.

I have updated the schematic to reflect the as built configuration. I added a potentiometer to use a reference for the internal comparator to sense the speed signal.

Now I need to develop the firmware to read the button presses and pass the speed signals through.

 

When I first started this project I wasn't sure what the speed signal actually looked like. I just knew that its frequency was proportional to the vehicle speed. I wasn’t sure if it was a square, sine, or some other kind of waveform. My initial plan was to use the 16F688 adjustable internal reference, feed it along with the vehicle speed signal to the internal comparator. Use the comparator to generate an interrupt and change the state of the outgoing speed signal lines. After looking at the datasheet for the PIC I discovered it could not be configured to shut down one comparator and have the voltage reference feed the second. That’s when the potentiometer was added, to provide an adjustable reference voltage for the comparator. Now that I’ve looked at the vehicle speed sensor signal I don’t believe this would be needed, but it’s in there anyway. The speed signal is a 0 – 10 volt square wave with a frequency proportional to vehicle speed.

Yes it is an ugly board. But considering I was soldering on an old breadboard with a $5 soldering iron it's not too bad.

 

It’s alive. I just got back from a short test drive with my wife and it appears to work. The resulting circuit is pretty small. Not even half the size of a key fob.

Since the previous pics I’ve added some hot glue to the wires for strain relief, some loom to the wires to clean up the mess, and hot glued the board to the side of the connector housing. This location will allow me to remove the microcontroller for reprogramming through the glove box opening. Once I’ve had a chance to thoroughly test it, I’ll heat shrink the board and mount it properly.

There are seven wires to connect. All connections are made by only removing one panel.

Power.................5H-14....Accesory Power to Radio
Gnd....................5B-5......Ground for cruise control
AC2....................5B-15
AU2....................5E-4
Speed Signal in.....5E-11....(to connector)
Nav Speed out......5E-11....(to harness)
Phone Speed out...5E-12....(to harness)

The software was fairly simple. Although I had loaned my debug cable to friend and didn’t have it here. So each minor program change meant pulling the chip and to debug I used a RS-232 level converter and streamed out debug info. A brief description of program operation follows.

I use Timer1 to generate an interrupt every 10 mS. At that time I scan both of the analog inputs with the A/D to determine if a button has been pressed. If a button is being pressed I increment a counter for that button. Once a certain number of counts have been reached I set or clear registers to indicate if the speed sensors should be bypassed.

Another function of this interrupt is as a timer for a four hertz signal (~3 mph). If a register is set (indicating the speed signal should be bypassed) this interrupt is responsible for toggling the appropriate output.

As mentioned in a previous post, the speed signal is feed to the comparator and used to generate an interrupt. If the registers are clear it will toggle the appropriate output lines. If a register is set, it takes no action allowing the Timer1 interrupt to generate the speed signal.

 

This could be difficult to do. The only way I know to enable the navigation functions is to modify the speed signal. This same signal is used to calculate distance travelled and vehicle position. With this approach it only requires a press of a button to switch back and forth. (There can be a short delay in acquiring your position after switching back.)

Of course I'm no expert on the subject. I've only had my Prius a few months and am still busy trying to learn as much about it as I can. This is just a variation on the method of using a switch to interupt the speed signal.

If anyone has suggestions on how this can be done I would love to hear them.

 

This sounds like an interesting approach. Theoretically it could work. However, my initial thought is it won’t react fast enough for this approach to work smoothly. Still I think it is worth looking into.

My first questions are:
How quickly can pulses occur with the nav system still counting them?
Are there delays in the locking out and enabling of the nav functions?
Can a short high speed burst of pulses pass through without locking out the system?

Work is keeping me really busy right now. However if I get a chance I’ll play around with this some and report the results here.

 

I tried feeding a faster signal into the navigation system. It appears it will accept speeds up to around 250 mph (~300 Hz). Anything above this limit registers as 0 mph.

With this limit known, I programmed the PIC to output a variable number of 250Hz pulses every two seconds. I stepped the number of pulses from 100 down to 4 in increments of 4. It appeared that when the pulses started the nav functions were almost immediately locked out. When the pulses ceased there was a short delay before the lock was released. Even with only 4 pulses the lockout lasted for around 0.5 second. With 100 pulses the delay increased but only to around 1 second. The delay would vary slightly from one time to the next. I tried to enter data like this. It was possible but a big pain with the keyboard blanking out every two seconds.

 

As far as microcontroller circuits go, this is a pretty simple one. The hardware is very straight forward.

At this time I haven't released the firmware. If there is interest I plan on releasing it for personal use after some more testing. I am looking for someone else interested in trying this. Do you have any microcontroller experience and the ability to program a PIC?

No relation. Just both familiar with hexadecimal notation.