Change Sat Nav Address Whilst Driving

[bob-o]

yep i expect the toyota lawyers told them if it was just a jumper to ground that would not be considered reasonably "tamper-proof". I wonder if the $309 box just has a couple of bucks worth of parts inside.

[pillpusher84]

Dr. Dyno ....

Let us know how well your unit works ... I'd be interested to find an alternate, inexpensive solution as you are proposing.

[bob-o]

Starting with the design from the 4WD guy with a different nav system, I made some measurements on the Pioneer/Toyota unit in my car and figured out how to defeat the lockouts for both nav and phone functions. It's pretty simple and costs less than $10 in parts.

Using the drawing of the radio system posted by our ever helpful narrator, I found that on my car the speed sensor wire is on pin 2 of the 28 pin connector on the HU, and is green. The signal varies from about 0-5V, NOT the 12V used in the original design. 12V might work, or might fry the input and make the system unusable.

The speed sensor pulses occur at about 1 Hz per MPH. The system locks out the nav keyboard functions above 5.5 Hz. in my testing. The bluetooth phone keyboard dialing is disabled if there are any pulses at all.

Disconnecting the speed wire from the nav will enable both functions. There is no "tamper" function. It does not matter how far or how fast we drive; there will be no lockout. The problem with doing this is that the nav system decides when to update based on the speed sensor rate, and it refines the gps location with the known distance traveled and the internal compass. To avoid the location jumping around when not in motion, the gps system ignores small location changes when the car is not supposed to be moving. It only updates every few seconds when there is no speed signal. The location shown and the direction of travel will be off.

When you reconnect the speed wire after driving around with it disconnected, the nav will put on a crazy dance of the vehicle wandering back onto the right track and reorienting as the true position is recalculated. I expect calculating a route would be difficult during that time.

To minimize this problem, we want the replacement speed signal to be as fast as possible, without going over the lockout limit. The slower our replacement signal, the jumpier the gps display and greater the location error. 4 Hz is fast enough for reasonable gps function, and far enough from the upper limit that it is easy to build a circuit with inexpensive components that will vary less than 20% over the expected temperature range, leaving margin for safety. GPS accuracy is NOT as good as the system operating with the speed signal connected.

Phone keypad dialing will not work if there are any speed pulses at all. For the length of time it takes to dial a number the gps will not get too confused or take too long to correct, so just disconnecting the speed signal or shorting it to ground for that brief period is the only solution. Using a series resistor on the 555 output and clamping with a zener would let an additional switch shorting the signal to ground provide dial keypad function when already in lockout defeat mode. I would not recommend just shorting the speed signal to ground.

A 555 in astable mode with a 10% 1 uf poly cap and 180k and 1k 5% resistors would produce about 4 Hz output that should be OK without a pot for those who don't have a scope or other way to adjust the rate. You could also use a .47 uf cap which is a bit more common, and a 360K resistor. The circuit would work with a cheap electrolytic cap, but for $2 or less, a good poly cap is worth using IMO. A 5v zener and 10k resistor can be used to clamp the output to <5v or a 5V regulator used to supply the 555 power, so as not to feed 12V pulses into a 5V input. Total parts cost < $10.

555 timer IC - Wikipedia, the free encyclopedia

Putting an LED on the 555 output would let one see the flashes and verify they are 4 per second by counting one-one-thou-sand, and seeing that the flashes are about the same rate.

In the original design he used a relay to select between the 555 pulses or the speed sensor pulses, then used a switch to energize the relay. This lets the switch control power to the circuit as well as switching modes. Power is just a few milliamps and I took it from the ACC line, but using the relay lets a simple OEM foglight or similar SPST switch control the lockout function from a now vacant cutout. The fog light switch is lighted so it will indicate the lockout defeated condition. A multiplexer chip could be used instead of the relay for lower cost, smaller size, higher reliability.

I am not encouraging anyone to do this, just reporting the results of my own experimentation.

[Rickl]

Excellent explanation Bob-0.

As I said in a previous post, the speed signal is used for dead reckoning, which helps determine location when the GPS signal is lost. I have had numerous Garmin units without Dead Reckoning, and the Pioneer Avic X930BT which was factory installed on my Subaru Legacy also never had the speed sensor connected. I have never been in a situation yet where Dead Reckoning would have helped. Granted the displayed position may jump a little when stopped, but that is a minor consequence compared to the benefits of disabling the lockouts.

One problem you may experience , is that some models of GPS are programmed to give you verbal turn instructions at predefined intervals such as 15 seconds prior to the turn. If your nav unit thinks it is moving very slowly (because of the pulse generator), it may not give the instructions to turn early enough. Of course these other units calculate the speed from the satellite signals to determine warning times.

[bob-o]

Originally Posted by Rickl

the speed signal is used for dead reckoning, which helps determine location when the GPS signal is lost.

The behavior of my system seems to indicate that it uses the speed signal for more than just dead reckoning when gps is lost. It appears to combine the two with compass readings to get better real time data. It acts like readings might stack up in a queue when there is no speed signal. I drove around for a couple of miles with no speed signal, and when I reconnected it my location was over 100 yards off and the car symbol spun around and jumped several times as it found its way back to the path.

With the 4 Hz replacement signal the nav display is a bit jerkier than in normal mode, but there are not significant position errors over a short time. As I slowed down the pulse generator the position started to jump in bigger increments.

[Rickl]

Originally Posted by bob-o

With the 4 Hz replacement signal the nav display is a bit jerkier than in normal mode, but there are not significant position errors over a short time. As I slowed down the pulse generator the position started to jump in bigger increments.

A Garmin GPSR recalculates it's location every second regardless of vehicle speed. I'm just guessing here but, it would appear that your unit uses vehicle speed to determine the update interval. I presume this is to spare up CPU cycles to perform other tasks.

When you are traveling at slow speeds, you can get away with slower update intervals. When you fed the unit the 4 Hz/4 MPH pulse, while driving at 30 MPH, it updated it's location less frequently, resulting in the "car" hopping on the map.

When you reconnected the speed signal when your position was off by 100 yards, you say that it corrected itself. I don't think that knowing the car was moving provided the more accurate location. I think the speed signal may have instructed the unit to stop sitting idle, and update it's location.

If this theory is correct, I think it will become a big problem when driving in an area where intersections are close together. You could be already past the intersection before the GPS updates your location and notifies you.

I wonder if there is another alternative. For example my Pioneer won't let me do anything unless the parking brake is on. If I permanently ground the PB signal, the unit gives me error messages when I start to drive. The secret to defeating this unit is an unused pin on the rear connector. There isn't even a contact in the connector cavity. You have to insert a contact and then ground this new wire and the PB wire, and everything is good. Perhaps this backdoor is provided for areas that have different laws, or just a way to give them an edge in product sales.

[bob-o]

Like you say we are only guessing, but the way my unit recovered in a number of steps where it changed the indicated direction of travel and location before finally arriving at the correct coordinates could not be just the update rate. There must be something more going on. Could it be that this $3200 unit does something the much less expensive Garmin does not?

At 30 mph driving through town, with the 4 Hz update rate substitution, I noticed an error of less than a hundred feet or so, but it could accumulate. I think the lockout disable should only be used when necessary and not left on.

Here's a simple schematic for those interested. The relay could be replaced with an spdt switch if the circuit is powered all the time from the ACC line.

There is an error in the original schematic, the anode of the zener should be connected to ground and not to the C1 Pin2 net. The attached file is now correct, though a bit sloppy as I edited it without using the cad software. I didn't bother to save the original file when converting it to .png. I'm still programmed not to waste disk space. Now that I have a TB instead of the 8MB on my first AT I should be less thrifty of disk space.

[Dr. Dyno]

I don't have either system in my RAV but it seems to me from Bob's study a simple SPST switch which would disconnect the VSS signal while you dial the phone or input an address would do all that's needed. Just turn it back on as soon as you're done. No circuit needed. The fact that the GPS/NAV didn't update while entering an address is a non-issue and I'm sure while dialing isn't really either. Or am I missing something?

[bob-o]

Originally Posted by Dr. Dyno

Or am I missing something?

Yes you are. go back and read my posts.

[Rickl]

Originally Posted by bob-o

I think the lockout disable should only be used when necessary and not left on.

Here's a simple schematic for those interested. The relay could be replaced with an spdt switch if the circuit is powered all the time from the ACC line.

I think that connecting the pulse generator only when you need to enter a new destination, is the best option. The rest of the time your system will work normally with full speed updates. When you are programming a new destination you really don't care that the system is inaccurate for that short period.

I have a question regarding the position of the Zener. You have the anode connected to the top of C1. I would expect that if you are trying to limit the voltage into the NAV unit, that you would reference the Zener to ground. I think that the Zener in this position would also change the charge/discharge rate of C1 and alter the timing. Also in your writeup you mentioned a 10K resistor in series with the output, but your diagram shows a 1K resistor, which I think is more suitable.