How to defeat the nav lockouts
Starting with the design from the 4WD guy with a different nav system, I made some measurements on the Pioneer/Toyota unit in my car and figured out how to defeat the lockouts for both nav and phone functions. It's pretty simple and costs less than $10 in parts.
Using the drawing of the radio system posted by our ever helpful narrator, I found that on my car the speed sensor wire is on pin 2 of the 28 pin connector on the HU, and is green. The signal varies from about 0-5V, NOT the 12V used in the original design. 12V might work, or might fry the input and make the system unusable.
The speed sensor pulses occur at about 1 Hz per MPH. The system locks out the nav keyboard functions above 5.5 Hz. in my testing. The bluetooth phone keyboard dialing is disabled if there are any pulses at all.
Disconnecting the speed wire from the nav will enable both functions. There is no "tamper" function. It does not matter how far or how fast we drive; there will be no lockout. The problem with doing this is that the nav system decides when to update based on the speed sensor rate, and it refines the gps location with the known distance traveled and the internal compass. To avoid the location jumping around when not in motion, the gps system ignores small location changes when the car is not supposed to be moving. It only updates every few seconds when there is no speed signal. The location shown and the direction of travel will be off.
When you reconnect the speed wire after driving around with it disconnected, the nav will put on a crazy dance of the vehicle wandering back onto the right track and reorienting as the true position is recalculated. I expect calculating a route would be difficult during that time.
To minimize this problem, we want the replacement speed signal to be as fast as possible, without going over the lockout limit. The slower our replacement signal, the jumpier the gps display and greater the location error. 4 Hz is fast enough for reasonable gps function, and far enough from the upper limit that it is easy to build a circuit with inexpensive components that will vary less than 20% over the expected temperature range, leaving margin for safety. GPS accuracy is NOT as good as the system operating with the speed signal connected.
Phone keypad dialing will not work if there are any speed pulses at all. For the length of time it takes to dial a number the gps will not get too confused or take too long to correct, so just disconnecting the speed signal or shorting it to ground for that brief period is the only solution. Using a series resistor on the 555 output and clamping with a zener would let an additional switch shorting the signal to ground provide dial keypad function when already in lockout defeat mode. I would not recommend just shorting the speed signal to ground.
A 555 in astable mode with a 10% 1 uf poly cap and 180k and 1k 5% resistors would produce about 4 Hz output that should be OK without a pot for those who don't have a scope or other way to adjust the rate. You could also use a .47 uf cap which is a bit more common, and a 360K resistor. The circuit would work with a cheap electrolytic cap, but for $2 or less, a good poly cap is worth using IMO. A 5v zener and 10k resistor can be used to clamp the output to <5v or a 5V regulator used to supply the 555 power, so as not to feed 12V pulses into a 5V input. Total parts cost < $10.
555 timer IC - Wikipedia, the free encyclopedia
Putting an LED on the 555 output would let one see the flashes and verify they are 4 per second by counting one-one-thou-sand, and seeing that the flashes are about the same rate.
In the original design he used a relay to select between the 555 pulses or the speed sensor pulses, then used a switch to energize the relay. This lets the switch control power to the circuit as well as switching modes. Power is just a few milliamps and I took it from the ACC line, but using the relay lets a simple OEM foglight or similar SPST switch control the lockout function from a now vacant cutout. The fog light switch is lighted so it will indicate the lockout defeated condition. A multiplexer chip could be used instead of the relay for lower cost, smaller size, higher reliability.
I am not encouraging anyone to do this, just reporting the results of my own experimentation.
Can't believe this is a bit of a tricky / expensive fix. Very annoying!!
