1. Attachments are working again! Check out this thread for more details and to report any other bugs.

Speed sensor defeat - a modified approach

Discussion in 'Gen 2 Prius Audio and Electronics' started by b11101100, Jun 11, 2008.

  1. b11101100

    b11101100 Spectra Blue Mica Driver

    Joined:
    Apr 17, 2008
    58
    2
    0
    Location:
    Arizona
    Vehicle:
    2008 Prius
    My plan is to use a PIC microcontroller to monitor the steering wheel buttons and controlling the speed sensor signals. Whenever someone presses and holds the off hook button for 2-3 seconds the system will activate and send a false phone speed signal. This will fool the computer into thinking the car is only going 2-4 MPH and allow full controls for my passenger. When the on hook button is pressed it will turn off and allow the signal to pass through as normal. The same will be done for the navigation with the map button.

    If this works the parts count will be minimal. The most expensive part will be the PIC microcontroller and it should only be 2-3 dollars. Total part cost should be around $10-$15. See below for a schematic of the proposed circuit.

    I think all the needed connections can be found in the same place where the normal bypass switches would be tapped at. I have a few free hours this week and should be able to put something together. I’ll provide updates as I go.
     

    Attached Files:

  2. efusco

    efusco Moderator Emeritus
    Staff Member

    Joined:
    Nov 26, 2003
    19,891
    1,193
    9
    Location:
    Nixa, MO
    Vehicle:
    2004 Prius
    Model:
    N/A
    Somewhere, recently, someone reposted the schematic Brosnan used to create a nice circuit similar to, but a bit more advanced than, what you're proposing. I have one of his Bluetooth custom circuits.
    I just tap the off-hook (no need to hold it down) and the BT phone becomes fully accessible by disrupting the speed sensor...there really isn't any need for a false signal for the phone.
    His NAV speed sensor used the NAV button (either Map or Dest...I don't recall) and I'm not sure if he had it send a false signal...I don't have it, but there is value in doing so to prevent the GPS from taking over.

    *I found the BT schematic if you want it. I tried to upload the file but can't seem to get the attachment tool to work.
     
  3. b11101100

    b11101100 Spectra Blue Mica Driver

    Joined:
    Apr 17, 2008
    58
    2
    0
    Location:
    Arizona
    Vehicle:
    2008 Prius
    I have actually seen that schematic before. I was thinking about going that route but I don't have all the parts on hand. If this works it will only require on 14 pin chip, a voltage regulator, three capacitors and a few resistors. (and the abilty to program the PIC microcontroller)

    I could set it up so it only requires a tap of the off hook switch. I guess there isn't a down side to doing so. I was just trying to set it up so it wouldn't get activated in normal operation.

    Not quite as elegant as the Brosnan circuit, but should do what i need it to. One difference is I'm not planning on connecting to the MFD switches so all inputs are from the steering wheel controls.
     
  4. Danny Hamilton

    Danny Hamilton Active Member

    Joined:
    Apr 30, 2007
    926
    94
    0
    Location:
    Greater Chicagoland Area
    Vehicle:
    2007 Prius
    Model:
    N/A
    So the 2 key questions are:

    How difficult will this be to install?

    How much would it cost me to have you build one for me?
     
  5. qbee42

    qbee42 My other car is a boat

    Joined:
    Mar 2, 2006
    18,058
    3,075
    7
    Location:
    Northern Michigan
    Vehicle:
    2006 Prius
    You wouldn't even need the 14 pin chip. You could do it with one of the 8 pin ones, but size and cost are not really an issue. I would probably use one of the 18F controllers, but that's just because I have a lot of them lying around.

    Tom
     
  6. b11101100

    b11101100 Spectra Blue Mica Driver

    Joined:
    Apr 17, 2008
    58
    2
    0
    Location:
    Arizona
    Vehicle:
    2008 Prius
    I too would have preferred to use a 18F controller, but I didn't have any extra of those laying around. The choice of a 16F688 was just because I have a bunch left over from another project.
     
  7. b11101100

    b11101100 Spectra Blue Mica Driver

    Joined:
    Apr 17, 2008
    58
    2
    0
    Location:
    Arizona
    Vehicle:
    2008 Prius
    I’ve got the circuit put together. I’ve also identified the wires I’ll need to tap into and have verified them with an oscilloscope. To test things out I’ve loaded some test firmware to simulate slow speed driving. It appears to work. The navigation diagnostic screen indicates 3 mph even with the vehicle parked.

    I have updated the schematic to reflect the as built configuration. I added a potentiometer to use a reference for the internal comparator to sense the speed signal.

    Now I need to develop the firmware to read the button presses and pass the speed signals through.
     

    Attached Files:

  8. qbee42

    qbee42 My other car is a boat

    Joined:
    Mar 2, 2006
    18,058
    3,075
    7
    Location:
    Northern Michigan
    Vehicle:
    2006 Prius
    Is the speed-in signal frequency modulated, PWM, or something else? I assume the button press signals are simply varying the voltage, and you are using two of the analog inputs to reference those to the voltage on the potentiometer. Is this correct?

    Btw, that's really an ugly board. :) I guess that's what happens with bread boards.

    Tom
     
  9. b11101100

    b11101100 Spectra Blue Mica Driver

    Joined:
    Apr 17, 2008
    58
    2
    0
    Location:
    Arizona
    Vehicle:
    2008 Prius
    When I first started this project I wasn't sure what the speed signal actually looked like. I just knew that its frequency was proportional to the vehicle speed. I wasn’t sure if it was a square, sine, or some other kind of waveform. My initial plan was to use the 16F688 adjustable internal reference, feed it along with the vehicle speed signal to the internal comparator. Use the comparator to generate an interrupt and change the state of the outgoing speed signal lines. After looking at the datasheet for the PIC I discovered it could not be configured to shut down one comparator and have the voltage reference feed the second. That’s when the potentiometer was added, to provide an adjustable reference voltage for the comparator. Now that I’ve looked at the vehicle speed sensor signal I don’t believe this would be needed, but it’s in there anyway. The speed signal is a 0 – 10 volt square wave with a frequency proportional to vehicle speed.

    Yes it is an ugly board. But considering I was soldering on an old breadboard with a $5 soldering iron it's not too bad.
     
  10. b11101100

    b11101100 Spectra Blue Mica Driver

    Joined:
    Apr 17, 2008
    58
    2
    0
    Location:
    Arizona
    Vehicle:
    2008 Prius
    It’s alive. I just got back from a short test drive with my wife and it appears to work. The resulting circuit is pretty small. Not even half the size of a key fob.

    Since the previous pics I’ve added some hot glue to the wires for strain relief, some loom to the wires to clean up the mess, and hot glued the board to the side of the connector housing. This location will allow me to remove the microcontroller for reprogramming through the glove box opening. Once I’ve had a chance to thoroughly test it, I’ll heat shrink the board and mount it properly.

    There are seven wires to connect. All connections are made by only removing one panel.

    Power.................5H-14....Accesory Power to Radio
    Gnd....................5B-5......Ground for cruise control
    AC2....................5B-15
    AU2....................5E-4
    Speed Signal in.....5E-11....(to connector)
    Nav Speed out......5E-11....(to harness)
    Phone Speed out...5E-12....(to harness)

    The software was fairly simple. Although I had loaned my debug cable to friend and didn’t have it here. So each minor program change meant pulling the chip and to debug I used a RS-232 level converter and streamed out debug info. A brief description of program operation follows.

    I use Timer1 to generate an interrupt every 10 mS. At that time I scan both of the analog inputs with the A/D to determine if a button has been pressed. If a button is being pressed I increment a counter for that button. Once a certain number of counts have been reached I set or clear registers to indicate if the speed sensors should be bypassed.

    Another function of this interrupt is as a timer for a four hertz signal (~3 mph). If a register is set (indicating the speed signal should be bypassed) this interrupt is responsible for toggling the appropriate output.

    As mentioned in a previous post, the speed signal is feed to the comparator and used to generate an interrupt. If the registers are clear it will toggle the appropriate output lines. If a register is set, it takes no action allowing the Timer1 interrupt to generate the speed signal.
     

    Attached Files:

  11. efusco

    efusco Moderator Emeritus
    Staff Member

    Joined:
    Nov 26, 2003
    19,891
    1,193
    9
    Location:
    Nixa, MO
    Vehicle:
    2004 Prius
    Model:
    N/A
    Nice work....I sure wish I knew something about electronics....what a huge hole in my knowledge base.
     
  12. hobbit

    hobbit Senior Member

    Joined:
    Mar 23, 2005
    4,089
    468
    0
    Location:
    Bahstahn
    Vehicle:
    2004 Prius
    Model:
    N/A
    Nice tidy hack! Bet Coastal Dave is rolling in his grave.
    .
    _H*
     
  13. 9G-man

    9G-man Senior Member

    Joined:
    Jul 2, 2005
    1,273
    194
    0
    Location:
    Atlanta, GA
    Vehicle:
    2012 Prius Plug-in
    Model:
    Plug-in Base
    Very nice, impressive work. Can you make something so the navigation system is fully functional while driving, and doesn't lose it's positional accuracy? So that it functions as well as when sitting stationary?
     
  14. RobH

    RobH Senior Member

    Joined:
    Sep 18, 2006
    2,369
    980
    70
    Location:
    Sunnyvale, California
    Vehicle:
    2006 Prius
    How about if your controller accumulated the speed pulses, and then occasionally output them in a burst? If used for the radio or nav functions, the buttons might grey out momentarily, but still be usable most of the time. Depending on the detection logic, you might even slip past it entirely.
     
  15. b11101100

    b11101100 Spectra Blue Mica Driver

    Joined:
    Apr 17, 2008
    58
    2
    0
    Location:
    Arizona
    Vehicle:
    2008 Prius
    This could be difficult to do. The only way I know to enable the navigation functions is to modify the speed signal. This same signal is used to calculate distance travelled and vehicle position. With this approach it only requires a press of a button to switch back and forth. (There can be a short delay in acquiring your position after switching back.)

    Of course I'm no expert on the subject. I've only had my Prius a few months and am still busy trying to learn as much about it as I can. This is just a variation on the method of using a switch to interupt the speed signal.

    If anyone has suggestions on how this can be done I would love to hear them.
     
  16. b11101100

    b11101100 Spectra Blue Mica Driver

    Joined:
    Apr 17, 2008
    58
    2
    0
    Location:
    Arizona
    Vehicle:
    2008 Prius
    This sounds like an interesting approach. Theoretically it could work. However, my initial thought is it won’t react fast enough for this approach to work smoothly. Still I think it is worth looking into.

    My first questions are:
    How quickly can pulses occur with the nav system still counting them?
    Are there delays in the locking out and enabling of the nav functions?
    Can a short high speed burst of pulses pass through without locking out the system?

    Work is keeping me really busy right now. However if I get a chance I’ll play around with this some and report the results here.
     
  17. b11101100

    b11101100 Spectra Blue Mica Driver

    Joined:
    Apr 17, 2008
    58
    2
    0
    Location:
    Arizona
    Vehicle:
    2008 Prius
    I tried feeding a faster signal into the navigation system. It appears it will accept speeds up to around 250 mph (~300 Hz). Anything above this limit registers as 0 mph.

    With this limit known, I programmed the PIC to output a variable number of 250Hz pulses every two seconds. I stepped the number of pulses from 100 down to 4 in increments of 4. It appeared that when the pulses started the nav functions were almost immediately locked out. When the pulses ceased there was a short delay before the lock was released. Even with only 4 pulses the lockout lasted for around 0.5 second. With 100 pulses the delay increased but only to around 1 second. The delay would vary slightly from one time to the next. I tried to enter data like this. It was possible but a big pain with the keyboard blanking out every two seconds.
     
  18. nerfer

    nerfer A young senior member

    Joined:
    Mar 1, 2006
    2,507
    237
    28
    Location:
    Chicagoland, IL, USA, Earth
    Vehicle:
    Other Hybrid
    Model:
    N/A
    This is a little off-topic, but I got to ask 0xCE, are you related to 0xDB (from Dan.'s signature)?
    I'm assuming those are his initials, so if those are your initials, then you're only related in spirit...

    1011110011101101 1100000011011110
     
  19. chinalfr2

    chinalfr2 Member

    Joined:
    Mar 23, 2007
    234
    0
    0
    Location:
    New England
    Vehicle:
    2007 Prius
    I like the hack, but can a noob do this? I think I can catch up with the schematic, but programming PIC will be new to me.
     
  20. b11101100

    b11101100 Spectra Blue Mica Driver

    Joined:
    Apr 17, 2008
    58
    2
    0
    Location:
    Arizona
    Vehicle:
    2008 Prius
    As far as microcontroller circuits go, this is a pretty simple one. The hardware is very straight forward.

    At this time I haven't released the firmware. If there is interest I plan on releasing it for personal use after some more testing. I am looking for someone else interested in trying this. Do you have any microcontroller experience and the ability to program a PIC?

    No relation. Just both familiar with hexadecimal notation.