This post documents how I modded my back door controls to provide rear window up using the factory keyless remote.
DISCLAIMER This is not a how-to guide for you, this is a how-I did it write up. Any modifications that you make to your vehicle are at your own risk and expense. You have been warned. END DISCLAIMER
That said, here we go: Like many 4Runner owners, I was dismayed that the factor keyfob only rolls the back window down, not back up. I am aware that this can be done using an aftermarket alarm that can dedicate a channel to the back-window up command, and I think I read where someone used a pulse extender on the door lock function, but had to run wires to back hatch. This hack is neither of those, and much simpler IMO.
I didn't want to install an aftermarket factory alarm, so I set out to see if I could mod my T4R within the following parameters; the mod should:
(1) Be Implemented using the factory keyfob.
(2) Be Non destructive (I don't consider tapping wires to be destructive.)
(3) Be Low Cost (if the cost isn't much less than an aftermarket keyless entry, what's the point?) and be of low technical risk.
(4) Preserve the built-in safety features of the window (anti-jam technology, down-button override, etc.)
I implemented this hack using about $30 worth of parts (magnetic reed switch, a relay, and a PAC audio TR7 timer module). It took me a while to figure out how to do it, though.
First some background. Looking at the T4R documentation reveals a few things. The back window does not use a limit switch; if you inspect the motor connector and read the FSM, you'll see only the power leads for the window motor and the wires for two Hall-effect integrated circuits (they are blank boxes in the factory service manual called IC1 and IC2--earlier FSMs explicitly indicate these are Hall Effect ICs, and the signal output is used to regulate the motor). Each Hall effect IC produces a pulse as the window motor turns by detecting the passage of a magnet mounted on the motor shaft. Essentially, the the back door ECU is programmed to monitor the voltage (and possibly amperage?) to the motor and the timing of the pulses from the two Hall ICs. Based on these variables, the ECU detects the direction of window operation as well as the position of the window. The ECU can become confused if it senses an anomalous state (for example window-down power being applied, but pulses from the Hall ICs indicating window-up movement) and end up in an indeterminant; hence there are procedures to reset the backdoor ECU and start anew by initializing the window to a known state (window all the way down--hold it there for several seconds till the relay clicks--window all the way up, hold it there for several seconds until the relay clicks).
This arrangement was problematic since it meant I had to either hack the backdoor ECU (risky, failure would be expensive) or find another method to sense window position and affect a window-up action based on a combination of the key fob press AND the window position. If you've ever tried rolling the back window down with the key fob when it is already all the way down, you know that the back door ECU tries to roll the window down, but just momentarily--you can hear the relays click if you stand next to the back door. At that point, the back door ECU apparently decides the window is already down and cuts power to the window motor. It is easy to detect the motor-voltage (a brief voltage pulse when the back door ECU tries rolling the window down), but in this case the window position is probably indicated by the fact there are no pulse outputs from the Hall ICs (since the motor shaft isn't turning).
So how do you detect this state and cause something to happen when you detect it? You could probably program this kind of logic--sense window-down voltage pulse, check for no pulse on IC1 and IC2--into a flexible controller like the Fusion Brain on mp3car.com, but then you're practically building your own back door ECU. I didn't want to go there.
Actually making the window go up is easy: short to connectors on the ECU which are closed when the key is inserted in the tailgate and turned all the way right. The problem is how to detect the window state (all the way open) and how to trigger an action based on the key fob impulse.
So here's what I did.
Materials I used:
- magnetic switch. I used this to detect the window state. This hack will actually work *without* the magnetic reed switch, but it causes some conditions which can be potentially hazardous (more on that later). The limit switch allows this hack to *only* be active when the back window is in the all-the-way-down state.
- 12-volt relay. The relay is used to short the two connectors on the ECU to simulate a key-insert-turn-right condition in the back door. It takes about five seconds for the back window to close completely from being completely open.
- PAC TR7 trigger module (aftermarket alarm accessory that is also a general purpose timer/latching relay/delay switch that has several programmable modes). This is the key item that I searched and searched for (didn't know if anyone made a time module that would do what I want). I think I paid around $15 on Amazon for mine. It has a mode that allows the output to trigger for a set amount of time (say five seconds) based on programmable input (say two pulses within a five second period). (Note: There seems to be some possible difference between the TR7 and the TR-7 according to the PAC audio site (TR-7 I think is an older model). I used the TR7, FWIW.
A picture of how it's all wired up is below.
First, I installed a magnetic switch on the window track/tailgate to sense when the window is fully open. (I couldn't think of simpler way to sense this condition.) In the window-fully-open position, the mangetic switch closes the circuit. I use this circuit to pass the down-motor positive voltage pulse to the TR7 input trigger. Then I programmed the TR7 module to output 12-V for 5-seconds when it sees two impulses to the input trigger within a five second period. This output voltage was in turn connected to a relay, which closes the two wires that activate the back window-up signal.
So here's a walk through of how it works.
STATE: Back Window not down all the way:
Back window works like usual. The curcuit is open in this condition because the magnetic switch is open, so the TR7 receives no trigger inputs from anything.
STATE: Back window all the way down
In this state, the magnetic switch circuit is closed, and connects the down-motor-voltage lead on the back door ECU to the input of the TR7. In this state, clicking on the key fob window-down button twice within 5 seconds causes two pulses to go to the back window motor, and hence to the trigger of the TR7. In response, the TR7 outputs close the relay for 5 seconds. Voila! Window UP after two keyfob pulses!
Some considerations:
- Trigger Settings: Two input pulses within five seconds was chosen as a safety feature. Didn't want just single to start the window-up action, and in fact this won't work to use just a single pulse. However it so happens that the TR7 triggers on the trailing edge of the pulse. So if I put the window down and hit the back-window-down button on the fob within five seconds, the back window goes back up with that one key-fob press. (The first pulse trailing edge is from the first time the window comes down, the second pulse edge is from the key fob press.) After the window is down for at least 5 seconds, then two presses of the keyfob are required to put the window back up.
- Failure detection: if the any of the components--magnetic switch, relay or TR7--fail, the mod is inoperative and the window functions like the factory specs.
- Fail Safe: since the window-up hack acts like the key-inserted-turn-right condition, all of the existing safety features are still active: anti-jam, down-button override. As the window rolls up, it can be interrupted by the down-window keyfob press. (Try it sometime: insert your key all the way right, and hit the down-window button the keyfob. Window up is interrupted. Same behavior.)
- Limited Exposure: without the magnetic switch, the TR7 module would be active all the time. Potentially, two quick window-down button presses with five seconds will cause the window to the go back up. That has the potential for confusion, since it alters the intuitive operation of the down-window button. So, for added safety, the TR7 timer module is only active when the back window is all the down.
- The doors lock when the back window goes all the way up, just like when you insert and turn the key in the back door. I'm not sure if I like that feature or not yet, but I guess I can live with it...
One last note: I implemented this mod using solid core wire leads, which I inserted into the back side of the molex-type connector. Then I secured the wires with multiple cable ties to remove any tension, so I didn't cut or tap single wire. Hope it holds up; I figure I can always tap later if I need to.
One last, last note: It's crowded behind the tailgate panel. I had to be careful not to obstruct the motion of the window glass and find room for the relay and TR-7 (which is actually flatter than the relay).
One last, last, last note: From here, it would be easy to add a button somewhere on the inside of the tailgate that would make window go up with 2 pushes. I was thinking about adding a small recessed panel with window up, window down, and door unlock functions to the inside of the gate for when I go camping--that would be convenient. Maybe that will be my next project...
Sorry for being so wordy, but hopefully it makes all clear. Hope you enjoyed reading about it.
theres 2 wires u can tap and ground it out so it go up and down on the plug, but it will also lock and unlock the doors. i have done it by finding the wires and ground it to make the window up and down. but im using aftermarket alarm and it works perfect for me, if i dont disarm the alarm its still going off if the doors were to open when the back window is down.
__________________
Pioneer DEH-80PRS,Rockford Fosgate T600-2,Hertz ML 1650.3(2 pairs),T400-2,Hertz ML 280.3(2 pairs),T1000-1bdcp,(2)JL Audio 12W6v3, Mechman 240a HO Alternator, Dual Northstar 31m,Borla Dual Exhaust,AFE Magnumforce intake.Enkei WT-4 Michelin Defender LTX 275/55R20. retrofitted S2000 projectors,Philips 85122 White Vision,Morimoto 5Five Ballast.Diode Dynamics SS3 Yellow Fog Sport.2 pairs of Hella Supertones.Full led conversion on interior and exterior.HAWK Talon Rotors and LTS pads F+R,Stoptech stainless steel lines F+R.Bilstein 5100 @0.85, MOOG FJ Springs front,Bilstein B12 36-281824 rear .
My IS-350 has a similar safety with the keyfob that can roll down all windows and sunroof but can only roll them back up with the actual key in the door, which is a pain because it's actually hidden by a plastic cover since it uses a smart-key.
I bet this circuit can be adapted to work on the car using the same function to fool the ecu into thinking the keyfob is the actual key.
sweet stuff. not sure if I will ever do it, its never been a big issue to me but I am sure I would use it if I had it one day. maybe this summer I will be bored.
Great simple solution to a complex problem. I'll probably be doing the same mod soon. I would have used a micro-switch but I'll bet the mag switch will hold up better in that environment. Nice touch.
man that is insanely awesome, that took some thought, do you have any idea if that will actually work on my 99 runner, i hate that i can put the window down but not up, let me know your thoughts on it, thaks
... do you have any idea if that will actually work on my 99 runner ...
Sorry, I don't have any experience with the '99 Runner, but I would guess a similar circuit would work as long as the operation of the key fob is similar, and the back window can be put back up with the key inserted in the tail gate. I seem to recall reading there is a back door ECU in the '99, too.
When you press the window-down button on the key fob with the back window already all the way down, what happens? Can you hear the motor switch on momentarily and then hear a relay clicking? If so, it probably works the same as the 4gen: the body ECU sends a command to the backdoor ECU to roll the window down, the backdoor ECU determines the window is already down after a moment and cuts off the power to the back window motor.
I've never used that type of switch before, but I don't see why not. I think another poster was thinking about using a microswitch. Pretty much anything that you can use to sense the window position would work.
It's pretty cramped getting your hand in the back tailgate, so aligning the switch was a bit of a pain, but the magnetic reed switch worked pretty well for me since I didn't have to be super-accurate in positioning the two parts of the switch.
Thanks to depodo! He did all the hard work. I installed my mod today and thought I'd put a couple of extra pics and other thoughts.
First once you get it installed, you have to press the window button twice but that means twice just like the extended press you have to do to get it to go down. It beeps like normal so you'll know when you pressed it long enough. Not that it matters but I originally thought it would be like the two quick presses you use to unlock the doors.
Alarm system mag switches have a huge margin of error. Use these and you won't have to worry much about alignment.
The install is pretty straight forward. I looked for some other locations to put the TR-7 and the relay but I think depodo already found the best spots. I used quick taps to tap into the wires because I think it's pretty non-destructive. I also didn't use a fuse (but you may want to) on the +12V line because the schematic indicated it is already protected by a 10amp fuse.
Don't forget you can test the setup without rolling the window up and down. Just disconnect the part of the relay that sends the up command but leave the rest of the relay connected. You'll hear the relay clicking.
The hardest part was probably programming the TR-7. It's not actually hard but the instructions are a bit complicated due to all the different options.
Here's my version of the instructions specific to this install. You will be using option 15.
First note that you use the unused (for this install) brown wire to program the TR-7.
Do this with the window up so you don't have to worry about anything.
Pull the connector from the bottom of the TR-7.
Switch the programming switch to on.
Connect the black wire to ground
Plug the connector back in. Look on the face of the unit where the PAC audio URL is. The LED is under the plastic here.
Touch the brown wire to ground 15 times.
The TR-7 will flash 15 times (after a couple of seconds)
Touch the brown wire to ground 2 times. The TR-7 will flash twice (after a couple of seconds).
Touch the brown wire to ground once. (this is the tricky part). The TR-7 will flash quickly. Then after 3 seconds it will do it again. You are waiting until you see a triple flash. It's really kind of like a set of double flashes that happen three times really fast.
Touch the brown wire to ground 5 times. The TR-7 will flash 5 times slowly.
Wait a bit and the TR-7 will flash rapidly for about 3 seconds. You are done. Put the programming switch back to the off position.
Oh, the part of the install picture that is blocked out with a white box is where I tapped into the wrong wire to sense the 'down' command. The instructions were right, I just messed up.