This post documents how I modded my back door controls to provide rear window up using the factory keyless remote.
<b>DISCLAIMER</b> This is not a how-to guide for you, this is a how-I did it write up. Any modifications that you make to your vehicle are at your own risk and expense. You have been warned. <b>END DISCLAIMER</b>
That said, here we go: Like many 4Runner owners, I was dismayed that the factor keyfob only rolls the back window down, not back up. I am aware that this can be done using an aftermarket alarm that can dedicate a channel to the back-window up command, and I think I read where someone used a pulse extender on the door lock function, but had to run wires to back hatch. This hack is neither of those, and much simpler IMO.
I didn't want to install an aftermarket factory alarm, so I set out to see if I could mod my T4R within the following parameters; the mod should:
(1) Be Implemented using the factory keyfob.
(2) Be Non destructive (I don't consider tapping wires to be destructive.)
(3) Be Low Cost (if the cost isn't much less than an aftermarket keyless entry, what's the point?) and be of low technical risk.
(4) Preserve the built-in safety features of the window (anti-jam technology, down-button override, etc.)
I implemented this hack using about $30 worth of parts (magnetic reed switch, a relay, and a PAC audio TR7 timer module). It took me a while to figure out how to do it, though.
<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/Vim2j8bK2bA?hl=en&fs=1"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/Vim2j8bK2bA?hl=en&fs=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="344"></embed></object>
First some background. Looking at the T4R documentation reveals a few things. The back window does not use a limit switch; if you inspect the motor connector and read the FSM, you'll see only the power leads for the window motor and the wires for two Hall-effect integrated circuits (they are blank boxes in the factory service manual called IC1 and IC2--earlier FSMs explicitly indicate these are Hall Effect ICs, and the signal output is used to regulate the motor). Each Hall effect IC produces a pulse as the window motor turns by detecting the passage of a magnet mounted on the motor shaft. Essentially, the the back door ECU is programmed to monitor the voltage (and possibly amperage?) to the motor and the timing of the pulses from the two Hall ICs. Based on these variables, the ECU detects the direction of window operation as well as the position of the window. The ECU can become confused if it senses an anomalous state (for example window-down power being applied, but pulses from the Hall ICs indicating window-up movement) and end up in an indeterminant; hence there are procedures to reset the backdoor ECU and start anew by initializing the window to a known state (window all the way down--hold it there for several seconds till the relay clicks--window all the way up, hold it there for several seconds until the relay clicks).
This arrangement was problematic since it meant I had to either hack the backdoor ECU (risky, failure would be expensive) or find another method to sense window position and affect a window-up action based on a combination of the key fob press AND the window position. If you've ever tried rolling the back window down with the key fob when it is already all the way down, you know that the back door ECU tries to roll the window down, but just momentarily--you can hear the relays click if you stand next to the back door. At that point, the back door ECU apparently decides the window is already down and cuts power to the window motor. It is easy to detect the motor-voltage (a brief voltage pulse when the back door ECU tries rolling the window down), but in this case the window position is probably indicated by the fact there are no pulse outputs from the Hall ICs (since the motor shaft isn't turning).
So how do you detect this state and cause something to happen when you detect it? You could probably program this kind of logic--sense window-down voltage pulse, check for no pulse on IC1 and IC2--into a flexible controller like the Fusion Brain on mp3car.com, but then you're practically building your own back door ECU. I didn't want to go there.
Actually making the window go up is easy: short to connectors on the ECU which are closed when the key is inserted in the tailgate and turned all the way right. The problem is how to detect the window state (all the way open) and how to trigger an action based on the key fob impulse.
So here's what I did.
Materials I used:
- magnetic switch. I used this to detect the window state. This hack will actually work *without* the magnetic reed switch, but it causes some conditions which can be potentially hazardous (more on that later). The limit switch allows this hack to *only* be active when the back window is in the all-the-way-down state.
- 12-volt relay. The relay is used to short the two connectors on the ECU to simulate a key-insert-turn-right condition in the back door. It takes about five seconds for the back window to close completely from being completely open.
- PAC TR7 trigger module (aftermarket alarm accessory that is also a general purpose timer/latching relay/delay switch that has several programmable modes). This is the key item that I searched and searched for (didn't know if anyone made a time module that would do what I want). I think I paid around $15 on Amazon for mine. It has a mode that allows the output to trigger for a set amount of time (say five seconds) based on programmable input (say two pulses within a five second period). (Note: There seems to be some possible difference between the TR7 and the TR-7 according to the PAC audio site (TR-7 I think is an older model). I used the TR7, FWIW.
A picture of how it's all wired up is below.
First, I installed a magnetic switch on the window track/tailgate to sense when the window is fully open. (I couldn't think of simpler way to sense this condition.) In the window-fully-open position, the mangetic switch closes the circuit. I use this circuit to pass the down-motor positive voltage pulse to the TR7 input trigger. Then I programmed the TR7 module to output 12-V for 5-seconds when it sees two impulses to the input trigger within a five second period. This output voltage was in turn connected to a relay, which closes the two wires that activate the back window-up signal.
So here's a walk through of how it works.
STATE: Back Window not down all the way:
Back window works like usual. The curcuit is open in this condition because the magnetic switch is open, so the TR7 receives no trigger inputs from anything.
STATE: Back window all the way down
In this state, the magnetic switch circuit is closed, and connects the down-motor-voltage lead on the back door ECU to the input of the TR7. In this state, clicking on the key fob window-down button twice within 5 seconds causes two pulses to go to the back window motor, and hence to the trigger of the TR7. In response, the TR7 outputs close the relay for 5 seconds. Voila! Window UP after two keyfob pulses!
Some considerations:
- Trigger Settings: Two input pulses within five seconds was chosen as a safety feature. Didn't want just single to start the window-up action, and in fact this won't work to use just a single pulse. However it so happens that the TR7 triggers on the trailing edge of the pulse. So if I put the window down and hit the back-window-down button on the fob within five seconds, the back window goes back up with that one key-fob press. (The first pulse trailing edge is from the first time the window comes down, the second pulse edge is from the key fob press.) After the window is down for at least 5 seconds, then two presses of the keyfob are required to put the window back up.
- Failure detection: if the any of the components--magnetic switch, relay or TR7--fail, the mod is inoperative and the window functions like the factory specs.
- Fail Safe: since the window-up hack acts like the key-inserted-turn-right condition, all of the existing safety features are still active: anti-jam, down-button override. As the window rolls up, it can be interrupted by the down-window keyfob press. (Try it sometime: insert your key all the way right, and hit the down-window button the keyfob. Window up is interrupted. Same behavior.)
- Limited Exposure: without the magnetic switch, the TR7 module would be active all the time. Potentially, two quick window-down button presses with five seconds will cause the window to the go back up. That has the potential for confusion, since it alters the intuitive operation of the down-window button. So, for added safety, the TR7 timer module is only active when the back window is all the down.
- The doors lock when the back window goes all the way up, just like when you insert and turn the key in the back door. I'm not sure if I like that feature or not yet, but I guess I can live with it...
One last note: I implemented this mod using solid core wire leads, which I inserted into the back side of the molex-type connector. Then I secured the wires with multiple cable ties to remove any tension, so I didn't cut or tap single wire. Hope it holds up; I figure I can always tap later if I need to.
One last, last note: It's crowded behind the tailgate panel. I had to be careful not to obstruct the motion of the window glass and find room for the relay and TR-7 (which is actually flatter than the relay).
One last, last, last note: From here, it would be easy to add a button somewhere on the inside of the tailgate that would make window go up with 2 pushes. I was thinking about adding a small recessed panel with window up, window down, and door unlock functions to the inside of the gate for when I go camping--that would be convenient. Maybe that will be my next project...
Sorry for being so wordy, but hopefully it makes all clear. Hope you enjoyed reading about it.
<b>DISCLAIMER</b> This is not a how-to guide for you, this is a how-I did it write up. Any modifications that you make to your vehicle are at your own risk and expense. You have been warned. <b>END DISCLAIMER</b>
That said, here we go: Like many 4Runner owners, I was dismayed that the factor keyfob only rolls the back window down, not back up. I am aware that this can be done using an aftermarket alarm that can dedicate a channel to the back-window up command, and I think I read where someone used a pulse extender on the door lock function, but had to run wires to back hatch. This hack is neither of those, and much simpler IMO.
I didn't want to install an aftermarket factory alarm, so I set out to see if I could mod my T4R within the following parameters; the mod should:
(1) Be Implemented using the factory keyfob.
(2) Be Non destructive (I don't consider tapping wires to be destructive.)
(3) Be Low Cost (if the cost isn't much less than an aftermarket keyless entry, what's the point?) and be of low technical risk.
(4) Preserve the built-in safety features of the window (anti-jam technology, down-button override, etc.)
I implemented this hack using about $30 worth of parts (magnetic reed switch, a relay, and a PAC audio TR7 timer module). It took me a while to figure out how to do it, though.
<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/Vim2j8bK2bA?hl=en&fs=1"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/Vim2j8bK2bA?hl=en&fs=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="344"></embed></object>
First some background. Looking at the T4R documentation reveals a few things. The back window does not use a limit switch; if you inspect the motor connector and read the FSM, you'll see only the power leads for the window motor and the wires for two Hall-effect integrated circuits (they are blank boxes in the factory service manual called IC1 and IC2--earlier FSMs explicitly indicate these are Hall Effect ICs, and the signal output is used to regulate the motor). Each Hall effect IC produces a pulse as the window motor turns by detecting the passage of a magnet mounted on the motor shaft. Essentially, the the back door ECU is programmed to monitor the voltage (and possibly amperage?) to the motor and the timing of the pulses from the two Hall ICs. Based on these variables, the ECU detects the direction of window operation as well as the position of the window. The ECU can become confused if it senses an anomalous state (for example window-down power being applied, but pulses from the Hall ICs indicating window-up movement) and end up in an indeterminant; hence there are procedures to reset the backdoor ECU and start anew by initializing the window to a known state (window all the way down--hold it there for several seconds till the relay clicks--window all the way up, hold it there for several seconds until the relay clicks).
This arrangement was problematic since it meant I had to either hack the backdoor ECU (risky, failure would be expensive) or find another method to sense window position and affect a window-up action based on a combination of the key fob press AND the window position. If you've ever tried rolling the back window down with the key fob when it is already all the way down, you know that the back door ECU tries to roll the window down, but just momentarily--you can hear the relays click if you stand next to the back door. At that point, the back door ECU apparently decides the window is already down and cuts power to the window motor. It is easy to detect the motor-voltage (a brief voltage pulse when the back door ECU tries rolling the window down), but in this case the window position is probably indicated by the fact there are no pulse outputs from the Hall ICs (since the motor shaft isn't turning).
So how do you detect this state and cause something to happen when you detect it? You could probably program this kind of logic--sense window-down voltage pulse, check for no pulse on IC1 and IC2--into a flexible controller like the Fusion Brain on mp3car.com, but then you're practically building your own back door ECU. I didn't want to go there.
Actually making the window go up is easy: short to connectors on the ECU which are closed when the key is inserted in the tailgate and turned all the way right. The problem is how to detect the window state (all the way open) and how to trigger an action based on the key fob impulse.
So here's what I did.
Materials I used:
- magnetic switch. I used this to detect the window state. This hack will actually work *without* the magnetic reed switch, but it causes some conditions which can be potentially hazardous (more on that later). The limit switch allows this hack to *only* be active when the back window is in the all-the-way-down state.
- 12-volt relay. The relay is used to short the two connectors on the ECU to simulate a key-insert-turn-right condition in the back door. It takes about five seconds for the back window to close completely from being completely open.
- PAC TR7 trigger module (aftermarket alarm accessory that is also a general purpose timer/latching relay/delay switch that has several programmable modes). This is the key item that I searched and searched for (didn't know if anyone made a time module that would do what I want). I think I paid around $15 on Amazon for mine. It has a mode that allows the output to trigger for a set amount of time (say five seconds) based on programmable input (say two pulses within a five second period). (Note: There seems to be some possible difference between the TR7 and the TR-7 according to the PAC audio site (TR-7 I think is an older model). I used the TR7, FWIW.
A picture of how it's all wired up is below.
First, I installed a magnetic switch on the window track/tailgate to sense when the window is fully open. (I couldn't think of simpler way to sense this condition.) In the window-fully-open position, the mangetic switch closes the circuit. I use this circuit to pass the down-motor positive voltage pulse to the TR7 input trigger. Then I programmed the TR7 module to output 12-V for 5-seconds when it sees two impulses to the input trigger within a five second period. This output voltage was in turn connected to a relay, which closes the two wires that activate the back window-up signal.
So here's a walk through of how it works.
STATE: Back Window not down all the way:
Back window works like usual. The curcuit is open in this condition because the magnetic switch is open, so the TR7 receives no trigger inputs from anything.
STATE: Back window all the way down
In this state, the magnetic switch circuit is closed, and connects the down-motor-voltage lead on the back door ECU to the input of the TR7. In this state, clicking on the key fob window-down button twice within 5 seconds causes two pulses to go to the back window motor, and hence to the trigger of the TR7. In response, the TR7 outputs close the relay for 5 seconds. Voila! Window UP after two keyfob pulses!
Some considerations:
- Trigger Settings: Two input pulses within five seconds was chosen as a safety feature. Didn't want just single to start the window-up action, and in fact this won't work to use just a single pulse. However it so happens that the TR7 triggers on the trailing edge of the pulse. So if I put the window down and hit the back-window-down button on the fob within five seconds, the back window goes back up with that one key-fob press. (The first pulse trailing edge is from the first time the window comes down, the second pulse edge is from the key fob press.) After the window is down for at least 5 seconds, then two presses of the keyfob are required to put the window back up.
- Failure detection: if the any of the components--magnetic switch, relay or TR7--fail, the mod is inoperative and the window functions like the factory specs.
- Fail Safe: since the window-up hack acts like the key-inserted-turn-right condition, all of the existing safety features are still active: anti-jam, down-button override. As the window rolls up, it can be interrupted by the down-window keyfob press. (Try it sometime: insert your key all the way right, and hit the down-window button the keyfob. Window up is interrupted. Same behavior.)
- Limited Exposure: without the magnetic switch, the TR7 module would be active all the time. Potentially, two quick window-down button presses with five seconds will cause the window to the go back up. That has the potential for confusion, since it alters the intuitive operation of the down-window button. So, for added safety, the TR7 timer module is only active when the back window is all the down.
- The doors lock when the back window goes all the way up, just like when you insert and turn the key in the back door. I'm not sure if I like that feature or not yet, but I guess I can live with it...
One last note: I implemented this mod using solid core wire leads, which I inserted into the back side of the molex-type connector. Then I secured the wires with multiple cable ties to remove any tension, so I didn't cut or tap single wire. Hope it holds up; I figure I can always tap later if I need to.
One last, last note: It's crowded behind the tailgate panel. I had to be careful not to obstruct the motion of the window glass and find room for the relay and TR-7 (which is actually flatter than the relay).
One last, last, last note: From here, it would be easy to add a button somewhere on the inside of the tailgate that would make window go up with 2 pushes. I was thinking about adding a small recessed panel with window up, window down, and door unlock functions to the inside of the gate for when I go camping--that would be convenient. Maybe that will be my next project...
Sorry for being so wordy, but hopefully it makes all clear. Hope you enjoyed reading about it.
