04 4runner remote start w/factory remote

Is there a way to use the factory keyless entry to unlock the doors while the vehicle is running from a remote start? Here's what I have: 04 4Runner SR5 with V6 and Factory keyless remote. Audiovox Prestige AS9234 aftermarket add-on alarm with remote start which uses the factory keyless remote to arm, disarm and for remote start. ( http://www.audiovoxproducts.com/prestige/remotestart/?sku=AS9234 ) PK-ALL bypass I have it hooked up and working. As noted in this 7 year old thread:    https://www.the12volt.com/installbay/forum_posts.asp?tid=79119&DIR=N&fid=3 Someone posted that when the 4Runner is running, the factory key fob features such as lock, unlock and window down are disabled.    I'm revisiting the same question. Is there a way to wire or rewire parts of the system to allow me to use the factory remote to unlock while the engine is running? In the prior thread Chris Luongo wrote:    <qoute> I found some information for you on component locations, but I cannot find wiring diagrams; sorry. A diagram I have shows the "Door Control Receiver" as being located in the driver's D-pillar, just above the taillight. ... Probably, you can look at that module for a wire that tests as ignition, and interrupt it during remote start... ...And if so, you must have triggered the keysense wire, right? That's going to be a problem----even with the ignition off, the keysense wire will also keep the factory remotes from working. <end quote> (Thanks for the info, Chris!). Does anyone have a wiring diagram for the "Door Control Receiver" or experience with this component or a solution to the problem? If required, the alarm has a few different wires that I can use so that I can only have the key sense grounded during the cranking part of the the remote start: BK/Y on 4 pin harness has GND only when cranking, and it also has a wire that "allows keyless to operate while under control of Remote Start Unit" Y/BK - To vehicle alarm or keyless ignition input, which according to the installation manual states: <quote> YELLOW w/ BLACK Tracer Wire: + 12 Volt Alarm By - Pass Output Note: You must disconnect the ignition input of the alarm from any other wire that it is presently connected to in the vehicle. This wire provides a + 12 Volt output when the ignition key is turned to the “ON” position, and 0 Volts when the ignition key is “OFF” and when the vehicle is running under the control of the remote starter. This wire should be connected to the ignition input of the alarm system. The Yellow w/ Black wire output will allow you to remote start the vehicle while leaving the alarm armed, and to lock/unlock the doors while running under control of the remote start unit. </quote> So it seems that I MIGHT be able to make it work by only grounding the key sense during cranking, an then using the Yellow/BK wire to allow the keyless entry to work while under remote start. My problem, is I don't know what wire(s) I need to cut and attached the Y/BK wire to. Wiring diagrams, info on how the factory keyless entry system is disabled when the engine is running, or other info would be greatly appreciated. For the record, for this audiovox unit, you lock, unlock then lock the doors using the remote and this causes the remote start to kick in and start up the car. As it is wired now, once the car is running with the remote start, the factory key fob no longer works. You manually unlock the door, and then either press the brake to cut off the engine, or put the key in the ignition and turn it to "run" to be able to drive off without having to restart the car. That part is SWEET. I just wish that I could use the keyfob to unlock the car while it's running under remote start (and if I get that to work, I might get clever and figure out a trick or too so that pressing lock on the keyfob while the car is running will cause the remote start to shut off... but that's later. I need to get the keyfob unlock to work first!). BTW, I'm an an electonics hobbyist and have a handful of alarm and remote start installs on my own cars in the past... I'm far from a pro, but I do understand the basics and quite a bit more. (DMM -yep!, Diodes -- got em, etc...). Sincerely,      -Phil -Phil

If you find the keyless module and find the wire that goes hot when Ignition is turned on, I am pretty sure that if you cut that wire so the module does not know the key is on, it should do what you are looking for.

Thank you. When I get a chance I'll look for the module in the D Pillar Driver's side and try probing it. Anyone with wiring diagrams know where I can find the feed to that module up by the Dash. It appears to me that the "Door Control Receiver" connects to the Body ECU, which would be a much better place to tap into it, but I'm not sure which plug/wire combo I'm looking for.    -Philip-Phil

Key sense wire GREEN/ YELLOW (-) in ignition loom connect to your GWR or staus wire, if that's being used for the bypass diode separate. How many more times will this query come up? Why don't people check the archives?

Howie, Thanks for the info regarding Diode isolation on the key sense. Right now, I've got: PK ALL Blue (GWR or Status -)   --> Remote Start GWR (Status -) Green (Key Sense)        --> Ignition Barrel (GREEN/ YELLOW - ) (Directions from Fortin for 04 4Runner) I believe I don't need to diode isolate in THIS setup, because I'm not connecting the Remote Start's GWR to one connection on the PK ALL. Please let me know if I'm mistaken. Below I've also attached a diagram from a Lexus forum (forgot the forum name) showing a proposed use with diode isolation. I'm assuming that this is the diode isolation you are referring to, but right now I'm NOT following this diagram, because I believe it's not needed. Again, someone let me know if I'm wrong. Thanks!        -Philip-Phil

The seond diagtram is correct, that's how I'd do it although I'm assuming the Fortin green wire is not connected to the blue GWR above it, meter via continuity if they are connected, diode as the second diagram, either method will work.

I thought I'd update everyone on my quest. The answer seems to be that once the 4runner is under control of the add-on remote start, my only option is to use the key to enter the truck. I found a diagram for a "Door Control Receiver" which is housed in the Driver's D Pilar behind and/or above the rear tail lights. It has four connections which are: Ground -- Always Ground +12V -- Always at +12 RDA -- Data line sends coded pulses to send lock and unlock messages PGM -- Used when programing new key fobs. Those are the only four connections, so I don't believe that there will be a way to fool the door lock controller into thinking that the ignition is off while the car is running.   I *might* try tapping into the RDA line and see if I can read the pulses with some custom programming logic, and use that to trigger door lock, unlock etc on my own... but that project would be for another day. Below is a link (and partial copy of the post... in case the link stops working) of someone who used an arduo board and custom programming to hack into the RDA line and mimick the unlock code. Maybe one day (probably not!) I'll try to read the RDA line, build a board that will send pulses when signals are received and the engine is running under remote start. Custom Device for Door unlock robmac 164 posts 14 Thanks LocationMelbourne, Australia Posted 30 July 2012 - 11:15 AM ADDING AN AFTERMARKET WIRELESS DOOR LOCK-UNLOCK 2002 TOYOTA ESTIMA 30 JULY 2012 OVERVIEW This document details how add and after radio receiver to a 2002 Toyota Estima. This project was undertaken because of exorbitant cost of wireless door transmitter when purchased via the Toyota dealer network. The total cost for two door remotes, arduino, radio receiver, sundry items and enclosure is around A$100. HOW THE TOYOTA RADIO RECEIVER WORKS The OEM radio receiver is mounted at the rear drivers side (RHD vehicle) immediately above return air vent for the rear air conditioning, just inside the rear tailgate. The radio receiver has four connections: +12 V always on fused power 0V     ground/earth connection RDA door unlock signal sent to the body ECU PGM a signal line that is used when programming any Toyota OEM remote door lock transmitters I have not investigated this PGM signal because it is irrelevant for an after market remote. The RDA signal is not a simple voltage level signal. To toggle lock/unlock the receiver sends a square wave pulse train to the body ECU. The signal comprises 12mS high-6mS low-9mS high sequence repeated 14 times. High is 8V, low is 0v. EDIT September 2nd 2012: This pulse train is used with the single button remotes to unlock all five doors. I have a feeling there are different pulse trains used when electric self opening doors are fitted and controlled by a three button remote. If you have a three button remote be aware that different buttons will have different pulse trains and thus signal different functions to the body ECU. I don't have access to a vehicle with a three button remote, so I can't investigate the different signals. HOW THE “AFTERMARKET” HACK WORKS A Freetronics 11 (or Arduino) programmable microcontroller is used to generate the pulse train to trigger the vehicle body ECU and thus unlock the doors. I have provided the source code free of charge. Freetronics controllers are available everywhere and cost around A$35 for the controller plus USB cable. Drivers, instructions, programming are a free download from Freetronics and Arduino websites. An after market radio receiver with a one button or two button is suitable. Suitable door remote kit can be from most car suppliers for around A$ 40. The only criteria is a normally open contact on the receiver, closing on when remote transmitter button is press. Receivers which send out 12vdc are also suitable. CIRCUIT EXPLANATION When radio remote is pressed radio receiver contact closes. Power is supplied to RL1 coil. Contact RL1 disconnects the Toyota radio receiver and connects the body ECU RDA line to pin 8 of the freetronics micro controller. This supplied power by contact RL2 closing. When the radio remote is released radio receiver contacts open and coil of RL1 is released. RL2 contacts open and interrupts power to the freetronics micro controller. RL2 contacts change-over, disconnecting the freetronics from RDA line and connecting the Toyota receiver to the RDA line DISCLAIMER This information without any warranty stated or implied. If blow something up on the ECU or receiver let it be on your head. There is one “shortcut” in the design. The Toyota receiver generates pulses of 8 volt DC level. The Freetronics provides output pulses of 5V DC level. It doesn’t seem matter at all it works fine on my vehicle. Also be aware the code for freetronics micro controller is “quick and dirty” My justification is that it works and took less than 3 minutes to write. Image of the unit I built is here: <a rel="nofollow" href="https://imageshack.us.../remote1j.jpg/" target="_blank"><img src="https://img442.images...emote1j.th.jpg" border="0"/></a> Circuit diagram is here: <a rel="nofollow" href="https://imageshack.us...2/remote3.jpg/" target="_blank"><img src="https://img832.images...remote3.th.jpg" border="0"/></a> Just a note on the circuit diagram. The RDA line is cut and extended at the receiver. Power and ground are obtained from the receiver. Make sure you use the receiver earth and not some random body bolt. The code is below and is can be cut and pasted into a freetronics “sketch” Enjoy! --------------------------------------------------------------------------------- int outPin = 8;      // digital pin 8 void setup() { pinMode(outPin, OUTPUT);      // sets the digital pin as output } void loop() { digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 millioseconds      01 digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 millioseconds      02 digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 millioseconds      03 digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 millioseconds      04 digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 millioseconds      05 digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds      digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 millioseconds      06 digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds      digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 millioseconds      07 digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds      digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 millioseconds      08 digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds      digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 millioseconds      09 digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 millioseconds      10 digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 millioseconds      11 digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 millioseconds      13 digitalWrite(outPin, HIGH); // sets the pin on delay(12);      // pauses for 12 milliseconds      digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds digitalWrite(outPin, HIGH); // sets the pin on delay(9);      // pauses for 9 milliseconds digitalWrite(outPin, LOW);     // sets the pin off delay(6);      // pauses for 6 milliseconds      14 delay(4000);      // loop pauses for 4 seconds } //configures pin number 8 to send a 3x pulse train of 14 times // 12mS high - 6mS low - 9mS high - low 6mS ----------------------------------------------------------------------------------- Edited by robmac, 02 September 2012 - 10:53 AM. -Phil

Have you tried the key sense yet?

Sort of... I connected the PK-ALL status wire to my alarm's BLACK / YELLOW (Neg during crank), and left the key sense connected only to the PK-ALL key sense output wire. So now my PK-ALL and my Key Sense both only go Negative when the Remote start is cranking the engine. I also found documentation for an '03 4 Runner that states that the remote lock and remote unlock will not work if the ignition switch is "On". From the logic involved and the wiring diagram, it seems that the Body ECU will always receive the lock or unlock commands from the Door Control Receiver, so I guess here's what I *might* try. The body ECU has a BLACK/ Red wire at pin 10 that is the secondary ignition, and it appears to be an input (sensor) wire. So I could try cutting that wire, and connecting it to the Yellow/Black wire (to keyless ignition input) on my remote start. That SHOULD make the body ecu think that the ignition is off when the car is running under remote start. I guess my only concerns are can I isolate just this wire (it's inside a grey box on toyota's diagram), and will the change have other negative consequences. I don't know if the Body ECU control anything truly important (like engine management). I see that it DOES control windows and locks and also the Anti-Theft system. (Relevant pages attached and quoted below. Source: LINHSY from T4R.Org Sorry for the images... not allowed to post PDFs yet.) <quote> System Outline Door lock control (Lock and unlock), back window control (Back window open) and panic control (Theft alarm and flash) is performed by remote control, without the ignition key inserted in the door key cylinder, using low–power electrical waves emitted by a transmitter. ... 3. Wireless Door Lock Stop Function If any of the following conditions are detected, the wireless door lock does not function. Lock operation ∗ When any door is open (Door courtesy SW on)    ∗ The ignition key is inserted into the ignition SW (Unlock warning SW on)    ∗ Ignition SW is on Unlock operation    ∗ Ignition SW is on <end quote> -Phil

Did you ever get to try this? Did it work?