Simpler solution for disabling the DCM telematics - Silencing Antennas

Why put users in time out when you can just close the entire discussion off..good job guys..

 

Did some more messing around and figured out a few more things.

The aluminum foil was not quite enough to completely sever communication. While it blocked signal in my driveway there was enough signal leaking out to occasionally update the mileage if I parked it elsewhere.

It looks like the communication occurs a few minutes after the truck is turned off. Where I drove did not have an impact on communication, only where I parked and turned the truck off. Filling up with gas is apparently enough time for the truck to communicate in my experience. I would think just because the mileage doesn't update until you park does not mean the truck can't or isn't communicating while driving.

I was able to develop a "test" where I parked in a nearby Walmart parking lot facing away from a nearby cellphone tower so that the rear of the DCM module with the connection would face the tower. The tower was about 1500 ft away according to google maps and I could clearly see the tower in the truck mirrors. I would turn the truck off and wait for 5 minutes. I would then go about my business and check the Toyota website over the next hour.

I went as far as double wrapping the DCM in conductive tape (

$16 Double Conductive Tape 2" x 50Feet Faraday Fabric High Temp Tape for Electrical Repair, RFI/EMI Shielding, Car Wire Harness, ESD Grounding, Seal Precision Components, Guitar Interference Blocking

https://www.amazon.com/dp/B097HC9HR7?ref=ppx_yo2ov_dt_b_product_details&th=1) with the short adapters and termination resistors still installed. I also wrapped first few inches of wires connecting to the DCM with the tape as well. After reconnecting the DCM I applied more conductive tape around the connectors to minimize any possible leakage. Drove to Walmart and did the test. Unfortunately I still got communication. I made several attempts with the faraday cage approach and trying to seal it the best I could but had no luck with the Walmart parking lot test. The only thing that passed the test was disconnecting the DCM module entirely which has the downside of losing the front right speakers and the overhead mic for handsfree calling.

Dug around the antenna wiring harness and found the front antenna and surrounding wiring. Aside from the rear antenna and DCM as far as I can tell the head unit was the only thing attached to that harness which in my case only the HD radio antenna was attached.

A bit of a thought experiment I was doing while sitting at Walmart. Anyone with more experience please chime in since this isn't my area of expertise but here we go... A quick web search tells me 4G/5G towers have a signal range of up to 4 miles. I would think the signal strength drops off at longer ranges in keeping with the inverse-square law. I tried a simplified volume approach and assumed the closer to the tower the better your connection. A 4 mile radius sphere has a volume of 268 cubic miles. A cage that blocks 99% of the signal might still work in the closest 2.6 cubic miles or within .86 miles of the tower. A cage blocking 99.9% of the signal still has a range of .4 miles. And a cage blocking 99.99% of the signal might still work in the closest .026 cubic miles or .18 miles from the tower. An area approach is not as bad but still has a range of .13 miles with a 99.9% signal blockage.

edit: After thinking about it some I believe the surface area of a sphere is the correct approach. A volume approach would give an over-estimation of range, but both prove the same point since surface area and volume both grow faster than distance.

That thought experiment tells me you need an almost perfect faraday cage to block enough signal to prevent communication within a few blocks of a cellphone tower. I could try making a double cage with an insulating material in between and ground both cages separately but the wires out of the back of the DCM make that difficult to do. Looking as the photos @Toycoma2021 posted of the inside of the DCM I do not see any antennas that would be easy to terminate. I might try pulling out the DCM battery, but at this point I might be leaning towards just deleting the DCM entirely and splicing the wires to regain speaker function. It would be nice to have a premade harness so everything is easily reversible.

TL;DR A good tinfoil hat is difficult to make.


DCM wrapped in a single layer of conductive tape


Wrapped DCM with resistors installed and wrapped


DCM module plugged in


Wrapping of wires and connections in conductive tape

 

You guys are getting a bit beyond my capabilities here, but I did some reading this morning and Ill post a few possible leads for yall below

Looks like it is 3G and 4G compatible. So multiple frequencies, may respond differently to shielding
This site has lots of info including photos and links
https://fccid.io/JOYDA39/Internal-Photos/Internal-Photo-3819228

User guide for AL-T52V1
https://fccid.io/JOYDA39/User-Manual/User-Guide-for-FCC-English-r1-3819237.pdf

User guide for a sister products AL-T51A2-1/AL-T51A2-2 (this one is searchable)
https://fcc.report/FCC-ID/JOYDA39/4940890.pdf

Note those guides talk about a thermistor and over-temp protection. That seems like it might be a viable option, if possible to remove the metal cover as shown in the pics and disable or bypass the thermistor, the device would be in a permanent over-temp shutdown mode. No idea what side effects this would incur and no idea if the thermistor could be identified.

Another thing to note, those docs talks about antenna selection. Implies the antenna is external and can be selected based on users needs. One of which is called "shark type" and has a part number very similar to Toyota. All that leads me to think the original idea at the start of this thread should have worked..?

 

Just for kicks disconnect the small connector below the three antenna connections. I believe it is a network connection. The other connection just below it is the speaker connection that goes dead with no DCM.

 

Wrapping that thing like a burrito; possible concern is heat dissipation and weakest link within that thing frying. Another option would be a 4g blocking device but I think those have legal ramifications and you could affect yourself/others around you.

Is it possible that body ground (ie entire vehicle) is partly being used as an antenna?

 

All the wires coming out of the unit are a likely culprit, they are picking up the signal inside the unit and conducting the radiation outside the unit. That’s all an antenna is is a piece of wire, albeit custom shaped for performance.

 

I have some RF background (have designed specialized microwave antennas and such) but was keeping quiet because you are spot on. I looked at that board for a while and don't see any other antennas on it. The solder bumps wouldn't be part of an antenna because they are too imprecise but you guys were right that section is designed for something, maybe a power rail as somebody said. On-board antennas are usually placed in the corner of a board for isolation purposes, which is where the 3-coax connector is placed. Between that block and the T51A2 is an obvious section of RC filtering which is a telltale sign of antennas as well as some obvious feedhorn shapes on that and the other side in that same region. Also you won't find antenna layers embedded within interior PCB layers unless there is obviously no adjacent layers to interfere.

Toward your mention of tower antennas- you get spherical radiation and 1/r^2 dropoff from a point source but the towers usually are usually directionally focused to shape vertical losses and concentrate coverage based on user density. In dense urban areas the dropoff can be assumed to go with ~1/r.

I too was wondering what that 2-conductor connector is next to the coax block. I suspect it is data and also wonder what happens when you disconnect it.

Somebody also mentioned plugging the 3 coax cables back in, one at a time. It could be useful to verify which of the 3 terminated connections restores the cell data when reconnected to both validate assumptions and identify which traces are relevant on the board before the coax. However I'm not sure if you already know this.

I too agree the signal is probably leaking out through the other wires as sensitivity is amazing both directions with these circuits due to years of optimization.

If the issue turns out to be leakage through other wires, my next thought would be toward what changes to the board could help. Perhaps terminate the relevant feedhorns as close as possible to the T51A2 with a surface mount resistor and disconnect it at the next possible SMT device by desoldering. Otherwise the image of the T51A2 interior pasted in the user manual could guide where the power might be disconnected to it based removal of some surface mount component(s). Lastly, there is a signal relay located just above the T51A2. I haven't tried to trace it yet, but wonder what happens when that is disabled.

Just some rando thoughts with no real
solutions, I need to figure out how to take my dash apart and am hoping
to get back in there too. At some
point I'll be trying to disable mine as well. Thanks for posting your progress, this is interesting to watch.

 

I assume the fuse for the DCM is always hot, even when the car is off? One idea is using this method https://www.youtube.com/watch?v=D46Vz_S8kb0&t=290s where he changes the power source for the DCM to a source that is only on when the car is on. You would need to disconnect the small battery on the DCM as well. Assuming that the battery on the DCM can be removed and it still gets power from the main just fine (many devices with a battery these days rely on the battery itself as being part of the power connection).

Assuming this works, this at least stops it from being active while the vehicle is off. It would also protect the vehicle from any remote attacks while the car is off since the telematics unit would be in a true off state when the car is off.

 

I still think in the long run, the best way to deal with this is find connector ends for the stereo cable and the main harness and use those connectors to make dongles that jump the proper wires to restore microphone and speaker usage while having the DCM entirely unplugged. That way you're not in there soldering wires or dealing with loose jump wires. The problem appears that Kyocera is using proprietary connectors.

 

I agree with this. I was just seeing if I could source a DCM unit to cannibalize for the connectors, but the ones I could find are prohibitively expensive :/

Slightly jealous of Subaru folks who have access to these ez plugs -- https://www.autoharnesshouse.com/69018.html

 

To the best of my knowledge, I will address some of your comments:
I too was just looking into removing the power from the cellular AL-T52V1 module only leaving all other features intact, without doing any jumpers and adding wires. Opened up the AL-T52V1 and found all the components to be much smaller than I was comfortable destroying, and I had no direction as just what to disconnect/remove. There is a one/quarter section that is still shielded with the main full-size shield removed. I have pictures if you like. Next, I looked to find the SIM and cut a trace or remove it. Found what I think is the SIM (8 Pin), it is diagonally opposite across from the relay you mentioned in the corner. The number on it starts with an "89" like most SIMs (89033023311330000000012251956265 and G07 at the very bottom). The common everyday SIMs are 6 pin, not 8 pin as this possible one is; 8 pin is an old standard and not brought out to the slide-in 6 contact SIMs we are all so familiar with.

In case there are any truly well-rounded Cellular people reading this; from TechStream the MMC is 310 and the MNC is 170 which according to Wikipedia is one of AT&Ts GSM 1900 bands and my ICCID(High) is 8901170327 and the ICCID(Low) is 2127204523. The MSISDN is 6016724506. No misprints in this information I've very much double checked.

On to that:

"there is a signal relay located just above the T51A2. I haven't tried to trace it yet, but wonder what happens when that is disabled."

That relay is for interrupting the regular radio left door speaker and letting the DCM output some audio to it. I did trace it, but now thinking about it I did not find any resistors to load the radio output to prevent damage to the radio output when the DCM is using that channel - strange, or perhaps not so strange as that 2-wire shielded connector that is immediate below the three antennas is a network connection between the DCM and the Radio. Perhaps when the DCM wishes to take over the speaker it "networks" the radio to mute that speaker, or all the speakers as I believe the only time the DCM would use audio would be in an emergency or when summoned by the driver.

++++++++
After all of this time and effort by myself and others I have come to the conclusion that disconnecting the DCM connectors and jumping the wires plus adding one or two wires from a kick panel connector and the radio detailed in another thread. Advantages are the mod gets rid of the cellular all together and gets rid of any power draw the DCM has naturally upon the vehicle - always a plus.

For those still wishing to do a plug-n-play application the large multi pin connector on the DCM should be Toyota part number 90989-12E34 and is made by Sumitomo. The 90989 is what most Toyota connector number start with, and the last 5 digits are molded into the connector plastic as is the case here. The 4-wire speaker connector could be de-pinned and compatible connector shells sourced and the pins inserted. Just find a male and female compatible connector pair.

In looking through the FCC information Kyocera states the AL-T52V1 will never be released from them without it being incorporated into a product like the DCM. To me, this means we will never see a publicly available copy of the schematic and board layout to be able to make informed decisions.

 

Quick update. This afternoon I disconnected the black connector below the three antenna connections and then reapplied new conductive tape. Did the Walmart parking lot test and the Toyota website has not updated the current mileage in over two hours and the front right speaker still works. I do not know if the overhead mic still works since I use a different mic for my aftermarket head unit. I will try a few different parking locations over the next few days and see if I can get anything to communicate back to Toyota.com. My concern now is that while I am blocking signals going out signals could still get in and I do not currently have a way to test that. If this seems to work well I might try reversing the mod as a proof on concept and to be sure I haven't damaged the DCM.


Black connector disconnected


Wires and connections rewrapped in conductive tape

 

Decided to try just pulling the fuse on the DCM. Started up and no error codes or other fuss from the truck. So far, so good.

With my iPhone plugged into the dash USB, I make a call. I can hear them, but they can’t hear me.

So - the incoming audio is going from my phone:
- through the USB cable, directly to the head unit?
- via Bluetooth to the head unit?
- other route?

And the outgoing audio is going from the headliner microphone:
- hardwired to the DCM, then Bluetooth to my phone?
- wired to the DCM, wired to the head unit, then Bluetooth to my phone?
- other route?

Just wondering, can the truck’s microphone be wired to the head unit, instead of the DCM? Or is the head unit only the interface for controlling the Bluetooth connection to the DCM?

 

So I just went out to my truck, checked Settings, and my phone is stilled paired to the truck, even with the DCM fuse pulled. As soon as I unpaired my phone, Bluetooth gets greyed out and I can’t pair the phone. I can plug my phone into the USB cord and get the phone menu, but no Bluetooth.

Reconnected the DCM, and the mothership will let me use Bluetooth again.

 

If you check some of the links in the first post of this you'll see that people have posted wiring diagrams and such. The microphone is, from what I remember, supplied power by the DCM. So you need to give it a power source since the DCM no longer does that.

Additionally, remember that the DCM has an onboard battery. Pulling the fuse alone may not disable it while the DCM battery is connected.

 

Update

No communication from the truck back to Toyota since my last update even tried parking right next to a cell tower. To test if I damaged the DCM I plugged everything back in including the three antennas but left the conductive tape covering most of the DCM since I didn't want to go through the effort of removing/reinstalling it. Started the truck up and the green SOS light came back on and stayed on. Drove around a bit and parked in my driveway but the Toyota website would never update the mileage. I tried the Walmart parking lot test and still could not get an update on the Toyota website. The front right speaker still worked through all of this so I count that as a small win.

Maybe leaving the black plug unplugged damaged the DCM or somehow confused it or the truck into not updating. Maybe the conductive tape made contact with the conductors of the black plug and damaged whatever is on the other end of the cable. Without being able to reverse the modification and restore communication I can't tell for sure what exact steps someone else would need to take to completely disable the communication.

For now I will be leaving the short adapters with resistors installed into the three antenna plugs in the DCM, the black plug will remain unplugged, and everything wrapped in conductive tape. Long term I will be looking to delete the DCM entirely.

 

Thanks for the follow up. This thread has me deeply interested.

Thanks

 

This thread has some information on "recovering" the microphone after deleting the DCM (https://www.tacomaworld.com/threads...ty-connect”-connected-services-module.794817/).

 

This isn't necessarily related and I don't want to side track the thread too much, but I was thinking this weekend, how does the payment structure for all this data work? Toyota must have some master agreement with all the major carriers? Any Tacoma with a DCM comes into range of a partner tower and transmits data, that then gets billed to Toyota?

 

If you're not paying for it, you're the product being sold. There's a reason insurance companies are specifically mentioned in the privacy policy opt out options.