Remote Secrets Revealed

by The AntiLuddite

I somehow reached my mid 30s without buying a new car, and I had no desire to buy one when I accompanied my girlfriend to a nearby Toyota dealership.

I merely wanted to help her find a replacement for her 1991 Toyota Camry.  After test driving a number of cars, haggling with the salesman, a tearful scene as the old car was driven away, and a couple of hours in the tentacled embrace of the finance department, we fell back out of the rabbit hole and discovered that I was the legal owner of a 2005 Toyota RAV4.

And this is where my story begins.

About two weeks after the purchase, my girlfriend threw her security remote against the garage door.  I'll omit the details of her feud with the car and get to the point: her remote no longer armed or disarmed the security system.

An LED still flashed at the tip of the banana-shaped remote when I pushed the red button or either of the smaller black and green buttons, so I knew some life yet remained.  I suspected the blow caused it to lose synchronization with the vehicle.  A yellow sticker on the back read:

"If you press the red button on your transmitter and the red light turns on but your vehicle does not respond, press and release the red button two times within one second."

Simple enough.

I pressed and released, pressed and released the button within one second.  The remote still didn't work.  There was a suggestion that timing was important.  For five minutes I clicked, slowly, then slower, then gradually increasing the frequency of my clicks as I tried to hit just the right interval.  I finally decided to consult the owner's manual like a good little consumer.

The booklet said nothing about this particular device; the figures weren't correct and the text described an entirely different remote.  I did manage to find a small plastic packet with a yellow card though.  It read like a trade show blurb:

"Each time you press a button on the transmitter, a new code number is sent to the vehicle and the vehicle will no longer respond to an older code number.  This eliminates the possibility of a thief reading your code as you disarm your system, then re-sending that code later to gain access to your vehicle.  Some high tech thieves use an electronic device known as a 'code grabber' to do just that!"

The remainder of the card was an elaboration of the instructions on the back of the remote itself.  The bulk of the text had an annoying number of exclamation points, as if it had been written to be read to children during story time at the local public library.

I know some devices get wonky when their power supplies run low so I decided to replace the batteries.  The case only had a single screw.  The interior was sparse; the most interesting feature was a lone chip marked NTK03T.

The battery was a generic 12-volt MN21/23 that I replaced with a Duracell.  This is a battery that had aspirations to become a AAA but failed halfway; it's a small, unusual battery most commonly used in garage-door openers and security remotes.

I went back outside to the car.  The LED winked as brightly as before, but the car refused to acknowledge my thumbing.  I was desperate, so I tempted madness by double-clicking the red button again expecting a different result.  I put the key in the ignition and turned it on, still clicking the remote.  The device lay in my hand like a broken toy.

I remember the ubiquitous HP calculators from my college days and how they could program each other through their infrared ports.  I had another, working, remote, so for a few minutes I tried to program the mute with its twin but I was still denied.

I was getting nowhere with my investigation.  I decided to let the dealer take care of it.  This was my first visit to the dealer s service center since the purchase and I was optimistically expectant, fool that I was.

I found a disinterested clerk who said that he would try to find someone to examine my remote but that, "It might take some time."  After waiting an hour and a half (I'm not exaggerating), a technician walked over and verified that the remote was indeed out of synch with the car.  He told me I could wait in the customer lounge while he fixed it, so I followed him outside.

I didn't have a good vantage point but I could see the tech was pressing the valet switch under the dash.  This was curious.  None of the documentation mentioned that the valet switch was used to program the remote.

For those with cars that lack one, the valet switch is a small, push-button toggle with an LED, usually located on the driver's side but sometimes under the seat or in the glove box, that temporarily disables the security system so you don't have to hand your remote to a car attendant.  It's often used to disable the alarm when it's accidentally triggered.

As the guy began fingering the dash, the car started honking and blinking its headlights, seemingly in distress, like a large animal being violated by a veterinarian.  I realized the chatter was some kind of feedback.  The tech hopped out, said it was fixed and started to walk away.  I went after him for an explanation.  After five minutes of his reassurances that if it ever faulted again he would be happy to take care of it, I realized that I wasn't going to get the data I needed without pinning him to the ground and holding my keys to his throat.  At least he didn't charge me.

I drove back to my townhouse and discovered that the green button on the remote still didn't work.  This is the button that turns on the headlights for thirty seconds.  It's a nice feature to have when you've lost your car in a parking lot so well that you can't hear the horn.  Okay, so it wasn't essential but it still meant I had a device with a nonworking function.  I couldn't sleep until I fixed it.

I began to experiment with various combinations of valet-switch presses and remote-button clicks.  The car began bleating loudly again and flashing its lights.  I succeeded in programming the green button with the functions of the red button and pissing off my neighbors who stared at me through their windows.  The designers obviously intended the programming to be noisy; it was almost as bad as the alarm.  At least no one can reprogram the system without the owner's knowledge.  Since I wanted to keep living here - and keep living period - I decided to find an empty parking lot to continue my experimentation.

But first I decided to consult the Internet for programming information using two clues from the remote's shell: a white label-TDS-and an FCC ID of ELVAT5G.  I felt like kicking myself for not running a search earlier.

Toyota's web site had absolutely nothing to offer.  I was able to identify the remote using a remote wholesaler's web site, but they only offered programming instructions with a purchase from their site.  Another site offered the instructions separately but for an inflated fee, and with a stated disclaimer that they made no refunds or guarantees that the information was even valid.  A seller on eBay auctioned car remote instructions (though not my model), and I was struck by the unfairness of the whole situation.?

I had two choices: I could pay an additional fee to acquire operational information for a device I'd already paid for, or I could resign myself to returning the car to the dealer whenever the remote needed to be reprogrammed and just accept the hour and a half wait for something I could do myself in less than a minute.  Some dealers even charged for this service.  I was not happy.

I discovered that my device was closely related to another remote known by the FCC ID of APS95BT3.  It operated at 433.92 MHz.  It was manufactured by a company known as Prestige, which appeared to be a subsidiary of Audiovox.  Audiovox had wisely and graciously included a manual on their web site rather than charge for it.  The manual didn't describe an exact procedure for my remote, but the documentation was very close and helped immensely.

Below I've paraphrased the programming instructions in the manual and added some clarifying information that wasn't in the guide, as well as some personal experiences.  Those wanting the information straight from the source should point their browsers to www.audiovox.com and select the "Find a Product -> MOBILE -> Car Security and Remote Start Systems."

How to Program a Prestige/TDS/Audiovox (APS95BT3/ELVAT5G) Remote

The remote is a three-button, seven-channel transmitter.

Most car security systems only have three or four channel receivers; theoretically, the higher channels in the remote can be programmed for an additional car, but I did not test this.

Below is a table outlining the channels:

Transmitter Receiver Channel Buttons Channel Function 1 1 1 Remote arm and disarm Remote emergency panic Remote door lock/unlock 2 2 2 Pulsed output for accessories (lock/unlock w/o alarm on my car) 3 3 3 Switched output for accessories (nothing on my car) 4 2,3 4 Switched output for accessories (Headlights on my car) 5 1,2 - - 6 1,3 - - 7 1,2,3

The following procedure will program a new remote or reprogram an unsynchronized remote.  Any discrepancies or clarifications are in parentheses.

Note:  Each step must be performed within 15 seconds of the previous step or the system will exit programming mode.

1.)  Turn the ignition key to the "ON" position.  (You do not need to start the engine.)

2.)  Flip the valet switch ON-OFF, ON-OFF, ON-OFF.  (My valet switch is on when pushed in and the light is off.  Conversely, it is off when popped out and the light is on.  Whatever your configuration, the switch needs to be cycled three times.)

3.)  The valet LED flashes once (it repeats a single flash pattern) and the siren (horn) chirps once to indicate the system is ready to program Channel 1.

4.)  Press and hold transmitter Button 1 (or whatever button you want to program on the remote) until the siren sounds a long chirp (horn blast), indicating the signal has been stored into memory.

5.)  Flip the valet switch on then off (one cycle).

Here, the process repeats for transmitter Channels 2 to 4:

6.)  The valet LED flashes twice (a repeating double flash) and the siren chirps twice to indicate the system is ready to program Channel 2.

7.)  Press and hold transmitter Button 2 until the siren sounds a long chirp, indicating the signal has been stored into memory.

8.)  Flip the valet switch on then off.

9.)  The valet LED flashes three times (a repeating triple flash) and the siren chirps three times to indicate the system is ready to program Channel 3.

10.)  Press and hold transmitter Button 3 until the siren sounds a long chirp, indicating the signal has been stored into memory.  (Important: I could not program transmitter Channel 3 [Button 3] for receiver Channel 3.  I do not know what receiver Channel 3 is used for in my car's security system, or if it's even there.  This is why the Toyota tech couldn't get the green button to work.  I had to skip step 10 and continue with step 11, and program transmitter Channel 3 [Button 3] for receiver Channel 4.  This restored the remote headlight function to my green button.)

11.)  Flip the valet switch on then off.

12.)  The valet LED flashes four times (a repeating quadruple flash) and the siren chirps once to indicate the system is ready to program Channel 4.

13.)  Press and hold transmitter Button 4 until the siren sounds a long chirp, indicating the signal has been stored into memory.

End the process:

14.)  Turn the ignition key off.  The siren will sound one short chirp followed by one long chirp to signal the system has left program mode.

I hope that someone finds this information useful and it spares them the frustration and loss of time that I experienced attempting to use what is otherwise a great product.

I think it's worth noting that none of the security system documentation from Toyota that was included with this brand new car was even "remotely" helpful.