100 Series NAV Delete – True Standalone HVAC Solution (OEM+)

[Anarchy]

LX470 / 100-Series NAV-Integrated HVAC – MPX Reverse Engineering Project​

Later 100-Series Land Cruisers and LX470s integrate climate UI and status into the NAV/MFD through Toyota’s body multiplex network. Removing the NAV removes the visible control path, not the HVAC ECU itself.

This project is focused on restoring full climate control capability without the factory MFD by interfacing directly with the vehicle’s multiplex network.

Vehicle under test:

• 2006 Lexus LX470 (USDM)
• Build date: 06/2005
• Reference sources include RM/EWD, harness validation, probing, and extended logic analysis.

---

Project Timeline Update

1/13/2026 — Project Start
Initial teardown of NAV-integrated HVAC architecture.
Confirmed loss of climate control is due to removal of the UI layer, not the HVAC ECU itself.

Late January — Network Isolation & Identification
Isolated relevant communication paths and confirmed HVAC-related traffic exists outside of standard CAN access.
Shifted focus fully toward the multiplex network.

Early February — Traffic Capture & Pattern Recognition
Captured repeatable HVAC-related data patterns under controlled inputs.
Confirmed system behavior is deterministic across repeated conditions.

Mid February — Transport Structure Validation
Identified structured packet behavior within the multiplex network.
Validated consistency across multiple capture sessions.

Late February — Injection Entry Point Established
Successfully moved from passive observation into active interaction testing.
Initial command attempts showed correct structure but no system response.

Early March — Behavioral Analysis Phase
Determined that correct packet structure alone is not sufficient for system response.
Shifted focus toward understanding broader system behavior and interaction conditions.

Mid March — Controlled Testing & Regression
Built repeatable test scenarios to compare OEM behavior vs injected behavior.
Confirmed consistent reproduction of system responses under known conditions.

Late March — System-Level Understanding (Current Phase)
Now working within a controlled framework to align injected behavior with expected system conditions.
Focus is on refining interaction consistency rather than signal discovery.

- Transport structure: understood
- Frame integrity: validated
- Repeatability: confirmed
- Injection capability: established

Current Focus:
Refining system interaction behavior under real operating conditions.

End Goal:
Standalone physical HVAC controller for NAV-delete vehicles.
No dependency on factory MFD or touchscreen systems.

 

[Anarchy]

HVAC control and UI integration is now conclusively confirmed to run over Toyota’s MPX/BEAN body network.

Key confirmations so far:

• No HVAC command or status frames are observable on DLC3 CAN
• All HVAC user actions (fan, temp, mode, recirc, etc.) are encoded logical events on MPX/BEAN
• MPX+ / MPX− behave as a fault-tolerant redundant pair
• Discrete control wires (FRBLW, etc.) are not triggers, everything is packetized

Captured and decoded stable MPX framing at the physical level and are actively testing safe command injection using a microcontroller in listen/inject mode.

If injection behaves as expected, this confirms a clean path to restoring HVAC functionality after NAV deletion via a small inline bridge module without modifying the factory A/C Amplifier.

Still early but this has officially moved out of theory...

 

[Zuberg]

This is pretty neat, nice work! Following along in hopes you develop something as I'd be interested in a module for 06 LX470 (prod date 06 2006). I'm sitting on a middle east non nav kit but lacking the board(s) needed for later LX470.

Would be great if you could list the toyota part numbers for the boards you're testing.

 

[dchilds]

Though I can’t say I understand the details, have a general idea of where you’re heading with this and love the effort. I would love to do an “easier” nav delete on my ‘03 LX.

 

[Anarchy]

This is pretty neat, nice work! Following along in hopes you develop something as I'd be interested in a module for 06 LX470 (prod date 06 2006). I'm sitting on a middle east non nav kit but lacking the board(s) needed for later LX470.

Would be great if you could list the toyota part numbers for the boards you're testing.

Thanks! and yep, 06/2006 is one of the initial targets.

I’m testing against the A/C Amplifier - part number family 88650-XXXXX.

Though I can’t say I understand the details, have a general idea of where you’re heading with this and love the effort. I would love to do an “easier” nav delete on my ‘03 LX.

Appreciate it. That’s exactly the motivation here, make NAV delete easy & allow the use of any head-unit preference. Still proving a few things, but if this holds, I’ll definitely circle back on earlier LXs like the ’03.

I could see it looking something like this.. one of the examples is a VW retrofit with haptic touch feedback.

 

[Anarchy]

Update:
MCU-based MPX injection is now electrically working and producing valid frames on the bus. The remaining work is precise OEM timing, edge behavior, and frame placement so the HVAC ECU accepts and executes commands.

Specific HVAC-related MPX message families have been isolated, and progress is no longer about signal discovery, it’s about matching OEM cadence and acceptance conditions.

Not calling it done yet, but this is the furthest I’ve seen anyone push this toward an actual solution.

 

[ndg]

I've got an early non-nav TLC, so no skin in this game, but I've got to applaud the work you're doing. Being on the official side of the fence for work I know how hard it can be reverse engineering network traffic.

 

[Formerjeeper]

I don't know what a lot of this means, but I have been planning to go the Teyes route and would much prefer this solution. I'll be eager to try this out on my 2005 LC when you have it fully figured out.

 

[Anarchy]

Thank yall for the support.

Just to be clear: this is not a quick-turn project & if you’re looking for a fast or inexpensive solution, this probably won’t be it.

If you want a clean, permanent NAV delete without sketchy screens or wiring hacks, this may be the solution.

More when there’s something worth posting

 

[Anarchy]

Still deep at the transport layer...

Bus is behaving more like a structured multiplex network so the focus lately has shifted from “finding commands” to validating packet structure, timing context, and acceptance conditions.

Isolated the frame families tied to blower transitions and confirmed repeatable OEM behavior. Current work is around why the HVAC ECU ignores injected sequences even when waveform and timing look correct.

No successful injection yet, but we’re past the guessing phase and into protocol validation.

This is proving to be a proper engineering project... 140 hours in.

 

[ScotyDosentKnow]

Still deep at the transport layer...

Bus is behaving more like a structured multiplex network so the focus lately has shifted from “finding commands” to validating packet structure, timing context, and acceptance conditions.

Isolated the frame families tied to blower transitions and confirmed repeatable OEM behavior. Current work is around why the HVAC ECU ignores injected sequences even when waveform and timing look correct.

No successful injection yet, but we’re past the guessing phase and into protocol validation.

This is proving to be a proper engineering project... 140 hours in.

Applaud you for diving into this. The head unit and HVAC controls are easily my least favorite thing about the 100 Series

 

[Sunman]

Ok, I'll bite.... what exactly are you doing here? Are you creating a way to separate the HVAC controls away from the head unit? Would you create a separate HVAC contoller that would fit in the radio slot? I hope so.... I have spent literally hundreds of hours going round and round trying to figure out which option will work for me, and pretty much all of them sound like they aren't that dependable. I don't like the Tesla style because it is too big; I'm not a big fan of using the controller behind the head unit because you are stuck with the stock really low res screen; I've even considered the "portable carplay monitors" to sit on the dash, but again pretty much all of them are from not well-known foreign factories with lots of conflicting opinions of their value. This would be a godsend for me. If this is what you are doing, the heater controller would be separate, and then a person could go with a head unit from Alpine, Kenwood, or Pioneer? Is that what I am gathering here? One of the criteria I want to add to the unit is to have a aux video input because I bought an infrared monitor from Robofinity and I thought it would be cool to tap the video input from it to the stock screen. As usual, I am always looking for something that no one makes. I'll be watching this thread and waiting on purchasing something.

 

[LJE]

This is outstanding! As someone with a 05 LX I'm super excited that that's exactly what you're starting with, hah!

Let me know if you'd like some help with the faceplate design/integration. More than happy to contribute whatever I can to this project.

 

[Coin]

As someone who loves their 03’ LX, if I had an option to ditch the T’eyes for hard hvac controls I would do it in a heart beat.

Please don’t make hvac controls a touch screen! Please please please!!

You could almost name your price.

 

[Anarchy]

Massive win this weekend was finally understanding why earlier injections attempts were being ignored. Diving into ECU acceptance logic now, which is the real challenge. Physical controls are still the endgame.

 

[Sunman]

As someone who loves their 03’ LX, if I had an option to ditch the T’eyes for hard hvac controls I would do it in a heart beat.

Please don’t make hvac controls a touch screen! Please please please!!

You could almost name your price.

agreed. Anxiously awaiting positive results.

 

[implayaz9]

Following this Thread.

 

[Jack90210]

Following

 

[cruiserbrett]

This is an amazing thread! I have an early LX470 without nav, just to avoid this problem. But this is going to cause me to buy a later truck with VVTi.

 

[imperium]

This sounds like a massive undertaking. We all appreciate the work you're doing!
I have a nav delete kit from overseas and haven't installed it yet- would that be compatible with what you're doing? Or would this be all custom controls?