Visit Us On FacebookVisit Us On TwitterVisit Us On Google PlusVisit Us On LinkedinVisit Us On YoutubeCheck Our Feed

Reverse Engineering Car Parking Sensors

It has been two years since my last post as i can see from the date but finally it seems i found the time to come back. The idea of reverse engineering the car parking sensors came when i replaced my car parking sensors and i was curious to find out how this thing really works. 

Generally, i had a picture in my mind on how they should work. A sounder that sends the sounding and a microphone/receiver that receives it back (as radar works), calculating the time, the signal takes to travel from the sounder and back to the microphone from the obstacle reflection. Having 4 sensors on the car bumper pointing to the same direction, is challenging for the processor to recognize which sounding comes from which sensor. A quick thought i made is that it may use a different operating frequencies for each sensor or a different timeslot for each sensor keeping the same frequency for that purpose. But we will find out later on, while powering things on.

So having this picture in mind we move on.

First interesting thing that got my attention while i was removing the sensors from the bumper was the sensors themselves. They had only two wires each so the picture in my mind with a separate microphone and sounder on each sensor should change to one device which may switch from sounder to microphone and vice versa (operating both as a sounder and microphone). All this because there are only two wires so there could not be two different components such as a sounder and a microphone. If that was true there should be at least 3 wires, 2 wires one for each component (sounder & microphone) and a shared wire for the common ground. 

Second step as long as i made the first optical investigation i unscrewed and removed the enclosure of the main processing unit in order to have direct access to the PCB design. In first look we can see the main processor from Atmel (AT89C2051), a Schmitt trigger (HEF40106B) which may be used for isolating/separating the analog front end from the main processor/circuit, two operational amplifiers (HA17358) with some external components around it which looks like to be used for filtering and amplifying the received reflections and a third IC which after some googling i found out that's an analog switch (HEF4066B). I can't imagine yet what could be the use of this as there could be a lot of uses such as signal scanning between the 4 sensors or for switching each sensor mode from reception to transmission etc. 

Looking closer to the sensor connectors on the PCB we can see that one connection of each sensor is directly connected to ground so the second connection seems to transmit/receive the signals (obvious). Also there is a small transformer connected on each sensor connection which looks to be used for increasing the signal voltage in order to drive the piezoelectric(possible) transducer of each sensor. 

I think it's time to power things on. Connect the main unit to power as well as the LCD screen to the main unit in order to have feedback and know in which step we are working on. Using the oscilloscope i started reading the pins of each sensor connector with the sensors disconnected trying to find a common pattern. At a first look, the waveform coming out from sensor connector 1 looks like a periodic square wave signal.

Trying the connector 2 the signal seems to be the same with the frequency of the square wave remaining at 40.12khz. In more detail i would describe it as a signal of 14 square pulses of 40.12khz repeating about each 160ms. So the device could send these 14 pulses to each sensor, then switch the sensor circuity to receiving mode and wait for the reflected signal to come until next transmission/sounding. But as the frequency of all 4 channels is the same the identification of the reflection (from which sensor the sounding is coming from) it looks that is not implemented using different frequencies. So let's see if there is a different sounding timing (timeslot) for each sensor. Measuring the timing distance between each channel we can see that each channel has exactly 40ms difference from the previous one . 

1st channel signal to 2nd channel signal distance 40ms

1st channel signal to 3rd channel signal distance 80ms

1st channel signal to 4rth channel signal distance 120ms

So these 40ms gaps may be used by the main unit to read the reflections. This also means a frequency of ~6.173Hz (1/160ms). Our first findings since now are clear. All sensors are transmitting on the same frequency but in different timeslots

Next step i tried to read all of the mcu pins and compare them with the function of each pin given by the datasheet. 


1 VCC +5V 20 I/O
2 UART RX 58.82KHZ SQ 19 I/O 40KHZ/6.173HZ SQ
3 UART TX 534.5KHZ SQ 18 I/O 40KHZ/6.173HZ SQ
6 INT0 SIGNAL SQ 15 I/O 6.173HZ SQ
7 INT1 6.182HZ SQ 14 I/O 6.173HZ SQ
8 T0 (timer 0 external input) 24.71HZ SQ 13 AIN1
9 T1 (timer 1 external input) 12.35HZ SQ 12 AIN0
10 GND GND 11 I/O 6.173HZ SQ

Pin by pin. 

From pin 1 to pin 5 all the signal readings are obvious and expected. UART pins 2&3 are used to communicate with the remote LCD display which displays the distance from the obstacle and its direction. This interface can be used in combination with an Arduino for any DIY application. Pin 6 is an external interrupt driven pin and we read a square wave input signal which is not periodic and stable which makes it more interesting and moves it closer to the fact that this pin may reads and decodes the reflections (do all the job). There is a stopped snapshot in the following screenshot where you can see the waveform on that pin. As you may notice there is a small gap after the 12th square wave and then follows another waveform. The following waveform is the reflection and changes its frequency depending on the obstacle distance. In combination with an internal timer the MCU can easily calculate the read frequency and make its calculations for the real objstacle distance. 

Pin 7 is also an external interrupt pin but the oscilloscope reads a 6.182hz square wave. We cannot be sure yet if this square wave is coming out of pin 7 or it's going in.

On pin 8 we have a square wave of 24.71hz. On pin 9 we have a 12.35hz waveform which i followed using the oscilloscope and a continuity meter and i came across a very interesting implementation. As it looks Timer 1 is generating this waveform, then it's inverted through the Schmitt trigger it's filtered and converted to a DC signal and then this signal is feed to the mcu RESET pin through the Schmitt trigger again reversing its polarity. By this implementation when the mcu is normally running it's providing 12.35hz which is then inverted, filtered and again inverted as a result to a zero voltage. When something goes wrong with the mcu (crash – infinity loop etc) and the T1 stops generating this frequency the output of all the above implementation is going high triggering the mcu to reset. This is a very clever "hardware" watchdog and it's something i see for the first time. 

Here is the schematic of this implementation 

Pins 16 to 19 look to drive the actual transducers as these are 4 identical pins generating the same frequency as the one i read on the sensors but in different timeslots. 

Finishing with all the pins i tried to move on and check the routing of the all 4 pins of 6.173Khz with a continuity meter and a desktop light in the backside of the PCB. As these pins are 4 in count probably they may have to do with the four sensors. The continuity shows that each of these pins is connected to the Enable pin on each channel of the analog switch. The Analog Switch consists of 4 analog switches each one having 2 pins that can be actually bridged and one pin that's the enable pin and in fact this pin triggers the corresponding switch bridging. Checking the pins of the IC and using the datasheet i found that one pin of all the analog switches is connected to the filter/amplifier and the other pin is connected to the analog front end of the corresponding sensor. So the logic diagram looks as the following. 

The incoming signals from each sensor is coming to the analog switch and the MCU using the four 6.173Hz square waves selects which sensor input wants to be driven through the Filter & Amplifier to the MCU and finally be decoded. As it looks from the above description the Pin7 (INT1) is not used as an external interrupt pin but as an output pin generating a waveform of 6.173Hz. All four 6.173Hz square waves are in different timeslots. 

Here is the 6.173Khz waveform (yellow) in compination with the 40KHz transducer frequency (Red) 

Regarding the transmission path, the soundings are coming out from the MCU pins (40Khz waveforms described above) then pass through the Analog Front End which also amplifies the signal with the transformers and then finally drive the transducer.

Combining all the above findings we can separate the circuits on the PCB as below

In the end i was really curious to see how the sensors look inside and how they are made of. So i tried to tear down or better to brake them down.

As you can see from the above pictures the whole enclosure is filled with an elastic resin something like silicon and just above the transducer there is a soft white textile material like a sponge visible in the photo above. The transducer itself is indeed a piezoelectric transducer which is very similar maybe the same size as well to the ones you can find in the Christmas wishing cards which plays xmas songs when you open them. 

Owon DS7102 – Rotary Encoder Noise Malfunction Fix

Hello All!

It has been a while since my last post. I had a lot to do all these days so my spare time was really cut down. In this post i'm going to write a small how to on how to fix possible rotary encoder problems on your OWON SDS7102 Oscilloscope. 

The issue:

Today while i was trying to read an analog signal using my OWON SDS7102 scope i realised that the Volts/div rotary encoder of Channel 1 didn't work as suspected. By turning the knob the value was jumping steps or do nothing ro changing direction. For example if channel 1 was set to 2V/div and the volts/div knob was turned one step right the value was jumping to 50V/div or to 20mv/Div or to another random value instead of 1V/div. 

In an older post i was analysing how a rotary encoder works. Brinking that post to my mind i thought that may be there is a filtering issue and the mcu reads most of the noise coming out of the encoder as a real output.

As a hardware engineer i always like to tear down the devices and see what is really going on inside. So i did and i reached the keyboard pcb.
OWON screws

After removing the backside of the scope you only need to unscrew the 5 screws shown in the above photo in order to reach the keyboard. 

Owon keyboard pcb backside

And… this is the keyboard back side. What i did was to solder two 100nF on each rotary encoder (one on each output) to filter the output signal. Each encoder has 3 pins in a row. The one in the middle is the GND and the other two on the sides are the outputs. As you can see in the above photo in the first raw i have soldered through hole capacitors and on the other two rows i have soldered SMD. Both types do the job and it's on your choice. 

After the reassembly of the oscilloscope i made a test and i show fully improved behaviour of all the knobs. The capacitors solved the problem and increased the quality of the knobs.

The conclusion is that the Chinese manufacturer may had chosen to make a software filter instead of adding these capacitors to reduce the cost but the software finally wasn't that good to filter all the noise. By adding these capacitors we reduced the noise going to the mcu from the rotary outputs and make software filter life easier. 

Now you can understand how important are the capacitors!

Nokia 5110 Graphics LCD

I received a sample of Nokia 5110 graphics lcd from IC Station to write a review including a small example project. 

The first impression. 

When i received the LCD i realised that the shipping package was very protective and the LCD was in excellent condition without any blemish of shipping.

The LCD has a very good size 84×48 pixels that feets most of embedded projects and comes in a very low price. 

Technical Data:

  • Power supply voltage: 2.7V-3.3V
  • Data interface level: 2.7-3.3V
  • Backlight power supply voltage:highest 3.3V
  • Module size: 43.6mm x 43.1mm(width X height)
  • Installation diameter: 2mm

Here i would like to note the function i liked most. On this LCD module you can configure the contrast in software without making any modifications in hardware. Usually most LCD modules in the market have a potentiometer or you have to add one in order to configure the contrast.

Note! As you see in technical data the data interface level is 2.7-3.3V so you have to include a level shifter if you use a 5Volt interface. 

Manufacturing quality

The manufacturing quality of the LCD i received was very good except the silkscreen at the bottom of the PCB module where the letters wasn't printed in good form but this doesn't effect the functionality of the LCD. 

Nokia 5110 Graphics LCD Nokia 5110 Graphics LCD


In order to test the LCD i made a simple project using Arduino (i don't usually use it but it is very good for fast prototyping and testing) and i built a simple thermometer with the well known LM35. 

It took me about an hour or less to make it work and write a simple testing software. To interface the LCD i used Adafruit's well documented Nokia 5110 LCD Open Source Driver which can be found here

First i used the example included in the Adafruit's LCD Driver to make sure the wiring was working and just after that i wrote a simple project to print my Logo. 

Attention! I didn't use a level shifter even though i used an Arduino uno which uses 5V data interface. That's not correct and may damage your LCD. I run this application only for a few minutes just for the review. 


RST -> Arduino PIN3
CE -> Arduino PIN4
DC -> Arduino PIN5
DIN -> Arduino PIN6
CLK -> Arduino PIN7
VCC & BL -> Arduino 3V3
LM35 VCC -> Arduino 3V3
LM35 Output -> Arduino PIN A0


Nokia 5110 Graphics LCD Candrian Logo

After i saw that everything was working as it supposed to i wrote some code to read the analogue output of LM35 and display it on the LCD making a simple digital thermometer. 

Nokia 5110 Graphics LCD Simple Thermometer


The Source Code:

DHT-11 & One wire bus


DHT-11 is a temperature & humidity sensor in one package. It utilizes exclusive digital-signal-collecting-technique and humidity sensing technology, assuring its reliability and stability. Its sensing elements is connected with 8-bit single-chip computer. Every sensor of this model is temperature compensated and calibrated in accurate calibration chamber and the calibration-coefficient is saved in type of program in OTP memory, when the sensor is detecting, it will cite coefficient from memory. Small size & low consumption & long transmission distance(20m) enable DHT-11 to be suited in all kinds of harsh application occasions.


  • Low Cost
  • Supply voltage 3 to 5V
  • Max current 2.5mA (while requesting data)
  • 20-80% humidity range with 5% accuracy
  • 0-50C temperature range with +-2C

Inside the package looks like this:


SDC11305 Inside DHT-11

The interesting thing in this module is the protocol that uses to transfer data. All the sensor readings are sent using a single wire bus which reduces the cost and extends the distance.

In order to send data over a bus you have to describe the way the data will be transferred, so that transmitter and receiver can understand what says each other. This is what a protocol does. It describes the way the data are transmitted. 

On DHT-11 the 1-wire data bus is pulled up with a resistor to VCC. So if nothing is occurred the voltage on the bus is equal to VCC.


To make the DHT-11 to send you the sensor readings you have to send it a request. The request is, to pull down the bus for more than 18ms in order to give DHT time to understand it and then pull it up for 40uS.


What comes after the request is the DHT-11 response. This is an automatic reply from DHT which indicates that DHT received your request. The response is ~54uS low and 80uS high.


What will come after the response is the sensor data. The data will be packed in a packet of 5 segments of 8-bits each. Totally 5×8 =40bits.

First two segments are Humidity read, integral & decimal. Following two are Temperature read in Celsius, integral & decimal and the last segment is the Check Sum which is the sum of the 4 first segments. If Check Sum's value isn't the same as the sum of the first 4 segments that means that data received isn't correct.

How to Identify Bits:

Each bit sent is a follow of ~54uS Low in the bus and ~24uS to 70uS High depending on the value of the bit.

Bit '0' : ~54uS Low and ~24uS High

Bit '1' : ~54uS Low and ~70uS High

End Of Frame:

At the end of packet DHT sends a ~54uS Low level, pulls the bus to High and goes to sleep mode.


Logic Analyzer Snapshots

In the following image you can see the request sent from the MCU to the DHT and following the packet. Because the request has very long duration as you can see is about 20mS and packet received is in uS we can't view the data bits.

If we zoom at the data bits we can read the values. You can see after the Request follows the Response, and Data bits. I have drawn some color notes to be more understandable.

If we decode the above data we have.

Humidity 0b00101011.0b00000000 = 43.0%

Temperature 0b00010111 = 23 C.

The last two segments can't be seen in this image because of zoom.



What we have to do to read a DHT-11 sensor is:

  1. Send request
  2. Read response
  3. Read each data segment and save it to a buffer
  4. Sum the segments and check if the result is the same as CheckSum

If the CheckSum is correct, the values are correct so we can use them. If CheckSum is wrong we discard the packet.

To read the data bits can use a counter and start count uSeconds of High level. For counts > 24uS we replace with bit '1'.  For counts <=24 we replace with bit'0'


Here you can find some code to read DHT-11 using an Atmega8 at 16Mhz


3-pin Rotary Encoder How to

The idea of explaining here how a rotary encoder works began from the need to use a rotary encoder myself for adjusting a pwm which drives a DC motor. So i started looking for how a rotary works. When i understood how it works i thought that it could be a good idea to show you and explain what i learned.

Anyone who has worked on circuits before has used an analog potentiometer. If you are new in electronics here is a quick explanation of what a potentiometer is. In a few words a potentiometer is a varying resistor which value changes by turning the knob. By the Ohm Law V=I*R implies that it can be used for voltage or current adjustments. An example of potentiometers use is in front panels for varying values e.g in a work bench power supply to adjust the voltage or the current.

Well the potentiometers have some disadvantage.

  • Produce noise at knob turn over the uses or if dust has passed in.
  • They are not that accurate.
  • To use them in a digital circuit you have to use an Analog To Digital converter.

On the other hand Rotary Encoder.

  • There is no noise production (if you use the appropriate capacitors).
  • They are accurate (they have steps).
  • There is no need of a digital to analog converter.

Also another difference is that the analog potentiometer has a stop and start point. Rotary encoder can be turned as many times as you want. There is no end and start point. Optically there is no big difference. The best way to find out if it is a rotary encoder is to turn the knob. If you feel steps and there is no start and end point it is a Rotary Encoder.

So Rotary Encoders can be used in digital circuits providing accuracy and ease of use. Analog potentiometers are easier to use in analog circuits.

A Rotary Encoder usually has 3 pins A, B and C. Pin C is the middle pin and we connect it to GND.

What a rotary encoder actually does is:

While you turn the knob it "short-circuits" pins A and B to pin C (GND) for some milliseconds depending on the speed you turn it. Actually this is the step you feel when you turn it. Which of the two pins is shorted first depends on the direction you turn the knob.

  • Right wise pin A will be first shorted to GND and then pin B.
  • Left wise pin B will be first shorted to GND and the pin A.

By this you can identify in which way the knob is turned to. To see the short circuit, you have to supply a voltage at pins A and B. If you don't do it the voltage at pins A and B will be 0Volt before and after the short circuit so no difference will be observed. If you put direct voltage on these two pins when short circuit occurs a lot of current will be drawn as a result the power supply connected to, may be burned. For this reason we have resistors. They can adjust the current flow and they can hold voltage difference at their edges. By putting a pull up resistor on each pin(A & B) to supply voltage you pull them the supply voltage (that's why the called pull ups) and when the short circuit is occurred their voltage drops to 0V as the GND. The current that will be drawn depends on the resistors value. With the Ohm Law V=I*R you can calculate it.

Above is a hand drawn schematic with the theoretical output pulses on the right. R1 and R2 are the pull up resistors i talked about before (In use with an MCU for better results don't use MCU's internal pull ups but external 10K's). The real waveforms is expected to have noise provided by the turning of the knob as a push button provides as you push it. To clear this noise i have put two decoupling capacitors C1 and C2 (1uF each). Follow real images from a logic analyzer when the knob is turned with decoupling capacitor connected and not. Notice the difference!

Right Wise

Capacitor NO

Capacitor YES

Left Wise

Capacitor NO

Capacitor YES

We don't care about the pulse width which depend on the speed you turn the knob. What we are interested in is which pin is getting first low. As you can see there is a big difference between waveforms with and without capacitors connected. Waveforms with capacitors connected are close to theoretical ones.

Actually the code exported from the 3-pin rotary encoder is a 2-bit gray code.

Right CCW

Left CW

A 0 0 1 1
B 1 0 0 1

A 1 0 0 1
B 0 0 1 1

We can identify in which direction is moving by just looking the B state after A's falling edge. With red is colored the state after the falling edge of A.

Well now that we know how it works we can use it with a microcontroller by just checking which pin is getting first low. One way is to use an external interrupt with triggering on the falling edge of pin A as shown in the following diagram. If a falling edge detected on pin A check pin B state. If it is low that means that the rotary has turned left otherwise it has turned right.


The test Circuit

Rotary Encoder How To

Workbench Power supply 0-30Volt 0-3A

This is my first fully homemade device i ever built and i built it before having enough knowledges on electronics. I found the circuit on the internet here. It is a very stable power supply with current limiting 0-30V adjustable and 0-3A adjustable which is enough for most of the electronic circuits. I also made a modification and added an Operational Amplifier for inverting the output Voltage in order to have symmetric voltages for powering Op Amps. The only disadvantage is that the negative voltage is 1 Voltage less than the positive (eg. if you have  a +6V positive output then the negative output will be -5V) and starts working after +1V of positive voltage.

The front panel is a printed cardboard.

PSU 0-30V 0-3A

PSU 0-30V 0-3A

Here you see the backside with the 2N3055 screwed on a heat sink

PSU 0-30V 0-3A

PSU 0-30V 0-3A

PSU 0-30V 0-3A

PSU 0-30V 0-3A

Function Generator

When i was using operational amplifiers at school lab i wanted a function generator at home to play with and work on circuits with Op Amps for better understanding. So i found on the internet a free function generator circuit which uses the IC XR-2206, i printed the PCB with my UV epxosure box, i bought an enclosure box, i put everyhting inside and here is the result.

The function generator can generate Square, TTL, Sine and Traingle waveforms from 1Hz to ~1Mhz with Voltage regulation to Square Sine and Traingle waveforms.

The front panel is a printed cardboard.

Function Generator

Function Generator

Function Generator

Inside Function Generator

Inside Function Generator


Here are some construction photos, taken with my mobile phone before buying a digital camera.


Drilling the holes

Drilling the holes

Soldered pcb


Homemade PCB

The schematic from the internet

The Scheme

The PCB from the internet


PC PSU to WorkBench PSU

Most of digital circuits needs a fixed stable voltage for powering ICs like a microcontroller. So a very good solution for these voltages can be a computer power supply which gives you the fixed voltages of +/-12V +/-5V and +3.5V. By the option of symmetric voltages you can also supply operational amplifiers. Here you can see a modification i made to a PC PSU putting it into a metal/aluminium box making it look more professional and safe.

The front panel is a printed cardboard.




The cooler hole was cut by my Jigsaw Base






Testing the MC34063 PSU for filament supply.

Today i started testing the MC34063 PSU i have just designed, supplying the six VFD-Tube filaments together at the same time.

Testing MC34063 PSU

MC34063A Step-Down Converter 12V to 1.2V 750mA

The IV-12/11 vfd tubes need 1.2Volt for the filament about 100mA each. In my clock project i'm going to use 6 tubes so the total draw current will be about 600mA which is to much for a linear regulator like LM317. The LM317 can be used, but it will be need a big heat sink to keep it cool. So i designed a step-down converter based on MC34063A, a pulsed regulator, which is also power efficient.

I could have been used a resistor in series with the filament but if any tube filament get burned then the other 5 will draw more current and get burned too. Also i could have been used the AVR to regulate this voltage than using the MC34063A but there wasn't more free space on the chip.

MC34063A Step Down Converter design.

The design is based on the MC34063A's datasheet. In this design i regulate the voltage to 2.5Volt because the tubes want to have a negative voltage about -1volt to get fully powered off. So i have put two diodes in series (with ones kathode connecting to others anode) connecting the negative filament pin to GND. By this, each diode works as a supply voltage providing 0.6V x 2 = 1.2Volt.   2.4V-1.2V =  1.2Volt which is the supply voltage needed for powering the filament.


Protoboard testing

MC34063A ProtoBoard