It has been two years since my last post as i can see from the date but finally it seems i found the time to come back. The idea of reverse engineering the car parking sensors came when i replaced my car parking sensors and i was curious to find out how this thing really works.
Generally, i had a picture in my mind on how they should work. A sounder that sends the sounding and a microphone/receiver that receives it back (as radar works), calculating the time, the signal takes to travel from the sounder and back to the microphone from the obstacle reflection. Having 4 sensors on the car bumper pointing to the same direction, is challenging for the processor to recognize which sounding comes from which sensor. A quick thought i made is that it may use a different operating frequencies for each sensor or a different timeslot for each sensor keeping the same frequency for that purpose. But we will find out later on, while powering things on.
So having this picture in mind we move on.
First interesting thing that got my attention while i was removing the sensors from the bumper was the sensors themselves. They had only two wires each so the picture in my mind with a separate microphone and sounder on each sensor should change to one device which may switch from sounder to microphone and vice versa (operating both as a sounder and microphone). All this because there are only two wires so there could not be two different components such as a sounder and a microphone. If that was true there should be at least 3 wires, 2 wires one for each component (sounder & microphone) and a shared wire for the common ground.
Second step as long as i made the first optical investigation i unscrewed and removed the enclosure of the main processing unit in order to have direct access to the PCB design. In first look we can see the main processor from Atmel (AT89C2051), a Schmitt trigger (HEF40106B) which may be used for isolating/separating the analog front end from the main processor/circuit, two operational amplifiers (HA17358) with some external components around it which looks like to be used for filtering and amplifying the received reflections and a third IC which after some googling i found out that's an analog switch (HEF4066B). I can't imagine yet what could be the use of this as there could be a lot of uses such as signal scanning between the 4 sensors or for switching each sensor mode from reception to transmission etc.
Looking closer to the sensor connectors on the PCB we can see that one connection of each sensor is directly connected to ground so the second connection seems to transmit/receive the signals (obvious). Also there is a small transformer connected on each sensor connection which looks to be used for increasing the signal voltage in order to drive the piezoelectric(possible) transducer of each sensor.
I think it's time to power things on. Connect the main unit to power as well as the LCD screen to the main unit in order to have feedback and know in which step we are working on. Using the oscilloscope i started reading the pins of each sensor connector with the sensors disconnected trying to find a common pattern. At a first look, the waveform coming out from sensor connector 1 looks like a periodic square wave signal.
Trying the connector 2 the signal seems to be the same with the frequency of the square wave remaining at 40.12khz. In more detail i would describe it as a signal of 14 square pulses of 40.12khz repeating about each 160ms. So the device could send these 14 pulses to each sensor, then switch the sensor circuity to receiving mode and wait for the reflected signal to come until next transmission/sounding. But as the frequency of all 4 channels is the same the identification of the reflection (from which sensor the sounding is coming from) it looks that is not implemented using different frequencies. So let's see if there is a different sounding timing (timeslot) for each sensor. Measuring the timing distance between each channel we can see that each channel has exactly 40ms difference from the previous one .
1st channel signal to 2nd channel signal distance 40ms
1st channel signal to 3rd channel signal distance 80ms
1st channel signal to 4rth channel signal distance 120ms
So these 40ms gaps may be used by the main unit to read the reflections. This also means a frequency of ~6.173Hz (1/160ms). Our first findings since now are clear. All sensors are transmitting on the same frequency but in different timeslots
Next step i tried to read all of the mcu pins and compare them with the function of each pin given by the datasheet.
| Pin | TYPE | READING | Pin | TYPE | READING |
|---|---|---|---|---|---|
| 1 | VCC | +5V | 20 | I/O | – |
| 2 | UART RX | 58.82KHZ SQ | 19 | I/O | 40KHZ/6.173HZ SQ |
| 3 | UART TX | 534.5KHZ SQ | 18 | I/O | 40KHZ/6.173HZ SQ |
| 4 | CRYSTAL | 12MHZ SINE | 17 | I/O | 40KHZ/6.173HZ SQ |
| 5 | CRYSTAL | 12MHZ SINE | 16 | I/O | 40KHZ/6.173HZ SQ |
| 6 | INT0 | SIGNAL SQ | 15 | I/O | 6.173HZ SQ |
| 7 | INT1 | 6.182HZ SQ | 14 | I/O | 6.173HZ SQ |
| 8 | T0 (timer 0 external input) | 24.71HZ SQ | 13 | AIN1 | – |
| 9 | T1 (timer 1 external input) | 12.35HZ SQ | 12 | AIN0 | – |
| 10 | GND | GND | 11 | I/O | 6.173HZ SQ |
Pin by pin.
From pin 1 to pin 5 all the signal readings are obvious and expected. UART pins 2&3 are used to communicate with the remote LCD display which displays the distance from the obstacle and its direction. This interface can be used in combination with an Arduino for any DIY application. Pin 6 is an external interrupt driven pin and we read a square wave input signal which is not periodic and stable which makes it more interesting and moves it closer to the fact that this pin may reads and decodes the reflections (do all the job). There is a stopped snapshot in the following screenshot where you can see the waveform on that pin. As you may notice there is a small gap after the 12th square wave and then follows another waveform. The following waveform is the reflection and changes its frequency depending on the obstacle distance. In combination with an internal timer the MCU can easily calculate the read frequency and make its calculations for the real objstacle distance.
Pin 7 is also an external interrupt pin but the oscilloscope reads a 6.182hz square wave. We cannot be sure yet if this square wave is coming out of pin 7 or it's going in.
On pin 8 we have a square wave of 24.71hz. On pin 9 we have a 12.35hz waveform which i followed using the oscilloscope and a continuity meter and i came across a very interesting implementation. As it looks Timer 1 is generating this waveform, then it's inverted through the Schmitt trigger it's filtered and converted to a DC signal and then this signal is feed to the mcu RESET pin through the Schmitt trigger again reversing its polarity. By this implementation when the mcu is normally running it's providing 12.35hz which is then inverted, filtered and again inverted as a result to a zero voltage. When something goes wrong with the mcu (crash – infinity loop etc) and the T1 stops generating this frequency the output of all the above implementation is going high triggering the mcu to reset. This is a very clever "hardware" watchdog and it's something i see for the first time.
Here is the schematic of this implementation
Pins 16 to 19 look to drive the actual transducers as these are 4 identical pins generating the same frequency as the one i read on the sensors but in different timeslots.
Finishing with all the pins i tried to move on and check the routing of the all 4 pins of 6.173Khz with a continuity meter and a desktop light in the backside of the PCB. As these pins are 4 in count probably they may have to do with the four sensors. The continuity shows that each of these pins is connected to the Enable pin on each channel of the analog switch. The Analog Switch consists of 4 analog switches each one having 2 pins that can be actually bridged and one pin that's the enable pin and in fact this pin triggers the corresponding switch bridging. Checking the pins of the IC and using the datasheet i found that one pin of all the analog switches is connected to the filter/amplifier and the other pin is connected to the analog front end of the corresponding sensor. So the logic diagram looks as the following.
The incoming signals from each sensor is coming to the analog switch and the MCU using the four 6.173Hz square waves selects which sensor input wants to be driven through the Filter & Amplifier to the MCU and finally be decoded. As it looks from the above description the Pin7 (INT1) is not used as an external interrupt pin but as an output pin generating a waveform of 6.173Hz. All four 6.173Hz square waves are in different timeslots.
Here is the 6.173Khz waveform (yellow) in compination with the 40KHz transducer frequency (Red)
Regarding the transmission path, the soundings are coming out from the MCU pins (40Khz waveforms described above) then pass through the Analog Front End which also amplifies the signal with the transformers and then finally drive the transducer.
Combining all the above findings we can separate the circuits on the PCB as below
In the end i was really curious to see how the sensors look inside and how they are made of. So i tried to tear down or better to brake them down.
As you can see from the above pictures the whole enclosure is filled with an elastic resin something like silicon and just above the transducer there is a soft white textile material like a sponge visible in the photo above. The transducer itself is indeed a piezoelectric transducer which is very similar maybe the same size as well to the ones you can find in the Christmas wishing cards which plays xmas songs when you open them.
Thankyou, its was good to read, Im planning to build one with arduino ( i have spare waterproof sensor lying around)
Is it possible to adjust the beeping distance?
I am also interested in this.
I too am interested in a longer sensing distance.
My interest lies in sensing curbs and dips in driveways, due to a low and extended front end body work.
At what distance would this become impractical?
Greate, thank You, I was searching information about how that sensor is build.
Now I know.
Will this work with any piezo resonance frequency or does it only work with 40khz resonance frequency?
Are these the Baud rate to use to read the serial Data from Pins2&3
2 UART RX 58.82KHZ SQ
3 UART TX 534.5KHZ SQ
And What does SQ stand for?
So Intuiative, thank you.
square wave signal
what about the Baudrate for serial UART on pins 2 & 3?