Hacking Automotive Ultrasonic Sensors

This instructable will show you how to hack / reuse a common Bosch automotive ultrasonic sensor(s).  The sensor in this instructable is a very common sensor that can be found in junkyards all over the world.  The hope is that this information will allow folks to reuse these sensors in wonderful new applications.

There are many advantages to using automotive ultrasonic sensors.

• Easily detect objects within a two meter range.
• Detect multiple objects within the sensor's field of view.  This particular sensor returns all echoes after a ping event.  In contrast, many hobbyist sensors only return the distance to the first detected object.
• All Digital.  No analog signals are used between the control module and sensors.  In other words, the sensors are all digital.  Note, the first generation automotive sensors were analog and had many problems.  Many aftermarket systems are still analog!
• Water proof.  Both the sensor and the connector are completely water proof.  Remember, these sensors live inside a vehicle fascia.  The inside surface of a fascia is a very tough environment!
• Short circuit proof.  The IO pins can be shorted to battery, or ground, or in any combination without harm to the sensor.  This includes reverse battery and double (24 Volts) battery connections.  Believe it, or not, but modern vehicles are still designed to allow good old back country boys to connect two batteries in series so that their trucks can start really fast! Legacy automotive requirement, I'm guessing.
• EMI (electromagnetic interference) resistant.  The sensor has been through a lot of testing to prove it's capable of both being resistant to EMI interference and resistant to generating EMI noise.  The EMI tests take weeks - being able to pass automotive EMI requirements is a really big deal!
• Hardened.  The face of the sensor is electro primed and painted solid aluminum.  The rest of the sensor is plastic with the electronics rubber potted.
• Shock proof.  Again, the sensor design had to prove it's self in a whole battery of tests.  Again, remember that fascia mounting location - bumpy place to live.
• Zap Proof.  Each of the sensor pin is tested during EMC (electromagnetic compatibility) testing to verify it can survive a high voltage discharge.  I think the test requires surviving a 15kV zap on each pin!  Nothing worst than watching this test being performed on your product at the EMC lab.  I'm convinced, watching this took years off my lifespan!
• Temperature proof.  Tested from -40 degrees C to +85 C.  There is also thermal shock tests that must be passed.  Living in a fascia is not easy.
• Expandable.  Multiple sensors can easily be used to cover any portion of 360 degrees.  As an example, it would be easy to use eight sensors on a robot where the sensors were placed at 45 degree increments around a circle.  The robot could then have a complete 360 degree view with no moving parts!
• Fast.  One ping out two meters and back takes just under 50ms (milliseconds).  The 50ms I quote actually includes two pings (to double verify) and guard-band time.  See below for more on this.
• Smart.  A sensor can be commanded to generate a ping or, instead, to simply listen.  Using a pinging sensor and one, or more, listening sensors tricks can be done to detect additional (very close) objects.  More on this below too.
• Elliptical Pattern.  The ultrasonic pattern generated is purposely not circular as you might expect.  Otherwise, the sensor would get echoes off the ground.  Turns out, the lip of a pot hole reflects a lot of ultrasonic energy.
• Low Power. A sensor only draws about 20 to 25mA.  About the same amount of energy used to light a standard LED.

OK, these sensors are just about as bullet proof as possible.  Needless to say, if you find yourself in possession of one of these sensors, and it has not been smashed, it is most likely a good one.  In other words, if the sensor shows no sign of mechanical abuse it is probably good.

These sensors can be found in junkyards all over the world.  The sensor used in this instructable come from Bosch and are widely used in GM and Chrysler vehicles.  I believe, but don't know for sure, that the sensor are also used in many European vehicles too.  After all, this is Bosch (a German company) we're talking about.

A disclaimer is in order.  I worked for a small supplier who also produced ultrasonic sensors for GM.  However, that was three years ago.  I never had, nor ever learned of, any direct knowledge of how a Bosch ultrasonic sensor / system is designed or how it is used or operated.  The GM engineers were very careful not to divulge anything (other than warranty info) concerning competing suppliers. 

All information in this instructable came by way of reverse engineering my wife's 2008 GM Tahoe which had a reverse backup system factory installed.  For sure, these sensor operates completely different than the system I was involved with.  Although I really like these sensors, I have no love loss for Bosch as a company.  They put it to us every chance they got.

It just kills me that these sensors are going unused by the hacker community.  After all, over 100 million Bosch ultrasonic sensors have been produced since being introduced in 1993.  This factoid can directly off their web site.  Let me say it again because it is astounding, there have been 100,000,000 ultrasonic sensors produced by Bosch since 1993.  However, Valeo's web site claims they are the world's largest ultrasonic automotive supplier.  So, Valeo (who introduced the sensor in 1991) has produced even more!  Wow, so there are a lot of sensors out there.  Note, Valeo (a French company) supplies ultrasonic sensors to Ford, as well as to European manufactures.

OK, head out to your local junkyard and look for any GM or Chrysler vehicle that was manufactured since 2006.  This particular sensor design might even go back even farther - I just don't know.  Still, there are plenty of 2006 through 2011 GM and Chrysler vehicles around to plunder.  Go get 'em boys and girls.  Oh, don't forget to snag the wire harness in the fascia too.  Those water proof sensor connectors are very precious.  You'll need those connectors later on.

When looking for sensors make sure they match the first picture below.  Bosch laser etches their name right into the sensor plastic housing.  Never mind GM does not allow suppliers to mark their name on their own product.  Bosch seems to get away with ignoring this GM rule.  Look for the Bosch name and logo, and also that the sensor shape matches the picture in this instructable.  With a matching logo and shape you have the right sensor.  You should not have any problem finding these sensors.  My local junkyard quoted me $30 bucks for a set of four sensors (harness included).

There is also a bunch more information on my web site which shows "procuring" sensors from my wife's Tahoe.  I've also got a bunch of info on my site about reverse engineering the ultrasonic park assist (UPA) module.  The info is mostly about getting the UPA module tricked into operating on my bench once removed from the vehicle. Below is a link to the site.

http://ph-elec.com/content/hacking-gm-ultrasonic-park-assist-sensors

Step 1 Hardware

Each sensor has three pins. The pins are +8.5 volt supply, single wire half duplex comm, and ground.  In a vehicle, the UPA module provides the 8.5 volt regulated supply to the sensors.  The UPA is able to switch this supply on, and off, at will.  As an example, while traveling down the highway the sensors are switched off.  When the vehicle slows below some magic speed threshold the sensors are switched back on.

The single wire comm between the UPA module and sensor seems a bit strange to me.  When inactive the bus is idle at eight volts.  In an open collector kinda fashion, the UPA module and sensor communicate using pulses which pull the bus low for short pulses.  The strange part is that the UPA sends digital commands to the sensor and the sensor responds with either a digital waveform that looks like the actual echo, or normal digital bits.  It depends on the command.  For the echo response it's like they just took the analog right off the piezo element, ran it through a op-amp comparator, and sent the op-amp output out into the comm wire.  It's strange and slick at the same time.  Downside is, the micro has to use a fast timer to measure all those echo pulses.  No simple UART action to receive an echo response.

After power-up, the UPA sends a bunch of data to the sensor.  I'm guessing the first set of pulses initialize the sensor with a certain gain level.  I'm guessing each different type of vehicle has a different initialization string of data pulses.  Looks like the UPA then sends a couple of reset commands to the sensor.  Of course, there is an acknowledgment from the sensor.  Finally, a sensor scan sequence starts on the UPA where one sensors is commanded to ping while one or two other sensors are simultaneously commanded to listen only.  Using one sensor to ping and one / two sensors to listen allows very close objects to be detected.  All the results from the sensors are sucked up by the micro in the UPA.  Note, the Star12 micro in the UPA can capture timer values based on pulses come in.  There are eight pins on the Star12 that have this ability.  So, a pulse triggers the Start12 to capture the timer automatically, at the same time an interrupt flag is set for that pin.  In the interrupt routine the micro buffers off the captured value, clears the interrupt flag, and returns.  The cool part is that captured timer value is done in hardware right when the trigger happens.  So, even if there is jitter in the interrupt response, it doesn't matter because the timer had already been captured.  Motorola really knows how to design automotive micros.  OK, I admit it, as an X Motorola employee I still have a soft spot for old Moto.  Note, Motorola sold the micro division to Freescale some 6 / 8 years ago.  Motorola has also sold my old automotive division. 

Do you how Motorola got it's name?  Well, a 100 years ago a Victrola played records.  So, Motorola got it's name by putting a Victrola (not an actual Victrola but just the idea playing a record) in a Motor vehicle. Motor Car + Victrola = Motorola Car Radio.  Motorola got its start by manufacturing automotive radios.  Now, Motorola is totally out of the automotive business.  Makes me sad. Anyway, a bit of trivia. 

Back to the hardware setup.  The development board shown below that I built interfaces four sensors to an MBed development micro.  Each sensor must have a buffer circuit to convert the bus voltages down to the 3.3V TTL values used by the MBed micro.  You can think of the sensor bus as a half duplex communications bus.  It appears the communications on the bus is 9600 baud serial.  At lease my LSA (logic state analyzer) can decode the pulses if set to 9600 baud.

I simply used pins P21 through P28 on the MBed to interface to the four sensors on my development board.  The MBed looks to be even better at processing pulse trains than the Star12.  It has all the bells and whistles that the Star12 does, plus a lot more.

Comments

[Pole Cat]

Is there any way to tell what cone angle the Bosch sensors are and how many feet they detect? I 'm replacing an OEM bumper with an aftermarket and what to make sure befor I drill holes in an expensive bumper.
GM 15797507
BOSCH 0 263 003 548 864
2257B 080128/Q5
BOSCH assembled in Mexico

[jimk3038]

Pole Cat,

The GM specification is that these sensors must detect out to a distance of 2.0 meters. It's a stretch for these sensors to reach that distance.

The standard GM spec also specifies a FOV (Field-Of-View) study to be done. We had a 2.5 meter square mat that we laided out behind a test vehicle. The mat had a printed 10cm grid on its surface. The spec then called for a 10cm pole be placed around the mat while testing when the system reported an object. This is easy to do with a GM car. Just turn the key to "on" with the engine off. Drop the PRNDL (GM speak for Park-Reverse-Neutral-Drive-Low ie the gear shifter) into reverse. A car with an existing backup system will then go active and you can play with it.

Living in the US we didn't have a "10cm pole" so we simply used a standard 3" PVC pipe which was about 3 1/2 feet long. The pole was cut well so it would stand up on its end.

We would mark the mat where the pole was detected by placing a post-it note on the mat where the pole was first reported. After the entire FOV was mapped out I would stand on the top of 10' ladder and take a picture. One of our secretaries would then convert the image into a Inkscape drawing for presentation at GM. All in all, a major pain in the backside.

The FOV was basically a box shaped envelope that extended out 2 meters from the back of the car. The side of the FOV should not extend out more than a 1/2 meter, ideally.

A bigger problem than FOV is the sensor mounting angle. Have a look at the attached picture. We used this to measure the up angle of the sensor. Using the steel bar, press bar flat on the face of a sensor. Then, use the tilt gauge to measure the sensor mounting angle. The sensor should be mounted such that the angle is +5 to 15 degree positive. With anything less the sensor will start to "see" pot holes and cracks on the surface.

Mounting the sensors can be tricky. The sensors must be mounted high enough off the ground, have a 5 to 15 up angle, and not be mounted to far around the corner of the fascia so that they pickup side object.

Oh, and you gotta mount the sensors in a retainer clip with a silicon isolator ring. The retainer clip can also help with getting the sensor up angle.

There is a bunch more info on my web site about this subject too. Here is a direct link: http://ph-elec.com/archives/category/ultrasonic/

I hope I didn't scare you will all the detail. Most of this was just GM over kill. The sensors, and sensor mounting, is pretty forgiving. As you can imaging, if your going into production with a vehicle you want the mounting to be perfect.

Hope your install work well,
Jim

[kdm06d]

This is a great instructable, Jim! Do you know anything about the circuitry inside the sensor? Is that a chip in there which communicates on the half-duplex comm wire? Wondering what kinda specs that chip has and if its EEPROM etc...

[jimk3038]

The chip is a custom designed ASIC just for this application. So no, there is no public information about the chip specifically.

However, I put a bunch more info on my person web site. You can find it all here: http://www.ph-elec.com

Thanks for the nice comments,
Jim

[kdm06d]

Wow, designing an ASIC is time consuming. It's noted numerous times here (section 1:Hardware) that the sensor runs off of 8.5V.

On your page (See link below) under "Sorting Out the Pinouts" page, item 3 LM2941S, part a reads "a.Linear Regulator – Provides a regulated 5Vdc / 1Amp output for the sensors."

http://ph-elec.com/archives/ultrasonic-sensor-hacking-step-1/3/

I don't see the difference in the 8.5V and the 5V. The delta V on your oscilloscope is < 1V, so I don't believe either of those are the signals which are used to talk?

Thanks,
Kevin

[jimk3038]

The ASIC is embedded in each sensor and are sold by the millions each year. I saw somewhere that more than 100 million sensors have been produced over the last 10 years. So yeah, a ASIC makes sense for them.

Have a look at this page:
http://ph-elec.com/archives/ultrasonic-sensor-hacking-step-1/8/

Or even better, have a look at this image:
http://ph-elec.com/wp-content/uploads/2010/04/Ping_With_Echo.jpg

Note, the scope was set for zero volts at one division up from the bottom. So, with no communication the comm wire is sitting at 8Vdc.

The ECU pulls the comm wire down to 1Vdc when active. The sensor, on the other hand, only pulls the wire down to 2Vdc.

Hope this helps,
Jim

Oh, and have a look at my new instructible I put up just today:
http://www.instructables.com/id/Computing-Pipe-Joints-in-Blender-for-Camp-Stoves/

[kdm06d]

On second read, the delta v is the difference in the two pulses (one from module, one from sensor), which then yields a 2V scale and hence, 8V. However, I still can't see what the 5V is for?

[jimk3038]

The 5Vdc is for the ECU micro.

Probably wrong to say that it provides power to the sensors. There must be another regulator in the ECU which provides power to the sensors. I know, for sure, the ECU has the ability to switch off sensor power. So, when your trucking down the highway the sensors are off.

Sorry for the confusion,
Jim

[sunruhai]

Can you tell us what this Mercedes-Benz Car Number: 0015425918 ultrasonic sensor detection data, which has an IC is Bosch's number: 30330 0806/06 PC054.1 function or feature, thank you.

[jimk3038]

Sorry, I have zero experience with Mercedes-Benz and their part numbers.

[abraxas1]

Really love this info. going to stop by the local pick-and-pull soon.
can you elaborate on what it takes to cause it to ping? do you have to actually send it digital commands to initiate pinging, or does it do it upon power-up automatically? i'm wondering how much complexity i need to get it to do the most simple range sensing. i'll need to address it digitally and program with the codes i figure out from sniffing? or maybe just pull some signal down/up for a moment and it starts pinging? then i can sample the resulting echo signal for analysis.
thanks so much
again!
michael

[jimk3038]

Michael,

Nope, the sensor is a total slave device. It won't do anything without being told. However, to get the sensor to generate a ping is quite easy. Just send the sensor a pair of "correctly" timed pulses (the pulses are understood by the sensor as a ping command) and your in business.

The hardest part is interfacing the sensor to a micro. The sensor has three wires - ground, power, and comm. The comm wire is half duplex which means both the micro and the sensor talk on the wire. That's the reason for the transistor interface circuit described above. Two micro pins (one for Rx and one for Tx) are needed.

When you send the ping command to the sensor it responds by pinging, of course, and then sending the echo pulses back to the micro on the same comm wire. Very cool.

Well, good luck at the junkyard,
Jim

[MnVelocityPilot]

If the range could be extended this would make a most excellent landing gear warning system for experimental airplanes (like mine). Landing with the gear up (retracted) is ... well ... a bad thing.

You mention that the data exchange in the power up sequence seems to be about gain setting... any ideas how it works? Any other ideas re. getting the range out to say, 100 - 150 feet?

[jimk3038]

I'm also a pilot and have had the same idea. I want to start flying amphibian aircraft and I understand landing on glass smooth water is difficult. It's hard to judge distance above the water when it's glassy. My people have flared too high and stalled while landing on smooth water.

I don't think the ultrasonic sensor is a good choice for this application. The automotive sensor is just not the right kinda beast. However, my wife's new leased Tahoe has a "blind spot detector" system. Oh boy! Now we're talking.

The blind spot detector system uses a 25GHz radar to detect vehicles coming up along side while driving down the highway. There is a little icon that appears in the outside review mirror when a vehicle is passing.

The blind spot detector is mounted in the fender on the inside surface of the fascia. In other words, the radar is punching through the fascia! There are two sensors, one for each side of the Tahoe.

The blind spot detector must have a range of at lease 20 to 30 meters. Perfect for our use as pilots.

Well, I guess it's back to the junk yard to look for some more parts.

Jim

[nerys]

I wonder of those cheap matchbox radar guns would be useful for landing distance? they output speed could they be adapted to output distance?

[jimk3038]

The nice thing about automotive stuff is how bulletproof it is. The OEMs (GM, Chrysler, & Ford) beat the tar out of suppliers over this kinda stuff. Believe it, or not, but quality is the number one thing. Quality even beats out performance or functionality. It's gotta work for years and years or you, as a supplier, are dead.

I would worry a bit about using a "cheap matchbox" to help me fly.

Also, automotive parts are plentiful. It's just a mater of finding them.

Thanks for the interest,
Jim

[nerys]

its not a match box its made by them AHH remember it now I think Matell ??

I am talking about these

http://www.youtube.com/watch?v=BvG0k5bSRgg

[jimk3038]

I'm sorry - I really did think you were talking about a cheesy little matchbox kinda thing. This is kinda cool. Plus, I bet your right, in that, there must be a way to get distance from this thing. How much does it cost? Where can I get one?

Thanks again,
Jim

[GordieGii]

Actually it may not be that easy to get a distance out of it. Speed radars use Doppler shift, they don't measure the distance.

You might be able to tap into the circuit to send and receive single pulses but you'd need a pretty accurate timer, radar travels a LOT faster than sound.

Gordie.

[nerys]

Hmm good point it does not even need to know distance just change in distance over time.

but it could still be useful. the hard part with landing on water is knowing WHEN your going to hit the water this would allow you to control your descent rate which would also be hard to judge over water.

either way it would be fun to "play" with if your someone (not like me) who has the electronic skills to know what your doing. maybe even use the radar and timing circuits to run your own processes on your own circuitry.

either way its $30 for a RADAR emitter and receiver and thats just cool !! :-)

[jimk3038]

I'm still hopeful about using the new automotive "blind spot" radar detectors. The sensor uses a 25GHz radar head that shoots through the fascia to detect vehicles passing by your own.

The blind spot detector measures distances. I know this because my wife's new leased Tahoe has the system. I was playing with it recently - as long as there is a vehicle next to me the warning lamp is on. In other words, while racing down the highway, if someone was acting like my wingman and just cruising next to me the system warning lamp stayed on. To be able to do that kind of a warning, the system must be able to measure distance so that it can detect a static object and not just measure relative speed.

Automotive electronics are so much more robust than consumer electronics. I'm sure the blind spot detector would have to meet all the automotive standards (water proof, shock proof, EMI proof, ect, ect).

My wife's lease is up in another year and there are two of these blind spot detectors on that vehicle! The anticipation is killing me.

Oh, have you seen the new "active cruise" control systems. These, too, use radar to actively manage your vehicle's cruise control speed. They "lock" onto the vehicle ahead of your own. These systems are good for several hundred meters! It's just too bad the Tahoe does not have one of these systems. Well, maybe her next one will.

[nerys]

$10 to $30 on ebay. I got 2 in the store on clearance a few years back $10 a pop :-) they sold new for $20 if I remember right.

impressive little gizmos that really work !!

just search for:

hot wheels radar

[dvboy]

100,000,000,000 is one hundred billion, not one hundred million.

[GordieGii]

That depends where you're from. In Britain that would be one hundred thousand million. There a billion is a million million, not a thousand million like here in North America.

That is all moot since the 'ible said 100,000,000 which is one hundred million here or there.

Gordie.

[jimk3038]

Well, isn't that embarrassing.

I'll edit the number in the post.

Thanks,
Jim

[d1wolf]

Could this 'sensor' be used to detect bats?

[jimk3038]

The membrane could.

Unfortunately, the sensor is tuned to one particular frequency (probably around 38kHz).  Probably not good considering that bats probably use lots of frequencies (I'm guessing).

Here is a page on my web site that shows a tear-down of the sensor: http://ph-elec.com/content/ultrasonic-sensor-hacking-step-5

Connect the membrane (kinda like a microphone) right to an oscilloscope input and you could see more frequencies.

Good luck,
Jim

[abraxas1]

I wonder how hot these things can tolerate, while actually working. must be significant, a bumper on a hot day in Las Vegas must get exceedingly hot.

i'm planning on torturing mine...

[jimk3038]

The spec is -40 to +85 degrees C. We tested our sensors to over 100 degrees to verify we had lots of margin.

Tough little buggers,
Jim

[abraxas1]

i just saw the details at your website. nicely done, thanks.
you tested it up to the boiling point of water and they still performed?

i'm an EE but automotive design is a different beast. like space work, but with a huge customer base.

gonna head to my "friendly" pick-and-pull and see what i can find.
or maybe ebay, hate the peeps at pick-and-pull.

[jimk3038]

Oh, going to 100C ain't nothin'. When I worked for Motorola we made engine control modules for GM (among others). Those babies had to perform from -40 to +125C. Living in the engine compartment is much worst than inside the fascia.

[abraxas1]

very interesting stuff. going to run out and get me some.
did you mention some where what ultrasonic frequency these units operate at? maybe 40KHz?

also, did you decode the data being sent to the device from the UPA into a string of ASCII characters? they might mean something to someone, or otherwise be separable into individual registers/commands... compare stings from different vehicles...

i was looking for a water proof transducer for a project i have in mind. never thought about looking in the junk yard. great idea.

[jimk3038]

If you decap a sensor you can dig out the membrane. Using an oscilloscope you can probe on the millivolt signal coming from the piezo element. You could then see exactly what frequency, as well as, how many cycles they are using. Simple point the membrane at a car which is in reverse gear (and has a reverse backup system).

Nope, the init string to the sensor is made up of only two values. Have a look at the source and you can see the pattern. The two values used are non-printable characters. Very strange.

The sensors are indeed waterproof. All I know is sound travels fast in water. I have no idea what kind of range your going to get.

Good luck,
Jim

[GYNot]

I have another interest which is an anemometer. If you have two senors and two emitters at 90 degree angles, you can measure the time for sound to travel from the first emitter to it's paired sensor then do the same for the second. Based on the delay from the ideal timings you can calculate the winds velocity and direction. I think these might be good choices for that application.

[jimk3038]

Yep, a anemometer would be a perfect application for these sensors. It would be a snap to trigger one sensor to ping and the others to listen only. The listening sensor would respond as soon as the sound made the jump over the gap. Want a great idea.

Thanks,
Jim

[mikchil]

Good work on the write-up. I don't know much about this kind of stuff but I know a lot more now than I did before I read it.

What kind of material is detectable? Can it see soft stuff like a person at the door or does it require hard stuff to generate the right echo properties?

[jimk3038]

Ultrasound will detect almost anything if the object is close enough. It's more about the geometry of the object at further distances. Round objects are easier to detect than square ones. Unless, if the flat surface is perpendicular to the sensor surface. Garbage dumpsters are the best ever if you get them at just the right angle.

Almost anything can be detected within the first one meter. After one meter it gets more difficult to detect objects. For General Motors the spec required detecting an ISO pole out to a distance of two meters. The ISO pole was just a piece of 4" PCV pipe one meter long. The spec required the pole be set up on the ground so that it balanced on the end. The spec required the pole to be moved all around within the two meter envelop behind the vehicle.

In fact, I was blown away one day when someone showed me how the sensor could detect a single string hung down in front of the sensor at a distance of 1/2 meter. Gosh, even a string generated an echo that the sensor could detect! Amazing.

Thanks,
Jim

[robot797]

my sensors only has 2 wires and now?

[jimk3038]

Yep, there are tons of different sensors out there in the world. I have a collection which has many types.

A two wire sensor sounds like one of the old analog sensors that was used many years ago.

To use this instructible your gonna have to find an exact match to the pictures above. There are just too many sensors out these. However, the sensor above is one of the all time most popular. You should be able to find some at your local junk yard.

Good luck,
Jim

[mainr]

Nice write up, thanks.
Came across these links via the "helpful, targeted advertisements" on instructables. Certainly help to clarify, and there is a high likelihood the interface is the same (- the beauty of "de-facto" standards ;-), though the packaging of the sensor is obviously different.

the sensor:
http://www.prowave.com.tw/pdf/US040.pdf

the controller chip:
http://www.prowave.com.tw/pdf/sonaric.pdf