I need to trick a fluid sensor to return a full signal

[hhoarder]

My car has an AdBlue fluid sensor that isn't working properly. It's an ultrasonic sensor and the car is reading 0mm of fluid from the sensor (out of maximum 245mm), despite the tank being full. A replacement part is only deliverable in July or so, which basically turns my car into a brick until then. My only hope is somehow tricking the sensor/car into reading the tank as being full.

I don't know exactly what kind of output the sensor is producing, but looking online at various ultrasonic sensors, they all seem to output 4-20mA.

Here is the wiring diagram for the sensor:

As you can see, the sensor uses 3 wires - positive, negative and signal.

My question is, how would I go about using the signal wire to send back "tank full" signal to the car?

Any help or tips are much appreciated, thank you!

Edit: after doing some more research, I've found that the module in question is Bosch Denoxtronic 5.

 

[atferrari]

I recall using, just for testing 4-20 chanels of an alarms pannel, a portable variable constant current source.

But, just for testing.

 

[Diver300]

4-20 mA is not common on cars. I would expect a variable voltage, a variable duty cycle PWM, or a LIN signal.

 

[hhoarder]

I recall using, just for testing 4-20 chanels of an alarms pannel, a portable variable constant current source.

But, just for testing.

Definitely worth a try, I see them online for about 10€. Thank you for the suggestion!

 

[hhoarder]

4-20 mA is not common on cars. I would expect a variable voltage, a variable duty cycle PWM, or a LIN signal.

Thank you for your comment. Any tips on how I would go about producing a LIN signal?

 

[Tony Stewart]

A LINear signal is just the average DC voltage of any PWM duty cycle with a potential range of 0.5 to 4.5V for 10 % to 90% PWM.

Measure what you have then try something else.

My oops

Local Interconnect Network - Wikipedia

en.wikipedia.org

 

[Diver300]

Thank you for your comment. Any tips on how I would go about producing a LIN signal?

With any signal, you need to find out what needs to be sent first.

One way would be to record a working sensor. It is possible that a sensor that is stuck at 0% would give you a clue as allow you to guess what needs to be sent.

In LIN, the frame ID is always sent by the master, and it's likely that the sensor is the slave, so it might be possible to look at what frames IDs are being sent by the master and to guess the frame content.

A microcontroller / arduino / Raspberry Pi or similar would be needed if it is a LIN system.

 

[hhoarder]

With any signal, you need to find out what needs to be sent first.

One way would be to record a working sensor. It is possible that a sensor that is stuck at 0% would give you a clue as allow you to guess what needs to be sent.

In LIN, the frame ID is always sent by the master, and it's likely that the sensor is the slave, so it might be possible to look at what frames IDs are being sent by the master and to guess the frame content.

A microcontroller / arduino / Raspberry Pi or similar would be needed if it is a LIN system.

I'm afraid I don't have any other sensor to try. However, I do have a few Raspberries and one older Arduino. I've already found a library that can sniff LIN messages, so if the sensor is indeed using LIN, I should hopefully be able to figure out the protocol and then send my own messages.

Thank you very much for pointing me in this direction!

 

[hhoarder]

I've raised the car again and measured some stuff, but I've gotten unexpected results.

Measuring between + and - gives 12V as expected. However, it's showing 7.2V between + and signal wire. Am I correct in assuming that the car is sending a 7.2V to the sensor? Would that mean it's trying to initiate some sort of start-up protocol?

Edit: the values above were measured inside the plug that's going from the car to the sensor. I've disconnected the plug and then measured the pins inside, the sensor was never involved.

 

[Diver300]

I've raised the car again and measured some stuff, but I've gotten unexpected results.

Measuring between + and - gives 12V as expected. However, it's showing 7.2V between + and signal wire. Am I correct in assuming that the car is sending a 7.2V to the sensor? Would that mean it's trying to initiate some sort of start-up protocol?

I suspect that the signal from the sensor is just a voltage, so more voltage represents more fluid.

Can you measure the voltage from the signal wire to ground. It should be 12 - 7.2 = 4.8 V but it's worth checking.

Can you also measure the voltages with the sensor disconnected?

What does the car say that the fluid level is when the sensor is disconnected?

 

[hhoarder]

I suspect that the signal from the sensor is just a voltage, so more voltage represents more fluid.

Can you measure the voltage from the signal wire to ground. It should be 12 - 7.2 = 4.8 V but it's worth checking.

Can you also measure the voltages with the sensor disconnected?

What does the car say that the fluid level is when the sensor is disconnected?

I'm sorry, I should have been more specific - I have disconnected the plug from the car to the sensor and I've measured the voltages inside the plug itself. The sensor was completely disconnected during this time. So the plug going into the sensor had 7.2V between + and SIG.

The raw fluid value is still showing as 0, just as it was when the sensor was actually connected.

 

[Nigel Goodwin]

I'm sorry, I should have been more specific - I have disconnected the plug from the car to the sensor and I've measured the voltages inside the plug itself. The sensor was completely disconnected during this time. So the plug going into the sensor had 7.2V between + and SIG.

The raw fluid value is still showing as 0, just as it was when the sensor was actually connected.

It could be a pull-up resistor, the sensor could pull it low, and could still be any kind of data, a variable voltage, or a variable current - you really need a working sensor to determine it.

 

[hhoarder]

It could be a pull-up resistor, the sensor could pull it low, and could still be any kind of data, a variable voltage, or a variable current - you really need a working sensor to determine it.

Your pull-up resistor gave me an idea - I went back and extended the wires between the plug and the sensor in such a way that I could measure voltages while it was all connected.

I'm still getting 12V between + and -, but the + and SIG was fluctuating between (roughly) 6 and 8 volts. I'm sure it was more nuanced as that, but I only have a multimeter and no scope. So you're right, it was a pull-up resistor and something started to happen once I connected the sensor. I'm guessing there was some sort of communication between the ECU and the sensor.

Since the voltages were always higher than 5V, I probably can't use Arduino to try and see what's going on. I've found some USB devices that can supposedly connect to the CAN hub and read this kind of data stream, but who knows if that would do me any good.

 

[jpanhalt]

Does your multimeter have a "frequency" function. Many do. That might show the PWM without actually being able to read it.

 

[Diver300]

It's not CANbus, because CANbus is two signal wires, that are both at about 2.5 V when idle, and one goes up from that and one goes down from that when there are signals.

It could be LIN bus. That is near 12 V when idle, and it goes down from that when there is are signals.

See what your multimeter does when you turn it to AC volts and see what it measures when you connect it to a battery. If it reads zero, you know that your multimeter ignores DC signals when set to AC. If that is the case, measure the AC voltage of the signal. If that reads between 1 and 3 V, it could well be a LIN signal.

If it does look like a LIN signal, you could try buying a LIN transceiver (https://uk.rs-online.com/web/p/can-interface-ics/7154542) and wiring that up to the Arduino. You might be able to write some code to analyse and simulate the sensor. It's quite a stretch without an oscilloscope.

 

[ZipZapOuch]

What vehicle is this (model/year/engine)?

 

[ZipZapOuch]

How do you know it's the level sensor and not the pump?
The Denoxtronic 5 you mentioned above is the replacement (aftermarket) pump sold by Bosch as an OEM replacement. Are you trying to replace it or bypass it so you don't need DEF?

 

[hhoarder]

Does your multimeter have a "frequency" function. Many do. That might show the PWM without actually being able to read it.

Great idea! It does have a frequency function, yes, I'll give it a try, thank you!

 

[hhoarder]

It's not CANbus, because CANbus is two signal wires, that are both at about 2.5 V when idle, and one goes up from that and one goes down from that when there are signals.

It could be LIN bus. That is near 12 V when idle, and it goes down from that when there is are signals.

See what your multimeter does when you turn it to AC volts and see what it measures when you connect it to a battery. If it reads zero, you know that your multimeter ignores DC signals when set to AC. If that is the case, measure the AC voltage of the signal. If that reads between 1 and 3 V, it could well be a LIN signal.

If it does look like a LIN signal, you could try buying a LIN transceiver (https://uk.rs-online.com/web/p/can-interface-ics/7154542) and wiring that up to the Arduino. You might be able to write some code to analyse and simulate the sensor. It's quite a stretch without an oscilloscope.

It's kinda funny because I've sold my mid-tier scope a few months ago since I haven't used it for years.

I also found a software that can supposedly analyze and send LIN data, it's even free, so worth a try if nothing else works. Thank you for your comment!

 

[hhoarder]

How do you know it's the level sensor and not the pump?
The Denoxtronic 5 you mentioned above is the replacement (aftermarket) pump sold by Bosch as an OEM replacement. Are you trying to replace it or bypass it so you don't need DEF?

Using diagnostics software, I was able to test/run the pump and it was fine, it built up enough pressure. Even if it was the pump, there's a different error for that and the fluid level should still be reading correctly. As it is right now, the ECU is reading 0 from the sensor.

The Bosch unit is built into the tank and cannot be removed or replaced individually, only the entire tank. I'm not trying to bypass DEF, I just want it to read the tank as being full and resetting the countdown timer.