Log In

Available Now.....

Sneek peek of what this game
changing system looks like

Details Here....


Celebrating 43 Years

Follow us on Facebook for all the latest news, updates and promotions



CAN Test Box

can test box


Continuing with our mission to make vehicle diagnostics easier and faster…the new CAN Test Box gives you easy access to the 16 pins of the diagnostic connector that is fitted to all modern vehicles. Depending on the configuration of the vehicle, this may allow you to check power, ground and CAN Bus signal quality. With the test leads supplied you can connect your PicoScope lab scope to the CAN Test Box to monitor signals such as the CAN High and Low. More.....

Attention all
Automotive Scope Users

Pico Automotive Scope software now sports a new Waveform Library browser.
Must own PicoScope to view.
See details here


We have just posted a few new Automotive Tutorials and Case studies Here is the latest:
Honda Rattle

Credit Cards Accepted

website security

Troubleshooting a Knock Sensor

Converts PC to Oscilloscope (1435 bytes)
    By Nick Hibberd

Hibtech Auto-Electrical Diagnostics

US Prices
CDN Prices

Privacy and Security



The vehicle arrived with the engine MIL on but with no noticeable running problem. Checking the system with a scan tool, I found these diagnostic messages:
  • KNOCK SENSOR CYL 1-2-7-8

Because the trouble codes relate to different aspects of the engine management, it was unlikely that either had any effect on the other. However, the faults were logged by the ECM for a reason and either of them could equally have caused the MIL to flag. It’s also unlikely that both events occurred at the exact same moment, so which one was the cause of the MIL flagging this time?

Look at this logically. Most stored trouble codes sit in the Engine Control Module’s memory until viewed and erased by a scan tool but, unfortunately, this opens the way for many stored faults to be present when often only one relates to the customer’s present complaint. The problem is aggravated if the last fault wasn’t erased from the ECM’s memory after it was rectified, so good technicians never leave old codes behind like this. To make sure, I recorded and erased the codes in an in attempt to see which one was the offending problem, the plan being to drive the vehicle and subject it to various driving conditions whilst monitoring for any trouble codes. As it happened, merely keying on caused a stored fault:

  • KNOCK SENSOR CYL 1-2-7-8
V8 engine

The engine is a V8 with two knock sensors installed, one monitoring cylinders 1-2-7-8 and the other cylinders 3-4-5-6. The sensors themselves are mounted at the bottom of the V and between the cylinder heads.

The sensor’s detecting element is a piezoelectric crystal which, when at rest, has no voltage across it. However, when subjected to mechanical pressure at the knock frequency, which is typically around 15 kHz, the crystal’s electrical structure becomes distorted, producing a voltage output. The emitted electrical signal is directly proportional the severity of the pressure or knock. This signal is interpreted by the ECM’s knock control strategy which alters ignition timing, and sometimes fuel delivery, in stages until the knock disappears. Backing off ignition timing for that cylinder is standard practice, while any other conditional tweaks performed by the ECM depend on the system.

There are various types of connection between the knock sensor and the engine management unit. Some early management systems only had a single cable running between them and the knock sensor; some knock sensors have two cables, where the second one acts as both a shield and a signal ground reference; some bias the signal line above chassis ground and the knock signal modulates the dc voltage; and some designs have a separate control unit (A/D converter) entirely dedicated to interpreting the knock signal before it reaches the ECM.

Once supplied with a knock sensor signal, the ECM’s diagnostic procedure can vary. The knock control strategy itself used by most ECMs predicts when a combustion knock will occur, so the ECM only listens to the knock sensor signal just before and after combustion. This reduces the chance of the sensor picking up stray signals that the ECM may incorrectly interpret as a knock.

What stirred my curiosity was the trouble code itself, which showed the ECM’s ability to detect a problem within the knock circuit with just the ignition on, when no engine knock was present nor expected.

Background information: known good signals

knock sensor

The system configuration was investigated further to form an understanding of this fault detection strategy and the sensor’s general operating characteristics.

Each knock sensor had three cables connected, two running straight to the ECM and one providing a ground path and signal shield. The signal recorded at pin 1 never altered much above ground potential but, because this cable came from the ECM, it was deemed to be more of a ground reference to the sensor rather than a direct chassis ground. Pin 2 was the line out carrying knock information from the sensor to the ECM. It was also this cable that revealed most of the diagnostics performed by the ECM. Pin 3 was a direct connection to chassis ground.

The sensor incorporates a shunt resistor across pins 1 and 2 that measured about 560 kΩ in a known good example. The polarity of the test leads is not important for this measurement.

knock sensor waveform

Capture 1 was taken during one key-on cycle. Each channel is monitoring one knock sensor’s signal line. For ease of viewing, the Red channel has been slightly offset to give a clearer comparison. The trace follows each sensor’s signal line from the moment ignition is switched on. Even though we can’t clearly see the signature itself here, we can definitely spot a pattern and a near perfect correlation between the two sensors.

The diagnosis that the ECM performs seems to be in three phases that make up the whole recorded trace. Immediately after ignition is switched on, the ECM produces a high-frequency sine oscillation, then a nominal carrier voltage hangs on the signal line, and finally there is a combination of the first two phases switching between each other rapidly. Incidentally, this third phase would remain present whenever the ignition was on; if the engine started, only the carrier voltage would remain. The following captures carry on from 1 and illustrate the same recorded signal, except now focusing on the different phases of the whole trace.


Capture 2 shows the first stage in more detail as ignition is switched on. It lasts for about 35 ms and the oscillations seen have a frequency of about 5.6 kHz.

Hertz (Hz) = cycles per second
Approximate distance between each peak = 177 µs (0.000177 seconds)
1 second / 0.000177 second = 5649 cycles per second
  = 5.6 kHz

Although the two signals look similar, they can be seen to drift slightly apart from one another in time, which offers a clue that two separate diagnostics are used. This makes sense, because we know that the ECM can determine which of the two knock sensor circuits is faulty.

automotive waveform

The nominal carrier voltage that the ECM hangs on the line seems consistent and interference-free throughout. Both signal lines here read about 1.6 V.

automotive waveform

Capture 4 shows more clearly a combination of the signals captured in 2 and 3. This repeated signal has about a 4.8 ms duration incorporating the same 5.6 kHz oscillation. The main factor here is the oscillations themselves, as these seem to be fundamental to the ECM’s diagnosis of the sensor and circuit. An interesting characteristic of any piezoelectric element is its ability to act as both a sensor and an actuator. In this application, the element's purpose is to react to a certain mechanical vibration frequency (combustion knock) then produce a voltage proportional to those vibrations, but it can also work the other way. If the element is supplied with an oscillating voltage, it produces a very small mechanical movement in the form of waves at the supplied frequency. It’s likely that this 5.6 kHz oscillation is used to excite the piezoelectric element.


USA Office

Address: 1480 Gulf Road, Suite 837,
PO Box 1364
Point Roberts, WA 98281

Western Canada - Vancouver BC

Tel:1.800.663.6001 or 1.604.925.6150
Address: 2454 Haywood Ave
West Vancouver, BC V7V 1Y1

Eastern Canada - Markham, Ontario

Tel:1.800.465.0164 or 1.905.513.7027