Technical Kill switch on Crankshaft Position Sensor?

[Reg 65]

I read elsewhere that (on another vehicle) any one of the 3 wires going to the crankshaft position sensor is a good wire to interrupt with a hidden switch for preventing theft. Apparently the engine will spin but not start even if the other security measures are bypassed by going through the OBD port.
Anyone know where the Crankshaft Position Sensor is? - and if its inaccessible a convenient place to interrupt any of the (3?) wires going to it?

 

[jackwhoo]

Location varies between engine types
Maybe you could state year and engine type size etc?
I'm sure then someone may be able to help.

 

[Reg 65]

Thanks for the reply. Mine is a Dec 2020 manufactured Ducato 2.3 manual Euro 6

 

[ceecff]

Usually rear engine, bottom around flywheel-clutch. At the end cables go to engine ecu.

 

[Reg 65]

Usually rear engine, bottom around flywheel-clutch. At the end cables go to engine ecu.

Thanks for the reply, Thats useful to know, but I was hoping for more detail if possible
Like a more accessible place to interrupt a wire if possible

 

[Communicator]

I read elsewhere that (on another vehicle) any one of the 3 wires going to the crankshaft position sensor is a good wire to interrupt with a hidden switch for preventing theft. Apparently the engine will spin but not start even if the other security measures are bypassed by going through the OBD port.
Anyone know where the Crankshaft Position Sensor is? - and if its inaccessible a convenient place to interrupt any of the (3?) wires going to it?

Fiat typically use an inductive sensor to determine the crankshaft position. Inductive sensors use only two wires, but may have a screened cable. Interrupting the screen connection is unlikely to work. The camshaft sensor is usually a Hall effect device with supply, signal, and ground wires.
The camshaft sensor will connect directly with the ECU, and is in a more accessible position at the top of the engine?

Interrupting the timing sensor connection will prevent the engine starting, but will not stop an already running engine using a Bosch engine management ECU. Diagrams for earlier versions of the 2,3jtd suggest that the timing sensor may have a short tail cable with a connector to couple into the main wiring harness. Sourcing matching connectors could be problematic, alternatively you would have to cut into the engine harness, but this would be easier to conceal.

Is this not akin to your previous proposal to interrupt the key code antenna connection?

 

[Reg 65]

Is this not akin to your previous proposal to interrupt the key code antenna connection?

Yes - thats what I have done. Interrupt either of the 2 thin wires going from the coil around the ignition key barrel, down along the steering column to the ECU. Padlock light on dashboard stays on and engine won't start until the wire is reconnected, the ignition switched off and on again. So it works well enough, but I don't know if it would still prevent the engine starting if it was all being hacked through the OBD port? If not then interrupting the crankshaft sensor wire would apparently be better.

*(I am reluctant to say the wiring colours because sometimes it seems as though they run out of the right colour and then use whatever colour comes to hand!
But on my Dec 2020 Ducato it is a thin grey/white wire. Look at the coil around your own ignition key barrel just to be sure)

 

[Reg 65]

The camshaft sensor will connect directly with the ECU, and is in a more accessible position at the top of the engine?

Yes - I was wondering if anyone knew the wire colours and route to the ECU to save trying to trace them?

 

[Reg 65]

Interrupting the timing sensor connection will prevent the engine starting, but will not stop an already running engine using a Bosch engine management ECU.

But how would the ECU know when to inject the fuel (to keep the engine running) if it doesn't know the position of the crankshaft?

 

[Communicator]

But how would the ECU know when to inject the fuel (to keep the engine running) if it doesn't know the position of the crankshaft?

Imprecise terminology is confusing you. What is frequently referred to as the "timing sensor", is in fact a camshaft sensor, while the rpm sensor is the crankshaft sensor. In my understanding the Bosch ECUs use the camshaft sensor to determine the stroke when starting, and subsequently rely upon the crankshaft sensor. This is why a failing camshaft sensor can make starting difficult, but once started engine runs OK. Conversely a failing crankshaft sensor will result in rough running, or a complete failure.

 

[Communicator]

Yes - I was wondering if anyone knew the wire colours and route to the ECU to save trying to trace them?

My only source for the info that I have is the x250 training manual, which is about 20 years old!!! An up to date copy of eLearn would be preferable.

The wire colours given for the timing sensor (K47) are pin1 (ground) = BH, or white/grey, pin 2 (signal) = BG or white/yellow, and pin 3 (supply) = CV or orange/green. Connections on ECU are A20, A50, and A11 respectively. Be aware that something may have been changed.

 

[Reg 65]

@Communicator Thanks for the replies. The bit I read elsewhere was interrupting a wire from the crankshaft sensor to prevent starting, so its the crankshaft sensor I am most interested in.

I'm guessing my current method of interrupting the (wireless) communication between the ECU and the key (as described above) may not be effective if the more sophisticated thieves have a way of starting it through the OBD port without the key.

Some people say we shouldn't discuss this sort of thing on forums because it might show a thief how to do it. But thieves already know! We owners need to know how they do it in order to stop them. And even if they suspect the presence of a secret kill switch, tracing and bypassing it is still likely to slow them down a lot. And time is not on their side.

 

[MSjoberg]

RPM sensor is K046 and timing sensor is K047 in this doc, if I’m not mistaken. The colour codes can be found in the Downloads section I think.

 

[Communicator]

RPM sensor is K046 and timing sensor is K047 in this doc, if I’m not mistaken. The color codes can be found in the Downloads section I think.