Analysing the BCM/MCM Signals

[retepsnikrep]

I really would like to find out what's being said when messages are passed between the various links/control units in our cars. The main reason I would like to know is to effectively fake the battery full signal/message to the MCM so that full assist/soc is available at all times.

To this end I'm looking at one of these

Welcome to Saleae

Any comments, looking through the archive here seems we know very little about the inter unit comms except the ones used for MIMA of course.

Anyone care to guess at the protocol being used for the BATTSCI1 & BATTSCI2 signals?

Even if we just end up capturing a full battery signal/message and then keep sending it out with a pic without even understanding it that would do at a pinch.

Here are a couple of scans from the manuals, which clearly mention a serial SOC (State of Charge) signal is being sent on connector pins (7) & (20) BATTSCI1 & BATTSCI2, these seem to have a pull up and pull down resistor shown, and Logic ground is also available. So thoughts? capture data between the two wires or referenced to ground and as two separate channels, is one transmit, other recieve? I suspect so.

www.solarvan.co.uk/insight/BcmDiagram1.jpg

www.solarvan.co.uk/insight/BcmDiagram2.jpg

Just looked into a spare BCM module and to my surprise this one does not have the chip blacked out!!

It's a hitachi H8/538

Couple of data sheets here

www.solarvan.co.uk/insight/H8_538Datasheet1.pdf

www.solarvan.co.uk/insight/H8_538Datasheet2.pdf

Looks like page 389 onwards in datasheet 1 looks critical to our project. Describes the serial inteface

Also page 118 in datasheet 2 looks interesting, are all three modules, BCM, ECM, MCM using this system on same bus?

I'll have a look inside the other modules to see If they are the same cpu.

Interestingly the bcm & mcm I opened have a 10pin programming connector on the main board, now I had heard some could be updated with a special programmer/software. Anyone ever seen this?

Peter

[E27006]

Since there are 2 pins for each signal,, and they are both pulsed, perhaps they are RS485 as opposed to RS232, by using RS485 they would be less prone to corruption due to noise on the cables.

malcolm

[JimIsbell]

WOW, just what I have been looking for. That is a great find.

[retepsnikrep]

Originally Posted by E27006

Since there are 2 pins for each signal,, and they are both pulsed, perhaps they are RS485 as opposed to RS232, by using RS485 they would be less prone to corruption due to noise on the cables.

malcolm

Malcolm

Care to explain the difference?

I'm sure one is txd and other is rxd. I haven't had time to study the serial comms section of the datasheet yet.

[retepsnikrep]

Here are some high res unresized pics of the innards of the three modules. I used macro mode with my cheapo compact camera but you can see quite a bit. All about 1mb

The Bcm & Mcm have the same cpu H8/538, the Ecm seems to have a different one.

www.solarvan.co.uk/insight/bcm.jpg

www.solarvan.co.uk/insight/mcm.jpg

www.solarvan.co.uk/insight/ecm.jpg

Talk about complicated!!!! Where do I adjust the points then. LOL

All have a programming 10 pin connector?


Examining the data sheet I see the H8/538 has two seperate serial data channels, that explains the METSCI1 & METSCI2 connectors as well as the BATTSCI1 & BATTSCI2 ones I was looking at.

I might try seeing if the SCI pins on the cpu are connected to the pins on the plug to confirm this in next few days.

[JimIsbell]

Is the program stored onboard the H8 or is there an external RAM somewhere else on the board.

[retepsnikrep]

I can't see any obvious RAM it's almost certainly onboard cpu in flashrom/prom.

The datasheet gives the following info

Product lineup Model Package ROM
HD6475388F 112-pin plastic QFP (FP-112) PROM
HD6435388F 112-pin plastic QFP (FP-112) Masked ROM
HD6475398F 112-pin plastic QFP (FP-112) PROM
HD6435398F 112-pin plastic QFP (FP-112) Masked ROM

But the code number on the BCM/MCM chip is not an exact match.

H8/538

HD64F5388F16

The BCM cpu has an obviously later etched code B02 on it

The MCM cpu has an obviously later etched code M04 on it.

This probably/perhaps indicates some bulk programming by the supplier prior to the modules being built.

[richardh]

Pete,

RS232 generally uses more pins and its use of a common ground limits distance and make it prone to interference. RS232 adds the ability for handshaking and the ability to stop/slow the flow of data if one side is not ready using RTS (ready to send) and CTS (clear to send) using a flow control protocol. RS232 is normally used in a point to point communications between two devices in a full duplex mode as multi-point was not defined in the protocol.

RS485 uses a more simple 2/3 wire implementation, it only defines electrical properties and not an overall protocol. It provides for support of greater distance and speed, and is less prone to interference. Voltages used are less and therfore the power requirements are lower. It is also used in multi-point comms (such as the three way comms you are talking about between the BCM, ECM, MCM) and is generally used in master -> slave(s) communication on a bus.

A good example of RS485 is the communication in a CCTV control room and the control unit that selects the cameras and sends the pan tilt zoom commands. All the cameras are listening to the same RS485 bus, but only action the commands to thier camera address. These signals running on simple cheap cables over kilometers.

Richard

[retepsnikrep]

I've had a reply from the Logic hardware people who seem to think there unit will be suitable to capture/analyse this bcm/mcm/ecm serial data.

However I need to confirm the voltage of the signals which must be logic level 3.3 or 5v for the unit to work. I'll try and do that today.

I'm almost certain to buy one of these, and if anyone in UK wanted to contribute, then feel free to send me some money via paypal to peter@solarvan.gotadsl.co.uk.

Richard has already offered to help, and the unit will obviously be available in UK to those who contribute towards it.

Any data I glean will of course be shared on here.

[retepsnikrep]

Searching the net for info on the data comms I have now joined another Honda forum which looks very interesting with some real boffins onboard.

Tons of ECU/ECM Honda info, some of which may be very relevant.

pgmfi.org • Index page

I have posted a question about our issues and whilst browsing found this as well

pgmfi.org • Login

Look familiar?

So much good info out there if you can find it. My heads going to explode soon!