Honda Insight Forum banner

1 - 20 of 134 Posts

·
Administrator
Joined
·
11,011 Posts
Discussion Starter #1 (Edited)
I really would like to find out what's being said when messages are passed between the various links/control units in our cars. The main reason I would like to know is to effectively fake the battery full signal/message to the MCM so that full assist/soc is available at all times.

To this end I'm looking at one of these

Welcome to Saleae

Any comments, looking through the archive here seems we know very little about the inter unit comms except the ones used for MIMA of course.

Anyone care to guess at the protocol being used for the BATTSCI1 & BATTSCI2 signals?

Even if we just end up capturing a full battery signal/message and then keep sending it out with a pic without even understanding it that would do at a pinch.

Here are a couple of scans from the manuals, which clearly mention a serial SOC (State of Charge) signal is being sent on connector pins (7) & (20) BATTSCI1 & BATTSCI2, these seem to have a pull up and pull down resistor shown, and Logic ground is also available. So thoughts? capture data between the two wires or referenced to ground and as two separate channels, is one transmit, other recieve? I suspect so.

www.solarvan.co.uk/insight/BcmDiagram1.jpg

www.solarvan.co.uk/insight/BcmDiagram2.jpg

Just looked into a spare BCM module and to my surprise this one does not have the chip blacked out!!

It's a hitachi H8/538

Couple of data sheets here

www.solarvan.co.uk/insight/H8_538Datasheet1.pdf

www.solarvan.co.uk/insight/H8_538Datasheet2.pdf

Looks like page 389 onwards in datasheet 1 looks critical to our project. Describes the serial inteface ;)

Also page 118 in datasheet 2 looks interesting, are all three modules, BCM, ECM, MCM using this system on same bus?

I'll have a look inside the other modules to see If they are the same cpu.

Interestingly the bcm & mcm I opened have a 10pin programming connector on the main board, now I had heard some could be updated with a special programmer/software. Anyone ever seen this?

Peter
 

·
Registered
Joined
·
821 Posts
Since there are 2 pins for each signal,, and they are both pulsed, perhaps they are RS485 as opposed to RS232, by using RS485 they would be less prone to corruption due to noise on the cables.

malcolm
 

·
Registered
Joined
·
1,616 Posts
WOW, just what I have been looking for. That is a great find.
 

·
Administrator
Joined
·
11,011 Posts
Discussion Starter #4
Since there are 2 pins for each signal,, and they are both pulsed, perhaps they are RS485 as opposed to RS232, by using RS485 they would be less prone to corruption due to noise on the cables.

malcolm
Malcolm

Care to explain the difference?

I'm sure one is txd and other is rxd. I haven't had time to study the serial comms section of the datasheet yet.
 

·
Administrator
Joined
·
11,011 Posts
Discussion Starter #5 (Edited)
Here are some high res unresized pics of the innards of the three modules. I used macro mode with my cheapo compact camera but you can see quite a bit. All about 1mb

The Bcm & Mcm have the same cpu H8/538, the Ecm seems to have a different one.

www.solarvan.co.uk/insight/bcm.jpg

www.solarvan.co.uk/insight/mcm.jpg

www.solarvan.co.uk/insight/ecm.jpg

Talk about complicated!!!! Where do I adjust the points then. LOL

All have a programming 10 pin connector?


Examining the data sheet I see the H8/538 has two seperate serial data channels, that explains the METSCI1 & METSCI2 connectors as well as the BATTSCI1 & BATTSCI2 ones I was looking at. ;)

I might try seeing if the SCI pins on the cpu are connected to the pins on the plug to confirm this in next few days.
 

·
Registered
Joined
·
1,616 Posts
Is the program stored onboard the H8 or is there an external RAM somewhere else on the board.
 

·
Administrator
Joined
·
11,011 Posts
Discussion Starter #7
I can't see any obvious RAM it's almost certainly onboard cpu in flashrom/prom.

The datasheet gives the following info

Product lineup Model Package ROM
HD6475388F 112-pin plastic QFP (FP-112) PROM
HD6435388F 112-pin plastic QFP (FP-112) Masked ROM
HD6475398F 112-pin plastic QFP (FP-112) PROM
HD6435398F 112-pin plastic QFP (FP-112) Masked ROM

But the code number on the BCM/MCM chip is not an exact match.

H8/538

HD64F5388F16

The BCM cpu has an obviously later etched code B02 on it

The MCM cpu has an obviously later etched code M04 on it.

This probably/perhaps indicates some bulk programming by the supplier prior to the modules being built.
 

·
Registered
Joined
·
79 Posts
Pete,

RS232 generally uses more pins and its use of a common ground limits distance and make it prone to interference. RS232 adds the ability for handshaking and the ability to stop/slow the flow of data if one side is not ready using RTS (ready to send) and CTS (clear to send) using a flow control protocol. RS232 is normally used in a point to point communications between two devices in a full duplex mode as multi-point was not defined in the protocol.

RS485 uses a more simple 2/3 wire implementation, it only defines electrical properties and not an overall protocol. It provides for support of greater distance and speed, and is less prone to interference. Voltages used are less and therfore the power requirements are lower. It is also used in multi-point comms (such as the three way comms you are talking about between the BCM, ECM, MCM) and is generally used in master -> slave(s) communication on a bus.

A good example of RS485 is the communication in a CCTV control room and the control unit that selects the cameras and sends the pan tilt zoom commands. All the cameras are listening to the same RS485 bus, but only action the commands to thier camera address. These signals running on simple cheap cables over kilometers.

Richard
 

·
Administrator
Joined
·
11,011 Posts
Discussion Starter #9
I've had a reply from the Logic hardware people who seem to think there unit will be suitable to capture/analyse this bcm/mcm/ecm serial data.

However I need to confirm the voltage of the signals which must be logic level 3.3 or 5v for the unit to work. I'll try and do that today.

I'm almost certain to buy one of these, and if anyone in UK wanted to contribute, then feel free to send me some money via paypal to [email protected].

Richard has already offered to help, and the unit will obviously be available in UK to those who contribute towards it.

Any data I glean will of course be shared on here.
 

·
Administrator
Joined
·
11,011 Posts
Discussion Starter #10
Searching the net for info on the data comms I have now joined another Honda forum which looks very interesting with some real boffins onboard.

Tons of ECU/ECM Honda info, some of which may be very relevant.

pgmfi.org • Index page

I have posted a question about our issues and whilst browsing found this as well

pgmfi.org • Login

Look familiar?

So much good info out there if you can find it. My heads going to explode soon!
 

·
Administrator
Joined
·
11,011 Posts
Discussion Starter #11
I've sent an e-mail today to a clever chap in UK re the BCM/MCM comms.

MarkLamond.co.uk - Homepage

I'm hoping I can persuade him to assist ;)

If he agrees I'll perhaps trundle up to see him in due course.

Jim and I are also touting for help on the PGFI forum. Fingers crossed

Peter
 

·
Administrator
Joined
·
11,011 Posts
Discussion Starter #12 (Edited)
I added an access point for the BCM BATTSCI1 & 2 & logic ground signals today, to have a look at the data.

I managed to snatch one pic of the data which seems very slow and repeats regulary about once a second. Looked like a couple of bytes at most.

SOC was 19 bars and signal starts as soon as ign turns on.

I could not get my recording scope to work today :( so could only snap the begining of the transmission on BATTSCI1 and logic ground.

Must get one of those analysers.

www.solarvan.co.uk/insight/BCMSignal.jpg

Doesn't look that hard to fake :) If I can work out baud rate etc.

Might be able to do it ultra cruedly if I can get a picture of the entire transmission by just switching a pic output pin high/low with some pauses in between! Check/adjust pic output on scope until it looks the same!!

LOL
 

·
Administrator
Joined
·
11,011 Posts
Discussion Starter #13
I've ordered one of those usb plug in logic analysers should be with me in a about 7 days.

Thanks to one IC member who sent be a donation towards it.

The total cost was about £100 UK.

I can't wait to get hold of it and get it plugged in.

I feel the faking signals pic project comming on as well now!!!

I'll look at the BCM MetSCI1 & 2 signals as well in due course, I havent even looked at where they go on the wiring diagram yet, perhaps to the Instrument cluster.

So might be able to con the SOC gauge as well later
 

·
Administrator
Joined
·
11,011 Posts

·
Registered
Joined
·
821 Posts
BCM chip photographs

Looking at the digital camera shots of the PCBs, the jelly bean chips are marked 9942 etc.

This means they (the chips) were manufactured year 1999 week 42.

This is likely to have been one of the earliest modules consructed for our cars.

E27006
 

·
Registered
Joined
·
5 Posts
Hi ...

I'm a new insight owner (2000 MT) in Nova Scotia. I'm also an electrical engineer with similar thoughts regarding taking control of the IMA at this level.

Just a thought, but a very simple tool to look at the data on the serial bus is to use the laptop serial port. You might need a USB to serial device on a newer laptop which probably won't have RS-232. These standards are fairly forgiving of voltage levels and because the laptop is not grounded, it may not matter if the source is unbalanced RS-232 or balanced RS-422/485. (Although I'd be suprised if it wasn't 422 or 485).

Just a thought ...
 

·
Administrator
Joined
·
11,011 Posts
Discussion Starter #18 (Edited)
Tim welcome on board. Yes I suspect serial of some sort, but need to analyse it and then see about faking it. Jump in and assist by all means. I suspect RS485 half duplex and I have been browsing extensive info on internet about this protocol.

An example RS485 transmission is below.

 

·
Administrator
Joined
·
11,011 Posts
Discussion Starter #19 (Edited)

·
Administrator
Joined
·
11,011 Posts
Discussion Starter #20
Working out the baud rate etc

Well I plumbed in the little RS485 transceiver into the BatSCI1 & BATSCI2 and logic grounds today and captured some BCM <> MCM comms data onto my laptop.

Problem is not knowing the baud rate/structure means it could all be garbage at the moment.

I tried various settings for the recieving software which was the demo version of

Data Logger. Advanced Serial Data Logger software - serial and RS232 port data collection and acquisition software | AGG Software

There was a fair bit of chat going on.

But I need to look at one packet/byte on my scope to see the structure and then set serial software accordingly.

Very neat little rs485/usb comms gadget should allow me to use my laptop to send test fake data to the mcm fairly easily.

www.solarvan.co.uk/insight/rs485gadget.jpg
 
1 - 20 of 134 Posts
Top