Honda CR-Z Hybrid Car Forums banner
1 - 18 of 100 Posts

· Registered
Joined
·
48 Posts
Hey there Peter this might not be the right spot, but someone contacted me on Facebook asking questions about modifying the firmware for the CRZs we have a member near you that works on the CRZs as well, he wanted me to reach out to you and have a chat if there is a way for us to talk in a more real time type setting.
We do have a bit of the IMA tables defined already in the software
Colorfulness Computer Font Screenshot Technology
 

· Registered
Joined
·
48 Posts
Any chance you might add custom CAN bus features? Something to run an expansion board for the modern K and J series that are fully CAN and have no additional IO available onboard?

Boost controllers, traction control, ethenol content sensors, signal generators for non CAN instrument clusters, are all things that come to mind. I have asked Hondata and Ktuner and neither wanted anything to do with that.

Or maybe the ability to tweak the CAN messages to match an engine swap to a chassis.

I do this for my swaps and Arduino as a go between but it would be so much better if it could be done in the PCM.
Well you can kind of cheat with traction control i believe, and use either VSA to some level if its built into the PCM already.
or simply a 2d or 3d lookup table of speed differences between the ABS sensors(Which the ecu can poll) and sensor from the transmission.
And then apply a ignition retard based on overspeed to control the amount or apply a rolling cut to keep power output down to keep it from spinning.

Boost control/flex fuel there are onboard devices you can use the inputs from, (EGR, PCV, 2nd O2 sensor, etc)
signal generators would probably be a fair bit harder, developing a standalone board that the factory ecu could use would be extremely hard, as we do have quite a bit of free space in most 1mb and 2mb roms, but its the way you have to generate your code for them makes that a lot more difficult, as each calibration id, would have to be modified for it.

Also it really depends on what you want changed in the canbus messages, a lot of them can be modified without a whole lot of effort.
HDS looks up what engine is available based on vinnumber, then calls ReadByIdentifier with the custom packet codes 0x2610-2615 and a couple others
that dumps out a stream (each packet being 57 bytes long) and those are the values that get looked up in HDS. So you can't really change it to say "this is a CRZ with a k24"
But I could be misunderstanding what your end goal there is. So please elaborate on it so I don't feel dumb :)


@ryanthegreat1 thank you for pointing me this direction with @HondaTuningSuite.
I really hope with some of the very smart people we have on this group we can get the mcm programable as well. I will do my best to get these guys what they need hardware wise such as mcm's, harnesses. Cluster. Ecu, ect. But to anyone else reading this. This is epic a company that wants to mess with the ima. Hondata and k tuner have lost my business.
And @PeterPerkins this is what i was sending you info about yesterday.

@HondaTuningSuite the things we discussed will greatly help this group. The members doing the fit cam and intake swap would really need the ge8 fit tune put into the crz ecu with vtec crossover point changed. Stock fit injectors or the accord k series injectors. 06 s2000 360cc? Injectors are direct drop in as well with no harness modifications.

Like ryanthegreat mentioned if possible the ability to run say the oem honda ntk 5 wire wideband with a circuit to control the heater, ability to run the oem honda electronic wastegate , and few other additional can bus or analog inputs_outputs.

Not sure how others on this group would ferl about this but id be ok with a donation to fund this and push it along.
Like i had said in our dms on facebook, using the maps from the Fit are not really a huge deal, changing vtec is also simple.
if you are swapping in the Fit intake/cam then the maf curve you should just have to copy from the Fit rom to the CRZ rom.
The injector scaling as well, Honda factory injector setups are a bit strange, but just copying over the base pulsewidth tables,
the built in speed density tables(Which are extremely small and limited 6x3), and the cranking/wallwetting stuff should be relatively easy to move those injectors over as well.

Not sure if the Fit has IMRC but if it does, thats where the difficulty would come from as i dont believe(but not sure) the CRZ has IMRC.

I want to dig a lot more into what can and can't be done with the CRZ. If honda can update the MCM then i can as well, time is my only limiting factor, but i need to get a full dump from the uC of the MCM. So that will be my first goal. Full dump of the MCM, Do some reverse engineering finding out limits, if there are any tables, etc.
We have done quite a bit of work on the PCM side, so we have a lot of the IMA tables defined and mapped in HTS already, which handles things like The Assist/regen Request

If someone wants to donate a CRZ to the cause i wouldn't say no lol.
Unfortunately HTS doesn't really make the kind of money I wish it did to be able to just go grab a new platform for developing on
We are relatively new to the game, and we are trying to contend with the big hitters, so we have like a 0.00001% market share compared to anyone else.

But i will do what i can with bench setups its pretty much how i have gotten by so far. :)
 

· Registered
Joined
·
48 Posts
I was trying to get a look at the MCM and get the part numbers for the uCs off that if you know what they are already that would be a big help to make the MCMs rewritable since i can see some of them have factory updates from Honda in HDS.
 

· Registered
Joined
·
48 Posts
The main IC in the HCH2 inverter (marked with green line) is marked 64F7047F40V looks like a RENESAS CPU similar to the attached pdf. View attachment 69805 There is a write enable line on the main harness connector so it can probably be reprogrammed via the CANBUS and HDS...
OK I'll look into this in the morning. It looks like the part number for the hch is 1b100-rmx right. Should be easy to pull apart the factory update and extract a partial rom from it. Hopefully from there I can get the whole dump from the mcu.
 

· Registered
Joined
·
48 Posts
More cross checking and seeing what is possible today while I wait to acquire an HCH2 IMA setup.
I'm also cycling an old HCH2 pack I had in storage for the testing.

It looks like the HCH2 IMA setup will plug straight into the CR-Z wiring harness with perhaps only a minor pin swap on the HCH2 connector. (y)


If this does work then in a Nimh car it would be an immediate +50% IMA boost compared with the stock 100V pack in the early cars. ;)
So i found some tables, not all of them, because im missing a lot of context in the disassembly because of the lack of the first 0x10000 bytes, as the factory updates only provide the updatable data and not the rom in its entirety.

i only found about 20ish tables, i feel like there should be well over 100 tables even though its only a 256kb rom. If i had one, i would probably be able to dump the whole rom. Is 0x18dA02f1 the address of the HCH?
 

· Registered
Joined
·
48 Posts
So i found some tables, not all of them, because im missing a lot of context in the disassembly because of the lack of the first 0x10000 bytes, as the factory updates only provide the updatable data and not the rom in its entirety.

i only found about 20ish tables, i feel like there should be well over 100 tables even though its only a 256kb rom. If i had one, i would probably be able to dump the whole rom. Is 0x18dA02f1 the address of the HCH?
Also i did find the security handler, and should be able to modify hts to be able to dump/edit these roms.
So if i can get my hands on a willing participant, should be able to dump and rewrite them easily
 

· Registered
Joined
·
48 Posts
Not quite sure what these tables are, but they are outputs of some sort.
X Axis being RPM, and Y axis is unknown, I haven't seen breakpoints like that, so its definitely something specific to the inverter.

Colorfulness Rectangle Font Parallel Pattern


This one is RPM on the Y axis, Unknown X
Colorfulness Rectangle Font Electronic device Electric blue

No idea what this long table is, maybe something with Regeneration.
Colorfulness Rectangle Font Parallel Pattern


Then there are these 2 this could be Assist while the following could be Regen
Colorfulness Rectangle Font Parallel Pattern


Regen maybe?
Colorfulness Rectangle Font Parallel Slope
 

· Registered
Joined
·
48 Posts
Are you using Ghidra for disassembly or something else?
If you want to share the instructions which read this data, i might be able to help there.

Second one might be max regen with X being the battery temps.
This might help:
View attachment 69835
Temps are usually represented as C with a .1 multiplier, I suppose it could be made granular like that but seems odd.

I use ghidra for reversing the roms, I can share a ghidrazip with you, with the table structures setup but its not a complete rom dump until someone wants to give it a whirl, If you have an Openport 2.0 i can send you app to dump a whole bin with, which would be greatly helpful for some of the context of the rom, since its missing the first 64kb of data.
 

· Registered
Joined
·
48 Posts
Interesting tables but I know nothing about roms. I can see a steep learning curve ahead. :unsure:

I suggest the roms dumps etc and disassembly would be better in a separate dedicated thread or this one will get very confusing.

I don't have an openport 2.
Thats a good idea. I will setup a thread for it, since i want to go as deep as i can into all the available systems, even though i don't have a CRZ, Always wanted one :D
 

· Registered
Joined
·
48 Posts
There are a few potential deal breaking issues putting an HCH2 IMA into a CR-Z.

The CAN messages may be incompatible and un-correctable.

Almost certainly need a CAN message faker of some sort as the HCH2 has an electric air-con compressor driven by a special IMA powered inverter.
If we take that out something is bound to complain about it being awol!
Both of the above issues can be handled via modification of the rom.
I don't have a module to test writing yet, but i have the assumed code taken care of already. However it would require us to make some modifications to the code side of things for it to work.
Changing canmessages comes really easy once you have a data dump, provided we have enough free space in the rom to hook what we want send to a new function that would either overwrite the data that it sends regularly with what we want to send, then add our data to the rom in the specific packets or just constructing our own canbus packets however we see fit :)
But before i can get there, im going to need that ROM and Ram dump :)
 

· Registered
Joined
·
48 Posts
OK I have a cheap scrap HCH2 on my drive now for data gathering.
It's not driveable on the road but the IMA works and it does move under it's own steam (just)
It will be going to the scrapyard in the spring after I have gathered any data we need and taken the IMA out.
Im currently working on the utility to be as foolproof as possible :D
I might not have it finished this evening(its 1am my time) but i will have it to you by tomorrow at the latest.
 

· Registered
Joined
·
48 Posts
There is however one thing i need, I need the address of the inverter module.
it would be an extended 29bit address

something like how

The ECU is 18da10f1
I need whatever the MCM broadcasts on.
After i get that i can finish it up :)
 

· Registered
Joined
·
48 Posts
Maybe really dumb question but what about the hch2 ecm and ipu in the crz and just reflash the ecu to work with the l15a7 fuel and ignition maps. And to work with our clusters. Or flash the hch2 ima bits into the crz ecu.
Im coming into this discussion a little late.
But i like the minds that are getting together.
I don't quite think that's possible. Pretty sure the hch2 mcm and bcm use different processors compared to the crzs but I'm not quite where I need to be with that to figure out if they are different or not.
 
1 - 18 of 100 Posts
Top