[da-coder]

Oh interesting 🤔
Thanks!

 

[Slociviccoupe]

Maybe really dumb question but what about the hch2 ecm and ipu in the crz and just reflash the ecu to work with the l15a7 fuel and ignition maps. And to work with our clusters. Or flash the hch2 ima bits into the crz ecu.
Im coming into this discussion a little late.
But i like the minds that are getting together.

 

[HondaTuningSuite]

Maybe really dumb question but what about the hch2 ecm and ipu in the crz and just reflash the ecu to work with the l15a7 fuel and ignition maps. And to work with our clusters. Or flash the hch2 ima bits into the crz ecu.
Im coming into this discussion a little late.
But i like the minds that are getting together.

I don't quite think that's possible. Pretty sure the hch2 mcm and bcm use different processors compared to the crzs but I'm not quite where I need to be with that to figure out if they are different or not.

 

[PeterPerkins]

Looking at the HCH2 setup we don't currently have an easy/any way to do voltage fooling for more power.

In the G1,G2 Insight, Nimh CR-Z and HCH1 you can fool the system voltages so the car thinks it is lower than actual and thence you get more power/current.
In the G1,G2 Insight and HCH1 and Nimh CR-Z things are more modular and the inverter is a dumb slave so intercepting the necessary signals is doable.

In the HCH2 the inverter contains the integrated MCM motor control module, you have no easy way to access inverter voltage data and modify it before the MCM sees it.

So we need to find a way to reduce the voltage the inverter detects.

1) This could be by reverse engineering the analog HV detection circuit to turn down it's sensitivity. (I will look at this on the bench)
Change resistors etc.

2) Intercept digital signals on the inverter pcb board and modify them.

Now if we look at the backlit HCH2 inverter PCB we can see as expected it is in several distinct isolated sections.

The top section is the MCM (motor control module with phase sensors attached)

The middle section is the IGBT connections interface.

The bottom right section is isolated power switching via the central transformer into the IGBT's and the bottom left section.

Now the bottom left section is likely to be voltage and other data detection and this information is transmitted to the MCM (top section) probably using a simple serial signal via the two opto isolators circled in blue. There is only one way comms so I suspect this section simply spits out voltage info etc for the MCM.

Now we could analyse that serial data and then insert a little modifying (PIC) gadget across the isolated interface and simply modify the voltage data.
That's what I did with both the HCH1 and CR-Z earlier tuning projects.

Anyway that's todays task analyse that interface and apply some varying voltages to the inverter and see what is being sent across that bridge.

 

[PeterPerkins]

Looks like it is 50,000 9,E,1 data stream 16 byte repeating packet via that top opto but my adjustable 0-300V psu is busted at the moment (awaiting parts).
So will have to wait before I can throw a lot of variable voltages at it and gather data for analysis.

The bottom opto doesn't seem to do anything and does not have a pull up resistor fitted on the pcb so a bit weird.

 

[PeterPerkins]

My variable HV supply is FUBAR so off to the skip. Ordered another but will be a few weeks delivery...

So messing with this HCH2 inverter on the bench I'm cooking up an OBDIIC&C based gadget to watch the CAN output and the serial data flowing internally.

I have tried adding some resistors to the internal voltage sensing and I can pull the voltage it sees down
Also manipulating that internal serial voltage data should be doable.

The Inverter is outputting IPU voltage and temperature on the IMA can bus.

$111 (7 bytes) Bytes 2,3 are the IPU voltage
$19C (8 bytes) Bytes 0,1 are the IPU temperature in C

 

[PeterPerkins]

More HCH2 Inverter tinkering.

(It looks like voltage hacking is doable on the HCH2 inverter so that might enable us to push the battery voltage to 250V or so later.)

 

[PeterPerkins]

Got my little voltage modifying HCH2 Inverter serial data interceptor in and working.

This intercepts the voltage data from the dumb side of the inverter and passes it through to the MCM (Motor control module) side.
With this we can modify (reduce) the voltage the MCM side sees by whatever percentage we want.

So say actual pack is 250V we can reduce that by 50V ~20% easily.

We can also fool the HCH2 BCM (Battery control module by the same percentage using the simple resistor divider method)

The serial data is 16 bytes 50,000 9,E,1 (Even parity) 11 bits total.
There is a checksum at the end as well which we can calculate on the fly.

 

[PeterPerkins]

Well I took another look at the HCH2 BCM pcb and it also has an isolated dumb HV section which measures the 11 battery tap voltages.
This is sent via 25 bytes of serial data 31250,9,O,1 via and opto to the battery monitoring chip. Blue zone.

So we could use exactly the same technique as in the inverter and intercept the data and modify/reduce it as we want.

So with the HCH2 BCM we have the external voltage divider option or the internal serial data interception or do both for maximum flexibility.

So I will make up another little board to send modified data and install it inside the BCM.

We might be able to do quite a few nefarious things with a voltage divider and/or serial interceptor.

Resistor Voltage Divider.

Fake perfectly balanced tap voltages.
Reduce battery pack voltage sensed with a pre-resistor.

Serial Data Interceptor.

Fake perfectly balanced tap voltages.
Reduce battery pack voltage sensed by a set %.
Extend the life and performance of an older OEM pack by reducing it's sensitivity to minor voltage variations.

We will have to be careful as it looks like some voltage data is also passing between the HV/LV sections elsewhere on the board.
It may just be a simple voltage present check or part of the HV leak detection we shall see. Red Zone.

 

[PeterPerkins]

So I modified yet another one of my OBDIIC&C devices to receive the internal BCM serial tap voltage data stream from the LV side of the isolation OPTO.

This could be the basis of a handy gadget for HCH2 owners with standard cars wanting to find out which sticks are bad etc.

It's basically 25 bytes 31250,9,O,1 format. Weird baud rate but that's what the shortest bits says.
We have a two byte rotating header $80,$52 or $C0,$52 and then 22 bytes of voltage data and a final checksum.

In this example packet below the header is $80,$52. The checksum is $43.
The two bytes that make up each tap voltage have the high byte and the bottom nibble of the low byte combined to form 12bits of data.

If we take (Voltage Tap 1) VHB0 the first part high byte $5E and low byte $05 low nibble $5 we get $5E5 = DEC 1509 = 15.09V
This is the voltage between VHB1 (negative) and VHB0 (positive)
VHB0 is the positive high end of the pack. VHB12 is the negative low end of the pack.

POS ------ VHB0 --- VHB1 ---- VHB2 --- VHB3 --- VHB4 --- VHB5 -- VHB6 & 7 -- VHB8 --- VHB9 --- VHB10 -- VHB11 - NEGATIVE VHB12
$80,$52,-- ($5E,$05),($5E,$0D),($5E,$06),($5E,$0E),($5E,$03),($5E,$0D),($5E,$05),($5E,$0D),($5E,$05),($5E,$0E),($5E,$06),$43

Note VHB6 and VHB7 are directly connected internally via the battery main switch when it is on.
So in effect they are the same connection but provide continuity for voltage sensing on the taps either side of the switch when it is off.

The operating sensing range of each voltage tap is about 0.5V to 20.15V
Resolution is to two decimal places with accuracy of about +/-10mv or so.

There is a full 25byte serial data packet sent every 15ms.
That is about a 66hz refresh rate if you wanted maximum speed for logging/processing the tap data etc.

In the video I also show the 11 x 10k 0.1% tolerance resistor matrix divider (BCM Fooler) for simulating perfectly balanced battery taps.

With a pre-resistor (inserted where the screw terminal jumper wire is) the voltage the BCM sees can be turned down to whatever we like...
i.e A 250V Battery can become 200V as far as the BCM is concerned.

Now to build and install the little serial fooling gadget into the BCM itself.

 

[PeterPerkins]

Testing the BCM 'Gadget' on a live HCH2 battery pack..

Oh dear! Bit of a basket case with a nearly 1.9V deviation between the taps!!

Need to do some more testing and cycling of my spare HCH2 packs to find the best one.

 

[PeterPerkins]

Video showing the TAP monitor more sorted and plugged into an Insight G1 pack using a simple wiring adapter.
It would be trivial to make an HCH1 adapter as well but I don't have need for one at the moment.
I will make a harness adapter for the Insight G2 and CR-Z Nimh cars as they use a 7 tap system and it would be handy to have for bench work. .

Need to tweak the software now to make the number of taps being monitored selectable.

I also recompiled the firmware for the cheap early PIC16F886 chip which I had loads of kicking around.
If you remember 15 years or so ago this was the first PIC I used in the OBDIIC&C gauge.
No point using a CAN enabled expensive 32mhz part for this simple job.

 

[PeterPerkins]

Interestingly the Nimh CR-Z MCM/BCM module has exactly the same sort of HV detection and opto isolated serial interface!
So you could power up a module like the one in the pic and read/display the voltages in the same way as I'm doing with the HCH2 BCM.

I don't have a spare voltage tap input socket so I would have to canabilise a dead MCM to get one and
hack off the bit in green to make an adapter. Not a lot of point in ruining a good MCM.

I might as well just reverse engineer the serial data in this module and add a 3.5mm jack socket so I can plug into it with the HCH2 gizmo!!
That's tomorrow mornings project then!!

Unless anyone has a dead/spare Nimh MCM and they want to send me the PCB out of it to support this research.

 

[Slociviccoupe]

Coming in late again. So does this look like we can actually use the hch2 igbt and possibly mcm/bcm in the lithium crz to be able to put in a big high viltage pack? Im itching to be able to put in my spare 72 or 84 cell lto pack in my 13 crz and turn it up.