Electronic Archeology

Electronic Archeology

I acquired a dead ECU (part number 5200030211, serial number 10J23E0044) from an Explorer for reverse engineering.  It would not communicate via the diagnostic port.  The ECU was very dirty, so it obviously had been working.  The following information comes mostly from notes and is therefore a bit unpolished.

Measurements showed that it drew a quiescent current of ~25 mA (about the same as a functional ECU) and the 5-volt reference was present.

After connecting it to my tester, I learned that at kickstarting speeds it produced the same injector pulse width (~5 ms) as a functional ECU.

The injector pulse width varied with changes in TPS and RPM.  It ran up to about 88 Hz (5280 RPM).  However, it would not run the fuel pump as the switched 12-volt output was inoperable.  This would have made it impossible to run an engine and obviously why it was replaced.

I then tried jumpering the switched 12-volt output directly to the +12V input.  This permitted the fan to operate when appropriate at elevated engine temperatures.  These were all good signs in terms of most of the ECU still being functional.

Curiously, it also responds to the dual map switch.  The OSSA map selector switch is a standard “kill” switch repurposed.  As such, the small button provides the run function and the switch is open (this is Map 1).  Depressing the big button provides the kill function and the switch is closed (this is Map 2).  However, grounding made the injector pulse widths shorter (leaner) which the opposite response I was expecting.  (Very strange as this ECU turned out not to have a dual map installed.)

Digging deeper into why it could communicate via the diagnostic port revealed that the ECU's TXD (transmit) pin measured about the same resistance values (about 14k ohms to +5V, about 11k ohms to ground) as a good ECU.  However, the RXD (receive) pin measured about 1.7k ohms to +5V, and about 50 ohms to ground.  Basically, even though the bad ECU could talk, it could not listen.

This indicated there was a hardware problem and I was willing to sacrifice the ECU to electronic archeology by “depotting” it. The depotting process is thoroughly unpleasant.  I have performed it on a variety of 2-stroke ignitions ranging from a very basic 1970s TZ250 to two versions of 1980s analog RZ350s to a “modern”1990s digital TZ250.  With each decade, huge advances were made in technology and performance.  I was eager to see what the 2010s would bring, and was not disappointed.

I began the depotting process by using a vertical milling machine to cut around the perimeter of the flat “bottom” plastic enclosure.  I then used a wood chisel to pry up the bottom sheet.  Before I realized what was happening, several diodes' plastic encapsulation came off with the outer plastic and potting compound!

You can see what I mean in this photo that I annotated with connector pin numbers.  There are about 8 small copper-colored areas visible.  These were all diodes that have been decapitated (and destroyed).

Depotting

Clearly, I should not have been so rough right off the bat.  However, I did not expect that the bottom of the PCB would have components.  Furthermore, I did not expect the high level of complexity overall.  Decided I needed to be much gentler.  My typical method of removing potting compound is with acetone and a carbide-tip scribe for the bulk removal.  Later, soft wood like a toothpick and/or Popsicle stick replaces the carbide-tipped scribe for the finer work.  

Acetone only softens the potting compound.  You must work with the potting compound while the chemical was recently applied (minutes versus hours).  I use a horsehair acid/flux brush to apply the chemicals from a small glass container.

March 18, 2021 tried MEK (methyl ethyl ketone) which seems quite potent!  But, simply mechanically removing the potting compound can easily lift the chip ceramic SMT caps.  Have to be really careful.  Have soldered two back down.  Submerged an electrolytic cap in MEK.  Within 10 minutes, the outer wrapper was destroyed.  Conversely, an IC was left for an hour with no damage apparent.

I only use MEK outdoors.  Acetone I will use indoors.  I did not keep track of my time, but I probably spent in the neighborhood of 40 hour depotting.  Some of that time was reverse-engineering, as depotting is terribly boring.

Read that MG Chemicals makes a Conformal Coating Stripper in a 55ml bottle (P/N 8310-55ML) is available from Mouser for $12.51, but did not try it.

Potting compound has excellent adhesion.  Briefly used a floor-standing belt sander to thin the plastic shell.   Worried about ESD as it seems very much like a Van de Graff generator, but I've never seen a spark. 

“Caucasians are just too damn tall.”

That's what kept popping into my head as I depotted the OSSA ECU.  The line comes from the 1990 movie Crazy People.  Unfortunately, playback on other websites is not allowed for that video.  Here's a direct link to the 32-second clip: 

https://www.youtube.com/watch?v=96iJsdGkl44

The Japanese are probably a generation ahead of the US in terms of consumer-level electronics miniaturization and this, being from 2011, is a generation ahead of the last surface-mount stuff I engineered.  So two generations of shrinkage make for a very challenging reverse-engineering job.

Nomenclature

The PCB is measures ~60mm x ~80mm.  Traces are typically 0.2mm wide.  The majority of the resistors and capacitors have an 0603 footprint.

The part identifiers are not necessarily sequential.  However, they are somewhat related by connection. For example, a resistor that connects to a transistor may be labeled R101 & F101.

The great news is that “related” components have similar identifiers.  The input side will have the lowest numbers, increasing as the signal moves to the output side.  This aids in reverse engineering.

Transistors are not market with the typical Q.  I would guess the F means FET.  Whereas a signal transistor would begin with a T.  There are no inductors on the PCB.  “L” indicates a copper pad, probably used as a factory test point.

I imagine Kokusan Denki anticipated selling this ECU into a broad market.  It has both CAN-bus and K-Line (an old standard that's part of OBD-II) communications hardware on the PCB, but they went unused in the OSSA.  The hardware signals are brought out to unused pins at the main connector.  Have not yet tried to determine if the microcontroller can do anything with them in the OSSA implementation.

Still, a ways to go to clean the remaining potting off so I can really see what's going on.  The top side is just as crowded but has some taller components.  Learning tons, but a long way to go for a full understanding.  

March 23, 2021 after depotting, the TX and RX pins exhibit satisfactory resistance values.

March 28, 2021 done depotting and removing components.  Still need to clean PCB to see silkscreen markings completely.  Need to repopulate components that were inadvertently depopulated.

March 30, 2021 powered-up by replacing 4 SMD Schottky diodes with a single 1N5819 & installing a single 1000 uF cap at C001

Shockingly, everything works except there's no RPM signal and the Baro is inoperative and defaulted to 101 kPa.

Was drawing more current than a functional ECU, 56 mA @ 8 volts DC input, increasing current consumption with increasing voltage.

By removing the blown chip, current consumption was reduced to 58 mA @ 14 V input

This all reminded me of Muntzing.  See: https://en.wikipedia.org/wiki/Muntzing

Blown chip: half connected to R611 caused the problem.  The bad news, it's a multi-layer PCB with traces evident on an inner layer under the blown chip.

It's Alive!

March 31, 2021 managed to make the dead ECU somewhat functional again.  Am extremely happy because now I can make a lot more progress.

Was able to communicate via K-Scan.  The ECU appears to have been from an original 2011 280.  The “Data Version” reported is 20110308 and does not mention a displacement.  Well, they only had that one engine back in 2011.

All the sensor inputs work except for the Baro and the erratic RPM input. Pretty sure I caused the RPM input to fail while depotting.  Prior to depotting. the injector clicked and changed tone based on RPM.  RPM input is not reliable, and it needs a higher amplitude than a functional ECU (say 4.5V p-p versus 1.5V p-p).

I'm kinda shocked as much works as it does - at least a dozen components came off the board due to my rough depotting, but some also due to insufficient solder from the factory (kinda disappointing for a Japanese product).  I'll need to order a few parts.

The bad news is that I removed that fried chip and discovered the PCB is multi-layer (meaning there are traces in the middle of the board not visible from the outside).  This makes it much harder to figure out what connects to what.  But since the ECU is mostly functional, I can learn a lot by probing while it's running.