Exploring the MX-5 ECU

Due primarily to the interest in supercharging the Mazda MX-5 (in this case the 2006-09 models), there has been a lot of recent activity in reverse-engineering the ECU (Engine Control Unit) that regulates fuel and ignition to the engine.  Most of this work has been done via the CAN bus, treating the ECU as somewhat of a “black box”.  Partially this has been done because in the end that’s the only path accessible to owners, and thus any software products to emerge must use that path.  The other reason is that physically cracking the ECU is potentially risky, and thus expensive.

Through the generosity of Jason Stooks, I have acquired a “dead” ECU, so there’s no risk to pulling this one apart for careful physical inspection.  Jason has carefully avoided any payment for his generosity, even to the extent of refusing to be reimbursed for the shipping cost.  At the very least, I want to acknowledge his contribution to this little project.

Opening the Case

The ECU (the circuit board itself) is held within a shell, made up of a cast aluminum base, and a plastic cover.  The two are held together by four screws, but removing the screws is only the beginning.  The shell pieces are stuck together with some really serious silicone adhesive, and have to be pried apart.  I used a wood chisel to get a corner far enough apart to insert a screwdriver.  From that point I pried like hell, and eventually was able to insert a penny to keep the halves apart.  In doing this, the plastic cover is bending, and in danger of breaking.

Along about this time I discovered that brake cleaner (I use non-chlorinated “Brake Cleaner II”, from Tacoma Screw) weakened the silicone.  That made all the difference.  I kept prying, and spraying, and inserting pennies to avoid losing the ground I’d gained.  Eventually the last of the silicone gave up its battle, and the cover came off.  It was a real fight, though.

Once the plastic top is off,  the only thing keeping the circuit board (and the connectors mounted to it) in place is more silicone.  In this case it’s primarily under the connectors.  Again I kept weakening the silicone with brake cleaner, and prying at the corners of the connectors with a large screwdriver.  Eventually the silicone yielded, and I finally had the “guts” out.

A First Look

I don’t know what I expected.  Perhaps more “analogish” components, due to the large amount of external interfaces — power transistors, inductors, that sort of thing.  But no, it’s very much in line with what you’d expect in your PC, a board chock full of high-density processor-based chips.  Inventory later.  In addition to 14 major integrated circuits (from 8 to 256 pins), there are lots of surface-mount resistors, a small sea of bypass capacitors, two (or perhaps three…) crystals, four power regulators, and lots of miscellaneous other discretes.

There are also five places cast into the aluminum base that reach up to nearly touch the circuit board.  These turn out to be heat sinks, with dabs of thermally conductive compaund to transfer hear from specific chips out to the aluminum.  Interestingly, this particular ECU had one dab of thermal compound missing!  No idea whether this was a potential cause of its failure, or perhaps the factory engineers decided that particular chip didn’t need extra cooling after all.  Or, perhaps both.

Here are pictures of the front and back (click for full resolution, they’re big).

 [add pictures!]

Chip Inventory

On-Chip Markings * Usage
64F7058F80
BK 0610
BB14119
256 pins, Renasas SH7058 (member of the SH-2 family).  This is the main processor, and contains too many features to name; see the hardware manual below for details.
Renasas SH7058 Hardware Manual
Renasas SH7058 Software Manual
IS706
6H02
Tall 8-pin, with open port on top, probably barometric sensor.
TD617A2
M4600
16-pin, used to drive ignition coils (thru 75-ohm resistors).  Output pins (open-collector?) are 2,8,10,13.
S93A56
ADAVF3
0594
8-pin, near processor. Might be Microchip TC1301A-ADAVMF dual LDO with microcontroller reset, but supply pins make it seem unlikely.
TC1301A-ADAVMF Datasheet
3694A82FZ
1518161420
K
AF01758
0624
64-pin
5H12
MV964
20-pin
INFINEON
TLE 6244 X
C2
VE520458
0516
Odd 64-pin. 18-CHANNEL Smart Lowside Switch.  16 Schmidt-trigger inputs, 18 open-drain outputs, plus SPI interface. Designed for auto use. Used for injector driver – outputs from pins 8,45,9,and 44 (Out1-4 go to injectors 1-4). Input1 (pin 7) is driven from 7058 pin 195 (PK0/TO8A)
Infineon TLE6244X Datasheet
MC33186DH
1
KAN0610
Freescale Semiconductor (Motorola) MC33186 Automotive H-bridge Driver, HSOP-20 package
MC33186 Datasheet
5H26
SE555
D
 Denso SE555.  128 pins (38×26)
5H30
SE648
1
D
 Denso SE648. 36 pins, contains CAN interface circuitry.
66100
612E
 8-pin.
5H20
SE585
D
 Denso SE585. 24-pin.
0616H
AC00-H
14-pin TSSOP-14 package, could be MC74AC00 (quad 2-in NAND gate, CMOS)
MC74AC00 Datasheet
 277 3 611 (on back of board) 8-pin. Performs signal conditioning for the crank angle sensor; cam angle sensor input goes very close also, might be a dual chip.
 1251 3 615 (on back of board) 8-pin

* Italics indicates presumed date code, bold indicates presumed chip identifier.

Processor pin usage

Tracing the connections to various processor pins is very time-consuming, but the information can help a lot in the reverse-engineering effort, because it also allows areas of the firmware to be identified.  Below are a few key connections:

Pin Usage
195 (PK0/TO8A) Injector 1 (via Infineon TLE6244X chip pin 7)

,

 

Tagged with:
 

6 Comments

  1. fubar says:

    This is a comment from a guest

  2. The Clown says:

    Clown comment

  3. The Clown says:

    ‘nother reply

  4. The Clown says:

    third comment