A little more about reverse engineering
Thread Starter
Evolved Member
Joined: Aug 2004
Posts: 528
Likes: 0
From: Canada
A little more about reverse engineering
Although my work is ralliart specific I thought this forum would be more appropriate for the post since it's focused more on ecus. Part of understanding the disassembly is that you have to understand what pins on the ECU go to what circuits and to what ADC on the MCU. This usually involves sacrificing an ECU or two to figure things out.
First I scan and catagorize every component. Some have different part numbers so with a collection of 5-10 ECUs you can usually match the parts as they often use different suppliers and the markings on each component can be quite different.
Next I desolder them all and sand the top and bottom of the board taking a high res scan of the results.
Top under the MCU
Same location on the bottom.
Next comes the tough time consuming part. I etch or sand off this layer and then carefully sand away the thin PCB layer to expose the inside layers. By matching these up in Photoshop I can then flip through all the layers and figure out where all the vias go and the inside layers too.
Ground layer. Ok I sanded it a little too much but it's less important because it's pretty easy to predict which vias will go to ground or power.
These middle layers are where all the action is. As you can see the first is mostly horizontal and the second middle is mostly vertical. So if you've got a trace starting at the injector pin (top right) it goes to the injector driver chip (also top right) then it jumps to an inside layer to go down, hops up a layer, goes across, hits a few resistors on the bottom and then through to the top layer where it hits a pin on one of the processors. YIKES!
So I've got about 40h of time spent tracing how pins are wired and how signals are conditioned. Most are very basic but some have produced some unexpected results. For example the board itself appears to have provisions for a wideband controller (not populated). It also has all the circuits (not populated) for the auto transmission controllers, drivers etc. Very complicated and time consuming.
-Michael
First I scan and catagorize every component. Some have different part numbers so with a collection of 5-10 ECUs you can usually match the parts as they often use different suppliers and the markings on each component can be quite different.
Next I desolder them all and sand the top and bottom of the board taking a high res scan of the results.
Top under the MCU
Same location on the bottom.
Next comes the tough time consuming part. I etch or sand off this layer and then carefully sand away the thin PCB layer to expose the inside layers. By matching these up in Photoshop I can then flip through all the layers and figure out where all the vias go and the inside layers too.
Ground layer. Ok I sanded it a little too much but it's less important because it's pretty easy to predict which vias will go to ground or power.
These middle layers are where all the action is. As you can see the first is mostly horizontal and the second middle is mostly vertical. So if you've got a trace starting at the injector pin (top right) it goes to the injector driver chip (also top right) then it jumps to an inside layer to go down, hops up a layer, goes across, hits a few resistors on the bottom and then through to the top layer where it hits a pin on one of the processors. YIKES!
So I've got about 40h of time spent tracing how pins are wired and how signals are conditioned. Most are very basic but some have produced some unexpected results. For example the board itself appears to have provisions for a wideband controller (not populated). It also has all the circuits (not populated) for the auto transmission controllers, drivers etc. Very complicated and time consuming.
-Michael
