ECU Reverse Engineering Step 1 - Another ECU


As I mentioned in the previous post, I had been sent the 1995 ECU BPL9-18-881B by an online seller, so I ended up buying an ECU from a 1999 NB Miata with the model number BP5R-18-881. This ECU came in today, so I quickly opened it up to take some pictures and find datasheets.

Similar to the BPL9 ECU, this one also has a metallic case (Figure 1) which I opened to reveal the back (Figure 4) and the front (Figure 2 and Figure 3) to show the details.

Figure 1. ECU cover
Figure 1. The ECU is enclosed in a secure aluminum box

Figure 2. ECU board front
Figure 2. This is the top (front) view of the ECU board

Figure 3. ECU board front closeup
Figure 3. This is the top (front) view of the ECU board shown so we can see the board number

Figure 4. ECU board back
Figure 4. This is the bottom (back) view of the ECU board

The CPU and the EEPROM chips were coated in a compound that made it difficult to take pictures directly, but I held them close to the light and was able to do so as you can see in Figure 5 and Figure 6.

Figure 5. ECU CPU
Figure 5. This chip is the CPU of the board

Figure 6. ECU EEPROM
Figure 6. This chip points to the EEPROM on the board (IC600)

As you may see that the CPU is a semi-custom chip with the numbers D151806-5740 or SC431421VFM185 or SSAU9945A and has 160 pins. From forums listed in the previous post, it is guessed that this is a Motorola/Freescale M68H16 variant, and the 160-pins match the model MC68HC16Y1TS(mirror). The EEPROM chip (IC600 on the board) has the numbers 29F200BA-90-V GT, is made by Fujitsu, and has 44 pins. This also matches with the MBA29F200BA chip which is a 2 Mbit chip with 44 pins and rectangular package shape.

I found a couple of different datasheets for this model: DSA00442610, FJSUS04981-1. I should be able to dump the contents of the chip based on these two datasheets.

Figure 7 shows a 44-pin chip marked IC400 which has the number 11U19 MG8461 and its purpose is unknown to me at this moment.

Figure 7. ECU IC400
Figure 7. IC400 on the board

With this information, now the next steps are to verify that the chips match the data sheets. Stay tuned for the upcoming posts.