More nerd hour bits have arrived. Thanks to friends in Germany who've sent me a V12 coil pack to test a theory that they can be repaired. Mercedes-Benz charge £1600 for one and you need two, which makes it a very expensive piece that breaks due to cheap components.

What usually fails are capacitors and MOSFETs due to poor choice of components used and the high heat kicked out from the M275 5.5 twin-turbo engine.

This is exciting

Wife's out and I've got a few hours, so what better to tear this open and have a look.

Made by Temic, the M275 engine has two of these. V12 with two spark plugs per valve, hence 24 coils.

She uses NGK Iridium IX as they are just amazing, so having a good coil pack is vital

First up, Mercedes-Benz have been utter scheisses. They made a serviceable part unserviceable. If one of the coils go, you have to replace the whole lot. Like I said above, it's £1600 for one side.

Getting inside one is possible without breaking the cover.

the plastic clips are brittle due to the heat and they've sealed the unit. Now some might say for weather-proofing but this is not something that would have moisture issues and the cover, with properly designed channels and clips, would solve this (like the throttle body does)

this pisses me off a lot about modern car manufacturers in that they go out of their way to cripple elements of the car so you can't easily repair them.

I get it's capitalism but that doesn't make it right

It's made up of two PCBs joined together with a ribbon and then a custom Microchip made for Temic

So guess the game here as they don't have datasheets.

I've spent a while already looking into this and based off the crystal and tracing each pin, I *think* it's a PIC18F458 or a PIC16 (CAN is vital here so yeah this is where I'm thinking)

Only real way to play next is to hook up the scope and look for UART on each pin

In 1998 Atmel acquired Temic, and then in 2016 Microchip acquired Atmel.

To show how far they've gone to make this 100% not serviceable, besides the clip and cover design, it's glueing shut the housing for the 16-pin ignition module wire. This means you can't easily remove the PCBs

Finally desoldering the 16-pin connector, which wasn't easy and I had to clip some of the pins, I have better access to the brains

Cleaned off a load of components and the main board has:

LM2901 - Quad differential comparator
ST 512AI - Dual Operational amplifiers
TI - Quad High Slew Rate JFET-Input Operational amplifier
TI - Quadruple 2-Input Positive-NOR Gates

Plus the custom Microchip IC

The IC has a few things which may make this very hard, namely:

Programmable code protection

Saturday nights are wild, episode 3: reversing a PCB.

I appreciate this thread means zilch to most, but it helps me learn, so apologies.

12V current comes in from the battery into the voltage transformer. This ensures 12V --> 23V -> 180V. This then is pushed to the coil packs

Tracing the traces you see that power coming into a ST 512AI, which amplifies the voltage and then pushes it to a LM2901.

LM2901, which is a quad differential comparator. Basically I understand this as a component that compares 4 incoming voltages and outputs 1 based on the diff

Eventually these traces head over to a 1600V film capacitor and that goes into a Insulated Gate Bipolar Transistor (IGBT) which makes sense as this is a high-performance part which pushes the current down to the plugs.

Looking at all of this, it looks like they suffer from usual older electronic issues such as dry solder, component fatigue and so on. All usually fixable but only if you can get to them, which in this case you can't.

As much as I despise how Mercedes-Benz have designed this key component, I do respect them for how they ensure information is shared.

It’s a car but here we have a lesson in atoms

Just like some of us diff patches and binaries to see changes, the same can be done with high-performance cars.

This engine has been around for a while, so looking at changes by Daimler, I can see a better approach. Individual coil packs and they’ve removed the voltage trans

The pulse now comes from the ECU, so this would mean dumping the newer ECUs firmware and some interesting modding.

Sadly a firm that had done some amazing r&d into this, Speedriven, closed. They’d made a plug and play unit and I’ve heard nothing since.

Sunday morning research: depicting potential major changes to revisions of parts.

Thankfully the previous owner of my V12 spent £7000 replacing coil packs and voltage transformer (swiss bankers, gotta love them)

So the voltage transformer fails with the MOSFETs dying due to the heat. It seems the replacement version makes use of BUZ102SL-4 MOSFETs, which are about 8 quid. Oh and it looks like they also used Beryl caps too

This is a £600 quid part to replace

Looking at all the other areas where this rather sensitive and complex system can fail, you start to see why it's a pretty poor design.

Coming out of the coil pack are the connectors that go into the spark plugs. There are a few things here that would cause a misfire

1: the ground connector that connects to the alloy body gets corroded. Poor ground, poor spark and we have misfire.

2: the solders themselves get fatigued due to heat and age.

3: corrosion in the tube itself causes a poor connection with the spark plug

It's sad that the default approach so many take when they find out the car has a misfire is to replace stuff, often at great expense or they just scrap the car, which is a waste.

The more I tear these down, the more I realise most faults stem from poor component choice,

placement in the engine (this M275 gets very warm) and also a lack of knowledge of how older electronics age.

I think this problem will only get worse with modern cars. Take the Tesla, this is not a car you will be restoring in a decade, the components will be the killer

The other issue many owners face is that if you do open up the cover, it will crack. Some just use ducktape here to remedy this. I wonder if 3D printing a case using ABS to withstand the heat might be an alternative here?

Next up, let's look inside the voltage transformer. They serve to ensure that two different voltages are generated by the on-board electrical system:

180 V for the generation of the ignition voltage.
23 V for the generation of an auxiliary voltage (test voltage).

What fails here are the capacitors and the diodes (again). This is due to high charge requirements and heat. Replacing them isn't expensive. What is a pain is getting rid of the silicon the board is covered in.

The more I ponder how I might play with the Microchip, the more I look towards those with much more skills. @colinoflynn is one of them and he pointed me to a paper by @Riscure on attacking automotive ECUs

https://www.riscure.com/uploads/2017/08/Riscure_Whitepaper_Safety_is_not_Security_Automotive.pdf

Colin also has a great series on attacking ECUs, where you learn a lot, so thanks Sir

Now in that video series, Colin did something I think is amazing: he used Photoshop and the layer mask to overlay the pinouts of the BGA. GENIUS!

So here's the mystery Microchip. The datasheet has all four corners with angles, whereas mine only has one. Still...

But with the magic mask and invert and pasting new layers....

Colin you are a sexy man!!

This now makes it slightly easier to reverse engineer the board. Next plan of action this evening will be:

1. Test pin #39 and #38 (CANRX and CANTX) using a multimeter to check for resistance elsewhere on the board
2: It uses SPI for lower comms, so trace these