Anyway, after determining that a moderate amount of brute force wasn't the answer, some additional fiddling showed that the four feet can be prised out to reveal four screws. These allow the box to be disassembled and the battery clip and baseplate removed. Removing two more screws freed up the PCB.
What I found was a basic unit that I assume comes from the original type of controller, with a really simple PWM circuit based on a 555 timer circuit grafted on with some fairly crude rework. That seems to explain a couple of things that had puzzled me - the fact that PWM output doesn't quite go down to 0% (there is always a faint buzz), and that the autostop/autoreverse feature doesn't include acceleration and deceleration.
There is also no voltage regulator on the external power supply circuit, so if you use this feature then make sure that you use a proper regulated 5V DC plugpack.


