RomRaider

HOW TO: Unbrick and/or Hard Reflash Nissan ECU (Step-by-Step Instructions Made Simple)

First off, many thanks goes to fenugrec and Shuher for all their help, also Sasha for helping trace my TP’s and figuring out that we could in fact use the SHBootmode technique.

Preliminary Note: you have to open up your ECU and solder connections to the printed circuit board in order to utilize this method. It is not difficult as long as you are very careful and have a reasonable amount of experience with a soldering iron. If not, you could very well permanently damage your ECU. Before doing anything, I highly advise you dump a copy of your ROM (and make sure it isn’t corrupt) by utilizing fenugrec’s nisprog software which can give you a copy of your ROM using an OBD2 to USB “dumb” cable. When you connect your ECU to the Renesas FDT Software (Step 4) it automatically erases your ROM.

Step One: Access Hardware
Remove ECU from vehicle, remove ECU’s cover screws and use a utility knife to remove the top cover. Cut through the adhesive sealant (location shown in red below) while at the same time carefully prying open the case with a flathead screwdriver or similar tool, the ECU has sealant all the way around the perimeter of the case. Be very careful not to damage the PCB during this process. Slow and steady wins the race. Some people also apply heat with a heat gun to make it easier to separate the sealant, I have heard mixed reviews on this approach. Remove the lower cover the same way, note that there is adhesive sealant in the center of the PCB that can also be carved out with your utility knife.



Step 2: Solder Connections to PCB
Turn the ECU over and locate these test ports (note: many PCB’s do not have the TP’s labelled but TP use should be the same. To verify you have the right TP’s you can measure voltages, frequency, and check continuity with a multi-meter between the TP and the corresponding MCU pin; the MCU pinout can be found in the MCU’s datasheet. Examples: you can measure 5V between TP84 and TP80 or TP81 (both are ground) or measure continuity between MD1 TP and MCU pin 55. When measuring MCU pins, find the nearest resistor, capacitor, solder joint, TP, etc. to apply your test lead to, do not apply the test lead directly to the MCU pin since you can damage the pin.)



TP82 = 12V+ (Optional Use)
TP83 = 12V+ (Optional Use)
TP80 = Ground
TP81 = Ground
TP84 = 5V+ (Optional Use)
TP(unlabeled) = NA (Do Not Use)

TP42 = PB14 (Do Not Use)
TP35 = SCI1 TX (Serial Communication Interface 1 Transfer)
TP31 = MD1 (One of the MCU Mode Selection Pins)
TP34 = SCI1 RX (Serial Communication Interface 1 Receive)
TP30 = WDT (WatchDog Timer = 250Hz/50% Duty Cycle)
TP43 = nRES (MCU Reset)

Next solder approximately 28-32 gauge wire (solid wire is much easier and better than stranded wire) to the necessary TP’s as shown below. Use hot glue or similar to provide strain relief! I put the wiring in place and glued them to the PCB before soldering. I also used a solder-type DB9 D-SUB connector to make plugging in and unplugging my SHBootmode tool easier and quicker (more on this later).



Step 3: Build SHBootmode Circuit
Next we have to make a circuit which will put the ECU’s Renesas Super-H MCU in Bootmode, keep the WDT satisfied and allow serial communication between the MCU and your computer. This is much easier than it sounds. Here’s an overall schematic of the circuit I ended up building:



Note that the “Toggle Switch w/ LED & Relay” is not necessary but was a personal preference. A simple SPST switch would suffice. This circuit has worked for me many times and is not difficult to build. Since I used a DB9 Female Connector for the ECU connection, the DB9 male connector will be mirrored from the above diagram.

First: solder a 20 ohm resistor from MD1 to Ground on the male connector. (note: this is the part of the circuit that actually enables bootmode on these ECU’s. Much more information can be in Section 4 – Operating Modes of the Renesas SH7058 Hardware Manual.)

Second: solder a 20 ohm resistor to a switch and use it to connect nRES to GND.

USB to TTL Interface (FT232RL Breakout Board):



On the breakout board, solder wires to 5V power, GND, SCI TX, and SCI RX (note that SCI TX and SCI RX will be opposite the MCU connector, i.e. breakout board TXD goes to ECU SCI1_RX and breakout board RXD goes to ECU SCI1_TX). I used a 100 ohm resistor between TXD/SCI1_RX and a 20 ohm resistor between RXD/SCI_TX which has worked well for me and provides some circuit protection for your ECU. (note: Shuher noted that the TX and RX should be the same and that he used 20 ohm resistors for both.)

Third: build the WDT generator circuit, the goal here is to achieve a 250Hz/50% Duty Cycle signal but the supervisor chip allows some leniency in frequency and duty cycle so don’t waste time trying to get it absolutely perfect. I used a 555 timer and produced a 240Hz/50% Duty Cycle signal which always seems to work. Make sure to look up the correct pinout for your 555 timer as they are not all the same. I powered mine via the FTDI breakout board’s 5V power output and ground (make sure you ground the WDT generator the to the DB9 connector GND to ensure a common ground). Depending on what resistors you have (or don’t have) lying around you can add them in series or parallel to get the right ohm reading. Here is what my circuit ended up looking like:



Here is what my SHBootmode tool looks like with all components assembled and put in a case:



Step 4: Software and Reflash
Connect your SHBootmode tool to your PC via USB port and ensure the FTDI driver loads. If it doesn’t you can do this manually through Device Manager on Windows. After the driver installs, go to Device Manager, click on Port (COM & LPT) and see which communication port was assigned to your FTDI device (example: COM1).



Connect your SHBootmode tool to your ECU (after doing this enough times you’ll understand why I used a connector). First close your RES switch, then power up your ECU with an appropriate 12V source. Make sure to apply 12V to the ignition pin as well. After your ECU has power, open your RES switch and your MCU should now be in Bootmode. More information and a detailed sequence of operations can be found here: https://nissanecu.miraheze.org/wiki/Bootmode#Sequence_of_operations. (Also, there is A LOT of really good information on this wiki as well thanks to fenugrec and Shuher. I know fenugrec has spent countless hours for the past few years to come up with the information on this wiki so please give it the respect it deserves!)



Download the Renesas Flash Development Toolkit (Free Software on Renesas Website) and start the Basic version of the application. (Note: when using the Renesas FDT software, as soon as it establishes a connection with your ECU it automatically erases your ROM!!! This is why it is so important to create a backup of your stock ROM before starting the reflash process.) Select Generic BOOT Device, Select the COM port you found in the previous step, After pressing next your MCU’s type should be displayed, Enter 10 MHz Crystal (this is a very common crystal oscillator frequency on these ECU’s but may differ between ECU’s), Select BOOT Mode Connection, Enter your preferences then click finish.

You should end up at a screen that looks like this:



Select User/Data Area and select the ROM file location that you want to reflash to your ECU (SH7055 MCU is 512kb, SH7058 MCU is 1024kb), deselect User Boot Area, and hit Program Flash. If all goes well it will reflash your ECU in about 5 minutes (for a 1MB file) and you should see something like this:

OS: Windows 10 ( Windows 8 ) [Admin]
FCF Settings Applied: HD64F7058, (C:\Users\JohnSmith\AppData\Local\Temp\)
FDT API initialised: version 4, 09, 02, 000
Clock Frequency (External) = 10.0000MHz, Clock Mode = 0, CKM = 4, and CKP = 2
Connecting to device 'HD64F7058' on 'COM1'
Configuration:
'BOOT Mode' connection - using emulated interface
Opening port 'COM1' ...
Loading Comms DLL
Loaded Comms DLL
Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device: 0xE6
Detected generic boot device
Sending inquiry for getting line size
Buffer size has been set to default (128 bytes)
Sending selection of device command
Selection of Device - Device selected, code 0601
Sending selection of clock mode
Sending selection of clock mode
Selection of Clock Mode - Clock selected, code 0
Changing baud rate to 38400 bps
Set baud rate value = 38400
Determining block usage
Connection complete
Processing file :"C:\Users\JohnSmith\Documents\Car\350Z\Bins\Raw Bins\2006_350Z_1CF43D_1.bin"
Loading image file : 'C:\Users\JohnSmith\Documents\Car\350Z\Bins\Raw Bins\2006_350Z_1CF43D_1.bin'
Loading image file : 'C:\Users\JohnSmith\Documents\Car\350Z\Bins\Raw Bins\2006_350Z_1CF43D_1.bin'
Operation on User Flash 0
Loaded the Write operation module
Writing image to device... [0x00000000 - 0x00001C7F]
Writing image to device... [0x00002000 - 0x0000447F]
Writing image to device... [0x00004480 - 0x000044FF]
Writing image to device... [0x00004500 - 0x0000457F]
Writing image to device... [0x00004580 - 0x00004A7F]
Writing image to device... [0x00004A80 - 0x00004B7F]
Writing image to device... [0x00004C00 - 0x0000617F]
Writing image to device... [0x00006180 - 0x0000627F]
Writing image to device... [0x00006300 - 0x0000B17F]
Writing image to device... [0x0000B180 - 0x0000C27F]
Writing image to device... [0x0000C280 - 0x0000CAFF]
Writing image to device... [0x0000CB00 - 0x0007FFFF]
Data programmed at the following positions:
0x00000000 - 0x00001C7F Length : 0x00001C80
0x00002000 - 0x0000447F Length : 0x00002480
0x00004480 - 0x000044FF Length : 0x00000080
0x00004500 - 0x0000457F Length : 0x00000080
0x00004580 - 0x00004A7F Length : 0x00000500
0x00004A80 - 0x00004B7F Length : 0x00000100
0x00004C00 - 0x0000617F Length : 0x00001580
0x00006180 - 0x0000627F Length : 0x00000100
0x00006300 - 0x0000B17F Length : 0x00004E80
0x0000B180 - 0x0000C27F Length : 0x00001100
0x0000C280 - 0x0000CAFF Length : 0x00000880
0x0000CB00 - 0x0007FFFF Length : 0x00073500
510.88 K programmed in 149 seconds

Operation on User Flash 1
Loaded the Write operation module
Writing image to device... [0x00080000 - 0x000A79FF]
Writing image to device... [0x000FFF80 - 0x000FFFFF]
Data programmed at the following positions:
0x00080000 - 0x000A79FF Length : 0x00027A00
0x000FFF80 - 0x000FFFFF Length : 0x00000080
158.63 K programmed in 46 seconds
Image written to device

Troubleshooting
As you can imagine I ran into all kinds of issues throughout the process, here are a few I can remember off the top of my head:

-Double and triple check your wiring and hardware connections!
-Systematically go through everything with your multi-meter to ensure everything is connected well and correctly.
-Make sure everything has a common ground connection (ECU-USB to TTL-WDT Circuit-PC via USB)
-Measure your WDT signal (buying even a cheap log analyzer can really help here)
-Make sure nothing is connected to the obd2 k-line, this is directly related to the MCU’s serial(1) TX/RX pins.
-Download the hardware manual/MCU datasheet to help with miscellaneous issues and to get a better understanding of how all this works.
-Download a serial terminal such as Realterm to test communication between PC and MCU
-Check driver settings in Device Manager, lowering the latency timer can help with echo and communication errors.
-Do a lot of reading!

I’m definitely forgetting some but this is a good place to start when running into issues.

Thanks for that nice write-up AK.

Just a minor addition, don't forget to check out some of the wiki pages for more details:

SHBootmode page
ECU hardware versions info (TPs etc)

@mods : could we have a Nissan subforum please : )

Heh... Seems it's time to share my FTDI AUD && EEPROM tool schematics & SW in similar topic Just to put my 2 cents ))) Give me few days to write it up

as a tip, using a heat gun or hair dryer to heat the case a bit softens the sealant before trying to pry it open.

Hah... for me it was kitchen oven set to ~120 C degree

" Some people also apply heat with a heat gun to make it easier to separate the sealant, I have heard mixed reviews on this approach."

I always just used a utility knife to cut through the sealant, I think I have opened 3 or 4 now and this way worked for me pretty quick and easy

swami - have you tried this method of reflashing yet?

i have not tried with the Z ecu yet ( busy with a few other projects at the moment) i will get back to the Z soon hopefully


but i have with countless denso diesel ecu

Heh, it wasn't "few days" as I said above, but anyway http://www.romraider.com/forum/viewtopic.php?f=45&t=13225

I'm at my wits end trying to get this to work. I've got my WDT set up and it appears to be satisfying the MCU as nRES stays high at 5.1V when I release nRES. If I disconnect the WDT, nRES goes low so those two connections seem OK. MD1 is 3.4V if not connected to ground; 0V when connected to ground.

I've also tried reversing RX and TX in case I had them backwards. I get NO response at all if I reverse them, the only response I do get when I try to get RDT to connect is:


I have applied 12V to both the main power supply pins and the ignition (key on) pin. I have tied one of the main ground pins and one of the other smaller ones together back to battery ground. I have hooked all grounds together so they are common.

If I have all my connections correct (I believe I do) for my ECU the TPs were not located conveniently in a common location. My connections are:

HL01 -> PL5 (WDT)
HL02 -> MD1
HL17 -> SCI1_TX (Rx on FT232)
HL18 -> SCI1_RX (Tx on FT232)
TP12 -> nRES (on back side of board)

Received immediate response from device: 0x55

Mean you have direct return path from UartTX to UartRX.
You are to analyze schematics around TX RX circuitry.
May be K-line circuitry is connected to those signals.

I have nothing wired to K-line externally. It may be that these are tied to a transceiver? but surely disconnecting from that transceiver isn't necessary!
https://static.miraheze.org/nissanecuwi ... wiring.png

I agree, very possible. A few things you can check:

- if you have resistors between SCI_* and TX/RX, make sure (measure !) they're no more than 22-33ohms

- with nothing connected, measure resistance between your SCI_RX/TX testpoints. If it's lower than ~2k, you'll need to investigate further

- make sure your powerup sequence is correct, i.e. MD1 always grounded, hold in reset until WDT valid, then release nRES, then proceed

- try the manual test procedure https://nissanecu.miraheze.org/wiki/Boo ... operations with Realterm or similar. If you're getting an instant echo no matter what byte you send, then you have some RX/TX loopback going on that needs further study.

both 20 ohms

over 20k

Yup, MD1 is always grounded. Reset is grounded for a few seconds after applying power to the ECU, then released (goes to 5V) and stays there.

I don't see ANY responses via Realterm. Not sure why Renesas is showing 0x55 (it's either 0x55 or 0x00 when it tries different baud rates)

Kept Realterm open while re-attempting boot mode and noticed I was getting 0x00 responses with no power supplied to the ECU while the WDT is hooked up. As soon as I supply power OR disconnect my WDT circuit the 0x00 responses stop. There's probably some noise being generated?

I have sourced a similar board and correct pinout is as follows

HL18 -> SCI1_TX (Rx on FT232)
HL17 -> SCI1_RX (Tx on FT232)

and not as
HL17 -> SCI1_TX (Rx on FT232)
HL18 -> SCI1_RX (Tx on FT232)

Moreover there is k-line circuitry with R452 as a pullup resistor and Q451 as SCI1_RX driver.
I would recommend to short R453 resistor to temporary disable SCI1_RX kline driver.

PCB is similar and not the same thus component markings may differ.

Thanks again Sasha. You are correct, I did have Rx and Tx reversed. I re-connected in the correct arrangement but nothing shows up at all in Realterm.

So, if I haven't destroyed this thing beyond repair already... I traced Rx and Tx further on the circuit and found Rx goes to R912 (pullup resistor?) to Q904 (SCI1_RX driver?) So would I tie the point circled to ground to disable the kline driver temporarily?