HOW TO: Unbrick and/or Hard Reflash Nissan ECU(Step-by-Step)

a33b · **Joined:** Sat Jun 24, 2017 6:23 pm **Posts:** 315

Finally made some progress here after months of just not trying. Putting a larger ground from my RS232 GND direct to the battery made all the difference. I'd tried this before but with tiny gauge wire that apparently wasn't adequate. Now the process goes OK for a little while until I end up with a checksum error, or sometimes a read timeout. I think the furthest it's made it is 11%. Same results with a couple of RS232 devices.

Code:

FCF Settings Applied: SH/7055F, (C:\Program Files (x86)\Renesas\FDT4.09\kernels\ProtB\7055\Renesas\1_0_00\)
Clock Frequency (External) = 10.0000MHz, Clock Mode = 0, CKM = 4, and CKP = 2
Connecting to device 'SH/7055F' on 'COM8'
Configuration:
'BOOT Mode' connection - using emulated interface
Opening port 'COM8' ...
Loading Comms DLL
Loaded Comms DLL
Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device: 0xAA
Using micro-Kernel : 'C:\Program Files (x86)\Renesas\FDT4.09\kernels\ProtB\7055\Renesas\1_0_00\uGen7055r.cde'
Downloading and verifying micro kernel...
Device is erasing...
Erase Timeout value set to 21 seconds
Erase Successful
micro-Kernel download successful
Sending inquiry for getting line size
Buffer size has been set to default (128 bytes)
Sending selection of device command
Selection of Device - Device selected, code 0405
Sending selection of clock mode
Sending selection of clock mode
Selection of Clock Mode - Clock selected, code 0
Changing baud rate to 38400 bps
Set baud rate value = 38400
Downloading main kernel 'C:\Program Files (x86)\Renesas\FDT4.09\kernels\ProtB\7055\Renesas\1_0_00\Genm7055.cde'
Main kernel download complete...
Connection complete
Processing file :"C:\NISTUN\nisprog_1_02\6Y303nn.bin"
Loading image file : 'C:\NISTUN\nisprog_1_02\6Y303nn.bin'
Operation on User Flash
Downloaded the operation module
Writing image to device... [0x00000000 - 0x000021FF]
Writing image to device... [0x00002200 - 0x0000227F]
Writing image to device... [0x00002280 - 0x0000237F]
Writing image to device... [0x00002380 - 0x00006B7F]
Error No 16170: Kernel Error Response: 0xd0 0x11 Checksum Error
Operation failed

fenugrec · **Joined:** Thu Jan 09, 2014 3:07 am **Posts:** 652

a33b wrote:

a checksum error, or sometimes a read timeout.

Did you make absolutely 100% sure the nRES line stays high the entire time ?

Is it a mule ECU that has been reflashed hundreds of times already ?

Sasha_A80 · **Posted:** Mon Nov 11, 2019 5:19 pm

Set baud rate 19200 or 9600 to overcome data transmission errors.
Ecu hardware may be not applicable for 38400 57600 115200 raud rate of FDT list.

Check whether your USB uart dongle provides 5 V Tx output level.
Many chips are sending just 3.3 V that may be not applicable for ECU schematics.

Sasha_A80 · **Posted:** Mon Nov 11, 2019 5:25 pm

fenugrec wrote:

a33b wrote:

a checksum error, or sometimes a read timeout.

Did you make absolutely 100% sure the nRES line stays high the entire time ?

Is it a mule ECU that has been reflashed hundreds of times already ?

My SH7055F mule was reflashed many hundreds times without problems.
Nevertheless any SH7055F ecu fails writing being preheated upto 60-70C.
And becomes healthy being cooled.

Watchdog circuitry will not allow SH boot kernel to be downloaded saying nothing about a part ROM to be reflashed.
Checksum errors are ecu schematics\signal levels related.

a33b · **Joined:** Sat Jun 24, 2017 6:23 pm **Posts:** 315

fenugrec wrote:

Did you make absolutely 100% sure the nRES line stays high the entire time ?

Yep, nRES is extremely reliable, 0.15V closed, 5.88V open and it stays there.

Sasha_A80 wrote:

Checksum errors are ecu schematics\signal levels related.

I successfully unbricked a 7058 ECU with this hardware setup. These stubborn 7055 ECUs are frustrating me. I'd forgotten I had shorted the locations for C981 and C985 on this in an earlier attempt. Tried an identical ECU without these locations shorted, doesn't seem to matter.

Tried lowering the baud rate, tried lowering latency, tried putting them back, tried a different RS232 converter, I'm currently having less success than I was earlier with identical settings.

I measure 6V on TX and 3V on RX

fenugrec · **Joined:** Thu Jan 09, 2014 3:07 am **Posts:** 652

a33b wrote:

Yep, nRES is extremely reliable, 0.15V closed, 5.88V open

I measure 6V on TX and 3V on RX

5.88V ? 6V? those seem pretty high, where's that extra volt coming from ? 3V on RX is questionable too, possibly not a problem but I would expect it to swith closer to 0 / 5V rails...

a33b · **Joined:** Sat Jun 24, 2017 6:23 pm **Posts:** 315

Yes, that 5.88V is higher than I observed when flashing the 7058 ECU, it was much closer to 5V (didn't write it down)

Both RX and TX float at 3V disconnected (other RS232 floats at 3.3V)

Sasha_A80 · **Posted:** Tue Nov 12, 2019 4:11 am

a33b wrote:

Tried lowering the baud rate, tried lowering latency, tried putting them back, tried a different RS232 converter, I'm currently having less success than I was earlier with identical settings.

Driver setting for FTDI chip latency 1 ms is a must for FDT software.
6V signal level does not look correct either. Check SH7055F power voltage.

a33b · **Joined:** Sat Jun 24, 2017 6:23 pm **Posts:** 315

SUCCESS!! Thank you all for steering me along. I added 2 more ECU grounds to see if the 'extra' voltage would go away and I had 5.1V on nRES. First time FDT stalled after loading the kernel, but 2nd attempt went perfect, except at 9600 bps.

Moral of the story, pay attention to ALL of the instructions in the step-by-step. And in my case, use healthy gauge wire for those grounds. :oops:

I'm going to try unbricking my second ECU tomorrow, this one I had shorted the two locations mentioned above, it worked, but I suspect that it is not necessary. I was wrong again...

I unbricked ECU #2 today. I shorted C985, didn't go. Shorted C981 as well and then it worked. Not sure if C985 is necessary, but once I had it unbricked I didn't feel like doing another test.

P1on3R · **Posted:** Thu Nov 14, 2019 6:40 pm

For my question with SH705822/28 ECM, i calculate that CPU is in the Reset state.
The oscilogram of pulse generator:
https://dropmefiles.com/e1D7F
This pulse generator i connect to the ECM with SH705513 and SH705520 later and Renesas FDT works fine, CPU going to the Boot Mode.
The oscilogram of nRes pin:
https://dropmefiles.com/OB1xj
For experiment i put WDT pin from another worked ECM (with SH705822/28), but nothing's change.
Until CPU is in the Reset state, may not to try connect with Renesas FDT - it makes no sense.

Sasha_A80 · **Posted:** Thu Nov 14, 2019 8:21 pm

Once again:
WDT circuity on Nissan MY08+ ecu relies upon WDT clocking

AND

SCI port communication with throttle control chip.
Analyze ecu bootloader code.

P1on3R · **Posted:** Fri Nov 15, 2019 5:15 am

Thanks, will try to analyze

P1on3R · **Posted:** Fri Mar 13, 2020 7:11 pm

All 4 boards are unbricking now.
Thank you Sasha_A80

Now all of them is 23710-JN93B

Next quest is unbrick TCM-CVT ECU 31036-JD02A from Nissan Qashqai J10 with CPU M32R M32176F4V-103FP.

Code:

Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device: 0xE6
Detected generic boot device
Requesting supported devices list...
List received - 1 selectable device(s)
    Device Code, Product Code: 1n01,R4F70580S

Selecting Device - 1n01
Device selected

List received - 1 selectable clock mode(s)
    Clock Mode: 0x00

Selecting Clock mode - 0
Clock mode selected

Requesting supported multiplication ratio list...
List received - 2 types of multiplication ratio(s)
 Multiplication Ratio type 2:
    Multiplication Ratio = 8

 Multiplication Ratio type 1:
    Multiplication Ratio = 2


Requesting supported operating frequencies list...
List received - 2 operating frequency range(s)
    Operating Frequency Range 0: 40.00 - 80.00 MHz
    Operating Frequency Range 1: 10.00 - 20.00 MHz

Requesting supported clock type list...
Requesting user ROM information...
List received - 1 user ROM area(s)
    User ROM Area 0: 0x00000000 - 0x000FFFFF

Requesting user-boot ROM information...
List received - 1 user-boot ROM area(s)
    User Boot ROM Area 0: 0x00000000 - 0x00002FFF

Requesting data mat existence information...
    No response to Data Mat command

Requesting erase block information...
List received - 16 erase block(s)
    Erase Block 00: 0x00000000 - 0x00000FFF
    Erase Block 01: 0x00001000 - 0x00001FFF
    Erase Block 02: 0x00002000 - 0x00002FFF
    Erase Block 03: 0x00003000 - 0x00003FFF
    Erase Block 04: 0x00004000 - 0x00004FFF
    Erase Block 05: 0x00005000 - 0x00005FFF
    Erase Block 06: 0x00006000 - 0x00006FFF
    Erase Block 07: 0x00007000 - 0x00007FFF
    Erase Block 08: 0x00008000 - 0x0001FFFF
    Erase Block 09: 0x00020000 - 0x0003FFFF
    Erase Block 10: 0x00040000 - 0x0005FFFF
    Erase Block 11: 0x00060000 - 0x0007FFFF
    Erase Block 12: 0x00080000 - 0x0009FFFF
    Erase Block 13: 0x000A0000 - 0x000BFFFF
    Erase Block 14: 0x000C0000 - 0x000DFFFF
    Erase Block 15: 0x000E0000 - 0x000FFFFF

Requesting line size information...
    Line size received - 128

Clock Frequency (External) = 10.0000MHz, CKM = 8, and CKP = 2
Changing baud rate to 38400 bps
Set baud rate value = 38400
FCF Settings Applied: R4F70580S, (C:\Users\P1on3R\AppData\Local\Temp\)

Attempting to finalise connection to Generic R4F70580S device...

Connection complete

Processing file :"C:\Users\P1on3R\Desktop\9ZVKJ2N32_1JN93B_SH705822N_Original.bin"
Loading image file : 'C:\Users\P1on3R\Desktop\9ZVKJ2N32_1JN93B_SH705822N_Original.bin'
Operation on User Flash
Loaded the Write operation module
Writing image to device... [0x00000000 - 0x00005DFF]
Writing image to device... [0x00005F80 - 0x00005FFF]
Writing image to device... [0x00006E80 - 0x00006F7F]
Writing image to device... [0x00008080 - 0x000080FF]
Writing image to device... [0x00008200 - 0x00009BFF]
Writing image to device... [0x00009C00 - 0x0000D27F]
Writing image to device... [0x0000D280 - 0x0000D9FF]
Writing image to device... [0x0000DA00 - 0x0000DDFF]
Writing image to device... [0x0000DE00 - 0x0000E7FF]
Writing image to device... [0x0000E800 - 0x00012BFF]
Writing image to device... [0x00012C00 - 0x00012D7F]
Writing image to device... [0x00012D80 - 0x0001317F]
Writing image to device... [0x00013180 - 0x00014CFF]
Writing image to device... [0x00014D00 - 0x00014DFF]
Writing image to device... [0x00014E00 - 0x00014EFF]
Writing image to device... [0x00014F00 - 0x000154FF]
Writing image to device... [0x00015500 - 0x000163FF]
Writing image to device... [0x00020000 - 0x000D8AFF]
Writing image to device... [0x000FFF80 - 0x000FFFFF]
Data programmed at the following positions:
 0x00000000 - 0x00005DFF      Length : 0x00005E00
 0x00005F80 - 0x00005FFF      Length : 0x00000080
 0x00006E80 - 0x00006F7F      Length : 0x00000100
 0x00008080 - 0x000080FF      Length : 0x00000080
 0x00008200 - 0x00009BFF      Length : 0x00001A00
 0x00009C00 - 0x0000D27F      Length : 0x00003680
 0x0000D280 - 0x0000D9FF      Length : 0x00000780
 0x0000DA00 - 0x0000DDFF      Length : 0x00000400
 0x0000DE00 - 0x0000E7FF      Length : 0x00000A00
 0x0000E800 - 0x00012BFF      Length : 0x00004400
 0x00012C00 - 0x00012D7F      Length : 0x00000180
 0x00012D80 - 0x0001317F      Length : 0x00000400
 0x00013180 - 0x00014CFF      Length : 0x00001B80
 0x00014D00 - 0x00014DFF      Length : 0x00000100
 0x00014E00 - 0x00014EFF      Length : 0x00000100
 0x00014F00 - 0x000154FF      Length : 0x00000600
 0x00015500 - 0x000163FF      Length : 0x00000F00
 0x00020000 - 0x000D8AFF      Length : 0x000B8B00
 0x000FFF80 - 0x000FFFFF      Length : 0x00000080
819.38 K programmed in 249 seconds
Image written to device

Code:

Адаптер: Tactrix Inc. - OpenPort 2.0 J2534 ISO/CAN/VPW/PWM
DLL: 1.01.4250 Apr 24 2014 09:33:35
Firmware: 1.16.4769
Модуль: Nissan: EFI SH705822N, SH705828N (Hitachi SH7058/1MB)
Идентификация
Версия ПО:   1JN93B00000
VIN номер:   
Основной номер:   9ZVKJ2N32
Каталожный номер:   23710-JN93B
Протокол:   Hitachi CAN
Тип ЭБУ: Nissan: EFI SH705822N, SH705828N (Hitachi SH7058/1MB)
Выполнено

Адаптер: Tactrix Inc. - OpenPort 2.0 J2534 ISO/CAN/VPW/PWM
DLL: 1.01.4250 Apr 24 2014 09:33:35
Firmware: 1.16.4769
Модуль: Nissan: EFI SH705822N, SH705828N (Hitachi SH7058/1MB)
Чтение ошибок
Ошибок: 18
Ошибка  1: U1000-C0 (Индикация)
Ошибка  2: P1564-C0 (Индикация)
Ошибка  3: P0118-C0 (Индикация)
Ошибка  4: P2122-C0 (Индикация)
Ошибка  5: P2127-C0 (Индикация)
Ошибка  6: P0223-C0 (Индикация)
Ошибка  7: P0123-C0 (Индикация)
Ошибка  8: P1212-80 (Индикация)
Ошибка  9: P1610-80 (Индикация)
Ошибка 10: P1612-80 (Индикация)
Ошибка 11: P0075-80 (Индикация)
Ошибка 12: P0081-80 (Индикация)
Ошибка 13: P1800-80 (Индикация)
Ошибка 14: P1801-80 (Индикация)
Ошибка 15: U1001-80 (Индикация)
Ошибка 16: P0113-80 (Индикация)
Ошибка 17: P0198-80 (Индикация)
Ошибка 18: P1551-80 (Индикация)
Выполнено

a33b · **Joined:** Sat Jun 24, 2017 6:23 pm **Posts:** 315

P1on3R wrote:

All 4 boards are unbricking now.
Thank you Sasha_A80

What was the solution to get the boards into boot mode? Did you have to change settings?

Sasha_A80 · **Posted:** Fri Jan 08, 2021 7:48 am

Once again:
WDT circuity on Nissan MY08+ ecu relies upon WDT clocking

AND

WDT circuity on Nissan MY08+ ecu relies upon SCI port communication with throttle control chip.
Analyze ecu bootloader code.

RomRaider

Forum rules

HOW TO: Unbrick and/or Hard Reflash Nissan ECU(Step-by-Step)

Who is online