Renesas NEC programmer

[VEGETA]

Hi all friends,

I am searching for an affordable NEC programmers to use for repair work... to copy the software from one working chip to other not working chips as I have done with ATMEGA using ArduinoISP and usbasp.

The boards are for washing machines not cars. I have seen programmers intended for automobile industry but I want to use it like usbasp not for ready modules.

I've seen this one too: http://www.etlweb.com/?ref=prod_prog_upd78 << don't know if it helps or not as I have 0 experience with these MCUs.

The chips I am interested in are:

D78012CW 016
D78F0515A

I want an affordable programmer like 50$ or something around it.

Note: I am also searching for MC908QC16CDZE if someone can help.

Thank you very much for your help in advance!

[Rasz]

those chips will most likely be read protected

[Bruce Abbott]

The uPD78012CW has mask ROM so it cannot be programmed, and probably can't be read either.

The uPD78F0515A has Flash ROM, but any found in commercial products will almost certainly be read protected.

Apart from automotive programmers, I don't know of any cheap commercial solutions. However the Flash programming protocol is well documented (http://documentation.renesas.com/doc/DocumentServer/U18291EU1V0AN00.pdf) so DIY could be an option. Here is one example that is supposed to work with 78k0 series chips,

http://www.creasol.it/it/equipment/nec-78k/0-and-78k/0s-parallel-programmer

Unless you can find a way to unlock a good chip to copy the firmware from, there's no point looking for a programmer. I have developed a method of extracting code from read protected 78k0S chips which may work on the Kx2. However it requires overwriting the boot code on the original chip, which is not good if it doesn't work!

[amyk]

The uPD78F0515A has Flash ROM, but any found in commercial products will almost certainly be read protected.

Looking through the datasheet it appears this one has the exact opposite type of protection - you can write-protect the flash (even permanently), but there is no read protection.

[Bruce Abbott]

it appears this one has the exact opposite type of protection - you can write-protect the flash (even permanently), but there is no read protection.

While there is no specific 'read protect' function, the chip is still effectively read protected because there is no 'read' function! You may be able to 'read' a block by first getting the checksum, re-writing the first location with 0, getting the new block checksum and then calculating the difference (repeat until all locations have been read). However this won't work if the block is write protected.

My technique is faster and can read write-protected blocks. I overwrite the reset vector with zeros, then add a jump to my own code which is written into a blank area (first half of the boot block usually has some space). My code then reads the ROM internally and dumps it out the serial port. If the boot block is write protected then the same technique can be applied elsewhere in the code (just have to let the program execute until reaches your code) but if the entire chip is write protected then you are screwed.           

[VEGETA]

The uPD78012CW has mask ROM so it cannot be programmed, and probably can't be read either.

The uPD78F0515A has Flash ROM, but any found in commercial products will almost certainly be read protected.

Apart from automotive programmers, I don't know of any cheap commercial solutions. However the Flash programming protocol is well documented (http://documentation.renesas.com/doc/DocumentServer/U18291EU1V0AN00.pdf) so DIY could be an option. Here is one example that is supposed to work with 78k0 series chips,

http://www.creasol.it/it/equipment/nec-78k/0-and-78k/0s-parallel-programmer

Unless you can find a way to unlock a good chip to copy the firmware from, there's no point looking for a programmer. I have developed a method of extracting code from read protected 78k0S chips which may work on the Kx2. However it requires overwriting the boot code on the original chip, which is not good if it doesn't work!

the link you provided has only schematic and stuff like that, I wanted to buy a finished one because it is hard to get all the parts for me at least now.

And, it is "Parallel programmer" so I guess no ICSP?? I want the ICSP really, can't do anything without it.

So, what do you suggest?

If I can read the thing as this programmer claims, and can't write... what to do? If I can write on blank chips (say from Aliexpress) then I guess it is a solution.

[VEGETA]

how about this one: http://www.digikey.com/product-detail/en/QB-MINI2-EA/972-1006-ND/2361764  ??

anyone tried it?

[Bruce Abbott]

how about this one: http://www.digikey.com/product-detail/en/QB-MINI2-EA/972-1006-ND/2361764  ??

anyone tried it?

I have used NEC's programmer software with my own programmer and it worked well, though I haven't tried on-chip debugging (I prefer to use the simulator).   

MiniCube2  is the official programmer/on-chip debugger for 78K0 chips, so it should work perfectly with the 78F0515.

[VEGETA]

how about this one: http://www.digikey.com/product-detail/en/QB-MINI2-EA/972-1006-ND/2361764  ??

anyone tried it?

I have used NEC's programmer software with my own programmer and it worked well, though I haven't tried on-chip debugging (I prefer to use the simulator).   

MiniCube2  is the official programmer/on-chip debugger for 78K0 chips, so it should work perfectly with the 78F0515.

Is your programmer available for buying online? I need an ISP one.

[Bruce Abbott]

Is your programmer available for buying online? I need an ISP one.

All my projects are DIY and open source, so anybody can build them. My programmer connects to the serial port and is ISP, but it only does 78k0S which is no good to you.   

If you want a 'finished' programmer for 78K0 etc. then buy the Minicube. If that is not possible and you can't purchase the components to build a programmer then you might be able to do it with parts scavenged from old electronic devices.

BTW I found some more information about programmers on the Renesas website at http://www.renesas.eu/products/mpumcu/78k/78k0kx/78k0kx2/soft_tools_index.jsp. In the category "Flash Programming Tools" is the application software for the Renesas Flash Programmer, and the docs include a 'sample circuit' showing how to make a simple serial port programmer that works with it.

 
         

[albaben]

I tried today una D78F0515A This MCU (Gorenje waching machine). I have a programmer elnec beeprog2c. This is not able to read the 78K0 family. Only the possibility of verification and programming. so I've errase an MCU, and then programing but with a (file) blank. (Because I do not have a file to this data for this processor.
there is someone ready firmware for this MCU?

[VEGETA]

I tried today una D78F0515A This MCU (Gorenje waching machine). I have a programmer elnec beeprog2c. This is not able to read the 78K0 family. Only the possibility of verification and programming. so I've errase an MCU, and then programing but with a (file) blank. (Because I do not have a file to this data for this processor.
there is someone ready firmware for this MCU?

You seem better than me as I don't have such pricey tools to begin with, I was asking about which tool should I use. It is regretful to not be able to copy the software... burning it on the chip is easy, but getting it is the challenge.

[albaben]

You seem better than me as I don't have such pricey tools to begin with, I was asking about which tool should I use. It is regretful to not be able to copy the software... burning it on the chip is easy, but getting it is the challenge.

you have not given any solution so far? where are concentrated, in which the programmer? Have you any ideas?

[VEGETA]

No, I don't have any solution. People here told me that such MCUs have masked ROM which is impossible to read.

[amyk]

Nothing is impossible, but a physical mask ROM extraction won't be cheap...

[VEGETA]

Nothing is impossible, but a physical mask ROM extraction won't be cheap...

how much?

[albaben]

Nothing is impossible, but a physical mask ROM extraction won't be cheap...

how much?

I make the same question: how much?

[amyk]

It usually starts at few hundred $ and goes up to several k$ depending on exact model/difficulty. Look for companies offering "MCU break" or similar services.

[Rasz]

too much for a washing machine, thats for sure

here is one dude doing this type of stuff (reading out protected chips):
http://caps0ff.blogspot.com