Tutorial. How to flash Onkyo main microcontroller.
Oct 18, 2020 9:46:37 GMT -5
dobrykamil and nodols like this
Post by djadi82 on Oct 18, 2020 9:46:37 GMT -5
Hi, everyone, so today I have decided to try to communicate with my main microcontroller in Onkyo TX-NR609 with the usage of standard USB to UART converter widely available on eBay, Amazon, Ali express and many other sources. This is very user friendly and cheap solution which should be very cost effective.
HW Requirements:
SW Requirements:
I will provide a proof of concept - a working solution which will prove beyond a doubt that this is easily possible to be achieved.
Main microcontroller in this unit is UPD70F3746 which is part of Renesas V850/JJ3 family of microcontrollers. This chip has 1024kB of onboard ROM and we will be addressing possibility of flashing it in this guide. Other Onkyo models may have same or similar chip but refer to your hardware and/or service manual as it may be not compatible with this guide.
With not much of additional cost you can make yourself an adapter which will allow you to communicate with your own main microcontroller without even removing or opening the case. There is a service port available at the back of your AV receiver which I will be using for this presentation.
We can have here 2 approaches, one when your AV receiver is connected to the mains but switched off it will still provide power to main microcontroller or second when it is not connected to the mains and entirely powered from your USB to UART converter. This microcontroller operating current is very low and your USB 2.0, and furthermore voltage regulator on your USB to UART converter is more than sufficient to provide enough power to your IC.
In this guide I will focus on solution like second option however with the difference that I removed the board from the unit.
There is a requirement for the user to know how to solder, read electronic diagrams, schematics and have some basic knowledge about electronics. If you decide to try it yourself should something go wrong, you take your own risk, and I will not be held responsible for it. You have been warned 😉
First and foremost, I would like to mention that this family of microcontrollers is widely used in many Onkyo AV receivers and possibly this solution could be applied to majority of the family. There is also a chance that many of other products on the market from other brands could benefit at least partially from what I want to present here if these uses same family of IC’s.
I expect the users to read the technical documentation regarding RENESAS flash programmer software, sample circuits and documentation of the V850 microcontroller 's family.
First things first, below are links to the documentation which you are advised to read:
Also a must read is a great thread created by tjmotter on this forum
Everything you never wanted to know about Onkyo firmware
I have first achieved my successful communication with microcontroller with usage of RENESAS EZ-CUBE however, I strongly believed that this should be possible with standard USB to UART converter and today I built a circuit which does just that.
This is a device I have used for the task Today instead of dedicated Renesas device:
www.onetransistor.eu/2017/08/ch341a-mini-programmer-schematic.html
Very important word of warning by default this converter supplies 5 volts on communication lines but we require 3.3 volts so therefore there is a hardware modification required before we can go ahead. It is unfortunately the case with a majority of available cheap USB to UART/RS232/COM/SERIAL converters. So, please verify your voltages before making any attempts.
I have modified my board in the same way as in the article linked below and therefore, I will not be covering this in further detail in this guide.
www.chucknemeth.com/usb-devices/ch341a/3v-ch341a-mod
After above modifications are done to your USB -> UART converter you can proceed further.
This device has dual functionality, as programmer and USB to SERIAL/UART converter. We configure the operation mode by setting jumper in correct position. Shorting pins 1-2 for programmer mode and shorting pins 2-3 for SERIAL/UART/TTL mode required in this guide.
I want to mention also that this programmer can read external EEPROM from this board located on opposite side of laminate (Q153 in Onkyo 609) containing identity information of you receiver. Mine was supplied with clamp like adapter allowing to read that EEPROM directly from the board. So, it clearly can serve dual purpose here.
The solution I will provide is non-invasive in terms of hardware in your Onkyo receiver. You will not be soldiering or making any modifications to the board to make the communication possible. What I highly recommend is same approach as mine – building yourself adapter as one below:
This will allow you to directly connect to your board without soldering. There is already dedicated service connector on the board – in this model it is called P751A and it will be used. Adapter is made from simple universal board, 9Pin connector and 9pin flex ribbon. There is not much magic to it and I expect everyone attempting this to have sufficient knowledge to make one.
Although one pictured above is not beautiful nothing is stopping you from making a proper board of your own. This was built to test PoC and was good enough for the intended purpose.
I have utilised a sample circuit Type C from “Renesas Flash Programmer Sample Circuit for Programming by Using a PC’s Serial Port” linked above in provided documentation. I have built everything on breadboard and used few additional components for the purpose of RESET functionality. In these microcontrollers RESET pin by default during normal operation is in high state therefore, is marked in Onkyo service manual and IC documentation with accent above its name. During initial boot for short period it needs to be in low state, to initiate reset on IC. Reset circuit is made of simple RC elements and diode.
Here is a schematic of my complete setup:
Video demonstrating PoC - communication with EEPROM.
Now after I have shown you how I have achieved successful communication with internal EEPROM on the main IC, I would like to present how I have prepared firmware to be ready to flash.
PREREQUISITES:
Once we acquire proper firmware for our device, we must unzip it.
In my example case it was ONKAVR0008 00EAEAEA00EA 122.zip
After unzipping I got these files:
We need to move unzipped content to machine running Linux. I will not be covering how to compile onkyo-decrypt as this is beyond scope of the guide. We must put unzipped files in same folder as our onkyo-dec executable and simply run it.
In my case it resulted in below decrypted files:
In my case file of interest containing firmware for uIC is of3.ONKAVR0008_00EAEAEA00EA.EA114. I have transferred this file back to my windows machine. I am sure that all other decrypted files are providing great value too 😉. On windows machine we must run this command:
Resulting flash.rec is ready to be flashed to uIC. It is file in Motorola format acceptable by Renesas Flash Programmer.
After successful flash (my onkyo was not turning on before) device started and operated properly. Because my device failed during firmware upgrade, I decided to flash it again from USB so, that all other chips are being flashed and correct security flag is restored to main IC. This time everything went well, and it took 60 minutes to complete vs. prior failed 1-minute flash.
ADDED:
I have created repository with firmware files in another thread. For all those struggling with decrypting firmware links to download those are provided.
Onkyo Firmware Repository
That is all.
HW Requirements:
- Soldering iron, solder.
- 9pin FFC FPC flat flexible cable 1.0mm pitch 9 pin type B
- 9pin 1.0mm FPC/FFC Connector LCD Flexible Flat Cable Socket Double Row DIP Straight Pin
- CH341A Mini Programmer or equivalent
- 4 x 10kOhm resistors
- 1 x Electrolytic capacitor .47uF
- 1 x 1N4148 diode
- 1 x Universal board
SW Requirements:
- Renesas Flash Programmer v2.05
- Bin2srec
- Onkyo firmware
- Compiled onkyo-decrypt (I have done this on Debian based distro)
I will provide a proof of concept - a working solution which will prove beyond a doubt that this is easily possible to be achieved.
Main microcontroller in this unit is UPD70F3746 which is part of Renesas V850/JJ3 family of microcontrollers. This chip has 1024kB of onboard ROM and we will be addressing possibility of flashing it in this guide. Other Onkyo models may have same or similar chip but refer to your hardware and/or service manual as it may be not compatible with this guide.
With not much of additional cost you can make yourself an adapter which will allow you to communicate with your own main microcontroller without even removing or opening the case. There is a service port available at the back of your AV receiver which I will be using for this presentation.
We can have here 2 approaches, one when your AV receiver is connected to the mains but switched off it will still provide power to main microcontroller or second when it is not connected to the mains and entirely powered from your USB to UART converter. This microcontroller operating current is very low and your USB 2.0, and furthermore voltage regulator on your USB to UART converter is more than sufficient to provide enough power to your IC.
In this guide I will focus on solution like second option however with the difference that I removed the board from the unit.
There is a requirement for the user to know how to solder, read electronic diagrams, schematics and have some basic knowledge about electronics. If you decide to try it yourself should something go wrong, you take your own risk, and I will not be held responsible for it. You have been warned 😉
First and foremost, I would like to mention that this family of microcontrollers is widely used in many Onkyo AV receivers and possibly this solution could be applied to majority of the family. There is also a chance that many of other products on the market from other brands could benefit at least partially from what I want to present here if these uses same family of IC’s.
I expect the users to read the technical documentation regarding RENESAS flash programmer software, sample circuits and documentation of the V850 microcontroller 's family.
First things first, below are links to the documentation which you are advised to read:
- Renesas Flash Programmer V2.05
- Renesas Flash Programmer Sample Circuit for Programming by Using a PC’s Serial Port
- V850ES/JJ3 User's Manual: Hardware
Also a must read is a great thread created by tjmotter on this forum
Everything you never wanted to know about Onkyo firmware
I have first achieved my successful communication with microcontroller with usage of RENESAS EZ-CUBE however, I strongly believed that this should be possible with standard USB to UART converter and today I built a circuit which does just that.
This is a device I have used for the task Today instead of dedicated Renesas device:
www.onetransistor.eu/2017/08/ch341a-mini-programmer-schematic.html
Very important word of warning by default this converter supplies 5 volts on communication lines but we require 3.3 volts so therefore there is a hardware modification required before we can go ahead. It is unfortunately the case with a majority of available cheap USB to UART/RS232/COM/SERIAL converters. So, please verify your voltages before making any attempts.
I have modified my board in the same way as in the article linked below and therefore, I will not be covering this in further detail in this guide.
www.chucknemeth.com/usb-devices/ch341a/3v-ch341a-mod
After above modifications are done to your USB -> UART converter you can proceed further.
This device has dual functionality, as programmer and USB to SERIAL/UART converter. We configure the operation mode by setting jumper in correct position. Shorting pins 1-2 for programmer mode and shorting pins 2-3 for SERIAL/UART/TTL mode required in this guide.
I want to mention also that this programmer can read external EEPROM from this board located on opposite side of laminate (Q153 in Onkyo 609) containing identity information of you receiver. Mine was supplied with clamp like adapter allowing to read that EEPROM directly from the board. So, it clearly can serve dual purpose here.
The solution I will provide is non-invasive in terms of hardware in your Onkyo receiver. You will not be soldiering or making any modifications to the board to make the communication possible. What I highly recommend is same approach as mine – building yourself adapter as one below:
This will allow you to directly connect to your board without soldering. There is already dedicated service connector on the board – in this model it is called P751A and it will be used. Adapter is made from simple universal board, 9Pin connector and 9pin flex ribbon. There is not much magic to it and I expect everyone attempting this to have sufficient knowledge to make one.
Although one pictured above is not beautiful nothing is stopping you from making a proper board of your own. This was built to test PoC and was good enough for the intended purpose.
I have utilised a sample circuit Type C from “Renesas Flash Programmer Sample Circuit for Programming by Using a PC’s Serial Port” linked above in provided documentation. I have built everything on breadboard and used few additional components for the purpose of RESET functionality. In these microcontrollers RESET pin by default during normal operation is in high state therefore, is marked in Onkyo service manual and IC documentation with accent above its name. During initial boot for short period it needs to be in low state, to initiate reset on IC. Reset circuit is made of simple RC elements and diode.
Here is a schematic of my complete setup:
Video demonstrating PoC - communication with EEPROM.
Now after I have shown you how I have achieved successful communication with internal EEPROM on the main IC, I would like to present how I have prepared firmware to be ready to flash.
PREREQUISITES:
- Access to Linux machine with compiled onkyo-decrypt.
- Correct unzipped firmware for our AV receiver.
Once we acquire proper firmware for our device, we must unzip it.
In my example case it was ONKAVR0008 00EAEAEA00EA 122.zip
After unzipping I got these files:
- ONKAVR0008_00EAEAEA00EA.of3
- ONKAVR0008_00EAEAEA00EA.of2
- ONKAVR0008_00EAEAEA00EA.of1
We need to move unzipped content to machine running Linux. I will not be covering how to compile onkyo-decrypt as this is beyond scope of the guide. We must put unzipped files in same folder as our onkyo-dec executable and simply run it.
In my case it resulted in below decrypted files:
- of3.ONKAVR0008_00EAEAEA00EA.EA114
- of3.DA83XEA_010203040506.06117
- of3.DA83XEA_010203040506.05117
- of3.DA83XEA_010203040506.03117
- of3.DA83XEA_010203040506.hdr
- of2.ONKAVR0008_00EAEAEA00EA.EA109
- of3.ONKAVR0008_00EAEAEA00EA.hdr
- of2.ONKAVR0008_00EAEAEA00EA.EA107
- of1.ONKAVR0008_00EAEAEA00EA.hdr
- of2.ONKAVR0008_00EAEAEA00EA.hdr
In my case file of interest containing firmware for uIC is of3.ONKAVR0008_00EAEAEA00EA.EA114. I have transferred this file back to my windows machine. I am sure that all other decrypted files are providing great value too 😉. On windows machine we must run this command:
bin2srec.exe of3.ONKAVR0008_00EAEAEA00EA.EA114 > flash.rec -l 16Resulting flash.rec is ready to be flashed to uIC. It is file in Motorola format acceptable by Renesas Flash Programmer.
After successful flash (my onkyo was not turning on before) device started and operated properly. Because my device failed during firmware upgrade, I decided to flash it again from USB so, that all other chips are being flashed and correct security flag is restored to main IC. This time everything went well, and it took 60 minutes to complete vs. prior failed 1-minute flash.
ADDED:
I have created repository with firmware files in another thread. For all those struggling with decrypting firmware links to download those are provided.
Onkyo Firmware Repository
That is all.
