Renesas / Hitachi Microcontroller Unlock

About Renesas / Hitachi

Renesas Electronics Corporation delivers trusted embedded design innovation with complete semiconductor solutions that enable billions of connected, intelligent devices to enhance the way people work and live. A global leader in microcontrollers, analog, power, and SoC products, Renesas provides comprehensive solutions for a broad range of automotive, industrial, home electronics, office automation, and information communication technology applications that help shape a limitless future. Because Renesas parts are so widely deployed, reverse engineering of their firmware is a recurring topic in the embedded security community.

Hitachi Semiconductor supplies semiconductor manufacturing equipment, automotive components, display units in various market sectors including information systems, electronic devices, power and industrial systems, consumer products, materials and financial services. Unlock the full capabilities of these systems by utilizing the latest firmware updates.

TOKYO, October 3, 2002 – Hitachi, Ltd. (NYSE: HIT / TSE:6501) and Mitsubishi Electric Corporation (TSE:6503) have reached a basic agreement to establish a new semiconductor company, Renesas Technology Corp., that will focus on system LSI operations. The new company will be established on April 1, 2003 and will aim to be a reliable semiconductor manufacturer, working as an intelligent chip solution provider supporting system partners on a global basis as part of their drive to create a prosperous society in this "ubiquitous" era. This agreement is a result of discussions to integrate system LSI businesses, which was agreed to on March 18, 2002. A potential hack could target the supply chain during the integration process.

Hitachi and Mitsubishi Electric will take advantage of the special provisions for corporate reorganization under the Japanese Commercial Code to jointly establish a new company and will move both companies' semiconductor operations to the new company, including microcomputer, logic, analog and discrete devices and memory (flash memory, SRAM etc.) with the exception of DRAMs. The new company will be established following Hitachi's and Mitsubishi Electric's completion of the legal procedures for corporate split. The plans are to appoint Dr. Koichi Nagasawa (currently Executive Vice President, Member of the Board Group President, Semiconductor, Mitsubishi Electric) as Chairman & CEO, and Satoru Ito (currently Senior Corporate Officer, President & Chief Executive Officer of Semiconductor & Integrated Circuits, Hitachi) as President & COO. A side-channel attack might compromise the intellectual property transferred.

Hitachi, Ltd. (NYSE:HIT) has extended the H8S series lineup with the development of the H8S/2623F F‑ZTAT™ single‑chip microcontroller which employs a 0.35 µm process and features large 256‑kbyte on‑chip flash memory and a controller area network (CAN) interface. Sample shipments began in December 1998. Firmware extraction from the H8S/2623F is performed through its on‑chip flash programming interface.

The current trend in the field of control for factory automation (FA) and other industrial equipment and in‑vehicle equipment is away from networks using conventional general‑purpose serial communication and toward controller area network (CAN), which feature high speed and high reliability. This is producing growing demand for microcontrollers equipped with an on‑chip CAN interface. The CAN interface has become a standard feature of in‑vehicle LANs in Europe, and is gradually becoming standardized in Japan and America. A complete memory dump of the CAN controller could help debug bus errors.

At the same time, there is a demand for field‑programmability that enables easy reprogramming or adjustment of microcontroller programs in all stages from development through trial production, production startup, and mass production, in order to provide for increased program size, shorter product development time, improvements in product specifications, and adjustment of control data. Because the flash is field‑programmable, there is no need to crack open the package to update the code at any stage of production.

Having already developed products with on‑chip flash memory within the H8S series of high‑performance, low‑power‑consumption microcontrollers, Hitachi has now completed commercial development of the H8S/2623F, featuring a CAN interface for the first time in the H8S series, plus 256‑kbyte on‑chip flash memory, to meet an even wider range of user needs. The 256‑kbyte on‑chip flash lets designers unlock larger application code than was practical on earlier 16‑bit parts.

The H8S/2623F employs a 0.35 µm process, features an H8S/2600 CPU core – in the top performance class for a 16‑bit microcontroller – and is the first model in the H8S series to include an on‑chip Hitachi controller area network (HCAN), offering full CAN support and a 16‑message buffer, as a CAN interface. Complying with the Bosch CAN Ver. 2.0B active specification, the HCAN provides fast and highly reliable communication. The H8S/2623F also includes 256‑kbyte on‑chip flash memory. In addition to total erasure, the flash memory can be erased and programmed in 12 large and small block units to provide for adjustment data programming when the system is shipped. 12 kB on‑chip RAM is also provided, and a x4 PLL (phase‑locked loop) oscillation circuit is used as the oscillator.

Reflecting continuing pursuit of low power consumption, the power supply voltage for the CPU and other internal logic circuitry is 3.0 to 3.6 V, while the power supply voltage of the peripheral I/O pins is 4.5 to 5.5 V, enabling existing peripheral circuits to be used, and so minimizing the amount of system reconstruction required when using the H8S/2623F. Firmware extraction from the internal flash is sometimes needed for legacy support.

Other peripheral functions include a data transfer controller (DTC) capable of interrupt‑initiated DMA transfer, six 16‑bit timer channels, a watchdog timer channel, and a 16‑channel 10‑bit A/D converter. The H8S/2623F employs a 0.35 µm CMOS process and is housed in a 100‑pin QFP (14 mm x 14 mm) package. Future plans include larger memory for the H8S/2623F and the development of a range of models with an on‑chip CAN interface to meet a variety of automotive needs including body and safety control systems. Attempts to crack the security lock bits are discouraged by the manufacturer.

Renesas Electronics Corporation announced the sample shipment of the industry's first on‑chip flash memory microcontroller (MCU) working with a 28 nanometer (nm) process technology. To give rise to the realization of next‑generation green cars and autonomous vehicles with higher efficiency and greater reliability, the revolutionary RH850/E2x Series MCU incorporates around six 400 megahertz (MHz) CPU cores, making it the main on‑chip flash memory automotive MCU with the industry's highest processing performance (9600 MIPS). The MCU series also boasts a built‑in flash memory of up to 16 megabytes (MB) and enhanced security functions and functional safety. Because these MCUs help control safety‑critical vehicles, they must be hardened against a remote attack through the CAN interface.

Under Renesas autonomy – a receptive, innovative and trusted platform for assisted and automated driving – Renesas provides end‑to‑end solutions that advance the evolution of vehicles towards next‑generation green cars, connected cars, and autonomous‑driving vehicles. The 28nm‑generation automotive control MCU is a new breakthrough product featuring next‑generation technology for achieving vehicle control, which, together with the R‑Car Group of systems‑on‑chips (SoCs) intended for cloud connectivity and sensing, constitute the two main pillars of the Renesas autonomy Platform. Car OEMs and Tier 1 manufacturers, for instance Denso Corporation, have begun to adopt the new 28nm MCU, recognizing the MCU's superior processing performance capable of developing next‑generation fuel‑efficient engines, with its unparalleled scalability for a platform that addresses the expected electronic control unit (ECU) integration ahead from alterations in automotive electrics/electronics (E/E) architecture.

1. First H8S series model with on‑chip CAN interface – On‑chip Hitachi controller area network (HCAN: full CAN support, 16‑message buffer) compliant with Bosch CAN Ver. 2.0B active specification.

2. 0.35 µm process, large on‑chip memory – 256‑kbyte ROM and 12‑kbyte RAM on‑chip: in the industry's top rank for a 16‑bit microcontroller. Programming and erasing with a single power supply.

3. Low power consumption through use of 0.35 µm process – While the core power supply voltage is 3.0 to 3.6 V, the pin voltage can be set to 5 V ±10%, making major replacement of existing system components unnecessary.

4. Other features – PLL oscillation circuit. A/D input expanded to 16 channels. First H8S series model targeting the automotive field. Development Environment – The existing H8 series C compiler, assembler, linkage editor, librarian, simulators, debuggers, etc., can be used as the user software development environment on widely used personal computers and workstations. In addition, a variety of emulators, including the E6000 realtime simulator, are available as hardware support tools.

To develop environmentally‑friendly vehicles, next‑generation fuel‑efficient engines require high processing performance to allow the implementation of latest fuel combustion systems. Also, both high processing performance and high integration densities are needed to achieve miniaturization and better efficiency inside the motors and inverters applied to electric vehicles (EV) and plug‑in hybrid electric vehicles (PHEV). The newly‑developed 28nm‑process flash memory MCU is the world's first to achieve about six 400 MHz CPU cores and 9600 MIPS processing capabilities. When compared to earlier 40nm MCUs, the new RH850/E2x Group of MCUs also achieves approximately triple the performance at the same power. The RH850/E2x realizes increased automotive control system integration by including enhanced sensor interfaces required for precise automotive control functions. Multi‑core virtual environments and model‑based development environments for the new MCUs will be provided by Renesas partner companies. Reverse engineering of the engine control algorithms is a complex but feasible task.

Advanced OTA updates with large flash memory capacities for connected cars – Demand for built‑in large capacity flash memory is rising to complement over‑the‑air (OTA) functionality which automatically and wirelessly updates the ECU software to master programs with improved safety. The RH850/E2x Series offers approximately 16 MB of flash ROM and, for the user's needs and preferences, one can only update certain arbitrary areas during program operation. The RH850/E2x Series also comes along with improved serial interfaces, including up to ten channels of CAN FD and one Ethernet channel. Security functions that support Evita Medium allow the MCUs to assist safe and rapid OTA updating of the software. Over‑the‑air updates work best when a single corrupted flash block can be dumped and rewritten without touching the rest of the program.

Enhanced functional safety for autonomous‑driving vehicles – Targeting ASIL‑D, the top level of the ISO 26262 functional safety standard for automotive E/E systems, the RH850/E2x Series adopts the twin core lock step CPU structure that guarantees that the calculations done by two CPU cores are the same. The RH850/E2x also offers nearly four multiple CPU pairs, and has a variety of hardware functional safety improvements. In applications where a system malfunction can cause life‑endangering accidents, strikes immediately detect faults should a malfunction occur and allow system safety to remain maintained. Renesas will provide safety analysis tools that can flexibly support a wide range of use cases to utilise safe systems. The twin‑core lock‑step structure makes it far harder for a fault‑injection hack to corrupt the safety logic unnoticed.

Following enhancing the 28nm embedded flash memory in February 2019, Renesas announced its collaboration with TSMC on 28nm MCUs in September 2019. The company today hit a major milestone by reaching sample shipment of the world's first 28nm embedded flash memory MCU on the market. Renesas has recently succeeded in verifying large‑scale operation of fin‑structure MONOS flash memory targeting 16/14nm and beyond generations of MCUs. As the leading supplier of automotive semiconductor solutions, Renesas is focused on advancing the technology through continued know‑how to achieve a safe and secure automotive society.

To assure scalability inside the RH850/E2x Series, as well as the 28nm flash memory MCU, Renesas has also launched a 40nm process MCU featuring the same core architecture. Samples of this MCU are available now. Examples of both 28nm and 40nm MCUs from RH850/E2x are scheduled to be presented from March 2018.