The most recent version they offer is 4.09
https://www.renesas.com/en-us/products/software-tools/tools/programmer/flash-development-toolkit-programming-gui.html#documents
here is their list:
SuperH RISC engine Family
    SH7010 Series
        SH7018
    SH7046 Series
        SH7046, SH7148, SH7101, SH7048, SH7104, SH7106, SH7108
    SH7047 Series
        SH7047, SH7049, SH7105, SH7107, SH7109
    SH7050 Series
        SH7052, SH7053, SH7054
        SH7055
    SH7060 Series
        SH7065
    SH7080 Series
        SH7083, SH7084, SH7085, SH7086
    SH7144 Series
        SH7144, SH7145
    SH7146 Series
        SH7146, SH7149
    SH7239 Series
        SH7239, SH7237
    SH7280 Series
        SH7285, SH7286

As far as I remember, we use 7144 (3.3V) and in older instruments a 5V 
type. If you don't find another source I could look for an install file, 
when I'm back there from vacations.

These controllers don't support ISP. They are programmed via serial 
interface (RS232 on PC side).

We have three steps for each instrument:

Program CPLD first via ISP, because we access the serial port through 
it.

Then the controller is set to programming mode by some DIP switches and 
the FDT is started. The controller contains a small boot program, that 
connects to the PC and loads a larger boot program and then flashes the 
internal flash.

And finally (since we use an external flash ROM also) the external flash 
is programmed via RS232 and through CPLD and controller. I don't know if 
we need different DIP-switch settings this time, programming is done on 
the PC with a command line window running.

At least we set the DIP switches to normal user mode.

Olaf wrote:
>> We are looking for a programmer for renesas Controller HD64F7045
>> (SH7040).
>
>
> Cool! I thought I am the only one in Germany who use the fastest
> microcontroller in the world. :-)
>
> This is the flasher I am using:
>
> http://mes.osdn.jp/h8/writer-j.html
>
> BTW: It is possible to use the gcc for this controller, too!
>
> Olaf

Hi Olaf
with which hardware do you flash the controller?
We have to change the software and to flash it into the controller on 
Board (ISP).
We had used the Flash module from renesas. But we don't have the flash 
module not  anymore. So we are looking for  an alternative programmer or 
for one used.
annett

The datasheet is really funny. There are JTAG pins, but it says (7144/45 
in my case):
"Note: This LSI does not support test modes other than the bypass mode."
so the only thing you can do is shift data into TDI and receive the same 
data at TDO...

They also don't support the usual Boundary scan via these JTAG pins.

Instead they have proprietary test modes "H-UDI" which can only trigger 
a special interrupt, nothing else, and "AUD" (Advanced User Debugger) 
but these on different pins, not JTAG.

Sorry for reviving a dead topic here. I have have found a very rare 
thread where SH-2 programmers gathered together.

I am also working on an SH7040 microcontroller.

I have a mask ROM variant(HD6437042F) of the chip and want to copy the 
content of it to a new flash F-ZTAT variant(HD64F7044F). So far no luck. 
Is my only hope to decap the MCU and physically read the die or is it 
possible to read the data via serial communication? I cannot find a 
development board, socket adapters since the architecture is no longer 
interesting to majority. There are almost no resource nor official 
support left for those old chips, therefore research of a month led me 
to nowhere.

I’d be grateful if you take your time to share your experience with me.

Renesas still offers the datasheets:
https://www.renesas.com/us/en/products/microcontrollers-microprocessors/other-mcus-mpus/superh-risc-engine-family-mcus/sh7040-32-bit-microcontrollers-non-promotion

The mask ROM is described starting on PDF-page 705 of 925. If you don't 
have the old development files I think it will be impossible to extract. 
There are appnotes for migration to newer MCU families.

I already have the datasheet and dug it as deep as I can. No mention of 
reading/extracting the data from the mask ROM. I know it will be almost 
impossible to get the source code out of the content.

What I need at minimum is to get the binary so I can configure an OTS 
chip to replace the existing one. I don’t even know what could the 
on-chip ROM hold to be critical for the firmware I have extracted from 
an external ROM. Is it some boilerplate for the debugger, that might not 
be relevant in a production chip or manufacturer’s code, I have no idea.

If no way of getting it via a software or circuit hacks, I think I will 
have to go through the reverse engineering it physically if it is 
possible at all.

> The controller has only a special mode. In this mode it accept 256Byte
> from the serial port, stores it in internal ram and than it start
> this code. h8-write provide a special code for flashing.

Did you read and understand this?

You should give it a try! If your mask Rom variant still has this mode
you can send and start YOUR own small program and than you can read it!

Vanye

Vanye R. wrote:

> Did you read and understand this?

I have read it. But not sure what mode was Olaf talking about. I could 
not find anything in the datasheet mentioning this. Do you have more 
context on this?

Any further info/link documenting the aforementioned process in details 
would be helpful. The official datasheet only specifies one special mode 
which is not via a serial communication and only available for PROM and 
flash variants.

Vanye R. wrote:
>
> Did you read and understand this?
>

This applies to the F-ZTAT (Flash) Version, additionally the Flash is 
erased before the transfered code is started.

I would not expect that this also works for the PROM or the Mask ROM 
version because there is most certainly no Boot ROM at all which 
contains the code for the above boot mode (the PROM Version is 
programmed like an ordinary
EPROM in parallel mode).

> I would not expect that this also works for the PROM or the Mask ROM

I think it is possible that it did not work!
However I expect there was a way to check for a correct PROM
in production so I would give it a try.

I atach the source, because it may be hard to find in these days, 
especially for non japanese speaker.
Oh..and Yukio was probably thinking the source is documentation enought. 
.-)

h8write  Version : 1.0.0 ,Yukio Mituiwa
This program follows GPL2.

Usage:h8write [options] -CPU_Type filename [devicename]
CPU_Type : Type of the CPU. Following CPU_Type is supported.
            3048,3664,3067,3068,3052,3064,7045,7050,3069
Filename  : Motrola "S" file to write to EEPROM on a H8/300H system .
            For STDIN '-'
DeviceName: The line which connected to H8/OS system.
            Default is /dev/ttyUSB0.
Options:
-fxx        CPU Speed. xx = [20|25].  Default is 25 [MHz].ly.
            This option work with CPU_Type 3069 only.
-d          Display debug information.
-h          Display this information and exit.
-v          Display this information and exit.

If I remember it correct I patched this source many years ago for a 
minor bug. So it is not exactly 1.0.0, but I forgot what I repaired.

The developing enviroment for linux is:

gcc h8write.c
mv a.out h8write


Vanye

Vanye R. wrote:
> I atach the source, because it may be hard to find in these days,
> especially for non japanese speaker.

I highly appreciate you sharing the flasher. I'd like to give it a try. 
What I was meaning in terms of a documentation was mainly on wiring 
diagrams. How am I supposed to attach the other end of an RS232 cable to 
the MCU, what I should set the mode pins to etc.

In addition, the H8 write does not include SH7042(16-bit ext. bus 
variant of SH7045) in the supported devices. Even if I assume these two 
won't behave differently it is impossible to find the tools, cables, 
adapters for any of them. Do you know how can I access what I need? It 
is fine if it is in Japanese sources.

No, sorry. Yukio Mituiwa had a homepage where he answer
this questions, but I think it is gone.

Vanye