Quick introduction of JECS ECU for Nissan Primera P11GT and Nissan 200sx S14a

JECS for “Japan Electrical Control Systems” was also know as UNISIA JECS manufactured many ECU for Nissan, following two ECU, left came from a Nissan 200sx S14a and right from a Nissan Primera P11GT, both cars share almost the “same” Nissan’s SR20 engine, one is N/A and the other one is turbocharged, one is mechanically distributing the sparks and the other do it electronically and there is much more differences between them but pay attention between this two ECU… they are as identical as the engines are: a common basis with some variants.Nissan S14a and P11GT ECU side by side

Let’s focus on the 200sx S14a ECU, here is whats you can find inside:
DSC_0983
MCU
A wonderful Mitsubishi MELPS 7700 MCU (M37780STJ) I have the original datasheet (in Japanese, never translated in any other languages) if your are interested feel free to contact-me.

RAM/ROM IC
The ROM is OTP, the firmware is burned once and can’t be modified but the ROM can be disabled while the RAM is still accessible, allowing external ROM/EEPROM/FLASH. The chip also provides memory mapped digital I/O with PWM/Counter capabilities.

Memory bus
I don’t know the orignal purpose to let this memory bus so easily accessible. Probably they designed the ECU not only for the final application but also for the engine tuning during the development phase. Because you can easily disable the ROM of the RAM/ROM IC and attach any memory (ROM/EEPROM/FLASH) or also a memory emulator on the memory bus, this is the most probable hypothesis.
Here is the pinout:
P11 S14a Memory bus pinout

I/O Extender
Also memory mapped, this chip provide additional digital I/O but not as complex as the RAM/ROM IC, decaping and DIE inspection for identification is planned.
Following is the pinout I found on the Primera P11GT ECU, may vary from one ECU to other.
A19-257 027

ASIC
When your car smokes like VW diesel with all dashboard’s warning lights on and without the ability to rev the engine… this is the limp-mode. It’s supposed to let you drive to the next workshop. This chip takes the control of your engine in place of the MCU, the control law is as simple as possible with a safe setup for the engine, rev is limited, more fuel are injected than necessary to protected the engine for knocking and overheating, etc. Limp-mode kicks-in when the MCU fail (reset, infinite loop, corrupted memory, unstable voltage, etc.). Back in time memory and MCU aren’t considered safe enough to let them alone in a ECU, an hardened control logic burnt directly on the silicium is considered bullet-proof.

Knock sensor board
Knock sensor is nothing more than a simple microphone, this board is filtering this signal with a band-pass filter, instead of using regular FR4 substrat they used a ceramic like substrat more stable and repeatable for impedance controlled trace. Resistor are printed with a special conductive ink for higher value precision. Because the knock frequency vary according to the cylinder bore, the filter have to be fine tuned to only take in account the knock.

NATS memory board
NATS for “Nissan Anti-Theft System” can be found everywhere but Japan, this board host a serial eeprom memory to store the rolling code.

Nissan Nats 2
Nissan NATS-II

The 8-pin IC is a serial EEPROM, see the “N” logo ? It’s from “National semiconductor” maybe a NM93C46, here is the pinout:
Nissan NATS serial memory

Nissan NATS serial memory

Watchdog board
This is where the ECU voltage (for MCU, memory etc.) is monitored and also the activity of the MCU, the MCU toggle a pin connected to this board causing a counter reset, if the MCU hang somewhere and “forget” to reset the watchdog counter then the watchdog force the MCU to reset, number of reset are limited and after that the ASIC takes the control over the MCU.

 

JECS A12-281001 who are you ?

The JECS “A12-281001” is found in Nissan Primera P11GT and seems to be identical to the JECS “A12-280 000” found in Nissan Silvia 200sx S14a but with a different firmware. Because of the memory technology used for the ROM (OTP) the firmware can only be written once, the chip is labelled with an ID identifying the firmware but the hardware is perfectly identical.

Used with the same processor but for earlier Nissan Primera/Silvia the M6M72561J IC made by Mitsubishi looks physically identical, the pinout is also compatible but not the ROM size, the M6M72561J is 32K ROM long and the A12-28xxxx is 48K ROM long. I contacted Renesas (Hitachi, Mitsubishi & NEC) to ask if Mitsubishi made an IC with larger ROM memory but they didn’t.

JECS A12-281001

As you can see there isn’t any logo or clue about who made the chip, I found the memory mapping by analyzing the firmware but still didn’t know who made the chip !

This chip is more than a simple ROM memory, there is also a RAM bank and memory mapped digital I/Os counter and PWM capable. It’s an all-in-one memory and I/O expander.

The only one solution is DIE inspection but to access to the DIE first I have the decap the IC. Laser helps me a bit but the nitric acid was more helpful (but takes more time)
JECS A12-281001 decapped

Unfortunately the IC is damaged (pin, bounding, etc.) but not the DIE and here is what I found:
NEC D29501
Please read “NEC” not “NFC”, so it’s a NEC IC potentially named D29501 ! Thanks to my amscope metallurgical microscope !

Here is the full-die of the NEC D29501:
NEC D29501