ECU ROM locations & formulæ
I was looking through the pgmfi forums the other day and I realized that it is pretty hard to find all the locations for all the ECU's. So I figured I would make a chart that lists the main ones people want to find for the most common ECU's. I did not find any of these locations. Likewise, I did not figure out any of the formulas. All that work has been done by very smart people who like to hang out at pgmfi.org.
This page is here to help you learn. It is not supposed to be an all-containing, comprehensive guide. Also, the info here is in no way set in stone, some of it may be wrong. And if you think it is please please e-mail me and let me know.
Info about the chart:
- Bytes 0-2 are the first 3 bytes of the rom file in hex. These are very useful in identifying what ECU the program is for.
- VTEC start is where the first value of VTEC is in the ROM file. There are either 4 or 8 VTEC values in the file depending on the ECU.
- VTEC engage is the actual engagement point the ECU uses under normal circumstances. The PR3 and PW0 locations were tested by me. The P30 one was not.
- VTEC disengage is the same as the VTEC engage but with the disengage.
- The locations are in hex as indicated by the 'h' after every number.
- n/a means it doesn't exist and a question mark means I don't know the location.
- I am only listing the maps that the ECU uses under normal conditions.
- The location I list for the maps and multipliers is the location of the first value of the maps and multipliers, respectively. OBD0 have 15x17 maps, and OBD1 have 20x10 maps (with the exception of the p72 which has half maps for VTEC).
| |
PM6/PS9 |
OBD0 PR4 |
PR3 |
JDM PW0 |
Euro PW0 |
P28 |
J/E P30/P61 |
US P30 |
| Bytes 0-2 |
02, 16, 00 |
01, 2F, 00 |
73, 16, 96 |
D8, 16, FF |
73, 16, 9A |
ED, 24, F4 |
E2, 21, E9 |
ED, 24, F4 |
| |
|
|
|
|
|
|
|
|
| Fuel map 1 |
3EF2h |
541Ah |
3DE4h |
3DE4h |
3DE4h |
7050h |
7032h |
7050h |
| Fuel mult 1 |
3FF1h |
540Bh |
3EE3h |
3EE3h |
3EE3h |
7118h |
70FAh |
7118h |
| Fuel map 2 |
n/a |
n/a |
3EF2h |
3EF2h |
3EF2h |
7122h |
7104h |
7122h |
| Fuel mult 2 |
n/a |
n/a |
3FF1h |
3FF1h |
3FF1h |
71EAh |
71CCh |
71EAh |
| |
|
|
|
|
|
|
|
|
| Ign map 1 |
3DF3h |
50FFh |
3BE6h |
3BE6h |
3BE6h |
72E4h |
724Eh |
72E4h |
| Ign map 2 |
n/a |
n/a |
3CE5h |
3CE5h |
3CE5h |
73ACh |
7316h |
73ACh |
| |
|
|
|
|
|
|
|
|
| Warm revlimit |
0DE6h |
109Bh |
31DEh |
391Ah |
3928h |
64A7h |
6387h |
64A7h |
| Warm retsart |
? |
? |
31E0h |
3922h |
3930h |
3930h |
6381h |
64A1h |
| Cold revlimit |
0DECh |
? |
31D8h |
391Ch |
392Ah |
649Bh |
637Bh |
h |
| Cold restart |
? |
? |
? |
? |
? |
31D6h |
6375h |
h |
| Idle |
3993h |
|
|
|
|
|
|
|
| VTEC start |
n/a |
n/a |
3414h |
3AD8h |
3AECh |
6542h |
6432h |
6542h |
| Engage VTEC |
n/a |
n/a |
3419h |
3AD9h |
? |
? |
6437h |
? |
| Disengage VTEC |
n/a |
n/a |
3418h |
3AD8h |
? |
? |
6436h |
? |
| Knock sensor |
n/a |
n/a |
? |
? |
n/a |
n/a |
6002h |
60E7h |
Here are some formulas. They will get you from the hex value (actually from the decimal equivalent of the hex value) to a human readable value like RPM or pulse width in what is believed to be milliseconds. You will have to figure out how to get back on your own. It should be easy if you even sort of know 9th grade algebra.
OBD0 Non-VTEC Formulas
- Fuel
a = 2 ^ ColumnMultiplier
pulsewidth in ms = (DecAtAddy + (224/a))/(208/a)
- Ignition - (DecAtAddy-15)*.36
- RPM formula (revlimits, idle, etc.) - 1920000/((DecAtAddy * 256) + DecAt(Addy+2))
i.e. if Addy is 1003h then (Addy+2) is 1005h
OBD0 VTEC Formulas
Note: The OBD0 VTEC development is very behind the rest of the ECU's. I don't know why, but people just don't use them to the same extent as the PM6 or P30. That being said, some of the formulas might be wrong (fuel, vtec, and maybe ignition). If, however, they are wrong, they wont be way off. From my experience, the VTEC formula has been around 100 - 200 rpm high but that could also be the tach.
- Fuel - same as above
- Ignition - same as above
- Revlimits (8 bit RPM values that aren't VTEC) - 1848000/DecAtAddy
- Idle & other 16 bit RPM values - 1848000/((DecAtAddy * 256) + DecAt(Addy+2))
- VTEC - (DecAtAddy - 128) * 62.52
OBD1 Formulas for P30, P28, P06 and a few others.
Note: The OBD1 fuel value that you get out of the formula isn't really a "human readable" value (it definitely is NOT milliseconds). It is just the value people have decided to use.
- Fuel - DecAtAddy * (ColumnMultiplier/4)
- Ignition - ((DecAtAddy - 24) / 4)
- 8 bit RPM values that aren't VTEC (revlimits, idle, etc.) - 1875000/DecAtAddy
- VTEC - (DecAtAddy - 128) * 62.52
Home