OBD1 P72 ECU Debug Mode and ROM Configuration Switches
Technical analysis of the diagnostic debug mode and ROM configuration byte switches in the OBD1 Honda P72 ECU.
The OBD1 P72 ECU, utilized in the B18C1 engine, contains a built-in diagnostic and debug segment within its ROM code. The software features a master debug switch that overrides standard sensor check routines and alters diagnostic behavior. By modifying the master debug byte, users can change how the ECU processes error codes, sensor bypasses, and communication telemetry.
1. The Debug Master Switch (0x547E)
The entry point for debug mode is controlled by a single-byte switch located at ROM address 0x547E.
- Value =
0x00(Debug Disabled): The ECU runs standard engine checks, sensor diagnostics, and code evaluations. - Value >
0x00(Debug Enabled): The ECU activates alternate logic branches, overriding several standard sensor checking subroutines.
2. Assembly Analysis (OKI 66k Instruction Set)
The following assembly block from the P72 ROM demonstrates how the ECU evaluates the debug flag to load alternate settings:
| Address | Instruction | Description |
|---|---|---|
| 53A7 | LCB A, 0547eh |
Load Code Byte from 0x547E into Accumulator A |
| 53AB | STB A, r0 |
Store Byte from Accumulator A to Register 0 (r0) |
| 53AC | MOV DP, #003d3h |
Move Data Pointer to 0x03D3 |
| 53AF | LB A, [[[DP]]] |
Load Byte from pointer address into A |
| 53B0 | STB A, r2 |
Store Byte to Register 2 (r2) |
| 53B1 | CMPB r0, #000h |
Compare byte in r0 to 0x00 |
| 53B4 | JEQ label_53ba |
Jump if Equal to label_53ba |
| 53B6 | LCB A, 0547fh |
Load Code Byte from 0x547F into A |
| 53BA | SLLB A |
Shift Left Logical Byte (places MSB into Carry flag) |
| 53BB | MB off(00216h).3, C |
Move Carry bit (C) to bit 3 of RAM offset 0x0216 |
| 53BE | LCB A, 05475h |
Load Code Byte from 0x5475 into A |
| 53C2 | SLLB A |
Shift Left Logical Byte |
| 53C3 | MB off(002eeh).3, C |
Move Carry bit to bit 3 of RAM offset 0x02EE |
| 53C6 | CMPB r0, #000h |
Compare r0 to 0x00 |
| 53C9 | JEQ label_53d2 |
Jump if Equal to label_53d2 |
| 53CB | LCB A, 05480h |
Load Code Byte from 0x5480 into A |
| 53CF | SLLB A |
Shift Left Logical Byte |
| 53D0 | SJ label_53dc |
Short Jump to label_53dc |
Execution Flow
- The ECU checks the master debug switch at
0x547E. - If the debug switch is
0x00, execution jumps tolabel_53ba, bypassing the secondary lookup at0x547Fand the tertiary lookup at0x5480. - If the debug switch is non-zero, the ECU processes additional configuration flags at
0x547Fand0x5480, saving their status as bitwise flags in RAM address offsets0x0216and0x02EE.
3. Neighboring Configuration Byte Switches
The ROM memory range from 0x5470 to 0x548F acts as a configuration table containing single-byte switch flags. These flags determine whether specific software subsystems are active:
- VTEC Solenoid Checks: Enable or disable diagnostic loops that verify VTEC solenoid continuity.
- VSS VTEC Check: Enable or disable the minimum speed requirement check for VTEC engagement.
- Knock Sensor Checks: Toggle the evaluation of knock sensor daughterboard signals.
- Oxygen Sensor Diagnostics: Toggle heated sensor heater circuit diagnostics.
Warning
When master debug mode (
0x547E) is active, these individual switches are bypassed or overridden. Ensure that all physical sensors are accounted for or properly bypassed in the ROM logic before enabling debug mode to prevent unexpected engine management behavior.