City Turbo ECU Code Reverse Engineering

Every bit of information we have about the Honda City compiled by our members!
User avatar
Moderator / Donating Member
Posts: 3092
Joined: Wed Apr 09, 2003 1:59 pm
Location: Putaruru

City Turbo ECU Code Reverse Engineering

Postby James » Thu Feb 21, 2008 3:22 pm

NOTE: All hardware locations and addresses are for a T2 ECU, as that is what I have taken apart. Many of them will be the same for T1.


I/O Addressing:

Accessed using the IN and OUT commands

-80H 81c55 I/O Control Register TM2 TM1 IEB IEA PC2 PC1 PB PA
-81H PA on 81c55 Output
-82H PB on 81c55 Input
-83H PC on 81c55 Output
-84H Timer 1 Count Register Lower Byte
-85H Timer 1 Count Register Lower Byte and control bits.

-AxH Multiply divide chip. Then use 0-3 as mode select.

-FxH Datalogging Connector (Future Reference doesn't appear to be used). Can use same 0-3 Mode selection as other IN/OUT commands.

Memory Addressing:

Accessed Using memory instructions, MOV, SHLD etc

-8000H to 80FFH 256B Ram onboard the 81c55 Activated by the de-mux IC14

-8100H Initital Stack Pointer Address - Maybe on the 5114?

-8xxxH 81c55 Chip Enable

-9xxxH Goes to NAND gate to enable 5114 SRAM Chip Addressed in 4 banks of 256 Nibbles 90xxh 91xxh 92xxh 93xxh

-AxxxH MSM6203 Multiply Divide Chip Select

-BxxxH Analog to Digital MSM5204 Chip Select

-CxxxH First Timer Chip IC18 Chip Select

-DxxxH Second Timer Chip IC17 Chip Select

-ExxxH Third Timer Chip IC16 Chip Select

-FxxxH Datalogging connector pin 16, Output enable?

Each timer chip has 3 internal addresses, the address lines for these are hooked up to A8 and A9 for A0 and A1 respectively.


RST 7.5 TDC Sensor in buffered with OR Gate

RST 6.5 High level until sampled. Analog to Digital Conversion Ready?

RST 5.5 Timer 1 (100HZ) interrupt latch. Reset by BCD Y2

81c55 Main I/O:

PA7 = Error Code Light 8
PA6 = Error Code Light 4
PA5 = Error Code Light 2
PA4 = Error Code Light 1
PA3 = AMUX Select Line C
PA2 = AMUX Select Line B
PA1 = AMUX Select Line A
PA0 = AMUX Chip Select Line

PB7 = BR1 (INPUT) Low = Bridge present
PB6 = BR2 (INPUT) Low = Bridge present
PB5 =
PB4 = Third Timer Chip IC16 OUT0
PB3 = Latched CYL In, reset by BCD Y3 (IC9)
PB2 = Starter Motor Running Signal
PB1 = 15km Signal. Not used in T2, same as below
PB0 = 45km Signal. When signal from dash is high, this is low.

PC5 =
PC4 =
PC3 = Fuel Pump Relay Inverse Sense
PC2 = Boost Control Solenoid Inverse Sense
PC1 = To Idle Up Unit. Inverse sense, pin A8
8085 SOD = To Idle Up Unit. Inverse sense, pin A9
PC0 = PGMFI Lamp


Base driver transistors on N2 drive main injector transistors. Main 4 are driven by 4019 IC11, CVCC by OR gate in 4071 IC4. This OR gate has two inputs, one from OUT0 of timer 3 IC17 and one from a bunch of other crap.

Injectors are driven by various outputs from the timer IC16 and IC17 with IC17 controlling the main injector enablement as well. There also seems to be an injector fail safe or something when all 4 injectors can be operated from a single enable line.

N2-23,22,21,20 = Main Injector ON signals. N2-17 = CVCC injector.

If you cut BR6 and jump BR5 then Sub leak valve is manual control from PC4 instead of IC18 Timer 2 OUT

BR3 and BR4 are used to select the CLK used by the ADC
Last edited by James on Tue May 06, 2008 4:18 pm, edited 3 times in total.

User avatar
Moderator / Donating Member
Posts: 3092
Joined: Wed Apr 09, 2003 1:59 pm
Location: Putaruru

Postby James » Sat May 03, 2008 12:47 pm

Software Stuff

RPM Calculation

Stock Bins

500 600 700 800 999 1200 1399 1600 1999 2401 2799 3200 3599 3998 5000 5990


(1 / ( Decimal Timer Value x (1 / 62500))) x 30

Return to “The Honda City InfoBase”

Who is online

Users browsing this forum: No registered users and 1 guest