Code-level analysis of the stock dump of the earlier 2.7 TDi (TD27ETi) ECU. 40,657 instructions decoded with the C166 disassembler, about 450 functions, a process table of 60 entries and 58 calibration maps (77 references) tied to the functions that read them and to the variables on their axes.
Same hardware and memory layout as the Frontera X22DTH ECU. Two flash chips, C167 with mask ROM, code at 0x10000–0x37FFF, calibration at 0x38000–0x3FFFF through DPP0/DPP1 = 0x0E/0x0F, the same task prologue and the same ROM routine addresses (map interpolation 00:20D6 / 00:20AC, task exit 00:07B4). Frontera tools and findings carry over; map addresses do not.
The pump metering controller is in ROM. The flash computes the metering setpoint FC56 and passes it straight to CALLS 00:26FC. There is no PI controller and no PWM/CAPCOM2 write in the flash, so the controller gains cannot be changed. The whole fuel chain up to the setpoint is in the flash.
Checksum algorithm is the same as on the Frontera. One block per dataset (0x00B80–0x07FFB → 0x07FFC, 0x38B80–0x3FFFB → 0x3FFFC); both match on the stock dump. The map editor supports this ECU and recalculates both.
Hard fuel limit in the parameter block. It limits fuel independently of every map ECM Titanium lists; above 68 mg it has to be raised too.
| Addresses | Contents |
|---|---|
| 00000–0FFFF | The CPU sees its mask ROM here; calls 00:xxxx go there. In the file, 0x00000–0x07FFF holds a second dataset (Nissan 7F406). |
| 10000–13FFF | Loader and services. 19-entry vector table at 0x10120 pointing into ROM (timers, ADC, serial port, reset). |
| 10000–37FFF | Code. Dispatcher with 81 entries at 0x2F1A0 (looks like K-line diagnostics). |
| 38000–3FFFF | Working dataset (Nissan 7F405). Process table at 0x383F6 (60 × 10 bytes), map pointer table at 0x38F04. Checksum at 0x3FFFC: the same algorithm as on the Frontera, recalculated by the map editor. |
The code works with the dataset at 0x38000 (DPP0 = 0x0E, DPP1 = 0x0F at startup). The copy at 0x00000–0x07FFF has the same layout and differs in 812 bytes, mostly the “fuel → metering” map and two rpm × fuel maps. No code switches to it and the CPU sees ROM at these addresses, so it is most likely unused. Addresses of the same map in the two sets differ by 0x38000; ECM Titanium shows the 0x0xxxx addresses and writes to both sets.
Driver demand = f(rpm, pedal C1D0).
Fuel ceiling: rpm limiter (atm. pressure × rpm), smoke limiter with its input , start fuel and 13 more maps.
Fuel coordinator: combines demand and limits; reads 8 maps at 0x3919A–0x39630.
Final and injection quantity.
Fuel temperature correction .
Metering setpoint: converts fuel and rpm into the pump metering position.
Process numbers and functions were found in this firmware directly. Their roles were identified by aligning the code with a later Terrano firmware in which the chain was traced line by line. Variables: rpm FC3A (axis ID E08A), final fuel FC36, ceiling FCBA, pedal C1D0, atmospheric pressure C234, setpoint FC56.
Maps the code actually reads through the ROM interpolation routines. Confidence of the label: H — role confirmed by code and ECM Titanium, M — by code, L — a guess; maps without a label have no confirmed role yet. Click a row to see the map description.
| Header | Data | Size | Role | Conf. | Function |
|---|