RomRaider

I am having a persistent P0607 on a 2008 WRX STI (ECU ID: 6912783007). I have already tried the 3 things listed in the service manual. The vehicle passes all wiring checks, swapping a known good throttle body changed nothing, and swapping in another ECU did not work either. I figured if I know what the conditions are to set P0607 I may be able to troubleshoot further without just throwing parts at the car.

I have started to decompile the ROM in Ghidra. I have used the various tools to define the CEL tables, etc but I don't seem to be getting any XREFs to any of the addresses related to P0607 and nothing related to P0607_Base nor P0607_Offset nor P0607_Bit_mask.

Any ideas on what I may be missing here?

Unfortunately, the DTC tables don't have XREFs to the routines that determine if that DTC should be triggered.

The way it works is:
- there are functions elsewhere in the ROM that test whether the conditions have been met for a 'NG' judgement for a particular DTC
- then a function 'Func_Handle_NG_Judgement_for_DTC' (my naming) is called. That function is passed one argument which is the DTC's index.
- this function checks if the DTC is enabled in the ROM and, if enabled, it sets that DTC in the DTC tables stored in RAM

For example, P0335 is generally the first DTC in the DTC tables and therefore has index 0. P0336 is the next and therefore has index 1. P0607 is my ROM is at index 0x97.

Locating the above functions is time consuming.

Another approach is to use the FSM which lists in detail the various conditions that trigger a 'NG' judgement for a given DTC.

Sometimes P0607 could be caused by tune. For example, setting 'Speed Limiting (Throttle)' table cells to the same value leads to P0607.

@rimwall Thank you. I have found a few of the offsets. I am finding it easier to follow the assembly when investigating DTCs rather than the decompiled code. I have found the threshold for considering the DTC active so far but still not having much luck finding the exact condition that increments the counter. The search continues...

@alesv The DTC has been raised on previously working accessport v2 tune. This is an issue that crept up over time on a tune that was previously OK. Since then I tried to run the stock ROM modified for only injectors with no luck. I also tried a new ECU with a different ROM (AZ1G202I vs AZ1G201I) with no luck. At this point I am convinced it is an electrical issue; I just can't keep out of limp mode long enough to get any data to determine the root cause.

Now that I have the counter and threshold I am thinking about increasing the threshold and then logging the counter to determine if the limp home voltage drop is occurring before or after the DTC is set.