Honda CBR600RR · PGM-FI · reverse-engineered

Every Honda fault code,
traced to the firmware.

A searchable reference for the CBR600RR ECU's diagnostic trouble codes — documented from the factory firmware, not guessed. Detection logic, sensors, reconstructed pseudocode, and an explicit confidence level on every page.

50: codes documented
6: confirmed in firmware
39: major categories
4: firmware generations

Confirmed codes

All 50 codes →

Codes whose detection path is traced in the reconstructed firmware and cross-referenced to the canonical Honda code table.

01-01 Confirmed

MAP sensor circuit low voltage

MAP (manifold absolute pressure) sensor · 2003–2022

01-02 Confirmed

MAP sensor circuit high voltage

MAP (manifold absolute pressure) sensor · 2003–2022

07-01 Confirmed

ECT sensor circuit low voltage

ECT (engine coolant temperature) sensor · 2003–2022

07-02 Confirmed

ECT sensor circuit high voltage

ECT (engine coolant temperature) sensor · 2003–2022

12-01 Confirmed

No.1 primary injector circuit malfunction

No.1 primary injector circuit · 2003–2022

23-01 Confirmed

O2 sensor heater malfunction

O2 sensor heater · 2003–2022

Under the hood

How the ECU handles a fault

Every code on this bike follows the same four steps. This behaviour is confirmed across the reconstructed firmware.

Detect

Each monitored signal is compared against calibrated high and low limits. An out-of-range reading starts a debounce counter, and the fault is only confirmed once it stays bad past a threshold — this rejects noise and glitches.

Store

A confirmed fault sets flags in RAM, and the first fault is latched as the primary code (g_dtc_primary_code, RAM 0x8043F7) that lights the FI lamp. Confirmed codes are mirrored to a serial Microwire (93Cxx) EEPROM so they survive a battery disconnect.

Report

Codes come out two ways: the FI lamp blinks them (long flash = tens, short = ones), and the K-line data protocol returns them over the diagnostic plug in pages of up to three. A one-time freeze-frame snapshot of sensor values is captured at the moment of the first fault.

Clear

There is no per-code erase — clearing wipes all stored codes at once (K-line 72 60 03). For serious faults the ECU keeps the engine running on safe default values (limp-home) so you can ride home with the FI lamp on.

The central sink every monitor calls — it latches only the first fault and lights the FI lamp:

Reverse-engineered pseudocode dtc_report_code — central fault sink (ROM 0x18B50)

1// dtc_report_code — the single point every monitor calls to log a fault.
2// Latches only the FIRST non-zero code for the MIL / limp-home display.
3// blink_code 0x1E (decimal 30) is the "no fault" sentinel and is ignored.
4function dtc_report_code(blink_code):
5    if blink_code == 0x1E:                 // no-fault sentinel -> nothing to do
6        return
7
8    irq_disable()
9    if g_dtc_primary_code == 0:            // keep only the first fault seen
10        g_dtc_primary_code = blink_code    // RAM 0x8043F7 (drives the FI lamp)
11    irq_enable()
12
13    g_fault_pending = 1                     // a confirmed fault now exists
14    if g_limp_enable_source:                // per-fault severity gate
15        g_limp_mode_flag = 1                // serious fault -> limp-home mode

Reverse-engineered interpretation · MEE-F02 reconstructed diagnostics source (diagnostics_dtc.cpp)

Documented honestly, not guessed.

Firmware-specific codes with no identified subsystem are labelled tentative and say so — no fabricated meanings. Every technical claim links to its research source.

Browse the index Machine-readable index

Every Honda fault code,traced to the firmware.