2.0L ECM

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first facelift model (2005), when CVVT was introduced and 4mbit SIMK43 was used.

Memory layout

Both units memory can be separated into 5 sections:

• bootloader & UIF
• adaptive values
• calibration zone
• program code

Memory layouts per ECU

SIMK41 - 2mbit

Start	End	Section	Size
0	3FFF	Bootloader & UIF	16 kByte
4000	7FFF	Adaptive values	16 kByte
8000	FFFF	Calibration Zone	32 kByte
10000	3FFFF	Program Code	192 kByte

SIMK43 - 4mbit

Start	End	Section	Size
0	3FFF	Bootloader & UIF	16 kByte
4000	7FFF	Adaptive values	16 kByte
8000	FFFF	Program Code	32 kByte
10000	1FFFF	Calibration Zone	64 kByte
20000	7FFFF	Program Code	384 kByte

Description of memory sections

Bootloader & UIF

This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.

This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.

Name	Offset	Size (bytes, decimal)	Example	Notes
KWP seed/key	0x3E01	4	0x58D8C848	Two bytes seed, followed by two bytes key
VIN	0x3E22	17		2.0 ECUs don't store VIN. Instead, sometimes there's a wildcard that narrows the VIN down to Tiburon models, sometimes it's just 'xxxxxxxxxxxxxxxxx'
Socket	0x3F70	2	0x5539 (ASCII: U9)	Value from the small sticker usually located on the ECU socket. Click for example with "U9" label
ECU family	0x3F80	8	0x3557593139323341 (ASCII: 5WY1923A)	In short - ECU hardware variant from the main label. For more in-depth analysis, see ECU family
Serial number	0x3F8A	50	0x2D31303831303336 3236322D484D4330 3830333130303630 39323931384B5237 3730323736303442 2D4B523737303235 3036	This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
Date (YYMMDD)	0x3F98	6?	0x303830333130 (ASCII: 080310 - 2008, March 31st)	Production/first flash date. This might/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified.

Adaptive values

This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)

Program code (32kByte)

This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs

Calibration zone

Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" reefers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)

Name	Offset	Size	Example	Notes
Chassis identifier	start	8	0x4B394E3756533041 (ASCII: K9N7VS0A)	Siemens calls it "calibration version" (confusing, I know)
Calibration version (#1 occurence)	start + 0x8	6	0x363535303239 (ASCII: 655029)
Calibration checksum initial value	start + 0xC	2	0x3239 (ASCII: 29)	Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the initial value for the calibration zone checksum
Calibration version (#2 occurence)	start + 0x40	12	0x63613635353032392E444154 (ASCII: ca655029.DAT)	Siemens calls it "description identifier". Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image. While not confirmed, it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series

Program code

This section contains the program code used for operating the engine