ECU flashing service

Toyota and Lexus speed limiter removal on Denso GEN 3 and GEN 4 (SPL OFF)

SPL Off — software deactivation of the speed limiter, allowing the vehicle’s factory-set speed limit to be removed

SPL OFF: removing the speed limiter in Toyota Denso GEN 3 and GEN 4 software

SPL OFF removes the factory top speed limit from the software of Toyota and Lexus vehicles with Denso GEN 3 and GEN 4 ECUs, petrol and diesel. In practice it is the same job as VMAX OFF, done for a different platform. For tuners: send us the original file and get a ready-to-flash file with corrected checksums, on average in 30–60 minutes.

Why Toyota ECUs with Denso GEN 3 and GEN 4 have their own option

Third and fourth generation Denso ECUs in Toyota and Lexus vehicles are built on Renesas RH850 processors. A GEN 3 file is 4 MB and a GEN 4 file is 8 MB. Their software and its protection work differently from Bosch or Continental units, so removing the limit on these ECUs is a separate item in the option list.

The limiting logic itself is the same as on other ECUs: the unit knows the vehicle speed and stops delivering power at the factory mark. How that works, where else the limit can be stored and why removing it adds no power is covered on the VMAX OFF page. What follows is specific to Denso.

Where the 180 km/h limit on Japanese cars comes from

Cars built for the Japanese domestic market are traditionally limited to 180 km/h, and kei cars to 140 km/h. No law requires this. It is a voluntary rule of the Japan Automobile Manufacturers Association (JAMA), and imported cars in Japan usually do not have such a limiter.

If a Toyota or Lexus came from the Japanese market, the limit is usually set at 180. Cars for other markets have their own figure, depending on the model and engine. So in the order, tell us the speed the car currently tops out at and which market it was built for.

What to know about Denso GEN 3 and GEN 4 files

Denso GEN 3 and GEN 4 files: what is edited and what is recalculated A GEN 3 file is 4 MB and in some dumps consists of two identical 2 MB halves; the speed limit is edited in both. A GEN 4 file is 8 MB. After the edit the CRC32 is recalculated, on GEN 3 the AES signature as well, and the file is ready to flash. GEN 3 · 4 MB file bank 0 · 2 MB bank 1 · 2 MB some dumps hold two identical 2 MB copies, both must be edited GEN 4 · 8 MB file full flash image original 4 or 8 MB edit the limit CRC32 recalculated AES signature (GEN 3) ready to flash speed limit, position for illustration only
Diagram, not an address map. The AES signature is shown for GEN 3: it is recalculated together with the CRC32.
  • The full file is needed. Editing and recalculating the protection takes the whole flash image: 4 MB for GEN 3 and 8 MB for GEN 4. A truncated file or the calibration area alone will not do.
  • Two copies. In some dumps the file consists of two identical halves: two 2 MB flash banks holding the same program. The edit goes into both, otherwise the change can disappear when the ECU switches to the other copy.
  • Protection. Besides the CRC32 checksum, a GEN 3 file carries a cryptographic AES signature. After any edit both are recalculated, otherwise the ECU will not accept the file. That is why a quick patch in a hex editor does not work here.
  • Reading. Via OBD or on the bench, depending on what your tool supports for this ECU. Keep the complete original: you will need it to return the car to stock.

Choose SPL OFF

  • Toyota or Lexus.
  • Denso GEN 3 ECU (4 MB file) or GEN 4 (8 MB file).
  • Petrol or diesel engine.

Choose VMAX OFF

  • ECUs from Bosch, Continental, Delphi and other makers.
  • Supported ECUs are listed on the VMAX OFF page.
  • Not sure which generation you have? Send the file with a request and we will advise.

What changes in the file

Only the factory top speed limit changes: it is raised above what the car can reach. Power, torque and the rest of the calibration stay stock, and the limits for overheating and faults work as before. Checksums are recalculated, so the file is ready to flash straight away.

Before the car goes back to the customer, check the tyre speed rating: it must be no lower than the new top speed. Under European rules winter tyres may be rated below the car's top speed, but then a sticker with their limit goes inside the car.

How to order

  1. Read the full ECU file, 4 or 8 MB, with a tool that supports your ECU. Keep the original.
  2. Upload it to the portal and select SPL OFF. Tell us the speed the car currently tops out at and which market it was built for.
  3. Get the finished file with recalculated checksums, on average within 30–60 minutes.
  4. Flash the file and check the result on a closed course only.

Your ECU is not in the list below? Send the file with a request and we will check whether there is a solution for it.

Driving above the factory limit is only acceptable where the rules allow it: on a track or a closed course, on tyres with a suitable speed rating and with sound brakes. Removing or readjusting the mandatory limiters of trucks and buses is illegal, and the service is not intended for that. Responsibility for using the file lies with the vehicle owner.

Already have the file? Upload it to the portal and select SPL OFF, the finished file arrives on average in 30–60 minutes.

Order SPL OFF

Supported ECUs for the SPL OFF service

2 blocks · 1 brand vehicles

Frequently asked questions

How is SPL OFF different from VMAX OFF?

The job is the same: both remove the factory speed limit. SPL OFF is a separate item for Toyota and Lexus with Denso GEN 3 and GEN 4 ECUs, which have their own file format and protection.

Which vehicles is SPL OFF for?

Toyota and Lexus with Denso GEN 3 (4 MB file) and GEN 4 (8 MB file) ECUs, petrol and diesel. If your ECU is not in the list, send the file with a request.

Why are Japanese cars limited to 180 km/h?

It is a voluntary rule of the Japan Automobile Manufacturers Association (JAMA) for domestic-market cars, not a legal requirement. Kei cars are limited to 140 km/h.

Can I send just the calibration instead of the full file?

No. Editing and recalculating the protection takes the whole flash image: 4 MB for GEN 3 and 8 MB for GEN 4.

Why not just change a few bytes in a hex editor?

A GEN 3 file carries an AES signature on top of the CRC32, and the ECU will not accept the file unless both are recalculated. In some dumps the program is also stored twice, and both copies must be edited.

Does SPL OFF add power?

No. Only the speed limit changes; power and torque stay stock.

Do the tyres matter?

The tyre speed rating must be no lower than the car's new top speed. Check it before the car goes back to the customer.

How long does the file take?

On average 30–60 minutes.

All ECU services

39 control-unit flashing services — choose the next one: