Support for Chinese / Continental EU4 NNN000830 ECUs / MG TF LE500

Download Link: https://andrewrevill.co.uk/Downloads/MEMS3Tools.zip

It had become the accepted position on the internet that the Chinese / Continental NNN000830 ECUs in e.g. the MG TF LE500 cannot be remapped in the way that the earlier MG Rover NNN100743 ECU could. Common statements include:

·         They were designed for one car only and so they don’t support reprogramming.

·         They don’t “like being poked around” like the earlier ECUs.

·         If you do write to them, you will get a checksum error DTC and the fans will misbehave.

Well, I have to tell you, that’s all a load of rubbish! I’ve done quite a bit of investigation of these ECUs, and to be honest they’re really not that different in principle to the earlier MG Rover ECUs. The main difference is that the EEPROM chip used was changed from a 256kB 29F200 to a 512kB 29F400. The 29F400 is reprogrammable in exactly the same way as the 29F200 was. There are just a few differences that you need to understand. If you try to program these ECUs without taking the differences into account, just pretending they are MG Rover ECU, that’s what leads to the reported problems.

MEMS3 Mapper now fully supports NNN00830. All of the features available with NNN100743 are now available with NNN000830. They all work in exactly the same way.

Because of the architectural changes, there are two version of MEMS3 Mapper (each available in 32-bit and 64-bit builds). You’ll find all of these in the ZIP file if you download the latest version of my tools:

·         Mems3Mapper.32.exe / Mems3Mapper.64.exe – These are the original EU3 build and support MG Rover EU3 ECUs.

·         Mems3Mapper.EU4.32.exe / Mems3Mapper.EU4.64.exe – These are the new EU4 build and support Chinese EU4 ECUs.

So What Exactly Has Changed?

The significant differences I have found are:

·         The 29F200 changes to a 29F400.

·         This has a different sector map, so the address map changes. Different locations and sizes for different areas.

o   Boot loader remains at $100000-$10FFFF (64kB).

o   Firmware size increases from $110000-$139FFF (168kB) to $110000-$16FFFF (384kB, +216kB).

o   Map moves from $13C000-$13FFFF (16kB) to $170000-$177FFF (32kB, +16kB).

o   VIN coding moves from $13A000 to $10C000.

o   ZCS coding moves from $13B000 to $10A000.

§  These changes appear to be aimed to increase security.

§  The coding is moved into the protected boot loader sector.

§  This means it’s no longer possible to read the coding record history, only the most recent coding through a message interface.

§  Coding history cannot normally be erased without wiping out the boot loader.

§  MEMS3 Mapper does have an Unrestricted Read wizard, which allows all areas including the coding to be read.

§  MEMS3 Mapper does allow the boot sector to be re-flashed, which erases the coding history.

o   The remaining sectors of the EEPROM $178000-$180000 (32kB) appear to be unused.

·         The map checksum constant, to which all Word values in the map sector should add up, changed from $A5A5 to $C5A5.

·         Diagnostic data in RAM moved down from $1B00 to $1900.

There are a lot of other detailed differences in the firmware, but to be honest these were just the normal evolution of features and no fundamental changes.

So long as you take the above changes into account, NNN000830 can be read, written and remapped just like any other MEMS3 ECU without triggering the checksum DTC or fan issues.

What Can MEMS3 Mapper Do?

The software is a FREE DOWLOAD. All you need to buy is a cheap VAG COM cable (e.g. £5 on eBay).

For those not familiar with some of the things that MEMS3 Mapper can now do, here are some of the highlights:

·         Read / write / edit / verify maps.

o   Interactive 3D graphs for tables.

o   Automatic checksum correction.

o   Fail-safe write, no bricking if write fails or is interrupted.

o   Many tables and scalars identified and described, list growing all the time.

·         Read / write / verify firmware.

o   Standard or modified firmware versions.

o   Many firmware custom patches and wizards available.

o   Fail-safe write, no bricking if write fails or is interrupted.

·         Read / write boot loader.

o   Fail-safe during write, no bricking if write fails or is interrupted.

o   Automatic reversion attempt on reflash failure.

·         Custom firmware patches for:

o   Dual maps. Live switching with the engine running.

o   Live mapping on the rolling road with the engine running.

§  Live display of table usage.

§  Live editing of table and scalar data.

·         ECU Tools.

o   Set fuel adaptation.

o   Clear fuel adaptations.

o   Clear flywheel adaptations.

o   Clear diagnostic information.

o   Learn idle deadband positions.

o   Learn immobiliser code.

o   Service adjustments.

o   VIN coding.

o   ZCS coding. With built-in checksum calculator.

o   Live diagnostics.

§  Full T4 set of live parameters plus more (100+).

§  High speed data logging mode.

§  Read freeze frames.

§  Live DTCs.

§  Live dashboard display with analog and digital instruments and LEDs.

o   Bricked ECU recovery.

o   Read & Save RAM / CAN chip / module registers / boot loader / serial EEPROM.

o   Write serial EEPROM.

o   Erase firmware / map / serial EEPROM.

·         Wizards

o   Downstream lambda delete. No DTCs or MIL light.

o   Overrun fuel cutoff delete.

o   Firmware immobiliser delete. Works even with BMW EWS 3.D security.

o   Injector swap.

o   MAP sensor scaling.

o   Flywheel trigger pattern.