Support for Chinese / Continental EU4
NNN000830 ECUs / MG TF LE500
Download
Link: https://andrewrevill.co.uk/Downloads/MEMS3Tools.zip
It had become the accepted position on the internet that the Chinese / Continental NNN000830 ECUs in e.g. the MG TF LE500 cannot be remapped in the way that the earlier MG Rover NNN100743 ECU could. Common statements include:
· They were designed for one car only and so they don’t support reprogramming.
· They don’t “like being poked around” like the earlier ECUs.
· If you do write to them, you will get a checksum error DTC and the fans will misbehave.
Well, I have to tell you, that’s all a load of rubbish! I’ve done quite a bit of investigation of these ECUs, and to be honest they’re really not that different in principle to the earlier MG Rover ECUs. The main difference is that the EEPROM chip used was changed from a 256kB 29F200 to a 512kB 29F400. The 29F400 is reprogrammable in exactly the same way as the 29F200 was. There are just a few differences that you need to understand. If you try to program these ECUs without taking the differences into account, just pretending they are MG Rover ECU, that’s what leads to the reported problems.
MEMS3 Mapper now fully supports NNN00830. All of the features
available with NNN100743 are now available with NNN000830. They all work in
exactly the same way.
Because of the architectural changes,
there are two version of MEMS3 Mapper (each available in 32-bit and 64-bit
builds). You’ll find all of these in the ZIP file if you download the latest
version of my tools:
·
Mems3Mapper.32.exe / Mems3Mapper.64.exe – These are the original EU3 build and
support MG Rover EU3 ECUs.
·
Mems3Mapper.EU4.32.exe / Mems3Mapper.EU4.64.exe – These are the new EU4 build and
support Chinese EU4 ECUs.
So What Exactly Has
Changed?
The significant differences I have found are:
·
The 29F200 changes
to a 29F400.
·
This has a
different sector map, so the address map changes. Different locations and sizes
for different areas.
o
Boot loader remains
at $100000-$10FFFF (64kB).
o
Firmware size
increases from $110000-$139FFF (168kB) to $110000-$16FFFF (384kB, +216kB).
o
Map moves from
$13C000-$13FFFF (16kB) to $170000-$177FFF (32kB, +16kB).
o
VIN coding moves from
$13A000 to $10C000.
o
ZCS coding moves
from $13B000 to $10A000.
§
These changes
appear to be aimed to increase security.
§
The coding is moved
into the protected boot loader sector.
§
This means it’s no
longer possible to read the coding record history, only the most recent coding
through a message interface.
§
Coding history
cannot normally be erased without wiping out the boot loader.
§
MEMS3 Mapper does
have an Unrestricted Read wizard, which allows all areas including the coding
to be read.
§
MEMS3 Mapper does
allow the boot sector to be re-flashed, which erases the coding history.
o
The remaining
sectors of the EEPROM $178000-$180000 (32kB) appear to be unused.
·
The map checksum
constant, to which all Word values in the map sector should add up, changed
from $A5A5 to $C5A5.
·
Diagnostic data in
RAM moved down from $1B00 to $1900.
There are a lot of other detailed
differences in the firmware, but to be honest these were just the normal
evolution of features and no fundamental changes.
So long as you take the above changes
into account, NNN000830 can be read, written and remapped just like any other
MEMS3 ECU without triggering the checksum DTC or fan issues.
What Can MEMS3 Mapper Do?
The software is a FREE DOWLOAD. All you need to buy
is a cheap VAG COM cable (e.g. £5 on eBay).
For those not familiar with some of the
things that MEMS3 Mapper can now do, here are some of the highlights:
·
Read / write / edit
/ verify maps.
o
Interactive 3D
graphs for tables.
o
Automatic checksum
correction.
o
Fail-safe write, no
bricking if write fails or is interrupted.
o
Many tables and
scalars identified and described, list growing all the time.
·
Read / write /
verify firmware.
o
Standard or
modified firmware versions.
o
Many firmware
custom patches and wizards available.
o
Fail-safe write, no
bricking if write fails or is interrupted.
·
Read / write boot
loader.
o
Fail-safe during write,
no bricking if write fails or is interrupted.
o
Automatic reversion
attempt on reflash failure.
·
Custom firmware patches
for:
o
Dual maps. Live
switching with the engine running.
o
Live mapping on the
rolling road with the engine running.
§
Live display of table
usage.
§
Live editing of
table and scalar data.
·
ECU Tools.
o
Set fuel
adaptation.
o
Clear fuel adaptations.
o
Clear flywheel
adaptations.
o
Clear diagnostic
information.
o
Learn idle deadband
positions.
o
Learn immobiliser
code.
o
Service adjustments.
o
VIN coding.
o
ZCS coding. With
built-in checksum calculator.
o
Live diagnostics.
§
Full T4 set of live
parameters plus more (100+).
§
High speed data
logging mode.
§
Read freeze frames.
§
Live DTCs.
§
Live dashboard
display with analog and digital instruments and LEDs.
o
Bricked ECU
recovery.
o
Read & Save RAM
/ CAN chip / module registers / boot loader / serial EEPROM.
o
Write serial
EEPROM.
o
Erase firmware /
map / serial EEPROM.
·
Wizards
o
Downstream lambda
delete. No DTCs or MIL light.
o
Overrun fuel cutoff
delete.
o
Firmware
immobiliser delete. Works even with BMW EWS 3.D security.
o
Injector swap.
o
MAP sensor scaling.
o
Flywheel trigger pattern.