The Ultimate Rover MEMS3 Remapping Toolkit

For Rover enthusiasts and mechanics alike, the prospect of optimising engine performance and customising ECU behaviour has long been a pursuit. The Rover MEMS3 ECU, a staple in many beloved models, offers a remarkable degree of flexibility, provided you have the right tools. Thankfully, a comprehensive and, crucially, free suite of tools has emerged, empowering owners to delve deep into their ECU's capabilities. This article explores the innovative 'MEMS Tools' by Andrew Revill, offering an unparalleled insight into remapping, cloning, and advanced diagnostics for your Rover MEMS3.

Introducing the MEMS Tools Suite: Your Gateway to ECU Mastery

At the heart of this revolution is Andrew Revill's 'MEMS Tools' suite, a collection of applications designed to interact with the Rover MEMS3 ECU. What truly sets these tools apart is their accessibility: they are provided completely free of charge. All you need to acquire is a readily available and inexpensive VAG COM KKL 409.1 cable, or a similar OBDII interface, which can be found for a few quid on online marketplaces. These tools run seamlessly on Windows XP or later, supporting both 32-bit and 64-bit systems.

The suite comprises three primary applications, each serving a distinct, yet interconnected, purpose:

• MEMS Mapper: The flagship tool for comprehensive remapping, including live mapping, dual map support, and crucial ECU recovery functions.
• MEMS3 Flasher: A simpler, yet incredibly powerful, utility for reading, writing, and cloning entire ECUs.
• MEMS3 Terminal: Designed for monitoring, decoding, and logging OBDII communications, providing invaluable diagnostic insights.

This integrated approach means that whether you're looking to fine-tune your engine's performance, back up your ECU's software, or diagnose complex issues, the MEMS Tools suite has you covered.

MEMS Mapper: Precision Remapping and Beyond

MEMS Mapper stands as the pinnacle of the suite, offering full support for remapping the Rover MEMS3 ECU. Its capabilities extend far beyond simple file flashing, venturing into advanced functionalities previously reserved for professional tuning houses.

Key Capabilities of MEMS Mapper:

• Full Remapping Support: Gain granular control over critical engine parameters, allowing for custom tunes tailored to your vehicle's modifications or desired performance characteristics. This includes control over target AFRs (Air-Fuel Ratios), open/closed loop control, fuelling adjustments, ignition timing, overrun pop and crackle, idle air control valve (IACV), and rev limiter settings.
• Live Mapping: This groundbreaking feature allows for remapping with the engine running, providing immediate feedback on changes and enabling highly precise tuning.
• Dual Maps with Live Switching: A fantastic innovation that allows you to store two different maps on your ECU and switch between them on the fly. This is particularly useful for those who might want a performance map for track days and a more economical or standard map for daily driving. This functionality has been extended to Rover K-Series and Land Rover Td5 engines, and even on tighter ECUs like the MG ZT Turbo via specific firmware memory map extensions.
• Reliable ECU Recovery: A significant safety net, MEMS Mapper includes a utility specifically designed to reliably recover a 'bricked' ECU without requiring physical disassembly.
• Seed Key Unlock: Addresses the security mechanism protecting the ECU, allowing for proper access and modification. The developer has even published the Pascal algorithm for deriving the seed key, demystifying this crucial step.
• Downstream Lambda Delete: Essential for those running decat (catalytic converter delete) setups, preventing diagnostic trouble codes (DTCs) and the dreaded 'check engine' (MIL) light.
• Firmware Immobiliser Delete: Offers solutions for common immobiliser issues, including support for Rover 75 / MG ZT / Freelander BMW EWS 3.D systems.
• VVC Response Sharpening: Specifically for Variable Valve Control (VVC) engines, this allows for quicker response from the VVC mechanisms.
• TestBook T4 Level Support: Provides diagnostic and programming capabilities akin to the original main dealer tools.
• High Speed Data Logging and Live Dashboard: Monitor real-time engine parameters, log data for analysis, and visualise performance through a live dashboard.
• Factory Wiping a MEMS3 ECU: Allows an ECU to be reset to a state where a TestBook T4 system will recognise it as a new unit.
• Support for Various ECU Families: While primarily focused on MEMS3, MEMS Mapper also offers full remap capabilities for Rover MEMS 2J and Land Rover Td5 MSB ECUs. It supports a wide range of MEMS3 variants, including early Rover 75 / MG ZT / NNN100682 ECUs and later Chinese / Continental EU4 NNN000830 ECUs / MG TF LE500.

MEMS3 Flasher: Effortless ECU Cloning and Programming

For those needing to copy, backup, or simply write new software to their ECU, the MEMS3 Flasher tool is indispensable. It simplifies a process that was once complex and invasive, making it accessible to the average enthusiast.

The Evolution of ECU Cloning:

Historically, cloning a Rover MEMS3 ECU involved a cumbersome process: dismantling the ECU, physically removing memory chips, and reprogramming them externally. This method was not only time-consuming but also carried significant risks of damaging the delicate components. Andrew Revill's breakthrough with MEMS Flasher eliminates these hurdles, enabling full firmware and map cloning directly through the OBDII port.

What MEMS3 Flasher Does:

MEMS3 Flasher allows you to copy the complete firmware and map from one MEMS3 ECU to another, provided they have the same part number or compatible hardware (specifically, the NNN part number should match for guaranteed compatibility, though some flexibility exists, e.g., between NNN000100 and NNN000160 ECUs). This means you can easily create a backup of your current ECU, or even clone a high-performance ECU (like a Supersport unit) onto a cheaper, standard Rover ECU bought off eBay.

Unlike simpler tools (e.g., Galletto), MEMS Flasher transfers the *full operating firmware* alongside the map data. This is crucial because each map is designed to work with a specific firmware version. MEMS Flasher automatically checks for firmware compatibility, preventing the flashing of incompatible maps that could 'brick' your ECU – a common pitfall with less sophisticated tools.

Hardware Requirements:

As with the entire suite, the only specific hardware required is a VAG-COM KKL 409.1 USB diagnostic cable. It's important to note that cables claiming to use an ELM327 chip or certain Galletto flasher cables are *not* compatible. The cable typically installs as an FTDI Direct device or a Windows COM serial port.

Using the MEMS Flasher Tool: A Step-by-Step Guide

The MEMS Flasher application is designed for simplicity. It's a standalone .EXE file, requiring no complex installation. Its interface is straightforward, mirroring a classic EPROM programmer with 'Read', 'Write', 'Save', and 'Load' functions.

Basic Steps:

1. Cable Installation: Install the drivers for your FTDI cable as per its instructions.
2. Connect to ECU: Crucially, plug the OBDII cable into the car and laptop *before* turning on the ignition. The ECU performs a connection check at power-on, and if nothing is connected, it may refuse to communicate. If this happens, cycle the ignition off for 10 minutes, briefly disconnect the smaller ECU plug, or pull the 30A ECU fuse to reset it.
3. Run Application & Select Connection: Launch MEMS Flasher, then select your OBDII cable (FTDI Direct Device or COM Serial Port) and the appropriate protocol (Rover BMW 9600 Baud or ISO 14230-2 / KWP2000 are recommended).
4. Turn On Ignition & Check Connection: Turn on the ignition. Use the 'About' button to confirm communication with the ECU, displaying VIN, Part Number, Firmware ID, etc.
5. Read the ECU: Click 'Read'. You can choose to read just the map (quicker, but only compatible with the same firmware version) or the full firmware and map (more versatile for cloning). A full read takes about 4 minutes 19 seconds. The data is checksum-protected and highly robust.
6. Save Data: Save the read data as a .BIN file. The default 'MEMS Flasher 192KB' format is suitable for full firmware and map.
7. Write to ECU: To write, open a previously saved file (if applicable), then click 'Write'. You can choose to write the full firmware and map, or just the map. The application will verify firmware compatibility if only writing the map.

Important Writing Options:

• Clear Adaptations: Recommended for modified maps, this clears learned fuelling parameters.
• Automatically Verify ECU: Performs a read after writing to confirm data integrity.
• Clear Diagnostic Information: Clears DTCs when writing firmware.
• Learn Immobiliser Code: Clears and relearns immobiliser coding when writing firmware, ensuring compatibility.

Writing a map takes about 46 seconds (including verification), while a full ECU write takes just over 8 minutes. The ECU will reboot upon completion.

Robustness and Risks: Minimising 'Bricking'

A common fear when flashing ECUs is the risk of 'bricking' – rendering the unit unusable. Andrew Revill has invested significant effort into making the MEMS Flasher incredibly robust and fail-safe. Extensive testing, including deliberate interruptions (turning off ignition, pulling cables, killing the application), has shown that the latest code ensures the ECU remains in a recoverable state. In almost all cases, if an interruption occurs, you just need to cycle the ignition, reconnect, and hit 'Resume' to pick up where you left off. The ECU will enter a boot loader mode, ready to receive programming instructions, even if it cannot run the engine in its partially written state.

The developer's confidence in the tool is such that he no longer uses modified ECUs with socketed memory chips for recovery, relying solely on the software's inherent robustness.

On Bench or In Car?

MEMS Flasher is designed for in-car reflashing via the OBDII port, which is the easiest method as it guarantees a reliable power supply without needing expensive bench harnesses. However, it can also be used with a simple bench testing harness if preferred.

Supported File Formats:

The tool handles various binary file types, identified by their size:

Hardware Compatibility: NNN Part Numbers

MEMS3 is a modular architecture, meaning the core ECU is common across many models, but additional hardware modules may vary. The NNN part number typically relates to the physical hardware, while the NNW relates to the firmware. For safe cloning, sticking to ECUs with the same NNN part number is recommended, though some cross-compatibility exists (e.g., NNN000100 and NNN000160). Flashing incompatible firmware (e.g., VVC onto a Freelander ECU) has been tested and found to be recoverable, demonstrating the tool's robustness.

Behind the Scenes: The Technical Ingenuity

The development of MEMS Tools involved significant reverse engineering and technical prowess. Understanding how the ECU communicates, stores data, and protects its integrity was key to creating these robust tools.

Communication Protocols:

The ECU supports several protocols, though not always strictly adhering to standards:

• ISO 9141-2: Primarily for OBDII scanners, operating at 10400 baud. Less reliable for flashing with FTDI cables.
• Native Protocol (Rover BMW 9600 Baud): Similar to KWP2000, but with different addressing. Used for Rover Testbook tools. This is one of the reliable protocols for MEMS Flasher.
• ISO 14230-2 / KWP2000: Adheres more closely to standards, 10400 baud, uses a 'fast-initialisation' signal. Also a reliable protocol for the tools.

The developer focused on the native and KWP2000 protocols due to their reliability for flashing operations.

Memory Map and Data Storage:

The MEMS3 ECU utilises a 29F200 EEPROM chip, divided into sectors for different data types:

• Boot Loader (64KB): Permanent, cannot be overwritten by the tool.
• Firmware (168KB): The ECU's operating software.
• Coding (8KB): Contains VIN and Part Variant. Not directly writable via the tool for security reasons, but informational only.
• Map (16KB): The engine tune parameters.

Runtime data like DTCs, adaptations, and immobiliser coding are stored in a separate 93C66 serial EEPROM chip, accessed via higher-level OBDII commands. The tools implement workarounds to clear these when flashing new firmware or maps.

Checksums: Ensuring Data Integrity

The firmware and map areas are protected by checksums – mathematical operations that verify data hasn't been corrupted or tampered with. The tools automatically check and correct checksums when loading, saving, or writing files, preventing the ECU from running with invalid data. This is a critical feature for safe and reliable flashing.

Seed Key Algorithm: Unlocking Security

The ECU employs a seed key security system. To gain access, the ECU provides a 'seed' number, which must be processed by a secret algorithm to generate a 'key'. This key is then returned to the ECU to unlock security access. Andrew Revill successfully reverse-engineered this algorithm, making it publicly available and enabling users to fully unlock their ECUs for programming.

function SeedToKey(ASeed: Word): Word; var I: Integer; begin Result:=0; I:=1; if Odd(ASeed shr 15) then Inc(I, 8); if Odd(ASeed shr 7) then Inc(I, 4); if Odd(ASeed shr 4) then Inc(I, 2); if Odd(ASeed) then Inc(I); for I:=I DownTo 1 do begin Result:=(((ASeed shr 1) and $FFFE) or Ord(not(Odd(ASeed shr 13) and Odd(ASeed shr 3)))) and $7FFF; if Odd(ASeed shr 9) xor Odd(ASeed shr 8) xor Odd(ASeed shr 2) xor Odd(ASeed shr 1) then Result:=Result or $8000; ASeed:=Result; end; end; 

Boot Mode and Diagnostic Sessions:

The ECU can be put into a 'programming diagnostic session' to enter boot mode, allowing the firmware to be overwritten. In this mode, the boot loader code executes, and engine management functions are suspended, ensuring safe programming without interference.

Future Plans and Community Contributions

The developer's ongoing commitment includes building a library of Caterham maps (especially special editions like Supersport ECUs), allowing them to be recreated on standard MEMS3 units. The ultimate goal is to make the MEMS3 ECU properly remappable, with comprehensive control over all key engine parameters. The work is largely complete, with a more comprehensive remapping application being the next step.

A special thanks is extended to James Portman at rovermems.com for his invaluable research and support on earlier ECU families, demonstrating the collaborative spirit within the Rover enthusiast community.

Frequently Asked Questions (FAQs)

Can I clone a Rover MEMS3 ECU?

Yes, absolutely! The MEMS3 Flasher tool is specifically designed to clone the complete firmware and map from one MEMS3 ECU to another. This means you can create backups, or even transfer the software from a higher-spec ECU (e.g., a Supersport) onto a standard, cheaper ECU, provided they have compatible hardware (same NNN part number).

What cable do I need to use these tools?

You only need a standard, inexpensive VAG COM KKL 409.1 USB diagnostic cable. These are widely available online. Crucially, avoid cables that claim to use an ELM327 chip or certain Galletto flasher cables, as they are not compatible.

Is it safe to remap or flash my ECU with these tools?

The tools have been developed with a strong emphasis on robustness and fail-safety. Extensive testing has been performed to minimise the risk of 'bricking' your ECU. Even if a write operation is interrupted (e.g., by losing power or disconnecting the cable), the ECU is designed to remain in a recoverable state, allowing you to resume the operation. However, as with any ECU work, it's always advisable to ensure a stable power supply and follow instructions carefully.

Does MEMS Mapper support all MEMS3 ECUs?

Yes, MEMS Mapper fully supports all Rover MEMS3 ECU families. It also extends its capabilities to other ECU families like Rover MEMS 2J and Land Rover Td5 MSB, supporting the specific features of each.

What if my ECU gets 'bricked' during the process?

The developer has put significant effort into ensuring that even if an operation is interrupted, the ECU will remain in a state where it can communicate with the tools. In most cases, you simply need to cycle the ignition off and on, ensure connections are secure, and then use the 'Resume' function in the MEMS Flasher application to complete the process. The ECU will drop back into its boot loader and wait for programming instructions.

Are these tools really free?

Yes, the 'MEMS Tools' suite is provided completely free of charge. You only need to purchase the inexpensive VAG COM KKL 409.1 cable.

Conclusion

The 'MEMS Tools' suite by Andrew Revill represents a significant leap forward for Rover MEMS3 ECU management. By offering powerful remapping, cloning, and diagnostic capabilities for free, combined with a focus on user-friendliness and robustness, it empowers enthusiasts and professionals alike to take unprecedented control over their vehicles. Whether you're aiming for performance gains, solving persistent immobiliser issues, or simply creating a vital ECU backup, these tools provide a reliable and accessible solution. Dive in and unlock the full potential of your Rover.

If you want to read more articles similar to The Ultimate Rover MEMS3 Remapping Toolkit, you can visit the Tuning category.