17/06/2020
Understanding MEMS Mapper EU2 and ECU Compatibility
The world of automotive ECU (Engine Control Unit) remapping has seen significant advancements, particularly with the development of sophisticated tools like MEMS Mapper. For enthusiasts and mechanics looking to tune or customise older Rover and Land Rover models, understanding ECU compatibility is paramount. This article delves into how MEMS Mapper EU2 specifically verifies and facilitates the remapping of Rover MEMS 2J and Land Rover Td5 MSB ECUs, systems that were not originally designed for easy modification via the OBDII port.
Andrew Revill's MEMS Tools suite has undergone a substantial evolution. Initially focused on MEMS3 ECUs, the latest iteration, now simply called MEMS Mapper, offers distinct EU2, EU3, and EU4 versions. The EU2 versions are specifically engineered to interact with the Rover MEMS 2J and Land Rover Td5 MSB ECUs. While earlier versions provided diagnostic and data reading capabilities, they lacked the ability to meaningfully edit and rewrite the ECU's map. The new MEMS Mapper EU2 bridges this gap, offering a comprehensive suite of tools for reading, writing, and remapping these specific ECUs, bringing their customisation potential almost on par with their MEMS3 counterparts.
Key Features and Functionality of MEMS Mapper EU2
MEMS Mapper EU2 provides an extensive range of functionalities for the supported ECUs:
- Read / Write / Erase Firmware & Map: This core functionality allows for the complete management of the ECU's software. Crucially, it includes fail-safe, resumable, and brick-proof writing, along with recovery options for 'bricked' ECUs.
- Serial EEPROM Operations: The tool can read, write, and erase data from the ECU's serial EEPROM, which often stores configuration and immobiliser data.
- RAM and Register Access: Users can read and save the ECU's RAM contents and module registers, valuable for in-depth diagnostics.
- Boot Loader Management: The ability to read and write the boot loader is essential for the remapping process.
- Advanced Customisation: MEMS Mapper EU2 supports features like dual map switching (with live switching based on various inputs such as throttle position, launch control, or OBDII data), immobiliser deletion, seed key unlocking, and adjustments for injector swaps, MAP sensor swaps, and flywheel trigger patterns.
A significant difference compared to MEMS3 ECUs is that in EU2 ECUs, the map data is often embedded within the same ROM sector as the firmware. This means that firmware and map updates are performed as a single operation, with a single checksum and verification procedure covering both. MEMS Mapper EU2 handles this seamlessly.
Architectural Challenges and Solutions for Remapping EU2 ECUs
The primary hurdle in making the Rover MEMS 2J and Land Rover Td5 MSB ECUs remappable was their original hardware architecture. Unlike later EU3 ECUs which used EEPROM with manageable sectors for boot loaders, EU2 ECUs typically employed One-Time-Programmable (OTP) ROM chips (AT27C1024). These chips, once programmed at the factory, could not be erased or rewritten. Furthermore, they lacked a dedicated boot loader, which is crucial for facilitating in-circuit programming.
To overcome this, a critical hardware modification is required: replacing the OTP ROM chip with a compatible 1 Mbit EEPROM, specifically the AT29C1024. This chip is pinout compatible, operates on a 5V supply, and crucially, supports in-circuit programming with a granular sector structure. This structure allows for individual sectors to be erased and rewritten, a prerequisite for implementing a boot loader.
The second major challenge was the absence of a boot loader. Andrew Revill developed a custom boot loader from scratch, written in 68000/CPU32 assembly language. This boot loader communicates using a subset of the ISO14230 / KWP2000 protocol, ensuring compatibility with the MEMS Mapper software. The boot loader is strategically placed in the ECU's memory map to initialise the ECU upon startup, allowing it to then decide whether to execute the original firmware or to enter a programming mode controlled by MEMS Mapper. To achieve this, the ECU's memory map is carefully rearranged. The boot loader's vector table resides at the beginning of the EEPROM, overwriting the original firmware's vector table. The original firmware's vector table is then relocated, and a small patch ensures the CPU correctly points to the new location. This careful memory management allows the boot loader to operate without requiring extensive modifications to the original firmware code itself.
ECU Modifications: The Necessary Steps
For an EU2 ECU to become remappable, it necessitates a physical hardware modification. This involves:
- EEPROM Replacement: The original OTP ROM chip (AT27C1024) must be desoldered and replaced with an AT29C1024 EEPROM chip.
- Boot Loader Installation: The custom boot loader software, developed by Andrew Revill, needs to be programmed onto the new EEPROM. This is typically done using a dedicated chip programmer, such as the XGecu T56 with an appropriate adapter.
These modifications enable the ECU to accept new firmware and map data via the K-Line (OBDII) interface using the MEMS Mapper EU2 software.
Using MEMS Mapper EU2: A Practical Guide
The process of using MEMS Mapper EU2 is designed to be intuitive, mirroring the workflow for MEMS3 ECUs.
Reading ECU Data
1. Connect: Connect the MEMS Mapper EU2 software to the modified ECU via the OBDII port.
2. Read: Click the 'Read' button. Unlike MEMS Mapper EU3, there's no option to read firmware and map separately; they are always read together in EU2 ECUs. The software will indicate that EU2 ECUs only support 1x speed reading and writing due to filtering on the K-Line.
3. Save: Once the read is complete, you will see an 'About Project' dialog confirming the data. Save this file for editing.
Editing and Writing Data
1. Edit: Open the saved file in MEMS Mapper EU2. You can edit various tables, scalars, and other parameters as needed.
2. Write: When ready to flash the modified data back to the ECU, click the 'Write' button. Note: This step is only possible on modified, remappable ECUs; attempting to write to a stock EU2 ECU will fail.
3. Patching: If the file was read from a stock ECU, MEMS Mapper EU2 will offer to automatically apply necessary patches for boot loader compatibility. If the file is already patched or came from a modified ECU, this step is bypassed. Click 'Patch' to proceed if required.
4. Writing Process: Again, firmware and map are written together. The software includes options for clearing adaptations, automatically verifying the write, clearing diagnostic trouble codes (DTCs), and learning the immobiliser code.
5. Map Selection: If the original ECU had multiple factory maps, MEMS Mapper EU2 defaults to the first map upon writing. You can change this selection later using the 'Tools | ECU Tools | EU2 Map Selection' menu.
6. Confirmation: A successful write is confirmed with another 'About ECU' dialog.
Immobiliser Deletion
Deleting the immobiliser on MEMS 2J ECUs is straightforward:
- Read the ECU data.
- Navigate to 'Tools | Wizards | Immobiliser Delete (Map Flag)' and check 'Delete Immobiliser Functionality'.
- Alternatively, manually change the 'Immobiliser Delete Flag' scalar from 0 to 1 in the Scalars tab.
- Write the modified file back to the ECU.
Dual Map Switching
MEMS Mapper EU2 enables dual map switching, allowing live changes between two maps:
- Select 'Tools | ECU Tools | Install Map Switch Patch'.
- Choose an available input pin on the ECU that is not currently in use. Connector pinout diagrams are available within the software for guidance.
- If the ECU has two native maps, the patch switches between them. If it has only one, a second map is installed.
- To switch between maps within the software project, use 'Tools | Project Tools | Switch Maps' or Ctrl-P.
Technical Deep Dive: Boot Loader and Firmware Patches
The functionality of MEMS Mapper EU2 relies on sophisticated low-level programming and memory management:
Boot Loader Technical Details
The core of the remapping capability lies in the custom boot loader. It's designed to take control of the ECU immediately after a reset. This is achieved by placing the boot loader's vector table at the very beginning of the memory map ($000000), where the ECU expects to find the initial stack pointer and program counter. The original firmware's vector table is relocated to a different address ($100400), and a crucial patch ensures the Vector Base Register (VBR) is updated to point to this new location. This allows the firmware to run normally, unaware that its initialisation routine has been intercepted.
The boot loader code itself is allocated a specific section of the ROM ($11E800-$11FFFF). The critical factor is that the boundary between the boot loader's vector table and the relocated firmware vector table must align with an EEPROM sector boundary. The AT29C1024's 256-byte sectors facilitate this, with the boot loader vectors occupying the first four sectors ($100000-$1003FF).
The boot loader communicates using a carefully implemented subset of ISO14230 / KWP2000. This includes support for the ISO fast initialisation sequence, timeouts, and the correct message structure, format bytes, and checksums. This ensures seamless communication between the MEMS Mapper software and the ECU, regardless of whether it's running the boot loader or the firmware.
Checksum Technical Details
A key aspect of ensuring compatibility is the checksum calculation. The ECU's firmware calculates checksums over the entire ROM space. To reconcile this with the boot loader's presence, the boot loader areas are programmed such that their checksum, when filled with $FF bytes, matches the checksum of the boot loader code itself. This ensures that MEMS Mapper EU2 and the ECU's internal verification routines agree on the integrity of the firmware, even with the boot loader present.
Firmware Patch Technical Details
MEMS Mapper EU2 automatically applies necessary patches to the stock firmware to ensure compatibility with the boot loader. These patches primarily address how the firmware remounts the ROM chip during startup. Two methods are observed:
- Rover MEMS 2J: Uses a "dirty trick" involving prefetching the next instruction to execute after the ROM relocation. This is a compact but somewhat fragile method.
- Land Rover Td5 MSB: Employs a cleaner approach by copying a small subroutine from ROM to RAM, executing it from RAM to handle the ROM relocation, and then returning to the relocated ROM code.
The second method, while cleaner, can conflict with the boot loader's memory management, as the boot loader already handles the initial ROM relocation. MEMS Mapper EU2 patches out the RAM subroutine call in these cases, ensuring the boot loader's initialisation sequence is not disrupted.
Frequently Asked Questions
Q1: Can I remap my stock Rover MEMS 2J or Land Rover Td5 MSB ECU without modification?
No. These ECUs use OTP ROM and lack a boot loader, making them non-rewritable without hardware changes. You must replace the ROM with an EEPROM and install a boot loader.
Q2: What hardware modification is required?
The original OTP ROM chip needs to be replaced with a compatible EEPROM chip (AT29C1024), and a custom boot loader must be programmed onto it.
Q3: How does MEMS Mapper EU2 check for compatibility?
MEMS Mapper EU2 relies on the presence of the custom boot loader and the necessary firmware patches. It verifies that the boot loader's memory regions are correctly programmed and that the firmware's memory access routines are compatible with the boot loader's initialisation sequence.
Q4: Is it possible to brick my ECU during the remapping process?
MEMS Mapper EU2 is designed with fail-safe, resumable, and brick-proof writing mechanisms. However, as with any ECU modification, there is always a small inherent risk. Following the procedures carefully and ensuring a stable power supply is crucial.
Q5: Can I switch between different maps on the fly?
Yes, MEMS Mapper EU2 supports dual map switching. This can be configured using various input signals, allowing for live switching of engine maps while the engine is running.
Q6: What are the main differences between MEMS Mapper EU2 and EU3?
The primary difference lies in the ECUs they support. EU2 is for Rover MEMS 2J and Land Rover Td5 MSB, which require hardware modification and a boot loader. EU3 is for Rover MEMS3 and Land Rover Td5 NNN, which are generally more easily remappable without physical ECU changes.
In conclusion, MEMS Mapper EU2 represents a significant leap in making older, less accessible ECUs like the Rover MEMS 2J and Land Rover Td5 MSB remappable. By understanding the necessary hardware modifications and the sophisticated software solutions employed, users can unlock the full potential of their vehicles' engine management systems.
If you want to read more articles similar to MEMS Mapper EU2: ECU Compatibility Explained, you can visit the Automotive category.