Last time I wrote about custom code, I was careful to call it a work in progress. The design was done and the code was written, but I did not have a clean, working result in the car, and I said I would not claim otherwise until I did.

Well. It works.

I now have my own code running on the MEG1.1, doing things Bosch never programmed, proven on the car and not just on the bench. This is the update I promised. Four things are working, and they all come down to the same new ability: reading and writing the ECU’s private internal state over the CAN bus, in both directions, whenever I want.

A quick reminder of what “custom code” means

For anyone landing here first, the short version. A normal remap changes the numbers in the ECU’s tables. Custom code changes what the program itself does, by writing new machine code, tucking it into the unused space in the FLASH (the code caves I wrote about last time), and then redirecting the factory code to run it. The last post was the theory. This one is four working examples.

1. RPM injection over CAN

This is the one that started it all, and it is now solid.

The problem it solves: on my car the MEG loses its grip on the crank signal at the top end. Above about 8000 rpm the signal goes marginal, the MEG reads engine speed as zero, decides the engine has stalled, and shuts the throttle. Right when you least want it to.

Every part of the MEG that cares about engine speed reads it from a single value in memory. The fix is to stop the MEG working that value out from the crank sensor, and instead write it there myself, taken live from the MaxxECU over CAN. Override that one value and the entire ECU follows: tacho, gearbox logic, the throttle stall response, all of it.

It tracks the MaxxECU’s own RPM almost perfectly, a correlation of 0.9964, updated as fast as two hundred times a second. And it is built with a dropout watchdog: if the CAN feed ever goes silent, the injected RPM falls back to zero after a fraction of a second, so the MEG safely returns to its normal stall behaviour rather than holding the throttle open on a stale number. That failsafe mattered more to me than the feature itself. Custom code that can hold your throttle open is not something you build casually.

2. Gearbox input shaft speed injection over CAN

Same trick, pointed somewhere new.

The gearbox brain needs to know how fast the transmission input shaft is turning to make its clutch and shift decisions. That value sits in the MEG’s memory the same way engine speed does, and now I can write it over CAN the same way. In a car like mine, where the MEG is sharing duties with a standalone, being able to feed the transmission logic a clean, reliable shaft speed rather than depending on whatever the original sensor path delivers is a real lever on how the auto clutch and gearbox behave.

This one is flashed and running on its own, so I can see its effect in isolation before it joins the rest.

3 and 4. Clutch position and clutch target, broadcast on CAN

These two are the injection trick run in reverse, and they have already earned their keep.

Here was the frustration. The automated clutch is at the centre of the takeoff behaviour I have been chasing for months, but its actual position is not broadcast on the CAN bus anywhere. I could see the clutch state and the requested and actual gear, but not the one thing I needed: where the clutch actually was, moment to moment. K-line diagnostics can read it, but far too slowly to catch anything that moves quickly.

So instead of writing a value in, a small routine now reads two clutch values every loop and pushes them out onto CAN, into two bytes of a frame the MEG already transmits that were sitting there carrying nothing but zeros. No new message, no extra hardware.

The two values are the interesting part:

• Clutch target: what the MEG’s clutch controller is commanding, the number it is trying to hit.
• Clutch position: where the clutch actually is.

Send both, and for the first time I can watch the actuator chase its target and log it right alongside every other channel in the MaxxECU, all on the same timebase.

It paid off straight away. That telemetry is what finally pinned down the cause of the clutch hunting I have been fighting. The commanded target and the engine RPM turned out to be cycling at exactly the same frequency, which points squarely at the integrator inside the clutch delivery law as the source of the oscillation. Months of guessing, answered by being able to see the two numbers move. That is what this telemetry is for.

The bigger picture

Step back from the four features and the real result is simpler than any of them. The MEG’s internal state used to be a locked box. Now I can reach into it over CAN and both read what it is doing and change it. Values in: engine speed, shaft speed. Values out: clutch target, clutch position. Both directions, proven on the car.

That is the foundation everything else is built on. Once you can do that safely and reliably, the list of what becomes possible gets very long.

What is not done yet

In the last post I made launch control the headline. Honesty time: it is still in development. The CAN work above is exactly the groundwork it needs, and it is coming, but I report things here when they work in the car, not before. So launch control stays in the “in progress” column for now, and you will read about it here the day it moves out of it.

As always

None of this is a product you download and flash. It is bespoke, per-car work, and a fair bit of it is at the frontier of what is known about this little ECU. I share the what, and how it works, because I think it is genuinely interesting and because the more of us who understand these things, the better off every Roadster on the road is. The exact how, the addresses and the code, stays between me and the cars I do it on.

If you have been picking at the MEG yourself, or you want this sort of work done on yours, get in touch.

Big thanks as ever to Mike Bailey at 223D Developmental, whose Brabus has its own set of these patches and has done its share of the testing, and to Andrew at Smart Automotive.

More to follow, and for once, sooner rather than later.

Tom South Australia WhatsApp: +61 401 723 903