Toms Turbo Garage

In my last post, I talked about how the MEG 1.1 EEPROM stores critical information like VIN numbers, engine models, immobilizer programming, and SCN coding that determines which maps the ECU uses.

What I didn’t mention is how difficult it’s been to actually see and understand all this data properly. Sure, you can read the EEPROM with the right tools, but interpreting those 256 bytes of hex data? That’s where things get tricky.

The Problem with Existing Tools

Most of the EEPROM analysis tools floating around the Smart community are incomplete fragments – usually old PHP scripts from forums that only decode bits and pieces. You might see the VIN, maybe some basic immobilizer data, but huge chunks of the EEPROM remain mysterious.

This became a real problem for me. When diagnosing ECU issues, swapping units between cars, or understanding why a particular remap wasn’t working properly, I needed to see everything stored in that little 24C02 chip.

I have also tried to avoid spending large sums of money on proprietary or cracked software which still may only give me part of the answers.

What’s Actually Stored in There?

After months of reverse engineering work (with plenty of help from the usual suspects – you know who you are!), I’ve mapped out most of the MEG 1.1 EEPROM structure. Here’s what Smart is actually storing in those 256 bytes:

Vehicle Identity & Configuration

• 0x35-0x37: Model code (452 = Roadster, 450 = Fortwo)
• 0x38-0x3A: Engine variant (434 = 61kw, 437 = 74kw Brabus, etc.)
• 0x3B: Steering configuration (LHD/RHD)
• 0x32-0x42: Complete VIN storage
• 0x0A-0x19: SCN ID code

The SCN Coding Mystery Solved (Partially!)

Remember how I mentioned SCN coding determines which maps the ECU uses? The actual coding lives at 0x05-0x06 and it’s far more detailed than anyone realized.

These two bytes contain 16 individual bits that control everything. I’ve managed to identify what some of them do:

• SCN5 Bit 6: Climate control presence
• SCN5 Bit 7: SB2 upgrade flag (the magic bit for Brabus maps!)
• SCN5 Bit 8: Roadster vs Fortwo identification
• SCN6 Bit 4: 45kW variant
• SCN6 Bit 5: 61kW variant
• SCN6 Bit 7: 74kW Brabus variant

But here’s the thing – many of the SCN control bits are still unknown. There are bits that clearly do something (they change between different ECU configurations), but I haven’t been able to figure out what they control yet.

This explains exactly how the ECU knows which internal maps to reference from the same FLASH file, but there’s clearly more functionality hidden in those unknown bits.

Immobilizer & Security Data

• 0x52: Key counter (immobilizer status)
• 0x2A-0x30: 7-byte immobilizer coding sequence
• 0xB4-0xB7: Immobilizer data blocks
• 0xA4-0xA5: Key programming data

Engine Management & Adaptations

• 0x5B: MIL status (check engine light)
• 0x5E-0x5F: Knock sensor reference values
• 0xA0-0xA1: Lambda sensor zero point
• 0x6C-0x6D: Odometer reading

Clutch & Gearbox Learning

• 0x9A-0x9B: Clutch protection class 1
• 0x9C-0x9D: Clutch protection class 2
• 0x9E-0x9F: Clutch protection class 3
• 0xA2-0xA3: Time spent in clutch protection mode
• 0xA6-0xA7: Clutch slip point learning
• 0xB0-0xB1: Disengaged position values

ECU History & Diagnostics

• 0xF2: Flash write counter (how many times it’s been remapped)
• 0xED: Flash type indicator (original sC vs tuning files)
• 0xE2-0xEC: Error byte range
• 0xF0-0xF1: Flash CRC verification

Building the Complete Decoder

Rather than keeping this knowledge locked away, I’ve built a proper Python tool with a clean GUI that decodes every single byte. This tool is provided here for free and I appreciate it if anyone who shows any use from this or has any input about what it does to please get in touch.

The SB2 Connection

Remember how I explained that SB2 maps have built-in protection? Now we can see exactly how it works. The ECU checks SCN5 Bit 7 to see if SB2 has been applied. If the FLASH contains SB2 maps but this bit isn’t set, limp mode kicks in within minutes.

This is why proper SCN coding (not just map flashing) is essential for SB2 conversions. The EEPROM and FLASH must match, or the protection system activates.

Update, I have successfully managed to make a modified SB2 map file which incorporates all the SB2 changes to the 371568 original map. This is the newest map file that Smart released and the only one which has faster gear changes. Please message me if you want a copy, all I ask is a donation for my time.

Still Much to Learn

Despite mapping out the complete EEPROM structure, there’s still a lot we don’t understand about these MEG 1.1 ECUs. The reverse engineering work has been like peeling back layers of an onion – every answer reveals new questions.

Some areas that need more investigation:

• Unknown SCN control bits – several bits change between configurations but their function is still mystery
• Adaptation algorithms – how exactly does the ECU learn and store clutch behavior?
• Inter-module communication – how does the MEG talk to the SAM and other modules?
• Hidden diagnostic functions – what other capabilities are buried in the firmware?

If anyone in the Smart community has additional knowledge about MEG 1.1 internals, SCN coding functions, or has discovered other interesting behaviors, please get in touch!

The more we understand these ECUs collectively, the better we can maintain, diagnose, and improve our cars. I’m always keen to collaborate and share knowledge with fellow Smart enthusiasts who are pushing the boundaries of what’s possible.

Looking Forward

More technical posts coming soon, including some exciting developments in gearbox control that build on this EEPROM knowledge…

Big thanks again to Mike Bailey at 223D Developmental and Andrew at Smart Automotive for their ongoing collaboration and pushing the boundaries of what’s possible with these brilliant little engines.

EEprom Decoder:
https://drive.google.com/file/d/1KGevWu-_O8_Ib1LeLYanKZSAPyb6HMDQ/view?usp=sharing

Tom
South Australia
WhatsApp: +61 401 723 903

So you want more power from your Roadster eh?

Smart Roadsters use a Bosch MEG1.1 ECU unit.

M stands for “Bosch Motronic” which can be traced back to Bosch’s first ECUs back in the 80s

E stands for “electronic accelerator” all Smart ECUs use drive-by-wire throttles where the accelerator pedal isn’t actually physically connected to the throttle body.

G stands for “Gearbox Control” all 450 Fortwo and Roadsters have the gearbox controlled by the ECU itself.

Unlike other Bosch ECUs like the ME7.5, the MEG1.1 in the Roadster has not had much reverse engineering done to it because the Roadster (and 450 Fortwo) are the only models which use this ECU.

Roadsters and 700cc Fortwos share the same MEG1.1 ECU and can be exchanged between the two with a bit of knowledge.

The MEG has two areas inside that can store information, the EEPROM and FLASH.

The EEPROM stores information about the car such as VIN number, engine model, immobilizer key programming, clutch grab point, gearbox learning adaptations and what options are enabled such as weather the Brabus tuning SB2 map has been applied or not.

The FLASH storage is a bigger chip that stores the “firmware” or the part that actually runs the engine and gearbox, this is where all the tables for how much fuel to put in, how much timing and how much boost to run.

When someone “remaps” the ecu, this is the chip that gets overwritten. EEPROM on the other hand is difficult to edit, usually requires removing the ECU from the car, opening it up and removing the entire chip off the board just to read and reflash it.

When someone “clones” an MEG, SAM or cluster, this is what they are doing; removing, reading and cloning the data on the internal EEPROM chips.

45kw Roadster Lite and 61kw regular Roadsters use the same map file, there are multiple maps inside the FLASH and the EEPROM tells it which maps to use.

Over the life of the roadster, there were 5 different revisions or versions for the 45/61kw that got released:

• 1037365163
• 1037365186
• 1037365239
• 1037365463
• 1037371568

Most of the changes between the versions are just small tweaks here and there to things like cold start, clutch engagement and emissions.

371568 is the biggest change of the lot, this is the one that got released in 2006? and was made after complaints that the gear changes were slow. This version has many tweaks to the gearbox control, driving it you can definitely notice the difference and gear changes are both faster and smoother.

Brabus Roadster (74kw and SB2) does have their own unique map files and there was only ever one version of each released. What this means that when the 371568 updated 61kw version got released, the Brabus models missed out on quicker and smoother gear changes.

The SB2 map, like all the maps have built in protection, you cant just load it using a flash tool to the ECU like other map files as the car will go into limp mode within a few minutes. The way this works is inside the EEPROM is an area that mentions if the car has had the SB2 map applied or not.

If the ECU starts and isn’t a model with the SB2 map applied but has the SB2 map loaded onto the FLASH then it goes into some sort of protection mode (limp mode) within a few minutes.

This is the same with 45/61kw variations, they use the same map but inside the EEPROM it states which variant it is and which internal values to reference.

The way the Smart dealers apply the SB2 map is with the STAR diagnostics unit, it updates both the FLASH and EEPROM to both be SB2.

Most people (who aren’t Mercedes) use STAR systems that aren’t genuine or legal. The way these work is mainly offline (no connection to Mercedes servers). To be able to use the SB2 map, the EEPROM needs to be edited to match the map file and this is called SCN coding on the STAR units.

Offline SCN coding is rare and not many people have the ability to do this. This means that loading the Brabus SB2 map via a STAR diagnostics unit is extremely rare outside of Mercedes.

Most generic “remappers” out there (who aren’t Smart specialists) who say they can reflash your Roadsters if you bring in your car will load a tune which they themselves have probably found online from an illegal leaked database.

These databases are the same ones which can be bought on eBay for a very small amount of money. They are the same bunch of files from pretty much every seller.

Only tuners which are smart specialists or have a dyno and have developed their own tune are to be relied upon.

Big thanks to Mike Bailey at 223D Developmental who has helped (and pushed) me to discover more along with Andrew at Smart Automotive who has also collaborated on this journey.

More posts to follow…

Lots has changed since I started this website!

In my spare time (when I’m not at my day job) You’ll find me tinkering on my (many) smart roadsters or customers cars.

I have developed with the help from Mike Bailey at 223D Developmental A remap which truly unlocks the power hiding within these engines.

The biggest flaw of these vehicles is the gearbox, and many agree that it leaves much more to be desired. What if I told you that we have managed to speed up the gear changes to the point where this isn’t an issue anymore?

If you’re interested in hearing more, I will make some posts detailing the process and what’s required.

This is a quick post to say that I’m well and truly still devoted to these vehicles and that there is more to come!

Please get in touch with me on Facebook, or Whatsapp (+61 401 723 903)