Lego released the protocols that they use http://www.philohome.com/pf/LEGO_Pow...ns_RC_v110.pdf

Aparently the IR reciever can support pwm but I it's where 4 bit binary number is sent with 0001 as full forwards, 1000 as brake and 1111 as full backwards.

I would probably have to buy one to test what wire does what and whether anything has to be done to the radio transmitters signal to make it work.