im trying to reverse engineer an ECU / GSU protocol from a model airplane jet turbine, in order to make a telemetry adapter.
i have decoded several other protocols in the past with good success but this one is extra stubborn and so i thought i would ask for assistance.
I have an Arduino Nano as the GSU emulator, with a LIN transceiver and verifying communication on a Saleae logic analyser.
the ECU uses a LIN interface but on a proprietary protocol unknown to me. in order to read it i am using an Arduino with a level shifter, and i verified the incoming data is correct.
When ECU is stand alone, it send several strings which appear to be interogations for bus nodes, but nobody is replying obviously.
0x0A 0x00 0x00 0x00 0x00 0x0A
0x14 0x00 0x00 0x00 0x00 0x14
0x1E 0x00 0x00 0x00 0x00 0x1E
0x28 0x00 0x00 0x00 0x00 0x28
When the GSU is connected to the ECU, it responds immidiately (0.2ms) after the first string (0x0A 0x00 0x00 0x00 0x00 0x0A), with a 6 byte reply. each time its a slightly different reply.
this reply is followed by the ECU sending a stream of data, which is the data i need to read.
i tried emulating some of these GSU replies with Arduino, but the ECU never sends the stream of data back on the bus if the arduino is interogating it, it just ignores it and continues interrogating as if nothing happend. with the GSU interogating, the ECU replies.
i have attached an excel table that shows some of the replies and a bit of data processing i played with. it appears that the reply is a 6 byte stream, where the MSB (most significant BIT) of each byte is either 0 or 1, not sure about the rules here and why its changing.
does this make sense to anyone?
any reverse engineering experts can share some ideas?
so far havent been able to get the ECU to answer to Arduino.
thanks for your help.