This question is related to another question I posted here.
I'm working with a small public transit agency on a neat open-source project that will help us to offer realtime data to local developers. A key piece of data we need is the current bus route a given vehicle is on. Currently, there is only a single electronic system that knows this information: the vehicle logic unit (VLU) that each vehicle is equipped with.
When a bus driver begins a route, they type its ID number into the keypad on the operator control unit (OCU). This ID number is sent to the VLU, which then displays the appropriate text on the LED signs on the bus.
On the OCU, there are two DB9F ports. In the manual, they are described as "J1708 PORTS". One of them is connected to the VLU, and the other one is available for me to plug in to. Connecting to it gets me some data that you can read about in my other question.
What I'd like to do is reverse engineer the firmware of the VLU and see how it decides what data to send or how to interpret received data. From what I can tell, the firmware is using RTTarget-32 as a base. I believe this is the case because the following strings can be found in the firmware file:
RTTarget-32 5.0 16-Bit Boot Code (c) 1996,2006 On Time Informatik
On Time RTOS-32 5.0 Disk Loader (c) 1996,2009 On Time
I didn't post a link to the firmware file because I know linking to external files is generally frowned upon on SE sites. If I should upload it, though, what file host should I use?
So, as my question title states, what techniques should I be using to begin reverse engineering this firmware file?