I'm trying to reverse engineer an ECU / GSU protocol from a model airplane jet turbine, in order to make a telemetry adapter. I have decoded several other protocols in the past with good success but this one is especially tough, so I thought I would ask for assistance.
I have an Arduino Nano as the GSU emulator, with a LIN transceiver and verifying communication on a Saleae logic analyser.
The ECU uses a LIN interface but on a proprietary protocol unknown to me. In order to read it I am using an Arduino with a level shifter, and I verified that the incoming data is correct.
When ECU is stand alone, it sends several strings which appear to be interrogations for bus nodes, but nobody is replying obviously.
0x0A 0x00 0x00 0x00 0x00 0x0A 0x14 0x00 0x00 0x00 0x00 0x14 0x1E 0x00 0x00 0x00 0x00 0x1E 0x28 0x00 0x00 0x00 0x00 0x28
When the GSU is connected to the ECU, it responds immediately (
0.2ms) after the first string (
0x0A 0x00 0x00 0x00 0x00 0x0A), with a
6 byte reply. Each time it is a slightly different reply.
Such a reply is followed by the ECU sending a stream of data, which is the data I need to read.
I tried emulating some of these GSU replies with Arduino, but the ECU never sends the stream of data back on the bus if the arduino is interrogating it; it just ignores it and continues interrogating as if nothing happened. With the GSU interrogating, the ECU replies.
I have attached an Excel table that shows some of the replies and a bit of data processing I played with. It appears that the reply is a
6 byte stream, where the MSB (most significant BIT) of each byte is either
1. I'm not sure about the rules here and why it's changing.
Does this make sense to anyone? Any reverse engineering experts can share some ideas? So far haven't been able to get the ECU to answer to Arduino.
Thanks for your help.