Yes I noticed this too, if you look at 1A0 for example, the second byte has a sequence counter, it seems to be two interleaved?

Yeah right, that is also the giveaway for at least two motors being on the bus imho


Yes, I dumped it via JTAG (and can also debug). These microcontrollers have a way ...

Sorry, I don't think I can share the firmware dump as that would violate copyright. As I understand it there is some room for reverse engineering when it’s for interoperability, so writing down the protocol and sharing that is OK. But sharing the actual code (like the firmware) is not. I just try ...

im tempted to buy one of the following and reverse engineering it.

https://www.onlyda.com/product-p26807141.html

or

https://www.botongautoelectronics.com/product-page/48v-audi-testing-platform-start-and-generator-for-audi-alternator

or

http://ebay.co.uk/itm/405899320374

might be abit ...

Hey bananaman, I'm also currently on the mission to figure out the CAN signals.
I have the 48V BSG 4N0903028R, but the replay that works for others hasn't worked for mine. I hear a click of a relay and increase in current consumption on 12V, but no rotation whatsoever.
Do you have a firmware dump ...