We are ordering batteries for powered wheelchairs from relatively big Chinese company specializing in large power banks (I am talking whole-house scale here). Our orders for them is just a side-business probably not deserving much attention. Recently they suggested using "smart BMS" on our packs and sent us couple prototypes. Unfortunately, we were unable to connect to their UART port.
First of all, for some reason they wired the GND from UART connector back to "-" of the battery pack. Pointless, but harmless. What is more puzzling is that neither of the remaining two wires (which I assume are RX and TX) have any voltage on them. Since UART typically idles at "high" I expected to see 3.3V or 5V on one of them. As it is, it could be that they are using inverted UART-TTL signalling, or maybe open-collector TX.
We contacted MANUFACTURER (not some unknown seller on alibaba, as it is often the case) and got back BMS documentation in Chinese with zero information on UART except for mention that it is supported. And also attached was this picture:
My guess is "UART-A" and "URAT-B" is someone's attempt to change from "485A" and "485B" mentioned in documentation as default port configuration. BMS model listed in documentation is "HBL-275-07S40A", and it gives no hits on google whatsoever. At this moment I have no idea what to do next.
Any hints on what electrical specs of this connector could be or how I can test it would be greatly appreciated.
Oh, and I forgot to mention that we did try to connect UART adapter (with 1k series resistors) to those wires and send battery status request packet per documentation, at various baud rates (it is not specified in documentation). There was no change on the other wire at all.
As requested, I've removed heatsink and took some photos of the PCB. The chips were conformal coated and slightly scratched, as expected. After playing with light angles I got couple shots with partly visible markings. I wasn't able to completely remove sticky crap from the other side of the PCB. As far as I can tell there are four distinct copper pours there, three under FETs (where stitching VIAs are) and one more under the rest of electronics. I believe the ground under electronics is connected at some point to the battery side of FETs.
Two pins on the right of "communication connector" go to D9, which is probably ESD protection, then via 0 Ohm jumpers somewhere in the direction of those 3 white 217B chips, which look like optocouplers to me. The voltage on these pins is about 7 mV. Looks like RS485, but I do not see any transceiver chips nearby. Those pins also connected directly to pads of missing U6 chip. The pinout of that chip is exactly the same as most common pinout of RS485 transceivers (note 2 and 3 tied together, usually !RE & DE. also 2k pull-ups on these and DI pins that further go to optocouplers).
The four pins of the "programming connector" have 0, 3.29, 3.28 and 0V. Two on the right go through 100 Ohm resistors to 16-pin QFP chip. These could be GND, VCC, TX and RX pins of UART port, but UART generally does not need additional chip. Strange.
Also, I translated the BMS documentation. There are exactly 4 places with any mention of the protocol:
in Overview: "Support UART or RS485 interface. The communication interface can realize real-time data such as battery voltage, temperature, current and so on with the host computer."
in Features: "Support UART host computer to view battery data;"
in Wiring: "Communication line interface description: Yellow: 485A Red: 485B"
and in Specifications: "Communication: RS485"
No mention of RS232, although salesperson said it is supported in the original agreement.