Connecting to UART port on smart BMS

Question

We are ordering batteries for powered wheelchairs from relatively big Chinese company specializing in large power banks (I am talking whole-house scale here). Our orders for them is just a side-business probably not deserving much attention. Recently they suggested using "smart BMS" on our packs and sent us couple prototypes. Unfortunately, we were unable to connect to their UART port.

First of all, for some reason they wired the GND from UART connector back to "-" of the battery pack. Pointless, but harmless. What is more puzzling is that neither of the remaining two wires (which I assume are RX and TX) have any voltage on them. Since UART typically idles at "high" I expected to see 3.3V or 5V on one of them. As it is, it could be that they are using inverted UART-TTL signalling, or maybe open-collector TX.

We contacted MANUFACTURER (not some unknown seller on alibaba, as it is often the case) and got back BMS documentation in Chinese with zero information on UART except for mention that it is supported. And also attached was this picture:

My guess is "UART-A" and "URAT-B" is someone's attempt to change from "485A" and "485B" mentioned in documentation as default port configuration. BMS model listed in documentation is "HBL-275-07S40A", and it gives no hits on google whatsoever. At this moment I have no idea what to do next.

Any hints on what electrical specs of this connector could be or how I can test it would be greatly appreciated.

Oh, and I forgot to mention that we did try to connect UART adapter (with 1k series resistors) to those wires and send battery status request packet per documentation, at various baud rates (it is not specified in documentation). There was no change on the other wire at all.

UPDATE:

As requested, I've removed heatsink and took some photos of the PCB. The chips were conformal coated and slightly scratched, as expected. After playing with light angles I got couple shots with partly visible markings. I wasn't able to completely remove sticky crap from the other side of the PCB. As far as I can tell there are four distinct copper pours there, three under FETs (where stitching VIAs are) and one more under the rest of electronics. I believe the ground under electronics is connected at some point to the battery side of FETs.

Two pins on the right of "communication connector" go to D9, which is probably ESD protection, then via 0 Ohm jumpers somewhere in the direction of those 3 white 217B chips, which look like optocouplers to me. The voltage on these pins is about 7 mV. Looks like RS485, but I do not see any transceiver chips nearby. Those pins also connected directly to pads of missing U6 chip. The pinout of that chip is exactly the same as most common pinout of RS485 transceivers (note 2 and 3 tied together, usually !RE & DE. also 2k pull-ups on these and DI pins that further go to optocouplers).

The four pins of the "programming connector" have 0, 3.29, 3.28 and 0V. Two on the right go through 100 Ohm resistors to 16-pin QFP chip. These could be GND, VCC, TX and RX pins of UART port, but UART generally does not need additional chip. Strange.

Also, I translated the BMS documentation. There are exactly 4 places with any mention of the protocol:

• in Overview: "Support UART or RS485 interface. The communication interface can realize real-time data such as battery voltage, temperature, current and so on with the host computer."

• in Features: "Support UART host computer to view battery data;"

• in Wiring: "Communication line interface description: Yellow: 485A Red: 485B"

• and in Specifications: "Communication: RS485"

No mention of RS232, although salesperson said it is supported in the original agreement.

Answer 1

Here are a few things that I would do to start, based on previous reverse-engineering experience. These are just to give some initial information:

• Look at the BMS PCB visually, don't limit yourself to measurements only

  I see there is some kind of gray plastic "wrap" holding the BMS to the battery in that photo. You would need to open this to reveal the BMS, remove the metal top plate (it's likely for protection and possible heatsinking of MOSFETs underneath) so you can see and view the PCB (which might have components on both sides). I know that leaves you with the job of replacing that "wrap" (or keeping that one BMS+battery as a lab-only, not-for-resale, unit - which I suggest is a good idea, as further disassembly may be needed).

  You might see a typical 8-pin IC connected to the external UART connections (perhaps via an opto-coupler) matching an RS-485 or RS-422 transceiver. That would immediately give you confidence that your idea about why the UART connections are labelled A & B, is indeed because they are a differential pair.

  MODBUS over RS-485 is used in some other BMS modules. If you have to make guesses without dismantling anything then, based on the A & B labels, I would certainly consider MODBUS over RS-485 as a possibility (default UART setting as a starting point is often 9600 bps, 8N1) and try using a PC RS-485 adapter (with A, B and Gnd connections to the BMS). Also remember that some devices use the opposite convention for which cable is A & B, so if unsuccessful, it is always worth swapping A & B cables at one end and trying again.

• Consider more reverse-engineering of the BMS

  If it has a UART, then it has an MCU or some other intelligence (I'll just say "MCU" for that device.). Its top marking might be removed, but you may be able to guess at least the device family. Again, the related circuitry between the MCU and external UART wires will give some clue about what type of interface that is.

  Also investigate how the MCU is powered, as that will tell you what is a valid maximum voltage at its inputs. Depending on what interface ICs you find between the MCU and the external red & yellow UART wires, this might be useful if you want to perform tests with pull-ups later, as you will know a valid voltage for the pull-up.

• Image search the BMS PCB

  Once you can see the whole PCB, image search that PCB online. You might find a seller of the same BMS who gives more information than you have at the moment. Also, seeing the whole PCB might reveal useful markings on the PCB silkscreen.

• PC software available?

  I have reverse-engineered some devices, where the manufacturer provided PC control software (but did not provide proper documentation for the interface and its commands) by intercepting, recording, and later analysing the data flow to and from the PC, when running their software.

• Reverse-engineer is like an onion - revealing one layer at a time

  Each new piece of information obtained from examination and tests, leads to other investigations. What you discover from those first steps can lead towards eventually learning what you wanted. But at the beginning, we don't know whether the journey will be successful. So until there are more details, I can't give you the answers you are seeking yet. However I hope those points are helpful.

---

You asked about the connector - the visible white latching connector does not seem to be related to the UART connection, but instead is typical of the connections between the BMS and the individual cells in the battery - it looks like 7 cell connections.

It's possible that other people here would see useful details in the Chinese documentation from the manufacturer, if you can repost the part which you said mentions a UART default configuration.

Finally just one point (which I know you don't want me to labour, but I'm concerned about this): If the manufacturer isn't interested enough in helping you with full details of the UART interface when there is a pending order, how interested will they be in helping you, in the event of you asking future questions or having problems, once they already have your money? I hope you see why I'm worried.