0
\$\begingroup\$

We are ordering batteries for powered wheelchairs from relatively big Chinese company specializing in large power banks (I am talking whole-house scale here). Our orders for them is just a side-business probably not deserving much attention. Recently they suggested using "smart BMS" on our packs and sent us couple prototypes. Unfortunately, we were unable to connect to their UART port.

First of all, for some reason they wired the GND from UART connector back to "-" of the battery pack. Pointless, but harmless. What is more puzzling is that neither of the remaining two wires (which I assume are RX and TX) have any voltage on them. Since UART typically idles at "high" I expected to see 3.3V or 5V on one of them. As it is, it could be that they are using inverted UART-TTL signalling, or maybe open-collector TX.

We contacted MANUFACTURER (not some unknown seller on alibaba, as it is often the case) and got back BMS documentation in Chinese with zero information on UART except for mention that it is supported. And also attached was this picture:

enter image description here

My guess is "UART-A" and "URAT-B" is someone's attempt to change from "485A" and "485B" mentioned in documentation as default port configuration. BMS model listed in documentation is "HBL-275-07S40A", and it gives no hits on google whatsoever. At this moment I have no idea what to do next.

Any hints on what electrical specs of this connector could be or how I can test it would be greatly appreciated.

Oh, and I forgot to mention that we did try to connect UART adapter (with 1k series resistors) to those wires and send battery status request packet per documentation, at various baud rates (it is not specified in documentation). There was no change on the other wire at all.

UPDATE:

As requested, I've removed heatsink and took some photos of the PCB. The chips were conformal coated and slightly scratched, as expected. After playing with light angles I got couple shots with partly visible markings. I wasn't able to completely remove sticky crap from the other side of the PCB. As far as I can tell there are four distinct copper pours there, three under FETs (where stitching VIAs are) and one more under the rest of electronics. I believe the ground under electronics is connected at some point to the battery side of FETs.

enter image description here

enter image description here enter image description here

Two pins on the right of "communication connector" go to D9, which is probably ESD protection, then via 0 Ohm jumpers somewhere in the direction of those 3 white 217B chips, which look like optocouplers to me. The voltage on these pins is about 7 mV. Looks like RS485, but I do not see any transceiver chips nearby. Those pins also connected directly to pads of missing U6 chip. The pinout of that chip is exactly the same as most common pinout of RS485 transceivers (note 2 and 3 tied together, usually !RE & DE. also 2k pull-ups on these and DI pins that further go to optocouplers).

The four pins of the "programming connector" have 0, 3.29, 3.28 and 0V. Two on the right go through 100 Ohm resistors to 16-pin QFP chip. These could be GND, VCC, TX and RX pins of UART port, but UART generally does not need additional chip. Strange.

Also, I translated the BMS documentation. There are exactly 4 places with any mention of the protocol:

  • in Overview: "Support UART or RS485 interface. The communication interface can realize real-time data such as battery voltage, temperature, current and so on with the host computer."

  • in Features: "Support UART host computer to view battery data;"

  • in Wiring: "Communication line interface description: Yellow: 485A Red: 485B"

  • and in Specifications: "Communication: RS485"

No mention of RS232, although salesperson said it is supported in the original agreement.

\$\endgroup\$
  • \$\begingroup\$ Hi, "I am only asking in a hope that somebody somewhere already faced this problem, found a solution and willing to share know-how" I have no experience of that BMS, so if you want only people with that experience to reply, then I'll step-back. However, if you are seeking replies from people with other reverse-engineering experience too, then perhaps make that clear? I expect that I'm not the only one who has some approaches that they would apply in this situation, but I don't want to waste your time (or mine :-) ) if you only want responses from those experienced with that BMS. Thanks :-) \$\endgroup\$ – SamGibson May 6 at 16:59
  • \$\begingroup\$ @SamGibson Actually, at this point I am looking for any help, whether you have first-hand knowledge or not. I think I did ask "how I can test it". What I meant is if there is any procedure I can use to figure out electrical characteristic of that port I certainly would like to try. I'll remove that part of the question as irrelevant \$\endgroup\$ – Maple May 6 at 17:43
  • \$\begingroup\$ I don't understand why you think connecting UART connector ground to battery pack negative is pointless. Everything needs a reference, and they have made the battery negative as reference for the communication circuits, which should be no surprise. \$\endgroup\$ – Justme May 6 at 21:29
  • \$\begingroup\$ @Justme because connector ground is already connected to ground pour on the PCB, which in turn is connected to battery "-". By connecting plug's pin back to the pack they in the best case made it unavailable as a reference output you've mentioned. In the worst case they either created ground loop or bypassed BMS FETs completely. \$\endgroup\$ – Maple May 7 at 6:02
0
\$\begingroup\$

Here are a few things that I would do to start, based on previous reverse-engineering experience. These are just to give some initial information:

  • Look at the BMS PCB visually, don't limit yourself to measurements only

    I see there is some kind of gray plastic "wrap" holding the BMS to the battery in that photo. You would need to open this to reveal the BMS, remove the metal top plate (it's likely for protection and possible heatsinking of MOSFETs underneath) so you can see and view the PCB (which might have components on both sides). I know that leaves you with the job of replacing that "wrap" (or keeping that one BMS+battery as a lab-only, not-for-resale, unit - which I suggest is a good idea, as further disassembly may be needed).

    You might see a typical 8-pin IC connected to the external UART connections (perhaps via an opto-coupler) matching an RS-485 or RS-422 transceiver. That would immediately give you confidence that your idea about why the UART connections are labelled A & B, is indeed because they are a differential pair.

    MODBUS over RS-485 is used in some other BMS modules. If you have to make guesses without dismantling anything then, based on the A & B labels, I would certainly consider MODBUS over RS-485 as a possibility (default UART setting as a starting point is often 9600 bps, 8N1) and try using a PC RS-485 adapter (with A, B and Gnd connections to the BMS). Also remember that some devices use the opposite convention for which cable is A & B, so if unsuccessful, it is always worth swapping A & B cables at one end and trying again.

  • Consider more reverse-engineering of the BMS

    If it has a UART, then it has an MCU or some other intelligence (I'll just say "MCU" for that device.). Its top marking might be removed, but you may be able to guess at least the device family. Again, the related circuitry between the MCU and external UART wires will give some clue about what type of interface that is.

    Also investigate how the MCU is powered, as that will tell you what is a valid maximum voltage at its inputs. Depending on what interface ICs you find between the MCU and the external red & yellow UART wires, this might be useful if you want to perform tests with pull-ups later, as you will know a valid voltage for the pull-up.

  • Image search the BMS PCB

    Once you can see the whole PCB, image search that PCB online. You might find a seller of the same BMS who gives more information than you have at the moment. Also, seeing the whole PCB might reveal useful markings on the PCB silkscreen.

  • PC software available?

    I have reverse-engineered some devices, where the manufacturer provided PC control software (but did not provide proper documentation for the interface and its commands) by intercepting, recording, and later analysing the data flow to and from the PC, when running their software.

  • Reverse-engineer is like an onion - revealing one layer at a time

    Each new piece of information obtained from examination and tests, leads to other investigations. What you discover from those first steps can lead towards eventually learning what you wanted. But at the beginning, we don't know whether the journey will be successful. So until there are more details, I can't give you the answers you are seeking yet. However I hope those points are helpful.


You asked about the connector - the visible white latching connector does not seem to be related to the UART connection, but instead is typical of the connections between the BMS and the individual cells in the battery - it looks like 7 cell connections.

It's possible that other people here would see useful details in the Chinese documentation from the manufacturer, if you can repost the part which you said mentions a UART default configuration.

Finally just one point (which I know you don't want me to labour, but I'm concerned about this): If the manufacturer isn't interested enough in helping you with full details of the UART interface when there is a pending order, how interested will they be in helping you, in the event of you asking future questions or having problems, once they already have your money? I hope you see why I'm worried.

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ Thanks a lot for your answer. These are evaluation units, so I have no problem with some hacking. I will open it up and post more photos, as well as relevant parts of the documentation. The final product should have BMS under molded plastic cover and (hopefully) the thermal sensors inserted into the pack instead of just tacked under the tape wrap. The documentation says that RS232, RS485 and UART are available, and lists "control registers" that can be changed to select protocol. This often means there is no discrete transceiver, the main chip does it by itself \$\endgroup\$ – Maple May 6 at 20:31
  • \$\begingroup\$ @Maple - You're welcome. Let's see what the photos show. Re: "This often means there is no discrete transceiver, the main chip does it by itself" Oh, my experience is the opposite; for RS-232 and RS-485 I usually see separate transceivers for those interfaces. So for something that claims "UART, RS-232 and RS-485" my initial expectation is to find a logic-level UART i/f, then a UART-to-RS-232 xcvr and a UART-to-RS-485 xcvr. I've seen exactly that design on a BMS. Anyway, the photos will give guidance. Good luck! (The mention of "control registers" is consistent with MODBUS terminology.) \$\endgroup\$ – SamGibson May 6 at 20:43
  • \$\begingroup\$ I don't know how all those transceivers can be connected to the same 3-pin socket without a bunch of additional electronics. But we'll see when I open it up. Also, I fully understand your concerns about manufacturer, we have those too. The reason we working with them is that they obtain required US certification for their batteries and also there are not many companies that assemble custom Li-NCM packs in small volumes. Our market is much smaller than e-bikes (which is actually a good thing, considering) \$\endgroup\$ – Maple May 6 at 20:57
  • \$\begingroup\$ @Maple - Hi, "I don't know how all those transceivers can be connected to the same 3-pin socket without a bunch of additional electronics" What I saw had separate sockets for UART (i.e. logic level signals), RS-232 & RS-485. Outputs on all 3 sockets driven all the time from MCU Tx pin via xcvrs (only 1 whould actually be connected externally). A jumper selected which one had its signal actually connected to the MCU UART Rx pin. Thanks for explaining the background :-) I'm hoping that this will turn out to be a poorly documented but usable MODBUS over RS-485 interface (fingers crossed emoji!) \$\endgroup\$ – SamGibson May 6 at 21:08
  • \$\begingroup\$ I've added all info I could find. From the PCB it looks exactly as you described - separate connectors for UART (4 pins with GND and VCC) and for RS485 (3 pins with GND). But no 485 transceiver and unknown chip on UART. I am certain I saw that logo many times, but can't recall the manufacturer. \$\endgroup\$ – Maple May 7 at 8:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.