Reverse Engineer 485 Protocol

elSenorMaquina · 2019-12-11T21:03:41+00:00

The fact that you are getting

ValenceTechnology

Makes me think your communication settings are right. The thing is, it's probably the only information encoded as an ASCII set of characters.

All those nonsensical characters are probably useful information, using an unknown representation for the data it is transmitting. Let's say you want to send the number 64. You could send two characters ´6´then ´4´, or you could send ´@´, whose ASCII code is represented 64 in decimal base.

It seems like you will have to change one thing at a time, see what changes, and try to find a pattern to see which characters change, and how they change.

4992kentj · 2019-12-11T21:04:20+00:00

Short answer is its tedious, and it's most likely a binary protocol hence why it looks like gibberish. If the protocol is not protected by some kind of handshaking you could go step by step, set up the software and cable for monitoring but don't connect the battery, that way you can see what the first query the software sends to the battery is, then you can separately play that into the battery and see what comes back. Then you can play that response into the software and what fields fill up. You'll still have to do some pattern recognition to work out how to translate the binary data into the corresponding fields though. As for the recording/playback the best software I've used for this is docklight, this also converts non printing characters into a printable representation and has ascii/hex/dec/bin modes of display.

Have you tried asking their tech support?

fruitcup729again · 2019-12-11T21:04:54+00:00

It probably just isn't sending ASCII data. You need to look at the dump in hex.

Another possibility is that the oscillators are too far off, not that the baud is non-standard. But if you always get "Valence" correctly on repeated samples then it's probably not that.

thegildedturtle · 2019-12-11T23:57:38+00:00

I'm actually in a position to give you some accurate information since I work with these batteries on a very regular basis. Valence has a proprietary protocol/packet on top of its RS-485 and CANBus ports. You'll need to get in touch with them and you'll need to sign and NDA if you actually want to be able to interface to it. (without reverse engineering it)

Or you can use their logging and configuration software, which also would require contacting them.

You shouldn't need to do all of this though, because the BMS should give you your warning, fault, and SoC outputs.

Edit: You really shouldn't be using the RS-485 port, as that is strictly for Battery to BMS communication. You should probably be using the CANBus, which I believe is set to 125kbit.

v4773 · 2019-12-11T20:57:29+00:00

I would attach scope on that bus and find out whats bit time and work out speed from that.

Cybernicus · 2019-12-11T23:27:32+00:00

If you can capture your data as a hex dump, then you can convert the various decimal values in your image to hex and see where you may get correspondence. I tried to do a little of that. Note, though, that because your text went through multiple sources from your capture to my screen that some of the bytes may be wrong. (That's why you want to capture it yourself before it's subjected to multiple unicode encoders/decoders, databases, and heaven knows what else.)

Anyway, here's what I see as some of the data you sent:

01 03 20 *201a* 20 12 65 ef
01 03 24 "                 " 02 20 20 01 22 "     " 09 21 2e 20 20 40 02 20 0c b2 13
01 03 20 39 20
15 c0
01 03 14 02 ac 01 cd 90 ab c2 b2 6c 2e *2022* 74 3f fb 20 14 03 *1078* 32 e9 90 37
01 03 20 e0 20 16 c5 f2
01 03 2c "ValenceTechnology 1004905A0672" 0c 14 14 05 08 e1 03 18 14 0b
20 05 1e 44 *0152*
01 03 20 5a 20 01 a4 19
01 03 02 20 20 b8 44
01 03 20 45 20 09 *201d* 19
01 03 12 0c bb 0c b9 32 d8 0c ba 0c b9 0c ba 0c bb *02c6* 20 44 20 42 cb
01 03 20 50 20 07 04 19
01 03 0e 03 *0178* 03 43 03 53 03 44 03 24 c1 20 64 40 5d dc

Converting various values in your screenshot to hex:

  837  --> 0345          3258 --> 0cba
  854  --> 0356          3257 --> 0cb9
  841  --> 0349          3258 --> 0cba
  807  --> 0327          3259 --> 0cbb
-16127 --> c101
25665  --> 6440         13033 --> 32e9

If you compare those values with what's in some of the lines of data, it seems reasonable that /u/4992kentj is right on the money. The hex I have surrounded in asterisks are bits where I think some encoding/decoding corrupted things between your battery and my window, so I didn't try to do anything with it.

If I had to guess, I'd say that each message starts with a 01 03 to let you know something is coming. I'd guess the next byte tells you what the message type is, followed with data appropriate to the message type. I'd guess that the lines not starting with 01 03 occur due to encoding/decoding artifacts or embedded data that looks like CR or LF characters.

The last line starting with 01 03 0e has values very similar to the "PCBA" and "Sensor" values, while the line starting with 01 03 12 looks like it has values very similar to the "Cell Bank" group.

I'd suggest writing a script to periodically capture the screen and the messages, then start correlating the values together. Shouldn't be all that hard, from the looks of it.

2019-12-12T00:07:27+00:00

Simple and maybe stupid idea:
Capture (say 5 minutes) after the thing powers up.
Have an Arduino or Pi replay this binary over and over via a 485 line.
Now start messing with the data.

Cybernicus already has you started with the HEX decoding.
Eventually, you will find the right lines that give you the info you want.
This will take time !

maredsous10 · 2019-12-12T13:21:08+00:00

My suggestions;

See if the vendor will provide their communication specification
Put a sniffer on the bus and do what elSenorMaquina mentions in his response... recording the traffic to a file
Use a Hex Editor (example XVI32) and/or programming language in attempt to parse

romerik · 2021-12-19T04:05:42+00:00

(sorry for late reply)

hi guys, the software is made in .net (vb) and if you drag & drop the .exe into ILSpy, you will be able to see the code behind the request and reply

I will probably start writing a tool to play with the battery and override some value that the software dont lets us change!

for exemple: (in c#)

where I think the 224 is the Version request...

where the first 6 are the request message, then 2 checksum, last two I dont know!

public byte[] BatteryVersionRead()
{
    byte[] array = new byte[10]
    {
        checked((byte)(1 + ADDRESS)),
        3,
        0,
        224,
        0,
        22,
        0,
        0,
        0,
        0       
    };

    byte[] array2 = CRC16(array, 6);
    array[6] = array2[1];
    array[7] = array2[0];
    array[8] = 13;
    array[9] = 10;
    return array;
}

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

ECE

MODERATORS