Unable to get valid RS485/RS232 communication from OEM 48V100Ah LiFePO4 BMS (PACE-style board, no documentation)

Been lurking on this thread for a while because I've got almost the exact same headache with a no-name 48V 100Ah pack I picked up off AliExpress last year. The BMS board looks identical to the PACE BMS units but with zero markings I can actually trace.

Has anyone tried running it through RS485 protocol sniffers to capture whatever the BMS is sending, rather than trying to poll it blind? I used a cheap USB-to-RS485 dongle and logged the raw output in RealTerm but I'm getting garbage — could be baud rate, could be parity settings, genuinely no idea.

A few things I've been wondering:

• Is there a definitive list of baud rates these PACE-style boards commonly use? I've tried 9600 and 19200 but haven't worked through all the options systematically
• Some posts elsewhere suggest these OEM boards use a proprietary variant of the PACE BMS protocol — has anyone successfully reverse-engineered the command structure?
• Would it be worth trying the JK BMS or JKBMS protocol as a starting point given how many clones share similar command sets?

My end goal is getting this talking to my Victron Cerbo GX properly rather than just relying on the SOC readout on the pack's own display, which I don't fully trust anyway.

If anyone's managed to crack comms on a similar unlabelled board I'd genuinely love to see your config or any Wireshark/RealTerm captures. Even partial packet structure would be a start.

@George1972 ah yes, the classic AliExpress "trust me bro" documentation experience 😄

Few things worth trying before you bin it:

• Most PACE-style boards default to 9600 baud, 8N1 — start there
• Try both RS485 and UART simultaneously, some clones are wired

@George1972 been down this exact rabbit hole with a similar pack on my boat. Worth grabbing a USB-RS485 adaptor and scanning through baud rates — 9600 is common but some of these PACE clones run at 19200.

Also check whether it's actually RS485 or just TTL dressed up — multimeter on the data pins whilst the BMS is idle should tell you pretty quickly.

If you can share a photo of the board markings I might recognise it. Some of these have a JBD or Daly-compatible protocol underneath even when the hardware looks different. overkill_bms software is worth a try too — surprisingly broad compatibility.

Don't give up on it, comms usually crack eventually.

@George1972 nothing says "off-grid adventure" quite like reverse-engineering a BMS at midnight with a logic analyser and a growing sense of regret — grabbed a cheap CH341A off eBay, set the baud rate to 9600 first (half these PACE clones default there before the "documentation" claims 115200), and if you're seeing garbage frames try flipping the A/B lines on your RS485 adaptor because apparently polarity is optional in Shenzhen 🔌 also worth checking if it'll respond to the standard PACE ~20004682C0048520FCC5\r\n query string — my Fogstar-adjacent pack woke right up to that before I ever found a manual.

@George1972 spent a good few evenings on this with a suspiciously similar board in my cabin build. What cracked it for me wasn't the baud rate or wiring — it was the address byte. These PACE-adjacent boards often won't respond at all unless you send the correct device address in the query frame, and it's rarely 0x00. Try cycling through 0x01 to 0x10 before assuming the comms are dead.

Also worth checking: some of these boards have a physical jumper or solder bridge that enables the RS485 port. Totally undocumented, naturally.

Once I got talking to mine, I used PBmsTools — free, handles most PACE variants, saved me writing anything custom.