ELI30_48ECE Rev1.0 not detected

[OiD-W]

Checklist

• I have filled out the template to the best of my ability.
• I have understood that this integration is only about battery management systems with Bluetooth Low Energy support.
• This only contains 1 feature request (if you have multiple feature requests, open one feature request for each feature request).
• I followed the instructions for devices that are not recognized.
• I have checked out the latest release.

Please describe the enhancement you would like to have.

ep-equipment 48V 30A battery with canbus and bluetooth BMS ELI30_48ECE

{"name":"EBAPMF073G6U",
"address":"60:6E:41:C8:D5:E9",
"rssi":-74,
"manufacturer_data":{"17750":"52322e30"},
"service_data":{},
"service_uuids":[],
"source":"A0:A3:B3:23:9E:22",
"connectable":true,
"time":1778584836.6154785,
"tx_power":null,
"raw":"0201060d09454241504d4630373347365507ff564552322e30"}

If needed and instructions are given i can collect data from bluetooth. All I've managed to get is:
41 54 00 00 00 00 00 00 00
7B 43 4D 44 45 52 52 4F 7D

Additional context

No response

[patman15]

Can you please

• See if you are able to capture the Bluetooth traffic
  • on Android or
  • on iOS while using the vendor app with the battery or,
  • if you have issues with the methods above, using nRF connect (please attach a log file)

[OiD-W]

Hi @patman15
Sorry i've not been able to get the ADB to work. I have some data from nRF connect:

nRF Connect, 2026-05-13
EBAPMF073G6U (60:6E:41:C8:D5:E9)
V	15:00:08.785	Connecting to 60:6E:41:C8:D5:E9...
D	15:00:08.785	gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, preferred PHY = LE 1M)
D	15:00:09.187	[Callback] Connection state changed with status: 0 and new state: CONNECTED (2)
I	15:00:09.187	Connected to 60:6E:41:C8:D5:E9
D	15:00:09.188	wait(1600ms)
D	15:00:09.194	[Broadcast] Action received: android.bluetooth.device.action.ACL_CONNECTED
D	15:00:09.344	[Broadcast] Action received: android.bluetooth.device.action.ENCRYPTION_CHANGE, encryption: ENABLED, algorithm: AES (16 bytes), transport: TRANSPORT_LE, status: 0
I	15:00:09.703	Connection parameters updated (interval: 7.5ms, latency: 0, timeout: 5000ms)
I	15:00:09.821	Connection parameters updated (interval: 30.0ms, latency: 0, timeout: 5000ms)
I	15:00:10.642	PHY updated (TX: LE 2M, RX: LE 2M)
V	15:00:10.789	Discovering services...
D	15:00:10.789	gatt.discoverServices()
D	15:00:10.794	[Callback] Services discovered with status: 0
I	15:00:10.794	Services discovered
V	15:00:10.798	Generic Access (0x1800)
- Device Name [R W] (0x2A00)
- Appearance [R] (0x2A01)
- Central Address Resolution [R] (0x2AA6)
Generic Attribute (0x1801)
- Service Changed [I] (0x2A05)
   Client Characteristic Configuration (0x2902)
- Client Supported Features [R W] (0x2B29)
- Database Hash [R] (0x2B2A)
Unknown Service (0000ff10-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [N WNR] (0000ff11-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
- Unknown Characteristic [N WNR] (0000ff12-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
Unknown Service (0000ffe0-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [N WNR] (0000ffe1-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
D	15:00:10.798	gatt.setCharacteristicNotification(00002a05-0000-1000-8000-00805f9b34fb, true)
D	15:00:10.799	gatt.setCharacteristicNotification(0000ff11-0000-1000-8000-00805f9b34fb, true)
D	15:00:10.799	gatt.setCharacteristicNotification(0000ff12-0000-1000-8000-00805f9b34fb, true)
D	15:00:10.799	gatt.setCharacteristicNotification(0000ffe1-0000-1000-8000-00805f9b34fb, true)
V	15:00:27.290	Reading all characteristics...
V	15:00:27.290	Reading characteristic 00002a00-0000-1000-8000-00805f9b34fb
D	15:00:27.290	gatt.readCharacteristic(00002a00-0000-1000-8000-00805f9b34fb)
I	15:00:27.341	Read Response received from 00002a00-0000-1000-8000-00805f9b34fb, value: (0x) 45-42-41-50-4D-46-30-37-33-47-36-55, "EBAPMF073G6U"
A	15:00:27.341	"EBAPMF073G6U" received
V	15:00:27.341	Reading characteristic 00002a01-0000-1000-8000-00805f9b34fb
D	15:00:27.341	gatt.readCharacteristic(00002a01-0000-1000-8000-00805f9b34fb)
I	15:00:27.401	Read Response received from 00002a01-0000-1000-8000-00805f9b34fb, value: (0x) 00-00
A	15:00:27.401	"[0] Unknown" received
V	15:00:27.401	Reading characteristic 00002aa6-0000-1000-8000-00805f9b34fb
D	15:00:27.401	gatt.readCharacteristic(00002aa6-0000-1000-8000-00805f9b34fb)
I	15:00:27.463	Read Response received from 00002aa6-0000-1000-8000-00805f9b34fb, value: (0x) 01
A	15:00:27.463	"Address resolution supported" received
V	15:00:27.464	Reading characteristic 00002b29-0000-1000-8000-00805f9b34fb
D	15:00:27.464	gatt.readCharacteristic(00002b29-0000-1000-8000-00805f9b34fb)
I	15:00:27.522	Read Response received from 00002b29-0000-1000-8000-00805f9b34fb, value: (0x) 00
A	15:00:27.522	"No features" received
V	15:00:27.522	Reading characteristic 00002b2a-0000-1000-8000-00805f9b34fb
D	15:00:27.522	gatt.readCharacteristic(00002b2a-0000-1000-8000-00805f9b34fb)
I	15:00:27.582	Read Response received from 00002b2a-0000-1000-8000-00805f9b34fb, value: (0x) 07-3A-3A-79-79-02-63-C4-10-89-DD-AD-83-BE-E8-35
A	15:00:27.582	"(0x) 07-3A-3A-79-79-02-63-C4-10-89-DD-AD-83-BE-E8-35" received
V	15:00:27.583	5 characteristics read
V	15:00:46.490	Reading PHY...
D	15:00:46.491	gatt.readPhy()
I	15:00:46.495	PHY read (TX: LE 2M, RX: LE 2M)
V	15:00:55.678	Reading all characteristics...
V	15:00:55.678	Reading characteristic 00002a00-0000-1000-8000-00805f9b34fb
D	15:00:55.678	gatt.readCharacteristic(00002a00-0000-1000-8000-00805f9b34fb)
I	15:00:55.721	Read Response received from 00002a00-0000-1000-8000-00805f9b34fb, value: (0x) 45-42-41-50-4D-46-30-37-33-47-36-55, "EBAPMF073G6U"
A	15:00:55.721	"EBAPMF073G6U" received
V	15:00:55.722	Reading characteristic 00002a01-0000-1000-8000-00805f9b34fb
D	15:00:55.722	gatt.readCharacteristic(00002a01-0000-1000-8000-00805f9b34fb)
I	15:00:55.812	Read Response received from 00002a01-0000-1000-8000-00805f9b34fb, value: (0x) 00-00
A	15:00:55.812	"[0] Unknown" received
V	15:00:55.813	Reading characteristic 00002aa6-0000-1000-8000-00805f9b34fb
D	15:00:55.813	gatt.readCharacteristic(00002aa6-0000-1000-8000-00805f9b34fb)
I	15:00:55.871	Read Response received from 00002aa6-0000-1000-8000-00805f9b34fb, value: (0x) 01
A	15:00:55.871	"Address resolution supported" received
V	15:00:55.871	Reading characteristic 00002b29-0000-1000-8000-00805f9b34fb
D	15:00:55.871	gatt.readCharacteristic(00002b29-0000-1000-8000-00805f9b34fb)
I	15:00:55.933	Read Response received from 00002b29-0000-1000-8000-00805f9b34fb, value: (0x) 00
A	15:00:55.933	"No features" received
V	15:00:55.934	Reading characteristic 00002b2a-0000-1000-8000-00805f9b34fb
D	15:00:55.934	gatt.readCharacteristic(00002b2a-0000-1000-8000-00805f9b34fb)
I	15:00:55.995	Read Response received from 00002b2a-0000-1000-8000-00805f9b34fb, value: (0x) 07-3A-3A-79-79-02-63-C4-10-89-DD-AD-83-BE-E8-35
A	15:00:55.995	"(0x) 07-3A-3A-79-79-02-63-C4-10-89-DD-AD-83-BE-E8-35" received
V	15:00:55.995	5 characteristics read

[patman15]

The setup couldn't be simpler: connect the phone to the computer via USB, enable USB debugging, select the "Android Bluetooth" capture source in Wireshark, and start recording!

That also did not work?

Did you run the battery app, while capturing with nRF connect?

The information provided is unfortunately not sufficient to identify or integrate the BMS.

[OiD-W]

I'm able to get the phone to connect to the PC as mentioned in the article but nothing is showing up in the Wireshark connections. Phone does show up in adb device list...

The only app i've found for this BMS is behind a corporate fleet management account. I'm trying to just throw commands at it (BLE or CANBUS) but so far I've had no luck. Was hopping to see if it was just some "clone" BMS.

I'm not finding much info on the "{CMDERRO}" and "AT" the BMS replies. I guess there is not much else to do here sadly.

Huge thanks for this project!

[patman15]

I'm able to get the phone to connect to the PC as mentioned in the article but nothing is showing up in the Wireshark connections. Phone does show up in adb device list...

Did you run adb server start before starting Wireshark?

[OiD-W]

adb server start gives me:

could not read ok from ADB Server
* could not start server *

adb start-server doesn't seem to do anything either.
I managed to get the hci log file into wireshark a different way. But again, no actual application data:
export.zip

[patman15]

Puh, without an app and no further information it is really hard to guess on how to talk to this BMS.
The only BMS type that could match is https://github.com/patman15/aiobmsble/blob/dfe38f75fcac022bbe285fe1a76ead226a9336a4/aiobmsble/bms/braunpwr_bms.py because it has same heading and end. You could try throwing \x7b\x01\x00\x7d at it.