Reverse engineer EV battery–BMS–vehicle communication Full Time

Role Intent (Read Carefully)

This role exists to reverse engineer EV battery–BMS–vehicle communication, not to operate within documented boundaries.

You will work on undocumented CAN networks, locked BMS units, and controller handshakes, with the goal of:

Understanding true battery behavior
Enabling safe BMS replacement or emulation
Diagnosing field failures that OEM tools cannot explain
If your experience is limited to reading DBC files or vendor manuals, this role is not a fit.

Core Responsibilities

1. CAN Bus Reverse Engineering

Capture raw CAN traffic from EVs, battery packs, chargers, and controllers
Identify message IDs, byte mappings, scaling, offsets, counters, CRCs, and alive frames
Correlate CAN frames with physical battery events (load, voltage sag, temperature rise, cutoff)
Detect handshake logic, watchdog behavior, and fault propagation paths
Work without DBC files and build internal documentation from scratch
Expected Tools:
SavvyCAN, CANalyzer, PCAN-View, CANable, USB2CAN, basic logic analyzers

2. BMS Reverse Engineering

Analyze smart and semi-smart BMS units (Daly, JBD, ANT, OEM-locked units)
Map BMS decision logic including OV/UV, OCD/SCD, temperature limits, and imbalance triggers
Understand why a BMS trips, not just that it trips
Reverse engineer BMS–MCU–vehicle dependencies that cause battery pack rejection
Assist in BMS substitution or compatibility validation

3. BMS Emulation & Compatibility (Critical)

Support development of BMS emulation strategies for controller acceptance
Assist in spoofing SOC, SOH, voltage, and temperature frames where required (controlled, safe testing only)
Validate emulation under real load conditions and thermal behavior
Identify non-obvious dependencies such as startup order, timing windows, and heartbeat loss

4. Battery Behavior Correlation

Correlate CAN data with:
Voltage elasticity
Internal resistance rise
String imbalance under load
Thermal gradients
Validate whether failures are electrochemical, electronic, or logical
Work alongside technicians during battery pack teardown and live testing

5. Documentation & Knowledge Capture

Create internal reverse-engineered CAN maps and logic notes
Convert learnings into diagnostic rules rather than reports
Contribute to SOPs and decision trees used in field deployment

Must-Have Skills (Non-Negotiable)

Deep practical understanding of CAN protocol (not theoretical)
Experience working with raw CAN logs without DBC files
Ability to correlate CAN traffic with real-world electrical events
Hands-on exposure to EV battery packs and BMS hardware
Strong debugging mindset: hypothesis → test → invalidate → refine

Strongly Preferred

Experience with undocumented EV systems
Exposure to BMS emulation, spoofing, or compatibility testing
Basic firmware familiarity (Arduino / STM32) for testing logic
Understanding of EV failure modes under Indian field conditions
Comfort working around high-voltage systems with discipline

Who Should Not Apply

Engineers who rely only on OEM tools
Simulation-only or documentation-driven profiles
Candidates uncomfortable opening battery packs or questioning specifications
Anyone expecting clean datasets and complete documentation

Why This Role Is Unique

Work on problems OEMs do not publish
Your output directly determines whether a battery is repaired or scrapped
Learnings are first-principles based, not framework-driven
This role builds engineers who understand battery truth, not battery marketing