The battery has a female DB-9 CAN-bus connector on top. This CAN-bus connector emits data continuously at 250 kbps – even when the battery has been “off for some time” (perhaps hours). The de facto standard for CAN on a 9-pin D-shell connector is:
EM followed this convention, but no power is available on pin 9. Unlike the SiliXcon controller, no real hacking is necessary to access BMS data. A bit of reverse engineering would be needed to make sense of the data, however. Even if ION Energy is not willing to disclose the data format to non-customers, it would be a straightforward reverse-engineering project. I've already seen a publicly available BMS data specification, plus the one for the 5.7. Really, all you care about is the individual cell voltages (and maybe temperatures). It seems like you could just watch the data stream while discharging the battery on the bench and make some assumptions. Definitely a low-priority project for me. I've included a screenshot of just a few seconds worth of data I got off my CAN-bus reader. I will need better analyzer software to eliminate redundant packets in order to make sense of it.