I actually like @John_Taves suggestion about using the data lines of the cell modules. In my head this simplifies the wiring.
Controller TX ==> Shunt Module ==> Cell modules ==> controller RX.
The fact its already isolated, the power could be supplied by full pack voltage via a buck converter (i already use one to power the controller from the full pack voltage in my case upto 60v), the shunt on the Negative therefore no dealing with high voltage.
I like it.
I would rather a custom module dedicated to the shunt module as opposed to hacking a cell module.
And as for the shunt being on the negative side, surely 50mv or even 100mv isnt going to play havoc with equipment. Theres losses in wiring too. Also it doesnt matter if the equipment is common positive or common negative, all we need is the current going into and out of the battery.
The only downside i can see is that the polling time will not give very quick updates to instantaneous current, SOC would be fine as it shouldn’t be dropping that quickly. But what we could do is then make use of the current sense pins on the controller with a CT to read the current in real time. SOC from shunt module and current from CT.
This also means if communication with the modules is lost, current will still show possibly helping with troubleshooting.
Food for thought.