Darfon E4C0C 36V 14Ah – cells OK but BMS won't enable charge or discharge

[Jaro No]

Hi,
I'm trying to repair a Darfon E4C0C battery used with a Shimano STEPS system and I'm looking for someone who has experience repairing or diagnosing these Darfon BMS boards.
Battery details:
Darfon E4C0C
36.3 V / 14 Ah / 508.2 Wh
10INR19/66-4
MFW: 0.0.007
GFW: 01.FF
The battery does not work in the bike and does not start charging with its original Darfon charger.
What I've checked so far:
Complete cell pack: ~39.5 V
All 10 series groups are very even, approximately 3.95 V each
No obviously weak or discharged group
Temperature sensor: ~9.25 kΩ at room temperature, dropping to about 7.7 kΩ when warmed, so the NTC appears to work
B+ to B−: 39.5 V
B+ to P−: 39.5 V
B− to P−: 0 V
B+ to P+: approximately 28.7 V
Voltage measured directly at P+ / P− is only around 2 V and unstable
The original Darfon charger is rated 42 V / 4 A. Its LED remains solid green both before and after connecting the battery. Charging never starts.
The battery's LED/display electronics are alive. Pressing the battery button shows the charge level (4 LEDs). Shortly afterwards LEDs 1, 3 and 5 illuminate briefly. According to the Darfon documentation this appears to be the normal shutdown indication rather than an error code.
Holding the button for several seconds gives the same result: charge LEDs appear, then go out, and LEDs 1/3/5 appear after releasing the button.
The same battery also does not power its original bicycle, so this isn't only a charger/adapter issue.
The BMS is the unusual multi-PCB Darfon design shown in the attached photos. There is an F1 fuse on the B+ board and several power semiconductor stages.
Has anyone repaired this exact E4C0C BMS or knows how its power/charge enable circuit works?
In particular I'm trying to determine:
What should cause P+ to be enabled?
Is there a known BMS lock/protection state that prevents both charging and discharge even with balanced cells?
Is there a documented reset/wake-up procedure?
Is communication with the bike/charger required before the BMS enables the power stage?
Has anyone identified the communication protocol or diagnostic interface on this BMS?
Are replacement E4C0C BMS boards available, or can the original board be repaired/reset?
I have the battery open and can take measurements with a multimeter, oscilloscope/logic analyser and CAN hardware if needed.
I would prefer to diagnose the original BMS rather than replace it with a generic BMS, because the battery needs to remain compatible with the Shimano system.
Any schematics, pinouts, service information or measurements from a working E4C0C would be very helpful.
Thanks.

 

[Jaro No]

Update – comparison with an identical working E4C0C battery
I have now obtained an identical, fully working Darfon E4C0C battery and was able to compare both the electrical signals and CAN communication directly.
Working battery:
PRESENT line (green wire) is approximately 4.8 V with no charger connected.
Pressing the battery button does not change this voltage.
When the original Darfon charger is connected, PRESENT is pulled down to approximately 0.6 V.
CAN communication starts with 0x718, DLC 3, data 42 54 59 ("BTY").
The communication then continues normally with frames including 0x709, 0x70A, 0x714, 0x715 and 8-byte 0x718 frames.
I captured the communication as a Vector ASC trace.
Faulty battery:
PRESENT is only approximately 0.24 V with nothing connected.
I measured approximately 3.1 MΩ to ground, so PRESENT does not appear to be simply shorted to ground.
The battery still transmits 0x718 / 42 54 59 ("BTY"), but the handshake does not continue.
Connecting the same known-good charger does not start charging.
The battery also does not work in the bike.
This makes the PRESENT circuit particularly suspicious. On the working battery it appears to sit at ~4.8 V until the charger pulls it down to ~0.6 V. The faulty battery never reaches this initial ~4.8 V state.
My next diagnostic test is to provide an external 5 V pull-up to PRESENT through a 10 kΩ resistor and see whether:
PRESENT returns to approximately 4.8–5 V,
the charger can pull it down normally,
the complete CAN handshake starts.
I don't want to dismantle the working battery's multi-board BMS any further because examining both sides of the PCBs would require desoldering the main power connections.
If anyone knows how the PRESENT circuit is implemented on these Darfon boards, or has experience with this failure mode, I'd be very interested.
I can also upload the ASC trace from the working battery/charger session if anyone wants to analyse it.