VanMoof S2 / Darfon E4C0E-001 BMS locked after deep discharge? Need help reverse engineering / wake-up
Hi everyone,
I’m trying to repair a VanMoof S2 battery with a Darfon E4C0E-001 BMS. I’ve reached the point where I think I need someone who has actually reverse engineered this board.
History
Bought the bike as defective.
Bike showed Error 27 and Error 29 before opening the battery.
Battery pack measured 3.75 V total when I first received it.
I slowly recharged the cell pack directly (NOT through the bike) using a current-limited lab power supply.
The complete pack is now at 30.5–30.7 V.
Cell condition
All series groups measure correctly.
Every group has a plausible voltage.
No group appears completely dead.
Total pack voltage remains stable at ~30.6 V.
Measurements
Fuse
LF30A fuse has continuity (~0.5 Ω)
Temperature sensors
NTC1 = 8.61 kΩ
NTC2 = 8.61 kΩ
Both appear normal.
Outputs
Measured:
B+ to B− = 30.6 V
P+ to P− ≈ 0 V
CH+ to CH− ≈ 0 V
Neither discharge nor charge outputs become active.
MOSFETs
The board has four power MOSFETs marked:
9581GP
No obvious signs of damage.
Controller
Main MCU:
Microchip PIC18F46K80
I cannot find any obvious logic supply around the MCU.
Communication wires
Connector has:
P+
P−
CH+
CH−
Blue
Green
Yellow
White
Orange wire labelled “PRESENT”
Measured against B−:
Blue = 0 V
Green = 28.8 V
Yellow = 0 V
White = 0 V
PRESENT = 0 V
Visual inspection
No burnt components.
No obvious damaged traces.
Back side of PCB has no components.
My questions
Does anyone know the actual function of:
PRESENT
Green wire
Blue
Yellow
White
Is there any documented wake-up/reset procedure for the Darfon E4C0E-001?
Does this BMS permanently lock itself after a deep discharge?
Has anyone reverse engineered the PIC firmware or communication?
Is there any known method to recover this BMS without replacing it?
Has anyone identified the internal 3.3 V / 5 V regulator or the gate driver on this board?
Any schematics, boardviews, reverse engineering notes or repair experience would be hugely appreciated.
Thanks!