Hello wk, I've been following your various battery adventures with gratitude.
I'm only up to page 16 here so stop me if you already know this, but some observations on your BMS PCB.
On your front picture there's a quad-pack IC, and the number on it is legible as 76PL536AQ1. TI is one of the manufacturers of these:
BQ76PL536A | Battery Monitor, Protection & Authentication Solutions | Battery Management Products | Description & parametrics
The datasheet is here:
http://www.ti.com/lit/gpn/bq76pl536a
It does perform battery management functions, including balancing. And here's the good news if you might someday consider re-rendering your (expensive) solar install: "
The bq76PL536A is intended to be used with a host controller to maximize the functionality of the battery management system. However, the protection functions do not require a host controller."
The smallest quad-pack on the front is a microcontroller:
Mouser Electronics - Microcontroller
... and I can't get a number off the small TSOP8 but I'll bet it's an EEPROM for the microcontroller's software, given the PROG pin nearby. No idea what the microcontroller might do though; the big chip seems to do most.
I notice also on the board the TSOP16 chip has numbers, but I just can't read them from the picture. This is a mystery chip.
On the back side of the PCB you'll notice that the heavy-duty IC has actually had its numbers
sanded off. This is probably a just set of power MOSFETS to shut off power to one set of cells or t'other, but whatever it is, it's controlled by the mystery TSOP16. Looks like it's switching heavy currents in planes internal to the PCB, probably charge current.
Also on the back there is a connector for 'cells 0-6'. This is going to go to 7 stacks of multiple cells, I'm betting 4 pins per stack, for monitoring and balancing.
Then there's the smaller connector for 'TS1-2', + and -. Referring to the main chip's datasheet, these are 2 differential temperature sensor inputs. (probably just thermistors toward one end and the other of the module)
So these BMS boards are daisy-chained together and are eventually connected to the main controller, which I think you'll found as the odd one. The thing that's puzzling though is how they communicate, unless it's somehow connecting to J2. But according to the datasheet there need to be 13 comm lines (SCLK, SDO, SDI, CS_N, CS_S, DRDY_N, DRDY_S, FAULT_N, FAULT_S, ALERT_N, ALERT_S, GND, V), and you need both north and south connected if you're going to daisy-chain. We're 3 pins short. I gotta infer that the 12V system of the car is all that's needed to power the BMS', or else how would they work when the pack is flat?
Hang on a sec... I notice that the microcontroller's P0.2 and P0.3 pins (general I/O pins) go to the big chip's CS_H and SDI_H. So the microcontroller is acting as the big chip's host. I'll bet it connects to the other vital functions too. Probably each BMS PCB has its own address in the EEPROM.
Tracing each PCB land may answer more questions. Maybe you're already way beyond me already, but I'll catch up this weekend.
