RCinFLA mentioned to leave charge & discharge enabled. Could this be an issue that has unintended consequences leading to the bms going stupid(Laymans term) and not balancing/protecting? The way most of us control energy in & out of a battery is not with bms. The only time I’ve used the the bms control is to disable discharge if I’m going to work on cable or fuse and the inverter is already off so I lessen the chance of fireworks. 4.25 is crazy. What’s wild to watch is how fast and little current it takes once a cell hit 3.6 volts to shoot beyond with poor regulation.
It is possible but would take a special condition.
The gate drive that turns on and off the MOSFET's is a very large value resistor. The MOSFET control gates have a large amount of capacitance. This makes the switching on and off the MOSFET's pretty slow.
The way the disable charge or discharge works is described in the above diagram by turning off one of the back-to-back MOSFET sets. As mentioned, to prevent overheating the switched off MOSFET body diode when passed current is high, the BMS overrides the disable setting and turns MOSFET back on when passed current gets above a few amps.
When this over-ride happens the BMS is in bi-directional mode again although current flow direction is monitored by BMS to re-disable the MOSFET if current level drops below a few amps or reverses direction. The re-disabling is slow due to the MOSFET low drive control speed.
If inverter/charger or PV charge controller and inverter, due to varying inverter AC loading, results in a rapid change, back and forth current flow on battery/BMS between charging and discharging of battery, when charging is disabled in BMS, the slow MOSFET enable/disable time can cause an oscillation. There will also be a momentary charge current flow during the slow MOSFET switching time turn-off of the over-ride function, when charging is disabled.
If the current hovers in this area, it could overcharge an overvoltage cell due to the repeated momentary charge current leak through every time the blocking MOSFET is turned off again. Hopefully the BMS firmware would be smart enough to monitor for cell overvoltage even though it has charge disabled. The fact that it allows a cell to exceed overvoltage protection trip point says otherwise.
I think the firmware figures if charging is disabled there is no way a cell can go overvoltage so why bother checking it. They did not count on a small glitch that allowed a small momentary charge current spurt to happen.
This is why I recommend only using the disable functions for testing purposes and not use them for regular operation.