Before a BMS can be declared safe, its hazards have to be named, not assumed. Hazard Analysis and Risk Assessment (HARA), formalised in ISO 26262 Part 3, is the systematic process of cataloguing what can go wrong at the vehicle or system level:
- overcharge
- overdischarge
- unintended loss of tractive power
- unintended high-voltage exposure
- cell overtemperature during high-rate charge or discharge
- thermal propagation from a failed cell to its neighbours
These are scored on three axes:
- Severity (how bad the outcome is)
- Exposure (how often the operating situation occurs)
- Controllability (how easily a driver or operator can prevent harm once the fault appears).
Those three scores combine into an Automotive Safety Integrity Level (ASIL) for each hazard, from QM (no special safety requirement) up to ASIL D (the most stringent). The rating rubric itself has fixed bands: Severity runs S0 (no injuries) to S3 (life-threatening or fatal), Exposure runs E0 (incredible) to E4 (high, i.e. part of everyday driving or charging), and Controllability runs C0 (generally controllable) to C3 (difficult or uncontrollable). A lookup table combines the three bands into a QM/A/B/C/D rating, with the highest-risk combination (S3, E4, C3) landing at ASIL D.
A worked example
The table below shows how this plays out for a handful of typical BMS hazards. The S/E/C values are illustrative rather than a determination for any specific vehicle programme — a real HARA has to argue each rating from evidence (field exposure data, controllability studies) and gets reviewed independently, since the ASIL it fixes drives cost and rigour for everything downstream.
| Hazard | Typical situation | S / E / C | Illustrative ASIL |
|---|---|---|---|
| Cell overtemperature | Driving or charging | S3 / E4 / C3 | D |
| Cell overvoltage (overcharge) | DC fast charging at high SoC | S3 / E3 / C3 | C |
| Pack overcurrent | Hard acceleration or external short | S3 / E3 / C3 | C |
| Cell over-discharge | Driving at low SoC | S2 / E2 / C3 | A |
| Unintended contactor opening | Driving | S3 / E4 / C2 | C |
Reading the top row: an undetected cell overtemperature is life-threatening if it propagates to thermal runaway (S3), the triggering situations — ordinary driving and charging — are part of everyday use (E4), and a driver has no way to sense or interrupt a cell-level thermal event once it starts (C3). That combination sits in the single worst cell of the lookup table, which is why cell overtemperature typically carries the BMS’s highest ASIL. Overcharge lands one band lower only because it is tied to a narrower situation — high-SoC fast charging — which drops Exposure from E4 to E3.
Once a hazard has an ASIL, it converts into a safety goal with a safe state and a time budget (the Fault Tolerant Time Interval) for reaching it — that derivation is covered on BMS Safety Goals & Concept (FSC/TSC).
References
- Chetan Shidling, Functional Safety For An EV Battery Management System, CSEE, 2026
See also: Functional Safety Fundamentals & Standards, BMS Safety Goals & Concept (FSC/TSC), Failure Mode and Effects Analysis (FMEA) in Battery Design