Road Vehicles — Functional Safety
ISO 26262 is the automotive functional safety standard, specifying requirements for safety-related electrical and electronic systems throughout the vehicle lifecycle. It defines the Automotive Safety Integrity Level (ASIL) framework: from ASIL A (lowest) to ASIL D (highest), which determines the rigour of the development process required for safety-critical functions. Battery management systems (BMS) in electric and hybrid vehicles are subject to ISO 26262 as they implement safety-critical functions including overcharge protection, thermal runaway prevention, and isolation monitoring.
Published by: International Organization for Standardization (ISO)
Current edition: ISO 26262:2018 (2nd edition, 12 parts)
Extension: ISO 21448 (SOTIF: safety of the intended functionality)
Scope
ISO 26262 applies to safety-related E/E systems in series production road vehicles up to 3500 kg. It covers the full development lifecycle from hazard analysis through design, implementation, verification, validation, and production. Part 6 addresses software development; Part 5 covers hardware. BMS software and hardware safety must be developed to the ASIL determined by the hazard analysis and risk assessment (HARA).
Key Concepts for Battery Systems
Hazard Analysis and Risk Assessment (HARA)
Hazards are identified for each operating scenario. For a BMS, hazards include thermal runaway propagation, loss of isolation, and incorrect state-of-charge estimation leading to overcharge. The ASIL is determined from the severity, exposure, and controllability of each hazard. Safety goals are derived directly from the HARA.
ASIL Decomposition and Architecture
ASIL requirements can be decomposed across redundant channels. A typical BMS architecture decomposes an ASIL D safety goal into two parallel ASIL B channels. The primary BMS and an independent safety monitor, hence reducing the development burden on each individual channel while maintaining the required system-level safety integrity. See BMS Hardware Architectural Metrics for how this decomposition is actually measured against SPFM/LFM/PMHF targets, and Dual-Core Lockstep vs. Dual-Microcontroller Architectures for ASIL D BMS for what “independent safety monitor” actually means in silicon terms and why the independence argument is the hard part of this decomposition.
Disclaimer: This is not a definitive guide, just an indication and it is important that you always go back to the source for legislation.
References
- ISO 26262:2018, ISO
See also: Functional Safety – the discipline this standard applies to vehicle E/E systems, translating IEC 61508’s SIL framework into automotive ASIL classifications for systems like the BMS., Functional Safety Fundamentals & Standards, BMS Hazard Analysis & Risk Assessment (HARA)