Failure Mode and Effects Analysis (FMEA) in Battery Design

Failure Mode and Effects Analysis (FMEA) is a structured method for identifying how a component, process, or system can fail, what happens when it does, and how likely that failure is to reach a customer or cause harm before it is caught. In battery engineering it is one of the primary tools used to systematically work through the enormous number of ways a cell, module, pack, or BMS can go wrong, and to prioritise engineering effort against the failure modes that matter most.

This page sets out what FMEA is, how it differs from related methods, the scoring conventions used to prioritise failure modes, and how it fits into the wider safety and quality framework already used in automotive and battery programmes. Worked examples at cell, pack, and BMS level are linked at the end.

What FMEA is, and isn’t

FMEA works forward from a cause: given that a component can fail in a certain way, what happens next. This makes it fundamentally different from Fault Tree Analysis (FTA), which works backward from an unwanted top-level event to find the combinations of causes that could produce it. FMEA is exhaustive and bottom-up; FTA is targeted and top-down. Most mature safety programmes use both: FMEA to sweep for failure modes nobody has thought of yet, and FTA to interrogate a specific known hazard in depth.

FMEA is also not the same as a HAZOP (Hazard and Operability Study), which is process-industry terminology built around deviations from design intent (more flow, less pressure, reverse flow) rather than component failure modes, though the two share a common ancestry and similar worksheet structures.

The three levels of FMEA used in battery programmes

DFMEA (Design FMEA) examines the product as designed, independent of how it is manufactured. For a battery this typically covers the cell (separator, electrodes, vent, casing), the module or pack (busbars, enclosure, cooling), and the BMS (sensors, contactors, firmware logic). The question asked at each line is: given how this part is designed, how can it fail, and what happens if it does?
PFMEA (Process FMEA) examines the manufacturing and assembly process rather than the design itself. Cell winding tension, electrode coating thickness variation, weld parameters, and torque control on busbar joints are typical PFMEA subjects. A design can be perfectly sound and still fail in the field because a process step drifted out of control.
System FMEA sits above both, looking at how subsystems interact rather than at any one component. This is where cross-domain failure propagation lives: a current sensor drift (electrical) causing an SOC estimation error (BMS) that leads to an over-discharge event (electrochemical) that increases thermal runaway risk (safety). System-level FMEA is where most of the genuinely dangerous failure modes in a battery pack are actually found, because they arise from interactions between subsystems designed by different teams.

Most OEM and Tier 1 battery programmes run all three in parallel and cross-reference them, since a single root cause (for example, a contaminated separator) can show up as a PFMEA entry (contamination control), a DFMEA entry (separator puncture as a failure mode), and a System FMEA entry (internal short circuit propagating to thermal runaway).

Scoring: RPN and the AIAG-VDA Action Priority method

The traditional scoring convention rates each failure mode on three scales, each typically 1 to 10:

Severity (S) – how bad the effect is if the failure occurs
Occurrence (O) – how likely the failure is to happen
Detection (D) – how likely existing controls are to catch it before it reaches the customer

These multiply to give a Risk Priority Number: RPN = S × O × D. Failure modes are then worked in descending RPN order.

RPN has a well known weakness: it treats the three factors as equally weighted and interchangeable, so a low-severity, high-occurrence, high-detection failure can generate the same RPN as a high-severity, low-occurrence, low-detection one, even though the latter is far more important to fix in a safety-critical product like a battery. The AIAG-VDA FMEA handbook, now the de facto automotive standard, replaces the RPN multiplication with an Action Priority (AP) table that looks up High, Medium, or Low priority directly from the S, O, and D combination, weighted so that severity dominates the outcome. In practice this means a high-severity failure mode is flagged High priority even at low occurrence and good detection, which suits battery safety analysis better than RPN does. New FMEA work on battery programmes should default to AP rather than RPN unless a customer specifically requires RPN.

Where FMEA fits alongside ISO 26262

FMEA is not itself a functional safety standard, but it is one of the standard inputs to the Hazard Analysis and Risk Assessment (HARA) process required by ISO 26262. The HARA determines the Automotive Safety Integrity Level (ASIL) of a given hazard; the FMEA (particularly the System FMEA) is where many of those hazards and their causal chains are first identified and traced to specific design and process controls. On a battery programme it is normal for the System FMEA and the HARA to be developed together, with failure modes flowing into the HARA and the resulting ASIL-driven safety requirements flowing back into the DFMEA and PFMEA as new detection or mitigation controls.

A generic FMEA worksheet

A single FMEA line typically records:

Failure Mode	Effect	Cause	Current Controls	S	O	D	AP / RPN	Recommended Action

FMEA Worksheet Template – a simple free template that is just meant as a guide to getting people started.

Working through a line means naming a specific way a specific component can fail (not “cell fails,” but “separator develops a pinhole during winding”), tracing it to its effect at the next level up, identifying the root cause, listing what already catches it, scoring it, and then deciding whether existing controls are good enough or whether a new design or process control is needed.