Worked Example: BMS/System FMEA

Current Sensor Drift and SOC Estimation Error Propagation

This is a worked example accompanying Failure Mode and Effects Analysis (FMEA) in Battery Design. It is the System FMEA example in the set, and deliberately chosen because it shows something the cell-level and pack-level examples cannot: a failure that originates in one subsystem (a sensor) and produces its effect in a completely different one (electrochemical safety margin), by way of a third (BMS software). This kind of cross-domain propagation is exactly what System FMEA is for, and it is often missed when DFMEA is run separately and in isolation within each engineering discipline.

Item and function

Pack current sensor, typically a shunt-based or Hall-effect sensor reporting instantaneous current to the BMS. Function: provides the current measurement used for coulomb counting, which is one of the core inputs to State of Charge estimation.

Failure mode

Sensor output drifts from true value over time or temperature, without producing a hard fault or an out-of-range reading that would trigger an obvious diagnostic.

This distinction matters: a sensor that fails completely (open circuit, stuck output, out-of-range signal) is a comparatively easy failure mode to detect, because the BMS can flag an implausible reading immediately. A sensor that drifts gradually and plausibly is far more dangerous precisely because nothing about the individual reading looks wrong.

Effect

Coulomb counting integrates the (now slightly incorrect) current signal over time, so the error accumulates rather than staying constant. The BMS’s SOC estimation drifts away from the true state of charge. Depending on the direction of the drift, this can cause the BMS to believe the pack is less charged than it actually is (leading to conservative but not dangerous behaviour), or, in the more safety-relevant direction, to believe the pack has more remaining capacity or is at a lower state of charge than it truly is.

The dangerous case is worth stating explicitly: if drift causes the BMS to under-read SOC while the true SOC is high, cell balancing or charge termination logic that relies on that SOC estimate can allow a cell to be pushed into overcharge before voltage-based safeguards intervene. Conversely, if drift causes over-reading of remaining capacity at the low end, the pack can be driven into over-discharge. Either direction ultimately depends on voltage-based limits as a backstop, which is why this is a System FMEA line rather than a BMS-only one: the actual safety outcome depends on how the current-sensing failure interacts with the voltage-sensing and balancing systems downstream, not on the sensor in isolation.

Severity: 7. Scored below the separator and busbar examples because multiple independent layers (voltage-based cutoffs, cell-level protection) sit between this failure mode and a genuine safety event, so a single point of failure here does not directly cause harm. It is not scored lower because, in combination with a coincident failure or an edge case in those other layers, the consequence chain does reach overcharge or over-discharge, both of which are directly safety-relevant.

Cause

Thermal drift of the current sensor’s zero-offset or gain characteristic that is not adequately compensated in firmware, particularly at temperature extremes outside the range used during initial sensor characterisation.

A related but separate cause, worth its own FMEA line, is long-term aging drift in the sensor itself (distinct from thermal drift), which would have a different Occurrence profile since it develops over years rather than varying with immediate operating temperature.

Occurrence: 3. Sensor drift of this kind is a known characteristic of current sensing technology generally rather than a defect specific to a bad component, so it is not rare, but a sensor selected and specified with adequate tolerance and temperature compensation for the application should keep the magnitude and likelihood of consequential drift low.

Current controls

Periodic OCV-based SOC re-anchoring: at low current or rest conditions, the BMS can use open-circuit voltage, which is largely independent of the current sensor, to correct accumulated coulomb-counting error
Sensor tolerance and temperature-coefficient specification enforced at qualification, per EV Current Sensors: The Basics
Cross-checking coulomb-counting SOC drift against expected bounds over a defined driving cycle, flagging a diagnostic if the two diverge beyond a threshold

Detection: 3. OCV-based re-anchoring is a genuinely strong detection and correction control for exactly this failure mode, since it does not rely on the current sensor at all and directly addresses the accumulated error. Detection is scored well rather than at the best possible value because OCV re-anchoring depends on the vehicle actually reaching suitable rest conditions with sufficient regularity, and because the OCV-to-SOC relationship is itself less precise in flat regions of the OCV curve, particularly for LFP-type chemistries.

RPN and Action Priority

RPN = 7 × 3 × 3 = 63.

Under Action Priority scoring, Severity 7 with both Occurrence and Detection at the lower end of the scale bands as Medium. This is a useful contrast with the two examples above: unlike the separator and busbar lines, good existing controls (OCV re-anchoring in particular) genuinely earn a lower banding here, because they materially reduce both how often the failure matters and how likely it is to go uncorrected, rather than only reducing the numeric RPN while leaving the underlying risk profile unchanged.

Recommended action

Add a temperature-compensated calibration routine for the current sensor across its full specified operating range, rather than relying solely on OCV correction to catch drift after it has already occurred
Tighten the divergence threshold used to cross-check coulomb-counting SOC against OCV-based SOC, so smaller amounts of drift are flagged earlier
Confirm that voltage-based overcharge and over-discharge cutoffs are genuinely independent of the SOC estimate derived from this sensor, so that a drifting SOC estimate cannot itself defeat the backstop protection that limits the severity of this failure mode

That last point is the most important one from a System FMEA perspective: the recommended action is not only about the sensor itself, but about confirming the independence of the safety-net layer that keeps this failure mode at Severity 7 rather than higher. If a design review found that voltage cutoffs shared any dependency with the SOC estimation path, this would need to be re-scored at a materially higher Severity and treated as a higher priority regardless of how good the sensor’s own detection controls are.

Where this connects

This example is deliberately the one that ties the set together: it shows why System FMEA has to look across BMS Sensors, SOC Estimation, and the electrochemical safety margins covered elsewhere on this site, rather than treating each as a self-contained DFMEA subject.

Download the FMEA Worksheet Template to work through this and your own examples.