Off-the-shelf controllers with safety certifications are giving e-mobility engineers a false sense of security.
An off-the-shelf BMS with a third-party functional safety certification sounds like a solved problem. SIL-rated, ASIL-rated, ready to drop into your e-mobility battery pack. But according to Rich Byczek, Global Chief Engineer for Batteries at Intertek, that certification probably doesn’t cover what you think it covers.
“Certified BMS systems, meaning certified systems that have functional safety certifications from a third party, don’t necessarily address these functions,” Byczek told Charged during a recent webinar (now available to watch on demand). “They just look at the controller as a more generic electrical system.”
The problem: most certifications evaluate the controller hardware against a general integrity standard (IEC 61508, ISO 26262 or ISO 13849). They verify that the electronics are reliable. They don’t verify that the controller monitors individual cell voltages, manages cell-level temperature limits or handles the specific failure modes of lithium-ion chemistry.
Fuses don’t protect at the cell level
The gap is sharpest with passive protection. A pack-level fuse can interrupt a gross overcurrent event, but it’s blind to an individual cell in a series string being driven past its voltage limits. That requires active, per-cell monitoring, and a generic certified controller may not have the inputs and outputs to deliver it.
For e-mobility systems specifically, Byczek stressed that the failure modes and effects analysis (FMEA) must evaluate overvoltage, undervoltage, overcharge, overdischarge, over- and under-temperature, short circuit and excessive current, all at the cell level. “We look at those at the cell level, not only at the macro or battery pack level,” he said.
This is a different world from portable devices, where legacy standards like IEC 62133 rely on type tests and single-fault evaluations. Those standards were designed for products a user could set down and walk away from.
E-mobility doesn’t work that way. “You’re literally riding on top of that battery, potentially going at a fairly high speed,” said Byczek. “You can’t just get away from it.”
Start with the FMEA, not the certificate
The fix isn’t complicated, but it does require work. Start with an FMEA that covers every safety-critical function your BMS must perform, at the cell level. Then verify that your controller (certified or not) actually has the architecture to deliver each one. A certified controller is a starting point, not a finish line.
The standards themselves can be mixed and matched. SIL, ASIL and Performance Levels don’t map one-to-one, but regulators accept cross-framework approaches as long as your risk assessment demonstrably covers every identified hazard. For BMS systems, you’re typically targeting SIL 2, ASIL B or PLc, but the specific level matters less than proving your system can fail safely when a sensor drifts, a resistor opens or a communication link drops.
For teams pivoting from automotive EV programs into adjacent markets like forklifts, floor scrubbers and personal mobility devices, this is the adjustment that matters most. The batteries may be smaller, but the safety obligations are not.
Watch the full webinar: Rich Byczek’s complete presentation on applying functional safety to e-mobility battery systems is available on demand.
