Battery & HV Powertrain Safety
Functional safety from cell to wheel: cell failure physics, the BMS measurement chain, contactors and HVIL, isolation monitoring, safe torque, charging and thermal runaway - quantified with FMEDA and FTTI.
- Chapters
- 14
- Chapters
- FMEDA elements in the worked slice
- 5
- FMEDA elements in the worked slice
- Worked FMEDA
- 1
- Worked FMEDA
- Minutes of study
- 100-120
- Minutes of study
Quick answers
- What is battery and HV powertrain safety under ISO 26262?
- It is the application of functional safety to the high-voltage electric powertrain: the battery pack, battery management system, contactors, inverter, motor and charging system. The hazards are distinctive - electric shock, thermal runaway and unintended torque - and some exist even when the vehicle is parked or charging. ISO 26262 governs the E/E safety functions such as the BMS measurement chain, overcharge protection and safe torque states, while ISO 6469 and UN R100 add electric-vehicle-specific safety and regulatory requirements. The safety concept must span cell physics, measurement integrity, disconnection, isolation and torque, and quantify the result with FMEDA and FTTI analysis.
- Why is the BMS measurement chain so critical?
- Because every battery safety claim rests on it. Overcharge, over-temperature and over-current protection can only react to what the BMS measures, so a frozen cell-voltage reading or a drifting analog front-end reference silently disables several safety mechanisms at once. The course follows the chain from sense line through AFE to the BMS host, covering open-wire detection, reference cross-checks such as cell-sum versus pack voltage, and the lockstep and ECC mechanisms protecting the computation itself.
Why it pays for itself
Reason from cell physics, not folklore
The cell failure and operating-window chapters let you justify voltage, current and temperature thresholds from physics, so your monitoring concept survives the question "why this number?"
Own the whole disconnect story
Contactors, precharge, weld detection, pyro disconnects and HVIL are treated as one coordinated path, so you can argue the pack can always be made safe - including under load.
Quantification with an EV twist
The worked overcharge-channel FMEDA and FTTI decomposition include the mission-profile trap most teams miss: charging is operating time, and the pack is energized even when parked.
What you’ll be able to do
Reason from Cell Physics to Requirements
Use the cell operating window and failure physics to justify monitoring thresholds and reaction times instead of copying them.
Run HARA for the HV Domain
Derive shock, thermal and unintended-torque hazards with the exposure reasoning specific to charging, parking and driving.
Design the Disconnect and Interlock Path
Specify contactors, precharge, pyro disconnects, weld detection and HVIL so the pack can always be made safe.
Argue Isolation and Shock Protection
Explain isolation monitoring, first-fault detection and layered barriers the way ISO 6469 and assessors expect.
Quantify a Battery Safety Channel
Build an FMEDA slice for the overcharge channel and decompose the FTTI across detection and reaction.
Navigate the Standards Landscape
Position ISO 26262 relative to ISO 6469 and UN R100 and know which document answers which question.
Chapter by chapter
- 01
Why the Electric Powertrain Is a Safety Domain
Frame the HV powertrain as a safety domain of its own: stored energy, voltage classes, and hazards that exist even when the vehicle is parked.
- Voltage classes
- Stored energy hazards
- Domain framing
- 02
Anatomy of the HV System
Tour the HV architecture: pack, BMS, contactors, DC link, inverter, charger and the LV side, and how the components interact in normal operation.
- Pack to wheel tour
- Component roles
- HV/LV boundary
- 03
How Lithium-Ion Cells Fail
Ground the safety concept in cell physics: the voltage-temperature operating window, abuse conditions, internal shorts and the road to thermal runaway.
- Operating window
- Abuse conditions
- Failure physics
- 04
HARA and Safety Goals for the HV Powertrain
Derive the hazards of the HV domain - electric shock, thermal events, unintended torque - and the safety goals and ASILs that follow.
- Shock and thermal hazards
- Unintended torque
- Safety goals
- 05
The BMS Measurement Chain
Follow cell voltage, current and temperature from sense line through AFE to the BMS host, and see why measurement integrity is the foundation of every battery safety claim.
- AFE architecture
- Sense line faults
- Measurement integrity
- 06
The Battery Safety Concept
Assemble the battery safety concept: monitoring layers, reaction thresholds and the allocation of safety mechanisms across cell, module and pack level.
- Monitoring layers
- Reaction thresholds
- Mechanism allocation
- 07
Contactors and the Disconnect Path
Design the disconnect path: main contactors, precharge, pyro disconnects, weld detection and interruption duty across current regimes.
- Contactor welding
- Pyro disconnects
- Interruption duty
- 08
The HV Interlock Loop
Understand HVIL as a distributed continuity loop: what it detects, what it does not, and how it coordinates de-energization when the loop opens.
- HVIL principle
- Coverage limits
- De-energization logic
- 09
Isolation Monitoring and Shock Protection
Protect against electric shock: isolation resistance monitoring, first-fault detection and the layered barriers between HV potential and people.
- Isolation monitoring
- First-fault detection
- Shock barriers
- 10
Torque and Inverter Safety
Connect the pack to the wheel: safe torque states, active short circuit versus freewheeling, and how inverter faults propagate into vehicle motion.
- Safe torque states
- Active short circuit
- Inverter fault paths
- 11
Charging Safety
Extend the safety concept to AC and DC charging, where the pack is energized for hours, external equipment joins the item, and control shifts across interfaces.
- AC vs DC charging
- Interface responsibility
- Charging hazards
- 12
Thermal Runaway Detection and Propagation
Build the thermal runaway strategy: detection signals, propagation delay design, venting, and the warning time occupants need to leave the vehicle.
- Detection signals
- Propagation delay
- Occupant warning
- 13
Quantitative Safety: FMEDA, Metrics and FTTI
Put numbers on the architecture: a worked FMEDA slice of the overcharge channel, FTTI decomposition, and the EV mission-profile twist that charging is operating time.
- Overcharge channel FMEDA
- FTTI decomposition
- Mission profile twist
- 14
Standards Map, Pitfalls and Checklist
Place ISO 26262 next to ISO 6469 and UN R100, catalog the recurring pitfalls of HV safety programs, and close with a review checklist.
- ISO 6469 / UN R100
- Pitfall catalog
- Review checklist
Not just text: the visual toolkit
Voltage classes and where common systems sit
Maps 12 V, 48 V and HV systems onto the voltage-class boundaries that decide which protection requirements apply.
Voltage-temperature operating window
An illustrative NMC cell window showing where safe operation ends and overcharge, over-discharge and thermal abuse begin.
Interruption duty by current regime
Conceptual view of what the disconnect path must interrupt across normal, overload and fault current regimes.
FMEDA Slice of the Overcharge Channel
Chapter 13 works a mini FMEDA through the overcharge protection channel, element by element, then decomposes the FTTI over an EV mission profile.
- Five elements budgeted: cell voltage sense path, AFE voltage reference, BMS MCU, contactor driver stage, main contactor
- Failure modes with dangerous fractions - frozen readings, reference drift, welded contacts, stuck-energized drivers
- Safety mechanisms per element: open-wire tests, cell-sum vs pack voltage cross-check, lockstep and ECC, weld check per cycle
- Residual dangerous FIT rolled up and read the way an assessor would
- FTTI decomposition plus the mission-profile twist: charging is operating time, and even parked the pack is energized
Unlock in course
Who this guide is for
- BMS and battery system engineers building or reviewing the battery safety concept
- Safety engineers running HARA and FMEDA for HV powertrain functions
- Inverter and charging engineers who own torque safety and interface responsibilities
- Engineers moving from conventional 12 V systems into HV powertrain development
Frequently Asked Questions
Common questions about Battery & HV Powertrain Safety
Start the course today
A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 78-guide library. No credit card required.