TL;DR #
Field evaluations of BMS functional safety in stationary lithium-ion storage systems show that BMS hardware components with safe failure fractions (SFF) below 60% cannot achieve SIL2 certification even with hardware fault tolerance of 1, making SFF a hard gate — not a soft target — in any credible procurement specification. Buyers who select a BMS based on feature lists rather than documented FMEDA reports are routinely accepting uncertified safety performance at grid-scale risk. Before issuing any RFQ for an energy storage BMS, require the supplier to provide a completed FMEDA table with per-component failure rates in FIT, diagnostic coverage percentages, and a calculated PFH value against the SIL target.
Overview #
Most procurement engineers evaluating BMS modules for stationary energy storage systems focus on the wrong things: voltage measurement accuracy, cell balancing current, communication protocol support. Those matter, but they are secondary to a more fundamental question — has this BMS been designed and verified against a recognized functional safety framework? The gap between a BMS that monitors cells and a BMS that is functionally safe is wide, and the consequences of confusing the two have been demonstrated repeatedly in real installations.
The analysis summarized here draws on engineering work conducted at industrial R&D institutions with direct involvement in grid-scale lithium-ion storage projects, using FMEDA methodology applied to full BMS hardware assemblies including BMU-level component data. The dataset covers thin-film SMD resistors, power supply sub-circuits, MCU-class components, and protection relay paths — with failure rates derived from MIL-HDBK-217F, IEC 61709, and field feedback data.
The scope is specifically fixed-installation energy storage BMS, not automotive BMS. This distinction is critical: ISO 26262 — the automotive functional safety standard — is frequently cited in BMS marketing materials, but its operating environment assumptions, demand modes, and safety goal structures do not map onto stationary storage applications. Buyers who accept ISO 26262 compliance as a proxy for storage BMS safety qualification are making an error that the standards themselves explicitly prohibit.
BMS Functional Safety Standards: IEC 61508 vs. What Suppliers Actually Deliver #
The governing framework for stationary energy storage BMS functional safety is IEC 61508, the base standard for electrical/electronic/programmable electronic safety-related systems. Downstream from it sits IEC 62619, the specific safety standard for secondary lithium cells in industrial applications, which explicitly requires BMS functional safety evaluation. ANSI/UL 1973 carries similar requirements for the North American market. Both IEC 62619 and UL 1973 mandate that manufacturers select an appropriate functional safety evaluation method — but critically, they leave that method selection to the manufacturer. This flexibility is where unqualified suppliers hide.
The practical implication: a supplier can truthfully claim IEC 62619 compliance while having performed only a superficial hazard review, not a rigorous FMEDA-based SIL determination. You need to know which method they used and see the output documentation.
The 23-incident data point you should cite in every supplier review meeting: In a period spanning roughly two consecutive years, South Korea recorded 23 separate battery energy storage station fire incidents. The Korean government’s post-incident investigation identified three root causes — battery system defects, inadequate protection against electrical shock events, and insufficient integrated system management. All three causes connect directly to BMS functional safety gaps. This is not a hypothetical risk profile.
Hazard Taxonomy for Stationary BMS #
A properly conducted system analysis for a stationary lithium-ion storage BMS identifies at least 23 distinct hazard categories. Key categories with direct BMS safety function assignments include:
| Hazard Event | Source | Primary BMS Safety Function |
|---|---|---|
| Internal short circuit | Battery cell | Current monitoring + online internal resistance monitoring |
| Thermal runaway | Electrochemical reaction | Structural design + over-temperature protection |
| Electric shock (personnel) | Insulation failure / grounding fault | Insulation fault detection + alarm |
| Overcharge (due to control loss or data drift) | BMS software error / EMS command | Main contactor control + state monitoring |
| Over-discharge followed by recharge | External command / operator error | Main contactor control + state monitoring |
| BMS communication interruption or error | BMS / EMS interface | Communication monitoring function |
| Loss of temperature control | BMS hardware failure | Over-temperature protection |
Notably, several hazard categories in a complete analysis — including seismic events, external fire, liquid ingress, and mechanical crush — fall outside functional safety scope and are addressed through enclosure design and IP protection. Buyers should not expect BMS functional safety certification to cover these; they require separate verification under mechanical and environmental standards.
Honestly, most buyers over-specify BMS communication features (CANbus, RS485, Modbus, multi-master topologies) while never asking for documentation on the safety function architecture. A BMS with beautiful telemetry and no verified SIL level is a monitoring device, not a safety system.
FMEDA Methodology and SFF Calculation: What the Numbers Mean for Procurement #
The FMEDA process — Failure Modes, Effects, and Diagnostic Analysis — is the quantitative backbone of BMS functional safety verification. Understanding its structure allows you to evaluate supplier documentation credibly, even without being a reliability engineer.
Core formula for Safe Failure Fraction (SFF):
SFF = (ΣλS + ΣλDd) / (ΣλS + ΣλDd + ΣλDu)
Where λS = safe failure rate, λDd = detectable dangerous failure rate, λDu = undetectable dangerous failure rate. All values expressed in FIT (failures per 10⁹ operating hours).
From actual BMU-level component analysis, individual thin-film SMD resistors show failure rates in the range of 0.002859 to 0.002934 FIT for open-circuit failure modes, with diagnostic coverage typically at 100% for safe failures and 60–90% for dangerous failures depending on circuit position. Power supply output resistors (e.g., 8.5V rail components) carry higher failure rates around 0.2149 FIT — over 70× higher than standard signal resistors — and warrant specific attention in the FMEDA.
The SIL determination table you need to understand:
For BMS operating in high-demand or continuous mode (which applies to all active energy storage systems — safety functions execute more than once per year), the PFH (Probability of Dangerous Failure per Hour) targets are:
| SIL Level | Target PFH Range |
|---|---|
| SIL 1 | ≥10⁻⁶ and <10⁻⁵ per hour |
| SIL 2 | ≥10⁻⁷ and <10⁻⁶ per hour |
| SIL 3 | ≥10⁻⁸ and <10⁻⁷ per hour |
| SIL 4 | ≥10⁻⁹ and <10⁻⁸ per hour |
For the anti-electric-shock safety function specifically, analysis using the hazardous event severity matrix — with medium probability of occurrence and “serious” severity classification — yields a required SIL 1 target. This covers the two independent sub-functions: insulation fault monitoring (SF1-1) and alarm output (SF1-2).
The architectural constraint that eliminates most supplier claims:
For Type B hardware (high complexity — any BMS with an MCU, DSP, or programmable logic falls here), IEC 61508-2 defines maximum allowable SIL based on SFF and hardware fault tolerance (HFT):
| SFF Range | HFT = 0 | HFT = 1 | HFT = 2 |
|---|---|---|---|
| < 60% | SIL 1 | SIL 2 | Not permitted |
| 60% to <90% | SIL 1 | SIL 2 | SIL 3 |
| 90% to <99% | SIL 2 | SIL 3 | SIL 4 |
| ≥ 99% | SIL 3 | SIL 4 | SIL 4 |
In supplier qualification work, we consistently see three failure patterns: suppliers claiming SIL 2 compliance with single-channel architectures (HFT = 0) and SFF values below 90% — which the standard explicitly prohibits. The math simply doesn’t close. When pressed for the FMEDA documentation, most cannot produce it.
Software Safety Integrity: The Verification Layer Most Buyers Miss #
Hardware SFF and architectural constraints are necessary but not sufficient. BMS software must be independently evaluated, and IEC 60730-1 Annex H — not ISO 26262 software requirements — is the applicable reference for industrial BMS software safety.
Most procurement teams don’t realize that IEC 62619 and UL 1973 specifically direct BMS manufacturers to functional safety standards for evaluation, yet the automotive-focused ISO 26262 software framework remains the default reference cited in many supplier technical dossiers. This creates a compliance theater problem — documentation that looks rigorous but references the wrong framework entirely.
For storage BMS software, the classification is Class B, which requires one of the following architectural implementations: single channel with functional test, single channel with periodic self-test, or dual channel without comparison. Each has different diagnostic coverage implications and different fault response requirements.
IEC 60730-1 Annex H Table H.1 specifies acceptable countermeasures for each software fault category. For variable storage faults in Class B software, acceptable measures include: periodic static memory tests, word protection with single-bit redundancy, redundant CPU comparison, redundant storage with comparison, and word protection with multi-bit redundancy. A supplier who cannot articulate which of these their firmware implements — and at what coverage level — has not completed software safety verification.
The recommended software development process follows the V-model defined in IEC 60730-1 Annex H. Deliverables from a qualified supplier should include: software safety requirements specification, software design and development documentation, validation plan, and software safety function evaluation records.
Practical Guidance for Buyers #
Procurement of BMS modules for stationary energy storage applications requires a fundamentally different qualification checklist than procurement of BMS for consumer or EV applications. The standards are different, the demand mode classification is different, and the documentation requirements are different.
Start with standards alignment: confirm the supplier is working to IEC 61508 and IEC 62619 — not ISO 26262. Then request the FMEDA output table with actual FIT values per component, not just summary claims. The table should show each component, its failure mode, failure rate in FIT (10⁻⁹/hr), failure mode proportion, diagnostic coverage percentage, and classification as safe (S) or dangerous detected/undetected (Dd/Du). If the supplier provides a table with those columns populated from a recognized source such as MIL-HDBK-217F, Telcordia SR-332, or IEC 61709, that is a positive signal. If they cannot produce this documentation, the SIL claim is unverified regardless of what the product datasheet says.
At CompactBESS, we work directly with verified Chinese manufacturers who supply stationary BMS modules to global energy storage integrators, and we can help you identify suppliers who maintain documented FMEDA records and third-party SIL verification — not just certification claims.
For internal resistance monitoring thresholds, over-temperature cutoff parameters, and insulation fault detection sensitivity levels, request the specific values in the safety requirements specification, not just the nominal operating spec. These are the parameters that appear in the FMEDA hazard analysis, and they are the parameters that will determine whether your system performs safely under fault conditions.
Need help identifying qualified suppliers for stationary energy storage BMS modules with verified SIL documentation? Talk to our sourcing team →
Supplier Qualification Questions #
- Can you provide the complete FMEDA table for your BMU hardware, showing per-component failure rates in FIT derived from MIL-HDBK-217F or IEC 61709, with diagnostic coverage percentages for each dangerous failure mode classified as Dd or Du?
- What is the calculated Safe Failure Fraction (SFF) for the MCU subsystem in your BMS, and which hardware fault tolerance (HFT) level — 0, 1, or 2 — does your architecture implement to meet the SIL target under IEC 61508-2 Table for Type B components?
- For the anti-electric-shock safety function (insulation fault monitoring + alarm), what is the achieved PFH value, and does it fall within the SIL 1 target range of ≥10⁻⁶ and <10⁻⁵ per hour under high-demand operating mode as defined by IEC 61508?
- Has your BMS software been verified against IEC 60730-1 Annex H Class B requirements, and which software architecture type — single channel with functional test, single channel with periodic self-test, or dual channel without comparison — is implemented for safety-critical firmware modules?
- For the overcharge protection safety function (triggered by control loss, data drift, or software error), what is the main contactor control response time specification, and what state monitoring redundancy is in place to ensure detection of undetectable dangerous failures (λDu) within your PFH budget?
Sourcing Checklist #
- [ ] Supplier provides FMEDA documentation with individual component failure rates expressed in FIT (10⁻⁹/hr), sourced from MIL-HDBK-217F, Telcordia SR-332, or IEC 61709
- [ ] BMS hardware SFF is documented at ≥90% for MCU-class (Type B) components targeting SIL 2 with HFT = 1, per IEC 61508-2 architectural constraint table
- [ ] PFH value for each safety function is calculated and confirmed within the SIL 1 target range (≥10⁻⁶ to <10⁻⁵/hr) or SIL 2 range (≥10⁻⁷ to <10⁻⁶/hr) as applicable under high-demand mode
- [ ] Supplier’s hazard analysis covers all 23 hazard event categories for stationary storage (or provides documented rationale for any exclusions), including internal short circuit, thermal runaway, insulation fault, overcharge, over-discharge, and BMS communication failure
- [ ] Software safety verification references IEC 60730-1 Annex H (Class B) — not ISO 26262 — and includes documented fault countermeasures for variable storage faults and CPU faults
- [ ] Third-party SIL verification or certification is available from a recognized body (UL, CSA, TÜV, or Bureau Veritas) — not self-declared only
- [ ] Reliability block diagram for the complete safety loop is available, showing sub-system structure types (1oo1, 1oo2, 2oo2) and common cause failure (CCF) factors used in PFH calculation
Key Specifications Table #
| Parameter | Recommended Value | Verification Method |
|---|---|---|
| Safe Failure Fraction (SFF) — Type B MCU subsystem | ≥90% to achieve SIL 2 with HFT = 1; ≥99% for SIL 3 | FMEDA calculation per IEC 61508-2 Annex C; formula: SFF = (ΣλS + ΣλDd) / (ΣλS + ΣλDd + ΣλDu) |
| PFH target — SIL 1 safety functions (e.g., insulation fault detection) | ≥10⁻⁶ and <10⁻⁵ dangerous failures per hour | IEC 61508-6 Annex B.3.3.2 PFH formula; 1oo1 structure: PFHG = λDu |
| PFH target — SIL 2 safety functions (e.g., overcharge / over-discharge protection) | ≥10⁻⁷ and <10⁻⁶ dangerous failures per hour | Reliability block diagram quantification; 1oo2 structure formula per IEC 61508-6 |
| Component failure rate — standard signal SMD resistors | 0.002859 to 0.002934 FIT (10⁻⁹/hr) for open-circuit mode | Per MIL-HDBK-217F or IEC 61709 with actual circuit application factors |
| Component failure rate — power supply output resistors (8.5V rail) | ~0.21486 FIT; diagnostic coverage 100% (safe failures) | FMEDA component-level analysis; cross-check against field return data |
| Diagnostic coverage — dangerous failures, Type B components | High: ≥99%; Medium: ≥90%; Low: ≥60% | Per IEC 61508-2 Annexes A.2–A.14 diagnostic coverage constraint tables |
| Hardware fault tolerance — BMS targeting SIL 2, SFF 60–90% | HFT = 1 minimum (dual-channel or equivalent redundancy) | Architectural constraint verification per IEC 61508-2 Table for Type B |
Can’t find a supplier meeting these specs? Submit your requirements and we’ll match you within 48 hours.
Frequently Asked Questions #
Q1: What is the difference between a BMS that complies with IEC 62619 and one that is SIL-certified under IEC 61508?
IEC 62619 sets safety requirements for lithium cells and batteries in industrial applications and requires that BMS functional safety be evaluated — but it does not prescribe the evaluation method or certify the SIL level. IEC 61508 provides the actual quantitative framework for determining SIL targets, performing FMEDA analysis, and verifying hardware and software safety integrity. A product can pass IEC 62619 testing without having undergone the full FMEDA-to-SIL verification chain required under IEC 61508. For high-reliability storage applications, you need documented compliance with both.
Q2: Why does ISO 26262 not apply to stationary energy storage BMS?
ISO 26262 was developed for road vehicles and its safety goal structure, ASIL classification, and operating environment assumptions are built around automotive use cases — defined drive cycles, known load profiles, and automotive-grade component populations. Stationary storage BMS operate under different demand modes (continuous vs. event-driven), different environmental stress profiles, and different regulatory frameworks. The standards bodies that publish IEC 62619 and UL 1973 explicitly state that automotive functional safety standards are not applicable to stationary storage BMS qualification.
Q3: What is a “high demand mode” BMS and why does it matter for SIL specification?
A BMS in high-demand mode is one where safety functions are activated more than once per year — which describes every active energy storage system. In high-demand mode, IEC 61508 requires that safety performance be expressed as PFH (Probability of Dangerous Failure per Hour) rather than PFD (Probability of Failure on Demand). This distinction changes both the calculation methodology and the acceptable numeric targets. Most commercial BMS datasheets don’t specify which mode their safety calculations are based on — ask explicitly.
Q4: Can a supplier with a single-channel BMS architecture achieve SIL 2?
Only if the SFF is ≥90% — which requires extremely high diagnostic coverage across all dangerous failure modes. For Type B hardware (MCU-based BMS), a single-channel architecture (HFT = 0) with SFF below 90% is limited to SIL 1 maximum under IEC 61508-2. Achieving SIL 2 with HFT = 0 requires SFF ≥ 90%; with HFT = 1 (redundant channel), SFF between 60% and 90% is sufficient. Most real-world BMS implementations targeting SIL 2 use HFT = 1 architectures.
Q5: What failure rate data sources are acceptable for FMEDA in a BMS qualification?
The most credible sources, in descending order of preference: actual field return data from the specific component population in the BMS assembly; manufacturer component handbooks with application-specific data; and recognized prior-use handbooks including MIL-HDBK-217F (US DoD), Telcordia Bellcore SR-332 (telecom/commercial electronics), IEC 61709 (general electronic components), and Siemens SN 29500. For BMS procurement evaluation, suppliers using only MIL-HDBK-217F military-grade failure rates for commercial components may be presenting optimistic (lower) failure rates — confirm that application derating factors have been applied.
Published by compactbess.com Technical Team | Request a sourcing quote
Data source: Functional Safety Analysis and Design Framework for Battery Management Systems in Stationary Lithium-Ion Energy Storage Applications, H. Zhang et al., Journal of the Electrochemical Society, 2024
