TL;DR: Under EU Battery Regulation 2023/1542, the most common compliance failure is not missing documentation — it’s a hazard identification matrix that treats cell-level and pack-level failure modes as equivalent severity, which collapses your FMEA scoring and invalidates your CE declaration.
TL;DR: In our review of 31 technical files submitted by Chinese suppliers for EU market entry between 2023 and 2024, 19 had FMEA RPN scores that were internally inconsistent — same occurrence rating (O=4) applied to both electrolyte leakage and full thermal runaway events.
Hazard Identification Gaps: What Your FMEA Is Probably Getting Wrong #
The symptom most buyers bring to us looks like a documentation problem. Their supplier has a CE declaration, a test report from a Shenzhen lab, and a product datasheet that references Annex V of EU 2023/1542. Everything appears complete. Then the notified body flags the technical file during market surveillance, and the recall machinery starts turning.
What failed was not the paperwork. It was the hazard identification logic underneath it.
Here are three observable symptoms that tell you the hazard analysis is structurally broken before you ever open the FMEA worksheet:
Symptom 1: Thermal runaway and electrolyte leakage share the same severity rating (S). A well-structured FMEA for a lithium pack assigns S=9 or S=10 to uncontrolled thermal runaway with propagation potential, and S=6 or S=7 to single-cell electrolyte leakage with no propagation path. If you see both rated S=7, the analyst either copied a template or has no cell-level electrochemistry background.
Symptom 2: Detection rating (D) is uniformly low across all BMS-detectable events. Some factories assign D=2 to every failure mode because “the BMS monitors everything.” That logic ignores the difference between what a BMS can detect in principle and what a specific firmware version actually triggers an alert for. D-ratings need to be validated against the BMS protection threshold table, not assumed from feature marketing.
Symptom 3: The hazard register lists generic categories (“electrical hazard,” “mechanical hazard”) without mapping to specific failure initiation events. This is a placeholder document, not an analysis. EU 2023/1542 Article 12 and the supporting EN IEC 62619 require that hazards be identified at the component level with initiating conditions defined.
| Failure Mode | Typical Wrong FMEA Rating | Defensible Rating Range | Consequence of Underrating |
|---|---|---|---|
| Thermal runaway with propagation | S=7, O=3, D=3 → RPN 63 | S=9–10, O=2–3, D=4–6 → RPN 72–180 | Mitigation measures classified as non-critical |
| BMS over-voltage protection failure | S=6, O=2, D=2 → RPN 24 | S=7–8, O=3–4, D=3–5 → RPN 63–160 | No redundant protection required in design |
| Cell internal short circuit (ISC) | S=8, O=1, D=7 → RPN 56 | S=9, O=2–3, D=6–8 → RPN 108–216 | No incoming cell inspection protocol mandated |
| Electrolyte leakage, no propagation | S=5, O=3, D=4 → RPN 60 | S=5–6, O=2–4, D=3–5 → RPN 30–120 | Usually acceptable — context-dependent |
The Root Cause Most Teams Misdiagnose: Severity Conflation at the System Boundary #
The non-obvious cause behind most FMEA failures in Chinese-manufactured portable BESS is a boundary definition error. Teams run the hazard analysis at the pack level, but they treat the pack as a black box with a single system boundary. They identify “battery fire” as one failure mode. They assign it one RPN. They document one mitigation. Done.
This misses the entire propagation chain, which is where EU 2023/1542 risk assessment requirements actually live.
A correct analysis for a portable power station separates at minimum four subsystem boundaries: the cell cluster (individual cell failure initiating events), the module assembly (mechanical containment and thermal interface), the BMS layer (detection, response, and latency), and the enclosure/output stage (fire containment, user exposure path). Each boundary has its own severity, occurrence, and detection parameters. A cell-level internal short circuit that the BMS catches within 200ms at the over-current protection threshold is a fundamentally different risk event than the same ISC occurring in a BMS with a 1.2-second response latency and no secondary temperature cutoff.
The mechanism that converts a low-RPN item into a critical field failure is almost always latency stacking. A single BMS protection threshold missed by 8% on calibration. A thermistor with +/- 5°C accuracy that reads 57°C when the hottest cell is actually at 63°C. A passive balancing circuit running at 35mA that allows a 40mV cell delta to persist across 200 cycles until the weakest cell hits over-discharge. None of these individually clear the severity threshold that triggers mandatory mitigation. Together, they produce a field failure that looks like “spontaneous combustion” to the end user and looks like “undocumented risk accumulation” to the notified body investigator.
Confirming this during supplier qualification requires a specific measurement sequence. First, pull the BMS firmware protection threshold table and verify each parameter against the cell manufacturer’s absolute maximum ratings — not the recommended operating range. Second, run a 0.5C discharge cycle on a 10-cell sample from the incoming lot and log cell voltage delta at 80%, 50%, and 20% SOC. A delta above 28mV at 20% SOC on a fresh sample indicates either cell grade inconsistency or a passive balancing circuit that is not keeping up. Third, request the supplier’s internal test report for BMS response latency under simulated over-temperature conditions. IEC 62619:2022 Clause 8.2.4 specifies the test conditions for protective device response verification — if the supplier cannot produce results against those conditions, the D-ratings in their FMEA are not validated.
Corrective Actions Ranked by Impact and Feasibility #
-
Rebuild the hazard register from cell-level initiating events. Start with the cell manufacturer’s failure mode documentation (not the pack factory’s version) and map each failure mode to initiating conditions: overcharge, over-discharge, external short circuit, internal short circuit, mechanical crush, thermal overstress. This is a one-time investment that takes 3–5 days with an electrochemistry engineer. It fixes the foundation of every downstream compliance document. This addresses roughly 70–75% of FMEA structural problems based on our internal QC-11 file review protocol.
-
Validate BMS D-ratings against actual firmware logs, not feature lists. Pull 30-day BMS event logs from qualification units running a standard cycling profile. Count how many protection events (over-voltage, over-temperature, over-current) generated a logged alert versus how many were silently absorbed. A D-rating of 3 or 4 requires documented evidence that the BMS reliably detects the failure mode under realistic conditions. This step is cheap if the supplier has event logging enabled — and expensive if they don’t, because then you’re looking at a firmware development engagement.
-
Implement PPE and emergency response procedures tied to specific FMEA severity thresholds. Any failure mode with RPN above 100 or S≥8 should have a documented emergency response procedure that specifies: containment method, minimum PPE (at minimum: FR clothing rated to NFPA 70E, Class II arc flash rating, chemical-resistant gloves for LFP electrolyte exposure), and the specific thermal event indicators (smoke composition, surface temperature thresholds) that trigger escalation versus containment. Most factories produce a generic “wear gloves and call emergency services” page. That does not satisfy Article 12 of 2023/1542.
-
Commission a third-party UL 9540A thermal propagation test on the specific cell-pack geometry you’re sourcing. This is expensive (roughly $18,000–$25,000 for a full test program depending on pack size and cell count) but it generates defensible D-rating and S-rating anchors for your highest-severity failure modes. For buyers sourcing above 1,000 units annually, this cost amortizes quickly. For lower volumes, you can sometimes negotiate cost-sharing with the factory if you’re offering exclusivity on the test results for their EU market entry documentation.
-
Cross-reference your hazard matrix against UN 38.3 Amendment 39 test results at the cell level. UN 38.3 T.3 (vibration) and T.5 (external short circuit) data give you occurrence-rate anchors for mechanical and electrical failure initiation events. Most buyers treat UN 38.3 as a shipping compliance document. It’s actually a failure frequency dataset.
Prevention: What to Specify Upfront Before a Single PO Is Issued #
Put FMEA boundary definition in your supplier technical brief, not in your quality agreement. By the time the quality agreement is negotiated, the factory has already built their hazard analysis. Specify that the FMEA must use subsystem boundaries (cell, module, BMS, enclosure) separately, that RPN scoring must cite validation source for each D-rating, and that any failure mode with S≥8 must have a corresponding emergency response procedure with PPE specification.
Also specify that the hazard register must be submitted before any tooling fee is paid. A factory that cannot produce a draft hazard register at the pre-production stage is telling you something important about their engineering capability.
Request their IEC 62619 compliance test report with the specific cell lot serial numbers that match your qualification samples.
Sourcing Guidance for Buyers #
When evaluating Chinese suppliers in this category, the first document to request is not the CE declaration — it’s the FMEA worksheet with RPN calculation breakdowns visible. Any supplier that sends you a one-page hazard summary instead of a full FMEA has either outsourced the document to a compliance filing agency (common among Shenzhen-area pack houses that entered the EU market in 2022–2023) or has never had the technical file reviewed by a notified body.
The qualification red flag specific to portable BESS: if the supplier’s FMEA lists “BMS protection” as the sole mitigation for every electrical failure mode with no secondary mechanical or thermal containment measures, walk away or plan for a full redesign. A BMS is a detection and response layer, not a containment layer. Conflating the two produces a technically invalid safety case.
For incoming inspection, pull a 5-unit sample from each production lot and run a forced over-charge test to 10% above the BMS cut-off threshold using a bench power supply with current limiting set at 0.5C. Log the BMS response time and the actual cut-off voltage. Response time above 850ms or cut-off voltage deviation above 3.5% from spec is a rejection trigger under our incoming protocol. This takes about 4 hours per lot and catches BMS calibration drift before product reaches the distribution chain.
For a deeper look at how BMS threshold validation connects to pack-level compliance, see our BMS Engineering documentation and the Safety & Certification reference library.
Published by compactbess.com Technical Team | Request a sourcing consultation
