The BMS is the part of a battery system that people either treat as a black box or blame for everything. It is neither mysterious nor all-powerful, and knowing precisely what it can and cannot do is one of the more useful pieces of professional knowledge in this industry.
The seven jobs
Measurement. Cell voltages, pack current, temperatures at a number of points, and in some systems insulation resistance to chassis. Everything else the BMS does depends on these signals being trustworthy.
State estimation. State of charge, state of health, and state of power, meaning how much current the pack can accept or deliver right now without violating a limit. None of these is measured; all are computed.
Protection. Enforcing voltage, current and temperature limits, by requesting a reduction from the host system where possible and by opening contactors where not.
Balancing. Equalising cells in a series string so the pack is not limited by one outlier.
Thermal coordination. Requesting cooling or heating, and in cold conditions restricting charge current until the pack reaches a temperature where charging is safe.
Communication. Reporting state and limits to the vehicle controller, inverter or energy management system, and receiving commands.
Logging. Recording operating history for diagnostics, warranty adjudication and, increasingly, regulatory reporting.
Topology
| Topology | Arrangement | Suits | Trade-off |
|---|---|---|---|
| Centralised | One board, all cell taps wired back to it | Small packs, low cell count, cost-sensitive | Long sense harnesses, noise pickup, awkward to service |
| Modular, master and slave | Slave boards per module, one master | Most EV and stationary systems | Extra communication layer to design and qualify |
| Distributed, cell level | Electronics on each cell or small group | High cell counts, aviation, high-value systems | Highest component count and cost |
The modular arrangement dominates because it keeps sense wires short, allows modules to be built and tested independently, and lets one design scale across pack sizes. Slave to master communication is usually a daisy-chained isolated link, with the master speaking CAN or CAN FD to a vehicle, or Modbus TCP and increasingly IEC 61850 to a grid controller.
Measurement, and why LFP raises the bar
Cell voltage measurement accuracy is a specification worth examining closely. In a nickel-rich cell with a sloped voltage curve, a measurement error of a few millivolts translates to a small state of charge error. In LFP, where the curve is nearly flat across the middle of the range, the same error can correspond to a large state of charge error, and it also makes cell divergence harder to spot early.
The practical consequences for LFP systems: specify tighter voltage measurement accuracy, pay more attention to current sensor quality and calibration since coulomb counting carries more of the estimation load, and plan for periodic full charges so the estimator has a reference point.
Temperature measurement has a different limitation. You will never have a sensor on every cell. Sensor count and placement are a design compromise, and the assumption that measured points represent the hottest cell is exactly that, an assumption. It should be validated with thermal modelling and instrumented testing, not asserted.
Balancing, done honestly
Cells in a series string differ in capacity, internal resistance and self-discharge rate, from production tolerance and from uneven ageing in service. Because the string charges until the first cell reaches its upper limit and discharges until the first cell reaches its lower limit, divergence directly costs usable capacity.
Passive balancing switches a bleed resistor across cells that are ahead, dissipating the excess as heat. Currents typically run from about 30 to 200 mA, with 50 to 100 mA common in automotive monitor chips. It is cheap, simple and adequate for cells that were well matched at build and have aged evenly.
Active balancing transfers charge from higher cells to lower ones using switched capacitors, inductors or transformers. It wastes far less energy and can handle larger imbalances, at the cost of components, board area, control complexity and validation effort.
The question to ask a supplier is not which type they use, but how long full balancing takes from a realistic worst-case imbalance. A passive system with 50 mA of balancing current facing a 2 Ah divergence needs on the order of forty hours of balancing time, and if balancing only runs at the top of charge in an application that rarely charges fully, it may never catch up. That arithmetic is where a lot of field capacity complaints originate.
Protection is layered
Treating the BMS as the safety system is a category error. Safe designs put independent layers in series, each covering the failure of the one before.
Software limits in the BMS act first, requesting current reduction from the host.
An independent hardware protection circuit, typically a separate integrated circuit with its own voltage and current thresholds, acts if the software layer fails or hangs.
Contactors open to disconnect the pack, with welded-contactor detection because a welded contactor is a failure mode that leaves the system apparently disconnected while it is not.
Fuses, and in automotive applications pyrotechnic disconnects, handle currents beyond what contactors can safely interrupt.
Which layers must be independent, and to what integrity level, is set by functional safety analysis. Automotive systems work to ISO 26262 with hazards assigned an ASIL rating. Industrial and stationary systems work to IEC 61508 and the sector standards derived from it, with IEC 62619 covering safety requirements for industrial lithium batteries. This work drives architecture, so it belongs at the start of a programme rather than at certification.
What a BMS cannot do
It cannot measure state of charge. Every displayed percentage is an estimate, with an error band that widens between calibration opportunities.
It cannot see inside a cell. An internal short developing from a metal particle introduced during manufacturing produces almost no external signature until it produces a very large one. This is precisely why propagation-resistant pack design exists.
It cannot compensate for bad cell selection or a poor thermal design. A BMS asked to keep an under-cooled pack inside its limits will do so by restricting current, and the user experiences that as a system that underperforms its specification.
It cannot balance faster than its hardware allows, whatever the software claims.
Where integrations go wrong
Temperature sensors placed where it was convenient to route the harness rather than where the pack runs hottest.
Balancing current specified without reference to the imbalance the application will actually produce.
State of charge limits set at cell level while the host system reasons in terms of the displayed pack percentage, so the two disagree at the edges of the window.
Contactor welding detection omitted or untested.
Communication timeouts handled by defaulting to a permissive state rather than a safe one. The correct behaviour on loss of communication is to move towards a safe state, and it needs testing rather than assuming.
Logging designed for engineering diagnostics rather than for warranty and, from 18 February 2027 in the EU, for the durability and state of health data the battery passport requires under Regulation (EU) 2023/1542. Retrofitting that data collection into deployed assets is considerably harder than specifying it at the start.
Informational and educational content only. Not professional, financial, legal, or engineering advice.