The dangers of Lithium-ion cells are well known, and not just to engineers. Stories about phones violently exploding in people’s handbags or an entire fleet of planes being grounded because of Battery related fires make for great news bulletins after all. Despite this, Li-ion batteries keep being used in basically everything because they are just, so, darn, useful.
The good news is that engineers experienced with these Batteries know exactly what they need to do to keep Li-ion cells safe. Don’t let them get too hot or too cold, don’t overcharge them or discharge them too far, and whatever you do, don’t forget to protect against short circuits.
Consumers don’t have to worry about these kinds of things because any Li-ion application where safety could be an issue has a Battery Management System (BMS) included that measures voltages, currents and temperatures in the Battery Pack, and ensures the cells are disconnected from the application whenever any of its parameters threaten to go outside of safe limits.
So that’s it then, right? No Batteries ever explode, and we all live happily ever after? Unfortunately, the universe can be a bit of a cruel place. For a variety of reasons that take longer than a 750-word Cleantron blog post to explain.
Electronic components can randomly fail without any prior warning. If this electronic component just happened to be part of a safety-critical circuit of the BMS, then we may have just lost the only system that was keeping watch over the cells and that could prevent dangerous failures. So, the one-million-dollar question is: how do you design a BMS that you can trust to do its job? That is where functional safety standards come in.
There are many standards that apply to the field of functional safety, often specializing in various applications (IEC 61508, ISO 26262, ISO 13849, to name a few), but their core purpose is always the same. If you have an electrical, electronic or programmable system performing an automatic task with the specific purpose of keeping a system safe for people, then these standards will remind you that electronics can randomly fail, and that you should implement circuits that can automatically diagnose faults in your safety-critical components.
If any of these diagnostics ever find a fault that could impact the safety of the application, then the BMS should assume the worst and turn off the Battery Pack. This design philosophy of “anything could break at all times” makes for an incredibly challenging design process. For every single component and subsystem on your BMS, an engineer must separately analyze if the component or subsystem is safety-critical and in what ways this component could fail.
If a fault in the component automatically results in the BMS disconnecting the cells, then the component is fail-safe, and you don’t have to worry about it. In any other case, diagnostics need to be implemented, and before you know it you are designing a management system for the management system. Of course, these diagnostics themselves may fail as well, but fortunately the standards recognize that an electric scooter requires a different level of safety than a nuclear power plant (this is what (A)SIL levels are for), so for most applications simple redundancy, or one level of diagnostics, is enough.
One of the interesting challenges in functional safety is to design a Battery Pack that is not just safe, but also still actually works! The safest battery pack is one that never turns on after all, and it sometimes feels like you’re designing a system that is preparing for an explosion at any moment, and you just filter out those few moments where a Battery Pack is just safe enough to actually briefly do its job. I admit there is quite some hyperbole to be found in the previous sentence of course, but nonetheless, increasing safety comes at the cost of Battery Module uptime. Finding a balance in this is quite the challenge.
There are many more aspects to functional safety that are deserving of a full blog post by themselves. For example: is software always safe? (absolutely not, look up the Therac-25); should we have diagnostics for engineers themselves? (we should, engineers are flawed human beings). For now though, I hope I have given you some idea of what functional safety is and why it’s important.
So next time you come across a Cleantron IEC 61508 certified Battery Pack you may just spare a thought for the engineers that processed hundreds of pages of functional safety standards to design a Battery Pack that – despite everything – may sometimes still just do its job!
