Problem
Battery Safety Risk
Lack of real-time cell-level monitoring created safety risks — overcharge, thermal runaway, and cell imbalance were undetected until failure. Warranty costs were rising.
Solution
Real-Time BMS Diagnostics
Custom STM32H7 BMS firmware with LTC6813 AFE, extended Kalman filter for SoC/SoH, FreeRTOS task architecture, and ISO 26262 ASIL-B fault handling over CAN.
Result
Improved Pack Reliability
Cell imbalance detection reduced by 40%, early fault detection prevented 3 thermal events in field trials, and pack lifespan extended by an estimated 18 months.
±1%SoC Accuracy (EKF)
10msFault Response Time
48SCell Count (400V)
ASIL-BSafety Level
SoC Estimation — Extended Kalman Filter
State-of-charge estimation uses an Extended Kalman Filter (EKF) operating on a 2RC equivalent circuit model. The filter fuses coulomb counting with open-circuit voltage lookup to maintain ±1% accuracy across the full charge/discharge envelope, including dynamic load conditions.
/* EKF State: [SoC, V_RC1, V_RC2] */
typedef struct {
float soc; // State of Charge (0.0–1.0)
float v_rc1; // RC1 polarisation voltage
float v_rc2; // RC2 polarisation voltage
float P[3][3]; // Error covariance matrix
} ekf_state_t;
void bms_ekf_update(ekf_state_t *st, float i_meas, float v_meas, float dt) {
/* Prediction step */
st->soc -= (i_meas * dt) / Q_NOMINAL; // Coulomb counting
st->v_rc1 = exp(-dt/TAU1) * st->v_rc1 + R1*(1-exp(-dt/TAU1))*i_meas;
st->v_rc2 = exp(-dt/TAU2) * st->v_rc2 + R2*(1-exp(-dt/TAU2))*i_meas;
/* Innovation: measured vs predicted terminal voltage */
float v_pred = ocv_lookup(st->soc) - st->v_rc1 - st->v_rc2 - R0*i_meas;
float innov = v_meas - v_pred;
/* Update step (simplified) */
float K = st->P[0][0] / (st->P[0][0] + R_NOISE);
st->soc += K * innov;
st->P[0][0] *= (1.0f - K); // Covariance update
}CAN Message Architecture
0x300 — BMS_StatusSoC (%), SoH (%), Pack Voltage, Pack Current — 100ms
0x301 — Cell_Voltages_1Cells 1–8 voltage (mV) — 500ms
0x302 — Cell_Voltages_2Cells 9–16 voltage (mV) — 500ms
0x310 — Thermal_StatusMin/Max/Avg cell temp, coolant temp — 200ms
0x320 — Fault_StatusFault codes, DTC active flags — on-change, QoS critical
0x330 — Charge_LimitsMax charge/discharge current, target voltage — 1s
Safety & Fault Architecture (ISO 26262 ASIL-B)
- Overvoltage (OV) — Cell >4.25V triggers contactor open within 10 ms. Latching fault requiring service reset.
- Undervoltage (UV) — Cell <2.80V triggers graceful discharge halt and warning to VCU via CAN DTC.
- Overcurrent (OC) — Pack current >300A (discharge) or >100A (charge) triggers hardware comparator latch independent of firmware.
- Overtemperature (OT) — Cell >55°C activates coolant valve; >65°C triggers emergency contactor open.
- Cell Imbalance — Delta Vcell >50 mV activates passive balancing; >150 mV logs diagnostic fault.
- Communication Timeout — VCU CAN silence >200 ms → safe state (contactors open, charge disable).
Technology Stack
MCUSTM32H743 @ 480 MHz, 2 MB Flash, 1 MB SRAM
AFELTC6813-1 (12-cell measurement, isoSPI chain)
FirmwareEmbedded C, FreeRTOS 10.x, HAL + CMSIS
CANCAN 2.0B @ 500 kbps, CANopen DS301, FDCAN peripheral
SafetyISO 26262 ASIL-B, hardware OV/OC comparator, WDT
DiagnosticsUDS (ISO 14229), DTC logging to Flash, CANalyzer validation