BMS Functional Safety Explained: HARA, FMEA, and ASIL/SIL Behind BMS Certification
| ⚡ Quick Answer: What Is BMS Functional Safety? BMS functional safety is the structured process used to find and control failure risks before a battery management system reaches the field. It centers on two core methods: HARA (Hazard Analysis and Risk Assessment), which identifies hazards and ranks their risk, and FMEA (Failure Modes and Effects Analysis), which traces specific failure modes to their effects. In automotive BMS design under ISO 26262, this risk ranking is called ASIL. For stationary BESS, the equivalent rating is SIL under IEC 61508, since ASIL itself is an automotive-only term. A supplier who can show you their HARA and FMEA documentation, not just a certificate, has done the real engineering work. |
1. Why the Process Matters More Than the Certificate
Most BMS buyers ask suppliers for certifications: UL 1973, IEC 62619, sometimes UL 9540A. Those certificates matter. However, they mostly confirm the outcome, not the process behind it. BMS functional safety is that process. It is the structured method engineers use to find failure risks early. In other words, it catches problems before they become field failures or safety incidents.
For the certifications a BMS itself typically carries, see our complete battery management system guide. This article goes behind those certificates, into the HARA and FMEA process that safety engineers use to earn them in the first place.
2. HARA: How Hazards Get Identified and Ranked
HARA stands for Hazard Analysis and Risk Assessment. It is the starting point of any BMS functional safety process. First, engineers define the “item” under review — for example, the high-voltage battery pack and its BMS. Then they ask a simple question: what could go wrong, and how bad would it be?
A typical HARA example for a BMS looks at overvoltage detection during charging. If that detection fails, the battery can overcharge. In the worst case, this leads to thermal runaway. As a result, HARA ranks this kind of hazard using three factors: how severe the harm could be, how often the situation is likely to occur, and how controllable it is once it starts. Together, these three factors produce a risk classification for that specific hazard.
3. From HARA to ASIL or SIL: Why the Terms Differ Between EV and BESS
Here is where a lot of BMS content gets confusing. In automotive functional safety, ISO 26262 assigns each hazard an ASIL rating. ASIL stands for Automotive Safety Integrity Level, and it ranges from ASIL A at the low end to ASIL D at the high end. Notably, ASIL is an automotive-only term. It only applies under ISO 26262.
Stationary BESS does not use ISO 26262 or ASIL at all. Instead, industrial and stationary battery systems typically reference IEC 61508, the foundational functional safety standard for industrial equipment. Under this standard, the equivalent risk rating is called SIL, or Safety Integrity Level. It ranges from SIL 1 at the low end to SIL 4 at the high end. IEC 62619, the safety standard most directly relevant to stationary lithium battery systems, builds on this same risk-based approach.
In short: if a supplier quotes an ASIL rating for a stationary BESS product, ask why. That term belongs to automotive design. For BESS, the correct reference point is SIL under IEC 61508, or the specific requirements in IEC 62619.
4. FMEA: Finding Failure Modes Before They Find You
Once HARA has ranked the hazards, FMEA takes over next. FMEA stands for Failure Modes and Effects Analysis. It works from the bottom up. First, engineers list every plausible way a component can fail. Then, they trace each failure forward to its effect on the system.
For a BMS, a typical FMEA entry might look like this: a voltage sensing connector goes loose. That failure causes a false voltage reading. In turn, the false reading could let the BMS miss a real overvoltage condition. For each entry, engineers also note a detection or mitigation mechanism. For example, this might be a redundant voltage check, or a plausibility test that catches an implausible reading before it reaches a safety-critical decision.
A properly documented FMEA does not just list failures. It also proves how each one gets prevented or caught. That proof is what an auditor or a certification body actually reviews.
5. FMEDA: When Hardware Diagnostics Get Quantified
FMEDA extends FMEA with numbers. It stands for Failure Modes, Effects, and Diagnostics Analysis. Rather than only describing failure modes in words, FMEDA calculates a diagnostic coverage percentage for each one. In other words, it shows what fraction of that failure mode’s occurrences the system’s safety mechanisms will actually catch.
This matters for BMS functional safety because a hardware design is only as safe as its worst-covered failure mode. A BMS might claim excellent overall diagnostic coverage. Even so, it could still leave one connector or one sensor path poorly monitored. FMEDA is what surfaces that gap before a customer, not an incident, does.
6. What a Real BMS Functional Safety Process Actually Produces
A supplier who has genuinely run this process should, therefore, be able to produce specific documents, not just a summary slide. Look for these deliverables:
- A HARA report, listing each identified hazard with its severity, exposure, and controllability ratings, plus the resulting SIL (for BESS) or ASIL (for automotive) classification.
- Safety goals derived from the HARA. These are stated as top-level requirements, for instance: “prevent cell overvoltage during charging under single-point failure conditions.”
- A functional safety concept. This translates each safety goal into requirements — first functional, then technical, down to the hardware and software level.
- An FMEA or FMEDA report, listing failure modes, their effects, and the safety mechanism that detects or prevents each one.
- A safety case or validation report. This shows how testing confirmed the safety mechanisms actually work as designed.
These safety mechanisms must map seamlessly across the entire battery topology. For a closer look at how these safety-critical diagnostic lines and communication protocols are distributed across physical hardware layers, see our guide to centralised, modular, and wireless BMS architecture.
For the specific BMS algorithms — SOH, SoP, isolation monitoring, safety diagnostics — that these safety mechanisms often rely on, see our BMS algorithms guide. In short, functional safety analysis is the process that justifies why those algorithms exist and how thoroughly they were tested.
7. Questions to Ask Your Supplier About BMS Functional Safety
Before finalizing your procurement, it helps to have a structured framework for vetting a vendor’s safety claims. For a comprehensive breakdown of what to look for beyond documentation, review our BMS supplier evaluation checklist.
- Can you show me the HARA report for this BMS, including the hazards identified and their risk ratings?
- Is your safety rating expressed as SIL under IEC 61508, or ASIL under ISO 26262? Does that match whether this is a stationary or automotive product?
- Can you provide the FMEA or FMEDA report showing diagnostic coverage for each major failure mode, not just one overall percentage?
- What safety goals came out of your HARA? How do they map to the BMS features you actually ship?
- Has an independent third party reviewed this functional safety process, or is it entirely self-assessed?
Conclusion: Ask for the Process, Not Just the Certificate
A certification number tells you a BMS passed a test. BMS functional safety documentation tells you why it should pass. It also shows what specific hazards the engineering team found and controlled along the way. For BESS projects, insist on SIL ratings under IEC 61508 or IEC 62619 evidence. Do not accept an automotive ASIL number instead, since it simply does not apply. Ask to see the HARA and FMEA reports directly. After all, a supplier with nothing to show beyond a certificate has likely skipped the part of the work that actually keeps a battery pack safe.
| ☀️ Need a BMS Functional Safety Review for Your BESS Project? Sunlith Energy reviews BMS functional safety documentation — HARA reports, FMEA coverage, and SIL classification — for BESS projects from 50 kWh upward. Contact us before you finalize a supplier. |
Frequently Asked Questions About BMS Functional Safety
What is the difference between HARA and FMEA in BMS functional safety?
HARA identifies hazards at the system level and ranks their risk using severity, exposure, and controllability. FMEA, on the other hand, works at the component level. It traces specific failure modes up to their effects on the system. Typically, HARA comes first and sets the risk target. FMEA then verifies the design meets that target.
Why doesn’t ASIL apply to stationary BESS?
ASIL, or Automotive Safety Integrity Level, is defined specifically within ISO 26262, an automotive functional safety standard. Stationary BESS does not fall under that standard. Instead, it typically references IEC 61508, whose equivalent risk rating is called SIL, or Safety Integrity Level.
What is FMEDA and how is it different from FMEA?
FMEDA, or Failure Modes, Effects, and Diagnostics Analysis, extends FMEA by adding a quantified diagnostic coverage percentage for each failure mode. Standard FMEA describes failure modes and their effects in words. FMEDA, by contrast, calculates how much of each failure mode the system’s diagnostics will actually catch.
What documents should a BMS supplier provide as proof of functional safety work?
At minimum, ask for the HARA report and the safety goals derived from it. Also request the FMEA or FMEDA report, plus a safety validation document showing that testing confirmed the safety mechanisms work as intended. If a supplier can only provide a certificate, with none of these underlying documents, they have likely not completed a full functional safety process.
Does IEC 62619 replace the need for a HARA and FMEA process?
No. IEC 62619 sets safety requirements specifically for stationary lithium battery cells and systems. However, it does not replace the underlying HARA and FMEA process used to design and verify BMS safety mechanisms. Instead, the two work together: IEC 62619 sets the target, and the functional safety process is how a supplier gets there and proves it.