Lithium-ion batteries are generally considered safe in properly controlled environments. We should say that most are safe, as battery management systems (BMS) and lithium-ion battery manufacturing processes are not always perfect. However, if we cannot contend with the physics of lithium-ion technology, we can strive for better BMS designs.
Here, we will describe the possible scenarios that may occur when a failure happens and how to mitigate the impact.
Thermal runaway in battery management systems
One of the well-known failure modes in power systems is thermal runaway, which often leads to fires. In the event of a BMS failure, thermal runaway can occur due to hardware malfunctions or firmware errors.
For example, a forgotten stop command in the balancer may allow the battery to over-discharge indefinitely. In this case, even if the problem is detected and the fuse is blown, the battery discharge will not stop. Due to over-discharge, this can cause the separator between the anode and cathode in the battery to break down and perforate, resulting in a strong internal short circuit when a new charge is attempted.
Figure 1. Formation of internal copper short circuit due to over-discharge.
You might be wondering how such a short circuit could be avoided. The initial contacts might have enough resistance to keep the battery voltage high, but have a very high self-discharge current, making it undetectable by external current sensors or voltage monitors. A short circuit causes the battery to heat up, and if it reaches a critical temperature above 60°C, it will rupture and burn, heating adjacent batteries and triggering a chain reaction. This is thermal runaway, which can have catastrophic consequences.
Figure 2. High-energy battery pack burning in a 2011 Chevrolet Volt.
Mitigating faults
One solution to unexpected errors is to use an external watchdog timer in case of a fatal error in the MCU, as shown in Figure 3.
Figure 3. Typical BMS block diagram with MCU watchdog implementation
If the MCU is not stuck but the command is forgotten, the unit monitor can implement a watchdog system, as shown in Figure 4.
Figure 4. Block diagram of a BMS with a complete watchdog implementation
Alternatively, if latch-up occurs due to EMC issues or radiation, it can be shut down by designing a watchdog timer that sends out a power cycle, rather than simply a logic reset. This architecture is less common.
Other solutions to mitigate BMS failures
As energy density and power demands increase, it becomes increasingly easy to place excessive requirements on battery cells. Therefore, more accurate fuel gauges are essential, with battery impedance being a critical component.
A simple method for directly measuring impedance during operation would be useful. Panasonic claims to have achieved this using a novel localized AC stimulation technique to monitor the electrochemical impedance of batteries. While other methods exist, they require an open-circuit reference voltage and calibration.
Another improvement can rely on FRAM technology, which is commonly used as system RAM in MCUs. When buffering coulomb counter samples, FRAM retains data after a reboot, meaning that in the event of a sudden reset, the firmware is less likely to lose the last valid data.
But ultimately, the real difference lies in battery chemistry: there are many more options besides lithium-ion batteries.
