Home › Safety

EV Battery Safety Architecture

A reused EV pack is a stationary lithium-ion storage system operating at 48–800 V DC and 40–200 kWh. This page describes which safety functions the original BMS retains, which the BMS-EV controller handles, and which the installer must provide externally.

Responsibility split — three layers of protection

Second-life systems are engineered as three concentric safety layers. Removing any one of them creates an unsafe installation. The table below summarises which subsystem owns each hazard.

HV isolation and DC architecture

Most high-voltage EV battery packs use a floating (IT) architecture — neither the positive nor the negative DC rail is bonded to the pack case or chassis. The exact grounding and isolation topology must be verified for the specific pack before installation. This is a deliberate safety choice: a single ground fault does not create a shock path. When you reuse the pack for stationary storage the isolation architecture must be preserved. Do not tie either DC pole to PE; instead install an insulation monitoring device (IMD, e.g. Bender ISOMETER, SMA ISO-Guard) rated for the pack's nominal voltage. The IMD continuously measures resistance between DC rails and earth and BMS-EV supported systems use an alarm threshold of 100 Ω/V. IEC 61557-8 specifies requirements for insulation monitoring devices themselves; the applicable trip threshold for a given installation depends on the IMD, the system voltage and the standards in force locally, typically 40 kΩ for a 400 V pack and 80 kΩ for an 800 V pack. Tesla Model 3/Y, BMW i3 and VW MEB packs include an integrated isolation monitor that reports to the internal BMS over CAN; BMS-EV forwards the value to the inverter. Nissan Leaf, older Renault Zoe and Kia Soul EV packs do not include IMD circuitry — the installer must fit an external unit. Isolation faults must trigger an immediate contactor opening; the BMS-EV firmware supports a digital input for this signal.

Precharge and contactor control

An HV pack presents 300–450 V (400 V class) or 550–800 V (800 V class) across the DC bus. The DC-link capacitors in a hybrid inverter can reach 3–10 mF. Closing the main contactor into an uncharged capacitor would draw thousands of amperes of inrush current, weld the contactor and possibly rupture the fuse. The BMS-EV controller sequences a precharge circuit — a 50–200 Ω power resistor (typically 100 W) in series with a small precharge contactor — that charges the inverter DC link to within 95 % of pack voltage before the main contactor closes. Typical precharge time is 200 ms to 2 s depending on capacitance. The controller measures inverter-side voltage on an analog input; if precharge does not complete within a timeout (5 s default) it aborts and reports a fault over CAN. On shutdown the main contactor opens first, then the precharge resistor discharges the inverter capacitors down to under 60 V DC (SELV limit per IEC 61140) before the system reports safe.

HVIL — High Voltage Interlock Loop

In a vehicle, every HV connector — battery service disconnect, charge port, motor bus bars, junction box — carries a small signal loop routed through pilot pins. If any HV connector is opened the loop breaks, the BMS detects it and opens the main contactors within 10 ms per ISO 6469-3 §7.4. For a stationary installation you must preserve this behaviour on any user-accessible HV joint. In practice the installer wires the pack's HV service disconnect (Tesla MSD, BMW manual service disconnect, MEB pyro switch) and the DC isolator switch in series into the HVIL loop; the BMS-EV controller closes the loop at its end and monitors continuity. Opening any switch immediately drops the main contactor. Preserving an HVIL loop across all user-accessible HV disconnects is standard practice for HV ESS installations. Whether it is a legal requirement in a specific jurisdiction depends on the local grid code and low-voltage directive interpretation — the installer is responsible for verifying applicable requirements before commissioning.

Isolation monitoring during operation

Continuous IMD operation is required whenever the pack is energised. Standard trip thresholds are: warning at 500 Ω/V, alarm and contactor open at 100 Ω/V. For a 400 V system this is a warning at 200 kΩ and trip at 40 kΩ. Typical failure modes that reduce isolation resistance include: condensation inside the pack after outdoor storage; damaged wiring insulation on installer-added cables; and coolant intrusion for liquid-conditioned packs (Tesla, VW MEB, Hyundai/Kia E-GMP use glycol-water; BMW i3 uses an R1234yf refrigerant loop tied to the vehicle HVAC circuit, which fails differently — a refrigerant leak does not leave conductive residue the way a glycol leak does, but it does remove the pack's thermal path). If you install a used pack that has been outdoors, perform an insulation resistance measurement using the test voltage explicitly permitted by the battery manufacturer's documentation. Do not apply an insulation-test voltage to a connected battery pack unless the OEM documentation explicitly permits that test voltage and test configuration — internal BMS electronics can be damaged by test voltages exceeding the pack's stated maximum (per IEC 60364-6) before first energising. Values below 1 MΩ warrant investigation; BMS-EV engineering treats below 100 kΩ pack-to-chassis resistance as a hard "do-not-close-contactors" threshold; the exact value used by the OEM BMS may differ per pack.

Thermal management

Different pack architectures place different thermal loads on the installer. Air-cooled packs (Nissan Leaf 24/30/40 kWh, first-gen Renault Zoe) tolerate stationary operation at moderate C-rates (0.2–0.3 C, typical for home storage) without active cooling — the internal air paths and enclosure surface dissipate the heat as long as ambient stays below 35 °C. Liquid-conditioned packs were engineered for 1–2 C automotive duty. Note that the thermal architecture differs: Tesla, VW MEB, Hyundai/Kia E-GMP and Audi e-tron use a glycol-water loop, while the BMW i3 uses a direct R1234yf refrigerant evaporator plate tied to the vehicle air-conditioning circuit. An i3 pack therefore cannot simply be plumbed to an external water pump and radiator the way a glycol-cooled pack can — for stationary reuse the i3 refrigerant circuit is normally left unconnected and the pack is run at low C-rate with ambient convection. These packs and are very conservatively loaded at stationary rates; however the coolant loop was originally driven by the vehicle's electric pump and radiator. For stationary reuse there are three strategies: (1) leave the coolant filled and static — considered by BMS-EV engineering to be acceptable at low stationary C-rates (≤0.3 C) and ≤30 °C ambient for the specific liquid-cooled OEM packs currently supported, based on the pack's original thermal design and residential cycling characteristics. Thermal behaviour must be validated for the specific pack, enclosure and ambient conditions; (2) reconnect an external pump and radiator sized for 0.5–1.0 kW dissipation; (3) fit temperature-controlled fans to the pack housing for forced air convection. The BMS-EV controller reads all cell/module temperatures reported by the original BMS and passes them to the inverter; the inverter derates charge/discharge current when any module exceeds 45 °C.

Cell balancing

Many EV BMS architectures implement cell balancing; the strategy and thresholds are manufacturer- and pack-specific to keep cell voltages within 10–30 mV of each other. Tesla uses passive (dissipative) top-balancing, typically activated when a cell exceeds 4.15 V during charge. BMW i3 and MEB use similar passive balancing but with per-cell bleed resistors of 50–100 Ω. The BMS-EV controller does not participate in balancing — it is not a cell-monitoring BMS. What it does is keep the original BMS awake long enough for it to complete balancing, which typically requires the pack to sit at high SoC (>95 %) for several hours. Because home solar systems rarely spend hours at 100 % SoC, second-life packs benefit from a monthly "balance charge" — a scheduled full-charge cycle held at 100 % for 4–8 hours. This can be automated via the inverter's schedule function.

Over- and undervoltage protection

The original BMS enforces hard limits at the cell level. Two different thresholds are often confused and should be kept apart. (a) Cell absolute protection trip — the voltage at which the OEM BMS opens contactors to protect the cell. For NMC/NCA cells this is typically around 4.25 V upper and 2.50 V lower; for LFP cells around 3.65 V upper and 2.50 V lower. These are protection limits, not operating targets, and the exact figures are set per pack by the manufacturer. (b) Charge taper threshold — the voltage at which charge current begins reducing in normal operation, well below the protection trip. For NMC/NCA packs this is commonly around 4.05–4.20 V per cell; for LFP around 3.45 V per cell. Integration guides in this documentation quote taper thresholds, not protection trips. Never configure an inverter using a protection-trip figure as if it were a charge target. The BMS-EV controller reads current cell voltage min/max/mean over CAN and forwards the pack-level "charge current limit" and "discharge current limit" values that the original BMS calculates. When the BMS commands zero charge or discharge current, BMS-EV re-encodes this as a fault-state message the inverter recognises, causing the inverter to stop drawing or delivering power. The inverter does not need to know cell-level detail — it responds only to pack-level limits — but the underlying protection is unchanged from the vehicle.

Fire protection and enclosure

Second-life lithium-ion storage must be installed in a fire-resistant enclosure isolated from occupied spaces. The relevant reference documents are UL 9540 (Energy Storage Systems), UL 9540A (large-scale fire test for propagation), EN 62619 (secondary lithium cells for industrial applications) and EN IEC 62933-5-2 (safety requirements for grid-integrated ESS). Practical enclosure guidance:

• Location. Detached garage, outdoor cabinet, dedicated utility room or basement with masonry construction. Do not install in living spaces, sleeping areas or single means of egress corridors.
• Enclosure material. Sheet steel enclosure, minimum 1.5 mm wall, with 60-minute fire-resistant lining (BMS-EV engineering recommendation, per EN 1363-1 typical residential fire barrier class; local building code may require higher) (rockwool 50 mm or calcium silicate boards) inside if wall-mounted against combustible construction.
• Clearance (BMS-EV recommendation). Typical clearances for HV battery packs: 900 mm in front for service access, 300 mm to the sides and above, 1 m from any electrical panel or gas meter. These are engineering recommendations; specific requirements depend on local fire code (e.g., NFPA 855 in the US, VDE 2510-50 in Germany) and installer sign-off.
• Ventilation. Passive vent to outdoor air at high and low points, minimum 200 cm² each, to prevent accumulation of vent gases (hydrogen, CO, hydrocarbons) that off-gas at the onset of thermal runaway.
• Detection. Smoke and heat detector wired to a shunt-trip on the DC isolator; optional lithium-battery-specific off-gas sensor (H₂/CO) for early warning at 500 ppm.
• Fire-response. Do not attempt to suppress an HV battery fire unless trained and equipped. Fire-response procedures must follow local fire-service guidance and the OEM emergency response guide for the specific battery family (Tesla, BMW, VW, etc.). Extinguishers commonly discussed for lithium-ion fires (Class D dry powder, F-500, AVD aerosol) may be present but are not a substitute for professional emergency response.

DC cable sizing and fusing

External HV cables must be sized for the pack's peak discharge current and installed with rated fuses at both ends. Typical numbers for common packs:

Use only DC-rated fuses (gPV, midi, or T-class DC 1000 V). AC breakers are not suitable — DC arcs do not self-extinguish at zero crossing and will sustain across a hot AC breaker's contacts.

Applicable standards

• EN 62619:2022 — Secondary lithium cells and batteries for use in industrial applications. Defines abuse tests, marking and installation requirements for stationary systems.
• ISO 6469-3:2021 — Electrically propelled road vehicles — Safety specifications — Part 3: Electrical safety. Basis for HVIL, isolation and precharge requirements even in second-life applications.
• IEC 61508 — Functional safety of electrical/electronic/programmable electronic safety-related systems. Referenced for SIL classification of protection logic.
• UL 9540 & UL 9540A — Energy storage systems and their equipment; fire-propagation test method. The de-facto reference for enclosure fire performance.
• EU Batteries Regulation (EU) 2023/1542 — Repurposed batteries are subject to the applicable conformity-assessment, documentation, safety and economic-operator obligations under this regulation (in particular Article 45 for repurposing/remanufacturing operators, and Article 77 for the Digital Battery Passport applicable from 18 February 2027). The regulatory status of the repurposed battery must be assessed for the specific product and economic operator.
• IEC 62443 — Referenced for the cybersecurity of the CAN interface if the system is exposed to network-connected inverters.
• IEC 61557-8 — Insulation monitoring device requirements for IT systems.
• IEC 60364-7-712 & IEC 60364-8-2 — Installation requirements for PV/ESS systems including bonding, DC disconnects and labelling.

Frequently asked questions