# Analysis and Synthesis of Architectures for Automotive Battery Management Systems
### Functional Safety  
The BMS of a HEV and especially of BEVs is an important subsystem of the powertrain. Due to its main purpose to keep the battery operating in the safe operating area (SOA), a right and reliable functionality of the BMS is indispensable. Various parts need to comply with automotive safety integrity level (ASIL) standards [24]. Further, a BMS must deliver various information to other systems, and for this reason, need to work constantly. Beside measurement sensors, a BMS communicates with important actors too, which is why some parts need to fulfill safety standards and may be planed redundant. In terms of safety, components such as the HV-contactors and pyro-fuses need to be implemented in a battery system, to make sure the battery can be connected and disconnected when needed. Even though it is not needed technically, most current EVs use two of these HV-contactors for security reasons. In terms of a malfunction of one contactor, the system can still be disconnected and brought into a safe state.  
Further, safety relevant systems such as the BMS need to be protected against electromagnetic interferences (EMI), especially if they use, for example, wireless transmission. A BMS, as an important component in EVs, is ranked as an ASIL. C component by the automotive industry. This means it has a high level of responsibility to work properly according to the ISO 26262. To be able to obtain exact approximations, all of the modules of a BMS have to measure the different magnitudes constantly. Losing the ability to communicate the data of one or more modules at the same time due to a damage or a malfunction (e.g., software bug) would lead to an incorrect state estimation and therefore may cause the vehicle to warn the driver or even stop the vehicle in order to prevent fatal damage. To provide a safe driving ability in such situations, at least as long as possible, a BMS should be able to work with the loss of a few measurement modules [25]. Therefore, the different measurement modules often can measure the cell voltages in different ways. If the accurate one is not working as it is supposed to, many systems still generate binary information about the actual voltage [26]. Even though this is not as accurate as in the normal state, it can be used for the most important situations and therefor help to keep the battery operate in its SOA in error conditions.  
EVs need to be safe against critical currents between high voltage components and the ground. That is why the United Nations defined several isolation resistances in their 20 th Global Technical Regulation [27]. Moreover, charging intervals are described to prevent the car to enable the active driving mode while it is physically plugged in into a charging station.  
Together with the upcoming electrification and growing functional safety requirements of various systems such as steer-by-wire, assisted braking systems and lastly the BMS, future E/E architectures need to proceed with different failure possibilities. AUTOSAR tries to set standards in the automotive E/E-architecture sector. HPCs and centralized architectures in general can achieve a high level of ASIL if those are redundantly structured. Not only for safety reasons, but also to achieve the highest possible efficiency, a redundantly structured computing unit can deliver advantages. The redundant unit can be used for monitoring functions and handle degraded safety regarding functionalities in case of an error [28]. Hence, a redundant, centralized E/E-architecture might lead to a safer system overall, since every DCU or HPC could be mirrored or at least in some parts replaced if needed.