BMS-EV Controller Safety Architecture

Safety in a second-life energy storage system built from a used EV battery does not come from a single component, but from a multi-layered protection architecture. Software alone, however well written, is not sufficient — it must be backed by the inverter and by physical hardware safeguards. Below we outline the complete architecture implemented by the BMS-EV controller in combination with a certified hybrid inverter and properly sized installation hardware.

Three layers of protection

Every safety function is implemented independently by at least two systems. If one layer fails, the remaining two continue to protect the battery, the installation and the user.

Layer 1 — Inverter-side protection functions

The hybrid inverter (GoodWe, Fronius, SMA, Sungrow, SolaX, Deye, Solis and others) provides the first level of protection, based on data received over the CAN bus from the BMS-EV controller.

Hard charge and discharge voltage limits calculated from the cell count and chemistry of the pack (NMC, NCA, LFP)
Cell temperature monitoring — maximum and minimum values from each module
Real-time power limitation based on current pack state
State of Health (SOH) calculation
Insulation resistance analysis at every startup and cyclically during operation
Reverse-mode protection — the inverter never charges the battery outside of permitted parameters

Layer 2 — BMS-EV controller protection functions

The BMS-EV controller acts as a bridge between the OEM BMS of the EV pack and the inverter. At the same time, it is an independent protection system that forces pack disconnection when an anomaly is detected.

Fault state triggers immediate inverter shutdown — the controller has veto authority over the inverter
60-second CAN communication timeout — if contact with the OEM BMS is lost, the pack is disconnected
Pack voltage sampling with hard limits independent of inverter data
Cell voltage monitoring — typically 2,900 mV (minimum) and 4,250 mV (maximum) for NMC chemistry
Reading of OEM BMS fault codes from Tesla, BMW, Nissan, VW or other manufacturer packs
HVIL loop monitoring (High Voltage Interlock Loop) — a physical control circuit whose interruption immediately opens the HV contactors
Protective Earth (PE) fault monitoring
Status LED for instant diagnosis of state (green / yellow / red)
Event logging in the controller’s local memory and in the BMS-EV cloud

Layer 3 — Hardware safeguards (mandatory, not optional)

Independently of any software, every second-life storage installation must include the following physical protective elements. The absence of any of them constitutes non-compliance with safety standards and is the most common cause of serious failures in DIY installations.

Class T fuse in the HV path — typically 250 A for a 96-cell NMC pack. A Class T fuse is designed to interrupt fault currents up to 20,000 A without enclosure rupture
Main HV contactor with precharge circuit — without precharge, closing the contactors onto the inverter’s discharged capacitor produces an electric arc that destroys the contacts within the first second of operation
Galvanic isolation between the high-voltage circuit and the 12 V low-voltage circuit — the BMS-EV controller has galvanic isolation rated at 2.5 kV
Manual service disconnect — in EV batteries this is the factory orange service plug, which separates the HV pack into two halves of lower voltage (~175 V instead of 350 V)
Equipment Stop / E-Stop accessible from outside the storage room
Dedicated fire compartment with smoke detector, temperature detector, dedicated emergency ventilation and EI 60 fire-rated doors
Surge protection on CAN communication lines — lightning strikes can destroy interfaces without this protection
Documented periodic visual inspection of the pack — software cannot detect a damaged cell casing, corrosion or electrolyte leakage

What software alone cannot guarantee

This is a key fact often overlooked in DIY projects: even the most advanced firmware cannot detect physical damage to a cell. A cracked pouch casing, corrosion on a terminal, electrolyte leakage or water ingress can only be detected by direct visual inspection. For this reason, our installation documentation recommends:

Visual inspection every 6 months in the first year of operation
Visual inspection every 12 months in subsequent years
Insulation resistance test with a 500 V DC megohmmeter once a year
SOH test performed automatically by the controller every 100 cycles
Smoke detector in the storage room — first signal of internal thermal propagation in the pack

Standards compliance

The BMS-EV controller carries the CE marking and complies with the requirements of the RoHS directive 2011/65/EU. The EU Declaration of Conformity is available on request at office@bms-ev.com.

A complete second-life energy storage installation should be carried out in accordance with the following standards:

VDE-AR-E 2510-50 — requirements for stationary battery storage (Germany)
Battery Directive 2006/66/EC and the new Regulation 2023/1542
HD 60364 / IEC 60364 — electrical installations in buildings
Mandatory installation by a qualified electrician with appropriate certification for DC up to 1 kV

When the BMS-EV controller is not enough

We are honest about the limitations: our controller does not replace the installer or the system designer. We do not recommend building a second-life storage system in the following situations:

No qualified electrician with certification for 1 kV DC work
No way to provide a separate fire compartment
An EV pack without documented service history (no SOH data, no service report)
A pack with visible mechanical damage, signs of water ingress or corrosion
An attempt to use a BMS for a different chemistry than the pack itself (for example LFP BMS on an NMC pack)
No insurance coverage for energy storage installations