3.1 Protection and Recovery

This page explains what the BMS does when a value leaves its limits: which path it switches off, when it switches the path on again by itself, and what you have to do when it does not.

Applies to

Boards: BMS1820, BMS3610, BCU2002, BMS1601, BMS1810.

3.1.1 How It Works

Every event belongs to a class, and the class decides what happens. The classes are introduced in 1.2 System Concepts; the full list of events with their class is in the error bit table.

Fig.3.1.1: What a Warning, a Protection and a Critical Fault Do

WARNING reports only Warning limit value past the warning limit Reported event in LiMon; all paths stay ON Cleared value back inside the limits PROTECT recovers by itself Protection limit value past the limit for its delay Path OFF the affected path; trip count + 1 Condition clears release value or release time reached Retry? trip count below Error Recovery Attempts? Path ON again by itself Path stays OFF User Attention Required yes no Error Recovery Attempts CRITICAL until restart Fault for example a cell connection error Both paths OFF User Attention Required Find the cause read the event, fix the system Restart Restart in LiMon™ or power-up A restart sets every trip count to 0 and clears User Attention Required. STATUS and MULTI-MASTER events are not shown.

  • WARNING: reported only. All paths stay on. Use warnings to act before a protection trips, for example to reduce the load or the charge current.
  • PROTECT: switches off the path that the condition endangers, as listed in Table.3.1.1. When the condition clears, the BMS switches the path on again by itself.
  • CRITICAL: switches off both paths and sets User Attention Required. The paths stay off until the BMS restarts.
  • Main contactor: it is on only while both the charge and the discharge path are on, so every protection opens it.

Table.3.1.1: Protections and the Path They Switch Off

Event Class Switches off Back on when
Cell Over Voltage Protection PROTECT charge path every cell that tripped is at or below O.V.P Release
Charge Under Temperature Protection PROTECT charge path every sensor that tripped is at or above CHG. U.T.P. Release
Charge Over Current Protection PROTECT charge path the release time of 10 s has passed
Cell Under Voltage Protection PROTECT discharge path every cell that tripped is at or above U.V.P. Release
Discharge Under Temperature Protection PROTECT discharge path every sensor that tripped is at or above DCHG. U.T.P. Release
Discharge Over Current Protection, 1st and 2nd PROTECT discharge path the release time of 15 s has passed
Over Temperature Protection PROTECT both paths every sensor that tripped is at or below Over Temp. Release
PCB Over Temperature Protection PROTECT both paths the board temperature is below PCB O.T. Release
FET Over Temperature Protection PROTECT both paths the FET temperature is below FET O.T. Release
Short Circuit Protection PROTECT both paths the release time of 60 s has passed
Max. Cell Delta Voltage, Max. Temperature Delta, Max. Parallel Group Delta Voltage, Cell Connection, Slave Module Communication, Main Contactor Malfunction, Pre-Charge Fault CRITICAL both paths the BMS restarts

The cell voltage limits are described in 2.1 Cell Voltage Limits, the temperature limits in 2.3 Temperature Limits, the current protections in 2.5 Current Limits, the precharge in 2.7 Precharge.

3.1.2 Error Recovery Attempts

The BMS counts how often each protection has tripped since the last start. Each protection has its own count. When a count reaches Error Recovery Attempts, the BMS no longer switches that path on by itself: the path stays off and the BMS sets User Attention Required. A protection that keeps tripping points to a fault in the system, and switching a path on and off again and again wears the contactors and stresses the cells.

Table.3.1.2: Recovery Setting (LiMon™ Peripheral tab)

Setting What it does How to choose Unit Range Default
Error Recovery Attempts Number of trips of one protection after which its path stays off. Keep the default for most systems. 0 switches the path on again without end; use 0 only where an unattended stop is worse than repeated trips, and only with a fuse and contactors rated for it. — 0…30 5

The LiMon™ reference describes every field of the screen: 7.5 Peripheral Settings.

  • The counts are not reset while the BMS runs. Trips add up over days or weeks; only a restart sets them to 0.
  • Only the path of the locked protection stays off. After the fifth Cell Under Voltage Protection, for example, the discharge path stays off but the charge path still works.
  • Stop Charger on Error: with this option on (LiMon™ Integration tab), a CAN charger is asked for zero current while any protection is active or User Attention Required is set.

3.1.3 User Attention Required

User Attention Required means the BMS will not recover by itself. It is set by every CRITICAL fault and by a protection that has used up its Error Recovery Attempts. To clear it:

  1. Read the events in LiMon™ (Events › Event Status) and find the cause: which protection tripped, and how often.
  2. Fix the cause, for example charge the battery, replace a loose cell tap or let the pack cool down.
  3. Restart the BMS: Restart in LiMon™, a button press assigned to Restart System, or a power-up. The restart sets every trip count to 0 and clears User Attention Required.
  4. Check that the paths switch on and that no event comes back.

Clear All Errors

A button press can also be assigned to Clear All Errors (LiMon™ Peripheral tab, Short Press Function, Mid Press Function or Long Press Function). It sets the trip counts to 0 and clears User Attention Required, but first it forces the power outputs ON for 60 seconds, even while a fault is still present. Use it only after you have found and fixed the cause, and never on a pack with a cell, temperature or contactor fault. A CRITICAL fault that is still present switches the paths off again after the 60 seconds.

3.1.4 Example

Calculation example: repeated under-voltage trips

Chosen values: a 16S LFP pack with U.V. Protection 2800 mV, U.V.P. Release 3000 mV and Error Recovery Attempts 5.

  • Under a heavy load the weakest cell drops below 2800 mV for longer than U.V.P Delay Time. The discharge path switches off; trip count 1.
  • Without load the cell recovers above 3000 mV and the discharge path switches on again. The load starts again and the same happens.
  • On the fifth trip, after some days of operation without a restart, the discharge path stays off and User Attention Required is set. The charge path still works.
  • The cause is a battery that is used too deep, or a weak cell. Charge the pack, check the cell voltages and the balance, then restart the BMS.

3.1.5 Checking the Result

  • After a restart: no User Attention Required, the paths that should be on are on.
  • During operation: warnings appear before protections. A protection without a warning first points to a warning limit that is set too close to the protection limit.
  • Events › Event Status lists every event as detected and cleared, with its time.

3.1.6 Common Mistakes

  • Restarting without finding the cause. A restart clears User Attention Required, but the same fault comes back and the count starts again. Read the events first.
  • Error Recovery Attempts set to 0 to "keep the system running". The BMS then switches the path on after every trip without end, also into a short circuit after each release time. Keep a limit unless the application really needs unlimited retries.
  • Warning limits equal to the protection limits. The warning comes at the same moment as the protection and gives no time to react. Set each warning limit before its protection limit.
  • Release value too close to the protection limit. The path switches on, the value crosses the limit again at once, and the trips add up quickly to Error Recovery Attempts. Leave a clear gap between the protection limit and its release value.
  • Clear All Errors used as a reset button. It forces the outputs on for 60 seconds, also with a fault present. Use a restart for normal recovery.
  • Charging stopped although only the discharge path is locked. With Stop Charger on Error on, any active protection or User Attention Required stops a CAN charger. Clear the cause and restart, or turn the option off if the charger must keep running.