Research Excellence Award (2021) recipient with strong expertise in Automotive Embedded Systems, EV Architecture, ADAS, Navigation, and Telematics. Passionate about developing intelligent, safe, and sustainable mobility solutions.
Select a country and a component to view the primary regulations/standards and jump to authoritative references.
A Comprehensive DVP Framework Aligned to AIS-156:2023
Lithium-ion battery systems are the foundational energy source for modern electric vehicles, including two-wheelers, three-wheelers, and passenger cars. While these systems enable high energy density and long cycle life, they also introduce safety risks if operated outside their defined electrical and thermal boundaries.
Among all electrical abuse conditions, over-voltage during charging represents one of the most critical hazards. Unlike short-circuit or over-current events, over-voltage can develop progressively and invisibly, especially in series-connected battery packs where individual cell behavior may be masked by aggregate pack voltage.
Historical field incidents and post-failure analyses consistently identify over-charge and inadequate BMS protection as primary contributors to thermal runaway events. These incidents have driven regulators, including the Ministry of Road Transport and Highways (MoRTH) in India, to strengthen battery safety requirements through AIS-156.
This document provides a deep, engineering-focused Design Verification and Validation (DVP) framework for pack-level over-voltage protection, centered on a representative test case:
T001 – Over-Voltage Trip @ Pack Level
The objective is not only to demonstrate compliance, but to explain the why, how, and what behind the test — linking electrochemical theory, BMS design, functional safety, and regulatory intent into a single, auditable narrative.
India’s EV battery safety regulations have evolved rapidly in response to market growth and field incidents. AIS-156 serves as the primary standard governing traction battery safety, with mandatory applicability for vehicle homologation.
AIS-156 is complemented by AIS-038 Rev.2, which addresses vehicle-level electrical safety, including insulation resistance, protection against electric shock, and fail-safe behavior under single-fault conditions.
Although AIS-156 is the binding standard, its requirements are influenced by global best practices and international regulations:
Understanding these references strengthens design justification and improves acceptance during audits and technical reviews.
Clause 6.1.2.3 of AIS-156 requires that the traction battery system shall be protected against electrical abuse conditions, including over-voltage, under-voltage, over-current, and short-circuit.
For over-voltage specifically, the BMS must:
Annex 8 defines the test philosophy for verifying electrical protection functions. It expects tests to be conducted under controlled conditions, with clear documentation of setup, instrumentation, procedure, and acceptance criteria.
Lithium-ion cells are designed to operate within a narrow voltage window. For most EV-grade chemistries, the maximum allowable charge voltage is approximately 4.20 V per cell.
This limit corresponds to the upper boundary of lithium intercalation in the cathode material. Exceeding it initiates parasitic reactions that degrade the electrolyte and electrode structure.
These effects may not cause immediate failure, but they significantly increase the probability of delayed catastrophic events under subsequent stress.
In a series-connected battery pack, cell imbalance causes individual cells to reach their voltage limits at different times. A pack-level over-voltage event therefore represents a direct threat to the most stressed cell, even if average values appear acceptable.
Traction battery packs for electric vehicles are typically constructed using multiple lithium-ion cells connected in series to achieve the required system voltage. In a 48 V nominal system, for example, a 16-series (16S) configuration is common.
While individual cells may meet strict manufacturing tolerances at the time of production, no two cells are truly identical. Variations exist in:
Over time, these variations widen due to differential aging, temperature gradients, and usage patterns. As a result, during charging, some cells reach their maximum allowable voltage earlier than others.
A charger operating purely on pack voltage feedback cannot detect cell-level over-voltage. For example, a 16S pack at 67.2 V (16 × 4.20 V) may appear compliant, while one or more cells may already be above 4.25 V due to imbalance.
AIS-156 implicitly recognizes this risk by requiring:
This requirement makes pack-level over-voltage protection a system-level function rather than a simple threshold comparison.
Once a single cell is over-charged, several cascading effects may follow:
From a safety perspective, the pack behaves as a tightly coupled system. Preventing the first over-voltage event is therefore critical to preventing downstream catastrophic failures.
A Battery Management System is a combination of hardware and software designed to monitor, control, and protect the battery pack. For over-voltage protection, the following functional blocks are essential:
AIS-156 requires that these elements operate reliably across the full operating range of voltage, temperature, and environmental conditions specified by the vehicle manufacturer.
Cell voltages are typically measured using either:
Measurement accuracy, resolution, and sampling rate directly influence over-voltage detection time. Errors introduced by:
must be accounted for when defining protection thresholds.
The BMS enforces over-voltage protection by controlling the flow of current from the charger into the battery pack. This is typically achieved using:
AIS-156 expects that when an over-voltage condition is detected, the charging path is interrupted in a deterministic and timely manner.
A robust battery safety design employs multiple, independent layers of protection. Relying solely on software for over-voltage protection is insufficient for safety-critical systems.
Typical protection layers include:
Software-based protection is implemented in the BMS firmware. It involves:
Software protection allows flexibility, diagnostics, and data logging, but is vulnerable to:
Hardware protection typically resides within the BMS monitoring IC or as discrete comparators. These circuits:
From a functional safety perspective, hardware protection provides a critical backup in the event of software failure.
Within the ISO 26262 framework, over-voltage during charging can be mapped to a hazardous event with potentially severe consequences, including fire and explosion.
A typical safety goal may be expressed as:
“The battery system shall prevent over-voltage of any cell during charging.”
FDTI is the maximum allowable time between the occurrence of a fault and the transition to a safe state. In the context of over-voltage protection:
AIS-156 does not explicitly define FDTI values, but the requirement that no cell exceed safe voltage limits implies a very short detection and response window.
For over-voltage events, the safe state is typically:
ISO 26262 principles reinforce that the safe state must be maintained until the fault is cleared and a controlled recovery is performed.
The coexistence of software and hardware over-voltage protection increases diagnostic coverage and reduces the probability of a single-point failure leading to a hazardous event.
This layered approach aligns with both ISO 26262 functional safety philosophy and the preventive safety intent of AIS-156.
Test Case T001 addresses the verification of pack-level over-voltage protection during charging. It is a mandatory safety verification test derived directly from AIS-156 electrical abuse protection requirements.
| Attribute | Description |
|---|---|
| Test ID | T001 |
| Category | Pack Electrical Protections |
| Title | Over-Voltage Trip @ Pack Level |
| Applicable Standard | AIS-156:2023 |
| Relevant Clause | Clause 6.1.2.3, Annex 8 |
| Test Level | Component / Pack / Bench / Pre-Compliance |
The System Under Test (SUT) consists of:
The test focuses on the ability of the BMS to prevent over-voltage at both pack and individual cell level during an abusive charging condition.
Clause 6.1.2.3 of AIS-156 requires that the traction battery system be protected against over-voltage conditions during charging. Annex 8 further clarifies that this protection must be demonstrated through testing.
The regulatory intent is to ensure that:
Unlike advisory standards, AIS-156 is mandatory for vehicle homologation. Failure to demonstrate effective over-voltage protection results in non-compliance.
From a physics perspective, over-voltage directly accelerates degradation mechanisms such as lithium plating and electrolyte oxidation. These mechanisms:
Because these effects may not manifest immediately, preventive intervention by the BMS is the only reliable mitigation.
At pack level, over-voltage is rarely a single-cell phenomenon. It often coincides with:
Testing T001 validates that the combined system — cells, BMS, and charge control hardware — functions correctly under worst-case charging conditions.
The test is conducted on a bench-level setup under controlled laboratory conditions. A representative setup includes:
Environmental testing may additionally be performed in a temperature chamber if required by the test plan.
Prior to the test:
The voltage ramp rate should be selected to represent a credible worst-case charger fault, such as control-loop failure or incorrect charger configuration.
The test should not rely on software commands or artificial overrides that bypass the normal protection path.
Accurate voltage measurement is critical for over-voltage protection testing. Measurement errors can arise from:
Independent DMMs or calibrated DAQ systems should be used to verify BMS-reported values.
The response time of the protection mechanism is typically measured using an oscilloscope to capture:
This allows precise determination of the protection response time, which is critical for demonstrating preventive behavior.
Although over-voltage testing focuses on electrical behavior, thermal monitoring provides additional safety assurance. A thermal camera may be used to confirm that no abnormal heating occurs during the test.
The test shall be considered a pass if all of the following conditions are met:
The charge disconnection shall occur within a time interval that prevents any cell from entering an unsafe over-voltage region. In practice, this typically corresponds to a response time on the order of tens of milliseconds.
After the test:
These acceptance criteria collectively demonstrate compliance with:
AIS-156 requires that battery safety functions remain effective across the operating temperature range specified by the manufacturer. Over-voltage protection must therefore be verified not only at room temperature, but also under temperature extremes.
Temperature affects cell impedance, voltage response, and sensor accuracy. The BMS must continue to detect and mitigate over-voltage even when measurement noise and response times are degraded.
Corner cases may include:
The pack-level over-voltage protection shall operate independently of charger-side safeguards, ensuring a fail-safe response.
Testing with deliberately imbalanced cells provides confidence that the most stressed cell is protected even when pack-average parameters appear normal.
Relevant failure modes associated with over-voltage protection include:
To address these risks, modern BMS designs implement diagnostics such as:
Diagnostic coverage directly influences the likelihood that an over-voltage event is detected and mitigated before becoming hazardous.
In accordance with functional safety principles, the safe state for an over-voltage event is defined as:
The system shall remain in the safe state until a controlled recovery procedure is performed.
One of the most common findings during AIS-156 pre-compliance testing is excessive delay between over-voltage detection and charge disconnection.
This may be caused by:
Incorrect calibration of over-voltage thresholds may allow cells to exceed their safe limits before protection activates.
Some systems implicitly rely on the charger to limit voltage. AIS-156 does not accept this approach; pack-level protection must be self-contained.
For homologation under AIS-156, the following evidence is typically required:
Each test case, including T001, should be traceable to:
Clear traceability significantly reduces the risk of audit findings or re-testing.
Pack-level over-voltage protection is a foundational safety function for lithium-ion battery systems. Through Test Case T001, manufacturers can demonstrate that:
This final part consolidates the theoretical foundations presented earlier into a practical OEM-oriented system view. It explains how EVCC is architected in real vehicles, how regulations shape implementation, and how the technology is expected to evolve over the next decade.
In modern electric vehicles, the EVCC may exist as:
The choice depends on vehicle segment, safety strategy, and OEM platform philosophy.
| Component | Purpose |
|---|---|
| Microcontroller / SoC | Protocol execution, state machines |
| PLC Modem | Power Line Communication (Green PHY) |
| Secure Element / HSM | Certificate storage, cryptography |
| CAN / Ethernet Interface | Vehicle network communication |
| Isolation & Protection | HV safety, EMC robustness |
EVCC hardware must comply with:
Although EVCC is not always classified as ASIL-D, its failure can indirectly cause safety risks, so OEMs often apply elevated safety rigor.
OEM EVCC software is typically layered as follows:
OEMs implement charging state machines using:
Each state transition is guarded by:
Given frequent standard amendments, EVCC software must support:
The BMS provides:
The EVCC translates these into protocol-compliant charging requests.
The VCU coordinates:
For OEMs, EVCC diagnostics are critical for:
The EU mandates CCS2 for DC public charging under:
OEM implications:
India has adopted CCS2 as the primary DC fast charging standard.
Key characteristics:
| Region | Dominant Standard |
|---|---|
| Europe | CCS2 |
| India | CCS2 |
| North America | CCS1 / NACS |
| China | GB/T |
Global OEMs must therefore implement multi-standard EVCC strategies.
Conformance ensures that:
Interoperability testing validates real-world charging across:
| Risk Area | Impact |
|---|---|
| Partial ISO 15118 support | Charging failures |
| Certificate handling errors | Plug-and-Charge rejection |
| Timing violations | Interoperability issues |
ISO 15118-20 enables:
EVCC will evolve from a consumer to an active energy asset controller.
EVCC functionality is increasingly:
Future EVCC systems may integrate:
EVCC and CCS2.
This part explains the formal standards governing EV charging communication, why they evolved, how amendments changed implementation expectations, and how cybersecurity became a first-class engineering requirement. The treatment balances theory, intent, and OEM implementation impact.
Public charging infrastructure is inherently multi-vendor. A vehicle produced by one OEM must charge reliably on equipment produced by hundreds of charger manufacturers across jurisdictions.
Without standards, each EV–charger interaction would require bespoke agreements—an unscalable approach. Standards solve this by defining:
From a systems viewpoint, a charging standard is a contract:
The EVCC is the component that enforces the vehicle side of this contract.
IEC 61851 defines the basic conductive charging system. Its primary concern is electrical safety, not digital services.
Key concepts introduced:
IEC 61851 ensures that power flows only when safe. However, it does not define:
Therefore, higher-level communication standards were layered on top.
DIN 70121 was designed as a minimal digital protocol to enable DC fast charging.
Its priorities were:
| Aspect | DIN 70121 Behavior |
|---|---|
| Authentication | External (RFID, backend) |
| Security | Minimal / none at protocol level |
| Energy Flow | Unidirectional (Grid → Vehicle) |
| Future Expandability | Limited |
Despite its limitations, DIN 70121 remains widely deployed. For OEMs, this means:
ISO 15118 redefined charging as a digital service interaction rather than a mere power transaction.
Its philosophy includes:
ISO 15118-2 introduced:
For the EVCC, this meant:
ISO 15118-20 expanded the scope significantly.
Key additions:
ISO 15118-20 does not replace -2; instead, it coexists. OEMs must carefully manage compatibility.
Traditional charging requires:
This introduces friction and failure points.
Plug-and-Charge allows:
Trust is established through a hierarchy:
The EVCC acts as a secure vault and protocol enforcer for these credentials.
Charging connects vehicles to:
This creates a broad attack surface.
| Threat | Potential Impact |
|---|---|
| Man-in-the-Middle | Energy theft, fraud |
| Replay Attacks | Unauthorized charging |
| Certificate Compromise | Fleet-wide vulnerability |
The EVCC must integrate cryptography without compromising real-time behavior.
As field experience accumulates, ambiguities and inefficiencies emerge.
Amendments address:
Each amendment may require:
For OEMs, EVCC software architecture must be update-friendly and modular.
Compliance is not simply supporting a protocol. It requires:
| Standard | Area | EVCC Responsibility |
|---|---|---|
| IEC 61851 | Electrical safety | Signal interpretation |
| DIN 70121 | DC charging comms | Protocol handling |
| ISO 15118-2 | Secure services | Crypto, state machine |
| ISO 15118-20 | Bidirectional energy | Advanced control logic |
PART 4 will conclude the document with:
In traditional electrical engineering, power delivery is often seen as a unilateral process: a source supplies energy to a load. However, EV charging fundamentally changes this paradigm. In CCS2-based systems, charging is a continuous negotiation between two intelligent agents:
The EVCC acts as the vehicle’s spokesperson in this negotiation. It communicates battery capability, thermal constraints, and charging preferences while interpreting offers from the charger.
This concept is similar to a diplomatic conversation where both parties must agree before any action occurs.
Communication systems use layered architecture to simplify complexity. Each layer solves a specific problem while relying on lower layers for support.
In EV charging communication, layers ensure:
| Layer | Purpose | Example Technology |
|---|---|---|
| Physical | Transmit electrical signals | PLC over cable |
| Data Link | Error detection and framing | HomePlug GreenPHY |
| Network | Addressing and routing | IPv6 |
| Transport | Reliable message delivery | TCP |
| Application | Charging logic and negotiation | ISO 15118 |
Imagine sending a parcel:
Similarly, EVCC uses layered communication to deliver charging instructions reliably.
Power Line Communication means sending data over power cables. In CCS2 systems, digital messages travel on the same wires that carry electricity.
This eliminates the need for extra communication cables.
PLC superimposes a high-frequency signal on top of the DC charging voltage. Think of it like adding radio waves to a power cable.
The charger and EV each have:
CCS2 systems use HomePlug GreenPHY because it:
A CCS2 charging session follows a structured conversation:
The EV detects a charger using Control Pilot signals. Once connected, PLC communication initializes.
Purpose:
In this phase:
This is similar to introducing yourself before a conversation.
The EVCC sends:
The charger responds with its own limits.
Both sides agree on:
This ensures optimal charging without battery stress.
During charging, EVCC repeatedly:
This loop runs every few milliseconds.
Charging stops when:
A state machine is a system that changes behavior based on current state.
EVCC states include:
Charging involves sequential steps that must occur in strict order. State machines prevent unsafe transitions.
| State | Description | Next Possible States |
|---|---|---|
| IDLE | No cable connected | CONNECTED |
| CONNECTED | Cable inserted | NEGOTIATING |
| NEGOTIATING | Parameter agreement | CHARGING |
| CHARGING | Energy transfer | TERMINATING, FAULT |
| FAULT | Error detected | IDLE |
Charging systems operate at high power levels where milliseconds matter.
Timing controls:
Typical EVCC update intervals:
| Message Type | Interval |
|---|---|
| Status update | 100–500 ms |
| Current request | 50–200 ms |
| Fault monitoring | 10–50 ms |
If a response is not received within a defined time, EVCC:
EV charging involves high voltage, making fault detection essential.
| Fault Type | Example | EVCC Response |
|---|---|---|
| Electrical | Overvoltage | Immediate stop |
| Thermal | Battery overheating | Reduce current |
| Communication | Lost message | Retry / abort |
| Security | Invalid certificate | Reject session |
EVCC performs controlled shutdown:
EVCC behaves like a negotiator ensuring:
Behind that simple message, EVCC likely detected:
Charging speed is limited by:
EVCC always chooses the safest common value.
This section established the theoretical foundation of EVCC communication by explaining:
These principles form the backbone of all modern EV charging standards.
The next section will explore:
Abstract: The Electric Vehicle Communication Controller (EVCC) is the digital intelligence that enables safe, interoperable, and future-ready electric vehicle charging under the Combined Charging System Type 2 (CCS2). This document provides a full academic-grade and OEM-oriented theoretical exposition of EVCC and CCS2, beginning from first principles and progressing toward modern protocol amendments, cybersecurity, and regulatory compliance.
In early electric vehicles, charging was treated as a unidirectional energy transfer problem. However, as battery capacities increased, charging power rose from kilowatts to hundreds of kilowatts, and public charging networks proliferated, the limitations of “dumb charging” became evident.
Modern EV charging is a cyber-physical process involving:
All these functions require structured, deterministic, and secure communication. The EVCC is the subsystem that performs this role within the vehicle.
The Electric Vehicle Communication Controller (EVCC) is a dedicated logical and often physical controller within an electric vehicle that implements standardized communication protocols enabling interaction with Electric Vehicle Supply Equipment (EVSE).
From a systems engineering perspective, the EVCC is:
The Combined Charging System (CCS) was developed to unify AC and DC charging under a single connector and communication framework. CCS2, based on the Type 2 connector, is dominant in:
Unlike legacy charging systems, CCS2 integrates high-speed digital communication using Power Line Communication (PLC) directly over the charging cable.
Early EVs relied on simple analog signaling. Chargers applied fixed voltage/current profiles with minimal feedback. This approach suffered from:
IEC 61851 introduced the concept of Control Pilot (CP) and Proximity Pilot (PP) signals, allowing basic negotiation of current limits. However, it lacked:
DIN 70121 introduced digital messaging over PLC, enabling:
However, DIN 70121 was intentionally limited in scope and not future-proof.
ISO 15118 transformed charging from a transaction into an ecosystem by introducing:
| Subsystem | Primary Responsibility | Interaction with Charging |
|---|---|---|
| EVCC | External communication & protocol handling | Direct |
| VCU | Vehicle-level coordination | Indirect |
| BMS | Battery protection & limits | Data provider |
The EVCC does not directly control power electronics. Instead, it:
The EVCC bridges:
This makes it one of the most safety- and security-critical controllers in an EV.
PART 2 will introduce **deep descriptive theory** covering:
Global EV Compliance Matrix — Country × Component Global EV Compliance Matrix — Country × Component Select a co...