The Battery Management System: The Part That Knows Each Cell

A 400 MWh battery plant can hold hundreds of thousands of cells. Each one has a safe window of voltage, current and temperature, and each one ages a little differently. The battery management system, or BMS, is the only part of the plant that watches every cell, and it is the part that decides, in milliseconds, to open a switch when something drifts out of bounds. Communities almost never ask about it. They should.

Idaho's adopted fire code already expects one. Section 1206.2.10.3 of the 2018 International Fire Code requires an approved energy management system for lithium and most other battery types that monitors and balances cell voltages, currents and temperatures within the manufacturer's specifications, and sends an alarm to an approved location when it detects hazardous temperatures, short circuits, overvoltage or undervoltage. The code calls it an energy management system; in the industry that cell-level job belongs to the BMS.

The layers

Sandia's Energy Storage Handbook describes a hierarchy. Data flows up; commands flow down.

The order matters. The EMS may want to discharge at full power because prices are high. The BMS is supposed to have the last word if a cell is too hot or too low.

What the BMS measures and estimates

State of charge

State of charge (SOC) is how full the battery is. Sandia makes a point people miss: for lithium-ion, SOC cannot be measured directly. A pumped hydro plant can read its reservoir level. A battery can only estimate SOC from voltage, current, temperature and age, using a model. Simple models are cheap and can carry large errors; better ones cost more computing and development.

SOC matters for safety, not just dispatch. A fuller cell holds more energy to release if it fails. EPRI's entries show it coming up in incident reports: the April 2023 container fire and explosion in Aghione, Corsica, occurred with the system at 95 percent SOC, and after the December 2025 fire at the Church Street battery in Warwick, New York, the owner reduced the site's SOC from fully charged to 50 percent as a safety measure.

State of health

State of health (SOH) compares present capacity with original capacity. Sandia notes that many applications treat 80 percent of rated capacity as the end of useful life, so "80 percent capacity" is often called 0 percent SOH. SOH can be estimated from rising internal resistance, though that link is not always tight, so model-based and data-driven methods are used too. A battery losing health unevenly is one the BMS has to work harder to keep balanced.

Temperature and thermal limits

Sandia observes that in many battery systems temperature, not stored energy, is what limits power. A battery can hit its high temperature limit long before it runs low on charge, so the controls need a thermal model to know how hard the battery can safely be pushed. In practice the BMS derates: it tells the inverter to cut power when cells get warm, and opens contactors when they get too hot.

Balancing

Cells in series carry the same current, but no two have identical capacity. Over many cycles the weak ones drift. A string is only as good as its weakest cell: stop charging when the fullest cell hits its limit and the others are left short; keep charging and the fullest cell is overcharged. Sandia describes passive and active methods.

• Passive balancing: charge the pack, then bleed excess charge from the highest-voltage cells through resistors until they match a reference. Cheap. Wastes energy as heat, does nothing for low cells, and adds heat the cooling system must remove.
• Active balancing: move charge from high cells to low cells with capacitors, inductors or converters. More efficient and handles both high and low cells, but more expensive and, Sandia notes, adds failure points of its own.

Healthy case: every sensor reads true.
  Charging stops when the highest cell reaches 3.65 V.

Fault case: one cell's voltage sensor reads 0.10 V low.
  The cell is really at 3.65 + 0.10 = 3.75 V
  when the BMS sees 3.65 V.
  If that cell is also the fullest one, it is now
  overcharged on every cycle, and nothing alarms.

SOC error on the whole plant:
  Plant size: 400 MWh. Estimate off by 3 percent.
  400 x 0.03 = 12 MWh the operator thinks it has, or
  thinks it doesn't.

Protection: what the BMS does when something is wrong

Sandia divides safety into passive and active. Passive measures do nothing until triggered: fuses and breakers against short circuits, thermal barriers inside modules to slow cell-to-cell spread. Active protection is the BMS's job, a feedback loop: measure, decide, act. Its actions run through actuators such as contactors that disconnect a module or string, commands to the inverter to reduce power, and in some designs signals to cooling or suppression systems. Typical triggers are overvoltage, undervoltage, overcurrent and overtemperature.

There is a ceiling on what the BMS can see. Sandia notes that some faults, such as an internal short circuit inside a cell, are hard to diagnose, and that predicting failure from early warning signs is still an active research area with limited commercial equipment. The Surprise, Arizona explosion in 2019 began with an internal cell defect, per the APS investigation cited in EPRI's entry. A BMS can catch the symptoms of such a defect, a voltage sag or a temperature rise, but it cannot reach inside the cell and stop the chemistry once runaway starts.

When the BMS fails or is switched off

EPRI, TWAICE and Pacific Northwest National Laboratory classified the root causes of incidents in EPRI's database in a May 2024 white paper. Of 26 incidents with enough information, cells and modules were the failed element in only 3, or 11 percent; controls and balance-of-system equipment made up the vast majority. Integration, assembly and construction was the most common root cause, and 72 percent of failures with known system age happened during construction, commissioning or the first two years of operation. TWAICE's Ryan Franks told Utility Dive the common storyline that failures come almost entirely from battery modules is inaccurate.

Who sees the BMS data

BMS hardware and firmware are usually proprietary. The logic that decides when to derate, disconnect or alarm is a vendor's trade secret, and the logs often live in a vendor's remote monitoring platform. Residents opposing projects, including Jeff Pierson in his 2026 briefing work, argue that a county is being asked to trust safety software it cannot inspect, and that the county should get access to alarm histories and maintenance logs, advance notice of firmware updates, and the right to order an independent controls and cybersecurity audit at the owner's cost. Developers and vendors answer that sites are watched around the clock by trained remote operators, that firmware access is restricted for security reasons, and that the codes rely on listing and testing (UL 9540, UL 9540A) rather than public source code. A county can write data access and notification into permit conditions; whether a vendor agrees is part of the negotiation.