Over-Voltage, Under-Voltage and Over-Temperature Protection with Relay Cut-off

The problem

Over-charging a Li-ion cell, discharging it too deeply or operating it too hot causes permanent damage and, in large packs, a safety risk. Every EV BMS includes protection that disconnects the pack when limits are crossed. This project implements that function on a low-voltage cell, including the details that make real protection reliable: filtering against false trips, hysteresis, latching and a safe default state.

Objectives

• Define over-voltage, under-voltage and over-temperature limits with warning and trip levels.
• Open the charge/discharge relay within a defined reaction time when a limit is crossed.
• Prevent nuisance trips with debounce timing and hysteresis.
• Latch faults and require a deliberate reset, with the relay open at power-up until checks pass.
• Verify every protection path with a test plan, including sensor-failure cases.

What you need

This project uses the kit's lithium cell. Respect polarity, never short the terminals, and don't leave the cell charging unattended.

Key concepts

Warning and trip levels

A warning level alerts the user before damage is near; a trip level opens the relay. Two levels give the system a chance to reduce load before cutting off.

Debounce time

A limit must be exceeded continuously for a set time, for example 500 ms, before tripping. This ignores brief spikes from noise or load switching.

Hysteresis

The level to clear a fault is set away from the trip level, so a reading hovering near the limit does not switch the relay on and off repeatedly.

Fail-safe default

The relay stays open at start-up and whenever a sensor reading is implausible, so a fault in the measurement cannot leave the cell unprotected.

Step-by-step guide

1. 1

   Set limits from the cell datasheet

   Read the cell's datasheet or label for maximum charge voltage, minimum discharge voltage and temperature ranges for charge and discharge. Set trip levels slightly inside these (for example over-voltage trip at 4.20 V, under-voltage trip at a safe level above the rated minimum) and warning levels inside those. Define debounce times and release levels. Put everything in one table, because these numbers will become constants in a single configuration header.

   Checkpoint: A protection table with warning, trip, release level and debounce time for each of OV, UV and OT, referenced to the cell datasheet.

2. 2

   Prepare the board and identify the relay control

   Check cell polarity and keep the terminals covered. Enable the DIP switches for battery sense, T-sense, relay, LCD, LEDs and buzzer. From the kit pin map, identify the GPIO that drives the charge/discharge relay and which logic level closes it. With loads switched on, toggle the relay from a test program and confirm the loads lose power when it opens. Note the relay's audible click and its operate time.

   Checkpoint: A test program that opens and closes the relay from a keypad key, with the load LEDs following.

3. 3

   Reuse calibrated measurements

   Bring in the calibrated cell-voltage and T-sense code from the monitor design, or build it now: ADC with DMA, VREFINT correction, divider calibration and a thermistor table. Protection decisions are only as good as these readings, so recheck the calibration against a multimeter. Sample at a fixed rate from a timer, for example every 10 ms, so debounce times can be counted in samples.

   Checkpoint: Voltage within ±10 mV of the multimeter and temperature within ±1 °C of a reference, sampled at a verified 100 Hz.

4. 4

   Write the protection state machine

   Model each protection as a small state machine: NORMAL, WARNING, TRIP_PENDING (limit exceeded, debounce counting), TRIPPED (relay open, fault latched). The overall relay command is closed only when every protection is NORMAL or WARNING and the system is not in a start-up check. Write it as a pure function of the readings and a tick so it can be unit-tested on the PC before running on the board.

   Checkpoint: PC-side unit tests feed recorded voltage sequences and confirm the trip happens exactly after the debounce time.

5. 5

   Add plausibility checks

   A broken thermistor reads as an extreme temperature; a disconnected divider can read as zero volts. Define plausible ranges for each signal (for example voltage between 2.0 V and 4.5 V, temperature between −20 °C and 80 °C) and treat anything outside as a sensor fault that opens the relay. Also check that the ADC DMA is still updating by watching a counter. This is how real BMS designs avoid trusting a dead sensor.

   Checkpoint: Disconnecting the T-sense input (with the board unpowered first) causes a SENSOR FAULT trip on the next power-up.

6. 6

   Implement latching and reset

   Once tripped, the relay stays open even if the reading returns to normal. Clearing requires the condition to be past its release level and a deliberate action: a keypad code, for example. At power-up, keep the relay open, run a self-test (readings plausible, within limits) and only then close it. Show the reason for the last trip on the LCD so the user knows what happened.

   Checkpoint: After a trip, the relay stays open until the release condition is met and the reset key is pressed.

7. 7

   Build the alert interface

   Use RGB LEDs for state (green normal, amber warning, red tripped), a buzzer pattern for each fault type and an LCD message such as TRIP: UNDER-VOLT 3.02V. Keep alerting non-blocking so it never delays protection: the protection logic runs in the timer tick, the display in the main loop. Make sure the relay command is written before any display update.

   Checkpoint: Each fault produces its own LED colour, buzzer pattern and LCD message while protection timing stays unchanged.

8. 8

   Test each protection path

   Test under-voltage by discharging with the loads under supervision until the trip; record the voltage and the time from crossing to relay open. Test over-voltage by lowering the trip level temporarily in a test build and charging (never raise it above the cell's maximum). Test over-temperature the same way, with a lowered threshold and gentle warming by hand. Capture timing by toggling a spare GPIO at the trip and watching it with an oscilloscope if available.

   Checkpoint: A test log where each trip occurs at the set level and within the debounce time plus relay operate time.

9. 9

   Test false-trip immunity

   Switch all three loads on together and off again repeatedly near the under-voltage warning level. The brief voltage dip should not trip the relay if it is shorter than the debounce time. Also check behaviour exactly at the release level and while the keypad reset is pressed during a fault. Record any nuisance trips and adjust debounce or hysteresis with a written justification.

   Checkpoint: Twenty load switching events near the threshold cause no nuisance trip, while a sustained crossing still trips.

10. 10

    Write the safety and test report

    Document the limits table, the state-machine diagram, plausibility rules, start-up sequence, and the full test log with pass/fail for every case. Describe what the design does not cover: over-current, which needs a current sensor, and multi-cell balancing. Note the safety rules followed during testing: supervised charging, temperature tests with lowered thresholds, and cell care. Add a traceability table that links each limit to its test case, the measured value and the pass or fail result, so a reviewer can check coverage at a glance.

    Checkpoint: A report where every requirement in the limits table maps to at least one passed test.

Testing & validation

• Trip voltage and temperature measured against each set level.
• Reaction time from limit crossing to relay opening, measured with a GPIO marker.
• No nuisance trips across repeated load switching near thresholds.
• Sensor-fault cases (open T-sense, implausible voltage) open the relay.
• Relay stays open at power-up until self-test passes, and after a trip until reset.

Expected results

Working OV, UV and OT protection with a latched relay cut-off, alerting, and a test report that traces every requirement to a measured result.

Take it further

• Add over-current protection with an INA219 add-on.
• Log every trip with an RTC timestamp to SPI flash as a fault history.
• Report protection state as a CAN frame for a vehicle control unit.
• Derate allowed charging, rather than just cutting off, as temperature rises.

Viva and review questions