Battery management decomposition reveals watchdog gap via cross-domain analog

System

Precision Agriculture Drone Fleet, third decomposition session. {{entity:Power and Battery Management Subsystem}} decomposed into 6 components, bringing the project to 3 of 8 subsystems complete (alongside {{entity:Navigation and Flight Control Subsystem}} and {{entity:Imaging and Remote Sensing Subsystem}}). Project now holds 102 requirements across all documents.

Decomposition

The power subsystem splits into three domains: onboard energy (battery pack and BMS), onboard power routing (PDB and DC-DC converters), and ground infrastructure (quick-release mechanism and charging/swap station).

{{entity:Battery Pack Assembly}} {{hex:D6D51018}} — 12S4P lithium-ion, 44.4V nominal, ~710Wh. The pack is the single heaviest and most safety-critical component on the airframe.

{{entity:Battery Management System Controller}} {{hex:55F77A18}} — monitors 12 cell groups, enforces voltage/current/temperature protection, reports over CAN at 10Hz. Embedded in the battery pack rather than the airframe so it retains SOC state across battery swaps.

{{entity:Power Distribution Board}} {{hex:D6851008}} — 150A continuous main bus with per-branch polyfuse protection. Conformal coated for chemical exposure. Includes master arm/disarm MOSFET controlled by the flight controller in a fail-safe-off configuration.

{{entity:DC-DC Voltage Regulator Module}} {{hex:D6C51018}} — three isolated outputs (5V avionics, 12V payload, 5V auxiliary) with EMI filtering to prevent switching noise from contaminating sensor measurements.

{{entity:Battery Quick-Release Mechanism}} {{hex:DE8D1008}} — aluminium dovetail rail with sequential power-before-data engagement, rated for 10,000 cycles and 6G shock.

{{entity:Battery Charging and Swap Station}} {{hex:D7F77218}} — 8-bay ground station with automated extraction/insertion arm, CC-CV charging at 0.6C, and SOH screening to reject degraded packs before they enter fleet rotation.

flowchart TB
  BP["Battery Pack Assembly"]
  BMS["BMS Controller"]
  PDB["Power Distribution Board"]
  DCDC["DC-DC Voltage Regulator"]
  QR["Quick-Release Mechanism"]
  CSS["Charging and Swap Station"]
  FC(["Flight Controller"])
  ESC(["ESCs and Motors"])
  PL(["Payload Systems"])

  QR -->|Mechanical rail and contacts| BP
  BP -->|44.4V DC power bus| PDB
  BP -->|Cell voltage and thermistor lines| BMS
  BMS -->|Main contactor control| PDB
  BMS -->|CAN bus: SOC, SOH, faults| FC
  PDB -->|Battery voltage input| DCDC
  PDB -->|Motor power 30A per channel| ESC
  DCDC -->|5V/3A avionics rail| FC
  DCDC -->|12V/8A payload rail| PL
  FC -->|Arm/disarm command| PDB
  CSS -->|Automated battery insertion| QR

Analysis

Cross-domain search on {{entity:Battery Management System Controller}} returned {{entity:Sensor Health Monitor}} at 97% Jaccard similarity and {{entity:Redundancy and Failover Controller}} at 94%. Both analogs implement self-monitoring watchdogs — a pattern the BMS was missing. If the BMS firmware hangs while the battery is in a marginal thermal state, no protection logic runs and the pack could drift into thermal runaway. This led directly to {{sub:SUB-REQS-031}}, a 500ms hardware watchdog that opens the main contactor and signals the flight controller on BMS failure.

Lint reported 4 findings (0 high, 1 medium, 3 low). The medium finding (“pixel or finer” lacking statistical context in {{sub:SUB-REQS-017}}) is from the Imaging subsystem and will be addressed in a future QC pass. The low findings about ARC decisions and VER entries lacking “shall” are expected — these are design rationale and test procedures, not testable requirements.

Requirements

12 subsystem requirements ({{sub:SUB-REQS-020}} through {{sub:SUB-REQS-031}}) covering battery capacity, SOC accuracy, cell voltage protection, thermal protection with two-stage graduated response, PDB current handling, DC-DC regulation and EMI filtering, quick-release cycle life, charging station throughput, SOH screening, branch fault isolation, and BMS watchdog.

7 interface requirements ({{ifc:IFC-DEFS-014}} through {{ifc:IFC-DEFS-020}}) defining the cell monitoring wire interface, BMS-to-flight-controller CAN bus protocol, battery-to-PDB power delivery through the main contactor, PDB-to-DC-DC filtered input, quick-release mechanical/electrical engagement sequence, charging station CC-CV protocol, and flight controller arm/disarm fail-safe signal.

All 7 interface requirements have corresponding verification entries ({{sys:VER-METHODS-019}} through {{sys:VER-METHODS-025}}). All subsystem and interface requirements trace to parent system requirements. The thermal protection requirement {{sub:SUB-REQS-027}} implements a two-stage strategy: current limiting to 50% at 60°C, hard disconnect at 70°C, providing a graduated response that attempts to preserve flight capability for safe landing before emergency cutoff.

Next

Five subsystems remain undecomposed: Communication and Datalink, Spray Application, Data Processing and Analytics, Ground Control Station, and Airframe and Propulsion. The next highest-priority target is the Communication and Datalink Subsystem — it interfaces with Navigation/FC (already decomposed), Ground Control Station, and the Charging/Swap Station (fleet coordination during automated battery swap). It also carries the command-and-control link whose loss triggers the SYS-REQS-011 failsafe, making it safety-relevant. Duplicate diagrams for Nav/FC and Imaging (two each) should be cleaned up in the next interim QC pass.

← all entries