WATTALPS streamlines ISO 26262 BMS verification with LDRA test tools from TASKING 

What is it about

Head­quar­tered in Moirans, France, WATTALPS devel­ops and pro­duces mod­u­lar lithi­um-ion bat­tery sys­tems capa­ble of deliv­er­ing reli­able power under extreme oper­at­ing con­di­tions. The company’s high-per­for­mance bat­tery tech­nol­o­gy is used across demand­ing sec­tors such as off-road vehi­cles, min­ing equip­ment, heavy trucks, and marine sys­tems, where per­for­mance, dura­bil­i­ty, and safe­ty are crit­i­cal.

WATTALPS deliv­ers bat­tery sys­tems cov­er­ing volt­age ranges from 48V to 800V and ener­gy capac­i­ties from 10kWh to over 500kWh, enabling scal­able elec­tri­fi­ca­tion solu­tions for a wide vari­ety of indus­tri­al and auto­mo­tive appli­ca­tions. 

The com­pa­ny devel­oped its Bat­tery Man­age­ment Sys­tem (BMS) to meet safe­ty require­ments in accor­dance with ISO 26262 ASIL C. By using LDRA tools from TASKING to auto­mate unit test­ing of its embed­ded soft­ware, WATTALPS reduced unit test effort by approx­i­mate­ly 50% com­pared to man­u­al har­ness test­ing. This avoid­ed around twelve months of addi­tion­al develop­ment time and ulti­mate­ly led to inde­pen­dent cer­ti­fi­ca­tion of its develop­ment process­es in 2023. 

Patented immersion cooling 

A key dif­fer­en­tia­tor of the company’s tech­nol­o­gy is its patent­ed immer­sion-cool­ing sys­tem, in which bat­tery cells are fully immersed in an elec­tri­cal­ly insu­lat­ing dielec­tric fluid. This advanced ther­mal man­age­ment enables sus­tained high-power peaks, repeat­ed fast-charg­ing cycles, and reli­able oper­a­tion even when exposed to extreme tem­per­a­tures, shock, dust, and vibra­tion.

Because these sys­tems oper­ate in safe­ty-crit­i­cal envi­ron­ments, WATTALPS devel­ops its own Bat­tery Man­age­ment Sys­tem (BMS) in-house. The BMS is designed to com­ply with strin­gent indus­tri­al and auto­mo­tive safe­ty stan­dards such as IEC 62619 and ISO 26262 to help ensure safe bat­tery oper­a­tion and pre­vent haz­ards such as ther­mal-run­away prop­a­ga­tion through­out the bat­tery life­cy­cle. 

Battery safety standards and functional safety 

High-ener­gy lithi­um-ion bat­tery sys­tems must com­ply with strict safe­ty stan­dards to ensure reli­able oper­a­tion and to pre­vent haz­ardous con­di­tions dur­ing charg­ing, dis­charg­ing, or fault sit­u­a­tions. In indus­tri­al and auto­mo­tive appli­ca­tions, this typ­i­cal­ly involves both bat­tery-spe­cif­ic safe­ty stan­dards and func­tion­al safe­ty stan­dards gov­ern­ing the embed­ded con­trol sys­tems that man­age them. 

IEC 62619 defines safe­ty require­ments for indus­tri­al lithi­um-ion bat­tery sys­tems, includ­ing pro­tec­tion against haz­ards such as over­charge, over­cur­rent, and over­heat­ing. In prac­tice these pro­tec­tions are typ­i­cal­ly imple­ment­ed by the Bat­tery Man­age­ment Sys­tem (BMS). When the BMS forms part of an auto­mo­tive or safe­ty-relat­ed con­trol sys­tem, stan­dards such as ISO 26262 define the func­tion­al safe­ty life­cy­cle used to devel­op and ver­i­fy the embed­ded soft­ware respon­si­ble for these pro­tec­tion func­tions.  

Text Box 2, Textbox

Derived from the more gener­ic func­tion­al safe­ty stan­dard IEC 61508, the sec­tor-spe­cif­ic ISO 26262 address­es func­tion­al safe­ty for elec­tri­cal and elec­tron­ic sys­tems in road vehi­cles. It defines a struc­tured life­cy­cle for iden­ti­fy­ing haz­ards, assess­ing asso­ci­at­ed risks, and imple­ment­ing safe­ty mech­a­nisms to reduce those risks to accept­able lev­els.
For bat­tery sys­tems, this includes the develop­ment and ver­i­fi­ca­tion of the Bat­tery Man­age­ment Sys­tem (BMS), which mon­i­tors cell volt­ages, tem­per­a­tures, and cur­rent while enforc­ing safe oper­at­ing lim­its. 

ISO 26262 requires sys­tem­at­ic test­ing of safe­ty-relat­ed soft­ware com­po­nents. Unit and com­po­nent test­ing with TASKING’s LDRA tools help demon­strate that BMS soft­ware behaves cor­rect­ly under both nor­mal and fault con­di­tions. 

A WATTALPS battery system

“LDRA test tools have allowed us to run the unit-testing project far more efficiently. Compared to manual harness testing, we saved approximately 50% of test effort, reducing the development phase of the project by around 12 months. These are significant cost savings.” 

Unit & component tests contribute to the safety-critical software development lifecycle 

WATTALPS bat­tery sys­tems are also used in a wide range of indus­tri­al appli­ca­tions beyond the auto­mo­tive sec­tor. These envi­ron­ments are typ­i­cal­ly gov­erned by safe­ty stan­dards also derived from IEC 61508, such as those used in machin­ery, indus­tri­al con­trol, and ener­gy sys­tems. While the ter­mi­nol­o­gy dif­fers, there are strong par­al­lels between these stan­dards. A sys­tem engi­neered to meet the rig­or­ous develop­ment and ver­i­fi­ca­tion prac­tices required by ISO 26262 will typ­i­cal­ly align close­ly with the safe­ty expec­ta­tions asso­ci­at­ed with equiv­a­lent Safe­ty Integri­ty Lev­els (SIL) in other domains. 

Achieving ISO 26262 compliance and certification 

Syl­vain Bas­set, Embed­ded Soft­ware Engi­neer at WATTALPS, takes up the story. “Three years ago, WATTALPS under­took a project to bring its BMS into com­pli­ance with the ISO 26262 stan­dard which is often required for auto­mo­tive appli­ca­tions.” 

The sys­tem was devel­oped to com­ply with the demands of ISO 26262 Auto­mo­tive Soft­ware Integri­ty Level C (or “ASIL C”). ASILs allow ISO 26262 to scale its develop­ment and ver­i­fi­ca­tion require­ments accord­ing to the crit­i­cal­i­ty of the soft­ware being devel­oped. ASIL C is used for sys­tems that demand strin­gent safe­ty require­ments and thor­ough val­i­da­tion, since fail­ure could result in seri­ous injury.  

“The sys­tem was designed in accor­dance with ASIL C from the out­set. We need­ed to com­plete the man­dat­ed unit test of the BMS C++ code to be fully ASIL C com­pli­ant.” con­tin­ued Syl­vain. “Our project there­fore con­sist­ed of using the LDRA tools from TASKING to per­form unit tests on an exist­ing embed­ded soft­ware pack­age.”  

“To pre­pare for the test cam­paign, we car­ried out a detailed analy­sis of the soft­ware archi­tec­ture and iden­ti­fied all safety‑critical mod­ules to ensure com­plete cov­er­age” Syl­vain said. “The unit‑testing project was car­ried out exter­nal­ly in col­lab­o­ra­tion with our part­ner ISIT, of Plai­sance du Touch, France.” 

“ISIT pro­vid­ed strong exper­tise in both func­tion­al safe­ty and embed­ded soft­ware val­i­da­tion. The project was suc­cess­ful­ly com­plet­ed, achiev­ing full code‑coverage require­ments and pro­duc­ing detailed trace­abil­i­ty doc­u­men­ta­tion to sup­port ISO 26262 com­pli­ance” he con­clud­ed. 

Com­pli­ance with ISO 26262 is demon­strat­ed through the develop­ment arte­facts and ver­i­fi­ca­tion evi­dence pro­duced dur­ing each project. Although the stan­dard does not pro­vide a for­mal reg­u­la­to­ry cer­ti­fi­ca­tion scheme, organ­i­sa­tions may seek inde­pen­dent assess­ment of their develop­ment process­es to con­firm align­ment with its require­ments. WATTALPS suc­cess­ful­ly com­plet­ed such an assess­ment in 2023, obtain­ing cer­ti­fi­ca­tion that its develop­ment process­es com­ply with ISO 26262.  

Auto­mo­tive man­u­fac­tur­ers and sys­tem inte­gra­tors typ­i­cal­ly require sup­pli­ers to meet the stan­dard con­trac­tu­al­ly and will review the result­ing evi­dence to con­firm com­pli­ance.

Sylvain Bassett, Embedded software
Engineer at WATTALPS

Why TASKING’s LDRA test tools? 

“After review­ing alter­na­tive tools, LDRA was select­ed due to its wide­spread use in the soft­ware develop­ment indus­try and because we already had inter­nal exper­tise and expe­ri­ence with it.” Syl­vain explained. A com­bi­na­tion of ease of use, code cov­er­age capa­bil­i­ties, cost, and par­tic­u­lar­ly the on-tar­get test capa­bil­i­ties also con­tributed to mak­ing LDRA test tools the ideal fit

TASKING’s struc­tured approach with LDRA allowed ISIT to sys­tem­at­i­cal­ly ver­i­fy each soft­ware com­po­nent against design intent and func­tion­al require­ments. Auto­mat­ed test exe­cu­tion and cov­er­age analy­sis pro­vid­ed clear, repro­ducible evi­dence of ver­i­fi­ca­tion activ­i­ties - a key advan­tage in reg­u­lat­ed sec­tors.

Building capability and confidence 

LDRA test tools from TASKING enable the WATTALPS team to use mean­ing­ful code cov­er­age met­rics and keep bet­ter track of the ful­fil­ment of require­ments. In addi­tion, the effi­cien­cy gains have trans­lat­ed direct­ly into reduced ver­i­fi­ca­tion effort and project cost. Accord­ing to Syl­vain, “LDRA test tools have allowed us to run the unit-test­ing project far more effi­cient­ly. Com­pared to man­u­al har­ness test­ing, we saved approx­i­mate­ly 50% of test effort, reduc­ing the develop­ment phase of the project by around 12 months. These are sig­nif­i­cant cost sav­ings.” 

The company’s empha­sis on qual­i­ty, safe­ty, and effi­cien­cy aligns close­ly with TASKING’s own phi­los­o­phy of soft­ware ver­i­fi­ca­tion excel­lence, so it is no sur­prise that there have been demon­stra­ble prac­ti­cal ben­e­fits. LDRA’s struc­tured test­ing envi­ron­ment has stream­lined the cre­ation, exe­cu­tion, and doc­u­men­ta­tion of ISO 26262 com­pli­ant unit tests, help­ing WATTALPS deliv­er trust­ed results ret­ro­spec­tive­ly on exist­ing code.

Along the way, WATTALPS’s engi­neers have also shared valu­able sug­ges­tions for fur­ther refine­ment, from enhanced cut and paste facil­i­ties to the intro­duc­tion of macro-like capa­bil­i­ties. TASKING wel­comes such feed­back as part of its ongo­ing com­mit­ment to con­tin­u­ous prod­uct improve­ment and col­lab­o­ra­tion with users in the field. 

Together into the future 

With the ini­tial unit test work hav­ing been in 2023, LDRA’s auto­mat­ed unit and com­po­nent test­ing is now firm­ly estab­lished in the WATTALPS toolk­it, and it con­tin­ues to con­tribute. As Syl­vain sum­ma­rizes, “Today, we con­tin­ue to use LDRA to main­tain unit tests as the soft­ware evolves and receives updates and bug fixes, ensur­ing long-term com­pli­ance and reli­a­bil­i­ty. It is a valu­able part of the broad­er strength­en­ing of our inter­nal develop­ment process­es by inte­grat­ing sys­tem­at­ic ver­i­fi­ca­tion prac­tices to fur­ther improve soft­ware qual­i­ty and sup­port future cer­ti­fi­ca­tion efforts.” 
In an indus­try where com­plex­i­ty and dead­lines are ever more demand­ing, TASKING’s LDRA helps WATTALPS keep its test­ing firm­ly under con­trol. 


Curious what this could look like for you? Great results start with the right tools.

Let’s explore how TASKING can sup­port your next project and make your next step eas­i­er.

Let’s Talk Tech
See What We Offer

Scroll to Top