A centralised BMS sees the battery as a monolith.
Traditional systems aggregate the pack into a single controller and mask per-cell chemical drift until the damage is done: lost capacity, hotspots, accelerated degradation. As scale grows, dozens or hundreds of modules in a storage plant, the central compute bottleneck and single point of failure become untenable. Intelligence needs to sit on the cell, not upstream of it.
Per-cell State-of-Health
Each module autonomously estimates its own cell's health and degradation with a physics-empirical model, catching drift before it becomes failure.
Predictive chemical balancing
A short-horizon predictive control loop, computed locally every few milliseconds, equalises the pack at the chemical level and extends service life.
Intelligence with no central node
A network of agents over a fieldbus: modules negotiate decisions peer-to-peer and a lightweight supervisor aggregates them, without centralising compute or creating a single point of failure.
Certifiable functional safety
Rust no_std firmware engineered for IEC 61508, with MC/DC coverage and requirements traceability, ready for the asset's certification pathway.
Sense
Each module acquires its cell's voltage, current and temperature in real time.
Infer
The State-of-Health model runs on the local microcontroller in a few milliseconds.
Balance
Each cell computes its own balancing action and negotiates it with neighbouring modules.
Aggregate
The supervisor composes the global pack state for oversight and diagnostics.
E-ION distributes intelligence across the pack: every cell module is an autonomous agent that senses, infers and balances locally, and negotiates decisions with its neighbours over a fieldbus. There is no omniscient central node and no single point of failure; a lightweight supervisor merely aggregates the global state.
Cloud (twin and analytics)
Cloud hosts the Simulink digital twin and the Python ML pipeline for training and fleet analytics; safety control always stays on the modules, never in cloud. Only aggregated diagnostic data goes up.
On-premise / plant
For stationary storage, the supervisor and SCADA/EMS integration run within the plant perimeter; distributed intelligence is already on the modules and needs no connectivity to operate.
Embedded air-gapped
In vehicle packs or isolated assets the system is inherently air-gapped: every cell knows itself and operates with no network. Firmware updates happen only via a maintenance procedure with signed artifacts.
Functional safety
Rust no_std firmware engineered for IEC 61508, with MC/DC coverage and full requirements traceability: the evidence package accompanies the asset along its SIL certification path.
Data sovereignty
Cell data never leaves the pack to operate: the safety decision is local. Only aggregated diagnostics, under the asset owner's control, is exposed to SCADA/EMS or exported to cloud.
Access and audit
Firmware updates and configuration changes are signed, versioned and logged; the supervisor keeps an immutable log of safety events, protection activations and degradation states for post-event analysis.
Encryption and integrity
Supervisor communications and links to SCADA/EMS are encrypted; every firmware image is signed and verified before execution, so a module never runs unauthenticated code.
What happens if a module fails?
Since there is no omniscient central node, a module failure does not stop the pack: neighbouring modules keep operating and negotiating, and the supervisor flags the degraded module for maintenance. There is no single point of failure.
Why Rust firmware and not C?
Rust no_std eliminates entire classes of memory errors at compile time, a decisive advantage for the IEC 61508 path where safety must be demonstrated. MC/DC coverage and requirements traceability complete the certification package.
Does it work with our cell chemistry?
The State-of-Health model is calibrated for NMC, LFP and related chemistries; the Simulink digital twin allows recalibration to a specific chemistry before deployment.
Is connectivity needed for balancing?
No. Balancing and SoH inference run entirely on the modules over the local CANopen bus; cloud is only for training and fleet analytics. The pack stays fully functional offline.
How does it integrate with our EMS?
The supervisor aggregates pack state and exposes it to SCADA/EMS for stationary storage, providing State-of-Health, alarms and available capacity without exposing the underlying safety compute.
The mark encodes the mechanism, not the sector: la sbarra e le derivazioni asimmetriche verso i nodi.