What is a BDU / Pyro-Fuse Unit?

A battery disconnect unit (BDU) sits between the high-voltage battery pack and the rest of the vehicle’s HV backbone. It combines the main contactors, a pyro-fuse or pyro switch, the pre-charge branch interface, HV interlock (HVIL) taps and high-voltage current sensing into a single safety and isolation module.

In a typical architecture the energy path is: HV battery pack → BDU / pyro-fuse unit → BJB / inverter / OBC / DC fast-charge interface. The BDU is the point where you can rapidly isolate the pack, measure pack current and coordinate safety actions across the rest of the high-voltage system.

• Main contactors for everyday pack connect and disconnect under normal operating currents.
• A pyro-fuse or pyro switch for one-shot, ultra-fast isolation in crash or severe fault events.
• An interface to the pre-charge branch so inrush current is controlled before the main contactors close.
• HVIL taps so the high-voltage interlock loop can detect open connectors or wiring issues.
• High-side current sensing so the control unit can monitor pack current and implement protection.

Compared with a traditional fuse or contactor, the pyro-fuse is a one-time device with microsecond–millisecond-scale response and much higher interrupt capability. It is fired by a dedicated squib driver and safety logic instead of a simple coil supply. The contactors handle everyday switching; the pyro is the last-resort cut, sized for crash, short-circuit and thermal runaway scenarios.

From an IC point of view, a modern BDU needs robust high-side current sensing and isolated amplifiers, dedicated squib driver ICs, digital isolation and communication interfaces, plus diagnostic circuits to monitor the contactors, pyro path, temperature and pack current. You can think of the BDU as the “main gate and safety fuse” sitting right next to the HV battery in the vehicle’s energy solar system.

Typical BDU / Pyro-Fuse Architecture

A typical BDU or pyro-fuse unit sits between the high-voltage battery pack and the downstream HV loads. The HV+ path flows from the pack through the main contactors and the pyro-fuse before it reaches the BJB, traction inverter, on-board charger and DC fast-charge interface. The HV− return path closes the loop back to the battery and may also include a shunt or sensor element.

Inside the BDU, the power, measurement and control paths overlap:

• The power path carries HV+ through the main contactors and pyro-fuse into the HV backbone.
• The measurement path uses a shunt, Hall or coreless sensor and an isolated amplifier or ΣΔ ADC.
• The control path connects the ECU or BMS MCU to the contactor coils and the squib driver.

The ECU, BMS or safety MCU collects measurements, supervises the HVIL loop, monitors the insulation monitor (IMD) fault line and decides when to close contactors or fire the pyro-fuse. Diagnostic feedback such as pack current, contactor state, pyro status and key temperatures closes the loop so you can meet both functional safety and serviceability requirements.

The simplified architecture below highlights these blocks and signal paths without going into pre-charge details, IMD measurement principles or downstream load internals, which are covered on dedicated pages.

Roles of Contactor vs Pyro-Fuse in HV Isolation

A modern BDU uses both main contactors and a pyro-fuse instead of choosing one or the other. The contactors handle everyday connect and disconnect operations, while the pyro-fuse is reserved for severe fault cases where very fast, high-energy isolation is required. Together they form a redundant isolation strategy so the pack can still be disconnected even if a contactor welds.

Main contactors are the “workhorse” switches in the HV backbone:

• They close after pre-charge is complete to connect the HV battery to the backbone under normal load.
• They open for normal shutdown, service operations and controlled isolation procedures.
• Their design focuses on mechanical lifetime, contact resistance, heating and the risk of welded contacts.

The pyro-fuse, or pyro switch, is a last-resort device:

• It is triggered in extreme events such as crash, severe short-circuit or thermal runaway in the pack.
• It offers very fast interruption in the microsecond–millisecond range and very high interrupt capability.
• It is a one-shot device: after firing, the BDU or pyro module must be serviced or replaced.

In normal shutdown sequences the control strategy uses only the contactors. The system may open downstream contactors first and then open the pack-side contactors; the pyro-fuse is not fired for routine operations. In a severe fault or crash, the safety logic commands the pyro-fuse to fire first or in parallel, so the HV pack is isolated even if a contactor has welded and cannot open.

From a functional safety point of view, the combination of contactors and pyro-fuse provides redundant isolation paths. The system still needs robust squib drivers, diagnostics and safe triggering logic, but the overall concept ensures that a single welded contactor does not prevent the vehicle from disconnecting the pack in a critical event.

High-Side Current Sensing & Isolated Amps in a BDU

The current sensor inside the BDU is one of the most critical measurement points in the HV backbone. It measures pack current during charge and discharge, observes short-circuit and fault currents and, in some architectures, feeds energy metering functions. The same measurement often supports over-current protection, thermal runaway protection and power or energy reporting.

The electrical conditions at the BDU make high-side sensing especially demanding:

• Common-mode voltages typically span from a few hundred volts up to 800 V or even 1000 V+ packs.
• Continuous currents reach tens to hundreds of amperes, with short-circuit peaks in the kiloampere range.
• Creepage, clearance and insulation requirements depend on device packaging and PCB layout and are closely tied to the overall safety and isolation design of the sensing chain.

In practice, most BDU designs use one of a small set of high-side current sensing architectures:

• Shunt + isolated amplifier – a resistive shunt on the HV+ or HV− rail and a precision isolated amplifier that converts the small differential voltage into a ground-referenced signal with galvanic isolation.
• Shunt + isolated ΣΔ ADC – the shunt feeds a high-voltage ΣΔ modulator or ADC on the HV side, and a bitstream crosses the isolation barrier into the MCU or power monitor for digital processing.
• Hall / coreless current sensor – a non-contact sensor around the bus bar or cable that avoids shunt losses at the cost of different offset, drift and bandwidth behaviour.

Protection and metering paths may share the same measurement chain or use separate channels. The protection path needs microsecond–millisecond response to catch short-circuit and fault conditions, while the metering path can tolerate more filtering. Because the BDU sits close to high dv/dt switching nodes, the current sensing chain must also offer high common-mode transient immunity (CMTI) so that switching edges do not create false trips or large measurement errors.

Detailed accuracy budgets, long-term drift analysis and full power or energy metering architectures are handled on dedicated HV bus sensing and power measurement pages. Here the focus is on the constraints that come from placing the sensor and isolated amplifier inside the BDU at pack voltage.

Fast Squib Drivers for Pyro-Fuse Firing

The pyro-fuse in a BDU relies on a dedicated squib driver path rather than a generic power switch. The driver must deliver a controlled high-current pulse into a low-resistance squib, within a tightly defined time window and energy budget, while guaranteeing that the fuse fires when required and does not fire at any other time.

Squib loads in automotive BDUs typically sit in the few-ohm range and need a short, high-current pulse that deposits a defined amount of energy. The driver must shape this pulse so it reaches the target current and duration, even when supply voltage and temperature vary, and must coordinate with the safety MCU or airbag ECU that decides when the pyro-fuse should be fired.

From a driver IC perspective, the core requirements include:

• Sufficient current and voltage capability to drive the squib under worst-case resistance and supply conditions.
• Tight timing control so the pulse width and energy remain within the specified window across process and temperature.
• Single or dual redundant channels, often with independent enable and monitoring paths to support ASIL C/D goals.
• Support for low-side, high-side or configurable driver topology depending on the BDU layout and grounding scheme.

Robust diagnostics are just as important as the firing capability. The squib driver must continuously monitor the loop for open-circuit, short-circuit and out-of-range resistance conditions. It needs online self-test functions before arming the pyro-fuse, and the system must define a clear fail-safe strategy when self-test fails: log the fault, notify the vehicle and decide whether the BDU can still meet its safety goals.

The trigger path usually starts in a safety MCU, airbag ECU or BMS that evaluates crash sensors and fault states. The squib driver often uses an independent supply rail or local energy storage so that a single supply failure does not silently block pyro firing. Isolation and signal integrity between the safety controller and the driver help to prevent a single fault from disabling both trigger channels at the same time.

Diagnostics & Health Monitoring in the BDU

The BDU is the point where the pack connects to the HV backbone and where most safety actions originate, so it must expose rich diagnostics and health information to the ECU. These signals determine how reliably the system can detect faults, log events and decide when to isolate or reconnect the pack.

At a minimum, a BDU should report the following:

• Pyro status – whether the pyro-fuse has fired, is still armed and whether the squib circuit shows open, short or out-of-range resistance conditions.
• Main contactor status – information from coil current and auxiliary contacts to detect welded contacts, slow opening and other mechanical issues without duplicating full driver details.
• Current and voltage monitoring – pack current and bus voltage for over-current, short-circuit and arc detection. More advanced weld detection strategies are covered on dedicated pages.
• Temperature points – sensors on the shunt, contactor terminals and pyro housing to spot overheating and localised stress in the BDU.

The BDU also feeds event and trip information into the vehicle diagnostics system. Crash events, shutdown causes and protection trips can be timestamped and stored in non-volatile memory so service technicians and field engineers can understand what happened in the HV backbone and how the pack was isolated.

Each diagnostic item implies specific IC and pin requirements: auxiliary contact inputs, comparator or ADC channels for current, voltage and temperature, dedicated pins for squib readback and digital lines for trip status. Mapping these requirements into concrete AFE, comparator, ADC and MCU resources is a key step when building the BOM and writing an RFQ for BDU electronics.

Safety Concept & Functional Safety Hooks

In most EV architectures the BDU and its pyro-fuse are part of the highest safety goals in the HV backbone. They are often allocated to ASIL C or D under ISO 26262 because they directly implement the isolation of high-voltage energy during crashes and severe electrical faults. The BDU becomes the executing element for safety goals that limit both the probability and the consequences of hazardous events.

Typical safety goals around the BDU and pyro-fuse include:

• When a crash or severe electrical fault occurs, HV energy between the pack and the vehicle must be isolated within a defined time (for example in the millisecond range).
• The pyro-fuse must not fire spontaneously or due to spurious triggers, as this creates its own safety and availability hazards.
• No single point fault is allowed to disable both the contactors and the pyro isolation function at the same time.

To support these safety goals, the electrical and system architecture around the BDU needs explicit functional safety hooks. Common examples include:

• Dual trigger paths using two MCUs or an MCU plus a safety monitoring IC, each capable of evaluating conditions and issuing a pyro command according to the safety concept.
• Independent or supervised supply rails for the squib driver and BDU logic, with voltage monitors that detect when the driver can no longer deliver a valid firing pulse.
• Safety relays or solid-state switches in the trigger paths to create independent, diagnosable isolation between control logic and the squib driver inputs.

The BDU does not operate in isolation. Its safety functions are tied to inputs from insulation monitoring devices (IMDs), the high-voltage interlock loop (HVIL) and residual or leakage current detection. These signals can become part of the conditions that justify pack isolation, such as failed insulation, open connectors or dangerous leakage currents to chassis, even though their measurement details are handled on dedicated sensing pages.

From an implementation point of view, these safety hooks translate into extra pins, supplies and diagnostics around the BDU: separate trigger inputs, status outputs, monitored power rails and explicit interfaces for IMD, HVIL and residual current monitors. Capturing these hooks early makes it easier to derive consistent safety requirements for the BDU electronics and to justify the safety case later.

BDU-Focused IC Selection Map (Seven Major Vendors)

A complete BDU design needs more than contactors and a pyro-fuse. It relies on a set of IC categories that cover current sensing, pyrotechnic actuation, isolation, monitoring and local power. Listing these categories explicitly helps both design teams and procurement to build a coherent BOM and to send focused RFQs to semiconductor suppliers.

Typical IC categories inside a BDU include:

• High-side current sense & isolated amps / ADC for pack current measurement with high common-mode range, high CMRR, strong CMTI and galvanic isolation.
• Squib / pyro drivers & safety drivers that can deliver controlled high-current pulses into squibs with diagnostics, self-test and dual-channel options.
• Isolation devices such as digital isolators and isolated CAN / LIN or Ethernet PHYs for communication between high-voltage domains and the rest of the vehicle network.
• Monitoring and supervisors including window comparators, voltage monitors, watchdogs and safety monitoring ICs for supplies, MCUs and trigger paths.
• Power devices such as small DC/DC converters, LDOs and power-tree components that feed the BDU logic, squib drivers and current sensing circuits.

TI, ST, NXP, Renesas, onsemi, Microchip and Melexis all offer automotive-qualified families in these areas. Some focus on high-side current sensing and isolation, others on safety PMICs, squib drivers or sensor portfolios. Using a category-based map makes it easier to compare vendor options and to ask for complete safety-capable chipsets instead of a random mix of general-purpose parts.

The matrix below does not list individual part numbers. Instead it highlights which vendors are typically strong in each category so you can prioritise datasheets and application notes during early concept and RFQ preparation.

BOM & Procurement Checklist for BDU / Pyro-Fuse Unit

This checklist is written for IC procurement teams and small integration projects. The goal is to turn abstract BDU and pyro-fuse requirements into concrete fields that can be placed in a BOM or RFQ template. Clear, structured fields make it easier for suppliers to propose complete, safety-capable chipsets instead of generic “BDU electronics”.

You can copy the table below into a spreadsheet or RFQ document and fill in the details for your project. Each line describes one aspect of the BDU / pyro-fuse design: electrical limits, fault behaviour, functional safety targets and interface expectations. Vendors can then align their current sensing, pyro driver, isolation, monitoring and power IC proposals with your real system constraints.

The more precisely you define these fields, the less room there is for misunderstanding around pack voltage, current peaks, fault currents, safety levels, dual-channel triggers and whether ISO 15118 or V2X signals are handled inside the BDU or by an external ECU.

FAQs × 12 – BDU / Pyro-Fuse Planning & Selection

These questions capture how I actually plan and select a BDU and pyro-fuse, from safety goals and current sensing to EMC and RFQ details. Each answer is short enough to reuse as a checklist item, a customer reply or structured FAQ data, while still pointing back to the deeper sections on this page.