First of all the BMS must do no harm to the batteries;
Ensure possible failure modes of the BMS are benign
The BMS should ramp the charger up and down a few times when the charger is first enabled and periodically during charge. If the charger does not respond then the BMS should sound alarms, drop the charger contactors and otherwise attempt to avoid overcharge
Analogue clamping (provides simple failsafe);
Dynamic bypass control (allows system to start bypassing current midway through charge based on previous cycle performance);
Any bus wiring which runs between all batteries or that goes back to a central point must be fibre optic or wireless (to reduce plasma risks). It may be acceptable to have traditional wiring for local bus communications between batteries that are contained within a single subpack (the acceptability of this will depend on the number of batteries, the voltage of the subpack and the physical proximity of the batteries within the subpack).
The BMS must tolerate an electrically noisy environment;
The BMS must tolerate a high vibration environment;