Batteries, O&M

Battery Safety for Power Engineers: Considerations for Safer Energy Storage Installations

Issue 6 and Volume 120.

By Dr. Davion Hill

Because high-temperature, sodium-based batteries run at high heat, maintaining proper temperatures is critical to ensuring cell efficiency and preventing any potential safety issues. Photo courtesy of DNV GL

The energy storage market has grown significantly in recent years. Battery costs have dropped 75 percent in the last six years. Bundled services for energy storage have added new value to their operation. Today, financing mechanisms and lucrative partnerships are taking hold, and new policies are driving regional markets for energy storage. According to the Energy Storage Association, the United States saw energy storage deployments totaling 40.7 MW in 2015 (a nine-fold increase over second quarter 2014) with 1,100 percent growth in behind-the-meter storage from second quarter 2014 to second quarter 2015.

Energy professionals can see the business opportunities in the energy storage industry, but safety questions remain. Recent events in several industries demonstrate that safety issues are still unresolved.

Past Accidents across Industries

Certain experiences in the energy storage sector have created a legacy for battery safety challenges.

Automotive battery systems in electric cars incorporate safety functions such as cell-level voltage monitoring, temperature monitoring at multiple locations in the module, cascading protections, and active cooling. Automotive battery packs also have high standards for cell quality, deploying current interrupt devices at the cell level as protections against overcharge or short circuit. Despite this, the Chevrolet Volt became the subject of a highly visible public failure when it caught fire after crash testing. The subsequent National Highway Traffic Safety Administration (NHTSA) investigation revealed the culprit to be leaking coolant that shorted the battery pack several days after testing. This could have been avoided by draining the fluids and/or discharging the pack after the test. An additional battery accident at GM’s laboratories demonstrated the dangers of flammable gases. A Tesla Model S sustained significant damage after an anomalous collision with road debris, at which point the cascading protections were overridden by first responders in order to access the pack interior with water. These incidents demonstrate that even high levels of engineered safety can be overcome by anomalous events.

Aviation batteries have been the subject of recently publicized safety incidents. The National Transportation Safety Board’s (NTSB) recent report revealed that a Boeing 787 battery had no cascading protections (passive barriers preventing heat transfer from cell to cell). A cell defect was identified as the initial cause of failure, but the lack of cascading protections contributed to the scale of the fire.

During a nail penetration test in a DNV GL lab, lithium-ion batteries are intentionally ignited to test their effectiveness in containing thermal runaway. Photo courtesy: DNV GL

Due to their size, battery hybrid marine vessels typically include onboard fire extinguishing and forced-air cooling. They are now adopting water-cooling as demonstrated by Plan B Energy Storage, XALT, and others. High-volume water cooling has been demonstrated to arrest thermal runaway by keeping temperatures below the exothermic thermal runaway threshold. Cascading protections are widely understood and designed against marine environmental standards, though only recently have explosive atmospheres been identified as safety issues. Recently, testing by the International Electrotechnical Commission resulted in a buildup of flammable gases within the module enclosure, illuminating the need to revise regulations on ventilation and air management in ship battery rooms. In 2012, a hybrid tugboat experienced a fire due to battery management system (BMS) failure and overcharging. The BMS oversees critical functions such as voltage balancing and charging commands. It was later revealed that the BMS controls were overridden. Again, despite efforts to engineer failure out of battery systems, unforeseen events can sometimes overcome these barriers.

Stationary battery failures have demonstrated lack of cascading protections. Ultracapacitors, while not susceptible to thermal runaway, are still flammable and can be ignited by overcharging. Even lead acid systems are susceptible to cascading fire as was demonstrated by an event at the Kahuku wind farm in Hawaii. These incidents have demonstrated that any energy storage system (ESS) should include protection against cascading, regardless of the chemistry, for the same reasons the international fire code recommends fire blocking within building walls. Consolidated Edison has recognized the potential inadequacy of this legacy for new battery technologies and has invested in research and development with NYSERDA to address appropriate extinguisher types, including Class-D fire considerations and adequate cooling.

Statistics from the Pipeline Hazardous Materials Safety Administration (PHMSA) demonstrate that energy infrastructure is susceptible to third-party damage. These statistics show that external events account for over 50 percent of incidents. Where failure is related to the operation of the system itself, case studies illuminate common failure modes including cell defects, BMS failure due to override or other error, external short, lack of cascading protections, high temperature, external impact, and inadequate venting of flammable gases. Case studies also illuminate best practices in safety. Appropriate for the fire class and external protection of devices against unforeseen physical hazards are: cascading protections, high levels of cell quality, detailed BMS controls with high resolution monitoring of cell parameters, active cooling, protections against shorts, management of flammable gases, and extinguishing practices.

System Architecture

Every battery system contains a basic building block-a single cylindrical, prismatic, or pouch cell. Cells are assembled into stackable modules which may have basic control and intelligence. These modules are then integrated into larger systems which have an overall control and intelligence architecture, usually called a BMS or energy management system (EMS). In order to connect it to the larger network, the system as a whole is connected to external control and communication. The whole system is usually packaged into a metal shipping container. Stationary ESS range in size from hundreds of kW to MW and may have hundreds to thousands of Li-ion cells within them. By comparison, the original Tesla Roadster had more than 6,000 cells in it. Each cell contained a current interrupt device or fuse to prevent thermal runaway at the cell level. The electronic controls at the string and system level provided further active and passive means to control safety events.

Fire Suppression

Fire suppression is often overlooked in stationary ESS design. This is partly a legacy of uninterruptible power supply (UPS) design, which has traditionally employed “clean agent” fire extinguishers which may be appropriate for Class-A (wood or paper), -B (flammable liquids and gases), or -C (electrical) fires. The onboard fire extinguishing systems in battery containers are designed to suppress incipient fires that may spread to the battery system. Clean agent extinguishers are typically gaseous or aerosolized and leave little residue.

Li-ion energy storage systems are not lead acid UPS. A Li-ion battery cathode fire is exothermic and characterized by thermal runaway, which implies that heat is being generated uncontrollably. In this stage, the fire is classified as Class D, but eventually evolves to a Class-A, -B, or -C fire. Once exothermic fuel is consumed, the remaining plastic packaging and polymer separator and binders from the battery continue to burn, at which point the clean agent extinguisher may be sufficient. Ideally, by this point the cascading protections in the system will have halted propagation of the fire beyond a single cell. Suppression and containment of this fire requires not only the appropriate extinguisher and timing of its deployment, but adequate cascading protections to limit the cell failure to a single cell.

Adequate Cooling

Because one of the most significant hazards to Li-ion batteries is temperature, ESS should have adequate cooling. Onboard heating, ventilating, and air conditioner (HVAC) systems are common. Water cooling can be more effective, but it may include design constraints. Water cooling has been demonstrated to maintain temperatures below the exothermic threshold that triggers thermal runaway during overcharge.

Best practice in combatting Li-ion fires requires the fire to be contained, and the heat suppressed. In an official statement in November 2011, the NHTSA recommended the use of “copious amounts of water” for this purpose. A single fire hose can manage a single vehicle fire, but a stationary system that is an order of magnitude larger will require significant volumes of water. Collateral damage associated with excessive water dousing may be unnecessarily costly. In addition, there are concerns about the mix of water with fluorine-based reactants in the Li-ion battery binders (LiPF6) that can create toxic byproducts such as Phosphoryl fluoride (POF3), according to the SP Technical Research Institute of Sweden. Extinguishers should have high thermal conductivity, yet other hazards such as electrical shock or toxicity should be addressed. For example, water mist has been recommended for extinguishing fires in order to control electrical shock during Class-C fires. Official recommendations, then, are in conflict with one another. A water mist may diminish the cooling effect, though it may partially mitigate electrical shock hazards; copious amounts of water may have greater cooling effect, but they may present electrical shock hazards and potential generation of other toxic gases.


A Li-ion battery fire potentially emits toxic and flammable gases. Because ventilation systems typically reduce ventilation in enclosed spaces when smoke is detected, toxic and flammable gases may be trapped, increasing their concentrations to fatal or explosive levels.

When a Li-ion battery undergoes thermal runaway, the event is typically a deflagration and may not be accompanied by flame. Energy release rates that last for several seconds or more are deflagrations. The form factor of the cell can dictate deflagration behavior. Pouch cells tend to swell with internally-generated gases that rupture the seal around the perimeter. Gases are then vented. Most module designs constrict pouch cells and mechanically direct venting (if it occurs) out of the bottom of the cell, though DNV GL testing has shown that the seal between the electrodes is often breached at the top of the cell. Cylindrical cells are typically encased in an aluminum skin with pre-stressed directional vents. Pouch cells are structurally weaker and are vacuum sealed and require compression in the module. Cylindrical cells are structurally stronger but may contain slightly pressurized contents. Both can fail violently or benignly. When deflagration occurs, gases may be combusted when flames are generated, creating hydrocarbon and fluorine-based emissions in the process, as was evidenced by DNV GL tests conducted for the ARPA-e AMPED program. Flammable gases will include carbonates from the electrolyte solvents and potentially hydrogen. The quantities of each gas depend on the mass of the battery, its chemistry, the rate of the deflagration, and whether or not the deflagration is accompanied by flame.

Ventilation systems for rooms and enclosures should allow for reduction of airflow during a conventional fire, and dynamic control during a Li-ion fire. It may be necessary to integrate ventilation controls with the BMS in order to sense if a cell is undergoing thermal runaway and to determine whether ventilation should be increased or decreased. The ventilation systems should be variable, and their peak rating should be sized to maintain an atmosphere below critical concentration thresholds. Ventilation controls should be interdependent with cooling systems such that cooling can be an active safety barrier.


Even when a cell is high quality, the module design and BMS can impact its safety and longevity. The BMS should have active controls to prevent the cell from drifting into damaging ranges of temperature, voltage, or current. The module should monitor individual cell voltages with cross-checking current measurements. Temperature should be monitored at multiple locations in the module, if not at every cell. The module design should mechanically protect and support the cell and provide adequate cooling. Monitoring equipment should include redundancy, self-diagnostics, and cross-verification mechanisms.

If possible, prognostic and diagnostic functions from the BMS could provide an added level of intelligence for ventilation and fire suppression systems. Quality management at every level of the supply chain is critical. A highly engineered BMS has little impact on a low-quality cell, and a high-quality cell is still susceptible to quality and safety incidents when it is managed by a poorly-designed BMS.

Quality procedures and audits of the supply chain should demonstrate that the systems integrator is matching quality cells with quality controls, and that the design is built to prevent potential failure modes with adequate reliability and redundancy. Bold claims such as resistance or imperviousness to thermal runaway, high temperature stability, or low cooling requirements should be scrutinized. The BMS should be evaluated to determine whether its functional safety barriers are appropriately matched with the battery cell.

Cascading Protections

Protection against propagation or cascading in a battery system should be a widely recognized practice by now, though this isn’t always the case. This is particularly true when a battery chemistry (or other electrochemical storage device) is claimed to be immune to thermal runaway. The international fire code mandates fire blocking in the walls of residential and commercial buildings in order to prevent the uncontrolled spread of fire into neighboring rooms or buildings. The reasons for this are obvious and logical. There should be similar requirements for energy storage devices-thermal runaway or not-to prevent cascading between cells or modules. Passive containment systems can be as simple as an air gap between cells, but are more commonly metal plates between cells. Other materials such as phase change materials, intumescent materials, or fire resistant materials can serve this purpose. DNV GL has tested each and found promising results.


There are numerous safety standards for energy storage installations. However, the industry is presently confused by disparities in recommendations between sectors (automotive, aviation, marine, and stationary). The timelines in the certification cycle are much slower than technology advancements. As a result, there is a lack of consensus on which safety standards should be used (and when).

There are multiple technical levels of battery system safety. The most basic level (Level 1) includes basic physical protection and a battery management system (BMS) which monitors temperature, voltage, and current. Level-2 safety systems have higher-resolution monitoring of these parameters via the BMS, as well as passive fuses at the cell level. They will also have a minimum level of cascading protections. The system may also have onboard fire extinguishing and forced-air cooling. The most advanced safety systems for energy storage systems (Level 3) may include water cooling, smart sensing and monitoring, incorporation of fire suppression and ventilation with BMS prognostics, and the ability to halt or mitigate thermal runaway through active or passive means.

Considering the external factors known to cause failures, testing against standards such as UN 38.3 is often considered sufficient, since it captures shock, external short, and puncture consequences of the system. While standardized abuse testing has narrowed battery failures down to eight possible scenarios in this certification test, the number of combined circumstances that would lead to one of these failure modes is infinite in the real world, and the consequences of such events can vary from zero to very large. This standard is primarily focused on the safe transport of battery cells, though it is often cited as a safety qualification of energy storage systems. This can be very confusing for a power engineer who is tasked with evaluating whether or not an ESS has adequate safety systems. Therefore, an examination of ESS safety should not only evaluate the checklist of accredited safety testing for the system, but an evaluation of risk associated with its intended application and site. Risk assessment should directly name risks, quantify their probability of occurrence, demonstrate the consequence of their occurrence, and let the stakeholders decide if they are willing to tolerate the risk.

For these reasons, DNV GL recommends a failure mode effects analysis (FMEA) supplemented with a Bowtie model which takes the ESS site into account. The Bowtie model can capture “barrier effectiveness” for the safety assessment. Quantification of barrier effectiveness is the first step toward accounting for the probability (or improbability) of a threat leading to a significant consequence.

Standards and certifications are useful to enable the adoption of energy storage, but most standardized tests investigate the strength of barriers in the incident path leading to consequences. Sites should be evaluated in detail to determine if there are context-specific risks associated with the functional safety of the ESS.


Dr. Davion Hill is Energy Storage Leader for DNV GL Americas.