BESS Fire Safety: How Thermal Runaway Starts, and the Layers That Are Meant to Stop It
A lithium battery fire does not begin as a fire. It begins as one cell generating heat faster than it can shed it, and for minutes before anything burns that cell vents a cloud of flammable gas — which is why a well-designed storage installation detects gas first, smoke second and heat last, and why the explosion risk is often more dangerous than the flame.
That ordering is the whole of battery fire safety, and most serious incidents at commercial scale came from getting it wrong. Gas accumulates inside an enclosure. Nobody knows. Someone opens a door, and the gas deflagrates. The layers meant to prevent this — gas detection, ventilation, deflagration venting, spacing, separation and cooling-based suppression — only work as a set.
What thermal runaway is, and why it is not an ordinary fire
Thermal runaway is a self-sustaining exothermic reaction inside a cell, in which heat from chemical decomposition raises the cell temperature, which accelerates the decomposition, which generates more heat. Once self-sustaining, it needs no external heat source and no outside oxygen, because the decomposition of the cell's own materials supplies both.
That is the difference from a conventional fire. You cannot smother it. Removing oxygen stops the flame above the cell, not the reaction inside it, which is why a gaseous agent effective on a cable fire can knock the flame down and then watch the pack re-ignite ten minutes later. The only effective external intervention is cooling.
How a cell gets there: the five initiating faults
| Initiating fault | What it looks like | Typical origin |
|---|---|---|
| Internal short circuit | Self-heating with no external cause | Manufacturing defect, metallic contamination, lithium plating from cold charging |
| Mechanical damage | Deformation, puncture, crushed terminal | Transport damage, dropped rack, forklift impact, poor handling |
| Electrical abuse | Overcharge, over-discharge, charging below freezing | Failed or bypassed BMS, wrong PCS setpoints, a rack left on defaults |
| External heat | Cell heated past its stability threshold | A neighbouring cell in runaway, nearby fire, failed cooling |
| Connection failure | A high-resistance joint heating under load | Bad torque at commissioning, loosened busbar, corroded terminal |
The last row is ours. Loose and under-torqued connections are the most common electrical defect we find at site, on panels and battery-side DC distribution alike, and a joint running hot at a 0.5C discharge runs hotter every cycle. Our practice is a documented torque record for every power connection and a thermographic check under load — the first thing a competent surveyor asks to see.
The temperature staircase inside the cell
The approximate temperatures below are general to lithium-ion chemistries, not specific to any product.
- Roughly 80 to 120 °C — the solid electrolyte interphase layer on the anode decomposes. The cell begins generating its own heat and gas. Nothing is visible outside.
- Roughly 130 to 165 °C — the polymer separator softens, then melts. Its shutdown function may work, or may fail and allow a direct internal short.
- Above roughly 200 °C — electrolyte decomposes rapidly and the cathode breaks down. In layered oxide chemistries such as NMC that releases oxygen, feeding the reaction internally. LFP cathodes are far more stable.
- Venting — the safety vent opens, releasing carbon dioxide, carbon monoxide, hydrogen, methane, ethylene and vaporised electrolyte solvents, with hydrogen fluoride from the fluorinated salt.
- Ignition or accumulation — the gas either ignites at once as a jet flame, or accumulates in the enclosure as a flammable mixture waiting for a source.
Step five has injured firefighters. A sealed enclosure full of hydrogen-rich gas that has not ignited looks, from outside, like a battery with a fault alarm.
Why LFP is safer than NMC, and why safer is not safe
Lithium iron phosphate has real advantages worth stating plainly. Its cathode is thermally more stable, it enters runaway at a higher temperature, it releases far less oxygen internally, and its peak heat release is lower. That is why most serious buyers of stationary storage now specify it.
But LFP still vents, and the gas carries a significant hydrogen fraction — very wide flammable range, very low ignition energy. The deflagration hazard is not removed by chemistry, and it is made easier to miss, because an LFP cell can vent heavily without producing an obvious fire.
We push back when a supplier presents LFP as a substitute for gas detection and ventilation. It is a substitute for neither. Chemistry reduces the probability and severity of the fire; it does not change the physics of gas accumulating in a closed box.
Why off-gas detection leads smoke and heat detection
| Layer | What it senses | When it responds | Good for |
|---|---|---|---|
| Cell voltage and temperature deviation (BMS) | A cell drifting from its neighbours | Earliest, if thresholds are tight | Catching a weak cell before chemistry starts |
| Off-gas detection | Electrolyte vapour, hydrogen, carbon monoxide | Minutes before visible smoke | Shutdown and ventilation while recoverable |
| Smoke detection | Particulates | After enough aerosol forms | Confirming an event under way |
| Heat detection | Temperature or rate of rise | Late; the volume must heat up | Confirmation; suppression release |
Off-gas detection is the layer that gives you usable warning time, because the cell vents before it burns. A detector in the exhaust path, or at the enclosure top where the plume collects, responds while the correct actions — stop charging and discharging, isolate the rack, start the exhaust, clear people — are still worth taking.
Smoke and heat detection remain required, as confirmation layers. An enclosure with smoke and heat detection and no gas detection is the most common deficiency in early-stage storage proposals, and it is worth challenging first.
How one cell becomes one rack
Propagation is the spread of thermal runaway from one cell to its neighbours, driven by conduction through casings and busbars, radiation inside the module, and the hot vented gas. Whether it propagates depends on cell spacing, thermal barriers, module design, busbar cross-section and whether cooling is still running.
That last point is an electrical design question. If the thermal management system loses power when the DC bus is isolated, you have removed the cooling at the moment you most need it. Our recommendation in every scheme review is to trace the supply feeding cooling, gas detection, the exhaust fan and the alarm panel. If any is fed from the bus being isolated, the design is wrong.
Deflagration: the hazard that is not the fire
A deflagration is the rapid combustion of an accumulated flammable gas mixture, producing a pressure wave. In a battery enclosure that wave can remove doors and walls. The best-known commercial-scale incident in the United States, which seriously injured several firefighters, happened when gas inside a container ignited as the door was opened — the clean-agent system had discharged, the flame was suppressed, and the cells had gone on venting into a sealed box for hours.
Two approaches are accepted, both referenced by the installation standard for stationary energy storage:
- Explosion prevention by ventilation — exhausting the enclosure so the gas concentration never reaches its lower flammable limit, as set out in the NFPA standard for explosion prevention systems.
- Deflagration venting — vent panels sized to relieve the pressure of an ignition along a safe path, as set out in the NFPA standard for deflagration venting.
Many designs use both. No design should rely on the enclosure staying sealed, because that is the condition making a deflagration possible. Ask five questions: which approach is used, what is the exhaust rate, what initiates it, where does it discharge, and what happens if the fan fails.
Spacing, separation and stored energy per fire area
NFPA 855, the standard for the installation of stationary energy storage systems, is the document that governs layout. It addresses the maximum stored energy permitted in one unit and one fire area, separation between storage units and from exposures such as occupied buildings, property lines and means of egress, and the requirements for detection, suppression and ventilation. It also allows some limits to be modified where large-scale fire test data supports the change — the route most often misquoted in sales material.
Two points of our own. Keep the enclosure away from the electrical room and any occupied control room, with fire-rated separation and fire-stopped cable penetrations; we push back when a cable trench runs from the battery enclosure into the LT room, because that trench is a path for hot gas. And give the fire service water within reach and isolation points operable from outside.
What UL 9540A proves, and what it does not
This is the most misrepresented item in storage procurement. UL 9540A is a test method for evaluating thermal runaway fire propagation in battery energy storage systems. It is a method, not a certification, and "passing" it is not a concept that exists. Testing runs at up to four levels — cell, module, unit and installation.
It produces measured gas composition and volume, heat release rate data, evidence of whether runaway propagated from cell to module and module to unit, and surface temperatures on adjacent units and walls. That data is what an authority uses to justify a reduced separation distance.
It does not prove the system will not catch fire, does not cover a layout different from the one tested, says nothing about a different cell, firmware revision or rack configuration, and does not by itself demonstrate code compliance. So the right question is never "is it UL 9540A certified" but "send me the report for the configuration you are quoting, and tell me which of its conclusions your layout relies on."
We hold no fire-test listing of any kind and claim none. We build the electrical assemblies around these systems at our works in Vadodara and read these reports critically on a client's behalf — a different and more honest service than a certificate someone else earned. The wider map of which storage certifications cover what is worth reading before comparing suppliers' claims.
Suppression: what stops a lithium fire, and what only looks like it does
| Approach | What it does | Honest limitation |
|---|---|---|
| Water sprinkler or deluge | Cools cells and surroundings; the only agent removing heat fast enough | Large sustained supply; drainage for run-off |
| Water mist | Cools using less water | Limited penetration into a sealed rack |
| Clean-agent gaseous systems | Knock flame down quickly | Little cooling, so re-ignition after dispersal is a known outcome |
| Condensed aerosol systems | Interrupt flame chemistry | Same limitation; at best a first-stage knockdown |
| Enclosure exhaust and dilution | Stops the flammable mixture forming | Not suppression — explosion prevention, and the more important layer |
Our view, stated plainly because buyers ask: a gaseous or aerosol system alone is not an adequate answer for a battery enclosure. It addresses the flame and not the heat, and it can create a false sense that the event is over. The mechanism matters, not the label on the cylinder.
The standards that apply, and the level each sits at
| Standard | Level | What it covers |
|---|---|---|
| UN 38.3 | Cell and battery, transport | Altitude, thermal, vibration, shock, external short and impact tests |
| IEC 62619 | Cell and battery, industrial | Safety requirements for secondary lithium cells and batteries |
| IS 16270 | Cell and battery, Indian standard | Safety requirements for industrial secondary lithium cells and batteries |
| IEC 62933 series | System | Terminology, unit parameters, planning, and system safety in the safety parts |
| UL 9540A | Test method | Thermal runaway propagation at cell, module, unit and installation level |
| NFPA 855 | Installation | Siting, separation, stored energy limits, detection, suppression, ventilation |
| CEA regulations | Connection in India | Connectivity, metering and electrical safety at the point of supply |
The recurring buyer mistake is accepting a certificate at one level as proof of the level above. A UN 38.3 report says a cell can be transported; an IEC 62619 certificate says a battery meets a set of safety requirements. Neither says anything about whether your installation is laid out correctly, and none of them replaces NFPA 855.
The electrical side: isolation, emergency stop and who has authority to trip
This is our ground, and where we see the most avoidable weakness. A battery installation needs rack-level DC isolation with correctly rated, coordinated protection, because a lithium rack can deliver very high prospective fault current and DC arcs do not self-extinguish at a current zero. It needs an emergency stop hard-wired to drop the rack contactors, not a software command on a communication bus that may itself have failed. And it needs insulation monitoring on a floating DC system, because an earth fault relay designed for an earthed AC system will not see the first earth fault there.
It also needs a hierarchy of authority that is never negotiable: the battery management system has the final word on cell safety, and no energy management or scheduling system may override a BMS trip. An optimiser that keeps discharging through a cell voltage deviation alarm is a software decision that ends badly. Where that boundary sits is set out in how EMS, BMS, PPC and SCADA divide responsibility.
In factory acceptance testing of storage-related assemblies we prove the trip path end to end — press the emergency stop, watch the contactor open, verify the auxiliary contact reports it — rather than testing the relay and assuming the rest, the discipline of any panel FAT and routine test routine. Cells deserve the same seriousness at site that they get on the manufacturer's production floor: handling, storage and first energisation are where that discipline most often slips.
What to ask before you sign
| Question | What a good answer looks like |
|---|---|
| Is there off-gas detection, and where are the sensors? | In the exhaust path and at the enclosure top, with stated thresholds and the action each alarm triggers |
| What is the deflagration strategy? | Ventilation, venting or both, with exhaust rate, initiation logic, discharge direction |
| Which supply feeds detection, cooling, exhaust and alarms? | One surviving isolation of the DC bus, with fan failure supervised |
| May I see the UL 9540A report for this configuration? | The full unit-level report, matching the quote |
| What separation distances does the layout assume, and why? | Traceable to NFPA 855 and, where reduced, to the test data allowing it |
| What suppression mechanism does the design rely on? | Cooling-based, with water supply, duration and drainage addressed |
| Is the emergency stop hard-wired, and who overrides whom? | Hard-wired to the rack contactors; the BMS overrides everything |
| What does the fire service need on arrival? | A pre-incident plan, external isolation points, approach direction, water |
These answers also decide whether a site is insurable on reasonable terms, so run that exercise early — what underwriters ask for on a battery installation overlaps heavily with this list.
The principle to hold on to
A battery fire is a gas problem before it is a fire problem, and a cooling problem rather than a smothering one. Detect the gas, stop it accumulating, space the equipment so one unit's failure is not everyone's, and plan to cool. Chemistry lowers the probability; it removes none of those layers.
One last thought. The question separating a serious supplier from a confident one is not "is it certified". It is "show me the test report for the configuration you are selling, and tell me which part of your layout depends on it".
Frequently Asked Questions
What is thermal runaway in a lithium battery?
Thermal runaway is a self-sustaining exothermic reaction inside a cell, where heat from chemical decomposition raises the temperature, which accelerates the decomposition and generates more heat. Once self-sustaining it needs no external heat source and no outside oxygen, because the cell's own materials supply both. That is why it cannot be smothered, and why cooling is the only effective intervention.
Why is off-gas detection better than smoke detection for battery storage?
Because a cell vents gas before it produces smoke or significant heat. Off-gas detection responds to electrolyte vapour, hydrogen and carbon monoxide minutes earlier than a smoke detector responds to particulates — the difference between stopping an event and documenting it. Smoke and heat detection stay useful as confirmation layers.
Is LFP chemistry safe from thermal runaway?
LFP is substantially more stable than layered oxide chemistries such as NMC: it enters runaway at a higher temperature, releases far less oxygen internally and has a lower peak heat release. It is not immune. LFP cells still vent large volumes of flammable gas with a significant hydrogen fraction, so gas detection, ventilation and deflagration protection remain necessary.
What is a deflagration and why does it matter in a battery enclosure?
A deflagration is the rapid combustion of an accumulated flammable gas mixture, producing a pressure wave that can remove doors and walls. Vented battery gas can build up inside a sealed enclosure without igniting, so it may look quiet while holding an explosive atmosphere. The recognised controls are explosion prevention by ventilation and deflagration venting.
Does UL 9540A certify that a battery system is safe?
No. UL 9540A is a test method for evaluating thermal runaway fire propagation at cell, module, unit and installation level, and it produces data rather than a pass or a listing. The report describes one specific configuration and feeds the fire protection design and separation distances. It does not certify the product or the installation.
What does NFPA 855 require for a battery installation?
NFPA 855 is the standard for the installation of stationary energy storage systems. It addresses siting and separation distances, the maximum stored energy allowed in a unit and a fire area, detection, suppression, ventilation and commissioning. It also allows certain limits to be modified where large-scale fire test data supports the change.
Can a gas suppression system put out a lithium battery fire?
A clean-agent or condensed aerosol system knocks the visible flame down quickly but provides little cooling, so the reaction inside the cells continues and re-ignition after dispersal is documented. Water-based cooling in sufficient volume and duration is what addresses the heat. Gaseous systems are one layer, never the whole answer.
Where should a battery enclosure be placed on an industrial site?
Outdoors or in a dedicated fire-separated area, at separation distances from occupied buildings, property lines, means of egress and other hazardous materials derived from NFPA 855 and the fire authority's requirements. Cable penetrations into electrical or control rooms must be fire-stopped, and the fire service needs water supply and external isolation points.
What electrical protection does a battery system need on the DC side?
Rack-level isolation with correctly rated and coordinated DC protection, because a lithium rack can deliver very high prospective fault current and DC arcs do not self-extinguish at a current zero. It also needs insulation monitoring on a floating DC system, since an earth fault relay meant for an earthed AC system will not detect the first earth fault there.
Should the emergency stop be hard-wired or software-based?
Hard-wired, directly to the rack contactors and the DC isolation path. A stop command on a communication bus depends on the bus, the controller and the firmware all working, and in a fault those are exactly the things that may have failed. Software stops belong on top of a hard-wired path, never in place of one.
Can an energy management system override a battery safety trip?
No, and the control architecture should make it impossible. The battery management system holds final authority on cell safety, and an energy management or scheduling system must never continue charging or discharging through a BMS safety trip. That boundary belongs in writing and enforced in hardware.
Related Guides
- Internal arc and IEC TR 61641
- Panel heat dissipation and cooling
- Panel earthing and earth busbar design
- LFP battery rack selection
- BESS certifications decoded
- Battery storage insurance requirements
- Product page: DC distribution board
- Service: Battery storage (BESS) EPC
- Service: Solar + BESS questions answered
Talk to Us About Your Plant
Wisdom Techno Solutions manufactures the electrical system that sits at the centre of a solar and storage installation — the LT panel, the switchgear, the metering, the protection and the control — at our works in Vadodara, Gujarat. We build DC distribution board, and the same engineers who design an assembly test it before it ships and commission it on site.
Wisdom Techno Solutions is a licensed partner for three design-verified switchgear platforms: Rittal Ri4Power (Rittal Solutions Partner since 2021 — the Ri4Power system carries Intertek ASTA design verification to IEC 61439-1 and -2 Edition 3, with copper and aluminium busbar systems up to 6300 A), C&S CX (Licensed Partner since 2023, up to Form 4B Type II) and Siemens SIEPAN Elite/8PU (IEC 61439 Solutions Partner since 2024). We build to each system's verified configuration and routine-verify every assembly in-house at our Vadodara, Gujarat facility, for industrial, EPC and infrastructure projects across India. For a solar or storage plant that covers the LT switchboard, the BESS PCC and the AC and DC distribution.
If you want to know whether your plant is a candidate, send us twelve months of electricity bills and one day's load profile. That is enough to size a system, show where the savings would come from, and tell you honestly if the answer is no.
The quickest route is our free feasibility study: send the bills and we come back with the sizing and the numbers behind it. To work out your own numbers first, use the free BESS sizing calculator.
Send your single line diagram, your load list or your last twelve bills, and we will come back with the electrical scheme and the numbers behind it.
DC and AC distribution for battery installations is built at our LT panel manufacturer in Vadodara.