Thermal runaway

What it is (precise)

Thermal runaway starts when an abuse condition drives a cell past its stability threshold: an internal short from a manufacturing defect, lithium dendrite, or crush damage; overcharge; over-discharge into voltage reversal; external short; or sustained over-temperature. Past that point internal heat generation exceeds the cell's ability to shed heat, so temperature climbs with no further external input.

Onset is usually preceded by measurable precursors — self-heating of roughly 0.02-0.2 C per minute in accelerating-rate calorimetry, cell swelling, and early electrolyte vapor — which off-gas detection exploits to alarm and shut the string down minutes before any flame appears. That lead time is the safety system's biggest lever, and why detection, not suppression, is the first line of defense.

The runaway climbs a decomposition ladder: the solid-electrolyte interphase breaks down first (around 80-120 C), then the separator melts and the electrolyte decomposes, and finally the cathode degrades — shedding oxygen strongly in NMC, far less in LFP. The cell vents a hot, flammable mixture through its safety port: hydrogen (often 20-50 percent of LFP vent gas by volume), carbon monoxide, methane and other hydrocarbons, CO2, and toxic hydrogen fluoride.

Test data typically show roughly 1-2 liters of vent gas per amp-hour for LFP, rising toward ~3 liters per amp-hour for NMC and at high state of charge. The dominant grid hazard is Propagation: heat and burning ejecta from one cell push neighbors over their own threshold, cascading cell-to-module and module-to-rack.

Why it matters in a real grid-scale project

A single cell failure is statistically unavoidable across a utility-scale fleet — a 100 MW / 400 MWh plant can hold on the order of a million large-format cells. The design goal is therefore not zero failures but no propagation and no deflagration: stop one cell's event from becoming a container fire or a vapor-cloud explosion.

Flammable off-gas pooling inside a sealed enclosure is frequently more design-critical than the flames themselves. Hydrogen burns between its Lower Explosive Limit of about 4 percent and its Upper Explosive Limit of about 75 percent by volume, so even a partial runaway of a handful of cells can push an unventilated container into that explosive band before anything ignites.

The consequences are commercial as much as physical. Thermal-runaway performance sets enclosure spacing, exposure to the PCS and adjacent gear, and setbacks to property lines and occupied buildings — which cap how much capacity fits on a parcel. An Authority Having Jurisdiction increasingly demands a UL 9540A unit-level test report and a Hazard Mitigation Analysis before permitting, and insurers and offtakers scrutinize the same data.

A weak propagation result forces larger setbacks, more suppression, or a redesign, hitting energy density, cost, and schedule directly. Real incidents — Surprise, Arizona (2019 deflagration that injured firefighters), Moss Landing, and the Korean fire series — rewrote both codes and insurance terms.

Typical values and standards

LFP (LiFePO4) dominates stationary storage largely because of its runaway behavior: onset sits higher, near 200-270 C versus roughly 150-210 C for NMC, and LFP releases less heat with no cathodic oxygen, so propagation is harder to sustain. Peak cell temperatures commonly reach about 400-500 C for LFP versus 600-900 C or more for NMC, whose layered-oxide cathode sheds oxygen that feeds its own combustion.

Treat every single-point temperature as approximate: behavior swings with state of charge (higher SOC means earlier onset and a more energetic event), cell format, and abuse mode. EV packs share the physics but answer to a different code chain than stationary sites, so do not borrow automotive test claims to permit a BESS.

The governing US framework is NFPA 855, the installation standard fixing separation, detection, suppression, and ventilation. Its common lithium-ion defaults — maximum stored energy near 50 kWh per ESS unit, roughly 3 ft between units and 10 ft to exposures — can be relaxed or tightened by large-scale fire-test data.

That data comes from UL 9540A, the standardized cell/module/unit/installation test that characterizes onset, vent-gas composition and volume, heat release, and whether propagation occurs. Explosion control follows NFPA 68 (deflagration venting) and NFPA 69 (prevention). UL 9540 is the separate product-safety listing for the ESS as a system, and IEC 62619 covers industrial lithium cell and battery safety in IEC-market projects.

How it shows up in specs, studies and contracts

Thermal runaway reaches a working engineer first as a vendor document package: the UL 9540A test report at cell, module, and unit level, the UL 9540 listing, cell certificates to UL 1973 and IEC 62619, and a fire-safety design description.

Read the unit-level 9540A report for four numbers: whether module-to-module and rack-to-rack propagation occurred, the heat flux measured at adjacent walls and target cells, the vent-gas composition and total volume (used to size deflagration vents per NFPA 68), and which detection layers were credited. The binding result is usually the first — no unit-to-unit propagation is the finding an AHJ credits to relax NFPA 855 spacing. Remember 9540A yields data, not a pass/fail certificate.

Downstream, the same physics drives permitting and contracts. The Hazard Mitigation Analysis converts 9540A results into site-specific separation, suppression, and explosion-control decisions; the Emergency Response Plan tells the fire service what the off-gas is, when not to open doors, and how long re-ignition stays a risk, since stranded energy can re-ignite hours to days later.

Supply and insurance agreements reference the certification package, and EPC scopes allocate who furnishes gas detection, deflagration panels, and suppression. Ask three questions explicitly: at what SOC was the 9540A test run, did any propagation occur, and what happens to the warranty after a thermal event in a single module.

Common pitfalls

The most common documentation error is conflating UL 9540 with UL 9540A: the first certifies the system's safety, the second is a fire-propagation test method, so a datasheet reading "UL 9540A certified" is a red flag — 9540A certifies nothing. A second trap treats clean-agent suppression as the cure: gaseous agents knock down flames but cannot pull heat from a cell already in runaway, so cell-to-cell cooling and propagation resistance do the real work.

Third, Off-gassing detection and smoke detection are different layers — off-gas sensors can trip minutes before flaming ignition and force shutdown. Finally, confirm the SOC in the 9540A test matches or exceeds your operating window; a report run below your maximum SOC understates the real hazard.