Knowledge / Battery Safety Battery Thermal Runaway Propagation Explained A battery pack is safe only if a rare cell failure stays local long enough for controls, barriers, and responders to work. 9540A ESS Propagation Test SOC Key Severity Lever BMS Probability Control Gas Explosion Hazard What Thermal Runaway Means Thermal runaway is what happens when a cell produces heat faster than it can shed heat, triggering self-heating reactions that can accelerate into venting, fire, or explosion. The pack-level danger is propagation. One cell can fail for a reason that is hard to eliminate entirely, but the system is supposed to keep that failure from becoming a module, rack, container, or vehicle event. Lithium-ion cells store energy in a compact electrochemical stack. That is the advantage and the hazard. Abuse can come from internal short circuits, overcharge, mechanical crush, external heating, manufacturing defects, contamination, separator damage, or dendrite growth in certain conditions. Some causes are visible during testing. Others are latent and appear later after cycling, vibration, or calendar aging. NREL has described internal short-circuit behavior as a major safety concern because latent defects can evolve into hard shorts through mechanisms such as separator wear, metal dissolution and deposition, or debris. That point matters for safety engineering. A good battery system does not assume perfect cells. It assumes that rare failures can happen and designs barriers around them. At cell level, the sequence usually starts with abnormal heat. The solid electrolyte interphase can break down, separator integrity can decline, electrolyte can decompose, and electrode reactions can feed more heat. Exact temperatures depend on chemistry, state of charge, cell design, and test method. Once the reaction becomes self-heating, removing the initiating trigger may no longer stop the event. Propagation is a heat-transfer and gas-management problem. A failing cell can heat neighboring cells through conduction, convection, flame impingement, hot ejecta, and radiant heat. It can vent flammable gases into a confined space. It can also launch particles or molten material. The question for pack designers is how much time and separation exist between cell failure and neighbor cell abuse. Chemistry changes the risk profile. LFP cells generally have better thermal stability than many nickel-rich chemistries, but LFP packs can still release gas and burn under severe abuse. NMC and NCA cells can offer high energy density, but pack designers must manage higher stored energy per volume and thermal behavior. Sodium-ion, solid-state, and other emerging systems will need their own propagation data rather than borrowed assumptions. How Propagation Is Tested UL 9540A is central for stationary storage because it evaluates thermal runaway fire propagation in energy storage systems. UL describes the method as an American and Canadian national standard for assessing fire propagation related to thermal runaway events in energy storage systems. It examines behavior from cell level through larger system levels so authorities, insurers, integrators, and fire officials can judge installation risk. The test ladder matters. A cell test asks what happens when one cell fails. A module test asks whether the failure spreads to adjacent cells and what gases, temperatures, and flames are produced. A unit or installation-level evaluation asks whether spacing, enclosures, HVAC, deflagration mitigation, suppression, detection, and emergency response assumptions are credible. Passing one level does not automatically answer every site question. Battery management systems reduce probability, not consequence. A BMS watches voltage, current, temperature, isolation, contactors, and state estimation. It can stop charge or discharge, open contactors, flag imbalance, and warn operators. It cannot see every internal defect directly and cannot cool a cell that is already deep into runaway. Physical design has to carry the consequence-management load. Mechanical design is the first barrier. Cell spacing, thermal pads, phase-change materials, ceramic barriers, vent channels, module walls, pressure-relief routes, and nonflammable structural materials can slow heat transfer and redirect gas. The best designs keep hot gas away from neighbor cells and away from electrical arcs. A small path detail can decide whether venting is controlled or chaotic. Cooling design is the second barrier. Liquid cold plates, immersion concepts, air channels, and refrigerant loops can remove routine heat and slow abnormal heating. Cooling is not a cure-all because thermal runaway releases heat rapidly and locally. Still, thermal mass and heat paths affect whether a neighbor cell crosses its own abuse threshold. Good cooling gives the system time. Gas handling is often underappreciated. A cell can vent gases before visible flame appears. In an enclosed BESS container, gas accumulation creates explosion risk if ventilation, detection, and ignition controls are poor. That is why modern storage safety design pays attention to gas sensors, exhaust paths, pressure relief, separation distances, and emergency procedures. Fire is not the only hazard. Layer Main Job Failure Mode Cell chemistry Reduce runaway severity High SOC or defect overwhelms stability BMS Detect abnormal operation Cannot see every internal short Module barriers Slow heat and ejecta transfer Gas path heats adjacent cells Container design Vent, detect, isolate, suppress Gas accumulates or fire spreads Pack Design and Project Risk For EV packs, propagation interacts with crashworthiness. A pack must survive vibration, potholes, curb strikes, water exposure, fast charging, cold starts, and collisions. Automakers use crush structures, pack segmentation, coolant isolation, current interruption devices, pyrofuses, vent paths, and software limits. The customer never sees most of this engineering unless it fails. For grid storage, propagation interacts with siting. A utility-scale battery container may sit near other containers, transformers, roads, walls, vegetation, or occupied buildings. Fire departments need access and information. Insurers need test data. Project developers need permits. A low-cost container that cannot support credible emergency response can become expensive during permitting or after an incident. State of charge is one of the simplest controls. Higher state of charge generally increases available energy and can worsen abuse outcomes. Operators can reduce risk by limiting maximum state of charge for certain duty cycles, managing temperature, avoiding aggressive charging under bad conditions, and retiring modules with suspicious trends. Software policy becomes a safety tool. The industry is moving toward better data because generic claims no longer satisfy buyers. They want cell chemistry, format, state of charge, trigger method, propagation time, gas composition, heat release, suppression response, and post-test condition. They want to know whether a single-cell failure stayed inside a module or moved through the system. That is the difference between marketing safety and engineering safety. The business case is direct. Safer packs win permits faster, lower insurance friction, reduce recalls, protect brand trust, and make larger installations acceptable in more places. Battery safety is not a tax on growth. It is a requirement for scaling storage and EV adoption without turning every rare failure into a public setback. The practical lesson is that thermal runaway cannot be managed by one component. It is chemistry, cell quality, controls, mechanics, cooling, sensing, enclosure design, installation layout, maintenance, and emergency planning. The best systems assume a bad cell can appear and make sure the rest of the pack does not follow. Engineering Details That Decide Deployment Cell format matters because heat and gas leave different packages in differen