BESS Safety Thermal Runaway

Battery storage is safer than it has ever been, and battery fires remain the risk that defines how projects are permitted, insured, and financed. A single thermal runaway event, though rare, can propagate through a system, release toxic and flammable gases, and in the worst cases reignite days after it appears extinguished. Fire authorities, insurers, and lenders all know this, and each now scrutinises the safety case of a storage project more closely than any other single aspect of its design.

Most discussion of battery safety concentrates on the last line of defence: detection and suppression, the systems that act once a cell is already failing. That work is essential, but it addresses the problem late. A complete safety strategy is layered, and its earliest and arguably most valuable layer is prevention — stopping the electrical and thermal conditions that trigger runaway before they develop. That layer is where the energy management system operates. This guide covers how thermal runaway happens, the layered defence that contains it, the European regulatory framework that governs it, and the specific protective role the EMS plays upstream of the fire-response systems most articles focus on. It concerns physical and thermal safety; for the distinct subject of cybersecurity, see PowerKonnekt's guide to energy storage systems security.

What Thermal Runaway Actually Is

Thermal runaway is a self-sustaining exothermic reaction inside a battery cell. Once a cell's internal temperature rises past a critical threshold, chemical reactions begin generating heat faster than it can dissipate. That heat accelerates the reactions, which generate more heat, in a feedback loop that, once established, cannot be stopped from outside the cell. The cell vents flammable and toxic gases, and the heat it releases can push neighbouring cells past their own thresholds, propagating the failure from cell to module to rack.

Thermal runaway can be triggered several ways: a manufacturing defect creating an internal short circuit, mechanical damage, exposure to excessive external temperature, or electrical abuse such as overcharging or over-discharging. The last category matters here because it is the one an intelligent control system can directly prevent. A cell driven outside its safe voltage window by a control failure is a cell being pushed toward runaway by the system that was supposed to protect it.

The Chemistry Dimension: Why LFP Changed the Picture

Battery chemistry substantially affects thermal runaway behaviour, and the industry's shift toward lithium iron phosphate for stationary storage has improved the safety picture. LFP's crystal structure retains its oxygen even at high temperatures above 250 degrees Celsius, and because free oxygen fuels the dangerous reactions during a thermal event, that stability makes LFP markedly harder to drive into runaway. LFP also generatesapproximately 86% less hydrogen fluoride than NMCduring a thermal event, a significant factor for both gas detection design and first-responder safety. This inherent stability is a primary reason LFP has become the preferred chemistry for utility-scale storage from both a safety and an insurance perspective. Its one complication is a flat voltage curve that makes state-of-charge estimation harder, demanding more sophisticated management — a challenge covered in PowerKonnekt's guide to state of charge, depth of discharge, and cycle life.

The Layered Defence: Five Lines Between a Cell and a Catastrophe

Battery safety is not a single system but a sequence of independent layers, each designed to catch what the previous one missed. Understanding the sequence clarifies where the EMS fits and why its position matters.

Layer One: Cell and Chemistry Design

The first line of defence is the cell itself: chemistry chosen for stability, quality control that minimises manufacturing defects, and mechanical design that resists internal short circuits. This layer is set at manufacture and cannot be changed in operation. Choosing a stable chemistry such as LFP raises the threshold at which every subsequent layer must act.

Layer Two: Electrical Prevention — Where the EMS Lives

The second layer prevents the electrical conditions that cause runaway. Overcharging and over-discharging are among the most direct electrical triggers, and preventing them is a control function. The battery management system enforces cell-level limits, and the energy management system enforces them at the system level and acts as a backup should the battery management system fail to respond. This is the prevention layer, and it operates continuously in normal operation, long before any detector has anything to sense. It is the layer most safety discussions skip past on their way to suppression, and it is the one that stops the largest share of preventable events.

Layer Three: Detection — The Early-Warning Window

If prevention fails and a cell begins to fail, early detection provides a critical intervention window. Before full thermal runaway, lithium-ion cells vent trace electrolyte vapours and volatile organic compounds. Detecting these off-gases can provide a warning window of, in some cases,up to 30 minutesbefore the situation becomes unmanageable — time to isolate the affected battery, stop charging, and activate ventilation. Off-gas detection has become central to modern fire safety because it acts earlier than heat or smoke detection: hydrogen is a primary early indicator, alongside carbon monoxide and, in a thermal event, hydrogen fluoride. Updated fire standards now explicitly recognise the limitations of older lower-explosion-limit sensors and battery-voltage monitoring as sole safeguards, driving adoption of dedicated off-gas sensing.

Layer Four: Suppression and Containment

If detection confirms an event, suppression and containment limit the damage. Water remains the preferred suppression agent for lithium-ion systems, used to cool cells and slow propagation. Equally important is containment: physical spacing, barriers, and enclosure design that prevent a fire in one unit from spreading to the next. Deflagration venting or explosion prevention manages the flammable gases a thermal event releases. A defining feature of modern requirements is that these systems must remain operational during the failure scenario itself, not merely under normal conditions.

Layer Five: Emergency Response and Isolation

The final layer is the built-in emergency response: automatic system isolation that disconnects affected components, alerts personnel, and coordinates with the facility's fire-alarm infrastructure. This is the point at which the system accepts that an event is underway and acts to protect people and limit consequence rather than to prevent the event.

The European Regulatory Picture

Much published guidance on battery fire safety is written around the American NFPA framework, whose standards are widely referenced worldwide. For a project deployed in Europe, the applicable framework is different, more fragmented, and frequently misunderstood.

There is currently no single European ESS safety standard equivalent to the American NFPA 855. A European project instead assembles its safety case from several sources.IEC 62933-5-2— the international standard for the safety of grid-integrated electrochemical storage — provides the system-level safety structure and is the closest thing to a common European reference.IEC 62619governs the safety of the industrial lithium cells themselves, andEN 50272covers the safety requirements for battery installations including ventilation. On top of these sit CE marking obligations, national fire regulations that vary by country, local planning processes, and environmental permitting.

Filling part of the gap left by the absence of a single EN standard isVdS 3103, the German insurance industry's guideline for fixed extinguishing and protection in lithium battery installations. Though not legally mandatory across Europe, it has become an increasingly important reference because insurers use it as a marker of credible loss-prevention design. A project designed with VdS 3103 compartmentation and suppression logic in mind signals to underwriters that consequence control was considered from the outset, which directly affects the terms on which the project can be insured, and therefore financed. The EU Battery Regulation adds further requirements around safety testing whose detailed classification standards are still developing. The connection between compliance, insurance, and financing is the same bankability logic explored in PowerKonnekt's guide to battery degradation, lifetime, and bankability.

Why Safety Has Become a Bankability Question

Fire safety is no longer only an engineering concern or a permitting hurdle. It has become a financial variable that shapes whether and on what terms a project can be built.

Insurers underwriting a storage project assess the credibility of its entire safety case, and the integrity of the control layer is an explicit part of that assessment. Weak control integrity increases the uncertainty an underwriter must price, and that uncertainty flows through into stricter terms: higher deductibles, tighter exclusions, more conservative business-interruption assumptions. Lenders, in turn, factor those insurance terms into the bankability of the project. A storage asset with a demonstrably robust prevention-and-isolation layer and auditable operating records is a more insurable, more financeable asset than an otherwise identical system without them.

This reframes the EMS's safety role in commercial terms. Its prevention functions are not only protecting the hardware; they are protecting the financial case. The same audit-ready operating records that support warranty compliance also support the safety case an insurer reviews. Involving safety and insurance considerations early, before design freeze, is repeatedly identified as the difference between a smooth underwriting process and an expensive late redesign. A control layer built for prevention and documentation from the start is part of what makes that early engagement productive.

The EMS's Protective Role in Detail

Within the layered defence, the energy management system performs several specific protective functions, all operating upstream of or in concert with the fire-response systems.

Overcharge and over-discharge prevention.The most direct electrical triggers of thermal runaway are prevented at the control layer. The EMS enforces safe operating limits at the system level and acts as a backup should the battery management system fail to halt an unsafe condition, stopping operation immediately when an overcharge or over-discharge warning is raised.

Continuous condition monitoring.The EMS continuously monitors the battery's state — voltage, current, temperature, and state of charge — across the system, polling the battery management system on a millisecond cycle for alarm and warning status. This constant visibility is what allows the system to react to an emerging problem in the moment it appears rather than after it has developed.

Rapid fault response and isolation.On a critical warning, the EMS halts operation within milliseconds and isolates the affected component. A best-effort isolation approach shuts down only the component that has failed, allowing the rest of the system to continue operating safely while confining the problem. This containment at the electrical level complements the physical containment that limits fire spread.

Thermal-aware operation.Because temperature is a primary driver of both degradation and runaway risk, the EMS keeps operation within safe thermal bounds, coordinating with thermal management and curtailing high-power operation when temperatures drift toward limits. Managing the conditions that age a battery and the conditions that endanger it are, to a large degree, the same task — explored further in the guide to battery degradation and lifetime.

Emergency stop and integration.In a critical hazard, an emergency-stop function fully isolates the system, opening all switches and disconnecting every component. The EMS coordinates with the facility's fire-alarm and safety infrastructure so that electrical isolation and physical fire response act together rather than independently.

Frequently Asked Questions

What is thermal runaway in a battery?

Thermal runaway is a self-sustaining exothermic reaction inside a battery cell, in which rising temperature accelerates internal chemical reactions that generate further heat in a feedback loop. Once established, it cannot be stopped from outside the cell; the cell vents flammable and toxic gases and can push neighbouring cells past their own thresholds, propagating the failure. It can be triggered by internal defects, mechanical damage, excessive temperature, or electrical abuse such as overcharging.

How is a BESS fire prevented?

Prevention is layered. Stable cell chemistry such as LFP raises the threshold for runaway; electrical prevention at the control layer stops the overcharging and over-discharging that trigger many events; off-gas detection provides an early-warning window to intervene; suppression and containment limit damage if an event begins; and emergency isolation protects people and limits consequence. The energy management system operates primarily in the prevention and isolation layers, reducing the probability that suppression is ever required.

What is off-gas detection and why does it matter?

Before full thermal runaway, lithium-ion cells vent trace electrolyte vapours and volatile organic compounds. Off-gas detection senses these early, providing a warning window of up to 30 minutes in some cases — time to isolate the battery, stop charging, and ventilate. It acts earlier than heat or smoke detection, with hydrogen as a primary early indicator. Updated fire standards now recognise the limitations of older sensor types and increasingly expect dedicated off-gas sensing.

Is LFP safer than NMC for battery storage?

Generally yes. Lithium iron phosphate retains its oxygen at high temperatures, which makes it substantially harder to drive into thermal runaway, and it generates roughly 86% less hydrogen fluoride than NMC during a thermal event. These properties make LFP the preferred chemistry for utility-scale storage from both safety and insurance standpoints. Its trade-off is a flat voltage curve that makes state-of-charge estimation harder and requires more sophisticated management.

What fire safety standards apply to battery storage in Europe?

Europe has no single ESS fire standard equivalent to the American NFPA 855. Projects assemble a safety case from IEC 62933-5-2 for system safety, IEC 62619 for cell safety, and EN 50272 for installation safety, alongside CE marking, national fire regulations, and local permitting. The German insurance guideline VdS 3103 is increasingly referenced by insurers as a marker of credible fire-protection design, even where it is not legally mandatory.

Can an EMS stop a battery fire?

No, and any claim otherwise should be treated with suspicion. Once a cell is in deep-seated thermal runaway, no control-system action stops the reaction, and software does not replace suppression hardware and physical containment. What the EMS does is prevent the electrical abuse that triggers many events, halt operation the instant a warning appears, and isolate the affected component to contain the problem. It reduces the probability that suppression is needed and limits consequence when an event begins.

Why does fire safety affect a project's financing?

Insurers assess the full safety case of a storage project, including the integrity of its control layer, and price uncertainty into their terms. A weak safety case leads to higher deductibles, tighter exclusions, and more conservative assumptions, which lenders then factor into bankability. A project with robust prevention, isolation, and auditable operating records is more insurable and therefore more financeable. Engaging safety and insurance considerations before design freeze avoids expensive late redesign.

How PowerKonnekt Relates to BESS Safety

PowerKonnekt is a control layer, not a suppression system, and its safety contribution is precise about that boundary. The EMS occupies the prevention and isolation layers of the defence-in-depth model, working to ensure that the suppression and containment layers are called upon as rarely as possible.Overcharge and over-discharge protectionhalts power conversion operations within milliseconds of a battery-management-system warning, acting as a backup layer should the battery management system itself fail to respond — directly addressing the electrical abuse that triggers a significant share of preventable thermal events.

Continuous battery monitoring underpins this: the EMS polls the battery management system every10 millisecondsfor alarm and warning status, including overcharge, over-discharge, and temperature thresholds, and monitors voltage, current, temperature, and state of charge across the system in real time. When a critical condition appears, theheartbeat mechanismand best-effort isolation approach shut down only the affected component while the rest of the system continues operating, confining a local fault before it can propagate. In a critical hazard, theemergency stopfully isolates the system — opening all switches, disconnecting every component, and alerting personnel.

On the documentation side, the audit-ready operating records the EMS maintains for warranty compliance also support the safety case that insurers and fire authorities review, contributing to the bankability of the project. PowerKonnekt operates within the European compliance framework — IEC 62933-5-2, IEC 62619, EN 50272 — and its ISO 27001 certification and in-progress IEC 62443 cybersecurity work address the digital dimension of safety covered in the energy storage systems security guide. Because the platform is hardware-agnostic, it applies these protective functions across battery and power-conversion equipment from any manufacturer.