BESS security protocols:
Why is UL 9540A more important than price?
Lithium batteries have a high energy density. This is their main advantage and main risk. When damaged or mismanaged, a "thermal runaway" occurs -- a chain reaction that cannot be quenched with water. For business, this means one thing: saving on security is unacceptable. In this article, we discuss in detail the physics of thermal dissipation, international certification standards, fire suppression systems, the role of BMS as the first line of defense, architectural requirements for BESS placement, and lessons learned from real incidents.
Anatomy of a Thermal Runaway: What Happens Inside a Cell
Thermal runaway is not an instant explosion. It is a cascading process that develops through several well-defined stages. Understanding each stage is critical to designing protection systems, as each stage has a window for intervention. Let's consider the anatomy of the process step by step.
Stage 1: Internal short circuit (90-130°C)
The trigger can be a manufacturing defect, mechanical damage, overcharging or dendritic sprouting of lithium through the separator. The internal resistance of the cell increases sharply, generating local heat. At this stage, the BMS can detect an abnormal increase in temperature and voltage and disconnect the cell.
Stage 2: Decomposition of the SEI layer (130-150°C)
The Solid Electrolyte Interphase (SEI) -- the protective film on the anode -- begins to break down. This is an exothermic reaction: it releases additional heat and accelerates heating. Lithium at the anode enters into a direct reaction with the electrolyte. The process becomes self-sustaining.
Stage 3: Decomposition of electrolyte and separator (150-200°C)
The organic electrolyte (usually a mixture of ethylene carbonate and dimethyl carbonate) decomposes by releasing combustible gases: hydrogen (H2), methane (CH4), ethylene (C2H4), carbon monoxide (CO). The polyethylene separator melts, which leads to a large-scale internal short circuit. The pressure inside the cell body increases rapidly.
Stage 4: Ventilation of gases (200-250°C)
The safety valve of the cell opens (or the case collapses), releasing a mixture of toxic and flammable gases. Characteristic sharp smell and hissing. This is a critical moment for Off-gas Detection systems -- VOC and CO sensors, which should work 10-20 minutes before ignition. If the room's ventilation system fails, the gas mixture accumulates to an explosive concentration.
Stage 5: Ignition and Propagation (250°C+)
Combustible gases are ignited by heat or a spark. The cathode (NMC, NCA) decomposes by releasing oxygen, which supports combustion even without external air. The temperature reaches 700-1000°C. If the design of the module does not provide thermal insulation between the cells, the fire spreads to the neighboring cells - this is "cell-to-cell propagation". The entire module can burn out in 5-20 minutes.
Key fact
Cathode material NMC (nickel-manganese-cobalt) emits its own oxygen at temperatures above 200°C. That is why the thermal acceleration of NMC cells cannot be stopped by simply blocking air access. This is a fundamental difference from the burning of ordinary materials. LFP (Lithium Iron Phosphate) cells are much safer: their cathode is stable up to 270°C and does not emit oxygen, making propagation extremely unlikely.
Safety standards: A complete overview
The BESS International Standardization System includes dozens of documents, but four standards form the basis that insurance companies, regulators and professional integrators around the world refer to. Let's consider each in detail.
UL 9540A -- Thermal Acceleration Test Method
UL 9540A, developed by Underwriters Laboratories (USA), is the most important standard for evaluating the fire safety of BESS. Its uniqueness lies in the four-level system of destructive testing. Engineers specifically initiate thermal acceleration in one cell and check whether the system is able to prevent it from spreading to neighboring cells.
| Level | The object of testing | What is checked |
|---|---|---|
| 1. Cell Level | A separate cell | Characteristics of thermal acceleration: temperature, speed, type and volume of gases, presence of flame, type of emission (gas vs molten material) |
| 2. Module Level | Module (10-20 cells) | Does the thermal acceleration of the initiated cell spill over to neighboring cells? Efficiency of thermal insulation between cells, ventilation of the module |
| 3. Unit Level | Complete unit (rack/cabinet) | Behavior during overclocking of the entire module: gas release, case temperature, effectiveness of the built-in fire extinguishing system, case integrity |
| 4. Installation Level | Complete installation | Impact on neighboring structures, distances to walls and buildings, effectiveness of room ventilation, operation of gas evacuation systems |
Tier-1 systems of manufacturers (CATL, BYD, Samsung SDI, EVE Energy) pass all four levels. Verified Financial & Technical Results of UL 9540A testing are mandatory for obtaining permission to install BESS in most jurisdictions of the USA, Canada, Australia and increasingly in the EU.
IEC 62619 -- Safety of secondary lithium batteries
The International Electrotechnical Commission (IEC) standard 62619 focuses on the safety of the battery cells and battery packs themselves for industrial applications. It defines the requirements for protection against: overcharge, overdischarge, external short circuit, shock loads, vibration, temperature extremes and forced discharge. Unlike UL 9540A, which tests the system's response to thermal runaway, IEC 62619 tests whether the battery is capable of triggering it at all under normal and abnormal operating conditions.
NFPA 855 -- Code for Installation of Stationary ESSs
National Fire Protection Association (NFPA) 855 is not an equipment testing standard, but an installation design code. It defines:
- Minimum distances from BESS to buildings, fences, power lines and between individual units
- Premises requirements: fire resistance of walls (minimum 2 hours), ventilation system, emergency lighting, evacuation routes
- Detection systems: mandatory smoke, heat and combustible gas detectors
- Fire extinguishing systems: type and power depending on battery chemistry and installation size
- Emergency shutdown: an external Emergency Disconnect (EPO) button is available for fire brigades
- Marking: clear warning signs about the presence of lithium batteries, the danger of electric shock and toxic gases
UN 38.3 -- Transport security
The standard of the United Nations Organization UN 38.3 (Manual of Tests and Criteria, Part III, Section 38.3) regulates the transportation of lithium batteries by all types of transport. It includes 8 tests: altitude simulation (depressurization), thermal cycling (-40°C to +75°C), vibration, shock, external short circuit, forced discharge and overcharge. Each shipment of BESS equipment crossing the border must have a UN 38.3 certificate. Without it, no transport company or port will accept the cargo.
Practical conclusion
When choosing a BESS supplier, ask for a full package of certifications: UL 9540A (reporting on all 4 levels), IEC 62619, UN 38.3 and documentation of project compliance to NFPA 855 or equivalent. This is not a formality - it is a condition of object insurance and legal protection in the event of an incident.
Fire extinguishing systems for BESS
Choosing a fire extinguishing system for a battery storage is not a matter of preference, but a matter of physics. The thermal acceleration of lithium cells is not a "normal" fire: the cathode can generate its own oxygen, the temperature reaches 1000°C, and the combustible gases create an explosion risk. Let's consider five main technologies.
Water Mist
Principle: Spraying water under high pressure on drops of size 50-200 microns. Evaporating, they absorb a huge amount of heat and cool the cells below the propagation threshold.
+ The most effective cooling. Prevents propagation to neighboring modules. Not toxic.
- Requires water supply. Risk of short circuit from water. Large volume of effluents to be disposed of (containing HF).
Recommended for: container BESS from 500 kWh
Novec 1230 (3M)
Principle: Fluoroketone (FK-5-1-12) stored as a liquid and sprayed as a gas. Absorbs heat during evaporation, displaces oxygen by volume.
+ Leaves no residue. Does not damage electronics. Quick operation (up to 10 seconds). Zero ozone depletion potential.
- Limited resource (single charge). It does not stop the thermal acceleration that has already started - it only suppresses the flame. High recharge cost.
Recommended for: cabinet BESS 30-200 kWh
Aerosol extinguishing
Principle: Aerosol generators release microparticles of potassium compounds that chemically inhibit the combustion reaction.
+ Compact generators. Do not need pipelines. Long storage period (up to 15 years). Low cost.
- Leaves residue on equipment. One-time operation. Minimal cooling effect. Not recommended for large format NMC chemistry.
Recommended for: small LFP systems, telecom BESS
FM-200 (HFC-227ea)
Principle: Refrigerant gas that absorbs heat during evaporation and reduces the concentration of oxygen.
+ Quick operation. Leaves no residue. Not leading.
- High GWP (Global Warming Potential = 3220). of circulation in the EU (F-Gas Regulation) is gradually being withdrawn. Does not cool cells enough to stop propagation.
Recommended for: legacy installations where FM-200 is already installed
CO2 (carbon dioxide)
Principle: Displacement of oxygen of the volume by inert CO2 gas and cooling due to gas expansion.
+ Leaves no residue. Relatively inexpensive. Available
- Deadly dangerous for humans in concentration >5% Requires a sealed room. Does not stop NMC overclocking (cathode generates oxygen). A large volume of cylinders.
Recommended for: uninhabitable technical premises
Importantly
No fire extinguishing system is capable of stopping the thermal runaway that has already developed to stage 5 (250°C+) in the NMC cells. The task of fire extinguishing is to cool the adjacent modules below the propagation threshold (130°C) and give time for personnel evacuation. That is why the best approach is a combination: early detection (Off-gas Detection) + gas extinguishing (Novec/FM-200 for flame suppression) + Water Mist (for cooling and prevention of propagation).
BMS as the first line of defense
Battery Management System (BMS) is the brain of the battery storage. In a safety context, BMS acts as the first line of defense: it can prevent thermal runaway as early as Stage 1, long before a fire suppression system is needed.
Key functions of BMS from a safety point of view
- Monitoring the voltage of each cell. BMS measures the voltage of each individual cell (cell-level monitoring) with an accuracy of 1-2 mV. Exceeding the upper threshold (for example, 3.65V for LFP or 4.2V for NMC) immediately stops charging. Falling below the minimum (2.5V for LFP) stops the discharge.
- Temperature monitoring. NTC thermistor sensors are located on each module (in premium systems - on each cell). The BMS monitors the absolute temperature and its rate of change (dT/dt). A sharp increase in temperature even by 2-3°C per second under normal conditions is an alarm signal.
- Cell balancing. Unevenness of cell charge is one of the main causes of premature degradation and potential overcharging of individual elements. The BMS performs passive (resistive excess dissipation) or active (charge redistribution) balancing, keeping the voltage difference between cells below 20-50 mV.
- Current overload protection. The BMS monitors the charging and discharging current, immediately disconnecting the contactor when the rating is exceeded. For industrial systems, a typical threshold is 1.2-1.5C for direct current and 2C for peaks lasting up to 30 seconds.
- SOC (State of Charge) management. The BMS limits the operating range of the SOC, preventing deep discharge and full charge. Typical range for maximum safety and durability: 10-90% SOC. Some systems use adaptive limits that narrow as the temperature increases.
- Isolation monitoring. Continuous measurement of the insulation resistance between the high-voltage bus and the chassis. A drop below the threshold (typically 100 ohms/V) indicates insulation damage -- a potential source of arcing and fire.
- Communication protocols. BMS exchanges data of EMS (Energy Management System) and SCADA via CAN bus, Modbus RTU/TCP or Ethernet. This allows the operator to remotely monitor the status of each cell and receive alarms in real time.
BMS Protection Hierarchy
Industrial BMS (e.g. CATL, BYD, Pylontech) implement a three-level architecture: BMU (Battery Module Unit) at the module level, BCU (Battery Cluster Unit) at the string level, and BAMS (Battery Array Management System) at the level of the entire installation. Each level has its own protection logic and can autonomously disconnect the contactors even in case of loss of communication with the upper level.
Architectural requirements for BESS deployment
Proper design of BESS placement is no less important safety factor than equipment quality. Even the best battery or the most reliable BMS can become a threat if infrastructure requirements are violated.
Ventilation and HVAC
The BESS room ventilation system performs two tasks. The first is maintaining the optimal temperature (15-25°C) for maximum battery life. Every 10°C increase shortens the service life of Li-ion cells by 30-50%. The second, critically important from the point of view of safety -- the evacuation of combustible gases in the event of an accident. Ventilation must provide a minimum of 6 air changes per hour (ACH) in normal mode and switch to emergency mode (up to 20 ACH) when gas sensors are triggered.
Emergency ventilation should work on the hood (negative pressure) so that gas flows do not spread to neighboring rooms. Ventilation ducts must have fire-resistant valves with an operating temperature of 72-74°C. Air intake - from the bottom of the room (combustible gases from batteries, such as CO and H2, are lighter than air and rise upwards), exhaust - from the top, taking into account a safe distance from entrances and windows.
Distances and zoning
- Between racks: minimum 0.9-1.0 m to ensure access of service personnel and air circulation. Some manufacturers require 1.2 m for container solutions.
- To the external walls of the building: depends on the size of the installation. For systems up to 600 kWh - at least 3 m. For systems of 600 kWh - 10 MWh - at least 6 m (NFPA 855).
- Between containers: minimum 1.8 m when using fire-resistant barriers (2-year fire rated walls) or 3 m without barriers.
- Security zone (exclusion zone): the perimeter around the BESS, where the storage of combustible materials, parking of vehicles and the presence of outsiders are prohibited.
Fire-resistant constructions
The walls of the BESS room must have a fire resistance of at least 2 hours (REI 120). For container solutions, the fire resistance of the case is from 1 hour. Doors are fireproof, with a self-opening mechanism, fire resistance of at least 1 hour. Cable penetrations are sealed with fire-resistant material.
Emergency shutdown
The emergency power off button (Emergency Power Off, EPO) must be placed outside the BESS premises, at a distance of 1.5-3 m from the entrance, clearly marked and accessible to fire brigades. The EPO must disconnect all battery string contactors, the inverter and the charging system. At the same time, it should not turn off the emergency ventilation, lighting and fire extinguishing system - they work from a separate source (usually a UPS or a separate battery group).
Incidents and lessons
The history of the BESS industry includes a number of serious incidents, each of which became a catalyst for changes in design standards and practices. Let's consider the most important ones.
McMicken, Arizona, USA (April 2019)
Arizona Public Service (APS) facility: 2 MW / 2 MW*h BESS (Samsung SDI, NMC chemistry) in container design. Thermal overclocking started in one module. Combustible gases (H2, CO, ethylene) accumulated inside the sealed container. When the fire brigade opened the door for inspection, there was an explosion. Four firefighters were seriously injured, one of them was thrown 23 meters.
Conclusions: Absence of forced ventilation system for evacuation of gases. The fire brigade did not have a protocol of work of BESS-incidents. After McMicken, APS reviewed all of its BESS installations, and NFPA 855 was significantly amended with requirements for ventilation and fire crew training.
Surprise, Arizona, USA (October 2020)
Another APS system: 2 MW / 2 MW*h, already equipped with an improved ventilation system and gas sensors after McMicken. Thermal acceleration happened again, but this time the Off-gas Detection system detected the gas leak at an early stage. The fire brigade was called in time, and the evacuation was carried out safely. The container burned, but there were no casualties or injuries.
Conclusion: Early detection (Off-gas Detection) + proper evacuation = lives saved. Equipment can be replaced, people cannot.
Liverpool, UK (September 2020)
The Carnegie Road BESS container system (20 MW) is one of the largest in Great Britain at that time. The fire lasted for several days. Fire crews used a "controlled burn" tactic -- they did not attempt to extinguish, but only cooled nearby containers and controlled the spread. Reason: defect of the module from the manufacturer.
Conclusion: Even systems from large integrators are not immune to manufacturing defects. Mandatory incoming inspection and Factory Acceptance Test (FAT) before shipment.
South Korea: 23 incidents (2017-2019)
A series of fires at BESS facilities in South Korea became the industry's biggest crisis. The investigation of the government commission revealed a complex of reasons: insufficient protection against condensation in the containers (voltage creepage during humidity), BMS defects (in particular, ignoring voltage anomalies after several false starts), violation of the rules for installing cables and connections. Consequence: moratorium on new BESS projects in the country for 6 months, development of new KS C 8577 standards and mandatory audit of all existing installations.
The main lesson
In all the listed incidents, no system had a complete set of protective measures: adequate ventilation + Off-gas Detection + automatic fire extinguishing + trained personnel + protocols for emergency services. Every incident is a failure in one or more lines of defense. BESS security is system engineering, not a separate option in the price.
Active protection of BESS Ukraine
We do not rely on chance. Our industrial solutions (Industrial Cabinet and Container) are equipped with a multi-level protection system:
- Level 1: BMS (Battery Management System). Monitoring the voltage and temperature of each cell 24/7. In case of deviation, the string is immediately disconnected through the contactors. Communication of EMS via CAN bus and Modbus TCP.
- Level 2: Off-gas Detection. Before ignition, the electrolyte emits specific gases (CO, H2, VOC). Our sensors detect them 10-15 minutes before the appearance of flames, initiating emergency ventilation and alerts.
- Level 3: Active fire suppression. Built-in aerosol or Novec 1230 extinguishing system for cabinet solutions. Water Mist for container systems from 500 kWh. Automatic activation by BMS and/or gas sensor signal.
- Level 4: Architectural protection. Location design according to NFPA 855: distances, fire barriers, emergency ventilation, EPO, marking for fire brigades.
- Level 5: Documentation and training. Instructions for fire brigades, evacuation plan, SDS (Safety Data Sheets) for each type of cell, contact of the manufacturer 24/7.
Garage assembly vs Industrial solution
Using "gray" batteries (for example, from dismantled electric cars or server UPS) is a game of roulette. They have no single BMS of cell-level monitoring, no thermal protection protocols, no UL 9540A certification, unknown history of cycles and possible deep discharges. Each cell can have a different state of health (SOH), which creates an imbalance and the risk of overcharging the weakest elements.
Insurance companies in the EU and the USA already refuse to insure objects of uncertified storage systems. In Ukraine, this trend is also gaining momentum. Moreover, when using non-certified equipment, any fire automatically becomes grounds for denial of insurance compensation even under an existing policy.
Safety checklist for BESS customer
Before signing the contract for the supply and installation of BESS, check each item on this list. This is not an exhaustive list, but it covers critical aspects of security.
1. Availability of UL 9540A report for all 4 levels
2. IEC 62619 battery pack certificate
3. BMS of cell-level temperature and voltage monitoring
4. Off-gas Detection system (gas sensors)
5. Automatic fire extinguishing system
6. Emergency mode ventilation system
7. Emergency shutdown button (EPO)
8. Placement project according to NFPA 855
9. Documentation for fire brigades
10. Warranty obligations and insurance
Conclusions of BESS Ukraine
Security is part of the investment model, not a separate cost item. One incident can cost more than the entire system: loss of equipment, downtime, environmental damage, legal liability, reputational damage. Choose equipment that has been fire tested in a UL lab so you don't have to test it in your facility.
The main theses of this article:
- Thermal Runaway -- is a cascading process of clearly defined stages. At each stage there is a window for intervention, but only if the appropriate protection systems are in place.
- UL 9540A of four-level testing -- the gold standard of BESS security. Without it, it is impossible to assess the real fire safety of the system.
- BMS -- the first line of defense, but not the last. Echelon defense is required: BMS + Off-gas Detection + fire suppression + architectural protection.
- LFP-chemistry significantly safer than NMC for stationary applications. Propagation in LFP systems is an extremely rare phenomenon.
- Uncertified equipment -- this is not savings, this is an uninsured risk of complete destruction of the object.
Insurance requirements?
We provide a full package of certificates (UL, IEC, CE) for object insurance.