Grid-connected battery storage has grown from demonstration projects into ordinary electrical infrastructure. The usual unit is a steel container or a purpose-built room holding racks of modules, each module holding tens or hundreds of lithium-ion cells, together with power conversion, cooling and a battery management system. The energy density that makes the technology attractive is also the source of its fire problem. A lithium-ion cell contains a fuel in the form of its organic carbonate electrolyte, an oxidiser in the form of its charged cathode, and stored electrical energy that can be released as heat through a short circuit (Doughty and Roth, 2012).

When a cell is abused thermally, electrically or mechanically, or when a manufacturing defect matures into an internal short, its temperature can rise to the point at which exothermic decomposition reactions sustain themselves. This is thermal runaway. In a consumer device the consequence is limited by the small number of cells. In a storage enclosure the failing cell sits among thousands of others, and the central safety question is whether its failure propagates (Wang et al., 2012; Feng et al., 2018).

This article reviews what the published literature says about propagation inside storage enclosures and about the means of limiting it. It is written for fire protection and structural engineers who must assess such installations and who need the electrochemical background in a compact form, together with the parts of the evidence that bear directly on design.

The article is a narrative review of the published literature. It draws on peer-reviewed studies of cell-level thermal runaway, on experimental and modelling work on multi-cell propagation, on published investigations and hazard assessments of stationary storage, and on the standards that now govern testing and installation. No systematic search protocol was applied and no claim of completeness is made. Sources were chosen because they are widely cited or because they address the enclosure scale directly. Much of the underlying experimental work was done for electric vehicle packs, and its transfer to stationary systems is discussed where it matters.

The reaction sequence inside an overheating cell is well established. As the temperature rises, the passivating layer on the graphite anode, the solid electrolyte interphase, begins to decompose, and the lithiated anode then reacts with the electrolyte. At higher temperatures the polyolefin separator melts, and its collapse allows widespread internal short-circuiting. The charged cathode decomposes and releases oxygen, which reacts with the electrolyte and, as later work showed, with the anode itself (Bandhauer et al., 2011; Feng et al., 2018).

Feng et al. (2018) describe the process as a chain of reactions in which each stage supplies the heat that triggers the next, and they characterise a cell by the temperature at which self-heating becomes detectable, the temperature at which runaway is triggered, and the maximum temperature reached. An internal short circuit is the common trigger but not a necessary one. Liu et al. (2018) showed that oxygen released from a nickel-rich cathode can cross to the anode and drive runaway without a massive short, a finding with direct consequences for separators designed only to resist shorting.

Lumped kinetic models translate this chemistry into engineering terms. Hatchard et al. (2001) combined Arrhenius expressions for the main decomposition reactions with a heat balance to predict the behaviour of cylindrical and prismatic cells in oven tests. Spotnitz and Franklin (2003) extended the reaction set and examined several abuse conditions, and Kim et al. (2007) carried the approach into three dimensions so that local hot spots could be represented. These models remain the basis of most propagation simulations.

Runaway is accompanied by venting. Gas generated by decomposition raises the internal pressure until a vent or the casing opens, and electrolyte vapour, decomposition gases and particles are expelled. Golubkov et al. (2014) measured the gas released from cells with different cathodes and found mixtures dominated by hydrogen, carbon monoxide, carbon dioxide and light hydrocarbons, with the quantity and the peak temperature depending strongly on chemistry. Cells with a lithium iron phosphate cathode reacted least violently in that work. The fluorinated salt in the electrolyte adds hydrogen fluoride and related compounds to the effluent (Larsson et al., 2017).

A cell in runaway can heat its neighbours by three routes. The first is conduction through the surfaces in contact and through any structure that joins the cells. The second is electrical: cells connected in parallel can discharge into a shorted neighbour, and the tabs and busbars that carry that current also carry heat. The third is the hot gas, flame and ejected particles leaving the vent, which transfer heat by convection and radiation and may land on cells some distance from the origin (Wang et al., 2019).

Experiments on small modules have separated these routes. In a nail-penetration study of a module of large prismatic cells, Feng et al. (2015) found that heat conducted through the cell casing to the adjacent cell accounted for most of the heat that triggered the next failure, with the busbar and the fire playing lesser parts. Lamb et al. (2015) showed that electrical configuration matters: in their small packs of cylindrical cells, parallel connection favoured propagation where series connection did not, and pouch cells stacked face to face propagated readily. Lopez et al. (2015) varied the spacing and tab arrangement in modules and reported that modest gaps between cells, and tab designs that limit the electrical and thermal path, reduced the likelihood that failure spread.

The factors that govern propagation are therefore reasonably clear, and Table 1 summarises them. Cathode chemistry and state of charge set how much heat a failing cell releases and how hot it becomes. Cell format sets the contact area and the direction of venting. Spacing, interstitial materials and the electrical layout set how much of that heat reaches the neighbour and how quickly. What is less clear is how these effects combine in a rack of full-size modules, where the hot gas from a lower module passes over those above it.

An enclosure changes the hazard in a way that cell and module tests do not reveal. In the open, vent gas disperses or burns as it is released. Inside a container the gas is confined. If it ignites promptly the result is a fire, and the ventilation of the enclosure limits its size. If it does not ignite, a flammable mixture accumulates, and any later ignition, or the admission of air when a door is opened, can produce a deflagration.

This is not a theoretical concern. The investigation of the 2019 explosion at a storage facility in Surprise, Arizona, describes a propagating failure within one rack, the discharge of a clean-agent suppression system that did not stop it, the build-up of flammable gas in the closed container over several hours, and an explosion shortly after the door was opened by the fire service, in which four firefighters were injured (McKinnon et al., 2020). Zalosh et al. (2021) reviewed this and other explosion incidents and drew attention to the quantity of gas that even a partial module failure can release relative to the volume of a container.

The explosion properties of the gas depend on its composition. Baird et al. (2020) calculated flammability limits, laminar flame speeds and maximum overpressures for vent gas mixtures reported for different cell chemistries and states of charge, and showed that the hazard varies widely between them. One implication deserves emphasis. A chemistry that releases less heat and is less likely to ignite its own vent gas is not for that reason free of explosion risk, because gas that does not burn at the source remains available to accumulate. An earlier hazard assessment of storage batteries had already identified vent gas as a principal concern (Blum and Long, 2016).

Protection against propagation is organised in layers, from the cell outward, as Figure 1 shows. No single layer is relied on, since each can be defeated: a thermal barrier by a failure more energetic than the one it was sized for, a suppression system by reignition, a detection system by a fault in the management electronics that should have acted on it.

At the cell and module level the aim is to stop the first failure from becoming a second. Passive measures include air gaps, insulating or intumescent sheets between cells, and heat-absorbing materials. Wilke et al. (2017) reported that a phase change composite surrounding cylindrical cells prevented propagation after a penetration-induced failure in a pack that propagated fully without it. Fusing of individual cells and thermally resistive tab designs address the electrical route. Vent paths can be directed away from neighbouring cells so that ejecta do not impinge on them.

At the rack and enclosure level the aims widen to include control of gas. Detection of the early off-gas that precedes runaway, or of hydrogen and carbon monoxide after venting, can trigger electrical isolation and ventilation. Explosion control follows the two established routes: prevention, by keeping the gas concentration below the flammable range through mechanical exhaust, as set out in NFPA 69 (NFPA, 2019), or protection, by deflagration vent panels sized according to NFPA 68 (NFPA, 2018). Sizing either requires a credible estimate of the gas release rate and composition, which is the weakest part of the present data.

Suppression has a limited role, and the literature is consistent on the reason. Gaseous and aerosol agents can extinguish flame but remove little heat, so the reactions inside the cells continue and the fire may reignite once the agent concentration decays. Water cools effectively and remains the agent of choice for limiting spread between racks, although it must reach the cells to stop propagation within a module, and module casings often prevent that (Ghiji et al., 2020; Wang et al., 2019). Full-scale fire tests of a commercial storage unit reported by Blum and Long (2016) illustrate how a well-compartmented product can confine a deliberately initiated internal failure.

Abuse test standards developed for vehicle batteries cover overcharge, short circuit, crush, penetration and external heating, and Ruiz et al. (2018) have compared them in detail. For stationary storage the reference method is UL 9540A, which evaluates propagation at four successive levels: the cell, the module, the unit and the installation (UL, 2019). At cell level it records the temperature at which venting and runaway occur and the composition and flammability of the gas. At the higher levels it records whether failure spreads, the heat release, the gas produced and the exposure of adjacent units and walls.

NFPA 855 uses these results. It limits the energy of individual units and requires separation between them and from walls unless large-scale fire testing shows that a failure will not spread, and it requires explosion control for enclosures in which flammable gas can accumulate (NFPA, 2023). The arrangement is sensible, but it places heavy weight on a test in which a small number of cells are forced into runaway by heating. Whether that initiation represents the range of credible field failures, including those that involve several cells at once or an external fire, is a matter the test report cannot settle by itself.

Three gaps stand out. The first is scale. Most published propagation experiments involve a handful of cells or a single module, and the mechanisms that dominate at that scale, chiefly conduction between adjacent cells, are not necessarily those that dominate in a rack, where flame and hot gas from below preheat whole modules. Validated models that link cell kinetics to enclosure-scale flow and combustion are still scarce, and the kinetic parameters they need are available for few commercial cells.

The second gap concerns gas. Published compositions come largely from new cells of small format tested singly. Data for large cells, for aged cells and for partial failures are thinner, yet these are the inputs to vent sizing and exhaust design. The third concerns suppression and response. Systems that deliver cooling to the interior of a module, and tactics that allow responders to establish the state of the atmosphere inside a container before opening it, are both areas in which practice has moved ahead of the published evidence.

The chemistry of thermal runaway in a single lithium-ion cell is well understood, and the routes by which it spreads to neighbouring cells have been separated and measured in module-scale experiments. Cathode chemistry, state of charge, cell format, electrical layout and spacing all affect the outcome, and passive barriers between cells can stop propagation in the cases tested. The enclosure adds a distinct hazard, the accumulation and delayed ignition of vent gas, which has caused serious injury and which is not removed by choosing a less reactive chemistry or by extinguishing flame. Current standards respond with tiered propagation testing, separation and explosion control. Their weak point is the data on which gas release and enclosure-scale spread are estimated, and that is where further experimental work would be of most use to designers.

To be declared by the author(s) before publication.

To be declared by the author(s) before publication.