TL;DR
- Myth: Battery energy storage safety is mainly an electrical-fault problem. Reality: the defining hazards are thermal runaway fire and the toxic, flammable gas that cells release when they fail.
- Myth: Water puts a battery fire out. Reality: water rarely stops thermal runaway and can carry contaminated runoff off-site — cooling and containment, not extinguishment, is the realistic goal.
- Myth: The fire is the main danger to people nearby. Reality: vented gas often is. Lithium-ion cells can release 20–200 mg of hydrogen fluoride per watt-hour of capacity in a fire (Larsson et al., Scientific Reports, 2017).
- Myth: Lithium iron phosphate (LFP) cells can’t burn. Reality: LFP resists runaway better than NMC but still vents flammable, toxic gas and has featured in large storage fires.
Battery energy storage safety centres on two linked hazards: thermal runaway fire and the toxic, flammable gas that lithium-ion cells release when they fail. Effective protection combines quality cells, cell-to-cell barriers, gas detection, ventilation, deflagration control, and an emergency plan built with the fire service — because suppression alone rarely stops a propagating event.
On 19 April 2019, a single defective cell inside the McMicken battery storage facility near Surprise, Arizona, began to overheat. Roughly three hours later, when firefighters opened the enclosure door, gas that had built up inside ignited in a deflagration that threw one responder around 75 feet and seriously injured four, two of them with traumatic brain injuries (DNV-led investigation; UL Firefighter Safety Research Institute, 2020). The fire suppression system had already discharged. It had not stopped the event.
That incident, and the larger fires that have followed it, reshaped how the industry thinks about battery energy storage safety. The hazard is not a conventional electrical fire that a crew can knock down with a hose. It is a self-sustaining chemical reaction inside sealed cells that produces heat, pressure, and a stream of toxic and flammable gas — and the controls that contain it look very different from anything in a standard fire plan. This article covers how those fires start, what comes out of a failing cell, the explosion mechanism behind several injuries, the standards that now govern installations, and the controls that genuinely reduce risk.
This article provides general HSE knowledge. Life-critical work — commissioning, maintaining, or responding to an incident at a battery energy storage system — must be planned and supervised by a competent person with relevant training, jurisdiction-specific authorisation, and a site-specific risk assessment. The information here does not replace that.
How one failing cell becomes a building fire
A battery energy storage system fails in a way ordinary fires do not: the fuel, the heat, and the oxidiser can all sit inside a sealed cell, so the reaction sustains itself even after external flames are knocked down. Understanding that mechanism is the difference between a control strategy that works and one that injures responders.
What thermal runaway actually is
Thermal runaway is a feedback loop. A cell heats up, that heat speeds the internal chemical reactions, those reactions release more heat, and the cycle accelerates until the cell vents and ignites. Once one cell goes, it heats its neighbours, and the failure cascades from cell to module to rack — what investigators call cascading thermal runaway.
The triggers fall into a few recognisable groups:
- Internal cell defect — manufacturing contamination or abnormal lithium plating creating an internal short, the suspected root cause at McMicken.
- Electrical abuse — overcharge, over-discharge, or external short circuit pushing a cell past its safe window.
- Thermal abuse — inadequate cooling or high ambient heat raising cells toward their failure point.
- Mechanical abuse — crushing, puncture, or impact damaging the cell internally.
Why the fire resists water
Water cools, but it does not reach the reaction driving runaway deep inside a sealed pack, and lithium-ion fires reignite from energy still trapped in the cells. Fire and rescue guidance increasingly accepts that there is no reliable way to extinguish a propagating storage fire with sprinklers; water-based systems are used to limit spread between modules and protect surrounding structures, not to put the fire out (National Fire Chiefs Council, UK). The practical implication is uncomfortable: the realistic objective on most large systems is to cool, contain, and let the affected units burn down in a controlled way.
What a burning lithium battery puts into the air
The chemical risk in battery storage is concentrated in what comes out of a failing cell, and it begins before there are any flames. When a lithium-ion cell overheats, the flammable electrolyte — typically built on lithium hexafluorophosphate (LiPF₆) — evaporates and vents, and the fluorine in that salt decomposes into hydrogen fluoride and related fluoride gases.
The quantities are not trivial. Quantitative fire testing across several commercial cell types measured hydrogen fluoride emissions of 20–200 mg per watt-hour of nominal capacity, alongside phosphoryl fluoride (POF₃) of 15–22 mg/Wh in some tests (Larsson et al., Scientific Reports, 2017). For a megawatt-hour-scale system, that scales into a serious airborne hazard.
| Substance | Where it comes from | Why it matters |
|---|---|---|
| Hydrogen fluoride (HF) | Decomposition of the fluorinated electrolyte salt | Corrosive; forms hydrofluoric acid in the lungs; severe effects can be delayed 8–24 hours |
| Carbon monoxide (CO) | Incomplete combustion | Asphyxiant; OSHA’s permissible limit is 50 ppm over 8 hours, and emissions testing has measured many times that (Texas A&M Engineering Extension Service) |
| Hydrogen cyanide (HCN) | Burning nitrogen-containing materials and electrolyte | Acutely toxic at low concentrations |
| Phosphoryl fluoride (POF₃) | Electrolyte breakdown | Toxic fluorinated gas measured in fire tests |
| Flammable VOCs | Vented electrolyte vapour — methane, ethylene, benzene | The fuel for the explosion hazard covered below |
| Metal particulates | Vaporised electrode materials | Respirable nickel, cobalt, manganese, lithium, and copper |
These emissions are why first responders treat any battery fire as a hazardous-materials scene and why downwind exposure — not just direct flame contact — is taken seriously. HF is the standout concern: its immediately-dangerous-to-life-or-health threshold is just 30 ppm (NIOSH), and the worst respiratory injury can appear hours after exposure, when someone believes they are unharmed.
This is HSE practitioner reference, not medical advice: anyone with suspected hydrogen fluoride exposure needs urgent assessment by a medical professional, precisely because the effects can be delayed. The detailed fluoride-emission data sits in the peer-reviewed Scientific Reports study for those building a site risk assessment.
What the incident record actually shows
Read enough storage incident reports and the same sequence repeats, which is what makes them so useful for prevention. Two cases anchor most of the lessons in current codes.
The McMicken explosion is the most thoroughly documented. The system held 10,584 nickel-manganese-cobalt (NMC) cells in a 2 MWh walk-in enclosure with a clean-agent suppression system (NFPA, 2020). The investigation traced a clear chain:
- An internal failure in one cell initiated thermal runaway.
- No thermal barriers between cells allowed the runaway to cascade through neighbouring modules.
- The clean-agent system discharged but could not halt the cascade.
- Flammable off-gas accumulated with no means to ventilate it safely.
- Responders opened the door about three hours in; within minutes, the gas-air mixture ignited (DNV-led investigation; UL Firefighter Safety Research Institute, 2020).
The more recent and far larger case is the Vistra Moss Landing fire in Monterey County, California. On 16 January 2025, the 300-MW Moss Landing battery system — holding roughly 100,000 lithium-ion batteries — caught fire, prompting evacuations; the EPA issued a federal response notice on 22 January and oversaw battery removal, with the facility reigniting on 18 February (US EPA, 2025). The cause remains under investigation, environmental testing has been contested between operator and community groups, and litigation is ongoing — but the operational facts are documented on the EPA’s response page.
Across the published record, a consistent set of contributing factors recurs:
- Cell quality — internal defects as the initiating event.
- No cascade barriers — propagation that suppression could not arrest.
- No safe ventilation — flammable gas allowed to build up.
- Response plans not matched to the hazard — crews arriving without battery-specific tactics.
The explosion most teams underestimate
The explosion usually arrives after the fire, not with it — and that timing is what catches experienced crews out. When cells vent, the flammable gas does not always ignite immediately. It can collect inside an enclosure, mix with air, and reach an explosive concentration that waits for an ignition source or, as at McMicken, for someone to open a door and introduce oxygen and turbulence.
This is a deflagration hazard, and it is addressed directly in fire-engineering practice:
- NFPA 68 (US) covers deflagration venting — engineered panels that relieve an explosion’s pressure along a safe path.
- NFPA 69 (US) covers explosion prevention, including managing the atmosphere so a flammable mixture never forms.
- Gas detection and forced ventilation keep concentrations below the lower flammable limit before they become dangerous.
The door-opening rule
The single most important behavioural lesson from the injury reports is procedural: do not open a sealed enclosure that has been venting. Investigators recommended that crews define a conservative blast radius and stay outside it, and that systems carry remote gas monitoring so conditions can be read from a safe distance (UL Firefighter Safety Research Institute, 2020). Two reports on the Arizona incident — one technical, one focused on responder injuries — are summarised by NFPA and remain core reading for anyone writing a BESS emergency response plan.
The rulebooks: NFPA 855, UL 9540A, and the UK approach
No single law governs battery energy storage safety, and the framework differs sharply by jurisdiction — which matters for any multi-site operator. In the United States the system is prescriptive and test-driven; in the United Kingdom it is risk-based and woven through existing health-and-safety law.
The US testing backbone is UL 9540A, a graduated test method that drives a cell into thermal runaway and then measures how far the fire propagates across four levels — cell, module, unit, and finally installation — so testing can stop at the level where propagation is contained. Its results feed directly into installation requirements such as separation distances and ventilation. NFPA 855 then sets installation rules; under its 2023 edition, lithium-ion systems above a 20 kWh aggregate threshold trigger the standard’s requirements, and units are separated by a minimum of 3 ft (914 mm) unless fire and explosion testing justifies less.
| Aspect | United States | United Kingdom |
|---|---|---|
| Lead installation standard | NFPA 855 | No single BESS statute; HSE framework + NFCC guidance |
| Fire test method | UL 9540A (referenced by code) | Referenced via standards and guidance, not mandated by one law |
| Core legal duty | Code compliance enforced by the AHJ | General duties under HSW Act; DSEAR for flammable/explosive atmospheres |
| Separation guidance | NFPA 855 spacing, refined by test data | NFCC guidance (increased to 30 m from occupied buildings in updated guidance) |
| Major-accident regime | Site-specific permitting | COMAH applicability debated; large sites not generally treated as COMAH establishments |
The UK position rests on the Health and Safety Executive, which collates the relevant legislation and notes, for example, that operators holding 25 tonnes or more of dangerous substances must notify their local fire and rescue service (HSE). Whether the largest installations should fall under the Control of Major Accident Hazards (COMAH) Regulations is genuinely contested, with stakeholders arguing the scale of toxic and flammable gas evolution warrants it (House of Commons Library, 2024).
Both frameworks are moving. The 2026 edition of NFPA 855 shifts toward a hazard mitigation analysis as a central requirement and places more weight on large-scale fire testing (UL Solutions, 2025), while the UK’s National Fire Chiefs Council issued updated grid-scale guidance and a policy position statement in October 2025. Where US and UK thresholds differ, the conservative course is to design to the stricter requirement and document the basis.
Regulatory content here reflects general HSE professional understanding of US and UK requirements as of 2026. It is not legal advice. Specific compliance questions, enforcement situations, or liability exposure should be directed to qualified legal counsel in the applicable jurisdiction. The regulatory position summarised in this section was last reviewed in June 2026.
Designing the risk down — and the limits of suppression
Designing out a battery fire starts with accepting one fact: once a pack is in full cascading runaway, you probably cannot put it out. That reframes the whole control strategy around preventing initiation and limiting spread, with suppression as one layer rather than the answer.
The layered approach that holds up against the incident record runs roughly in this order:
- Start with cell quality and the battery management system. Most documented events began with a defective cell, so cell selection and a BMS that catches over-voltage, over-temperature, and imbalance is the first and cheapest line of defence.
- Build in cell-to-cell and module-to-module barriers. Thermal barriers are what failed at McMicken; their job is to stop one cell’s failure from becoming the room’s failure.
- Detect the failure early. Off-gas and smoke detection inside the enclosure can flag a venting cell before flames appear, buying time that water never will.
- Plan ventilation and deflagration control together. Forced ventilation keeps gas below its flammable limit; deflagration venting gives any explosion a safe path out.
- Use suppression to slow spread, not to “win.” Clean-agent and water-based systems can limit propagation and protect surroundings, but industry experience is clear that neither reliably halts thermal runaway.
- Separate units and respect setback distances. Spacing between units and from occupied buildings limits how far a fire and its gas plume can reach — the rationale behind both NFPA 855 spacing and the NFCC’s increased separation guidance.
The honest summary on battery fire suppression is that it is a containment tool, not a kill switch. Treating a sprinkler or clean-agent system as the primary safeguard is precisely the assumption that has led crews into danger.
When it burns: emergency response and the responder problem
When a battery system fails, the people most at risk are the ones who arrive to help — and the injury reports show that gap is about information as much as equipment. A storage fire is a hazardous-materials event with an explosion risk and a long tail, and the response plan has to say so explicitly.
The essentials of a workable BESS emergency response plan:
- Build it with the local fire service, before commissioning. Crews need to know the chemistry, the layout, and the hazards in advance — not discover them at 5 a.m.
- Mandate full SCBA, including downwind. Hydrogen fluoride can be present below the level you can smell, and its respiratory effects can be delayed.
- Define a conservative blast radius and hold it. Until conditions are confirmed, do not open enclosures that have been venting.
- Provide remote gas monitoring. Responders should be able to read the atmosphere inside the enclosure from a safe distance.
- Plan for reignition. Storage fires can reignite hours or days later from stranded energy, which is why the Moss Landing site kept private firefighting and continuous air monitoring on station during battery removal (US EPA, 2025).
- Plan for contaminated runoff. Water used on the fire can carry toxic and metallic contaminants off-site, so containment is part of the response, not an afterthought.
Recognised training pathways — NEBOSH, IOSH, and OSHA outreach in their respective regions — increasingly address energy-storage hazards, and the McMicken reports specifically flagged that standard HAZMAT curricula did not yet cover basic storage hazards. Closing that knowledge gap is one of the cheapest safety gains available.
Frequently Asked Questions
Where battery storage safety is heading
The trajectory of battery energy storage safety is set by the failure record, and the standards are visibly catching up to it. The shift in NFPA 855’s 2026 edition toward hazard mitigation analysis and large-scale fire testing, the evolution of UL 9540A’s installation-level testing, and the UK’s tightening separation guidance all point the same direction: away from assuming a system is safe and toward proving how it behaves when a cell fails.
Two things will not change. The chemistry will keep producing heat, flammable gas, and toxic fluoride compounds whenever a cell loses control, and suppression will keep being a containment tool rather than a guaranteed fix. The systems that stay out of the incident reports are the ones designed around those facts — good cells, real barriers, early gas detection, engineered venting, sensible separation, and a response plan written with the fire service rather than for them.
The cost of getting it wrong is not abstract. Four firefighters carried lasting injuries out of a single enclosure in Arizona because the gas was allowed to build up and no one knew not to open the door. Treat the next battery storage installation as a chemical and explosion hazard first and an electrical asset second, and that lesson does not have to be relearned on site.