The Three Pillars of Battery Safety

Why Certification Alone Won’t Save Us

Introduction

Lithium-ion batteries power modern life, from the phone in your pocket to the electric vehicle in your driveway to the grid-scale energy storage facility humming at the edge of town. With this ubiquity comes an uncomfortable truth: these systems store enormous energy in compact volumes, and when they fail, the consequences range from property damage to potential loss of life. U.S. lithium-ion battery fire incident rates rose 86% between 2020 and 2023 [1], and the National Fire Protection Association acknowledges it cannot yet even track the full scope of the problem [2]. The industry’s response has traditionally centered on compliance certification, passing UL, IEC, and UN standards as proof of safety. But the evidence from a decade of catastrophic failures tells a different story. Real battery safety emerges from the interplay of three distinct but interdependent pillars:

1. compliance certification (a necessary but insufficient baseline)
2. design for safety (an engineering philosophy that must pervade every decision from the earliest stages)
3. the battery control system (the always-on guardian that keeps users safe minute by minute)

When any single pillar is weak, people can get hurt—regardless of how strong the other two may be.

Pillar One: Compliance Certifications Are Not Enough

Battery safety certifications: UL 1642/2054, IEC 62133, UN 38.3, UL 2271/2580 IEC 62368 establish baseline requirements for battery performance under controlled conditions. As one battery testing laboratory summarized: “Standards such as UL 2054, IEC 62133, and UN 38.3 set important baseline requirements for battery safety. They are a necessary starting point. They are not a complete picture of how a battery will behave after two years of daily charging, repeated drops, connector wear, and exposure to temperature variation” [3].

The most critical gap is temporal: certifications test snapshots, not lifetimes. They evaluate batteries at the time of manufacture and do not test how batteries degrade over months or years of real-world use predominantly driven by customer behavior. Element confirms that “most compliance tests evaluate a battery under controlled, defined conditions over a relatively short duration” and that “the gap between passing certification and performing reliably in the field is where most recalls originate” [3].

The Samsung Galaxy Note 7 passed every required certification before launch and yet Samsung was forced to issue two separate recalls. The root cause was a design flaw: “there wasn’t enough room between the heat-sealed protective pouch around the battery and its internals. In the worst scenarios, that caused electrodes inside each battery to crimp, weaken the separator between the electrodes, and cause short circuiting” [4]. The Anker PowerCore 10000, a product from a reputable brand, was recalled in 2025 covering more than 1.16 million units after six years on the market, demonstrating that failure was “not detected at certification” but “emerged gradually, through real-world use conditions that compliance testing had not fully replicated” [3]. New York City has become ground zero for demonstrating certification’s limitations at scale. Since 2022, lithium-ion batteries—many uncertified—have caused 900 fires, killing 30 people and injuring 400 more [5]. Even after NYC’s Local Law 39 mandated UL certification for e-mobility devices, FDNY data shows fire counts remained stubbornly high: 268 fires in 2023 and 277 in 2024 [6].

Analysis of fire statistics reveals that many failures stem from conditions no certification tests for. In the U.S., 42% of lithium-ion battery fires in 2022 were linked to improper charging [7], manufacturing defects drove 28% of fires, and overcharging was behind 35% of initiations [8].

OK these don’t add up to 100% as this is a mix from across different sources, hopefully, soon we can find a single source that builds a total picture.

The CPSC has explicitly acknowledged that voluntary standards are insufficient, with Acting Chairman Peter A. Feldman citing “numerous catastrophic incidents involving lithium-ion batteries, including fatalities, life-threatening injuries, and devastating residential fires” and “persistent quality and compliance issues involving imported lithium-ion batteries” [9].

Pillar Two: Design for Safety Must Begin at the Beginning

Safety in lithium-ion battery systems is not a feature to be added at the end of a design cycle—it is a philosophy that must pervade every decision from material selection to pack architecture. As one automotive battery engineering review states, “the objective of system safety engineering is to develop a system with no unreasonable risk” and “appropriate risk reduction measures have to be considered in an early phase of development” [10].

Material Selection as Safety Architecture

The choice of cathode material is the single most consequential safety decision in battery design. It determines the fundamental thermodynamic stability of the system. LFP chemistry triggers thermal runaway at 270–300°C while NMC reaches it at just 150–210°C [11]. That ~150°C margin is not marginal—it fundamentally changes the safety architecture required at every subsequent design level.

Cell-Level Safety Mechanisms

Modern cells incorporate a graduated hierarchy of passive safety mechanisms:

Battery University describes this hierarchy: “Built-in PTC protects against current surges. CID opens the circuit at a cell pressure of 1,000kPa (145psi). Safety vent releases gases on excessive pressure buildup at 3,000kPa (450psi)” [12].

Pack-Level Propagation Prevention

At the pack level, the primary safety objective shifts from preventing individual cell failure to containing it. When a single cell undergoes thermal runaway, “the intense heat and exothermic reactions can rapidly propagate to neighboring cells, leading to thermal runaway propagation (TRP) at the module or pack level” [13].

NASA’s Johnson Space Center has pioneered propagation-resistant battery designs for human-rated space flight, “successfully demonstrated Thermal Runaway (TR) risk reduction in a lithium ion battery for human space flight by developing and implementing verifiable design features which interrupt energy transfer between adjacent electrochemical cells” [14]. Their Carbon Fiber Reinforced Polymer (CFRP) sleeve exploits a remarkable physical property: “Carbon fiber material has a negative coefficient of expansion and accordingly shrinks when heated, while steel and aluminum expand. The shrinking of the CFRP sleeve when heated compresses the cell located within it, significantly aiding in the prevention of SWR [sidewall rupture]” [15].

The design philosophy is instructive: rather than solely trying to prevent thermal runaway—which cannot be guaranteed—the design assumes a cell will fail and engineers the surrounding structure to contain the consequences. NASA’s approach evolved from relying solely on cell screening to combining screening with propagation-resistant design, thereby “reduces both the probability, and the severity, of a single cell failure” [14].

It is during the design for safety process that design analysis tools such as DFMEA can be used to identify many of the electrical, mechanical, thermal, and software systems needed to ensure reliability and performance throughout the life of the product.

Pillar Three: The Battery Control System Is the Daily Safety Guardian

The battery management system (BMS) occupies a unique position in the safety architecture. Unlike passive design elements that operate on physics alone, the BMS provides continuous, active vigilance—monitoring voltage, current, temperature, state of charge, and state of health in real time, making thousands of safety decisions per minute. It has been described as a “24-hour on duty ‘battery doctor'” 16.

Every battery pack, “from a 5 kWh residential Powerwall to a 4 MWh utility container relies on BMS hardware and firmware running 24/7 to balance cells, prevent thermal runaway, calculate state of charge, and protect the asset” [17]. The BMS “sits between the cells and the outside world, monitoring everything that happens inside the pack and making real-time decisions about protection and communication” [18].

Active Protection Mechanisms

When monitoring detects anomalous conditions, the BMS intervenes within milliseconds. Overcurrent protection “detects when current exceeds safe limits and quickly interrupts or limits the flow to protect the battery and connected systems” [19]. The thermal management layer “works in concert with temperature sensors attached to the battery cells. If temperatures rise beyond a safe operating range, even before a formal overload is declared, the BMS can preemptively reduce the allowed current or disconnect the battery entirely” [20].

Cell Balancing: The Long-Term Safety Function

Cell balancing represents the BMS’s most important long-term safety function. Over time, individual cells inevitably develop differences: “A weak battery cell will charge and discharge faster than stronger or higher capacity cells and thus it becomes the limiting factor in the run-time of a system” [21]. Without balancing, “an improper balancing scheme will result in reduced usable capacity and shortened battery service life in mild cases. In severe scenarios, it may trigger persistent thermal accumulation, progressive cell consistency degradation, accelerated cycle attenuation, and even potential safety hazards” [22].

Functional Safety Standards

Battery management systems in safety-critical applications must meet rigorous functional safety standards. ISO 26262 for automotive applications is “a specialized adaptation of the broader IEC 61508 standard, customized for automotive applications to address the complexities of modern vehicle electronics” [23]. A BMS in an electric vehicle battery pack typically requires ASIL C or D certification—the highest safety integrity levels—because BMS failure can directly lead to thermal runaway, fire, and loss of life.

The Next Frontier: Predictive Intelligence

The next generation of BMS moves beyond reactive protection toward predictive intelligence. AI-driven BMS technology in 2026 encompasses “machine learning estimates SOC and SOH, predicts degradation and remaining useful life, gives early thermal-runaway warning, runs cell digital twins, and pipes data from Modbus to the EMS” [24]. Cloud-connected analytics “allows adverse trends in the operational performance of the BESS to be identified at a very early stage” [25]—transforming the BMS from a reactive guardian into a proactive one.

Custom Algorithms – Use Case Dependence

The battery control system is the primary place to install custom algorithms that enhance the control system during expected or unexpected use cases. A great example of this is Apple’s optimized charging algorithm, which is designed to reduce the chemical ageing of the battery. This algorithm is designed to reduce the predictable user behavior of leaving one’s phone or watch over night. That constant approximate 8 hours of stress every night can have major impacts on long term performance and safety. Custom algorithms can be made to be as intrusive or non-intrusive as needed.

They key point here is, is that more advanced and custom algorithms are needed in battery control systems to better prevent and control user or use case induced behavior.

The Interplay: Three Pillars, One System

These three pillars do not operate in isolation—they form a defense-in-depth architecture where each compensates for the limitations of the others. Understanding their interplay is essential to understanding why all three are necessary.

How Each Layer Compensates for the Others

Case Studies in Layer Failure

Boeing 787 Dreamliner (2013): The NTSB determined that “shortcomings in design and certification ultimately led to the fire in a lithium-ion battery” [26]. Boeing “had considered, but ruled out, cell-to-cell propagation of thermal runaway” without adequate justification, meaning “the potential for cell-to-cell propagation of thermal runaway was not thoroughly scrutinized by Boeing and FAA engineers, ultimately allowing this safety hazard to go undetected by the certification process” [26]. All three layers failed simultaneously: certification missed propagation, the design lacked adequate barriers, and the BMS could not prevent internal shorts from manufacturing defects.

Hoverboard Fire Epidemic (2015–2017): Early hoverboards “lacked a proper Battery Management System (BMS)… Without it, a single weak cell could be driven beyond its limits, leading to a chain reaction known as thermal runaway” [27]. Cell-level certification existed, but without system-level design or active management, the result was hundreds of fires and fatalities—including two young girls killed in a Pennsylvania fire [28].

Korean ESS Fires (2017–2019): The batteries themselves were not defective. The Korean government’s investigation “highlighted four factors: a lack of battery protective systems for electrical shocks; insufficient management of the operation environment; inattention to installation; and a lack of ESS integrated control and protection systems” [29]. This demonstrates that even certified, well-made batteries can fail catastrophically when system-level design and management are inadequate.

The 89% Problem

EPRI’s analysis of documented BESS failures reveals a striking finding: “only 11 percent of failures trace to cell defects. The rest involve balance-of-system components, cooling infrastructure, environmental conditions, and integration quality” [30]. This means that even perfect cells and perfect cell-level certification would address barely one-tenth of actual failure pathways. The remaining 89% require design engineering and system-level management that no cell certification can provide.

Conclusion: A Call for Defense-in-Depth

The evidence is unambiguous. No single safety layer—no matter how rigorous—is sufficient to guarantee the safe operation of lithium-ion battery systems. Certification provides a necessary floor but leaves vast gaps in long-term degradation, real-world abuse, and system-level propagation. Design for safety creates inherent stability and containment, but passive mechanisms have limits and manufacturing perfection is unattainable. The battery control system provides continuous active protection, but it cannot compensate for fundamental design flaws or detect every failure mode instantaneously.

The path forward demands that manufacturers, regulators, and consumers recognize a simple truth: battery safety is not a checkbox—it is a system property that emerges from the integration of complementary layers. Industry must invest in all three pillars simultaneously, with particular emphasis on:

1. Moving beyond certification as a proxy for safety. Compliance is a starting point, not a destination. Long-term reliability testing, manufacturing process controls, and post-market surveillance must supplement snapshot certification.
2. Embedding safety into design from day one. Chemistry selection, thermal architecture, propagation barriers, and structural containment cannot be retrofitted effectively. The Boeing 787 and Samsung Galaxy Note 7 teach us that design shortcuts create liabilities that no amount of testing or monitoring can fully overcome.
3. Treating the battery control system as mission-critical infrastructure. The BMS is not an accessory—it is the most important minute-by-minute safety mechanism in the battery ecosystem. It deserves the same engineering rigor, functional safety certification, and continuous improvement investment that we apply to aircraft flight control systems or nuclear reactor instrumentation.

When all three pillars are strong and well-integrated, lithium-ion batteries can safely power the electrified future we are building. When any one fails, the consequences—measured in fires, injuries, and lives lost—are the price of complacency.

References

1. Bucala, M., Nguyen, D., Knight, H. et al. Device-Specific Fire Risk Analysis of Lithium-Ion Battery Incidents: Engineering Implications for Detection and Protection Systems. Fire Technol 62, 45 (2026)
2. Fire Prevention Week 2026 Focuses on Lithium-Ion Battery Charging Safety, PHCP PROS
3. Lithium-Ion Battery Recalls: Causes and Prevention, Element
4. Why the Samsung Galaxy Note 7 Kept Exploding, Wired
5. NYC DOT Takes First Steps to Install Public E-Bike Battery-Swapping Network Citywide, NYC Department of Transportation
6. E-Bike Lithium Battery Fire Injury Claims in New York, JTNY Law
7. Lithium Battery Fire Statistics: ZipDo Education Reports 2025, ZipDo
8. Lithium-Ion Battery Fire Statistics, Gitnux
9. Statement of Acting Chairman Peter A. Feldman on CPSC’s Proposed Lithium-ion Battery Safety Standard for Micromobility Products, U.S. Consumer Product Safety Commission
10. Introduction. In Automotive Battery Technology. Springer (2014)
11. NMC Battery vs LFP Safety: The Complete BESS Risk Breakdown, SunLith Energy
12. BU-304b: Making Lithium-ion Safe, Battery University
13. A review on mitigating thermal runaway propagation in battery packs: from mechanisms to modeling and design optimization. Energy Advances (2026)
14. Darcy, E., Jeevarajan, J., Russell, S. Mitigating Thermal Runaway Risk in Lithium Ion Batteries. NASA Technical Reports Server (2014)
15. Carbon Fiber Sleeve Tempers Battery Thermal Runaway, NASA Technology Transfer Program
16. Battery Management System (BMS) Detailed Explanation: Working Principle, Core Functions, and Key Technologies, SYS Technology
17. Battery Management Systems (BMS): A Complete Guide, How to Store Electricity
18. Battery Monitoring & Management, SurgePV
19. What is Overcurrent Protection in BMS?, Leyaa.ai
20. Guardians of the Home: How BMS Technology Prevents Overload and Short Circuits in Energy Storage Systems, Daly BMS
21. Passive Battery Cell Balancing, Analog Devices
22. Smart Active Balance vs Passive Balance BMS: Differences & Selection Guide, eybms.com
23. Functional Safety, PEM Motion Battery Glossary
24. AI Battery Management System, How to Store Electricity
25. AI Driven Data Analytics – A Solution for Battery Energy Storage Fires?, Aviva Risk Management Solutions
26. Shortcomings in Design and Certification of Boeing 787 Li-ion Batteries, EE Power
27. Will My Hoverboard Explode? Understanding the Risks and Safety Measures, Gyroor
28. Following Fatal House Fire, CPSC Warns Consumers to Stop Using LayZ Board Hoverboards, U.S. Consumer Product Safety Commission
29. Panel blames electric shock, poor management system for ESS fires, not companies, The Korea Herald
30. Battery Storage Safety in 2026: Why Cell-Level Monitoring Is No Longer Enough, Prom Wad Electronics Design