A cell in thermal runaway is not burning in the ordinary sense. It is running a sequence of exothermic reactions that supply their own heat, so removing external heat does not stop it. That distinction shapes every sensible engineering and emergency response decision about lithium-ion systems.
The mechanism is a positive feedback loop. Reaction rates rise with temperature. If the heat those reactions release exceeds the heat the cell can shed to its surroundings, temperature rises, rates rise further, and the loop closes. Once it closes, the cell will complete its reaction path.
The stages
The sequence below is a simplification of what Feng and colleagues set out, and the temperatures vary with chemistry, state of charge, cell design and how the test was run.
Self-heating begins. The passivation film on the anode starts to decompose exothermically, typically becoming measurable somewhere around 80 to 120 degrees Celsius. Heat output at this stage is small. A cell here may still be recoverable if it can be cooled, which is why early detection has value.
Separator failure. Polyolefin separators soften and then melt: polyethylene near 130 degrees Celsius, polypropylene near 165, with ceramic coatings buying some additional margin before collapse. As the separator loses integrity, direct contact between electrodes creates internal short circuits, which convert stored electrical energy into heat very quickly.
Electrolyte decomposition and gas generation. Carbonate solvents break down, generating a mixture that includes hydrogen, carbon monoxide, carbon dioxide, methane, ethylene and, from fluorinated salts, hydrogen fluoride. In comparative tests on commercial 18650 cells, Golubkov and colleagues measured hydrogen at roughly 30 per cent of the vent gas across chemistries, with layered oxide cells producing several times more total gas than LFP. Pressure rises and the cell vents. The vented mixture is flammable and toxic, and in a confined enclosure it can accumulate to an explosive concentration before any flame appears. The 2019 failure at the APS McMicken site in Surprise, Arizona ran exactly this course: an internal defect in one cell of the 2 MW, 2 MWh NMC system cascaded through a rack, vent gas accumulated in the enclosure for around three hours, and the mixture deflagrated when firefighters opened the door, hospitalising eight firefighters and a police officer. Note too that lower fire intensity does not mean lower toxicity: Larsson and colleagues measured more hydrogen fluoride per unit of energy from LFP cells than from some layered oxide cells in fire tests.
Cathode decomposition. Layered oxide cathodes release oxygen as they break down, which supplies an oxidiser inside a system already full of flammable material. For charged nickel-rich material the onset sits roughly between 150 and 300 degrees Celsius, and it falls as nickel content rises. This is the point at which the temperature curve turns near-vertical: peak cell temperatures for layered oxide cells commonly exceed 600 degrees Celsius and can approach 850, while LFP cells in the same test series peaked near 400. The phosphate group binds its oxygen strongly and releases very little of it, which is the single largest reason for LFP's safety reputation.
Propagation. The failing cell now radiates and conducts heat into its neighbours, along with hot ejected material. If the neighbours reach their own self-heating threshold, the process repeats.
Why propagation matters more than initiation
Internal short circuits arising from manufacturing defects occur at very low rates, with published estimates ranging from around one per million cells down to one per ten million, but a gigafactory produces cells in the hundreds of millions. Multiply a very small probability by a very large number and single-cell failure becomes a certainty across a fleet rather than a possibility. No realistic quality programme drives it to zero.
Modern safety engineering therefore assumes a cell will fail and designs so that the event stops at one cell, or at one module. That reframing is what UL 9540A codified for stationary storage: the test characterises propagation behaviour at cell, module and unit level rather than trying to prove that initiation cannot happen.
Design measures that follow from it:
Thermal barriers between cells, using mica, aerogel, intumescent materials or engineered air gaps, sized against the energy a single cell can release.
Directed venting, so that hot gas and ejecta leave the pack along a controlled path rather than into the next cell.
Cell spacing and format choice. Cylindrical cells in a matrix have inherent gaps and small individual energy content. Large-format prismatic and pouch cells contain more energy per unit, so a single failure delivers a larger thermal insult to fewer neighbours.
Gas detection ahead of temperature detection. Off-gassing precedes visible thermal signals by a useful margin, and detecting hydrogen or specific electrolyte volatiles is now standard practice in stationary systems.
Enclosure design against deflagration, including explosion venting or explosion prevention systems, since preventing gas accumulation is more tractable than suppressing a fire.
Chemistry and state of charge as design variables
| Factor | Effect on runaway behaviour |
|---|---|
| Nickel content in a layered oxide cathode | Higher nickel lowers the decomposition onset and increases oxygen release, so NMC 811 has less margin than NMC 622 |
| Phosphate cathode (LFP, LMFP) | Higher onset, much lower oxygen release, slower and less energetic event, still vents flammable gas |
| State of charge | A cell at high state of charge has more stored energy and a more reactive, delithiated cathode, so it releases more heat and reaches runaway sooner |
| Cell energy content | Larger cells release more total energy per failure, which raises the barrier requirement for stopping propagation |
| Electrolyte formulation | Flame-retardant additives, alternative salts and higher-boiling solvents shift onset and reduce peak heat release |
| Solid electrolytes | Remove the flammable liquid, but introduce their own failure modes, and lithium metal anodes bring different hazards |
The state of charge row has an operational implication that is easy to act on. A system stored or transported at a lower state of charge presents a smaller hazard, which is why transport regulations under UN 38.3 and associated rules limit state of charge for shipping, and why storage sites often reduce state of charge during extended idle periods.
What testing tells you
Accelerating rate calorimetry measures self-heating onset and heat release for a single cell under adiabatic conditions, giving the temperatures a designer works from.
Nail penetration, crush and overcharge tests characterise initiation routes, though correlation between forced internal shorts and field defects is imperfect and remains an active research question.
Propagation testing, of which UL 9540A is the reference method for stationary storage, gives the answer that actually matters for a system: does one cell failing take out the unit, and what gas and heat does the installation have to handle.
Certification under IEC 62619 for industrial applications and UN 38.3 for transport sets the baseline. Neither certificate means a system cannot fail; both mean it has been characterised. On the installation side, the US code NFPA 855 sets defaults for lithium-ion storage of 50 kWh per unit, 0.9 m (3 ft) separation between units, and 600 kWh per fire area, limits the authority having jurisdiction can relax on the strength of UL 9540A large-scale fire test data.
For anyone specifying or operating a system
Ask for the UL 9540A large-scale fire test report, not only the certificate, and read what happened at unit level.
Ask what the gas detection strategy is and what the control system does when detection triggers, since detection without an automated response adds little.
Confirm the deflagration strategy for any enclosed installation, and check it against the local fire authority's expectations rather than the supplier's home market.
Establish the emergency response plan with the fire service before commissioning. The response to a battery incident is defensive cooling and exclusion, sometimes for many hours, and re-ignition after apparent extinction is documented behaviour. A fire service that learns this on the night will make worse decisions than one that walked the site in advance.
The scale of what is at stake was set out plainly on 16 January 2025, when fire destroyed Phase 1 of Vistra's Moss Landing facility in California: 300 MW and 1,200 MWh of NMC racks installed inside a repurposed turbine hall. The fire burned for days, smouldered for nearly a week, and prompted the evacuation of between 1,200 and 1,500 residents, though no injuries were reported. That dense indoor architecture had no modern equivalent, and the loss reinforced the industry shift toward separated outdoor enclosures with unit-level UL 9540A propagation data.
Informational and educational content only. Not professional, financial, legal, or engineering advice.