Safety for

energy storage
Why safe operation of Li-ion
energy storage requires a
holistic system approach.
Saft White Paper

1 Introduction: the need

for a holistic concept
- p3
4.3 Gas and pressure management

4.4 Propagation mitigation

2 Risk analysis and

assessment - p6
5 Testing and
certification - p15
5.1 Characterization testing
2.1 Reliable power for shift working
5.2 Validation testing
2.2 Flexibility, scalability and streamlined
costs for vehicle manufacturers 5.3 Certification testing

2.3 Fast or ultra-fast charging 5.4 Training of firefighters

and operators

3 Design phase - p7
3.1 Electrical risks

3.2 Electrochemical risks

6 Outlook - p20

7
3.3 Thermal risks
Case studies - p21

4
7.1 Dunkerque – France’s largest battery
Thermal runaway energy storage project
- p9
7.2 RINGO – relieving transmission grid
4.1 Thermal runaway prevention
congestion
measures

8
4.2 Fire containment measures
– the fire suppression system (FSS) About the authors
- p24

02 Safety for energy storage

Introduction
The global energy transition and drive for a and North America have illustrated that
carbon neutral future is fueling an expanding safety rules are not applied with equal
market for energy storage systems, rigor by all manufacturers and operators.
particularly to support the grid integration Furthermore, standalone fire protection
of renewables. According to the report devices or technologies that were
published in 2020, “Global and United States erroneously considered as “intrinsically
Energy Storage Systems (ESS) Market safe” have proved insufficient when
Insights, Forecast to 2027”, the global ESS d eal i n g w i t h p ot en t i al l y com p l ex
market was $US 2,738 million and it is scenarios where multiple risks of different
expected to reach $US 11,700 million by natures can affect battery operations.
the end of 2027.
The complexity of the safety challenge
The majority of large scale ESS installations arises because an ESS integrates thousands
feature lithium-ion (Li-ion) battery of individual cells together with multiple
technology. Ensuring the safe operation electronic systems that control vital
of this technology is critical, not only aspects such as thermal management. Risk
to protect people but also to protect business can arise from electrochemical, electrical or
assets and revenues. Li-ion batteries can mechanical behavior of cells, malfunction
store considerable amounts of energy in of the control system, external electrical
a small volume – as much as 670 Watt- faults or environmental impacts such as
hours (Wh) in a single liter. That means, like lightning strikes or earthquakes.
other electrical devices, such as heating
Saft is well placed to comment on safety
equipment and media used to store
since it deployed its first utility-scale ESS
energy, including fuel, compressed air and
in 2003 – a 27MW installation based on
flywheels, they can give rise to certain
nickel-cadmium (Ni-Cd) batteries for the
hazards in the case of misuse or abuse.
Golden Valley Electric Association in
Therefore, in common with other fuel or gas
Fairbanks, Alaska. In 2012, we introduced
storage systems, safety rules and practices
Li-ion technology in a containerized
have been established for batteries and are
ESS and since then have deployed over
continuing to develop.
250 systems worldwide. All of our
The safety challenge is, however, particularly installations have operated successfully
complex for the high energy density, high without a significant safety incident. The
voltage, Li-ion batteries deployed at the key to this track record for safety has been
heart of multi-MWh, utility-scale ESS in adopting a holistic approach.
schemes. Recent incidents in Asia, Europe

Saft - March 2022 03

Saft White Paper

1.1 What is Saft’s holistic

approach to safety?

Saft’s company policy on product qualification and manufacturing

safety involves not only the design processes. This approach is summarized
of electrochemical cells and battery in our “four pillars of safety” as illustrated in
systems, but embraces also product Figure 1.

Figure 1 – The four pillars

of product safety
4 pillars on product safety

Cell Design System Design Validation & Manufacturing

certification
Safety protections

Reliability analysis
Cathode & anode

Electrochemical

manufacturing
management

In line layered
Electronics &
Mechanical

Safety tests
technology

capabilities
validations
software
Thermal

controls
Process

Process
design

Clean
stack

User Requirements

The starting point for in designing for safety design, system design, certification,
is a detailed analysis of potential risks manufacturing and quality control,
and their consequences. This risk analysis installation and day-to-day operation.
follows international standards, covering
Saft’s safety solution is designed to enable in-
risks of any possible nature that can be
depth defense against risk, from preventing
identified for the entire ESS. In particular, we
critical events during operation to ensuring
look in detail at interdependencies, where
safe decommissioning, as shown in Figure 3.
the coincident occurrence of two or more
We look at the possible consequences
factors can give rise to a safety incident.
of a risk, and then define mitigation
ESS safety must, however, go beyond safe measures at the system and environmental
product designs for a truly holistic approach. level. The process starts with the
As shown in Figure 2, we adopt an end-to- detection and possible prevention of a
end overview from design, development and critical event.
installation to operation. This includes cell

04 Safety for energy storage

 Figure 2 – ESS safety requires an end-to-end overview

Battery design Manufacturing Installation Operation

Based on in-depth Implementing the Takes account of Real-time monitoring
possible hazard analysis highest level of potential hazard and active maintenance,
(PHA) and failure quality control in the operational as well as operator
mode and effects and tests at environments. training, and defintion
analysis (FMEA). cell, module and of safety procedures.
system levels.

In the case of a hypothetical event, we fire and preventing deflagration of gases,

consider how to best implement measures to protecting people and infrastructure, enabling
manage it. A typical critical event is Thermal the secure intervention of first responders
Runaway (TR) – see explanation in section 4. (fire-fighting services) and ensuring
The aim is to limit its ability to propagate and effective post-event clear-up of the site.
control its effects. This covers containing

In summary, the overall goal

Figure 3 - Saft’s safety solution is designed of Saft’s holistic approach
to enable in-depth defense against risk is to protect people, the
environment and energy
storage assets by:

•Preventing safety events

where possible

• Minimizing the level of an

event should it occur

• Limiting the consequences

of an event

Saft - March 2022 05

Saft White Paper

2. Risk analysis and assessment

We have already established that risk The categories of safety events are:
management is at the heart of Saft’s safety
concept. As part of this, we accept that it
• Electrical
is not possible to totally exclude a critical • Thermal
event. Therefore, our goal is to limit the risk • Electrochemical
of a critical event to a known and acceptable
maximum level. We define this as:
• Mechanical
The possible safety events and combinations
A maximum of 1 critical event (loss of a
there of are analyzed to produce a list of risks,
container) for a fleet of 1,000 ESS containers
such as thermal runaway. The assessment
operating over 10 years.1
established for each identified risk covers:
The methodology for the risk analysis is to
create an exhaustive list of potentially critical
• Severity, occurrence and ease of detection
of the event
events by applying PHA (Preliminary Hazard
Analysis) and DFEMA (Design Failure Mode • Exposure impact on the battery, on people
& Effect Analysis) techniques. and assets

• Controllability of the event

Figure 4 – Saft’s risk matrix2

SA FT W HITE PA P ER - ES S

Severity:
Negligible Slight Moderate High Very High
Material cost • $1k • 1k to $20k • 20k to 200k$ • 200k to 2m$ • > 2m$
Personal injury • None • Minor cuts • Injury w/ short • Serious injury w/ • 1+ fatalities
time off long time off

Very unlikely
< 0.010%

Unlikely
Likelihood:

0.01% to 0.10%

Posssible
0.10% to 1.0%

Likely
1.0% to 10%

Very likely
>10%

Acceptable risk levels in Saft safety policy

1 - This translates into a failure rate of 1,14 * 10-8 per hour

2 - Based on Standard IEC 61508 (Industrial market) for likelihood regarding critical event

06 Safety for energy storage

3. Design Phase
In this phase the focus is to determine as humidity and door contacts (D)
the most suitable technical solutions to
minimize or otherwise mitigate any risk
• Feedback circuits to validate the function
of sensors (D, O)
identified as “critical” that could give rise to
a critical event. • Electronic hardware for over-voltage
protection, over-temperature protection and
These solutions can be organizational (i.e.
cell balancing (D)
on processes and controls) and/or technical
in nature, embracing passive or active • Electrical hardware such as fuses and
hardware and software devices at the cell, contactors (D)
module or system levels. Typical examples in
Design (D), Process (P) and Operations (O) • Battery management system (BMS) to
detect a critical situation and raise an alert.
include:
Then, if necessary, the BMS will put the
• Elimination or substitution of compo- battery into a safe condition (D, O)
nents. For example, we avoid wherever
possible the use of flammable materials, • Thermal management system to
maintain the battery within the designated
conductive plastics and materials that can
temperature envelope and to minimize
fail or degrade (D)
temperature differentials (D, O)
•Minimize risk in the supply chain through
quality assurance (QA) procedures, such • Mechanical protection devices such as heat
protection sheeting and pressure vents (D)
as preventing the use of non-compliant
materials or components (P) • Active fire suppression systems (FSS) (D)
• Reduce risks during manufacturing • Local and remote information and alert
such as detecting and eliminating systems (D, O)
deviations. An example is a failure to reject
cells where electrode rolls are joined, leading
to short circuits (please see the green
box below for more details) (P)

• Measurement and calculation of key

parameters such as voltage, state of charge,
and insulation resistance (O)

• Monitoring and assessment of external

parameters that influence the battery such

Saft - March 2022 07

Saft White Paper

Saft practical experience

During early production at our US manufacturing facility in Jacksonville,

malfunctioning controls on a cell-winding machine led to cells not being rejected
when electrode rolls were joined. This resulted in an increased probability of
short circuits inside cells. Isolated events did occur in the field, but the module
design prevented propagation.

Having identified the root cause, we addressed the issue by improving the winding
process and implementing additional manufacturing controls. Furthermore, this
risk is now systematically addressed in all risk analysis exercises. This example
shows that manufacturing control is just as important as chemistry or design
features.

This white paper cannot provide an 3.2 Electrochemical risks

exhaustive inventory of risks and
Electrochemical risks can result in critical
risk mitigation methods. However,
failures including internal cell short circuits
we can illustrate some important examples:
and electrolyte leakage. Saft’s safety
solutions include:

3.1 Electrical risks • Cell design:

Electrical risks result from events such as - Raw materials selection for cathode and
over-charging or over-discharging of the anode
battery, external short circuits, high voltage
or high current. Saft’s safety solutions - Electrode design
include: - Cell mechanical design
• BMS design embedding safety functions,
such as algorithms for dynamic current • Quality control during manufacturing:
limiting - Controlled process

• Build redundancy in electrical architectures, - Controlled environment

e.g. redundant I/O line to trip battery in case
of communications failure

• Prevent people from electrical hazards,

e.g. by separating the control room from the
energy room

08 Safety for energy storage

3.3 Thermal risks • Design of the temperature control system
Thermal risks include over-temperature to ensure homogeneity among cells and
operation of single or multiple cells, modules
insulation failure, failure in regulation of
heating, ventilation and air conditioning
• HVAC design to control humidity and avoid
corrosion faults
(HVAC) systems resulting in condensation
and corrosion, accumulation of explosive • Overpressure valve and blast panels to
gases and deflagration. Saft’s safety manage gases
systems include:
• Thermal insulation to limit heating from
external sources

• Procedures to avoid condensation during

maintenance operations

Saft practical experience

Early ESS projects often involved installations on islands. Saft discovered

condensation in containers in tropical locations, resulting in the corrosion of BMS
circuit boards that could ultimately lead to safety issues. This was addressed by
the installation of humidity sensors as well as raising the container temperature
setpoint above the external dew point just before it was opened for servicing.
This example shows that safety extends beyond design and manufacture to
field service operations, which are integral to Saft’s comprehensive approach.

4. Thermal runaway
Thermal runaway (TR) is the single most An ISC is the most critical root cause of
critical event that can result either from one a TR because it can be neither predicted
or more of the risks outlined in section 3, nor prevented by the BMS, and because it
such as over-temperature, over-voltage or results in an immediate rise in cell
an internal short circuit (ISC). temperature to the point where it is able to
trigger a thermal runaway.

Saft - March 2022 09

Saft White Paper

What is a thermal runaway?

While many in the industry define thermal runaway as the point where the
cathode (positive electrode) experiences catastrophic breakdown and spiraling
temperature rise, it is important to recognize that this is the culmination of a
chain of reactions of increasing severity. The initiating point is the breakdown
of the passivating layer, or solid-electrolyte interphase, at the surface of the
anode (negative electrode), which occurs above about 120°C. This breakdown
allows an uncontrolled reaction between the electrolyte and the lithium ions in
the anode, generating gas and more heat. As the temperature increases, higher
energy reactions are triggered, involving the separator and electrolyte, and
producing more gas and heat.

The evolved gas raises the cell internal pressure to the point where the cell
vents, releasing a large volume of hot gas. If the event is limited to a single
cell, the heat released during venting is often sufficient to avoid catastrophic
reactions at the cathode. However, if heat from the initiating cell propagates
to adjacent cells and causes them to undergo the same sequence of
reactions, the accumulated heat makes full-blown thermal runaway at the
cathode inevitable. Different cathode materials show different thresholds,
and the amount of heat generated is different:

- Lowest heat generation is by LFP batteries with iron-phosphate cathodes.

This non-reactive positive material results in lower heat release under abusive
operation, so the safety behavior is better than other Li-ion chemistries.

- Highest heat generation is for batteries with cathodes that have a high nickel
(Ni) content, such as NMC and NCA materials.

A single cell venting releases a considerable volume of flammable gases and

toxic fumes. Gas release enables gas detectors to trigger fire alarms. However,
given the potentially high volume of gases in a multi-cell propagating event,
explosion risk and toxicity need to be managed at the container or battery room
level.

10 Safety for energy storage

Saft’s safety solution for thermal runaway is 4.2 Fire containment
based on a battery design that implements
measures – the fire
software and hardware barriers at the cell
suppression system (FSS)
and system levels. The aim is to:
Fire containment measures are deployed
•Prevent TR, interrupting any chain reaction to protect against electrical fire and
as quickly as possible thermal runaway of a single cell by
providing three staged responses:
• Contain fire and manage gases and fumes
• Mitigate cell-to-cell propagation and heat •and, if a fire is detected, release inert gas
An active primary FSS will detect fumes
transfer from individual cells, modules
and systems to neighboring equipment, (nitrogen) to decrease the level of oxygen
through thermal insulation barriers at cell inside the container below the level that
and module level. supports combustion (15%). This measure
is highly effective in stopping electrical fires.
Oxygen depletion also reduces the risk of gas
explosion.
4.1 TR prevention
measures • The FSS interacts with the battery control
system to set the battery into safe mode.
Thermal, electrical, and electrochemical risk
All contactors are opened, and charge/
management are intended to reduce the
discharge operations are stopped. Local and
risk of occurrence of the most common TR
remote warnings are triggered to alert the
scenarios. They include:
operator and first responders (fire services)
• Insulation protection - detects insulation about the fire.
faults, caused by factors such as high
humidity conditions, and prevents leakage • Upon arrival, first responders can judge,
without opening the battery container, if the
currents
fire is extinguished or if a thermal runaway
• BMS and electric protection devices - of the battery by heat propagation is still
interrupts chain reactions during an external ongoing. In this case, a secondary, passive
short circuit, over-charging or excess water FSS is available to stop the process
currents through cooling.

It is vital to ensure that such protection Although the primary FSS will usually stop
functions are highly reliable and/or the original fire, the initial heat transfer
redundant. Therefore, BMS safety functions to adjacent cells or modules may have
are qualified to SIL 13 and critical sensors triggered further thermal runaways through
and switches are equipped with regular, overheating. These will take between 60 to
automatic function testing. 90 minutes to escalate. In this “worst case”
scenario, only intensive cooling with water
3 - SIL: Safety Integrity Level according to IEC 61508 can definitely stop the event.

Saft - March 2022 11

Saft White Paper

The Saft solution is designed to spray water ceiling-mounted sprinklers. The system is
onto each individual module inside the entirely activated from outside, without the
container. This guarantees much higher need to open container doors.
module cooling effectiveness compared to

Principle of a Fire Suppression System

The activation of the FSS is self-powered and is based on two detection levels:

• When one of the sensors detects a fire event (gas, heat or smoke), it trips
a “warning” signal. This first signal will stop the cabinet’s fans and the air
conditioning. The system will stay in alert mode until a second detection is
performed by another sensor.

• If a second fire detection occurs by another physically independent sensor,

audible and visible warnings inside and outside the container will be activated.
There is a delay of 30 seconds before activating the FSS. The neutral gas is then
released over a period for 30 seconds and impregnation will last 10 minutes
according to the relevant standards. Explosive gases are flushed through the
overpressure valve.

This sequence is triggered by the FSS control panel. It is linked to the battery
control system in order to command the battery shutdown. This includes
opening of contactors in the battery management module (BMM) and
managing all local (visual, audible) and remote alarm functions. Its design must,
therefore, ensure high reliability and routine inspection is part of the regular
maintenance operation.

12 Safety for energy storage

 Figure 5 – An overview of an ESS control room with FSS components

1 4 1 2 3

Thermal IG55 cylinder Gas nozzle in

detectors with nitrogen battery
2 compartment

4.3 Gas and pressure gases reaching a critical concentration

management • An external flame deflector, to direct
A thermal runaway can result in the emission potential flames away from personnel that
of a large volume of gases, specifically: could be in the vicinity of the container

• Carbon monoxide (CO) – which is • Blast panels on the container roof that
flammable and toxic burst in the case of an internal explosion.
This releases the pressure, protecting the
• Hydrogen (H ) - which is flammable if the
2
local environment and people from container
concentration exceeds about 4% by volume
deflagration.
(40,000 ppm)
The interior temperature is indicated
To reduce risk, and especially to
outside the container, and gas concen-
protect fire fighters who may need
tration can also be measured, so that
to approach the ESS in case of an
firefighters can assess the criticality of the
accident, it is essential to both ensure
situation without opening or entering the
dilution of gases and avoid any dangerous
container. They can determine if thermal
overpressure inside the container. Saft
runaway is happening and if the atmosphere
containers (see Figure 7) are therefore
is explosive. Depending on their observations
equipped with:
and using decision tree instructions
• An overpressure vent that operates at provided by Saft, first responders will then
around 100 Pa, enabling the controlled decide upon the most appropriate actions
release of gases and, therefore, preventing to take.

Saft - March 2022 13

Saft White Paper

Figure 6 – Overview of Saft’s ESS safety protection systems

Figure 6 provides an overview of the ESS safety protection system that covers fire
containment and gas and pressure management measures.

4.4 Propagation • In the worst case of a full container fire,

mitigation sufficient spacing to avoid propagation from
container to container
Measures to mitigate propagation in the
case of thermal runaway: To design these barriers and to ensure
their effectiveness, it is important to have a
• Heat barriers and heat evacuation at the good knowledge and understanding of the
cell and module levels
behavior of battery cells and modules in
• Primary FSS (nitrogen) extinguishes fire, abusive conditions. As mentioned previously,
and also acts to flush hazardous gases their behavior can vary significantly
through the overpressure vent. depending on the cell chemistry (NMC,
LFP, …), the cell size and format (pouch,
• Water FSS to mitigate larger-scale heat cylindrical, prismatic), and the way they are
propagation
packaged inside a module.

14 Safety for energy storage

 Figure 7 – Unique combination of safety devices on a Saft IHE container

1 – Primary FSS with redundant gas,

smoke, heat sensors and inert gas to
suppress electrical fires and reduce
explosion risk

2 – Blast panels

3 – Pressure relief vent with flame

deflector

4 – Secondary water spray system for

cooling

5 – External fire hose connection

6 – Rockwool container internal heat

insulation

5. Testing and certification

Testing cells, modules and systems 5.1 Characterization
under abusive conditions is essential
testing
to ensure the effectiveness of the
Extensive testing of battery cells and
different safety designs implemented for a
modules in abusive conditions is necessary
particular ESS. In essence, this testing has
to characterize their behavior precisely in
three different levels and purposes:
terms of:
• Characterization of Li-ion cells and other • Heat evolution and propagation
ESS components

• Validation testing of systems and sub- •

Flame characteristics

systems • Volume, composition and temperature of

gases
• Certification testing

Saft - March 2022 15

Saft White Paper

Testing must be conducted under different following:

operating conditions – especially state of • Abuse tests (fire resistance, electrical
charge (SOC) – and, as a minimum should abuse, mechanical or thermal stress...) of
cover the cell and module levels. This is components or sub-systems, typically Li-ion
because the behavior of a single cell or cells and battery modules
group of cells in a temperature chamber
can vary dramatically once they are • Functional tests of electronic circuits,
assembled into a module with its specific switching devices, etc.
design characteristics in terms of materials, • Functional tests of detection and measu-
density, air flow, cabling, etc. rement devices

5.2 Validation testing • Redundancy tests

Validation testing is integral to the In addition to extensive abuse testing of
engineering process of designing and cells, Saft has performed hundreds of abuse
developing a battery system. and propagation tests on Li-ion modules and
batteries.
The purpose is to ensure that the
design will fulfil the requirements of These include large scale testing of
the specification. This specification is systems in excess of 150 kW, to determine
usually a combination of external standards propagation characteristics and the best
and company internal rules. Saft has materials and solution methodologies for
established its own internal, company-wide extinguishing Li-Ion fires once a propa-
safety requirements applicable to any Li-ion gation event begins. Saft benefits
battery system. from the strong competence of its
mother company in this domain.
Achievement of the safety targets
TotalEnergies’ safety exper ts for
must be validated by internal and/
industrial sites with high risk exposure
or external testing and subjected to
in adverse environments helped to
a QA controlled review process before
define methods and execute testing.
product qualification and release.
Figure 8 shows testing being carried out.
Component testing can embrace the

Figure 8 – Saft’s ESS testing setup

16 Safety for energy storage

 Saft practical experience

Thanks to safety testing at the container level, we recognized the need to implement a
water-spray system for our new generation of high energy ESS containers. In
contrast to Saft’s first three generations, which were built with smaller Li-ion
modules in a less energy-dense arrangement, we found that a primary FSS
was not sufficient to prevent heat propagation. Despite extinguishing
fires, larger modules and a very high packing density inside the container led
to levels of heat transfer not seen in previous generations and which could
not be investigated in module component testing. Saft was, therefore, one
of the first manufacturers to systematically adopt a water spray system
for cooling in its safety design.

5.3 Certification testing • IEC 62619 Safety requirements for

The obvious purpose of certification testing Large format Secondary Lithium Cells and
is to establish the compliance of Saft’s Batteries, for use in Industrial Applications
ESS with international safety standards.
Tests can be performed by an external
test laboratory such as UL, TÜV or DNV, or 5.3.1 Qualification
according to UL
in house with witnessing by the relevant
certification body. (Underwriters
UL®

Laboratories)
The most significant tests applicable to
In order to be “UL listed”, the ESS battery
ESS are:
must be certified against UL 1973.
• UL 1642 Lithium Batteries 4
The prerequisite for this is to obtain UL 1642
• UL 1973 Standard for Batteries for Use or UL 1973 for the Li-ion cells inside the
in Stationary, Vehicle Auxiliary Power and container.
Light Electric Rail (LER) Applications
In order to be “UL listed”, the ESS battery
• UL 9540 Energy Storage Systems and must be certified against UL 1973.
Equipment

• UL 9540A Test Method for Evaluating 4 - Since the addition of cell-level requirements to the latest version
Thermal Runaway Fire Propagation in of UL 1973, the latter is increasingly used in practice instead of UL
1642, which was one of the first standards specifying safety tests
Battery Energy Storage Systems at cell level.

Saft - March 2022 17

Saft White Paper

The initial step for this is to certify the Li-ion context (indoor, outdoor, floor mounted,
cells inside the container against UL 1642 wall mounted…).
or UL 1973.
Saft has conducted UL9540A testing at cell,
This is followed by a process to achieve UL module and DC string level. Due to thermal
listing for the full ESS battery system, with a insulators integrated to Saft’s 18 kWh LFP
typical duration of 6 months. battery module, no propagation occurred
during the test. The test report according to
The four main steps to complete with UL are:
9.8 of UL 9540A 4th edition concludes the
• 1 - Preliminary Investigation module passes all 4 criteria, i.e.

• 2 - Engineering Review and Documentation • no flame

• 3 - Testing • module surface temperature remains
below critical level
• 4 - Final Certification
UL determines the physical tests to be
• wall surface temperature remains below
critical level
conducted as well as the specific paperwork
to be produced depending on its analysis • no explosion or cell rupture
of the manufacturer’s documents and
Test reports are available.
component compliance etc.
The UL9540 qualification covers a full
Saft has obtained UL listing for its
DC+AC system and is project specific for
containerized DC battery system Intensium
a given combination of a DC battery and
Max High Energy.
a AC system (PCS – Power Conversion
UL 9540A describes the test method for System). Assuming all system components
a system fire test, evaluating fire safety are UL qualified, the system qualification is
hazards associated with propagating essentially a documentary exercise.
thermal runaway within battery systems.
The purpose of this test method is to
determine the capability of a battery
technology to undergo thermal runaway
5.3.2 Design and
and then evaluate the fire and “explosion”
qualification to IEC
hazard characteristics. and EN standards:
the CE mark
Testing is performed by forcing thermal
Saft’s ESS are designed and qualified
runaway at different levels of the ESS,
against IEC and EN standards. They
starting at cell level. Then, depending on
are used as references for safety,
performance results, the next level testing
EMC and compliance to environmental
is required or not. The performance criteria
conditions.
are different depending on the installation

18 Safety for energy storage

Evidence of compliance to IEC standards IEC 62477-1
is mainly established by Saft’s self-
cer tification, obtained by testing Safety requirements for power electronic
or other relevant qualification processes systems and equipment (relevant for electric
and documented in QA controlled product safety)
qualification reviews.

As a result, Intensium Max containers are

CE certified, which means they meet high 5.4 Training of
safety, health, and environmental protection firefighters and
requirements. operators
The relevant IEC design and testing As outlined previously, Saft’s safety approach
standards applied for product safety are: is based on the acceptance that a critical
event can happen – even though we do
everything to avoid it. Subsequently, we need
IEC 62619
to ensure that operators and firefighters are
Secondary cells and batteries containing informed and trained in order to behave
alkaline or other non-acid electrolytes appropriately and to take the right decisions
– Safety requirements for Large format and actions should an event occur.
Secondary Lithium Cells and Batteries, for
use in Industrial Applications
Saft has, therefore, created a comprehen-
IEC 62485-2 sive information and training package that
comprises:
Safety requirements for secondary
batteries and battery installations – • Basic training on Li-ion batteries and their
Part 2: Stationary batteries. Safety aspects characteristics
associated with the erection, use, inspection,
maintenance and disposal of batteries.
• Awareness and detailed understanding of
potential risks: heat, explosion, toxic gases,
arc flash
IEC 61508
• Detailed information and documentation
Functional safety of electrical/electronic/ of the Saft ESS, in particular the nature and
programmable electronic safety-related operating principle of safety devices
systems
• General safety rules with batteries, dos
and don’ts
EN 60950

General Safety Requirements, Information

Technology Equipment

Saft - March 2022 19

Saft White Paper

• Decision trees to assess critical situations

and take appropriate decisions

• Detailed action plans to extinguish

fires, shutdown systems and protect the
environment

• Post-event instructions
We provide training courses and collect
feedback, keeping always in mind our main
overarching objective is to protect people,
the environment and the energy storage site
itself.

6. Outlook
Recent incidents with Li-ion ESS have • Standards do not always reflect the reality
alerted regulators and operators, illustrating of abuse scenarios. For example:
that safety is not yet mature in the energy
- The nail test. It is spectacular. But does
storage market. This is despite the huge
it really mean the cell is safe?
number of safety rules and standards
that exist already. The main challenges - Methods of triggering a thermal runaway.
in achieving a coherent, industry-wide Some methods are harsher than others,
approach to safety are: and do not accurately represent the reality
of an ISC.
• Diverse approaches to safety across
different areas - electrical safety, • Standards do not cover all areas of
electrochemical cells in general, Li-ion risk, in particular gas management
batteries in particular, electromagnetic and the prevention of deflagration are
compatibility (EMC) and other factors. At the not, or only poorly, dealt with in most
same time there are different system levels standards. However, these aspects have
– cells, DC battery systems, full AC ESS. been recently addressed by NFPA 855
Some rely on design rules, others on test
methods or safety performance values. • Tests are expensive. Carrying out an abusive
test of a full ESS involves considerable costs
• Standards are not necessarily applied in materials, test equipment and effort.
by all manufacturers.

20 Safety for energy storage

• Different
initiatives between UL, IEC, • The global energy storage community will
national committees, EU, as well as gain maturity
knowledgeable experts (DNV, …).
- Standardization bodies will hopefully align
• There are still gaps in the global and complete the process
patchwork of standards and best
- Developers and integrators will
practices, currently they do not fully
build greater knowledge of how to
reflect the practical reality of applications
specify ESS and the key qualifications
and systems.
to ask for
Saft’s philosophy for ESS safety can be
- Manufacturers will continue to develop
summarized as follows:
new technologies and enhanced safety
• There is no unique, universal recipe systems

• Our approach is based on technical -The increased involvement of

expertise, understanding, competence, insurance companies and investment
experience and the strict application of houses in financing ESS projects will
design and quality rules surely place an even greater emphasis on
minimizing risk

7. Case studies – the practical

deployment of ESS solutions
Two recent case studies in France illustrate France for a frequency response
the practical deployment of ESS solutions project (see Figure 9). Its architecture
that embrace Saft’s safety philosophy. needed to be future-proof and flexible to
serve as a blueprint that TotalEnergies could
7.1 Dunkerque – France’s roll out at other sites. Two more storage
largest battery energy plants of different power ratings are currently
storage project planned at different locations across France.

In 2021, TotalEnergies deployed a

Saft Li-on ESS at Dunkerque, Northern

Saft - March 2022 21

Saft White Paper

Figure 9 – TotalEnergies has deployed a flexible ESS at Dunkerque

with the primary use to provide FCR services to RTE

The 61 MW AC peak power and 61 MWh so as to assess and minimize any potential
facility at Dunkerque is the largest battery- risk for their sites.
based energy storage facility in France. It
connects to the network operated by RTE,
7.2 RINGO - relieving
France’s transmission system operator (TSO),
transmission grid
at a 90 kV grid connection point. Its primary
congestion now
use is to provide Frequency Containment
Reserves (FCR) services to RTE, but it is
and stacking services
designed to provide additional services for the future
as the market evolves, such as automatic RTE has adopted a 30 MWh Saft Li-
frequency restoration reserve (aFRR) or peak ion ESS for its ground-breaking RINGO
shaving to relieve grid congestion. project. The trial project is using
energy storage to boost the grid’s flexibility
Saft’s ESS solution comprises 27 Intensium
to prepare for the growing deployment of
Max High Energy containers, each providing
renewable energy in France’s electricity mix.
2.5 MWh of energy storage built with NMC cell
technology. The safety case was of utmost Rather than upgrading the grid, RTE is using
importance to TotalEnergies, as this ESS -like the RINGO project to explore the concept of
several others to come- is installed at an oil a ‘virtual transmission line;’ an innovative
and gas facility (in order to share existing approach using digitally controlled energy
grid connections). Therefore, TotalEnergies storage to absorb and release energy
and their insurance companies performed simultaneously at different sites located up
an in-depth audit of Saft’s safety concept and downstream of grid bottlenecks.

22 Safety for energy storage

While the primary task is relieving grid deployments on the French electricity grid.
congestion, after the first three years in Saft was able to demonstrate the advantages
operation, the RINGO ESS will be called on of a self-contained, certified and replicable
to provide other services such as frequency safety concept.
regulation.
Saft and its consortium partner Schneider
The full requirement for the RINGO ESS Electric are delivering a turnkey system
in its “second life” is not yet known. comprising 12 Intensium Max 20 High
But it almost certainly will need to Energy 1500 V containers, six inverters and
support a portfolio of multiple services four high-voltage transformers.
and potentially stack different services
Each container provides 2.5 MWh energy
simultaneously. There is also the possibility
storage and 1.2 MW power with control,
that it might be entirely or partially relocated
thermal management, and safety systems
to another site. Besides operational
in a standard 20-foot shipping container.
flexibility and modularity, RTE’s “sandbox”
The ESS has a total storage capacity of 30.8
project also involved the assessment
MWh and can deliver 10 MW for two hours,
of environmental and safety aspects to
with a peak power of 20 MW.
determine the conditions for potential future

Saft - March 2022 23

Saft White Paper

8. About the author

Jim McDowall has worked in the battery industry since 1977
and is currently in the position of Senior Technical Advisor
with Saft. Involved in the energy storage market since 1998,
Jim was a Director of the Energy Storage Association for 14
years and is a past Chair of the organization. Jim is an IEEE
Fellow and is Standards Coordinator and Past Chair of the
IEEE Energy Storage and Stationary Battery Committee, and
Chair of three of its working groups. Jim is a frequent speaker
at energy storage conferences and related events.
Jim McDowall Email: jim.mcdowall@saftbatteries.com
Senior Technical
Advisor and Certified
Senior Expert,
Saft IEEE Fellow

Michael Lippert is currently in charge of product and

market strategy for Saft’s Energy Storage Systems (ESS)
Business Unit at the company’s headquarters near Paris.
He is also Vice-President of the European Association for
Storage of Energy (EASE), Chairman of the Governing
Board of the European Technology and Innovation Platform
«Batteries Europe» and Chairman of the «Batteries European
Partnership Association» (BEPA), all three in Brussels.

Michael holds a degree in European Business Studies in

Michael Lippert
France and Germany and has worked for more than 20 years
Director Innovation and in different international sales and marketing positions at
Solutions for Energy, Saft
Saft for Railway, Traction and Stationary markets. He has
Vice President, EASE
Chairman of the Board, played a major role in establishing Saft’s market position in
Batteries Europe and BEPA Li-ion battery technology for renewable energy and smart
grids since 2010. In parallel he contributed to the develop-
ment of EASE since its foundation in 2011. In October 2019,
he was elected Chairman of the Governing Board of the
newly founded European Technology and Innovation
Platform (ETIP) for Batteries, which is driving and
coordinating R&I activities at EU level.
Email: michael.lippert@saftbatteries.com

24 Safety for energy storage

Saft - March 2022 25
We energize
the world.
On land, 
at sea,
in the air 
and in space.

26, quai Charles Pasqua

92300 Levallois-Perret - France
T. : +33 (0)1 58 63 16 00 Document N°22150-0322-2
F. : +33 (0)1 58 63 16 18 Edition: March 2022
Data in this document is subject to change without
Saft une société de TotalEnergies
notice and becomes contractual only after written
S.A.S. au capital de 26 724 876 € confirmation.
R.C.S. Nanterre 481 480 465 Photo credits: Saft, TotalEnergies, Adobe stock,
Numéro de TVA FR 51 481 480 465 Conception: Cap Interactif agency - 1026
www.saftbatteries.com © Saft