Efforts to decarbonize the transportation industry drive one of the largest technological trends: the shift from combustion engine powered cars toward battery electric vehicles (BEVs).
This has led to a steep ramp-up in production capacity for lithium-ion batteries and BEVs and adds new requirements to the design of those vehicles.
Batteries contain a lot of energy: in addition to the electrochemical energy, even more energy is released when a battery catches fire. This combustion enthalpy can be six times larger than the electrochemical energy. When released in an uncontrolled way, it causes perilous fires and explosions.
When a battery cell temperature increases beyond the safe range specified by the manufacturer, it can initiate a thermal event. This can be caused by, among other things, a manufacturing defect that creates an internal short circuit. An uncontrolled decomposition reaction releases large amounts of energy and further accelerates the temperature increase — a situation known as thermal runaway. In the worst case, thermal runaway propagates from one cell to another, making it exponentially harder to contain the energy and resultant combustion.
These developments are accompanied by increasingly mature regulations and norms, especially concerning BEV safety. As a result, engineers and manufacturers are finding the current EV battery landscape quickly evolving and difficult to navigate. But new sensing technologies may make their tasks less difficult.
Norms and regulations
The UN Global Technical Regulation No. 206 on EV safety — reflected in both European and Chinese regulations — requires that passenger risks from thermal propagation be minimized by ensuring that the vehicle provides an advanced warning indication to exit at least five minutes before an incident occurs.
Complementing this, ISO 26262, the functional safety standard for road vehicles, outlines a safety lifecycle aimed at reducing risks from systematic and random hardware failures, focusing on the malfunctioning of electrical/electronic (E/E) systems such as the battery management system (BMS) that prevents overcharging, though it offers limited guidance on non-E/E systems like battery cells.
Meanwhile, the ISO 6469 standard series, including ISO 6469-1:2019 and its amendment ISO 6469-1:2019/Amd.1:2022, specifically addresses the safety of electrically propelled road vehicles by establishing standards for the rechargeable energy storage system (RESS) and methods to assess and mitigate thermal runaway propagation risks. The technical report ISO/TR 9968:2023 further supplements ISO 26262 by providing additional methodologies to bridge the gap between E/E and non-E/E systems, offering concrete examples for both the BMS and battery cells and effectively linking ISO 26262 and ISO 6469.
The rechargeable energy storage system (RESS) shown in Figure 1, adapted from ISO/TR 9968, includes an electric energy storage element composed of lithium-ion battery cells, which are non-E/E elements. One potential hazard associated with these battery cells is thermal runaway, a non-E/E functional hazard that can lead to severe consequences.
A Failure Mode and Effects Analysis (FMEA) for thermal runaway identifies several root causes, including overcharge, overheating, charging at too high a current, mechanical deformation and manufacturing defects. While the first three causes can be attributed to malfunctioning of E/E systems, mechanical deformation is typically linked to crash scenarios and is addressed separately by other standards. Manufacturing defects, on the other hand, are outside the scope of ISO 26262 but may be considered in the safety case for thermal propagation as per ISO 6469-1.
To mitigate these risks, a detection system can be implemented that provides an early warning to the driver in the event of thermal runaway, allowing for evacuation from the vehicle. As per ISO/TR 9968:2023, introducing a thermal runaway sensor as an E/E element ensures protection for the battery. This sensor is considered an E/E system and thus falls under ISO 26262, thereby integrating the safety requirements of both E/E and non-E/E systems within a cohesive safety framework. Risk analysis according to ISO 26262 assesses the hazard scenario of "driving with occupant(s) present in the vehicle."
Given the frequent occurrence of this scenario, the exposure rating is considered E4, and the severity of injuries resulting from fire or smoke is classified as S2 (severe and life-threatening but with survival probable). The controllability of the situation, assuming the driver can stop the car and evacuate, is rated C2 (normally controllable). This results in an ASIL B classification for the hazard.
In addressing the hazard, the safety goal (SG1) can be defined as "Prevent thermal runaway from causing harm to person(s)." To fulfill this goal, functional safety requirements (FSR) are derived, such as FSR1: "The system shall detect thermal runaway and alert person(s) more than 5 minutes before smoke or flames appear in the passenger compartment." This requirement is allocated to the RESS, with technical safety requirements (TSR) further developed for its implementation. For example, TSR1 specifies that the system must monitor gas venting to detect thermal runaway and alert the battery management system (BMS). Additional TSRs ensure that, upon detection of thermal runaway, the system will trigger alerts, activate emergency cooling and disconnect high voltage from the system.
By following the guidelines of ISO 26262 and considering a range of potential scenarios, a structured safety concept can be developed to mitigate the risks associated with thermal runaway. This process highlights the importance of redundancy and independence to avoid systematic failures, as outlined in ISO 26262-9:2018. Although this example is only a small part of a broader safety analysis, it demonstrates the application of international standards to ensure the functional safety of EV systems, with a detailed discussion of risk analysis and thermal propagation available in related literature.
Gas sensors offer new hope
Thermal runaway sensors must be fast, resilient, able to monitor many cells in parallel and emit few false alerts. Placing temperature sensors on every single cell in a battery pack would be ideal to detect thermal runaway early — but this is typically not feasible due to high cost and complexity.
Cell voltage, pack current and module or busbar temperature signals are often readily available, but research shows that these signals are insufficient to reliably fulfill the requirements stated above. For example, cell voltage is slow to respond to thermal events because typically several cells are connected in parallel and unaffected cells prop up the branch voltage even if one cell fails.
An alternative approach is to detect thermal runaway by monitoring gas pressure inside a battery pack. While pressure indeed changes in case of thermal runaway, research shows that the pressure signal is transient. Almost all vehicle battery packs employ a pressure relief valve that limits the maximum pressure inside the pack. The trend toward lowering the opening pressure of these valves also requires lowering the threshold pressure at which a pressure based thermal runaway detection system triggers an alarm.
Since vehicles can experience rapid pressure changes during normal operation, pressure sensors are prone to false alerts. When a false alert triggers the evacuation alarm of a vehicle, customer confidence suffers.
In contrast, when gas sensors are strategically placed within the vent path of a battery pack, they are well suited to monitor all cells inside a pack simultaneously and detect a single cell thermal event with high fidelity. This is because the gases released during cell venting and thermal runaway — such as hydrogen — are very specific and distinct from the normally encountered environment gases.
Gas sensors also respond sufficiently fast to thermal events from cells placed far apart. This is because vented gas volumes are significant compared to the typical dead volume present in packs, forcing gas through the pack toward the pressure release valve — resulting in a much faster transport of gas molecules compared to diffusion. Finally, if the signal change is strong and persistent, it provides the possibility to conduct sanity checks to avoid false positives.
Summary
About the author
Dr. Martin Ebner is a senior business development manager at Sensirion, where he leads sales for thermal runaway sensors for EV safety. With over a decade of experience in the lithium-ion battery field, he previously founded and led a technology startup as CEO and later CTO. A recognized expert in the industry, Dr. Ebner represents Switzerland on an ISO norm committee focused on EV safety standards. He holds a Ph.D. in electrical engineering from ETH Zurich.
About Sensirion
Sensirion is one of the world’s leading developers and manufacturers of sensors and sensor solutions that improve efficiency, health, safety and comfort. Sensirion sensors can measure a wide range of environmental parameters and flow rates, precisely and reliably. When it comes to the safety of EVs, gas sensors play an essential role in monitoring and preventing safety hazards. More information is available on the Sensirion website
