Lithium-ion cells, modules and battery management

Lithium-ion batteries have replaced lead-acid in most new data centre UPS installations. They take a third or less of the floor space for the same runtime, weigh much less, last ten to fifteen years instead of four to six, tolerate warmer rooms and can be monitored cell by cell. They also bring a hazard that lead-acid batteries do not have in the same form: a damaged or abused cell can enter thermal runaway, releasing flammable and toxic gas and possibly fire, and the failure can spread to other cells. Understanding how lithium-ion cells are built, how they are assembled into modules and racks, and how the battery management system protects them is the foundation for Lesson 7 on thermal runaway and Lessons 8 and 9 on detection, ventilation and suppression.

DCE-340 Lesson 3 covers lithium-ion batteries from an engineering perspective, including chemistry selection, sizing and lifecycle cost. This lesson focuses on the features that matter for safety.

Inside a lithium-ion cell

A lithium-ion cell has four main parts. The anode, usually graphite on copper foil, stores lithium ions when the cell is charged. The cathode, a lithium metal oxide or phosphate on aluminium foil, holds them when the cell is discharged. A thin porous polymer separator, typically polyethylene or polypropylene a few tens of micrometres thick, keeps the electrodes apart while letting ions pass. The electrolyte, a lithium salt in organic solvents, carries the ions between them. When the cell charges, lithium ions move from the cathode to the anode; when it discharges, they move back and electrons flow through the external circuit to do work.

Several features of this design matter for safety. The electrodes are separated only by the thin separator, so any defect, contamination or damage that lets them touch creates an internal short circuit. The electrolyte is flammable. A thin layer called the solid electrolyte interphase (SEI) forms on the anode during the first charges and protects the electrolyte from further reaction; it is stable in normal use but begins to break down at elevated temperatures. And the cathode materials, especially nickel-rich oxides, can release oxygen when they decompose at high temperature, which feeds combustion inside the cell even without air.

Cell formats

Cells come in three main formats. Cylindrical cells, such as the familiar 18650 and 21700 sizes, have a rolled electrode stack in a steel can with a vent and often a current interrupt device in the cap. Prismatic cells have a stacked or flattened winding in a rectangular aluminium or steel case, with a vent in the lid; large prismatic LFP cells of 100 Ah or more are common in data centre and energy storage batteries. Pouch cells have a stack sealed in a flexible laminated foil pouch, which is light and space-efficient but offers little mechanical protection and swells visibly when gas forms. Each format vents and fails differently, which affects how a module is designed to contain a failure.

The comparison should not be read as LFP is safe and NMC is dangerous. LFP cells are less likely to enter thermal runaway and release less heat when they do, but they can release large volumes of flammable gas, which can be an explosion hazard precisely because there may be no flame to burn it off as it is released. Both chemistries require the protections described in this course.

From cells to modules, racks and systems

A data centre lithium-ion battery is assembled in levels. Cells are connected in series and parallel into a module, typically housed in a metal enclosure with its own monitoring board, temperature sensors and sometimes a fuse. Modules are stacked in a rack or cabinet and connected in series to reach the string voltage of several hundred volts, with a rack-level controller, a DC breaker or contactors and a fuse. Several racks are paralleled into a system connected to the UPS DC bus, supervised by a system-level controller that communicates with the UPS and the building management system.

Each level has a role in safety. The cell's own design, including its vent and any internal current interrupt device, is the first barrier. The module enclosure and any thermal barriers between cells are intended to slow or stop propagation of a failure to neighbouring cells. The rack provides isolation by contactors and fuses, and the system controller coordinates protection with the UPS. UL 9540A testing, introduced in Lesson 2, examines how a failure in one cell affects the module, the unit and the installation.

The battery management system

The battery management system (BMS) is the electronic supervisor of a lithium-ion battery. It measures cell voltages, temperatures and currents; calculates state of charge and state of health; balances cells so they stay at similar voltages; communicates with the UPS charger to control charging; and, most importantly for safety, opens contactors or signals the UPS to stop charging or discharging when any measurement goes outside safe limits. Lead-acid batteries can operate without a BMS, although monitoring is good practice; lithium-ion batteries must not.

The BMS protects against the conditions that most often lead to thermal runaway: overcharge (too high a cell voltage), over-discharge (too low a cell voltage, which can cause copper dissolution and later internal shorts), overcurrent, over-temperature during charge or discharge, and charging at low temperature, which can cause lithium plating on the anode. It typically uses staged thresholds: an advisory alarm, a stronger alarm that reduces charging current, and a protective trip that opens contactors.

A BMS is a safety system, and its settings are safety settings. Changing protective thresholds, disabling alarms, bypassing contactors or using a battery whose BMS has lost communication can remove the protection that keeps cells out of thermal runaway. Only the manufacturer or its authorized service personnel should change BMS configuration, under the site's management of change process, and any loss of BMS function should be treated as a condition requiring the battery to be taken out of service or placed under heightened watch as the manufacturer directs.

Reading BMS data for early warning

The BMS also provides early warning. Many cell failures are preceded by subtle signs: a cell whose voltage drifts away from its neighbours, a cell that self-discharges faster than others, a module that runs a few degrees warmer than its neighbours, or rising internal resistance. Trending these values and investigating outliers can catch a failing cell months before it fails. The program below simulates a simple version of this analysis on invented module data, applying staged temperature and voltage thresholds and flagging outliers relative to the rest of the rack.

import random, statistics

# Illustrative BMS-style screening of invented cell data for one rack (seeded).
random.seed(322)
modules, cells_per = 10, 16
V_ALARM_HI, V_TRIP_HI = 3.60, 3.65      # volts per LFP cell (illustrative thresholds)
T_ALARM, T_TRIP = 45.0, 55.0            # degrees C (illustrative thresholds)

data = []
for m in range(1, modules + 1):
    for c in range(1, cells_per + 1):
        v = random.gauss(3.38, 0.005)
        t = random.gauss(27.0, 0.6)
        data.append([m, c, v, t])
data[73][2] += 0.035      # one cell drifting high in voltage
data[74][3] += 6.5        # the adjacent cell running warm

volts = [d[2] for d in data]
temps = [d[3] for d in data]
v_mean, v_sd = statistics.mean(volts), statistics.stdev(volts)
t_mean, t_sd = statistics.mean(temps), statistics.stdev(temps)

for m, c, v, t in data:
    notes = []
    if v >= V_TRIP_HI or t >= T_TRIP:
        notes.append("TRIP")
    elif v >= V_ALARM_HI or t >= T_ALARM:
        notes.append("ALARM")
    if abs(v - v_mean) > 4 * v_sd:
        notes.append(f"voltage outlier {v:.3f} V")
    if abs(t - t_mean) > 4 * t_sd:
        notes.append(f"temperature outlier {t:.1f} C")
    if notes:
        print(f"module {m:2d} cell {c:2d}: " + "; ".join(notes))
print(f"rack mean {v_mean:.3f} V, {t_mean:.1f} C; no thresholds reached means no automatic trip")

module  5 cell 10: voltage outlier 3.410 V
module  5 cell 11: temperature outlier 33.3 C
rack mean 3.381 V, 27.1 C; no thresholds reached means no automatic trip

The result illustrates an important limit. Neither cell has reached an absolute alarm or trip threshold, so the BMS's protective functions have not acted, yet both stand out clearly from the rest of the rack. Outlier analysis of this kind, whether performed by the BMS vendor's analytics, the site's monitoring platform or a technician reviewing trends, is how failing cells are found before they become incidents. The 2022 Pangyo investigation, discussed in Lesson 12, found that the battery monitoring system had not detected any abnormality before the fire, which shows that monitoring is necessary but not sufficient.

Inspecting lithium-ion batteries

Routine inspection of lithium-ion battery systems is simpler than for lead-acid because there is no electrolyte to check and no watering. It still matters. Typical inspection items include BMS status and active alarms, cell voltage and temperature spreads, room temperature and humidity, the condition of cabinets and doors, signs of swelling or deformation of modules, unusual smells, sounds such as hissing or popping, and the status of any off-gas, smoke or heat detection. Any sign of physical damage, swelling or a smell around a lithium-ion battery should be treated as a possible precursor to thermal runaway and reported immediately rather than investigated by opening the cabinet.

Second-life and mixed batteries

A few operators and suppliers have experimented with second-life batteries, such as retired electric vehicle packs, for backup or energy storage. These batteries have unknown histories, mixed states of health and sometimes BMS designs not intended for stationary use. Mixing modules of different ages or from different production lots in one string can also create imbalance. Any use of second-life or mixed batteries in a critical facility should be treated as a significant change, requiring the manufacturer's approval, a hazard analysis and, where the fire code applies, listing to UL 9540 and the corresponding UL 9540A data.