Safe battery pack design starts from an uncomfortable premise: across enough cells, one will eventually fail, and you cannot fully prevent it. The packs that stay safe in the field aren't the ones that pretend otherwise. They're the ones built so that a single failure has nowhere to go.
That premise is the whole philosophy. Safety isn't one clever safeguard, it's layers of them, each independent of the others, arranged so that when one is defeated the next still holds. Engineers call it defense in depth, and it's also the right lens for anyone choosing a supplier: the question to ask isn't "is this pack safe," it's "how many independent things have to fail before it isn't."
Here's how the layers stack up, and where each one quietly gets compromised.
Defense in Depth, and Why One Safeguard Is Never Enough
Anyone who tells you a single safeguard is enough hasn't read enough failure reports. Every protective measure has a failure mode of its own. A sensor can read wrong. Firmware can hang. A MOSFET can fail shorted, which means a switch you were relying on to open stays closed at the worst possible moment.
The most dangerous assumption in pack design is that the BMS will catch everything. It catches a lot, and it's essential, but it's electronics, and electronics fail. A serious design never puts the entire safety case on any one component, least of all one that runs on code. Each layer below exists precisely because the layer next to it can let you down.
What Causes Thermal Runaway
Thermal runaway is the failure everything else is built to prevent. It's a self-sustaining exothermic reaction: once a cell gets hot enough, it starts generating heat faster than it can shed it, the temperature climbs on its own, the cell vents flammable gas, and the energy stored in it comes out fast. Left unchecked in a multi-cell pack, one cell's runaway can heat its neighbors until they follow.
A handful of triggers put a cell there:
- Overcharge, pushing voltage past the cell's limit until the chemistry breaks down.
- External short, dumping current through a fault.
- Internal short, from a manufacturing defect or a dendrite growing inside the cell.
- Mechanical damage, a crush or puncture that shorts the layers internally.
- Over-temperature from the outside, often a thermal-management failure.
Most of these you can design against directly. The internal short is the hard one, because it begins inside the cell where no external protection can reach it. You can lower its odds with good cells and good charging, but you can't drive it to zero. Hold that thought, because it's the reason the last layer matters as much as the first.
Layer 1: The Cell, Where Safety Begins and Is Quietly Compromised
Safety starts at the cell, and so does a lot of avoidable risk.
Chemistry is the first lever. LFP is intrinsically more thermally stable than the nickel-rich oxide chemistries and tolerates more abuse before it becomes dangerous, which is one reason it's chosen for applications where safety leads. (We compare the chemistries in a separate guide.) Modern cells also carry built-in safety features: a current-interrupt device that disconnects on overpressure, a PTC element that limits current as the cell heats, a vent that relieves pressure in a controlled way, and a shutdown separator that melts closed to stop ion flow before things escalate.
But the part that gets compromised is upstream of all that: cell sourcing and grading. A pack is only as safe as the cells it's built from, and a surprising share of field failures trace back to cells of unknown provenance, mixed grades, or strong and weak cells thrown into the same pack. Cells that aren't matched age unevenly, and uneven aging concentrates stress on the weakest cell. Buying on price alone, or skipping incoming inspection and grading, is where safety problems are designed in long before anyone welds a tab. This is not the place to cut corners, and it's the first thing worth probing about any supplier.
Layer 2: Electronic Protection, and Its Limits
The BMS is the active layer. It watches every cell's voltage, the pack current, and temperature, and it intervenes on overvoltage, undervoltage, overcurrent, short circuit, and over- or under-temperature. Specified properly, it's the safeguard doing the most work in normal operation. (We cover how to specify one in detail elsewhere.)
The mature move is to not stop there. Because the BMS can fail, serious packs add independent secondary protection: a separate overvoltage-protection circuit, for instance, that will disconnect even if the main BMS misses it. The point is redundancy. You don't want a single firmware bug or a single failed component to be the only thing standing between a charging fault and an overcharged cell. Two independent protections that have to both fail is a very different risk profile from one.
Fusing: The Dumb Safety That Always Works
Every layer so far depends on something working: a sensor reading correctly, firmware behaving, a transistor switching. Fusing is the layer that depends on nothing. A fuse is a deliberate weak point, sized to open and break the circuit when current goes somewhere it shouldn't. No power, no sensing, no code. It just works, and that's exactly why every serious pack has it.
Two levels are worth distinguishing.
A pack-level main fuse protects against gross overcurrent or an external short, opening the main path before the fault energy does damage. Its interrupt rating has to exceed the largest fault current the pack can deliver, which for a big pack is substantial. Undersize that rating and the fuse can fail to clear the fault, which is worse than having no fuse at all.
Cell-level fusing is what separates a thoughtful design from a basic one. Picture a single cell in a large parallel group developing an internal short. With nothing to stop it, every other cell in that group pours its energy into the shorted one, feeding the fault and the heat. A fusible link on each cell, a deliberately thin section of the interconnect, lets that one cell disconnect itself before it drags the group down with it. It's a small feature that changes how a single-cell failure plays out.
Fuse selection is a coordination problem. The fuse has to be invisible to the pack's normal peak currents so it doesn't nuisance-trip, while still opening fast on a genuine fault. Miss that window in either direction and you've built either a pack that trips on hard load or one that doesn't protect when it counts.
Layer 4: Mechanical and Structural
Not all hazards are electrical. The pack's physical construction is a safety layer in its own right.
The enclosure has to protect the cells from crush, puncture, and the vibration and shock of real service, because mechanical damage is one of the runaway triggers. Cell spacing and isolation reduce both heat coupling and the chance of one failure reaching the next. Insulation and adequate creepage and clearance distances matter as voltage climbs. And the interconnects deserve specific attention: a poor weld is both a hot spot and a reliability risk, and a high-resistance joint can heat a perfectly good cell until it isn't one. Construction quality is safety, not just finish.
When a Cell Goes Anyway: Containing Propagation
Here's the part mature design gets right and optimistic design skips. You cannot fully prevent the internal short. Across a large enough population of cells, a latent defect or a slow dendrite will eventually put one cell into runaway no matter how good your protection is, because that failure starts where no external safeguard can reach.
So the serious question isn't only "how do we keep a cell from failing." It's "when one does, does it take the pack with it, or does it stay a one-cell problem."
Containing propagation means denying that first failure a path to its neighbors. The tools are mostly physical: thermal barriers between cells, using materials like mica or aerogel that slow heat transfer; spacing that buys time; fire-resistant enclosure materials; and deliberate venting design that routes the hot, flammable gas a failing cell ejects out of the pack and away from the surrounding cells rather than into them. A pack that channels a single cell's vent safely overboard behaves very differently from one that lets it cook its neighbors.
This is where a tension from thermal design resurfaces. Good thermal management wants cells coupled so heat spreads and temperatures even out. Propagation containment wants them isolated so a failure stays put. Both can't win, and the design has to pick a deliberate point on that trade, usually materials that conduct heat in normal operation but resist a runaway front in a fault. (We dig into the thermal side of that trade-off in its own piece.)
Proving It: Abuse Testing and the Paper Trail
You don't get to declare a pack safe. You demonstrate it, and the way you demonstrate it is by abusing it on purpose.
Real validation means subjecting the pack to the failure modes it's supposed to survive: overcharge, external short, crush, penetration, over-temperature, vibration and shock. Recognized standards put structure around this. UN 38.3 governs what a pack must pass to ship. IEC 62133, and UL 2054 or UL 1973 depending on the application, define safety test regimes for cells and packs. Passing them isn't a marketing badge, it's evidence that the design behaves the way it's meant to when pushed past normal.
Behind the abuse tests sits the quieter half of safety: the production process. Incoming cell inspection. Cell matching and grading, so a pack isn't a mix of strong and weak cells. Insulation and hipot testing to catch shorts before they ship. Capacity and internal-resistance screening. Traceability, so that if something does go wrong, every pack from the same batch can be found. None of this is glamorous, and all of it is where field safety is won or lost.
If you're sourcing a pack and want to know whether a supplier takes safety seriously, this is the part to press on. Ask what abuse testing the design has passed and to which standards. Ask how cells are sourced, graded, and matched. Ask whether there's traceability back to the batch. A supplier doing this work can show you the evidence. The absence of an answer is itself an answer. (We cover the certification side of this in a dedicated guide.)
How We Approach Safety
At PackForge Energy, we design to defense in depth rather than to any single safeguard. In practice that means cells sourced and graded for quality and consistency, a BMS backed by independent secondary protection, fusing at the pack and, where the architecture calls for it, the individual cell, propagation containment built into the mechanical design, and validation against recognized abuse-test standards with the traceability to stand behind it. We start from the assumption that a cell can fail, and we build so that when one does, it stays a one-cell problem.
One Last Thought
The thread through all of this is a single shift in mindset. Optimistic design asks how to keep every cell from ever failing. Mature design assumes one eventually will, and makes sure that when it does, it has nowhere to go.
So that's the question I'll leave you with. When you evaluate a pack, your own or a supplier's, what's the one safety layer you treat as non-negotiable, and what's the corner you've seen cut that still bothers you? The shorted cell that took out a whole module because nobody fused at the cell level, the "we'll catch it in firmware" that didn't, the abuse test quietly skipped to hit a ship date? Put it in the comments. We all build safer packs when these stories don't stay private.