CET 96 DOI: 10.3303/CET2296031 Paper Received: 30 November 2021; Revised: 14 July 2022; Accepted: 30 July 2022 Please cite this article as: Soffientini L., Chiusolo C., Gotti M., 2022, Lithium-ion Batteries: Analysis of Intrinsic Hazards and Evaluation of Minimum Safety Requirements Through Risk Assessment of Storage and Testing Installations, Chemical Engineering Transactions, 96, 181- 186 DOI:10.3303/CET2296031 CHEMICAL ENGINEERING TRANSACTIONS VOL. 96, 2022 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: David Bogle, Flavio Manenti, Piero Salatino Copyright © 2022, AIDIC Servizi S.r.l. ISBN 978-88-95608-95-2; ISSN 2283-9216 Lithium-Ion Batteries: Analysis of Intrinsic Hazards and Evaluation of Minimum Safety Requirements through Risk Assessment of Storage and Testing Installations Lorenza Soffientini, Cristina Chiusolo, Mauro Gotti DEKRA Italia s.r.l., Process Safety Business Unit, Via Fratelli Gracchi 27, 20122 Cinisello Balsamo (MI) lorenza.soffientini@dekra.com Nowadays the demand for lithium-ion battery technology is continuously growing (The European Association for Advanced Rechargeable Batteries, 2013), above all for e-mobility: cells with lithium ion-based chemistries have proven to be most suitable for providing energy in an electrified car with a traction motor (EUCAR, 2019). For this reason, it is fundamental that these devices are proved to be safe. To produce and put on the market this type of product, it is of paramount importance to be aware of current battery testing methods and good practices to ensure safe use and storage. Nevertheless, it is always necessary to carry out risk analyses to verify that the systems implemented fit every single industrial reality. In this article, the mode of operation of generic lithium batteries, which, due to their intrinsic nature, present some risks such as chemical and/or electrical, is first analysed. Following, a brief description of the current technologies for conducting performance tests of Lithium-ion batteries is illustrated, with particular reference to testing facilities. This article aims to demonstrate that every risk associated with the production, use, and storage of lithium batteries inside climatic chambers facilities which must have minimum design requirements for safety devices and systems (such as Fire&Gas detection system, smoke detectors, etc.), is properly addressed through risk assessment analysis such as HAZard Identification (HAZID), Reliability Analysis, and Layers of Protection Analysis (LOPA). Three methodologies of risk analysis (HAZID, Reliability Analysis, and LOPA) are discussed more in detail: every type of safety assessment addresses different problems and should be applied in accordance to what is the goal of the analysis. In detail, it is shown that HAZID methodology is more suitable when it is the overall working area to be investigated (for example, shifts, working conditions, authorized accesses, etc.). Reliability analysis shows its strength when it comes to assessing the presence and the proper dimensioning of a utility network or process equipment. Last, the LOPA analysis allows understanding which is the minimum Safety Integrity Level (SIL) level a single safety loop of each equipment should be marked with allocated. Finally, through the analysis of different case studies, it is demonstrated that the combination of the minimum safety requirements identified, along with the application of risk analysis, are valuable means to properly manage the risk related to lithium-ion batteries. 1. Introduction Nowadays, lithium-ion batteries are used in a wide range of applications, starting from portable and static chargers to the field of the so-called e-mobility. In particular, it is observed that the demand for lithium-ion battery technology is continuously growing (The European Association for Advanced Rechargeable Batteries, 2013). Lithium-ion batteries are having great success because of their energy and power density which make this technology the most suitable for providing energy in an electrified car with a traction motor (EUCAR, 2019). Furthermore, it is quite unlikely that there will be a lithium shortage soon (Gruber et al., 2011, Speirs et al., 2014). As the number of applications in which lithium-ion batteries are used continues to grow, it is important that they are intrinsically safe. In this article, the focus is precisely on the bases of safety to be applied during battery testing: although tests must be carried out in CE-certified machines (which requires the manufacturer to 181 provide them with a risk analysis), the risks of the machines are not always properly addressed in view of the interfaces they have with the testing site, with other machines and with operators. It is for this reason that this paper proposes the original approach of applying three traditional types of risk analysis to complete and integrate the manufacturers' assessments and to enable battery testing to be carried out safely. 1.1 Lithium-ion based batteries description The technology behind lithium-ion batteries (LIBs) is the same as that of more traditional batteries: lithium is dispersed within the cathode and its ions flow through the electrolyte to the anode during the charging process (during the discharging process, lithium ions follow exactly the reverse path). The reactions that occur at the electrodes are configured as oxidation-reduction reactions, and these causes the oxidation of transition metals present in the cathode (Co, Ni, Mn) and the reduction of the anode. At the construction level, usually, the electrodes are separated by a separator to prevent physical contact and avoid a short circuit. The two electrodes are associated with current collectors (aluminium for the cathode and copper for the anode) to facilitate the movement of electrons from the cell to the circuit, preventing unwanted reactions at the electrodes. The materials used for the cathodes and the anodes are selected at the manufacturing level on the basis of the performances required for the battery: some parameters are the reaction surface, the mechanical stability, the rate of ion transport in the electrolyte, the formation of passivation layers on the electrode surfaces and the control of the solubility of the active materials as well as of the decomposition products (Nitta et al., 2015). The cathode is the battery component with the highest number of alternatives in terms of chemical composition, so LIBs are classified according to the composition of the cathode. Some examples can be LCO (lithium cobalt oxide batteries, LMO (lithium manganese oxide) batteries, etc. The types of anodes most commonly used in commercial lithium-ion batteries are graphite and LTO (lithium titanium oxide). As for the electrolyte, it is typically liquid and soaks all the batteries components: it is usually made of highly flammable electrolytes, corrosive, and toxic components (Levy and Bro, 1994, Lebedeva et al.,2015). 1.2 Risks related to lithium-ion based batteries The risks related to the use, storage and testing of batteries consist of two main factors: the intrinsic nature of the accumulator and the surrounding environment that may contain potential sources of ignition and/or factors that could promote the propagation of flames/toxic cloud. The criticality of lithium-ion batteries is increased during the testing phase, which is the focus of this paper, because it is not possible to know in advance the behaviour of the batteries to external environmental stresses, and therefore it is not possible to identify the operating range to work safely (e.g. range of temperatures, applied current, humidity, etc.) within which the batteries can work in stable and safe conditions. Again, in the testing environment, the choice to test only some types of batteries (with a certain type of safety design) is not representative for the purposes of this discussion: since it is likely that accidental scenarios will occur – as batteries are pushed to their limits in order to estimate the operability ranges – it is necessary to investigate the options of mitigation strategies. The hazards posed by lithium-ion batteries are of different types (ENEA, 2020): • physical: depending on the energy stored and the type of abuse suffered by the battery, deformation of cells/batteries or explosion with a projection of fragments may occur; • thermal: there may be a decomposition/loss of mechanical/electrical/electronic stability of the battery with consequent initiation of a runaway reaction with the production of heat (thermal runaway), and explosion; • chemical: an abuse/accidental event can cause the emission of corrosive and toxic substances; • electrical: operations above certain voltages may produce electric shock or electrocution. Except for the release of corrosive and toxic substances, all of the hazards listed above can lead to the ignition of fires due to the so-called thermal runaway process. The thermal runaway, although studied extensively, is not yet adequately characterized (Chen et al., 2020). It is essentially a fugitive reaction consisting of three phases: the preheating phase, the exothermic stage, and the cooling stage. During the preheating phase, the battery responds to the thermal stimulus by increasing its own temperature in the cells; subsequently – once the instability condition is reached – the real fugitive reaction starts and finds its end during the cooling phase. The temperatures at which the decomposition reactions take place depend strongly on the materials used. Considering that the most common material used as an anode for batteries is graphite, the temperatures at which batteries enter their unstable range are between 57 and 60 °C (Jonathan, 2020). During the exothermic phase, complex chemical and physical processes occur: the electrodes may decompose; burn or ejection of some parts of the battery may occur (Chen et al., 2020). 182 2. Testing facilities Endurance and ageing tests on lithium-ion batteries are carried out in so-called climatic chambers which are enclosures where climatic conditions are reproduced. The chambers can have different sizes and features according to the test they are going to hold; for the sake of this discussion, only climatic chambers with watertight reinforcement that can be isolated by sectioning are considered. During the testing phases, the objective of the tests is to stress the batteries by subjecting them to external stimuli that could damage them. In fact, the goal of the tests is to verify if physical and chemical phenomena can influence the performance of the batteries and their safety. Currently, there are several types of chambers on the market such as: • thermostatic chambers, in which only temperature cycles (extremely high or extremely low) are carried out; • climatic chambers, in which environmental conditions are simulated more accurately, considering other factors such as humidity (adjustment with water vapor) and altitude (adjustment of chamber pressure); • sand/dust test chambers that can reproduce all the conditions included in the dedicated standards that require continuous ventilation, dust drop tests and tests with an irregular whiff of compressed air; • vibration test chambers that perform various test conditions with both vertical and horizontal vibrations, produced by a shaker. The battery is positioned on a plane in contact with the shaker and the overall system is surrounded by fixed or mobile walls; • corrosion test chamber where salty fog is sprayed by means of atomizing nozzles. The salt solution is collected by a reservoir and supplied with conditioned compressed air. 3. Risk analyses Along with the proper design of the environments/facilities in which tests are conducted, it is important to have risk analysis assessments to verify that all issues are properly addressed. Risk analyses should be conducted just after the early-stage design, so that any additions to the adopted basis of safety can be applied with relatively little cost. 3.1 HAZID (UNI EN ISO, 2010, ISO, 2016) The overall intent of a HAZard IDentification study (HAZID) is to assist in demonstrating that the risks associated with all the identified hazards shall be managed during the whole activity and will be reduced to an acceptable level by: • checking the general design for project development and consider whether any external or internal cause may generate a hazard to people working on the installation and/or to the general public and/or damage to the assets and/or impacts on environment or reputation; • checking whether the precautions and safeguards incorporated in the project development are sufficient to either prevent the hazard occurring or mitigate the severity of any consequence to an acceptable level; • identifying and implementing additional precautions or safeguards to manage all the hazards not sufficiently considered during the design phase. The HAZID may be accounted as a structured brainstorming of potential hazard scenarios using a comprehensive set of guidewords. For each potential hazard that is identified, the specific threat (or cause) and its associated consequences are derived. Recommendations for reducing risks are identified during the brainstorming, accordingly to the expected level of risk and the applied risk management process. 3.2 Reliability analysis (IEC, 2016) To assess the reliability of the utilities (such as nitrogen, compressed air, etc.) used during the normal test execution to allow the test and to enhance its safety, the HAZard OPerability analysis (HAZOP) appears to be the most suitable to be applied. The technique is used for the systematic and detailed examination of the availability of utilities during the testing phase. It identifies potential operability hazards linked to the system, such as the causes of operational and production deviations that could lead to dangerous situations. Deviations from design intentions are identified using a set of guidewords. The HAZOP, using an experience-based approach, should be a reinforcement of the design phase rather than a substitute for it. 3.3 Safety functions analysis (IEC, 2016, ISO 2006) For a plant and facility, it is necessary to verify that the level of reliability of the safety instrumented functions ensures that they are within the established risk tolerance limits. The Layers of Protection Analysis (LOPA) is a methodology used to estimate the risk related to a specific scenario more quantitatively than the initial risk 183 ranking obtained in risk analyses. Usually, the LOPA is carried out following a HAZOP analysis: the barriers identified in the HAZOP are analysed in the LOPA in detail in order to understand if any minimum level of SIL is required. Nevertheless, a LOPA analysis can also be carried out following a HAZID if risk analyses are conducted at an early stage of design. This type of analysis is applied to verify if there are sufficient layers of protection to prevent the scenario or/and if their reliability is sufficient to mitigate the consequences of hazardous events. If additional risk reduction is required and if it is to be provided in the form of a Safety Instrumented Function (SIF), the LOPA methodology allows the determination of the appropriate Safety Integrity Level (SIL) for the SIF. According to IEC 61508 and 61511, the allocated SIL levels imply requirements in terms of loop architecture integrity and in terms of the maximum allowed PFD (Probability of Failure on Demand) of the safety interlocks. 4. Application examples 4.1 Example 1 – HAZID The HAZID technique, as already explained, is typically used to carry out a general risk analysis. The assessment does not focus on process deviations but gives a broader idea of the generic risks that may be encountered during the activity (starting from the ergonomics of the machines to the verification of the presence of alarms and safety systems). The added value that can be brought by this analysis consists in the chance to check if the entire plant is equipped to manage the risks deriving from each installed testing machine or process plant. For example, if in a plant it is planned the operation of a vibration test chamber, it will be important not only to verify that the chamber is able to withstand the vibrations (which is a piece of information that, however, must be confirmed by the manufacturer), but it will be also necessary to understand if the other chambers can withstand the residual vibration spreading on the site and if they affect the operators somehow. The experience gained from the study of the installation of testing facilities allows us to note that any criticalities detected on a single machine are not always contextualized at the level of the entire plant (up to the battery limits) and, consequently, are not properly addressed. In view of the above, it is recommended to focus on the following factors that could be arisen during a HAZID session: • have an idea of the frequency of occurrence of a thermal runaway in consideration of the progress of the testing steps (last test before sale or first prototype tests), historical analysis and site experience: this allows to verify that the barriers applied are effective and in the correct number to reduce the risk to a tolerable level; • provide adequate spacing between testing facilities. If this is not possible due to space constraints, consider installing dedicated sensors to monitor oxygen (due to nitrogen loss of containment) and hydrocarbon levels in spaces accessible to operators but still restricted and poorly ventilated; • provide operating procedures for maintenance of testing facilities including a Lock Out/Tag Out (LOTO) procedure; • prevent battery re-ignition by providing a containment pool in the testing machine: batteries are suggested to be fully submerged by water and completely protects from the chance of re-ignition after an accidental scenario; • prevent short circuits due to improper battery storage: provide special blankets to avoid the accumulation of dust that can form electrical bridges. Preferably store batteries in dedicated rooms that can be confined; • do not discharge process water directly into the sewage system: based on the batteries tested, make a rough estimate of the composition of the effluent and contain it in a dedicated drainage pit which should be emptied and reclaimed regularly; • check that the environment in which the operators work is safe from the point of view of ergonomics, noise, magnetic fields, etc. produced by the machines. 4.2 Example 2 – Reliability analysis The reliability analysis (HAZOP) allows for identifying the process deviations that can evolve in accidental scenarios by hazard identification. Utility networks are essential to conduct any plant, in case of any failure or malfunction of a part of air compressed, nitrogen, cooling water, demi water networks (or similar), is fundamental to manage the potential failure and to lead the plant to safety arrangement. A deep analysis of the utilities network allows to control the hazard and mitigate the magnitude of the consequences; typical issues originated by reliability studies of this useful part of a plant are: check of the presence of protection against reverse flow of machines, the correct position of manuals isolation valves, useful alarms of the machine to send a signal to control panel, verification of design conditions of piping of all network related to maximum pressure and 184 temperature that could arise in the studied distribution net. Most of the time, every single machine is designed by a singular vendor, so the hazards identification of interface conditions between the plant and each piece of equipment is essential to identify potential situations that can lead to accidents. Using reliability analysis is possible to recognize all potential hazards. So, from our experience in applying HAZOP methodology for utility network of testing chambers, it is possible to say that, generally, the minimum safety requirements related to utility network serving climatic chambers plant are: • the reliability analysis is strongly recommended for all utility services of a plant; • the reliability analysis should be performed in the presence of the vendor of the specified network; • control panels of the singular unit should communicate with each other; • all machines own protection should be known by the designer and by the end-user of the climatic chambers plant; • maintenance issues should be analysed and manual valves or maintenance procedures checked and implemented if it’s the case; • all signals from each transmitter should be taken into consideration and should be verified if a specific signal should be equipped with low/high alarms; • the reliability of firefighting system configuration should be verified before and after discharge. in case of lack of instrument air or electrical power, the configuration of pneumatic or electrical valves of the installation should be analysed in detail because the climatic chamber must be safely shut down during an emergency. 4.3 Example 3 – Safety function analysis It is recommended to perform the safety functions analysis to verify that a proper safety architecture is adopted in the plant and to establish the minimum reliability level of the control loops and any instruments installed on climate chambers. Although the reliability analysis does not usually apply to process control systems without any specific safety functions, manual switches, manual valves, and manual alarms, it is noted that the facilities where battery performance/aging/resistance tests are performed are still very dependent on manual actions, beginning with the setting up of the specimen inside the chamber and ending with its removal at the end of the test. Although the intervention of the operator cannot be evaluated as part of the “chain of safety functions" as originally meant by the methodology (IEC, 2016, ISO 2006), manually activated buttons/instrumentation and sensors can be studied anyway, while the operator errors are not included in the evaluation. By the performance of several reliability analyses, it is possible to outline some minimum safety requirements: • since it is not always possible to promptly intervene by sinking the Device Under Test (DUT) in dedicated basins, it is recommended to add in the operative procedure a buffer time before the operator enters the chamber. The buffer time will be established according to the experience and statistics related to the chance of batteries to re-ignite; • provide the operators working in the chambers with a personal detector; • to avoid an incorrect detection of the oxygen level in the chamber (formation of an air pocket in the proximity of the sensor), perform a complete washing of the chamber (compressed air), defining a priori the timing associated with this operation (not relying completely on the oxygen sensor); • introduce an operating procedure with a checklist to be followed before opening any climatic chamber: this would add a layer of protection. 5. Conclusions Seen the current development of the lithium battery (Liu et al., 2001), it is necessary to apply tools that allow investigating the safety of the batteries themselves and the testing facilities where they are tested. To do this, it is suggested to apply three different types of risk assessment depending on the objectives set. The application of the HAZID technique is adequate to understand at a general level if the operations of the testing machines affect the activity or the integrity of other machines and the health of the operator, an aspect which is not present in the risk analysis provided by the manufacturers of the single machines. Since the reliability analysis is more structured than HAZID, it can be applied to different types of systems and processes that can be represented by a logic and schematic way, such as the schemes related to the utilities of the site. The added value of this technique is that it allows achieving an exhaustive hazard identification and analysis of the machine-utility network interface, which is not investigated by the vendors of the single plants and/or machines. Finally, the safety functions reliability analysis allows verifying or establishing the minimum level of reliability of the safety function of safety loops. The experience of the joint application of the three above-mentioned risk analyses has 185 allowed outlining some safety requirements that are considered minimal for the safe operation of the climatic chambers and the surrounding working environment: • provision of portable sensors or deployment in unventilated environments; • adoption of strategies to avoid battery re-ignition (containment pools, blankets, operative procedures); • installation of alarms associated with the service and operation of climatic chambers; • drafting of emergency procedures for the management of accidental events and to ensure the safe shutdown of machines; • drafting of operating procedures that increase the level of reliability of safety loops. In conclusion, although the application of at least these outlined parameters, together with an accurate design, can reduce the level of risk to tolerable levels, it is considered likely that in the future new battery technologies will be developed; for this reason, seen the demonstrated contribution provided by the risk analyses, it is recommended to apply them to identify potential new risks and any lacks in the safeguards in the view of continuous improvement. References Chen H., Buston J. E.H., Gill J., Howard D., Williams R.C.E., Rao Vendra C. M., Shelke A., Wen J. X., 2020, An experimental study on thermal runaway characteristics of lithium-ion batteries with high specific energy and prediction of heat release rate, Journal of Power Sources, 472, 228585, DOI: 10.1016/j.jpowsour.2020.228585 ENEA (Agenzia nazionale per le nuove tecnologie, l’energia e lo sviluppo economico sostenibile), 2020, Rischi connessi con lo stoccaggio di sistemi di accumulo litio-ione, accessed 04.01.2022 EUCAR, 2019, Battery requirements for future automotive applications accessed 04.01.2022 Gruber P.W., Medina P.A., Keoleian G.A., Kesler S.E., Everson M.P., Wallington T.J., 2011, Global Lithium Availability, Journal of Industrial Ecology, 15, 760-775, DOI: 10.1111/j.1530-9290.2011.00359.x IEC 61882:2016 (2016), Hazard and operability studies (HAZOP studies) - Application guide, Geneva IEC 61511:2016 (2016) – Functional safety – Safety instrumented systems for the process industry sector, Geneva ISO 13849:2006 (2006), Safety of machinery – Safety-related parts of control systems, Part 1: General principles for design, Geneva ISO 17776:2016 (2016), Petroleum and natural gas industries – Offshore production installations – Guidelines on tools and techniques for hazard identification and risk assessment, Geneva Jonathan A., 2020, Review of polymers in the prevention of thermal runaway in lithium-ion batteries, Energy Reports, Volume 6, Supplement 5, 217-224, DOI: https://doi.org/10.1016/j.egyr.2020.03.027 Lebedeva N., Ruiz V., di Persio F., Kriston A., Pfrang A., Kosmidou T., Ungeheuer J., Dams D., Brett L., 2015, Evaluation of volume of free electrolyte in various cell types – method and preliminary results, accessed 15.07.2022. Levy S.C., Bro P.,1994, Battery hazards and accident prevention, Plenum Press, New York and London, United States of America and United Kingdom Liu Y., Zhang R., Wang J., Wang Y., 2001, Current and future lithium-ion battery manufacturing, iScience 24, DOI: 102332, 10.1016/j.isci.2021.102332 Naoki N., Wu F., Jung Tae Lee, Gleb Yushin, 2015, Li-ion battery materials: present and future, Materials Today, 18, 252-264, ISSN 1369-7021, DOI: 10.1016/j.mattod.2014.10.040 Pacala S., Socolow R., 2004, Stabilization Wedges: Solving the Climate Problem for the Next 50 Years with Current Technologies, Science, 305, 968-972, DOI: 10.1126/science.1100103 Speirs J., Contestabile M., Houari Y., Gross R., 2014, The future of lithium availability for electric vehicle batteries, Renewable and Sustainable Energy Reviews, 35, 183-193, DOI: doi.org/10.1016/j.rser.2014.04.018 The European Association for Advanced Rechargeable Batteries, 2013, Safety of lithium-ion batteries, RECHARGE aisbl, Avenue de Tervueren, 168. B-3. B-1150 Brussels, Belgium UNI EN ISO 12100:2010 (2010), Sicurezza del macchinario, Principi generali di progettazione, Valutazione del rischio e riduzione del rischio, Geneva 186 79soffientini.pdf Lithium-Ion Batteries: Analysis of Intrinsic Hazards and Evaluation of Minimum Safety Requirements through Risk Assessment of Storage and Testing Installations