This chapter addresses the third of the four ESS axes — safety and fire prevention. Even when cells (Chapter 2) and the BMS/PCS (Chapter 3) operate correctly, life and property cannot be protected without adequate fire barriers, separation distances, and suppression equipment. This chapter integrates UL 9540 and UL 9540A:2024 testing from Underwriters Laboratories, NFPA 855:2023 installation standards from the National Fire Protection Association, and the KESCO ESS Fire Safety Standard (2024 revision).
"The party that pays the highest tuition teaches the deepest lesson" — this aptly describes Korea's experience with the 23 ESS fires of 2017–2019, contrasted with only six total fires from 2020 onward. That dramatic reduction is the empirical validation of the principle of simultaneous compliance across the chemistry, BMS, PCS, and safety axes. This chapter operationalizes that principle on the safety axis.
Thermal runaway (THERMAL_RUNAWAY) is the most dangerous failure mode of lithium secondary batteries. Once internal cell temperature exceeds a critical point (approximately 270℃ for LFP, 200℃ for NMC), oxygen release from the cathode, separator melting, and electrolyte decomposition begin to proceed in chain reaction, making the cell itself a self-sustaining heat source. The process cannot be arrested by external cooling alone; ultimately the cell ruptures explosively and ejects flame.
Thermal runaway has four main trigger causes: (1) internal short circuit — direct anode-cathode contact through foreign particles or separator damage; (2) external short circuit — accidental short across external terminals; (3) overcharge — exceeding the charge voltage limit; and (4) external heating — heat transfer from adjacent cells or external fire.
The 2020 ESS Thermal Runaway Incident Analysis jointly published by KETI and KERI shows that 18 of the 23 fires originated from internal or external short circuits, while five originated from overcharge or external heat. The cell tests (Chapter 2) and BMS protections (Chapter 3) defined in this standard are designed to interrupt all four of these triggers.
UL 9540A:2024 evaluates thermal-runaway fire propagation in an ESS. The test proceeds in four levels:
The pass criterion at each level is "no propagation to the next higher level." If thermal runaway in a single cell does not propagate to adjacent cells in the module, the module-level test is considered passed. The Anchored tier of this standard requires passing all four levels.
UL 9540A testing is performed at accredited laboratories including UL Solutions, CSA Group, and KERI. In Korea, KERI's Changwon test center received UL 9540A accreditation in 2023, allowing Korean operators to obtain U.S. certification through tests conducted at KERI.
NFPA 855:2023 comprehensively defines installation requirements for stationary ESS:
NFPA 855:2023 was revised in 2024 to directly connect to UL 9540A:2024. If UL 9540A testing demonstrates no fire propagation, NFPA 855's maximum capacity and separation requirements can be relaxed. This standard formalizes that connection via cross-walk, allowing Korean operators to use UL 9540A test results as the basis for NFPA 855 design.
Since the 2019 ESS Safety Reinforcement Plan, KESCO has evolved a Korea-specific ESS fire safety regime. The 2024 revision includes:
KESCO is stricter than NFPA 855 in certain areas (separation distance, indoor capacity). This standard makes these differences explicit via cross-walk, providing a trace matrix that allows global operators entering the Korean market to also satisfy NFPA 855 and UL 9540A by meeting KESCO.
The 47-item KESCO pre-use inspection had a 92% pass rate in 2024. The leading reasons for failure were inadequate fire barriers (34%), inadequate BMS-PCS communication tests (23%), incorrect suppression specifications (19%), missing gas sensors (14%), and inadequate ventilation design (10%). The safety-axis recommendations in this standard directly reflect these failure patterns.
OFF_GAS refers to flammable gases released immediately before cell thermal runaway, and is the key signal for early warning. When cell temperature reaches 80–120℃, decomposition of the SEI layer produces H₂, CO, CH₄, and C₂H₄. This is the "pre-thermal-runaway phase"; if gas detection triggers PCS shutdown, suppression activation, and personnel evacuation immediately, the incident can be interrupted before fire develops.
This standard mandates OFF_GAS monitoring for GRID_SCALE, UTILITY, and COMMERCIAL_INDUSTRIAL applications. Detection equipment must simultaneously detect H₂, CO, and VOC and notify the BMS, PCS, and suppression system within 100 ms of detection. KERI standardized the OFF_GAS detection algorithm in Korea, and this standard adopts the KERI algorithm as recommended practice.
The effectiveness of OFF_GAS detection is borne out by analysis of the 23 Korean ESS fires: 17 of the 23 incidents were accompanied by gas evolution 30 minutes to 6 hours before the fire phase, and 12 incidents could have been interrupted before fire onset if gas detection had been operational. The OFF_GAS monitoring mandate is the direct consequence of this analysis.
The LARGE_SCALE_FIRE_TEST is the installation-level final step of UL 9540A. An actual ESS container or module group is deployed in the test arena, thermal runaway is artificially induced, and fire-spread behavior, heat release, gas composition, and temperature distribution are comprehensively evaluated. The test typically lasts 4–8 hours at a cost of $100,000–$500,000.
KERI in Korea operates a LARGE_SCALE_FIRE_TEST facility, accredited for UL 9540A in 2023. Korean operators using KERI can obtain certification for the U.S., European, and Japanese markets simultaneously. KERI preserves test outputs as video, thermal imaging, and gas-analysis data, all of which can be integrated into the Anchored-tier manifest under this standard.
ARC_FLASH is another major hazard at high-voltage ESS sites. A short circuit at the 1,500 V DC level can produce a multi-thousand-degree arc, causing severe burns, blindness, or hearing damage to personnel. NFPA 70E and IEEE 1584 define arc-flash hazard assessment and protective-equipment requirements.
This standard requires: (1) operator use of PPE matched to the arc-flash hazard category; (2) ESS cabinet designs that do not eject flame in an arc-flash event; (3) lowering of ESS output to zero and activation of a maintenance mode in the BMS and PCS during service; and (4) recording of the arc-flash hazard assessment in the manifest.
In Korea, the Occupational Safety and Health Act enforcement rule specifies arc-flash protection, and the Korea Occupational Safety and Health Agency (KOSHA) certifies protective equipment. This standard recommends KOSHA-certified equipment.
Of the 23 fires from 2017–2019, nine were directly attributable to safety-axis defects: inadequate fire barriers (3), inadequate ventilation (2), suppression system not activated (2), missing gas detection (1), and inadequate separation distance (1). All nine predated the introduction of KESCO pre-use inspection in 2019.
KESCO synthesized the safety-axis findings from the 23 fires into the 2024 revision of the ESS Fire Safety Standard. The two cornerstones of the revision are mandatory gas detection and module-level automatic suppression. This standard mandates both for every GRID_SCALE and UTILITY application.
Another lesson is the human factor. Some incidents began with installer carelessness (cable crushing, loose fasteners) or operator dismissal of alarms. The manifest preserves construction and operations history in tamper-evident form, enabling post-incident attribution and learning.
The response to an actual ESS fire differs from that of a conventional fire. The principle is "do not attempt unaided suppression": lithium-cell fires carry their own heat source and are frequently impossible to extinguish externally. Instead, "isolate and wait for self-burnout" is recommended; once the fire is contained within a barrier and not propagating to adjacent modules, the typical self-burnout period of 4 to 24 hours is observed.
The Korea National Fire Agency revised its ESS Fire Response Manual in 2024 to codify these principles. This standard aligns with that manual so that firefighters, operators, and workers follow the same procedure. The manual also mandates the use of respiratory protection against toxic gases (HF, HCl, CO) generated during ESS fire suppression.
KFPA's 2024 ESS Fire Risk Assessment Guide offers premium reductions to sites that follow these procedures. The Anchored-tier manifest is directly compatible with the KFPA guide, allowing insurers to perform risk assessment using the manifest alone.
Fire barriers, separation distances, and ventilation are the three foundational axes of ESS safety design. Barriers provide spatial isolation; separation distances block thermal propagation; ventilation manages flammable-gas concentration.
For barriers, this standard recommends 2-hour fire-rated barriers for indoor GRID_SCALE and 1-hour fire-rated barriers for indoor RESIDENTIAL. Barrier materials must satisfy KS F 2257-1 (concrete, steel + insulation, or certified fire-rated panels). For separation, this standard recommends 1.5 m between ESS containers, 5 m from combustible structures (wood, plastic), 10 m from residences, and 15 m from public facilities. For ventilation, this standard recommends six air changes per hour indoors, automatically increased to twelve or more on OFF_GAS detection, with explosion-rated motors and fans (IECEx or KS C IEC 60079).
Module-level automatic suppression emerged as a core safety technology from the Korean fire experience. Earlier ESS suppression released clean agent or water mist into the entire container at once, but failed to isolate the originating module accurately, reducing effectiveness. Module-level systems place independent suppression nozzles and gas sensors at each module, isolating and extinguishing only the affected module the moment fire begins.
This standard mandates module-level automatic suppression for GRID_SCALE and UTILITY applications. Suppression agents include FK-5-1-12, HFC-227ea, or water mist, with module isolation within 30 seconds and extinguishment within 60 seconds. Hanwha Aerospace and Samsung SDI have started global production of module-level suppression systems, whose specifications anchor the recommendations of this standard. The Korea Fire Institute (KFI) operates ESS suppression certification, and certification outcomes integrate into the manifest.
ESS economics are heavily influenced by insurance premiums. Following the 2019 Korean fires, some insurers refused to underwrite ESS or raised premiums by multiples, decisively eroding ESS project economics. In 2024, KFPA and the General Insurance Association of Korea jointly issued the ESS Fire Risk Assessment Guide, providing objective risk-assessment criteria.
The Anchored-tier manifest of this standard automatically satisfies every item in the KFPA guide. Insurers verify the Sigstore signature on the manifest and then perform risk assessment, allowing sites of equal tier to receive consistent premiums. This standardizes "risk pricing" for ESS, providing predictability for operators. The KFPA guide also offers tiered premium differentials, with the lowest risk class (Surface tier outdoor with gas detection and module automatic suppression) paying roughly one-fifth the premium of the highest class.
This standard's safety requirements draw lessons from global incidents as well as Korean ones. The 2021 Victorian Big Battery fire in Australia, in which a 300 MW Tesla Megapack saw fire propagate between two containers, underscored the decisive importance of container-to-container separation, reflected in this standard's 1.5 m recommendation. The 2024 Moss Landing fire in California — at the world's largest 1.6 GWh site — burned for four days, underscoring that the absence of module-level automatic suppression prolongs fires; this is the direct basis for this standard's module-suppression mandate. The 2023 Liverpool ESS fire in the United Kingdom, where a non-operational gas sensor left the fire undetected for over an hour, underscores the need for regular gas-sensor inspection and redundancy, reflected in this standard's six-month inspection cadence requirement.
These global cases demonstrate that this standard's recommendations are not "excessive Korean regulation" but rather a synthesis of global best practice. The lessons Korea drew from 23 fires are answers to the same problem the world faces.
ESS fires affect not only life and property but also the environment. Combustion of lithium cells produces HF, HCl, and CO; suppression water can be contaminated with heavy metals (nickel, cobalt, manganese). This standard includes environmental impact assessment and post-incident remediation as recommended practice.
The Korean Hazardous Chemicals Management Act mandates the measurement and reporting of emitted gas concentrations during ESS fires. This standard recommends installing H₂, CO, HF, HCl, and VOC sensors at ESS sites, integrating measurements into the manifest. Post-fire remediation follows the Korea Environment Corporation (KECO) "Environmental Damage Relief Procedure," with remediation records preserved in the manifest. The Anchored tier recommends environmental liability insurance.
The final axis of ESS safety is people. This standard mandates regular safety training for every worker involved in ESS installation, operation, inspection, or decommissioning, covering: the hazard characteristics and thermal-runaway mechanisms of lithium cells; the meaning of BMS and PCS alarms and the response procedures; the basic principles of barriers, separation, and ventilation; the use of arc-flash protective equipment; and emergency response to fires and gas leaks.
KOSHA provides ESS worker training standards in Korea, and KESCO operates an ESS operator certification program. This standard requires that GRID_SCALE applications be supervised by KESCO-certified operators. Worker safety ultimately depends on safety culture — a culture that reports the smallest precursors immediately, calls out peer violations, and treats incidents as learning resources rather than secrets. Such a culture is not built overnight; it requires sustained education and leadership by example.
The KESCO 47-item pre-use inspection aligns directly with this standard's safety requirements. The items fall into five areas: 12 items on cells and modules (specifications, IEC 62619 test validity, assembly quality, separator, electrolyte, terminals); 14 items on BMS and PCS (measurement precision, SOC/SOH/SOP accuracy, alarm response time, protection accuracy, conversion efficiency, anti-islanding, LVRT/FRT, communication reliability); 9 items on electrical safety (insulation resistance, ground resistance, residual-current devices, overcurrent and short-circuit protection, surge protection, cable specifications, terminal torque, arc-flash assessment); 8 items on fire safety (barrier rating, separation, gas/smoke/heat detection, suppression, ventilation, evacuation routes); and 4 items on operations (operator qualification, inspection schedule, emergency manual, incident reporting). The manifest of this standard is designed to satisfy all 47 items automatically, so that Korean operators can submit the KESCO inspection and the Anchored-tier manifest simultaneously and avoid duplicate review.
Practical adoption of this chapter's safety requirements follows a 15-item checklist spanning site selection through decommissioning: separation from adjacent combustible structures, residences, and public facilities; geotechnical and flood-risk assessment; distance to grid interconnection and substation; indoor versus outdoor placement aligned with KESCO; 2-hour fire-rated barriers using KS F 2257-1 materials; module-level automatic suppression with KFI certification; OFF_GAS sensor placement (H₂, CO, VOC); forced ventilation with explosion-rated motors; UL 9540A four-level cell/module/rack pass; BMS and PCS cyber security (TLS 1.3, MFA, Secure Boot); communication interface to KEPCO I-SMART; operator KESCO certification; emergency manual and fire drill schedule; KFPA risk assessment and insurance; and registration of the Anchored-tier manifest with Rekor anchoring. Korean operators submitting this checklist alongside the KESCO pre-use inspection avoid duplicate review and obtain automatic recognition from KFPA insurers.
ESS safety standards evolve continually with technology and incident experience. Future revisions of this standard will address: standardization of solid-state battery safety (KIER and Samsung SDI are developing test methods, targeting incorporation in the 2026 revision); AI-driven early warning (KETI's "K-Battery Cloud Analytics" predicts thermal runaway hours in advance, and this standard will define AI validation procedures and accountability boundaries); and second-life battery safety evaluation (aligned with MOTIE's Spent Battery Industry Activation Plan). This evolution demonstrates that this standard is not a static rulebook but a living commitment.
ESS deployment requires technical safety and social acceptance simultaneously. Large ESS near residential areas can provoke community anxiety and opposition, becoming the principal obstacle to site selection. Some Korean local governments enacted strict zoning ordinances on ESS following the 2017–2019 fires.
The transparent testing and evidence disclosure of this standard directly supports social acceptance. When the Anchored-tier manifest is anchored in the Sigstore Rekor log, anyone can verify the safety evidence of a site. Residents no longer depend on the operator's unilateral assertions; they can evaluate safety on objective data. MOTIE published the 2024 ESS Social Acceptance Guideline recommending operator engagement with residents from the site-selection stage, and this standard provides the "language" of that engagement: every manifest item is translatable into plain Korean and English, and the simulator renders risk assessment visually. Social acceptance is ultimately a question of trust — trust forms when the operator discloses safety data, residents can verify it, and accountability is clear in the event of an incident. This standard is the objective infrastructure for that trust.
Allocation of responsibility after an incident frequently leads to disputes. This standard sets principles: (1) design-stage defects are the designer's responsibility — inadequate barriers, insufficient separation, missing suppression — and Simulator Panels 3 and 4 provide automated design-time verification; (2) manufacturing-stage defects are the manufacturer's responsibility — the manifest preserves manufacturing tests and evidence tamper-evidently; (3) installation-stage defects are the installer's responsibility — the manifest integrates installation inspection records; (4) operations-stage defects are the operator's responsibility — alarm dismissal, missed inspection, inadequate training — and the manifest preserves operations history permanently; (5) maintenance-stage defects are the technician's responsibility — incorrect spare specifications, missed tests — and maintenance records integrate into the manifest. These principles align with the combined framework of the Korean Product Liability Act, Electric Utility Act, and Electrical Safety Act.
The manifest structures safety-area data into three sections: testing (UL 9540A four levels, NFPA 855 installation tests, KESCO pre-use inspection in OpenAPI 3.1 form); design (barriers, separation, ventilation, suppression validated against JSON Schema 2020-12); and operations (OFF_GAS history, alarm response records, periodic inspection results as time-series data). Each section is sealed within a Sigstore DSSE envelope and anchored to the Rekor transparency log. After an incident, the entire history can be reconstructed chronologically, and any tampering is immediately detectable. KESCO's "KESIS" incident database cross-walks with this manifest, allowing a single dataset to satisfy both Korean and global reporting.
Synthesizing Chapters 2 through 4, ESS safety is achieved only when chemistry/cell (Chapter 2), BMS/PCS (Chapter 3), and safety/fire (this chapter) are simultaneously satisfied. Failure on any one axis defeats the whole. Safe cells are useless when the BMS misses SOA exit; an accurate BMS is useless when the PCS ignores shutdown commands; a competent PCS is useless without barriers, separation, and suppression. This standard binds the three axes into one verifiable safety commitment.
The deepest lesson from the 23 Korean ESS fires is the "trap of partial compliance" — systems satisfying only some axes tend to overestimate their own safety. KS C 8546 certified cells invite neglect of BMS precision; a precise BMS invites cutting corners on barriers; perfect barriers invite ignoring gas detection. The principle of "simultaneous four-axis compliance" blocks every such complacency. Anchored-tier conformance requires evidence from all four axes in the manifest; missing evidence on any axis downgrades the tier. This is the mechanism that forces operators into systemic safety thinking.
This chapter has defined the third of the four ESS axes — safety and fire prevention. The five core messages are: (1) the mechanism of thermal runaway must be understood and its triggers blocked through layered defense; (2) UL 9540A:2024 evaluates fire propagation across four test levels from cell to installation; (3) NFPA 855:2023 defines installation standards directly linked to UL 9540A; (4) the Korean KESCO standard is stricter than NFPA 855 on separation and indoor capacity; and (5) OFF_GAS monitoring and module-level automatic suppression directly reflect the lessons of the 23 Korean ESS fires.
Chapters 5 through 8 are handled by other sub-agents, covering operations, grid integration, certification procedures, and the future roadmap. Through this chapter, the first three of the four axes — cells (Chapter 2), BMS/PCS (Chapter 3), and safety (Chapter 4) — are now complete. The four-axis simultaneous-compliance principle is Korea's deepest lesson from 23 fires, and in the spirit of "Hongik Ingan" it is offered freely to every operator worldwide. ESS safety is ultimately a technical standard and simultaneously a cultural standard — only when a culture that prioritizes safety, reports early signals, and treats incidents as learning takes root does this standard become a living safety commitment rather than print on a page.
弘益人間 (Hongik Ingan) — Benefit All Humanity