Applying HAZOP and LOPA to a battery energy storage system

HAZOP was built for process plants. It divides a plant into nodes, usually a line or a vessel with a design intent, and applies guide words to parameters to generate deviations: no flow, more pressure, less temperature. The method works because a process plant is a set of streams with intended behaviour, and deviations from that intent are enumerable.

A battery installation has no flowing process stream. The energy is stored electrochemically inside sealed cells, and the things that move are electrons, heat and, in a fault, gas. The natural nodes are electrical and thermal rather than hydraulic, and the classic guide words need substitutes before they generate useful deviations against them.

The method still transfers, because the underlying discipline is systematic deviation analysis with a multidisciplinary team, and that is technology-agnostic. What has to be rethought is the node definition and the guide word set.

The nodes that work in practice follow the physical and electrical hierarchy: the cell and module, the rack or string, the enclosure or container, the power conversion system, the point of connection, and the site-level auxiliary systems including HVAC and fire protection.

Each has a design intent that can be stated in the way a process node's intent can. A module is intended to hold a defined energy at a defined temperature within defined voltage limits. An enclosure is intended to contain, ventilate and, on demand, detect and suppress.

Auxiliaries deserve their own nodes rather than being treated as support. HVAC failure is a genuine initiating event with a plausible path to consequence, and it is frequently studied as a utility rather than as a cause, which understates it.

More and less transfer directly to temperature, current, voltage and state of charge, and generate most of the useful deviations. Reverse works for current, which covers charging when discharge was intended and the abuse cases around it.

No flow becomes no cooling or no ventilation, which are among the more productive deviations on this asset. Contamination becomes moisture ingress or corrosive atmosphere.

The additions worth making explicitly are around isolation and control: failure to isolate on demand, isolation when not intended, loss of the battery management system, loss of communications between management layers, and part of the string behaving differently from the rest.

That last one deserves emphasis. A great deal of what goes wrong in battery installations is a population problem, where a small number of cells or modules depart from their neighbours, and a guide word set built only around bulk parameters will not surface it.

Thermal runaway in a cell, initiated by internal defect, mechanical damage, overcharge, over-discharge or external heating. Propagation from that cell to its neighbours, to the module and to the rack, which is largely a design and separation property.

Accumulation of flammable and toxic gas inside an enclosure, with the deflagration risk that follows, and the ventilation and detection arrangements that address it.

Electrical hazards that are unusual by process plant standards: stored energy that cannot be isolated because the source is inside the enclosure, direct current arc flash, and the residual hazard a de-energised installation still presents.

Electrolyte release, which is a chemical hazard with its own handling and drainage implications, and reignition after an event appears controlled, which is a well-documented characteristic of these installations and matters for emergency response planning.

LOPA works by crediting independent protection layers between an initiating event and a consequence, each with a claimed risk reduction, until the residual risk is tolerable. It assumes that layers have time to act.

On a thermal runaway the time from initiation to propagation can be short enough that layers a process engineer would credit routinely have nothing to do. Operator response to an alarm, which is a standard layer with a standard credit, is often not available on this timescale in any meaningful sense.

That compression is the central difficulty. The layers that remain are design measures that act without a decision: cell chemistry and construction, separation distances and barriers, enclosure design, ventilation, and automatic detection and suppression. None of them is credited by being present. A LOPA credit is specific to one scenario and has to show independence from the initiating event, effectiveness against that scenario, a defensible probability of failure on demand, and an audit trail.

Which means the honest LOPA on a battery installation tends to conclude that prevention sits mostly in design and procurement rather than in operation, and the operational layers earn credit for consequence limitation instead.

Detection buys evacuation and notification time reliably. It buys prevention much less reliably, and crediting it as prevention is the common error in these studies.

Off-gas detection generally provides earlier indication than temperature, because venting chemistry precedes the thermal signature, and that difference is worth several minutes in the cases where minutes matter. Whether those minutes prevent anything depends on what can be done with them.

The question to ask of every credited layer is what action it enables and whether that action is available in the time the layer provides. A layer that alerts a control room ten minutes away, on a hazard that develops in two, has not earned the credit it is being given.

The distinction between precursor conditions that can be trended and the event itself, which cannot, is set out in thermal runaway: what is predictable and what is only detectable, and it maps directly onto which layers a LOPA can honestly credit.

The most valuable and most commonly skipped output is the link from the study to what gets instrumented. Every initiating event the study identifies, and every condition a credited layer depends on, implies a measurement.

In practice that means the study should produce an instrumentation schedule alongside its recommendations: which parameters, at what location and granularity, at what sampling rate, with what retention, and with what alarm or action attached.

A hazard identified in a study and not instrumented is a hazard nobody is watching, and the gap between the two documents is where most of the practical risk on these installations actually sits.

Nothing here substitutes for the applicable standards, the fire authority's requirements or a competent multidisciplinary study on the specific installation. It describes how the method adapts, not what the answer is.