Sodium-ion cell safety: what the evidence really says

“Is it safe?” is the first question we are asked, and whoever asks it is right. A battery is not a reservoir: it is an electrochemical system that stores energy in chemical form and which, when stressed beyond its limits, can release it all at once. The serious answer is not an adjective, it is a test protocol with its conditions and its acceptance criteria.

This article describes the safety tests passed by the polyanionic NFPP cells of the second generation of Heiwit systems, with the protocols set out in full. No test is meaningful without its conditions: “passing the nail test” without specifying which needle, at what speed and for how long means nothing.

What is being tried to be provoked

All the evidence that follows has a single target: the thermal runaway, in English thermal runaway. It is the mechanism whereby a damaged cell generates heat, the heat accelerates degradation reactions, the reactions generate more heat, and the process feeds itself until a fire or violent rupture of the casing occurs.

A safety test is therefore a deliberate attempt to trigger that cycle: the cell is punctured, overloaded, crushed, heated from the outside. The pass criterion is not “nothing happens” — something almost always happens — but no fire, no explosion, no containment breach.

It must also be stated what a test does not demonstrate. A positive single-cell result does not automatically transfer to the complete battery pack: propagation from one cell to neighbouring ones is a system phenomenon, and is the subject of a different standard, UL 9540A, which we discuss later.

The evidence, one by one

Nail penetration

It is the most severe and the most spectacular test. The cell is at 25 °C and is fully charged, that is in the condition of maximum stored energy. A steel needle from 5 mm in diameter she crosses it in the centroid at the speed of 25 ± 5 mm/s. The needle is not withdrawn: remains stuck in the cell, maintaining the short circuit between the electrode layers for one hour of observation.

The recorded result is: opening of the CID, emission of smoke, no explosion, no fire.

The CID, Current Interrupt Device, is an internal mechanical device within the cell: when the internal pressure exceeds a threshold, a disc deforms and physically breaks the circuit. It is the last line of defence, the one that acts when electronics are useless because the cell is already punctured. The fact that the CID has operated and that the outcome stopped at smoke is exactly the behaviour expected from a well-designed cell.

Overload

The cell, at 25 °C and already fully charged, is charged at 1C constant current until 1.5 times the end-of-charge voltage, or for one hour, depending on which condition occurs first. This is followed by one hour of observation.

This is the scenario of a serious fault in the control electronics: the BMS fails to activate and the inverter continues to supply current to a battery that is already fully charged. The result observed is swelling of the casing, with no leakage of fluid and no fire.

Thermal control

The loaded cell comes heated from the outside while simultaneously charging it at a constant current of 1C. Heating continues until one of these three conditions occurs: the cell enters thermal runaway, the temperature reaches 300 °C, or they pass four hours.

It is the test that reproduces the external fire: not the battery catching fire, but the battery being located inside a fire. Three hundred degrees is well above the temperature at which a lithium cell goes into thermal runaway. Here too the criterion is no fire, no explosion, no rupture, and here too the recorded outcome stops at the opening of the CID and the emission of smoke.

Crushing, short circuit, oven

Lo crushing replicates mechanical damage — the dropping of a heavy object, an impact during transport or installation — and requires the absence of fluid leaks and fire.

The external short circuit connect the two terminals with a resistance of negligible value; the criterion, in this case, is strict in a different way: no change in appearance, meaning the cell must emerge from the test visually intact.

La bake in the oven according to GB/T 36276-2018, the Chinese standard specific to grid-connected electrochemical energy storage systems, the cell is subjected to prolonged high-temperature storage.

Security that comes from chemistry, not devices

The tests above measure behaviour under extreme conditions. But the most interesting part is that the polyanionic cathode makes those conditions harder to reach, for three structural reasons.

It generates less heat for the same current. In the increasing current discharge test, at a 4C rate, the NFPP cell records a maximum overtemperature of 15.5 °C, against 22.1 °C of a reference LFP cell. Less heat produced means a wider margin before any triggering mechanism comes into play.

It tolerates deep discharge. Taking a lithium cell below its minimum voltage means damaging it permanently, and in certain cases creating the conditions for a subsequent failure. Polyanionic chemistry withstands deep discharge without structural consequences.

It can be brought down to zero volts. It is the most singular consequence of the fact that, in sodium cells, both current collectors can be made of aluminium — whereas a lithium cell requires copper at the anode, which corrodes irreversibly if the voltage drops too low. A sodium cell can therefore be completely discharged to zero volts for storage or transport, and then recharged without damage. A battery transported while discharged is a battery with no energy to release.

The cell certifications

In addition to the above tests, the cells have the following reports and certificates:

• IEC 62619 — safety requirements for secondary cells and batteries, containing lithium and other alkaline systems, for industrial applications. It is the benchmark international standard for stationary energy storage.
• UL 9540A — test method for thermal runaway propagation in energy storage systems. It answers the question that single-cell tests do not address: what happens to neighbouring cells. It is the document that fire brigades and insurance companies require for systems of a significant size.
• UN 38.3 mandatory tests for the transport of batteries: altitude, thermal cycle, vibration, shock, external short circuit, overcharge.
• RoHS e material safety data sheets - absence of hazardous substances and declared composition.
• Certifications for the sea and air freight of dangerous goods.

The system, not just the cell

One final clarification, because it is the most common confusion. The tests and certifications described here concern the cells. The complete energy storage system — battery pack, BMS, control electronics and inverter — is subject to a separate qualification process, which covers the Low Voltage Directive, the Electromagnetic Compatibility Directive and national grid connection regulations.

The two things are complementary and neither replaces the other: an excellent cell inside a poorly designed system remains dangerous, and a well-designed system cannot compensate for an unstable cell.

Frequently asked questions

Can sodium cells catch fire?

Any energy storage cell can release its energy in an uncontrolled manner if stressed enough. The difference lies in the threshold and the behaviour beyond that threshold. In the tests described — nail penetration with the needle left inside for an hour, overcharging to 1.5 times the end-of-charge voltage, heating up to 300 °C — the outcome stopped at the emission of smoke, without fire or explosion.

What is the CID?

Current Interrupt Device: un disco metallico interno che si deforma quando la pressione dentro la cella supera una soglia, interrompendo fisicamente il circuito. Agisce in modo puramente meccanico, senza elettronica, ed è l’ultima protezione disponibile quando la cella è già compromessa.

Perché si parla di stoccaggio a zero volt?

Perché nelle celle al sodio entrambi i collettori di corrente possono essere in alluminio, mentre il litio richiede rame all’anodo, che si corrode se la cella si scarica troppo. Una cella al sodio può quindi essere trasportata e stoccata completamente scarica, cioè priva di energia da liberare, e ricaricata senza danno.

La cella certificata basta a rendere sicuro l’impianto?

No. La sicurezza è una proprietà del sistema completo: cella, pacco, BMS, elettronica e installazione a regola d’arte. Le certificazioni di cella sono la base necessaria, non la garanzia finale.