Calculation of the state of safety (SOS) for lithium ion batteries

,


Introduction
Field incidents that result in fire of battery cells and packs of lithium ion chemistry are still a matter of discussion and cast doubts on the readiness of the technology for applications that require more energy (longer life) or more power (higher current), or a higher number of cells.The incidents that resulted in fire of battery electric vehicles (EVs) [1,2], and auxiliary power supplies [3] are three known examples which drew a lot of attention from the industry, the scientific community, and the general public.
In order to study safety, researchers have tried to define an operating area for energy storage systems mostly based on thermal properties but have not indicated exactly how to numerically quantify this area.
One of the known ways of classifying the safety of a battery is the hazard levels shown in Table 1 originally proposed by the European Council for Automotive Research and Development (EUCAR) [4].These hazard levels have been mentioned in standards and other documents that certify battery cells and packs [5,6].In Table 1, the higher level assumes that the previous level has already occurred.For example, when there is fire, it is assumed that leakage or venting have also occurred, and thus fire is worse than them, but not as extreme as the next level, explosion.
Of interest is noting that two different documents describe the hazard levels in distinct ways.In the SAE J2464 manual [6] the rupture hazard is in position 5 while flame is in position 6.In the case of the older EUCAR documentation and the SAND2005 report [5,7], these two positions are interchanged, and moreover there are differences in the wording explaining what constitutes leakage, venting, or rupture.This shows that while the general concept of what constitutes safety is intuitive, how to numerically quantify it is an imprecise task, often subject to interpretation.
It is noted that in many cases to assert that an energy storage system (ESS) is safe, the level should not go beyond 4 when performing abuse tests, that is, the device under test should show no signs of a major rupture, fire or explosion, as these are clear dangers to the people operating the battery.On the other hand, hazard levels up to 4, although they may render the device unusable, are tolerated because they don't expose the user to a bigger risk.
The hazard levels were used in a numerical way by Ashtiani [7], who introduced a methodology called hazard modes and risk mitigation analysis (HMRMA), and defined the hazard risk (H R ) as the product of the hazard severity (H S ) and the hazard likelihood (H L ), where H S can take values from 0 to 7, in accordance with the hazard level, and H L can take values from 1 to 10, indicating the rate of occurrence (ROO), which describes the percentage of faults in a million of samples, as shown in Table 2.These concepts are common in the automotive and aerospace industries as part of their failure mode and effects analysis (FMEA) [8,9] methodology.
As we see, H R combines two different states in order to find a safe operating area (SOA) for a constant value That is, if the objective is to lower the value of the risk H R0 , either the severity H S or the likelihood H L must be reduced.It follows that this can be accomplished by adding a third state, a hazard control (H C ), to the system so that where H C can take values from 0 to 1.Moreover, Ashtiani proposes that the values for H C be classified in different ranges depending on the amount of control of the hazard, as seen in Table 3.No control 1 means that the original value of H R remains unchanged, while full control 0 reduces H R to zero.
Lu et al. [10] discuss the safe operating area of a battery based on the voltage and temperature.They mention the effects that can occur if the limits are breached.In case of low voltage, the positive active material collapses, and the copper negative current collector dissolves.In case of high voltage, lithium dendrites appear, and the positive active material decomposes.In case of low temperature there is lithium plating in the negative collector.In case of high temperature there is decomposition of the solid electrolyte interface (SEI) and reaction of the positive active material.
Additionally, they present the state of function (SOF) which relates the state of charge (SOC) and state of health (SOH) with the degradation of output power as SOFðtÞ ¼ PðtÞ À P d P max À P d ;  where P(t) is the instantaneous power that the battery is providing, P d is the power demanded at one instant (constant), and P max is the maximum power (constant) that the battery is able to provide when it is at maximum capacity, that is, when it is new and fully charged.In general, the instantaneous power depends on both states at that moment so PðtÞ ¼ P max $SOCðtÞ$SOHðtÞ: Previously, the SOF was defined for lead-acid batteries by Meissner and Richter [11,12] in a similar way as SOFðtÞ ¼ SOCðtÞ$SOHðtÞ; (6) but considering that SOH is defined like (4).Instead of using power they consider the voltage of the ESS as representative of the state as where the quantities in this case refer to the minimum voltage that the battery achieves during a period of discharge, that is, V d is the minimum voltage for a given demanded load, and V lim is the minimum voltage for that demand when the battery is new.Conversely, the quantities refer to maxima when considering a period of charge.Given the linear dependence between SOC and voltage in lead-acid batteries [11], these relationships hold well for that technology but not so for other systems like those based on lithium ion intercalation.Other descriptions of a SOA are mentioned by He et al. [13], who consider voltage, temperature, and over-current protection to define the state.We could establish this as a function of three variables f ðx 1 ; x 2 ; x 3 Þ ¼ f ðV; T; iÞ: Catastrophe theory [14] was used by Wang et al. [15] to study the probability of thermal runaway and explosion of lithium ion batteries.Due to their nature, catastrophes can be classified based on the number of control parametres being simultaneously varied.In their approach they start from an equation of balance of heat generation rate where, for the left hand side, i and V are the current and voltage at the terminals of the battery, E react is the total reaction heat rate from the decomposition of the SEI layer and internal materials, V 0 is the equilibrium potential, T is the absolute temperature, and E loss is heat dissipation rate due to convection and radiation.The right hand side represents the total heating rate of the battery as c is the specific heat capacity, r is the mass density, W is the total volume, and t is time.
Their analysis reestablishes the equality as vq vt where q is a dimensionless temperature, t is a dimensionless time, and the parametres a n are factors that consider the activation energy and heat transfer of the different decomposition reactions.With this description, they are able to map the thermal runaway region for a cylindrical lithium ion battery as dependent on three control variables u, v, and w, themselves dependent on q and a n .

Formulation of the state of safety as the reciprocal of a probability function for abuse
As exemplified in the previous section, the attempts to define a SOA include discrete hazard levels and mathematical descriptions.In the case of the catastrophe theory [15], the problem is that of finding an unsafe, rather than a safe, operating area.As Richter discusses [12], the SOF is a measure for the probability of the ESS being able to provide a minimum amount of energy at a given time.The hazard risk number of Ashtiani [7], is also a hazard probability of second order, or third, if the control parametre is introduced.
Taking these concepts as a basis, we will use a similar approach.We define "safety" in a way that is inversely proportional to the concept of "abuse", safety∝ 1 abuse ; or where f abuse is the state of abuse, f safety is the SOS proper, and x represents all types of state and control variables that describe the behaviour of the battery, for example, voltage, temperature, charging and discharging currents, internal impedance, battery expansion, and battery deformation, at a given time t.In this formulation, as abuse increases, the state of safety will decrease accordingly.The rate of this decrease should be a matter of investigation but several relationships can be considered including polynomial, exponential, and logarithmic.In order to limit the SOS to reasonably working values, we consider it has the same numerical range as the SOC, from 0 to 1.As the absolute value of abuse becomes infinitely large, the value of safety should tend to 0 or completely unsafe, and when the abuse is non-existent or zero, the safety should be limited to 1 or completely safe.Then we have the relationship which has the required range as where g(x) is the abuse function defined for values !0. In order for this abuse function to be more general, we prefer the quadratic representation where h(x) can take any value, including zero and negative, and m and d are constants that allow us to control the rate of decrease as needed.
In many practical uses of a storage system, it is considered to have reached end of life (EOL) when its capacity (power or energy) can only reach 80% or 0.8 of the same capacity at the beginning of life (BOL), which is normalised as 100% or 1.0 [10,16,17].Therefore, we will also use the familiar numerical value 0.8 as a boundary to indicate when the battery is at acceptable value of abuse Thus we use ( 15) and ( 17) to establish the system 1 ¼ 1 which reduces to from which we solve for the parametres m ¼ 0:25 where x 100 and x 80 are the combination of battery variables that describe 100% and 80% safety, respectively, at an original time t 0 .
Then the state of safety function is The general plot of this function appears in Fig. 1, for arbitrary values h(x 100 ) ¼ 1.1, and h(x 80 ) ¼ 2.7.In this figure we also see how h(x 100 ) determines the point of maximum safety, and h(x 80 ) determines the rate of decay.As the value of h(x 80 ) approaches h(x 100 ) the parametre m becomes larger, and f safety decreases faster.This can be generalised, instead of 0.8, using a number z between zero and one.Then and and finally The abuse function h(x) distinguishes two cases depending on its domain:

located between two limits [h low ,h up ],
where h up is hðx z Þ.The first case occurs with conditions that absolutely start from zero, for example, mechanical deformation: a newly manufactured battery can be assumed to have no mechanical abuse until it becomes impacted by an external body, or suffers internal layer expansion, or other effects.
The second case may appear with abuse conditions in which the state variables are already in a specific window of operation.For example, voltage and temperature are not normally zero, thus the abuse function h(x) could be defined to be within a certain range instead of starting from zero.
Considering the first case As is seen in Fig. 1, in most cases h(x) only makes sense for values larger than h(x 100 ) as the curve is symmetrical with values lower than this.
In general, ( 27) is a form of the Cauchy distribution [18e21] for continuous random variables with probability density function (PDF) where x 0 is the location parametre, and g is the scale parametre.By comparing with ( 16), we see that gp ¼ 1, and therefore m ¼ p 2 .
It is clear that by using this approach, other probability distributions can be used, including the familiar normal distribution and other types of bell curves, such as a log-normal distribution that has a bias to one side of the maximum [22].
Fig. 1.General form of the state of safety function.The value h(x 100 ) controls the location of the maximum safe point, and h(x 80 ) indicates the limit for an acceptable safe state, which influences the rate of decay of the curve.Three curves are plotted with the same h(x 100 ), but distinct values of h(x 80 ) so that the slope m is scaled proportionally.

Formulation with individual variables
In the general case (27), the abuse function h(x) considers all variables that could affect the ESS.We could assume that only one variable exists, and that abuse increases simply together with this variable, that is, and where x k is any variable of interest, and x k,100 and x k;z are the corresponding limits for safety.This f k (x k ) is thus a subfunction which, when linked together with other such subfunctions, results in the characteristic value for the SOS for the entire ESS.On the basis of the definition of the SOS as a probability function, this characteristic value can be calculated as the product distribution of the individual subfunctions [21].Therefore where n is the number of subfunctions.
Given that each subfunction has a lower value z to guarantee safe behaviour, and a maximum of one, we have the important values SOS ¼ 1:0 completely safe ðall functions are 1:0Þ; SOS ¼ z warning ðone function may be at zÞ; Fig. 2 shows the general values possible, represented in a similar way to a traffic light with three levels: safe (green), warning (yellow), and unsafe (red).

Properties that describe the state of safety
Many variables or properties can be studied to describe the safety of an ESS.Here we present some that are more applicable for a lithium ion battery with a lithium-metal-oxide material as positive electrode, and a carbon-based material as negative electrode.
Nevertheless, this list is not exhaustive and other conditions may be observed depending on the type of storage system [10,23,24].

Temperature
If surface or internal temperature exceeds an upper value (overtemperature), the SEI layer and the active material will start decomposing, resulting in exothermic reactions and possibility of thermal runaway [10,23,25e27], which could further lead to fire and explosion [28].If it goes below a lower value (undertemperature), the reaction rate is greatly decreased and attempting to charge or discharge may result in metallic lithium depositing on the negative electrode, leading to irreversible loss of capacity and risk of internal short circuits [10,29e31].

Current
Current is associated with Joule heat generation [32,33].If the heat inside the battery is produced at a faster rate than it can be dissipated by conduction, convection, or radiation, this may lead to thermal runaway [32].High current charge (overcurrent) also contributes to lithium plating in the negative electrode with the risk this brings [34].

Voltage
Two cases should be considered, overvoltage and undervoltage.Overvoltage (overcharge) results in decomposition of the positive electrode and the electrolyte, which results in heat generation and gas [10,35e38].Undervoltage (overdischarge or deep discharge) results in lithium plating in the negative electrode, and dissolution of the copper current collector, which will result in copper dendrites, increasing the chance of an internal short circuit [10,35,39].

State of charge
The higher the SOC, the higher the energy that could be released as heat or fire during a catastrophic event [15,40e43].It is therefore estimated that there is an inverse relationship between SOC and safety.

State of health
Two observations can be made.The first is that an older battery, with low SOH, will not be able to hold the same amount of charge or energy as when the device was new.Therefore this effect is similar to having a lower SOC.The second observation is that an aged battery may already contain damage on the electrodes, the separator, or have signs of swelling and lithium plating [30,34].Therefore, an aged system may be more prone to unsafe behaviour [31,44].
These two possibilities oppose each other in their relationship with safety.Both could be considered by separate safety functions, or by erring on the side of prevention, we may consider the second case only, that is, that the battery is less safe the older it is.As shown by (6), the concept of SOF may consider both effects SOC and SOH together [10,11], perhaps making it unnecessary treating both values separately.While the SOC can be estimated by simple methods, including Coulomb counting, the effects of ageing and capacity fade should be looked more into detail by using suitable ageing estimation techniques [45].
The SOH is also an important value that should be taken into consideration when discussing the possibility of second life of storage devices [46].As long as the storage unit is in a general good state, able to supply enough power and energy for a given application, it may be possible to repurpose it for this new use.However, if the SOS value is defined in such a way that it strongly takes into consideration the ageing effects, a decision should be made on whether the battery system is safe enough for the new application, or if a specific SOS should determine the EOL for all applications.In this case, complete disposal and recycling of the storage system may be preferred.For the particular case of lithium ion batteries, recycling of their components is difficult and has not achieved optimal levels worldwide [47,48], and so the issue of reusing or recycling will become more important as a larger number of storage units are manufactured and discarded.
Especially hazardous for second life applications of lithium ion batteries is the risk presented by plating of metallic lithium in the negative, carbonaceous electrode, and the unpredictable nature of internal short circuits caused by it.Studies have shown that plating is reversible in some amount and could be quantified, both by destructive tests (opening of the cell) as well as nondestructive tests (measuring a specific voltage or impedance, or by neutron diffraction) [30,49].With sufficient knowledge of the lithium plating mechanisms it should be possible to design discharge regimes or establish other conditions (for example, maintaining a stable temperature or pressure) during the first life of the battery so that plating is minimised and second life is still possible.Thus aged batteries should be used only if their ageing history is sufficiently known and if tests are conducted that guarantee the required level of safety [31,50].

Internal impedance
There are several methods of finding the internal impedance of an ESS, of which three common ones are (a) a current pulse test, (b) a small-signal sinusoidal current test at 1 kHz, and (c) by electrochemical impedance spectroscopy, sweeping a typical range from 5 kHz to 1 mHz [51].
The impedance, however determined, is a ratio of the voltage to the current and thus indicates how much charge q can be transported in a given time interval Dt.Any quantity that can describe effects on the charge transport should be helpful to infer the internal state of the battery.Impedance increase occurs in both positive and negative electrodes, and rather than changes in the bulk of the active materials themselves it's the changes in the interfaces of the particles with the electrolyte that results in the higher values of impedance [52].
A larger impedance in the negative electrode typically indicates growth of the SEI layer.This growth necessarily consumes lithium ions and electrolyte, which reduces the available charge carriers (capacity), and thus increases impedance.While this growth occurs primarily in the first cycles of the cell after it is manufactured, and can be considered stable, it continues during the lifetime of the system at a reduced rate.The growth of the SEI layer also reduces the access of the electrode surface for ion intercalation thus while not necessarily reducing capacity it limits how fast the ionic transport can be done, resulting in a power capability decrease.Another source for impedance increase is the loss of mechanical and electronic contact of the particles of the electrode.This in part stems from the natural expansion and contraction of the carbon structure during the process of intercalation and deintercalation, but may also be due to the decomposition of the binder material, such as polyvinylidene difluoride (PVdF), which ties the particles to each other and to the current collector [52].
The positive electrode also contributes to ageing and impedance increase because during cycling a passivation film develops on its surface that reduces the amount of available active material.In contrast to the negative electrode, the positive electrode increases its impedance from two to five times [53,54].
As discussed, changes in impedance usually indicate effective ageing of the system by reducing the energy storage efficiency and power (high current) capability both at charge and at discharge.Impedance information may be ambiguous and requires careful interpretation in order to know whether the values are the ones expected and correctly describe purely ohmmic effects, or changes in the charge transfer capability and the double layer capacitance.Moreover attention should be given to the conditions in which the measurements are done as the impedance results vary and are affected by the temperature, SOC, and current rate used [55].With that said, the changes in impedance, usually an increase, in the SOS formulation may be treated in similar way as a decreased SOH to indicate capacity fade or a decreased SOF to indicate power fade.

Mechanical deformation
Mechanical abuse is quantified by the strain ε of the battery, that is, by comparing a deformed dimension to its original dimension, or by measuring the stress s that would produce such strain.The causes of strain may be due to natural expansion during intercalation [56,57], because of ageing and lithium plating [34], or because of compression or external impacts [58e61].

Derivatives
The derivative of any quantity with respect to time dx/dt is indicative of how fast a state changes.This rate may have noticeable effects on the abuse response of the battery.For example, overcharge is already an abuse state, but it has been shown that this abuse is magnified with faster rate of charging [26,32,36,62,63].

Abuse conditions dependent on multiple variables
As seen from the previous list, there doesn't exist a unique correlation between a single parametre and a single safety hazard.For example, thermal runaway is a result of extreme heating, and this heat may come from different sources such as a large demand of current (maybe an external short circuit), a localised hot spot (internal short due to lithium plating), or an external heat source (fire).Therefore, to prevent a thermal runaway it is not sufficient in most cases to focus on a single variable, say, the current.The engineers who design or implement the battery management system (BMS) for an ESS should decide, based on their experience or priorities, which properties to monitor in order to correctly describe the abuse condition that they want to avoid.
In this paper the application of the probability distribution will be discussed briefly on five conditions: high current, high voltage, low voltage, high temperature, and mechanical deformation.Nevertheless, other conditions may be studied as well.

Establishment of safety limits by means of experimental tests
The limits of safe operation, that is, the values for x 100 and x z , or x 100 and x z , should be defined for each type of storage system by different means.This could be done by theoretical understanding of the physical and electrochemical principles involved or by way of performing a series of abuse experiments.
For the discussion in this paper we present the results of doing abuse experiments on lithium ion cells in 18 650 cylindrical format, of lithium iron phosphate (LFP) chemistry, and with a capacity of 1.1 Ah.
Experiments were made inside a "safety chamber", a room of 6 m 2 in area with reinforced concrete walls, especially designed to contain hazards of destructive tests.The chamber is fitted with ventilation and air extraction, blast resistant windows, high definition cameras, and extinguishing systems to make sure the operator of the experiment is at a safe distance from the potentially dangerous response of the batteries.
Electrical charging and discharging tests were performed with a Digatron UBT battery tester with a circuit with a charging and discharging capacity of 0 Ae440 A, and À6 V to 18 V.
Additional discharge and short circuit tests were done with a programmable electronic load Agilent N3306A with a range of 0 Ae110 A and 0 Ve60 V, with which it is possible to control the discharge impedance.
A universal testing machine Instron 5966 with a maximum force of 10 kN was used to perform mechanical indentation on the battery cells.With this machine it was possible to control the displacement of the crosshead with a resolution of up to 0.01 mm, and measure the resulting force.
Electrical readings were also captured with a simultaneous data acquisition system Dewetron DEWE-800, at a rate of 1000 S s À1 .Measured quantities included voltage, current, both by a current shunt and a Hall-effect clamp, and cell surface temperatures by type K thermocouples.

High current
High current discharge events such as external short circuits should be monitored to quantify the safety of the battery.However, it is very difficult to define general rules for a safety limit, since the current level can vary over a wide range for different types of batteries.High power batteries, for example, may have a different chemistry and different electrode structure than high energy batteries.This information should be read from the manufacturer documentation or data sheet, especially the maximum continuous discharge current I max,c and the maximum peak discharge current I max,p .
The results from our external short circuit and high current tests show that the 18 650 cylindrical cells can be discharged with 20C without safety problems, while discharging with 30C and more heats up the cell to elevated temperatures.Referring to the data sheet revels that Thus we use these values as the limits for the variable of current, and we use z ¼ 0:8 as the limit for safety, so x 80 ¼ 30: Then using ( 33) and ( 34) and the function, established with respect to the C-rate, can be defined as the piecewise expression That is, for cases where the current is below the 100% limit, we can consider that the system is entirely safe, and for values above it we consider the appropriate probability function.Because of the use of the C-rate, rather than absolute values, this formulation is a bit more general and may scale to other types of batteries with similar chemical and electrode composition.The plot of this subfunction f i can be seen in Fig. 3.

Overvoltage
Voltage abuse appears in the form of overvoltage or overcharge, and undervoltage or overdischarge.The operating voltage of the LFP lithium ion cell is from 2 V to 3.6 V.For overcharge situations we take the upper limit of the charging voltage, thus x 100 ¼ 3.6.Tests performed show that a single overcharge up to 4.5 V does not cause any immediate failure or safety threat.Nevertheless, we select x 80 ¼ 4.3 to account for a better safety margin.This also agrees with information reported in the literature [39,64], where LFP materials would seemingly keep their structural stability even when cycled above 4 V.

Undervoltage
For overdischarge cases the lower limit is x 100 ¼ 2. Conducted tests, and literature reported values [39], show that the cell is not irreversibly damaged if the discharge is stopped at 1 V, thus x 80 ¼ 1, and we obtain The effects of low and high voltage can be considered by separate subfunctions f odc and f oc , or by a combined one The plot of this subfunction, with both effects, overcharge and overdischarge, is seen in Fig. 4.

Thermal abuse
As mentioned in the literature [15,43,65,66], essentially all abuse conditions can be summarised by the amount of energy or heat that results from this abuse.Thus we can define the subfunction f T using the cell temperature as an indicator.
The risk of initiating exothermic reactions is essentially non existent at values lower than 60 C [67,68], thus we choose x 100 ¼ 55 C. As given by accelerating rate calorimetry (ARC) experiments, self heating of the carbon electrode with electrolyte using the LiBF 4 salt may start at temperatures as low as 60 C in adiabatic heating conditions; however, the value is usually 80 C for the more common LiPF 6 salt, and the actual decomposition of the SEI layer starts later at a temperature around 100 C [68].Additional ARC, differential scanning calorimetry (DSC), and thermogravimetric (TGA) studies confirm that self heating is rarely a problem below 100 C [67,69]; therefore we choose x 80 ¼ 90 C as our limit for safety.

Mechanical abuse
A variable that is rarely considered to quantify the safety for ESSs is mechanical abuse or deformation.Energy storage systems decrease their expected performance and lifetime when submitted to some form of electrical or thermal abuse; however, many times these effects cannot be easily seen, except by using advance measurement techniques on the internal components of the battery, which means the device has to be disassembled, and cannot be used anymore.
Mechanical effects such as external deformation or indentation, expansion, or inflation, are readily visible and thus direct indicators that the system is in a different state than it previously was.In many cases, the device works without any appreciable problem even after these mechanical changes.However, if the device is heavily abused and ruptures, the possible flames and explosion are more significant than in other types of abuse in which only the internal structure is degraded.
If it is possible to quantify the magnitude of the mechanical effect on the battery then it is also possible to calculate the characteristic value for abuse and for the SOS, as explained in this work.
A punch indentation test is considered over the 18 650 cylindrical cell, as is depicted in Fig. 5. Assuming that this indentation is described by the depth of deformation w, a completely new battery cell has no deformation and thus x 100 ¼ 0 indicates the maximum level of safety.
For a cylindrical cell that is indented with a solid, stainless steel punch having a tip of 6.35 mm radius, a drop of voltage and short circuit is detected approximately after 6 mm of depth of indentation [59].Therefore we choose x 80 ¼ 5, including 1 mm as a small safety margin.
Again using the familiar value z ¼ 0:8, and ( 33) and (34), we find and the plot for the value for f w is shown in Fig. 6.Several indentation tests were performed with punches of different radius, including 0.9 mm, 3.175 mm, the aforementioned 6.35 mm, and a sharp nail.In general, the punch with the smallest radius of curvature will pierce the metallic can faster, that is, after a smaller depth of deformation.In the case of the sharp nail, this occurs almost immediately.
For all punches with a blunt tip of 0.9 mm, 3.125 mm and 6.35 mm radius, no tested cell showed a reaction or temperature increase at a depth of deformation less than 2.0 mm, which agrees with published values [59,61].So, barring penetration by a sharp nail, using x 80 ¼ 2 as a general safety limit for this kind of tests seems reasonable.This results in m w ¼ 0.0625.

Representation of the SOS in three-dimensional space
As the SOS ( 38) is a multidimensional quantity, in general it cannot be plotted in three-dimensional space to observe the dependency of each of its variables.In order to do this, only two variables at a time have to be considered.Fig. 7 shows the effect of low and high voltage and high temperature on the SOS, and no further subfunctions are taken into consideration.This is equivalent to assuming that any other subfunction has the numerical value of one, and is therefore entirely safe, that is SOS The two subfunctions considered are those of current and voltage.In order to see the behaviour clearly, tighter limits are chosen than those exemplified in section 5.For the current, the values are normalised over the capacity as x 100 ¼ 5C, and x 80 ¼ 15C.For the voltage, in the upper values a tight range is chosen as x 100 ¼ 3.5V, and x 80 ¼ 3.7V.For the lower values the range is defined by x 100 ¼ 2.5V, and x 80 ¼ 2.2V.
The upper charging limit according to the manufacturer is 3.65 V; however, in this example, we chose 3.5 V as indicating 100% safety.This means that even when the cell is within the manufacturer limit, the SOS is calculated as being less than one (slightly unsafe), as is shown in Fig. 8 during the initial charge and pause (minutes 0 to 15), and during the final charge (minutes 130 to 135).This selection of limit is thus very sensitive to overvoltage, which may be desired for certain applications.
For the lower limit the manufacturer recommends 2 V, however, we select an SOS value of 80% at 2.2 V. Just like in the previous case, this is done to make the condition of overdischarge more sensitive.
Moreover, the manufacturer recommends a maximum continuous discharge of 20C, but we set the 80% limit lower, to only 15C.As we see in the figure, at the high discharge of 18C, the cell discharges excessively, as seen by the fast drop in voltage and subsequent rise, in minutes 20 to 23.Both conditions of overdischarge and high current combine to produce an SOS that crosses into the "unsafe" region.Referring to Fig. 2, we are using two state variables, and therefore the "warning" range ends at 0.8 2 ¼ 0.64.After the abrupt discharge the current is stopped completely, so the voltage returns within normal values, and the SOS is again one (safe).

Conclusions
Given the way the SOS is presented in this paper, its value indicates the probability that the ESS not be found in a state of abuse.The SOS is fundamentally different from other states like the SOF as it does not consider the application for which the battery is intended, but only the possibility of it reacting in a dangerous way in any given instant t.Essentially the SOS can be quantified even when the storage system is not in use, and it is applicable to other systems like fuel cells and supercapacitors if proper safety limits are identified.
In a BMS the SOS could be seemingly integrated as part of the charging or energy management systems already in place in most EVs and charging stations.The SOS can be calculated online similarly to how online estimation of the SOC is done [70].The implementation in a real system should be adaptable so the BMS takes decisions to reduce the possibility of abuse.For example, after a charging incident that resulted in fire in a garage, the car manufacturer introduced a software update to respond to possible unsafe charging conditions [71].In a hypothetical case, after a mild EV crash, if the BMS is still in operation it could calculate the SOS based on the information from the sensors prior to the crash or after it to warn the passenger and first responders about imminent hazards.
The accuracy and reliability of the proposed SOS can be further improved by defining more subfunctions and by adjusting the existing ones.In this paper, the safety limits were selected by empirical methods.Given the number of battery safety tests that have been done world-wide it is possible that more statistical data be used when defining the probability functions of abuse.More research can also be undertaken on studying the probabilities of failure of the individual components such as the electrodes, the separator, and the electrolyte.
It is not necessary to weigh the individual subfunctions with factors, as each subfunction can be justified in a way that it decreases as quickly as necessary.As they are linked together, just like a chain, the maximum value for the SOS is determined by the weakest, or in this case unsafest, subfunction.If in effect each subfunction depends on only one variable, the rate of decrease of the SOS is controlled by the rate of decrease of the specific subfunction f k , in which the parametre m k is most important, itself dependent on the selection of x 80 .

Fig. 2 .
Fig.2.Operating zones for the proposed SOS function, where z is the minimum numerical value, between 0 and 1 guaranteeing safety, and n is the number of subfunctions.

Fig. 3 .
Fig.3.State of safety function for the high current condition f i , which is current dependent.Two additional curves show how as x 80 approaches x 100 , the decay in the safety is more pronounced.

Fig. 4 .
Fig.4.State of safety function for the voltage abuse condition f V , considering both overvoltage and undervoltage.Two additional curves show how as x 80 approaches x 100 , the decay in the safety is more pronounced.

7 .
Use of the SOS during a dynamic test In Fig. 8 (or Animation 1 in the online version) the use of the SOS function is shown during a dynamic current test on the LFP lithium ion cell of 1.1 Ah.The current pattern follows the sequence: a) charge with 0.5 C until 3.65 V, lasting 1.5 min; b) rest of 15 min; c) 10 s discharge pulse of 3 C; d) rest of 3 min; e) 10 s charge pulse of 3 C; f) 2.3 min discharge of 18 C; g) rest of 20 min; h) 10 s discharge pulse of 3 C; i) rest of 3 min; j) 10 s charge pulse of 3 C; k) rest 3 min; l) charge with 0.5 C until 3.65 V, lasting 86 min; m) final rest of 20 min.

Fig. 5 .
Fig. 5. Diagram of a cylindrical 18 650 lithium ion battery being indented by a solid punch with a hemispherical tip of 6.35 mm radius.

Fig. 6 .
Fig.6.State of safety function for the deformation abuse condition f w , which is displacement dependent.Two additional curves show how as x 80 approaches x 100 , the decay in the safety is more pronounced.

Fig. 7 .
Fig. 7. Surface plot of the SOS considering only the two variables V and T in the subfunctions f V , and f T .

Table 1
[6]AR hazard levels for battery safety tests and description; adapted from Ref.[6].Hazard levels until 4 are usually tolerable as they don't pose a direct risk to humans.
4 Major leakage or venting No fire or flame.Weight loss !50% of electrolyte weight.5 Rupture No explosion, but some internal parts are expelled.6 Fire or flame No explosion.7 Explosion Explosion (disintegration).

Table 2
[7]elihood levels for a failure, showing the statistical rate of occurrence in parts per million and percentage, as is common in the automotive industry; adapted from Ref.[7].