Everything in a conventional energy control program assumes an isolation point and a verified zero-energy state. OSHA’s 29 CFR 1910.147 is built on it; so is every lockout procedure written against it. On a stationary battery string neither exists. Waiting for the energy to run down is not a control measure — on a large system it is not even a plausible one.
So the LOTO logic does not transfer, and procedures have to be written specifically for battery work. That means sectionalising the string, insulated tooling and single-point-of-contact rules, chemical and thermal hazards carried alongside shock and arc flash, and a defined “lower risk” end state that a named person signs. Sandia National Laboratories’ published work on energised battery work describes exactly this approach — reducing risk by sectionalising batteries into lower-voltage, lower-energy strings.
D. M. Rosewater, Sandia National Laboratories, “Reducing Risk When Performing Energized Work on Batteries,” IEEE Transactions on Industry Applications, Vol. 60, No. 2, March–April 2024.
An honest note on battery arc flash
The standards community does not agree on whether a stationary battery string can sustain an arc. A 2013 committee presentation to the NFPA Conference & Expo by B. Gray (HBI) and S. McCluer (Schneider Electric) argued that in most cases it cannot, because a battery’s stored energy depletes rapidly and the literature shows millisecond sparks rather than sustained blasts. Presenting battery arc flash as uniformly catastrophic would be indefensible. Presenting it as trivial would be equally so. The procedure has to be built on your own string configuration, not on a slogan.
Documented incident
McMicken Energy Storage, Surprise, Arizona — 19 April 2019
APS McMicken facility, a 2 MW / 2.16 MWh lithium-ion (NMC) battery energy storage system in service since March 2017.
16:55
Smoke detector activation. Clean agent suppressant deployed.
18:28
Hazmat team on scene, detecting hazardous levels of hydrogen cyanide and carbon monoxide.
20:01
After developing an incident action plan, the team opens the enclosure door.
20:04
Deflagration. Four career firefighters seriously injured.
Sequence and injury count from the line-of-duty-injury report by the Fire Safety Research Institute (UL Research Institutes), which documents four seriously injured career firefighters. Contemporaneous trade reporting stated that eight firefighters and one police officer were transported to hospital. Both figures are on the public record; the difference between “seriously injured” and “transported for evaluation” is not resolved in the published material, so we cite the basis rather than pick a number.
The root cause finding — and the dispute
APS commissioned DNV GL, whose final report of 27 July 2020 determined the root cause to be failure of a single cell on one rack from abnormal lithium metal deposition and dendritic growth, cascading into thermal runaway across the rack. Contributing factors identified included the absence of thermal barriers to limit cell-to-cell and module-to-module cascading, a suppression system unable to stop thermal runaway, accumulation of flammable off-gas in a sealed enclosure, and inadequate emergency response planning and coordination.
That finding was contested. LG Chem, through its investigator Exponent, rejected the internal-cell-failure conclusion — arguing that metallic lithium plating did not cause an internal cell failure and that voltage profiles from testing did not match the incident data — and proposed instead an external cause: intense heating from electrical arcing on the same rack. The disagreement has not been publicly resolved.
DNV GL findings and the LG Chem response as reported by IEEE Spectrum and Utility Dive, 29 July 2020, and by APS. FSRI notes the facility was commissioned before the current consensus standard for stationary energy storage installations existed, and complied with the codes in force at the time.
What a dc practice should take from this: the mechanism that injured people was not shock and not arc flash. It was a flammable-gas deflagration released when a door was opened on an enclosure that could not be de-energised, could not be safely ventilated, and had no site-specific response plan. dc consulting that stops at incident energy and labels misses the thing that actually hurt people.