Integrating Electrochemical Degradation Mechanisms into Fuzzy Fault Tree Analysis for Lithium-Ion Battery Systems Safety Assessment

1. Introduction

Lithium-ion batteries (LIBs) are essential across numerous applications, and this widespread usage stems from key performance advantages, such as high energy density [1], strong energy conversion efficiency, and a long operational lifespan [2]. These qualities have supported the rapid technology expansion of compact and high-performance electronic devices. However, the growing demand for energy storage and the extending to higher energy densities have coincided with a rise in safety incidents, with a notable example of an explosion in an energy storage system (ESS) in Beijing, which caused three fatalities [3]. Such incidents raised concern on the seriousness of the associated risks. One of the most dangerous scenarios in LIBs is thermal runaway (TR), a process of self-accelerating exothermic reactions [3,4] that may lead to fires or explosions [5].

This dangerous phenomena initiates when a cell produces more heat than it can dissipate, causing a rapid and uncontrollable temperature rise leading to thermal runaway [6]. This process can generate several negative consequences, ranging from damages to cell’s internal components, release of flammable gases, and ultimately it can lead to fire or explosion. Mechanical, electrical, and thermal abuses can trigger these conditions [7]. The decomposition of the solid electrolyte interphase (SEI) is widely recognized as the first step in the thermal runaway sequence, beginning at around 90 °C [8,9] (actually depending on the cell chemistry [10,11,12]). Sallard et al. [13] further noted that reaching this temperature can also directly provoke the onset of the runaway. As a matter of fact, once this critical threshold is exceeded, a thermal runaway is likely triggered, so that understanding of scenarios and conditions that can trigger thermal runaway is essential for designing a safer energy storage system.

Adopted methods for this objective range from traditional methods [14,15] —such as Fault Tree Analysis (FTA), Failure Mode and Effects Analysis (FMEA) [16,17,18], and Event Tree Analysis (ETA)—to advanced techniques including Bayesian Networks (BNs) [19], the System-Theoretic Accident Model and Processes (STAMP) [20,21] and fuzzy logic [22,23] concerning cell, module, pack and system level scenarios in a static and dynamic approach. FMEA and FMEA-based methods have been adopted to identify risk scenarios and define fundamental safety practices or to highlight the physical mechanisms that determine failure modalities. Because each technique has inherent strengths and limitations, hybrid approaches have often proved to be most effective [24,25].

A thorough review of the adopted hazard identification and risk assessment techniques [26] showed that, within lithium-ion battery energy storage systems, certain methodologies have become particularly prevalent due to their clarity and effectiveness. Among these, Fault Tree Analysis (FTA) stands out for its ability to logically represent causal relationships between failure events, support both qualitative and quantitative evaluations, and identify the minimal combinations of basic events that can lead to a critical outcome (Top Event, TE). FTA has been used alongside FMEA to broaden the analysis of failure mechanisms [16]; it can be transformed into Bayesian Networks and Dynamic Bayesian Networks (DBNs) to incorporate time-dependent behavior [27,28,29]; or paired with Analytic Hierarchy Process (AHP) to compare and quantify risk factors derived from FTA-based testing [30]. Qi et al. [31] applied a different hybrid approach, combining mutation-rheology theory with FTA to assess LIB explosion risk, while Tan et al. [32] focused on the fire or explosion of the battery energy storage systems (BESS). Wang et al. [33] derived probabilities of basic events (BEs) from the literature.

One of the major issues in quantitative risk assessment is the scarcity of data. There are mainly two different approaches to tackle this issue; data generation and expert judgment. Luder et al. [34] developed a systematic data generation platform to address the high costs, time-intensive nature, and scarcity of labeled lithium-ion battery fault data from real-world operations or laboratory experiments. By coupling electrical, thermal, and ageing models with Monte Carlo simulations, they successfully generated realistic datasets for 8,000 battery packs featuring random faults (including hard and soft short circuits, abnormal internal resistance, and abnormal contact resistance) under real-world variances like road conditions and manufacturing quality. The other method widely used in risk assessment research, is to use expert judgments, converting linguistic terms with fuzzy logic into quantitative probabilities [20,22,23,35]. The use of fuzzy logic offers a powerful means to generate quantitative data and to handle uncertainty in expert judgments regarding failure probabilities and consequence severity, an aspect especially relevant in the rapidly evolving field of lithium-ion batteries.

While most of the previous studies focused on specific applications of the battery system, the present analysis was kept as general as possible. The study of Zhou et al. [36] developed a risk assessment framework that integrates multiphysics simulations (LS-DYNA and FDS), extreme-value statistics, and neural networks to evaluate the safety of lithium-ion batteries during maritime transport. By simulating container drops and subsequent fire propagation, the study quantified failure probabilities and potential fatalities. While this study provides a comprehensive analysis of transport-specific accidents, it acknowledges that limitations remain in modeling complex, multi-factor failure mechanisms.

Another study [37] developed a comprehensive FTA to identify and structure the failure sequences leading to lithium-ion battery pack fires, specifically for electric vehicle applications. By applying this framework to a cell–module–pack architecture, the study used fuzzy logic to quantify undocumented failure modes through a questionnaire distributed to 150 battery experts, ultimately aggregating their responses using a simple arithmetic mean to prioritize safety-critical components.

The study of Jiang et al. [38] developed an integrated risk assessment framework combining FTA and Fuzzy Bayesian Networks (FBN) to model the multi-stage fire hazard chain for Roll-on/Roll-off passenger vessels transporting electric vehicles. Applied specifically to the Shanghai Baoshan–Chongming ferry route, the study utilized expert judgment to quantify risk probabilities for stages ranging from initial battery ignition to full vessel involvement, ultimately identifying critical triggers such as external heat sources and improper vehicle securing.

Another study [39] performed a comprehensive risk evaluation of marine Li-ion BESS by analyzing past maritime incidents and applying HAZID and bow-tie methodologies to identify safety-critical failure pathways. The study specifically focused on the unique operational and environmental challenges of the maritime sector, such as water ingress and salt spray, to determine the effectiveness of current guidelines and propose risk-reduction barriers like immersion cooling and improved fault detection.

The study of Bucala et al. [40] conducted a statistical analysis of 148 lithium-ion battery fire incidents in Massachusetts to quantify risk factors across different equipment categories. Its application was specifically focused on urban fire safety and micromobility devices, discovering that e-bikes and e-scooters carry significantly higher injury rates and charging hazards compared to consumer electronics. By using spatial clustering and regression models, the study identified geographic "hotspots" and highlighted the increased risk associated with online marketplace purchases.

A key contribution of the present study is the explicit consideration of battery degradation as a fundamental contributor to lithium-ion battery safety risk within a fault tree analysis framework. Based on thorough literature review, a direct link has been established between degradation-induced changes in battery characteristics and the associated failure mechanisms, integrating their effects into a general Fault tree to identify the main system conditions and pathways leading to cell failure. Furthermore, to quantify this generalized degradation-related risk under limited empirical failure data, the proposed approach integrated the fault tree methodology with a fuzzy analysis through the Similarity Aggregation Method (SAM), combining qualification-based expert weighting and consensus evaluation to account for expert disagreement and epistemic uncertainty. Finally, a Fussell–Vesely importance analysis was employed to identify and prioritize the basic events that contribute most strongly to the overall top-event probability. In the end, this provided a degradation-oriented framework for connecting battery ageing with safety-critical failure pathways and their relative importance.

Although the proposed framework is application-independent, its relevance is particularly significant for traction batteries, where repeated cycling, fast charging, variable ambient conditions and reliance on battery thermal management and battery management systems can interact with degradation mechanisms during vehicle operation. In this context, explicitly linking degradation mechanisms to safety-critical failure pathways can support risk-informed battery monitoring and preventive management in electric transportation applications.

2. Methodology

This study focused on the identification of the operating conditions and stress factors that can trigger a thermal runaway during operation of a Li-ion battery. This included examining phenomena such as electrical overload, internal and external short circuits, extreme environmental conditions, and also electrochemical degradation, highlighting how each factor can contribute to the overall risk and how they relate to each other. In order to keep the analysis as general as possible, reference was made to no specific cell chemistries or applications, so that the tree could be applied in any context.

2.1. Fault Tree Diagram Construction

The Fault Tree Analysis was developed using information from the scientific literature, reconstructing cause-and-effect relationships to create a detailed and accurate logic model. The temperature at which a lithium-ion cell should operate usually ranges between approximately 0°C and 40°C, while, as mentioned above, a range of damages can be expected at higher temperature values [6]. Above approximately 60°C, depending on the battery chemistry, the safe operating area (SOA) is exceeded, and at approximately 90°C the exothermic decomposition of the SEI will start [8]; once this temperature level has been reached, i.e. from SEI decomposition onwards, it becomes very difficult to stop the reactions and prevent runaway conditions [28,41]. Based on these considerations, the initial overheating, here defined as "Triggering of uncontrollable reactions leading to thermal runaway", rather than the TR itself, has been adopted here as the Top Event of the developed Fault Tree. As a consequence, the reactions involved in the TR phenomenon (e.g. the electrodes and solvent decomposition/reactions, etc.) have not been considered in the analysis. The fault tree was constructed using standard FTA logical gates, identifying intermediate events and tracing back to basic events that, when occurring in combination within a minimal cut set (MCS), can lead to the final failure. Given the complexity of the system behavior, and the sometimes-contrasting information provided by the literature regarding the influence of the many parameters involved, a significant effort was required in this initial step: smaller trees were initially created, representing specific cause-effect relationships. These were subsequently critically analyzed and gradually integrated to create the whole tree presented in Figure 1 for operational cell conditions. A legend of the events represented in the figure is reported in Table 1.

As discussed above, the adopted TE, i.e. the Thermal runaway initiation point, is closely linked to the internal temperature of the cell and, in turn, to the balance between heat generation and dissipation: the triggering of the reactions that lead to thermal runaway, occurs when the heat accumulated (which usually, but not necessarily, means generated) within the cell exceeds the amount the system can dissipate. In the fault tree, this condition is represented by an AND gate that links:

• Heat input to the cell, due to either internal generation or external heating (M1, in Figure 1)
• Insufficient heat dissipation (M2)

2.1.1. Heat Input to the Cell (M1)

Having established the role of heat input in initiating thermal runaway, the following section considers the mechanisms that can lead to excessive heat generation within the cell. One of the main causes of this phenomenon is a high current flowing through the cell. In particular, an internal short circuit (ISC) is one of the primary triggers of excessive heat generation. It can occur when the anode and cathode come into direct contact due to separator failure, creating a low-resistance path that enables uncontrolled current flow and rapid heat release [42]. The possible separator failure modalities leading to ISC are generally classified according to three mechanisms: tear, puncture, and shrinkage (or collapse). These mechanisms are often associated with external mechanical actions, commonly defined as mechanical abuses, such as crush, extrusion, impact, and drop [43], and the type of failure of the separator depends on the specific mechanical action, as evidenced in the developed FT where different basic events, such as X5, and X8 to X12 (Table 1), are connected to the three separator failure modalities (M8, M9 and M10) [41,44,45]. Mechanical abuse not only deforms the cell structure but can also cause cell rupture or electrolyte leakage, further increasing the likelihood of ISC and thermal runaway [46].

Besides the external mechanical forces mentioned, other causes may generate a separator failure: for example, ageing (over-usage) of the cell (X7) can directly lead to separator tear or collapse. Similarly, puncture can be caused by dendrites growing on the cell’s electrodes. In this regard, it can be observed that Lithium plating consists in the deposition of metallic lithium on the anode surface instead of its intercalation within the electrode [20], and it is caused by several conditions, including high charging rates (high C-rate), overcharging (SOC > 100%), and low-temperature charging [47]. Overcharging during the final stages before failure, through continuous lithium deposition, leads to Li plating and dendrite growth, which can pierce the separator and trigger an internal short circuit [46,48]. In particular, Yuan et al. [49] reported that the hazards associated with overcharging become critical only at extremely high SOC levels (above 160–180%), while Ouyang et al. [48] further noted that plating can also occur during overdischarge, particularly in the final failure stage. Dendrites formation develops as an advanced phase of plating: first, metallic lithium is deposited on the anode surface, then it progressively grows into dendritic structures capable of piercing the separator. However, it must be noted that during charging, the morphology of the deposited lithium on the anode (Li plating) varies as a function of the current density: at low densities, mossy or granular structures form, while at high densities, dendritic growth prevails, which is more dangerous because it can penetrate the separator and cause internal short circuits [50,51]. Therefore, as shown in Figure 1, separator perforation by Li dendrites (M11) results from the combination of Li plating (M13) and stress factors (M33), primarily associated with cell ageing (X7 and X24), in conjunction with high C-rate charging (X14). All those conditions are required for separator failure to occur. Overdischarge can also produce dendrites (M12), but in this case, they derive from Cu²⁺ ions reduced to metallic copper, which accumulate and eventually perforate the separator—an effect exacerbated by high temperatures that accelerate copper dissolution and deposition [52]. Even in this case copper dendrites are generated by the simultaneous effect of overdischarge (M15) and stress factors (M21). Finally, separator perforation may also arise from manufacturing defects (X6) [32,41]. A separator puncture, either caused by external mechanical forces (impact, penetration, drop) or by electrical abuse (overcharge, overdischarge), provides a direct conductive pathway between electrodes and is therefore a critical initiator of ISC.

Separator shrinkage or collapse can occur due to either thermal or mechanical abuse (such as crush X5 or compression X12), as well as because of manufacturing defects [13] or over-usage. Thermal abuse, in the form of high cell temperature, can in turn be generated by an external heat flux impacting on the cell (M27), such as in the case of external fires or extreme ambient conditions, if not adequately removed by some battery cooling system. It is also worth noting that, in the presence of a temperature control system, its failure (X31) can itself represent a possible cause of thermal abuse for the cell.

Contamination and manufacturing defects can contribute significantly to generating localized deformation of the separator and/or abnormal heat production, consequently weakening separator integrity [13].

During operation, an alternative possible cause of high current within the cell is represented by a failure of the control system (M6), which in turn can be generated by a failure of the Battery Management System (X21) or sensors failure (X20). Furthermore, the adoption of a very high current discharge during operation (X15) undetected by the BMS, especially when combined with stress factors, can also produce high current and then excessive heat inside the cell (M34).

An external short circuit (ESC) (M5) occurs when the anode and cathode are directly connected outside the cell, causing an abrupt current surge and significant heat generation [5]; it is recognized that this event can create internal localized thermal abuse by generating hot spots that can weaken the separator [5,13,30,46]. However, in most cases the melting point of the separator is around 135-165 °C [26], depending on its specific material, i.e. a much higher value than that required to ignite the exothermic reactions leading to the TR. As a consequence, in accordance with the adopted Top event, it is more likely that an ESC will directly cause a significant temperature increase within the cell, through a high current, rather than via separator failure. Impact and crushing were identified as primary causes of ESC by Zhou et al. [51] and Chowdhury et al. [53], while Lalinde et al. [54] highlighted improper cable connections and immersion in liquids as additional pathways that can establish unintended conductive routes.

A significantly increased internal resistance, which is often an indicator of battery degradation [55,56], can lead to significant heat production even under normal current conditions (M4) [57,58]; this resistance increase can be associated with different causes such as:

• Cathode/anode contact loss (M16): low states of charge (SOC < 20%) can cause electrical contact loss, dissolution of transition metals, and current collectors corrosion, especially in the case of aged cells (stress factors, M21) [59]. Mechanical actions (M24) such as crush, impact, drop and compression can also cause a loss of contact due to breakage or weakening of the designed contact points, causing loss of electrical continuity.
• Binder Decomposition (M17): it is a degradation process that reduces cohesion between active particles and electrical contact loss. A direct effect caused by binder degradation or other mechanisms like cracking and corrosion, falls under the loss of active material (LAM) mechanisms [52,60]. These phenomena lead to reduced electrical contact and an increase in charge transfer resistance, thus contributing to increased internal resistance. The main factor promoting these processes is high temperature [59,61]. Low voltage favors electrical contact loss [59], while binder decomposition is favored by high voltage. Specifically, SOC above 90% and temperatures above 45°C can accelerate binder degradation [59].
• Ion blockage (M18): due to SEI growth and lithium plating, ion blockage represents a critical degradation mechanism in lithium-ion batteries, directly affecting ion transport and electrochemical performance. The underlying causes of ion blockage can be summarized as follows:
• SEI/CEI Layers Thickening (M26): the formation of the Solid Electrolyte Interphase (SEI) on the anode and of the Cathode Electrolyte Interphase (CEI) on the cathode in NMC cells are initially beneficial mechanisms which, however, in the long term, increase cell resistance and properties degradation [62]. A thicker SEI layer hampers ion transport and reduces lithium ions diffusion rates, increasing resistance and degrading power performance [63]. The main stress factors promoting anode degradation are state of charge (SOC), temperature, and overcharge [55,59]. Calendar ageing and the other stress factors markedly influence SEI growth [59]. This process begins immediately after cell assembly and proceeds independently of usage, caused by potential and concentration gradients that expose new electrode surfaces to reactions with the electrolyte [64].
• Excessive Lithium Plating (M25): as already seen when discussing the effects on separator failure, this phenomenon occurs when, during charging, lithium ions fail to intercalate into graphite and are reduced on its surface. Over time, and in combination with ageing (either calendar or cycling) as a stress factor (M33), this phenomenon can be intensified, causing a significant increase in internal resistance and substantial capacity loss [56].
• Electrolyte Decomposition (M19): this is a crucial process that triggers several interconnected mechanisms, namely, lithium consumption, byproducts formation, and increased internal resistance. Degradation products can deposit on the separator, occluding its pores and reducing ionic conductivity (often named as conductivity loss, CL), further contributing to increased ohmic resistance [35,55]. Overcharging accelerates battery degradation, including electrolyte decomposition [52]. Elevated temperatures can also destabilize electrode/electrolyte interfaces and accelerate electrolyte decomposition (T > 40°C) [22,63]. In particular, as mentioned for binder decomposition, SOC above 90% and temperatures above 45°C can accelerate this process [59].
• Collectors corrosion (M20): current collectors corrosion increases internal resistance and contributes to CL [55]. Low states of charge (SOC < 20%) can cause electrical current collectors corrosion, especially in the presence of ageing factors [59]. Furthermore, high temperatures also contribute to collector corrosion, often through the related mechanism of electrolyte decomposition [52].

Finally, adverse ambient conditions (M28), such as an external fire or high ambient temperature, can generate an external heat flux, causing the cell temperature to rise, if not adequately balanced by an equivalent heat dissipation effect (M2).

2.1.2. Insufficient Heat Dissipation (M2)

As discussed in the previous section, heat generation can cause an internal temperature increase when it is not balanced by an equivalent heat dissipation. This latter can occur either as direct dispersion from the cell to the surrounding environment, or via a dedicated cooling system, so that it will depend on both the thermal properties of the cell itself and the effectiveness of the cooling system [4]. In summary, in the context of lithium-ion batteries, the conditions that can compromise heat dissipation can be summarized as follows:

• Cooling system failure (M29). It can be represented as an intermediate event in the tree, and traced back to several basic events, including:
• Reduced coolant flow rate (M30), which can be caused by:
• Faulty or blocked liquid/air pump, preventing fluid circulation and thus reducing heat dissipation (X30);
• Flow restrictions along the cooling channels (X26), e.g. caused by fouling due to impurities in the fluid or corrosion phenomena that reduce the available cross-section area or other flow obstructions;
• Inadequate control of the cooling system (M31) due to faulty temperature sensors (X4) or to problems with the BTMS (X31);
• Coolant leakage (X28) which reduces its total volume/flow rate.
• Degradation of the physical properties of the coolant, compromising its heat exchange capacity (X29);
• Degraded properties of the cooling system (e.g. due to fouling or scaling) (X19);
• Unexpectedly high ambient temperature that reduces the coolant ability to absorb heat from the cell, for instance due to a higher-than-expected inlet temperature, which will limit the thermal gradient required for an efficient cooling (X27);
• Undersized cooling system (X25), which is unable to dissipate the heat generated under actual operating loads, leading to heat accumulation and an increase in the battery internal temperature. It refers to a system that is not adequately designed for the actually established operating conditions, due to unforeseen operating conditions, or incorrect system sizing.

Based on the description above, the following fault tree was constructed (Figure 1). In order to avoid drawing a complex figure, some recurrent intermediate events (e.g. M21, M13, etc.), linked to several lower-level events, were fully represented in one branch only, while in all other branches their development was interrupted, referring to the former one by the same color.

The developed Fault tree can be preliminarily solved to qualitatively identify all the combinations of events (Minimal Cut Sets, MCS) which can give rise to the Top event.

2.2. Fuzzy Logic

One of the objectives of the present study was also to assess the relative quantitative influence of the identified minimal cut sets on the probability of the Top Event. To this end, the probability of the Base Events are required as input data. Due to the scarcity of historical data for all the identified scenarios, a questionnaire was developed to collect expert assessments of the Base Events probabilities. These qualitative expert judgments were then transformed into quantitative estimates using fuzzy set theory. The following sections provide a detailed description of the required fuzzy logic steps and their application in the present study.

2.2.1. Identification of Variables and Domain

When applied to Fault Tree Analysis, the objective of fuzzy logic is to allow the calculation of the probabilities of the individual base events, in order to subsequently allow the calculation of the intermediate and top event probabilities [65]; therefore, in this case, the method’s variables are represented by the base events themselves.

2.2.2. Expert Evaluation and Fuzzification

Given the unavailability of the input data and the uncertain nature of the basic events, a group of experts in the field was selected and their judgment was used for defining the probability of the base events. Experts expressed their opinion regarding the probability of each basic event using linguistic terms, such as “very high”, “low”, etc.; in particular, a five-level approach was adopted to balance ease of compilation with sufficient detail. Accordingly, the experts were asked to rate each base event selecting a choice from the following 5 classes: VERY LOW (VL), LOW (L), MEDIUM (M), HIGH (H), VERY HIGH (VH). This five-level linguistic scale was selected as a compromise between the resolution of the elicitation and the cognitive burden imposed on the experts. A smaller number of categories would provide insufficient discrimination between basic-event likelihoods, whereas a substantially larger number of categories would require experts to make finer distinctions that are difficult to justify when historical probability data are limited. The five-level scale therefore provided a sufficiently expressive representation while maintaining a simple and reproducible elicitation procedure. This formulation also fits with the objective of obtaining reliable expert judgments rather than maximizing the mathematical complexity of the fuzzy representation.

Judgments expressed by experts in linguistic terms were then transformed into fuzzy sets. These sets were defined by a membership characteristic function, applied to each element, ranging between zero and one, which indicated its degree of membership to the set itself. Among the available types of fuzzy numbers, both triangular fuzzy numbers (TFN) and trapezoidal fuzzy numbers (TZFN) are often used in fuzzy set theory applications to FTA [65,66,67].

Kabir and Papadopoulos [67] and Mahmood et al. [66] used TFN, while Tan et al. [32] used TZFN. Mahmood et al. [66] stated that triangular fuzzy numbers facilitate intuitive assessments by decision makers by representing the most probable failure rate, useful for describing the variability of human performance, the uncertainty of system phenomena and the stability of components in human-machine systems. Trapezoidal numbers, characterized by a "plateau" rather than a single peak, are conceptually and practically easier to apply than triangular ones and are also widely used [27]. In general, if the function is symmetric and the central point is known, a triangular number is preferred; conversely, if the asymmetry is known or an interval of maximum membership has to be represented, a trapezoidal number is more appropriate [68]. In the present study, since each expert provided a single linguistic term, both types were used. Triangular fuzzy numbers were assigned to the intermediate categories because these judgments can reasonably be associated with a representative central value. Conversely, the Very Low and Very High categories describe boundary conditions for which a unique central value is less meaningful; trapezoidal membership functions therefore provide an interval of high membership and avoid imposing an artificial single-point optimum at the boundaries. This distinction is consistent with the general interpretation of triangular fuzzy numbers, which represent uncertainty around a single most plausible value, and trapezoidal fuzzy numbers, which allow a range of values to be considered equally representative [69]. This approach ensured complete coverage of the boundary values and a smooth transition to adjacent levels. In Table 2 and Figure 2, the adopted membership functions are represented.

2.2.3. Expert Selection

A purposive expert panel consisting of six experts was established to provide qualitative estimates of the probabilities of the basic events. Because the analysis concerns lithium-ion battery safety, the panel was designed to include complementary academic, research, and engineering profiles, while also covering different levels of professional experience and academic qualification. The six experts comprised an Associate Professor, two Senior Researchers, a Researcher, two Engineers. Their professional experience ranged from 1 to 10 years, while their educational qualifications included Bachelor’s, Master’s, and PhD degrees. The use of a heterogeneous panel was intended to reduce the dependence of the assessment on a single professional perspective and to account for the multidisciplinary nature of lithium-ion battery safety, which involves electrochemical, thermal, electrical, and engineering aspects. Since reliable historical probability data were unavailable for several basic events, expert elicitation was adopted as a means of explicitly incorporating epistemic uncertainty into the FTA.

2.2.4. Expert Judgment Aggregation

After obtaining the opinions of the experts, next step is aggregation of the judgments by one of the available approaches, such as the ordered weighted average operators, the coordination index, the similarity-based aggregation, the coherence aggregation method (CAM), or the similarity aggregation method (SAM).

The SAM method, originally proposed by Hsu and Chen [70], is often mentioned and adopted in the literature [32,65] because it is believed to provide more robust and reliable results. It allows to convert the subjective judgments expressed in linguistic terms by the experts into a single result representing an overall consensus [27]. The calculation consists of several steps ( [32,35,65,67]), here summarized:

• Degree of Similarity (S_ij) calculation: it is the similarity between the opinions of experts i and j. After the experts opinions have been represented into fuzzy numbers, e.g. as trapezoidal ones $\widetilde{A_i}=\left(a_{i1},a_{i2},a_{i3},a_{i4}\right)$, their pairwise degree of similarity is calculated, using specific formulas based on the type of fuzzy number used, whether triangular or trapezoidal. The equation used for trapezoidal fuzzy numbers is:

  $$S_{\mathit{ij}}=1-{\displaystyle \frac{{\sum }_{k=1}^4\left|a_{\mathit{ik}}-a_{\mathit{jk}}\right|}{4}},$$

  (1)

  where S_ij will constitute an element of the overall similarity matrix S where each S_ij value ranges between 0 and 1, 1 indicating perfect similarity. For triangular fuzzy numbers, the corresponding equation is given as:

  $$S_{\mathit{ij}}=1-{\displaystyle \frac{{\sum }_{k=1}^3\left|a_{\mathit{ik}}-a_{\mathit{jk}}\right|}{3}},$$

  (2)
• Average Agreement (AA(Ex_i)): for each expert Ex_i, the average agreement between his/her opinion and the opinions of all other M-1 experts in the group is calculated as:

$$\mathit{AA}{(\mathit{Ex}}_i)={\displaystyle \frac{{\sum }_{j=1}^M{S}_{\mathit{ij}}}{M-1}}, i\ne j,$$

(3)

• Relative Agreement (RAD(Exi): The degree of agreement of each expert is then determined with respect to the overall agreement among all experts:

$$\mathit{RAD}{(\mathit{Ex}}_i)={\displaystyle \frac{\mathit{AA}{(\mathit{Ex}}_i)}{{\sum }_{j=1}^M\mathit{AA}{(\mathit{Ex}}_j)}},$$

(4)

• Weighting Factor (WF(Ex_i)): each expert can be assigned with a specific weight, as a function of several parameters. A group of parameters often adopted in previous analyses is given by professional position, years of experience in the area of concern and level of education, and several criteria have been proposed to assign weights to each of the parameters [32], [35]. The weight assignment criteria adopted for this work are reported in Table 3. WS(Ex_i) is the weighting score assigned to expert Ex_i, which results from the sum of the scores of the three parameters. The Weighting Factor (WF) depends on the WS of an expert, compared to the sum of the WS of all experts:

$$\mathit{WF}{(\mathit{Ex}}_i)={\displaystyle \frac{\mathit{WS}{(\mathit{Ex}}_i)}{{\sum }_{j=1}^M\mathit{WS}{(\mathit{Ex}}_j)}},$$

(5)

• Consensus Coefficient (CC(Exi)): The consensus coefficient, calculated as reported in Equation (6), combines the weighting factor (WF) and the degree of relative agreement (RAD), often using a relaxation factor (β) to balance their influence. A typical value of β is 0.5: if β=0, no weighting has been assigned to experts’ qualification and therefore a homogeneous panel of experts is considered, conversely, when β = 1, an experts' consensus scores are equal to their importance weight. The consensus score coefficient for each expert is a good measure for assessing the relative importance of each expert's opinion. It is the decision maker's responsibility to assign an appropriate value to β [35]:

CC(Ex_i) = β∙ WF(Ex_i) + (1 − β)∙RAD(Ex_i),

(6)

• Finally, aggregation of the experts' opinions into a single fuzzy number that represents the consensus opinion of the group is performed as follows:

$$\widetilde{R_{\mathit{AG}}}={\displaystyle {\sum }_{i=1}^M}(\mathit{CC}{(\mathit{Ex}}_i)\times \widetilde{A_i})=\mathit{CC}\left(E_1\right)\times \widetilde{A_1}+\mathit{CC}\left(E_2\right)\times \widetilde{A_2}+\cdots +\mathit{CC}\left(E_M\right)\times \widetilde{A_M},$$

(7)

2.2.5. Defuzzification

A crucial step in fuzzy set methodologies is represented by the process of converting a fuzzy number (or a fuzzy set) into a precise, non-fuzzy value (the so-called “crisp failure possibility”, CFP), so that, after starting from uncertain and vague data, a single numerical value is finally obtained [32,67].

There are various methods for performing this defuzzification process, the “center-of-area” (COA) method being one of the most widely used methods in reliability engineering applications [22,32,35,67]. The COA allows us to calculate the center of gravity of the area under the fuzzy membership function, as follows:

$$\mathit{CFP}\mathit{or}X={\displaystyle \frac{\int {\mu }_i\left(x\right)x\mathit{dx}}{\int {\mu }_i\left(x\right)\mathit{dx}}},$$

(8)

where X or CFP is the defuzzified output, μ_i(x) is the aggregate membership function, and x is the output variable. The fuzzy trapezoidal number is reduced with the following formula [30], [35]:

$$\mathit{CFP}\mathit{or}X={\displaystyle \frac{\int {\mu }_i\left(x\right)x\mathit{dx}}{\int {\mu }_i\left(x\right)\mathit{dx}}}={\displaystyle \frac{{\int }_{a1}^{b1}\frac{x-a1}{b1-a1}x\mathit{dx}+{\int }_{b1}^{c1}\frac{c1-x}{c1-b1}x\mathit{dx}+{\int }_{c1}^{d1}\frac{d1-x}{d1-c1}x\mathit{dx}}{{\int }_{a1}^{b1}\frac{x-a1}{b1-a1}\mathit{dx}+{\int }_{b1}^{c1}\frac{c1-x}{c1-b1}x\mathit{dx}+{\int }_{c1}^{d1}\frac{d1-x}{d1-c1}x\mathit{dx}}}={\displaystyle \frac{1}{3}}{\displaystyle \frac{{(d1+c1)}^2-d1c1-{\left(a1+b1\right)}^2+a1b1}{(d1+c1-a1-b1)}},$$

(9)

Once the defuzzified crisp value is obtained, it is possible to transform this possibility value into a precise probability value [Onisawa, [32]]:

$$P=\left\{\begin{array}{cc}{\displaystyle \frac{1}{{10}^K}},& \mathit{if}\mathit{CFP}\ne 0\\ 0,& \mathit{if}\mathit{CFP}=0\end{array}\right.,$$

(10)

$$K={\left({\displaystyle \frac{1-\mathit{CFP}}{\mathit{CFP}}}\right)}^{{\displaystyle \frac{1}{3}}}\times 2.301,$$

(11)

where P is the final probability value of a basic event derived from the experts’ judgments.

2.3. Top Event and MCS Probability Calculation

After calculating and collecting the P value of each base event, the probability of the top event (TE) and of the intermediate events (ME) can be quantitatively calculated through the minimal cut sets (MCS) corresponding to TE and each ME [32]. The Minimal cut sets are combinations of base events that are necessary and sufficient to cause the top event of a fault tree, when occurring all together. The top event is initially represented in terms of intermediate events (e.g., M1, M2, etc.), which are, in turn, replaced with their equivalent Boolean causes. This process continues until the fault tree's Boolean equation contains only basic events (e.g., X1, X2, X3). Boolean reduction is then performed: the resulting expression, which represents the main event in terms of basic events only, is further reduced using the laws of Boolean algebra. In the present analysis, a MATLAB [71] code was used to solve the tree, and to calculate the minimal cut sets and the TE probabilities.

Finally, to identify the basic events that most contribute to the overall system failure risk, the Fussell–Vesely (FV) importance measure was calculated for each basic event. The FV measure quantifies the fraction of the top-event probability attributable to a specific basic event, and it is calculated as the fraction of the TOP event probability that is eliminated by making that basic event impossible:

$${\mathit{FV}}_i={\displaystyle \frac{P\left(\mathit{TE}\right)-P\left(\mathit{TE}|P_i=0\right)}{P\left(\mathit{TE}\right)}},$$

(12)

where P(TE) represents the TE probability assuming all the basic events probabilities calculated through the adopted procedure, while P(TE| P_i = 0) is the probability of the TE assuming a null probability of basic event “i” in all MCSs containing it.

FV is therefore a measure of relative importance with respect to the overall risk, rather than a measure of the probability of the basic event itself. Higher FV values indicate greater importance and therefore identify basic events that should receive greater attention for risk mitigation and safer design.

3. Results

Preliminary fundamental results deriving from the construction of the Fault tree are the identification of the basic events (Table 1), their interaction mechanisms which can lead to the Top event (failure pathways) and the identification of the Minimal Cut Sets (see Table 1S in the supporting document). A quantitative resolution of the Fault tree also allowed us to calculate the probability of the numerous MCSs and to assess the relative importance each base event has on the Top event.

3.1. Basic Events RAG, CFP and Final Probability

The aggregation of expert judgments using the Similarity Aggregation Method (SAM) and the calculation of the probability of each event were implemented using Matlab. The FuzzySAM_Expert_Trazpez function was integrated into the calculation code, which, starting with the fuzzy numbers representing the experts’ opinion, derived the Aggregate Fuzzy Number (RAG) and the Centroid CFPs (Table 4). Finally, the probability of each basic event using the Onisawa equation was obtained (Figure 3).

It can be seen that, among the many basic events identified, conditions of overcharge (SOC >80/90%) and factors associated with battery ageing (both calendar and cycling) were found to be characterized by a higher likelihood, in the order of 1-1.5 10-2. A little smaller probability characterizes events like high C-rate charging or discharging and operation in an unbalanced battery pack, as well as operation at very low SOC, all with a probability in the order of 6 10-3. These values indicate that the greatest likelihood of initiating a hazardous sequence possibly leading to a thermal runaway ignition is believed to be associated mainly with factors related to cell operating conditions. A lower probability was obtained for external events or those connected with the heat removal system, the most probable one being high ambient temperature (>40°C), with a probability of around 5 10-3, all others ranging between 1 10-4 and 1 10-3. Among the external mechanical actions, drop and compression were considered more likely, while the least likely basic events appeared to be accidental events like immersion in a liquid or dust contamination (in the order of 10-5). To this regard, it is worth noting that, besides the subjective judgment by the consulted experts, a decisive role in the evaluation of the events likelihood is played by the specific field of application for the batteries under investigation; its knowledge may induce expert opinions towards specific directions which would possibly not be considered relevant under different circumstances.

The probabilities here obtained were then compared with results available from the literature. The goal was to identify common trends, highlight discrepancies, and analyze their possible causes, always keeping in mind the specific assumptions and conditions adopted in each study. In fact, we remind that this analysis was referred to a generic lithium-ion cell under operating conditions and the Top event was the overheating of the cell preceding the onset of the thermal runaway, while in other cases either specific applications or specific cell chemistries were assumed, and, above all, the Top event was usually assumed as the thermal runaway or the final complete failure of the cell.

In the following, the main assumptions and conditions applied in the references adopted for the comparison are summarized:

• Meng et al. [28] used triangular fuzzy numbers and seven linguistic variables. The Center of Area (COA) is not mentioned as a defuzzification method, but the Onisawa approach was chosen for the assessment of failure probabilities. Unlike the present work, their Top Event was the battery TR, directly caused by abnormal overheating and failure of the emergency response.
• A partially different approach was adopted by Zhang et al. [27], in which trapezoidal fuzzy numbers were employed, also maintaining seven linguistic variables; however, in this case the focus was on the BESS fire during maritime transportation. The adopted context led to the evaluation of specific base events such as the ship's speed, stowage adjacent to the engine room, and hold flooding; the probabilities were then evaluated by maritime experts.
• A confirmation of the diffusion of the approach with trapezoidal fuzzy numbers, seven linguistic variables, and the COA method is also found in the work by Tan et al. [32], whose study focused on the design and optimization of a multi-site Integrated Energy System (IES), with the Top Event identified as the BESS fire or explosion. A distinctive feature was the separate analysis for new LFP cells and retired batteries with reduced SOH, considering various applications and environmental scenarios. The probabilities were assessed by five experts with different backgrounds. Furthermore, the analysis was developed considering different applications and environmental scenarios, including installation in commercial buildings, industrial buildings, and outdoor environments, to explore how operating conditions and context influenced the risk profiles.
• Wang et al. [33], derived the base event probabilities (BEs) from the literature, in particular from Meng et al. [28] and Tan et al. [32], defining the full TR of the cell as the Top Event.

Given the considerations highlighted above, it was not possible to make a direct comparison between the Top event probabilities, so Table 5 summarizes the failure probabilities for several common base events. Where possible, similar events reported from the literature were aggregated to facilitate the comparison: for example, in the study by Wang et al. [33], external short circuits were distinguished either as “connector failure” and “wiring ageing”, two types of failure that can be grouped within the more general category of “external wire connection problems”. By this way, it was possible to maintain consistency with the categories used in other reference studies and allow a wider comparison of the failure mechanisms related to wiring.

From a review of Table 5 it can be seen that several base events (such as external wire connection problems, crush, impact, and high ambient T) show probabilities of the same order of magnitude across the compared studies, or a difference within one order of magnitude, indicating consistent likelihood evaluation despite different fuzzy-logic settings and expert groups.

Other events probabilities, especially for immersion in a liquid, overuse, penetration and external heat source, displayed a much wider variability range, with the results reported in Meng et al. [28] always higher than those reported in the other studies (see Figure 4); this confirms that context assumptions strongly influence expert judgment and the derived likelihoods. Environmental and operational factors also varied: for instance, high ambient temperature is considered in Zhang et al. [27] with a notably higher probability, probably reflecting maritime transport conditions, whereas sensors or BMS failures appear only in studies focusing on system-level safety (Tan et al. [32] and this work). Generally speaking, it seems that generic, external, independent events, like mechanical abuses or battery manufacturing, can be more easily characterized by similar likelihood, independently of the analysts, while issues more closely connected with battery operation or characterization are more case-specific.

In summary, despite the methodological and context specificities, the comparison confirmed that some basic events (e.g. elevated ambient temperatures, BMS failure or mechanical impact) are the primary drivers of risk in lithium-ion energy storage systems, in all the studies analyzed, regardless of the methodologies adopted. Even from a quantitative point of view, despite the differences highlighted above in some events characterization, overall, the results demonstrated that different methodologies and application scenarios lead to relatively small numerical differences, or at least smaller than might be expected given the applied methodology, and that the structure of the event taxonomy and the presence of common failure modes across sources support the robustness and comparability of the adopted probabilistic assessment methodology.

Without limiting the analysis to similar base events, but rather reviewing all the events identified in each study, it can be observed that the discrepancies highlighted how the selection and characterization of the basic events are strongly influenced by the application context (maritime transport, integration into complex energy systems, or stationary applications) and by the primary objective of the analysis (dynamic risk forecasting, environmental conditions assessment, or design optimization). Each study tends to focus on a subset of failure scenarios that reflect the priorities and operating conditions considered, making a direct and systematic comparison among different studies difficult. However, on the other hand, making reference to specific applications and conditions may also help experts in providing more consistent and realistic judgments about the basic events, that will positively affect the evaluation of the final Top event probability.

3.2. Minimal Cut Sets Probabilities and Importance

The probability values reported in Figure 3 provide significant insight into the failure mechanisms of the battery system, however the actual impact of the basic events on the occurrence of the Top event depends on their association with other events in the form of the Minimal Cut Sets, i.e. the smaller combinations of basic events which will lead to the top event, and on their overall probability. A list of all the identified MCSs, along with their estimated probabilities, is reported in Table 1S.

Most of the MCSs are composed of two basic events, while MCS1 consists of one single event (BTMS failure), which thus represents a critical issue. In this regard, it must be observed that if the BTMS is designed as a cooling system only, it is unlikely that it will represent a failure cause in the Fault tree, possibly acting as a heat source; conversely, if the BTMS had a more complex task, e.g. operating as a generic temperature control system, this event would become possible, and this failure mode would actually represent a critical condition for the battery system. With reference to this consideration, it must be reminded that, as mentioned before, this tree has been built referring to a generic battery system, without reference to any specific application or use, and this justifies the reported probabilities; would it be applied to some specific use, it is likely that other, more relevant probability values would better represent the system behaviour. Focusing on the present analysis, it can be observed that, even though the BTMS failure has a lower probability value (8.6×10-4) compared to the other base events reported in Figure 3, these latter require the simultaneous occurrence of other base events to give rise to the Top event (Table 1S), so that, at the more substantial MCS level, BTMS failure actually represents a critical issue even from a quantitative perspective.

After the BTMS failure, the combinations of events with the second highest probability (in the order of 10-5) are reported below:

• X7 & X26: overuse and cooling system internal fouling
• X7 & X29: overuse and degraded thermal properties of coolant
• X7 & X27: overuse and high inlet T of coolant
• X17 & X26: high ambient T and cooling system internal fouling

It can be observed that, regardless of the concurrent cause of heat removal failure, the most frequent cause of cell failure is associated with an ageing factor, namely overuse (X7). Overuse and high ambient temperature (X17) appear as a frequent cause of failure also in the subsequent group of MCSs with failure probability in the order of 10-6, where they appear in 10 out of 22 MCSs. Besides these, other frequent causes of failure were found to be manufacturing defects (X6) and BMS failure (X21). As far as the causes of heat removal failure are concerned, it was found that none of them has an apparent predominance, with the exception of the cooling system internal fouling (X26), which was considered more likely.

From the discussion above, it can be summarized that both management (overuse, high ambient T) or maintenance (BTMS or BMS failure and cooling system fouling) deficiencies are deemed as main responsible for battery failure. On the other hand, numerous event combinations were estimated as extremely unlikely, with very low probabilities of occurrence (10-8-10-10), especially those involving calendar ageing (X24), the other ageing cause, and charge at low T (X13).

Table 6 reports the results of the importance analysis: for each base event, its probability, the Top Event probability calculated assuming a null probability for that base event P(TE | Pi=0), and the Fussell-Vesely coefficient based on Equation 12, are reported. It can be seen that the contribution of the basic events to the top event varies considerably. X31 is the most significant basic event, with an FV value of 0.824, meaning that it provides by far the largest contribution (82.4 %) to the overall probability of the top event, among all the basic events considered. The next most influential basic events are X7 (FV = 0.098) and X26 (FV = 0.078). After ignoring X31, only 6 out of 30 basic events have an importance larger than 1%, most of the remaining basic events having significantly lower FV values, thus indicating a substantially small contribution to the top event. For example, X13 has an FV value of only 2.48 × 10⁻⁵, while X15 has an FV value of 0, indicating no contribution at all under the conditions of the analysis.

It is apparent that the benefit of running such an analysis is to identify those basic events which should be actually prevented, independently of their own initially calculated probability of occurrence, to more efficiently reduce the overall TE probability. In the present study, the results suggest that the overall top-event probability might be strongly reduced by preventing a small number of basic events, like overusage of the cells, deterioration of the heat exchange system (in particular due to fouling) and, above all, a BTMS failure. For electric transportation applications, these results suggest that safety-oriented battery management should not rely only on detecting abnormal cell temperature, but should also account for indicators of ageing and degradation of the thermal management system. In particular, monitoring BTMS performance together with ageing-related indicators could provide an effective basis for preventive intervention before conditions leading to thermal runaway initiation are reached.

4. Conclusions and Prospects

Thermal stability of Li-ion batteries, especially under demanding conditions, still represents a critical issue which hampers the adoption of this technology in a wider range of applications. This work addressed the identification of the root causes and of the mechanisms that can bring a battery into a state where the typical irreversible exothermic reactions of the thermal runaway will be ignited, and the failure of the cell becomes almost inevitable. The analysis was kept as general as possible, to allow its adoption and adaptation in different applications based on their specific needs.

To this end, an approach based on the combination of two methodologies has been proposed:

• A conventional FTA to represent the hierarchical logical model including all the possible mechanisms which can lead to the battery final hazardous state, through their cause-effect relationships; this also allowed to identify the minimal combinations of basic events required to cause the failure of the cell (Minimal Cut Set);
• A Fuzzy logic methodology to overcome the lack of statistical data and to address the uncertainty inherent in expert judgments, to translate qualitative evaluations into numerical values and thus allowing the probabilities of failure of the system and its components to be estimated.

A comparison with previous literature results demonstrated the consistency of the proposed approach, which allowed us to identify the most critical basic events and mechanisms (MCS) that can cause the failure of a Li-ion cell.

A distinctive aspect of the proposed methodology consisted in its generality and its ability to consider scenarios and factors that have been little explored in previous studies, such as ageing and degradation phenomena. Integration of these aspects broadened the scope of the risk assessment and allowed for the inclusion of real-world situations that can significantly impact on the behavior of the storage system.

In order to check which basic events have the highest impact on the final Top Event probability, an importance analysis has been carried out. The Fussell–Vesely analysis showed that BTMS failure is the dominant contributor to the top event, while over-usage/cycling ageing and cooling-system internal fouling are the next most influential contributors. These results demonstrate that degradation-related mechanisms can play a substantial role in the propagation of critical failures, so that management deficiencies and maintenance shortcomings should be carefully addressed to improve system reliability and safety.

From a practical perspective, a further benefit of the proposed methodology lies in its potential integration into Battery Management Systems of electrified transportation platforms. Its adoption could support the development of predictive algorithms capable of implementing preventive strategies based on the continuous monitoring of identified risk scenarios and critical events, thereby enhancing the effectiveness of battery management and risk prevention.