NASA's battery rule is not no fires; it is no propagation

The acceptance boundary

For batteries above 80 Wh using high-specific-energy cells (the presentation gives greater than 80 Wh/kg as the example threshold) with catastrophic failure modes, NASA Johnson Space Center requirements call for evaluation of a worst-case single-cell thermal runaway in the intended application and environment. The stated rule is blunt: for batteries above 80 Wh, no cell-to-cell propagation is permitted.¹

The source estimates an individual cell entering thermal runaway at roughly one in ten million, but consequence, not likelihood, drives the classification. A lithium-ion cell contains its own fuel and oxidizing chemistry. A spacecraft has limited free volume (the presentation notes the ISS holds about 800 cubic meters) and limited carbon-monoxide scrubbing, and 80 to 90 percent of the gas a failing cell emits is carbon dioxide and carbon monoxide. For small crewed vehicles the volume problem is worse, and the presentation notes the ISS can absorb only about 270 Wh of burning lithium-ion before carbon-monoxide exposure becomes excessive.

Three pathways turn one failure into many

Propagation can travel by heat, by current, or by debris, and a credible design must defeat all three. Calorimetry at Johnson Space Center, using NASA's fractional thermal runaway calorimeter, found that standard cylindrical cells release only 20 to 30 percent of their thermal-runaway energy through the casing, with the remainder carried by ejected material. Bottom-vent cells split energy three ways between casing, top ejecta, and bottom ejecta. Measured total heat release varies by cell: the presentation lists 36.6 kJ for a Molicel 18650-J up to 75.2 kJ for an LG MJ1, with standard deviations of several kJ. That ejecta fraction is what impinges on neighbors.

Current adds a second path. When a cell goes into runaway in a parallel block, the carcass becomes a hard short across the remaining cells, and the presentation warns that conduction-only testing without electrical connectivity can understate propagation because of this extra heat; current interrupt devices are not effective with multiple cells in parallel. The prescribed fix is fusing every cell in parallel and every parallel string, fast-blow on a hard short but with margin for normal and transient loads.

Mechanical failure is the third path. Sidewall breaches, where the can wall ruptures sideways, directly impinge on neighbors. Contributing factors include energy content at or above 2.6 Ah and thin can walls; the presentation gives cell can thicknesses of roughly 125 to 250 microns and reports a 10 percent sidewall-breaching rate measured for the NCR18650B under slow oven heating to runaway.

How NASA tests containment

The protocol is destructive and full-scale. The test article is the complete battery with electrical bussing and internal safety features intact, charged to the highest flight state of charge. A single cell is deliberately triggered into runaway a minimum of three times, with locations chosen to cover each unique environment or the worst case. One full-scale article may be reused across the three (or six) tests with inspection, cleaning, and refurbishment between events, and the spent trigger cell need not be replaced.

A fully successful design shows thermal runaway in only the triggered cell, leaves neighbors undamaged, unvented, unignited, and unleaking, keeps protection devices untripped, and lets neighboring cells cycle within plus or minus five percent of pre-test capacity, with no flames leaving the enclosure. An alternate containment path instead demands that no flames, sparks, gases, or fluids leave the containment vessel and that exterior vessel temperature stay at or below 60 C. A marginal pass shows no propagation and no escaping flame but allows electrical damage to neighbors, requires a minimum of six tests, and demands a design assessment showing the leaked material or degraded performance is tolerated by the battery and adjoining systems.

The strongest case for the method

The steelman is empirical. The presentation's own counterexample is the X-57 battery: a 320-cell module with 4 mm cell spacing and cell fusing, built without mitigating sidewall-breach risk or providing a real heat dissipation path, catastrophically failed single-cell propagation testing with near-simultaneous runaway of multiple cells. The compliant counterexample is the Orion superbrick, which follows all five design guidelines (support the can against sidewall rupture, no direct cell-to-cell contact, individual parallel-cell fusing, ejecta protection, flame-arresting vents) with 2 mm spacing, stainless steel sleeves, 19 A fusible links, and cell bottoms heat-sunk into an aluminum housing, achieving 140 to 160 Wh/kg at the pack level. The method demonstrably permits high specific energy; it just refuses to grant it for free. And the screening side is equally concrete: computed tomography specified to catch 50 by 50 by 20 micron metal particles, plus destructive physical analysis, acknowledges what acceptance testing cannot do, which is screen out every latent defect.

Where a skeptic should push

Three triggers on one refurbished article, however carefully located, cannot sample every latent defect, impact, soft short, assembly variation, or aging state, and the presentation says so directly: you cannot screen out all potential latent defects by acceptance testing alone, and prevention methods are rarely 100 percent effective. A marginal pass that tolerates damaged neighbors leans hard on a design assessment, which is analysis rather than demonstration. There is also an uncomfortable trade the presentation surfaces: thermally isolating cells in air keeps adjacent-cell temperature rise at 80 to 100 C but only works for cells with little sidewall-breach risk (it cites 180 Wh/kg-class cells), while providing a conductive heat path, as Orion does, cuts the rise to 50 to 70 C at similar pack energy. Every safe high-energy design is buying its propagation resistance with mass and volume, and the test protocol verifies the purchase, not the price.

Stored energy is safe only when failure pathways are designed

The non-obvious implication is that cell energy density is not a battery's mission metric; pack-level specific energy under a verified no-propagation boundary is. The opportunity is a transparent design discipline, spacing, heat rejection, individual fusing, ejecta barriers, containment, that transfers directly to lunar surface habitats, pressurized rovers, and crewed stations, where the carbon-monoxide budget scales with free volume and a 270 Wh-class event in a small pressurized volume is a mission threat, not a maintenance item. The threat is the mirror image: high-energy commercial packs whose cells are reliable individually but tightly coupled into a cascading spacecraft hazard. NASA's own storage-bag testing, where insulated fire bags trapped enough heat to propagate between batteries one to two hours after ignition until phase-change shields allowed full packing, is a small-scale rehearsal of exactly that failure.

The bottom line

High confidence: passive propagation resistance is a system property that requires destructive, full-scale verification, and NASA's pass, marginal, fail criteria are a reasonable codification of it. Moderate confidence: the prescribed repetitions provide useful margin for a stable production design. That confidence falls as chemistry, supplier, packing, charge limit, or enclosure changes, because each can alter the propagation pathways. What would strengthen the claim is published repeat-test statistics across lots; what would break it is a flight anomaly in a battery that passed this protocol.