An Integrated Framework for Deflagration Risk Analysis in Electrochemical Energy Storage Stations: Combining Fault Tree Analysis and Fuzzy Bayesian Network

Abstract

Electrochemical energy storage is pivotal in constructing new-type power systems. However, the large-scale deployment of energy storage stations poses severe safety challenges, particularly the risk of deflagration. The coupling of combustible accumulation within battery systems and the confined structure of storage units can trigger cascading thermal runaway and deflagration accidents. Existing research still falls short in systematically analyzing the deflagration risks and process evolution mechanisms in energy storage stations. To address this gap, this study develops a probabilistic risk assessment model that enables analysis of risk propagation through the integration of fault tree analysis (FTA) with a static fuzzy Bayesian network (BN). The proposed approach delineates the complete risk evolution pathway from battery thermal runaway to deflagration in a confined space. Diagnostic reasoning identifies a dominant risk escalation path initiated by internal short circuits, leading to thermal runaway, flammable gas release, and pressure accumulation due to inadequate pressure relief. Sensitivity analysis highlights gases ejected during thermal runaway (C22) and lack of pressure relief devices or insufficient venting area (C31) as the most influential risk drivers. This study thus offers a practical, model-based framework for enhancing targeted risk prevention and safety resilience in electrochemical energy storage station infrastructure.

1. Introduction

The global transition to a low-carbon energy structure is positioning electrochemical energy storage as a strategically vital technology, due to its indispensable function in integrating intermittent renewable sources and facilitating the development of modern power systems [1,2]. According to a guiding document issued by China’s National Development and Reform Commission and National Energy Administration, new energy storage has been explicitly designated as a key initiative to underpin the development of the nation’s new power system [3]. The electrochemical energy storage industry in China has been undergoing a significant expansion, driven by strong policy support. As of June 2025, the country had put into operation a cumulative total of 1663 grid-scale electrochemical energy storage (EES) stations, with their aggregate installed capacity amounting to 75.79 GW/175.12 GWh [4]. The rapid growth of the industry is fraught with serious safety challenges, with combustion and explosion incidents becoming a global bottleneck to its sustainable development. The high energy density of EES lithium batteries is counterbalanced by their inherent chemical instability, which poses a risk of thermal runaway and consequently compromises the entire system’s safety boundary [5,6]. From 2017 to 2024, there were over 90 publicly reported fire accidents involving energy storage systems worldwide, highlighting severe safety challenges [7]. The complex risks—where battery thermal runaway converges with external system failures—are exemplified by the 2024 container-system deflagration in Thuringia, Germany (causing €700,000 in losses) and the 2021 Beijing Dahongmen incident in China.

Currently, risk assessment across various industries remains predominantly reliant on a suite of conventional methodologies. While fault tree analysis (FTA) and Event Tree Analysis (ETA) have been applied to trace the root causes of safety incidents [8,9], techniques such as the Analytic Hierarchy Process (AHP) are commonly employed to rank and assign weights to various safety-influencing factors [7,10,11]. These methods, however, demonstrate significant limitations in modeling highly nonlinear systems with multiple couplings. FTA and ETA are poorly equipped for interdependent relationships and feedback, with model scale exploding exponentially with complexity, challenging both qualitative and quantitative assessment [12]. Meanwhile, other methods like risk matrices and Delphi rely heavily on subjective input and static data, failing to depict complex causal-probabilistic interactions. They are thus inherently constrained in analyzing risk propagation and supporting probabilistic inference [7,12].

Overcoming the inherent drawbacks of traditional approaches, Bayesian Networks (BN)—a probabilistic graphical model—have shown considerable utility in process industry risk assessment. BNs excel by using multi-state nodes to represent risk factors, moving beyond simplistic binary assumptions, and by supporting bidirectional reasoning for both prediction and diagnosis [12,13]. The common practice of using expert knowledge to define network parameters alleviates the need for exact data but introduces evaluator bias. A more reliable approach involves refining this expert input with fuzzy set theory, which systematically accounts for and quantifies subjective uncertainty [14,15]. In contrast to traditional Bayesian networks that rely on crisp probabilistic inputs, the FBN method replaces these inputs with fuzzy sets. The primary innovation of the FBN framework lies in its ability to retain and propagate the epistemic uncertainty derived from expert judgments within the computational graph. This feature enhances the robustness and transparency of the risk quantification model, particularly beneficial for assessing complex systems when data is limited. Bayesian networks have been successfully applied in domains such as chemical safety [12,16], fire and explosion analysis [17,18,19], and hydrogen risk analysis [20], which confirms the method’s competence in analyzing complex systems with coupled risks.

There is a serious gap between the existing risk assessment research in the EES field and the actual situation. Most current studies focus predominantly on the thermal runaway processes of individual lithium battery cells and the associated fire and deflagration risks, yet they often fail to adequately capture the holistic risk characteristics of an entire EES station [17,21]. An EES station is not a mere aggregation of individual devices; rather, it is a complex energy system comprising thousands of cells arranged in series and parallel to form battery racks, integrated with multiple subsystems such as the Battery Management System (BMS), Power Conversion System (PCS), and thermal management system. This high level of system integration gives rise to risks that are inherently systemic, featuring chain-reaction escalation and multi-physics coupling, the complexity of which far exceeds the risk assessment of a single battery cell [22,23].

To address the need for quantitative deflagration risk assessment in EES and overcome the limitations of traditional methods in handling uncertain information and complex causal relationships, this study develops a comprehensive probabilistic risk analysis methodology that proceeds as follows. Firstly, a systematic FTA is conducted to identify risk factors and delineate the complete causal chain from initial failures to deflagration. The fault tree is then systematically mapped into a BN structure to enable probabilistic reasoning. Secondly, to compensate for the scarcity of empirical accident data in the energy storage sector, fuzzy set theory is introduced to process expert judgments for determining the prior probabilities of basic events. This approach effectively quantifies linguistic evaluations while reducing subjectivity through an expert weighting system based on professional experience and domain relevance. Finally, the established fuzzy Bayesian network is implemented in GeNIe software (University of Pittsburgh Decision Systems Laboratory) to perform causal reasoning for deflagration probability prediction, diagnostic reasoning for critical path identification, and sensitivity analysis for pinpointing core risk drivers.

The structure of the paper is organized as follows: Section 2 introduces the integrated risk assessment methodology, covering Fault Tree Analysis, fuzzy Bayesian Networks, and their mapping. Section 3 focuses on constructing and analyzing the deflagration risk model, including risk factor identification, fault tree development, Bayesian network mapping, and prior probability estimation using fuzzy expert elicitation. Section 4 presents the results, including causal reasoning, diagnostic analysis, sensitivity evaluation, and the study’s conclusions.

2. Risk Assessment Methods

2.1. Fault Tree Analysis

The Fault Tree Analysis (FTA) constitutes a top-down, deductive analytical procedure for assessing system safety and reliability (Figure 1). The process originates from a predefined top event and iteratively progresses through logical gates to delineate all potential causative basic events, resulting in a graphical representation of the deterministic causal pathways between component failures and the system-level fault [12]. The conventional FTA methodology, nevertheless, is inherently constrained by its foundations in static Boolean logic and the presumption of probabilistically independent basic events, thereby exhibiting pronounced limitations in handling common cause failures, causal event sequences, and epistemic uncertainties.

2.2. Fuzzy Bayesian Network Model

2.2.1. Bayesian Network Model

A static Bayesian Network (BN) constitutes a probabilistic graphical model utilized for representing and inferring dependency structures among variables, grounded in Bayes’ theorem and probability theory. It employs a directed acyclic graph (DAG) to model inter-variable causality, with nodes corresponding to random variables and edges representing direct probabilistic dependencies.

The foundational principle of BN is the factorization of the joint probability distribution. Consider a network comprising n variables, {X₁, X₂, …, X_n}. The joint probability distribution is factorized as shown in Equation (1) [24]:

$$P(X_1,X_2,\dots ,X_n)={\displaystyle \prod _{i=1}^{n}P}(X_i\mid \mathrm{parents}(X_i))$$

(1)

where parents(X_i) denotes the set of parent nodes pointing to X_i in the graph. This factorization leverages conditional independence, thereby significantly reducing the number of required model parameters. The marginal probability of a node X_i is given by Equation (2):

$$P(X_i)={\displaystyle \sum _{X_1,...,X_{i-1,}{X}_{i+1},...,X_n}P(X_1,...,X_n})$$

(2)

where P(X_i) is the marginal probability of the variable and (X₁, …, X_n) is the joint probability distribution of all variables.

Bayes’ theorem is employed for probabilistic inference within Bayesian networks. For instance, given some observed evidence D, the posterior probability of a variable A can be updated using the following calculation:

$$P(A\mid D)={\displaystyle \frac{P(D\mid A)P(A)}{P(D)}}$$

(3)

where P(A) represents the prior probability, P(D∣A) is the likelihood function, and P(D) is the evidence (or marginal likelihood). In the context of Bayesian network modeling, parameter learning typically involves estimating the Conditional Probability Tables (CPTs) or Conditional Probability Distributions (CPDs) from data, whereas probabilistic inference is employed to compute the posterior distribution of query variables.

2.2.2. Fuzzy Set Theory

In conventional risk assessment, precise numerical values are typically employed to describe the probability of event occurrences or the severity of their consequences. However, in practical expert elicitation processes, human judgments often contain subjectivity and ambiguity. For instance, when evaluating the “likelihood of a specific failure,” experts tend to prefer linguistic terms such as “high,” “medium,” or “low” rather than providing specific probability values. To effectively handle this uncertainty, fuzzy set theory is introduced, which quantifies such vague and imprecise concepts through membership functions, offering a powerful mathematical tool for processing fuzzy information in expert knowledge. In risk assessment, linguistic evaluations provided by experts need to be converted into fuzzy numbers for computation. This study employs trapezoidal fuzzy numbers to quantify linguistic variables. A trapezoidal fuzzy number can be represented as A = (a, b, c, d), with its membership function defined in Equation (4) and Figure 2 [25]:

$${\mu }_{\tilde{T}}(x)=\{\begin{array}{ll}0,\hfill & x<a\hfill \\ {\displaystyle \frac{x-a}{b-a}},\hfill & a\le x\le b\hfill \\ \begin{array}{l}1,b\le x\le c\\ {\displaystyle \frac{d-x}{d-c}},\end{array}\hfill & c\le x\le d\hfill \\ 0,\hfill & x>d\hfill \end{array}$$

(4)

where a and d represent the lower and upper bounds of the fuzzy number, respectively, and the interval [b, c] denotes the core where the membership degree equals 1.

Apart from facilitating the interpretation of linguistic terms, a significant benefit of utilizing fuzzy set theory in expert elicitation lies in its intrinsic ability to quantify and retain epistemic uncertainty, encompassing the variability stemming from potential individual biases within expert judgments. This method offers a clear mathematical structure to handle subjectivity, aiming to manage it rather than eradicate it.

2.2.3. Mapping Between Fault Tree and Bayesian Network

Although Fault Tree Analysis (FTA) is widely used in system risk analysis, its static and deterministic framework exhibits limitations in handling issues such as common-cause failures and multi-state variables. To overcome these shortcomings, mapping a fault tree into a Bayesian network (BN) has emerged as a powerful extension method.

As illustrated in Figure 3, this mapping process follows systematic conversion rules:

• The top event and basic events in the FTA are transformed into the leaf node and the root nodes in the BN, respectively.
• The logic gates in the FTA (e.g., AND and OR gates) are converted into conditional probability tables (CPTs) within the BN. These CPTs define the dependency relationships between parent and child nodes.
• For instance, an AND gate is equivalent to a deterministic probabilistic relationship: the child node has a probability of 1 of occurring only if all parent nodes are in the “occurred” state; otherwise, the probability is 0. Through this structured mapping, the explicit logical relationships from the fault tree are fully embedded within the graphical structure of the Bayesian network. The direct translation of logic gates (AND/OR) from deterministic Fault Tree Analysis (FTA) into binary Conditional Probability Tables (CPTs) significantly simplifies the modeling process, yet it inherently assumes that causal relationships are perfect and static. In reality, relationships between failure events often involve uncertainty, partial failures, or temporal sequences, aspects that Boolean logic struggles to fully capture. While the current strategy provides a clear and user-friendly foundation for our probabilistic model, future considerations may involve introducing dynamic Bayesian networks or fuzzy CPTs to more accurately portray these complex relationships.

2.2.4. A Prior Probability Calculation Method Based on Fuzzy Comprehensive Evaluation

Deriving prior probabilities for nodes in a Bayesian Network (BN) model of an energy storage station typically relies on extensive historical statistical data. However, the field of deflagration risk analysis for electrochemical energy storage stations faces a scarcity of such data, owing to the industry’s relatively short development history and insufficient accumulation of accident records, making it difficult to obtain ample and reliable empirical evidence. To address this issue, this study employs an integrated approach combining fuzzy set theory and expert judgment to systematically estimate the occurrence probabilities of basic events. By converting expert knowledge into fuzzy linguistic variables, the method effectively reduces the uncertainty and randomness inherent in subjective evaluations, thereby enhancing the reliability of the probability assessment. The fuzzy comprehensive evaluation method comprises the following key steps:

• Determination of Expert Weights: Expert weights are assigned using the Analytic Hierarchy Process (AHP), based on four criteria: professional title, educational background, work experience, and domain relevance;
• Design of the Linguistic Term Set: A standardized set of linguistic expressions (e.g., “Very High”, “High”) is defined, with each term mapped to a corresponding trapezoidal fuzzy number;
• Aggregation of Expert Evaluations: The fuzzy evaluations provided by multiple experts are aggregated into a comprehensive fuzzy number through a weighted averaging process;
• The specific implementation details of this methodology will be elaborated in Section 3.3, integrated with the deflagration risk model for the energy storage station.

3. Deflagration Risk Assessment and Model Construction for Energy Storage Station

3.1. Risk Identification and Fault Tree Construction

3.1.1. Risk Identification Process

Risk identification forms the basis of risk assessment, with the objective of systematically identifying potential incidents and tracing their root causes and contributing factors [26]. This is achieved through a structured knowledge-processing workflow. In this study, the risk factors associated with deflagration incidents in energy storage power stations are analyzed by considering four essential preconditions: an ignition source, combustible material, an oxidizing agent, and a confined space. This framework finds its roots in the core principles of combustion and explosion—the renowned “fire triangle”—which has been broadened to encompass deflagration hazards in enclosed settings. While established industry benchmarks like NFPA 855 [27] and GB/T 42288 [28] may not expressly detail these four elements, their technical stipulations—encompassing facets like ventilation system planning, detection of flammable gases, deployment of explosion-resistant pressure relief mechanisms, and fire compartmentalization—are fundamentally geared towards governing these four factors to avert concurrent incidents. Recent inquiries into lithium-ion battery thermal runaway additionally affirm the pivotal significance of gas aggregation, confinement, and ignition sources in amplifying deflagration risks [29,30]. Based on this theoretical foundation, we developed an indicator system to operationalize the four prerequisites for assessing deflagration risk in electrochemical energy storage stations. This system, detailed in

Table 1. Risk factors of deflagration for electrochemical energy station.

First Level Indicators	Second Level Indicators	Third Level Indicators	Description
A1 Ignition Source	B1 Electrical System Failure	C1	Insufficient torque on battery connection bolts
		C2	Aged/damaged cable insulation (short-circuit discharge)
		C3	Design flaws in power distribution cabinets (arc discharge)
		C4	Electrical circuit overload (high-temperature)
		C5	Lack of deflagration-proof electrical equipment (electrical sparks)
		C6	Grounding system failure
	B2 Battery Thermal Runaway	C7	Battery overcharge/over-discharge (exothermic side reactions)
		C8	Internal short circuit (separator damage leading to thermal runaway)
		C9	BMS voltage monitoring failure (failure of overcharge protection)
		C10	Poor thermal design of battery pack (heat accumulation)
		C11	Product defects, manufacturing contamination (local micro-short circuits)
	B3 Sparks and Hot Surfaces	C12	Mechanical impact on batteries
		C13	A short circuit caused by coolant leakage contacting metal components
		C14	Equipment friction-induced heating
		C15	Thermal management system failure
		C16	Local temperature overheating during equipment operation
A2 Combustible Materials	B4 Battery Materials	C17	Electrolyte leakage
		C18	Graphite anode dust
		C19	Conductive carbon black
		C20	Thermal decomposition of cathode materials
		C21	Separator thermal shrinkage (accelerating internal short circuits)
	B5 Thermal Runaway Products	C22	Gases ejected during thermal runaway (containing flammable H2/CO)
		C23	Electrolyte pyrolysis vapors
		C24	Molten battery casing materials
		C25	Electrode particles ejected during thermal runaway
A3 Oxidizing Conditions	B6 Oxygen Supply	C26	Improper design/control of ventilation system (continuous introduction of fresh air)
		C27	Malfunction or leakage of deflagration-proof pressure relief valves (continuous ingress of external air)
		C28	Heating, ventilation, air conditioning/ environmental control system failure (running continuously in fresh air mode)
		C29	Inerting system failure (interruption of nitrogen protection)
A4 Confined Space	B7 Physical Confinement	C30	Relatively enclosed energy storage container
		C31	Lack of pressure relief devices or insufficient venting area
		C32	Construction defects in deflagration-proof walls
		C33	Ventilation openings blocked or obstructed
	B8 Layout and Structure	C34	Insufficient spacing between battery clusters
		C35	Multi-layer non-framed containers
		C36	Blocked fire lanes
		C37	Poor equipment layout
		C38	Aging of container components (degraded blast resistance)
	B9 Confined Space Safety System Failure	C39	Gas concentration monitoring system failure
		C40	Automatic deflagration suppression system failure
		C41	Emergency ventilation system failure
		C42	Pressure relief device failure
		C43	Temperature monitoring system failure

, comprises 4 first-level, 9 second-level, and 43 third-level indicators.

The 43 third-level indicators (Table 1) were identified through a comprehensive multi-source information synthesis process. These indicators were derived from: (1) a systematic analysis of publicly reported failure incidents in battery energy storage systems (

Table 2. Overview of Causes in Typical Deflagration Accidents at Energy Storage Stations (2019–2025).

Date	Location	Project	Cause of Accident
24 September 2019	Pyeongchang, Korea	Solar energy storage system in Pyeongchang-gun, Gangwon-do	Overcharging of ternary lithium batteries caused increased voltage, leading to an internal short circuit.
19 April 2019	Arizona, USA	Arizona Public Service energy storage facility in McMicken	A defect in the battery module (initial failure of a battery cell) led to thermal runaway. Oxygen introduced by firefighters opening the compartment triggered an explosion.
6 April 2021	Chungcheongnam-do, Korea	Energy storage unit at a photovoltaic power station in Hongseong-gun	Ternary lithium battery failure.
16 April 2021	Beijing, China	Energy storage power station in Fengtai, Beijing	Gases released during battery thermal runaway ignited by an open flame or electrical spark, causing an explosion.
30 July 2021	Victoria, Australia	Tesla Megapack at the Victorian Big Battery project during testing	A coolant leakage in the cooling system caused a battery short circuit, leading to a fire that spread through the battery module.
12 January 2022	Nam-gu, Ulsan, Korea	Energy storage system provided by LG Energy Solution	A defect in the Battery Management System (BMS) led to overcharging, causing thermal runaway and subsequent explosion of released gases.
13 February 2022	California, USA	Moss Landing energy storage station in Monterey County	Overheating of multiple battery packs triggered the automatic release system.
26 May 2024	Hainan, China	Energy storage station in Wenchang, operated by China Huadian Group	The power distribution box at the bottom of the battery was damaged by external impact, causing a short circuit. This led to internal damage and arcing, igniting the batteries.
15 February 2025	Taichung, Taiwan	Energy storage system in Taichung	Storage cabinet tipped over, causing an internal short circuit and fire.
17 September 2025	California, USA	Valley Center battery storage project	Thermal runaway in an energy storage container released large amounts of gas, causing nearby containers to explode.
26 September 2025	Daejeon, Korea	KEPCO (Korea Electric Power Corporation) testing facility	Spark-generating work (welding) ignited flammable gases released by the battery system, triggering an explosion.

), capturing typical real-world accident causes; (2) insights from practical engineering experience and expert judgment obtained via structured workshops and interviews; (3) a review of standard operational and maintenance checklists used in routine safety inspections of energy storage facilities. This approach ensured the final set of risk factors was both empirically grounded and systematically structured, effectively linking historical accident patterns with potential failure modes identified by domain experts.

It is important to highlight that specific foundational environmental conditions, such as the existence of atmospheric oxygen, are not individually itemized as third-level events. These factors are acknowledged as consistent background requirements for combustion and are thus not categorized as variable risk elements. The emphasis is directed towards engineering aspects that have the potential to falter or diverge from intended design, such as instances of ventilation system malfunctions leading to the introduction of excessive oxygen or failures in inerting systems.

3.1.2. Fault Tree Construction

Based on the deflagration risk indicator system for electrochemical energy storage stations established in Section 3.1.1, the logical evolution of deflagration accidents was modeled graphically using Fault Tree Analysis (FTA). The fault tree is constructed with Deflagration in an electrochemical energy storage station as the top event. The analysis then systematically traces downward through the four necessary conditions for deflagration (ignition source, combustible material, oxidizing agent, and confined space). Through logic gates such as AND and OR, the intermediate events are linked to the underlying basic events (corresponding to the 43 third-level indicators). This structure clearly delineates the complete causal chains and failure paths from various initial faults to the eventual deflagration. The fault tree model not only intuitively illustrates the logical dependencies among risk factors but also provides a clear structural foundation for the subsequent probabilistic mapping to a Bayesian network (Figure 4).

3.2. Bayesian Network Model Mapping

Deflagration risk in electrochemical energy storage stations is characterized by multi-factor coupling, rapid escalation, and high unpredictability. Fundamentally, a deflagration is the outcome of the instantaneous interaction of four necessary components: combustible material, an oxidizing agent, an effective ignition source, and a confined space. Leveraging the pre-constructed fault tree, this research translates it systematically into a Bayesian network to facilitate probabilistic inference under uncertainty. The model was built and parameterized using the GeNIe software (University of Pittsburgh Decision Systems Laboratory), which provides efficient inference algorithms for managing probabilistic dependencies in complex Bayesian networks. The finalized Bayesian network, depicted in Figure 5, forms the computational foundation for conducting both forward prediction and backward diagnostic analysis.

3.3. The Prior Probability Determination of Root Node Based on Fuzzy Theory

To address the scarcity of historical failure data, this study employs a fuzzy comprehensive evaluation method that integrates expert judgment with fuzzy set theory. This approach systematically quantifies linguistic assessments into precise prior probabilities for the root nodes (basic events) in the Bayesian network. The core of the expert evaluation is to determine the failure likelihood for each basic event (C1–C43). Experts were provided with a reference scenario: a typical large-scale energy storage power station compliant with current safety standards (e.g., GB/T 42288). Crucially, the evaluation does not assume perfect system operation. Instead, experts were asked to quantify the probability that specific safety functions or components in such a system might fail or degrade in practice due to manufacturing defects, aging, inadequate maintenance, or operational errors. Thus, the risks in this model originate from potential deviations from the system’s designed and compliant state during its lifecycle.

3.3.1. Determination of Expert Weights

The fuzzy comprehensive evaluation begins with the determination of individual expert weights to account for their differing levels of expertise. This is achieved by employing the Analytic Hierarchy Process (AHP) to compare the relative importance of the four predefined competency criteria.

Firstly, AHP is used to compare the relative importance of four predefined competency criteria. Based on the collective judgment of the expert panel, a pairwise comparison matrix A was constructed as shown in

Table 3. Judgment Matrix.

Criterion	Professional Title C1	Educational Background C2	Work Experience C3	Domain Relevance C4
Professional Title C1	a11 = 1	a12 = 2	a13 = 1/2	a14 = 1/4
Educational Background C2	a21 = 1/2	a22 = 1	a23 = 1/3	a24 = 1/6
Work Experience C3	a31 = 2	a32 = 3	a33 = 1	a34 = 1/2
Domain Relevance C4	a41 = 4	a42 = 6	a43 = 2	a44 = 1

, where the element a_ij represents the relative importance of criterion i with respect to criterion j.

Table 3 can be further written in matrix form as follows:

$$A=\left[\begin{array}{cccc}1& 2& 1/2& 1/4\\ 1/2& 1& 1/3& 1/6\\ 2& 3& 1& 1/2\\ 4& 6& 2& 1\end{array}\right]$$

(5)

The principal eigenvector of the pairwise comparison matrix was calculated and normalized to derive the eigenvector W of the criteria:

$$W=\left[\begin{array}{c}0.140\\ 0.081\\ 0.260\\ 0.520\end{array}\right]$$

(6)

The principal eigenvalue of the corresponding matrix in Equation (5) is calculated as follows:

$${\lambda }_{\max }={\displaystyle \frac{1}{n}}{\displaystyle \sum _{i=1}^n\frac{{(AW)}_i}{W_i}}$$

(7)

where n represents the order of the matrix, A is the pairwise comparison matrix, W denotes the weight vector, and λ_max represents the principal eigenvalue.

To ensure the logical consistency of the judgment matrix, a consistency check was performed. The Consistency Ratio (CR) is calculated as follows:

$$CI={\displaystyle \frac{{\lambda }_{\max }-n}{n-1}}, CR={\displaystyle \frac{CI}{RI}}$$

(8)

where λ_max is the principal eigenvalue, CI is the consistency index, RI is the random index, and n is the matrix order. The calculated CR was 0.0038, which is below the acceptable threshold of 0.10, confirming the rationality of the pairwise comparisons. The resultant weights for the four criteria are listed as “AHP Weight” (w_k) in

Table 4. Expert competency evaluation framework and scoring standards.

Evaluation Dimension (AHP Weight, ωk)	Level Description	Intra-Dimension Score (k)
Professional Title (ω1 = 0.140)	Senior Engineer	1.0
	Intermediate Engineer	0.8
	Junior Engineer	0.6
	Technician	0.4
Educational Background (ω2 = 0.081)	Doctorate	1.0
	Master’s Degree	0.8
	Bachelor’s Degree	0.6
	College Diploma	0.4
Work Experience (ω3 = 0.260)	≥20 years	1.0
	15~<20 years	0.9
	10~<15 years	0.8
	5~<10 years	0.6
	<5 years	0.4
Domain Relevance (ω4 = 0.519)	Very Relevant	1.0
	Relatively Relevant	0.8
	Generally Relevant	0.6
	Basically Relevant	0.4

.

Second, predefined scoring scales were established within each criterion to translate an expert’s credentials into a quantitative score. These “Intra-dimension Scores” are standardized values (e.g., Senior Engineer = 1.0, Master’s degree = 0.8) as detailed in Table 4.

Finally, the comprehensive weight w_i for an individual expert is calculated using a weighted arithmetic mean model, which linearly combines the standardized scores across all dimensions according to their relative importance. The model computes a raw competency score for each expert by summing the product of each dimension score and its corresponding AHP weight, and then normalizes these scores across all experts to obtain the final weights:

$$w_i={\displaystyle \frac{{\displaystyle \sum _{k=1}^4{w}_k\times S_{i,k}}}{{\displaystyle \sum _{j=1}^N\left({\displaystyle \sum _{k=1}^4{w}_k\times S_{j,k}}\right)}}}$$

(9)

where S_i,k is expert i’s score in criterion k (from Table 4), w_k is the AHP weight for criterion k, and N is the total number of experts. This approach ensures that an expert’s comprehensive weight reflects a linear combination of their performance across all criteria, with each criterion weighted according to its predetermined importance.

The intra-dimension scores were assigned based on a combination of industry practice and expert consultation, reflecting the relative competency differentials between adjacent levels within each criterion. These standardized scores enable the quantitative integration of qualitative expert profiles.

Based on the above evaluation framework, a panel of ten experts with diverse professional backgrounds was assembled to participate in the risk assessment. The choice of a ten-member expert panel follows established conventions in judgment-based risk assessment methodologies. This panel size is deemed adequate for capturing a range of professional perspectives while remaining operationally feasible for the fuzzy aggregation process, focusing on achieving informational saturation concerning risk factors rather than statistical representation through a large sample size. The basic information of these experts is summarized in

Table 5. Profile of the expert panel.

Number	Professional Title	Educational Background	Work Experience [Years]	Domain Relevance
E1	Senior Engineer	Doctorate	≥20	Very Relevant
E2	Senior Engineer	Master’s Degree	15~<20	Very Relevant
E3	Intermediate Engineer	Master’s Degree	10~<15	Relatively Relevant
E4	Senior Engineer	Bachelor’s Degree	10~<15	Very Relevant
E5	Intermediate Engineer	Doctorate	5~<10	Relatively Relevant
E6	Junior Engineer	Master’s Degree	5~<10	Generally Relevant
E7	Technician	College Diploma	≥20	Relatively Relevant
E8	Senior Engineer	Bachelor’s Degree	<5	Basically Relevant
E9	Intermediate Engineer	Bachelor’s Degree	15~<20	Generally Relevant
E10	Junior Engineer	Master’s Degree	<5	Very Relevant

, detailing their qualifications across the four criteria: professional title, educational background, work experience, and domain relevance. This diverse panel includes senior engineers and technicians, experts with doctorates to college diplomas, and individuals with a wide range of work experience (from less than 5 years to over 20 years). Crucially, all experts possess a certain degree of domain relevance to electrochemical energy storage station safety, with several rated as “Very Relevant”. The composition of this panel ensures a multi-perspective and balanced assessment, mitigating the potential bias from any single profile. Their individual comprehensive weights w_i were subsequently calculated using Equation (9) and the scores from Table 4, which were then used to aggregate their linguistic judgments in the following sections.

The sensitivity of the model’s outputs to variations in expert weights is critical for ensuring robustness. While a detailed quantitative sensitivity analysis of the weight values could be a promising direction for future research, our current methodology incorporates a crucial feature to address this concern: the fuzzy aggregation process. This process does not reduce the weighted judgments to a single crisp probability; instead, it generates a composite fuzzy number where the width of the membership function explicitly represents the diversity of opinions within the expert panel. As a result, the uncertainty stemming from the weighting and judgment process—a significant potential bias factor—is retained and quantified as epistemic uncertainty in the fuzzy prior. This uncertainty is then propagated through the Bayesian network, ensuring that the outcomes reflect a range of credible expert inputs rather than a single, potentially fragile weighted average.

Prior to conducting the formal fuzzy language assessment, a specialized workshop was organized for the expert panel. The workshop had two primary objectives: firstly, to establish a standardized reference system scenario for the assessment; and secondly, to review and refine the descriptions of the 43 basic events outlined in Table 1. In alignment with the fault tree logic depicted in Figure 4, the experts collaborated to develop a coherent understanding of the technical definitions and scopes of each event being evaluated. This rigorous step played a crucial role in mitigating potential evaluation biases arising from differing interpretations.

3.3.2. Fuzzy Linguistic Assessment and Aggregation

Following the determination of their individual weights, the expert panel described in Table 5 was invited to assess the occurrence likelihood of each basic event using the linguistic scale provided in

Table 6. Linguistic variables and corresponding trapezoidal fuzzy numbers.

Linguistic Term	Fuzzy Numbers
Very low (VL)	(0, 0, 0.1, 0.2)
Low (L)	(0.1, 0.2, 0.2, 0.3)
Moderately Low (ML)	(0.2, 0.3, 0.4, 0.5)
Medium (M)	(0.4, 0.5, 0.5, 0.6)
Moderately High (MH)	(0.5, 0.6, 0.7, 0.8)
High (H)	(0.7, 0.8, 0.8, 0.9)
Very high (VH)	(0.8, 0.9, 1.0, 1.0)

. In line with the finding that human discriminative ability is effective within 5 to 9 intervals [15], a set of seven linguistic terms was adopted: L = {Very High (VH), High (H), Moderately High (MH), Medium (M), Moderately Low (ML), Low (L), Very Low (VL)}. Each term corresponds to a trapezoidal fuzzy number (TrFN), defined by a quadruplet (a, b, c, d).

The seven-level linguistic scale and the corresponding trapezoidal fuzzy numbers shown in Table 6 follow the standard practice in fuzzy risk assessment literature [19,31]. This design, which ensures appropriate overlaps between adjacent terms across the probability space [0, 1], explicitly represents the inherent vagueness in expert linguistic judgments.

In this study, a panel of experts was invited to assess each basic event using the linguistic scale in Table 6. For a given event, each expert’s linguistic assessment was first converted into its corresponding TrFN. The evaluations from N experts were then aggregated into a composite TrFN A using the fuzzy weighted average, as shown in Equation (10).

$$\tilde{A}={\displaystyle \sum _{i=1}^n{w}_i}{\tilde{R}}_i=\left({\displaystyle \sum _{i=1}^n{w}_i}{a}_i,{\displaystyle \sum _{i=1}^n{w}_i}{b}_i,{\displaystyle \sum _{i=1}^n{w}_i}{c}_i,{\displaystyle \sum _{i=1}^n{w}_i}{d}_i\right)$$

(10)

where ${\tilde{R}}_i$ = (a_i, b_i, c_i, d_i) is the TrFN from the i-th expert, w_i is their comprehensive weight, and ${\displaystyle \sum _{i=1}^n{w}_i}$ = 1.

3.3.3. Defuzzification to Obtain Crisp Probabilities

The aggregated composite fuzzy number A = (a, b, c, d) was then converted into a precise crisp value P* via the center of area (COA) defuzzification method. For a trapezoidal fuzzy number, the COA formula simplifies to:

$$P^{*}={\displaystyle \frac{{\displaystyle \int x}\cdot {\mu }_{\tilde{A}}(x)dx}{{\displaystyle \int {\mu }_{\tilde{A}}}(x)dx}}={\displaystyle \frac{{\left(d+c\right)}^2-cd-{\left(a+b\right)}^2+ab}{3(d+c-a-b)}}$$

(11)

where P* is the defuzzification value and ${\mu }_{\tilde{A}}(x)$ is the membership function of fuzzy. The a, b, c, and d represent the lower bound, left core point, right core point, and upper bound of the membership function, respectively.

This crisp value P*, derived for each basic event, serves as its prior probability of being in the “Occurred” state. In the subsequent Bayesian network model, this value is assigned as the marginal probability P(Node = Yes) for the corresponding root node. The conditional probability tables for intermediate and top events, which are mapped directly from the fault tree’s AND/OR logic gates, then govern the probabilistic propagation through the network during inference.

3.4. Deflagration Risk Inference for Electrochemical Energy Storage Station

3.4.1. Causal Reasoning

Using the prior probabilities of the root nodes derived from the fuzzy assessment, the Bayesian network performs forward (causal) reasoning. This computes the probability of each node being in its fault state (“Yes”), including the top event, “Deflagration”. The simulation yields a top-event probability of 28%. This value is a model-derived risk index for a defined reference scenario, which describes a large-scale, grid-connected lithium-ion battery energy storage facility. This scenario adheres to contemporary safety standards such as GB/T 42288 and includes key physical parameters like battery arrays housed in standard 40-foot freight container modules, a ventilation system designed for flammable gas dispersion, and the presence of deflagration-proof pressure relief devices. During the expert evaluation process, the focus was on assessing the likelihood of functional failures within this system. Experts evaluated not the perfect design, but the probability of components (such as sensors, cooling systems, relief valves) or software functions (like BMS logic) degrading or failing due to manufacturing flaws, aging, maintenance lapses, or human error, leading to deviations from the intended safe state.

The 28% probability signifies the model-estimated likelihood of deflagration initiation under the assumption of these latent failures, serving as a benchmark for relative risk analysis. It does not directly reflect real-world accident rates but provides a consistent, quantifiable measure for ranking risk factors, identifying system vulnerabilities, and evaluating the effectiveness of potential safety interventions within the model. This benchmark risk value originates from the experts’ assessments of the likelihood of functional failures, establishing a stable reference point for risk assessment. This underscores the model’s adaptability: in specific applications, actual engineering parameters and conditions can be incorporated as evidence inputs to enhance and refine this foundational assessment.

A detailed analysis of the risk propagation pathways (Figure 6) reveals that the primary risk contributors are the first-level indicators A2 (combustible materials), A4 (confined space, 60%), and A1 (ignition sources, 58%). These high-risk states are driven by their respective sub-indicators. Specifically, B5 (thermal runaway products) contributes 68% to the probability for A2 (combustible materials). The probability of B5 is primarily governed by highly flammable components such as C22 (gases ejected during thermal runaway, 52%) and C23 (electrolyte pyrolysis vapor, 44%). The mixing and accumulation of these substances in a confined space constitute the material basis for deflagration accidents. Meanwhile, B2 (battery thermal runaway, 67%) and B3 (sparks and hot surfaces, 62%) are the key drivers elevating the probability of A1. The formation of B2 can be traced back to electrochemical failure modes such as C7 (battery overcharge/over-discharge) and C8 (internal short circuit), which trigger internal chain reactions including exothermic side reactions and separator rupture, ultimately leading to thermal runaway. Additionally, B7 (physical confinement), with a 64% probability, significantly influences A4 (confined space). This highlights that inherent enclosed structures (e.g., storage containers) can cause dangerous pressure accumulation if the pressure relief design is inadequate. Such pressure buildup not only accelerates flame propagation but also increases the peak overpressure, thereby transforming a fire into a destructive deflagration.

3.4.2. Risk Diagnosis

Under conditions of limited data, backward inference can be employed to evaluate the safety status of electrochemical energy storage stations with respect to deflagration accidents. Using the established Bayesian network (BN) model (Figure 6), diagnostic (backward) reasoning enables the calculation of the posterior probabilities of various risk factors given that a deflagration accident has occurred, thereby identifying the most critical contributors. As shown in Figure 7, when conditioning on the occurrence of an accident (i.e., setting the top event probability to 100%), the posterior probabilities of the first-level indicators identify the most influential risk factors as A2 (combustible materials, 74%), A4 (confined space, 71%), and A1 (ignition source, 69%). Further analysis of the posterior probabilities for the second- and third-level factors (Figure 8 and Figure 9) shows that the probabilities of several key factors exceed 50%, including B2 (battery thermal runaway), B3 (sparks and hot surfaces), B5 (thermal runaway products), B7 (physical confinement), C7 (battery overcharge/over-discharge), C8 (internal short circuit), C16 (local temperature overheating during equipment operation), C22 (gases ejected during thermal runaway), C30 (relatively enclosed energy storage container), and C31 (lack of pressure relief devices or insufficient venting area). This indicates that these factors constitute critical links in the accident chain and should be prioritized in routine inspection and maintenance.

To further investigate the propagation mechanisms of key risk factors, evidence was set for first-level indicators A1, A2, and A4 (i.e., their occurrence probabilities were fixed at 100%), and the resulting posterior probability distributions of their direct child nodes (secondary factors) were analyzed. As shown in Figure 10, Figure 11 and Figure 12, bubble sizes in the bubble charts reflect the probability levels of each factor.

When A1 (ignition source) was set as evidence, the secondary factors B2 (battery thermal runaway) and B3 (sparks and hot surfaces) showed the highest posterior probabilities, at 82% and 78%, respectively. Among their corresponding third-level indicators, C7, C8, and C16 showed notable posterior probabilities of 47%, 61%, and 77%, respectively. With A2 (combustible materials) set as evidence, B5 (thermal runaway products) showed the highest probability (89%). Its associated third-level factors, C22 (gases ejected during thermal runaway) and C23 (electrolyte pyrolysis vapors), showed posterior probabilities of 71% and 47%, respectively. For A4 (confined space), set as evidence, the probability of B7 (physical confinement) reached 64%. Its corresponding third-level factors, C30 (relatively enclosed energy storage container) and C31 (lack of pressure relief devices or insufficient venting area), showed posterior probabilities of 64% and 68%, respectively.

Synthesizing these diagnostic results with the general backward inference, a dominant risk propagation pathway for deflagration accidents is identified as follows: C8 (internal short circuit) → B2 (battery thermal runaway) → C22 (gases ejected during thermal runaway) → Interaction within a space defined by C30 (relatively enclosed energy storage container) and C31 (lack of pressure relief devices or insufficient venting area) → deflagration.

The integrated analysis reveals that deflagration risk follows a distinct, cascading pathway. It originates from internal faults (C8/C16), which trigger B2 (battery thermal runaway). The resulting release of C22 serves as the primary combustible material. These flammable gases accumulate within a space characterized by C30, where C31 (lack of pressure relief devices or insufficient venting area) prevents their safe venting, leading to progressively increasing concentrations. Ultimately, ignition occurs through either a pre-existing A1 source or B2/B3 sources generated during the thermal runaway event itself.

This chain of events demonstrates that risk is not uniformly distributed. The analysis underscores that battery thermal runaway constitutes the core source of combustibles, and that inadequate pressure relief acts as a more critical risk amplifier than confinement alone. Consequently, safety management must prioritize early warning and suppression of thermal runaway at the battery source, while ensuring the reliability of pressure relief systems as a critical last line of defense. This approach enables a transition from fragmented safety measures to a systematic and targeted risk mitigation strategy.

3.4.3. Sensitivity Analysis

A sensitivity analysis was conducted on the Bayesian network model for deflagration accidents in energy storage power stations to quantify how probability variations in individual nodes affect the target node, thereby identifying their relative importance within the network. This analysis plays a critical role in risk assessment, helping to uncover system vulnerabilities and inform prevention strategies. Even minor probability fluctuations in key nodes can significantly alter the overall system risk. Thus, sensitivity analysis is essential for pinpointing critical risk drivers throughout the risk propagation process. The sensitivity analysis was conducted using the internal algorithm within GeNIe. This software computes a sensitivity coefficient for each node in the network concerning the target node (“Deflagration”). This coefficient represents the derivative of the posterior probability of the target node in relation to the prior probability of the node under examination, measuring the impact of a unit change in the latter on the former.

The analysis was performed with “Energy storage power station deflagration” set as the evidence node. The results are presented in Figure 13, where the color intensity of each node reflects its sensitivity level (darker shades indicate stronger influence). Figure 14 further highlights nodes with higher sensitivity coefficients.

The results identify several highly sensitive factors, indicated by dark red nodes: C22 (gases ejected during thermal runaway) in Group A2; B7 (physical confinement), C30 (Relatively enclosed energy storage container) and C31 (lack of pressure relief devices or insufficient venting area) in Group A4 (confined space); C16 (local temperature overheating during equipment operation). Additionally, nodes with moderate sensitivity (shades between deep red and pink) include B3 (sparks and hot surfaces), B2 (battery thermal runaway), B4 (battery materials), B5 (thermal runaway products), C7 (battery overcharge/over-discharge), C24 (molten battery casing materials), and C25 (electrode particles ejected during thermal runaway). Although of medium sensitivity, these factors still play non-negligible roles in accident progression.

3.4.4. Risk Mitigation and Preventive Maintenance Strategies

Building upon the critical risk pathway and the identification of highly sensitive nodes through causal inference and sensitivity analysis, this study outlines a comprehensive risk mitigation and operational management strategy (Figure 15). Central to this strategy is the establishment of a defense-in-depth system. Vertically, it comprises three progressively advancing technical lines of defense, targeting distinct incident stages. Horizontally, it is supported by a risk-based preventive maintenance management framework spanning the entire lifecycle of the system.

The first line of defense focuses on preempting potential incidents at their source by systematically eliminating or controlling initial conditions that could trigger accidents. This involves two key aspects: firstly, preventing battery thermal runaway through measures like advanced battery management systems, optimized temperature monitoring, and regular electrical connection maintenance to curb the generation of combustible materials at the origin. Secondly, rigorously managing potential ignition sources station-wide by adhering to deflagration-proof electrical standards, implementing electrostatic protection measures, and standardizing hot work management from system design to daily operation to eradicate ignition energy presence fundamentally.

The second line of defense aims to hinder the escalation from thermal runaway to deflagration, with a core focus on managing flammable gases. This necessitates addressing critical nodes like gas ejection during thermal runaway and pressure relief system failures by designing effective directional venting pathways and deflagration-proof pressure relief structures at module and system levels. This ensures swift redirection of flammable gases to safe zones, averting their accumulation in confined spaces and the formation of explosive atmospheres.

The third line of defense is dedicated to minimizing consequences in worst-case scenarios by mitigating damages when an deflagration occurs. It establishes a rapid linkage response mechanism integrating gas detection, early warning systems, and active fire suppression to promptly contain hazards, halt fire spread, and facilitate safe evacuation and emergency responses.

To ensure maintenance efforts are prioritized according to the risk levels identified by the model and optimal resource allocation, our work proposes a horizontal risk-based preventive maintenance management framework. This framework translates quantitative risk indicators from the Bayesian network model into specific operational decisions. It prioritizes node criticality based on diagnostic probability and sensitivity coefficients, guiding varied maintenance task priorities and frequencies. By continuously comparing actual operational data with model predictions, an “evaluation-optimization” loop is formed, enabling ongoing model calibration and maintenance strategy refinement. Through this integrated defense-in-depth system and horizontal management framework, the deflagration risk of energy storage systems is deconstructed into quantifiable, manageable engineering components.

3.5. Limitations and Future Work

The static fuzzy Bayesian network model developed in this study offers a structured analytical framework for assessing the deflagration risk of electrochemical energy storage stations. Its primary strength lies in the systematic integration of fault tree analysis’s rigorous logic with fuzzy expert judgment’s capacity to represent uncertainties. This integration enables the identification of intricate risk pathways and critical causal nodes even in the absence of accident data. It is essential to recognize that all models simplify reality, and the current framework has specific constraints. The deterministic logic gates (AND/OR) inherited from fault trees ensure clarity in initial causal relationships but may oversimplify real-world complexities by assuming independence among basic events. An essential simplification in the present FTA-to-BN conversion is the lack of explicit modeling of common cause failures (CCFs)—scenarios where multiple basic events stem from a shared root cause. This simplification may result in an underestimation of the system risk overall, as the failure probabilities of interconnected events are not entirely considered under the current assumption of event independence.

While expert priors are managed through fuzzy set processing to address cognitive uncertainties at the parameter level, incorporating physical or functional couplings at the network structure level is a crucial future direction for model enhancement. To address dependencies like CCFs in future iterations, methodological extensions could include introducing common cause parent nodes into the BN structure or employing more advanced probability gates (e.g., Noisy-OR, Noisy-AND) that can capture partial causal influences and shared failure mechanisms. Exploring the introduction of common cause failure nodes or utilizing probability logic gates like Noisy-OR to capture partial causal relationships can improve the model’s alignment with practical engineering scenarios. Furthermore, expanding the existing static framework to model accident temporal evolution through a dynamic BN and iteratively updating prior and conditional probability tables with operational and fault data accumulation has the potential to elevate this model from a fundamental risk assessment tool to an adaptive analysis platform supporting precise safety management.

4. Conclusions

This work introduces an integrated framework that merges Fault Tree Analysis with a static fuzzy Bayesian network for conducting probabilistic risk assessments related to deflagration incidents in electrochemical energy storage stations. The methodology first systematically identifies risk contributors via fault tree analysis and then maps the causal logic into a static BN. To address data scarcity, the model employs trapezoidal fuzzy numbers to quantify expert linguistic judgments for root node probabilities, with expert weights calibrated based on professional background and domain relevance. The assessment estimates a baseline deflagration probability of 28% for a typical system. Diagnostic inference reveals a primary risk escalation path: C8 (internal short circuit) → B2 (battery thermal runaway) → C22 (gases ejected during thermal runaway) → C31 (lack of pressure relief devices or insufficient venting area) combined with C30 (relatively enclosed energy storage container) → deflagration. Sensitivity analysis further highlights that ejected gases (C22) and, more critically, lack of pressure relief devices or insufficient venting area (C31) are the most sensitive risk drivers, serving as key amplifiers of deflagration risk. These results underscore that pressure relief failure is a more decisive risk amplifier than confinement alone. Therefore, safety management must prioritize early warning and suppression of thermal runaway at the battery source, while ensuring robust pressure relief systems as the ultimate line of defense. Theoretically, this research contributes a static fuzzy Bayesian network methodology that enables effective risk quantification under uncertainty. The model’s bidirectional reasoning (causal and diagnostic) extends risk assessment capabilities by enabling the inference of risk relationships and critical paths in complex, coupled systems. Practically, the model delivers actionable insights for safety management, offering specific guidance for optimizing critical systems such as gas detection, pressure relief design, and battery management. This approach facilitates the transition from generalized safety measures to precision prevention, thereby enhancing the operational resilience of electrochemical energy storage stations.