The fire they could only watch

The firefighters recognised the address the moment the call came in. They had toured the Moss Landing battery building, inspected it, and in 2021 responded to an incident there when some batteries began to smoke. This was not an unfamiliar site. Yet when an engine reported flames shooting from the roof that afternoon, and the batteries went into thermal runaway, the crews found there was nothing they could do but monitor it. The fire was too hot to approach, water could not extinguish it, and applying water risked shorting undamaged batteries and spreading the event. The county ordered more than 1,200 residents to evacuate. The building — Phase 1 of one of the largest battery plants in the world — was a complete loss.

That single image — trained firefighters who knew the building, reduced to watching it burn — is the whole lesson. It was not a failure of courage or competence. It was that the hazard, once it began, was beyond the reach of the tools and tactics anyone had. Thermal runaway in a mass of lithium-ion cells is not a fire you fight; it is an energy release you contain and wait out. And if the realistic response is containment and evacuation, then the time to make the event survivable was long before the alarm — in how the system was designed, detected and prepared for.

Moss Landing's Phase 1 batteries were housed in a repurposed former turbine building — a 1950s-era structure once described in the project application as robust and non-combustible. It placed large numbers of high-energy battery racks together in a single enclosed space, without the compartmentalisation that newer modular, containerised designs use to stop a fire spreading from one unit to the next. The project had no local precedent; reporting describes planning commissioners being given assurances rather than analysis. One commissioner who had voted to approve later said, publicly and plainly, that she had been wrong.

This is the latent condition of the whole case: a new, high-energy hazard deployed at world-leading scale faster than the design rules, suppression technology and emergency doctrine to manage its worst-case failure had matured. The standards now most associated with battery storage — NFPA 855 for installation, UL 9540A for fire testing — and the modular, lower-energy-chemistry designs that newer sites use, have advanced considerably since Moss Landing was conceived. The hazard did not wait for the standards to catch up. It rarely does. A technology can be commissioned and earning revenue years before the discipline to contain its failures is settled.

Because runaway cannot be reversed once it is established, the only place to stop it is before it starts — at the high-temperature precursor, in a single cell or module, before it propagates to its neighbours. Everything about a safe battery installation serves that window: early detection that alarms on the first thermal anomaly, physical separation so a failing cell cannot cascade, and chemistry and state-of-charge choices that lower the susceptibility in the first place. Massing high-energy racks in one undivided space does the opposite — it removes the firebreak and lets one cell's failure recruit thousands more.

Moss Landing had given signals before. There were high-temperature incidents at the site in 2021 and 2022 that triggered warning systems without becoming fires. After them, the operator reported taking corrective actions to its very-early-warning system; investigative reporting and litigation have since alleged that those changes may have degraded that early-warning capability and were made without testing first. Those claims are contested and the cause is still under investigation, so treat them as allegations, not findings. But the principle stands regardless of this case: the early-warning system is the one barrier that protects your only window, and it must never be degraded, bypassed or modified without rigorous testing.

At Moss Landing, overhead sprinklers proved ineffective and were deactivated during the response; preliminary findings reported by investigators point to rack-level suppression — pressure-relief and aerosol systems — not activating as intended, allowing the runaway to spread between modules. Whatever the final cause, the engineering truth is unforgiving: water does not extinguish a battery in runaway and can worsen it, and a suppression system that does not match the failure mode is decoration. So the design must assume the fire cannot be put out — and build instead for containment, separation, and a worst-case that the surrounding people and structures can survive.

For any novel high-energy or high-consequence technology — battery storage is only the example — this gate runs before you deploy it and while you operate it.

1. Characterise the worst-case failure before deployment — Demand that the failure modes — for batteries: thermal runaway, module-to-module propagation, a toxic plume, water being ineffective — are defined and engineered for in advance. Assurances that something is "non-combustible" are not a hazard analysis; insist on the analysis.
2. Engineer the firebreak: separation and containment — Never mass concentrated energy in one undivided space. Use compartmentalisation or modular isolation so a single failure cannot propagate to the rest — the firebreak that the Moss Landing layout did not have.
3. Protect the early-detection window — Early detection of the first thermal anomaly is the only point at which runaway can be stopped. Never degrade, bypass or change the early-warning system without rigorous testing — the precursor is your sole warning, and once it passes there is no second chance.
4. Match suppression to the failure mode — and know its limits — Confirm the suppression actually works on this hazard, and design for the case where it does not: water cannot extinguish a battery in runaway. If the realistic outcome is "contain and burn out," the layout and siting must make that survivable for people and neighbours.
5. Pre-brief emergency responders and the community — Before commissioning, local responders must know the technology, that the standard playbook (such as water) may not apply, and the toxic-plume and evacuation plan. The people who will manage the worst day should not be meeting the hazard for the first time on that day.

Applied to Moss Landing, the chain breaks at steps 2 and 3: a genuine firebreak — compartmentalisation or modular isolation — would have stopped one module's failure from taking the whole building, and a protected detection window would have caught the precursor while it was still one cell. The firefighters' inability to do anything but watch was not the start of the failure. It was the designed-in consequence of everything the gate exists to prevent.

The first four cases in this series were failures of known hazards poorly controlled. Moss Landing is different: a new hazard deployed faster than the discipline to hold it. That is its warning. When a technology outruns the playbook, the playbook ends up being written in the incident — in evacuations, in a total loss, in metals settling over wetlands. The practitioner's job, with anything new and energetic, is to refuse that sequence: understand the worst case before scaling, engineer the firebreak, protect the detection window, match the suppression, and brief the people who will have to live with the failure. A hazard you have deployed faster than you can control is not yet an asset. It is a fire you have not yet been forced to watch.

"A technology you have deployed faster than you can control is not an asset yet. It is a hazard you have not finished designing."