How Lithium-Ion Batteries Are Made: From Mine to Cell to Pack

A lithium-ion battery is made in four stages. Miners and refiners turn ore and brine into battery grade lithium, nickel, cobalt, manganese and graphite compounds. Factories coat those powders onto metal foil to make electrodes, then stack or wind the electrodes into sealed cells, fill them with electrolyte and charge them slowly for the first time. Finally, cells are wired into modules and packs with cooling and a battery management system.

Each stage has its own geography, its own failure modes and its own rules. The mining stage is dominated by a handful of countries. The electrode stage is mostly about drying solvent off a moving sheet without cracking it. The cell stage happens in rooms drier than a desert. Formation, the first charge, is one of the slowest and most expensive steps in the whole plant. The pack stage is where software arrives, because the battery management system decides how hard every cell is pushed for the rest of its life. This guide walks through all of it, with figures from the US Geological Survey, US Department of Energy, the EU Batteries Regulation and the transport rules, and it extends our earlier explainers on how a car is made, how a smartphone is made and how charging ports evolved.

Key takeaways

• Batteries took an estimated 88% of global lithium use in 2025, according to the USGS. World lithium mine output outside the United States rose 31% to about 290,000 tons of contained lithium that year.
• Mining is concentrated. The USGS estimates Congo (Kinshasa) mined 73% of the world's cobalt in 2025, Indonesia mined about two thirds of the world's nickel, and China produced an estimated 82% of natural graphite.
• The three cathode families you will meet most often are lithium iron phosphate (LFP), nickel manganese cobalt (NMC) and nickel cobalt aluminium (NCA). LFP trades energy density for lower cost, longer life and no cobalt or nickel. NMC and NCA pack more energy per kilogram.
• Electrode making is mixing, coating, drying, calendering and slitting. The drying step removes solvent, and for the cathode that solvent is usually NMP, which boils at about 204 °C against 100 °C for water.
• Cells are assembled in dry rooms. One US national lab dry room is held below 0.5% humidity, a dew point of minus 53 °C.
• Formation and ageing, the first controlled charges and the rest period that follows, take days to weeks and have been estimated at up to 30% of total cell manufacturing cost.
• Before a lithium battery can ship, its design must pass the UN Manual of Tests and Criteria sub-section 38.3, which US rules in 49 CFR 173.185 require. Product safety standards such as IEC 62133-2 (portable) and UL 2580 (electric vehicle packs) sit on top.
• From 18 February 2027, every EV battery, every light means of transport battery and every industrial battery above 2 kWh placed on the EU market needs a digital battery passport, under Article 77 of Regulation (EU) 2023/1542.
• The battery management system is software. It decides charge limits, balancing and fault response, and on vehicles its updates fall under UN Regulation No 156. That makes BMS firmware a software supply chain like any other.

The whole process at a glance: mine to pack

Before going stage by stage, here is the chain in one table. "Typical output" is what leaves that step and goes to the next one.

The rest of this guide walks down that table.

Which minerals go into a lithium-ion battery, and where are they mined?

The US Environmental Protection Agency describes a lithium-ion cell as an anode layer, a cathode layer and a separator, all in contact with an electrolyte that is most often a liquid. Those parts are stacked or rolled and sealed in a steel can or an aluminium and polymer pouch. The EPA notes that aluminium, lithium, nickel, cobalt, manganese and graphite used in these batteries are all on the USGS critical minerals list.

Here is where each one came from in 2025, using the USGS Mineral Commodity Summaries 2026. All figures are estimates in metric tons of contained element unless stated, and the shares are worked out from the USGS production tables.

Lithium: brine and hard rock

Lithium comes from two kinds of deposit. Continental brines in Argentina and Chile are pumped from salt flats, and the lithium salt is concentrated, mostly by evaporation, before it is converted into lithium carbonate. Hard rock deposits, mostly the mineral spodumene, are mined in Australia, China, Brazil, Canada, Mali and Zimbabwe, crushed and concentrated, and then roasted and leached into lithium carbonate or lithium hydroxide.

The USGS 2026 lithium chapter counts the operations that supplied most of the world's lithium in 2025: four brine operations in Argentina, seven mineral operations in Australia, one mineral operation in Brazil, two in Canada, two brine operations in Chile, nine mineral and six brine operations in China, two mineral operations in Mali and five in Zimbabwe. The only commercial scale US production was a continental brine operation in Nevada.

Prices swing hard. The USGS gives the annual average US price for battery grade lithium carbonate as $63,700 per ton in 2022, $39,000 in 2023, $11,800 in 2024 and an estimated $9,000 in 2025. Spodumene concentrate at 6% lithium oxide traded in Australia at roughly $800 per ton in January 2025 and roughly $970 in November. Those swings matter to anyone planning a cell plant, because a cathode's material cost can move by a large fraction of the cell price within two years.

World lithium reserves, in the USGS estimate, are about 37 million tons, with Chile (9.2 million), Australia (8.4 million), China (4.6 million), Argentina (4.4 million) and the United States (4.4 million) holding the largest shares. Measured and indicated resources are much larger, at about 150 million tons.

Cobalt: mostly a by-product, mostly from one country

Most cobalt is mined as a by-product of copper in Congo (Kinshasa) and Zambia and of nickel elsewhere. The USGS reports that Congo (Kinshasa) temporarily banned cobalt exports in February 2025 to address oversupply and low prices, then in October replaced the ban with export quotas: 18,125 tons of contained cobalt for the rest of 2025 and up to 96,600 tons a year in 2026 and 2027, including 9,600 tons for national strategic reserves. The USGS also notes that the cobalt content of lithium-ion batteries was being reduced, and that cobalt free substitutes using iron and phosphorus, which is LFP, held significant market share in China.

Nickel: laterites and sulfides

Nickel comes from two very different ores. Sulfide ores, in Canada, Russia and Australia, are relatively easy to smelt. Laterite ores, in Indonesia, the Philippines and New Caledonia, need more energy and chemistry. The USGS puts 54% of global nickel resources in laterites and 35% in magmatic sulfide deposits. Indonesia's estimated mine production of 2.6 million tons in 2025 was about two thirds of the world total of 3.9 million tons. Australian production fell an estimated 54% as several mines went into care and maintenance because of low prices.

Manganese

Manganese for batteries is a small slice of a market that is mostly steel. The USGS lists South Africa, Gabon, Ghana and Australia as the leading producers in 2025, and estimates that South Africa holds about 70% of the world's manganese resources. Battery makers need high purity manganese sulfate, which is a refining step rather than a separate mine.

Graphite: natural flake and synthetic

Anodes use either natural flake graphite, which is mined, purified and shaped into small rounded particles called spherical purified graphite, or synthetic graphite made by heating petroleum coke or needle coke to very high temperatures. The USGS estimates China produced 82% of the world's natural graphite in 2025. It also reports that the US Department of Commerce, in preliminary results in 2025, set antidumping duties of 93.50% and countervailing duties from 11.58% to 721.03% on graphite active anode material from China, depending on the company. US imports of graphite anode material in the first eight months of 2025 were 43,400 tons, against 28,100 tons a year earlier.

Why the mining picture matters to a battery buyer

Three points stand out. First, a single chemistry choice changes which countries you depend on: an LFP cell needs lithium, iron, phosphate and graphite but no nickel or cobalt. Second, policy moves fast: an export ban, a quota or a duty can appear within a year. Third, the next stage, refining and chemical conversion, is even more concentrated than mining for several of these materials. The USGS states that plainly for refined cobalt. We do not quote a refining share for lithium or graphite here because we did not find one in the primary sources we checked.

What are the main cathode chemistries and anode materials?

The EPA notes that lithium-ion batteries are named for the chemistry of their cathode, and that chemistries differ in total energy, how fast energy is released, stability, charge speed and cycle life. It gives two examples: lithium cobalt oxide is common in consumer electronics and lithium nickel cobalt aluminium oxide is often used in electric vehicles.

The numbers in names like NMC 532 or NMC 811 are the nickel, manganese and cobalt ratio in the cathode. NMC 811 has eight parts nickel to one each of manganese and cobalt. The US Department of Energy research labs have worked through those generations. An Oak Ridge National Laboratory presentation at the DOE Annual Merit Review in 2014 used NMC 532 as its baseline cathode, and a 2021 one listed a milestone to coat an NMC 811 cathode on a roll to roll line.

Nominal cell voltage differs by chemistry. Layered oxide cells (NMC, NCA, LCO) usually sit around 3.6 to 3.7 volts nominal, and LFP cells around 3.2 volts. That difference matters for pack design, because you need more LFP cells in series to reach the same pack voltage.

Anode materials

Most anodes are graphite, natural or synthetic, sometimes blended with a few percent of silicon or silicon oxide to raise capacity. Silicon stores far more lithium per gram than graphite but swells a lot when charged, so manufacturers add it in small amounts. Lithium titanate anodes exist for very long life and fast charge at the cost of lower energy. Lithium metal anodes, used in many solid state designs, are still at an early commercial stage.

Separator, electrolyte and current collectors

The separator is a thin porous polymer film, usually polyethylene or polypropylene, often coated with ceramic. The liquid electrolyte is a lithium salt, most commonly lithium hexafluorophosphate, dissolved in a mix of organic carbonate solvents. The cathode is coated on aluminium foil and the anode on copper foil, because copper would dissolve at cathode potentials and aluminium would react with lithium at anode potentials.

How chemistry choice shows up in design and policy

The DOE Vehicle Technologies Office lists its battery goals as cutting EV battery cost to below $100 per kWh and ultimately $80 per kWh, raising range to 300 miles and cutting charge time to 15 minutes or less. The DOE Alternative Fuels Data Center says research is aimed at reducing cost, extending life, using less cobalt and addressing safety under fault conditions. Every one of those goals is a chemistry trade-off. LFP wins on cost and cobalt, high nickel layered oxides win on range.

Electrode manufacturing: mixing, coating, drying, calendering and slitting

Electrode making is a continuous roll to roll process, much like printing on a very long sheet. Here is each step.

1. Mixing the slurry

Active material powder, a conductive carbon such as carbon black, and a polymer binder are mixed with a solvent into a thick slurry. For the cathode, the binder is usually PVDF dissolved in N-methyl-2-pyrrolidone (NMP). For the graphite anode, water based binders are already standard. Mixing quality decides whether the dried electrode has an even spread of conductive carbon or clumps that become weak spots.

The ORNL work presented at the 2014 DOE merit review set out to replace NMP with water for all active materials. It listed the main problems with water based cathode slurries as agglomeration and settling, and poor wetting and adhesion on the foil.

2. Coating

The slurry is spread onto metal foil by a slot die or a comma bar at a controlled thickness, often on both sides. The University of Michigan team behind a 2022 study of formation protocols describes coating its electrodes on a roll to roll machine using the reverse comma technique at 1.5 metres per minute, to a double sided loading of 15.7 milligrams per square centimetre. Production lines run far faster than that research line, but the controls are the same: coating weight per area, edge quality and no streaks.

3. Drying and solvent recovery

The wet coating passes through long ovens that evaporate the solvent. Drying limits line speed. The ORNL 2021 merit review presentation says the conventional solvent drying process limits coating speed, needs long drying lines, takes up a large amount of plant space and carries high operating and capital cost.

The physics is simple. ORNL's 2014 slides compare the two solvents: NMP boils at 204.3 °C and has a heat of vaporisation of 50.6 kJ per mol at 100 °C, while water boils at 100 °C with 40.7 kJ per mol. NMP's vapour pressure at 40 °C is 1.0 mm Hg against 55.3 mm Hg for water. In plain words, NMP takes more heat to drive off and does not want to leave. Because NMP is costly and regulated as a workplace chemical, cathode lines recover it from the oven exhaust and recycle it.

ORNL estimated that combining all water based processing with electrodes twice as thick could save $111 per kWh usable against its baseline at the time. That is a lab estimate from 2014, useful for the direction of travel rather than as a current price.

4. Calendering

The dried electrode is pressed between heavy rollers to compress it to a target thickness and porosity. Porosity matters because liquid electrolyte must reach every particle. The Michigan study calendered both anode and cathode at room temperature to about 30% porosity. Too dense and the cell cannot deliver power; too porous and you waste volume.

5. Slitting and notching

Wide rolls are cut into narrower strips (for wound cells) or sheets (for stacked cells), and tabs are notched into the foil. Cutting must not leave burrs or loose metal flakes, because a single conductive particle that later pierces the separator can cause an internal short.

6. Vacuum drying of electrodes

Before assembly, electrode rolls are often baked under vacuum to drive out the last moisture. Water reacts with lithium hexafluorophosphate in the electrolyte to form hydrofluoric acid, which attacks the electrodes. That is why everything after this step happens in a dry room.

Cell assembly: stacking versus winding, and the three formats

Dry rooms

The ORNL battery manufacturing facility, described in its 2014 merit review slides, includes a 1,400 square foot dry room in two compartments held below 0.5% humidity, which is a dew point of minus 53 °C. It handled every assembly step from pouch forming to electrolyte filling and wetting, and at the time produced 20 to 25 pouch cells a week from powder. The Michigan study moved its electrodes into a minus 40 °C dew point dry room for final assembly and filling. Production plants run much larger dry rooms with the same purpose.

Winding versus stacking

There are two ways to put a cathode, a separator and an anode together.

• Winding: long strips of cathode, separator, anode and separator are rolled into a jelly roll. Round jelly rolls go into cylindrical cans; flattened ones go into prismatic cans or pouches. Winding is fast and well understood.
• Stacking: individual cathode and anode sheets are stacked with separator between them, either as separate sheets or with one long separator folded back and forth in a z-fold. The Michigan research cells were z-fold stacked with 7 cathodes and 8 anodes, then ultrasonically welded and sealed into a formed pouch. Stacking uses space well in flat cells and avoids the bent corners of a flattened jelly roll.

Notice the extra anode in that stack. Anodes are usually sized slightly larger than cathodes, and there is one more anode layer than cathode layer, so that every bit of cathode faces anode. If lithium leaving the cathode found no graphite to go into, it could plate as metal.

Cylindrical, prismatic and pouch formats

The EPA shows the three standard form factors using a Sandia National Laboratories schematic.

Electrolyte filling and sealing

The assembled dry cell is filled with a measured amount of electrolyte, usually under vacuum, so the liquid soaks into the pores of both electrodes and the separator. Wetting is not instant. The cell rests so the electrolyte can fully penetrate before formation. Pouch cells are often sealed with an extra gas pocket that is cut off after formation, because the first charge produces gas.

Formation and ageing: why the first charges matter

Formation is the first time a cell is charged, under tightly controlled current and temperature. During that first charge, some electrolyte reacts at the graphite surface and forms a thin layer called the solid electrolyte interphase, or SEI. A good SEI lets lithium ions through but blocks further electrolyte breakdown. A poor one keeps growing for the life of the cell and eats capacity.

The University of Michigan team, writing in 2022, describes formation and ageing as charging and discharging hundreds of thousands of cells in environmentally controlled chambers. It is a process that "takes days to weeks to complete," and earlier studies they cite estimated it at up to 30% of total manufacturing cost. Their study tested a fast formation protocol against a standard one and looked for early signals that predict lifetime.

Why so slow? Low current gives the SEI time to form evenly. Charge graphite too quickly in the first cycle and lithium can plate on its surface as metal instead of slipping between graphite layers. So formation trades time for quality.

Ageing and grading

After formation, cells rest for days to weeks, often at elevated temperature first and then at room temperature. Ageing lets the SEI settle and, more important, exposes cells with abnormal self discharge. A cell that loses voltage faster than its siblings during ageing may have a microscopic internal short from a particle or a burr. Those cells are rejected.

Grading then measures each cell's capacity and internal resistance, and sorts cells into bins. Packs are built from cells in the same bin, so no single cell is pushed harder than the others.

Worked example 1: how formation time drives factory size

Take a hypothetical plant that wants to ship 10 million cells a year, and assume formation plus ageing ties each cell up for 14 days.

• Cells started per day: 10,000,000 / 365 = about 27,400.
• Cells sitting in formation and ageing at any moment: 27,400 × 14 = about 384,000.

Halve that time to 7 days and the work in progress falls to about 192,000 cells. That is why the industry studies faster protocols so closely. Each formation channel, rack and ageing shelf is capital and floor space, and every cell on a shelf is inventory that cannot be sold yet. The numbers here are illustrative arithmetic, not data from any plant.

Module and pack assembly, thermal management and the battery management system

From cells to modules to packs

The EPA explains that multiple cells make a module and multiple modules make a pack, and that an EV pack may need hundreds or even thousands of cells, with wide variety in design. Some newer designs skip the module and place cells straight into the pack, often called cell to pack.

Pack assembly typically includes:

1. Cell sorting and placement, using graded cells from the same bin.
2. Electrical connection, with busbars or wire bonds joined by laser welding or ultrasonic welding. Every weld is tested, because a high resistance joint becomes a hot spot.
3. Sensors: voltage taps on each series group and temperature sensors at chosen points.
4. Thermal path: thermal interface material, cooling plates or channels, and sometimes fire barriers between cells.
5. Housing and sealing, with insulation and, for vehicles, a crash structure.
6. High voltage components: contactors, fuses, current sensor, pre-charge circuit, service disconnect.
7. Battery management system hardware and firmware.
8. End of line test: insulation resistance, functional checks, and the firmware and calibration flash.

Worked example 2: pack voltage and energy

Pack energy is cells in series × cells in parallel × cell voltage × cell capacity.

Example A, layered oxide car pack. Take 96 series groups, each with 4 cells in parallel, using cells of 3.65 volts nominal and 5 amp hours.

• Pack voltage: 96 × 3.65 V = 350.4 V nominal.
• Capacity: 4 × 5 Ah = 20 Ah.
• Energy: 350.4 V × 20 Ah = 7,008 Wh per string; that is only 7 kWh, so a real car pack would use many more cells in parallel. With 20 in parallel, energy is 350.4 × 100 = 35,040 Wh, about 35 kWh, from 1,920 cells.

Example B, LFP pack at the same voltage. At 3.2 volts nominal, reaching 350 volts needs 350 / 3.2 = about 109 cells in series. With large 100 Ah prismatic cells and no parallel cells, energy is 109 × 3.2 V × 100 Ah = 34,880 Wh, about 35 kWh, from 109 cells.

Same energy, very different pack: 1,920 small cells and thousands of welds against 109 large cells. That is the format choice from the previous section, showing up as a design decision.

Thermal management

Cells age fastest when hot and cannot charge quickly when cold. Packs use air cooling (cheap, limited), liquid cooling through plates or channels, or immersion in a dielectric fluid. The goal is to keep every cell in a narrow temperature band and, just as important, to keep the spread between the hottest and coolest cell small, because the hottest cell ages fastest and sets the life of the whole pack.

What the battery management system does

The battery management system (BMS) is a set of circuit boards and firmware that:

• measures every series group voltage, pack current and temperatures;
• estimates state of charge (how full) and state of health (how worn);
• enforces voltage, current and temperature limits by asking the charger or the vehicle to slow down, or by opening contactors;
• balances cells so they stay at the same state of charge;
• checks isolation between the high voltage system and the chassis;
• logs faults and communicates with the rest of the vehicle or device.

The EU now writes some of this into law. Article 14 of Regulation (EU) 2023/1542 requires that, from 18 August 2024, the BMS of stationary battery energy storage systems, light means of transport batteries and EV batteries holds up to date data for the parameters that determine state of health and expected lifetime set out in Annex VII. It also requires read only access to that data, on a non-discriminatory basis, for the person who legally bought the battery and for independent operators.

Safety testing and transport rules

Three layers of rules apply, and they answer different questions.

UN 38.3

UN 38.3 is a design type qualification. The test sequence that cell and battery makers report, numbered T.1 to T.8, is altitude simulation, thermal cycling, vibration, shock, external short circuit, impact or crush, overcharge, and forced discharge. The aim is that a design survives the pressures, temperatures, vibration and abuse of transport without leaking, venting, rupturing or catching fire. We could not fetch the UN manual itself from unece.org while writing this, so for test parameters read the current revision directly rather than relying on summaries.

US rules make 38.3 mandatory. Under 49 CFR 173.185, each lithium cell or battery must be of a type proven to meet 38.3, and the rule allows designs tested to Revision 3, Amendment 1 or any later applicable revision to continue to ship. Since 1 January 2008, every manufacturer and later distributor of lithium cells or batteries (other than button cells installed in equipment) must make a test summary available. Packages are marked UN3480 for lithium ion cells or batteries, UN3481 when they are packed with or contained in equipment, and UN3090 and UN3091 for lithium metal. The small battery provisions apply to lithium ion cells up to 20 Wh and batteries up to 100 Wh, and since the end of 2015 such batteries must show their watt-hour rating on the case. A cell or battery with a net mass over 30 kg is limited to one per outer packaging under the large battery packing rules. State of charge limits for air shipment are set by a special provision the rule cross references.

IEC 62133-2

The IEC webstore describes IEC 62133-2:2017 as specifying requirements and tests for the safe operation of portable sealed secondary lithium cells and batteries with a non-acid electrolyte, under intended use and reasonably foreseeable misuse. That first edition of Part 2 replaced the 2012 second edition of IEC 62133. A consolidated version including Amendment 1 of 2021 is available.

UL 2580

UL 2580, Batteries for Use in Electric Vehicles, is in its third edition. Its scope covers electrical energy storage assemblies such as battery packs, combined pack and capacitor assemblies, and the modules that make them up. It evaluates whether the assembly can safely withstand simulated abuse without exposing people to hazards, based on the manufacturer's specified charge and discharge parameters. Two limits are worth knowing. The standard says it does not evaluate the pack's interaction with other control systems in the vehicle, and it does not evaluate performance or reliability. E-bike and e-scooter batteries fall under UL 2271 instead. A June 2022 revision clarified how internal short circuit trigger cells are used.

Worked example 3: is this battery allowed on a plane?

The FAA allows lithium ion batteries up to 100 Wh each for passengers, and up to two spare larger batteries from 101 to 160 Wh with airline approval. Spare batteries and power banks must go in carry-on bags only, with terminals protected.

Watt-hours are volts × amp hours. If a label only shows milliamp hours, divide by 1,000 first.

• A power bank labelled 20,000 mAh at 3.7 V: 20 Ah × 3.7 V = 74 Wh. Under 100 Wh, so allowed as a spare in the cabin.
• A camera battery labelled 14.4 V, 6,700 mAh: 6.7 × 14.4 = 96.5 Wh. Allowed.
• A large laptop battery labelled 14.4 V, 9,800 mAh: 9.8 × 14.4 = 141.1 Wh. Needs airline approval and counts toward the two spare limit.

Airlines may set stricter limits, as the FAA notes.

Step by step: check a battery's rating and health on your own machines

This section uses real commands to read what the BMS of a laptop or phone battery reports. None of these commands change the battery; they read status only.

Step 1: compute the watt-hour rating from a label

A tiny script avoids arithmetic slips when you are checking several labels before a trip or a shipment.

# wh.py: convert a battery label to watt-hours
import sys

def watt_hours(volts: float, mah: float) -> float:
    return volts * mah / 1000.0

if __name__ == "__main__":
    v, mah = float(sys.argv[1]), float(sys.argv[2])
    wh = watt_hours(v, mah)
    if wh <= 100:
        note = "within the 100 Wh passenger limit"
    elif wh <= 160:
        note = "needs airline approval (101 to 160 Wh)"
    else:
        note = "above 160 Wh, not allowed in passenger baggage"
    print(f"{wh:.1f} Wh: {note}")

python3 wh.py 14.4 9800
# 141.1 Wh: needs airline approval (101 to 160 Wh)

Step 2: read battery health on Linux

The kernel exposes BMS data under sysfs. The battery may be called BAT0, BAT1 or similar.

ls /sys/class/power_supply/
cat /sys/class/power_supply/BAT0/cycle_count
cat /sys/class/power_supply/BAT0/energy_full_design
cat /sys/class/power_supply/BAT0/energy_full

# or, with UPower installed:
upower -i "$(upower -e | grep -m1 BAT)"

State of health is roughly energy_full / energy_full_design. Some batteries report charge_full and charge_full_design in microamp hours instead of energy in microwatt hours; the ratio works the same way.

Step 3: read battery health on macOS

system_profiler SPPowerDataType | grep -E "Cycle Count|Condition|Maximum Capacity"

Step 4: read battery health on Windows

From an administrator PowerShell or command prompt:

powercfg /batteryreport /output "$env:USERPROFILE\battery-report.html"

Open the report and compare "Design Capacity" with "Full Charge Capacity", and read the cycle count.

Step 5: record the firmware that made those readings

Everything above came from a BMS or a fuel gauge chip running firmware. If you build devices or packs, record that firmware as a component in your bill of materials. CycloneDX, an OWASP standard for bills of materials, has component types for both device and firmware, and its specification says a hardware device containing firmware should list a component for the hardware and a separate component of type firmware.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "components": [
    {
      "type": "device",
      "name": "pack-bms-board",
      "version": "rev-c"
    },
    {
      "type": "firmware",
      "name": "pack-bms-firmware",
      "version": "4.2.1",
      "hashes": [ { "alg": "SHA-256", "content": "REPLACE_WITH_IMAGE_HASH" } ]
    }
  ]
}

Fill in the hash from your own release pipeline. That one record lets you answer, months later, which packs in the field carry which BMS build.

Recycling routes and the EU battery passport

What happens to a used battery

The EPA describes the typical path. Batteries are collected by retailers, e-waste collectors or businesses that specialise in used electronics; EV batteries may end up at a dealer, a repair shop or a vehicle dismantler. They are identified, sorted, and sometimes partly dismantled into modules or cells. Some are repaired or repurposed. The rest are discharged or otherwise managed to prevent fire, then shredded. Shredding produces "black mass", a granular mix of cathode and anode material, plus foils and steel cans that go to separate recycling streams. The EPA points out that there are no industry standards for black mass, so its make-up varies.

The EPA also says most lithium-ion batteries are likely to be hazardous waste when discarded, because they may catch fire or explode, and would typically carry waste codes D001 (ignitable) and D003 (reactive). Fires at end of life are common.

Pyro, hydro and direct recycling compared

The DOE Alternative Fuels Data Center lists three recovery technologies at different stages of commercialisation, with mechanical shredding to black mass as a common front end.

The AFDC adds that studies show an EV battery could still hold at least 70% of its original capacity at end of vehicle life if it has not failed or been damaged, and could serve 10 years or more in a second use such as stationary storage, though the economics of second life are still evolving.

The EU Batteries Regulation in numbers

Regulation (EU) 2023/1542 of 12 July 2023 replaced the old Batteries Directive. The European Commission says it entered into force on 17 August 2023 and has applied since 18 February 2024, with many articles phased in later. It covers five categories: portable, light means of transport (LMT, such as e-bikes and e-scooters), electric vehicle, industrial and SLI (starting, lighting and ignition) batteries.

The battery passport, under Annex XIII, holds three tiers of information: public information about the battery model (including its chemistry, hazardous substances and material composition), information for notified bodies, market surveillance authorities and the Commission, and information for people with a legitimate interest such as repairers, remanufacturers, second life operators and recyclers. The Commission also adopted rules in 2025 on how recycling efficiency and material recovery rates are calculated and verified.

Note the dependency the passport creates. A passport is a database record and a web service, reached through a QR code on the battery. It has to stay available, accurate and protected for as long as the battery exists, which for a car or a grid battery can be well over a decade.

BMS firmware and over-the-air updates: the software supply chain inside the pack

Every safety limit described above is enforced, in the end, by firmware: the BMS, the charger controller, sometimes a fuel gauge chip inside a phone battery. That firmware is built from a real software stack, usually a real-time operating system or bare metal code, a hardware vendor's SDK, communication stacks such as CAN, and increasingly cryptographic libraries for secure boot and update verification. On vehicles, UN Regulation No 156, in force since 22 January 2021, requires a software update management system. It requires that the authenticity and integrity of updates be protected, that the vehicle can restore the previous version or reach a safe state after a failed update, and that updates run only when the vehicle has enough power to finish them. Its sister, UN Regulation No 155, covers cybersecurity management for the same vehicles. Those rules exist because a bad update to a BMS is not a cosmetic bug. Treat BMS firmware, the tools that build it, the factory software that flashes it and the cloud services behind battery passports as a software supply chain: know every open source component in them, know which version shipped in which pack, and patch on a schedule.

Where Safeguard fits, honestly

Safeguard does not make, test or analyse batteries, and our models are single purpose security models, not chemistry or materials tools. Safeguard does not scan firmware binaries, generate hardware bills of materials or manage devices. The fit is narrower and real: the software around the battery. If your team builds BMS firmware from source, runs factory or test software, or operates passport and fleet services, Safeguard can scan those repositories and container images for vulnerable open source components (safeguard scan --dir ., --image <name>), analyse an SBOM file your firmware build already produces (--sbom <file>), show which projects contain a given component and version, and open fix pull requests when you switch autonomous remediation on.

Common mistakes

• Treating "lithium" as one supply chain. Brine lithium and hard rock lithium come from different countries and different processes, and the cathode chemistry decides whether you also depend on nickel and cobalt.
• Comparing chemistries on energy alone. LFP's lower energy per kilogram often comes with longer cycle life, lower cost and better thermal stability. The right answer depends on the use.
• Assuming a 38.3 test summary covers product safety. UN 38.3 is a transport qualification. IEC 62133-2 or UL 2580 answer different questions, and a retailer or regulator may want both.
• Assuming UL 2580 covers the BMS's behaviour in the vehicle. The standard says it does not evaluate the pack's interaction with other vehicle control systems. Functional safety and software update rules handle that.
• Rushing formation to save money. Shorter formation is an active research area, but cutting it without data risks lithium plating and a poor SEI that costs capacity for the rest of the cell's life.
• Reading watt-hours off milliamp hours without the voltage. A 20,000 mAh label means nothing for air travel until you multiply by the nominal voltage.
• Throwing used batteries in household waste or recycling. The EPA warns these batteries start fires in waste trucks and facilities. Use a battery collection point.
• Treating the battery passport as a one-off label. It is a live record that must be available for the life of the battery, with access tiers. Plan the hosting, access control and data quality, not just the QR code.
• Not tracking BMS firmware versions per pack. When a fix ships, you need to know which packs carry the old build. Without a per-pack record, a recall becomes guesswork.
• Shipping firmware without update integrity checks. UN R156 expects authenticity and integrity protection and a safe fallback for failed updates. Devices outside its scope benefit from the same discipline.

FAQ

What raw materials are used to make lithium-ion batteries?

Lithium, plus a cathode metal set that depends on chemistry: nickel, manganese and cobalt for NMC; nickel, cobalt and aluminium for NCA; iron and phosphate for LFP. The anode is usually graphite, sometimes with a little silicon. Cells also use aluminium and copper foil, a polymer separator and an electrolyte made of a lithium salt in organic solvents.

Where does most of the world's lithium come from?

In 2025, by USGS estimates, Australia mined about 92,000 tons of contained lithium, China about 62,000, Chile about 56,000, Zimbabwe about 28,000 and Argentina about 23,000, out of about 290,000 tons outside the United States. Australia mines hard rock spodumene; Chile and Argentina pump brine.

What is the difference between LFP and NMC batteries?

LFP uses lithium iron phosphate, with no nickel or cobalt. It is cheaper per unit of material, lasts more cycles and is more thermally stable, but stores less energy per kilogram. NMC uses lithium nickel manganese cobalt oxide and stores more energy per kilogram, at higher material cost and with more dependence on nickel and cobalt supply.

How long does it take to make a lithium-ion battery cell?

Electrode coating and cell assembly move fast, but formation and ageing take days to weeks. A 2022 University of Michigan study describes formation and ageing as taking "days to weeks" in production.

What is battery formation and why does it matter?

Formation is the first controlled charge of a new cell. It builds a thin solid electrolyte interphase on the anode that lets lithium pass but blocks further electrolyte breakdown. A good SEI is one of the biggest factors in long cycle life. Formation and ageing have been estimated at up to 30% of total cell manufacturing cost.

What is the difference between cylindrical, prismatic and pouch cells?

Cylindrical cells are wound jelly rolls in steel cans, made on very fast mature lines. Prismatic cells sit in rigid rectangular cans and use pack space better. Pouch cells are sealed in a flexible aluminium and polymer laminate, are light and space efficient, but rely on the module to hold and compress them.

What does a battery management system do?

A BMS measures voltages, current and temperatures, estimates state of charge and state of health, balances cells, enforces safety limits, checks isolation and reports faults. Under the EU Batteries Regulation, the BMS of EV, LMT and stationary storage batteries must hold state of health data from 18 August 2024.

What is UN 38.3 testing?

UN 38.3 is the set of design type tests in the UN Manual of Tests and Criteria that lithium cells and batteries must pass before they can be transported. The reported sequence is altitude, thermal cycling, vibration, shock, external short circuit, impact or crush, overcharge and forced discharge. US rules in 49 CFR 173.185 require it and require a test summary.

What is the EU battery passport and when does it start?

It is an electronic record for each battery, reached by QR code, holding public, restricted and legitimate interest information about the battery model and the individual battery. Under Article 77 of Regulation (EU) 2023/1542, it is required from 18 February 2027 for every EV battery, every LMT battery and every industrial battery above 2 kWh placed on the EU market.

How are lithium-ion batteries recycled?

They are collected, sorted, discharged and shredded into black mass. Metals are then recovered by smelting (pyrometallurgy), which recovers cobalt, nickel and copper but leaves lithium in slag unless extra steps are added, or by leaching (hydrometallurgy), which can recover cobalt, nickel, lithium and manganese. Direct recycling, which keeps the cathode structure, is still mostly at smaller scale.

Why software hygiene still applies to batteries

The battery itself is made of minerals, but the systems that run it are made of code, and code is built from open source components. BMS firmware, factory test software and the cloud services behind battery passports all pull in dependencies that need tracking and patching, which is why the usual supply chain hygiene still applies here even though the fit is indirect.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos involves a battery. They show the software side of this guide: finding a vulnerable open source component in code you build, fixing it with a person approving each step, and running scans on hardware you control. To try the CLI, download it from https://safeguard.sh/download and read the setup guide at https://docs.safeguard.sh/docs/cli .

The first demo is a real Safeguard CLI session. Asked to fix the lodash CVE in a repo, it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, prints a summary and pushes nothing, then shows /permissions, /model and /scan. The same flow applies to the web dashboard or passport service that sits behind a battery fleet, or to the build tooling in a BMS firmware repository.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code, then scans from the terminal. Factory and test software often lives on isolated networks, and a runner you host yourself keeps the scan close to that code.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. For a firmware or factory software team, that means asking plain questions about which projects carry a given component version, with the assistant limited to the tools you picked.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• USGS Mineral Commodity Summaries 2026: Lithium
• USGS Mineral Commodity Summaries 2026: Cobalt
• USGS Mineral Commodity Summaries 2026: Nickel
• USGS Mineral Commodity Summaries 2026: Graphite (natural)
• USGS Mineral Commodity Summaries 2026: Manganese
• EUR-Lex: Regulation (EU) 2023/1542 concerning batteries and waste batteries
• European Commission: Batteries
• eCFR: 49 CFR 173.185, Lithium cells and batteries
• FAA: PackSafe, lithium batteries
• IEC webstore: IEC 62133-2:2017
• UL Standards and Engagement: UL 2580, Batteries for Use in Electric Vehicles
• US DOE Vehicle Technologies Office: Batteries
• US DOE Alternative Fuels Data Center: Batteries for Electric Vehicles
• US EPA: Lithium-Ion Battery Recycling
• ORNL at the DOE Annual Merit Review 2014: Aqueous processing of lithium-ion battery electrodes (ES164)
• ORNL at the DOE Annual Merit Review 2021: Electron beam cured cathodes (BAT475)
• Weng et al., Predicting the impact of formation protocols on battery lifetime immediately after manufacturing (arXiv, 2022)
• EUR-Lex: UN Regulation No 156, software update and software update management system
• EUR-Lex: UN Regulation No 155, cybersecurity and cybersecurity management system
• CycloneDX 1.6 JSON reference (component types)

Last reviewed: 23 October 2026. Mineral data, regulatory dates and standard editions change; check the linked sources for the latest figures.