Modeling and testing are used to characterize consequences of a first lithium-ion cell having an internal short. The vulnerability of a second lithium-ion cell being induced into thermal runaway by the energy released by the first cell undergoing an internal short is quantified. Characteristics of the packaging of Li-ion cells within a battery pack are analyzed. Combined, these analyses determine the robustness required of a cell in order to withstand a nearby cell's internal short given that the battery is maintained within the specified operational envelope by a BMS and this envelope is modified in real-time as required to meet the safety requirement. Robustness factors are: age, history of charging/discharging, as well as immediate state of charge and environment. In operation, the cell's operational history is incorporated into a model. When the model indicates cell robustness at a predetermined lower limit, operation of the cell is ceased or limited.