Double Penetration
A shell can continue its flight path after the initial impact, either on the outside of the tank in case of ricochet or inside of the tank following penetration of spaced armour, hull armour or external modules. A shell will continue flying for ten times its caliber (a 100mm shell will continue for 1 meter). The remaining penetration potential is the initial penetration value, randomized at the point of impact +/- 25%, minus whatever effective armour thickness that was penetrated. This remaining penetration potential is then used to calculate whether any other armour plates that are hit can be penetrated. Internal modules or crew members have no armour and thus will always get hit if any penetration potential is left in the shell.
Until update 9.3 the penetration model was simplified and after initially impacting a vehicle a shell is "bound" to this vehicle and cannot hit any other tank anymore (no longer true since). That means that a shell could neither ricochet off a tank to hit another tank within its deflected flight path, nor could a shell pass through a tank to hit another tank behind it. A shell's flight path also ended after impacting the ground and those buildings structurally invulnerable to shell damage.