We may never get to the single root cause [of the battery events], but the process that we have applied to understanding what improvements can be made is the most robust process to improving a part in our history.

—Mike Sinnett

Background. The two Li-ion batteries on board the 787 serve two separate purposes. The main battery is used during ground maintenance operations—e.g., refueling, brake power when towing, navigation lights when towing. The auxiliary power unit (APU) battery provides ground power and provides a role in tertiary backup power in flight.

Sinnett elaborated on that last point, both to emphasize that the Li-ion batteries play no major role inflight, but also to emphasize an aspect of design philosophy:

The 787 is a more electric jet. It is considered so because we don’t have a high-pressure bleed air system [compressed air taken from within the engines for use in many different ways] on the airplane. We use electric power instead. There are two generators on each engine—four primary generators on the [two-engine] airplane. These generators in combination produce 1 MW of electrical power. However, we have been able to demonstrate continued flight safely with only a single generator operating.

In addition to the 4 primary generators, the auxiliary power unit also has two generators associated with it. If any of the primary generators fail, the auxiliary power unit is started, and the generators are brought on line to provide fill-in power. If, in the very unlikely event all four generators fail, and if, in the very unlikely event, the auxiliary power unit fails, we have a ram air turbine which deploys from the airplane to supply backup electrical power.

The only job the battery plays in any of this is to keep the displays from blinking when we transition to ram air turbine power. We do not need it in flight for safety...What I just described is significant layers of redundancy in a very safe system. This is the essence of the Boeing design philosophy.

—Mike Sinnett

Li-ion is a good solutions for these requirements, Sinnett said, due to its energy density (less weight/volume); improved charging characteristics; no memory effect; and improved storage life.

The events. Two separate thermal events occurred with 787 Li-ion batteries earlier this year: one on the ground at Logan Airport in Boston; the other in the air that saw the flight divert and land at the Takamatsu, Japan airport. Both events are still under investigation by a number of agencies, including the NTSB in the US and the JTSB in Japan.

In both events, cells vented—a safety feature—releasing hot, vaporized electrolyte which caused other cells to overheat and vent. There was no fire in the Takamatsu event; the only fire in the Logan event was two 3-inch flames at a connector outside of the battery box. (What was reported as smoke was vaporized electrolyte, Sinnett said.)

The 787 has four independent protections against overcharging (a cause of thermal runaway), and no evidence of overcharging has been found in either event. What the batteries suffered was propagation of overheating and venting, Sinnett said. The cause of the initial venting has yet to be determined.

This diagram, Sinnett noted, was an attempt to capture some 200,000 hours of engineering effort from Boeing and colleagues from other companies (automakers), the government and academia to determine causal factors and develop a solution. The team took the original design assumptions, revisited all those assumptions, and added new assumptions. It took the original fault tree, challenged it, and added additional things to the fault tree—even unlikely things, Sinnett said, “because we wanted to examine everything”. The team was able to take 80 potential things leading to failure, group them into four general categories, and then design a set of solutions that addresses all four of those general categories. While that was going on, the investigative teams are working at it from the other direction—working backwards up the chain from a battery event. These two teams working independently come together and validated the assumptions, looking at potential causes, looking at evidence from field, to work together to develop a set of solutions that addresses the 80 or so things that the designers came up with and the forensic evidence.

Enhancements. The enhancements to the battery system address potential causal factors (approximately 80) identified by the Boeing technical team as possible causes of battery failure. The technical team’s findings also were verified by an independent group of lithium-ion battery experts from a number of industries, universities and national laboratories.

The first layer of improvements is taking place during the manufacture of the batteries in Japan. Boeing teamed with Thales, the provider of the integrated power conversion system, and battery maker GS Yuasa to develop and institute enhanced production standards and tests to further reduce any possibility for variation in the production of the individual cells as well as the overall battery.

Four new or revised tests have been added to screen cell production, which now includes 10 distinct tests. Each cell will go through more rigorous testing in the month following its manufacture including a 14-day test during which readings of discharge rates are being taken every hour. This new procedure started in early February and the first cells through the process are already complete. There are more than a dozen production acceptance tests that must be completed for each battery.

Boeing, Thales and GS Yuasa have also decided to narrow the acceptable level of charge for the battery, both by dropping the charging ceiling to reduce the potential energy of the battery and also raising the voltage floor to better protect against effects from deep discharge.

Two pieces of equipment in the battery system—the battery monitoring unit and the charger are being redesigned to the narrower definition. The circuitry of the battery charger will also be adapted to ensure that the charging waveform has a more gentle effect on the battery during charging.

Changes inside the battery pack to prevent issues and reduce the impact of issues. Click to enlarge.

Changes inside the battery pack will help to reduce the chances of a battery cell fault developing and help to further isolate any fault that does occur so that it does not propagate.

To better insulate each of the cells in the battery from one another and from the battery box, two kinds of insulation will be added. An electrical insulator is being wrapped around each battery cell to electrically isolate cells from each other and from the battery case, even in the event of a failure. Electrical and thermal insulation installed above, below and between the cells will help keep the heat of the cells from impacting each other.

Wire sleeving and the wiring inside the battery will be upgraded to be more resistant to heat and chafing and new fasteners will attach the metallic bars that connect the eight cells of the battery. These fasteners include a locking mechanism.

Finally, a set of changes is being made to the battery case that contains the battery cells and the battery management unit. Small holes at the bottom will allow moisture to drain away from the battery and larger holes on the sides will allow a failed battery to vent with less impact to other parts of the battery.

View of new 787 battery enclosure, which adds another layer of protection and eliminates the potential for fire. (Door not shown) Click to enlarge.

The battery case will sit in a new enclosure made of stainless steel. This enclosure will isolate the battery from the rest of the equipment in the electronic equipment bays. It also will ensure there can be no fire inside the enclosure, thus adding another layer of protection to the battery system. The enclosure features a direct vent to carry battery vapors outside the airplane. New titanium fixtures are being installed in the electronics equipment bays to ensure the housing is properly supported.

Testing to gain FAA approval of the battery enhancements has already started, with the FAA’s permission. During engineering testing, which occurs prior to certification testing, the team demonstrated that the new enclosure could safely contain a battery failure that included the failure of all eight cells within the battery.

The “ultimate” load is the equivalent of 1.5 times the maximum force ever expected to be encountered during a battery failure. The housing easily withstood this pressure and did not fail until the pressure was more than three times the ultimate load.

Through another test, the team demonstrated that fire cannot occur within the new enclosure. Its design eliminates oxygen, making the containment unit self-inerting. Inerting is a step above fire detection and extinguishing as it prevents a fire from ever occurring. The design also vents all vapors by venting directly outside of the airplane rather than into the equipment bay.

The enclosure is very important...it eliminates the possibility of fire. It has been misreported that all we are doing is building an enclosure around a potential fire. This enclosure keeps us from ever having a fire to begin with. That’s the number one job of this enclosure; to eliminate the possibility for fire. It also helps vent vaporized electrolyte directly overboard. The number 2 job is to vent the gases The number 1 job is to prevent a fire.

We put this new design through a rigorous set of tests. We tried to find a way to introduce a fire in the containment but it just wouldn’t happen. Even when we introduced a flammable gas in the presence of an ignition source, the absence of oxygen meant there was no fire.

We drew from the new industry standard, DO311, established by RTCA, to establish our testing plan. These standards weren’t available when we set the testing plan for the baseline battery and they helped us ensure the new design is robust and safe. We intend to show, during certification, that the 787 battery meets all objectives of DO-311 and only deviates from specific requirements where the 787-unique items are not covered by the standards.

—Mike Sinnett

These improvements, which continue to undergo extensive certification testing, will allow operators to resume commercial flights with their 787s as soon as testing is complete and the US Federal Aviation Administration (FAA) and other international regulators grant their final approval.

The improvements include enhanced production and operating processes, improved battery design features and a new battery enclosure.