archae86, #850:
Thanks for that. Have had time to have a good read now and there's quite
a bit of fresh info to fill in more of the gaps.
The key points seem to be:
1) There are two temperature sensors. One to inhibit charging when the
battery is at under or over temperature, and a second "reported to the
BCU", to control charge current. Effectively, only a single sensor to cover
charge and discharge.
2) There is a single hall effect current sensor ("dc current tranformer"),
where two might have been expected for redundancy reasons, for such a
critical function.
3) Charge balancing is done for each cell, but no info as to how this is
monitored / managed in discharge by the software.
4) The voltages of individual cells are not logged, which explains why it
hasn't been possible to determine the failure timeline and primary cause.
The only logging being the charger error codes (idiot lights) and fdr
logging of bus voltage.
5) The battery isolation contactor has normally closed contacts. Trivial
item, you may think, but in fact, it has very serious implications.
I'll try to explain how a contactor functions, with apologies to those who
know all this already. A simple contactor is nothing more than a pair of
contacts arranged as an on/off switch, as is found in eg: a domestic light
switch. Whereas a light switch is operated manually, a contactor or relay
is switched by applying power to an electromagnet/coil, which is mechanically
linked to the contacts. Spring loading against the coil provides opening
force when power is removed. The contacts may be arranged to be normally
closed or normally open, ie: switch normally on or off, with no power applied
to the coil.
In most cases, for fail safe operation, normally open contacts are used so
that in the absence of power or circuit failure, the contacts open, isolating
the circuit. In the 787 system however, the contacts are normally closed and
thus need power to open the contacts and isolate the circuit. This is opposite
to what would be expected for such an application, since there really is no
way to isolate the battery from charger or load in the event of electronic,
software or other failure. In extremis, the battery will remain connected
until the fire is put out and the wires cut.
I know i've been banging on about all kinds of issues with the design for
weeks, but more info that comes to light, the more seems to be exposed and
that's without any idea of what the underlying control software is getting
up to...