edmundronald
There is a design problem in the 787 which won't go away - an APU battery failure makes the APU shutdown, so the APU is only as reliable as the battery - these two holes in the swiss cheese are aligned by design. Worse, deep discharge puts the battery at risk, but such discharge would likely occur exactly when starting the APU.
I don't think the FAA should have certified this design logic, nor do I think they should certify it now.
The APU on the 777 operates the same way - if the APU battery becomes inoperative, the APU shuts down. Other Boeing Commercial Aircraft families may operate similarly.
The risk is that in case of a double engine malfunction the APU start process would deep discharge the battery, causing battery failure, and then the battery would be taken offline by its safety mechanisms which would take the APU offline and leave the plane reliant on the RAT, and possibly incapable of an engine restart.
A double-engine failure is going to happen from one of two causes - FOD ingestion or fuel exhaustion. And both are pretty rare. Still, if such a scenario did happen, normal operation is for the Ship's Battery and APU Battery together start the APU, so the load is shared. However the APU battery can start the APU on it's own and I believe it can do so three times before the APU - not the APU battery - needs a "rest" before a fourth attempt can be made.
It is most certainly not a "one or done" situation in terms of starting attempts.