FAA Grounds 787s
Join Date: Jan 2008
Location: uk
Age: 68
Posts: 29
Likes: 0
Received 0 Likes
on
0 Posts
Thanks Turin
Thank you for lots of useful information.
Seems the maximum charging rate is 45 A. Fair enough.
So the battery load in normal flight is only the emergency light wireless receivers.
As we know there is a diode unit in the output of the main battery. My question is is not possible to have the hot battery bus fed from a transformer rectifier unit in normal flight thus keeping the diode reverse biased?
Without any doubt batteries need to be fully charged during flight and recharged during flight if used. The question is with a self discharge rate of less than 15% per month does routine inflight charging need to take place?
There has been speculation here about software in the charging system. As far as I know it is accepted practice to have software written by different teams for triplicate software flight control systems. Because you can never positively prove a software system is safe. Does this apply in some way to the quadruple battery charging system. Not that 4 is a suitable number for a voting system.
Seems the maximum charging rate is 45 A. Fair enough.
So the battery load in normal flight is only the emergency light wireless receivers.
As we know there is a diode unit in the output of the main battery. My question is is not possible to have the hot battery bus fed from a transformer rectifier unit in normal flight thus keeping the diode reverse biased?
Without any doubt batteries need to be fully charged during flight and recharged during flight if used. The question is with a self discharge rate of less than 15% per month does routine inflight charging need to take place?
There has been speculation here about software in the charging system. As far as I know it is accepted practice to have software written by different teams for triplicate software flight control systems. Because you can never positively prove a software system is safe. Does this apply in some way to the quadruple battery charging system. Not that 4 is a suitable number for a voting system.
Join Date: Jul 2007
Location: Germany
Posts: 556
Likes: 0
Received 0 Likes
on
0 Posts
Rory166,
I don't know about the 787, but this is rarely done in practice, because it doesn't really work. It is far better to have very good requirements specifications and then system specifications derived from that, and then make one very good implementation, rather than have several, which are merely "good". The resources saved from having only one team of software engineers is best put to use getting the requirements and specifications right.
Boeing tried diversity on the 777 but had to abandon it, and independent academic research also showed that diversity did not work well in practice. See this paper.
The most common error source is bad requirements, and since all diverse teams would be working from the same requirements, the software would contain many of the same errors. This is important, since it negates the whole point that diversely developed implementations would have different errors.
As far as I know, no airliner in wide use uses diversely developed software. All of them have had some problems, but none of them crashed because of flight control software problems, and the systems are generally extremely reliable. The only accident I know of concerns Qantas, where several severe injuries occurred when the flight control computers ordered an abrupt nose-down input resulting in a peak normal acceleraction of -0.8 G.
Bernd
[...] As far as I know it is accepted practice to have software written by different teams for triplicate software flight control systems. Because you can never positively prove a software system is safe. Does this apply in some way to the quadruple battery charging system. Not that 4 is a suitable number for a voting system.
Boeing tried diversity on the 777 but had to abandon it, and independent academic research also showed that diversity did not work well in practice. See this paper.
The most common error source is bad requirements, and since all diverse teams would be working from the same requirements, the software would contain many of the same errors. This is important, since it negates the whole point that diversely developed implementations would have different errors.
As far as I know, no airliner in wide use uses diversely developed software. All of them have had some problems, but none of them crashed because of flight control software problems, and the systems are generally extremely reliable. The only accident I know of concerns Qantas, where several severe injuries occurred when the flight control computers ordered an abrupt nose-down input resulting in a peak normal acceleraction of -0.8 G.
Bernd
Glad rag.
If you lose both engine's gennies then you are relying on the APU to be started, quickly. The Cabin Air Compressors (CACs) can draw up to 105KVa each, so a battery is no use there.
There is also a Ram Air scoop that opens in the left wing/body fairing. This Alternate Vent System (AVS) cannot keep the cabin pressurised though.
Posted from Pprune.org App for Android
If you lose both engine's gennies then you are relying on the APU to be started, quickly. The Cabin Air Compressors (CACs) can draw up to 105KVa each, so a battery is no use there.
There is also a Ram Air scoop that opens in the left wing/body fairing. This Alternate Vent System (AVS) cannot keep the cabin pressurised though.
Posted from Pprune.org App for Android
MEL. According to someone else who posted on one these threads.
Posted from Pprune.org App for Android
Posted from Pprune.org App for Android
Join Date: Jan 2008
Location: lancs.UK
Age: 77
Posts: 1,191
Likes: 0
Received 0 Likes
on
0 Posts
As an "outsider" I have so far resisted the temptation to post. However there seems to be a dire lack of understanding of fundamentals.
As an aside, the Bentley Arnage motor-car(carries 1 driver and 3/4 Pax.) has 2 batteries of~ 60 AH capacity. When parked, the "standby load" ( electronic "memories" and the like , is provided by ONE battery.
In an infrequently -used car, this gets discharged such that Central-Locking ceases to function...BUT the second battery has capacity to start the car and then all warning, self-check, courtesy-light-systems etc. come on -line POWER PROVIDED BY THE GENERATOR- which also , via a split-charge system, recharges BOTH batteries.
What's so different?- except the Plastic Fantastic sosts a few million more AND has 3 alternative power-sources as well as 2 batteries.
In both cases, system-power is generated "on demand" the batteries are purely a reservoir of energy to get a generator started. I'm astounded at the fact that a huge, power-hungry beast such as this, has such miniscule reserve-supplies, but there again, the chance of 4 main gennys + 2 APU gennys + a RAT genny (which "should" supply enough power to kick the APU into life) makes the need for big batteries superfluous.
As I've stated previously in other threads, the model helicopter world are early adopters of Li technology...these people WILL invest a couple of weeks' wages in a flying-machine which may well catch fire, have an electronics glitch or otherwise self-destruct.
THE RISK IS MINIMISED BY PROPER CELL-MANAGEMENT.
You note I did NOT say "Battery" Several other posters have pointed out - the charger MUST monitor EACH cell continuously.
Discharge is done also via an electronic circuit that eliminates out-of design- parameter excursions.
I find it difficult to understand why Boeing has not arranged their batteries and associated controllers on a modular basis...It should be feasible to" un plug" the battery/controller packs from the aircraft's main harness and substitute with an alternative Certified battery/controller pack......
Oh, Wait.... they had absolute blind faith in the unproven technology and didn't bother to make an alternative strategy, "just in case"
Regarding the "can't add weight, otherwise everything will demand a few extra pounds"-argument,- RUBBISH There isn't another on-board system with the KNOWN risk of unexplained spontaneous combustion .
These Lithium cells are the ONE issue where there are still unquantifiable risks.--Composites, you say?... plenty of light aircraft, racing-yachts and cars have come and gone and a huge database of knowledge has been aquired.
The Airframe is not the problem, nor the brakes, entertainment systems or aerodynamics....
Electricity and it's storage is the achilles heel of this aircraft and until it's sorted, the Press will have a field-day and feed sensationalist horror stories to the revenue-generating Pax.
Re-load-limitations.... Is the airframe Really load-limited by Pax+ luggage? -or are the majority of flights conducted mixed pax/freight.
Obviously, were one carrying lead-ingots, weight would be the consideration, but freighting, say, flowers, you run out of volume long before weight becomes an issue (other than balance )
Please don't all jump on me at once!
As an aside, the Bentley Arnage motor-car(carries 1 driver and 3/4 Pax.) has 2 batteries of~ 60 AH capacity. When parked, the "standby load" ( electronic "memories" and the like , is provided by ONE battery.
In an infrequently -used car, this gets discharged such that Central-Locking ceases to function...BUT the second battery has capacity to start the car and then all warning, self-check, courtesy-light-systems etc. come on -line POWER PROVIDED BY THE GENERATOR- which also , via a split-charge system, recharges BOTH batteries.
What's so different?- except the Plastic Fantastic sosts a few million more AND has 3 alternative power-sources as well as 2 batteries.
In both cases, system-power is generated "on demand" the batteries are purely a reservoir of energy to get a generator started. I'm astounded at the fact that a huge, power-hungry beast such as this, has such miniscule reserve-supplies, but there again, the chance of 4 main gennys + 2 APU gennys + a RAT genny (which "should" supply enough power to kick the APU into life) makes the need for big batteries superfluous.
As I've stated previously in other threads, the model helicopter world are early adopters of Li technology...these people WILL invest a couple of weeks' wages in a flying-machine which may well catch fire, have an electronics glitch or otherwise self-destruct.
THE RISK IS MINIMISED BY PROPER CELL-MANAGEMENT.
You note I did NOT say "Battery" Several other posters have pointed out - the charger MUST monitor EACH cell continuously.
Discharge is done also via an electronic circuit that eliminates out-of design- parameter excursions.
I find it difficult to understand why Boeing has not arranged their batteries and associated controllers on a modular basis...It should be feasible to" un plug" the battery/controller packs from the aircraft's main harness and substitute with an alternative Certified battery/controller pack......
Oh, Wait.... they had absolute blind faith in the unproven technology and didn't bother to make an alternative strategy, "just in case"
Regarding the "can't add weight, otherwise everything will demand a few extra pounds"-argument,- RUBBISH There isn't another on-board system with the KNOWN risk of unexplained spontaneous combustion .
These Lithium cells are the ONE issue where there are still unquantifiable risks.--Composites, you say?... plenty of light aircraft, racing-yachts and cars have come and gone and a huge database of knowledge has been aquired.
The Airframe is not the problem, nor the brakes, entertainment systems or aerodynamics....
Electricity and it's storage is the achilles heel of this aircraft and until it's sorted, the Press will have a field-day and feed sensationalist horror stories to the revenue-generating Pax.
Re-load-limitations.... Is the airframe Really load-limited by Pax+ luggage? -or are the majority of flights conducted mixed pax/freight.
Obviously, were one carrying lead-ingots, weight would be the consideration, but freighting, say, flowers, you run out of volume long before weight becomes an issue (other than balance )
Please don't all jump on me at once!
Join Date: Jul 2002
Location: UK
Posts: 3,093
Likes: 0
Received 0 Likes
on
0 Posts
Boeing's T7 software was always going to be significantly more complex than that of the Airbus series, simply by nature of the systems design - that may be why they ran into probems and abandoned the methodology.
Last edited by DozyWannabe; 23rd Jan 2013 at 12:21.
FCC software design in the 1980s (A320)
Bernd and Dozy,
The flight control computers on the A320 - ELACs (2 off) and SECs (3 off) - each have a control channel and a monitor channel. IIRC, in both cases the software for the control side was written by a different team from the monitor side. (The ELACs come from a different vendor to the SECs.)
There is no voting system. If a monitor channel is in disagreement with its control channel, the relevant computer shuts down.
Bernd, you are of course right (correct!) to say that the design team has to know what it needs, and communicate its requirements to all the software teams without ambiguity. IIRC, they used either Maths or logic diagrams (AND/OR gates, etc.).
The flight control computers on the A320 - ELACs (2 off) and SECs (3 off) - each have a control channel and a monitor channel. IIRC, in both cases the software for the control side was written by a different team from the monitor side. (The ELACs come from a different vendor to the SECs.)
There is no voting system. If a monitor channel is in disagreement with its control channel, the relevant computer shuts down.
Bernd, you are of course right (correct!) to say that the design team has to know what it needs, and communicate its requirements to all the software teams without ambiguity. IIRC, they used either Maths or logic diagrams (AND/OR gates, etc.).
Last edited by Chris Scott; 23rd Jan 2013 at 13:14. Reason: Title and third para added.
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes
on
0 Posts
The genesis of the original discussion around discrete, or divergent (anomalous) design, originated with the initial EAD re: pitots, AF447, AFAIK.
Actually, before that, with BA038, and common (ICE/FUEL) failure that cost a Hull, and a compound fracture of a Femur.
EG: had 038 been powered by a GE on the starboard side, the accident would not have occurred.
That actually more precisely describes anomalous SPEC....
Actually, before that, with BA038, and common (ICE/FUEL) failure that cost a Hull, and a compound fracture of a Femur.
EG: had 038 been powered by a GE on the starboard side, the accident would not have occurred.
That actually more precisely describes anomalous SPEC....
TURIN and sb_sfo,
Thanks for all that! A number of morsels to chew over with relish. Should have remembered how paranoid the Yanks are on sharing their technology. (Unlike we Brits, who hand it all away for free!) When, in 1986, our two A310s ended up being sold to Colonel Gaddafi (RIP...), the US govt went mad about the possible leakage of info, in relation to the GE engines, IIRC.
First thoughts are it's very interesting that the APU is normally run throughout a 90-minute turnround. Just like the old days!!! In the late, increasingly "green", 1990s, many airports got very excited if we didn't shut ours down within 5 mins of arrival... Is this a particularly quiet, low-polluting APU?
Yesterday, I proposed on this thread that the APU could be left running off-load from the beginning of the flight until the end of an ETOPS leg. This might be an interim measure if charging of the APU battery in flight was considered unsafe until a new charge system is developed. From what you say now, is the APU battery already restored to a fully-charged condition by the end of a 90-minute turnround with the APU running? If so, it would solve that problem.
Chris
Thanks for all that! A number of morsels to chew over with relish. Should have remembered how paranoid the Yanks are on sharing their technology. (Unlike we Brits, who hand it all away for free!) When, in 1986, our two A310s ended up being sold to Colonel Gaddafi (RIP...), the US govt went mad about the possible leakage of info, in relation to the GE engines, IIRC.
First thoughts are it's very interesting that the APU is normally run throughout a 90-minute turnround. Just like the old days!!! In the late, increasingly "green", 1990s, many airports got very excited if we didn't shut ours down within 5 mins of arrival... Is this a particularly quiet, low-polluting APU?
Yesterday, I proposed on this thread that the APU could be left running off-load from the beginning of the flight until the end of an ETOPS leg. This might be an interim measure if charging of the APU battery in flight was considered unsafe until a new charge system is developed. From what you say now, is the APU battery already restored to a fully-charged condition by the end of a 90-minute turnround with the APU running? If so, it would solve that problem.
Chris
Last edited by Chris Scott; 23rd Jan 2013 at 14:54. Reason: (1st) Typos. (2nd) acknowledgment to sb_sfo, & 1st para extended.
Join Date: Jul 2007
Location: Germany
Posts: 556
Likes: 0
Received 0 Likes
on
0 Posts
DozyWannabe,
The way the A320's computers were developed is not the same as what we mean here by diversity. In the stricter sense this means identical functionality, fulfilling the same requirements is implemented by different teams of developers.
The paradigm for the A320 was two-fold, but both aspects are different from diversity:
- There are different types of computers that perfom different, but partially overlapping functions. These may or may not be made by different developers or even different companies. E. g. there are the ELACs performing elevator and aileron control in normal and alternate laws, and the SECs, which could also perform elevator control, but in degraded laws. So both types were not developed to the same requirements, but to different ones.
- The other idea was hardware-diversity, in that all computers have independent command and monitor channels, that perform the same functions, and according to the same requirements, but run on different hardware, in case of the ELACs Motorola 68000 for the command channel and Intel 80186 for the monitor channel, if I recall correctly. If command and monitor channel disagree, the computer considers itself failed and shuts down.
In large parts already for the A320, and more so for later models, automatic code generation was used from formal specifications. Still not sure about different teams for command and monitor channel.
See, e. g. Chapter 12 of The Avionics Handbook.
(I just saw this crosses with Chris Scott's post ...)
Bernd
The way the A320's computers were developed is not the same as what we mean here by diversity. In the stricter sense this means identical functionality, fulfilling the same requirements is implemented by different teams of developers.
The paradigm for the A320 was two-fold, but both aspects are different from diversity:
- There are different types of computers that perfom different, but partially overlapping functions. These may or may not be made by different developers or even different companies. E. g. there are the ELACs performing elevator and aileron control in normal and alternate laws, and the SECs, which could also perform elevator control, but in degraded laws. So both types were not developed to the same requirements, but to different ones.
- The other idea was hardware-diversity, in that all computers have independent command and monitor channels, that perform the same functions, and according to the same requirements, but run on different hardware, in case of the ELACs Motorola 68000 for the command channel and Intel 80186 for the monitor channel, if I recall correctly. If command and monitor channel disagree, the computer considers itself failed and shuts down.
In large parts already for the A320, and more so for later models, automatic code generation was used from formal specifications. Still not sure about different teams for command and monitor channel.
See, e. g. Chapter 12 of The Avionics Handbook.
(I just saw this crosses with Chris Scott's post ...)
Bernd
sb_sfo,
Thanks for the MMEL reference. 4 ED gennies does seem a safe situation to start ETOPS 180, particularly as you have the Main battery and the RAT to cater for a (temporary) double flameout.
The double engine failure, leading to a forced landing/ditching, is not part of the ETOPS remit, I guess, but the Main battery and RAT should give you enough EIS to perform it.
Thanks for the MMEL reference. 4 ED gennies does seem a safe situation to start ETOPS 180, particularly as you have the Main battery and the RAT to cater for a (temporary) double flameout.
The double engine failure, leading to a forced landing/ditching, is not part of the ETOPS remit, I guess, but the Main battery and RAT should give you enough EIS to perform it.
Last edited by Chris Scott; 23rd Jan 2013 at 15:04. Reason: Typo
Join Date: Dec 2010
Location: Middle America
Age: 84
Posts: 1,167
Likes: 0
Received 0 Likes
on
0 Posts
Hi Chris,
A little info for you on the B787 APU. It was designed and built by Hamilton-Sundstrand, now part of United Technologies. The model is the APS5000. It weighs 540 lbs. and develops 1,100 shaft horsepower. It is a variable speed APU, speed determined based on temperature and altitude. It is 50% quieter and has 10% lower emissions compared to a B767 APU. This makes it less objectionable to being run on the ground at a gate during a relatively short turn around situation. If it is shut off during flight, it is capable of being started at any altitude during flight up to 43,100 feet which is remarkable for a turbine engine, usually they don't like to start very well at high altitudes.
My understanding is that for a B787 ETOPs flight to take place, the APU and associated generators must be operable or the plane can't fly an ETOPs route.
sb-sfo pointed out:
This is surprising to me in that the usual problem with small turbines is core lock or near core lock. This is because the tolerances between the rotating parts and the outside diameter casing are tighter to prevent leakage and efficiency losses, much more important on a small engine verses a large engine. The down side is the casing cools much faster and shrinks around the internal rotating components. Since the engine is so short forward to aft, I would think the shaft would not bow.
and Lyman, Pratt & Whitney doesn't start either GE or RR engines on the B787, UTC does, P&W is a separate division entirely...
TD
A little info for you on the B787 APU. It was designed and built by Hamilton-Sundstrand, now part of United Technologies. The model is the APS5000. It weighs 540 lbs. and develops 1,100 shaft horsepower. It is a variable speed APU, speed determined based on temperature and altitude. It is 50% quieter and has 10% lower emissions compared to a B767 APU. This makes it less objectionable to being run on the ground at a gate during a relatively short turn around situation. If it is shut off during flight, it is capable of being started at any altitude during flight up to 43,100 feet which is remarkable for a turbine engine, usually they don't like to start very well at high altitudes.
My understanding is that for a B787 ETOPs flight to take place, the APU and associated generators must be operable or the plane can't fly an ETOPs route.
sb-sfo pointed out:
There is a limitation on the APU that once it is shut down, it requires 25 minutes cooldown due to shaft bowing before it can be restarted.
and Lyman, Pratt & Whitney doesn't start either GE or RR engines on the B787, UTC does, P&W is a separate division entirely...
TD
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes
on
0 Posts
TD
and Lyman, Pratt & Whitney doesn't start either GE or RR engines on the B787, UTC does, P&W is a separate division entirely...
Don't mind me, I was reminiscing about some work I got to do on a generation plant that backed up a substantial wind farm. The energy came from a stack of JT8Ds, and I was thinking the HS APU puts out just about the same power as the much larger Turbine. My bad.....
and Lyman, Pratt & Whitney doesn't start either GE or RR engines on the B787, UTC does, P&W is a separate division entirely...
Don't mind me, I was reminiscing about some work I got to do on a generation plant that backed up a substantial wind farm. The energy came from a stack of JT8Ds, and I was thinking the HS APU puts out just about the same power as the much larger Turbine. My bad.....
Join Date: Jul 2007
Location: My Stringy Brane
Posts: 377
Likes: 0
Received 0 Likes
on
0 Posts
The Chicago Tribune reports:
Japan: overcharging unlikely cause of Dreamliner woes
TOKYO/WASHINGTON (Reuters) - Japanese regulators have joined their U.S. counterparts in all but ruling out overcharged batteries as the cause of recent fires on the Boeing Co 787 Dreamliner, which has now been grounded for a week worldwide.
TOKYO/WASHINGTON (Reuters) - Japanese regulators have joined their U.S. counterparts in all but ruling out overcharged batteries as the cause of recent fires on the Boeing Co 787 Dreamliner, which has now been grounded for a week worldwide.
Solving the battery issue has become the primary focus of the investigation, but with excess voltage more or less off the table, investigators are still hunting for a possible cause.
Last weekend the U.S. National Transportation Safety Board said the fire on a Japan Airlines Co Ltd 787 in Boston was not due to excess voltage, and on Wednesday, Japanese officials all but ruled it out for the incident on an All Nippon Airways Co Ltd plane there.
"On the surface, it appears there was no overcharging," said Norihiro Goto, chairman of the Japan Transport Safety Board, at a media briefing.
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes
on
0 Posts
If the discussion was to halt now, and a spontaneous ignition solution had to derive, dendrites due age and lack of monitoring would be my posit....Maybe an MRI of each cell periodically? (I jest)...sort of
in the scheme of things, I give Boeing an A+ for the composite solution to efficiency, an A+ for its elegant electrical system, an A+ for their part in powerplant development, and an F for the ironic and more or less last resort choice of Lithium chemistry.
A two hundred million dollar ship grounded by regulated, demanded back up batteries
Probably unnecessary, so long as all served aerodromes have a start cart. Maybe Airbus can get the archaic requirement for batteries extinguished in time for the 350?
Dendrites as "Fossils"? Likewise FAA regs?
in the scheme of things, I give Boeing an A+ for the composite solution to efficiency, an A+ for its elegant electrical system, an A+ for their part in powerplant development, and an F for the ironic and more or less last resort choice of Lithium chemistry.
A two hundred million dollar ship grounded by regulated, demanded back up batteries
Probably unnecessary, so long as all served aerodromes have a start cart. Maybe Airbus can get the archaic requirement for batteries extinguished in time for the 350?
Dendrites as "Fossils"? Likewise FAA regs?