UniFoxOs is right - they had the incredible presence of mind to immediately start the APU.

But even if there had been any power coming from the heavily damaged engines...the relight procedure (which they followed if I remember correctly) will require to set the engine master switch to off for some time, to permit ventilation of the combustion chamber, after an unsuccessful attempt - at that point there definitely can't be any generator power whatsoever.

My last post, (as some will have realised) ;) was deliberately over-dramatised.

The batteries areonly as good as their reliability and state of charge,

To pretend to oneself that they meet their functional requirements, is tobe in denial.. they have caused 50 aircraft to be grounded and god knows how many completed airframes to back-up at the factory out-door.

there have been at least 2 out-of fuel instances, plus the BA incident, plus the "Sully" incident, that i can recall in my lifetime. in commercial Pax-carrying Aviation.

Composite -structures have totally different Thermal properties to Aluminium Alloys... to have blind faith in a bunch of feckwits who designed wings that wouldn't fit. a faulty electrical system that can backfeed and flatten the second battery (if neither becomes incendiary in the interim!)...is naive in the extreme.
IMHO, they haven't had enough operating experience to really know if fuel-freezing /starvation will ever be an issue.
Prudence suggests one plans for a worst-case scenario and the multiple-backups are/ should be predicated on this
IF both main-engines fail to produce enough power (for whatever reason)
It's all in the lap of an unsafe, unreliable battery-system to start the APU
As it stands, that can't be assured, so I stand by my assertion that 2 holes line up. It cannot be denied there is a safety-critical weak link in the design...the American authorities themselves decided that grounding was more important than national pride.

As a matter of National Pride, the US Government will make sure Boeing survive this crisis...but it won't be due to the expertise of the current management of the company.

Boeing neither state nor imply that the brakes are served by the RAT.

"It's all in the lap of an unsafe, unreliable battery-system to start the APU"

I assume you've followed the changes made to the batteries?

Before the aircraft has actually been cleared (or not) to fly, you've already decided the new proposed solution is unreliable and unsafe?

How do you know it's unsafe?

Whatsthisbuttondo.
Its a regulation requirement to have an independent backup brakes source.
On a hydraulic dependent a/c the RAT will not supply enough energy to supply the brakes. Whether it has a hydraulic pump or a generator driving a pump etc.
The 787 requires an independent backup power source for its braking system. The battery is it.
It matters not a jot whether you or I calculate the odds of it being needed as 10 milllion to 1 or evens.
The regs say it needs to be there. End of.

"The 787 requires an independent backup power source for its braking system. The battery is it.
It matters not a jot whether you or I calculate the odds of it being needed as 10 milllion to 1 or evens.
The regs say it needs to be there. End of."

Yet the "regs" (the MEL) allow a 787 to dispatch without a functioning battery?

No, the MEL allows dispatch without a functioning APU battery; it's the main battery that supplies back-up power to the brakes.

APU windmill?
 

Just to be curious: Is there an APU existing, which can be started by windmilling?

The point is, if the 787 gets cleared to operated again, it will be because the FAA/NTSB/whoever decide the battery solution is safe and reliable enough.

Thus the main battery will be the back up to the brakes. Why are people suggesting or assuming the 787 will be flying around without a battery or in a perilous condition as there might be a double engine failure, then for some reason the APU won't start and THEN the (new safer more reliable) main battery will also fail?

The 787 when cleared to fly will have a backup source for the brakes as the new battery and it's associated systems will have been certified as being safe and reliable. As I ever, I expect some people have ulterior motives to scare monger but there seems to be a lot of unfounded sensationalism on this thread.

I have just looked at the Jackx 123 (posting 36) which I find very disturbing. I suggest all to give it a look. Cutting edge technology always has risks but not to learn, follow up & fix problems is unforgivable.
The 787 is cutting edge in so many ways. But I now feel that there have been so many other safety issues (not just the batteries) that the general airworthyness needs to be looked at carefully.

If we're still talking ETOPS, it seems to me that anything that might or might not happen after both engines fail is pretty much irrelevant . . .

Re: Experts
 

Perrin,

Going to call you on your statement "No manufacturer will ever ask you guys to fly in in a unsafe A/C if they knew it had a fault."

Turkish DC-10 1974

McDonnell Douglas knew that the door latch system was flawed back in 1969, Convair's Dan Applegate documented this in 1972 (Convair were fuselage sub-contractors).
McD ignored this and only made changes when the NTSB made them do so after two incidents, even then McD cosied up with the FAA who waived some of the NTSB requirements.
After the Turkish crash, McD implemented all the changes and re-designed the latch mechanism, did they know the system was unsafe, YES they damn well did.

FAA/NTSB disagreeing over the extent of fixes sound eerily familiar?

Is the 787 Main battery getting a firebox as well? :hmm:

Certified as safe: Yes. Certified as reliable: Highly unlikely.

The fireproof box and containment system appears to based on solid and proven engineering priciples, however will need to demonstrate its ability to contain the same failure scenario as on the ANA flight before it will be certified.

There are two ways to demonstrate reliability: The first is to deterministically ascertain and then eliminate the root cause of whatever caused the device to not meet the previous reliabilty certification criteria (i.e. 1 fire in 10 million hours).

The second way is to create a new device with moderate reliability claims based on engineering design, then to demonstrate higher reliability through accumulated service hours without incident.

The first method CANNOT yet be applied to the 787 battery as the root cause has not yet been determined. Most aspects of the new design such a separated/insulated individual battery cells, are containment improvements to offer better protection in the case of failure - they do not reduce the risk of the failure and thus do not increase reliability. Production changes such as tighter tolerances may help reliability, but there is no way of knowing without a deterministic confirmation of what the root cause failure mode is.

The 2nd method is what is commonly used for ETOPS certification. A new model aircraft/engine will typically have a moderate ETOPS rating based on the number of incident free test hours during certification. A case can then be made to increase the duration of the ETOPS certification as the number of incident free hours increases.

The problem for Boeing is that they don't have the luxury of time to go through thousands of hours of inflight testing of the "new" battery to demonstrate reliabilty using this method.

As such, I would expect the 787 to resume flights with a reduced ETOPS limit and stricter MEL (e.g. APU must be functional) until the reliability (or otherwise) of the "new" battery solution can be proven. I wouldn't be surprised to see additional operational requirements such as having the APU ON during takeoff, approaches and landings.

... other startups that can't say the same (Comet, A320)
 

Perrin, I don't see the link between Comet and A320. Comets crashed and killed people because of engineering failures.

The A320 hasn't done that, unless my memory has faded.

Toffeez,

If you believe that the Habsheim A320 recorders weren't switched, then no.

Personally, I believe that at a crucial stage of the A320 implementation, the facts were massaged to present a more palatable truth.

There is a design problem in the 787 which won't go away - an APU battery failure makes the APU shutdown, so the APU is only as reliable as the battery - these two holes in the swiss cheese are aligned by design. Worse, deep discharge puts the battery at risk, but such discharge would likely occur exactly when starting the APU.

IN OTHER WORDS, THE FIREBOX PROTECTION OF THE APU BATTERY MAY PREVENT A THERMAL RISK, BUT BATTERY FAILURE DUE TO DEEP DISCHARGE DUE TO IN-FLIGHT STARTING OF THE APU WILL ANYWAY TAKE DOWN THE APU EXACTLY WHEN IT IS NEEDED.

The risk is that in case of a double engine malfunction the APU start process would deep discharge the battery, causing battery failure, and then the battery would be taken offline by its safety mechanisms which would take the APU offline and leave the plane reliant on the RAT, and possibly incapable of an engine restart.


I don't think the FAA should have certified this design logic, nor do I think they should certify it now. And yes, I may be an idiot but I'm an idiot with an electronic engineering degree and a PhdD.

edmundronald
The APU on the 777 operates the same way - if the APU battery becomes inoperative, the APU shuts down. Other Boeing Commercial Aircraft families may operate similarly.


A double-engine failure is going to happen from one of two causes - FOD ingestion or fuel exhaustion. And both are pretty rare. Still, if such a scenario did happen, normal operation is for the Ship's Battery and APU Battery together start the APU, so the load is shared. However the APU battery can start the APU on it's own and I believe it can do so three times before the APU - not the APU battery - needs a "rest" before a fourth attempt can be made.

It is most certainly not a "one or done" situation in terms of starting attempts.

Point taken regarding commonality of procedure between 777 and 787, however the 777's battery is not in question.

I make it at least 6, BA09 and KLM867 (Volcanic ash), ALM980 fuel exhaustion, RYR4109 is a strong contender for 7 (Written off after emergency landing following multiple bird strikes).

Did you go one step further than reading yellow press to come to this informed opinion? :(

Can the APU be started in the case of fuel exhaustion? Is there a sump or "reserve tank" or something?

Walnut's post@51, prompted me to go back to #36 (TV programme posted by Jackx123)
I really wish I hadn't :suspect: If even 50% of that investigative journalism is true, then there's a massive amount of collusion and cover-up of which we are not aware. I had read an article elsewhere about the botched, substandard parts and assumed, like most would, "heck, they're still flying,Boeing always build like a brick outhouse,so even if the parts are a bit down on spec, there's still plenty of strength"
WRONG

Business and politics have been guiding the decisions in this matter......All the Engineering talent and informed opinion on this Forum, has a broad concensus that the 787 electrical system is fundamentally flawed,,,,,,yet it was certified safe and meeting regulatory requirements -until the evidence was overpowering and worldwide.

How the arrogant fools ever thought they could keep this hidden, I don't know. A bigger worry, is the extent of collusion by the very people who are supposed to keep the general public safe.

Bung them all on a faulty aircraft, show and explain the faults that THEY certified were safe, lock them in and fly them .....see how many have brown trousers and a new humility!

Fizz57.
No.

Edmundronald.
Very good points which I think were addressed in the Tech log thread. Fitting the APU with a dedicated PMG to power the APUC would seem the answer.

As for having no APU with a double engine failure. The Air Transat A330 into the Azores and the Gimli glider spring to mind.

APU battery
 

Kiskaloo

On B777 the APU battery can be removed with APU running as the controller receives power from the Main battery bus as well.
Strangely on B787 the APU controller has only the APU battery supply. Without that the APU shuts down.
I have no idea why this change. May be they wanted save the weight of a wire??

Dual power
 

Why all this complication of PMG. Make it like the B777, the APU controller receives power from Main Battery bus also. Keep it simple....

Hi tech.
As the reliability of both batteries is in question perhaps that is why.
Admittedly, the odds of both batteries failing at the same time...during an engine emergency...on an etops sector, are probably not worth calculating.

Some one will of course.

No ETOPS, no trips to Shemya Island?
 

ETOPS Not!
 

Until Boeing or the FAA can confirm the direct cause of the fire on either battery, the 787 should be Non ETOPS
The only way to even look at ETOPS would be a design change back to Nicad batteries and re-certification with the Nicads as part of the electrical system for the Main & Apu Batteries.
Until then, the rubbish fix which doesnt confirm the original cause of the fault, should result in the 787 staying Non ETOPS.
The Dreamliner has become the Nightmare Liner...a 78 Lemon!

Was sent this yesterday. :O

http://i82.photobucket.com/albums/j2...ps8c9de1ad.jpg

I don't think it's even possible due to space requirements to go nicad. The equivalent nicad batteries would be far larger than the li-ion ones.

I would not be surprised if the JTSB temporarily rescinds their approval to allow NH and JL to operate the 787 at ETOPS-180 and the FAA may again decide to follow their lead for PR purposes as they did with the grounding.

On the other hand, considering the 787's testing was trouble-free enough for the FAA and EASA to find the 787 suitable for ETOPS-180 operations and the plane flew without incident for over a year, which convinced the JTSB that the 787 was suitable for ETOPS-180, to issue a new ruling that finds the 787 not suitable for ETOPS-180 operation might call into question again how these agencies certify twin-engined aircraft for ETOPS at EIS and that could impact the suitability for ETOPS at EIS for new twins like the A320neo, A350 and 737 MAX.

Pretty straight forward really - they made a determination based on the evidence and granted approval. Subsequent events raised significant concerns about the capability, those events were not in evidence at the time the original determination was made.

Accordingly the evidence was reviewed and a new position, based on the additional evidence determined.

Does it call into question how certification works?

Almost certainly not. A test and compliance regime would be determined and certification granted if passed. If subsequent events mean a type no longer passes then their accreditation is reviewed.

Sounds like a sensible pragmatic process. Where's the problem? The battery fire? Sure that's bad, but if it didn't happen in testing then there's no reason to fail the accreditation process. And if subsequent events contradict the genuinely obtained results during certification then you review what certifications are granted.

How is any of this hard to understand? Things can change and the system is flexible enough to cope with that.

In three hours, the battery box would probably be down to ambient temperature, or darned near it. There's only so much stored electrical energy and electrolyte in the battery, think self extinguish. You really can't "fight" a Lithium battery fire, just safely contain it until it's out. The new vented containment system should address the fire risk very well.
Pete

Since you can fly the 787 without an APU battery or APU, we're honestly saying that because one Ship's Battery failed in flight we should therefore determine the 787 is no longer suitable for ETOPS-180?

Should we find the 767, 777 and A330 not suitable for ETOPS-180 every time one of them suffers an inflight shutdown of an engine?

Should we risk finding the A350 suitable for ETOPS-180 before EIS? Or should it suffer an IFSD or some other ETOPS-related systems failure, should we immediately find it unsuitable?

I don't think the batterymalfunction is the root cause the FAA is reconsidering; it merely wakens them up that they have certified a brand new aircraft to ETOPS right from the start, without it proving itself in line flying. First fix the teething problems (or prove that there aren't any), then let it become ETOPS

golfyankeesierra
They certified the 777 as suitable for ETOPS-180 before the first revenue flight took off from Dulles for Heathrow.

And it's assumed EASA will certify the A350 as suitable for ETOPS-180 before the first revenue flight departs Doha, so should the FAA break tradition and not accept EASA's certification suitability until the A350 accumulates sufficient flight hours to "prove itself"?

And we should remember that the 787 did fly for over a year without major incident, so how long is long enough when it comes to proving oneself with flying? For the Japanese, it was a year, and once the 787 met that requirement, they allowed NH and JL to operate it on missions with ETOPS-180.

It seems extra ordinairy meassures were taken by Boeing and the airlines to keep 787 dispatch reliability up, which is different from aircraft reliability. Even 100+ battery exchanges didn't ring a bell. The FAA is reviewing all. The question is in how far they are covering their .ss and how much the truth about 787 is becoming clear.

How Airlines Kept 787s on Schedule - WSJ.com