So its not a surprise.... Engineers have been designing systems, with the assumption that batteries are not going to fail. With the technology that we had... that was fine. Batteries didn't fail, so having a system that in this particular scenario, required the APU to run, to operate the vents, to control a fire... was fine.... because the battery wouldn't set on fire and go off line in the first place...

My point is that it is clearly not enough to simply insulate the batteries a little more and vent any fire out of the aircraft.... Thought has to be given to the implications of failure of batteries, that appears to have been a scenario not worth bothering about previously.

The APU shut down when its battery failed because it needs an independant pwr supply to fire off its fire bottles if the unit (APU) catches fire. An APU frequently runs unmonitored on the ground.

KiloMikeDelta
 

As an experienced programmed with 30+ years exerience, writing anything in processor machine code increases the risk. Languages like C++, Ada, Forth et al, were deleveloped to both abstract the program away from the physical processor but to also allow the programmer to work at a higher level. The only time software is really required in machine code is when speed, critical sections and/or complete control over the hardware is required.

While at University studying Computer Science, one of my lecturers told us about his year sabbatical at Nasa working on Cat III landing projects. The problems they encountered were rarely the software being written in a high level language, but where two or more software processes made very sensible assumtptions (when viewed in isolation) "what if something goes wrong, do this...." actions, but when combined together made life terrifying for the poor pilot.

If software is to blame for these battery events, then it it will be down to two or more "assumptions" not lining up correctly.

Reply to various questions raised.
 

The interim report has given a lot of points for discussion on info that was not available.
But I give below answers (as much as I know) for some of the questions raised by various, though some are irrelevant to this thread.

Prior to landing brakes are selected on through the auto brake system. Pilot selects the deceleration rate depending on aircraft weight, runway length available, dry/wet condition etc. But the brakes are not applied till the air/gnd sensing circuit has sensed that the aircraft weight has come on wheels. The anti-skid system also plays a part in keeping the brakes released on most aircraft till that time. This is true on all aircraft from B747 on wards.

The recording is actually of some one turning off the Main battery switch in the cockpit. It was probably done by the engineer to de-power the aircraft completely as there was a fire in one zone. Such action is normal.


On most aircraft I know, APU fire protection is through the APU battery. So it could be same here, (I have not seen the WDM for this plane). You do not want to run an APU on ground without the fire protection. Do you?


This aircraft and most Boeing types are fitted with a smoke detector in the duct that carries the cooling air out of the electronics bay. That way all the electronic boxes etc are monitored. It is like fitting a smoke alarm near the exhaust fan of a room than any one location inside the room. These equipment are force cooled, so this arrangement is possible.

You are right. I don't want this but I also don't think its wise to have the smoke handling systems for the APU battery, require the APU to keep running... If that can't be achieved with the APU battery off-line... Last paragraph of page 34.... As I said... someone needs to think through the implications of battery failures.

Here's another opinion piece on the Boeing 787 situation, and it says many of the things already posted on this forum. What's interesting is that the author comes from the financial industry, yet still reaches many of the same conclusions.

Annals of quantitative overconfidence, Boeing edition | Felix Salmon

Mark in Ca:

How about: "Selective generalisations of the facts to support his case, from someone
who obviously has no idea what he's talking about, but may have his own agenda".

Sorry, but it needs to be said. There's enough scaremongering over this already...

E/E Cooling
 

quentec

When Boeing conceived and designed B787 some of the legacy system design was almost same as the older Boeing planes. What we have on this aircraft is not a smoke evacuation system, but an equipment cooling, by drawing air from the cabin by using a fan to blow the air through the electronic racks. This air is exhausted on ground to the outside. In flight this air which is warm, is ducted in to the cargo compartment to conserve the heat energy. A smoke detector is there only to divert this air when a smoke is detected in these ducts. In flight, by opening valves air and smoke is vented outside through the same port which is used on ground. Diff air pressure will do the job. No point in dumping the smoke in to the cargo.
This design is the same from B747 classic of 1960s design. When Boeing designed the B787 they had no idea that their battery will go up in smoke in violent fashion. They stuck to the legacy design as the battery fire was not in their mind then.
When APU shuts down, the venting also stops (on ground) as the Fan blowing the air will also stop, and there is no diff pressure. Functionally, I doubt if this vent duct can with stand a lithium overheated discharge. Now Boeing is coming out with a strong box and external venting. Details are unknown, and I am sure it will not be through the existing ducts which are very thin fiber material. It will require a re-design as well. watch this space.

and how would using x86 or whatever processor being used make any difference? What you'd end up with is a much harder job of writing code. As it is C/C++, PL/1, Ada etc have code-checkers, well defined, certified compilers, assertion libraries which make writing in these high(er) level langauges MUCH safer than writing at the level of bare metal.

language isn't the issue, since the language is simply there to express
a solution to a problem. After all, you want to program solutions to the
problem, not get a first in processor architecture :8. The more that the
problem can be expressed in high level structured form, the better and
assembler is just too low level and non portable to be of any use. It's also
much more bug prone and difficult to maintain.

Speaking as an ancient 6502 bod from 1977 vintage and one who still programs
things like startup code in assembler, I would much rather be programming in
C, but agree wholeheartedly that C++ is a step too far for any critical
embedded work, irrespective of how fashionable it is. There are good reasons
as well...

They almost fried the Flight Control Battery
 

@Turin:

According to Ben Sandilands, they nearly fried the Flight Control backup battery as well:Dreamliner crisis: JAL 787 was at risk of 2nd battery fire | Plane Talking

The Firebox would seem like a good idea, essential in my opinion, if you want to fly Li-Ion batteries.

But as I said before, my problem with Li-Ion batteries is not that they catch fire, but that they fail. I don't think Lithium Ion batteries are sufficiently reliable for safety-critical aviation service.

Cheers

Hudson APU
 

APU: Unsung hero of the engine world
Print
By: JOHN CROFT WASHINGTON DC 12:00 5 Oct 2010 Source: Flight

Auxiliary power units (APUs) do their dull and dirty work hidden away in aircraft tailcone compartments, unlike their turbine engine brethren connected to the wings or empennage.

On occasion however, the tables get turned.

On a bitterly cold Thursday in January 2009, the Honeywell 131-9A APU in the tailcone of a US Airways A320 that had just departed New York's LaGuardia airport came to the rescue after the aircraft struck a flock of geese. With both CFM56 turbofans damaged and the associated electrical generators eventually knocked off line, the APU during the final seconds of the ditching provided the power needed to keep the flight controls, displays and envelope protections in place to allow the pilot to touch down in the Hudson River in control and at the lowest possible airspeed.

Intensity of Fire
 

“This test resulted in venting with smoke but no fire,” the NTSB reported.

Boeing also consulted with other companies about their experience with the use of similar lithium-battery cells and “based on this information, Boeing assessed that the likelihood of occurrence of cell venting would be about one in ten million flight hours.”

Yet all of this analysis badly missed the mark. The probabilities proved to be off by a factor of 200.

The 787 that caught fire in Boston had logged just 169 flight hours.

And the entire operational fleet of 787s had logged a total 51,662 in-service hours, plus about 6,000 flight-test hours.

On the day of the Boston fire, the battery did not behave as predicted.

The battery’s power discharge was “not at the constant rate described by the Boeing or Thales documents and included large changes and reversals of power within short periods of time,” the report states.

The fire that day was small but intense.

Boston airport firefighters encountered heavy smoke in the passenger cabin and had to forcibly extract a smoking, hissing, popping, chemical-spewing battery from the belly of the plane.

Interviews by the NTSB revealed the firefighters did not know they were dealing with a lithium-ion battery, and they had great difficulty putting out the fire.

When Capt. Mark Munroe of the airport’s aircraft rescue and firefighting unit entered the plane, he “saw heavy white smoke billowing through the floor” of the passenger cabin.

After locating the fire inside the electronics bay in the belly of the airplane, firefighters entered the compartment through dense smoke and applied shots of Halotron fire extinguisher to the battery.

Lt. David Hoadley of the firefighting unit reported that “it seemed like the fire did not want to go out, it kept rekindling.”

Then the battery, in munroe’s words, “exploded.”

“Capt. Munroe heard the battery hissing still and pushing white smoke or steam. There was liquid sizzling over the sides of the battery and still heavy smoke conditions. ... The battery continued to hiss before exploding.”

Munroe related that “he felt something hit him in the neck while he was in the airplane,” and he was sent for medical treatment. “Something had burned his neck.”

Firefighters attempted to remove the battery from the jet but found the “quick disconnect” mechanism Boeing had included to allow the battery to be removed for maintenance was “melted and unrecognizable” and a metal plate was preventing access.

The firefighters cut away the metal plate, severed the battery wires, then “pried the battery loose with hydraulic spreaders and removed it.”

The battery was passed down to a firefighter and placed on the tarmac about 50 feet from the airplane.

100 minutes

The fire was declared under control an hour and 40 minutes after the initial notification.

Still, for all the intensity, no one was badly hurt and details in the report suggest it could have been worse.

NTSB investigators found no heat damage to any primary airplane structure — that is, any part of the airframe critical to flight.

Only the floor panel and carbon-fiber floor support material, which are considered to be secondary structure, “were found to be heat damaged beneath where the APU battery had been installed.”

And sitting on a rack above the battery that burned was a smaller lithium-ion battery, also supplied by Japanese manufacturer GS Yuasa, that is used to provide emergency power for the jet’s flight controls for 10 minutes or more “when no other electrical power is available.”

Investigators found the exterior of this battery had been “lightly scorched” by the fire below and noted its case had openings at the corners.

The firefighters suppressed the fire before it could spread to that second battery.

By Dominic Gates
Seattle Times aerospace reporter

Always good form to attribute the material you quote ;)

Aaarrrggh...everything the FAA does requires a statistical probably of 10-9 RELATED to itself, or the system.

Cell venting is a DEPENDENT variable, not independent, so the relationship is based on the CUMULATION of ALL events related to the battery, takeoff/landing, startup, charging/discharging, BMS, etc.

The issue is not 1 in 10 million flight hours, but a statistical relationship of all of the related events, and that the statistical average of ALL of the events to happen at the same time is 10 to the minus 9.

Of course, just so you are aware, your aircraft has a 10 -9 capability to stay within the selected RNP level... :ok:

edit..and really, quoting Gates???..

Boeing Marketing V-P says the 787 proposal is a "permanent fix"

UPDATE 1-Boeing confident has permanent 787 battery fix-exec | Reuters

They just don't get it, do they ? Having the Sales & Marketing department making the public pronouncements on the 787 fix. It's not only that many informed observers in the industry don't buy the proposal for one second (see above), let alone what the customer airlines think, but the overbearing dominance of the sales-led management over the design and engineering side was what got them into this in the first place.

What is surely needed is for the CEO and their competent electrical engineers (Boeing must have a few left) to stand up and say what the issue is, what the correction is, and all the technical detail needed for informed observers to understand what has been done. Instead we seem to have "Hey, it's fixed, I'm tellin' ya. Just gimme the certificate back so we can ship the iron and get the billing done ......".

Mr Battery meet Mr Circuit Breaker
 

I'm a professional electrical engineer. I don't work in aviation. I have just read the NTSB Interim and I am horrified.

We (the overall engineering sector) have know for a long time that Li Ion batteries don't play well with others. They are have an *inherent* tendency to get hot and catch on fire if they are at all mis-treated (over-charge, over-discharge, sudden changes in rates of charge).

The standard solution is always to provide an old-style circuit breaker (or fuse) and an old-style over-temp breaker. By old style I mean "mechanical".

Boeing chose to use a "contactor" do both jobs, based on software calculations performed by the BCU. This is just plane (no pun intended) poor engineering. I have written thousands of lines of controller code in my career, I would never support a decision to protect a Li Ion battery with a breaker which makes decisions based on software (Even if I had written it).

This is a blatant failure of good engineering governance and a failure to apply good sense. (And putting a firebox around what is essentially a bomb still leaves you with a bomb, I don't know of any material which would have contained the fire which happened at BOS).

So I guess Boeing need a good, safe, sound, sensible solution. My suggestion is a slow-blow circuit breaker and an over temp fuse, placed in series. I know that this combination may limit the performance envelope of the battery but I think that's what needs to be done.

You would have thought that Boeing would have taken this down by now
Batteries and Advanced Airplanes - Boeing 787 Updates

Their latest news statement is on the 9th February. Not bad for a website that is supposed to keep everyone up to date on the 787.
Latest Statements - Boeing 787 Updates

sky9

Which makes me wonder about this:

Its possible that this V-P may have gone 'off reservation' to soothe the customers. Or there is a deeper split within company ranks over the strategy for handling this issue. Its all just guessing from where I sit.

Boeing always liked to present a unified face to regulators, the press, customers, etc. This might be one reason why we are not seeing the breadth of investigation that I'd expect on this topic. They can't have multiple teams of engineers pursuing various hypothesis. That would look like uncertainty. And that could undermine their image as the ultimate technical authority for all things flying.

One way or another, rest assured that Boeing is expending quite a bit of energy to maintain their public image and legal liability. Sadly, probably a lot more than their engineering budget.

The surprising thing to me is the battery, made by a Japanese company, the charging system electronics, made in Arizona USA under the direction of the French company Thales, who is in turn in charge of power electronics for the 787, have all never been fully tested as an integrated package.

Word has it the NTSB, Boeing, Thales and the rest of the gang now have a bench setup where all the various bits will be wired together and put through the paces in hopes of finding what went wrong.

Was it battery abuse caused by or ignored by improper, inadequate, or shortsighted computer programming electrickery? That's where my money is.