787 Batteries and Chargers - Part 1

[Lyman]

If the Battery is integrated into the distribution network, it is not a Back Up Battery. It is a Battery that has an additional function in name only. By definition, this functional demand is outside the intent of the regulation, imo.

This battery has the elements of a reliable back up source. Too much was expected, and demanded. Is it a legacy of antiquated obsession with pounds of weight? It may be down to Fire, or reliability. Choose wisely. This situation was predictable, and was predicted. The failure in implementation is down to lack of test, and lack of in service experience. Or, worse.

The CT scans of sections of even the JAL exemplar show problematic bunching, packing, wrinkling and pinching of the electrode stacks. Given the design, the geography of the enclosure, and its attendant kit, to ignore the probability that failure is merely a shortened service life due environmental impacts and/or excessive demand is a mistake.

If this type, specific storage battery is not suitable, and cannot be made safe, then the outcome of the public hearings might be "game-changing".

The box was a stupid PR move, a non starter.....

[USMCProbe]

Every plane that I can remember flying had an auto shutdown feature on the ground in case of APU fire. It must be a certification thing. The APU can be running with no crew aboard for aircraft servicing. There is also an APU fire control panel in a wheel well usually, with a fire bell that goes off outside the aircraft. The APU fire extinguishing systems are connected to the hot battery bus. I don't know what that bus is called on the 787.

Unfortunately for the 787, there is no certification requirement for auto battery fire extinguishing, or a battery ejection seat in case of battery fire on the ground.

[syseng68k]

archae86, #850:

Thanks for that. Have had time to have a good read now and there's quite
a bit of fresh info to fill in more of the gaps.

The key points seem to be:

1) There are two temperature sensors. One to inhibit charging when the
battery is at under or over temperature, and a second "reported to the
BCU", to control charge current. Effectively, only a single sensor to cover
charge and discharge.

2) There is a single hall effect current sensor ("dc current tranformer"),
where two might have been expected for redundancy reasons, for such a
critical function.

3) Charge balancing is done for each cell, but no info as to how this is
monitored / managed in discharge by the software.

4) The voltages of individual cells are not logged, which explains why it
hasn't been possible to determine the failure timeline and primary cause.
The only logging being the charger error codes (idiot lights) and fdr
logging of bus voltage.

5) The battery isolation contactor has normally closed contacts. Trivial
item, you may think, but in fact, it has very serious implications.

I'll try to explain how a contactor functions, with apologies to those who
know all this already. A simple contactor is nothing more than a pair of
contacts arranged as an on/off switch, as is found in eg: a domestic light
switch. Whereas a light switch is operated manually, a contactor or relay
is switched by applying power to an electromagnet/coil, which is mechanically
linked to the contacts. Spring loading against the coil provides opening
force when power is removed. The contacts may be arranged to be normally
closed or normally open, ie: switch normally on or off, with no power applied
to the coil.

In most cases, for fail safe operation, normally open contacts are used so
that in the absence of power or circuit failure, the contacts open, isolating
the circuit. In the 787 system however, the contacts are normally closed and
thus need power to open the contacts and isolate the circuit. This is opposite
to what would be expected for such an application, since there really is no
way to isolate the battery from charger or load in the event of electronic,
software or other failure. In extremis, the battery will remain connected
until the fire is put out and the wires cut.

I know i've been banging on about all kinds of issues with the design for
weeks, but more info that comes to light, the more seems to be exposed and
that's without any idea of what the underlying control software is getting
up to...

[bill good]

B787 battery

Keep in mind there are two failures of batterys from two different locations each with very simular end results. The report on the first indicates 17 mins after the APU was started from the APU battery, the voltage dec from 32V to 30V which indicates the first time a short is present. Since the current information is being derived from the neg of the battery & is after the shorted cell it is the sum of both charge & the discharge of the faulty section of the battery & thus would not be the correct recorded value. Because the breakdown of the insulation barrier between the cells has effectively reduced the number of cells over voltage would now appear on the cells before the short resulting in damage but lesser damage than the cells with the higher circulating current involving the path via the case to the ground point of the battery case & A/C bonded points. Further just to make sure the whole thing is destroyed all the wires from every connection appears to be taken thru a stainless "protective " shield which is bonded to the case to short out all wires from each cell to the external world of the case once the heat melted the insulation. i.e. just about 100% chance of every cell being destroyed. (The local heat build up is seen in the pictures is clear & reports of flame by the fire crew confirms) I can't help thinking that if the case was not bonded this event would have not flagged so many design oversights & safety issues. Not a good idea to enclose all the protective & contol circuits & components in an area of a battery case which has known potential fire & heat issues as well. All in all how did this design get this far?? Could someone who has watched the current levels of the B787 APU battery indicate that 45Amps without reducing for 15 mins after starting the APU is a normal expected level as it seems a bit high. There are more concerns but the battery case & installation of this case is the primary cause. The swiss cheese model follows after this level with secondary oversights as time will show.

ps Looking at the specs for this cell the CC part for a cell start point 3.75V which would be degraded for a battery to 29.6V (est) & at 10A is 1 hr. Again anyone know if the battery in the B787 gets a CC to start the recharge process? Applying 32V initally seems very strange & would like to see how long a battery would last being tested on the bench by taking it to a low SOC & applying the 32V that is being stated as normal. (i would be in the next building) Best est 300-500 cycles.

Regards

[saptzae]

Further to my post 857: http://www.pprune.org/7731615-post857.html

Three possible explanations for the 45A into the battery from 10:21:04:
a) Likely: that the charger commenced fast charging at about 0.7C
b) Improbable: APU bat bus was connected to a high current source such as Main bat bus.
c) Unlikely: Parasitic connection via small load such as nav lights. Such connection could not deliver 45A.

Thus it appears likely that the BMU has not detected the cell short and that the charger commenced fast charge, initiating the conflagration.

Detecting Cell short is difficult: http://www.pprune.org/7679259-post500.html
(Note: since that post, it was confirmed that there are only 3 sub cells per cell)

What remains illusive, is the cause of the Cell short.

[Lyman]

@saptzae post #500

What has to be done, is to make the BMS more sensitive to voltage transients on individual cells and shut charging down very quickly.

A Battery that cannot be charged cannot be relied upon to perform. The purpose of the Batteries: to provide a storage of dependable power to satsify regulations.

NTSB have stated unequivocally that this incident was precipitated by a short in one of the eight 'cells'.

The short led to thermal runaway, a disqualifying condition for service. (imo)

Boeing has proposed a heavy and sturdy containment to prevent fire from spreading and other disqualifying conditions, admirable.

The failure mechanism is known. Can this battery be made safe such that containment is not a requirement?

Other large battery packs have been constructed from “large format cells” that have capacities in the range of 10 to 100 Ah. Standards for these sorts of applications are currently being written or revised to be appropriate for lithium-ion technology

(from: "Fire Research Study", Exponent Failure Analysis Associates, July, 2011

We'll have to see, but I don't think 'containment' will 'fly'.

[saptzae]

@Lyman

The failure mechanism is known.

I am fairly confident about causes of cascading - Secondary and Tertiary - failures. Known?, Not yet. Lets say we are on a good track to understanding.

Can this battery be made safe such that containment is not a requirement?

Yes, upon remedy after gaining understanding of the failure causes.

Containment is just an additional layer and is not critical part of safe operation.

To accomplish this

• Monitor and Manage cells better
• Eliminate cascading failures - Stop secondary and thereby Tertiary failure

Safe means that a cascading failure occurs less frequently than what the regulator specifies.

The grounding is better discussed in the other thread.

[Lyman]

Howdy saptzae,

Monitor and Manage cells better. Eliminate cascading failures - Stop secondary and thereby Tertiary failure

As to Monitor.... Secureaplane has their patent, a method of sensing and thereby controlling charging? For each cell? That did not happen... Patents protect frrom imitation, they do not guarantee performance.

As we see, it is not possible to control (manage) charging in an eight battery (cell) series. The "control" is to take the unit (all eight) off line. This pertains to reliability, certainly a technical issue, grounding is not pertinent here...


NTSB have eliminated overcharging as a cause, at least preliminarily....

That leaves a primary. Short circuiting in large format LiIon batteries is not well understood, as a read of the above study demonstrates. There are no industry standards as of July 2011.

The FAA regulations were written in 2007 (sic).

For a serviceable cell to short circuit, internally, the separation Anode/Cathode must be breached. As far as I can determine, that means a break down of the separator, and/or, the presence of metallic Lithium dendrites, spanning the borders of the connectors at either end.

Dendrites far and away are the more troublesome of the two, separator issues are related to diffusion of the Ions, dendrites are a mechanical connector....

Some of the microscopic photography in the materials addendum is interesting....

The hearings are open to the Public. Are you considering being present?

I am.

[HighWind]

B787 battery

Syseng68k #902


Hi, I'm an Electronics engineer working in another industry, involving MW size power electronics, UPS systems, and IEC61508 P/P/E.

2) There is a single hall effect current sensor ("dc current tranformer"), where two might have been expected for redundancy reasons, for such a critical function.

I would prefer two, not only for redundancy, but also for insulation monitoring.
The battery is in a conductive casing, and is expected to be insulated from the power circuits. But one single fault in a battery could connect it to the casing, thereby creating a circuit that can't be disconnected. I would insert a HAL sensor in both the positive and the negative connection, for insulation detection.

5) The battery isolation contactor has normally closed contacts. Trivial item, you may think, but in fact, it has very serious implications.

This is serious, it seems the designers has been more concerned with the risk of the system failing so it can't provide power, than the system failing so it can't protect itself. (against high currents, and high/low charge).

I would prefer two separate contactors (or at least a two pole), with normally open contact sets, one installed in the positive and the other in the negative connection. The contactors and BMS has to be able to detect and break the highest possible short circuit current.

The contactor operation could then be a part of a daily self-test (Feedback from forcefully guided contact sets).

This would also allow the battery box to have unpowered terminals during installation, the power could be connected when the communication link is established.

This would then create a chicken and egg problem, since the contactors has to be unpowered, when the aircraft is parked in order not to drain the battery, and the system needed to wake-up the battery has to be powered from the same battery. This could be solved by providing power via. the data communication connector to the charger/DC bus controller.

If Boeing continues with the hot-box solution then the energy-density would be lower than the current solution, and more rack-space would then be required.
Such a battery box would probably have a MTBF (safe faults) in the range of 5 years, for extra availability of backup power a 2oo3 architecture could be used.

[Lyman]

Howdy HighWind...

The battery is in a conductive casing

So too, is each individual battery, ('cell').

I think... (Aluminum) Ground Failure issues?

[RR_NDB]

Absolutely questionable design

Hi,

syseng68k:

Chris,

5) The battery isolation contactor has normally closed contacts. Trivial item, you may think, but in fact, it has very serious implications.

A BAD BATTERY! A design capable to ...

[syseng68k]

HighWind, #908:

Hi, I'm an Electronics engineer working in another industry, involving MW size
power electronics, UPS systems, and IEC61508 P/P/E.

Very welcome and judging by the name, location and work, wind energy systems
perhaps ?.

I would prefer two, not only for redundancy, but also for insulation monitoring.
The battery is in a conductive casing, and is expected to be insulated from the
power circuits. But one single fault in a battery could connect it to the casing,
thereby creating a circuit that can't be disconnected. I would insert a HAL
sensor in both the positive and the negative connection, for insulation detection.

Very good point, since any differential / imbalance between the two current sensors
are an indication of leakage to ground. Ideally, each sensor would be on the busbar
terminations at the power socket, to cover leakages right up to that point.

I would prefer two separate contactors (or at least a two pole), with normally open
contact sets, one installed in the positive and the other in the negative connection.
The contactors and BMS has to be able to detect and break the highest possible short circuit current.

Hadn't thought about about case leakage isolation, which does need contacts in
each line to work. There's stiil the problem of >1 cell shorting to case, but I guess
that scenario could be covered by fusable links between the cells, rather than the
existing copper straps. A two pole contactor would get the job done and should be
more reliable and cost effective as well. However, my point would still be that
if the cells are properly managed and run within data sheet limits, the problem
won't arise in the first place.

This would then create a chicken and egg problem, since the contactors has to be
unpowered, when the aircraft is parked in order not to drain the battery, and the
system needed to wake-up the battery has to be powered from the same battery.
This could be solved by providing power via. the data communication connector to the charger/DC bus controller.

That's just a system design issue and could perhaps be covered via a low power micro,
with uA in sleep mode, always connected to the battery, or even a small disposable
memory style backup cell. The micro is then woken up by the first comms packet down
the line.

Over the past few weeks, many people contributing here have found loads of issues
with the design and while hindsight can be a wonderfull thing, the present design
looks like half the job that should have been done. The introduction of cots tech
into aviation may have saved loads of money, but I wonder if some of the design
rigour and attention to detail have been thrown out of the window at the same time.

Having said that, I'll bet the design teams were really pleased with themselves to
start with ...

Regards,

Chris

[FlightPathOBN]

From Seattle Times...

Everyone needs to stop picking on Boeing, formerly of Seattle, for this minor 787 battery snafu.

It’s now becoming clear that the company paid a company to pay a company to hire a subcontractor to run some simulated tests on theoretical imaginary battery problems, exactly as required by the FAA.

What more could anyone expect of them?

[Lyman]

FPOBN,

The Special Regulations were composed in 2007, and approved the same year (October).

The Fire Research report, in addressing the "large format" Li technology, stated unequivocally that there were no Industry standards in place as of JULY,2011.....

Large Format seems to mean 10-100 aH. So FAA left Boeing to come up with a PROVEN system. I do not fault FAA for that. To the contrary, advancing technology requires room to advance. The special regs set limits, not specs on how to ennable the technology short of them (pardon the pun). The limits turn out to be sufficiently rigorous, NO FIRE, NO UNCONTAINED ELECTROLYTE. (One in a Billion, one in ten million)

The Airworthiness Directive is couched in similar terms and provoked a snarky rejoinder from the airframer. "Show us how to conform"....

It is up to the builder to perform, there is no room for wriggling.

Large Format seems to be simply, "scaled up". Not an engineer, but that seems like an invitation to Fail. "Nice Battery, can you make it bigger?"

Primarily as to heat control. Now Boeing can "scale back", until they can demonstrate some acceptable thermal performance, but that will take time, and it means satisfying a regulator who has been taken to the cleaners once already.
It also means packaging more and smaller batteries into an existing architecture.

The Big Box format might be fine to alleviate fire control issues, but it does not address the prevention of fire in the first place, something that was touted to be on the order of "One in a BILLION" (John Goglia). It does nothing to salvage the trashed reliability profile as to "Back Up Battery".

Have you seen the photos of the "Exemplar" battery removed from JAL 08?

The "Jelly Roll" looks to have sat in the lunch box for quite awhile, and may have seen Sally and Joey sit on it several times.

The electrode stacks are sensitive to shape retention, as to remaining safe from internal damage, and evenly distributed excess heat. (Sic).

[Ian W]

Lyman

As to Monitor.... Secureaplane has their patent, a method of sensing and thereby controlling charging? For each cell? That did not happen... Patents protect frrom imitation, they do not guarantee performance.

I think this may be the initial development management error. Did anyone ever test this Securaplane patented technology with a failed cell? Or was the assumption made that with this patented method they wouldn't fail or the failure would be detected? From what we see now the 'patented technology' allowed the charger to carry on with a dead cell. This means that the idea doesn't work or that it was incorrectly implemented.

One wonders why it was thought necessary to rely on indirect assessment of cell health and indirect temperature sensing and serial charging rather than individual cell monitoring and parallel charging which would seen a lot safer?

[Lyman]

Prior to filing document of disclosure for a patent in the early seventies, I would not have guessed that a Patent hasn't anything whatever to do with the utility of the patented process/device.

There is no requirement anywhere in the successful Patent process to demonstrate that the device actually works, or has any use whatever....

It provides "protection" from infringement, only. It is not a Warranty, nor is it a "Guarantee". Obviously, in the case of the Dreamliner.

Boeing would not be the first client to be over-impressed with a REGUSPATOFF file number....

But the only germane discussion at this point is how can the battery be made reliable, let alone safe?

VOLTAGE and TEMPERATURE numerics are useless against thermal runaway. So far as keeping this "Battery" operating in any case. They might be useful in stopping a conflagration, but for Gods sake, why is anything that can ignite spontaneously anywhere near an AIRCRAFT?

Surely Boeing knew that?

[saptzae]

A single cell (blade) failure can be contained. A multi cell failure (hub) is hard to contain.

Thus am I most concerned about fixing the Primary cause and preventing the Secondary and Tertiary cascading failures.

@Lyman

As to Monitor.... Secureaplane has their patent

From #590 http://www.pprune.org/7685780-post590.html

It is one of those patents one gets to get a patent for making life harder for the competition to sue one. Well, and a little for marketing hype too. As to its merit, inflection, prediction, assumption is IMHO a demerit.

Edit: I do not believe that the patent, which was developed for Pb type cells, is applied here, other than in the marketing documentation.

As we see, it is not possible to control (manage) charging in an eight battery (cell) series.

It has been discussed many times. It is common practice for more than 100 years. It can be managed.

Rather, by what we see, all boils down to inadequate management, on all levels.

• Primarily, of the cells, so they short.
• Secondarily, of the cell short, leading to the conflagration
• That 100+ batteries got line replaced

The containment box worked pretty well!

For a serviceable cell to short circuit, internally, the separation Anode/Cathode must be breached. As far as I can determine, that means a break down of the separator, and/or, the presence of metallic Lithium dendrites, spanning the borders of the connectors at either end.

Concur, but we do not know which, less so why, and the evidence is all but destroyed after subjected to heat sufficient to melt aluminum.

Dendrites far and away are the more troublesome of the two, separator issues are related to diffusion of the Ions, dendrites are a mechanical connector....

Yes, Examining other serviceable cells from the fleet for deterioration is my best hope.

The hearings are open to the Public. Are you considering being present?

Interesting question. I wont be present, but will consider to make a submission.

@HighWind
Welcome!

Yes, two hall sensors would be good.

Yes, two pole contactor would be better.

A bistable contactor would be possible.

@syseng68k
Fusible links would not be practical. Cells should be insulated more reliably (heat resistantly) from the case (edit: and each other).

[FlightPathOBN]

All that aside..

The NTSB report showed that the battery was tested, the charging system was tested, but the battery and charging system were not tested together, and the entire system was not tested while installed in the aircraft, nor with the entire electrical system of the aircraft.

How this approach permeates throughout how the rest of the aircraft was tested, remains to be seen.

As we have all noted, the exact cause has not yet been determined.

The sum of the parts does not always equal a whole....

edit: remember back to some of the early issues with this aircraft? Remember the retro fit of titanium wires for lightening arrest. Really, a comp aircraft, and it went that far down the path, before lightening was addressed?
and of course, the associated extra weight of all the wires...

[saptzae]

@Ian W
Well, the securaplane lab building burned down once while testing (without BMU connector plugged in)

Seriously, they surely did not test a cell to failure inside an airframe, nor with _all_ systems operating on a test bench.

System level testing is whats lacking, both during design and in production, for example, parasitic connections where found after TAK incident.

They apparently drove a nail into a cell. But they did not deteriorate a cell to short itself "naturally" by over/undercharge.

A nail through all layers of all sub cells is 10s of times better short than a single spot of a sub cell shorting!

[saptzae]

@FlightPathOBN
Yes, there is so much to learn about this wonderful airplane.

When all this is over, the entire industry will have progressed substantially.