787 Batteries and Chargers - Part 1
Join Date: Feb 2013
Location: Seattle, WA
Posts: 78
Likes: 0
Received 0 Likes
on
0 Posts
@Lyman
As I understand it, it is only designed to provide emergency power to the ACEs in the event of a loss of other in-flight power sources.
I would expect none since it would only be used if all other in-flight power sources failed.
It is enclosed.
Yes, it appears to only be designed for use in an emergency.
It appears to not be as I have seen no mention of it in any of the FAA, NTSB or JTSB. Same with other Li-Ion batteries aboard the 787 like the ~30 for wireless emergency light units and those that power the DFDR boxes.
Does the ACE perform other, occasional duty?
How many discharge/charge cycles per flight?
Is it enclosed, with a tamper proof seal?
Is it not a true "Backup" storage battery, where the APU/MAIN batteries do extra duty?
Do (we) know if the ACE storage battery is part of the AD?
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes
on
0 Posts
Kiskaloo
It occurred to me a while ago that perhaps too much was being asked of the APU/MAIN Batt system, as designed. It turns out there is a similar system one rack above the main problem. So it would be of great interest to see how Boeing addresses the AD. There are myriad problems, most of which seem to be a result of "utilizing" the Larger groups almost casually, as if they represent a time proven system, rather than what we see, a very problematic new-ish iteration of a Battery that got its credentials from the industry after the Dreamliner launched.
I am stuck on how building a bigger box solves the reliability problems. Unless the swelling, misaligned rolls, and internal shorting are remedied, the result will be safe but inert "back-ups", going off line at a rate too high to satisfy dependability. At great expense. Cannot a windmilling donk fire up the APU?
Thank you for a great response....
It occurred to me a while ago that perhaps too much was being asked of the APU/MAIN Batt system, as designed. It turns out there is a similar system one rack above the main problem. So it would be of great interest to see how Boeing addresses the AD. There are myriad problems, most of which seem to be a result of "utilizing" the Larger groups almost casually, as if they represent a time proven system, rather than what we see, a very problematic new-ish iteration of a Battery that got its credentials from the industry after the Dreamliner launched.
I am stuck on how building a bigger box solves the reliability problems. Unless the swelling, misaligned rolls, and internal shorting are remedied, the result will be safe but inert "back-ups", going off line at a rate too high to satisfy dependability. At great expense. Cannot a windmilling donk fire up the APU?
Thank you for a great response....
Join Date: Feb 2013
Location: Seattle, WA
Posts: 78
Likes: 0
Received 0 Likes
on
0 Posts
@Lyman
To my knowledge, the Ship's and APU batteries for the 787 power the same systems as they do on other Boeing Commercial Airplane families. So I don't believe Boeing is asking more of them on the 787 than, say, the 777.
As to reliability issues, I agree that the containment box does nothing to address this. It's merely designed to ensure that if a battery enters thermal runway, it cannot affect the safety of flight of the aircraft.
To address reliability, Boeing is making changes to the battery design, increasing cell spacing and putting in insulation between the cells. The expectation is that this will reduce the chance of a single cell entering thermal runway and, if it should, reduce the chance of adjacent cells entering thermal runway. They also appear to be increasing quality control in production of the cells and assembly of those cells into batteries to reduce the chance of a short circuit that could induce a thermal runway in a cell.
Even if Boeing eliminates safety as a concern, they must also eliminate economics as a concern. As the APU battery appears to be necessary in order to run the APU, the low MTBF for the APU battery is going to affect the ability to certify the 787 for ETOPS beyond 180 minutes (the current limit for a plane with an inoperative APU). And even if a failed battery can't damage the plane, it is expensive to replace so a low MTBF will be a concern and pain point for airline customers.
To my knowledge, the Ship's and APU batteries for the 787 power the same systems as they do on other Boeing Commercial Airplane families. So I don't believe Boeing is asking more of them on the 787 than, say, the 777.
As to reliability issues, I agree that the containment box does nothing to address this. It's merely designed to ensure that if a battery enters thermal runway, it cannot affect the safety of flight of the aircraft.
To address reliability, Boeing is making changes to the battery design, increasing cell spacing and putting in insulation between the cells. The expectation is that this will reduce the chance of a single cell entering thermal runway and, if it should, reduce the chance of adjacent cells entering thermal runway. They also appear to be increasing quality control in production of the cells and assembly of those cells into batteries to reduce the chance of a short circuit that could induce a thermal runway in a cell.
Even if Boeing eliminates safety as a concern, they must also eliminate economics as a concern. As the APU battery appears to be necessary in order to run the APU, the low MTBF for the APU battery is going to affect the ability to certify the 787 for ETOPS beyond 180 minutes (the current limit for a plane with an inoperative APU). And even if a failed battery can't damage the plane, it is expensive to replace so a low MTBF will be a concern and pain point for airline customers.
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes
on
0 Posts
BOX 2.0
Here is the condition that requires the presence of the upgraded BOX.
This is why I have made such an issue of the nomenclature, "Cell" v. "Battery".
As written, the language prevents (prohibits) a single short circuit. A single short circuit in the current design will (should) take the entire eight cell "Group" off line, "loss of essential system".
Technically, then, there should be:
Eight separate "boxes" that isolate a short circuit from failing the "essential system" (the other seven "cells") and a means for keeping the power storage at usable level. OR,
""Short Circuit" must be proven to be "One in Ten Million flight hours".
This is regulatory, and hasn't anything to do with "Fire".
Again, the major problem is the 'current' design as to suitable (and "demonstrable") "Reliability", not the prevention of fire.
If the APU battery is an agglomeration of eight cells, comprising a "battery", then going off line is a major failure with or without any fire issue. If it is a group of eight individual batteries, and can be made to perform if one battery shorts out, the system is (becomes) reliable by definition...
The potential to catch fire must still be one in one BILLION flight hours, regardless the design of the enclosure.
EXCEPT. The discussion will be: "What causes the fire". The battery cannot be the source, (cause) of fire, this is fatal to its installation. It is by definition "flammable" in and of itself, and if exposed to extraneous ignition, may ignite, this is allowed.
imo....
(6) Each Lithium ion battery installation must have provisions to prevent any hazardous effect on structure or essential systems caused by the maximum amount of heat the battery can generate during a short circuit of the battery or of its individual cells.
As written, the language prevents (prohibits) a single short circuit. A single short circuit in the current design will (should) take the entire eight cell "Group" off line, "loss of essential system".
Technically, then, there should be:
Eight separate "boxes" that isolate a short circuit from failing the "essential system" (the other seven "cells") and a means for keeping the power storage at usable level. OR,
""Short Circuit" must be proven to be "One in Ten Million flight hours".
This is regulatory, and hasn't anything to do with "Fire".
Again, the major problem is the 'current' design as to suitable (and "demonstrable") "Reliability", not the prevention of fire.
If the APU battery is an agglomeration of eight cells, comprising a "battery", then going off line is a major failure with or without any fire issue. If it is a group of eight individual batteries, and can be made to perform if one battery shorts out, the system is (becomes) reliable by definition...
The potential to catch fire must still be one in one BILLION flight hours, regardless the design of the enclosure.
EXCEPT. The discussion will be: "What causes the fire". The battery cannot be the source, (cause) of fire, this is fatal to its installation. It is by definition "flammable" in and of itself, and if exposed to extraneous ignition, may ignite, this is allowed.
imo....
Join Date: Mar 2011
Location: engineer at large
Posts: 1,409
Likes: 0
Received 0 Likes
on
0 Posts
The potential to catch fire must still be one in one BILLION flight hours,
Per FAA AC23-1309 SYSTEM SAFETY ANALYSIS AND ASSESSMENT FOR
PART 23 AIRPLANES
Step 1: Determination of the "average flight;"
Step 2: Calculation of the probability of a failure condition for a certain "average flight;"
Step 3: Calculation of the "average probability per flight" of a failure condition; and
Step 4: Calculation of the "average probability per flight hour" of a failure condition.
The failure mode must be statistically 10 -9 (1 in a billion) for EACH FLIGHT HOUR.
Last edited by FlightPathOBN; 13th Mar 2013 at 15:25.
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes
on
0 Posts
I should have used quotes, I have no knowledge of the statistics of these failures.
The quote is from John Goglia, outspoken critic of Boeing's actions, and a former Member of NTSB...
my bad.....
BUT. Does it not mean that a fire aboard must not happen in the life of the fleet, roughly?
The quote is from John Goglia, outspoken critic of Boeing's actions, and a former Member of NTSB...
my bad.....
BUT. Does it not mean that a fire aboard must not happen in the life of the fleet, roughly?
Last edited by Lyman; 13th Mar 2013 at 15:26.
Join Date: Mar 2011
Location: engineer at large
Posts: 1,409
Likes: 0
Received 0 Likes
on
0 Posts
Lyman...no worries. I have seen this quote around, in this form, but it is really not the intent of the safety case analysis. It changes the flavor significantly from 1/Billion per fight hour to 1 Billion flight hours.
It is the sum of all of the parts, so while you may have a known battery failure every thousand flight hours, it is the sum of all of the components failure modes, happening at the same time, that must be 1/Billion probability.
OT alert...
I had to provide this type of analysis for RNP procedure criteria. as an example, you have a high probability of losing a single sat, then lower probabilities of losing more to where the GPS signal is degraded enough to be useless for nav, all that combined with on-board combination of system failures...adding up to an off-track probability per RNP level.
edit:
not exactly. there is the potential for fire on an ac, such as with the engines...and the Li battery fires from devices has been addressed on ac.
While the potential for the LI fires was somewhat addressed by the FAA, it doesnt appear, from the design on-board, that it was considered an issue, and mitigated by other means such as the BMS controls, in the statistical models...
So I guess the answer, and the avenue Boeing appears to be following, it that yes, with this system, we have to add the probability of a fire with the battery system, and mitigate that potential. They must also re-evaluate the entire system, and how it allowed this to happen.
As we have noted, there is all of the bench testing, but there will be the testing with the 2 aircraft. Very, very complex issue. Personally, I dont feel that they will be able to mitigate the issues that caused the batteries into failure mode in a reasonable amount of time. Testing the battery containment box, on a production aircraft??
It is the sum of all of the parts, so while you may have a known battery failure every thousand flight hours, it is the sum of all of the components failure modes, happening at the same time, that must be 1/Billion probability.
OT alert...
I had to provide this type of analysis for RNP procedure criteria. as an example, you have a high probability of losing a single sat, then lower probabilities of losing more to where the GPS signal is degraded enough to be useless for nav, all that combined with on-board combination of system failures...adding up to an off-track probability per RNP level.
edit:
BUT. Does it not mean that a fire aboard must not happen in the life of the fleet, roughly?
While the potential for the LI fires was somewhat addressed by the FAA, it doesnt appear, from the design on-board, that it was considered an issue, and mitigated by other means such as the BMS controls, in the statistical models...
So I guess the answer, and the avenue Boeing appears to be following, it that yes, with this system, we have to add the probability of a fire with the battery system, and mitigate that potential. They must also re-evaluate the entire system, and how it allowed this to happen.
As we have noted, there is all of the bench testing, but there will be the testing with the 2 aircraft. Very, very complex issue. Personally, I dont feel that they will be able to mitigate the issues that caused the batteries into failure mode in a reasonable amount of time. Testing the battery containment box, on a production aircraft??
Last edited by FlightPathOBN; 13th Mar 2013 at 15:53.
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes
on
0 Posts
I believe it was BOEING that stated the possibility for fire was only related to overcharging, and they optimistically pegged that at 1/billion.
If I delete all reference to statistics and probability, will you address the main thrust of my longer post, that FIRE is not the only problem here?
If I delete all reference to statistics and probability, will you address the main thrust of my longer post, that FIRE is not the only problem here?
Join Date: Mar 2011
Location: engineer at large
Posts: 1,409
Likes: 0
Received 0 Likes
on
0 Posts
I think we are talking about the same thing here....
Very complex, holistic, system wide issue...
edit; this just in..
Looks like it worked (for Boeing stock that is)
"Some analysts said the high-tech plane, which was grounded worldwide in January, might be flying passengers again as early as May, after the Federal Aviation Administration on Tuesday approved Boeing's plan to certify the battery system."
Boeing tests prompt analysts' upgrades, but risks still lurk - Yahoo! Finance
Very complex, holistic, system wide issue...
edit; this just in..
Looks like it worked (for Boeing stock that is)
"Some analysts said the high-tech plane, which was grounded worldwide in January, might be flying passengers again as early as May, after the Federal Aviation Administration on Tuesday approved Boeing's plan to certify the battery system."
Boeing tests prompt analysts' upgrades, but risks still lurk - Yahoo! Finance
Last edited by FlightPathOBN; 13th Mar 2013 at 17:54.
Do you know if the ACE storage battery is part of the AD?
To my knowledge, the Ship's and APU batteries for the 787 power the same systems as they do on other Boeing Commercial Airplane families. So I don't believe Boeing is asking more of them on the 787 than, say, the 777.
Join Date: Mar 2011
Location: engineer at large
Posts: 1,409
Likes: 0
Received 0 Likes
on
0 Posts
still have to meet or exceed this:
In lieu of the requirements of 14 CFR 25.1353(c)(1) through (c)(4), the following special conditions apply. Lithium ion batteries must be designed and installed as follows:
(1) Safe cell temperatures and pressures must be maintained during any foreseeable charging or discharging condition and during any failure of the charging or battery monitoring system not shown to be extremely remoteimprobable. The lithium ion battery installation must preclude explosion in the event of those failures. (working group to refine).
(2) Design of the lithium ion batteries must preclude the occurrence of self-sustaining, uncontrolled increases in temperature or pressure. (this may be met with requirement (1) - working group to refine).
(3) No explosive or toxic gases emitted by any lithium ion battery in normal operation, or as the result of any failure of the battery charging system, monitoring system, or battery installation not shown to be extremely remoteimprobable, may accumulate in hazardous quantities within the airplane. (this may be redundant with (1)).
(4) Installations of lithium ion batteries must meet the requirements of 14 CFR 25.863(a) through (d). (may also need to include parts 23, 27, & 29).
(5) No corrosive fluids or gases that may escape from any lithium ion battery may damage surrounding structure or any adjacent systems, equipment, or electrical wiring of the airplane in such a way as to cause a major or more severe failure condition, in accordance with 14 CFR 25.1309(b) (also 23, 27, & 29) and applicable regulatory guidance. We may want to give other means of compliance such as venting gases off-board, containment enclosure, etc.
(6) Each lithium ion battery installation must have provisions to prevent any hazardous effect on structure or essential systems caused by the maximum amount of heat the battery can generate during a short circuit of the battery or of its individual cells. NOTE: Need to add a requirement to report maximum temperature reached during the RTCA/DO-311 Short circuit test. The equivalent UN 38.3 short circuit test states that testing occur at 55 deg C. DO-311 2.3.12 – External Short Circuit With Protection Disabled: states to report maximum temperature.
Test is run at 23 deg C. (7) Lithium ion battery installations systems must have a system means to control the charging
rate of the battery automatically, so as to prevent battery overheating or overcharging, and,
(i) A battery temperature sensing and over-temperature warning system with a means for automatically disconnecting the battery from its charging source in the event of an over- temperature condition, or,
(ii) A battery failure sensing and warning system with a means for automatically disconnecting the battery from its charging source in the event of battery failure.
(8) Any lithium ion battery installationsystem whose function is required for safe operation of the airplane must incorporate a monitoring and warning feature that will provide an indication to the appropriate flight crewmembers whenever the state of charge of the batteries has fallen below levels considered acceptable for dispatch of the airplane. (this is a new requirement that is applicable to Li-ion batteries/systems).
(9) The Instructions for Continued Airworthiness required by 14 CFR 25.1529 must contain maintenance requirements for measurements of battery capacity at appropriate intervals to ensure that batteries whose function is required for safe operation of the airplane will perform their intended function as long as the battery is installed in the airplane. The Instructions for Continued Airworthiness must also contain procedures for the maintenance of lithium ion batteries in spares storage to prevent the replacement of batteries whose function is required for safe operation of the airplane with batteries that have experienced degraded charge retention ability or other damage due to prolonged storage at a low state of charge. (this requirement is already required to meet compliance to 1529).
In lieu of the requirements of 14 CFR 25.1353(c)(1) through (c)(4), the following special conditions apply. Lithium ion batteries must be designed and installed as follows:
(1) Safe cell temperatures and pressures must be maintained during any foreseeable charging or discharging condition and during any failure of the charging or battery monitoring system not shown to be extremely remoteimprobable. The lithium ion battery installation must preclude explosion in the event of those failures. (working group to refine).
(2) Design of the lithium ion batteries must preclude the occurrence of self-sustaining, uncontrolled increases in temperature or pressure. (this may be met with requirement (1) - working group to refine).
(3) No explosive or toxic gases emitted by any lithium ion battery in normal operation, or as the result of any failure of the battery charging system, monitoring system, or battery installation not shown to be extremely remoteimprobable, may accumulate in hazardous quantities within the airplane. (this may be redundant with (1)).
(4) Installations of lithium ion batteries must meet the requirements of 14 CFR 25.863(a) through (d). (may also need to include parts 23, 27, & 29).
(5) No corrosive fluids or gases that may escape from any lithium ion battery may damage surrounding structure or any adjacent systems, equipment, or electrical wiring of the airplane in such a way as to cause a major or more severe failure condition, in accordance with 14 CFR 25.1309(b) (also 23, 27, & 29) and applicable regulatory guidance. We may want to give other means of compliance such as venting gases off-board, containment enclosure, etc.
(6) Each lithium ion battery installation must have provisions to prevent any hazardous effect on structure or essential systems caused by the maximum amount of heat the battery can generate during a short circuit of the battery or of its individual cells. NOTE: Need to add a requirement to report maximum temperature reached during the RTCA/DO-311 Short circuit test. The equivalent UN 38.3 short circuit test states that testing occur at 55 deg C. DO-311 2.3.12 – External Short Circuit With Protection Disabled: states to report maximum temperature.
Test is run at 23 deg C. (7) Lithium ion battery installations systems must have a system means to control the charging
rate of the battery automatically, so as to prevent battery overheating or overcharging, and,
(i) A battery temperature sensing and over-temperature warning system with a means for automatically disconnecting the battery from its charging source in the event of an over- temperature condition, or,
(ii) A battery failure sensing and warning system with a means for automatically disconnecting the battery from its charging source in the event of battery failure.
(8) Any lithium ion battery installationsystem whose function is required for safe operation of the airplane must incorporate a monitoring and warning feature that will provide an indication to the appropriate flight crewmembers whenever the state of charge of the batteries has fallen below levels considered acceptable for dispatch of the airplane. (this is a new requirement that is applicable to Li-ion batteries/systems).
(9) The Instructions for Continued Airworthiness required by 14 CFR 25.1529 must contain maintenance requirements for measurements of battery capacity at appropriate intervals to ensure that batteries whose function is required for safe operation of the airplane will perform their intended function as long as the battery is installed in the airplane. The Instructions for Continued Airworthiness must also contain procedures for the maintenance of lithium ion batteries in spares storage to prevent the replacement of batteries whose function is required for safe operation of the airplane with batteries that have experienced degraded charge retention ability or other damage due to prolonged storage at a low state of charge. (this requirement is already required to meet compliance to 1529).
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes
on
0 Posts
FP
As above in my post #965, the condition number six, as written, prohibits this Battery installation as designed.
Any short circuit will take the battery off line, as will any temperature that may effect sister cells.
The APU/MAIN Batteries themselves are "Essential systems", so any self induced failure qualifies as a battery caused loss of a safety critical system.
If the language is changed to "Other Essential Systems", and the FAA is satisfied that the loss of the Battery is not "essential", the Box will fly.
It looks lke they are revising the conditions to suit the Boeing Fix. Did we think they would not?
Unbelievable.
BUT. FIRE cannot be allowed, and since the Box is identified as "Fire Protection"
the whole proposal is a travesty of the first order anyway.
Curiouser and curiouser....
As above in my post #965, the condition number six, as written, prohibits this Battery installation as designed.
Any short circuit will take the battery off line, as will any temperature that may effect sister cells.
The APU/MAIN Batteries themselves are "Essential systems", so any self induced failure qualifies as a battery caused loss of a safety critical system.
If the language is changed to "Other Essential Systems", and the FAA is satisfied that the loss of the Battery is not "essential", the Box will fly.
It looks lke they are revising the conditions to suit the Boeing Fix. Did we think they would not?
Unbelievable.
BUT. FIRE cannot be allowed, and since the Box is identified as "Fire Protection"
the whole proposal is a travesty of the first order anyway.
Curiouser and curiouser....
Join Date: Aug 2003
Location: FR
Posts: 234
Likes: 0
Received 0 Likes
on
0 Posts
John (#953), I believe I understand all of that. However I would say it is "inexcusable" (and not just with the benefit of what we know now) to go ahead with the new technology without having put in place a programme of battery monitoring, data logging, and periodic data analysis.
The NTSB report, unless I missed something, does not answer some question re. what data may be available. Any useful data which might have been logged by the BCU, for example?
Also the following seems not a very precise statement:
"The BMU and suppressor had passed manufacturing quality tests and would have logged a failure if the suppressor had detached before the incident"
I would read it as "The only opportunity to detect the missing TVS would have been during the QA/QC bench test of the BMU". Is this correct?
The NTSB report, unless I missed something, does not answer some question re. what data may be available. Any useful data which might have been logged by the BCU, for example?
Also the following seems not a very precise statement:
"The BMU and suppressor had passed manufacturing quality tests and would have logged a failure if the suppressor had detached before the incident"
I would read it as "The only opportunity to detect the missing TVS would have been during the QA/QC bench test of the BMU". Is this correct?
Join Date: Jan 2008
Location: lancs.UK
Age: 77
Posts: 1,191
Likes: 0
Received 0 Likes
on
0 Posts
I just posted my (worthless) opinion on the R&N thread.
reiterating:
another bodge to get them earning revenue again
wound cells have same expansion/contraction/shuffling/void problems as folded cells.
Each of the 24 sub-cells should be heat and electrically insulated in a ceramic enclosure and connect to the cell's internal busbar/strap via a fusible link...thus any failed cell will automatically drop out and allow the whole battery to stay on-line at correct voltage (though capacity reduced by 1/3 due to the weakest link in the series-arrangement.
This would be a more graceful degradation than the current all or nothing scenario.
I also made a somewhat tfacetious suggestion, re- the firebox/vent.
reiterating:
another bodge to get them earning revenue again
wound cells have same expansion/contraction/shuffling/void problems as folded cells.
Each of the 24 sub-cells should be heat and electrically insulated in a ceramic enclosure and connect to the cell's internal busbar/strap via a fusible link...thus any failed cell will automatically drop out and allow the whole battery to stay on-line at correct voltage (though capacity reduced by 1/3 due to the weakest link in the series-arrangement.
This would be a more graceful degradation than the current all or nothing scenario.
I also made a somewhat tfacetious suggestion, re- the firebox/vent.
Join Date: Mar 2011
Location: engineer at large
Posts: 1,409
Likes: 0
Received 0 Likes
on
0 Posts
Lyman,
The box is simply a Red Herring to get the press/investors going.
It cannot be part of the solution, but simply a worst case scenario placate for the regulators..
I look at the extensive cooling systems on the hybrid cars/electric cars, but like a nuke reactor, in an accident, you loose cooling, shes gonna blow...
The box is simply a Red Herring to get the press/investors going.
It cannot be part of the solution, but simply a worst case scenario placate for the regulators..
I look at the extensive cooling systems on the hybrid cars/electric cars, but like a nuke reactor, in an accident, you loose cooling, shes gonna blow...
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes
on
0 Posts
Yes, the box is not allowed for the intended purpose, containment. FIRE is prohibited. So the box is moot, and has got to be a distraction only. The box can be used for containment of gases, and electrolyte, but not for fire.
Who kids who?
Who kids who?