If the Battery is integrated into the distribution network, it is not a Back Up Battery. It is a Battery that has an additional function in name only. By definition, this functional demand is outside the intent of the regulation, imo.
This battery has the elements of a reliable back up source. Too much was expected, and demanded. Is it a legacy of antiquated obsession with pounds of weight? It may be down to Fire, or reliability. Choose wisely. This situation was predictable, and was predicted. The failure in implementation is down to lack of test, and lack of in service experience. Or, worse. The CT scans of sections of even the JAL exemplar show problematic bunching, packing, wrinkling and pinching of the electrode stacks. Given the design, the geography of the enclosure, and its attendant kit, to ignore the probability that failure is merely a shortened service life due environmental impacts and/or excessive demand is a mistake. The box was a stupid PR move, a non starter..... |
Every plane that I can remember flying had an auto shutdown feature on the ground in case of APU fire. It must be a certification thing. The APU can be running with no crew aboard for aircraft servicing. There is also an APU fire control panel in a wheel well usually, with a fire bell that goes off outside the aircraft. The APU fire extinguishing systems are connected to the hot battery bus. I don't know what that bus is called on the 787.
Unfortunately for the 787, there is no certification requirement for auto battery fire extinguishing, or a battery ejection seat in case of battery fire on the ground. |
archae86, #850:
Thanks for that. Have had time to have a good read now and there's quite a bit of fresh info to fill in more of the gaps. The key points seem to be: 1) There are two temperature sensors. One to inhibit charging when the battery is at under or over temperature, and a second "reported to the BCU", to control charge current. Effectively, only a single sensor to cover charge and discharge. 2) There is a single hall effect current sensor ("dc current tranformer"), where two might have been expected for redundancy reasons, for such a critical function. 3) Charge balancing is done for each cell, but no info as to how this is monitored / managed in discharge by the software. 4) The voltages of individual cells are not logged, which explains why it hasn't been possible to determine the failure timeline and primary cause. The only logging being the charger error codes (idiot lights) and fdr logging of bus voltage. 5) The battery isolation contactor has normally closed contacts. Trivial item, you may think, but in fact, it has very serious implications. I'll try to explain how a contactor functions, with apologies to those who know all this already. A simple contactor is nothing more than a pair of contacts arranged as an on/off switch, as is found in eg: a domestic light switch. Whereas a light switch is operated manually, a contactor or relay is switched by applying power to an electromagnet/coil, which is mechanically linked to the contacts. Spring loading against the coil provides opening force when power is removed. The contacts may be arranged to be normally closed or normally open, ie: switch normally on or off, with no power applied to the coil. In most cases, for fail safe operation, normally open contacts are used so that in the absence of power or circuit failure, the contacts open, isolating the circuit. In the 787 system however, the contacts are normally closed and thus need power to open the contacts and isolate the circuit. This is opposite to what would be expected for such an application, since there really is no way to isolate the battery from charger or load in the event of electronic, software or other failure. In extremis, the battery will remain connected until the fire is put out and the wires cut. I know i've been banging on about all kinds of issues with the design for weeks, but more info that comes to light, the more seems to be exposed and that's without any idea of what the underlying control software is getting up to... |
B787 battery
Keep in mind there are two failures of batterys from two different locations each with very simular end results. The report on the first indicates 17 mins after the APU was started from the APU battery, the voltage dec from 32V to 30V which indicates the first time a short is present. Since the current information is being derived from the neg of the battery & is after the shorted cell it is the sum of both charge & the discharge of the faulty section of the battery & thus would not be the correct recorded value. Because the breakdown of the insulation barrier between the cells has effectively reduced the number of cells over voltage would now appear on the cells before the short resulting in damage but lesser damage than the cells with the higher circulating current involving the path via the case to the ground point of the battery case & A/C bonded points. Further just to make sure the whole thing is destroyed all the wires from every connection appears to be taken thru a stainless "protective " shield which is bonded to the case to short out all wires from each cell to the external world of the case once the heat melted the insulation. i.e. just about 100% chance of every cell being destroyed. (The local heat build up is seen in the pictures is clear & reports of flame by the fire crew confirms) I can't help thinking that if the case was not bonded this event would have not flagged so many design oversights & safety issues. Not a good idea to enclose all the protective & contol circuits & components in an area of a battery case which has known potential fire & heat issues as well. All in all how did this design get this far?? Could someone who has watched the current levels of the B787 APU battery indicate that 45Amps without reducing for 15 mins after starting the APU is a normal expected level as it seems a bit high. There are more concerns but the battery case & installation of this case is the primary cause. The swiss cheese model follows after this level with secondary oversights as time will show.
ps Looking at the specs for this cell the CC part for a cell start point 3.75V which would be degraded for a battery to 29.6V (est) & at 10A is 1 hr. Again anyone know if the battery in the B787 gets a CC to start the recharge process? Applying 32V initally seems very strange & would like to see how long a battery would last being tested on the bench by taking it to a low SOC & applying the 32V that is being stated as normal. (i would be in the next building) Best est 300-500 cycles. Regards |
Further to my post 857: http://www.pprune.org/7731615-post857.html
Three possible explanations for the 45A into the battery from 10:21:04: a) Likely: that the charger commenced fast charging at about 0.7C b) Improbable: APU bat bus was connected to a high current source such as Main bat bus. c) Unlikely: Parasitic connection via small load such as nav lights. Such connection could not deliver 45A. Thus it appears likely that the BMU has not detected the cell short and that the charger commenced fast charge, initiating the conflagration. Detecting Cell short is difficult: http://www.pprune.org/7679259-post500.html (Note: since that post, it was confirmed that there are only 3 sub cells per cell) What remains illusive, is the cause of the Cell short. |
@saptzae post #500
What has to be done, is to make the BMS more sensitive to voltage transients on individual cells and shut charging down very quickly. NTSB have stated unequivocally that this incident was precipitated by a short in one of the eight 'cells'. The short led to thermal runaway, a disqualifying condition for service. (imo) Boeing has proposed a heavy and sturdy containment to prevent fire from spreading and other disqualifying conditions, admirable. The failure mechanism is known. Can this battery be made safe such that containment is not a requirement? Other large battery packs have been constructed from “large format cells” that have capacities in the range of 10 to 100 Ah. Standards for these sorts of applications are currently being written or revised to be appropriate for lithium-ion technology We'll have to see, but I don't think 'containment' will 'fly'. |
@Lyman
The failure mechanism is known. Can this battery be made safe such that containment is not a requirement? Containment is just an additional layer and is not critical part of safe operation. To accomplish this
The grounding is better discussed in the other thread. |
Howdy saptzae,
Monitor and Manage cells better. Eliminate cascading failures - Stop secondary and thereby Tertiary failure As we see, it is not possible to control (manage) charging in an eight battery (cell) series. The "control" is to take the unit (all eight) off line. This pertains to reliability, certainly a technical issue, grounding is not pertinent here... NTSB have eliminated overcharging as a cause, at least preliminarily.... That leaves a primary. Short circuiting in large format LiIon batteries is not well understood, as a read of the above study demonstrates. There are no industry standards as of July 2011. The FAA regulations were written in 2007 (sic). For a serviceable cell to short circuit, internally, the separation Anode/Cathode must be breached. As far as I can determine, that means a break down of the separator, and/or, the presence of metallic Lithium dendrites, spanning the borders of the connectors at either end. Dendrites far and away are the more troublesome of the two, separator issues are related to diffusion of the Ions, dendrites are a mechanical connector.... Some of the microscopic photography in the materials addendum is interesting.... The hearings are open to the Public. Are you considering being present? I am. |
B787 battery
Syseng68k #902
Hi, I'm an Electronics engineer working in another industry, involving MW size power electronics, UPS systems, and IEC61508 P/P/E. 2) There is a single hall effect current sensor ("dc current tranformer"), where two might have been expected for redundancy reasons, for such a critical function. I would prefer two, not only for redundancy, but also for insulation monitoring.The battery is in a conductive casing, and is expected to be insulated from the power circuits. But one single fault in a battery could connect it to the casing, thereby creating a circuit that can't be disconnected. I would insert a HAL sensor in both the positive and the negative connection, for insulation detection. 5) The battery isolation contactor has normally closed contacts. Trivial item, you may think, but in fact, it has very serious implications. This is serious, it seems the designers has been more concerned with the risk of the system failing so it can't provide power, than the system failing so it can't protect itself. (against high currents, and high/low charge). I would prefer two separate contactors (or at least a two pole), with normally open contact sets, one installed in the positive and the other in the negative connection. The contactors and BMS has to be able to detect and break the highest possible short circuit current. The contactor operation could then be a part of a daily self-test (Feedback from forcefully guided contact sets). This would also allow the battery box to have unpowered terminals during installation, the power could be connected when the communication link is established. This would then create a chicken and egg problem, since the contactors has to be unpowered, when the aircraft is parked in order not to drain the battery, and the system needed to wake-up the battery has to be powered from the same battery. This could be solved by providing power via. the data communication connector to the charger/DC bus controller. If Boeing continues with the hot-box solution then the energy-density would be lower than the current solution, and more rack-space would then be required. Such a battery box would probably have a MTBF (safe faults) in the range of 5 years, for extra availability of backup power a 2oo3 architecture could be used. |
Howdy HighWind...
The battery is in a conductive casing I think... (Aluminum) Ground Failure issues? :ok: |
Absolutely questionable design
Hi,
syseng68k: Chris, 5) The battery isolation contactor has normally closed contacts. Trivial item, you may think, but in fact, it has very serious implications. :mad: A BAD BATTERY! A design capable to ... :{ :sad: |
HighWind, #908:
Hi, I'm an Electronics engineer working in another industry, involving MW size power electronics, UPS systems, and IEC61508 P/P/E. perhaps ?. I would prefer two, not only for redundancy, but also for insulation monitoring. The battery is in a conductive casing, and is expected to be insulated from the power circuits. But one single fault in a battery could connect it to the casing, thereby creating a circuit that can't be disconnected. I would insert a HAL sensor in both the positive and the negative connection, for insulation detection. are an indication of leakage to ground. Ideally, each sensor would be on the busbar terminations at the power socket, to cover leakages right up to that point. I would prefer two separate contactors (or at least a two pole), with normally open contact sets, one installed in the positive and the other in the negative connection. The contactors and BMS has to be able to detect and break the highest possible short circuit current. each line to work. There's stiil the problem of >1 cell shorting to case, but I guess that scenario could be covered by fusable links between the cells, rather than the existing copper straps. A two pole contactor would get the job done and should be more reliable and cost effective as well. However, my point would still be that if the cells are properly managed and run within data sheet limits, the problem won't arise in the first place. This would then create a chicken and egg problem, since the contactors has to be unpowered, when the aircraft is parked in order not to drain the battery, and the system needed to wake-up the battery has to be powered from the same battery. This could be solved by providing power via. the data communication connector to the charger/DC bus controller. with uA in sleep mode, always connected to the battery, or even a small disposable memory style backup cell. The micro is then woken up by the first comms packet down the line. Over the past few weeks, many people contributing here have found loads of issues with the design and while hindsight can be a wonderfull thing, the present design looks like half the job that should have been done. The introduction of cots tech into aviation may have saved loads of money, but I wonder if some of the design rigour and attention to detail have been thrown out of the window at the same time. Having said that, I'll bet the design teams were really pleased with themselves to start with :yuk:... Regards, Chris |
From Seattle Times...
Everyone needs to stop picking on Boeing, formerly of Seattle, for this minor 787 battery snafu. It’s now becoming clear that the company paid a company to pay a company to hire a subcontractor to run some simulated tests on theoretical imaginary battery problems, exactly as required by the FAA. What more could anyone expect of them? |
FPOBN,
The Special Regulations were composed in 2007, and approved the same year (October). The Fire Research report, in addressing the "large format" Li technology, stated unequivocally that there were no Industry standards in place as of JULY,2011..... Large Format seems to mean 10-100 aH. So FAA left Boeing to come up with a PROVEN system. I do not fault FAA for that. To the contrary, advancing technology requires room to advance. The special regs set limits, not specs on how to ennable the technology short of them (pardon the pun). The limits turn out to be sufficiently rigorous, NO FIRE, NO UNCONTAINED ELECTROLYTE. (One in a Billion, one in ten million) The Airworthiness Directive is couched in similar terms and provoked a snarky rejoinder from the airframer. "Show us how to conform".... It is up to the builder to perform, there is no room for wriggling. Large Format seems to be simply, "scaled up". Not an engineer, but that seems like an invitation to Fail. "Nice Battery, can you make it bigger?" Primarily as to heat control. Now Boeing can "scale back", until they can demonstrate some acceptable thermal performance, but that will take time, and it means satisfying a regulator who has been taken to the cleaners once already. It also means packaging more and smaller batteries into an existing architecture. The Big Box format might be fine to alleviate fire control issues, but it does not address the prevention of fire in the first place, something that was touted to be on the order of "One in a BILLION" (John Goglia). It does nothing to salvage the trashed reliability profile as to "Back Up Battery". Have you seen the photos of the "Exemplar" battery removed from JAL 08? The "Jelly Roll" looks to have sat in the lunch box for quite awhile, and may have seen Sally and Joey sit on it several times. The electrode stacks are sensitive to shape retention, as to remaining safe from internal damage, and evenly distributed excess heat. (Sic). |
Lyman
As to Monitor.... Secureaplane has their patent, a method of sensing and thereby controlling charging? For each cell? That did not happen... Patents protect frrom imitation, they do not guarantee performance. One wonders why it was thought necessary to rely on indirect assessment of cell health and indirect temperature sensing and serial charging rather than individual cell monitoring and parallel charging which would seen a lot safer? |
Prior to filing document of disclosure for a patent in the early seventies, I would not have guessed that a Patent hasn't anything whatever to do with the utility of the patented process/device.
There is no requirement anywhere in the successful Patent process to demonstrate that the device actually works, or has any use whatever.... It provides "protection" from infringement, only. It is not a Warranty, nor is it a "Guarantee". Obviously, in the case of the Dreamliner. Boeing would not be the first client to be over-impressed with a REGUSPATOFF file number.... But the only germane discussion at this point is how can the battery be made reliable, let alone safe? VOLTAGE and TEMPERATURE numerics are useless against thermal runaway. So far as keeping this "Battery" operating in any case. They might be useful in stopping a conflagration, but for Gods sake, why is anything that can ignite spontaneously anywhere near an AIRCRAFT? Surely Boeing knew that? |
A single cell (blade) failure can be contained. A multi cell failure (hub) is hard to contain.
Thus am I most concerned about fixing the Primary cause and preventing the Secondary and Tertiary cascading failures. @Lyman As to Monitor.... Secureaplane has their patent It is one of those patents one gets to get a patent for making life harder for the competition to sue one. Well, and a little for marketing hype too. As to its merit, inflection, prediction, assumption is IMHO a demerit. As we see, it is not possible to control (manage) charging in an eight battery (cell) series. Rather, by what we see, all boils down to inadequate management, on all levels.
For a serviceable cell to short circuit, internally, the separation Anode/Cathode must be breached. As far as I can determine, that means a break down of the separator, and/or, the presence of metallic Lithium dendrites, spanning the borders of the connectors at either end. Dendrites far and away are the more troublesome of the two, separator issues are related to diffusion of the Ions, dendrites are a mechanical connector.... The hearings are open to the Public. Are you considering being present? @HighWind Welcome! Yes, two hall sensors would be good. Yes, two pole contactor would be better. A bistable contactor would be possible. @syseng68k Fusible links would not be practical. Cells should be insulated more reliably (heat resistantly) from the case (edit: and each other). |
All that aside..
The NTSB report showed that the battery was tested, the charging system was tested, but the battery and charging system were not tested together, and the entire system was not tested while installed in the aircraft, nor with the entire electrical system of the aircraft. How this approach permeates throughout how the rest of the aircraft was tested, remains to be seen. As we have all noted, the exact cause has not yet been determined. The sum of the parts does not always equal a whole.... edit: remember back to some of the early issues with this aircraft? Remember the retro fit of titanium wires for lightening arrest. Really, a comp aircraft, and it went that far down the path, before lightening was addressed? and of course, the associated extra weight of all the wires... |
@Ian W
Well, the securaplane lab building burned down once while testing (without BMU connector plugged in) :{ Seriously, they surely did not test a cell to failure inside an airframe, nor with _all_ systems operating on a test bench. System level testing is whats lacking, both during design and in production, for example, parasitic connections where found after TAK incident. They apparently drove a nail into a cell. But they did not deteriorate a cell to short itself "naturally" by over/undercharge. A nail through all layers of all sub cells is 10s of times better short than a single spot of a sub cell shorting! |
@FlightPathOBN
Yes, there is so much to learn about this wonderful airplane. When all this is over, the entire industry will have progressed substantially. |
All times are GMT. The time now is 00:46. |
Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.