Original post courtesy of NTSB.gov on January 7, 2013
Executive Summary
On January 7, 2013, about 1021 eastern standard time, smoke was discovered by cleaning personnel in the aft cabin of a Japan Airlines (JAL) Boeing 787-8, JA829J, which was parked at a gate at General Edward Lawrence Logan International Airport (BOS), Boston, Massachusetts. About the same time, a maintenance manager in the cockpit observed that the auxiliary power unit (APU) had automatically shut down. Shortly afterward, a mechanic opened the aft electronic equipment bay and found heavy smoke coming from the lid of the APU battery case and a fire with two distinct flames at the electrical connector on the front of the case. None of the 183 passengers and 11 crewmembers were aboard the airplane at the time, and none of the maintenance or cleaning personnel aboard the airplane was injured. Aircraft rescue and firefighting personnel responded, and one firefighter received minor injuries. The airplane had arrived from Narita International Airport, Narita, Japan, as a regularly scheduled passenger flight operated as JAL flight 008 and conducted under the provisions of 14 Code of Federal Regulations (CFR) Part 129.
The APU battery model is the same model used for the 787 main battery. On January16, 2013, an incident involving the main battery occurred aboard a 787 airplane operated by All Nippon Airways during a flight from Yamaguchi to Tokyo, Japan. The airplane made an emergency landing at Takamatsu Airport (TAK), Takamatsu, Japan, shortly after takeoff. The Japan Transport Safety Board investigated this incident with support from the National Transportation Safety Board (NTSB).
Boeing was responsible for the overall integration and certification of the equipment in the 787’s electrical power conversion subsystem, which is part of the airplane’s electrical power system (EPS). Boeing contracted with Thales Avionics Electrical Systems to design the 787 electrical power conversion subsystem, which includes the main and APU batteries. Thales then subcontracted with various manufacturers for the main and APU battery system components, including GS Yuasa Corporation, which developed, designed, and manufactured the main and APU batteries.
Boeing was required to demonstrate that the 787’s design complied with the Federal Aviation Administration’s (FAA) Special Conditions 25-359-SC, “Boeing Model 787-8 Airplane; Lithium-Ion Battery Installation,” which detailed nine specific requirements regarding the use of these batteries on the airplane. As part of the compliance demonstration with these requirements and 14 CFR Part 25 airworthiness standards, Boeing performed a safety assessment to determine the potential hazards that various failure conditions of EPS components could introduce to the airplane and its occupants. Boeing determined that the rate of occurrence of cell venting for the 787battery would be about 1 in 10 million flight hours. However, at the time of the BOS and TAK incidents (both of which involved cell venting), the in-service 787 fleet had accumulated less than 52,000 flight hours.
After the BOS and TAK events and the FAA’s subsequent grounding of the US787 fleet, Boeing modified the 787 main and APU battery design and its installation configuration to include, among other things, a stainless steel enclosure for the battery case and a duct that vents from the interior of the enclosure to the exterior of the airplane to prevent smoke from entering the occupiable space of the airplane. In April 2013, the FAA issued an airworthiness directive mandating the installation of the modified battery aboard US 787 airplanes before they could return to service.
The 787 main and APU battery design was also modified to mitigate the most severe effects of an internal short circuit (that is, cascading, cell-to-cell thermal runaway of other cells within the battery; excessive heat; flammable electrolyte release; and fire). The recommendations resulting from the safety issues identified during this investigation could help prevent such effects from occurring in future battery designs.
The NTSB identified the following safety issues as a result of this incident investigation:
787 Battery Parts
- Cell internal short circuiting and the potential for thermal runaway of one or more battery cells, fire, explosion, and flammable electrolyte release. This incident involved an uncontrollable increase in temperature and pressure (thermal runaway) of a single APU battery cell as a result of an internal short circuit and the cascading thermal runaway of the other seven cells within the battery. This type of failure was not expected based on the testing and analysis of the main and APU battery that Boeing performed as part of the 787 certification program. However, GS Yuasa did not test the battery under the most severe conditions possible in service, and the test battery was different than the final battery design certified for installation on the airplane. Also, Boeing’s analysis of the main and APU battery did not consider the possibility that cascading thermal runaway of the battery could occur as a result of a cell internal short circuit.
- Cell manufacturing defects and oversight of cell manufacturing processes. After the incident, the NTSB visited GS Yuasa’s production facility to observe the cell manufacturing process. During the visit, the NTSB identified several concerns, including foreign object debris (FOD) generation during cell welding operations and a postassembly inspection process that could not reliably detect manufacturing defects, such as FOD and perturbations (wrinkles) in the cell windings, which could lead to internal short circuiting. In addition, the FAA’s oversight of Boeing, Boeing’s oversight of Thales, and Thales’ oversight of GS Yuasa did not ensure that the cell manufacturing process was consistent with established industry practices.
- Thermal management of large-format lithium-ion batteries. Testing performed during the investigation showed that localized heat generated inside a 787 main and APU battery during maximum current discharging exposed a cell to high-temperature conditions. Such conditions could lead to an internal short circuit and cell thermal runaway. As a result, thermal protections incorporated in large-format lithium-ion battery designs need to account for all sources of heating in the battery during the most extreme charge and discharge current conditions. Thermal protections include (1) recording and monitoring cell-level temperatures and voltages to ensure that exceedances resulting from localized or other sources of heating can be detected and addressed before cell damage occurs and (2) establishing thermal safety limits for cells to ensure that self-heating does not occur at a temperature that is less than the battery’s maximum operating temperature.
- Insufficient guidance for manufacturers to use in determining and justifying key assumptions in safety assessments. Boeing’s EPS safety assessment for the 787 main and APU battery included an underlying assumption that the effect of an internal short circuit within a cell would be limited to venting of only that cell without fire. However, the assessment did not explicitly discuss this key assumption or provide the engineering rationale and justifications to support the assumption. Also, as demonstrated by the circumstances of this incident, Boeing’s assumption was incorrect, and Boeing’s assessment did not consider the consequences if the assumption were incorrect or incorporate design mitigations to limit the safety effects that could result in such a case. Boeing indicated in certification documents that it used a version of FAA Advisory Circular (AC) 25.1309, “System Design and Analysis” (referred to as the Arsenal draft), as guidance during the 787 certification program. However, the analysis that Boeing presented in its EPS safety assessment did not appear to be consistent with the guidance in the AC. In addition, Boeing and FAA reviews of the EPS safety assessment did not reveal that the assessment had not (1) considered the most severe effects of a cell internal short circuit and (2) included requirements to mitigate related risks.
- Insufficient guidance for FAA certification engineers to use during the type certification process to ensure compliance with applicable requirements. During the 787 certification process, the FAA did not recognize that cascading thermal runaway of the battery could occur as a result of a cell internal short circuit. As a result, FAA certification engineers did not require a thermal runaway test as part of the compliance demonstration (with applicable airworthiness regulations and lithium-ion battery special conditions) for certification of the main and APU battery. Guidance to FAA certification staff at the time that Boeing submitted its application for the 787 type certificate, including FAA Order 8110.4, “Type Certification,” did not clearly indicate how individual special conditions should be traced to compliance deliverables (such as test procedures, test reports, and safety assessments) in a certification plan.
- Stale flight data and poor-quality audio recording of the 787 enhanced airborne flight recorder (EAFR). The incident airplane was equipped with forward and aft EAFRs, which recorded cockpit audio data and flight parametric data. The EAFRs recorded stale flight data for some parameters (that is, data that appeared to be valid and continued to be recorded after a parameter source stopped providing valid data), which delayed the NTSB’s complete understanding of the recorded data. In addition, the audio recordings from both EAFRs during the airborne portion of the flight were poor quality. The signal levels of the three radio/hot microphone channels were very low, and the recording from the cockpit area microphone channel was completely obscured by the ambient cockpit noise. These issues did not impact the NTSB’s investigation because the conversations and sounds related to the circumstances of the incident occurred after the airplane arrived at the gate and the engines were shut down, at which point the quality of the audio recordings was excellent.
Probable Cause
The NTSB determines that the probable cause of this incident was an internal short circuit within a cell of the APU lithium-ion battery, which led to thermal runaway that cascaded to adjacent cells, resulting in the release of smoke and fire. The incident resulted from Boeing’s failure to incorporate design requirements to mitigate the most severe effects of an internal short circuit within an APU battery cell and the FAA’s failure to identify this design deficiency during the type design certification process.
As a result of this investigation, the NTSB makes safety recommendations to the FAA, Boeing, and GS Yuasa. The NTSB previously issued safety recommendations to the FAA regarding (1) insufficient testing methods and guidance for addressing the safety risks of internal short circuits and thermal runaway and (2) the need for outside technical knowledge and expertise to help the FAA ensure the safe introduction of new technology into aircraft designs.
Follow up on new 787 Battery design
Auxiliary Power Unit Battery Fire 2013 Click To Tweet