National Transportation Safety Board
Washington, DC 20594
Safety Recommendation
Date: May 22, 2014
In reply refer to: A-14-032 through -036
The Honorable Michael P. Huerta
Administrator
Federal Aviation Administration
Washington, DC 20591
We are providing the following information to urge the Federal Aviation Administration
(FAA) to take action on the safety recommendations issued in this letter. These recommendations
address certification testing of lithium-ion batteries to be used on commercial airplanes and the
certification of new technology. The recommendations are derived from the
National Transportation Safety Board’s (NTSB) ongoing investigation of the January 7, 2013,
battery event aboard a Boeing 787 in Boston, Massachusetts. As a result of this investigation, the
NTSB has issued five recommendations, all of which are addressed to the FAA. Information
supporting these recommendations is discussed below.
Background
On January 7, 2013, smoke was discovered by cleaning personnel in the aft cabin of a
Japan Airlines Boeing 787-8, JA829J, which was parked at a gate at General Edward Lawrence
Logan International Airport, Boston, Massachusetts. About the same time, a maintenance
manager in the cockpit observed that the auxiliary power unit (APU)—the sole source of airplane
power at the time—had automatically shut down. Shortly afterward, a mechanic opened the aft
electronic equipment (E/E) bay and found “heavy smoke” and a “small flame” coming from the
APU battery case.1
No passengers or crewmembers were aboard the airplane at the time, and
none of the maintenance or cleaning personnel aboard the airplane was injured.
Although this incident is still under investigation, the NTSB’s preliminary findings
indicated that one of the eight APU lithium-ion battery cells had experienced an uncontrollable
increase in temperature and pressure (known as a thermal runaway) as a result of an internal
1
The mechanic reported that he saw “heavy smoke in the [E/E] compartment” and a “small flame around APU
batt[ery].” He estimated the flame size to be “about 3 inch[es].” 2
short circuit.2
The single-cell failure propagated to adjacent cells, resulting in the cascading
thermal runaway of several cells and the release of additional smoke and flammable electrolyte
from the battery case.
3
This type of failure was not expected based on the testing and analysis of
the APU battery system that Boeing performed as part of the 787 certification program.
The APU battery model is also used for the 787 main battery. On January 16, 2013, an
incident involving the main battery occurred aboard a 787 airplane operated by
All Nippon Airways during a flight from Yamaguchi to Tokyo, Japan. The airplane made an
emergency landing in Takamatsu, Japan, shortly after takeoff. No injuries were reported. The
Japan Transport Safety Board (JTSB) is investigating this incident with support from the NTSB. 4
Certification Requirements
In September 2004, Boeing met with representatives of the FAA’s aircraft certification
office in Seattle, Washington, to indicate the company’s intent to install lithium-ion technology
for the main and APU batteries on the 787 airplane. In response, the FAA reviewed the adequacy
of the existing regulations governing the installation of batteries in large transport-category
airplanes and determined that the regulations did not sufficiently address several failure,
operational, and maintenance characteristics of lithium-ion batteries that could affect the safety
of the battery installations.
5
As a result, the FAA issued Special Conditions 25-359-SC, “Boeing
Model 787-8 Airplane; Lithium-Ion Battery Installation,” which detailed nine specific
requirements regarding the use of these batteries on the 787.6
The intent of these special
conditions was to establish additional safety standards that the FAA considered necessary to
provide a level of safety that was equivalent to the existing standards for aircraft batteries.
Special condition 2 of 25-359-SC stated, “design of the lithium-ion batteries must
preclude the occurrence of self-sustaining, uncontrolled increases in temperature or pressure.”
During the NTSB’s April 2013 investigative hearing on the Boston battery incident, Boeing and
FAA representatives testified that only those failure conditions resulting in cell venting with
smoke and fire were considered relevant to special condition 2. The Boeing and FAA
representatives also testified that, at the time of the 787 certification, they believed that an
uncontrolled increase in temperature or pressure could only occur if a cell or a battery were
2
The APU battery consists of eight individual lithium-ion cells that are connected in series and assembled in
two rows of four cells. The cells are based on a lithium cobalt-oxide compound technology and contain electrolyte
liquid. The cause of the internal short circuit is currently under investigation.
3
Evidence of the electrolyte fluid (in the form of residue and thermal damage) was seen within areas located
about 20 inches from the APU battery installation. No primary structures (that is, those associated with airplane
flight loads) were found damaged; secondary structures—specifically, the avionics rack and the floor
panel―exhibited thermal damage near the location where the APU battery had been installed.
4
The JTSB described this battery event as a “serious incident.” For information about this investigation, see the
JTSB’s website, which can be accessed at http://www.mlit.go.jp/jtsb/english.html. The JTSB is also assisting the
NTSB with its investigation of the Boston battery incident.
5
The battery regulations that existed at the time were found in 14 Code of Federal Regulations (CFR) 25.1353,
“Electrical Equipment and Installations,” paragraphs (c)(1) through (4).
6
The final special conditions for the 787 lithium-ion battery installation (72 Federal Register 57842,
October 11, 2007) became effective on November 13, 2007. 3
overcharged. The NTSB’s investigation has not found any evidence to date to indicate that the
Boston incident battery was overcharged.
Development Testing Results
Boeing determined that an internal short circuit in a single cell that resulted in thermal
runaway would not propagate to other cells within the battery. This determination was based in
part on the results of development (noncertification) testing performed in November 2006 by
GS Yuasa Corporation of Kyoto, Japan, which developed, designed, and manufactured the
battery.
7
This testing involved driving a steel nail through a cell case to penetrate the electrodes
of a fully charged single cell within a fully charged, nongrounded, preproduction battery to
induce an internal short circuit within the cell.8
The purpose of the test, which was conducted at a
temperature representative of the E/E bay operating temperature during a typical flight, was to
observe the behavior of the cells near the nail-penetrated cell, observe any release of smoke or
initiation of fire, and document any damage to the battery case.
9
The nail penetration test results showed that the surface temperature of the
nail-penetrated cell increased, smoke vented from the cell and the battery case, and the surface
temperature of the adjacent cells increased with no venting. On the basis of this development test
and field reliability data of a similar cell designed and manufactured by GS Yuasa,
Boeing determined that the effects of cell internal short circuiting would be limited to (1) the
release of smoke from the battery, which could be effectively handled by the airplane’s
ventilation system, and (2) an increase in surface temperature of the short-circuited cell with no
propagation of thermal runaway to adjacent cells, damage to the battery case, fire, or explosion.
As a result, the 787 electrical power system (EPS) certification plan proposed by Boeing and
approved by the FAA did not include a cell internal short circuit abuse test because it was not
required for demonstrating compliance with special condition 2.
10
Accounting for Internal Short Circuits and Thermal Runaway in Certification Tests
An FAA issue paper, dated March 2006, included Boeing’s statement that the
certification tests planned for the 787 main and APU batteries would substantiate that the battery
7
Boeing had collaborated with GS Yuasa and Thales Avionics Electrical Systems of France about the
development tests to be performed on cells and batteries. (Thales designed the equipment for the 787 electrical
power conversion subsystem, which includes the main and APU battery systems and is part of the 787 electrical
power system.) Results from this testing helped Boeing determine what types of abuse (thermal, physical, and/or
electrical) certification testing and/or safety analyses needed to be performed to show compliance with the
applicable battery regulations, including the special conditions. The development tests were not required by the
FAA.
8
The test battery was considered to be in a “floating” ground state because its case was not electrically
grounded. The battery case, when installed in the airplane, is grounded via the 787 common return network.
9
APU battery temperature was not recorded on the incident flight recorder. However, after the incident, Boeing
monitored E/E bay temperatures during several flights and reported average values of 10ºC to 15ºC (50ºF to 59ºF)
during a typical flight.
10
A cell internal short circuit abuse test simulates the most severe effects of internal short circuiting by
triggering thermal runaway of a cell (or cells) within the battery to evaluate the potential for propagation to other
cells and resulting hazardous effects, such as smoke, excessive heat, release of flammable electrolyte, fire, and/or
explosion. 4
design would remove the possibility of internal short circuit failures.11
In its design safety
assessment for certification, Boeing considered the potential for smoke generation as a result of
the internal short circuit failure mode. However, Boeing underestimated the more serious effects
of an internal short circuit, that is, thermal runaway of other cells within the battery, excessive
heat, flammable electrolyte release, and fire.12
The 787 EPS certification plan proposed by
Boeing, which, as previously stated, did not include a cell internal short circuit abuse test, was
approved by the FAA in January 2007.
Lithium-ion batteries in service at that time in other applications (including cellular
telephones and personal computers) were exhibiting susceptibility to internal short circuiting
with effects such as excessive heating or an explosion.13
Such failures were generally attributed
to manufacturing or design deficiencies or exposure of the cell or battery to abuse conditions.14
In addition, in December 2007, the NTSB issued safety recommendations addressing the hazards
of transporting lithium batteries as a result of its investigation of an in-flight cargo fire aboard a
United Parcel Service DC-8 airplane.15
Experts in lithium-ion technology have indicated that the conditions within a cell that
lead to an internal short circuit can progress over time while the battery is in use and that these
conditions are not readily detectable until an internal short circuit occurs.
16
Depending on its
effects, an internal short circuit might not be detected and managed by a battery monitoring
system in sufficient time to stop the thermal runaway of a cell and subsequent adjacent cells. For
example, between the date that the Boston incident airplane was delivered new to the operator
(December 20, 2012) and the date of the incident (January 7, 2013), there were no abnormal
indications or maintenance messages related to issues with the incident battery.17
As a result, it is
important for manufacturers to demonstrate, as part of certification testing, that a battery’s design
can effectively mitigate the most severe effects of an internal short circuit because the failure
conditions that lead to an internal short circuit may not be apparent.
11
Federal Aviation Administration Issue Paper SE-9, “Special Condition: Lithium-Ion Battery Installations,”
March 31, 2006.
12
In April 2013, the NTSB held a forum on lithium-ion batteries in transportation. The forum included panelists
from the US military, civilian government agencies, academia, and the transportation industry who discussed the
safety risks of internal short circuits in lithium-ion batteries. The presentations from this forum can be found on the
NTSB’s website, which can be accessed at http://www.ntsb.gov. Information from two of the presenters is discussed
in this section of the letter.
13
S. Tobishima, “Secondary Batteries – Lithium Rechargeable Systems – Lithium-Ion: Thermal Runaway,”
Encyclopedia of Electrochemical Power Sources, Amsterdam: Elsevier, 2009, pages 409-417.
14
For more information, see J. Lamb and C.J. Orendorff, “Evaluation of Mechanical Abuse Techniques in
Lithium Ion Batteries,” Journal of Power Sources, vol. 247, 2014, pages 189-196.
15
For more information, see Inflight Cargo Fire, United Parcel Service Company Flight 1307,
McDonnell Douglas DC-8-71F, N748UP, Philadelphia, Pennsylvania, February 7, 2006, Aircraft Accident Report
NTSB/AAR-07/07 (Washington, DC: NTSB, 2007), which can be accessed at the NTSB’s website.
16
J. Lamb and C.J. Orendorff, “Evaluation of Mechanical Abuse Techniques in Lithium Ion Batteries.”
M. Keyser, D. Long, Y.S. Jung, A. Pesaran, E. Darcy, B. McCarthy, L. Patrick, and C. Kruger, “Development of a
Novel Test Method for On-Demand Internal Short Circuit in a Li-Ion Cell,” Presented at the Large Lithium Ion
Battery Technology and Application Symposium, Advanced Automotive Battery Conference, Pasadena, California,
January 2011. B. Barnett, D. Ofer, S. Sriramulu, and R. Stringfellow, “Lithium-Ion Batteries, Safety,” Encyclopedia
of Sustainability Science and Technology, New York: Springer, 2012, pages 6097-6122.
17
During this time period, the airplane had logged 169 flight hours and 22 flight cycles. 5
It appears that the most severe effects of a cell internal short circuit were not
demonstrated during GS Yuasa’s 2006 lithium-ion battery development testing for a number of
possible reasons, one of which is that the test setup did not include mechanical and electrical
interfaces between the battery and the airplane system.18
Thus, the test setup did not fully
represent the battery installation on the airplane.
A postincident inspection of the Boston battery found evidence that electrical arcing
between a cell case and the battery case had occurred at some point during the failure sequence.19
There was also evidence of excessive current flow in the ground wire connecting the battery case
to the airplane grounding point and in the shielded signal wires in the connector between the
battery and the battery charger unit. This damage showed that a number of unintended electrical
interactions occurred among the cells, the battery case, and the electrical interfaces between the
battery and the airplane, likely after the initiation of thermal runaway in the first cell, which
might have contributed to the propagation of thermal runaway to the other cells.
The NTSB conducted testing in March 2014 to understand the effects of temperature and
installation configuration on the 787 battery’s response to a simulated short circuit (via
nail penetration) within a single cell.20
In one test, the battery was electrically grounded using a
single ground wire that was representative of the ground wire installed on the 787 airplane.21
The
battery temperature at the beginning of this test was between 11ºC and 14ºC (about 52ºF
to 57ºF), which was consistent with measured temperatures in the E/E bay during a typical flight.
In another test, the battery was not electrically grounded (similar to the test setup used by
GS Yuasa in its 2006 battery development test), but the test was conducted at the battery’s
maximum operating temperature of 70ºC/158ºF.
22
The test with the electrically grounded battery showed that when a short circuit was
induced into a single cell inside the battery, thermal runaway occurred, resulting in cell swelling
and venting of the nail-penetrated cell. None of the other cells in the battery underwent thermal
runaway or vented. This test also showed that the initiating cell and other cells within the battery
case began to electrically discharge at an uncontrolled rate, causing a high electrical current to
18
Integration of the battery into the 787 EPS involved connection of the battery to other system elements and
airplane interfaces, including the battery charger unit, the electrical power bus, the electrical grounding point, and
the physical mounting structure in the E/E bay. Design requirements were established for this integrated system and
each system component, including the battery. Various development and certification tests were conducted by
GS Yuasa, Thales, and Boeing to verify that the requirements could meet design, performance, and safety objectives.
GS Yuasa’s testing was conducted only at the battery level.
19
The battery case exhibited a 0.25-inch-wide nodular protrusion that extended about 0.12 inch from the case.
The protrusion was inspected using a scanning electron microscope and energy dispersive x-ray spectroscopy. The
inspections determined that arc damage occurred from contact between the battery case and a cell case that was
adjacent to the protrusion. For more information, see the March 2013 interim factual report for this incident on the
NTSB’s website.
20
This testing was conducted at Underwriters Laboratories’ facility in Northbrook, Illinois.
21
The battery test setup did not include all electrical ground paths to the battery case as installed on the airplane
(that is, the ground wire, shielded signal wires, and a physical connection between the battery case mounting rails
and ground).
22
A joint Thales and GS Yuasa document describing the thermal environment for the battery indicated that its
operating temperature range was -18ºC to 70ºC (-0.4ºF to 158ºF). 6
discharge through the ground wire circuit.23
Within 30 seconds of the initiation of cell venting of
the nail-penetrated cell, the ground wire fused open, and the current flow through the grounding
path ceased. The post-test inspection of the battery found signs of arcing between the
nail-penetrated cell and the battery case, including welding of the cell case to the battery case.
The test with the ungrounded battery showed that thermal runaway of a single cell
propagated to all other cells inside the battery case. This result (propagation to and venting of all
cells) differed from the result of GS Yuasa’s battery development test (venting of the
nail-penetrated cell and no propagation to and venting of other cells), but the NTSB notes that
GS Yuasa’s battery test was performed at a temperature that did not reflect the battery’s
maximum operating temperature under normal conditions. The post-test inspection of the battery
used for this NTSB test found no signs of arcing between the nail-penetrated cell (or other vented
cells) and the battery case.
A presenter at the NTSB’s forum on lithium-ion batteries in transportation stated that a
cell internal short circuit is a critical safety concern and that the risk of propagation from a
single-cell failure increases at higher temperatures.24
Another presenter at the NTSB’s forum
stated that internal short circuits are one of the causes of catastrophic failures in lithium-ion
batteries. She also stated that cell-level safety controls to mitigate the effects of lithium-ion
battery failure modes do not necessarily translate to battery-level safety controls for this purpose.
As a result, lithium-ion battery safety controls need to be verified by testing at the appropriate
level and in the relevant environment.25
The Boston 787 battery incident demonstrated that thermal runaway of a single cell could
propagate to other cells at a temperature consistent with that in the E/E bay during a typical
flight, which is below the battery’s maximum operating temperature. The incident battery also
exhibited damage consistent with electrical arcing between a cell case and the battery case.
Neither of the NTSB’s tests nor GS Yuasa’s battery development test had completely repeated
the damage found in the Boston incident battery, but each NTSB test replicated one aspect of the
documented battery damage. Specifically, the 70ºC/158ºF test repeated the propagation of
thermal runaway to all cells within the battery, and the grounded battery test repeated electrical
arcing damage sufficient to melt the battery case material. Thus, the NTSB’s tests indicated that
the damage to the battery that resulted when a single cell underwent thermal runaway varied and
that design and environmental factors, such as installation interfaces and/or ambient temperature
conditions to which the battery was exposed, could affect test results.
23
The incident battery ground wire was found intact with the wire insulation exhibiting an undamaged exterior
surface but a slightly blackened interior surface, which was consistent with resistance heating associated with the
flow of high levels of electrical current. The shielded signal wires also exhibited signs of internal heating that were
consistent with resistance heating by high levels of electrical current. For more information, see the NTSB’s interim
factual report for this incident.
24
Daniel H. Doughty, Failure Mechanisms of Lithium-Ion Batteries. Presented at the Lithium Ion Batteries in
Transportation Forum, National Transportation Safety Board, April 2013. The presenter is the president of a battery
safety consulting firm in Albuquerque, New Mexico.
25
Judith Jeevarajan, End-User Acceptance: Requirements or Specifications, Certification, & Testing. Presented
at the Lithium Ion Batteries in Transportation Forum, National Transportation Safety Board, April 2013. The
presenter is the group lead for battery safety and advanced technology at the National Aeronautics and Space
Administration, Johnson Space Center, Houston, Texas. 7
Although the NTSB’s tests were not exhaustive regarding all aspects of the battery
design, use, and approved operating conditions, the test results indicated that, to fully understand
the most severe effects that could occur when a single cell within a lithium-ion battery undergoes
thermal runaway, various factors expected during normal operations need to be included in
aircraft certification tests. In particular, it is important to ensure that installation, environmental,
and usage factors are fully accounted for in abuse tests intended to demonstrate the most severe
effects of an internal short circuit-induced thermal runaway. The current standard for lithium-ion
battery design and safety certification in aviation applications, RTCA document DO-311,
“Minimum Operational Performance Standards for Rechargeable Lithium Battery Systems,”
includes abuse testing, but the document does not address all of the unique aspects of a battery’s
installation on an aircraft.26
Thus, aircraft manufacturers need to evaluate whether additional
requirements and testing are necessary to ensure aircraft-level safety.
The NTSB concludes that aircraft certification tests that induce thermal runaway of a cell
in a lithium-ion battery configured as installed on the aircraft would better demonstrate to the
FAA that the battery installation could effectively mitigate the potential safety effects of an
internal short circuit. As a result, the NTSB recommends that the FAA develop abuse tests that
subject a single cell within a permanently installed, rechargeable lithium-ion battery to thermal
runaway and demonstrate that the battery installation mitigates all hazardous effects of
propagation to other cells and the release of electrolyte, fire, or explosive debris outside the
battery case. The tests should replicate the battery installation on the aircraft and be conducted
under conditions that produce the most severe outcome. The NTSB also recommends that, after
Safety Recommendation A-14-032 has been completed, the FAA require aircraft manufacturers
to perform the tests and demonstrate acceptable performance as part of the certification of any
new aircraft design that incorporates a permanently installed, rechargeable lithium-ion battery.
Although the NTSB believes that tests to induce thermal runaway of a cell are necessary
to verify that a battery’s design adequately mitigates the potential threats (to the aircraft and its
occupants) of internal short circuiting, the NTSB is concerned about the reliability and
repeatability of such tests. According to government and industry experts in lithium-ion battery
technology, the test method used to induce thermal runaway (such as nail penetration or hot pad),
the type of short induced, and the cell and battery design could all significantly impact test
results such that the most severe effects of internal short circuiting would not be fully evaluated
during certification.27
According to a National Renewable Energy Laboratory report, “an internal
short hazard is one of the most difficult to reproduce, yet it is the most important to solve to
26
In 2006 the FAA chartered a federal advisory committee, known as RTCA Special Committee SC-211, to
develop a standard for the design, certification, production, and use of permanently installed, rechargeable
lithium-ion battery systems. The committee included representatives from the FAA, US Air Force, US Navy,
US Army, commercial air carriers, and battery and aircraft manufacturers. Boeing, Thales, and GS Yuasa were also
members of the RTCA special committee. The resulting standard, DO-311, which was issued in 2008, is currently
considered by the FAA to be an acceptable means of compliance to the special conditions for rechargeable
lithium-ion batteries and battery systems.
27
For more information, see David Howell, U.S. DOE Perspective on Lithium-Ion Battery Safety. Presented at
Technical Symposium: Safety Considerations for EVs Powered by Li-Ion Batteries, National Highway Traffic
Safety Administration, May 2011. Also see Premanand Ramadass, Weifeng Fang, and Zhengming (John) Zhang,
“Study of Internal Short in a Li-ion Cell I. Test Method Development Using Infra-red Imaging Technique,”
Journal of Power Sources, vol. 248, 2014, pages 769-776. 8
improve safety.”28
Researchers have found that current test methods might not reliably produce
failure effects as severe as those observed in actual field failures involving internal short
circuiting and that, as a result, a consensus for how best to simulate this critical failure mode is
needed.
29
The NTSB conducted additional testing in March 2014 to understand and compare the
energy level of a thermal runaway in response to three different methods of simulating an
internal short circuit within a single cell from a 787 battery assembly. During the testing, thermal
runaway of each cell was initiated using the indentation, nail penetration, or hot pad methods to
simulate a short circuit, and temperatures were measured at various locations on the cell cases.30
Preliminary test results indicated that, immediately after inducing the short circuit, (1) the
maximum temperature at a common location on the cell cases ranged from about 240ºC to 375ºC
(about 464ºF to 707ºF), (2) depending on the method used, the cell case temperature at various
locations differed by as much as about 270ºC/518ºF, and (3) the hot pad method resulted in the
highest temperatures measured.
Although various other factors, such as cell age, were not evaluated during this testing,
the preliminary test results were consistent with the observations of industry experts who
indicated that the method used to simulate a cell internal short circuit in a thermal runaway abuse
test could have a significant impact on the resulting thermal energy released.31
Thus, the method
used to initiate thermal runaway as part of an internal short circuit abuse test could also influence
how the thermal runaway condition could affect other cells within a battery.
Significant ongoing research about the causes and types of internal short circuiting in
lithium-ion batteries and potential test evaluation methods to simulate worst-case effects is
currently being conducted by experts within the US military, civilian federal agencies,
US national laboratories, and test standards development organizations.
32
Maintaining awareness
of this evolving body of knowledge could help the FAA determine the most reliable ways to
simulate an internal short circuit in a lithium-ion battery and ensure that manufacturers have the
guidance needed to address related aircraft-level safety hazards during certification.
28
Daniel H. Doughty, Vehicle Battery Safety Roadmap Guidance, Department of Energy, National Renewable
Energy Laboratory, NREL Report No. SR-5400-54404 (Golden, Colorado: NREL, 2012). This report, which
addressed lithium-ion battery safety in electric vehicles, noted that development of an internal short circuit test is an
important objective that is being explored by several laboratories but that “no one test has gained acceptance by
industry or test organizations.”
29
J. Lamb and C.J. Orendorff, “Evaluation of Mechanical Abuse Techniques in Lithium Ion Batteries.”
Daniel H. Doughty, Vehicle Battery Safety Roadmap Guidance. L. Florence, H.P. Jones, and A. Liang, Safety Issues
for Lithium-Ion Batteries, Underwriters Laboratories, 2010.
30
This testing was performed at Underwriters Laboratories’ facility in Taipei, Taiwan.
31
David Howell, U.S. DOE Perspective on Lithium-Ion Battery Safety. Premanand Ramadass, Weifeng Fang,
and Zhengming (John) Zhang, “Study of Internal Short in a Li-ion Cell I. Test Method Development Using Infra-red
Imaging Technique.”
32
J. Lamb and C.J. Orendorff, “Evaluation of Mechanical Abuse Techniques in Lithium Ion Batteries.”
M. Keyser et al., “Development of a Novel Test Method for On-Demand Internal Short Circuit in a Li-Ion Cell.”
Daniel H. Doughty, Vehicle Battery Safety Roadmap Guidance. Alvin Wu, Mahmood Tabaddor, and Carl Wang, Test
Methods for Simulating Internal Short Circuits in Lithium Ion Cells, Presented at the Seventh Triennial International
Fire and Cabin Safety Research Conference, December 2013. 9
The NTSB concludes that an evaluation of various methods to replicate internal short
circuiting within a lithium-ion cell could help manufacturers determine whether they are using
appropriate test methods to demonstrate the most severe effects that could result at the cell,
battery, and aircraft levels given the battery’s unique design and installation. Guidance on test
protocols and methods that reliably simulate the most severe effects of internal short circuiting in
lithium-ion batteries could help ensure that this failure mode is properly assessed as part of
aircraft certification. As a result, the NTSB recommends that the FAA work with lithium-ion
battery technology experts from government and test standards organizations, including
US national laboratories, to develop guidance on acceptable methods to induce thermal runaway
that most reliably simulate cell internal short-circuiting hazards at the cell, battery, and aircraft
levels.
In-Service Lithium-Ion Batteries
According to the FAA’s March 2006 issue paper, the Boeing 787-8 airplane was the first
large transport-category airplane to use permanently installed lithium-ion main and APU
batteries.33
The 787 also incorporated lithium-ion batteries in the airplane’s flight control
electronics, the emergency lighting system, and the recorder-independent power supply. Other
airplane designs, including the Boeing 777-200/300/300ER and 737NG and the Airbus A380,
have incorporated permanently installed lithium-ion batteries. Each of these airplane designs was
required to comply with the same special conditions applied to the 787 certification. However,
the methods used to show compliance with the special conditions in each of those programs were
uniquely established with agreement between the applicant and the FAA to address the features,
installation, and operating environment of each specific battery application.
Given the absence of a standardized certification test to evaluate a battery’s response to a
cell thermal runaway as installed on an aircraft, the NTSB concludes that the methods of
compliance used to certify in-service lithium-ion batteries might not have adequately accounted
for the hazards that could result from internal short circuiting. As a result, the NTSB
recommends that the FAA review the methods of compliance used to certify permanently
installed, rechargeable lithium-ion batteries on in-service aircraft and require additional testing, if
needed, to ensure that the battery design and installation adequately protects against all adverse
effects of a cell thermal runaway.
Introduction of New Technology Into Aircraft
Although lithium-ion batteries have been used in non-aviation applications for more than
a decade, the high-power nature of the 787 main and APU lithium-ion batteries represented new
technology for use in commercial airplanes. New, first-of-a-kind technology can offer substantial
improvements in operational efficiency, capabilities, and/or safety, and its safe introduction into
the aviation system is a key objective of the aircraft certification process.
33
An article in an SAE International journal stated that the Cessna Citation J4, which was certified on
March 10, 2010, was believed to be the first civil airplane certificated with a lithium-ion main battery. The 787-8
received transport-category approval on August 26, 2011. For more information about the SAE article, see
Vernon W. Chang, Steven B. Waggoner, and John W. Gallman, “System Integration of a Safe, High Power,
Lithium Ion Main Battery into a Civil Aviation Aircraft,” SAE International Journal of Aerospace, vol. 3, no. 1,
2010, pages 149-158. 10
Although the 787 battery special conditions were developed with input from various FAA
technical staff members and in consultation with members of the RTCA SC-211 committee, FAA
certification staff members relied primarily on Boeing’s expertise and knowledge to define the
necessary tests and analyses for certification of the main and APU battery design. The NTSB
recognizes that reliance on a manufacturer’s expertise is a necessary part of the FAA’s aircraft
certification process and that this process has historically been an effective component for
ensuring safety.34
However, expertise outside the aviation industry during a certification program
involving new technology could further strengthen the aircraft certification process by ensuring
that both the FAA and the manufacturer are kept up to date about the most current research and
information related to the technology, which could be rapidly expanding in other industries
during the course of an aircraft certification program (which can typically last 5 or more years).35
As early as 2000, researchers supporting Department of Energy programs dedicated to the
development of large-scale lithium-ion batteries for automotive applications had determined
through testing that internal short circuiting could result in thermal runaway of a cell and the
potential for propagation to other cells within the battery. The researchers had also determined
that thermal runaway from internal short circuiting could result in venting with smoke and fire
for a number of different cell and battery designs.36
If the FAA had reached out to these or other
experts working on large-scale lithium-ion batteries to tap into their knowledge, it is possible that
the FAA could have recognized that the 787 methods of compliance were insufficient to
appropriately evaluate the risks associated with cell internal short circuiting and that an internal
short circuit test was needed as part of certification.
The nature of the aircraft certification process requires manufacturers to “lock down”
designs early in the program because of the multiyear timeframe needed to complete the testing
and evaluation required to demonstrate regulatory compliance. As a result, it is difficult for
manufacturers to incorporate new information into the aircraft design as the certification program
progresses. Incorporating new information becomes even more difficult once the aircraft design
goes into service because design changes can require extensive recertification activity. As a
result, the involvement of outside experts as early as possible in a certification program could be
the most efficient way to help ensure the operational safety of a new technology.
34
In 2006, the NTSB found that the FAA’s type certification process was sound and produced a high level of
safety but that improvements were warranted because “existing policy, practices, and procedures for the ongoing
assessment of risks…do not ensure that the underlying assumptions made during design and certification are
adequately and continuously assessed in light of operational experience, lessons learned, and new knowledge.”
For more information, see Safety Report on the Treatment of Safety-Critical Systems in Transport Airplanes,
Safety Report NTSB/SR-06/02 (Washington, DC: NTSB, 2006), which can be found on the NTSB’s website.
35
Title 14 CFR 21.17, “Designation of Applicable Regulations,” states, “an application for type certification of
a transport category aircraft is effective for 5 years…unless an applicant shows at the time of application that
product requires a longer period of time for design, development, and testing, and the FAA approves a longer
period.”
36
This work was performed as part of the Partnership for a New Generation of Vehicles (PNGV), a research
collaboration involving the federal government and the US automotive industry. The PNGV partners, which
included seven federal agencies, 19 federal laboratories, and a consortium representing three car manufacturers,
researched different subject areas for building a hybrid electric car. For example, Sandia National Laboratories
focused on energy storage (batteries and their safety). 11
The NTSB concludes that technical knowledge imparted by independent and neutral
experts outside of the FAA and an aircraft manufacturer could provide the agency with valuable
insights about best practices and test protocols for validating system and equipment safety
performance during certification when new technology is incorporated. As a result, the NTSB
recommends that the FAA develop a policy to establish, when practicable, a panel of independent
technical experts to advise on methods of compliance and best practices for certifying the safety
of new technology to be used on new or existing aircraft. The panel should be established as
early as possible in the certification program to ensure that the most current research and
information related to the technology could be incorporated during the program.
Therefore, the National Transportation Safety Board makes the following
recommendations to the Federal Aviation Administration:
Develop abuse tests that subject a single cell within a permanently installed,
rechargeable lithium-ion battery to thermal runaway and demonstrate that the
battery installation mitigates all hazardous effects of propagation to other cells
and the release of electrolyte, fire, or explosive debris outside the battery case.
The tests should replicate the battery installation on the aircraft and be conducted
under conditions that produce the most severe outcome. (A-14-032)
After Safety Recommendation A-14-032 has been completed, require aircraft
manufacturers to perform the tests and demonstrate acceptable performance as
part of the certification of any new aircraft design that incorporates a permanently
installed, rechargeable lithium-ion battery. (A-14-033)
Work with lithium-ion battery technology experts from government and test
standards organizations, including US national laboratories, to develop guidance
on acceptable methods to induce thermal runaway that most reliably simulate cell
internal short-circuiting hazards at the cell, battery, and aircraft levels. (A-14-034)
Review the methods of compliance used to certify permanently installed,
rechargeable lithium-ion batteries on in-service aircraft and require additional
testing, if needed, to ensure that the battery design and installation adequately
protects against all adverse effects of a cell thermal runaway. (A-14-035)
Develop a policy to establish, when practicable, a panel of independent technical
experts to advise on methods of compliance and best practices for certifying the
safety of new technology to be used on new or existing aircraft. The panel should
be established as early as possible in the certification program to ensure that the
most current research and information related to the technology could be
incorporated during the program. (A-14-036)
Acting Chairman HART and Members SUMWALT, ROSEKIND, and WEENER
concurred in these recommendations.
The NTSB is vitally interested in these recommendations because they are designed to
prevent accidents and save lives. We would appreciate receiving a response from you within
90 days detailing the actions you have taken or intend to take to implement the 12
recommendations. When replying, please refer to the safety recommendations by number. We
encourage you to submit your response electronically
