National Transportation Safety Board Safety Recommendation certification testing of lithium-ion batteries to be used on commercial airplanes and the certification of new technology.

National Transportation Safety Board
Washington, DC 20594

Safety Recommendation 

Date: May 22, 2014
In reply refer to: A-14-032 through -036

The Honorable Michael P. Huerta
Administrator
Federal Aviation Administration
Washington, DC 20591

We are providing the following information to urge the Federal Aviation Administration
(FAA) to take action on the safety recommendations issued in this letter. These recommendations
address certification testing of lithium-ion batteries to be used on commercial airplanes and the 
certification of new technology. The recommendations are derived from the
National Transportation Safety Board’s (NTSB) ongoing investigation of the January 7, 2013,
battery event aboard a Boeing 787 in Boston, Massachusetts. As a result of this investigation, the
NTSB has issued five recommendations, all of which are addressed to the FAA. Information
supporting these recommendations is discussed below.
Background
On January 7, 2013, smoke was discovered by cleaning personnel in the aft cabin of a
Japan Airlines Boeing 787-8, JA829J, which was parked at a gate at General Edward Lawrence
Logan International Airport, Boston, Massachusetts. About the same time, a maintenance
manager in the cockpit observed that the auxiliary power unit (APU)—the sole source of airplane
power at the time—had automatically shut down. Shortly afterward, a mechanic opened the aft
electronic equipment (E/E) bay and found “heavy smoke” and a “small flame” coming from the
APU battery case.1
 No passengers or crewmembers were aboard the airplane at the time, and
none of the maintenance or cleaning personnel aboard the airplane was injured.
Although this incident is still under investigation, the NTSB’s preliminary findings
indicated that one of the eight APU lithium-ion battery cells had experienced an uncontrollable
increase in temperature and pressure (known as a thermal runaway) as a result of an internal

1
 The mechanic reported that he saw “heavy smoke in the [E/E] compartment” and a “small flame around APU
batt[ery].” He estimated the flame size to be “about 3 inch[es].” 2
short circuit.2
 The single-cell failure propagated to adjacent cells, resulting in the cascading
thermal runaway of several cells and the release of additional smoke and flammable electrolyte
from the battery case.
3
 This type of failure was not expected based on the testing and analysis of
the APU battery system that Boeing performed as part of the 787 certification program.
The APU battery model is also used for the 787 main battery. On January 16, 2013, an
incident involving the main battery occurred aboard a 787 airplane operated by
All Nippon Airways during a flight from Yamaguchi to Tokyo, Japan. The airplane made an
emergency landing in Takamatsu, Japan, shortly after takeoff. No injuries were reported. The
Japan Transport Safety Board (JTSB) is investigating this incident with support from the NTSB. 4

Certification Requirements
In September 2004, Boeing met with representatives of the FAA’s aircraft certification
office in Seattle, Washington, to indicate the company’s intent to install lithium-ion technology
for the main and APU batteries on the 787 airplane. In response, the FAA reviewed the adequacy
of the existing regulations governing the installation of batteries in large transport-category
airplanes and determined that the regulations did not sufficiently address several failure,
operational, and maintenance characteristics of lithium-ion batteries that could affect the safety
of the battery installations.
5
 As a result, the FAA issued Special Conditions 25-359-SC, “Boeing
Model 787-8 Airplane; Lithium-Ion Battery Installation,” which detailed nine specific
requirements regarding the use of these batteries on the 787.6
 The intent of these special
conditions was to establish additional safety standards that the FAA considered necessary to
provide a level of safety that was equivalent to the existing standards for aircraft batteries.
Special condition 2 of 25-359-SC stated, “design of the lithium-ion batteries must
preclude the occurrence of self-sustaining, uncontrolled increases in temperature or pressure.”
During the NTSB’s April 2013 investigative hearing on the Boston battery incident, Boeing and
FAA representatives testified that only those failure conditions resulting in cell venting with
smoke and fire were considered relevant to special condition 2. The Boeing and FAA
representatives also testified that, at the time of the 787 certification, they believed that an
uncontrolled increase in temperature or pressure could only occur if a cell or a battery were

2
 The APU battery consists of eight individual lithium-ion cells that are connected in series and assembled in
two rows of four cells. The cells are based on a lithium cobalt-oxide compound technology and contain electrolyte
liquid. The cause of the internal short circuit is currently under investigation.
3
 Evidence of the electrolyte fluid (in the form of residue and thermal damage) was seen within areas located
about 20 inches from the APU battery installation. No primary structures (that is, those associated with airplane
flight loads) were found damaged; secondary structures—specifically, the avionics rack and the floor
panel―exhibited thermal damage near the location where the APU battery had been installed.
4
 The JTSB described this battery event as a “serious incident.” For information about this investigation, see the
JTSB’s website, which can be accessed at http://www.mlit.go.jp/jtsb/english.html. The JTSB is also assisting the
NTSB with its investigation of the Boston battery incident.
5
 The battery regulations that existed at the time were found in 14 Code of Federal Regulations (CFR) 25.1353,
“Electrical Equipment and Installations,” paragraphs (c)(1) through (4).
6
 The final special conditions for the 787 lithium-ion battery installation (72 Federal Register 57842,
October 11, 2007) became effective on November 13, 2007. 3
overcharged. The NTSB’s investigation has not found any evidence to date to indicate that the
Boston incident battery was overcharged.
Development Testing Results
Boeing determined that an internal short circuit in a single cell that resulted in thermal
runaway would not propagate to other cells within the battery. This determination was based in
part on the results of development (noncertification) testing performed in November 2006 by
GS Yuasa Corporation of Kyoto, Japan, which developed, designed, and manufactured the
battery.
7
 This testing involved driving a steel nail through a cell case to penetrate the electrodes
of a fully charged single cell within a fully charged, nongrounded, preproduction battery to
induce an internal short circuit within the cell.8
 The purpose of the test, which was conducted at a
temperature representative of the E/E bay operating temperature during a typical flight, was to
observe the behavior of the cells near the nail-penetrated cell, observe any release of smoke or
initiation of fire, and document any damage to the battery case.
9

The nail penetration test results showed that the surface temperature of the
nail-penetrated cell increased, smoke vented from the cell and the battery case, and the surface
temperature of the adjacent cells increased with no venting. On the basis of this development test
and field reliability data of a similar cell designed and manufactured by GS Yuasa,
Boeing determined that the effects of cell internal short circuiting would be limited to (1) the
release of smoke from the battery, which could be effectively handled by the airplane’s
ventilation system, and (2) an increase in surface temperature of the short-circuited cell with no
propagation of thermal runaway to adjacent cells, damage to the battery case, fire, or explosion.
As a result, the 787 electrical power system (EPS) certification plan proposed by Boeing and
approved by the FAA did not include a cell internal short circuit abuse test because it was not
required for demonstrating compliance with special condition 2.
10

Accounting for Internal Short Circuits and Thermal Runaway in Certification Tests
An FAA issue paper, dated March 2006, included Boeing’s statement that the
certification tests planned for the 787 main and APU batteries would substantiate that the battery

7
 Boeing had collaborated with GS Yuasa and Thales Avionics Electrical Systems of France about the
development tests to be performed on cells and batteries. (Thales designed the equipment for the 787 electrical
power conversion subsystem, which includes the main and APU battery systems and is part of the 787 electrical
power system.) Results from this testing helped Boeing determine what types of abuse (thermal, physical, and/or
electrical) certification testing and/or safety analyses needed to be performed to show compliance with the
applicable battery regulations, including the special conditions. The development tests were not required by the
FAA.
8
 The test battery was considered to be in a “floating” ground state because its case was not electrically
grounded. The battery case, when installed in the airplane, is grounded via the 787 common return network.
9
 APU battery temperature was not recorded on the incident flight recorder. However, after the incident, Boeing
monitored E/E bay temperatures during several flights and reported average values of 10ºC to 15ºC (50ºF to 59ºF)
during a typical flight.
10
 A cell internal short circuit abuse test simulates the most severe effects of internal short circuiting by
triggering thermal runaway of a cell (or cells) within the battery to evaluate the potential for propagation to other
cells and resulting hazardous effects, such as smoke, excessive heat, release of flammable electrolyte, fire, and/or
explosion. 4
design would remove the possibility of internal short circuit failures.11
 In its design safety
assessment for certification, Boeing considered the potential for smoke generation as a result of
the internal short circuit failure mode. However, Boeing underestimated the more serious effects
of an internal short circuit, that is, thermal runaway of other cells within the battery, excessive
heat, flammable electrolyte release, and fire.12
 The 787 EPS certification plan proposed by
Boeing, which, as previously stated, did not include a cell internal short circuit abuse test, was
approved by the FAA in January 2007.
Lithium-ion batteries in service at that time in other applications (including cellular
telephones and personal computers) were exhibiting susceptibility to internal short circuiting
with effects such as excessive heating or an explosion.13
 Such failures were generally attributed
to manufacturing or design deficiencies or exposure of the cell or battery to abuse conditions.14

In addition, in December 2007, the NTSB issued safety recommendations addressing the hazards
of transporting lithium batteries as a result of its investigation of an in-flight cargo fire aboard a
United Parcel Service DC-8 airplane.15

Experts in lithium-ion technology have indicated that the conditions within a cell that
lead to an internal short circuit can progress over time while the battery is in use and that these
conditions are not readily detectable until an internal short circuit occurs.
16
 Depending on its
effects, an internal short circuit might not be detected and managed by a battery monitoring
system in sufficient time to stop the thermal runaway of a cell and subsequent adjacent cells. For
example, between the date that the Boston incident airplane was delivered new to the operator
(December 20, 2012) and the date of the incident (January 7, 2013), there were no abnormal
indications or maintenance messages related to issues with the incident battery.17
 As a result, it is
important for manufacturers to demonstrate, as part of certification testing, that a battery’s design
can effectively mitigate the most severe effects of an internal short circuit because the failure
conditions that lead to an internal short circuit may not be apparent.

11
 Federal Aviation Administration Issue Paper SE-9, “Special Condition: Lithium-Ion Battery Installations,”
March 31, 2006.
12
 In April 2013, the NTSB held a forum on lithium-ion batteries in transportation. The forum included panelists
from the US military, civilian government agencies, academia, and the transportation industry who discussed the
safety risks of internal short circuits in lithium-ion batteries. The presentations from this forum can be found on the
NTSB’s website, which can be accessed at http://www.ntsb.gov. Information from two of the presenters is discussed
in this section of the letter.
13
 S. Tobishima, “Secondary Batteries – Lithium Rechargeable Systems – Lithium-Ion: Thermal Runaway,”
Encyclopedia of Electrochemical Power Sources, Amsterdam: Elsevier, 2009, pages 409-417.
14
 For more information, see J. Lamb and C.J. Orendorff, “Evaluation of Mechanical Abuse Techniques in
Lithium Ion Batteries,” Journal of Power Sources, vol. 247, 2014, pages 189-196.
15
 For more information, see Inflight Cargo Fire, United Parcel Service Company Flight 1307,
McDonnell Douglas DC-8-71F, N748UP, Philadelphia, Pennsylvania, February 7, 2006, Aircraft Accident Report
NTSB/AAR-07/07 (Washington, DC: NTSB, 2007), which can be accessed at the NTSB’s website.
16
 J. Lamb and C.J. Orendorff, “Evaluation of Mechanical Abuse Techniques in Lithium Ion Batteries.”
M. Keyser, D. Long, Y.S. Jung, A. Pesaran, E. Darcy, B. McCarthy, L. Patrick, and C. Kruger, “Development of a
Novel Test Method for On-Demand Internal Short Circuit in a Li-Ion Cell,” Presented at the Large Lithium Ion
Battery Technology and Application Symposium, Advanced Automotive Battery Conference, Pasadena, California,
January 2011. B. Barnett, D. Ofer, S. Sriramulu, and R. Stringfellow, “Lithium-Ion Batteries, Safety,” Encyclopedia
of Sustainability Science and Technology, New York: Springer, 2012, pages 6097-6122.
17
 During this time period, the airplane had logged 169 flight hours and 22 flight cycles. 5
It appears that the most severe effects of a cell internal short circuit were not
demonstrated during GS Yuasa’s 2006 lithium-ion battery development testing for a number of
possible reasons, one of which is that the test setup did not include mechanical and electrical
interfaces between the battery and the airplane system.18
 Thus, the test setup did not fully
represent the battery installation on the airplane.
A postincident inspection of the Boston battery found evidence that electrical arcing
between a cell case and the battery case had occurred at some point during the failure sequence.19

There was also evidence of excessive current flow in the ground wire connecting the battery case
to the airplane grounding point and in the shielded signal wires in the connector between the
battery and the battery charger unit. This damage showed that a number of unintended electrical
interactions occurred among the cells, the battery case, and the electrical interfaces between the
battery and the airplane, likely after the initiation of thermal runaway in the first cell, which
might have contributed to the propagation of thermal runaway to the other cells.
The NTSB conducted testing in March 2014 to understand the effects of temperature and
installation configuration on the 787 battery’s response to a simulated short circuit (via
nail penetration) within a single cell.20
 In one test, the battery was electrically grounded using a
single ground wire that was representative of the ground wire installed on the 787 airplane.21
 The
battery temperature at the beginning of this test was between 11ºC and 14ºC (about 52ºF
to 57ºF), which was consistent with measured temperatures in the E/E bay during a typical flight.
In another test, the battery was not electrically grounded (similar to the test setup used by
GS Yuasa in its 2006 battery development test), but the test was conducted at the battery’s
maximum operating temperature of 70ºC/158ºF.
22

The test with the electrically grounded battery showed that when a short circuit was
induced into a single cell inside the battery, thermal runaway occurred, resulting in cell swelling
and venting of the nail-penetrated cell. None of the other cells in the battery underwent thermal
runaway or vented. This test also showed that the initiating cell and other cells within the battery
case began to electrically discharge at an uncontrolled rate, causing a high electrical current to

18
 Integration of the battery into the 787 EPS involved connection of the battery to other system elements and
airplane interfaces, including the battery charger unit, the electrical power bus, the electrical grounding point, and
the physical mounting structure in the E/E bay. Design requirements were established for this integrated system and
each system component, including the battery. Various development and certification tests were conducted by
GS Yuasa, Thales, and Boeing to verify that the requirements could meet design, performance, and safety objectives.
GS Yuasa’s testing was conducted only at the battery level.
19
 The battery case exhibited a 0.25-inch-wide nodular protrusion that extended about 0.12 inch from the case.
The protrusion was inspected using a scanning electron microscope and energy dispersive x-ray spectroscopy. The
inspections determined that arc damage occurred from contact between the battery case and a cell case that was
adjacent to the protrusion. For more information, see the March 2013 interim factual report for this incident on the
NTSB’s website.
20
 This testing was conducted at Underwriters Laboratories’ facility in Northbrook, Illinois.
21
 The battery test setup did not include all electrical ground paths to the battery case as installed on the airplane
(that is, the ground wire, shielded signal wires, and a physical connection between the battery case mounting rails
and ground).
22
 A joint Thales and GS Yuasa document describing the thermal environment for the battery indicated that its
operating temperature range was -18ºC to 70ºC (-0.4ºF to 158ºF). 6
discharge through the ground wire circuit.23
 Within 30 seconds of the initiation of cell venting of
the nail-penetrated cell, the ground wire fused open, and the current flow through the grounding
path ceased. The post-test inspection of the battery found signs of arcing between the
nail-penetrated cell and the battery case, including welding of the cell case to the battery case.
The test with the ungrounded battery showed that thermal runaway of a single cell
propagated to all other cells inside the battery case. This result (propagation to and venting of all
cells) differed from the result of GS Yuasa’s battery development test (venting of the
nail-penetrated cell and no propagation to and venting of other cells), but the NTSB notes that
GS Yuasa’s battery test was performed at a temperature that did not reflect the battery’s
maximum operating temperature under normal conditions. The post-test inspection of the battery
used for this NTSB test found no signs of arcing between the nail-penetrated cell (or other vented
cells) and the battery case.
A presenter at the NTSB’s forum on lithium-ion batteries in transportation stated that a
cell internal short circuit is a critical safety concern and that the risk of propagation from a
single-cell failure increases at higher temperatures.24
 Another presenter at the NTSB’s forum
stated that internal short circuits are one of the causes of catastrophic failures in lithium-ion
batteries. She also stated that cell-level safety controls to mitigate the effects of lithium-ion
battery failure modes do not necessarily translate to battery-level safety controls for this purpose.
As a result, lithium-ion battery safety controls need to be verified by testing at the appropriate
level and in the relevant environment.25

The Boston 787 battery incident demonstrated that thermal runaway of a single cell could
propagate to other cells at a temperature consistent with that in the E/E bay during a typical
flight, which is below the battery’s maximum operating temperature. The incident battery also
exhibited damage consistent with electrical arcing between a cell case and the battery case.
Neither of the NTSB’s tests nor GS Yuasa’s battery development test had completely repeated
the damage found in the Boston incident battery, but each NTSB test replicated one aspect of the
documented battery damage. Specifically, the 70ºC/158ºF test repeated the propagation of
thermal runaway to all cells within the battery, and the grounded battery test repeated electrical
arcing damage sufficient to melt the battery case material. Thus, the NTSB’s tests indicated that
the damage to the battery that resulted when a single cell underwent thermal runaway varied and
that design and environmental factors, such as installation interfaces and/or ambient temperature
conditions to which the battery was exposed, could affect test results.

23
 The incident battery ground wire was found intact with the wire insulation exhibiting an undamaged exterior
surface but a slightly blackened interior surface, which was consistent with resistance heating associated with the
flow of high levels of electrical current. The shielded signal wires also exhibited signs of internal heating that were
consistent with resistance heating by high levels of electrical current. For more information, see the NTSB’s interim
factual report for this incident.
24
 Daniel H. Doughty, Failure Mechanisms of Lithium-Ion Batteries. Presented at the Lithium Ion Batteries in
Transportation Forum, National Transportation Safety Board, April 2013. The presenter is the president of a battery
safety consulting firm in Albuquerque, New Mexico.
25
 Judith Jeevarajan, End-User Acceptance: Requirements or Specifications, Certification, & Testing. Presented
at the Lithium Ion Batteries in Transportation Forum, National Transportation Safety Board, April 2013. The
presenter is the group lead for battery safety and advanced technology at the National Aeronautics and Space
Administration, Johnson Space Center, Houston, Texas. 7
Although the NTSB’s tests were not exhaustive regarding all aspects of the battery
design, use, and approved operating conditions, the test results indicated that, to fully understand
the most severe effects that could occur when a single cell within a lithium-ion battery undergoes
thermal runaway, various factors expected during normal operations need to be included in
aircraft certification tests. In particular, it is important to ensure that installation, environmental,
and usage factors are fully accounted for in abuse tests intended to demonstrate the most severe
effects of an internal short circuit-induced thermal runaway. The current standard for lithium-ion
battery design and safety certification in aviation applications, RTCA document DO-311,
“Minimum Operational Performance Standards for Rechargeable Lithium Battery Systems,”
includes abuse testing, but the document does not address all of the unique aspects of a battery’s
installation on an aircraft.26
 Thus, aircraft manufacturers need to evaluate whether additional
requirements and testing are necessary to ensure aircraft-level safety.
The NTSB concludes that aircraft certification tests that induce thermal runaway of a cell
in a lithium-ion battery configured as installed on the aircraft would better demonstrate to the
FAA that the battery installation could effectively mitigate the potential safety effects of an
internal short circuit. As a result, the NTSB recommends that the FAA develop abuse tests that
subject a single cell within a permanently installed, rechargeable lithium-ion battery to thermal
runaway and demonstrate that the battery installation mitigates all hazardous effects of
propagation to other cells and the release of electrolyte, fire, or explosive debris outside the
battery case. The tests should replicate the battery installation on the aircraft and be conducted
under conditions that produce the most severe outcome. The NTSB also recommends that, after
Safety Recommendation A-14-032 has been completed, the FAA require aircraft manufacturers
to perform the tests and demonstrate acceptable performance as part of the certification of any
new aircraft design that incorporates a permanently installed, rechargeable lithium-ion battery.
Although the NTSB believes that tests to induce thermal runaway of a cell are necessary
to verify that a battery’s design adequately mitigates the potential threats (to the aircraft and its
occupants) of internal short circuiting, the NTSB is concerned about the reliability and
repeatability of such tests. According to government and industry experts in lithium-ion battery
technology, the test method used to induce thermal runaway (such as nail penetration or hot pad),
the type of short induced, and the cell and battery design could all significantly impact test
results such that the most severe effects of internal short circuiting would not be fully evaluated
during certification.27
 According to a National Renewable Energy Laboratory report, “an internal
short hazard is one of the most difficult to reproduce, yet it is the most important to solve to

26
 In 2006 the FAA chartered a federal advisory committee, known as RTCA Special Committee SC-211, to
develop a standard for the design, certification, production, and use of permanently installed, rechargeable
lithium-ion battery systems. The committee included representatives from the FAA, US Air Force, US Navy,
US Army, commercial air carriers, and battery and aircraft manufacturers. Boeing, Thales, and GS Yuasa were also
members of the RTCA special committee. The resulting standard, DO-311, which was issued in 2008, is currently
considered by the FAA to be an acceptable means of compliance to the special conditions for rechargeable
lithium-ion batteries and battery systems.
27
 For more information, see David Howell, U.S. DOE Perspective on Lithium-Ion Battery Safety. Presented at
Technical Symposium: Safety Considerations for EVs Powered by Li-Ion Batteries, National Highway Traffic
Safety Administration, May 2011. Also see Premanand Ramadass, Weifeng Fang, and Zhengming (John) Zhang,
“Study of Internal Short in a Li-ion Cell I. Test Method Development Using Infra-red Imaging Technique,”
Journal of Power Sources, vol. 248, 2014, pages 769-776. 8
improve safety.”28
 Researchers have found that current test methods might not reliably produce
failure effects as severe as those observed in actual field failures involving internal short
circuiting and that, as a result, a consensus for how best to simulate this critical failure mode is
needed.
29

The NTSB conducted additional testing in March 2014 to understand and compare the
energy level of a thermal runaway in response to three different methods of simulating an
internal short circuit within a single cell from a 787 battery assembly. During the testing, thermal
runaway of each cell was initiated using the indentation, nail penetration, or hot pad methods to
simulate a short circuit, and temperatures were measured at various locations on the cell cases.30

Preliminary test results indicated that, immediately after inducing the short circuit, (1) the
maximum temperature at a common location on the cell cases ranged from about 240ºC to 375ºC
(about 464ºF to 707ºF), (2) depending on the method used, the cell case temperature at various
locations differed by as much as about 270ºC/518ºF, and (3) the hot pad method resulted in the
highest temperatures measured.
Although various other factors, such as cell age, were not evaluated during this testing,
the preliminary test results were consistent with the observations of industry experts who
indicated that the method used to simulate a cell internal short circuit in a thermal runaway abuse
test could have a significant impact on the resulting thermal energy released.31
 Thus, the method
used to initiate thermal runaway as part of an internal short circuit abuse test could also influence
how the thermal runaway condition could affect other cells within a battery.
Significant ongoing research about the causes and types of internal short circuiting in
lithium-ion batteries and potential test evaluation methods to simulate worst-case effects is
currently being conducted by experts within the US military, civilian federal agencies,
US national laboratories, and test standards development organizations.
32
 Maintaining awareness
of this evolving body of knowledge could help the FAA determine the most reliable ways to
simulate an internal short circuit in a lithium-ion battery and ensure that manufacturers have the
guidance needed to address related aircraft-level safety hazards during certification.

28
 Daniel H. Doughty, Vehicle Battery Safety Roadmap Guidance, Department of Energy, National Renewable
Energy Laboratory, NREL Report No. SR-5400-54404 (Golden, Colorado: NREL, 2012). This report, which
addressed lithium-ion battery safety in electric vehicles, noted that development of an internal short circuit test is an
important objective that is being explored by several laboratories but that “no one test has gained acceptance by
industry or test organizations.”
29
 J. Lamb and C.J. Orendorff, “Evaluation of Mechanical Abuse Techniques in Lithium Ion Batteries.”
Daniel H. Doughty, Vehicle Battery Safety Roadmap Guidance. L. Florence, H.P. Jones, and A. Liang, Safety Issues
for Lithium-Ion Batteries, Underwriters Laboratories, 2010.
30
 This testing was performed at Underwriters Laboratories’ facility in Taipei, Taiwan.
31
 David Howell, U.S. DOE Perspective on Lithium-Ion Battery Safety. Premanand Ramadass, Weifeng Fang,
and Zhengming (John) Zhang, “Study of Internal Short in a Li-ion Cell I. Test Method Development Using Infra-red
Imaging Technique.”
32
 J. Lamb and C.J. Orendorff, “Evaluation of Mechanical Abuse Techniques in Lithium Ion Batteries.”
M. Keyser et al., “Development of a Novel Test Method for On-Demand Internal Short Circuit in a Li-Ion Cell.”
Daniel H. Doughty, Vehicle Battery Safety Roadmap Guidance. Alvin Wu, Mahmood Tabaddor, and Carl Wang, Test
Methods for Simulating Internal Short Circuits in Lithium Ion Cells, Presented at the Seventh Triennial International
Fire and Cabin Safety Research Conference, December 2013. 9
The NTSB concludes that an evaluation of various methods to replicate internal short
circuiting within a lithium-ion cell could help manufacturers determine whether they are using
appropriate test methods to demonstrate the most severe effects that could result at the cell,
battery, and aircraft levels given the battery’s unique design and installation. Guidance on test
protocols and methods that reliably simulate the most severe effects of internal short circuiting in
lithium-ion batteries could help ensure that this failure mode is properly assessed as part of
aircraft certification. As a result, the NTSB recommends that the FAA work with lithium-ion
battery technology experts from government and test standards organizations, including
US national laboratories, to develop guidance on acceptable methods to induce thermal runaway
that most reliably simulate cell internal short-circuiting hazards at the cell, battery, and aircraft
levels.
In-Service Lithium-Ion Batteries
According to the FAA’s March 2006 issue paper, the Boeing 787-8 airplane was the first
large transport-category airplane to use permanently installed lithium-ion main and APU
batteries.33
 The 787 also incorporated lithium-ion batteries in the airplane’s flight control
electronics, the emergency lighting system, and the recorder-independent power supply. Other
airplane designs, including the Boeing 777-200/300/300ER and 737NG and the Airbus A380,
have incorporated permanently installed lithium-ion batteries. Each of these airplane designs was
required to comply with the same special conditions applied to the 787 certification. However,
the methods used to show compliance with the special conditions in each of those programs were
uniquely established with agreement between the applicant and the FAA to address the features,
installation, and operating environment of each specific battery application.
Given the absence of a standardized certification test to evaluate a battery’s response to a
cell thermal runaway as installed on an aircraft, the NTSB concludes that the methods of
compliance used to certify in-service lithium-ion batteries might not have adequately accounted
for the hazards that could result from internal short circuiting. As a result, the NTSB
recommends that the FAA review the methods of compliance used to certify permanently
installed, rechargeable lithium-ion batteries on in-service aircraft and require additional testing, if
needed, to ensure that the battery design and installation adequately protects against all adverse
effects of a cell thermal runaway.
Introduction of New Technology Into Aircraft
Although lithium-ion batteries have been used in non-aviation applications for more than
a decade, the high-power nature of the 787 main and APU lithium-ion batteries represented new
technology for use in commercial airplanes. New, first-of-a-kind technology can offer substantial
improvements in operational efficiency, capabilities, and/or safety, and its safe introduction into
the aviation system is a key objective of the aircraft certification process.

33
 An article in an SAE International journal stated that the Cessna Citation J4, which was certified on
March 10, 2010, was believed to be the first civil airplane certificated with a lithium-ion main battery. The 787-8
received transport-category approval on August 26, 2011. For more information about the SAE article, see
Vernon W. Chang, Steven B. Waggoner, and John W. Gallman, “System Integration of a Safe, High Power,
Lithium Ion Main Battery into a Civil Aviation Aircraft,” SAE International Journal of Aerospace, vol. 3, no. 1,
2010, pages 149-158. 10
Although the 787 battery special conditions were developed with input from various FAA
technical staff members and in consultation with members of the RTCA SC-211 committee, FAA
certification staff members relied primarily on Boeing’s expertise and knowledge to define the
necessary tests and analyses for certification of the main and APU battery design. The NTSB
recognizes that reliance on a manufacturer’s expertise is a necessary part of the FAA’s aircraft
certification process and that this process has historically been an effective component for
ensuring safety.34
 However, expertise outside the aviation industry during a certification program
involving new technology could further strengthen the aircraft certification process by ensuring
that both the FAA and the manufacturer are kept up to date about the most current research and
information related to the technology, which could be rapidly expanding in other industries
during the course of an aircraft certification program (which can typically last 5 or more years).35

As early as 2000, researchers supporting Department of Energy programs dedicated to the
development of large-scale lithium-ion batteries for automotive applications had determined
through testing that internal short circuiting could result in thermal runaway of a cell and the
potential for propagation to other cells within the battery. The researchers had also determined
that thermal runaway from internal short circuiting could result in venting with smoke and fire
for a number of different cell and battery designs.36
 If the FAA had reached out to these or other
experts working on large-scale lithium-ion batteries to tap into their knowledge, it is possible that
the FAA could have recognized that the 787 methods of compliance were insufficient to
appropriately evaluate the risks associated with cell internal short circuiting and that an internal
short circuit test was needed as part of certification.
The nature of the aircraft certification process requires manufacturers to “lock down”
designs early in the program because of the multiyear timeframe needed to complete the testing
and evaluation required to demonstrate regulatory compliance. As a result, it is difficult for
manufacturers to incorporate new information into the aircraft design as the certification program
progresses. Incorporating new information becomes even more difficult once the aircraft design
goes into service because design changes can require extensive recertification activity. As a
result, the involvement of outside experts as early as possible in a certification program could be
the most efficient way to help ensure the operational safety of a new technology.

34
 In 2006, the NTSB found that the FAA’s type certification process was sound and produced a high level of
safety but that improvements were warranted because “existing policy, practices, and procedures for the ongoing
assessment of risks…do not ensure that the underlying assumptions made during design and certification are
adequately and continuously assessed in light of operational experience, lessons learned, and new knowledge.”
For more information, see Safety Report on the Treatment of Safety-Critical Systems in Transport Airplanes,
Safety Report NTSB/SR-06/02 (Washington, DC: NTSB, 2006), which can be found on the NTSB’s website.
35
 Title 14 CFR 21.17, “Designation of Applicable Regulations,” states, “an application for type certification of
a transport category aircraft is effective for 5 years…unless an applicant shows at the time of application that
product requires a longer period of time for design, development, and testing, and the FAA approves a longer
period.”
36
 This work was performed as part of the Partnership for a New Generation of Vehicles (PNGV), a research
collaboration involving the federal government and the US automotive industry. The PNGV partners, which
included seven federal agencies, 19 federal laboratories, and a consortium representing three car manufacturers,
researched different subject areas for building a hybrid electric car. For example, Sandia National Laboratories
focused on energy storage (batteries and their safety). 11
The NTSB concludes that technical knowledge imparted by independent and neutral
experts outside of the FAA and an aircraft manufacturer could provide the agency with valuable
insights about best practices and test protocols for validating system and equipment safety
performance during certification when new technology is incorporated. As a result, the NTSB
recommends that the FAA develop a policy to establish, when practicable, a panel of independent
technical experts to advise on methods of compliance and best practices for certifying the safety
of new technology to be used on new or existing aircraft. The panel should be established as
early as possible in the certification program to ensure that the most current research and
information related to the technology could be incorporated during the program.
Therefore, the National Transportation Safety Board makes the following
recommendations to the Federal Aviation Administration:
Develop abuse tests that subject a single cell within a permanently installed,
rechargeable lithium-ion battery to thermal runaway and demonstrate that the
battery installation mitigates all hazardous effects of propagation to other cells
and the release of electrolyte, fire, or explosive debris outside the battery case.
The tests should replicate the battery installation on the aircraft and be conducted
under conditions that produce the most severe outcome. (A-14-032)
After Safety Recommendation A-14-032 has been completed, require aircraft
manufacturers to perform the tests and demonstrate acceptable performance as
part of the certification of any new aircraft design that incorporates a permanently
installed, rechargeable lithium-ion battery. (A-14-033)
Work with lithium-ion battery technology experts from government and test
standards organizations, including US national laboratories, to develop guidance
on acceptable methods to induce thermal runaway that most reliably simulate cell
internal short-circuiting hazards at the cell, battery, and aircraft levels. (A-14-034)
Review the methods of compliance used to certify permanently installed,
rechargeable lithium-ion batteries on in-service aircraft and require additional
testing, if needed, to ensure that the battery design and installation adequately
protects against all adverse effects of a cell thermal runaway. (A-14-035)
Develop a policy to establish, when practicable, a panel of independent technical
experts to advise on methods of compliance and best practices for certifying the
safety of new technology to be used on new or existing aircraft. The panel should
be established as early as possible in the certification program to ensure that the
most current research and information related to the technology could be
incorporated during the program. (A-14-036)
Acting Chairman HART and Members SUMWALT, ROSEKIND, and WEENER
concurred in these recommendations.
The NTSB is vitally interested in these recommendations because they are designed to
prevent accidents and save lives. We would appreciate receiving a response from you within
90 days detailing the actions you have taken or intend to take to implement the 12
recommendations. When replying, please refer to the safety recommendations by number. We
encourage you to submit your response electronically

eBay To Ask Users to Change Their Passwords, No Evidence PayPal Customer Information Accessed or Compromised

eBay To Ask Users to Change Their Passwords, No Evidence PayPal Customer Information Accessed or Compromised
May
21










Later today, eBay Inc. will be asking all eBay users to change their passwords due to a cyber attack that compromised an eBay database containing encrypted eBay passwords and other non-financial information. eBay will notify its user base directly within the next 24 hours with more details.



Extensive forensic research has shown no evidence of unauthorized access or compromise to personal or financial information for PayPal customers. PayPal customer and financial data is encrypted and stored separately, and PayPal never shares financial information with merchants, including eBay.



In addition to asking users to reset passwords, eBay Inc. said it will also encourage any eBay user who used the same password on other sites to change those, too.



We will update the PayPal Forward blog and eBay Inc blog with more details later today.

EBAY INC. TO ASK EBAY USERS TO CHANGE PASSWORDS

eBay Inc. (Nasdaq: EBAY) said beginning later today it will be asking eBay users to change their passwords because of a cyberattack that compromised a database containing encrypted passwords and other non-financial data. After conducting extensive tests on its networks, the company said it has no evidence of the compromise resulting in unauthorized activity for eBay users, and no evidence of any unauthorized access to financial or credit card information, which is stored separately in encrypted formats. However, changing passwords is a best practice and will help enhance security for eBay users.


Information security and customer data protection are of paramount importance to eBay Inc., and eBay regrets any inconvenience or concern that this password reset may cause our customers. We know our customers trust us with their information, and we take seriously our commitment to maintaining a safe, secure and trusted global marketplace.


Cyberattackers compromised a small number of employee log-in credentials, allowing unauthorized access to eBay’s corporate network, the company said. Working with law enforcement and leading security experts, the company is aggressively investigating the matter and applying the best forensics tools and practices to protect customers.


The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth. However, the database did not contain financial information or other confidential personal information. The company said that the compromised employee log-in credentials were first detected about two weeks ago. Extensive forensics subsequently identified the compromised eBay database, resulting in the company’s announcement today.


The company said it has seen no indication of increased fraudulent account activity on eBay. The company also said it has no evidence of unauthorized access or compromises to personal or financial information for PayPal users. PayPal data is stored separately on a secure network, and all PayPal financial information is encrypted.


Beginning later today, eBay users will be notified via email, site communications and other marketing channels to change their password. In addition to asking users to change their eBay password, the company said it also is encouraging any eBay user who utilized the same password on other sites to change those passwords, too. The same password should never be used across multiple sites or accounts.


About eBay Inc.


eBay Inc. (NASDAQ: EBAY) is a global commerce and payments leader, providing a robust platform where merchants of all sizes can compete and win. Founded in 1995 in San Jose, Calif., eBay Inc. connects millions of buyers and sellers and enabled $205 billion* of commerce volume in 2013. We do so through eBay, one of the world’s largest online marketplaces, which allows users to buy and sell in nearly every country on earth; through PayPal, which enables individuals and businesses to securely, easily and quickly send and receive digital payments; and through eBay Enterprise, which enables omnichannel commerce, multichannel retailing and digital marketing for global enterprises in the U.S. and internationally. We also reach millions through specialized marketplaces such as StubHub, the world’s largest ticket marketplace, and eBay classifieds sites, which together have a presence in more than 1,000 cities around the world. For more information about the company and its global portfolio of online brands, visit www.ebayinc.com.


* This adjusted number reflects decision to remove vehicles and real estate GMV from ongoing total GMV and ECV metrics (previously stated ECV for 2013 was $212 billion, incorporating vehicles and real estate GMV).

NTSB ISSUES RECOMMENDATIONS ON CERTIFICATION OF LITHIUM-ION BATTERIES AND EMERGING TECHNOLOGIES

NTSB ISSUES RECOMMENDATIONS ON CERTIFICATION OF LITHIUM-ION BATTERIES AND EMERGING TECHNOLOGIES
May 22


WASHINGTON - The National Transportation Safety Board issued a series of recommendations today related to the evaluation and certification of lithium-ion batteries for use in aircraft systems, as well as the certification of new technology.


The five safety recommendations, all addressed to the Federal Aviation Administration, are derived from the NTSB's ongoing investigation of the January 7, 2013, fire event that occurred in a lithium-ion battery on a Boeing 787 that was parked at Boston Logan Airport.


Investigators found that the battery involved in the Boston 787 fire event showed evidence not just of an internal thermal runaway but that "unintended electrical interactions occurred among the cells, the battery case, and the electrical interfaces between the battery and the airplane."


The 12-page safety recommendation letter said that the processes used in 2006 to support the certification of the lithium-ion battery designed for the 787 were inadequate, in part, because there is no standardized thermal runaway test that's conducted in the environment and conditions that would most accurately reflect how the battery would perform when installed and operated on an in-service airplane.


Further, the NTSB said that because there is no such standardized thermal runaway test, lithium-ion battery designs on airplanes currently in service might not have adequately accounted for the hazards associated with internal short circuiting.


In its examination of the challenges associated with introducing newer technologies into already complex aircraft systems, the NTSB said that including subject matter experts outside of the aviation industry "could further strengthen the aircraft certification process" by ensuring that both the FAA and the aircraft manufacturer have access to the most current research and information related to the developing technology.


To address all of these issues, the NTSB asked the FAA to do the following:
Develop an aircraft-level thermal runaway test to demonstrate safety performance in the presence of an internal short circuit failure
Require the above test as part of certification of future aircraft designs
Re-evaluate internal short circuit risk for lithium-ion batteries now in-service
Develop guidance for thermal runaway test methods
Include a panel of independent expert consultants early in the certification process for new technologies installed on aircraft


"The history of commercial aviation is one in which emerging technologies have played a key role in enhancing flight safety," said NTSB Acting Chairman Christopher A. Hart. "This is why it's crucial that the process by which these technologies are evaluated and certified is as robust and thorough as possible. These recommendations will take us further in that direction."


The final report on the January 2013 Boston 787 battery fire investigation is estimated to be completed in the fall.


The full text of the safety recommendation letter to the FAA is available at http://go.usa.gov/8XaV.


All of the information and resources the NTSB has released for this investigation can be accessed from the following page: http://go.usa.gov/4K4J.

Ebay urges users to reset passwords after cyberattack

E

bay's announcement that a database holding the personal details of users – potentially all 223 million worldwide – was hacked raises a number of serious questions.

It's the biggest reported hack ever in terms of the number of people affected, but does not affect financial data, which is stored separately.

Q: Do I need to change my eBay password?

A: Yes. eBay is recommending this to all users.

Q: But I just changed it a few weeks ago when all the Heartbleed stuff was happening. Do I really need to?

A: eBay says that it discovered the hack about two weeks ago, and that it happened between "late February and early March". If you haven't changed your password since then, you should.

Q: What data was stolen?

A: eBays says that the database with users' customer names, encrypted password, email address, physical address, phone number and date of birth was breached. It hasn't said how much of that data was copied. It's best to assume that it all was.

Q: Who was behind it?

A: eBay hasn't said, and it's unlikely that any group would claim responsibility. But the fact that the hackers targeted eBay and its customer database suggests that they were commercially oriented, rather than an Anonymous-style "hacktivist" group.

Q: What could someone do with that data?

A: That varies from country to country, but enterprising villains could certainly use it for online identity theft.

Q: Was any financial data stolen?

A: eBay says not; PayPal, its payment arm, says it was not affected, and that all its information is encrypted.


Q: Should I change my PayPal password?

A: If you want to be ultra-cautious, yes, but make it different from your eBay one.


Q: What's the biggest risk from this hack?

A: The most obvious one is "phishing" emails pretending to be from eBay asking you to reset your password, but which direct you to a fake site that will steal your password. The problem is that eBay is going to be sending out lots of emails asking people to change their password.

Normally, you can recognise a real eBay email because it contains your username in the subject line – which run-of-the-mill phishing attempts don't have. (Those tend to say something like "eBay user, change your password!" and should always be ignored.)

But if hackers have got hold of a database with your email address and username (aka customer name), then they can format an email which will look just like the real thing – but lead you to a fake site that looks like eBay but will capture your login details.

To avoid this, don't follow any links in emails that seem to come from eBay. Type the site's address into your browser. Advise your friends (and relatives) about this too: if eBay's username database has leaked to any extent, all those people are very vulnerable to phishing.

Q: Do I have to change my "secret question", which is used if I can't remember my password?

A: No. eBay says that this was stored separately.

Q: What method was used to encrypt the passwords, and how hard will they be to decrypt?


A: eBay hasn't yet answered our question on this. Internet companies use increasingly sophisticated methods to encrypt passwords; the idea is that your password should be transformed in a one-way process into a string of near-random characters. When you (or someone else) enters a password for the account, it undergoes the same processing, and the resulting strings of characters are compared. If they're the same, the password entry is accepted; if not, it's rejected.


Q: Why did eBay wait two weeks before telling everyone of a break-in that happened in February?

A: The company hasn't explained the timeline, but security breaches of this type typically take some time first to detect, then to determine their extent, and then to close against further hacks. It's only then that most companies announce they've been affected.

Q: Will eBay be introducing two-factor authentication (where you have to enter a code from a mobile device or previously printed list in order to log in from a previously unused device)?

A: We have asked, but so far haven't received an answer. The large email suppliers (Google, Microsoft, Yahoo, Apple) all offer "2FA" security, which ensures that even if someone steals your password they can't log in from a new device.

Boeing 787 Battery Fire NTSB ID: DCA13IA037

View Larger Map



NTSB ID: DCA13IA037

Event Type: Aviation Incident

Location: Boston, MA

Date: January 7, 2013


Boeing 787 Battery Fire

WASHINGTON - Investigators with the National Transportation Safety Board are investigating a battery fire aboard a Boeing 787 at Boston's Logan Airport. The Japan Airlines 787 was on the ground and empty of passengers at the time of the incident.


Follow us on twitter (@ntsb) for announcements related to the investigation.

NTSB photos of the burned auxiliary power unit battery from a JAL Boeing 787 that caught fire on Jan. 7 at Boston's Logan International Airport. The dimensions of the battery are 19x13.2x10.2 inches and it weighs approximately 63 pounds (new).
Photo of an undamaged battery used in the Boeing 787.

NTSB Investigator Mike Bauer inside the Boeing 787 under investigation at Boston's Logan Airport.
Examination of the Battery Charger Unit.
NTSB investigator Joseph Panagiotou documents internal components from the battery involved in the JAL Boeing 787 fire incident in Boston.

NTSB Materials Engineer Matt Fox examines the casing from the battery involved in the JAL Boeing 787 fire incident in Boston.
Director of the Office of Research and Engineering, Joseph Kolly, identifies components of the battery involved in the JAL B-787 incident during the media briefing held January 24, 2013.
NTSB investigator Joseph Panagiotou examines a battery cell from the JAL B-787 with a stereo microscope.

In Seattle, NTSB investigators and Boeing engineers examine the type of lithium ion battery used on the Boeing 787 to start the auxillary power unit and to provide backup power for flight critical systems.
NTSB identifies origin of JAL Boeing 787 battery fire; design, certification and manufacturing processes come under scrutiny



Investigative Report and Related Documents
Safety Recommendations A-14-032 through 036
Interim Factual Report
Accident Docket
Presentations
Presentation for Investigative Update - [PowerPoint | PDF] (February 7, 2013)
FAA Special Conditions for B-787 Lithium Ion Battery Installation - [PDF] (February 7, 2013)
Presentation for Investigative Update - [PowerPoint | PDF] (January 24, 2013)
Primer on Lithium Ion Battery Technology - [PowerPoint | PDF] (January 24, 2013)
Events
Investigative Hearing: Boeing 787 Battery Fire (April 23-24)
Forum: Lithium Ion Batteries in Transportation (April 11 - 12, 2013)
Video
Chairman Hersman provides second media briefing on the JAL Boeing 787 battery fire investigation. (February 7, 2013)
Chairman Deborah A.P. Hersman briefs the media on the JAL Boeing 787 battery fire investigation. (January 24, 2013)
Press Releases
NTSB ISSUES RECOMMENDATIONS ON CERTIFICATION OF LITHIUM-ION BATTERIES AND EMERGING TECHNOLOGIES (May 22, 2014)
NTSB Provides Update on Boeing 787 Battery Fire Investigation (January 8, 2014)
NTSB CHAIRMAN HERSMAN UPDATES SENATE PANEL ON BOEING 787 INVESTIGATION AND AIR SAFETY(April 16, 2013)
Final agenda announced for NTSB forum on lithium ion batteries in transportation (April 8, 2013)
NTSB announces dates for investigative hearing on Boeing 787 battery fire incident and battery design and certification (April 2, 2013)
NTSB announces dates and agenda for lithium ion battery forum (March 25, 2013)
NTSB releases interim factual report on JAL 787 battery fire investigation and announces forum and investigative hearing (March 7, 2013)
NTSB To release interim factual report and open public docket on JAL B-787 battery fire investigation (March 6, 2013)
NTSB identifies origin of JAL Boeing 787 battery fire; design, certification and manufacturing processes come under scrutiny (February 7, 2013)
NTSB issues seventh update on JAL Boeing 787 battery fire investigation (February 1, 2013)
NTSB issues sixth update on JAL Boeing 787 battery fire investigation. (January 29, 2013)
NTSB Update on JAL Boeing 787 Battery Fire Investigation (January 27, 2013)
NTSB Chairman says 'We have not ruled anything out' in investigation of Boeing 787 battery fire in Boston.(January 24, 2013)
NTSB to provide investigative update and photo opportunity of lab work related to Boeing 787 battery fire in Boston (January 23, 2013)
NTSB Provides Third Investigative Update on Boeing 787 Battery Fire in Boston (January 20, 2013)
NTSB Sending Investigator to Assist with Boeing 787 Battery Incident in Japan (January 16, 2013)
NTSB Provides Second Investigative Update on Boeing 787 Battery Fire in Boston (January 14, 2013)
NTSB provides investigative update on Boeing 787 fire incident in Boston (January 8, 2013)
NTSB investigators looking into Boeing 787 smoke event in Boston (January 7, 2013)

The W. Garfield Weston Foundation

The W. Garfield Weston Foundation





Not to be confused with The Weston Foundation.

The W. Garfield Weston Foundation is a Canadian charitable foundation committed to making grants in Canada for the benefit of Canadians.

The foundation was created with donations from both W. Garfield Weston and his wife Reta Lila Weston (née, Howard) and from all of their 9 children: Grainger Weston, Miriam Burnett, Barbara Mitchell, Garry Weston, Wendy Rebanks, Camilla Dalglish, Gretchen Bauta, Galen Weston and Nancy Baron. It is named for W. Garfield Weston, who established bakery and other successful enterprises throughout Canada and in many parts of the world. Today, these businesses include George Weston Limited and Loblaw group of food retailing, processing and distribution companies.

The Foundation is supported by an endowment from the extended Weston family, with the majority of the funds being directed to specific organizations in the fields of education and environment. In 2012, the Foundation initiated the Weston Family Parks Challenge, announcing $5 million, in aggregate over 3 years, to enhance Toronto's green spaces while encouraging private-public partnership for their long-term sustainability.[1]

In addition to its principal ongoing commitments, the Foundation makes a number of trustee-initiated grants each year.