> the majority of evidence from the flight data recorder and both thermal and mechanical damage pointed to an initiating event in a single cell. That cell showed multiple signs of short circuiting, leading to a thermal runaway condition, which then cascaded to other cells.
> Boeing ... determined that the likelihood of a smoke emission event from a 787 battery would occur less than once in every 10 million flight hours ... there have been two critical battery events on the 787 fleet with fewer than 100,000 flight hours.
From what I have been reading, it seems non-engineering people have taken over Boeing. I wouldn't be surprised these suits have been pressuring everyone to get the 787 out and the culture goes from there.
It really feels a lot like the shuttle disasters, with Boeing playing the part of NASA and delegating work out to contractors who feel they must get something out or risk losing the next big contract. God forbid if this does come down to a disaster it will be even more difficult to unravel, since this time it will cross political and cultural boundaries.
I think it's unfair to call Musk's opinion a "guess". It is a sound criticism of the fundamental safety margin of those cells, and it was backed up by other experts.
If it's a fundamental design aspect such as the size and spacing of cells in a battery I don't think detailed schematics are necessary. If I saw a sketch of a car design which called for the fuel tank to be an open top 5 gallon plastic bucket sitting in the passenger's seat with a hose going into it I wouldn't need any additional or more finely grained details to be able to definitively say that it's an inherently unsafe system. If I saw a sketch of a bridge with a 50 meter gap in the bridge deck I shouldn't think to myself "oh, maybe it's just for hovercars, or maybe they've invented something revolutionary" I should think "that's a fundamentally broken bridge design". Sometimes the finer details of a design matter, and sometimes there's no possible way for them to correct for a fundamental design error.
Unless Boeing's subcontractors have made ground breaking advances in the design of lithium-ion cells then these criticisms are enormously well founded. And as we've seen those subcontractors have not, in fact, found a magical escape from the fundamental problems of thermal runaway and chain-reaction in lithium-ion cells.
Yup, or as we call it in our industry: code smell.
A good engineer doesn't need to see detailed diagrams, etc, pop open a couple files and you've got a pretty good idea of whether a project is good, or is fucked.
I thought this sentence was particularly revealing: "In tests to validate these assessments, Boeing found no evidence of cell-to-cell propagation or fire, both of which occurred in the JAL event."
yeah, that was the part that had me confused... how does that square with the 10-million-hour figure? Or is a fire not considered a "smoke emission event"?
You appear to be mis-parsing "In tests to validate these assessments". "These assessments" refers to Boeing's certification assessments, not the NTSB's incident assessment.
Long before any incidents, Boeing estimated a smoke event as once in 10 million hours. The measured rate of fire events is much higher than Boeing's pre-certification estimate of the rate of smoke events. There is absolutely no implication that Boeing's definition of smoke event doesn't include fires.
Edit: as mentioned below, the real problem seems to be that you're assuming smoke implies fire, when smoke merely suggests fire.
No, I understand that. Here's the full context of the two sentences:
> During the 787 certification process, Boeing studied possible failures that could occur within the battery. Those assessments included the likelihood of particular types of failures occurring, as well as the effects they could have on the battery. In tests to validate these assessments, Boeing found no evidence of cell-to-cell propagation or fire, both of which occurred in the JAL event. The NTSB learned that as part of the risk assessment Boeing conducted during the certification process, it determined that the likelihood of a smoke emission event from a 787 battery would occur less than once in every 10 million flight hours.
So, to summarize, in the certification process, Boeing claimed:
a: no evidence of a fire.
b: a 10-million-hour estimate for a "smoke event".
My original question was merely from a statistical/technical perspective: how is this figure calculated if they have no evidence of the event they are supposed to measure? From my understanding, automobiles undergoing similar certification are tested under abnormally rigorous conditions, and the chances of those conditions happening are taken into account when calculating failure rates. But if Boeing claims it had no evidence of a fire happening at all, what is the reasoning behind the number? Is it just a convenient way to say probability=0?
I would imagine some sort of fault tree analysis. Safety engineering in complex systems does that a lot: you start with an event you don't want to happen, imagine all the ways it could happen, estimate the probabilities of each contributing factor, and do the math.
It sounds like one of their incoming assumptions--a probability, a manufacturing spec, something like that--didn't match up with reality. That happens. They're probably going over the fault tree, madly trying to figure out which one and by how much.
>>So, to summarize, in the certification process, Boeing claimed:
a: no evidence of a fire.
b: a 10-million-hour estimate for a "smoke event".
Boeing counted a malfunction as a "smoke event" which is a release of emissions from a battery overheating, not necessarily a fire. The no evidence of a fire is a claim that regardless of a battery failure, there is no plausible failure chain that leads to a fire beginning in the battery.
>>But if Boeing claims it had no evidence of a fire happening at all, what is the reasoning behind the number? Is it just a convenient way to say probability=0?
In the case of a fire, yes. But this just means that the battery fault alone won't cause a fire. If other systems fail all bets are off.
I suspect you are conflating smoke event with a fire.
>>My original question was merely from a statistical/technical perspective: how is this figure calculated if they have no evidence of the event they are supposed to measure? From my understanding, automobiles undergoing similar certification are tested under abnormally rigorous conditions, and the chances of those conditions happening are taken into account when calculating failure rates.
As I explained above, Boeing claimed that it was possible that a battery could malfunction(one in ten million hour), but they had no plausible scenario that could lead to a fire. In this case, battery malfunctioning does not necessarily equal a fire. The smoke event is calculated from a number of probabilistic factors such as the confluence of the possibility of electrical overcharging and arcing and simple faults with the battery. It is a made up number that doesn't take into account that this is a new design that introduces other possibilities of failure.
Ahh... you're assuming that "where there's smoke, there's fire". You apparently haven't done much cooking. Smoke may suggest fire, but it doesn't imply fire.
If smoke doesn't imply fire then P(smoke) > 0 doesn't imply P(fire) > 0.
Fire, on the other hand, should imply smoke. So they estimated P(smoke) as being 1:10M hours, but we got fire with 2:10K, which suggests that P(smoke) is at least 1:5K or more often.
To be fair, Boeing could have just gotten incredibly unlucky. I kind of doubt it given assessments of the situation, but it's within the realm of possibility.
Thermal runaway in Lithium-ion and Lithium-polymer batteries is not an "unknown failure mode", it should be constantly in the front of mind every day for everyone working on such cells.
If I understand correctly, this finding seems consistent Elon Musk's hypothesis on how the battery is fundamentally unsafe. "Large cells without enough space between them to isolate against the cell-to-cell thermal domino effect means it is simply a matter of time before there are more incidents of this nature,"
Interesting report. Elon Musk's comments aside, one would think that Boeing would short a cell on purpose in a battery pack to verify their assertion that the failure of one of the cells would not propagate to other cells.
That said, if this is the proximate cause of the smoke and fire then it points to some ways to fix the problem that don't involve completely re-designing the way the plane is built which is good news for Boeing.
As for the 'other chemistry' arguments, one of the challenges of various battery chemistry is the rate of charge and the rate of discharge. My Battlebot team went through a number of battery packs for our robots[1] and found that the energy-density, charge rate, and discharge rate was one of those "pick any two" scenarios. A pain to work around.
Were I the folks in charge at Boeing, I'd be looking at a joint venture with Mr. Musk, starting today. I suspect that the difference in estimates are owed to the usual testing phenomenon---you test for what you can imagine and that is heavily conditioned by your expectations. Same reason that the folks who write software/engineering/whatever should never test it. You need a team who's main goal in life is to ruin someone else's day. When I worked for EA, the testing team was the biggest PIA you could imagine. But if they could come up with bugs, imagine what real life could do. (Pesky 8-year old kids...<grumble/>)
>Were I the folks in charge at Boeing, I'd be looking at a joint venture with Mr. Musk, starting today.
Boeing and Lockheed are pretty much the only space flight companies working with the government. Musk has an issue with this which is why his battery predictions are so enjoyable.
Boeing and Lockheed are major players, and you're right about the rivalry, but they're not the only ones. ATK (the former Thiokol) is a major player in the Space Launch System project, and politically very well connected; there are also smaller fry like SpaceX and Orbital Sciences (makers of the Pegasus air-launched rocket, and the other commercial supplier for ISS cargo resupply).
These batteries (or more often, ground power) are used to first start a small turbine engine in the tail (APU) which generates the compressed air used to start the main engines.
Edit: after further research, it seems compressed air is not used on the 787. It's all electric (two generators on the APU and on each engine):
"The power source for APU starting may be the airplane battery, a ground power source, or an engine-driven generator. The power source for engine starting may be the APU generators, engine-driven generators on the opposite side engine, or two forward 115 VAC ground power sources. The aft external power receptacles may be used for a faster start, if desired."[1]
I think it's less about money and more about stuff like:
- backup power for emergencies
- allowing attempted engine restarts in the air
- allowing the airplane to be self-sufficient should it be forced to land somewhere without ground equipment (or big enough ground equipment)
As investigators work to find the cause of the initiating
short circuit, they ruled out both mechanical impact damage
to the battery and external short circuiting.
Sounds to me like no orgin was identified at all. All they know is that the fire started because of short-circuiting. But what caused the short circuiting? I don't know?
Chairman Hersman said that potential causes of the initiating short circuit currently being evaluated include battery charging, the design and construction of the battery, and the possibility of defects introduced during the manufacturing process.
They don't know the precise cause, but they have narrowed it down to a few possibilities.
Chairman Hersman said that potential causes of the initiating short circuit currently being evaluated include battery charging, the design and construction of the battery, and the possibility of defects introduced during the manufacturing process.
Paraphrase:
"The thing we built doesn't work properly, and we think it could be because of how it works, how we designed it, or how we built it".
Of course it's useful. It's just like debugging code: when the bug first surfaces, the cause can be anything in a large space. As you learn more of the characteristics of the bug, the problem space grows smaller until you eventually identify the root cause.
"how it works, how we designed it, or how we built it" is pretty much inclusive of every possibility and doesn't rule anything out. In other words, useless.
The NTSB is not saying what you are claiming. They are only talking about those possibilities in reference to one specific failure mode: a short circuit in a single battery cell causing a fire that spreads through the entire battery. That rules out a lot.
Um, the NTSB didn't build the battery. The quote I gave is from the NTSB chairman, not from Boeing. She was talking about the current state of an ongoing investigation, which has already narrowed down the possibilties greatly.
Chairman Hersman said that potential causes of the initiating short circuit currently being evaluated include battery charging, the design and construction of the battery, and the possibility of defects introduced during the manufacturing process.
This. It's pretty obvious what happened to the battery; the question is why, and why testing didn't bring the issue to light. Is it a maintenance problem? A quality control issue in manufacturing? Something unknown about the physics of flight or the interplay between various electrical systems that reduces the safety margin? Unknown at this time.
The temperature those batteries (and those used in newer RC planes - LiPo) burn is ridiculous.
You buy some electronic/hobby equipment while traveling, put in your luggage among your clothes. In mid-flight those things get shorted and everybody is doomed.
Those batteries can ignite when shorted due to shock or tearing - which is pretty much what happens to some luggage on every flight.
I don't understand that logic. If we have "In mid-flight those things get shorted and everybody is doomed." and "Those batteries can ignite when shorted due to shock or tearing - which is pretty much what happens to some luggage on every flight.", I would expect pretty much every passenger flight to be doomed. So, at least one of those claims must be an exaggeration.
Oh I don't know, such a ban might be uncharacteristically rational for the TSA. ...actually, how many plane crashes have Li-ion battery failures in luggage caused? No it wouldn't be, a ban like that would be par for the course.
The luggage compartment is much hotter than the flight deck, especially on a freighter. If your luggage is parked in the hold during summer when the air conditioning units are off that is a major concern. There is concern that DHL flight 6 could have crashed for that reason.
What we know is that, for whatever the reason, the rate of catastrophic failure has been quite low in the past.
When new information becomes available we are able to update our risk assessment, it isn't necessary for us to wait for more plane crashes. I don't see any new information here though, the risks posed by Li-ion batteries and fires on airplanes have been well understood for quite some time.
The ban would be irrational because there is no reason to think that batteries will suddenly start causing unacceptable rates of plane failure in the near future.
Presumably such a blanket ban would come in the wake of a single high profile incident, so in fact I am saying quite the opposite of "we should only take precautions against things that have already caused problems." Taking precautions against things that happened, instead of things which are likely to happen in the future is irrational.
Box cutters took down a few planes, so we banned them. This is an irrational ban, because box cutters now have an infinitesimally small chance of taking down planes. Whether box-cutters took down 4 planes or 100 planes in the past really doesn't matter since it does not indicate future performance.
This seems a politically motivated press release by the NTSB. Boeing certainly wants to get their planes back in the air. This misleading declaration that NTSB has identified a "cause" is the first step in removing the grounding order on the aircraft.
Chairman Hersman said that potential causes of the initiating short circuit currently being evaluated include battery charging, the design and construction of the battery, and the possibility of defects introduced during the manufacturing process.
The choice of Li-ion battery saved only 30 kg over a same performance and specifications NiMH battery used without a single insident in 6.6 million hybrids produced over the last decade. There was no valid reason to use Li-ion system in this case. Even only 1 fire in 10 million flight hours mens a fire every year once 1500 Dreamliners ar flying as Boeing hopes. Switch the battery now, it is totally unnecessary risk
My point is the more we outsource important pieces to the cheaper ends of the globe - the more expensive it becomes for everyone to fix the consequences.
The 787 batteries are built in Japan, which is not at all cheap, and in general has a much better reputation for quality and reliability than the U.S... This is particularly true for high-end specialty products—like airliner batteries.
[Japanese companies outsource all their cheap goods manufacturing to other countries.]
> the majority of evidence from the flight data recorder and both thermal and mechanical damage pointed to an initiating event in a single cell. That cell showed multiple signs of short circuiting, leading to a thermal runaway condition, which then cascaded to other cells.
> Boeing ... determined that the likelihood of a smoke emission event from a 787 battery would occur less than once in every 10 million flight hours ... there have been two critical battery events on the 787 fleet with fewer than 100,000 flight hours.
Seems like Musk was right in his guess after all (http://www.flightglobal.com/news/articles/elon-musk-boeing-7...), but it is shocking how badly Boeing got its estimates wrong. Does anyone know exactly how they came up with these numbers?