A bit more on Boeing’s battery woes…
The NTSB has released more pictures of the JAL battery, and there are some interesting conclusions that can be drawn from the evidence to date.
First the NTSB took an X-ray (see above) of the battery, note how the battery cell cases have distorted causing them to come in contact with adjacent cells, of course direct physical conduct also increases the rate of thermal transmission from cell to cell.
Also note from the X-ray the relative distortion of the cells, which is an indicator of the pressure at which the pressure relief vent actually actuates. The faster the temperature rises the faster the internal pressure rise as well, giving less time for the vent to actuate and resulting in greater over pressure and cell distortion.
The NTSB have also published pictures taken during their tear down of the battery. On the most damaged left side of the battery the cell with the least bulging, indicating the lowest pressure rise before venting, is number 6 while cells 5, 7 and 8 all show much more distortion, indicating that these cell’s vent valves actuated at considerably higher pressures.
Which is interesting as the NTSB has singled out cell number six as the initiating failure due to indications of internal damage.
A failure scenario
So a tentative failure scenario goes something like this. The internal failure of cell six (cause as yet undetermined) led to a thermal runaway inside cell 6 and the eventual venting and auto-ignition of electrolyte and internal plastic into the battery box. This triggered thermal runaways and rapid temperature and pressure rises in the adjacent cells (5 and 7) which resulted in high internal pressures before they vented, significant distortion of the case and physical contact with adjacent cells.
The pressurised venting of these adjacent cell’s electrolytes in turn fed the fire along the left side of the battery. The fires radiant and convective heating, along with the conductive heat transfer from the physically contacting cell 7, led to the most rapid overheating of cell 8 as witnessed by the extreme distortion of the case.
The cells on the right side of the battery presented their narrower end cross sections to the fire and therefore cooked off at a slower rate leading to the vent valves on 1, 2 and 3 opening at lower pressures and lesser consequential distortion of their cases.
Relying on ad-hoc behaviour
But according to Boeing they conducted tests to confirm that such a common cause failure scenario could not occur, so what went wrong?
As I see it the Boeing engineers fell into the trap of relying on ‘ad-hoc’ system behaviour. That is while the battery box and it’s cells were designed to perform their required functions in a nominal environment their behaviour in an abnormal one (such as a battery fire) was not designed for and was therefore fundamentally unpredictable (1).
Instead it seems that the Boeing engineers assumed that cell behaviour was predictable enough that a small set of tests could conclusively determine that a cell thermal runaway would not result in a cascading series of failures and an overall battery fire. Unluckily for them their tests did not result in the common cause failures just experienced.
Not relying on such behaviour and instead designing in predictable ‘upon failure’ behaviour is a design concept well known in other domains, for example it’s one of the foundational principles of nuclear weapons safety. In the case of Boeing’s battery box that would involve including designed deterministic features such as isolation barriers and vent paths that would reliably preclude a chain reaction in batteries.
1. For example individual cell performance will diverge over time leading to different responses to thermal or charging abuse. Similarly differences in the state of charge of various cells will also have a marked effect upon the probability of a thermal runaway resulting subsequent cell fire.