Ray Conner, CEO of Boeing Commercial Airplanes, Mike Fleming, VP and Chief Engineer for EIS of the 787 and Mike Sinnett, vice president and chief project engineer for the Boeing 787, provided an update on the battery fix during a visit to Japan today (or tomorrow, Japan time….)
Here is a running brief of comments:
RC Ray Conner
MF Mike Fleming
MS Mike Sinnett
RC: US FAA has a comprehensive process we must follow to get airplanes into the air for testing and for re-EIS.
We’re here this week to discuss our solution and to take feedback from Japanese authorities, The solution is the result of thousands of hours of tests within Boeing and with other agencies.
We acknowledge the work of the Japanese regulators and GSD Yuasa and have been a tremendous partner throughout this process. I speak for the 170,000 employees of Boeing when we say that the safety of our product is the #1 priority of the company, ahead of everything else we do.
We have three layers of solutions and we are confident these are the right ones.
MS: (Going through the PDF slides linked above.) We understand that we do not have a business if we don’t have safety. Safety is the number one thing we think of in designing an airplane.
With 100 years of experience, we apply these lessons to each new airplane. We stand behind the integrity of each Boeing airplane.
The battery is only a backup in flight. It operates on the ground. The 787 is an electric jet, using two generators in combination producing one megawatt of electrical power. The APU also has two generators associated with it.
If in the unlikely event all generators and batteries fail, the Ram Air Turbine deploys. We don’t need the main battery in flight or the APU battery in flight for safety. The batteries operate the brakes on the ground and other ground-based functions.
The Li-Ion batteries technology was already mature technology for many applications, including aerospace (not commercial aerospace).
[Note: Bombardier reached a different conclusion, telling us that in 2009 when it had to make a decision on batteries that it was not satisfied with the Li-Ion technology, and therefore selected nickel-cadium.)
Li-Ion technology earned its way on to the 787.
We work very hard to design a system that will not fail Then we assume it will fail and provide redundancies or backups. We apply this design philosophy to every system on the airplane.
This is a core, fundamental design philosophy for the company. No single failure can put at risk the flight.
How do JAL and ANA square with this?
First no major structure was damaged. Minor damage in the surrounding area in JAL. No collateral damage in ANA. Widely reported there were fire, flames and an explosion. The factual report concluded there was two small flames on JAL and no fire on ANA.
The batteries vented as designed. When these vent, it looks like smoke. It is true it propagated from one cell to another but there was no fire.
Damage was limited to the function of the battery and the immediate area of the battery, but the aircraft was not at risk.
There has been significant attention to the term thermal runaway. You can have what some call thermal runaway from one cell to another. What we worry about is when there is so much energy it puts the airplane at risk. This was not the case with JAL or ANA.
The only thing that can lead to thermal runaway is over-charging. These were not over-charged. We know this from the investigation.
We are very confident we have never seen over-charging in the fleet.
When this first happened, Boeing responded immediately. We work with our partners and suppliers, but at the end of the day, it is the Boeing name on the side of the airplane.
I can tell you quite honestly we all worked as one team to understand what happened and to make sure it never happens again.
We brought in Boeing people responsible for the Space station and throughout the company. By the end of the first week we had 500 engineers working on this. By the end of the second and third week we drew on people outside Boeing: auto manufacturers, universities, elsewhere.
At this point, we have more than 200,000 hours of analysis, designs and tests to understand what has happened.
There are three layers of protection (shown on PDF page 11 of the slide show). We've also changed the battery charging unit and the voltage coming into the battery, reducing the amount of voltage going into the battery.
We've also changed the design of the battery to make it more robust. We've made other changes to theb attery charger and created a battery enclosure.
We wrapped the battery cells to make sure short circuits can't go from one cell to another. We added drain holes to be sure moisture gets out. We've given the battery better heat resistance.
We've made changes to the battery charger as well to better protect the battery from deep discharges.
The enclosure keeps us from having a fire in the first place. This is very, very important. It also contains the venting and directs venting overboard. Flight crew never gets a warning message telling them they need to divert. This also protects the electronics bay from heat or venting.
We've been testing this design features for six weeks. It can withstand more than three times the pressure we ever expect to see in a battery event. We have more than 60,000 hours in tests on this design.
We now have our Go-Forward Plan to prove design to the FAA and get the airplanes back into the air.
I often get asked if the airplane is still safe. I say absolutely. It is the safest airplane we have ever produced. I will gladly have my wife and family fly on this airplane. I have flown on it more than 100 times.
Our team took our original design assumptions about how a battery could fail and added new assumptions. We took original fault tree and added new ones, even if unlikely. We took 80 potential things that could lead to battery failure and worked to address all these.
We looked at all of these and came up with a comprehensive set of solutions. We looked at all the forensic evidence coming off both airplanes.
MS: The enclosure has very little air in it. When electrolytes occur, the valves open and sent venting overboard. There is not sufficient oxygen to materially contribute to combustion. As long as we keep oxygen out of enclosure, you can't have a fire.
Our certification plan has been approved by the FAA. We need one flight to prove elements. Laboratory testing is extensive. That began a week ago. It will take weeks.
RC: intent is to bring the fleet up first, then go to production. (But he didn't give a timeline.)
MS: We may never get to the root cause, but the process to address many possible things gives us greater confidence than before. I don't have questions now. We have made significant improvements across the board.
If there is an 81st or an 82nd issue, we know that at the airplane level it can land.
I can assure that the new battery fire eliminates all risk of fire. We've minimize potential ignition sources and elminated potential oxygen sources. If a cell fails, I am very very confident we will not have a fire.
Are we confident there will never, ever be another battery failure? The answer is that parts fail. But we are sure there won't be serious events. With other batteries in use, there have been thousands and thousands of battery events, but there will be safe flight.
RC: All of our conversations with customers are confidential (question is about compensation).
RC: Customers in general, across the board have been extremely supportive and patient with us. They are looking forward to returning to flight.
MS: The 787 has more "get-home" capability than any plane we have built. (The redundancies permit this.) the only way the battery can harm the airplane is thermal runaway. The thermal runaway discussed [to date] is limited to the battery but it did not threaten the airplane.