Boeing's 787 Dreamliner is flying again. It was grounded in January after vital lithium-ion batteries burnt out on two planes.
The US National Transportation Safety Board is still investigating the root cause of the failures and how hazardous batteries got approved. It is also probing whether the relationship between Boeing and its regulator, the Federal Aviation Administration, is too cosy.
Boeing is not waiting until it knows why the batteries failed. Nor has it switched to safer nickel-cadmium batteries. Instead Boeing simply refined the existing ones and put them in a fireproof box, designed to vent any explosive fumes. The FAA acquiesced to this strategy, even though it had been mooted before and rejected for passenger planes.
The 787 is a sleek, fuel-efficient twin-jet airliner that carries up to 290 passengers on long inter-continental routes. Boeing claims that the 787 Dreamliner is a ''game changer'' in air travel, but so far it has been a troubled experiment. It entered service in November 2011, three years late after a string of design defects and production glitches. Boeing has delivered 50 and another 800 are on order.
One innovation is that the 787's jet engines only give thrust and electrical power. Conventional engines also provide hydraulic pressure and compressed air to power aircraft systems. Virtually all 787 systems including flight controls, cabin pressurisation and even wheel brakes are electrically driven. This is lighter, more efficient and simplifies maintenance.
Two main batteries are integral parts of the electrical system. Each weighs 30 kilograms. They are vital for safe functioning of aircraft systems, especially if an engine fails.
Boeing chose lithium-ion batteries because they are light and charge quickly. They are used by the million in consumer electronics but can be dangerous. Lithium-ion batteries occasionally self-ignite, then their internal chemistry generates oxygen, making them difficult to extinguish. So carriage of lithium-ion batteries on passenger planes is strictly controlled.
The dangers of using lithium-ion batteries on the 787 were clearly understood. In 2007 the FAA carefully spelled out the dangers and set stringent ''Special Certification Conditions'' (SCC) including:
■ Safe cell temperatures and pressures must be maintained during any foreseeable charging or discharging condition, and during any failure of the charging or battery monitoring system.
■ Design of the lithium-ion batteries must preclude the occurrence of uncontrolled increases in temperature or pressure.
■ No corrosive fluids or gases that could escape from any lithium-ion battery may damage surrounding structure or any adjacent systems, equipment, or electrical wiring.
■ Each battery installation must have provisions to prevent any hazardous effect on structure or essential systems caused by the maximum amount of heat the battery can generate during a short-circuit.
On January 7 a lithium-ion battery self-ignited on a Japan Airlines 787 parked at Boston Airport. No one was hurt but it took firefighters more than an hour to remove and extinguish the battery. Nine days later, the crew of an All Nippon Airways 787 flying over Japan smelled smoke and landed quickly, with a battery burnt. Both failures contravened the SCCs and were potentially dire had they happened far from land.
Boeing shares 787 design and manufacture around the world; it is a masterpiece of delegation. The errant batteries are made in Japan by GS Yuasa and their chargers by Securaplane, a US subsidiary of Britain's venerable Meggitt PLC. The system is integrated into the plane by French company Thales.
Likewise, testing and certification is not actually done by the FAA; most is delegated to Boeing and its subcontractors. Traditionally, makers of a new airliner negotiate certification rules with their regulator and, after agreed testing and analysis, senior company engineers assess compliance. These engineers were called ''designated engineering representatives'', appointed in their particular field of expertise as representatives of the regulator. DERs were proud of their independent status and took their responsibilities to the regulator and the public seriously.
On the 787, delegation went further, as it was the first airliner approved under a new ''organisation designation authorisation'' arrangement. FAA gave Boeing greater autonomy to test, analyse and self-certify its designs. Somehow the batteries slipped undetected through the new procedures.
Last month the NTSB held public hearings into the use of lithium-ion batteries. For two days expert panels discussed their dangers, and accidents, in all modes of transport. Pointedly, Tesla Motors warned that lithium-ion batteries must always be designed assuming that cells can fail, and it is vital that one faulty cell does not trigger others to fail. The Tesla Roadster super-car is powered by batteries made in eleven modules each with 600 small lithium-ion cells. The cells are liquid cooled, individually monitored and isolated if temperature or pressure becomes excessive.
The 787 batteries have just eight large, closely packed cells and no active cooling. So if a 787 cell overheats it releases lots of energy and can cause cascading failures of other cells.
NTSB chairwoman Deborah Hersman summed up by repeating a panellist's warning that ''systems fail in ways that designers never imagined''. Another two days focused specifically on the 787 and on approval of its hazardous batteries. Sworn testimony from Boeing and subcontractors revealed:
■ The FAA mostly had an auditing role, with little involvement in the intricacies of 787 certification.
■ The FAA, Boeing, GS Yuasa, Securaplane and Thales had battery expertise but little that related to the type on the 787.
■ Components of the battery system were tested individually, not as an entity, and tests did not accurately replicate actual usage.
■ In 2007, while negotiating with the FAA on battery standards for the 787, Boeing was also co-chairing an industry group setting ''minimum operational performance standards'' for lithium-ion batteries on aircraft. The industry-wide standards were finalised five months after those for the 787 and were much more rigorous.
Throughout the hearings Hersman was unfailingly polite but seemed exasperated when a Boeing witness would not fully explain how the risks of overheating were so badly miscalculated. Boeing and the FAA admit 787 battery failures were ''unacceptable'' but insist the planes were not in jeopardy.
The NTSB's views on the rash assumptions that led to unacceptable batteries are unknown until it reports in many months.
Others responded immediately. Former NTSB member John Goglia asked in Forbes magazine why Boeing did not follow industry standards. Former NTSB chairman James Hall was even more forthright. He wrote in The New York Times: ''Essentially, aircraft makers persuaded the FAA to let them certify their own aircraft so they could save money … It is puzzling that [the FAA] was so quick on its feet to accommodate Boeing in recertifying the safety of the airplane, without even knowing the root cause of the battery problem.''
The NTSB just investigates safety breaches and recommends how to avoid recurrence. The FAA makes the rules. The FAA approved the modified battery system because, it says, software has been ''tuned'' to better control overcharging or over-discharging. Cells are better separated to reduce the risk of thermal runaway. Hazardous effects of battery failure are mitigated by enclosing it in a fireproof, stainless steel box with an external vent to discharge excessive heat, pressure or fumes.
Controversially, the FAA still lets the 787 fly up to 180 minutes from a safe landing place. Until 1985 planes with fewer than three engines were not allowed to fly more than 60 minutes from safety. As engines and aircraft system became more reliable, the rule was relaxed. At first planes needed to prove their reliability in service but now 180 minutes is allowed for new types, including the 787, based entirely on theoretical assessment of reliability.
Not all twin-engine planes are allowed to fly ''extended operations''. It is a privilege based on enhanced equipment, maintenance and record-keeping. Given that 787 service records tend to prove unreliability and that the theoretical assessment of battery system reliability was so wrong, it would seem prudent to await actual service data before allowing extended over-water flights.
Where does Australia stand in this saga? Qantas originally ordered 115 Dreamliners. As the program slipped, Qantas progressively cut its order while pocketing $300 million in penalty payments from Boeing. Just 14 remain on order.
Long ago the Australian authority (now CASA) sent small teams of technical specialists to independently ''validate'' foreign certifications. We probed critical features that might have been glossed over by the home authority and often found deficiencies. Usually they were minor but sometimes entire regulations had been overlooked. Now, when Boeing deems a plane okay, the FAA agrees and Australia rubber-stamps the approval. Personally, would I fly on a Boeing 787? Yes, but not too far from land. I trust the firebox to keep the plane safe long enough to land quickly. I would not want a long over-water flight - not yet.
Martin Aubury is a retired aeronautical engineer whose career in aircraft design and airworthiness spanned 50 years.