B788, London Heathrow UK, 2013
From SKYbrary Wiki
|On 12 July 2013 an unoccupied and unpowered Boeing 787-8, remotely parked at London Heathrow after an arrival earlier the same day caught fire. An investigation found that the source of the fire was an uncontained thermal runaway in the lithium-metal battery within an Emergency Locator Transmitter (ELT). Fifteen Safety Recommendations, all but one to the FAA, were made as a result of the Investigation.|
|Actual or Potential
|Airworthiness, Fire Smoke and Fumes, Loss of Control|
|Flight Conditions||On Ground - Normal Visibility|
|Aircraft||BOEING 787-8 Dreamliner|
|Type of Flight||Out of Service|
|Location - Airport|
|Airport||London Heathrow Airport|
|Tag(s)||Inadequate Airworthiness Procedures,|
Ineffective Regulatory Oversight
|Tag(s)||Airframe Structural Failure|
|System(s)||Equipment / Furnishings,|
|Contributor(s)||OEM Design fault,|
Component Fault in service
|Damage or injury||Yes|
|Causal Factor Group(s)|
On 12 July 2013, a Boeing 787-8 (ET-AOP) being operated by Ethiopian Airways and remotely parked at London Heathrow caught fire whilst unoccupied and unpowered. After initial difficulties, the airport RFFS eventually succeeded in extinguishing the fire after almost half an hour. Damage sustained to the aircraft was limited but included externally visible evidence of structural damage to the composite fuselage.
An independent investigation in accordance with ICAO Annex 13 principles and procedures was carried out by the UK AAIB. This action was taken on a discretionary basis in accordance with the nationally defined powers of the Chief Inspector of Air Accidents on the basis that although the fire occurred to an aircraft which was unoccupied, unpowered and parked out of service, the fire proved difficult to extinguish and it was suspected that it might be possible for an in-flight fire to occur by similar causation.
It was established that the aircraft had landed at Heathrow earlier the same day after an uneventful scheduled passenger flight from Addis Ababa and taxied to a Terminal 3 gate for passenger disembarkation, arriving there at approximately 0540. Later, it was towed to a remote Terminal 5 parking stand adjacent to one of the airport fire stations where the aircraft was subsequently secured after an engineer on the flight deck had visually confirmed that the ground electrical power, although remaining connected, was no longer available to the aircraft.
Nearly ten hours after the arrival at Terminal 3 for passenger disembarkation, signs of fire reported by ATC were investigated by fire fighters who initially discharged water and foam onto the aircraft and disconnected the cable leading to a non-running ground power cable. They had then entered the aircraft at door L2 equipped with breathing apparatus and had encountered thick smoke. “As they moved to the rear of the aircraft the smoke became denser so they opened further cabin doors to clear the smoke. At the rear of the passenger cabin they observed indications of fire above the ceiling panels. They attempted to tackle the fire with a handheld Halon extinguisher but this was not effective, so they forcibly moved a ceiling panel and tackled the fire with water from hoses” which was effective and led to the fire being extinguished.
Examination of the aircraft disclosed extensive heat damage to the upper part of the rear fuselage of the aircraft in the vicinity of the Honeywell 'RESCU 406AFN' Emergency Locator Transmitter (ELT). The absence of any other source of a system containing stored energy capable of initiating a fire in thus area supported by evidence gained from a forensic examination of the ELT, led to the conclusion that the fire had been initiated by an uncontrolled and rapid discharge of stored energy from the 5-cell lithium-metal battery which powered the ELT. ELT battery wires were found "crossed and trapped under the battery compartment cover-plate". investigators concluded that this had "probably created a short-circuit current path which could allow a rapid, uncontrolled discharge of the battery". It was concluded that this latent wiring fault had been in existence since the battery had last been accessed without detection. Both Boeing and OEM Honeywell subsequently concurred with the conclusion that this latent fault was "the most likely cause of the ELT battery fire, most probably in combination with the early depletion of a single cell".
It was noted that both cell-level and battery-level safety features had failed to prevent this single-cell failure so that when it propagated to adjacent cells, a cascading thermal runaway developed with rupture of multiple cells and the consequent release of smoke, fire and flammable electrolyte. It was concluded that the trapped battery wires had "compromised the environmental seal between the battery cover plate and the ELT" thus providing a way for flames and battery decomposition products to escape from the ELT. Once released from the ELT, the flames came into contact with the thermo-acoustic insulation blankets and composite aircraft structure in the immediate vicinity of the ELT. "This elevated the temperature in the fuselage crown to the point where the resin in the composite material began to decompose, providing further fuel for the fire" and "a slow-burning fire became established in the fuselage crown". It was concluded that the fire so-caused had then continued even after the initiating energy from the battery thermal runaway had been exhausted.
No evidence was found that a flashover fire had occurred - or was about to occur and neither was there any evidence that the rate of progression of the structural fire was increasing by the time it was interrupted. Thermal modelling was used to assess the likely effects of a similar fire occurring in-flight and indicated that a combination of an increased rate of convective cooling which would have been created by external airflow and the lower outside air temperatures which would have prevailed, would have substantially reduced the progression of a fire of the type that occurred.
The inaccessible location of the ELT and its battery and the limited awareness of this were considered during the Investigation. It was found that, at the time of the fire, "published ARFF information for the B787 did not indicate the location of ELT battery" and that Heathrow Airport RFFS "were not aware that there was a lithium-metal battery above the ceiling panels that could be the source of the fire". It was also noted that were an in-flight ELT battery fire to occur, its detection and the identification of its location would be "challenging" for any cabin crew, as would achieving success in the fighting of such a fire.
It was noted that the ELT involved had been manufactured under contract to Honeywell by Instrumar and that, at the time of the investigated fire, “there were approximately 3,650 identical batteries in service in RESCU 406AFN ELTs and the similar RESCU 406AF ELTs fitted to numerous aircraft types”. It was found that although there had been no reports of other in-service thermal events involving the same batteries or cells prior to the instance under investigation, five months beforehand, Honeywell had received one of these batteries back from an aircraft manufacturer because it had discharged and had discovered battery wires trapped under the cover plate in a similar way to those on the unit from which fire had originated. As a result, a quality review had been conducted which had led to “a modification of the Instrumar ELT assembly instructions”. Prior to the instance under investigation, “no inspections or modifications were recommended for ELTs already delivered and the findings were not communicated to customers and aircraft manufacturers.” Following the event, however, operators were instructed to either remove the ELT or inspect ELT wiring via an AAIB bulletin, Boeing Multi-operator Message, and FAA & Transport Canada Airworthiness Directives.
After the completion of extensive investigative work, it was concluded that:
- the battery design did not ensure that its rated maximum continuous discharge current could not be exceeded and the absence of cell segregation in the battery allowed the thermal runaway of one cell to propagate rapidly to the remaining cells.
- although the ELT battery had a valid TSO-C142 approval, "the guidance and requirements of RTCA DO-227, invoked by TSO-C142, were outdated and did not adequately take account of advances in lithium battery technology since the inception of DO‑227 in 1995".
- The system safety assessment conducted by Honeywell in support of the preparation for 787 type certification did not identify failure modes in any ELT battery installed in the aircraft which could contribute to a hazardous condition.
- It was the proximity of fuselage insulation blankets to the ELT, and the static ambient temperatures inside and outside the airplane, which led to sufficient heat being retained close to the aircraft skin for the fire to become self-sustaining.
- Modelling of structural loads based on the damage sustained on the ground during the investigated fire "determined that the aircraft’s ability to carry flight loads had been compromised". However, based on the thermal and fire modelling of an in-flight ELT fire, “the modelling suggested that these conditions would have prevented flame propagation beyond the localised ELT ignition zone, and slowed the propagation rate to a point where the composite fire might self-extinguish....It is therefore concluded that, in the event of localised ignition of the composite structure in flight, the rate of convective heat loss would reduce the extent and intensity of fire propagation, and may be sufficient to cause the fire to self‑extinguish.” Boeing’s structural loads modelling, based on the predicted damage from the thermal modelling of an in-flight ELT fire, “predicted that the fuselage would remain capable of carrying flight loads but might experience a depressurisation if the damage were extensive”.
- Because of the limitations of the NRS system safety assessment, the Type Certification process for the 787 failed to identify the ELT battery as a possible ignition source close to the aircraft skin, the composite flammability tests undertaken as part of this process "did not take this into account as a specific source of ignition".
The Investigation formally identified the following four Causal Factors in respect of the fire:
- A thermal runaway failure of the lithium manganese dioxide battery in the ELT resulted in the uncontrolled release of stored energy within the battery cells.
- The location and orientation of the ELT, and the compromised seal on the battery cover-plate, allowed the resulting hot gas, flames and battery decomposition products to impinge directly on the aircraft’s composite fuselage structure, providing sufficient thermal energy to initiate a fire in the rear fuselage crown.
- The resin in the composite material provided fuel for the fire, allowing a slow-burning fire to become established in the fuselage crown, which continued to propagate from the ELT location even after the energy from the battery thermal runaway was exhausted.
- The Navigation Radio System safety assessment conducted in support of the ELT certification did not identify any ELT battery failure modes which could represent a hazard to the aircraft and therefore these failure modes were not mitigated in the ELT design or the B787 ELT installation.
The Investigation also formally concluded that the following five Contributory Factors "most likely" led to the thermal runaway of the ELT battery:
- The trapped ELT battery wires created a short-circuit condition, providing a current path for an unplanned discharge of the ELT battery.
- The ELT battery may have exhibited an unbalanced discharge response, resulting in the early depletion of a single cell which experienced a voltage reversal, leading to a thermal runaway failure.
- The Positive Temperature Coefficient protective device in the battery did not provide the level of external short-circuit protection intended in the design.
- There was no evidence that the reset behaviour and the implications of the variable switching point of the PTC, had been fully taken into account during the design of the ELT battery.
- The absence of cell segregation features in the battery or ELT design meant the single-cell thermal runaway failure was able to propagate rapidly to the remaining cells.
Safety Action taken as a result of the fire and during the Investigation was noted to have included the following:
- OEM Honeywell issued an Alert Service Bulletin (ASB) for the inspection of ELT battery installations of the type which caught fire or were equivalent to it in design terms for pinched wires, damage to the wires or battery, deformation of the battery cover plate or damage to the battery cover gasket which may prevent it from forming a water-tight seal. They have also, from May 2014, reported having “modified the battery orientation within the ELT on all new production units” and have reviewed options to improve the robustness of short-circuit protection for the subject battery when installed in an ELT.
- Boeing issued a series of Multi Operator Messages (MOM)s in respect of all Boeing aircraft types fitted with ELTs of the type involved in the fire or equivalent in design terms to it to carry out one-off inspections to validate correct ELT installation. They have also updated the ARFF information for the B787 showing the location of the ELT as a component containing a lithium battery.
- The FAA and EASA issued ADs requiring the removal or inspection of installed ELTs of the type involved in the fire or equivalent in design terms to it.
- The FAA and Transport Canada issued ADs mandating the Honeywell ASB requiring ELT inspection.
- The FAA has decided to request that the RTCA revise and update their Document DO-227, ‘Minimum Operational Performance Standards for Lithium Batteries’ to cover non-rechargeable lithium metal batteries.
A total of fifteen Safety Recommendations were made as a result of the Investigation as follows:
On publication on 18 July 2013 of Special Bulletin S5/2013:
- that the Federal Aviation Administration initiate action for making inert the Honeywell International RESCU 406AFN fixed Emergency Locator Transmitter system in Boeing 787 aircraft until appropriate airworthiness actions can be completed. (2013-016)
- that the Federal Aviation Administration, in association with other regulatory authorities, conduct a safety review of installations of Lithium-powered Emergency Locator Transmitter systems in other aircraft types and, where appropriate, initiate airworthiness action. (2013-017)
Responses to both of these Recommendations were subsequently received and assessed by the AAIB as "Adequate - Closed".
On publication on 18 June 2014 of Special Bulletin S4/2014:
- that the Federal Aviation Administration develop enhanced certification requirements for the use of lithium-metal batteries in aviation equipment, to take account of current industry knowledge on the design, operational characteristics and failure modes of lithium-metal batteries. (2014-020)
- that the Federal Aviation Administration require that electrical performance and design-abuse certification tests for lithium-metal batteries are conducted with the battery installed in the parent equipment, to take account of battery thermal performance. (2014-021)
- that the Federal Aviation Administration work with industry to determine the best methods to force a lithium metal cell into thermal runaway and develop design-abuse testing that subjects a single cell within a lithium-metal battery to thermal runaway in order to demonstrate the worst possible effects during certification testing. (2014-022)
- that the Federal Aviation Administration require equipment manufacturers wishing to use lithium-metal batteries to demonstrate (using the design-abuse testing described in Safety Recommendation 2014-022) that the battery and equipment design mitigates all hazardous effects of propagation of a single-cell thermal runaway to other cells and the release of electrolyte, fire or explosive debris. (2014-023)
- that the Federal Aviation Administration review whether the Technical Standard Order (TSO) process is the most effective means for the certification of lithium-metal batteries installed in aircraft equipment, the actual performance of which can only be verified when demonstrated in the parent equipment and the aircraft installation. (2014-024)
As of June 2015, it was recorded that a Final Response from the FAA to all these Recommendations was still awaited.
On Publication of the Final Report:
- that the Federal Aviation Administration, in conjunction with the European Aviation Safety Agency and Transport Canada, conduct an assessment of the circuit protection offered by the existing Honeywell RESCU 406AF and 406AFN ELT battery, to determine whether the ELT/battery design incorporates an acceptable level of circuit protection to mitigate against external short-circuits and unbalanced discharge. (2015-014)
- that the Federal Aviation Administration, in conjunction with the European Aviation Safety Agency and Transport Canada, conduct a review of installed aircraft equipment on transport category aircraft powered by lithium-metal batteries, which have been approved under TSO-C142 /C142A or by equivalent means, to ensure that the design of such batteries incorporates an acceptable level of circuit protection to mitigate against known failure modes including, but not limited to, external short-circuits and unbalanced discharge. (2015-015)
- that the Federal Aviation Administration, in conjunction with the European Aviation Safety Agency and Transport Canada, require equipment manufacturers intending to use lithium-metal batteries in aircraft equipment to demonstrate that the battery design incorporates an acceptable level of circuit protection to mitigate against known failure modes including, but not limited to, external short-circuits and unbalanced discharge. (2015-016)
- that the Federal Aviation Administration, in conjunction with the European Aviation Safety Agency and Transport Canada require equipment manufacturers intending to use lithium-metal batteries in aircraft equipment, to quantify the heat produced by the battery over a range of discharge conditions and demonstrate that the battery and equipment design can adequately dissipate the heat produced. (2015-017)
- that the Federal Aviation Administration, in conjunction with the European Aviation Safety Agency and Transport Canada require the manufacturers of lithium-metal batteries and manufacturers of aircraft equipment powered by lithium-metal batteries, to conduct battery-level and equipment-level ‘failure mode and effects analyses’ to identify failure modes and their effects. (2015-018)
- that the Federal Aviation Administration, in conjunction with the European Aviation Safety Agency and Transport Canada, review all previously-approved aircraft equipment powered by lithium-metal batteries to determine whether they comply with the intent of the ‘Toxic Gas Venting Precautions’ described in TSO-C142/ TSO‑C142a Appendix 1. (2015-019)
- that the Federal Aviation Administration, in conjunction with the European Aviation Safety Agency and Transport Canada, review whether the ‘Toxic Gas Venting Precautions’ described in TSO-C142/ TSO-C142a Appendix 1 should be applied to portable aircraft equipment powered by lithium-metal batteries. (2015-020)
- that Boeing expedite the modelling of the B787 Environmental Control System, to examine the distribution of the ELT battery combustion products through the aircraft cabin, and demonstrate the results of this modelling to the Federal Aviation Administration. (2015-021)
The Final Report of the Investigation was published on 19 August 2015. This incorporates the findings contained in Special Bulletins S5/2013 and S4/2014 which were issued to report interim progress during the Investigation.