Air Accident Report: 2/2015

ET-AOP EW/C2013/07/01

Aircraft Accident Report No: 2/2015

This report was published on 19 August 2015 and is available in full
on the AAIB Website www.gov.uk

Report on the serious incident to

Boeing B787-8, ET-AOP
London Heathrow Airport
on 12 July 2013

Registered Owner and Operator: Ethiopian Airlines

Aircraft Type: Boeing B787-8

Nationality: Ethiopia

Registration: ET-AOP

Place of Accident: London Heathrow Airport

Date and Time: 12 July 2013 at 1534 hrs

Introduction

On the afternoon of Friday 12 July 2013 the Air Accidents Investigation Branch (AAIB) was
notified of a ground fire in a parked and unoccupied Boeing 787-8 on Stand 592 at London
Heathrow Airport. The circumstances surrounding the occurrence did not fall within the
definitions of an accident or serious incident as defined in ICAO Annex 13, however, the Chief
Inspector, in exercise of his powers under the Civil Aviation (Investigation of Air Accidents
and Incidents) Regulations 1996, initiated an investigation, treating the occurrence as a
serious incident and invoking the protocols of ICAO Annex 13 with regard to the participation
of other interested States. An investigation was commenced immediately and a team of
AAIB Inspectors was deployed.

The AAIB were assisted in the investigation by Accredited Representatives from the National
Transportation Safety Board (NTSB) (representing the State of Design and Manufacture),
the Civil Aviation Authority of Ethiopia (representing the State of Registry and the Operator)
and the Transportation Safety Board of Canada (representing a State of component
manufacture), with technical advisors from the Federal Aviation Administration (FAA), the
operator and the aircraft and component manufacturers.

Summary

The aircraft suffered extensive heat damage in the upper portion of the aircraft’s rear
fuselage, in an area coincident with the location of the Emergency Locator Transmitter
(ELT). The absence of any other aircraft systems in this area containing stored energy
capable of initiating a fire, together with evidence from forensic examination of the ELT, led
the investigation to conclude that the fire originated within the ELT.

© Crown copyright 2015 9

Air Accident Report: 2/2015 ET-AOP EW/C2013/07/01

The ground fire on ET-AOP was initiated by the uncontrolled release of stored energy from
the lithium-metal battery in the ELT. It was identified early in the investigation that ELT
battery wires, crossed and trapped under the battery compartment cover-plate, probably
created a short-circuit current path which could allow a rapid, uncontrolled discharge of the
battery. Root Cause testing performed by the aircraft and ELT manufacturers confirmed this
latent fault as the most likely cause of the ELT battery fire, most probably in combination
with the early depletion of a single cell.

Neither the cell-level nor battery-level safety features prevented this single-cell failure,
which propagated to adjacent cells, resulting in a cascading thermal runaway, rupture of the
cells and consequent release of smoke, fire and flammable electrolyte.

The trapped battery wires compromised the environmental seal between the battery coverplate
and the ELT, providing a path for flames and battery decomposition products to escape
from the ELT. The flames directly impinged on the surrounding thermo-acoustic insulation
blankets and on the composite aircraft structure in the immediate vicinity of the ELT. This
elevated the temperature in the fuselage crown to the point where the resin in the composite
material began to decompose, providing further fuel for the fire. As a result, a slow-burning
fire became established in the fuselage crown and this fire continued to propagate from the
ELT location, even after the energy from the battery thermal event was exhausted.

Fourteen Safety Recommendations have been made during the course of the investigation.
In addition the ELT manufacturer carried out several safety actions and is redesigning the
ELT unit taking into account the findings of this investigation. Boeing and the FAA have
also undertaken safety actions.

The following causal factors were identified in the ground fire:

a) A thermal runaway failure of the lithium manganese dioxide battery in the

ELT resulted in the uncontrolled release of stored energy within the battery
cells.

b) The location and orientation of the ELT, and the compromised seal on
the battery cover-plate, allowed the resulting hot gas, flames and battery
decomposition products to impinge directly on the aircraft’s composite
fuselage structure, providing sufficient thermal energy to initiate a fire in the
rear fuselage crown.

c) The resin in the composite material provided fuel for the fire, allowing a slow-
burning fire to become established in the fuselage crown, which continued
to propagate from the ELT location even after the energy from the battery
thermal runaway was exhausted.

d) The Navigation Radio System safety assessment conducted in support of

the ELT certification, did not identify any ELT battery failure modes which
could represent a hazard to the aircraft, and therefore these failure modes
were not mitigated in the ELT design or the B787 ELT installation.

© Crown copyright 2015 10

Air Accident Report: 2/2015 ET-AOP EW/C2013/07/01

The following factors most likely contributed to the thermal runaway of the ELT battery:

a) The trapped ELT battery wires created a short-circuit condition, providing a

current path for an unplanned discharge of the ELT battery.

b) The ELT battery may have exhibited an unbalanced discharge response,

resulting in the early depletion of a single cell which experienced a voltage
reversal, leading to a thermal runaway failure.

c) The Positive Temperature Coefficient (PTC) protective device in the battery

did not provide the level of external short-circuit protection intended in the
design.

d) There was no evidence that the reset behaviour, and the implications of the
variable switching point of the PTC, had been fully taken into account during
the design of the ELT battery.

e) The absence of cell segregation features in the battery or ELT design meant
the single-cell thermal runaway failure was able to propagate rapidly to the
remaining cells.

Findings

General

1) The fire in ET-AOP initiated while the aircraft was parked, unpowered and
unoccupied.

2) The extent of the damage to the ELT and the absence of other systems in
the vicinity of the ELT capable of providing an ignition source, identified the
ELT as the source of the fire.

ELT battery failure

3) The ELT fire resulted from the uncontrolled release of the stored energy
within the battery cells.

4) The battery failure most likely resulted from an external short-circuit, in

combination with the early depletion of a single cell, leading to thermal
runaway which propagated to adjacent cells.

5) The ELT battery failure did not result from external heating, mechanical
damage or environmental conditions within the aircraft.

6) The external short-circuit was created by the battery wires being crossed
and trapped under the ELT battery compartment coverplate, when the ELT
battery was last accessed.

7) The trapped wires remained undetected until the incident.

© Crown copyright 2015 11

Air Accident Report: 2/2015 ET-AOP EW/C2013/07/01

8) The PTC protective device did not provide the level of external short-circuit
protection intended in the battery design.

9) The trapped wires compromised the environmental seal of the battery cover-
plate, allowing the escape of hot gas, flames and battery decomposition
products.

10) The location and orientation of the ELT within the aircraft, and the
compromised seal on the battery cover-plate, allowed the hot gas, flames
and battery decomposition products to impinge directly on the composite
fuselage structure, providing sufficient thermal energy to initiate a slow-
burning fire in the rear fuselage crown.

Battery design

11) The range of temperatures across which the PTC is required to operate
means that in certain conditions, the switching point of the PTC exceeds the
rated maximum continuous discharge current for the battery.

12) The PTC reset behaviour was not well understood during the battery
design.

13) The absence of cell segregation features in the battery or ELT design
contributed to the severity of the incident, as the initial cell thermal runaway
was able to propagate rapidly to the remaining cells.

Battery and ELT certification

14) The ELT battery held a valid TSO-C142 approval.

15) The guidance and requirements of RTCA DO-227, invoked by TSO-C142,

were outdated and did not adequately take account of advances in lithium
battery technology since the inception of DO227 in 1995.

16) The NRS system safety assessment, conducted in support of the B787
certification campaign, did not identify any battery failure modes which
could represent a hazard to the aircraft, and as a result, the ELT battery
was not identified as a potential ignition source.

Structural fire

17) The location of the fuselage insulation blankets in the region of the ELT
allowed sufficient heat to be retained close to the skin to allow the fire to
become self-sustaining.

18) The fire progressed outward from the location of the ELT, in the space
between the insulation blankets and the fuselage skin, moving between
frame bays, through the stringer cut-outs in the shear ties.

© Crown copyright 2015 12

Air Accident Report: 2/2015 ET-AOP EW/C2013/07/01

19) There was no evidence that a flash-over fire occurred, or was about to
occur, nor that the rate of progression of the structural fire was increasing.

20) Structural loads modelling, based on the damage sustained during the
ground fire, determined that the aircraft’s ability to carry flight loads had
been compromised.

21) Thermal modelling conducted to assess the likely effects of a similar fire
occurring in-flight, predicted that the increased rate of convective cooling,
from the external airflow and lower air temperatures, would substantially
reduce the progression of such a fire.

22) Boeing’s structural loads modelling, based on the predicted damage from
the thermal modelling of an in-flight ELT fire, predicted that the fuselage
would remain capable of carrying flight loads but might experience a
depressurisation if the damage were extensive.

Fire detection and firefighting

23) The location of the ELT in the fuselage crown made it difficult for the
Heathrow Airport RFFS to locate the source of the fire.

24) At the time of the incident, the published ARFF information for the B787
did not indicate the location of ELT battery and the Heathrow Airport RFFS
were not aware that there was a lithium-metal battery above the ceiling
panels that could be the source of the fire.

25) In the event of an in-flight ELT battery fire, detecting the fire and locating
its source, would be challenging for cabin crew, due to the inaccessible
location of the ELT in the cabin.

26) In the event of an in-flight ELT battery fire, fighting the ELT fire and any
subsequent structural fire would be challenging for cabin crew, due to the
inaccessible location of the ELT in the cabin.

Toxicity

27) It has not been possible to determine accurately the composition and
quantity of the combustion products produced by the structural fire.

Aircraft certification aspects

28) At the time of the B787 certification the ELT battery was not identified
as a possible ignition source close to the aircraft skin, so the composite
flammability tests did not take this into account as a specific source of
ignition.

© Crown copyright 2015 13

 Air Accident Report: 2/2015 ET-AOP EW/C2013/07/01

Safety Recommendations

Safety Recommendation 2013-016 issued on 18 July 2013

Safety Recommendation 2013-016

It is recommended that the Federal Aviation Administration initiate action for

making inert the Honeywell International RESCU 406AFN fixed Emergency
Locator Transmitter system in Boeing 787 aircraft until appropriate airworthiness
actions can be completed.

In response to Safety Recommendation 2013-016, the FAA issued Airworthiness Directive

(AD) 2013-15-07 on 26 July 2013 requiring, within 10 days, either the removal, or inspection
and corrective action as necessary, of Honeywell RESCU 406AFN ELTs installed on B787-8
aircraft1.

Honeywell subsequently issued an Alert Service Bulletin (SB) instructing operators of all
aircraft types equipped with specified RESCU 406AF / AFN ELTs, to perform an inspection
of the ELT and its battery and to correct any anomalies. Embodiment of this SB was
mandated by Transport Canada AD CF-2013-25 issued 15 Aug 2013 and FAA AD 2013-18-
09 issued 18 September 2013.

This Safety Recommendation has been assessed by the AAIB as ‘Adequate – Closed’.

Safety Recommendation 2013-017 issued on 18 July 2013

Safety Recommendation 2013-017

It is recommended that the Federal Aviation Administration, in association with

other regulatory authorities, conduct a safety review of installations of Lithium-
powered Emergency Locator Transmitter systems in other aircraft types and,
where appropriate, initiate airworthiness action.

In April 2014 the FAA provided the following response to the recommendation:

‘The FAA is currently conducting a safety review of Lithiumpowered ELT

systems with other regulatory authorities to identify any unsafe conditions in
other aircraft types. The FAA expects to provide an update on the status of
the safety review by March 31 2015.’

This Safety Recommendation has been assessed by the AAIB as ‘Adequate – Closed’.

Footnote
1
On 26 July 2013 the European Aviation Safety Agency (EASA) issued AD 2013-0168, with the same intent.

© Crown copyright 2015 14

Air Accident Report: 2/2015 ET-AOP EW/C2013/07/01

Safety Recommendations 2014-020 to 2014-024

The following Safety Recommendations were issued on 18 June 2014.

Safety Recommendations 2014-020

It is recommended that the Federal Aviation Administration develop enhanced

certification requirements for the use of lithium-metal batteries in aviation
equipment, to take account of current industry knowledge on the design,
operational characteristics and failure modes of lithium-metal batteries.

Safety Recommendation 2014-021

It is recommended that the Federal Aviation Administration require that electrical

performance and design-abuse certification tests for lithium-metal batteries are
conducted with the battery installed in the parent equipment, to take account of
battery thermal performance.

Safety Recommendation 2014-022

It is recommended that the Federal Aviation Administration work with industry to

determine the best methods to force a lithium-metal cell into thermal runaway
and develop design-abuse testing that subjects a single cell within a lithium-
metal battery to thermal runaway in order to demonstrate the worst possible
effects during certification testing.

Safety Recommendation 2014-023

It is recommended that the Federal Aviation Administration require equipment

manufacturers wishing to use lithium-metal batteries to demonstrate (using the
design-abuse testing described in Safety Recommendation 2014-022) that the
battery and equipment design mitigates all hazardous effects of propagation of
a single-cell thermal runaway to other cells and the release of electrolyte, fire or
explosive debris.

Safety Recommendation 2014-024

It is recommended that the Federal Aviation Administration review whether the

Technical Standard Order (TSO) process is the most effective means for the
certification of lithium-metal batteries installed in aircraft equipment, the actual
performance of which can only be verified when demonstrated in the parent
equipment and the aircraft installation.

As of June 2015, final response from the FAA is awaited for Safety Recommendations
2014-020 to 024, however in a letter dated 31 October 2014, the FAA provided the following
interim comment in respect of Safety Recommendation 2014-022:

© Crown copyright 2015 15

Air Accident Report: 2/2015 ET-AOP EW/C2013/07/01

‘We plan to request that the Radio Technical Commission for Aeronautics
(RTCA) task Special Committee 225, ‘Rechargeable Lithium Batteries and
Battery Systems’, to revise and update RTCA Document DO-227, ‘Minimum
Operational Performance Standards for Lithium Batteries’, for non-rechargeable
lithium metal batteries. The revision would include methods to force lithium
metal cells into thermal runaway and develop design abuse testing that would
subject a single cell within a lithium metal battery to thermal runaway conditions.

The tasking would include exploring the mitigation of the worst possible effects
of this condition during certification testing. We plan to include evaluation criteria
to ascertain pass/fail criteria under these conditions.’

In the same correspondence, the FAA provided the following interim comment in respect of
Safety Recommendation 2014-024:

‘We believe a Technical Standard order (TSO) is effective in approving

the design and production of an article to meet the Minimum Performance
Standards. A TSO alone is not sufficient for certification approval. In order to
complete a certification of a lithium metal battery installed in aircraft equipment,
an airworthiness regulation approval is required. The airworthiness regulation
must be complied with during Type certification, and Supplemental Type
certification (including their respective amendments).

I believe the FAA has effectively addressed Safety Recommendation [2014‑024]

and we do not plan any further action.’

Safety Recommendations 2015-014 to 2015-021

The following additional Safety Recommendations are made in this report:

Safety Recommendation 2015-014

It is recommended that the Federal Aviation Administration, in conjunction

with the European Aviation Safety Agency and Transport Canada, conduct an
assessment of the circuit protection offered by the existing Honeywell RESCU
406AF and 406AFN ELT battery, to determine whether the ELT/battery design
incorporates an acceptable level of circuit protection to mitigate against external
short-circuits and unbalanced discharge.

Safety Recommendation 2015-015

It is recommended that the Federal Aviation Administration, in conjunction

with the European Aviation Safety Agency and Transport Canada, conduct a
review of installed aircraft equipment on transport category aircraft powered by
lithium‑metal batteries, which have been approved under TSO-C142 /C142A or
by equivalent means, to ensure that the design of such batteries incorporates
an acceptable level of circuit protection to mitigate against known failure modes
including, but not limited to, external short-circuits and unbalanced discharge.

© Crown copyright 2015 16

Air Accident Report: 2/2015 ET-AOP EW/C2013/07/01

Safety Recommendation 2015-016

It is recommended that the Federal Aviation Administration, in conjunction

with the European Aviation Safety Agency and Transport Canada, require
equipment manufacturers intending to use lithium-metal batteries in aircraft
equipment to demonstrate that the battery design incorporates an acceptable
level of circuit protection to mitigate against known failure modes including,
but not limited to, external short-circuits and unbalanced discharge.

Safety Recommendation 2015-017

It is recommended that the Federal Aviation Administration, in conjunction

with the European Aviation Safety Agency and Transport Canada, require
equipment manufacturers, intending to use lithium-metal batteries in aircraft
equipment, to quantify the heat produced by the battery over a range of
discharge conditions and demonstrate that the battery and equipment design
can adequately dissipate the heat produced.

Safety Recommendation 2015-018

It is recommended that the Federal Aviation Administration, in conjunction

with the European Aviation Safety Agency and Transport Canada, require the
manufacturers of lithium-metal batteries and manufacturers of aircraft equipment
powered by lithium-metal batteries, to conduct battery-level and equipment-level
‘failure mode and effects analyses’ to identify failure modes and their effects.

Safety Recommendation 2015-019

It is recommended that the Federal Aviation Administration, in conjunction

with the European Aviation Safety Agency and Transport Canada, review all
previously-approved aircraft equipment powered by lithium-metal batteries
to determine whether they comply with the intent of the ‘Toxic Gas Venting
Precautions’ described in TSO-C142/ TSOC142a Appendix 1.

Safety Recommendation 2015-020

It is recommended that the Federal Aviation Administration, in conjunction with

the European Aviation Safety Agency and Transport Canada, review whether
the ‘Toxic Gas Venting Precautions’ described in TSO-C142/ TSO‑C142a
Appendix 1 should be applied to portable aircraft equipment powered by lithium-
metal batteries.

Safety Recommendation 2015-021

It is recommended that the Boeing expedite the modelling of the B787

Environmental Control System, to examine the distribution of the ELT battery
combustion products through the aircraft cabin, and demonstrate the results
of this modelling to the Federal Aviation Administration.

© Crown copyright 2015 17