MOC VTOL.2440 Propulsion Batteries Thermal Runaway for VTOL category enhanced

1.      Introduction

Compliance with VTOL.2440, but also with VTOL.2330, VTOL.2400(d), VTOL.2425(a), VTOL.2430 (a)(1)(5), (b)(2), (c)(3), (d), VTOL.2510, and VTOL.2525 requires demonstrating that the hazards from a fire in the propulsion battery system will be appropriately prevented and mitigated.

The latest rechargeable lithium battery systems minimum operational performance standard RTCA DO-311A is a useful baseline for developing and testing propulsion battery systems. However, its “Thermal runaway containment test”, in section 2.4.5.5, was developed for lithium batteries that provide power to other aircraft systems or equipment. Therefore, the standard did not necessarily consider the particularities of battery systems intended to be used for electric and hybrid aircraft propulsion.

That containment test, when applied to propulsion battery systems, may lead to decrease their energy/weight ratio unduly and substantially, because of placing the focus on the containment of an unprecedented thermal runaway event instead of considering the implementation of different protection layers and the containment of a realistic worst-case thermal runaway event. While this test could be accepted as means of compliance, provided that other requisites are also met, it should not alleviate the implementation of appropriate protective layers/measures.

In this Means of Compliance, the Agency proposes an alternative test method for propulsion lithium batteries, to promote best industry practices, robust designs, and protection layers strategies for the entire propulsion battery system. Moreover, this alternative intends to foster innovation and development of new solutions for these battery system protection layers, instead of relying only on containment mitigations.

The main reasons for this alternative method to RTCA DO-311A section 2.4.5.5. “Thermal Runaway Containment Test” are:

(a)      The amount of additional external energy put into the battery system for this test is far in excess of energies used in service, which are limited by fail-safe protection layers and proper design, manufacturing, installation, operation, and maintenance.

(1)     Depending upon the chemistry, rechargeable lithium batteries can accept overcharging levels that lead to double the normal energy before reaching a point of chemical and thermal instability.

(2)     Heating the whole battery could compromise the validity of the test results due to mechanical and thermal effects created by pre-heating the whole battery structure, materials, and components to high temperatures.

(b)     In some cases, overcharging (if feasible) or overheating the whole battery can drive a near-simultaneous failure of all cells in the battery, which would not represent a realistic in-service field failure, but an extreme condition not encountered in service, even in batteries where reliable and tested protection layers were not implemented.

(c)      However, in other cases, this test may lead to undertest the propulsion battery containment, since:

(1)     Only one test article is tested.

(2)     There is no characterisation of thermal runaway behaviour at cell level for different parameters.

(3)     The variability in the characteristics of the cells, or the possibility of having defective cells within the battery system, may lead to trigger very few cells at temperatures lower than the thermal runaway initiation temperature of most of the cells.

(4)     As the power to the heating device may be removed once a thermal runaway has initiated, it could lead to have only those very few cells into thermal runaway.

(5)     If a thermal runaway occurs in at least two cells, the objective of the test is already met.

(6)     Degradation of the propulsion battery containment due to aging and environmental conditions during operation is not considered.

(d)     The design of electronics for critical aviation applications has been practiced for decades in the industry and demonstrated as highly effective for the safe operation of aircraft when consistent with appropriate industry practices. Therefore, as for any other system in the aircraft, if designed protections are shown to be reliable, the overall risk testing should consider these protections and their reliability.

Considering this, two acceptable approaches are proposed in this Means of Compliance to address the demonstration of an adequate mitigation of battery system thermal runaway conditions for VTOL capable aircraft in the category enhanced.

This Means of Compliance is neither addressing nor superseding other tests and considerations needed for the certification of propulsion battery systems (i.e., external short circuit, available system capacity and energy, protections testing, battery system crashworthiness tests, HV signage…).

This Means of Compliance is predicated on battery technologies and chemistries that are currently known and ready for use. Future technologies and chemistries might require additional or alternative considerations that should be first established at project level.

2.      Reference Documents

The following references have been used as a source of information or to provide accepted methods and practices:

(a)      RTCA DO-311A “Minimum Operational Performance Standards for Rechargeable Lithium Batteries and Battery Systems”, December 19, 2017.

(b)     RTCA DO-160G/EUROCAE ED-14G “Environmental Conditions in Airborne Systems and Equipment”.

(c)      ED-289 “Guidance on Determination of Accessible Energy in Battery Systems for EVTOL Applications”.

(d)     ED-312 “Guidance on Determining Failure Modes in Lithium-Ion Cells for eVTOL Applications”.

(e)     RTCA DO-227A “Minimum Operational Performance Standards for Non-Rechargeable Lithium Batteries”.

(f)      EASA AMC 20-115 “Airborne Software Development Assurance Using EUROCAE ED-12 and RTCA DO-178”.

(g)      EASA AMC 20-152 “Development Assurance for Airborne Electronic Hardware (AEH)”.

(h)     SAE ARP 4761 “Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment”.

(i)      EASA MOC VTOL.2330 “Fire Protection in designated fire zones”.

3.      Definitions

For the purpose of this MOC:

(a)      “Battery” is used as a generic term for an electrochemical energy storage system.

(b)     “Battery Cell” means a single electrochemical unit which exhibits a voltage across its two terminals and is used as the elementary unit of a battery module or battery system.

(c)      “Battery Module” means a group of electrically interconnected cells in series and/or parallel arrangement contained in a single enclosure that ensures that no fluids, flames, gasses, smoke, or fragments enter other modules, and that no thermal runaway is propagated from one module to the others during normal operation or failure conditions.

(d)     “Battery system” means an assembly of electrically interconnected battery modules (modularized battery) or cells in series and/or parallel, plus any protective, monitoring, alerting circuitry or hardware inside or outside of the battery, its packaging, and the designed venting provisions.

(e)     “Propulsion battery (system)” means a battery or battery system used primarily for electric and hybrid propulsion applications.

(f)      “Cell Thermal Runaway” is a rapid self-sustained heating of a battery cell driven by exothermic chemical reactions of the materials within the cell. Examples of objective evidence or unambiguous markers that demonstrate that a cell achieved thermal runaway are:

(1)     A sharp increase in temperature and pressure and a drop in cell voltage.

(2)     Measured peak temperature at least 80% of the typical peak temperature reached during thermal runaway for a given chemistry, per test or per literature reports.

(3)     Melted metallic components of cells (other than lithium).

(4)     Decomposed active materials / Oxidized metallic lithium.

(5)     Pyrolyzed (charred) cell contents.

(g)      “Battery Thermal Runaway” is defined as:

(1)     Thermal runaway of two cells that thermally affect at least one common adjacent third cell within the same battery or, for modularized batteries, within the same module.

(2)     Thermal runaway of any three or more cells within the same battery or, for modularized batteries, within the same module.

4.      Prerequisites

Propulsion battery systems should successfully demonstrate the implementation of multiple layers of mitigation mechanisms against unsafe conditions, such as thermal runaway, by providing the following:

(a)      Evidence that RTCA DO-311A section 2.1 “General Requirements” have been considered and successfully implemented and that section 3 “Installation Considerations” has been evaluated.

(b)     Evidence that critical functions including control and protective functions that include software have been designed and validated, as per the applicable revision of EASA AMC 20-115, to an appropriate design assurance level.

(c)      Evidence that critical functions, including control and protective functions with airborne electronic hardware, have been designed and validated as per the applicable revision of EASA AMC 20-152 to an appropriate design assurance level.

(d)     Evidence that a safety assessment of the propulsion battery system has been performed as per the applicable revision of SAE ARP 4761, addressing the hazards leading to, during, and following a thermal runaway. This safety assessment should include:

(1)     Functional Hazard Assessment (FHA).

(2)     System Safety Assessment (SSA) including a qualitative and quantitative analysis of the failure condition (e.g., Fault Tree Analysis (FTA/DD/MA)).

(i)      The System Safety Assessment (SSA)   should demonstrate that the safety objectives associated to identified failure conditions are fulfilled.In particular, any catastrophic failure condition should be extremely improbable and not result from a single failure of the propulsion battery system, including control and protective functions inside or outside of the battery.

(3)     Failure Modes and Effects Analysis (FMEA).

(4)     Common Cause Analysis (CMA, PRA and ZSA).

(e)     Evidence that propagation prevention mechanisms are successfully implemented when the propulsion battery system is tested in accordance with thermal runaway Non-Propagation Tests guidelines defined in section 7.(a).

5.      Approach #1: RTCA DO-311A Section 2.4.5.5. Battery Thermal Runaway Containment Test

Propulsion battery systems are considered to properly fulfil verification aspects of propulsion battery system thermal runaway conditions when:

(a)      Section 4. “Prerequisites” of this document is followed, and

(b)     They are tested in accordance with RTCA DO-311A section 2.4.5.5 Battery Thermal Runaway Containment Test in accordance with the requirements of RTCA DO-311A section 2.2.2.4, and

(c)      At least 20% of the cells in the battery system achieved thermal runaway in the test referenced in previous point 5.(b).

6.      Approach #2: Battery Thermal Runaway Containment for Continued Safe Flight and Landing (CSFL)

Propulsion battery systems are considered to properly fulfil verification aspects of propulsion battery system thermal runaway conditions when they are tested following:

(a)      Section 4. “Prerequisites” of this document, and

(b)     The Thermal Runaway Containment for CSFL time tests guidelines defined in section 7.(b).

7.      Test Guidelines

(a)      Thermal Runaway Non-Propagation Tests:

(1)     Latent manufacturing cell defects should be minimized, as stated in RTCA DO-311A section 2.1.7 “Mitigation of cells failures” and in ED-312 “Guidance on Determining Failure Modes in Lithium-Ion Cells for eVTOL Applications” section 2.1.3 “Manufacturing considerations”. However, even using the most reliable cells from the most robust suppliers, and applying proper incoming inspection and testing, these manufacturing defects cannot be totally prevented.  Consequently, having an internal short circuit at cell level in propulsion battery systems with thousands of cells becomes a likely scenario for a thermal runaway. For that reason, propagation to adjacent cells in the battery should be properly prevented to avoid a chain reaction.

(2)     The applicant should define, in coordination with the Agency, a set of tests at battery system level to demonstrate that the propagation prevention mechanisms have been successfully implemented.

(3)     The following guidelines should be considered for the development of Thermal Runaway Non-Propagation tests:

(i)      Aging and environmental conditions during operation may result in degradation of the electrochemical properties and protection layers for each battery. Therefore, to test the worst-cases conditions during the life of the propulsion battery system, these tests should also be performed with battery systems that have experienced loading that could lead to such degradation, i.e., vibrations, thermal and electrical cycling, either on separate test articles or sequentially on the same test articles. Battery systems used for RTCA DO-160/EUROCAE ED-14 environmental tests and aging cycle tests (iaw. EUROCAE ED-289) can be used as test samples when the applicant demonstrates a proper aging and degradation. Alternatively, battery systems that have gone through equivalent accelerated life tests can also be used.

(ii)     A full characterisation of thermal runaway behaviour at cell level should be performed by the applicant to identify, and include at battery system level tests, the potential worst-cases for cell-to-cell propagation at battery system level tests, combining the following parameters:

(A)     Thermal Runaway Trigger Method. When it is possible to overcharge the cell to force a thermal runaway, the behaviour of the cell between overcharging and overheating may lead to different outcomes.

(B)     State of Charge (SOC). In some cases, low SOC leads to more material remaining in the cell, hence increasing the probability of cell-to-cell propagation. However, higher SOC usually leads to a more explosive and energetic thermal runaway with more material expelled outside the cell.

(C)     Positions of the internal short-circuit relative to the cell venting mechanism. Different positions of the heater on the cell may lead to different outcomes in the way the cell is venting or even cause side or bottom ruptures of the cell case.

(D)     Heating rates. Different heating rates (i.e., between 5°C/min and 20°C/min) have demonstrated different behaviours of the thermal runaway at cell level, with flames or smoke development depending on the heating rate.

(iii)     For this characterization, at least the following parameters should be determined during the test:

(A)     Initial State of Charge.

(B)     Trigger time for the thermal runaway.

(C)     Maximum temperature.

(D)     Average total thermal energy release expressed in joules.

(E)      Initiation temperature.

(F)      Temperature rise rate.

(G)     Quantification of mass ejected.

(iv)     Due to the high variability in cell level tests, the applicant should define, in coordination with the Agency, an appropriate number of replicates to ensure a representative sample for the cell thermal runaway characterization in (ii). This sample should represent all expected cell variabilities that are anticipated in the life of the product, and should include cell replicates from different lots, manufactured on different dates and from different manufacturing sites (if applicable).

(v)     A thermal runaway in a cell in the propulsion battery system should be caused by the worst-case combinations of test conditions determined in the cell characterisation in (ii).

(vi)     The triggered cell should be selected as follows:

(A)     To maximize the potential for propagation to other cells, the spacing and heat transfer characteristics between cells should be assessed.

(B)     The battery system configuration, location of the cell within the battery system, and point 7.(a)(3)(ii) should be assessed to justify the selection of cells with the potential to become worst cases to be tested (e.g. centre, wide face, narrow face, corner, edge…).

(vii)    The tested battery system should be representative of the type design configuration, and should include the installation into the aircraft, designated venting provision, installation orientation, and any other design configuration or variable that could impact the test outcome.

(viii)   In case there are battery systems with different installations within the aircraft that could impact the test outcome, these different installations should be tested, or if properly justified, at least the worst-case installation.

(ix)     The tested battery system should not be modified to such an extent that the method of propagation is not anymore representative of that for a non-modified battery system. Wires for heating, voltage, and temperature monitoring should be passed through the housing and any openings should be sealed to retain internal pressure. Suitable sealant may be high temperature RTV silicone rubber or equivalent.

(x)     The cells should not be modified in any way that changes their composition or mechanical properties (including the external cell case).

(xi)     The temperature of the battery system before triggering the cell should be always stabilized at 55°C or the maximum operating high temperature, whichever is higher.

(xii)    The trigger mechanism may be deactivated once thermal runaway has been initiated in the triggered cell.

(xiii)   If a thermal runaway in the targeted cell does not occur, the objective of the test has not been met.

(xiv)   The following parameters should be recorded during the test:

(A)     The voltage of at least the cell being triggered.

(B)     The temperature of the cell being triggered.

(C)     The temperatures of the cells nearest to the cell being triggered.

(D)     The temperature of the external surface of the battery system and/or Explosive Fire Zone (including the venting provisions).

(E)      The volume at standard temperature and pressure, rate of release, and temperature of gasses that exit the battery system and/or Explosive Fire Zone.

(xv)    The battery system tested should be monitored for a minimum of 8 hours after the initial thermal runaway event, and during this time it should comply with the following:

(A)     No propagation to other cells.

(B)     No rupture of the battery system and/or Explosive Fire Zone.

(C)     No release of fragments outside the battery system and/or Explosive Fire Zone.

(D)     No escape of flames or emissions outside of the battery system and/or Explosive Fire Zone, except through the designed venting provisions.

(E)      No compromise of warning signals and safety functions (e.g., battery automatic disconnect function).

(b)     Thermal Runaway Containment for CSFL time Tests

(1)     Experience has demonstrated that, although very unlikely, more than a cell could go into thermal runaway due to an unforeseen failure mode. Therefore, the applicant should define in coordination with the Agency, a set of tests to demonstrate that realistic worst-cases of thermal runaway in more than a cell can be managed at propulsion battery system level and installation level (Battery Explosive Fire Zone) ensuring continued safe flight and landing in accordance with EASA MOC VTOL.2330 “Fire Protection in designated fire zones”.

(2)     The following guidelines should be considered for the development of Thermal Runaway Containment for CSFL time Tests:

(i)      Aging and environmental conditions during operation may result in degradation of the electrochemical properties and protection layers for each battery. Therefore, to test the worst-cases conditions during the life of the propulsion battery system, these tests should also be performed with battery systems that have experienced loading that could lead to such degradation, i.e., vibrations, thermal cycling and electrical cycling, either on separate test articles or sequentially on the same test articles. Battery systems used for RTCA DO-160/EUROCAE ED-14 environmental tests and aging cycle tests (iaw. EUROCAE ED-289) can be used as test samples when the applicant demonstrates a proper aging and degradation. Alternatively, battery systems that have gone through equivalent accelerated life tests can also be used.

(ii)     All the parameters identified in Section 7.(a)(3)(ii) (Guidelines for development of Thermal Runaway Non-Propagation Tests) for the full characterisation of thermal runaway behaviour at cell level should be also considered to determine the potential worst-cases for Thermal Runaway Containment tests.

(iii)     A thermal runaway in at least 20% of the cells in the propulsion battery system should be caused by the worst-cases of combinations of test conditions as determined in the previous point 7.(b)(2)(ii).

(iv)     Triggered cells should be selected as follows:

(A)     To maximize the potential for propagation to other cells, the spacing and heat transfer characteristics between cells should be assessed.

(B)     The battery system configuration, the location of the cells within the battery system, and point 7.(b)(2)(ii) should be assessed to justify the selection of cells that have potential to be worst cases to be tested (e.g. centre, wide face, narrow face, corner, edge, subgroup of triggered cells in different sides, …)

(v)      The tested battery system should be representative of the type design configuration, and should include the installation into the aircraft, designated venting provision, installation orientation, and any other design configuration or variable that could impact the test outcome.

(vi)     In case there are battery systems with different installations within the aircraft that could impact the test outcome, these different installations should be tested, or if properly justified, at least the worst-case installation.

(vii)    The tested battery system should not be modified to such an extent that the method of propagation is not anymore representative of that for a non-modified battery system. Wires for heating, voltage, and temperature monitoring should be passed through the housing and any openings should be sealed to retain internal pressure. Suitable sealant may be high temperature RTV silicone rubber or equivalent.

(viii)   The cells should not be modified in any way that changes their composition or mechanical properties (including the external cell case).

(ix)     The temperature of the battery before triggering the cells, should be always stabilized at 55°C or the maximum operating temperature, whichever is higher.

(x)      The trigger mechanism may be deactivated once a thermal runaway has been initiated in all the targeted cells.

(xi)     It should be proven for each test that:

(A)     The trigger method setup aims to trigger all targeted cells at the same time.

(B)     All triggered cells have entered into thermal runaway within a reasonable amount of time (approximately 1 minute).

(xii)    If a thermal runaway in the targeted cells does not occur, the objective of the test has not been met.

(xiii)   If propagation to all cells is prevented, the number and locations of cells that entered thermal runaway should be reported.

(xiv)   The following parameters should be recorded during the test:

(A)     The voltages of at least the cells being triggered.

(B)     The temperatures of the cells being triggered.

(C)     The temperatures of the cells nearest to the cells being triggered.

(D)     The temperature of the external surface of the battery system and/or Explosive Fire Zone (including the venting provisions).

(E)     The volume at standard temperature and pressure, rate of release, and temperature of gasses that exit the battery system and/or Explosive Fire Zone.

(xv)    During the test it should be demonstrated that the thermal runaway can be managed at propulsion battery system level and at installation level (Battery Explosive Fire Zone) ensuring continued safe flight and landing in accordance with EASA MOC VTOL.2330 Fire Protection in designated fire zones.