When a serious safety issue occurs, the normal engineering process tends to become quickly corrupted by management misdirection and stonewalling. Some prior examples of this are the explosion of the space shuttle Challenger in 1986, and Toyota’s more recent “unintended acceleration” fiasco. And now, as I recently discussed in the DACI Newsletter, we have fires on Boeing’s new Dreamliner aircraft (“Boeing’s Flaming Lithium Batteries: Was This A Risk Worth Taking?“).
In the Challenger case, although the root cause was immediately known, it took a long time for the NASA managers to admit what they knew. This is because, prior to launch, they had ignored the pleas of their engineers, who had been very concerned about the possibility that a large and critical o-ring seal might fail catastrophically due to unseasonably cold weather. This is indeed what happened, but that simple fact was deliberately buried under NASA’s confusing jargon and misdirecting blather, until physicist Richard Feynman cut through all the nonsense with a simple science demonstration. At a hearing on the disaster, he showed how the o-ring became too brittle to perform its function when exposed to a frigid temperature. (You can see him dipping the o-ring material into a glass of ice water here; start at 1:57.)
With regard to the recent Toyota unintended acceleration issue, Toyota likewise tried to downplay the problem, until forced to address it because of the growing number of fatal incidents. (Note 1)
Today, Boeing is faced with a crisis: the lithium batteries used in their new Dreamliner aircraft have caught on fire during some initial flights, forcing those flights to be aborted, and the fleet to be subsequently grounded while the problem is investigated.
1. I have no proof of this, but it is my firm belief that there are engineers at Boeing who strongly recommended that lithium batteries not be used on the Dreamliner.
2. Using the batteries was not wise, since lithium batteries have a history of catching on fire. If the battery properties were clearly understood, there would not be incidents of lithium batteries bursting into flame in cell phones and laptops, and of being the cause of the tragic crash of UPS Airlines Flight 6 in December 2010.
3. On January 30 (after the flaming battery incidents), Boeing CEO Jim McNerney said, “We feel good about the battery technology and its fit for the airplane. We have just got to get to the root cause of these incidents and we will take a look at the data as it evolves, but there is nothing that we have learned that causes us to question it at this stage.” At the time of his statement, lithium batteries were known to have a history of catching on fire, which is at odds with Mr. McNerney’s purported optimism.
4. The steps to reassure the flying public that the Dreamliner battery system is safe should include:
a. Generation of a detailed analysis, vetted by an independent third party review, of the battery properties that affect the tendency of the batteries to catch on fire; e.g. chemistry, mechanical tolerances, operating temperature, charge/discharge rate, etc. The lithium batteries used by Boeing would be redesigned accordingly.
b. Confirmation of the analysis by a demonstration showing that the redesigned batteries, with proper construction and application, cannot catch on fire when subjected to the worst case combination of variables (e.g. high ambient temperature, high charge/discharge rates, shock/vibration, aging, etc.)
c. Even after the battery system has been redesigned, the possibility will remain that a rare and unintended event (e.g. extreme shock, or higher than normal discharge) could ignite the batteries. Therefore there should be a demonstration that a containment design will successfully prevent a fire in the battery system from breaching the containment and threatening the flight. (Such second-stage protection is routine for critical hazards, and is especially necessary because of the extreme volatility of lithium.)
A much simpler option, as I earlier recommended, would be to discontinue the use of the hazardous and unstable lithium batteries, and replace them with stable batteries such as nickel metal-hydride. (Following this logic, Airbus has recently pulled lithium batteries from its new A350 design.)
The bottom line: We cannot expect zero risk, but we should expect that proper engineering be applied to known hazards. For example, gasoline and other fuels are highly flammable and very hazardous, but because of proper engineering we all feel comfortable with the gas tanks that are strapped under the cars we drive, and with the large containers of fuel that accompany us on the planes we fly. We do not expect gas tanks to spontaneously ignite, ever. The same reasonable expectation should apply to batteries.
Note 1. Although Toyota has maintained that a faulty floor mat was the root cause, I believe that there was an additional serious problem in the electrical system, based on the report of a driver who experienced uncontrolled acceleration until he turned off his cruise control (see “Toyota Unintended Acceleration: “No Electronics-Based Cause”: Not True & Misleading.” Related posts are listed under the Protect Yourself tab, Health & Safety, here). My guess is that the cruise control design was inadequate from a safety standpoint, and that the problem was quietly remedied by Toyota.