Review of EASA requirements for eVTOL propulsion batteries thermal runaway testing

Yesterday, almost exactly 3 years after the publication of the basis for certifying eVTOL aircraft in Europe (SC-VTOL),?EASA published the Means of Compliance “MOC VTOL.2440 Propulsion Batteries Thermal Runaway”, which describes how to demonstrate safe management of thermal runaway events in eVTOLs. This marks an important milestone in in electric aviation, bringing clarity to one of the issues with the highest criticality for electric aircraft that until now was lacking regulatory guidance due to its novelty. (Keep in mind though that this only applies to to EASA SC-VTOL type certifications, and the FAA may choose to follow another path.)

EASA sets some lofty goals with this MOC:

In this Means of Compliance, EASA proposes an alternative [testing] method for propulsion lithium batteries, to promote best industry practices, robust designs, and protection layers strategies for the entire propulsion battery system. Moreover, this alternative intends to foster innovation and development of new solutions for these battery system protection layers, instead of relying only on containment mitigations.

In the following, I will first provide an overview of the status regarding thermal runaway requirements and testing for aviation applications before this publication, to better showcase the differences of the new approach in the MOC. I will then describe the key provisions of this MOC and review them.

All views expressed here are my own, from the point of view of a battery development engineer, and do not represent my employer. Although I strive to be objective, this article may be biased in some areas, as I have had regular exchange on this topic with the technical experts at EASA since at least 2020. Stockholm syndrome, anyone?

Introduction & background

Big lithium batteries are widely used in automotive and industrial applications, but are a novel technology in aviation. On the other hand, the level of public expectations and regulatory requirements, especially around safety topics, is much higher in commercial aviation compared to other industries. While some standards and regulations regarding lithium battery safety testing for aviation applications already exist, they were written with small backup, starter and support batteries in mind, not for big propulsion batteries. The published MOC attempts to close the gap resulting from this, in regards to thermal runaway testing.

The MOC is the result of at least 2 years of hard work with internal and external stakeholders at EASA. I want to commend Carlos Javier Mu?oz Garcia and the entire EASA team in Panel 5 (Electrical Systems) and beyond for the end result, the diligence displayed during this process, and their unwavering focus on safety.

While safety is absolutely the highest priority, it is easy (and tempting) to go overboard with layer upon layer of safety margins in the quest for higher and higher assurance levels, despite diminishing returns. This is especially true for a novel and “dangerous” technology like big propulsion level lithium batteries. This approach “may lead to decrease [the batteries'] energy/weight ratio unduly and substantially”, as stated diplomatically in the MOC.

Finding the right balance between big enough safety margins to ensure the safety of passengers and aircraft in case of thermal runaway, and leaving enough breathing room for the developers to come up with solutions without massive weight penalties is not easy, as evidenced by the numerous, often tedious, sometimes heated discussions I had the pleasure to participate in during the last 2 years.

In my opinion EASA manages to find a relatively good balance in this MOC. While I consider some requirements as still erring too much on the side of caution and as very challenging to comply to, I understand the reasoning and don’t see them as absolute showstoppers for the certification of eVTOL propulsion batteries. I expect however that they will trigger significant redesign of existing battery system concepts.

The MOC is open for public consultation, with a deadline for the the submission of comments by the industry / public until August 12th, followed by answers/clarifications to the comments and possible adjustments of the MOC by EASA, before final publication. While the comments and answers will be quite interesting to follow, I don’t expect significant changes to the MOC at this point due to the extensive background work that went into it.

Status before the MOC

Before this MOC, the main Acceptable Means of Compliance (AMC) regarding lithium batteries in aviation was the RTCA standard DO-311A “Minimum Operational Performance Standards for Rechargeable Lithium Batteries and Battery Systems” from 2017. The A revision of the standard updated the previous DO-311 standard from 2008 as a response to the Boeing 787 Dreamliner lithium battery fires.

DO-311A covers many aspects of safety testing for lithium batteries and provides solid guidance on battery design. In fact, the MOC calls for compliance to big parts of DO-311A as a prerequisite:

Propulsion battery systems should follow the design, manufacturing, installation, operation, and maintenance guidance provided in RTCA DO-311A section 2.1 “General Requirements” and section 3 “Installation Considerations”

However, DO-311A was not written considering big propulsion batteries, as electric aviation was in its infancy at the time of its development. It was intended for smaller (e.g. backup, starter, etc.) batteries in aircraft. This is obvious in the thermal runaway test that is prescribed there:

DO-311A Battery Thermal Runaway Containment Test

Slightly simplified, the setup for the thermal runaway test is this:

• Charge all cells to 100% SOC
• Install heating devices inside the battery to heat all cells, or surround the battery with a heating device, or place the battery in a temperature chamber that will act as the heating device
• Heat up at 5-20°C/min until thermal runaway is initiated.

The success criteria are:

• No release of fragments outside of the battery system.
• No escape of flames outside of the battery system, except through the designed venting provisions.

This testing method practically causes all cells in the battery to go into thermal runaway more or less at the same time. This is a clear case of erring on the side of caution from the side of the regulators, forcing the battery manufacturers to design super robust battery housings that can withstand this worst-case release of energy.

This can be done with metal housings for small batteries like the 8s1p 75Ah battery of the 787 Dreamliner, adding just a couple of kg of weight to the >100 tons of the aircraft. However, with the much larger size of propulsion batteries, and correspondingly the much larger amount of released energy and gasses, containment in metal housings becomes impossible in practice due to the weight impact.

Splitting up the battery pack in smaller, physically separate packs, and making liberal use of materials like CFRP and specialized thermal insulators may be able to provide a workable solution, but the packaging overhead is still quite high.

In the introduction of the MOC, EASA lists additional, valid deficits of the test procedures defined in DO-311A as justification for the new testing requirements.

DO-311A Alternative Battery Thermal Runaway Containment Test

Interestingly, DO-311A also provides an alternative testing method in the appendix:

• Select at least 5 pairs of adjacent cells. The pairs should take into account spacing and heat transfer characteristics to maximize the potential for propagation to other cells.
• Perform a Battery System Safety Assessment (SSA) including Functional Hazard Assessment (FHA), Fault Tree Analysis (FTA), Failure Modes and Effects Analysis (FMEA), and a common mode analysis per SAE ARP 4761. The FTA shall demonstrate the battery system critical functions including control and protective functions have a probability of catastrophic failure of 1E-9 per flight hour or less.
• Charge all cells to 100% SOC
• Stabilize the battery at 55°C or the manufacturer's rated maximum operating high temperature, whichever is higher.
• Install heating devices inside the battery to heat the pair of cells at 5-10°C/min until thermal runaway is initiated in both cells.

The success criteria are the same as for the containment test.

In this test, two neighboring trigger cells are defined, with the reasoning that this provides an adequate safety margin against the expected single-cell failure condition. If the battery pack is designed to prevent fire propagation from the two trigger cells to any other cell, the severity of the thermal runaway event (and consequently the effort to safely manage it) can be reduced significantly during this test. So, the absence of a requirement to cause fire propagation during the test means that designing the battery pack in a way to prevent propagation is the easiest and most lightweight option to comply with this “thermal runaway containment” requirement. It is worth noting that for this test, a full safety assessment and the highest levels of design assurance for control and protective functions are required, in contrast to the "standard" thermal runaway containment test.

However, “Use of this alternate test method … shall be coordinated with the FAA or applicable regulatory agency”. While it is unclear whether the FAA or EASA has ever accepted this alternative testing method, it is clear by now that for eVTOL applications this alternative approach is not acceptable by either agency.

I expect that all eVTOL battery developers on a path to certification have been actively involved in discussions with EASA and/or FAA on defining what testing methods and success criteria would be applicable for their project, with the alternative “non-propagation” test as the low bar, and the standard “containment” test as the high bar. This is exactly the issue that the new MOC from EASA is addressing in a way that brings clarity and a level playing field for everyone seeking type certification under SC-VTOL.

Key provisions and review of the new MOC

The new MOC is based on a multi-level approach:

• Ensure proper design of the battery pack and corresponding control and protection functions
• Ensure no fire propagation inside the battery in case of a random cell failures
• Ensure safe management of propagating fire in the battery in case of multiple cell failures

Both fire-related safety levels are mandatory – demonstrating safe management of propagating fire (“containment”) does not alleviate from having to show non-propagation properties. This is a major difference to DO-311A, where these two aspects were an OR, not an AND.

The requirement for non-propagation is the main key for increasing the safety of battery systems in my opinion, as the thermal runaway situations will most probably occur from internal / manufacturing defects of individual cells (assuming no significant design and manufacturing errors, which should be covered by the usual aviation safety and quality assurance processes).

Safe management / containment of propagating fire is also a reasonable requirement for a propulsion level battery system. The key here, and the point that causes the most controversy, is the definition of the initial condition for the propagation management / containment test. From the one extreme of “since non-propagation for 2 cells has been demonstrated, the starting condition for containment should be 3 cells” to the other extreme of “all cells in the battery should be triggered simultaneously (i.e. DO-311A)”, there is a wide gap, with huge differences in the approach and effort needed to achieve compliance. Increasing the initial number of cells used to trigger a propagating fire has two key consequences:

• It increases the initially released energy and amounts of ejected gasses / materials, which means the battery housing and venting provisions need to be further reinforced up to safely manage them.
• It increases the speed at which subsequent cells go into thermal runaway, as more neighboring cells are affected by a higher thermal load.

So, assuming the safe management of propagating fire is given as the target, the big question that the published MOC attempts to answer is what would be a reasonable starting condition for such a test.

In the following, we will take a more detailed look into the two requested tests:

Thermal Runaway Non-Propagation Tests

Starting with the non-propagation test in the MOC, it is superficially similar to the "alternative test" in the appendix of DO-311A:

• Stabilize the battery at 55°C or the manufacturer's rated maximum operating high temperature, whichever is higher.
• Install heating devices inside the battery to heat a pair of cells until thermal runaway is initiated in both cells.

However, there are significant additional requirements that increase the confidence in the non-propagation characteristics of the design:

• The cell thermal runaway behavior must be analyzed to determine the worst-case trigger conditions that provoke e.g. maximum released energy through venting products or cell body, or explosive cell behavior. Aspects that need to be analyzed regarding their effect on the cell thermal runaway behavior are:

o Overcharging vs. overheating

o Low vs. high SOC

o Heating element position on the cell and area

o Heating rate (5-20 °C/min)

• The effect of electrical, thermal and mechanical aging must also be taken into consideration: The test must also be performed also with batteries that have experienced corresponding aging cycles, if this leads to worse conditions.
• The goal is to trigger both cells simultaneously, but at least within 30s from each other

Success criteria:

• No propagation to other cells for 8h after the thermal runaway event
• No rupture of the battery system and no release of fragments, flames or emissions outside the battery system except through the designed venting provisions

As can be seen, the test in the MOC significantly expands upon the test in DO-311A, mainly in identifying the trigger conditions that cause the worst-case thermal runaway behavior of the cells. While this adds a lot of testing effort, it also significantly increases the confidence that there really will be no fire propagation in case of a single cell thermal event.

Personally, I agree with the rationale and the expanded scope of this test. Prevention of fire propagation should be the main fire safety strategy for an eVTOL battery pack. I would even propose to go a bit further and extend this test to cover more cases. The requirement that the trigger cells must be “adjacent cells” disregards the possibility of two non-adjacent cells thermally impacting a common third cell and causing it to go into thermal runaway. This is illustrated in the two figures below:

On the left side is an example of the trigger cell positions according to the MOC, with crosses on the cells that are most probable to be affected. On the right side are alternative trigger cell positions, which might represent a worse case in regards to fire propagation, but are not considered in the MOC. Any two cells along the “circle of danger” around a victim cell igniting simultaneously could bring it to thermal runaway. This trigger cell selection principle can be applied both to pouch/prismatic cells (top row) and cylindrical cells (bottom row) and should be required in the MOC in my opinion.

On the other hand, I disagree with the requirement to always start the test at 55°C or the manufacturer's rated maximum operating high temperature. Yes, this adds a safety margin compared to testing at the worst-case {Temperature, SOC} conditions that will be encountered in each individual eVTOL operating profile, but we already have the safety margin of triggering two cells simultaneously, and another safety margin afforded by the subsequent "safe management of propagating fire" test. This is a case of - in my opinion - unneccesarily adding safety margin on top of safety margin.

Battery Thermal Runaway Containment for Continued Safe Flight and Landing (CSFL) time Tests

For the safe management of propagating fire (“containment”), there are two options provided in the MOC:

• Use the DO-311A “Battery Thermal Runaway Containment” Test
• Use the new “Battery Thermal Runaway Containment for Continued Safe Flight and Landing (CSFL) time” Test

So, the “overkill” DO-311A test with simultaneous triggering of all cells in the pack is still accepted. However, taking into consideration the much larger propulsion level batteries, and the now required non-propagation test, the containment test starting conditions can be relaxed a bit for the new proposed test:

• Select again the worst-case conditions (aging, SOC, heating characteristics), like in the non-propagation test
• Trigger 20% of the cells in the battery pack (with possibility to reduce to 15% with EASA approval)

o Select cell positions so as to maximize propagation potential

o Target to trigger all cells at the same time, but at least within 60s

Success criteria: It should be demonstrated that the thermal runaway can be safely managed at propulsion battery system level or installation level (Battery Explosive Fire Zone) for a time that covers at least the detection of the fire and an ensuing Continued Safe Flight and Landing (CSFL).

One significant difference to DO-311A is that performance-based success criteria are defined. There are no concrete requirements regarding the release of fragments or flames outside of the battery system. The only requirement is that Continued Safe Flight and Landing must be ensured. If the eVTOL is intended to be used only outside of cities and without transporting passengers commercially (SC-VTOL category basic), the battery system and aircraft must only withstand the propagating fire during a controlled emergency descend and landing (i.e. a couple dozen seconds). If the eVTOL is intended to be used over cities or for commercial passenger transport (SC-VTOL category “enhanced”), the battery system and aircraft must withstand the propagating fire for the duration needed to reach a designated landing site, land there and evacuate the passengers. If the operational concept can ensure that a designated alternate landing site is always less than x min away, x min + evacuation this is the duration needed to safely manage the fire. After the eVTOL has landed and the passengers have evacuated, it may in principle go up in flames.

A key part in enabling this performance-based requirement is the previously defined “Explosive Fire Zone / Explosive fire capability” (MOC VTOL.2330 “Fire Protection in designated fire zones” in MOC-2 SC-VTOL published by EASA), where requirements for protection of structures and components that are necessary for CSFL and located adjacent to battery installation locations are defined.

Worth noting is also that if no fire propagation is initiated as a result of triggering 20% of the cells, the test is considered passed, a long as CSFL can be ensured. The absence of a requirement to cause propagation during this test provides an incentive for battery developers to design the battery pack in a way that will prevent fire propagation, even with more than 2 cells in thermal runaway. Whether this is feasible remains to be seen, but it is an option.

Personally, I feel that triggering 20% of cells in a battery pack is a very high bar and does not take into consideration the size of the cells or battery packs, which have a significant impact on the amount of energy released during this event.

• Assuming a problem with the propagation protection, this will cause only 2-3 cells at most to go into thermal runaway at the same time, at least initially.
• Assuming a common external cause (physical or electrical) that triggers multiple cells into thermal runaway, the number of affected cells will heavily depend on the electrical and physical layout of the cells and the type and position of the external hazard.

It is understandable that as these factors are design-specific, the definition of a percentage of cells as the starting condition is a compromise to have common requirements for all applicants. Whether this is a good compromise remains to be seen.

The concerns about triggering 20% of the cells are alleviated a bit by the provision of a possibility to modularize the battery. Of course, in eVTOL applications, the usage of multiple battery packs is necessary anyway in order to achieve the redundancy needed to enable CSFL (“no single failure catastrophic”). In addition to that, the MOC provides the possibility to further split up the battery packs in even smaller modules and perform these tests on module level, i.e. trigger 20% of the cells of a module, instead of 20% of the cells of the pack. Prerequisite for this is that the battery is “properly modularized”, i.e. “cells in series and/or parallel arrangement contained in a single enclosure that ensures that no fluids, flames, gasses, smoke, or fragments enter other modules during normal operation or failure conditions”. This modularization option provides a path to reduce the absolute number of trigger cells, although it comes with a weight penalty due to the increased module housing weight. With this provision, EASA seems to be pushing the industry to split to the batteries in multiple small self-contained packs, accepting the increased risks due to the added external interconnections between them.

As a last comment on this test, in my opinion the possibility to reduce the amount of trigger cells to 15% “based on the design, protection layers, installation and testing robustness proposed by the applicant” is not appropriate. If all these aspects are so well-executed as to warrant a reduction of the inital load, the battery system should have no trouble at all passing the test with 20% of the cells in thermal runaway. So, why not show that the system can withstand the same conditions as a battery system with weaker design, protection layers, installation and testing robustness.

Definition of catastrophic condition

Another point I expect to be controversial is a note in the MOC:

Demonstrating compliance with one of the test approaches defined in this MOC does not alleviate the classification of the failure condition “battery thermal runaway” (i.e. the thermal runaway of two or more cells within a battery) considered catastrophic.

This means that the case of any two random cells in the battery going into thermal runaway, at any point during the flight, is considered catastrophic. There are several issues with this:

• The classification of a failure condition should be the result of a safety analysis according to applicable standards (ARP4761 “Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment”), not predetermined and without justification.
• Since the Catastrophic failure condition has extremely low occurence rate requirements for eVTOLs, this note places direct and very low failure rate requirement on the cells that could be difficult if not impossible to demonstrate.

• There is no consideration for the physical position of the two cells in relation to each other and their possible separation that may allow the two events to be considered indepently from each other. If a single cell in thermal runaway is not considered catastrophic, it is not clear why two cells in TR on e.g. opposite sides of the battery pack should cause a catastrophic event.
• Same for the temporal separation of the two TR events, if the heat from the initial event has already dissipated, it is not clear why a second event should lead to a catastrophic failure.

To be clear, I am not advocating to take full credit of the tests in the MOC and claim that only more than 20% of the cells going simultaneously into thermal runaway would be a catastrophic condition. Due to the variability and unpredictability of cell behavior during thermal runaway, it is reasonable to assume that at some point, some cases that would fall within the testing envelope of the MOC will nevertheless be catastrophic. In addition, a high level of development and design assurance rigor (triggerd by the presence of catastrophic events) is necessary in order to minimize situations where thermal runaway could have been prevented with more reliable monitoring and control functions.

I think that for the purposes of defining cell failure rate requirements and control/protective function design assurance levels, it would be reasonable to consider as catastrophic all situations where two cells in thermal runaway directly (physically) and overlappingly (timing wise) thermally affect at least one common third cell (see non-propagation test). This provides enough safety margin between what is considered catastrophic and what has been demonstrated with the tests to be non-catastrophic, ensures high development assurance levels, but reduces cell failure rate requirement to more reasonable levels.

Despite the concerns and criticisms expressed in this article, in my opinion EASA is taking a generally thoughtful approach, addressing the deficiencies of DO-311A, adding reasonable protection layers and pushing for increased reliability of the protection features. From a technical point of view, the main concern remains the weight impact of the new requirements. They will at the very least “foster innovation and development of new solutions”...

Let the testing begin!