Introduction

As rechargeable Li-ion batteries have reached technological maturity, with an increase in performance metrics (Wh/kg, Wh/L, W/kg, and W/L) and a drop in price ($/kWh), they have enabled the electrification of multiple modes of transportation, recently including electric aircraft.1,2,3 The specific energy of commercially available Li-ion cells has increased from about 100 Wh/kg in 1990 when they were first commercialized to greater than 250 Wh/kg by 2020,4 with prototype cells currently achieving between 300 and 350 Wh/kg. Charge and discharge rates of these batteries have also improved. While battery performance metrics and adoption have increased, incidence of safety related issues has also increased.5 The majority of these reported incidents are related to the failure mode of thermal runaway, either with6 or without internal shorts,7 where an exothermic reaction and ignition in one cell cascades into similar exothermic reactions in neighboring cells and eventually a critical portion of the battery pack itself.8,9

Along with an increase in the adoption of EVs, the number of reported EV battery fires has also increased.10 Battery fires have occurred in a variety of scenarios, including in parked, driving and charging vehicles. Most of these incidents have been due to one or more faulty cells reaching operating conditions beyond the safety limits, leading to thermal runaway. These safety issues should be examined in further detail in the context of electric aviation, given the greater risks and unique failure modes present in an airborne environment. One of the most publicized battery-related fire events in aviation was the grounding of the Boeing 787 Dreamliner fleet after a controlled fire event in 2013.11 The Li-ion batteries involved in this incident were part of the auxiliary power unit and not used for propulsion. In 2018, a prototype electric aircraft, the Magnus eFusion designed by Siemens and EcoFly, caught fire during low-altitude maneuvers and crashed during testing.12 Initially, the batteries used for propulsion were suspected of causing the fire, however later investigations concluded that the crash was due to pilot error.13 Failure modes other than thermal runaway could arise due to accelerated degradation, change in discharge performance, faulty state of charge (energy) or state of health monitoring systems. In terrestrial EV’s, the safety risks from these modes are not high, but the risk is critical for aircraft.14 Currently, aviation regulatory bodies rely on a standard published by RTCA Inc. (formerly known as Radio Technical Commission for Aeronautics) in 2017, called DO-311A to specify the mandatory testing and compliance requirements for rechargeable batteries used in aircraft. One of the key characteristics that DO-311A attempts to determine is the “airworthiness” of a battery, which implies the “compliance of a battery with all the requirements for safe operation in an airborne environment.”15

In this article, we begin with a discussion on the possibilities around electric aviation and how important improvements in batteries are enabling feasible electric aircraft designs. We look at how the improvements in performance also bring with them unique thermal and safety risks. Battery safety issues in the context of electric aircraft can be categorized into (1) thermal, which relates to the risk of excess heat, fire, and explosions; and (2) functional, which relates to loss of safety critical power due to material degradation or architectural or control-related malfunctions of battery systems. The operating conditions in an airborne environment are different from terrestrial conditions, given the changes in pressure, temperature and unique power demands of aviation. We evaluate these risks with the help of existing literature on thermal and safety modeling of Li-ion batteries in the context of an airborne environment, along with mitigation strategies for the same. Finally, we conduct an evaluation of the regulatory literature on rechargeable Li-ion batteries used in aircraft to identify key areas where current and upcoming work from the battery research community needs to be incorporated in the said aviation regulatory literature.

Advent of electric aviation

Electric aircraft designs and use-cases

Most electric aircraft efforts can be categorized and subdivided by size, range, configuration, and target market. The largest passenger aircraft, generally referred to as transport aircraft, can be broken into three categories: twin aisle or wide-body aircraft (typical range > 2000 mi), single aisle or narrow-body aircraft (typical range around 1000 mi), and regional aircraft (typical range < 1000 mi). While the vast majority of flights take place on regional and narrow body aircraft, most of the carbon emissions from aircraft come from the wide-body category.16 For transport aircraft, specific energy of the battery is a considerable barrier, leading to consideration of hybrid combustion-electric systems.

Smaller aircraft, though they consume less energy and emit less carbon, are more conducive to electrification,2,16 some aircraft in this category have already been electrified.17,18 One of the most prolific markets for small aircraft is urban air mobility (UAM), which aims to carry two to five passengers or conduct last mile parcel delivery over short distances (< 100 miles).3,19 UAM development is primarily focused on various diverse designs for small battery-powered electric vertical takeoff and landing aircraft (eVTOL), with some interest in short takeoff and landing aircraft (eSTOL).20,21

Challenges and solutions

The largest barrier to widespread adoption of electric aircraft is specific energy.16,22 Harbor Air, a seaplane airline in British Columbia, has begun electrifying its fleet,23 representing the first electric commercial aircraft and others are in production.17 Specific energy of requirements of greater than 800 Wh/kg for narrow-body aircraft are beyond the performance limits of near-term battery technologies.2

The opportunities presented by electric powertrains are the overall efficiency gains through elimination of thermodynamic cycles of jet engines and improved efficiency due to changes in propulsion system architecture, there is a vast body of literature in the aviation community that discusses these aspects.19,24 Another category within electrification of aircraft is hybridization, which could relax the specific energy required of batteries. For the purpose of this article, the safety challenges presented by hybrid aircraft25 are considered to be similar to fully electric aircraft, which might feature much larger battery packs than hybrid aircraft.

Development arc of electric propulsion batteries

Materials

In the 1990s, when Sony commercialized the Li-ion battery, the cathode material used was lithium cobalt oxide (LCO) and the anode was graphite,26 both of which were immersed in a carbonate-based electrolyte. The organic carbonate-based electrolyte is intrinsically flammable27 with very low flash points.28 The oxygen released from the predominantly oxide-based cathodes provides the required conditions for combustion.5 The performance metrics of the Li-ion cells in the 1990s were not sufficient for applications such as electric vehicles. In the next two decades, several other cathode materials such as lithium nickel cobalt manganese oxide (NCM), lithium nickel cobalt aluminum oxide (NCA), and lithium iron phosphate (LFP) have been commercialized29 along with numerous improvements to the graphitic anode leading to approximately a threefold increase in the specific energy of the Li-ion cells.4 From the perspective of safety, the available chemical energy for exothermic reactions has increased by an equivalent amount.6 At the same time, the class of materials used for the anode, cathode, and electrolyte have been largely unchanged.29 Barkholtz et al.30 conducted accelerated rate calorimetry (ARC) experiments to compare the energetics of LCO, LFP, and NCA cathodes by tracking the heating rate of each cathode. They found that NCA has a heating rate that is four orders of magnitude greater than LFP.30 LFP cells are considered to be the safest among the different cathode materials.31 At the same time it should be noted that most NCA cells have up to twice the specific energy of LFP cells.3 This implies a possible trend of an increase in the risk of thermal events that has largely followed the development arc of Li-ion batteries to date. As noted previously, specific energy and specific power are crucial for the feasibility of electric aircraft, meaning prototype electric aircraft will utilize batteries with the highest performance metrics and implicitly, these batteries may have a greater risk of thermal events.

Among the different upcoming battery materials that can achieve the required specific energy for aircraft, Li-metal anodes show great promise with the possibility of achieving cell-level specific energies of more than 400 Wh/kg.32 One of the major risks of Li-metal anodes is the possibility of dendrite growth during charging which could lead to internal short circuits. These internal shorts could firstly cause a loss of safety critical power (i.e., posing a functional safety risk) and eventually overheating and potentially a fire hazard leading to thermal runaway of cell and then eventually, a pack (i.e., a thermal safety risk). Designing safely around the dendrite issue is a critical design consideration for lithium-metal batteries. One of the approaches to preventing dendrite growth from Li-metal anodes is to use solid-state electrolytes.33,34 Solid-state electrolytes also represent a change in the class of materials used for electrolytes, thereby changing the thermal and functional risks involved. The thermal stability of solid electrolytes is generally much higher than liquid electrolytes, although, it does not completely eliminate risk of thermal runaway.35 While batteries with solid electrolytes show promise of delivering high specific energy through the use of Li-metal anodes and higher safety due to solid electrolytes, simultaneously meeting the power, rate capability and other required metrics are beyond the reach of current solid electrolyte-based lithium-metal batteries for use in electric aircraft.3 This represents an important tradeoff between safety and performance that the aircraft designers will face in the near future.

Battery design

Cell design has a strong influence on the thermal behavior, heating, and heat transfer in a Li-ion battery. Generally, most Li-ion batteries are designed as cylindrical, prismatic, or pouch cells. Most electric vehicles currently use either cylindrical cells or prismatic cells.29 The materials used for the cell casing, terminals and other packing artifacts are different between the different cell designs.36 The casing materials control the heat transfer between the cell and the surrounding environment, and hence plays a crucial role in events of overheating.37 Cell overheating is one of the initial conditions required for thermal runaway.27 Cell design also dictates the manner in which venting of gaseous products occurs during exothermic or parasitic reactions.38 The mechanical strength of the casing materials is strongly correlated to the likelihood of shorts forming due to external stress or point loads. Electric X-planes like the NASA Maxwell X-57 have used commercial-off-the-shelf (COTS) cylindrical cells due to their superior safety characteristics such as stipulated venting mechanisms and greater strength of the casing materials.39

Battery pack design also plays a significant role in both thermal and functional safety and risk profile of an electric propulsion system. Pack designs control the risk of failure cascading from one cell to more cells within the battery pack.40 The arrangement of cells within the pack and the thermal management systems are crucial in the mitigation of excess heat generation from certain cells. The X-57 battery pack was tested with trigger cells and reportedly the fire from one cell did not propagate to other cells.39 Pack design and by extension the battery management system affects the ability to monitor the state-of-charge (SoC) and state-of-health (SoH) of individual cells. The SoC and SoH of individual cells determines the extent to which functional safety such as a sufficient and reliable supply of power can be controlled.

Battery safety mitigation strategies for aircraft

Thermal

There are three stages to thermal runaway as Liu et al.27 as shown in Figure 1: (1) onset of overheating, (2) heat accumulation and gas release process, and (3) combustion and explosion. Flaws or defects in manufacturing, internal shorts (due to separator issues, dendrites, and mechanical stresses) or other functional issues can cause Stage 1 resulting in the onset of overheating. If the overheating is mitigated in Stage 1 itself, thermal runaway could be completely avoided. However, an important point to note for electric aircraft is that once Stage 1 occurs, functional safety cannot be guaranteed since Stage 1 signifies that the battery has transitioned from normal to abnormal behavior.27

Figure 1
figure 1

The three stages leading to thermal runaway in a cell that need to be examined to develop mitigation strategies.27

Full size image

Among the mitigation strategies for Stage 1, airworthy batteries, as a first step, could require much higher quality control standards compared to batteries manufactured for electric vehicles or other applications thereby minimizing the incidence of manufacturing defects. Cell design decisions are instrumental in determining the possibility of Stage 1 occurring. For example, in the widely publicized Samsung Galaxy Note 7 fires,41 extremely thin separators were identified as one of the primary culprits in causing an onset of overheating.27 A significant fraction of heat generated within a cell is due to transport resistance faced by ions and electrons.42 This implies that electrode formulations which modulate the number and amount of conductive additives and ionic transport properties also affect the heat generation behavior. Further, the electrode composition also affects the specific heat capacity of the cell.43 Effectively, the electrode composition plays a crucial role in both the heat generation and the heat transfer thereby directly affecting the likelihood of Stage 1. For electric aircraft, mandated compliance with a stipulated set of minimum cell design metrics such as minimum separator thickness, electrode porosity, and heat capacity of the cell stack could avoid the use of cells that are a result of safety-performance tradeoffs.

One of the important considerations for Stage 1 in an airborne environment is the effect of low pressure and rarer air on the heating or burning rate of cells.44 As reported by Xie et al., for two cells operated at the same rate, the cell at 95 kPa pressure exhibited a burning rate that is 3.9 times higher than one at 20 kPa, as shown in Figure 2. In addition, it is reported that the time taken to reach thermal runaway is more sensitive to changes in charge/discharge rates at 20 kPa compared to 95 kPa.44 These observations imply that apart from possibly more stringent cell design and composition requirements for airworthy batteries, the unique heating characteristics of airborne batteries must be accounted for Stage 2, as categorized by Liu et al.,27 involves the decomposition of certain cell components accompanied by an increase in temperature due to heat accumulation. The decomposition process entails the release of several gaseous products: an increase in internal pressure of the cell and is marked by the release of oxygen from the cathode, a necessary ingredient for combustion reactions. The onset of Stage 2 effectively implies cell failure, and the mitigation measures focus on containing the hazard. One of the popular fail-safe mechanisms to handle Stage 2 is the use of cell-venting mechanisms. A cell-vent, once activated, releases all the gaseous products in a controlled manner into the surrounding environment.28,40 The release of gases simultaneously balances the heat accumulated within the cell. For airworthy batteries, the cell-venting needs to account for the possibility of a low pressure environment in an aircraft.44 Low pressure presents a significant challenge to controlling the gas release process from a cell-venting event, and poses the risk of causing an uncontrolled explosion of gases and heat during venting.

Figure 2
figure 2

© 2020 IOP Publishing.

A comparison between the heating rates (a) at different C-rates at the same pressure of 20 kPa, and (b) at different pressures for the same C-rate of 2.0 C. Reprinted with permission from Reference 44.

Full size image

If Stage 2 is not controlled, the cell inevitably goes to Stage 3 where the organic liquid electrolyte forms the primary fuel for combustion aided by accumulated heat, gaseous decomposition products and oxygen from the cathode. The priority at Stage 3 is to prevent propagation of the fire, thermal runaway and system-failure.

High safety, high reliability packs, specifically targeting the prevention of Stage 3 from cascading have been traditionally developed for NASA’s manned missions.14,40 Such pack design approaches can be borrowed and scaled to propulsion batteries as well.9 Torres-Castro et al.40 devised two time-based parameters to study the cascading behavior of a thermal runaway namely, the “cell crossing time” and the “cell gap crossing time.” They reported that using heat-absorbing plates between cells was an obvious way to prevent cascading with thick plates made of copper or aluminum completely preventing the cascading. For an electric aircraft, however, such plates would significantly affect the specific energy of the battery pack which is a critical design parameter. One of the popular studies on strategies to prevent thermal runaway in high specific energy Li-ion battery systems has been by Darcy,45 who proposed five design rules for modules that achieves more than 190 Wh/kg used in space suits. The five rules covered: (1) risk of side-wall rupture, (2) cell spacing and heat dissipation, (3) fusing of parallel cells, (4) protecting adjacent cells from “hot ejecta” from exploding cells, and (5) preventing sparks from leaving the enclosure. Figure 3 shows a visualization of one such module design architecture.46

Figure 3
figure 3

© 2020 Elsevier.

Module architecture that shows mechanisms to protect against thermal runaway with a thermal fuse and heat dissipating material between cells. Reprinted with permission from Reference 46.

Full size image

Functional

Functional failures are battery failures in which the aircraft experiences partial or complete loss of safety–critical power supply. Functional failures are either due to “acute” loss of power supply or “chronic” loss of power supply. Acute losses of power supply occur quickly and without substantial warning, often causing catastrophic failures. Acute losses are generally due to thermal runaway reactions and sometimes due to internal shorts, loss of contact within the cell, or system-wide issues with cell-to-cell interconnections. Strategies for mitigating thermal runaway were the focus of the previous section, and in this section, we will focus on the loss of power supply.

Chronic loss of power supply is the result of slow chemical or electrochemical side reactions that degrade the performance of a battery over its life. Degradation is also closely linked with the safety of cells.47 The typical modes of degradation are capacity loss, resistance gain, and changes in other functional properties of the battery. Long-term changes in performance are particularly concerning for aircraft applications where high power performance is necessary during landing for aircraft such as eVTOLs and aborted landing in conventional electric aircraft and eVTOLs.3 Another safety concern due to battery degradation is the so-called “kneepoint” phenomenon which signifies a rapid increase in the rate of performance deterioration, and can quickly push a battery to its end of operating life.48 Mitigation strategies for this failure type mainly consist of accurate degradation prediction and state estimation, which will ensure that the aircraft operator is continuously aware of the current state of the battery.

The most common degradation mechanisms cited in the literature are formation of the Solid Electrolyte Interphase (SEI), isolation and loss of active material (LAM) due to mechanical stress and particle cracking, and lithium plating.49 SEI growth causes an increase in resistance of a cell. SEI growth and lithium plating both contribute to a loss of lithium and hence a capacity loss. Identifying the rate of progress of these mechanisms would help in monitoring the change in battery performance.50

Modeling these degradation modes is crucial for monitoring the state-of-health of a cell. Degradation models typically fall into one of three categories: physics-based, empirical, and data-driven. Physics based methods often require advanced battery models such as pseudo-two-dimensional51 models, which can be too slow to run in real time on a battery management system especially to use in the context of battery pack safety. To that end, reduced order models such as single particle models that maintain many of the positive characteristics of physical models, such as interpretability, while improving computational efficiency.52

Empirical and data-driven models typically have a lower computational cost than physics-based models, but often have difficulty extrapolating to conditions outside of the data on which they were trained.53 There are also data-driven approaches that directly predict the safety envelope of battery packs in electric vehicles.54 The coupling of these safety envelopes with performance envelopes would be an important contribution in battery performance and safety modeling. Current battery pack and cell state estimation literature is focused on state-of-health modeling, however, in the context of functional safety of electric aircraft, predicting the power capability and the risk of kneepoint or rapid performance loss is also equally important.

Critical evaluation of current regulations

As noted in this article, functional and thermal safety have been widely covered in the current regulatory literature, primarily in the DO-311A documentation. The document is designed to address batteries that fall under the “Energy Category-4,” which means battery systems either cell or module that have a total energy content of at least 200 Wh. DO-311A tries to evaluate the potential “airworthiness” of a battery system, as previously discussed.

Among the different aspects stipulated for compliance, the first set includes charge/discharge protection and overdischarge protection. In our discussion on functional and thermal safety issues, we note a growing body of work on understanding the interplay between overcharge, overdischarge, degradation, and safety.55 Although the DO-311A requires airworthy batteries to comply with automatic systems that limit charging current and discharging behavior beyond manufacturer’s specifications,15 we find that it lacks concrete measures as to how these requirements will be verified for reliability in both regular operation and abnormal operation. For example, when a flight declares an emergency and operates with reserve power there is a nonzero possibility of overdischarge, and if this happens it is important to have fail safes that can ensure thermal and functional safety.

The next area that DO-311A examines is venting which is sub-divided into three categories (A–C).15 Category A covers situations where emissions from the cell are not allowed outside the battery system enclosure. Category B uses the aircraft exhaust system to vent the gaseous ejecta from the cells, while Category C permits the emissions to leave the battery system enclosure through “louvers, ventilation/cooling holes,” and other such avenues. While this categorization provides a guidance for the design of safety features of the battery pack, it does not address potential complexities that could arise in a larger battery pack with a large number of cells and modules. There could be other potential measures taken at the module-level such as spacing and heat dissipating materials that could mitigate the impact of the hot emissions from cells, however, these are not explicitly addressed in DO-311A.

Testing of thermal runaway containment as specified by the DO-311A has been a subject of contention in the aviation sector. The Boeing Company (Boeing), backed by several other aircraft manufacturers including Airbus, Bombardier, Zee, Aero, and others,15 published a dissenting opinion that now features as an addendum to the DO-311A document. One of the main points of contention was the requirement to push the battery pack to thermal runaway through overcharging as prescribed in “Battery Thermal Runaway Containment Test” section of the document. Boeing argued that such a requirement is unrealistic since such extreme levels of overcharging is unlikely to occur in the real world. Further, it was argued that DO-311A required thermal runaway with multiple cells transitioning to abnormal behavior instead of one cell within the pack behaving as the “trigger-cell,” which would be the more likely scenario in reality. The proposal to mitigate some of these issues was to prescribe a thermal runaway test that would account for single cell failure in multiple locations of the battery pack and accounts for different pack designs.

Other requirements prescribed by DO-311A on functional safety include properly working SoH metrics which aids maintenance systems. However, explicit discussions on the importance of SoH estimation on functional safety particularly in relation to partial or complete loss of power has not been covered in DO-311A. Similar to airworthy materials for battery systems, airworthy algorithms and maintenance systems would be a crucial inclusion to the regulatory literature. DO-311A also features an extensive list of tests overcharge, overdischarge, short-circuit, thermal runaway containment, and explosion containment. These tests are broadly described for standalone and embedded batteries wherever relevant. One of the aspects that would be useful in augmenting the currently available list of tests, especially for large (> 5 kWh) propulsion batteries would be an inclusion of procedures which examine issues that arise due to the complexity of large battery pack architectures. For example, the reliability of cell balancing for strings with 10s–100s of cells and the mitigation of cell-to-cell variation in such large clusters of cells, etc. Another aspect that was not discussed in this article, but pointed out in DO-311A, is the possibility of corona discharge with high voltage battery packs in airborne environments.15 The issue of corona discharge could be exacerbated as larger battery packs are used in aircraft.