Boeing 787: how a containment box became the concession that prevention failed

When a regulator signs off on a steel box as the remedy for a battery that catches fire in flight, you are not witnessing engineering elegance. You are witnessing the moment every stakeholder agreed the failure mode was real and the prevention plan was not. I have closed enough 8D actions to recognise the tell: when containment becomes the certified solution, root cause was never resolved.

The situation

The 787 was Boeing's more-electric architecture. Systems that had run on pneumatics and hydraulics now ran on electricity. That demanded high-density energy storage, and Boeing selected lithium-ion cobalt oxide cells from GS Yuasa, integrated into a battery system by Thales. These were not auxiliary batteries. They were primary power: the main ship's battery and the APU battery.

In 2007, the FAA issued special conditions specific to lithium-ion battery installations. Boeing had to demonstrate that the battery system would not catch fire, would not propagate thermal runaway between cells, and would not damage the aircraft or pose a hazard to occupants. The certification pathway rested on one assumption: cell-level failures would be rare, isolated, and detectable before cascading.

How it unfolded

On 7 January 2013, a Japan Airlines 787 at the gate at Boston Logan emitted smoke from its APU battery compartment after passengers had deplaned. Firefighters found electrolyte leakage, charred cells, thermal damage. Nine days later, on 16 January, an All Nippon Airways 787 in flight over Japan reported smoke in the cockpit and cabin. The crew made an emergency landing and evacuated. Both battery packs showed evidence of thermal runaway – cells that had self-heated past the point of self-sustaining exothermic reaction.

The FAA issued an emergency airworthiness directive on 16 January, grounding all US-registered 787s. Regulators worldwide followed within days. First fleet-wide grounding of a commercial aircraft type since 1979. The fleet – roughly 50 delivered aircraft – sat for about three months while Boeing developed a fix. The fix was not a new cell chemistry. It was a stainless-steel containment box, redesigned cell spacing, insulation between cells, and a venting path directing any released gases overboard. The system was designed to contain a full thermal runaway and prevent it from threatening the aircraft. It flew. It still flies.

Root-cause anatomy

Technically, the failure was thermal runaway in lithium cobalt oxide cells – a chemistry with high energy density and a narrow thermal margin. An internal short circuit, from a manufacturing defect or electrical overstress, drives local temperature past the decomposition threshold. The cell becomes its own fuel source. Electrolyte breaks down, flammable gases vent, heat propagates to adjacent cells. The certification model assumed this propagation would not occur, or would be caught and isolated. It was not.

Organisationally, the problem sat in the interface between three players: Boeing as the airframer responsible for certification, Thales as the battery system integrator, and GS Yuasa as the cell manufacturer. The cell-level failure assumptions were embedded deep in the design – in the PFMEA, in the safety analysis, in the certification compliance artefacts. Nobody in that chain had the incentive or the mandate to challenge the probability model with the question that mattered: what if we are wrong, and what does wrong look like at thirty thousand feet?

Where the quality system failed

The PFMEA. Specifically, the occurrence ratings assigned to cell-level thermal runaway and the assumption that propagation between cells was unlikely. When your FMEA assigns a low occurrence to a failure mode you have not tested to destruction at full pack scale, you are not performing risk analysis. You are performing risk theatre. The detection controls – battery monitoring, thermal sensors – were rated as if they could intercede in a reaction that cascades in seconds.

The APQP and validation under FAA special conditions asked the right questions. But the answers were built on analysis and limited testing rather than adversarial abuse. The gap between "we met the special condition" and "this battery will not burn" was bridged by probability assumptions, and real electrochemistry demolished the bridge.

Containment is not prevention that arrived late. It is prevention that was never coming.

The 8D crisis response was effective – the grounding, the investigation, the containment fix. But 8D separates containment from permanent corrective action for a reason. Here, containment became the certified permanent solution. The root cause – an underestimated hazard in the PFMEA – was never resolved at the chemistry level. It was fenced.

What would have caught it

Adversarial propagation testing would have caught it. Full-pack thermal abuse – nail penetration, overcharge, internal short simulation – on complete battery assemblies, not individual cells, to observe whether and how failure cascades under real conditions. Consequence-first hazard assessment: if the failure mode is in-flight fire, occurrence probability should not be the lever that lowers the risk priority number. The consequence alone should drive the design response.

Supplier quality at the cell level needed independent process audits at GS Yuasa focused on internal short-circuit precursors – burrs, separator integrity, contamination, welding quality – not just incoming inspection at the system integrator. And a PFMEA challenge protocol: a mandatory review requiring the team to assume the worst-case failure occurs and justify why the system survives it, rather than starting from the assumption it will not happen.

My take

In two decades of aerospace quality under AS9100 and EN 9100, the pattern I recognise in this public record is the comfortable PFMEA. I have inherited FMEAs where the occurrence rating was low because the failure had never been observed – which is not evidence of low probability, it is evidence of insufficient operating hours. When I built a greenfield QA department for 900+ employees from the ground up, one of the first things I did was challenge every RPN driven by a low occurrence score on a failure mode we had not tested to destruction. Some of those challenges were uncomfortable. None of them were wrong.

I have also lived the moment where containment hardens into permanent process. In QRQC and 8D work, containment is supposed to be a bridge – temporary, urgent, ugly. But when the root cause is a design assumption embedded in certified hardware, the temporary fix becomes the certified configuration. I have seen it on subsystems. The 787 battery is what it looks like when the stakes are fleet-wide and the passengers are on board.

The lesson I carry from my own audit experience: compliance is a floor, not a ceiling. A clean EASA audit or an AS9100 certificate means your system meets the standard. It does not mean your product is safe. The 787 was compliant. The battery was certified. The special conditions were met. And it still burned.

The 787 battery story is not about lithium-ion chemistry being inherently dangerous. It is about a quality system that trusted its own model more than the physics it was supposed to describe. When the model broke, the only answer left was a steel box. That box flies today – and every time it does, it carries the weight of a PFMEA that called the failure mode improbable. Containment earned its place. Prevention never arrived.