Boeing 787 battery fires made thermal-runaway containment a certification accountability test

Summary

• Confirmed events: On 7 January 2013, a Japan Airlines 787 parked at Boston experienced an auxiliary power unit battery fire after passengers and crew had left. On 16 January, an All Nippon Airways 787 in climb received a battery failure indication and unusual smell, diverted to Takamatsu, and evacuated; four passengers sustained minor injuries during that evacuation. The two aircraft used the same battery model for different installed functions.
• Investigative findings: The U.S. National Transportation Safety Board found that the Boston event began with an internal short in one cell, followed by thermal runaway that cascaded to adjacent cells. It attributed the incident to Boeing's failure to specify mitigation for the most severe effects of a cell internal short and the Federal Aviation Administration's failure to identify that design deficiency in type certification. The Japan Transport Safety Board found cell 6 very likely initiated the Takamatsu propagation, but it did not identify the conclusive mechanism that created the internal short.
• Trigger, root and contributing factors: The operational trigger for grounding was not merely a failed battery; it was the second serious event in nine days, this time in flight. The root accountability failure was an invalidated system-safety assumption that single-cell thermal runaway would not propagate or produce hazardous aircraft-level effects. Contributing conditions included nonrepresentative development testing, use of a preproduction and ungrounded battery in a key nail-penetration test, underestimation of occurrence rates, incomplete requirement-to-test traceability, manufacturing processes capable of introducing wrinkles or foreign entity debris, and oversight that did not reach the subtier cell factory effectively.
• Control and response: GS Yuasa controlled cell and battery manufacture; Thales controlled integration of the power-conversion subsystem; Boeing controlled aircraft-level requirements, supplier integration, safety assessment and type-certificate application; authorized representatives and FAA engineers made compliance findings within delegated and retained scopes, while only the FAA could issue the type certificate and airworthiness directives. Airlines controlled immediate fleet use, and investigative authorities controlled their own safety findings, not civil liability.
• Recovery: The FAA grounded U.S.-registered 787s through an emergency airworthiness directive and approved return after installation of new batteries and chargers, tighter operating controls, added cell isolation, a sealed steel enclosure, and an overboard vent. A January 2014 Narita event then overheated one redesigned battery cell without propagation or surrounding equipment-bay damage. Japan's regulator treated that as evidence that the second and third protection layers worked, while also calling for further improvement because the first layer had not prevented cell overheating.
• Accountability conclusion: The redesign supplied strong evidence that consequence containment had improved. It did not retrospectively make the original certification assumptions reasonable, identify every initiating mechanism, or publicly prove a zero-failure battery. Durable assurance requires continuing evidence at three levels: cell-process capability, battery-level propagation resistance, and aircraft-level containment under the worst credible installed conditions.

The case is about a safety boundary, not a battery brand

The decisive boundary in this case was supposed to lie inside the battery. A cell might fail, vent, or overheat, but the safety analysis assumed that the event would remain limited enough that it would not become a multi-cell fire threatening the aircraft. Once the Boston battery produced fire and the Takamatsu battery propagated heat across cells, that boundary was shown to be unreliable in service. The accountability issue therefore reaches beyond asking which microscopic defect started which cell.

It asks who defined the boundary, what evidence justified it, who reviewed that evidence, and what controls remained when the initiating mechanism could not be reconstructed.

The NTSB's completed investigation page states the Boston probable cause in institutional terms: an internal cell short led to cascading thermal runaway, and the incident resulted from missing Boeing design requirements and an FAA certification-review failure. That is an official safety finding, not an allegation by a litigant and not a court judgment. The full NTSB incident report contains the evidence, analysis, findings and recommendations behind that statement. Its precision matters.

It does not say that Boeing intentionally accepted a known fire, that an FAA employee knowingly waived a failed test, or that one identified particle was proved to have caused the short.

The Japan investigation is equally important because it reached a different limit. The JTSB final report found a likely event sequence around cell 6, swelling, contact with a brace bar, large ground currents, arcing and propagation. It said the cell's heat generation was probably caused by an internal short, but the conclusive mechanism of that short was not identified. Treating the two reports as interchangeable would erase a central lesson: investigators can prove the escalation path and control failure without proving the first microscopic act.

This analysis uses five labels. A confirmed fact is directly established by an official record or contemporaneous formal filing. An investigative finding is a conclusion adopted by an accident investigation body within its safety mandate. A company position is evidence of what Boeing said or did, but not independent proof of causation or durability. A supported inference connects established facts without claiming the connection was formally adjudicated. An unresolved question remains open in the public record.

A counterfactual describes a control that could have interrupted the sequence; it is not a claim that a particular person was legally required to foresee it at the time.

Forensic timeline: from novel technology to certified service

28 March 2003 to September 2004 - application and technology choice. Boeing applied for a 787-8 type certificate in March 2003. In September 2004 it informed the FAA that it intended to use high-capacity rechargeable lithium-ion batteries for main and APU functions. The chemistry offered lower weight and useful electrical performance for the 787's more-electric architecture, but commercial transport experience with such large installed batteries was limited. The technology choice was legitimate; novelty created an evidence obligation, not a presumption of fault.

The supplier chain distributed detailed control. Boeing selected Thales for the power-conversion subsystem. Thales selected GS Yuasa for the lithium-ion battery and Securaplane for the battery control unit, with Boeing participating in the selection process. GS Yuasa made eight large lithium cobalt-oxide cells connected in series and assembled them into the battery. The same battery model served as the main battery in the forward electronics bay and the APU battery in the aft bay. Boeing remained responsible for aircraft-level integration and the certification showing even when lower tiers designed and manufactured components.

2005 to 2007 - requirements and special conditions. The FAA concluded that the ordinary transport-aircraft battery rules did not adequately address the novel design. The official 2007 Federal Register issue containing Special Conditions 25-359-SC identified susceptibility to internal failure, thermal runaway, flammable electrolyte, overcharge and over-discharge.

Its nine conditions required, among other things, safe temperatures and pressures, prevention of self-sustaining uncontrolled temperature or pressure increases, control of hazardous gases and fluids, protection from maximum heat during a cell or battery short, charging control, warnings, and continuing-airworthiness instructions.

Those words appear strong because they are strong. The problem arose in translation from top-level safety language to assumptions, detailed requirements, methods of compliance and representative tests. A condition that says the design must preclude uncontrolled temperature growth does not itself specify how to induce an internal short, how many trials to run, whether the battery must be grounded as installed, which temperature produces the most severe result, or whether the tested article must match the final production design. Those links had to be made through certification planning and engineering evidence.

2006 and 2009 - development warnings, changes and interpretation. The JTSB record describes a 2006 overcharge fire during development after a signal wire was not connected, followed by design changes. In 2009, an integrated-system test produced excessive charging and a vented cell; investigators associated that event with repeated over-discharge followed by high-current recharge and made further corrections. These events were not the same mechanism established in Boston, and it would be inaccurate to call them ignored replicas.

They did, however, show that the battery system could enter energetic failure states and that design configuration, electrical environment and control logic mattered.

A 2006 GS Yuasa nail-penetration development test became influential. It drove one cell into thermal runaway without observed propagation to adjacent cells or fire. The later NTSB analysis found that the test did not use the battery's maximum operating temperature, did not fully represent installation on the aircraft, did not repeat trials across multiple batteries, and used a development unit different from the final certified design. Other claimed battery-level development tests lacked documentation available to the NTSB.

Qualification abuse tests did not drive a cell into thermal runaway to prove non-propagation or containment, and the tested batteries were not grounded as installed.

That does not mean the certification consisted of one casual test. Boeing, suppliers, authorized representatives and FAA staff used safety assessments, fault trees, failure-mode analyses, qualification tests and certification reviews. The narrower and more consequential finding is that the evidence chain did not challenge the crucial assumption under the most severe representative conditions. Activity was extensive; coverage was incomplete.

26 August 2011 - type certification. The FAA granted transport-category approval for the 787-8. Boeing had obtained FAA approval of its electrical-power-system certification plan, and the FAA reviewed qualification procedures, approved type inspection authorization and accepted final reports. Boeing had received Organization Designation Authorization in 2009, allowing authorized representatives to make specified compliance findings on the FAA's behalf. Only the FAA issued the type certificate.

Describing this as Boeing simply certifying its own battery would conceal the divided controls and the retained public authority that the investigation actually examined.

Forensic timeline: the two January 2013 events

7 January, Boston - a parked aircraft, an active battery fire. Japan Airlines flight 008 arrived at Boston Logan from Narita and parked at the gate. The APU was the source of aircraft power. At about 10:21 local time, cleaning personnel found smoke in the aft cabin, a maintenance manager saw that the APU had shut down automatically, and a mechanic opening the aft electronics bay found heavy smoke and flames at the APU battery case connector. None of the 183 passengers or 11 crewmembers remained aboard. Maintenance and cleaning personnel were not injured; the NTSB reported a minor injury to one responding firefighter.

The sequence is documented in the public NTSB docket for DCA13IA037, which includes factual reports, photographs, test records, hearing exhibits and technical material. The battery was difficult to access and the event had aircraft-level consequences even though the aircraft was empty. Heat damage, smoke, flammable electrolyte and fire escaped the intended cell-level boundary. The fact that the event occurred on the ground reduced human exposure; it did not reduce the design significance.

Investigators excluded several alternatives for the Boston event. Recorded data did not show overcharge, over-discharge or a high-current external short before failure. Examination did not find an external heat source, chafed battery cable, mechanical abuse or an abnormal aircraft electrical transient that initiated it. Component and integrated tests did not implicate the charger or related external components. Damage concentrated around cells 5 and 6, but destruction prevented the NTSB from deciding which of those two initiated the sequence. The board found an internal short in one of them, followed by propagation.

11 January - review announced before the second event. The FAA publicly announced a broader design and production review. In its 11 January statement, the agency said it would review critical systems, emphasize electrical systems and verify design, production and oversight. At that point, the FAA expressed confidence in the aircraft while saying it needed the full picture. This was a regulatory response, not a completed finding that the battery was safe or unsafe.

16 January, Takamatsu - the hazard moves into flight. All Nippon Airways flight 692 departed Yamaguchi-Ube at 08:11 for Tokyo. At 08:27, while climbing through 32,000 feet, the crew received a battery-failure message and detected an unusual smell in the cockpit. The aircraft diverted and landed at Takamatsu at 08:47. The crew initiated an evacuation by slides at 08:49. Four of the 137 occupants sustained minor injuries during evacuation. JTSB found that the damaged main battery did not develop an external fire, but cell heat, electrolyte and smoke produced an in-flight system event serious enough to divert and evacuate.

This second event changed the risk decision. Boston had shown a fire after passengers left; Takamatsu showed a related battery architecture failing during flight. Earlier that day JAL and ANA voluntarily suspended 787 operations. The FAA then issued Emergency AD 2013-02-51, later published as the February 2013 final rule. It required modification or another approved action before further flight because battery failures could damage critical systems or structures and could cause fire in an electrical compartment. EASA adopted the FAA directive for the European fleet, and other authorities acted for aircraft under their jurisdiction.

The operational trigger for fleet grounding was therefore cumulative and cross-context: two high-energy battery failures, the same battery model, two installed functions, nine days, one confirmed fire and one in-flight diversion. A regulator did not need to wait for a fatality or a completed microscopic root cause to conclude that continued unrestricted operation lacked adequate assurance.

What physically failed, and what remained unresolved

For Boston, the NTSB found an internal short within cell 5 or 6. That cell entered thermal runaway; heat and failure propagated to neighboring cells; smoke, electrolyte and fire followed. The board found that overcharge, over-discharge, external shorting, external heating, installation factors and aircraft environmental conditions did not initiate the failure. This is the strongest confirmed technical chain in the public record.

The NTSB also examined manufacturing. GS Yuasa wound electrode and separator layers into cylindrical assemblies, partially flattened them, grouped them and performed final flattening before cell assembly. Flattening could create perturbations in electrode foils. Welding near internal components could generate metallic debris. The NTSB found that GS Yuasa monitored some pre-winding wrinkles but did not formally monitor perturbations created during winding, flattening and assembly; its foreign-entity-debris process was not a standardized control for finding, reducing and preventing debris generation.

Much inspection occurred after cell completion and relied materially on visual review.

The board's materials laboratory factual report and final analysis documented wrinkles, folds, lithium deposits and foreign material as relevant defect mechanisms. The NTSB concluded that the manufacturing process allowed defects capable of causing internal shorts to enter 787 cells. It did not identify one surviving wrinkle or particle as the proved initiator in Boston. That distinction prevents a process-level finding from being converted into an unsupported device-specific accusation.

For Takamatsu, JTSB reconstructed cell 6 as the very likely initiator. Heat and pressure swelled the cell, melted surrounding insulation and allowed contact with a brace bar. Large currents through the grounded battery box generated arcing, which strengthened thermal propagation. Tests that reproduced the installed grounding configuration could produce propagation; a floating configuration did not. JTSB found that nonrepresentative development testing and underestimation of internal-short effects possibly contributed to propagation.

The internal short itself remained unresolved. JTSB considered lithium deposition under low-temperature conditions, metallic contamination, separator damage and nonuniform winding, but expressly said it could not conclusively identify the mechanism and could not exclude other design or manufacturing factors. The three notable events then known had occurred in January, but seasonality is not causation. Cold temperature was a hypothesis, not a final finding. A defensible account therefore stops at: internal short likely initiated cell 6; the precise origin of that short was unknown.

Trigger, root cause and contributing factors

The triggering events were observable and time-bound: the Boston APU battery fire and the Takamatsu in-flight main-battery event. The grounding trigger was the loss of confidence that either installed location could safely tolerate the known battery failure mode. Trigger is not root cause. A trigger describes when a control decision became necessary, not why the system was vulnerable.

The physical root cause for Boston, using the NTSB's adopted probable cause, was an internal cell short followed by cascading thermal runaway. The system root cause was a requirements and certification failure: Boeing's battery safety assessment did not consider the most severe effects of that short or specify mitigation, and the FAA review did not identify the deficiency. The special conditions demanded prevention of uncontrolled temperature and pressure and protection from short-circuit heat. Yet the detailed evidence chain treated non-propagation as an assumption rather than a result demonstrated across worst-case installed conditions.

The first major contributing factor was test representativeness. The influential nail-penetration test did not use the final battery design, maximum operating temperature, installed grounding or repeated trials. Post-event NTSB, UL and JTSB tests showed that changing these conditions could change whether thermal runaway propagated. The lesson is not that nail penetration perfectly reproduces every spontaneous internal short. It is that a test used to dismiss propagation must be conservative, installed-representative and repeatable enough to support that conclusion.

The second was probability transfer. Boeing's safety assessment estimated cell venting at roughly one occurrence per ten million flight hours using GS Yuasa data from an industrial cell with similar mechanical design. The NTSB found that both Boston and Takamatsu occurred within the first approximately 52,000 fleet hours, far above the prediction. JTSB separately criticized calculations derived from similar industrial cells whose ingredients differed and noted the low confidence level used.

Historical absence of failure in an adjacent application was treated as evidence about a new application without enough margin for chemistry, capacity, environment and process differences.

The third was requirement traceability. NTSB found unclear links among each special condition, safety-assessment assumption, rationale, lower-level requirement and method of compliance. Better traceability would likely have revealed that no explicit battery requirement and no planned thermal-runaway certification test addressed propagation from an internal short.

The board's 2014 lithium-battery certification recommendations called for abuse tests that induce single-cell thermal runaway in the installed configuration under conditions producing the most severe outcome, review of in-service approvals, and access to independent technical expertise.

The fourth was manufacturing and subtier oversight. Thales audited GS Yuasa in 2011 and 2012, but the recorded discrepancies did not address cell-manufacturing features later examined. Boeing relied on Thales for subtier audit and did not audit GS Yuasa before the event; FAA did not audit the cell facility before the event. Post-event audits identified nonconformities and corrective actions. This supports a finding that oversight could have been more effective. It does not prove that every audit was perfunctory or that a specific undisclosed nonconformity caused either event.

The fifth was monitoring resolution. Battery systems monitored voltages and temperatures but could not necessarily detect a localized internal short early enough to stop thermal runaway. NTSB later recommended individual-cell temperature and voltage monitoring and recording of exceedances, along with research into precursors and active mitigation. Detection cannot be credited with controlling a mechanism that develops internally faster than the available sensors and disconnects can arrest it.

Detection, response and recovery

Detection began with people and aircraft messages, not a predictive safety monitor. In Boston, cleaning staff saw smoke, a maintenance manager saw the APU shutdown, and a mechanic found the battery fire. In Takamatsu, the crew received a battery failure message and smelled an unusual odor. These indicators enabled response after the event had already progressed. They did not provide a reliable early warning of the initiating short.

The immediate response was appropriately conservative. Firefighters addressed the Boston event. The Takamatsu crew diverted, landed within about 20 minutes of departure and evacuated. JAL and ANA suspended operations before the FAA directive. The FAA used an emergency AD, an instrument directed at an unsafe condition in the product, rather than waiting for a final accident report. International authorities adopted or paralleled the restriction. This sequence separated operational risk control from causal certainty.

Investigation then widened detection. CT scanning, destructive physical analysis, electrical tests, recorded data, factory observation and installed-configuration propagation tests converted a hidden cell event into an evidence map. The NTSB docket preserved underlying reports, while the two national boards reached conclusions under Annex 13 safety-investigation principles. JTSB's report states that its purpose is prevention, not apportioning blame or liability. That boundary should guide use of every technical finding in accountability analysis.

Recovery occurred in stages. Boeing proposed a certification plan; the FAA approved the plan on 12 March 2013. Boeing's certification-plan announcement described three layers: reduce faults, enhance production and testing, and contain any failure so it could not affect the aircraft. This was a company position about the intended solution, not yet approval to resume passenger service.

The company's detailed design announcement described tighter screening, production controls, electrical and thermal insulation, a revised operating voltage range, charger changes and a steel enclosure vented outside the aircraft. Boeing said it drew from RTCA DO-311, which had not been available for the original baseline plan. That later use of a newer standard is remediation evidence; it must not be described as a standard Boeing violated during the earlier certification.

On 19 April, the FAA approved the modification design after observed testing and analysis. The return-to-service AD 2013-08-12 required installation of main and APU battery enclosures and environmental-control-system ducts, replacement of both batteries and chargers, and a maintenance-program revision for enclosure vent burst discs. It superseded the grounding directive and became effective on 26 April. The corresponding EASA record shows adoption for continuing airworthiness outside the primary certification state.

Recovery did not rest on proving one initiating defect had been removed. It rested on defense in depth: reduce the chance of initiation, reduce the chance of propagation, and prevent aircraft-level consequences even if both earlier layers failed. This was a rational response to unresolved initiation, but it created a durable obligation to verify containment rather than quietly returning to the old non-propagation assumption.

Accountability control map

Actor	Practical control before the events	Control after detection	Evidence owed
Boeing	Aircraft-level requirements, system integration, supplier flow-down, safety assessment, certification plan, final product release and continued operational safety	Design of the three-layer remedy, service instructions, retrofit support, supplier corrective action and fleet monitoring	Traceable requirements; conservative assumptions; representative abuse tests; supplier audit closure; configuration and lot traceability; field-event trends
GS Yuasa	Cell materials, winding, flattening, welding, electrolyte filling, battery assembly, inspection, acceptance testing and manufacturing change control	Process revision, stricter acceptance, training and defect prevention	Process capability; calibrated inspection; foreign-material control; CT criteria; rejection data; proof that changes remain effective
Thales	Power-conversion subsystem integration, flow-down to battery and charger suppliers, supplier audit and interface assurance	Coordination of changed batteries, chargers and requirements	Verified interface requirements; subtier audit depth; change approvals; evidence that system assumptions reach component controls
Securaplane and charger/control suppliers	Battery monitoring and control-unit design within assigned specifications	Charger and monitoring modifications, test support	Detection limits; disconnect behavior; voltage and temperature margins; abnormal-condition test results
FAA	Certification basis, special conditions, retained findings, ODA oversight, type-certificate issuance, production oversight and continuing-airworthiness authority	Emergency grounding, approval of certification plan and redesign, mandatory AD, installation surveillance and policy changes	Independent challenge of assumptions; delegation boundaries; method-of-compliance traceability; inspection records; continuing safety review
Boeing authorized representatives	Delegated findings within FAA-approved scope, review of compliance reports and tests	Review of redesign evidence within delegated scope	Documented independence of judgment, escalation of ambiguity, complete findings and traceability to FAA requirements
Airlines	Maintenance, event reporting, operational dispatch and voluntary suspension	Aircraft isolation, crew response, fleet suspension, retrofit installation and return only after local approval	Accurate defect reports; preserved evidence; maintenance configuration; compliance records; operational trend data
NTSB and JTSB	No design-release or operating authority; independent safety-investigation authority after events	Evidence preservation, testing, findings and safety recommendations	Transparent distinction between fact, analysis, probability and unresolved mechanism
Passengers and crews	Exposure to the hazard but almost no access to design, supplier or certification evidence	Crew diversion and evacuation; passenger compliance with instructions	Clear operational procedures and candid risk communication from institutions with control

This map prevents two common errors. First, supplier causation does not erase integrator accountability. Boeing did not wind electrodes, but it controlled the aircraft-level safety proposition and was the production approval holder. Second, public certification does not erase applicant accountability. FAA alone issued the certificate and retained oversight duties, but Boeing had to demonstrate compliance and validate the data and assumptions it submitted.

Delegation complicates responsibility without making it disappear. The NTSB found that Boeing authorized representatives and FAA certification engineers reviewed an assessment that omitted the most severe internal-short effects. The failure crossed the delegation boundary. It was not enough for each actor to perform its assigned review if the shared evidence model excluded the hazard that mattered.

The 2014 joint Boeing 787 Critical Systems Review Team report concluded that the overall aircraft met its intended safety level, while also identifying inconsistent requirement flow-down, verification gaps, supplier communication issues, inspection-delegation variation and FAA policy not fully aligned with an extended international supply chain. Its scope extended beyond the battery. It was co-led and staffed by FAA and Boeing personnel, so it is valuable evidence of institutional review and corrective action, not an independent accident investigation equivalent to NTSB or JTSB.

Legal and regulatory boundaries

The legal starting point is type certification. The official text of 49 U.S.C. section 44704 assigns the FAA Administrator authority to issue a type certificate after finding that a product is properly designed and manufactured, performs properly and meets applicable standards, and permits tests the Administrator considers necessary for safety. The current text includes amendments enacted after 2013. This article uses it only to describe the enduring allocation between applicant evidence and FAA issuance; later additions are not applied retroactively to the 787 battery certification.

The applicable certification basis included 14 CFR Part 25 and the 2007 special conditions. The special conditions were legally part of the 787-8 certification basis. Their existence shows that the novel battery hazard was recognized institutionally. The later investigative finding was not that no rule mentioned thermal runaway. It was that methods of compliance, assumptions and tests did not adequately demonstrate the protection the conditions required.

An airworthiness directive is a mandatory product-safety rule. The emergency directive grounded affected aircraft until an approved modification or other action addressed the unsafe condition. The April directive mandated a specific configuration for return. Neither directive was a criminal charge, a damages award or a finding of intent. It was a regulatory risk decision under continuing-airworthiness authority.

The NTSB and JTSB reports are not civil judgments. Their mandates focus on prevention. NTSB's probable-cause language is authoritative for its safety conclusion, but it does not by itself decide negligence, contractual allocation, punitive damages or criminal liability. JTSB expressly disclaims apportionment of blame. Likewise, Boeing's statements that the redesign was comprehensive or permanent were company claims made during remediation. They are not admissions of legal liability, and their optimistic wording cannot substitute for regulator and field evidence.

The June 2013 congressional hearing record on lessons from the 787 and the Department of Transportation's certification testimony document oversight questions and the FAA's explanation of redesign approval. Testimony is evidence of institutional position and scrutiny. It is not a court disposition. The public record used here does not establish a judicial finding that Boeing, Thales, GS Yuasa or the FAA owed or breached a particular private-law duty to a named claimant.

Standards also require temporal discipline. RTCA DO-311 was used in redesign certification but was unavailable when the original 787 plan was developed. FAA Advisory Circular 20-184, issued in 2015, supplies later guidance on installed rechargeable lithium batteries and states that advisory material is not itself a regulation. It is useful remediation evidence and a modern benchmark. It is not proof that a 2015 advisory circular was binding in 2005 or violated in 2011.

Counterfactual controls

The strongest counterfactual is a representative propagation test before certification. A final-configuration battery would have been installed with aircraft-equivalent grounding, operated at the most severe approved temperature and electrical condition, and subjected repeatedly to a credible single-cell internal-short method. Pass criteria would have addressed not only whether one cell vented but whether adjacent cells propagated, whether electrolyte and gas escaped, whether arcing paths formed, and whether aircraft systems remained protected. Post-event tests suggest this control could have exposed the invalid non-propagation assumption.

It does not prove the precise test would have reproduced Boston on demand.

A second counterfactual is explicit assumption governance. Every safety-significant claim would have an owner, rationale, source, uncertainty range, validation method and trace to a requirement and compliance artifact. The assumption that a cell internal short could not propagate would have appeared as a review item rather than an invisible premise inherited across GS Yuasa, Thales, Boeing and FAA documents. An independent technical panel could then challenge its applicability to final chemistry, capacity, installation and environment.

A third is conservative probability treatment. Failure data from a similar industrial cell would be treated as supporting context, not a direct frequency estimate for the aircraft cell, until equivalence in materials, manufacturing, loading and environment was demonstrated. Uncertainty would be carried into the aircraft-level analysis. Where consequence was severe and data sparse, containment would be required regardless of a reassuring point estimate.

A fourth is subtier process verification. Boeing and Thales could have jointly mapped cell critical characteristics, observed flattening and welding operations, defined measurable perturbation and foreign-material limits, validated CT resolution and detection probability, and sampled records across lots and process changes. FAA production oversight could have treated the battery as critical despite functional electrical redundancy because common physical failure could release heat, smoke and electrolyte. This counterfactual addresses escape probability; it does not guarantee elimination of every latent microscopic defect.

A fifth is aircraft-level containment from initial design. If the original installation had assumed that one or more cells would eventually enter thermal runaway, a sealed, overboard-vented enclosure and isolation sufficient for the worst event would have been part of baseline certification. This is the most robust counterfactual because it does not depend on identifying every initiation mechanism. The redesign later adopted essentially this consequence-based logic.

A sixth is high-resolution field monitoring and threshold review. Individual-cell data, exceedance recording, battery removals, charger events and manufacturing-lot identifiers could have been aggregated under predeclared triggers. One energetic event in a young fleet would prompt immediate reassessment of the prior rate estimate and operating envelope. Monitoring is not a substitute for containment, but it shortens the time between assumption failure and control action.

These counterfactuals are engineering propositions. They should not be converted into claims that a named individual consciously rejected them or that every element was legally mandatory under later guidance. Their value is to show where practical control existed and where a different evidence design could have interrupted the sequence.

Repair evidence: what changed before return to service

The redesign addressed three levels. At the cell and battery level, Boeing and suppliers changed insulation, terminal hardware, drainage, production and acceptance processes, voltage range, over-discharge protection, wiring protection and vent paths. At the propagation level, additional thermal and electrical separation reduced transfer among cells and between cells and the battery case. At the aircraft level, the battery sat in a sealed stainless-steel enclosure connected to a titanium duct that vented heat, pressure, gas and electrolyte outside.

The FAA did more than accept a press release. It approved a certification plan, observed tests, reviewed analysis, approved the design changes, mandated the configuration through an AD and said it would monitor installation on U.S. aircraft. Boeing's 19 April approval announcement reported a month of supervised certification testing and more than 100,000 engineering and test hours. Those numbers come from Boeing and do not independently establish test completeness, but the mandatory AD establishes that the FAA accepted the design for return.

Boeing's 2013 annual report says it installed the improvements on 50 previously delivered aircraft and resumed deliveries in the second quarter. This is implementation evidence at fleet scale, not merely a planned remedy. Operators and foreign regulators still controlled return for aircraft under their jurisdictions.

Investigation-driven recommendations broadened the repair beyond hardware. NTSB's final report recommended stronger FAA oversight of production approval holders and subtier suppliers, standards for heating sources and cell monitoring, objective self-heating tests, explicit safety-assessment assumptions, requirement-to-method traceability and training. It recommended that Boeing improve supplier oversight and safety-assessment validation and that GS Yuasa review manufacturing processes and employee training. The separate NTSB letter to Boeing records the company-focused recommendations without implying they were penalties.

JTSB recommended installed-representative tests, review of lithium-ion technical standards, re-examination of the 787 failure-rate estimate, heat-propagation review, assessment of contactor behavior, continuing study of internal shorts and improved battery quality. Its formal recommendation to the FAA preserves the distinction between demonstrated propagation and unresolved initiation. The FAA response record published by JTSB is evidence that the recommendation entered an international follow-up process, though the public attachment format does not provide a simple independent score for long-term effectiveness.

The 2014 Narita event was both success evidence and a warning

On 14 January 2014, after the redesign, a Japan Airlines 787 parked at Narita produced visible white smoke and main-battery messages. Examination found that cell 5 had overheated and its rupture disc had opened. Electrolyte residue remained in the enclosure and appeared near the external vent outlet. The surrounding electronics-bay area was clean and undamaged; the other cells retained voltage, though adjacent cell 6 showed limited thermal effects.

The Japan Civil Aviation Bureau's announcement and full assessment treated the event with useful balance. JCAB found that the redesign's second layer prevented cell-to-cell propagation and its third layer protected the aircraft. It concluded that safe-flight capability would have been maintained. But it also observed that the first layer had not prevented one cell from overheating and called for further reliability improvement and continued work on possible causes.

This event is the best public case-specific test of the containment architecture. It was not a staged certification test; it was a field failure in a modified battery. The outcome supports the inference that the redesign materially changed escalation. One cell failed, but the whole battery and surrounding bay did not reproduce Boston or Takamatsu damage. That is strong remedy evidence.

It is not proof that all possible failures are contained. One event cannot cover every cell location, state of charge, airflow, enclosure condition, vent obstruction, maintenance error or multi-cell initiation. Nor did JCAB find the overheating cause. Metallic particles, possible lithium deposit, wrinkles, electrolyte variation, condensation and cold environment were examined, but no objective evidence isolated the initiator. The event therefore validates the importance of containment while preserving the unresolved question of cell initiation.

What durable remediation evidence should look like

Cell-process evidence should include lot-level process capability for electrode alignment, winding perturbation, separator condition, weld debris, contamination, moisture and electrolyte fill; inspection detection rates; calibrated CT criteria; reject and rework trends; and approval records for process changes. A statement that quality control improved is a starting point, not a durability measure.

Battery-system evidence should include repeated abuse tests across production variation, temperature, age, state of charge and grounded installed configuration. It should demonstrate isolation, wiring integrity, contactor behavior, monitoring performance and pressure management. Results should show distributions and failures, not only passing exemplars.

Aircraft-containment evidence should include enclosure leak checks, vent-path inspections, burst-disc maintenance, corrosion effects, installation conformity and worst-case gas, heat and pressure testing. Because containment is now a last line of defense, maintenance of its seals and duct cannot be treated as incidental hardware upkeep.

Fleet evidence should connect removals, warnings, smoke or odor reports, cell venting, charger faults and maintenance findings to aircraft, battery and cell lots. Rates should be recalculated with confidence bounds and exposure denominators. A long period without another public grounding supports confidence, but absence of a headline is not the same as a published reliability dataset.

Governance evidence should show closure of audit findings, recurring review of assumptions, independent access to anomalous batteries, regulator visibility into subtier changes and defined escalation thresholds. Safety assurance decays if a validated configuration is followed by undocumented material, process, software or maintenance changes.

Configuration evidence should connect each aircraft installation to the exact enclosure, duct, charger, battery, cell population, maintenance revision and approved software or control logic in effect at the time. A passing test on one configuration cannot silently validate a later material substitution, altered inspection threshold or changed production step. Removed batteries with unusual voltage, odor, venting or thermal indications should be quarantined with recorded state of charge and operating history before destructive examination.

Investigators and regulators then need access to negative findings as well as dramatic failures, because an apparently intact removal may reveal the early stages of the mechanism that a burned battery can no longer preserve. This chain turns isolated maintenance events into usable precursor evidence and gives the type-certificate holder a defensible basis for deciding whether a trend is confined to one lot, one process state or the approved design itself.

Public evidence is uneven across these categories. The AD, certification activity, installed retrofit, accident reports and Narita outcome provide substantial evidence that the aircraft-level hazard was reduced. The public record does not disclose complete longitudinal cell-lot data, all supplier audit results, every enclosure test, current false-negative rates or an independently reproducible trend analysis. That gap does not prove poor performance. It limits how strongly outsiders can verify durability.

Unresolved questions

The first unresolved question is the exact microscopic initiator in each field battery. Boston was narrowed to an internal short in cell 5 or 6, but not to one surviving defect. Takamatsu was narrowed to likely cell 6 initiation, but not the short mechanism. Narita was narrowed to an internal short in cell 5, but candidate causes were not proved.

The second is why the cross-organizational review accepted non-propagation. The record identifies the test and traceability weaknesses, but it does not provide every internal discussion, dissent, schedule decision or approval rationale. It would be defamatory overreach to infer concealment, bad faith or deliberate evasion without evidence.

The third is how well manufacturing corrections performed over time. Post-event audits found and closed nonconformities, and the modified design accumulated service. Yet the public record reviewed here does not provide continuous independent process-capability or defect-escape metrics for GS Yuasa's 787 cells.

The fourth is whether later monitoring and standards changes fully closed the recommendation set. FAA's 2015 guidance and later standards work show institutional learning, but guidance can be advisory and recommendation status can turn on documented actions narrower than complete elimination of risk. Each current approval must be judged on its own certification basis and evidence.

The fifth is the exact limit of containment under multiple simultaneous or maintenance-degraded failures. The redesign was tested and the Narita event supplied field confirmation for a single-cell overheat. Public materials do not expose every worst-case proprietary compliance result. The correct conclusion is high confidence in material improvement, not a claim of physically impossible aircraft-level consequence.

Conclusion: certification must survive the unexplained cell

The 787 battery case is not a simple story of an unsafe chemistry corrected by a box. Lithium-ion technology brought legitimate performance benefits, and the modified architecture returned the fleet to service. The deeper failure was evidentiary: a safety assessment assumed that an internal short would remain bounded, while the supporting test did not represent the final installed system under the most severe relevant conditions. Manufacturing could introduce latent defects; monitoring might not detect them before runaway; and the certification chain did not require the battery and aircraft to survive the resulting propagation.

The investigations apportioned control with precision. GS Yuasa's process allowed defect mechanisms capable of causing shorts. Thales had integration and subtier responsibilities. Boeing owned aircraft-level requirements, supplier integration and the compliance showing. Authorized representatives and FAA engineers reviewed the evidence, and FAA retained certificate and airworthiness authority. Airlines and crews controlled immediate operations. NTSB and JTSB supplied preventive findings while leaving civil and criminal liability to other institutions.

The recovery succeeded because it stopped depending on one perfect explanation. It reduced initiation, impeded propagation and contained failure outside the occupied and equipment spaces. Narita then showed why that architecture mattered: the first layer did not prevent a cell event, but later layers prevented the earlier cascade and bay damage. That outcome is more persuasive than a promise that cells will never fail.

The enduring accountability test is therefore straightforward. For a high-energy component whose initiating defect may be rare, microscopic and destroyed by the event, safety cannot rest on the absence of observed failures in a similar product or on a single favorable abuse test. The applicant must expose assumptions, test the final installed configuration at severe credible conditions, control subtier manufacture, monitor the fleet with usable denominators, and preserve a last line of defense that remains effective when prevention and diagnosis fail. The regulator must independently challenge that chain.

The Boeing 787 returned to service when containment became part of the proof; durable accountability requires keeping that proof current.