DO-311A Battery Safety Analysis
A battery-level fault tree analysis of uncontained thermal runaway, as required by DO-311A for the rechargeable lithium batteries of eVTOL aircraft and electric and hybrid-electric powertrains.
RTCA DO-311A, Minimum Operational Performance Standards for Rechargeable Lithium Batteries and Battery Systems, requires a battery-level Fault Tree Analysis (FTA). The following analysis applies it to a typical battery system for an electric Vertical Takeoff and Landing (eVTOL) aircraft, or an aircraft with an electric or hybrid-electric powertrain.
DO-311A requirements
Appendix C prerequisites
- Critical functions, including control and protective functions, that include airborne electronic hardware are designed and approved to DO-254 Design Assurance Level (DAL) A.
- Critical functions, including control and protective functions, that include software are designed and approved to DO-178 DAL A.
- A battery System Safety Assessment (SSA) is performed in accordance with SAE ARP4761. It includes a Functional Hazard Assessment (FHA), an FTA, a Failure Modes and Effects Analysis (FMEA), and a common mode analysis, and addresses the hazards identified in section 2.1.7.b.
- The FTA demonstrates that the critical functions of the battery and battery system, including control and protective functions, have a probability of catastrophic failure of 1E-09 or less.
Thermal runaway containment test
Section 2.4.5.5 specifies a battery thermal runaway containment test, triggered by overcharging (2.4.5.5.1) or overheating (2.4.5.5.2). Industry comments on DO-311A noted that the test does not relate failure severity to a probability objective, which is standard aerospace practice, and proposed a more robust, or a more plausible, single cell thermal runaway containment test, such as that of SAE J2464 section 4.4.5.
Appendix C gives an alternative test method, in which a pair of adjacent cells is driven into thermal runaway:
- The pairing takes account of spacing and heat transfer characteristics, to maximize the potential for propagation to other cells.
- For batteries of 10 cells or fewer, the number of pairs is at least the number of cells divided by 2, rounded up. For an odd number of cells, one cell is tested twice.
- For batteries of more than 10 cells, 5 pairs are tested at the following locations, as applicable: center, wide face, narrow face, corner, and edge. Batteries with many more than 10 cells, or with complex geometries, may need more than 5 pair locations for comprehensive coverage.
| Cells per battery | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 or more |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Minimum number of batteries to test | n/a | 1 | 2 | 2 | 3 | 3 | 4 | 4 | 5 | 5 | 5 |
Minimum number of batteries to be tested, from DO-311A Table C-1.
The trigger is either overheating or overcharging. Overheating is normally used, although the heater wiring can interfere with the test. The test report includes:
- The data and evidence showing compliance with the prerequisites of section C.1.
- Any rupture of the housing of the Equipment Under Test (EUT).
- Any emission of gas, smoke, soot, or fluid from the EUT.
- The voltages and temperatures of the trigger cells, the external temperature of the EUT, and the temperature of any gases that exit it, as a function of time.
- Objective evidence, confirmed by post-test inspection, that at least the two trigger cells reached thermal runaway.
System architecture
The battery has 14 stacks of 12 cells in series. Each stack has its own temperature sensors, Resistance Temperature Detectors (RTDs), and balancing circuits, which report to the battery controller with the current shunts.
Fault tree analysis: uncontained thermal runaway
The top event is uncontained battery cell thermal runaway, the hazard. It results from thermal runaway in any battery, or from an uninterrupted over voltage or under voltage when the protection of any of the 4 batteries fails:
Each battery stack is analyzed with the following branch. Thermal runaway in 2 or more of its 12 cells is uncontained; a battery’s probability, UBCTR1, is 14 times that of one stack:
Corrected November 2026: the first event under the over voltage gate is Battery 1 over voltage protection. It was previously shown as Battery 1 under voltage protection, which duplicated an event under the under voltage gate and gave a top-level probability of 9.957E-06.
For the safety assessment of the battery management system as a controller, see our STPA analysis of an Energy Storage System.