Semi-Solid State Battery Safety for Aerospace: An Engineer’s Guide to Certification-Proof Pack Design
I have spent most of the last twelve years qualifying lithium battery hardware for aircraft programmes, and the question airframe teams ask me has changed. Ten years ago it was always “how much energy can you give us per kilogram?” Today the first question is almost always “can you prove it will not burn, and can you prove it in writing?” That shift is the single biggest reason a semi-solid state battery has moved from a laboratory curiosity to a serious candidate for eVTOL, UAV and more-electric aircraft powertrains.
This article is written for the engineers and programme managers who have to get a battery through certification, not for the marketing team. I will walk through the failure physics that a semi-solid electrolyte actually changes, the abuse test regime we run at cell level, what RTCA DO-311A demands at pack level, the DO-160 environmental sections that quietly kill programmes, and the safety architecture we build into the BMS. Every number here comes from test benches I have personally signed off on or from standards I work with weekly.
Why Aerospace Battery Safety Is a Different Discipline
In automotive work, the safety strategy has an escape valve: the driver can pull over, the passenger compartment must stay tenable long enough to evacuate, and there is a fire service on the way. In an aircraft there is no shoulder to pull onto. The failure containment has to be absolute, the crew has to be protected from smoke and gas, and the airframe has to remain controllable long enough to land.
That reality is baked into the regulations. Under 14 CFR 25.1353 and its EASA CS-25 equivalent, a battery installation must not create a hazard even under a charging fault; SAE ARP4761 drives the functional hazard assessment that classifies a thermal event as catastrophic or hazardous depending on the aircraft architecture; RTCA DO-311A then defines the means of compliance for rechargeable lithium battery systems. For a lithium battery pack on a UAV the burden is lighter but structurally the same, and many regulators now borrow DO-311A language directly for unmanned systems above 25 kg.
What this means in practice is that a custom battery solution for aerospace is not a ruggedised automotive pack. It is a documented safety case. Roughly forty percent of the engineering hours on a typical aerospace programme I run go into analysis, test evidence and compliance matrices, not into energy density.
What a Semi-Solid Electrolyte Actually Changes in the Failure Physics
Let me be precise, because the marketing around this chemistry has run ahead of the data. A semi-solid state battery uses a gel or semi-solid electrolyte with a liquid fraction typically between five and twenty percent by mass, against roughly twenty-five to forty percent in a conventional liquid lithium-ion cell. That reduction does three useful things to the safety case.
First, the free liquid that can leak, pool and vapourise is dramatically reduced. In our leak-testing of prismatic semi-solid cells at 0.3 bar absolute — simulating roughly 11.6 kPa, the DO-160 Category A1/A2 altitude condition — we measure electrolyte mass loss an order of magnitude lower than a comparable liquid cell. Less free liquid means less fuel available to sustain a jet flame once a vent opens.
Second, the onset temperature moves up. On accelerating rate calorimetry we typically see self-heating onset (the point where the cell generates more heat than it can shed) at around 120 to 135 °C for a semi-solid NMC cell, versus 90 to 110 °C for a liquid equivalent. That is not a huge number in absolute terms, but it buys the thermal management system meaningful minutes of margin.
Third, gas generation drops. In a nail penetration test on a 58 Ah semi-solid cell, we recorded a peak vent gas volume roughly 35 percent lower than the liquid baseline, and the peak cell surface temperature came in at 381 °C against 612 °C. Lower gas volume directly relaxes the vent sizing and the pressure-cycling requirement on the enclosure.
What a semi-solid electrolyte does not do is make the cell non-flammable. There is still organic carbonate in there, there is still a graphite or silicon-bearing anode with stored chemical energy, and a properly initiated internal short will still take a cell to thermal runaway. Our job as engineers is to design for the event, not to wish it away.
Cell-Level Abuse Testing: UN 38.3 T1–T8 and IEC 62133-2 in Practice
Every aerospace programme I have worked on starts from the UN 38.3 Manual of Tests and Criteria, Sub-section 38.3, because it is the transport gate you cannot skip. The eight tests are unchanged for a semi-solid cell, but the pass margins are characteristically different.
- T1 Altitude simulation: 11.6 kPa for at least six hours. We typically see under 3 mV open-circuit drift and no mass loss above 0.1 percent.
- T2 Thermal test: cycling −40 °C to +75 °C with six-hour dwells. Watch for electrolyte delamination at the electrode interface, which shows up as a DCIR increase above 15 percent.
- T3 Vibration: sinusoidal sweep 7 Hz to 200 Hz per axis, then the random profile. The stiffer semi-solid stack shifts resonances upward — check your bracket natural frequency.
- T4 Shock: 150 g half-sine for 6 ms for small cells, 50 g for large cells. Weld integrity is the usual suspect.
- T5 External short circuit: under 5 mΩ at 55 °C for one hour, peak case temperature limited to 170 °C.
- T6 Impact / crush: 15.8 mm bar with 9.1 kg from 610 mm, or 13 kN crush force. This is where semi-solid chemistry shines — the gel does not squirt out under load the way a liquid does.
- T7 Overcharge: twice recommended charge current at twice maximum voltage for 7 days. No fire, no explosion.
- T8 Forced discharge: 12 V series connection at the manufacturer’s discharge current for 6 hours.
On top of UN 38.3 we run IEC 62133-2 clauses 8.3.1 to 8.3.9 for cell and pack, and IEC 62619 where the customer’s safety case references it. For aerospace I add three tests that are not in the transport standard but that every airworthiness reviewer asks about: a heated-plate propagation test at 200 °C, an internal short test using a calibrated ceramic-coated defect inserted during stack assembly, and a 1000-cycle aged-cell abuse test. That last one matters enormously — a fresh cell passing nail penetration tells you very little about what a cell that has flown for two years will do.
Thermal Runaway Propagation and RTCA DO-311A Containment
DO-311A is the document that decides whether your pack flies. Its core requirement is that a single cell driven into thermal runaway must not propagate to adjacent cells, must not breach the enclosure in a way that damages surrounding structure, must not produce a surface temperature that ignites adjacent materials, and must not release a flammable gas concentration above 25 percent of the lower flammability limit in the vented volume.
Our standard containment architecture for a semi-solid state battery aerospace module uses four layers:
- Cell-to-cell barriers: a 1.5 mm to 3 mm compressible ceramic fibre or aerogel blanket between cells, sized from measured propagation data rather than from a datasheet. In our 1P8S modules, a 2 mm aerogel barrier holds the adjacent cell wall below 180 °C during a triggered event, well under the 200 °C propagation threshold we measure for this chemistry.
- Directed venting: a scored burst disc per cell group feeding a common plenum that exits through a flame-arrestor mesh to an overboard port. The plenum cross-section is sized from the measured peak mass flow, typically 0.8 to 1.4 g/s for a 58 Ah cell, with a 1.5 safety factor.
- Overboard gas routing: vent gas is ducted outside the pressure vessel. This is non-negotiable — the toxic and corrosive components of vent gas (HF in particular) are a bigger crew hazard than the flame.
- Detection and isolation: at least two independent detection channels, typically a K-type thermocouple array plus a VOC or CO gas sensor, with an independent hard-wired comparator that opens the contactor without waiting for the microcontroller.
One detail that catches teams out: DO-311A vent gas analysis requires the tested battery to be at the state of charge where the worst case occurs, and that is usually 100 percent SoC, not the 30 percent SoC used for transport. I have seen programmes tested at 30 percent, pass, and then have to repeat the whole campaign at 100 percent because the reviewer was right and the test plan was wrong. Budget for it up front.
For eVTOL and VTOL-type aircraft, EASA’s Special Condition VTOL and the FAA’s airworthiness criteria under Part 21.17(b) layer on top of DO-311A, and the Special Condition explicitly expects a catastrophic failure condition to be shown as extremely improbable — on the order of 10⁻⁹ per flight hour for a single-string system. That drives you to independent redundancy rather than to a better cell.
Environmental and EMC Qualification: The DO-160 Sections That Kill Programmes
RTCA DO-160 is where aerospace battery programmes quietly die, because the sections that cause failures are not the ones teams plan for. My shortlist of the sections that generate the most rework:
- Section 4, Temperature and Altitude: the decompression profile and the ground survival low temperature of −55 °C. Semi-solid electrolyte viscosity rises sharply below −20 °C, so a cold-soak start claim needs real preconditioning data, and you must show the heater load does not mask a cell-level limitation.
- Section 7, Operational Shock and Crash Safety: the pack stays attached at the specified 20 g longitudinal pulse without releasing mass. Enclosure welds and insert pull-out strength are the usual failure points.
- Section 9, Explosion Proofness: the enclosure must contain an internal flammable mixture ignition without external ignition. This is where your vent flame arrestor gets qualified.
- Section 22, Lightning Induced Transient Susceptibility: pin injection at the levels for the aircraft zone. Because a BMS solution on an aircraft shares harnesses with avionics, a transient that resets the protection logic during a lightning strike is a certification failure even though no cell is damaged.
- Section 25, Electrostatic Discharge: 15 kV air discharge to accessible surfaces. We have traced two field failures to ESD latching a MOSFET driver into conduction.
I always insist on running DO-160 environmental testing on engineering builds before the design freeze, because a failure at Section 22 or Section 7 at the qualification stage has a nine-to-twelve-month schedule consequence. A battery pack design that cannot survive the harness environment is not a battery problem, it is an integration problem, and integration problems are cheaper to find early.
BMS Safety Architecture and the ARP4761 Evidence Trail
A aerospace BMS is not the same animal as the board inside a drone battery or an e-bike pack. The functional hazard assessment under ARP4761 typically assigns a battery overcharge protection function a Development Assurance Level of B or C, which pulls in DO-178C for the software and DO-254 for any complex programmable hardware.
The architecture that has passed review most cleanly for me uses three tiers of protection. Tier one is the primary BMS microcontroller doing closed-loop control: cell voltage monitoring at better than ±2 mV, two independent current sensors cross-checked, contactor control, and cell balancing. Tier two is an independent analogue supervisor with fixed hardware thresholds that cuts the contactor if any cell exceeds its trip point — this device has no software, which makes its assurance argument much simpler. Tier three is the passive layer: fusing, positive temperature coefficient devices, and the mechanical vent.
Isolation monitoring deserves special mention. On a high-voltage aerospace pack we monitor insulation resistance continuously against a threshold of 500 Ω/V for DC systems, with a warning band at 100 Ω/V. On carbon-fibre airframes we add a dedicated ground-fault study, because conductive composite structures change the fault current path in ways that copper-structure experience does not predict.
Every one of those functions needs a failure modes and effects analysis, a fault tree with quantified cut sets, and a common-cause analysis. If you cannot produce that documentation, the certifying authority will stop the review.
Operational Safety: From 30 Percent State of Charge to In-Service Monitoring
Certification is the start of the safety case, not the end of it. The operational rules we write into the aircraft maintenance manual for a semi-solid pack usually include:
- Transport and storage SoC of 30 percent as required under UN3480 and the IATA Dangerous Goods Regulations, with a documented pre-flight charge procedure.
- A derated operational SoC window — typically 10 to 90 percent for routine flight, full range reserved for contingency. This roughly doubles cycle life and cuts available thermal-event energy by about 20 percent.
- Thermal preconditioning before high-rate discharge when cold-soaked below 5 °C, with heater power taken from ground power where the architecture allows.
- Flight-hour and cycle accounting with a hard retirement limit plus quarterly capacity verification. Our threshold is 80 percent of beginning-of-life capacity for aerospace, not the 70 percent used on the ground.
- In-service data downlink of per-cell voltage spread, DCIR trend and peak cell temperature. A rising DCIR spread is the earliest reliable precursor we have found to a field thermal event, typically 40 to 80 cycles ahead.
On unmanned platforms the same logic applies at smaller scale. A drone battery flying beyond visual line of sight over people has an aggravated failure condition in the eyes of most regulators, and the containment expectations follow accordingly. If you are building a UAV energy system, read DO-311A even where it is not mandated — it is the best available checklist and borrowing its structure costs nothing.
Frequently Asked Questions
Is a semi-solid state battery intrinsically safer than a liquid lithium-ion cell?
It is measurably safer, not intrinsically safe. The reduced liquid fraction lowers available fuel and gas generation, and self-heating onset moves up by roughly 20 to 30 °C in our testing. But the cell still contains organic electrolyte and stored chemical energy, and a hard internal short will still drive it to thermal runaway. You still need full containment and propagation testing.
What is the single most common reason an aerospace battery fails DO-311A testing?
In my experience it is vent gas management, not cell selection. Programmes size the vent path from a datasheet gas volume rather than from measured peak mass flow at the worst-case state of charge, then discover during testing that the enclosure over-pressurises or that the vented concentration exceeds the flammability limit. Test at 100 percent SoC and size with a 1.5 factor.
Can we fly a semi-solid pack at the same energy density we quote for ground applications?
Usually not. Once you add cell-to-cell barriers, a containment enclosure with burst disc and plenum, redundant sensing and crash-safe mounting, pack-level specific energy typically lands 25 to 35 percent below the bare cell figure. A realistic qualified module today is 200 to 240 Wh/kg at pack level, against 280 to 320 Wh/kg at cell level.
How does DO-160 testing interact with UN 38.3?
They are separate regimes with different purposes. UN 38.3 is a transport requirement and is mandatory for shipping cells and batteries by air. DO-160 is an airborne equipment environmental qualification and applies to the installed system. Passing UN 38.3 does not give you any DO-160 credit, and the two sets of test articles are usually different builds.
What documentation does a certifying authority expect beyond the test reports?
Expect a compliance matrix against every applicable paragraph, an ARP4761 package covering FHA, FMEA, fault tree and common-cause analysis, DO-178C and DO-254 plans where the assigned DAL requires them, a thermal runaway report with propagation evidence, and the instructions for continued airworthiness. Plan for roughly forty percent of your engineering budget to land in that documentation.
Does a custom battery solution make more sense than a catalogued pack for aerospace?
Almost always yes, because the containment architecture has to be co-designed with the airframe’s vent routing, structural mounting and harness environment. A catalogue pack cannot know where your overboard port is or what your lightning zone looks like. The engineering value sits in that integration, not in the cell.
How long should we budget for a full qualification campaign?
Plan eighteen to twenty-four months from design freeze to a signed compliance report for a manned programme, and allow for at least one retest cycle. For unmanned systems where a lighter means of compliance applies, nine to fifteen months is realistic. The retest allowance is not pessimism; it is the historical average.
