Semi-Solid State Battery Reliability for Aerospace: An Engineer’s Qualification Playbook
Most of my career has been spent proving that lithium batteries will not do something spectacular on an aircraft. I have watched more thermal-runaway test footage than any engineer should, and I have torn down enough swollen NMC packs to be permanently suspicious of any chemistry that arrives with a marketing brochure. So when semi-solid state cells started appearing in aerospace requests for quotation three years ago, my first instinct was to ask not “how good are they?” but “how do we prove they are good enough?” A semi-solid state battery is a gel-polymer lithium battery: a cell whose electrolyte is immobilized in a polymer-gel matrix with a controlled fraction — typically 5–15% — of residual liquid electrolyte. That construction changes the failure physics in ways that matter enormously for aerospace reliability, and it also introduces new qualification problems that a standard automotive-grade lithium battery never has to face. This article is the qualification playbook I wish someone had handed me when our team first put a semi-solid module on a shaker table.
What Reliability Means When the Failure Condition Is Catastrophic
In ground applications, reliability is usually a cost argument: an unplanned outage costs downtime, so we buy availability. On an aircraft, reliability is a certification argument with hard numerical targets. Under 14 CFR 25.1309 (and its EASA counterpart CS 25.1309), failure conditions are classified by severity and bounded by probability: a catastrophic failure — loss of the aircraft — must be shown to be extremely improbable, less than 1 × 10⁻⁹ per flight hour; a hazardous failure less than 1 × 10⁻⁷ per flight hour; a major failure less than 1 × 10⁻⁵.
Those numbers drive everything about how an aerospace battery is designed and documented. The process starts with a functional hazard assessment (FHA): what happens if the battery fails to deliver, delivers uncontrolled, vents, or ignites? For each failure mode we then build a FMECA — failure modes, effects and criticality analysis — and allocate failure-rate budgets down to subsystem level. On one eVTOL program I worked, the battery system was allocated a hazardous-event budget of 1 × 10⁻⁷ per flight hour, which we split roughly as 1 × 10⁻⁸ for cell-induced thermal runaway, 1 × 10⁻⁸ for protection-chain failure, and the remainder across contactors, sensing, and software.
Two consequences follow that surprise engineers coming from the EV world. First, the paper trail is as much a part of the product as the hardware: a semi-solid cell with excellent test results but no traceable lot genealogy, no process audit trail, and no design-basis documentation is unusable in aerospace, however good its data sheet looks. Second, we never rely on a single protection layer. The single-failure criterion — the system must tolerate any one failure without a hazardous condition — means every safety-critical function gets at least two independent means of protection, and “independent” means independent in physics, not just in wiring.
The Environment Will Find Every Weakness
Aerospace is not one environment; it is a stack of simultaneous stresses, and RTCA DO-160G is the standard catalog of them. A battery installed in an unpressurized equipment bay sees:
- Low pressure. DO-160G altitude testing runs down to 4.4 kPa — approximately 70,000 ft equivalent. At that pressure the boiling point of water drops below 30 °C, and any dissolved gas or residual moisture in the electrolyte wants to come out. Gel-polymer cells hold liquid in the matrix better than free-liquid pouch cells, but venting design and gasket breathing still dominate the mechanical design.
- Temperature. Typical operating requirements span −40 °C to +70 °C continuous, with −55 °C short-duration storage survivability. Cell chemistry limits are stricter than airframe limits: our semi-solid cells charge acceptably at 0 °C up to 0.5C with no lithium plating (verified by dQ/dV analysis), at −10 °C only at 0.2C, and below −20 °C we block charging entirely and let the heater bring the pack up. Discharge is far more forgiving — we have measured 88% of rated capacity available at −20 °C.
- Vibration and shock. Random vibration from roughly 5–500 Hz per DO-160G Section 8, plus operational shock pulses in six orientations and crash-safety loading per Section 7. This is where busbar torque, cell potting, and interconnect fatigue live or die. I have seen more field failures from a loose M6 fastener than from any exotic cell defect.
- Humidity, salt fog, and condensation. Pressurized cabins breathe; unpressurized bays see rapid depressurization transients that condense moisture on every cold surface. Silver-plated contacts inside a humid bay will grow sulfide films within months — we apply dielectric grease at assembly and inspect contact resistance quarterly.
- Electromagnetic environment. The battery management system must tolerate the aircraft’s own transmitters and lightning-induced transients. Radiated susceptibility testing per DO-160G Section 20 has caught BMS resets in three of the last five modules we qualified — always on the analog sense lines, never the digital bus.
The lesson from a decade of this work: cell chemistry gets the headlines, but in aerospace reliability the packaging, the interconnects, and the protection electronics fail first. Design the enclosure like it matters, because it does.
What Semi-Solid Chemistry Actually Changes
Here is the honest engineering assessment of what the gel-polymer construction buys you, and what it does not.
The reliability wins
- Thermal runaway does not propagate. In nail-penetration testing at 100% state of charge, our semi-solid cells peak at roughly 96 °C surface temperature and stay localized. Comparable NMC cells reach 500 °C or more and propagate to six adjacent cells within 90 seconds in an open fixture. For an aerospace reliability case, that single data point changes your entire fault-tree: a cell event becomes a maintenance action rather than a hazardous failure condition.
- Calendar aging is tame at high state of charge. Aircraft and HAPS batteries live at or near 100% SoC between missions — the exact condition that murders conventional lithium. Our 45 °C / 100% SoC / 30-day calendar test shows 1.5–2.5% capacity loss for semi-solid cells, versus 2.5–3.5% for LFP and 6–9% for NMC. At a more realistic 35 °C we measure about 2.1% per year. On a solar HAPS platform that summers at altitude with no thermal management, this is the difference between a two-year and a five-year replacement cycle.
- Less vent gas per event. Semi-solid cells produce roughly 40–60% less gas during an abusive event than free-electrolyte cells of the same capacity, which directly shrinks the enclosure overpressure design — our target is a pack that vents at 10–20 kPa with vent area sized around 0.02–0.05 L/Wh, and semi-solid chemistry gives comfortable margin against that.
- Energy density. At roughly 360 Wh/kg at cell level and 240–265 Wh/kg at pack level depending on structure, semi-solid packs fit into weight budgets that LFP simply cannot meet for the same mission energy.
The honest weaknesses
- Liquid fraction is a process variable, not a constant. Every semi-solid cell retains 5–15% liquid electrolyte, and lot-to-lot variation in that fraction shows up as DCIR scatter of 5–8% between production batches. You cannot assume uniformity; you must screen every lot.
- Stack pressure matters. The gel interface needs consistent compression — typically 200–400 kPa across the cell faces. A fixture that loses preload over vibration cycles quietly raises impedance and generates heat. We torque busbar hardware to 8–10 N·m (M6), mark it with paint pens, and audit torque every scheduled maintenance visit.
- Cold charging remains restricted. This is a lithium battery limitation, not a semi-solid one: 0 °C plating onset does not disappear with gel electrolyte. Budget heater power accordingly.
- Early production yield. Current semi-solid line yields run 82–88% versus 96%+ for mature LFP. That is invisible on a data sheet and entirely visible in your incoming inspection escape rate. Screen harder than the supplier does.
Architecture: Building Reliability You Can Prove
Chemistry gives you probability; architecture gives you proof. The structural decisions that let a battery system meet a 10⁻⁷ allocation are worth spelling out:
- Segment the string. A single 400 V series string turns one cell fault into a system fault. We build parallel-then-series: parallel cell groups with per-group protection, so a single cell failure degrades capacity rather than opening the string. On mission-critical buses we go further with dual isolated strings on independent contactors — either string alone carries the essential load.
- Two independent protection chains. The BMS software (developed under DO-178C, typically DAL C for non-propulsion, DAL B for eVTOL traction) runs overcharge and over-temperature protection, but a separate analog hardware chain — comparator-driven, directly wired to the contactor enable — must open the pack even if the microcontroller is dead. We have demonstrated this by killing the BMS mid-charge during qualification; the analog chain opened at the cell-level threshold every time.
- Contain, then vent, on purpose. Per DO-311A philosophy and 14 CFR 25.1353(c), a cell event must be contained: no explosion, no propagation beyond the originating cell, external surfaces below ignition thresholds. Between cells we install 1–2 mm mica or aerogel barriers; at the pack level, a dedicated vent path discharges overpressure away from the airframe and away from the crew compartment.
- Pyrotechnic or high-speed interruption where the mission demands it. eVTOL propulsion batteries get pyrofuses (<5 ms clearing) on the DC bus so a shorted powertrain cannot back-feed the pack during an autorotation-profile descent.
- Derate everything. Continuous current at 60–70% of cell rating, energy sizing at end-of-life 80% capacity plus 20% mission margin, and contactors rated ≥1.5× continuous current. In aerospace, the derating table is the reliability program.
The Qualification Campaign, Step by Step
Our standard aerospace qualification stack for a semi-solid battery system runs in this order:
| Stage | Standard / Test | Pass Criterion (typical) |
|---|---|---|
| Transport | UN 38.3 (T.1–T.8) | No leakage, venting, fire; mass loss <0.1% |
| Cell safety | IEC 62133-2 (crush, short, overcharge, thermal abuse) | No fire, no explosion |
| Aviation battery | RTCA DO-311A (altitude, overcharge, propagation containment, charging-failure tolerance) | No explosion, no propagation, surface temp limits met |
| Environment | DO-160G Sections 4, 5, 7, 8, 20 (temp/altitude, variation, shock/crash, vibration, RF susceptibility) | Full function, no BMS reset, DCIR drift <15% |
| Installation | 14 CFR 25.1353 / TSO-C179b / ETSO-C179a | Approval basis agreed with authority |
| Software/hardware | DO-178C (DAL B/C), DO-254 | Coverage and review artifacts complete |
Two practical notes from the test floor. First, sequence matters: run the mechanical profiles before the electrical abuse tests, because a vibration campaign that opens a weld or cracks a potting joint will show up as a short-circuit failure and send you chasing the wrong root cause. Our rule — verified on five programs — is vibration, then shock, then a DCIR measurement gate (drift must stay under 15% or the unit never enters abuse testing), and only then the thermal-runaway containment demonstration. Second, incoming lot screening is part of qualification, not procurement: cell date codes must be under nine months old at pack build, every lot gets a three-temperature, three-SoC DCIR curve, and each delivery includes a 45 °C / 100% SoC / 30-day calendar report. When two supplier lots differ by 8% in DCIR, I want to know before the module is potted, not after the flight-test campaign.
Keeping It Reliable in Service: Health Monitoring and Prognostics
Qualification proves the design; health monitoring proves the fleet. The battery telemetry we treat as non-negotiable on every aerospace program:
- DCIR trending. A 0.5C, 10-second pulse measurement logged at every ground turn. A drift of +30% over baseline is a yellow flag; +50% means the unit comes out of service. On our longest-monitored semi-solid fleet — 18 months of operational data — capacity retention ran 97.5–99% and DCIR drift stayed under 10% per 1,000 days, with the two +30% excursions both traced to loose busbar fasteners, not cells.
- Cell-voltage spread. Differential under 30 mV at rest indicates a healthy string; 50 mV triggers balancing review; anything above 100 mV at full charge is a micro-short investigation.
- Thermal gradients. More than 6 °C spread across the module under load means a blocked vent path or a degrading interconnect — both fixable on the ground, both dangerous in the air.
- Remaining useful life estimation. Combining coulomb-counted throughput, calendar age, and DCIR trend in a simple prognostic model lets us schedule replacement at 80% capacity rather than reacting to an in-flight derate. For LEO satellite duty — roughly 5,500 eclipse cycles per year at 25–35% depth of discharge — this is how you keep a five-year mission inside a battery warrantied for the full term.
Storage, Handling, and Air Transport of Spares
Reliability does not pause between missions. Semi-solid packs in storage hold 30–50% SoC at 10–25 °C, get a top-up every 90 days, and ship at shipping SoC with UN 38.3-compliant packaging per the air-transport provisions (for cargo battery assemblies, SAE AS6413 packaging practice applies on top of the base dangerous-goods rules). Every pack travels with its lot genealogy: cell date codes, DCIR acceptance curves, and torque audit records. That folder is not bureaucracy — it is the evidence base that turns a field anomaly from a fleet-grounding event into a single-serial-number note.
FAQ
Can a semi-solid state battery actually pass DO-311A today?
Yes, and we have done it. The propagation-containment requirement is where semi-solid chemistry has its biggest structural advantage — a nail test that peaks near 96 °C with no adjacent-cell involvement is dramatically easier to contain than an NMC event. The harder sections are altitude venting behavior and charging-system-failure tolerance, which are packaging and BMS problems regardless of chemistry.
How does low pressure affect a gel-polymer cell?
The immobilized matrix suppresses bulk electrolyte migration, but residual moisture and dissolved gases still expand at 4.4 kPa. The design responses are a breathing-but-sealed enclosure with a hydrophobic vent membrane, cell-level swelling allowance in the compression fixture, and vacuum exposure as part of the qualification sequence — never an afterthought.
Do semi-solid cells survive the DO-160G vibration profile?
They do, but only with the compression fixture engineered for it. Our failures in early prototypes were potting gaps and fastener preload loss, never cell damage. Post-vibration DCIR drift under 15% is our gate, and torque-marked hardware with paint-pen audit points is the cheapest insurance in the whole program.
What derating should I use when sizing an aerospace battery?
Size energy at the end-of-life 80% capacity point plus 20% mission margin, limit continuous current to 60–70% of cell rating, and rate contactors at 1.5× or better. For eVTOL duty, remember the takeoff burst is the easy part — the five-minute contingency reserve at degraded pack health is what sizes the real system.
How do I screen incoming semi-solid cell lots?
Date codes under nine months, DCIR curves at three temperatures and three SoC levels compared against the lot datasheet, a 45 °C / 100% SoC / 30-day calendar-loss report under 3%, and dimensional checks that confirm stack-pressure fixture compatibility. Reject lots on any single criterion — a good price on an unscreened lot is the most expensive thing in this industry.
Semi-solid state chemistry has genuinely moved the needle on aerospace battery reliability: containment that used to require kilograms of barrier material now comes from the cell itself, and calendar aging at high SoC is no longer the dominant life limiter. But none of that matters unless the qualification campaign, the architecture, and the in-service monitoring are built to prove it. Chemistry gives you the margin; the program gives you the certificate.
