Certification considerations for the configuration of a hydrogen-fuelled aeroplane

Abstract

Replacing kerosene with hydrogen as a fuel for propelling aeroplanes will undoubtably have ramifications for the existing certification basis and the necessary means of compliance. What this paper attempts to do is explain how a future hydrogen-powered aeroplane could be certified and how this will influence the aircraft’s design. Emphasis has been placed on the safety of hydrogen with regards flammability, ignition energy, cryogenic states and crashworthiness. The influence of certification on a future hydrogen-fuelled aeroplane’s configuration has been established. Lessons learnt from rockets are limited in scope. Consideration of hydrogen’s cryogenic and ambient temperature properties has established some fundamental safety principles. Fuel system crashworthiness influence on certification has been examined. An explosion prevention certification scheme has been developed. It is proposed to exclude oxygen from the fuel system and avoid accumulation of leaked or permeated hydrogen from adjacent zones. Three generic hydrogen-fuelled configurations have been considered for certification: adapting conventional airliner design, hydrogen-electric (fuel cell) propulsion and an unconventional approach. Hydrogen as a safe gas turbine fuel has been examined in technical and environmental terms. Further experimental work to close knowledge gaps in the aviation use of hydrogen has been suggested. In conclusion the necessary changes to the certification basis are outlined. Comments as to what the configuration of a future hydrogen-fuelled aeroplane might look like are provided. These observations are based on analysis of hydrogen’s properties, the existing certification basis, knowledge gaps, and what Special Conditions and Acceptable Means of Compliance might emerge in a future design Type Certification.

Nomenclature

AMC

Acceptable Means of Compliance

BLEVE

Boiling Liquid Expanding Vapour Explosion

CDCCL

Critical Design Configuration Control Limitations

CG

Centre of Gravity

CS

Certification Specification

DDT

Deflagration to Detonation Transition

FAA

Federal Aviation Administration

FBW

Fly-by-Wire

FHA

Functional Hazard Analysis

FMEA

Failure Mode and Effect Analysis

g

acceleration due to gravity

HPT

High Pressure Turbine

ICAO

International Civil Aviation Organisation

ISA

International Standard Atmosphere

L/D

Lift to Drag ratio

LFL

Lower Flammability Limit

LFLAS

Lower Flammability Limit Avoidance System

LH₂

liquid hydrogen

NDT

Non-Destructive Testing

PEM

Proton Exchange Membrane

PHA

Preliminary Hazard Analysis

SH₂IFT

Safe Hydrogen Fuel Handling and Use for Efficient Implementation

SINTEF

Stiftelsen for industriell og teknisk forskning (The foundation for Industrial and Technical Research)

STP

Standard Temperature and Pressure

SVP

Saturated Vapour Pressure

TWA

Trans World Airlines

UERF

Uncontained Engine Rotor Failure

1.0 Introduction

The public perception of hydrogen in aviation usually invokes reference to the 1937 Hindenburg disaster [1]. This cannot be justified given the improvements in aviation safety over the intervening 84 years. An airline pilot was asked if she would be happy flying a hydrogen-fuelled aeroplane. Her response, after careful consideration was “Yes, if it was certified” (from a conversation between the author and Easyjet pilot Deborah Thomas on 30 March 2021). This paper tries to address this caveat by outlining the certification approach and its influence on the aeroplane’s configuration. Aircraft have perpetually advanced since the 1930s, perfecting wing shape, control surfaces and fuselage configuration. Propulsion has developed from crude piston engines to turbofans. Improvements in safety are now such that no single failure can be catastrophic, and combined catastrophic failures conditions must be extremely improbable (<10⁻⁹ per flight hour as discussed in Acceptable Means of Compliance (AMC) 25.1309 sections 7. Failure Condition Classification and Probability Terms and 8. Safety Objective [2]).

Numerous papers have been written on hydrogen-fuelled flight, but certification is not considered in depth. Brewer [3] discusses safe liquid hydrogen (LH₂) containment schemes (including “resistance to accidental penetrations”) and human exposure to cryogenic fuel. He states that to understand these risks ‘tests would involve carefully instrumented crashes of suitably modified surplus aircraft’. The Airbus Deutschland Cryoplane final report [4] does provide a brief safety review of hydrogen aboard the aircraft. It concludes that “Airworthiness requirements may be amended according to the specific behaviour of LH₂ and technical design solutions”. The only specific conclusion was that fuel tanks and equipment should not be placed in rotor disc burst impact areas.

The main rocket engines of NASA’s Space Shuttle were hydrogen fuelled. The LH₂ was stored in external tanks [5]. The Challenger disaster involved the catastrophic failure of one of these external tanks. The subsequent presidential commission [6] concluded that “the only possible overheating of the tank was the impingement of leaking Solid Rocket Motor gases. This resulted in the ultimate breakup of the External Tank”. One hundred thirty-five shuttle mission were flown [5]. Assuming each mission was ten days in duration gives a total fleet time of 3.24 × 10⁴ flight hours. CS 25 [2] requires the occurrence of catastrophic failures conditions to be less than 10⁻⁹ per flight hour. Catastrophic failure of the Challenger’s LH₂ tank was five orders of magnitude short of the CS 25 requirement. Comparing rocket and CS 25 certified aeroplane safety appears not to be justified.

2.0 Aviation safety and hydrogen’s physical properties

The rulemaking to prevent kerosene fuel tank explosions was long and tragic – Philippine Airlines Flight 143 (1990) [7], TWA 800 (1996) [8] and Transmile Air Service (2006) [9]. It culminated in 2008 with an extensive Certification Specification (CS 25.981 Fuel tank explosion prevention), Acceptable Means of Compliance (AMC 25.981) and Appendices M and N (Fuel tank flammability exposure and reduction means) [2]. When compared with kerosene, hydrogen has the disadvantages of a much wider flammability range and 1/15^th the ignition energy, but it has the advantage of a much higher Lower Flammability Limit (LFL 4.1% cf. 0.7%), as illustrated in Table 1.

Table 1. Ignition characteristics of hydrogen cf. Jet A1

Kerosene based fuels (such as Jet A-1) require vaporisation before mixing with air to form an explosive mixture. Therefore, CS 25 Appendix N [2] defines upper and lower flammability limits in terms of altitude dependent flash point temperatures. “Liquid Hydrogen vaporizes rapidly on release” [12] and so LH₂ flammability limits are appropriately defined as percentage concentrations in air. Another consideration is which hydrogen thermodynamic phase is most suitable for aviation. Table 2 compares standard temperature and pressure (STP), volumetric energy density and respective ratios for liquid, gaseous and supercritical hydrogen with Jet A1 fuel. LH₂ maximises volumetric energy density over compressed gaseous and supercritical hydrogen but in energy terms is over four times bulkier cf. Jet A1. Compressed gaseous and supercritical hydrogen have the advantage of not requiring cryogenic storage, but the tanks would be much heavier.

Table 2. Jet A-1 volumetric energy cf. hydrogen

The stress in the walls of a thin-walled spherical pressure vessel is given by:

\begin{equation*} \sigma = Pd/4t \end{equation*}

Retaining the same stress level (σ) and tank diameter (d) while increasing internal pressure (P) will result in a proportional increase in wall thickness (t). Increasing tank pressure from 1 bar (LH₂) to 350 bar (gaseous hydrogen) or to 700 bar (supercritical hydrogen) will result in 350- or 700-fold increase in wall thickness and therefore tank weight. Maximising volumetric energy density minimises additional drag. The bulkier the tank, the greater the extra wetted and/or frontal area. Tank weight and bulk considerations suggest that a CS 25 [2] certified hydrogen-fuelled aeroplane would utilise low pressure LH₂. LH₂ requires pressurisation, and LH₂ tanks might require removal for non-destructive testing (NDT) [16]. This excludes directly utilising conventional wing box structure for storing fuel as it is not designed to withstand pressurisation, it cannot be removed for NDT nor probably provide the bulk LH₂ volume for a kerosene comparable range. LH₂ fuel tank installations will be more akin to the range extending auxiliary tanks on today’s airliners. The requirement to pressurise LH₂ to maintain its thermodynamic state can be exploited to prevent not just fuel tank explosion, but detonation within the entire pressurised LH₂ fuel system.

Pressurisation will exclude oxygen, effectively akin to inerting the ullage of a kerosene fuel tank.

A LH₂ fuel system can be thought of as a series of pressure vessels interconnected by pumps, valves and heat exchangers. In this respect CS 25.981 Fuel tank explosion prevention [2] now becomes applicable to the entire pressurised LH₂ fuel system. A pressurised system facilitates the exclusion of oxygen such that the “fire triangle” becomes the “fire line” (Fig. 1). If oxygen is not present, then possible ignition sources become a secondary consideration.

Figure 1. Explosion prevention – kerosene tank vs. pressurised LH2 fuel system. (Source: author).

LH₂ can condense and freeze oxygen. Solid oxygen in an excess of LH₂ can be detonated by impact with an explosive yield greater than an equivalent weight of trinitrotoluene (TNT) [17]. The impact velocity of a turbine disc fragment would be sufficient to detonate such a mixture (see Appendix 1: UERF Kinetic Energy Estimates). LH₂ system failures leading to air ingress and oxygen freezing must be shown to be extremely improbable in accordance with CS 25.1309 [2]. Such failures could only be identified following comprehensive test and analysis of a specific and detailed LH₂ system design. One plausible scenario would be failure to follow fuelling or post-maintenance recommissioning procedures. “Air in a system must be purged prior to putting hydrogen in the system. Likewise, hydrogen must be purged from a system before it is opened to make repairs or do maintenance” [11]. It would be prudent for purging procedures in the Aircraft Maintenance Manual to be approved by the Airworthiness Authority. It would also be sensible to consider positioning the refuel coupling and gallery outside of Uncontained Engine Rotor Failure (UERF) trajectories [18], removing one source of detonating shock.

The failure mechanisms for pressurised LH₂ tanks and systems are expected to behave significantly differently to conventional (typically unpressurised) kerosene systems. Violent structural failure, large releases of hydrogen, boil-off and high flammability are some of the rotor burst effects that need to be considered in addition to any range loss from fuel leaks. For these reasons it is unlikely that a LH₂ pressurised fuel tank could be located in a rotor burst zone and shown to be compliant with CS 25.903(d)(1) [2]. Other LH₂ fuel system components such as lines, valves, pumps etc. that cannot be located outside of this zone will need special consideration to avoid hazard to the aeroplane and occupants. For these reasons it is expected that the rotor burst requirement will shape the architecture and location of critical LH₂ components.

3.0 Thermodynamic considerations

To maximise volumetric energy density LH₂ should be stored in the ‘corner’ point of the Liquid Vapour Phase, liquid and saturated vapour phases (SVP) in tenuous equilibrium (Fig. 2). At a cryogenic temperature of around 22K (−251^oC) the entropy of the LH₂ is so low that it will “crave” heat. At the same time LH₂ volume is drawn from the tank to feed the engine. Warming the LH₂ via a heat exchanger before feeding to the engine could result in phase changing to supercritical, but there is a little head room as the supercritical phase does not occur until 13 bar and 30K is reached. This likely phase change marks the demarcation between aircraft and engine fuel systems.

Figure 2. LH₂ and phase equilibrium. (source: Ref. (19) and annotated by author).

“In terms of liquid hydrogen systems control and perhaps use of hydrogen boil-off needs to be explored” [12]. Cryogenic fuel tank thermal protection schemes must minimise heat flow into the LH₂. Any absorbed heat should be into the cold vapour above the LH₂ (Fig. 3). Boil-off could be minimised by a passive double vacuum jacket or actively by cryogenic cooling. Failure modes for the tank pressure control means that result in hydrogen release should be identified and understood [12]. Hydrogen should not be vented under normal operation as it is potentially damaging to the environment [20]. As required by CS 25.1309 [2], the pressure control function of the fuel system should be identified, and an analysis carried out to determine the hazard to the aircraft if this function should fail. This may include hazard as a result of venting in addition to tank integrity failure. Normal process would apply to show that by System Safety Assessment/Failure Mode and Effect Analysis (SSA/FMEA) that the failure probabilities meet the safety objectives identified in the Functional Hazard Analysis (FHA). CS 25.965(d) [2] requires that the design of a pressurised fuel tank to withstand maximum pressures is demonstrated by analysis or testing. Given the nature of hydrogen fuel tanks and systems, it is likely that some additional guidance unique to these systems may be required to assist demonstration of system integrity.

Figure 3. Basic elements of a LH₂ fuel system. (source: author).

An arrangement centred on passive vacuum insulated tanks will lead to heavy tank installations once thicknesses have been sized for buckling and pump-down systems added to maintain vacuum. Active cryogenic cooling and/or liquefaction will facilitate lighter tank installations but at the cost of increased system complexity and additional system weight. An intermediate mix of passive and active means to maintain thermodynamic phase equilibrium will require a clearly defined zero boil-off design point. The choice of a fuel tank/pressurisation/cooling/pressure relief integrated design scheme will influence aircraft design, given the tank weight and bulk. A high-pressure ambient temperature hydrogen system would avoid boil-off, but at a cost of even more bulk and weight. Figure 3 outlines the basic elements of a LH₂ fuel system. It has not been developed to include redundancy, cross-feeding, non-return valves, sensing elements, etc.

The Norwegian Safe Hydrogen Fuel Handling and Use for Efficient Implementation (SH₂IFT) project conducted experiments in September 2021 to determine what could happen if a LH₂ storage tank caught fire. Three experiments with 1m³ tanks were performed. The tanks were vacuum insulated and performed with two insulation materials: multi-layer insulation and perlite. A propane burner attempted to initiate a Boiling Liquid Expanding Vapour Explosion (BLEVE). “We performed three BLEVE tests where one of them indeed resulted in a BLEVE. We also did about 75 releases of liquified hydrogen into a basin containing water with the release point just above water (50cm above the water pointing downwards) and under water (30cm under the water surface horizontal and vertical downwards) to look at the consequences there. The original idea was to see whether we could get so-called Rapid Phase Transitions (RPTs). Although a violent evaporation of the hydrogen occurred real RPT’s as known to happen when releasing LNG or liquified nitrogen onto/into water did not occur. However, the majority of the releases ignited due to a yet unknown reason” (e-mail Kees Van Wingerden SINTEF 19/04/22). Results are expected to be published in the Journal of Loss Prevention in the Process Industries June 2022.

4.0 Crashworthiness

Certification requirements [2] for emergency landing conditions, on land or water, are equally applicable to kerosene and LH₂ fuel systems and are as follows:

• 25.561 Emergency landing conditions

• 25.562 Emergency landing dynamic conditions

• 25.563 Structural ditching provisions

• 25.721 Landing gear

• 25.801 Emergency provisions – ditching

• 25.963(d) Fuel tanks – emergency landing conditions

• 25.994 Fuel system components in a nacelle – wheels-up landing

A Special Condition for 25.963(d) to mention additional hazards from LH₂ fuel release, such as cryogenic temperature LH₂ and risk of asphyxiation would be needed. The requirements for no fuel release in or near the fuselage, or near the engines in quantities sufficient to start a fire in otherwise survivable emergency landing conditions remains “business as usual”. Requirements 25.563 Structural ditching provisions and 25.801 Emergency provisions – ditching may require a Special Condition. Any additional hazards or damage posed by collapse of external doors, windows, or other frangible structures with subsequent water ingress and impingement on LH₂ fuel tanks, systems and insulation would need to be addressed. What will be needed is guidance, in the form of an Acceptable Means of Compliance (AMC), for the existing crashworthiness requirements. FAA Advisory Circular Auxiliary Fuel System Installation [21] provides a good starting point for considering the crashworthiness of a hydrogen-fuelled aeroplane. As mentioned in 2.0 above volume and the possible need to remove LH₂ tanks for NDT excludes use of wing box structure for fuel storage. In this respect installation of a LH₂ fuel tank and system would be more akin to the installation of range-extending auxiliary cargo or tail trim tanks on kerosene-fuelled aeroplanes.

25.561(c) requires equipment, cargo in the passenger compartments and any other large masses to be positioned so that if they break loose, they will be unlikely to penetrate fuel tanks or lines or cause fire or explosion hazard by damage to adjacent systems. AMC guidance should make it clear that for a LH₂ fuel system any cryogenic cooling system and associated insulation would be part of the fuel system i.e. the “adjacent systems” mentioned above. For example, damage and failure of the cryogenic system or damage to insulation during an emergency landing as outlined by 25.561 that could cause hazard by overpressure and boil-off will need to be addressed. The type of hazard, not just fire, will need to be explained e.g. direct hazard to occupants by very cold LH₂, asphyxiation and loss of escape provisions. Table 3 provides a brief summary of forward and vertical crash-landing conditions.

Table 3. Forward and vertical crash-landing conditions

CS 25.561(b)(3) [2] also mandates inertial accelerations of 3g upward, 3g sideward on the airframe, 4g sideward on seats and their attachments and 1.5g rearward.

Sufficient vehicle structural crush distance should be available to avoid cryogenic fuel tank and system elements from ground contact under the loading conditions of Table 3. Compliance may be shown by analysis and where necessary by test. The analysis should identify the failure mode and define the interaction between the tank with fuel system elements and adjacent structure and between adjacent tanks. Structural deformation must be shown to be controllable and predictable, as required by 25.965 [2]. Bottom and lower structure must be adequate for tank load distribution and protection against rupture in crash landing. Consideration should be given to eccentricities introduced into the basic airframe from cryogenic fuel tank attachments. If there is a possibility that a wing-mounted tank will break away in a crash landing, then in addition to showing that there will be no likelihood of fire, the trajectory of the released tank will need to be assessed for subsequent trajectory and hazard to the aircraft and its occupants.

For these reasons it is expected that crashworthiness requirements will shape the aeroplane’s architecture and location of critical LH₂ components.

5.0 Hydrogen explosion prevention

As discussed in Section 2 the exclusion of oxygen from a pressurised LH₂ fuel system, combined with ignition source prevention, will eliminate the risk of explosion in the system itself. What now becomes pertinent is the risk of explosion in areas adjacent to the LH₂ fuel system. Because hydrogen consists of such a small molecule (Fig. 4), natural permeation through pipes, connections, etc. will be inevitable. Only when hydrogen accumulates over time in a confined area will there be a risk of a flammable mixture.

Figure 4. Kerosene and hydrogen molecules compared. (Source: File:Hexane-3D-balls.png Wikimedia Commons).

If the LH₂ tanks and system were installed on the outside of the aeroplane, then any permeated hydrogen would not be confined and would not accumulate. Most likely this would not be the case, as hydrogen fuel system elements might have to be installed within the fuselage contour and wing box, for example. A secondary barrier would be required to isolate flammable hydrogen/air mixtures from the rest of the aircraft. The space between such a barrier and the LH₂ tanks, pipes, etc. would also have to be considered as part of the LH₂ fuel system. Taking this definition of the fuel system then leakage within the aircraft contour due to failure of the secondary barrier would have to be assessed. Table 4 correlates this approach with existing certification requirements.

Table 4. Explosion prevention and fire protection requirements applicable to LH₂ fuel systems

Compliance with 25.1309 Equipment, systems and installations [2] will be required for the LH₂ fuel system, and any other systems that might present ignition sources, breach of barriers, etc. for fire, explosion and any other hazards associated with LH₂ fuel systems. Existing Appendix M [2] fuel tank flammability reduction and Appendix N [2] flammability reduction system analysis and compliance demonstration requirements shall have to be rewritten to address the specifics of a LH₂ fuel system. Exploiting the higher hydrogen LFL (cf. kerosene) will be a key point to consider in adapting these requirements. AIR 6464 [22] provides discussion of low (<25% LFL), medium (>25% LFL) and high (100% LFL) leakage scenarios into a ventilated enclosure. Mitigation by hydrogen diffusion, passive and active ventilation is proposed. Safeguards for Entering Permit-Required Confined Spaces states “Minimum acceptable entry conditions that must exist in a permit space to allow entry – Hydrogen content shall be less than 10% of LFL (less than 0.4% by volume)” [11]. So additionally, if the LFLAS is triggered at 10% of the LFL then passengers and crew will not be exposed to the risk of asphyxiation. There is a lesson to be learnt from The Nimrod Review [23] “An appreciation of the increasing trend of fuel leaks may have given pause for thought by those responsible for completion of the Nimrod Safety Case.” The same can be said for hydrogen fuels systems, but with foresight rather than hindsight. Testing will be required to understand hydrogen permeation and leaks under pressure altitude cycling and vibration [24]. From the onset trend analysis should be undertaken to understand how hydrogen fuel systems “leak”, from the first rig testing of system elements, through iron-bird complete system testing and eventually to experimental flight tests.

Deflagration is characterised by a subsonic flame velocity and relatively modest overpressure. Detonation is characterised by supersonic flame velocity and substantial overpressure. Unburnt gas is compressed to above its autoignition temperature. Presently there is no theory that can predict deflagration to detonation transition (DDT), but it is believed that partial confinement and turbulence introduced by multiple obstacles can induce the transition. If the fuel system installation could be engineered to avoid DDT of leaked or permeated hydrogen then a catastrophic failure might be adverted, noting that the levels of heat emitted from a hydrogen flame are significantly less than that from hydrocarbons. This is highly speculative given the lack of understanding of DDT [12]. Demonstrating that a “non-hazardous” deflagration always occurs following ignition for all cases would be extremely difficult. Ignition sources must still be assessed irrespective of flammability, so such an approach could only be seen as complementary to flammability mitigation and ignition prevention. See Fig. 5.

Figure 5. Potential route to certification utilising a Lower Flammability Limit Avoidance System (LFLAS). (Source: author).

The hazards associated with LH₂ spillage and subsequent pool behaviour needs further research. It is understood that the ENABLE H2 [25] project is conducting experimental research into this subject, but it is not known if the results will be published in the public domain.

6.0 The influence of the certification basis on the possible configurations for hydrogen-fuelled aeroplanes

There are many safety considerations for a hydrogen-fuelled aircraft. LH₂ tank and fuel system location with respect to ignition prevention, flammability and crashworthiness, susceptibility to particular risks, passenger egress, stability and control are certainly challenging points for certification.

6.1 Adapting the conventional

Figure 6 depicts a conventional airliner configuration adapted for LH₂.

Figure 6. Over-wing LH₂ tank gas turbine arrangement. (source: author).

This illustration benefits from the LH₂ fuel system being separate from the pressure cabin (25.863) [2], redundancy in engine feed as two tanks feed one engine (25.953) [2]. The tank walls are in contact with the outside environment eliminating the need for a secondary fuel tank barrier (25.981(a)) [2]. The fuel system is contained within the wing and with no cross-feed, facilitating a secondary barrier in which elimination of ignition sources is eased by fewer systems routed through this area (25.1309) [2]. The LFL is avoided by ventilation.

In the event of a crash landing and fuel tank release, it would have to be shown that there was no risk of fire and the trajectory of the tank assessed for any hazard to the aeroplane and its occupants (25.963(d)) [2]. Hazards posed by water impingement on LH₂ tanks and systems during ditching would have to be assessed (25.801(b)) [2]. Consideration of rapid passenger emergency egress (25.803) [2] would have to consider possible cryogenic and asphyxiation hazards in addition to fire. The LH₂ tanks are positioned to avoid UERF debris trajectories (25.903(d) [2]. It would have to be established that the neutral point was always behind the aft CG limit, allowing for destabilizing effects, such as those due to slipstream, structural distortion and air compressibility, which move the neutral point forward (25.27) [2]. Heavy wing-mounted LH₂ tanks will increase the aircraft’s moment of inertia about the x-axis. The possible effect on spiral stability, gradually increasing angle of bank, rate of descent, coordinated turns and levels of manoeuvrability free of stall warning would have to be assessed (25.143(h)) [2].

6.2 Hydrogen-electric propulsion

Figure 7 illustrates a scheme for a propulsion system based on a hydrogen-fuelled fuel cell.

Figure 7. Hydrogen-electric propulsion system. (source: author).

Gaseous hydrogen is fed to the anode and oxygen (air) is fed to the cathode. A catalyst at the anode separates the electrons (e-) from the hydrogen atoms. The Proton Exchange Membrane (PEM) allows the positively charged hydrogen ions (H⁺) to pass to the cathode. The electrons pass through the propulsive electrical load to the cathode. At the cathode the electrons, hydrogen ions and oxygen combine to produce water. The propulsive electrical load consists of the entire electrical power distribution, power management and electrical engines network necessary to drive the propellers. The fuel cell will require cooling. This is depicted as a circuit containing a heat exchanger with cooling airflow. The hydrogen fuel system will require a secondary barrier as discussed in Section 5 (Fig. 5) above, including means to avoid the LFL being reached in between fuel system primary and secondary barriers.

The fuel cell system will have to address the failure conditions and criticalities determined by safety assessments. AIR 6464 [22] provides comprehensive background on installation of on-board fuel cells to provide auxiliary power, including design for safety. Destructive fuel cell testing has been conducted by the FAA [26]. Deliberate loss of coolant leads to the fuel cell plates shorting and igniting hydrogen. An intentional short circuit damaged the PEM, leading to H₂/O₂ cross-over, which subsequently ignited. Planned H₂/O₂ crossflow tests, with normal and the short circuit loads resulted in significant external damage, O₂ ports fire, majority of fuel cells fused and localised heavy damage. An unplanned H₂ leak was attributed to a faulty connection to the fuel cell stack. There were ample means to detect these failures before becoming catastrophic:

• H₂/O₂ supply pressure fluctuation

• Coolant temperature increase

• Stack temperature increase

• Change in stack current/voltage characteristics

• Reacted exhaust gas temperature change

• Stopping the H₂ and O₂ flow resulted in rapid self-extinguishing

The O₂ (air) supply may require a compressor, failure of which should be the subject of a Particular Risk Analysis in accordance with CS 25.1309 [2]. Appendix 1 provides an estimate of kinetic energies associated with various sources of discrete damage.

A fuel cell stack would provide the power required for operational of all connected loads during all intended operating conditions. An AMC would have to be established for climb with one engine (propulsive unit) inoperative (25.121) [2]. The impact on control and manoeuvrability would also have to be established (25.143) [2]. A FMEA for the integrated hydrogen-electric propulsion system (Fig. 7) would identify critical elements leading to loss of thrust. The critical failure paths through the system’s functional elements would need to be identified to establish:

1. (i) The percentage loss of thrust

2. (ii) Whether the loss of thrust was distributed across all propulsive units or only affecting one

3. (iii) Any drag associated with such loss of thrust e.g. propeller feathered or windmilling

4. (iv) Resulting moment about z-axis due to extra drag from the blades of the failed propulsive unit

5. (v) The extent of the effect on spiral stability from (iv) above and it’s dependency on failed propulsive unit position

6. (vi) Common mode analysis in accordance with ARP 4754 [27] to ensure that enough redundancy has been incorporated in the hydrogen-electric propulsion system to avoid any single catastrophic failure. The compliant architecture will influence the aeroplane’s configuration as regards the number and position of propulsive units.

Forced air cooling follows Newton’s law of cooling. The rate of cooling is given by Equation (1):

(1) \begin{equation} \frac{{dQ}}{{dt}} = hAT\left( t \right) - Tenv \end{equation}

Where:

$\dfrac{{dQ}}{{dt}}$ is the rate of heat transfer

h is the heat transfer coefficient

A is the heat transfer surface area

T(t) is the temperature of the surface at time t

$Tenv$ is the temperature of the adjacent environment

The rate at which the cooling system’s heat exchanger dissipates heat is proportional to the difference between T(t) and $Tenv$ . This infers that if the fuel cell were to run hotter, more heat would be dissipated for the same heat transfer area. This is an important consideration for minimising parasitic drag and weight attributed to the cooling system.

6.3 An unconventional approach

The final “worked example” for certification discussion is shown in Fig. 8.

Figure 8. Variation on the gondola [28] concept. (courtesy of Nangia & Hyde).

This configuration avoids installing LH₂ tanks and fuel system within the fuselage contour allowing the gondola and wing structure to act as secondary barriers. This facilitates the application of ignition prevention (25.981(a)) [2] within these areas and LFL avoidance measures, e.g. ventilation. The gondola offers the possibility of designing for deflagration as opposed to detonation of accumulated hydrogen. The arrangement avoids placing LH₂ tanks (and perhaps the majority of the fuel system) in the UERF trajectories (25.903(d)) [2]. The dedicated LH₂ housing structure lends itself to incorporation of crushable structure (25.965) [2] to protect the LH₂ tanks under crash conditions (25.561) [2]. The asymmetric concept has ameliorative consequences in the event of crashworthiness precautions being breached. Any fire after LH₂ tank rupture would be remote from the passengers, leaving a reasonable chance of emergency egress. Rapid passenger emergency egress (25.803) [2] would have to consider possible cryogenic and asphyxiation hazards in addition to fire, particularly from the starboard over-wing exits.

Conventional swept wing airliners have the advantage of sequencing wing tank fuel use in flight and filling during fuelling to manage longitudinal CG position. The unlikelihood of utilising wing box structure for LH₂ tanks is discussed in Section 2 above. LH₂ distributed between two tanks in the gondola would provide an alternative arrangement for ensuring that the neutral point was always behind the CG aft limit. This unusual configuration would require testing and analysis of ditching qualities (25.563 and 25.801) [2].

Body main landing gear mounted in fuselage and gondola combined with an offset nose gear [28] would require guidance in the form of an AMC for 25.495 Turning, 25.499 Nose-wheel yaw and steering and 25.503 Pivoting [2]. Careful application of wheel and tyre failure models (AMC 25.734) [2] would be needed to ensure that the LH₂ tank and fuel system was not put at risk.

Because of the symmetry of a conventional aircraft in plan view, a pitching motion does not produce any rolling or yawing motion. In side elevation, however, a conventional aircraft is by no means symmetrical, and a yawing motion will induce a rolling motion and vice versa. A small pitching motion is also induced, and thus lateral stability is more complex than longitudinal stability – for a conventional aeroplane. For the unconventional example considered above (Fig. 8) longitudinal stability now becomes complex such that:

“Asymmetry in shape causes cross-coupling between longitudinal and lateral responses, a fly-by-wire (FBW) solution as on military aircraft will be needed to integrate the longitudinal and lateral motions, e.g. a pitch command will combine tail plane, rudder and aileron deflections to produce the appropriate motion” [28]. There is no CS 25 [2] requirement for an aeroplane to be laterally symmetric, but it is anticipated that guidance in the form of an AMC for CS 25.143 Control & Manoeuvrability will be needed.

7.0 Hydrogen as a safe gas turbine fuel

Figure 9 was produced when the feasibility of a supersonic combustion ramjet was under consideration. When the reaction time falls to the order of milliseconds and less, then an acceptable combustion length will be obtained even with mean gas velocities of thousands of metres per second. The fast flame path of hydrogen immediately lends itself to supersonic ramjet application but complicates the situation for a gas turbine.

Figure 9. Reaction times for combustion of hydrogen in air. (Courtesy of Rolls Royce, Bristol Engine Division 1970) [29].

The propensity of hydrogen to transition from deflagration to detonation is associated with the gas’s fast flame path. “Deflagration will result in a rapidly moving high-temperature flame and an overpressure” [10]. If hydrogen ignition is uncontrolled, then the adiabatic compression produced by a supersonic flame could result in detonation and damage to the gas turbine. Hydrogen has a high diffusion coefficient of 0.61cm²/s compared with other gaseous fuels, gasoline vapour being 0.05cm²/s [30]. Failure to ignite hydrogen during a ground start could result in the engine flooding with hydrogen. Not relighting following an altitude flame out could result in the formation of a larger flammable atmosphere, that when eventually ignited could lead to worse onward effects [12]. CS 25.903 (e) [2] states that “means to restart any engine in flight must be provided”. A cannular gas turbine design, such as the Curtis-Wright J65 installed on the NACA B57 [31], might be worth investigating as a design solution to mitigate these concerns. Details of a modern annular combustor suitable for hydrogen would be commercially sensitive and therefore beyond discussion in this paper. Further research is required to find a safe, practical and reliable solution for engine start-up and in-flight relight.

The use of hydrogen as a safe gas turbine fuel has ramifications beyond certification. Is it “safe” as regards its impact on global warming? Water vapour emissions have a net warming effect on the climate. Avoidance of ice-supersaturated area would reduce the formation of contrail-cirrus clouds [32]. The impact of future hydrogen fuelled gas turbines on contrail formation is an open question. Attempts to estimate the impact on positive radiative forcing have been inconclusive [33]. To climb over contrail inducing weather, aircraft may need to fly above 45,000 feet. Modern airliners have a maximum ceiling of around 40,000 feet. The weight of the aeroplane would have to increase to cope with the additional pressurisation loads and rapid decompression emergency descent. Lateral avoidance might be a more appropriate strategy but would be somewhat involved as regards the accuracy of metrological predictions and Air Traffic Management. Gierens outlines the theory behind the formation of contrails from fuel cells and concludes that their climate impact will be lower than that of contrails from contemporary jet engines [34].

One final consideration is that of the release, be it accidental or deliberate of hydrogen into the atmosphere. Modelling suggests hydrogen acts as an indirect greenhouse gas because of its reaction with tropospheric hydroxyl (OH) radicals [20]. It depletes the oxidising capacity of the troposphere and increases the atmospheric lifetimes of all the other trace gases which have OH oxidation as a main feature of their life cycles, such as methane. Increased methane lifetimes will lead to increased greenhouse warming and, in turn, increased tropospheric ozone which is also a potent greenhouse gas. Venting, leaking, permeating and accidental release of hydrogen into the atmosphere needs further consideration. Venting in normal operation would not be a means to protect against over-pressure (as mentioned in Section 3 above).

8.0 Further work required

Maintaining pragmatism is of paramount importance and the need for further experimental work to close knowledge gaps cannot be conveniently ignored, namely:

“Study the fundamental characteristics of hydrogen flammability under altitude conditions to predict how it will behave in the real world” [25]. CS 25 Appendix N [2] defines upper and lower flammability limits in terms of altitude dependent flash point temperatures for kerosene vapour. Experimental data is required to establish hydrogen flammability limits as a combined function of pressure and temperature, i.e. as a function of altitude. This data should be published as guidance material analogous to CS 25 Appendix N [2].

Research the behaviour of ignited small hydrogen leaks and the associated jet flames in the area adjacent to the fuel system. Consideration should be given to the geometry and thermal properties of the airframe structure to sustain the effects of jet flames, including self-extinguishing if deprived of a sustained oxygen supply.

Physically test LH₂ fuel tanks to determine if a BLEVE is feasible at cryogenic temperatures, be it due to impact damage (cold BLEVE) or flame impingement (hot BLEVE).

Conduct tests to understand the effects of water impingement on LH₂ fuel tanks, systems and thermal installation schemes. The consequences of LH₂ spillage on water should also be investigated.

Explore the permeation and small leakage of hydrogen under the conditions of pressure altitude cycling and vibration [24]. Testing should start with simple fuel system elements (e.g. pipes, connectors and couplings), progress to sub-system assemblies and finally through to a complete fuel system.

Further research is required to understand the transition from deflagration to detonation (DDT). Thought should be given to engineering structural features that might have ameliorative consequences should leaked hydrogen ignite, i.e. would hinder hydrogen’s propensity for DDT.

Explore the influence on the aeroplane’s configuration of the high leakage scenario discussed in AIR 6464 [22], i.e. research the behaviour of a substantial volume of LH₂ (sufficient to exceed 100% of the LFL) leaking into the space between the fuel system’s primary and secondary barriers.

Testing to understand the formation mechanism, persistence and impact on global warming of contrails from hydrogen fuelled gas turbines must be a priority. Consideration should be given to developing environmental safety standards such as CS-34 Aircraft Engine Emissions and Fuel Venting and ICAO Annex 16: Environmental Protection Volume II – Aircraft Engine Emissions to address contrail formation, stratospheric water vapour release and the inadvertent escape of hydrogen into the atmosphere.

9.0 Conclusions

The concept of a hydrogen-fuelled aeroplane is completely outside the scope of existing certification specifications. The first step in remedying this would be to undertake an FHA to identify and categorise potential failure conditions for aeroplane and system functions. A preliminary aeroplane design would then explain how such safety risks were to be mitigated. It would be at this point that discussion of Special Conditions and Acceptable Means of Compliance could begin. This paper has not provided any sort of formal FHA nor any preliminary aeroplane design, but the following have been discussed:

• Hydrogen’s properties

• Cryogenic thermodynamics

• Crashworthiness

• Explosion prevention

• Possible aeroplane configurations

• Hydrogen as a safe gas turbine fuel

The above considerations do provide foresight of what a certification basis might look like. In many instances the existing certification requirements and Acceptable Means of Compliance might remain applicable without modification. The compliance demonstration for some requirements may be more demanding and so new Acceptable Means of Compliance might be needed. Some requirements might require modification by Special Conditions given the novel or unusual design features introduced by hydrogen-fuelled aeroplanes. Appendix 2 summarises these deliberations. It hints at some generic Special Conditions as follows.

9.1 Cryogenic LH₂ fuel system

Thermodynamic phase and temperature must be established for proper engine or fuel cell functioning. Venting overboard as a normal form of pressure control is prohibited. It is unlikely that compliance for UERF requirements could be shown if the LH₂ tanks were installed in UERF trajectory zones.

9.2 Crashworthiness of cryogenic LH₂ fuel system

Additional hazards to the aircraft and occupants from LH₂ fuel release, such as very low temperature hydrogen and risk of asphyxiation, must be considered. There must be no damage that compromises thermal insulation schemes that protect against hazardous boil-off. Water impingement on cryogenic LH₂ tanks, fuel system and insulation during ditching must be addressed. If there is a possibility that a wing-mounted tank will break away in a crash landing, then its trajectory must be assessed for hazards to the aeroplane.

9.3 Hydrogen explosion prevention

Specific controls on flammability in primary hydrogen zones will be required, for example oxygen exclusion, inert purging, etc. Secondary areas subject to hydrogen permeation will require either passive and/or active means to maintain hydrogen-air ratios to below the LFL. For an LFL of around 4%, to provide a margin of safety, a control limit should be set at 0.4% (i.e. an order of magnitude below the LFL and also avoiding the risk of asphyxiation [11]).

9.4 Hydrogen fuel tank position and aft CG limit

Hydrogen fuel tanks should be positioned where they have no adverse effect on the aft CG limit, static margin, handling qualities, control following a fuel exhaustion event and flare for an emergency landing on land or water.

9.5 Final conclusions

Physics and knowledge gaps suggest how the certification basis might be modified for hydrogen propulsion. Hydrogen-electric propulsion (Fig. 7) using highly compressed gas would avoid the need for cryogenic systems, but at the cost of bulkier tanks. Crashworthiness, aft CG, explosion prevention and one-engine inoperative are potential review items. LH₂-fuelled propulsion would need cryogenic thermal protection, pressurisation and pressure relief systems (Fig. 3). LH₂ burning-gas turbines come with a caveat for contrail research [32] as the first priority. The outcome could change operational altitudes and increase navigation workload. A LH₂ gas-turbine aeroplane configuration must place various layers of defences against the introduced risks. Should the hierarchy of precautions fail, then what remains are the ameliorating measures [23] taken in the aircraft design. On balance the Nangia & Hyde concept (Fig. 8) [28] succeeds in this.