Hydrogen Aircraft, Technologies and Operations Towards Certification Readiness Level 1

Abstract

Aviation has become an essential part of the modern world’s ability to grow personal, market and international connections. To enable continued benefits while reducing emissions, future aircraft will need radical redesign and novel, complementary technologies. Hydrogen aircraft are potentially the means to emissions reduction. As part of the European Union’s (EU’s) Clean Aviation Joint Undertaking (CAJU), it is aimed to have hydrogen aircraft entering into service by 2035. To realise this, it would require the certification of these aircraft in a relatively short timeline, which the CONCERTO project aims to help enable. Given the lack of mature experimental designs and pending certification processes, this endeavour is ambitious. To accelerate this, dedicated preparation for the certification through regulatory analysis should be complete, requiring initial options for technologies and aircraft operations to be defined. The technologies and operations were defined, analysed and weighted in CONCERTO, upon which a Generic Concept was made, outlined in this paper, with Level 1 on the Certification Readiness Level Scale. The aircraft systems which are likely to experience the largest changes; Fuel Storage, Fuel Distribution, Propulsion, Auxiliary Power Unit (APU), Heat Exchange (HEX) System and Sensing and Monitoring for Hydrogen (H2), will be outlined in this paper with respect to their components and integration challenges, and the subsequent changes to operations to enable this.

1. Introduction

CAJU is vital for achieving net-zero emissions in aviation, aligning with the ambitious environmental goals set forth in the European Green Deal and the European Climate Law. The main objective is to reduce the ecological footprint of aviation by accelerating the development and deployment of climate-neutral aviation technologies, targeting a 55% net emissions reduction by 2030 compared to 1990 levels for the EU, and achieving climate neutrality by 2050. CAJU’s ambition is to go over decisive impactful steps in demonstrated disruptive aircraft performance compatible with 2035 Entry into Service (EIS) and will only be possible if the future regulatory framework is not an impediment to innovation. To complete this, a comprehensive set of regulatory materials on certification, together with a preliminary description of methods of compliance applicable to the three “thrusts” of CAJU, and a first status of comprehensive digital framework of formalised collaborative model/simulation-based processes for certification must be created. Critical challenges, tackled through Proof of Concepts for the regional and Short and Medium-Range (SMR) aircraft, in this case hydrogen, will be easily transposable and scalable to different product lines and aircraft segments such as general aviation, rotor-craft, business jets or commercial medium-long range, affecting the complete fleet.

As part of the EU’s CAJU, it is aimed to have H2 aircraft entering into service by 2035. For this to happen, it would require the certification of these aircraft in the next 11 years. This is ambitious, considering there are no mature experimental designs at present and the certification of these aircraft and technologies is yet to be undertaken in earnest. To accelerate this, dedicated preparation for the certification through regulatory analysis should be complete. To undertake this regulatory analysis, initial starting technologies and aircraft concepts should be defined to compare against. To achieve aviation emission reduction, the introduction of aircraft using H2 as a fuel is seen as a major component of the solution. To introduce H2 aircraft, inroads will have to be made in the certification of H2 technologies for flight and H2-powered aircraft. To reach this goal, throughout this paper, hydrogen aircraft technologies are analysed for incorporation into a large hydrogen-fuelled aircraft, for regional-short range travel, as this is where the initial EIS is envisioned, and an area where certification will be most pertinent due to the changes to technology required. The technologies are defined, analysed and weighted depending on two measures of readiness for incorporation along with industrial partners’ likelihood to engage their use, upon which a Generic Concept is proposed.

When looking at certification there are two main criteria that can be used to analyse systems and their components: Safety and Reliability. In this case, due to the varying but generally low Technology Readiness Level (TRL) of hydrogen (H2) technologies, quantification of reliability is a difficult undertaking. Therefore, this paper will focus on employing general safety systems for aircraft, concentrating on the creation of system redundancy through secondary options for systems and characterisation of failure to employ these secondary systems. In commercial aircraft, it is normally a balance of these safety systems with their weight penalties that determines system and technology choices. In this paper, since exact weights are not yet known, the focus will be on safety functionality effectiveness. The incorporation of systems and technologies into the final concept had a few assumptions made once the technology choices were complete:

• The mentioned technologies are expected to be mature enough for integration into an airframe by 2035 (TRL 9).
• These technologies are projected to meet the minimum performance criteria, based on research papers and industry data.
• Assumed application to both Certification Specification 25 (CS-25) and CS-23 airframes, with exception of power plant, where CS-23 would use Fuel Cell (FC) generators and electric propulsion units. Other potential applicable categories for hydrogen systems such as CS-21, SC-VTOL-01 and CS-27 were not considered.
• Despite variations, it is assumed that all systems can be incorporated into an airframe, with final verification left to manufacturers.
• It is assumed that the required hydrogen-related regulation can be developed in parallel using the Certification Readiness Level (CRL) [1,2].

The nine-level CRL scale aims at evaluating the maturity of a regulatory framework for certifying an innovative product or a product that embeds innovative technologies. This study investigates Level 1 (CRL1) of this scale [2], which involves defining the general design and Concept of Operations (CONOPS), in this case for a H2 aircraft to be certified, with particular emphasis placed on disruptive features and on identification of new hazards introduced by this novel fuel technology. Its outcomes serve as an input for CRL2 and CRL3 activities, respectively, establishing an acceptable level of safety and conducting a regulatory gap analysis, both of which are detailed in [1].

The paper hereafter is organized as follows. Section 2 describes the methodology used to define, assess and select the technologies to be retained, using a literature review. Section 3 then details the resulting H2 aircraft generic concept defined in the CONCERTO project. Finally, results are discussed in Section 4, along with conclusion and plan for future work.

2. Materials and Methods

To create a viable and relatable concept to build the CONCERTO certification gap analysis off of, the following method combines outcomes from scientific literature and expert engineering judgment involving subject matter experts from industry, research and technology organisations, and academia. This original approach makes it possible to design and propose an H2 aircraft generic concept that fulfils technological adequacy and maturity requirements for the targeted 2035 EIS. This results in a significant advancement in formalizing mature H2 aircraft architectures. Thus, the research presented in this paper started with a comprehensive literature review that includes identification of existing safety criteria and safety design principles for H2 technologies. Then, the literature review was thoroughly evaluated by subject matter and industry experts from the CONCERTO project and from other European aviation H2-related research projects, and proposed technologies were investigated to select the most advantageous and mature to incorporate into an aircraft concept based on expert opinion from industry. For this purpose, each possible technology, related components or choice of system was presented in the form of a questionnaire shared among the experts where each component was researched and basic requirements for implementation, functionality and failure modes were outlined, with particular granularity in systems chosen to be implemented in the generic concept. The questionnaire supports a ponderation-based analysis to measure the readiness for incorporation in the aircraft generic concept. The outcomes of the literature review blended with expert engineering judgment are presented in this section. It then results in the architectural definition of the selected H2 aircraft generic concept that is presented in Section 3.

2.1. Literature Review

To begin to create this concept, it was initially decided to compile a literature review of the area of hydrogen aircraft conceptualisation and to create the initial CS-25 aircraft concept. The literature review focused on main areas outlined as subsections below the table.

2.1.1. Regulations, Standards and Certification

Existing hydrogen regulation, standards and certification seen in

Table 1. Hydrogen and aircraft-related standards with partial or full applicability.

Industry	Document Reference	Title	Hydrogen Aircraft Applicability
Vehicles	SAE J2579	Standard for Fuel Systems in Fuel Cell and Other Hydrogen Vehicles	Design, construction, CONOPS and maintenance requirements for H2 fuel storage and handling systems in on-road vehicles
	UN GTR 13	UN Global Technical Regulation No. 13 Hydrogen and Fuel Cell Vehicles	Hydrogen Fire and Crashworthiness for vehicles
	EU Reg. 2019/2144 Art.10	Type approval of hydrogen-powered motor vehicles	Classification of Safety Factors
	ANSI HGV 2	Compressed hydrogen gas vehicle fuel containers	Comprehensive Explosion case of hydrogen description in vehicles
Aircraft *	AIR 6464	WG80/AE-7AFC Hydrogen Fuel Cells Aircraft Fuel Cell Safety Guidelines	Clear Guidance on correct implementation of hydrogen fuel cells implementation and safety conditions
	DOT/FAA/TC-19/16	Energy Supply Device Aviation Rulemaking Committee Final Report to: Federal Aviation Administration	Overview of Certification Roadmap for Fuel Cell as energy supply device
	EU Reg. 748/2012	Part 21: Initial Airworthiness	Safety requirements for aircraft—fuel system, crashworthiness, etc.
	CS-25	Certification Specification for Large Aeroplanes	Large commercial aircraft certification specifications
	CS-E	Certification Specification for Engines	Hydrogen Combustion aircraft regulation likely to be built on this
	14 CFR 25.981 (FAR 25.98)	Fuel tank explosion prevention	Traditional Fuel Explosion Prevention Measures
	SAE ARP4761	Guidelines for Conducting the Safety Assessment Process on Civil Aircraft, Systems and Equipment	Qualitative and Quantitative Assessment of Aircraft Equipment Methodology
	DO-160	Environmental Conditions and Test Procedures for Airborne Equipment	Standard for Aviation components to meet Environmental Requirements
	ER-034	Hydrogen Fuelling Stations for Airports in both gaseous and liquid form	Explains best practices for design and operation of hydrogen aircraft refuelling station
H2 Storage	ISO 19881	Gaseous hydrogen: Land vehicle fuel container	Standards for hydrogen storage under pressure.
	ISO 21028-2	Cryogenic vessels: Toughness requirements for materials at cryogenic temperature	Material requirements for LH2 storage
	ISO 13985	Liquid hydrogen land vehicle fuel tanks	Only regulation on moveable LH2 tanks
	GB/T 35544	Fully wrapped carbon fibre-reinforced cylinders with an Al. liner for the on-board storage of compressed hydrogen as a fuel for land vehicles	Comprehensive description of liners lacking in other regulations
	EIGA Doc 06/19	Safety in storage handling and distribution of liquid hydrogen	Comprehensive doc. for safe implementation of LH2 systems considering safety distances to properties of H2 to different installations and guidelines for equipment
Other	NSS 1740.16	NASA Safety Standards for hydrogen and hydrogen systems	Space implementation standards—LH2 valves, etc.
	ISO 19880-1	Gaseous hydrogen—Fuelling stations	Interfacing with Aircraft and CONOPS

* EUROCAEWorking Group 80/SAE AE-7AFC is known to be working on further recommendation documents for the implementation of liquid and gaseous hydrogen storage, distribution etc., in aircraft.

were used to create the initial starting point for what is safe in relation to H2 and how it is employed with vehicles. Large effort has been invested in the creation and thought process of how to ensure H2 safety, and therefore, it is pertinent and wise to use these as sources for design and operation of safe H2 aircraft, even if some of these are not for H2, or for aircraft specifically.

At present, aviation regulation authorities have not created specific regulation for the certification of H2 aircraft, and therefore all attempts to create a fully certifiable concept are fully reliant on regulatory speculation. This speculation is generally based on a few documents available from the European Union Aviation Safety Agency (EASA), the USA Federal Aviation Administration (FAA) and other certifying bodies. Examples of those publicly available are as follows.

• NASA Report—Guide for Hydrogen Hazards Analysis on Components and Systems—Beeson 2003 [3].
• EASA Fire Protection for H2 systems—April 2022.
• EASA–SC E-19 Electric/Hybrid Propulsion System—Comment Response Document TE.CERT.00142-002.
• EASA Hydrogen as aviation fuel—Workshop on Aircraft Certification Fire and Explosion challenges—Cologne June 2023.
• EASA Research Agenda 2022–2024.
• FAA Hydrogen-Fueled Aircraft Safety and Certification Roadmap—December 2024.
• EASA Certification Roadmap on H2—International Workshop—December 2024.

2.1.2. Hydrogen Aircraft and Reviews

There are many papers that complete high level review of hydrogen aircraft, and the differentiation proposed by this paper is the suggestion of architecture and process flow diagrams (PFDs).

When looking at H2 aircraft, Brewer started investigation with Lockheed and National Aviaition and Space Agency (NASA) into hydrogen fuel systems [4], which stands as a basis to this day. He later expanded this into a full book in 1991, providing a broader baseline for H2 aircraft design [5]. When defining the generic concept for the CONCERTO project, this book was still used as a foundational point. Khandelwhal next dedicated himself to the cause of summarising the entire H2 aviation landscape, with his 2012 and 2013 papers [6,7], the sources for which provide a more in-depth evaluation of individual areas, and are worth referring to, as can be seen in the individual system components hereafter.

The late 2010s and early 2020s lead to a large increase in publishing of hydrogen-related review papers, showing the increased interest in the creation of an H2 commercial aviation segment. These can be further broken down into segments; system choice reviews [8,9,10], safety [3,11] concept building reviews [5,12,13,14] and performance reviews [15,16,17]. There is overlap in papers in these areas as well; however, very few manage to summarise all three while keeping ample granularity. Adler and Martins successfully undertook this in their 2023 paper, where they outlined and critically assessed the validity of all segments above briefly [18].

These papers, alongside expert engineering judgment, were used to define the initial concept of the aircraft, as outlined in the Results Section 3.

2.1.3. Hydrogen Storage

In 2023, Massaro completed a comprehensive review for the possible H2 storage techniques available, including primarily liquid (LH2), compressed hydrogen and cryo-compressed H2 [19]. Of these, the first two have the highest associated TRL. Comparing the suggested solutions from Massaro to Boichenko’s writings on aviation fuels and lubricants, we can see that, for fuel tanks, a simple repurposing is not an option, and instead at minimum a retrofit of H2 storage solutions and overhaul of associated fuel systems is required [20]. Looking at LH2 solutions, the options are outlined by Hassan in 2021 [21], and their integration methods briefly investigated by Adler in [18], whereupon the disadvantageous characteristics of the Gaseous Hydrogen (GH2) Gravimetric Index (GI) are outlined, leading to the attractiveness of LH2 for medium and long-haul flight, as seen from their diagrams.

In terms of ensuring the safety of these components, there are a few integrateable off-the-shelf and in-development features; inerting of H2 gases, fire suppression as a replacement to true extinguishing that is currently not feasible, shut-off valves capable of high performance and reliability in LH2 as outlined by Shu in 2023 [22], structural protection in the form of fireproofing with the use of silicon matrices, as suggested by Bourbigot in 2014 [23], though this interaction of these materials with H2 and cryogenics needs further research [22,23]. Isolation is also essential, with the retrofitting of space bulkheads and use for fire and pressure presenting a large potential cross-sector feasibility, as demonstrated by Airbus [24].

Material choice is important, as each type of tank has its advantages. For an LH2 tank, specifically the choice of materials for the inner tank [25], insulation [26] and outer tank, form a difficult procedure. Literature such as McCarville’s chapter on cryotank design can be helpful with [27,28]. Thermal performance of the tank is a priority [29], alongside structural performance and correct sizing to ensure mission compatibility. The overarching issue and therefore point of investigation is the GI of the tank, which though touched on by Adler, is better expanded upon by Heute [30].

2.1.4. Hydrogen Distribution

Modifying an aircraft’s fuel piping system for LH2 involves addressing the extreme cold of cryogenic temperatures (−253 °C). Components like pipes, pumps, valves and tanks must withstand these temperatures without structural issues [31]. Vacuum-insulated piping is preferred for larger components, while foam insulation can be used for smaller ones [32]. Vacuum-insulated transfer lines are effective, though heavy due to metal construction. Multi-layer insulation (MLI) is efficient but problematic in aerospace due to weight and vacuum maintenance requirements. Redundancy in fuel distribution is necessary, potentially increasing system weight [3]. Insulating LH2 piping minimizes heat leakage, maintaining hydrogen in a liquid state for efficient transport and preventing partial evaporation. Vacuum insulation and MLI are advanced cryogenic insulation technologies, involving layers of insulation material and a vacuum space to reduce heat transfer [4,33]. Insulation failure can lead to increased heat leakage, causing H2 to evaporate and disrupt the system. Structural issues due to rapid temperature changes and H2 permeation are also concerns [32,34]. Integration into the airframe requires considering insulation thickness, mechanical properties and thermal–structural responses to maintain desired temperature conditions.

Metallic alloys, particularly Al2219-T8, are used for LH2 piping. Challenges include extreme cold temperatures, H2 embrittlement, thermal contraction and weight constraints. Composite piping could be a potential future option, though H2 exposure and characteristics with flow, heat transfer and flammability need further investigation as detailed in the DOT/FAA/TC-17/23 report listed in Table 1 and in [35,36]. Materials such as aluminium, austenitic steel and titanium are suitable, while others like carbon steel and cast iron are not. Cryogenic-capable materials and separate actuators outside the cryogenic area are necessary for piping valves. Cross-feed valves, as suggested by Brewer (1978), are feasible [4,37]. Polytetrafluoroethylene, Polychlorotrifluoroethylene and Ultra-high-molecular-weight polyethylene are materials compatible with cryogenic sealing [38,39]. Altitude impacts valve performance, and fluid control manifolds can reduce weight but require failure analysis [40]. Metering valves provide accurate fuel modulation. Two-stage servo-valves are common in kerosene systems, while novel architectures like hydraulic cylinders and piezo-electric actuators may be used for H2. Ball valves, as concluded by Li, are reliable for LH2 transfer [41] but still tend to have the traditional failure modes including internal leakage and H2 embrittlement.

Reciprocating pumps have limitations, while diaphragm pumps are effective but require careful material selection. Variable-speed pumps, as discussed by Brewer [4], offer efficiency and flexibility. Direct Current (DC)-driven pumps are preferred for the generic concept configuration, since it assumed that the APU and in turn the high voltage distribution system would normally be DC. In case of leakage, the affected pipe section should be shut off, and remaining LH2 vented. Secondary piping provides redundancy, maintaining system temperatures and allowing fuel flow transfer in case of malfunction. GH2 poses different challenges, primarily H2 embrittlement. Materials like nickel and aluminium improve permeability and reduce embrittlement [25]. ASME B31.3 and B31.12 standards guide material properties and requirements for H2 piping to avoid these issues. These insights highlight the complexities and considerations in designing and integrating LH2 fuel systems in aircraft, emphasizing the importance of material selection, insulation, and safety measures.

2.1.5. Propulsion

Efficient combustion in H2 turbofan engines is influenced by specific inlet conditions, including temperatures and pressures. Lei and Khandelwal suggest an inlet temperature of 600 °C and a pressure of 0.69 MPa [42], while Perry et al. and others provide detailed pressures and temperatures for idle, cruise and full power conditions [43,44]. Combustion outlet temperatures must remain below 1700 K (1400 °C) to avoid turbine blade failure. LH2, stored at 20 K (−253 °C), is heated to 150 K (−123 °C) to 250 K (−23 °C) before injection for efficient combustion [45,46].

H2 injection systems present unique challenges and opportunities. Various configurations, such as NASA’s Glenn Research Centre design with opposing H2 jets, ensure robust performance [47]. These systems must handle varying conditions, with rapid H2 reaction rates necessitating quick mixing. Integration into the engine includes a heat exchanger for converting LH2 to gas. Potential failure modes include cooling issues and varying flight conditions affecting performance. The micro-mix combustion method offers potential but requires further development [42,48,49].

Turbofans are preferred due to their higher technology readiness levels and research for hydrogen use. Autoignition through blade turbines eliminates the need for ignition components during flight [50]. Efficient combustion requires precise control over temperatures and pressures. Some of the main challenges presented by this technology are managing H2’s high reactivity and preventing flashbacks. Efficient integration into engine architecture is crucial for the safe operation and mitigation of potential design failure modes including overheating and structural integrity risks for the turbine’s blades [51].

2.1.6. Sensing and Monitoring

Maintaining and monitoring aircraft fuel systems for LH2 is essential for ensuring airworthiness. Instead of relying solely on visual inspections, robust monitoring systems can be employed. Structural Health Monitoring (SHM) systems use sensors to continuously monitor the structural integrity of piping, detecting changes in stress, strain or vibrations that could indicate potential leaks or weaknesses [52,53,54]. Temperature sensors can detect abnormal heat changes around leak points, while acoustic sensors can pinpoint the exact location of a gas leak by triangulating acoustic outputs caused by the likes of cracking or plastic deformation [55]. H2 leak sensors detect hydrogen concentrations in the air, triggering safety measures if a leak is detected. Flow measurement sensors help understand system function and pressure requirements, and can also detect leaks by measuring changes in flow rate.

Pressure sensing is essential throughout the aircraft, particularly around piping connections, insulation of liquid tanks and the engine. Technologies include fibre optic sensors, Micro-ElectroMechanical System-based technologies, capacitive sensors and piezoelectric sensors, each with varying levels of spark hazard risk. Temperature sensing is also critical, with fibre optic sensors, Resistance Temperature Detectors (RTDs), semiconductor-based sensors, thermocouples and infrared sensors being potential technologies [56,57]. Hydrogen sensing technologies, such as electrochemical sensors, semiconductor sensors, catalytic heat of combustion sensors, optical fibre sensors and Surface Acoustic Wave sensors, are vital for detecting leaks and ensuring safety.

Level sensors in LH2 tanks typically use capacitance sensors, with optical sensors being an experimental alternative [58,59]. For GH2, pressure sensing can be used to interpret levels. Flow sensing for LH2 is advancing, with products like Micro Motion ELITE Coriolis flow meters and turbine-type flow meters being adapted for transport solutions [60]. Fire sensing can be achieved through temperature or infrared sensing, with type J thermocouples being a likely implementation due to the high flame temperatures of H2 [57]. Overall, these monitoring and sensing technologies are essential for maintaining the safety and efficiency of H2 fuel systems in aircraft, addressing challenges such as extreme temperatures, H2 embrittlement and potential leaks.

2.1.7. Auxiliary Power Unit

The main component of the APU would be the FC stack created using Proton-Exchange Membrane Fuel Cell (PEMFC) technology, as this has the highest TRL of all the FC technologies and is the most applicable in APU use due to the temperature range and performance [61]. The FC stack itself would be an amalgamation of individual FCs. Each individual FC is made up of an anode, cathode and electrolysis membrane in between, alongside the channelling for providing contact between the liquids and anode/cathode. The catalyst, normally in the form of precious metals such as platinum, is crucial. Low-cost catalysts with high activity and stable performance are key to the large-scale application of PEMFCs [62,63].

Compressors are required for the FC to work. The primary function of the compressor in a PEMFC system, as noted by Guida [64,65] and Agnolucci, is to supply air to the cathode side of the FC stack. The oxygen in the air is essential for the electrochemical process that generates electricity from hydrogen fuel. Compressors adjust the air pressure to the required level for optimal FC operation, which is crucial because the rate of the electrochemical reaction in the FC depends significantly on the availability and pressure of oxygen. By controlling the flow of air, compressors also contribute to the thermal management of the FC system, helping to dissipate the heat generated during the electricity generation process.

The compression process involves using a compression intake and then bleeding air from the bypass. This compressor can also be used for cooling of electronics in case of APU, and traditionally this is a turbofan compressor. In this case, it would be electric for a FC APU [66]. The bleed air amount is controlled using a variable valve, extracting air from the bypass at the required flow rate. Pressure and temperature require further control beyond this point, necessitating the integration of sensors for both systems. Potential failure modes include over-pressurisation, overheating and damage due to environmental factors. Many FCs work at ambient pressure and, therefore, on the ground, would not require large compression, simply a fed intake function. At altitude, the intake could function as a compressor with a factor of 1.36 due to altitude [66]. There is also the option of a pressurised FC, which would require a larger compression ratio but, in turn, would allow for the use of a turbine instead of a valve to provide FC back pressure, leading to the recuperation of pressurisation energy.

Possible failure modes of the FC, as listed by EUROCAE WG80, include cell stack or process faults due to out-of-limit thermal, pressure, flow, humidification or composition conditions. Internal transfer faults between the anode and cathode can occur due to pinhole formation caused by membrane ageing, mechanical stress or thermal overstress. Internal transfer faults between gas and cooling can result from bipolar plate cracks due to thermal or mechanical stress. External gas leakage faults can be caused by overstress of seals, seal ageing, stack over temperature or mechanical overstress. External coolant leakage faults can result from coolant over temperature, over pressure, bipolar plate cracks or ageing of seals. High coolant conductivity faults can occur due to ion enrichment causing current creep. Electrical faults such as low voltage, over current and short circuits can lead to internal or external component failures. Appropriate system reactions must be defined if a failure mode is triggered by monitoring to bring the system into a safe status. Schroder further investigated these failure modes, with similar outcomes observed [67].

2.1.8. Heat Exchange

In current aircraft, heat exchange is an essential component of most systems [68], and fulfils main functions based around combustion, environmental control, hydraulic cooling and avionics. In the case of LH2 supply for combustion, there are two main changes to the heat exchange system, firstly in the fuel conditioning, and secondly engine control. Significant changes in fuel temperatures throughout the system result in large changes in the behaviour of waste heat management. One way in which to do this, considering the relatively high maturity of HEX systems, is to integrate the heat exchange system through parallel coolant loops, as suggested by Srinath 2022, as one of their many extensive potential implementations of a combined H2 aircraft heat exchange system, based on the source material review above [69]. Srinath’s paper initially recommends a configuration which involves using an exhaust gas heat exchanger to utilize the exhaust heat for raising the fuel temperature. This setup helps in melting any nitrogen or oxygen crystals before they enter the fuel circuit and can also reduce exhaust gas temperature, potentially lowering exhaust noise. This is a very novel technique, that has major advantages in increasing the efficiency, weight and volume of a system, which will be important considering the additional HEX conditions of H2 powered aircraft. Srinath’s paper is the most comprehensive and can be seen as an important source for fuel systems as well. Gomez et. al. also investigated this system more recently [70], and found that the use of similar efficient heat exchangers could reduce the hydrogen used in flight by 6.7–9.8%.

Gortz and Silberhorn also looked at thermal balancing of specifically combustion engines, and gives a model allowing for the calculation of the thermal potential of the engine system, and bypass duct in a H2 case, something allowing more concrete analysis when adapted to any HEX system when full performance and balancing is undertaken [71].

2.1.9. Concept of Operations

Definitive H2 concepts of operations are currently evasive, due to unclear architectures at present. However, some theories exist based on proposed open source aircraft architectures. As well as this, as part of H2 aircraft safety, EASA has outlined that they expect similar if not greater safety in H2 flight. SAE’s AE-5C committee is working on the integration of H2 into airports. For the implementation of this, they have undertaken workshops with industry partners and outlined the initial ideas of what safety levels would be required for crash safety, emergency operations, etc. Other than this, according to Cipolla 2022 [72]: “This reference mission used to assess the performance of the box-wing aircraft was divided into segments with their own characteristics”, as described in the following:

• Ground holding: A greater than the current 30 min standby phase carried out with the engines switched off, which is necessary for fuelling and for other aircraft preparation operations.
• Taxi-out: Conducted according to the Landing and Take-off cycle specifications defined by the International Civil Aviation Organisation (ICAO); its duration is equal to 13 min, half of the total taxi in and out duration, in which the engine power setting is set to 7% of maximum thrust, corresponding to the idle condition.
• Take-off: As for the taxi-out phase, the take-off was also computed by using the ICAO engine emissions database specifications; specifically, the duration of the manoeuvre is set to 0.7 min in which the engine power setting is 100% nominal flight thrust.
• Take-off path: This segment of the mission acts as a link between the on and off ground mission stages; the take-off flight path starts 35 ft above the ground and ends when the height of 1500 ft is reached. In this stage, the aircraft is configured for starting the climb segment.
• Climb: This stage is divided into three main segments in which the aircraft accelerates and gains altitude, as suggested by the flight programme the climb ends as the altitude of the cruise condition is reached.
• Cruise: This segment is performed with a constant speed–constant altitude flight programme; The aim here is to be competitive with current SMR aircraft and therefore the upper range of 0.76 M_cr and 11,000m cruise altitude [73].
• Descent: The descent is performed with an imposed speed profile and a constant rate of descent, until landing on the runway in a traditional fashion.

2.2. Questionnaire

To evaluate the relevance of these technologies by subject matter experts, a questionnaire was created by the authors of this paper, with the help of ONERA, also partaking in the CONCERTO project. An overview of the subject, the project, and the aims of the generic concept were outlined. Type of fuel, storage solutions, phase change location, insulation, propulsion system thrust, ground operations, operating principles for ground and flight, technological and certification risks, were enquired about. These questions were mainly two-parted, with a simple defined answer to begin with, and then detail after to allow for design and operational flexibility depending on their solutions.

A total of 12 comprehensive answers were received, plus another three meetings were held with industry partners for less detailed outlines. Another five partial answers were also received and accounted for. This was then compiled into a large spreadsheet, where answers for each question were anonymised, so as to not give bias to decisions later made during the workshop.

2.3. Workshop

To collectively evaluate the maturity of the technologies, a workshop involving subject matter experts was prepared through the creation of overviews of the options for each system, with literature research and sources stated above used as sources. A weighting system was created for the simplification of the selection process. This weighting process relied on the TRL scale (1–9), CRL scale seen in Jézégou et al. 2024 [1] (1–5), though still in development at the time, and integrate-ability (1–5). This lead to a weighting equation seen below:

$$W=(5\ast TRL)+(3\ast CRL)+(3\ast IA)$$

(1)

The weighting of components, systems, and technologies was undertaken by workshop participants from the CONCERTO project based on a majority agreement, with the creation of the concept from each highest weighted technology, starting from operations, aircraft initial sizing and then continuing to systems and components. Note that TRL had the highest weighting, with CRL and integrate-ability being secondary.

2.4. Concept Refinement

To create the concept after the completion of the questionnaire and workshop, the main authors listed above came together and critically analysed how to merge the chosen concepts together. When there were doubts regarding how to approach integration, the subject matter experts who had originally proposed the system/concept were consulted to obtain more clarity. In a few cases, this was not available and therefore literature had to be used as the main source of the integration techniques, such as lean direct injection of hydrogen fuel in gaseous spray.

3. Results

This section presents the hydrogen aircraft generic concept that results from the selection process described in the previsous section. It consists in a concise and precise description of the experimental results, their interpretation as well as the experimental conclusions that can be drawn. This concept is the main output of the CRL1 evaluation conducted in the CONCERTO project.

3.1. Concept Overview

The proposed capabilities of the entire system would be the same as those for current CS-25 commercial Regional/Short Range aircraft, such as the ATR-72 and the Airbus A220. Major changes to refuelling times, maintenance and emergency procedures, as seen with each of the relevant sections below, are envisioned. The proposed capabilities of the system are a 70–100 passenger capacity aircraft family. The introductory aircraft would likely be at the lower end of this range, and over time as design efficiency of hydrogen aircraft is improved, and superfluous safety and reserve systems are used, more weight and likely more importantly space are made available to passengers, moving the aircraft into the short-range category.

Fuel capacity would be 1600 kg of LH2 storage capacity. This would translate to circa 23,000 L of LH2, though with fill only to 85–90% of tank capacity to allow for gaseous ullage, this would translate to circa 27,000 L for storage. This fuel capacity would allow for a range of circa 1400 km for the aircraft. This is likely a conservative estimate, as for high level initial sizing lower estimates were incorporated. A simplified overview of the generic concept is presented in Figure 1.

In terms of operational ceiling, this would be greater than 25,000 ft; however, it should be limited below this at introduction to service to ensure the behaviour of the aircraft at altitude is well-known and near excessive flight data are available. Rate of climb would likely be above 1900 ft/min; however, this should be restrained to circa 1700 ft/min at introduction to allow for sufficient safety margins. Empty weight would be envisioned to be circa 14,500 kg and minimum take-off weight 22,500 kg. All of the above would lead to the aircraft having a conservative flight time of 100 min.

3.2. Concept Systems

For granularity of the design, the concept was split down into the systems that were previously reviewed in the literature, applying the outcomes of the literature review, questionnaire and workshop. This way, aircraft requirements could be extrapolated to system-level requirements, and from this each system could be analysed and simplified functional design undertaken at the system level. Thereafter, it could be built back up into an aircraft-level system of systems, with further refinement.

3.2.1. Hydrogen Storage

A description of the generic concept hydrogen storage is presented in Figure 2.

On-board the aircraft, LH2 is stored in two separate tanks located in the rear of the fuselage. There is no gaseous or cryo-compressed hydrogen stored on board the Generic Concept itself. These tanks are non-integral to the fuselage, of capsular shape, and not of equal size, due to the reducing cross-section of the fuselage at the rear. The structure of the tank is one of an inner composite tank, MLI insulation below foam for insulation and an outer composite tank to encapsulate. The inner tank would likely use a polymer or metallic liner to reduce permeability, likely a Fluon and Perfluoroalkoxy alkanes copolymer, thanks to their cryogenic and hydrogen permeability characteristics, respectively. The metallic liner with polymer would also help with hydrogen exposure burn effect, as seen in DOT/FAA/TC-17/23, while the composite would ensure any potential embrittlement is not a catastrophic failure case. This would be for EIS, and could later be replaced with coating or polymer liner for weight reduction, the essential component being low permeability and H2 absorption.

Low thermal conductivity supports run from the outer tank to the inner to structurally support its weight. Anti-sloshing baffles within the tank negate most of the negative effects of acceleration similar to those seen in current fuel tanks, though definitive characterisation of this for semi-full LH2 tanks could not be found in the literature.

The functions and system of both tanks are the same; however, in the case of the need to avoid the use of one, the other can supply LH2 as needed by all the systems throughout the aircraft. Supply of the LH2 to fuel system is undertaken using two separate systems in each tank, one for the APU and one for supply to the engine. The engine supply is undertaken by a pump fed system, employing two cryogenic centrifugal pumps. These pumps can be used in tandem, or separately if either fails. Separate piping to each allows for effective use of either pump independently. APU supply is undertaken by the pressure-fed system.

Pressure is maintained within the tank to ensure the function of this system using the HEX located within the tank. This is an automated system that can be used to keep the pressure above a set amount (circa 2–3 bar in this case). Once higher pressures (up to 8 bar working pressure in this case) are reached, the venting system can be used to control the upper pressure. Three parts of the tank can be vented in order of likeliness of use: the gaseous ullage in the tank, the liquid in the tank, and the insulation in the case of the inner tank failure. The gaseous ullage venting also serves a secondary function of the GH2 recovery line when refuelling. This can be undertaken using the filling line that has a distributed filling system allowing for the cooling of GH2 while refuelling the aircraft.

Conventional liquid fossil fuel aircraft can rely on jettisoning system to dump the fuel in-flight. This procedure aims at ensuring minimum aircraft performance by reducing weight in emergency situations. The ability to dump fuel is highly advantageous for traditional fuels, but undertaking this manoeuvre with hydrogen fuel could lead to new safety disadvantages and performance unknowns due to the large explosive cloud being released from the aircraft. Therefore, jettisoning would have to be completed at a slower rate, and the use of inerting or a similar system could help the controlled use of this system. Jettisoning of hydrogen fuel was part of the J-57 tests in 1957 and is included in Mulhollands NACA report 1959, and has not been addressed in detail since, other than in Brewer’s book.

The design for safety approach retained to develop the generic concept relies on checking the design against safety cases representing off-nominal or degraded conditions. Here below is an example of a safety case for storage system:

Safety Case Example:  Tank Leakage greater than Lower Flammability Limit (LFL) in surrounding volume during flight, the % of hydrogen in safety zone at rear of aircraft, within a few minutes. This means that inner tank compromised, outer tank and both insulations affectivity decreasing. The damage to the tank is likely to cause heat ingress, pressure increase and therefore tank should be emptied at haste.  Safety Case Implementation:  Begin emergency flight procedure. Open full venting system of inner tank, engage both LH2 tank pumps at full throttle, transferring as much as possible of failed tank’s LH2 to the secondary tank. Once the secondary tank is full, feed engines 80% from this tank until 10% LH2 level reached, or 1 bar pressure in damaged tank. Shut-off valves to engine and other tank engaged. Shut-off both pumps and all electronics in the failing tanks system, other than sensors and meters, and of course vents. Fill the damaged tank using inerting gas, to stop ingress of oxygen containing mixtures into the tank due to pressure differential. Continue venting the tank, and if any fire detection sensor in tank or hydrogen gas sensor goes above LFL in the altitudes oxygen content, attempt jettisoning any remaining LH2. Be cautious of fuel jettison when entering landing procedure.

3.2.2. Hydrogen Distribution

A description of the generic concept hydrogen distribution is presented in Figure 3.

From each of these LH2 tanks, alongside each section of the piping, there is the ability to vent to atmosphere. The distribution of fuel around the aircraft is undertaken using a dual backup system, to provide redundancy within the system. In normal operation, the majority of the fuel would be passed through one set of pipes, with circa 20% being passed through the reserve system, simply to keep it at temperature. Both the gaseous supply to the APU after the heat exchanger and the liquid supply to the engine is completed using metallic pipes, specifically aluminium. In the case of the liquid pipes, these are insulated with MLI for longer sections of piping and generally the preferred solution, with foam insulation used to contain smaller sections such as valving, etc., where required. Within each section of piping, pressure and temperature sensing should be located and in the surrounding area also there should be pressure, temperature and hydrogen detection available. These systems together would consist of the sensing system for the distribution system further outlined below for both liquid and gaseous distribution; please see the sensing subchapter below for more details.

There is a separate filling system for each tank, and in the case of one of these not being used, the fuel transfer system between each of the tanks can be used to fill from one to the other. This system allows for the recovery of fuel in the case of slow degradation/malfunction of either tank. Once the recoverable fuel has been transferred, this tank can be vented and decommissioned until the ability to inspect and perform maintenance is available.

For defueling/jettisoning, there is an in-built system to remove fuel. Ideally, where possible venting would be used first for the removal and control of fuel systems during operation, with this system mainly being used for defueling in maintenance situations. However, if urgent conditions occur where the jettisoning of fuel is required, this system could act as a fail-safe.

Safety Case Example: Temperature sensor on the outer wall of the LH2 supply line, this part of which is a non-vented isolated area, near the wing route alarms the aircraft’s safety system due to a rapid decrease in temperature. The corresponding pressure sensor in this area also reports a slight drop in pressure. The hydrogen sensor in the area is not reporting an increase to ppm’s. Safety Case Implementation: The drop in temperature on the outside of the pipe is characteristic of the failure of the insulation of the pipe, in this case the MLI due to the slight drop in pressure. This will effect the supply of hydrogen to the engine. For safety, reduce LH2 flow through this pipe and transfer to secondary pipe, previously only transferring 10–20% of the LH2. Shut off the section of pipe once transfer complete. If hydrogen ppm begins to increase, vent and ensure that it does not continue. This would be failure of the inner wall of the supply line, and the hydrogen seen here should only be from the section of pipe that is shut-off. If the % hydrogen continues to increase after this, begin emergency procedures as it is the secondary pipe leaking as well, or the shut-off valves have not engaged.

3.2.3. Propulsion

A description of the generic concept propulsion system is presented in Figure 4. Propulsion for the aircraft generic concept is provided by two hydrogen burning turbofan engines. These engines are very similar to existing high bypass ratio engines. Electric motors within the engine assemblies are used to obtain the initial pressure required for combustion. The engine heat exchangers are brought to temperature also using power provided by the APU and batteries, which in turn generates heat as seen at the bottom of the diagram above. Thereafter, injection and combustion are initiated by the engine.

The liquid to gaseous heat exchange within the engine has the secondary function of partially cooling the engine systems using the latent heat in the system, improving efficiency. Flow rate of the GH2 is determined through flow control thereafter. The propulsion system will also incorporate a gearbox for the generation of electrical power for battery recharging, which will support the aircraft in off-nominal conditions for safe emergency flight.

Water injection is envisioned as being integrated as a possible way to reduce nitrous oxides produced by the hydrogen engine through the creation of lower burn temperatures in the combustion chamber, though it is expected that, like the kerosene combustion engine, it will have negative effects on engine performance as a whole. This is not outlined in the diagram as it is not a change to the traditional turbofan. From a hydrogen burn safety point of view, it may be worth underrating this thrust value as understanding the reliability and lifecycle of these engines is not fully complete yet—similar to older Pratt and Whitney engines before computer thermal modelling was introduced—if this proves to be overly conservative it will simply extend the lifetime of the engines.

Safety Case Example:  Injection and Ignition in one engine malfunctions due to part damage and malfunction. Engine sputters out with no thrust case. Attempt to restart the engine causes engine temperature increase, likely due to engine fire.  Safety Case Implementation:  Shut off hydrogen supply to engine and vent fuel in the engine HEX system and distribution through the wing vent. Initiate emergency procedures and land as soon as possible. Inform the airport of the likelihood of engine fire.

3.2.4. Sensing and Monitoring

This system is found throughout other systems; however, since the technologies being used overlap with each other and form the backbone of the active safety components of the aircraft, this has been made a separate system. For the storage tanks, sensing and monitoring is needed for temperature and pressure of LH2 and GH2 ullage. Alongside this, fuel level indication is necessary. For the inner and outer tank, SHM and acoustic emission in distributed form is used to ensure the structural functionality of the tank. Between these, the insulation in the MLI and foam is observed using temperature, pressure and hydrogen sensing. These together make a leak detection system for the internals of the tank.

In the case of the fuel system, like the tank, temperature and pressure are used in the insulation of the piping to detect any failure of inner piping in each isolated section. Hydrogen molecular sensing is used external to this along with additional temperature and pressure in case of failure of the system to be able to properly assess conditions and take mitigating actions where possible. In the case of gaseous supply, only the secondary option is available. These sensing components should be in each section of the supply line between components, with shut-off valves allowing for the isolation and venting allowing for the diffusing of potentially dangerous components in this case. At the ends of the venting lines, temperature and pressure should also be observed.

Propulsion system sensing and monitoring remains similar to that of existing engines, with the addition of the heat exchange pressure and sensing components, which are used to ensure control of fuel flow and temperature for efficient combustion (see section above). For each heat exchange system outside of the engine, temperature and pressure should be monitored as well. Within all non-pressurised and pressurised areas, hydrogen molecular sensing is available to ensure monitoring of any possible leaks for mitigation procedures. Surrounding the engines and venting locations, temperature sensing in the form of thermal imaging will be used to locate any hydrogen burns external to the engine, as unlike in traditional kerosene engines these flames are not detectable using smoke or flame by eye.

Safety Case Example:  The hydrogen flame detectors in the rear of the aircraft above the hydrogen tanks is having issues due to unknown causes during cruise.  Safety Case Implementation:  Shut-off the sensor and use the point temperature and pressure sensors in the area as the primary sensing for failure of the tank. Engage more stringent safety measures as an extra line of safety and continue in normal operations.

3.2.5. Auxiliary Power Unit

A description of the generic concept auxiliary power unit based on FC is presented in Figure 5. The APU uses a Low-Temperature PEMFC Stack to provide auxiliary power to the aircraft. This system is made of four main sub-systems; hydrogen control, air/water control, electricity control and heat control.

Hydrogen is supplied from the hydrogen tanks via a pressure feed, after which a positive displacement pump is used to ensure correct flow rate for the heat exchanger where the LH2is transformed into GH2 and brought to temperature. This heat exchanger fulfils a secondary function in the form of conditioning the air for the FC, and cooling the electrolyte if sufficient cooling is available for this function. Thereafter, the H2 gas is passed through the FC where it is used to create electricity. Not all the H2 is used in the cathode so it can be recirculated to allow for the full use of the fuel. Water can be removed from this flow using a water trap and the fuel can be removed using the anode exhaust.

Air is supplied from the outside ambient environment using a ram air intake with a compressor, similar to current APUs found in commercial aircraft. This compression causes an increase in temperature after which the flow must be cooled, for which the cooling effect of the phase change of H2 is used. Thereafter, environmental control system, avionics and the electrolyte can be cooled by this system if necessary. Thereafter, part of the flow can be passed through the humidifying membrane if necessary to receive the necessary amount of humidification for efficient function of the FC. This deviated air then passes through the air-cooling system again. Thereafter, insertion of the air into the cathode side of the FC stack occurs. Any air that is not used in the cathode returns into the humidifier where the water within it is transferred into the inlet air through the membrane. If there is too much water created, this is not all transferred and it is condensed after the humidifier and trapped for removal before the exhausting of the air.

Heat exchange for the FC electrolyte is essential to its effective operation. This is undertaken in a cooling loop where cooling capabilities can be taken from either the additional heat sink ability of the LH2 and of ram air heat exchanger. This system temperature is kept regular using expansion vessels for the coolant, pumps and bypass valves.

The output of the FCs, direct current, is collected using a circuit that connects to a distribution centre. This allows for the distribution of AC or DC current to the aircraft systems, dependant on what is required by the system. There is also the ability to charge the battery system.

Safety Case Example:  Malfunction of the Three Phase HEX for APU during cruise, Hydrogen supplied to APU temperature reduced and potentially will cause damage to the PEMFC.  Safety Case Implementation:  Shut down the FC as per normal operation. Calculate the remaining battery charge to compute how much mission time is still available for replacing emergency case of the APU. If flight duration cannot be achieved, and 100% thrust is not required, additional charging can be taken from the electric motor generator on the main propulsive engines, if fuel range and reserve allows.

3.2.6. Heat Exchange

A description of the generic concept H2 heat exchange system is presented in Figure 6. The heat exchange system is an agglomeration of components belonging to other systems; however, due to their similar functionality and interaction with each other, this has been made into its own system. The system is made of four sub-systems: APU system HEX, Flight systems HEX, Fuel Storage HEX and Engine HEX.

The APU HEX has four separate functions: conditioning of LH2 fuel into GH2 for use in the FC, conditioning of air for supply to the FC, cooling of the FC electrolyte and cooling of the batteries. This system also supplies the electrical energy indirectly used to heat the LH2 tanks for pressurisation.

This leads to the fuel storage sub-system. The function of this is to pressurise the tank by creating GH2 from the liquid. This is not a system that would run continuously. Since no electrical spark ignition is wanted near the tank, the electrical element would create a heat exchange with coolant, which in turn would be used in a HEX within the tank.

The liquid fuel from these tanks is used both for the APU and the supply of the engines. The fuel entering the engines through the fuel system encounters a set of three heat exchangers that can be controlled to cool different parts of the engine to differing amounts using bypass systems. The flight systems can be cooled through either the use of bleed air from the engines, or using the compressed air heat exchange for the APU, dependant on where at that moment in time is most efficient.

Safety Case Example:  Damage to the Bleed Air System in engine reduces the ability of the the avionics and Environmental Control Subsystem HEX to cool components.  Safety Case Implementation:  Damage to the bleed air system is likely caused by Foreign Object Damage in one of the aircraft’s main propulsive engines. Though as a singular failure, the bleed air issue is unlikely to be critical, it could indicate major damage to the engine. Firstly, engage APU Bleed air in the place of engine bleed air. Next run checks on engine performance, to ensure there is no further system failures.

3.3. Concept of Operations

In terms of operations, the aim was to keep the operations similar to traditional Short and Medium-Range (SMR) aircraft, while allowing for additional safety to account for the unknowns of the H2 aircraft.

3.3.1. Nominal Flight Operations

Here an estimation of a few possible mission envelopes is possible, based on existing literature in comparison to the above concept—with impact of each undertaken using weighting. The Concept of Operations for the Generic Concept is presented in Figure 7.

With reference to what was stated by Cipolla in the 2022 paper, also referenced in the literature review:

• Ground holding: Likely increases in this phase because of necessary H2 safety precautions creating a ground holding period of 45–60 min. Once fuelling is de-risked and operations are standardized, this is likely to decrease again.
• Taxi-out: Percentage use of engines likely to decrease upon EIS, spacing between aircraft to increase on the ground and therefore a 20–25 min length of this operation not unreasonable.
• Take-off: In the H2 case, still likely 0.7 min in which the engine power setting is 100% nominal flight thrust, with a safety factor allowing over-thrust to 110% in case of emergency during Take-Off.
• Take-off path: Likely no changes to the take-off path except possible increased spacing between aircraft, considering the venting of H2, and this being a risky part of flight. This should be investigated further before any concrete conclusions are made.
• Climb: No changes envisioned.
• Cruise: No changes envisioned.
• Descent: For go-arounds, 100% of nominal thrust should still be available, similar to traditional aircraft operations, with 110% thrust available for one-time off-nominal conditions. Intervals between aircraft could be increased at initial entry into service to give more safety aspects, considering H2 venting and possible flaming in crash-landing or emergency condition.
• Landing: Considering the location of the H2 tanks, it is essential that the landing procedure goes as smoothly as possible, with as little chance of tail strike as possible. This should be given extra space for possible increased safety.

3.3.2. Nominal Ground Operations

These will remain relatively similar to traditional CS-25 aircraft ground operations. The one overarching change likely is the increase in safety distances between aircraft and other hazardous equipment during all stages of ground operation. This could likely be decreased again in future, once the hazards and reliability of different components are fully quantified. The stages of the nominal conditions are likely to stay similar, and some more detail can be seen below:

• Entry Into Daily Operations:
  Cooling the storage tank sufficiently to store LH2 requires a significant amount of energy. Although the entire tank structure does not need to reach 20K, a major portion of the inner tank does, representing a substantial mass to cool. The technique used for filling the tank greatly influences both the pressure required for filling and the expected boil-off losses. It has been observed that methods like upward pipe discharge and top spray fill lead to minimal evaporation losses, thanks to the condensation of gas particles when they encounter super-cooled liquid droplets. Empirical evidence suggests that initially filling a storage tank might require up to two to three times the tank’s total volume in LH2. Accurately estimating the H2 gas lost during the filling of a warm tank necessitates a thermodynamic model. Before moving LH2 from the storage tank to the dispenser, the transfer lines must be pre-cooled to minimize LH2 vaporization during transfer. This cooling is achieved by circulating super-cooled LH2 through the pipes, allowing heat transfer from the pipes to the LH2, which then warms and vaporizes. This vapour remains in the pipes until vented. If the LH2 vaporizes too quickly during transfer, it can substantially reduce, or even halt, liquid flow due to the creation of two-phase flow. Pre-cooling the pipes helps to mitigate the negative impacts of two-phase flow, which can manifest in various flow regimes. A potential route to the initial fill of the tank is as described in Figure 8. First, the system is filled with relatively cheap liquid nitrogen. This is done for two reasons: to reduce the temperature of the system from ambient to approximately 69 °K, and to also purge the atmospheric gases from the system. This will likely consume quite a large amount of time. An alternative to this would be to vacuum the entire tank to remove any water moisture and air; however, this would require a tank capable of experiencing compression from the outside and would not help reduce the temperature. A combination of both initial steps could also be undertaken. Next, the system is filled with cooled GH2 to displace the liquid nitrogen; thus, further reducing the system temperature towards the 20 °K target but also ensuring that any remaining oxygen gases are removed from the system. If helium is used, it should be recovered due to its finite supply. Finally, the LH2 can be introduced, and the aircraft is ready to fly. The aim is to keep the system suitably primed with LH2 so that the first two stages are undertaken as an exception rather than as a rule. Due to the high level of effort required to condition and fill the LH2 system upon entry into daily operation, it is recommended that this procedure be minimised. Maintenance check flights will likely be required after any work on the aircraft during the initial years of H2 flight.
  Not all the LH2 can be used as fuel, a portion: anything between 17% and 25% depending upon the pressure vessel and insulation design and properties will need to remain in the system to ensure cryogenic stability. Too little LH2 and the system will experience run away boil off, necessitating the purging and refuelling of the system from scratch.
• Refuelling:
  The aim of the system would be to try keep the tank and system at cryogenic temperatures for periods as long as possible. There are a few distinct disadvantages to undertaking this with LH2. Firstly, the thermal cycling of tank, piping and valves leads to the material expansion and contraction during operation. Cycling of materials, especially composites where two distinct coefficients of thermal expansion exist, can lead to the reduced operational life of the system, and higher probability of component part failure. This is especially true for the top of the tank, where thermal stressing will occur on each fill. Secondly, there is the issue of the fuel loss and energy use for bringing the tank, fuel and system down to LH2 temperature, along with the time sacrifice required to do so. LH2 has very different properties to traditional Jet-A1 fuel and therefore will need a large change to operating procedures due not only to this but also thanks to the new systems above. Since LH2 is significantly lighter than conventional fuel, lower refuelling kg/s rates would be required, but its larger volume means that a larger diameter hose and different pumping techniques would be required. Pressure-based cryogenic pumps would be the most effective way of achieving this. At present, refuelling trucks with the required pumping technology are not in service and have low TRL; therefore, much improvement would be required before the incorporation of these into the aircraft refuelling system for LH2. Current maximum refuelling rates for LH2 are 5–8 kg/min compared with Jet-A1’s 15 kg/s. This flow rate would have to be increased to circa 7.2–20 kg/s for future commercial use and would be achieved through the implementation of larger hoses [74]. The refuelling time can be increased by increasing the number of LH2 trucks. When defining safety zones for refuelling, the question of risk associated with LH2 refuelling procedures comes into question. This is currently unknown, as a comprehensive baseline has not been developed due to a lack of experience with this system. It can be assumed at present, however, that the safety zone will be far larger than the 3 m cubed used for Jet-A1. The resulting refuelling procedure is desribed in Figure 9.
• Taxiing:
  As stated above, use of engines is likely to decrease upon EIS spacing between aircraft to increase on the ground, and therefore a 20–25 min length of this operation is not unreasonable. Breaking’s risk of spark creation should be accounted for, perhaps shielding the rear of the fuselage or the wheels themselves to keep spark hazards from being directed towards H2 storage areas for extra safety.
• Aircraft Storage:
  The below scenario is based on the long-term shut-down of H2 tanks. In case of LH2 storage, distribution or engine system maintenance, malfunction or long-term shut-down, the aircraft should be brought out of service and the H2 removed. Where possible, it is recommended to complete this at low LH2 level, or when fuel tanks are nearly empty. Initially, connect a gaseous helium or H2 supply to the system and ensure certain connections are securely closed. Then, depressurize the system and purge the supply line by alternately pressurizing and depressurizing it to remove air and reduce oxygen content below 0.03%. For evaporation, introduce a slow flow of warm gaseous helium or hydrogen, ensuring certain valves are closed, and continue until all LH2 is evaporated. If using H2 gas for evaporation, replace it with helium gas and repeat the purging process. Pressurize the system to a lower pressure and then depressurize it, repeating this process several times to reduce H2 content. Next, warm up the system with a continuous flow of helium gas until the gas at the vent header reaches room temperature, indicated by the absence of ice formation or by using a thermometer. If desired, this warming process can also be performed with dry nitrogen once the temperature inside the system is above 100 K. Once at room temperature, purge the system with nitrogen gas following the same pressurization and depressurization steps. Finally, pressurize the system slightly again, close all valves and disconnect the gas supplies. This complete process, as described in Figure 10, prepares the LH2 system for safe storage, maintenance or repair and can also be applied at the end of the system’s lifetime.

3.3.3. Off-Nominal/Emergency Operations

Off-nominal conditions can occur in a few different scenarios, such as failure of a system, low performance of a component or system, unexpected environmental conditions and operator errors. In this paper, we will mainly look at low performance and system failure, as due to the low level of H2 aircraft development, operator errors are hard to account for. Environmental conditions will be briefly touched on. Examples of Off-Nominal System failure can be seen above in the safety cases. This is to give an instantaneous picture of how each of these systems works, so that system failure cases and how this influenced system design decisions can be better understood.

• Crash Landing Example:
  • In the case of a minor crash landing, we expect the requirements to be similar to those already existing, regulated by CS25.785-789, CS25.809, CS25.561 and CS25.562 or equivalent regulations. Making an assumption on this, vertical load factors are likely to be circa 6 fps, and horizontal load factors circa 1.5 times the weight of the aircraft, with seats surviving 16 g. Fuel system would have to take these forces into account, and reduce the effect of distribution or storage damage to passenger wellbeing and emergency evacuation.
  • Fuel tank crashworthiness in a survivable crash case is likely to play a large part in the certification of H2 aircraft, especially LH2 with fuel tanks in the aft of the fuselage, as this already requires a Means Of Compliance for classic kerosene tank thanks to its increased risk in a tail strike on landing, as seen in the SC-E25.963-01. H2’s low ignition energy and wide flammability range means the fuel tank is likely to have higher certification criteria than those currently available in regulation and special conditions.
  • Aircraft Ditching is another crash landing case that currently has not been fully investigated in H2 aircraft. Although there are still many unknowns here, there are a few areas worth considering already; structural integrity in the case of water impact should cause no impairment to exiting the aircraft, the aircraft should be buoyant when partially flooded, safe evacuation should be maintained, H2 fire on and in water is an unquantified risk at present. An inerting solution could possibly negate the effects of this; however, first the risk must be properly understood.
• In-flight Hydrogen Tank Failure:
  In-flight failure of the tank is an emergency case where rapid drainage of H2 could be needed. As part of this emergency procedure, a portion of the fuel that cannot be isolated would likely have to be released from the aircraft through venting or alternative techniques. The ability to dump fuel with H2 fuel could lead to new safety disadvantages and performance unknowns due to the large explosive cloud being released from the aircraft. Therefore, the release rate could be critical, and the use of inerting or a similar system could help the controlled use of this system.
  In case of the failure of the tank, the architecture of the tanks in the aircraft should allow for the isolation of a portion of the fuel for flight. This would be undertaken by initially leak detection and using response rate, temperature, pressure and H2 ppm error sizing, estimating the maximum leak rate of H2 into rear of the aircraft. This would allow for an assessment of the amount H2 that will leak, the risk of combustion of the end mixture and the amount of fuel from that tank that can be saved in the emergency procedure through tank transfer. These figures should be displayed to the flight crew, who should start the emergency procedure and communicate this information to Air Traffic Management, who should initiate clearing of traffic for an emergency landing of the aircraft. Even though the full flight may be achievable due to this, the reliance on novel software and sensing components upon EIS means that a conservative approach could still be the most practical approach to this.

4. Discussion and Conclusions

It could be deduced through this paper that the creation of safe, certifiable, commercial H2 aircraft should be achievable through simple linear development of test, technologies and procedures mentioned in the paper above. The above method works to obtain an initial vision of systems, technologies, components and operations in consortium of partners pursuing different technologies. The result of this vision is a detailed aircraft concept that meets the expected outcomes of a CRL1 evaluation, which was completed in the form of an aircraft’s general familiarisation meeting with EASA, and deliverable outlining of the concept as seen above. This concept serves as a key foundation for both advancing certification regulations and enhancing the certifiability of the design at the next CRL levels. However, for a functional aircraft design, the method could be further improved, relying less on published papers for technological and operational details, though this would require all fidelity of technologies coming from partners’ potential intellectual property. The linear development mentioned is the most pressing and essential piece of work that needs to be continued, but there are some more nuanced intricacies along this development path that must be addressed.

Firstly, the technology readiness of H2 aircraft components and systems is still quite low, as off-the-shelf systems are normally for ground use and would have a detrimental efficient aircraft design due to their weight and sometimes volume. Therefore, continuous optimisation of systems is required throughout their development, to ensure weight creep and thus feasibility of H2 aircraft flight remains at a maximum.

A large point of the discussion regarding methodology and results is the value of the development of these safety specific system and technologies. With the generic concept outlined in the results above, the primary aim was design for safety; therefore, the weight, flight performance and manoeuvrability, volume use and financial viability were either not investigated or secondary aims. This means, in the case of the creation of H2 aircraft that are certifiable as per the outlined practices in this paper, that the aircraft’s affectivity in performance and financial aspects is likely to be largely reduced, compared with traditional kerosene aircraft of similar size.

Lack of performance characterisation and impact estimation means that, though many of these technologies are effective for increasing H2 aircraft safety, their use in normal flight may be too great a cost for their implementation. This factor is something that must be properly weighted and considered, rather than just nominally addressed as in this methodology and design. This could be done through a clean sheet analysis, keeping safety in mind as undertaken here, or through further iteration loops building on this.

For future work, it would be advisable to initiate iteration loops with performance, financial and operational efficacy taken into consideration as well as the safety and certification aspect outlined above. It could easily be that some of the safety aspects introduced above have minimal safety improvements compared to their large weight effect, and should be fully performatively analysed, for which each component, sub-system and system needs to be fully sized, Functional Hazard Analysis, Failure Modes and Effects Analysis, and reliability properly understood. At present, there are too many unknowns and the TRL mentioned above obstruct the comprehensive completion of this. Particular novel failure cases and their characterisation is also necessary, work that is known to be underway at present.

There is likely to be difficulty in achieving regulation that balances safety of the system with creation of commercially competitive aircraft. International coordination is required to harmonise regulation in these areas which will benefit this. EASA, the FAA and other Civil Aviation Authorities, as well as standardisation bodies such as SAE, EUROCAE and ASTM, where industrial partners and end-users will likely play a large role in the creation of these standards and regulations. To create a certifiable aircraft, these regulations, their standards, MOC and any related special conditions will have to be outlined, as until that point, aircraft familiarisation level design cannot proceed to fully certified products.