Safety Case Modeling for Fire Risks in Liquid Hydrogen-Fueled Aircraft ^†

Abstract

The aviation industry is transitioning toward hydrogen propulsion to meet sustainability goals, introducing novel fire safety risks that require updated regulatory frameworks. This study addresses the certification challenges for liquid hydrogen fuel systems by advancing the Certification Readiness Level through a model-driven approach. Using a Model-Based Safety Assessment, this research applies Bow-Tie Diagrams within the NASA AdvoCATE software to analyze in-flight fire risks for a tube-and-wing aircraft architecture. The study models critical threats, including cryogenic embrittlement and leakage, mapping them to specific prevention and protection barriers derived from a regulatory gap analysis. The assessment identifies leakage as the primary failure condition and proposes a safety architecture that emphasizes prevention barriers. Quantitative safety case modeling demonstrates, with proposed means of mitigation and barrier integrity, the feasibility to compute the residual probability of a catastrophic in-flight fire according to EASA CS 25.1309 requirements. These findings validate the use of safety architectures to bridge the gap between design and rulemaking, offering a scalable framework to support early-stage certification and the safe integration of hydrogen technologies into commercial aviation.

1. Introduction

Civil aviation is currently undergoing a paradigm shift aimed at achieving net-zero emissions by 2050, a goal aligned with the European Green Deal framework. To meet this sustainable objective, the integration of disruptive technologies, such as hydrogen ($H_2$) propulsion, is required. These technologies must mature over time, progressing from conceptualization to entry into service (EIS), while being integrated with legacy systems according to their Technology Readiness Level (TRL). However, the introduction of hydrogen introduces novel risks that differ significantly from those present in conventional kerosene-based aviation, particularly regarding fire and explosion hazards.

The existing regulatory system faces the challenge of addressing these risks through adapted rules, guidelines, and Acceptable Means of Compliance (AMCs) tailored to emerging technologies [1,2]. A critical challenge in this domain is the “chicken-and-egg” dilemma: regulations are typically built around a design, but design activities require an understanding of what the regulations will be. To mitigate the gap between technological development and regulatory preparedness, the Clean Aviation CONCERTO project has developed a nine-level Certification Readiness Level (CRL) scale [3]. This scale systematically measures the maturity of the regulatory framework for innovative aeronautical products before the formal certification process begins.

This study proposes a methodology designed to support the analysis required to consolidate a CRL 4. Specifically, this methodology facilitates the identification of mitigation barriers corresponding to safety requirements previously identified in a CRL 3 gap analysis. The objective is to formalize the initial steps of a CRL 4 evaluation, defining orientations for rulemaking activities to address hydrogen innovation. By offering a holistic view of risks and consequences, this approach can provide regulators and designers with a broader understanding of fire prevention and protection strategies.

The paper hereafter is organized as follows. Section 2 outlines the methodology developed for safety case modeling and its perimeter. Section 3 elaborates on the development of a safety case model for in-flight fire hazard on hydrogen-powered aircraft. These results are discussed in Section 4 along with plans for future work, before concluding the paper.

2. Materials and Methods

2.1. Model-Based Safety Assessment

To address the limitations of implementing traditional document-based safety assessments during early design and certifiability evaluation stages, this research utilizes a Model-Based Safety Analysis (MBSA) approach. The methodology is primarily founded on Bow-Tie Diagrams (BTDs), a tool previously employed in civil aviation safety assessments to map threats and consequences to preventive and recovery barriers [4].

As illustrated in Figure 1, BTDs are composed of five distinct elements. Linearly, a series of threats (initiating events) lead to a top event (the Failure Condition) representing the loss of control of a given hazard. To prevent this, prevention barriers are established. If these barriers are breached and the top event occurs, protection (recovery) barriers are engaged to prevent the final consequences and mitigate their severity. This study uses NASA AdvoCATE Version 0.35.1-s software (Assurance Case Automation Toolset for Aviation) to model these diagrams, enabling centralized risk analysis and traceability between hazards, requirements, and safety architectures.

2.2. Aircraft Architecture and Scope

The methodology is applied to develop a safety case model for $H_2$ fire risks using the hydrogen aircraft generic concept presented in Figure 2 from the Clean Aviation CONCERTO project. It is a tube-and-wing architecture with two $H_2$-burn turbojet engines, two liquid hydrogen ($L{H}_2$) tanks in the aft section of the fuselage, an $L{H}_2$ fuel distribution system, and a fuel cell stack acting as the auxiliary power unit.

The fuel system comprises $L{H}_2$ tanks, $L{H}_2$ distribution lines designed to withstand cryogenic temperatures (−259.35 °C), valves, pumps, heat exchangers, and the gas turbine. The system design accounts for intrinsic hazards such as hydrogen embrittlement, permeation, and the high diffusivity of hydrogen [2,6].

2.3. Risk Modeling and Quantification

In the BTD model, threats correspond to the failure modes of the system components. These failures are assigned user-defined attributes: initial probability and severity. Each prevention and protection barrier is assigned a barrier integrity value, which serves as a measure of their reliability. Barrier integrity is thus calculated as

$$\mathrm{Barrier}\mathrm{Integrity}=1-\mathrm{\Lambda }\left(T\right)$$

(1)

where $\mathrm{\Lambda }\left(T\right)$ represents the mean failure rate of a barrier over the operation time T of the system. For the purpose of this study, given the current low maturity of components for an aircraft $H_2$ distribution system, the numerical values for the probability of occurrence of threats and barrier integrity were approximated based on industrial standards, existing literature, and expert engineering judgment. This quantification allows the NASA AdvoCATE to calculate, through the safety case BTD model, the residual probability and severity of the Failure Condition (FC) and its final consequences. By comparing these results against the acceptability matrix of EASA CS 25.1309, the robustness of the proposed mitigation measures can be evaluated.

3. Results

This section presents the development, content and outcomes of the safety-case model for in-flight fire scenarios using the $H_2$ aircraft architecture described in Section 2.2.

3.1. Identification of the Top Event and Threats

The safety assessment process commences with the definition of the critical failure condition to be investigated. Based on findings from previous research, hydrogen leakage is selected for this study as its adequate characterization contributes to addressing critical areas for the certification of hydrogen aircraft identified in ref. [2]. This selection was driven by the unique physical and chemical properties of liquid hydrogen ($L{H}_2$), specifically its wide flammability range in air of 4–75% by volume, its high diffusivity, and a minimum ignition energy (MIE) in air of 0.017 mJ in the most unfavorable conditions. The analysis classifies the threats leading to this top event into three primary categories: mechanical, structural, and insulation failures. Mechanical threats encompass the degradation of moving parts such as seals, hoses, and connections, alongside issues like vibration fatigue and excessive pressure within the distribution and venting lines. This category then includes failure of components of the $H_2$ distribution system e.g., pumps, valves, fuel lines, heat exchangers, and their connections. Structural risks arise principally from material exposure to cryogenic temperatures, which can induce thermal contraction and $H_2$ embrittlement, thereby weakening the integrity of the tanks and pipelines and reducing the $H_2$ isolation properties of the structural elements. Insulation threats relate to failures in the pressure and temperature control system of $H_2$ tanks and distribution lines that may result in abnormal boil-off.

Finally, threats that constitute potential ignition sources are considered to model the cause-and-effects relationships between the top event and the final consequences, i.e., fire. These threats include potential arcing, short circuits, or malfunctions in power supplies for pumps and sensors located in proximity to the fuel system.

3.2. Barrier Modeling

A comprehensive safety architecture is then modeled in the NASA AdvoCATE environment through a BTD, following the methodology presented in Section 2. A streamlined version of the resulting BTD is presented in Figure 3 for clarity. Details of existing barriers are presented in the following subsections. The BTD connects the threats to the top event and to subsequent consequences, with prevention and protection barriers as means of mitigation. The definition and sequencing of the proposed barriers are derived from an extensive review of scientific publications, industrial standards, and publicly available information data on the considered $H_2$ technologies and their maturity level. These inputs are then synthesized to develop the risk-mitigation strategy illustrated in the BTD.

The prevention side of the architecture, particularly concerning the loss of tank pressurization and distribution integrity, integrates multiple layers of defense. Key preventative measures include the implementation of double-walled vacuum-insulated tanks and distribution lines to minimize heat transfer and boil-off. Furthermore, the system incorporates redundant pressure relief valves (PRVs) connected to a dedicated venting system to manage overpressure scenarios. To further reduce the likelihood of flammable atmosphere formation, active means such as continuous ventilation in the Hydrogen Tank Zone (HTZ) and On-Board Inert Gas Generation Systems (OBIGGSs) are proposed to ventilate and/or inert zones that are prone to gaseous $H_2$ accumulation.

To complement prevention barriers through a multi-layer risk-mitigation strategy that combines prevention and protection, the model then addresses the consequences, specifically in-flight fire initiated by ignition of a flammable atmosphere, resulting from uncontrolled leakage as the top event, by mechanical sparks, thermal sources with surfaces temperatures typically above 560 °C, or electrical sources. The protection architecture relies heavily on a revised fire zoning strategy that is based on the current zoning prescribed in certification regulation appropriate for fossil fuel complemented by the introduction of Hydrogen Distribution Fire Zone (HDFZ) and Confined Fire Zones (CFZ). Protective barriers within these zones include the strict segregation of Electrical Wiring Interconnection Systems (EWISs) from $H_2$ components, the application of anti-static coatings, and the use of specialized optical flame detectors capable of identifying invisible hydrogen flames as well as active fire suppression systems.

3.3. Residual Risk Assessment

The quantitative verification of the model relies on barrier integrity values derived from industry standards, e.g., a mean failure rate of ${10}^{-3}$ per flight hour for fuel pumps over 3000 h of operation based on ref. [7], used to approximate reliability for similar components thus yielding a barrier integrity of 0.995. Based on the proposed risk-mitigation strategy, the computational analysis performed by the software yields a residual probability for the catastrophic top event of hydrogen leakage of $9.37\times {10}^{-10}$ per flight hour. This result falls below the CS 25.1309 regulatory threshold of ${10}^{-9}$ per flight hour as presented in Figure 4, indicating that the proposed combination of prevention and protection barriers is theoretically sufficient to meet the quantitative safety objective for a catastrophic failure condition, provided the assigned barrier integrities are maintained. This early assessment furthermore demonstrates the feasibility of modeling and quantifying safety cases at low certifiability maturity stages using the BTD techniques, without requiring detailed design features, for later maturation of regulatory framework, development of means of mitigation, or design principles.

4. Discussion

4.1. Combining Prevention and Protection

This study highlights that demonstrating an acceptable level of safety for $H_2$-powered aircraft regarding $H_2$ leakage and subsequent fire hazards will likely require a reassessment of the current prevention-protection balance existing for kerosene-fueled aircraft. The findings suggest that, given $H_2$ volatility and flammability properties, regulatory efforts and design specifications should place a particular emphasis on preventing leaks and the formation of flammable H2-air atmospheres. The BTD model reflects this by placing a significant number of barriers on the Prevention side of the diagram, such as supercritical fuel flow sensors and fail-safe sealing and connecting designs.

4.2. Regulatory Maturation (CRL 4 Consolidation)

This work illustrates a practical pathway for transitioning from CRL 3 (regulatory gap and risk analysis) to CRL 4 (orientation for rulemaking) as defined in ref. [3]. By formalizing safety barriers into a coherent model, this methodology helps supporting the “chicken-and-egg” resolution by providing a platform for iterations, at early design and certifiability evaluation stages, between regulators, designers and research laboratories.

The model directly addresses identified safety concerns and gaps identified in current regulations. The regulatory adjustments that could result from this modeling will be essential to close gaps identified in [2] as part of Fire & Explosion Prevention and Protection critical area for certification. For example:

• CS 25.863 (Flammable Fluid Fire Protection): The model proposes new leak detection and management systems as primary barriers.
• CS 25.955 (Fuel Flow): The requirement for flowmeters is updated to suggest locking mechanisms in the presence of leaks, rather than simple bypasses used in kerosene systems.
• CS 25.1181 (Designated Fire Zones): The study integrates the concept of HDFZ and Confined Fire Zones (CFZ) into the safety architecture.

The model serves as a “black box” assessment at the system level. It supports establishing and evaluating in a dynamic manner qualitative and quantitative requirements and means of mitigation for the fuel system as a whole without dictating the internal physical architecture of every component. This flexibility ans scalability is crucial for early-stage certification, allowing regulations to evolve alongside technological definitions.

4.3. Future Work

Future work will focus on refining the barrier integrity values, i.e., the effectiveness of proposed means of mitigation, through more accurate component testing and experimental data on hydrogen fire behavior. Additionally, the safety-case model will be expanded to improve modeling of the complexity of possible fire scenarios and to refine the proposed fire zoning and associated safety criteria for each zone. Then, the scope of this in-flight fire hazard analysis should be expanded to specifically address the engine-nacelle area where new systems such as $H_2$ phase-transitioning system or threats such as $H_2$ flame burn-through are to be considered. Finally, the proposed methodology could be extrapolated to other design configurations to further support rulemaking tasks and ensure a unified approach to $H_2$ aircraft certification.

5. Conclusions

The transition to hydrogen-powered civil aviation requires a robust regulatory framework for certification that evolves in step with technological advancements. This study presented a model-driven methodology using bow-tie diagrams and NASA AdvoCATE software to assess in-flight fire risks for a hydrogen-powered aircraft. By identifying critical threats—ranging from mechanical failures to cryogenic embrittlement—and mapping them to specific prevention and protection barriers, this safety-case modeling approach proves to be valuable in dynamically and progressively assessing the effectiveness of risk-mitigation strategies and associated technical or regulatory barriers. In addition to supporting qualitative evaluation, the methodology enables quantitative assessment of residual risk. Its full potential therefore depends on the availability of relevant characterization data for the proposed mitigation barriers to ensure accurate quantification of remaining risk.

The research confirms the utility of Model-Based Safety Assessment in supporting the consolidation of Certification Readiness Level 4. It facilitates a collaborative environment where regulators and industry can define means of compliance before physical prototypes are fully realized.