1 Introduction

The European Union sets ambitious goals in Flightpath 2050 regarding the emissions of aircraft in 2050 [1]. Also, the NASA announced challenging reductions in aircraft emissions in the \(N+3\) goals [6]. These aims are hard to achieve with conventional propulsion systems, therefore hybrid and full electric propulsion concepts attract increasing attention. Consequently, several concept studies are conducted about aeronautical electric propulsion systems [13, 15]. Brelje and Martins provide a broad review on projects in this area [5]. There are supply grid designs available for individual aircraft configurations like in [9]. Other authors found more general design methods [14, 23]. The approach of Gaspari et. al groups the required components in a way that the desired functionality is provided. However, the supply grid structure is only briefly addressed. Also a protection concept on system level is not provided [14]. Stückl presents a method to design a supply structure based on the electrical system of an Airbus A320. Hence, that method is limited to a static supply structure independent of the thrust share of the electrical drivetrain [23]. The protection concept proposed by Stückl is based as well on that of the Airbus A320. Since the electrical structure of the Airbus A320 was developed in the 1980s, it contains only a small amount of power electronics. Hence, the power flow is mostly defined by the physical structure of the supply system. However, electrical drivetrains in hybrid electric aircraft require modern power electronic systems, which enable an arbitrary power flow control. This also affects the protection concept, which is not covered in [23]. Further, the methods proposed in [14, 23] do not distinguish between reference potential and common return of the electrical supply structure. Especially the reference potential selection of the electrical supply structure has a major impact on isolation and protection requirements.

This article extends the approaches of [23] and [14] by including specific characteristics of the electrical drivetrain components and their influence on each other. Additionally, the selection of a proper reference potential and DC grid topology is discussed. The contribution addresses CS-25 certified aircraft, which range from the size of an ATR72 up to an Airbus A320-200. For hybrid electric drivetrains of this aircraft class, electrical propulsion power from \(500\,\hbox {kW}\) for low electrical thrust shares to \(50\,\hbox {MW}\) for full electrical thrust are considered. Therefore, medium-voltage direct current (MVDC) and high-temperature superconductor (HTS)-based onboard grids are in focus to reduce the electrical drivetrain weight. In the context of this contribution, MVDC comprises grid voltage levels between 1 and \(52\,\hbox {kV}\), whereas low voltage direct current (LVDC) grid voltage levels are below \(1\,\hbox {kV}\) as common in power engineering. HTS are considered as an alternative material for power cables and windings of electrical machines. This is an option to keep the supply grid voltage within limits, since the application of HTS enables the transfer of high-power ratings at considerably lower voltage levels than with conventional conductors.

The characteristics of the drivetrain components, their interaction and the onboard grid layout are the basis of the subsequent protection concept development. The scope of this article is the electrical protection concept. For future work, it is considered to expand the protection concept and include the cooling system especially for HTS-based supply structures.

The supply structure design follows the CS-25 certification. For this, the thrust share of the electrical drivetrain serves as a parameter to select an appropriate supply grid layout. This results in a design method for preliminary aircraft design, which is applicable to software environments such as the Multidisciplinary Integrated Conceptual Aircraft Design and Optimization Environment (MICADO) [17]. The proposed approach addresses the design of an onboard supply grid structure of a preliminary hybrid electric CS-25 class aircraft with an arbitrary electrical thrust share. It can serve as a validation instance for manually designed supply grids or as a basis for automated supply grid design. Hereby, the focus lies on the grid structure itself and its implications on component design. Detailed component calculations are subject to the following design step and beyond the scope of this article. Figure 1 visualizes the proposed design flow. The CS-25 certification specifications and the power hybridization level of the respective aircraft determine the onboard grid design. Onboard grid connected drive train components, i.e., electrical drive and electrochemical systems together with the grid potential reference system and the grid technology selection influence the fault behavior of the onboard grid. Hence, for the overvoltage and fault protection system design, it is required to determine the characteristics of these systems. For this purpose, a generic electric propulsion system is introduced first, before the proposed design method is considered in detail.

Fig. 1
figure 1

Design flow for supply grid structure and protection concept determination of a hybrid electric aircraft

Full size image

2 Generic electric propulsion system

To divide the electric power train of a hybrid electric aircraft into several subunits, a generic electric propulsion system is introduced in the following. This simplifies the design process of the electric drive train, since it enables the consideration of each subunit independently before merging them to the complete electric propulsion system.

The electric propulsion system of a partially or fully electric propelled aircraft contains four subsystems independent of the electrical thrust share and whether a MVDC or HTS-based system is applied. These subunits are the power generation unit (PGU), the energy storage unit (ESU), the power transmission unit (PTU) and the thrust generation unit (TGU). Figure 2 illustrates the generic electric propulsion system. The arrows indicate the power flow from power sources to power consumers.

Fig. 2
figure 2

Generic electric propulsion system

Full size image

A PGU generates electrical power from chemically bound energy. This includes turbine-driven generators as well as fuel cells. In contrast to this, ESUs are electrical storage systems able to store available electrical energy directly. ESUs comprise, for instance, batteries, capacitors or superconducting magnetic energy storage (SMES) systems. SMES devices store energy in a static magnetic field using current circulating in superconductive coils [4]. TGUs include components required for thrust generation like propellers, electrical motors and power electronic inverters. The PTU includes all components necessary to distribute electrical energy from source to load. Hence, wiring, separators, fuses and breakers are part of a PTU. The general layout of the PTU is mainly constrained by regulatory aspects, whereas the protection concept is additionally affected by the PGU, ESU and TGU design.

3 Power transmission unit design

International regulations have a major influence on the onboard supply grid layout. The applied conductor technology, however, whether it is HTS or MVDC is of minor importance. As long as HTS-based systems are considered as DC grids, their electrical behavior is similar. The Certification Specifications for Large Aeroplanes CS-25 of the European Aviation Safety Agency (EASA) [12] have been analyzed. In general, the CS-25 certification specifications require that a single malfunction in an aircraft subsystem must not lead to an aircraft loss, i.e., a single point of failure in all aircraft subsystems has to be avoided. An example is the AMC 25.1355(c), which assures that a PTU has no single point of failure. Transferred to hybrid electric propulsion approaches, this results in two PTU classes dependent on the electrical thrust share. For the characterization of these classes, the power hybridization factor \(H_\mathrm {P}\) is used. \(H_\mathrm {P}\) was introduced by [19] and describes the electrical power/thrust share of the overall power/thrust generation. It reaches from \(H_\mathrm {P} = 0\) for aircraft with completely mechanical thrust generation to \(H_\mathrm {P} = 1\) for fully electrical propulsion. The “minor hybridization” class comprises aircraft with an electrical thrust share of \(H_\mathrm {P} \le 0.5\). In this hybridization class, the mechanical propulsion system provides up to \(50\%\) of the total thrust. Referring to the common twin-jet configuration for CS-25 certified aircraft, the electrical thrust share reaches maximal the share of one jet engine. Therefore, the thrust generation redundancy is given by the combination of the mechanical and electrical propulsion system. Hence, the PTU is not required to be redundant in minor hybridized aircraft.

The “significant hybridization” class comprises electrical thrust shares from \(0.5 < H_\mathrm {P} \le 1\). In this class, the mechanical thrust share makes up less than \(50\%\) of the total thrust generation. Due to this, a failure in the electrical propulsion system results in a thrust loss of more than \(50\%\), which exceeds the one-engine-inoperative case of a twin-jet configuration. Therefore, the redundancy in thrust generation is no longer provided by the combination of the mechanical and electrical propulsion system. Consequently, the PTU design needs to provide sufficient redundancy to ensure electrical thrust generation.

The energy hybridization does not directly affect the PTU layout, since its impact is limited to the PGUs and ESUs. However, the application of battery storage systems, fuel cells or turbogenerators requires a certain power hybridization level to convert electrical energy into thrust as [19] points out.

The PTU is principally comparable to existing onboard supply grids for sensor, communication and steering systems [11]. Hence, from the specifications of these systems additional design constraints arise. According to CS 25.1310, in case of single subsystem failure, it is required that the remaining PGUs and ESUs are still able to supply the TGUs. This results in separated PGUs and ESUs defined in AMC 25.1310(a). CS 25.1351 demands that a failure in a single PGU or ESU does not affect the operation of other subsystems. In case of a single PGU or ESU failure, an independent PGU or ESU has to take over the supply of the TGUs. Further, the PTU transports power from source to propulsion, so it has a similar task as the fuel system. From this, the demand arises in CS 25.953 that every TGU needs a power supply, which is independent of other TGUs.

Besides this, the PTU requires a common ground to define a reference potential for the PTU voltage. For this, a low impedance connection to all PTU-connected subunits is mandatory to prevent PTU voltage deviations within the electrical propulsion system. AMC 25.899 specifies that the aircraft body has a low electric impedance for lightning protection. Therefore, the aircraft body is an appropriate reference potential for the PTU. Moreover, the low impedance of the aircraft body protects passengers against electric shock by limiting the potential difference between two points of the aircraft body to a safe value. Table 1 lists the considered regulations including resulting PTU layout requirements and the power hybridization factor for which they apply.

Table 1 CS-25 certification specifications affecting the PTU depending on the power hybridization factor \(H_\mathrm {P}\)
Full size table

For aircraft with \(H_\mathrm {P} \le 0.5\), these design constraints lead to the PTU layout illustrated in Fig. 3. For conciseness, Fig. 3 focuses on the electrical propulsion system, the mechanical propulsion system is omitted. A symmetrical bipolar DC grid is applied, which features the lowest DC grid voltage for a given power transmission capability. Hence, the isolation effort is minimized and the use of simpler switches is possible. The onboard grid reference potential is connected to the fuselage making use of AMC 25.899. Additionally, this complies with CS 25.1353 and avoids a third grid cable. It should be noted that only the power cables serve for power transfer. There is no current flow over the reference potential in normal condition. The onboard grid in Fig. 3 features a common DC bus between the PGUs, ESU and TGUs. The subunits are connected to the PTU in parallel, therefore the supply of the TGUs is in compliance with CS 25.953. Further, this enables separated PGUs and ESUs in accordance to AMC 25.1310(a). Principally, for fuel cell applications the PGUs in Fig. 3 could be concentrated in a single unit. However, Fig. 3 shows the configuration for generator-based PGUs, which are coupled with the aircraft turbines. Hence, there is a connection between mechanical and electric propulsion, so that the power generation is split into two identical PGUs. This ensures that in failure mode half of the total thrust is still available regardless of which turbine fails.

Fig. 3
figure 3

PTU layout for “minor hybridization” level aircraft and turbine driven PGUs

Full size image

The PTU layout of “significant hybridization” levels with \(0.5 < H_\mathrm {P} \le 1\) requires an inherent redundancy. This is due to the fact that the electric thrust share is larger than 50 % of the total thrust. For this purpose, the PTU is split into two supply zones as shown in Fig. 4. Again, the mechanical propulsion system is omitted for conciseness. Each supply zone comprises half the electric power generation \(P_\mathrm {gen}\) and half the thrust generation \(P_\mathrm {thr}\) as well as half the electrical storage capacity \(E_\mathrm {store}\) installed in the aircraft. In Fig. 4, the power generation and energy storage are concentrated in one PGU and ESU, respectively, per supply zone. The thrust generation is split into two TGUs. This topology has been chosen to explain the protection concept in Sect. 4. Principally, the power generation, energy storage and the thrust generation can be split into an arbitrary number of elements. In normal operation, both supply zones are working independently similar to existing low voltage onboard supply grids. Hence, in case of a failure in one supply zone half of the propulsion power is still available which complies with AMC 25.1355(c). During normal operation, a supply zone equals a PTU of a “minor hybridization” level aircraft. Both supply zones are only coupled in failure mode to enable the PGU and ESU of one supply zone to feed the TGUs of the other zone in accordance to CS 25.953 and CS 25.1310. This allows the reconfiguration of thrust generation enhancing maneuverability in failure mode.

Fig. 4
figure 4

PTU layout for “significant hybridization” level aircraft

Full size image

4 Power transmission unit protection

The protection system of the PTU is dependent on the subunit design and the grid potential management. Further, the CS 25.1357 specifies an automated circuit protection, which operates independently for each subsystem. Additionally, it demands that components are disconnected and discharged. Since this section considers a protection concept for an universal aeronautical DC grid, the resulting protection system is applicable to MVDC and HTS-based systems.

4.1 Electrical drive systems

One of the main tasks when designing an electric propulsion system is the selection of suitable electrical machines for the TGUs and turbine driven PGUs. Possible machine types include the induction machine (IM), the permanent magnet synchronous machine (PMSM) and the switched reluctance machine (SRM).

IMs involve a rotating magnetic field in the stator, which induces a rotor current in the rotor windings. This allows the IMs to be switched off by disconnecting the stator voltage, thereby enabling fast machine shut downs, since the drive shaft is not required to stop rotating.

Conversely, the PMSM features internal induction by permanent magnets mounted on the rotor. The constant induction of these magnets can not be turned off during failure. Hence, the PMSM induces current until the induced voltage falls below the terminal voltage or the rotor stands still.

The SRM is based on the magnetic reluctance principle instead of a rotating magnetic field to convert electrical into rotational power. Basically, a SRM consists of several electromagnets, which are switched in a certain pattern. The advantage of a SRM is that the rotor consists of solid steel and does not incorporate windings or magnets, which need to be fastened. Hence, the SRM can operate at higher rotational speeds than an IM or PMSM. Since the rotor contains no magnets, the SRM enables fast machine shut downs similar to IM by switching off the electromagnets [8].

For power and thrust generation by DC grid connected electrical machines, power electronic converters are necessary to provide a variable AC current. Although there are several topologies suitable for high-power electrical drives, the effect of the drive inverter on the PTU protection concept is almost independent of the actual inverter topology. This results from multilevel drive converters like the three-level neutral point clamped converter (3LNPC) [20] or the five-level flying capacitor converter (5LFCC) [24] being a deduction of the basic two-level configuration shown in Fig. 5. This also applies to modular multilevel converters (MMC) [18]. Hence, regardless of the number of voltage levels, semiconductor switches with an anti-parallel diode are placed between the PTU connection and the machine terminals. Figure 5 illustrates this for the example of a two-level three-phase inverter. Therefore, the current flow between the PTU and electrical machine is controllable. Consequently, a fast shut down of IMs or SRMs by the converter control is feasible. A fast shut down of a PMSM is also possible, but requires the PTU voltage to be higher than the induced voltage at the PMSM terminals. If the PTU voltage drops below the induced voltage at the PMSM terminals, the current will commute to the anti-parallel diodes. In this operation mode, the converter control is unable to manipulate the current flow into the onboard grid. Hence, the PMSM turns into an uncontrolled fault current source during a low impedance grid fault.

From the converter behavior, it can be concluded that the semiconductor switches should have a so-called normally-off characteristic, i.e., the semiconductor switches turn off when the auxiliary converter power supply is shut down. In case of a converter failure, the auxiliary power supply of that converter is shut down to switch off the semiconductor switches. This measure requires the low voltage onboard grids to provide the auxiliary power for the electric drive train. Hence, low voltage circuit breakers are sufficient to shut down the drive converters.

Fig. 5
figure 5

TGU with two-level drive inverter and over voltage protection

Full size image

4.2 Electrochemical systems

Energy sources mainly discussed to propel hybrid electric aircraft are hydrocarbons like synthetic fuels [3] and liquid hydrogen [22]. Therefore, turbines and fuel cells are likely to provide the required electrical power. Consequently, PGUs will comprise electrical machines to convert rotational into electrical power or fuel cells to extract power from hydrogen. Other sources for electrical power are storage systems like batteries, which are part of ESUs. Both battery storage systems and fuel cells are electrochemical devices providing a DC current at their terminals. The terminal voltage of batteries and fuel cells changes with state of charge and operation point, respectively. Hence, if an electrochemical system is directly connected, the PTU is required to manage the state of charge of the battery system and the battery or fuel cell current. For this purpose, the PTU needs to adapt its voltage to the voltage of the connected electrochemical systems. The protection of the electrochemical systems require fuses or circuit breakers for fast disconnection in case of a failure.

If a DC-to-DC converter is applied to connect the electrochemical systems to the PTU, this DC-to-DC converter manages the state of charge and the current of the electrochemical system. Therefore, the PTU voltage can be constant. Additionally, the electrochemical devices can have a nominal voltage different to the PTU voltage. This enables the operation of fuel cells and battery storage systems at LVDC level independent of the PTU voltage level. Consequently, low voltage breakers or fuses are sufficient to separate the electrochemical element from the low voltage connection of its DC-to-DC converter in fault condition. Further, the supply current from electrochemical devices becomes controllable, since it passes power electronic conversion units. Figure 6 illustrates this using the example of a dual-active bridge [7]. The application of an isolated or non-isolated DC-to-DC converter has a minor influence on the PTU connection requirements, since there is a controllable power flow in both cases. Hence, a disconnector is sufficient at the PTU connection of the DC-to-DC converter.

Fig. 6
figure 6

PGU featuring a fuel cell connected to the PTU by a two-level dual-active bridge including voltage protection

Full size image

Table 3 summarizes the effects of electrochemical systems on PTU protection.

4.3 Grid potential management

CS 25.1353 defines that the return conductor of all PTU-connected subsystems is assured in normal operation as well as in failure conditions. Additionally, AMC 25.899 determines that a low impedance aircraft structure is available. The aircraft structure serves as reference potential for other onboard grids as well and is a key element for personal safety. Therefore, the PTU is directly connected to the aircraft structure at the DC link capacitor’s midpoint terminals of the subsystems as illustrated in Figs. 5, 6 and 7. Thus, CS 25.1353 is also complied if a grid pole cable detaches. In this case, the failure current will commute to the aircraft structure and return to the midpoint terminals. This situation is similar to a lightning traveling through the aircraft. Hence, the low impedance aircraft structure prevents the development of dangerous potential differences and ensures personal safety. In normal operation, the current returns over the other DC grid pole, so in steady state no current flows over the aircraft structure.

The capacitive referencing via the DC link capacitors in Fig. 7 prevents that DC link midpoint voltages increase to the positive grid voltage \(U_\mathrm {+}\) during failure. Hence, the voltage \(U_\mathrm {-}\) of the unaffected grid pole remains on nominal value. This results in reduced blocking voltage requirements of the semiconductors and less isolation effort in all components of the drive train. Therefore, the same potential referencing scheme is applied to galvanic isolated low voltage domains of electrochemical systems as depicted in Fig. 6.

Fig. 7
figure 7

PTU pole-to-reference fault example

Full size image

Due to the low resistive referencing, the failure impedance \(Z_\mathrm {failure}\) is determined by the failure location and the pole-to-reference impedance. As the PTU of an aircraft is a comparably small grid, there is little line impedance from source to failure. Hence, \(Z_\mathrm {failure}\) is mainly dependent on the pole-to-reference impedance. In case of a low impedance failure, this behavior results in a current impulse at fault instant supplied by the subunit’s DC link capacitors. Subsequently, the stationary fault current \(I_\mathrm {failure}\) equals to the maximum sum of the nominal currents of all PGUs and ESUs connected, if all fault current sources exhibit a controlled fault current behavior. As soon as a directly connected electrochemical device or a rotating PMSM is involved, \(I_\mathrm {failure}\) can exceed the sum of nominal currents, since the fault currents of these components depend on their respective internal resistance and feed in uncontrolledly during a grid voltage drop out.

However, HTS-based systems show a different behavior in this context. HTS wires consist either of superconductive filaments embedded in an usually conductive metallic matrix or of superconductive tapes deposited on a metallic substrate [10]. Since the aircraft structure is not superconductive a pole-to-reference failure results in a high \(Z_\mathrm {failure}\), which causes the conductor to leave the superconductive state and become an isolator due to the heat injection at the fault location [21]. Hence, the fault current commutes to the metallic matrix or substrate, respectively. As this leads to a sharp increment in the line resistance, the line inductance faces a steep fault current drop, so that an overvoltage spike will occur. In case of a pole-to-pole fault, the resulting current impulse drives the superconductor into the isolating state, which in turn leads to a sharp current drop and an overvoltage spike. Another aspect is the different fault behavior of rotating PMSM with superconductive windings during PTU voltage drop out. Since the HTS winding is designed for nominal current, the short-circuit current of the PMSM is limited to that value.

4.4 Overvoltage protection

The electrical drive train of a hybrid electric aircraft is vulnerable to overvoltage events like lightning strikes or voltage spikes due to fault instants. To limit these overvoltages, varistors are placed at the subunit’s PTU terminals between grid poles and reference as illustrated in Figs. 6 and 5. Thus, the source driving the overvoltage is discharged to grid reference, while the PTU voltage is limited to the residual voltage of the varistors. For electrochemical systems as given in Fig. 6, additional varistors are inserted at the coupling point between the DC-to-DC converter and electrochemical device to ensure overvoltage protection at the low voltage terminal as well. By the placement of the varistors, sensitive electronic systems of the subunits are protected. Since varistors are passive components varying their resistance dependent on the applied voltage, the proposed overvoltage protection acts completely autonomously and in compliance with CS 25.1357.

The varistor design is dependent on the PTU voltage and the maximum dissipation energy [2]. Regarding overvoltages due to switching events, the maximum dissipation energy is determined by the PTU nominal current and the PTU inductance. The energy of lightning impulses is given in literature [16]. The main aspect of varistor design affecting the electrical drive train is the residual voltage. That voltage represents the maximum voltage for power electronics and separator design. At the cable line, the voltage drop between varistor and overvoltage source adds up to the residual voltage. Hence, the PTU cable necessitates a higher isolation voltage than the residual voltage dependent on the maximum distance between a PTU-connected subunit and a varistor.

4.5 Fault protection

The fault protection system layout for a hybrid electric aircraft follows the PTU design discussed in Sect. 3. To ensure an independent operation of the supply zones of an aircraft, separate fault protection systems are applied for each supply zone. Hence, the PTU fault protection is split into several protection zones as Fig. 8 illustrates. The division depends on \(H_\mathrm {P}\) and exhibits the same thresholds as for the power source separation. For \(H_\mathrm {P} \le 0.5\), one protection zone is sufficient. \(H_\mathrm {P} > 0.5\) implicates intrinsic redundancy in the PTU fault protection system, consequently it is split into at least two protection zones.

Fig. 8
figure 8

PTU fault protection system layout for “significant hybridization” level aircraft

Full size image

The fault protection system design itself is the same for all values of \(H_\mathrm {P}\). To support the compliance with CS 25.1310, AMC 25.1310, CS 25.1351 and AMC 25.1355(c), it comprises switches at every subunit terminal and between the respective PTU connection points. Thus, the PTU fault protection enables failure separation, so that the operation of a single subunit is independent from other subunits. Additionally, the switches divide the PTU supply zone into several grid sections depicted in Fig. 8. The resulting PTU partitioning serves the failure localization. For this purpose, in each grid section an isolation and connection monitoring device is installed. These enable isolation and cable detach fault detection in all grid sections in parallel.

A more detailed definition of the PTU switches requires the fault clearing scheme. If a fault is detected, the fault current is cut off from its sources by opening the switches at the PGU and ESU terminals. Subsequently, all grid sections are separated to localize the failure. Then all unaffected grid sections are reconnected and the PTU starts up again. Hence, referring to the subunit characteristics given in Tables 2 and 3 circuit separators are sufficient, if all PGUs and ESUs comprise controlled sources. In this case, it is feasible to ramp down the fault current by the power electronic converters, so that the PTU switches can open under zero-current conditions. Consequently, a circuit breaking capability is not required. However, PGUs or ESUs comprising an uncontrolled fault current source as a directly coupled electrochemical system require circuit breakers at their terminals. Also, PMSM drive-based PGUs and TGUs require circuit breakers due to inertia and windmilling unless the mechanical system is able to stop the PMSM immediately. Additionally, the electrical system design has to account for the required deceleration time during which the fault current persists. Considering a HTS-based PTU, the fault behavior is similar. During fault, the superconductive material leaves superconductivity and becomes an isolator. Hence, the fault current commutes to the metallic matrix or substrate, respectively. The fault clearing scheme is therefore similar to that of the MVDC-based system, so a circuit breaking capability is only required for uncontrolled fault current sources like PMSM drives or directly coupled electrochemical systems. However, the metallic matrix or substrate has a significantly higher resistance than the superconductor. This shrinks the fault current to a level below the nominal current of the feeding sources.

Table 2 Electrical machine characteristics affecting the PTU protection system layout
Full size table
Table 3 Electrochemical system characteristics affecting the PTU protection system layout
Full size table

After the fault clearance, the affected PTU grid pole is completely discharged. Hence, the PTU requires a certain amount of energy storage during a mission to restart after fault. In case of a single pole-to-reference fault, the required energy is stored in the capacitors of the unaffected pole. Therefore, the subunits need the ability to start from PTU pole-to-reference voltage, which is half their nominal voltage. However, after a simultaneous fault in both PTU poles, there is no unaffected pole available. In this case, the drive train needs a self-contained start capability to get back into operation. A rotating PMSM, a fuel cell, or a battery storage are appropriate systems for this purpose. Hence, one of these devices is required in a hybrid electric aircraft to achieve a fault-tolerant drive system.

For fault detection, the subunit current sensors at the respective DC links are principally suitable. To comply with CS 25.1357, a separate current monitoring at grid reference connection of each subunit is required. That device enables the physical separation of the PTU supply control and the PTU fault protection system. Hence, the given sensors of the subunits serve as backup system for the fault protection system. Moreover, the measurement data of the given sensors enable the monitoring of the grid reference current sensor functionality.

5 Conclusion

This article proposes a general electrical propulsion system for CS-25 certified hybrid electric aircraft. A generic propulsion system is introduced to divide the electric drive train into several subunits. Additionally, the CS-25 certification regulation is reviewed and applied on the respective subunits. Based on this, the onboard grid topology and protection system is developed. The DC supply grid layout depends on the power hybridization factor of the respective aircraft, since the redundancy demands rise with electrical thrust share. Hence, for a power hybridization factor exceeding 50% total thrust share, the onboard supply grid is split into two autonomous entities with equal power generation and thrust share. The onboard grid protection system is designed based on CS-25 certification demands and divided into two protection zones for a power hybridization factor larger than 50%. A protection system design without DC circuit breakers is feasible, if all subunits exhibit a controlled fault current feed behavior. In this case, the subunits are able to shut down the current by themselves. The findings presented in this article are applicable to aeronautical DC supply systems in general comprising medium-voltage DC and high-temperature superconductor-based systems.