That’s better than nothing, but surely the relay and probably even the zener will be too slow to avoid frying the avionics.
That is not the case for a Lycoming / Continental with a big battery. The load impedance will be quite low. When the regulator goes for maximum output the voltage will rise relative slowly, and the Relay will disable the field, thus no alternator output.
It would be different on an Rotax engine, or when using external power
I think the internal generator on the Rotax 912 is very poorly, and massive spike can be seen (and also seen some defective avionics in these).
The one valid way is to short circuit the supply to ground behind the fuse with something very fast and capable of quite some current – a 50Amp thyristor goes a long way. Even if it does blow to become a short circuit, it is much better to blow a 1,00 € thyristor than a few 1000 quid of avionics.
Series protection, like your MOSFET example, takes a lot of believing: one day the MOSFET will blow and you won’t even know, until it’s too late.
That’s true, but the old “overvoltage crowbar” method with an SCR is rarely used these days. It is a pretty drastic solution and requires a fuse which blows, and requires that the power source can generate enough current to “definitely” blow the fuse. That is OK with a linear power supply whose transformer+rectifier can generate a lot more current than it normally does, but an offline switching power supply is usually quite close to the line and would struggle to go say 50% or 100% above, as is needed to decisively and rapidly blow a fuse.
Fuses are really crude devices which need a huge amount of current (above the normal level) to blow them… Ideally you want a 10x overcurrent, to quickly pop a fuse which is rated correctly so it doesn’t run hot during normal operation. Same issue with the crappy thermal circuit breakers we have in our planes … a lot of them run pretty warm under a rated load 
Today, you can buy a 300A MOSFET with an Rds of 0.003 ohm for maybe 10 quid, which could perfectly well carry the current draw of a GA aircraft. Much less than 10 quid if you take the data sheet literally and use a TO220 device (yeah, right, 300A?) but that would be stupid. The point is that the chance of the power supply failing and generating a high voltage and the MOSFET failing, are miniscule.
However there is no way that an alternator (that has any significant load on it) can generate an excessive voltage if the field current is missing. It is physically impossible. So interrupting the field current is just as good and does not involve switching big currents. Well, almost as good, because you might have a short between the bottom of the field winding and ground, causing the field to appear right across the bus and thus getting the maximum current. You just have to hope that the wiring is OK. Not every fault condition can be designed out.
However, personally I would not use a relay for the purpose of breaking the field current because while it is true that IF there is a battery in the circuit, the potential (no pun intended) for a massive overvoltage is very limited in the time the relay takes to open, if the battery became disconnected then all bets are off as far as the bus voltage goes, and that is a realistic failure scenario especially as many aircraft alternators are unstable with no battery connected (reportedly).
The over voltage trip that failed on our aircraft was a crude electromechanical device with coils and contacts. But they were welded shut the only time they were needed.
The voltage regulator was also an electromechanical thing; somewhat similar to the one on my 1946 Ferguson tractor
It was aircraft serial no 532 if I remember correctly.
With these old fashioned systems the biggest problems come with battery disconnection with the alternator turning. A bad battery connection is the typical cause. The regulators are just too slow to catch it, resulting in what the automotive people used to call a load dump transient. On a 12v system it went up to about 80v for about 300mS
I just purchased a ground power supply from the US. Its specs are: 28.3 +/- 0.5 Volts DC, 35 amps continuous. Used to run the avionics on the ground etc. Quite important not to deplete the battery with a turboprop.
The regulators are just too slow to catch it, resulting in what the automotive people used to call a load dump transient. On a 12v system it went up to about 80v for about 300mS
There is even an ISO spec for the load dump pulse profile which automotive equipment is supposed to be able to withstand. If e.g. you look up the LM2940CT-5.0 regulator, the data sheet refers to this.
One would hope that avionics designers would have taken this into account, since GA alternators are straight out of cars (12V) or trucks (24V). But you never know… yesterday I was looking at the schematics of the KC225 autopilot computer and it is best described as a tour de force in throwing the maximum possible number of components on a PCB – the sort of thing a kid straight out of univ might do. Reassuringly the same concept was applied to the power supply so it will probably withstand 2000V for 10 seconds
Indeed there is an ISO spec for Load Dump, plus many other automotive transients, but most car companies have their own as well. We have some rather expensive test kit to produce many different electrical transients to all the subtly different requirements.
The faster spikes can be troublesome to microcontrollers, whereas the load dump is quite destructive.
Peter did you use TVS diodes as part of the PSU protection circuitry?
Never heard of that term – had to google on it I know them as VDRs – voltage dependent resistors. They are not diodes in any sense of the term “diode”.
Yes – always use a big one of them across the mains input.
They are no good for protecting the aircraft bus though. Their knee is far too vague. A massive zener diode (or a synthesised zener, done with a MOSFET) would be OK but we come back to the problem of somewhat limited power available to blow some upstream fuse or a thermal circuit breaker. But it could be done and I don’t know why it isn’t.
I think there is a difference between a TVS and a VDR – the one being a kind of diode, the other a distant cousin to the resistor. One does apply them more or less for the same purpose, but ISTR TVS’s are much faster than VDRs. Typical VDR application is across the entry of (distribution) power (as stated), typical TVS application is across the output of a DC power supply, to protect the same from rubbish being sent against it.
IOW the one typically protects against spikes, the other against surges.
BTW I still do not believe in your argument about massive power being required to blow the fuse – the massive power is indeed required, but it is present in the form of a battery, probably sustained by an alternator. The critical thing is only the triggering of the blowing, for which little power is needed.
