RAL Template

1
Hydrogen RD system HAZOP and failure analysis
Yury Ivanyushenkov, Elwyn Baynham, Tom Bradshaw,
Mike Courthold, Matthew Hills and Tony Jones
2
Hydrogen Properties

• The potential hazards of liquid hydrogen stem
  mainly from three important properties
• Its extremely low temperature
• Its very large liquid to gas expansion ratio
• Its wide range of flammable limits after
  vapourising to gas

3
Hydrogen Hazards

• Consequences (hazards) of these properties
• 1. gt - severe burns can be produced upon
  contact with the skin
• - some materials can become
  brittle and easily broken
• gt overpressure gt - excessive deformation of a
  vessel
• -
  rupture of the pressure vessel
• gt fire gt - injury of personnel
• - damage to
  equipment / property
• Fire is a primary hydrogen hazard !

4
Hydrogen Hazards (2)

• Fire is a primary hydrogen hazard !
• A fire can result from two scenarios 1
• - Hydrogen is released,
• - mixes with an oxidizer,
• - forms a combustible mixture,
• - the mixture contacts an ignition
  source,
• - and ignition occurs.
• - The hydrogen system is contaminated with an
  oxidizer
• (as a result of improper purging
  and/or in leakage of an
• oxidizer, such as air),
• - the hydrogen and the oxidizer form a
  combustible mixture
• - the combustible mixture contacts an
  ignition source
• - and ignition occurs.
• 1 Guide for Hydrogen Hazards Analysis on
  Components and Systems, NASA TP-WSTF-937

5
MICE Hydrogen RD System
6
HAZOP Nodes
Node 1 Metal hydride storage unit Node 2
Hydrogen absorber vessel Node 3 Hydrogen
absorber vacuum jacket Node 4 Buffer tank Node
5 Hydrogen enclosure
7
HAZOP Node 1
Node 1 Metal hydride storage unit
Intent To keep hydrogen gas in the storage unit
- absorber vessel closed system.
No Parameter Guide word Cause Consequence Safeguards Recommendations
1 Pressure Higher Hydride bed is overheated. Hydrogen goes back into the absorber rather then to be stored in the hydride bed. Pressure in the absorber can exceed the max working pressure. Pressure regulator to reduce the pressure on the line to the absorber. Pressure relief valve to vent outside. Active pressure gauge to trigger an alarm. Consider implementation of an active pressure gauge.
8
HAZOP Node 2
Node 2 Hydrogen absorber vessel
Intent To keep hydrogen liquid inside hydrogen
absorber module.
No Parameter Guide word Cause Consequence Safeguards Recommendations
1 Temperature Lower Too much cooling power. Pressure in the hydrogen system drops below atmospheric, the system is vulnerable for the ingress of air. Active pressure gauge to trigger an alarm. Temperature sensor to trigger an alarm. Additional Liquid hydrogen level meter to trigger an alarm. The temperature and pressure to be continuously monitored. Additional Implement an active liquid level meter.
2 Temperature Higher Not enough cooling power. Power cut. Liquid hydrogen evaporates and LH2 level eventually goes down. Hydrogen pressure rises. Temperature sensor to trigger an alarm Additional Liquid hydrogen level meter to trigger an alarm. Pressure gauge to trigger an alarm. As above.
3 Pressure Lower Absorber hydrogen vessel is leaking. Absorber hydrogen vessel is over cooled. Hydrogen leaks into vacuum vessel. Pressure in the system drops and air might leak into the system if seals are faulty. Active pressure gauge to trigger an alarm. Temperature sensor to trigger an alarm. As above.
9
HAZOP Node 3
Node 3 Hydrogen absorber vacuum jacket
Intent - To insulate thermally the internal
hydrogen vessel. - To provide additional barrier
for air.
No Parameter Guide word Cause Consequence Safeguards Recommendations
1 Pressure Higher Hydrogen internal vessel leaks. Vacuum jacket or seals are leaking Hydrogen leaks into vacuum jacket Air leaks into vacuum jacket. Pressure in the vacuum jacket goes up and heat load onto hydrogen vessel increases. Pressure relief valve to vent hydrogen outside in case of rapid pressure rise. Pressure gauge to trigger an alarm. Pressure to be continuously monitored.
10
HAZOP Node 4
Node 4 Buffer tank
Intent To quickly relief pressure in the test
absorber module in case of accidental rapid
pressure rise.
No Parameter Guide word Cause Consequence Safeguards Recommendations
1 Pressure Lower Hydrogen internal vessel is over-cooled. Potential ingress of air into the buffer tank if it leaks. Temperature control loop in the hydrogen vessel cooling system.. Active pressure gauge triggers an alarm. Pressure to be continuously monitored.
11
HAZOP Node 5
Node 5 Hydrogen enclosure
Intent To localize and vent hydrogen off in
case of hydrogen leakage.
No Parameter Guide word Cause Consequence Safeguards Recommendations
1 Hydrogen concentration Higher Hydrogen leaks out hydrogen pipes. Hydrogen leaks out hydride bed. Venting system stopped working due to power cut. Explosive oxygen-hydrogen mixture can be formed Ventilation system to quickly vent hydrogen out. Hydrogen detector to trigger an alarm and to start a high rate mode for the ventilation system. Fans in the venting system are powered by UPS. Consider installation of additional active hydrogen detector.
12
HAZOP Recommendations

• Hydrogen storage unit
• Consider implementation of active
  pressure gauge
• Hydrogen absorber internal vessel
• Implement monitoring of pressure
• 
  temperature
• and liquid
  hydrogen level
• 
  
• Hydrogen absorber vacuum jacket
• Implement monitoring of pressure
• Buffer tank
• Implement monitoring of pressure
•  
• Hydrogen module enclosure
• Consider implementation of more
  than one active hydrogen detectors.

13
Preliminary FMECA
Failure Mode Effect and Criticality Analysis
(FMECA)
No. Failure Mode Effect Criticality Comments
1 Failure of electricity supply The temperature control of the hydride bed will be lost and the hydride will absorb hydrogen up to its equilibrium point. If there is liquid hydrogen in the system it will be evolved and absorbed by the hydride. The loss of vacuum will accelerate this process. Need to ensure that the hydride bed can accommodate the evolution rate else hydrogen will be lost through the vent line. Normally loss of vacuum is gradual.
2 Failure of chiller/heater unit to hydride Temperature control of the hydride will be lost and it will absorb up to its equilibrium pressure. When the pressure in the vessel riches the relief valve setting point, hydrogen venting starts. Hydride bed vessel design pressure is about 30 bar.
14
Preliminary FMECA (2)
No. Failure Mode Effect Criticality Comments
3 Rupture of line between hydride and absorber Hydrogen will be lost and detected by hydrogen detectors in the vent line. The hydrogen detectors are the only indication of system gas loss.
4 Fire in vicinity of hydride This will cause a rise in temperature of the hydride bed leading to evolution of the hydrogen. The pressure will rise leading to venting as soon as the relief valve operates. The hydrogen will be vented at roof level away from the scene of the fire. Is the hydride flammable ?