Quantitative Risk Assessment, Safety Studies and Risk Mitigation Jeffrey LaChance

1. Quantitative Risk Assessment, Safety Studies and Risk Mitigation Jeffrey LaChance Sandia National Laboratories Presented at the 2nd International Conference on Hydrogen Safety San Sebastian, Spain 12 September 2007 Preliminary Data

2. Outline • Role of QRA in Hydrogen Safety • Applications of QRA • Risk-Informed Codes and Standards • Separation Distances • Application to an Example Facility • Input Data and Assumptions for QRA Models • Results • Summary Preliminary Data

3. Project Background • Work performed under U.S. DOE Hydrogen, Fuel Cells & Infrastructure Technologies Program, Multi-Year Research, Development and Demonstration Plan • Hydrogen Safety, Codes & Standard R&D • Sandia National Laboratories is developing the scientific basis for assessing credible safety scenarios and providing the technical data for use in the development of codes and standards • Includes experimentation and modeling to understand behavior of hydrogen for different release scenarios • Use of Quantitative Risk Assessment (QRA) methods to help establish separation (setback, safety) distances at hydrogen facilities and to identify accident prevention and mitigation strategies for key risk drivers Preliminary Data

4. Hydrogen Safety • Public perception of hydrogen safety has been skewed by major incidents such as the Hindenburg accident • In reality, the use of hydrogen has an excellent safety record • The expanded use of hydrogen will include new challenges (e.g., very high pressures) that will require design features and operational requirements to manage the risk to acceptable levels Risk assessment (both qualitative and quantitative) provides a means to demonstrate hydrogen safety! Preliminary Data

5. The Role of Risk Assessment • Various levels of risk assessment can be utilized to assess the risk associated with a hydrogen facility: • Qualitative methods such as Failure Modes Effects Analysis are typically used to identify hazards and specify accident prevention and mitigation features • Semi-Quantitative methods such as risk matrices can identify risk-significant accidents Quantitative Risk Assessment (QRA) evaluates the facility risk and provides much more! Preliminary Data

6. Quantitative Risk Assessment • QRA is a systematic process for evaluating the risk associated with a facility for: • Verification that it meets an accepted risk criteria • Identification of important accidents, components, operations contributing to risk • Identification and evaluation of risk reduction and control measures • Identification of risk management requirements (e.g., maintenance intervals) Preliminary Data

7. Applications of QRA • Primary application is to determine that a facility is safe! • Can be performed for evaluating early prototype facilities and for evaluating standard designs • Can be used as part of facility permitting process • Can be used to generate risk-informed code and standard requirements • National Fire Protection Association has generated guidance for this application Preliminary Data

8. Risk-Informed Codes and Standards • Use of a risk-informed process is one way to establish the requirements necessary to ensure public safety • Comprehensive QRA used to identify and quantify scenarios leading to hydrogen release and ignition • Accident prevention and mitigation requirements identified based on QRA • Results combined with other considerations to establish minimum code and standard requirements needed for an established risk level • Required prevention and mitigation features can be specified as a function of important facility parameters: • Hydrogen generation method • Volume and pressure of hydrogen • Location of components (e.g., inside versus outside) Preliminary Data

9. Separation Distances • Specified distances in codes separating H2 components from the public, structures, flammable material, and ignition sources • Distance vary with possible consequences from hydrogen releases (e.g., radiation heat fluxes or overpressures) • Distances influenced by facility design parameters (e.g., hydrogen pressure and volume), available safety features (e.g., isolation valves), and release parameters (e.g., leak size and location) • Options for evaluating: • Consequence-based (deterministic) • Worst case leak size (e.g., equivalent to flow area) • More probable break size (e.g., 20% flow area) • Risk-informed (based on acceptable risk level) Separation distances based solely on the consequences of hydrogen leaks can be long for high pressure systems! Preliminary Data

10. Sandia Hydrogen Leak Model • Used to evaluate separation distances for jet releases • Model predicts (as function of system volume, pressure, and leak size): • Radiant heat flux from hydrogen jet flames • Radial and axial positions downstream of the jet as a function of time • Visible flame length for ignited jets • Hydrogen concentrations in jets • Separation distances based on free jets • Model validated against Sandia/SRI experiments • Reference: Houf and Schefer, “Predicting Radiative Heat Fluxes and Flammability Envelopes from Unintended Releases of Hydrogen,” IJHE Paper GI-353 Preliminary Data

11. Example of Consequence-Based Separation Distances for a Jet Fire Leak Diameter (mm) Preliminary Data

12. Separation Distancesfor Different Consequence Measures – Jet Fires Consequence Parameter Preliminary Data

13. Separation Distancesfor Different Consequence Measures – Jet Fires Preliminary Data

14. Risk-Informed Approach • Uses risk insights from QRA plus other considerations to help define code requirements Risk = Frequency X Consequence from all accidents • Requires definition of important consequences • Requires definition of acceptable risk levels • Requires comprehensive evaluation of all possible accidents • Accounts for parameter and modeling uncertainty present in analysis Preliminary Data

15. Risk Approach for Establishing Separation Distances Cumulative frequency of accidents resulting in consequences that requires this separation distance Preliminary Data

16. Application to Example Facility • Evaluated risk-based separation distances for a representative fueling facility • To demonstrate risk methodology • To evaluate important facility features (e.g., gas volume and leak isolation features) • To determine importance of modeling parameters (e.g., data, geometry, temporal effects) • To identify key risk scenarios and identify possible ways to reduce the risk to acceptable levels • Work presented is focused on hydrogen jet releases from gas pipes and gas storage cylinders Preliminary Data

17. Example Facility Description • Facility can refuel 100 cars/day • All components located outside • Gas storage was sized for 500 kg of hydrogen(12.63 m3 for 70 MPa facility) • Analyzed gas storage area and distribution piping Preliminary Data

18. Analysis Assumptions • No protective barriers are installed around the outside gas storage area • No isolation of a gas storage leak from upstream of isolation valve is possible • Pipe leaks downstream of isolation valve can be isolated • State-of-the art hydrogen leak or flame detector sends signal to isolation valve resulting in closure within 10s • Immediate ignition results in injury or damage at separation distance if not automatically detected and isolated (no credit for manual detection and isolation) • Delayed ignition of un-isolated gas jet results in flash fire • Injury or damage assumed out to a distance corresponding to ignitable concentration levels (used to determine separation distance) • Pipe leak orientation was assumed directed at lot line or structures/equipment resulting in maximum separation distances • Impact of surfaces on jet flames not included Preliminary Data

19. Failure Data Used in Analysis Preliminary Data

20. Leakage Frequency Distributions Large leak assumed = 1mm diameter; leak diameter distributed as inverse function of diameter Preliminary Data

21. Pipe Leak or Immediate Ignition Detection of Automatic Isolation Delayed Ignition of Rupture of Hydrogen Jet Hydrogen or Flame of Pipe within 10s Hydrogen Downstream of PIPE_LEAK I-IGNITION DETECTION ISOLATION D-IGNITION # END-STATE-NAMES 1 JET-FIRE-(10-S) 2 JET-FIRE 3 JET-FIRE 4 GAS-RELEASE-(10-S) 5 FLASH-FIRE 6 GAS-RELEASE 7 FLASH-FIRE 8 GAS-RELEASE pipe leak - (New Event Tree) 2007/01/27 Page 0 Gas Pipe Leak Event Tree Preliminary Data

22. Gas Pipe Results: Un-isolated Jet Fires Mean frequency of any size un-isolated pipe leak < 1E-6/yr Decreasing leak frequency is countered by increasing ignition probability Preliminary Data

23. Gas Pipe Results:Isolated Jet fire Frequency of isolated jet fires are higher but the exposure time is short (10 s) which reduces potential for structural or equipment damage and personnel injury. Preliminary Data

24. Gas Pipe Results:Isolated Jet fire Preliminary Data

25. Gas Pipe Results:Flash Fires Delayed ignition assumed to result in flash fire and injury/damage out to various hydrogen concentration levels. Preliminary Data

26. Gas Storage Leak Event Tree Preliminary Data

27. Gas Storage Results:Un-isolated Jet Fires Accident frequencies are affected by leakage contribution from different components. Heat Flux Preliminary Data

28. Gas Storage Results:Flash Fires Flash fires require longer separation distances than jet fires. Hydrogen Concentration Preliminary Data

29. Gas Storage Sensitivity Study – Volume of Stored Gas Limiting gas storage volume can lead to reduced separation distances. Mass of Gaseous Hydrogen Preliminary Data

30. Gas Storage Sensitivity Study – Storage Pressure Preliminary Data

31. Leak Orientation Sensitivity Leak orientation is important in determining separation distances for jet fires. Leak Orientation to Target Preliminary Data

32. Transient Effects Integrated dose for 60 s = 1070 (kw/m2)1.333 s. Probability of second degree burns = 0.7, fatality = 0.5. Preliminary Data

33. Example Parameter Uncertainties Preliminary Data

34. Use of Low Consequence Measures Can Lead To Wrong Separation Distances Preliminary Data

35. Separation Distance Results • Separation distances are significantly affected by facility operating parameters (H2 pressure and volume) • Consequence-based separation distances can be prohibitively long for large leak diameters • If small leak diameters can be justified, short separation distances even for high pressures can be justified • Risk methods can be used as a basis to help justify selection of leak diameter and separation distances • Risk-informed separation distances are significantly affected by component leakage frequency data and selected consequence parameters and risk criteria • Installation of mitigation features can reduce the frequency and consequences from leakage events • Selection of low consequence parameters to set separation distance can result in unacceptable risk Preliminary Data

36. Backup Slides Preliminary Data

37. Current Separation Distances in ICC International Fire Code for H2 Gas Preliminary Data

38. Failure Data Used in Analysis Preliminary Data

39. Failure Data Used in Analysis Preliminary Data

40. Potential of Injury from Jet Fires Reduced time of exposure to heat flux reduces the radiation dose and the magnitude of injury. Average Thresholds: Third Degree Burn Second Degree Burn 25 kW/m2 First Degree Burn 4.7 kW/m2 1.6 kW/m2 Preliminary Data

41. How Do You Select Leak Diameter? • Ideally, examine appropriate leak data to determine leak distribution • Select leak size that encompasses a designated percentage of leaks (e.g., 50% or 95%) • Use precedents (e.g., 20% flow area cited in several documents) • Base selection on available analyses (e.g., offshore process leakage data) Preliminary Data

42. Leak Distribution Sensitivity Preliminary Data

43. Offshore Leakage Data Preliminary Data

44. Use of Risk Can Eliminate Large Leaks from Consideration Risk Criteria Increasing Leak Diameter Preliminary Data

45. Example Facility Preliminary Data

46. Consequence Parameters and Risk Criteria Used in Current Analysis Consequence Parameters • Radiant Heat Flux from Jet Fires: • 1.6 kW/m2 – no harm to individuals for long exposures • 4.7 kW/m2 – injury (second degree burns) within 20 seconds • 25 kW/m2 – 100% lethality within 1 minute; equipment and structural damage • Hydrogen Concentration from Un-ignited Releases: • 4%, 6%, and 8% concentrations – lower flammability limit • Risk Criteria • Frequency of Fatality to Individual at Separation Distance Used as Upper Bound Accident Frequency Criteria • <2E-4/yr – fatality risk from all other high-risk hazards in society Preliminary Data

47. Example Separation Distances Due to Flash Fires Preliminary Data

48. Summary • QRA can help ensure hydrogen facility safety directly • Identifies important accidents • Evaluates effectiveness of preventive and mitigation features • Used to establish risk management strategies • QRA can help establish hydrogen code and standard requirements • Compliance with minimum requirements ensures an accepted level of risk is achieved Preliminary Data

49. Future Efforts • Continue evaluating safety distances for example facility to further demonstrate methodology • Examine other gas-related accidents (e.g., vapor cloud explosions) • Examine liquid hydrogen storage leaks/ruptures • Evaluate facilities using different methods for onsite hydrogen production (gas reforming and electrolysis) • Improve risk methodology including consideration of time-dependent impacts, geometry factors, and incorporation of uncertainty • Get consensus on failure data for use in QRA (e.g., leak frequencies and component failure rates); Bayesian approaches to data analysis • Identify methods for determining accident phenomenology probabilities (e.g., ignition and detection probabilities) • Identify key risk drivers for hydrogen facilities and identify what can be done to reduce the risk and separation distances to acceptable levels • Extend evaluation to other types of hydrogen facilities Preliminary Data