1. "UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
Use of PSA for Design of Emergency Mitigation Systems in a Hydrogen Production Plant, using General Atomics SI Cycle Technology, Section II "Sulfuric Acid Decomposition"
Alexander Mendoza, Pamela F. Nelson & Juan Luis François
Departamento de Sistemas Energéticos, Facultad de Ingeniería
Universidad Nacional Autónoma de México,

2. Methodology description Development of mitigation system design
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
Presentation Outline
Introduction
Methodology description
Development of mitigation system design
Conclusions

3. Introduction "UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
Introduction
Need for Large Scale Hydrogen Production Plants
Development of many novel technologies for the production of this energy carrier.
S-I cycle
-High theoretical efficiency.
-Chemical substances can be precursors to dangerous situations.
Adequate chemical risks mitigation systems must be designed in order to provide safety to the complete plant, including the nuclear-chemical tie in points.
For this study, we focus our attention in a specific S-I cycle, the General Atomics SI process, -Section II, “Sulfuric Acid Decomposition”.
-Leakage of sulfuric acid in this section can conduct to a Toxic Cloud Formation.
The methodology for design that we purpose is a combination of Process Engineering and Probabilistic Safety Assessment .

4. 2. Methodology description
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
2. Methodology description
Options Analysis
Information Gathering
Preliminary Structure Design
Final PSA aided design
Definition of System’s Architecture
Development of Event tree
Development of Fault Trees
Risk Quantification & Allowable Risk Definition
System’s economy
System’s redefinition
Definition of Process to be protected
Risk Identification
End states Definition
Sensitivity analysis
optimal ?
Yes No

5. Development of mitigation system design
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
Development of mitigation system design
Next sections will summarize the steps followed for emergency mitigation systems PSA aided design.

6. 3.1 Definition of process to be protected
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
3.1 Definition of process to be protected
Brown L.C., et al., “Alternative Flowsheet for the Sulfure Iodine Thermochemical Hydrogen Cycle”, Rep. GAA24266, General Atomics, USA (2003).

7. 3.2 Risk Identification (Initiating Event)
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
3.2 Risk Identification (Initiating Event)
Any kind of qualitative safety analysis can be performed in order to identify dangerous situations, and when effects produced by such situations are not allowed, adequate mitigation systems must be placed.
For this study, we used a Hazop analysis, finding the release of sulfuric acid from decomposition section could produce:
Structural damage to mechanical support elements
Fire because of chemical attack to metals
Direct injuries to plant personnel
Toxic Cloud Formation

8. "UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
3.3 End states definition
“OK”. When no personnel or materials result affected by the acid release, because of the correct functioning of mitigation system.
“Minimal Damage“. When corrosion of equipment and mechanical supports takes place, but no personnel is injured.
“Personal Injury". When personnel and materials are affected by the release but no toxic cloud is formed.
“Toxic cloud Formation”. When every mitigation system fails and toxic cloud is formed.

9. 3.4 Information Gathering and Options Analysis
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
3.4 Information Gathering and Options Analysis
For each process, we ask:
How can I attack the problem?
How much of every resource will we need to have success?
Are there accepted mitigation systems for this problem?
What level of risk is allowed?
Which one of my options is the most reliable?
Can I combine the effect of two or more options?
In our particular case, information gathering and options analysis yielded the following preliminary design.

10. 3.5 Preliminary Structure design
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
3.5 Preliminary Structure design
After options analysis we came to the conclusion that an effective system to avoid toxic cloud formation, could be composed of three simple systems.
Isolation System: Intended to isolate any sulfuric acid release to prevent a major spill.
Neutralization System: Placed to chemically neutralize sulfuric acid and trap sulfur oxides
Emergency Flushing System (EFS): Uses a great amount of water to flush a sulfuric acid puddle before toxic cloud formation*
*Because the EFS can produce violent reactions during the first moments of its actuation, it should be employed only as a final measure

11. Isolation system "UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
Isolation system

12. Neutralization System
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
Neutralization System

13. Emergency Flushing System
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
Emergency Flushing System

14. "UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
3.6 System Architecture
This refers to the emergency system’s electromechanical devices and the way they will act during a contingency.
The System Architecture defines the chronological order for the element to actuate in the process and its interaction with other systems.
It could be said that this is the basis for the event tree construction.

15. 3.7 Event Tree "UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
3.7 Event Tree
Initiating Event
Mitigation Systems
End State
Sequence

16. 3.8.2 Neutralization System
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
3.8 Fault Trees
Isolation System
Neutralization System
EFS

17. 3.9 Risk Quantification and Definition of Allowable Risk Level
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
3.9 Risk Quantification and Definition of Allowable Risk Level
After we have defined Event and Fault Trees for the original design, and once we have defined probabilities for basic events (as we did), we can quantify the frequency of the Final State.
We did it using the software Saphire 6.0, obtaining an initial frequency of 5.29E-09/year for Toxic Cloud Formation.
As it was a low enough value, and for demonstrating purposes, we set this as the Allowable Risk Level for Final PSA Aided Design.

18. 3.10 Design Redefinition Loop
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
3.10 Design Redefinition Loop
Once the model is loaded in the PSA software and we have a Maximum Allowable Risk Level Limit, we are able to start the Design Redefinition Loop, taking the next points into account.
Try to remove any system whose actuation could cause another dangerous situation
Add redundant elements to those where Risk Reduction Worth (RRW) have a large value (when economically permitted)
Remove elements whose Risk Achievement Worth have a value near unity (if they don’t have another function or they are critical)
Relocate isolation elements from high thermal specifications parts to low-medium thermal specification.
Try different configurations to avoid excessive use of check and stop valves

19. "UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
Modifications
As a first modification to the system we will remove the EFS, due to the violent reaction which water and sulfuric acid present.
It can be seen, from the original design, that electric supply will have an important role in the design redefinition

20. This valve was added due to its high RRW
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
Redundant Valve V51X
This valve was added due to its high RRW

21. This valve was removed due to its RAW near unity.
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
Valve V53 is removed
This valve was removed due to its RAW near unity.

22. 3.10.4 Third Diesel Generator is Added
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
Third Diesel Generator is Added
DG1 in Isolation system
DG2 in Neutralization system
Even though an electric backup to the isolation system (redundancy to DG1) would reduce the frequency by 30, it should be noted that this diesel generator is much more expensive than a backup diesel generator in the neutralization system (redundancy to DG2), which reduces the frequency by 7. Therefore, the third diesel generator will be placed in neutralization system area.

23. 3.10.5 Summary of modifications
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
Summary of modifications

24. 3.11 Determination of Optimal Design
"UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
3.11 Determination of Optimal Design
This determination must be done on economical and technical basis.
For this study, we determined that design was optimal since it achieved a frequency value of only 16% of that of the original system and cutset contribution to total frequency is well distributed.

25. "UNIVERSIDAD NACIONAL AUTÓNOMA DE MÉXICO"
Fourth Information Exchange Meeting on the Nuclear Production of Hydrogen
Chicago, Illinois, USA April 2009
4. Conclusions
Design of safety systems supported by PSA provides efficient designs at a lower cost than those based solely on engineering criteria, guaranteeing a priori an adequate level of safety with a predetermined risk acceptance. It is also a useful tool for appropriate location of isolation valves.
In the particular case of the Second Section of the SI Process of General Atomics, an adequate system of isolation, a system for neutralization and a second electrical power backup will maintain the frequency of toxic cloud formation, resulting from leakage of sulfuric acid, below 1 E-09 per year, which is only 16% of the frequency calculated for a system whose design is based only on process engineering.
It should be noted that in areas where there is not a reliable supply of electricity, the reliability of backup electrical generators is one of the elements that have the most influence on the overall safety of a mitigation system.