1. Hydrogen R&D system HAZOP and failure analysis Yury Ivanyushenkov, Elwyn Baynham, Tom Bradshaw, Mike Courthold, Matthew Hills and Tony Jones

2. 2 Hydrogen Properties The potential hazards of liquid hydrogen stem mainly from three important properties: 1.Its extremely low temperature 2.Its very large liquid to gas expansion ratio 3.Its wide range of flammable limits after vapourising to gas

3. 3 Hydrogen Hazards Consequences (hazards) of these properties: 1. => - severe burns can be produced upon contact with the skin; - some materials can become brittle and easily broken 2.=> overpressure => - excessive deformation of a vessel; - rupture of the pressure vessel 3.=> fire => - injury of personnel - damage to equipment / property Fire is a primary hydrogen hazard !

4. 4 Hydrogen Hazards (2) Fire is a primary hydrogen hazard ! A fire can result from two scenarios [1]: (1)- Hydrogen is released, - mixes with an oxidizer, - forms a combustible mixture, - the mixture contacts an ignition source, - and ignition occurs. (2)- The hydrogen system is contaminated with an oxidizer (as a result of improper purging and/or in leakage of an oxidizer, such as air), - the hydrogen and the oxidizer form a combustible mixture; - the combustible mixture contacts an ignition source; - and ignition occurs. [1] Guide for Hydrogen Hazards Analysis on Components and Systems, NASA TP-WSTF-937

5. 5 MICE Hydrogen R&D System Node 1 Node 4 Node 3 Node 2 Node 5

6. 6 HAZOP: Nodes Node 1: Metal hydride storage unit Node 2: Hydrogen absorber vessel Node 3: Hydrogen absorber vacuum jacket Node 4: Buffer tank Node 5: Hydrogen enclosure

7. 7 HAZOP: Node 1 Node 1: Metal hydride storage unit NoParameterGuide word CauseConsequenceSafeguardsRecommendations 1PressureHigherHydride bed is overheated. Hydrogen goes back into the absorber rather then to be stored in the hydride bed. Pressure in the absorber can exceed the max working pressure. Pressure regulator to reduce the pressure on the line to the absorber. Pressure relief valve to vent outside. Active pressure gauge to trigger an alarm. Consider implementation of an active pressure gauge. Intent: To keep hydrogen gas in the storage unit - absorber vessel closed system.

8. 8 HAZOP: Node 2 Node 2: Hydrogen absorber vessel NoParameterGuide word CauseConsequenceSafeguardsRecommendations 1TemperatureLowerToo much cooling power. Pressure in the hydrogen system drops below atmospheric, the system is vulnerable for the ingress of air. Active pressure gauge to trigger an alarm. Temperature sensor to trigger an alarm. Additional: Liquid hydrogen level meter to trigger an alarm. The temperature and pressure to be continuously monitored. Additional: Implement an active liquid level meter. 2TemperatureHigherNot enough cooling power. Power cut. Liquid hydrogen evaporates and LH2 level eventually goes down. Hydrogen pressure rises. Temperature sensor to trigger an alarm Additional: Liquid hydrogen level meter to trigger an alarm. Pressure gauge to trigger an alarm. As above. 3PressureLowerAbsorber hydrogen vessel is leaking. Absorber hydrogen vessel is over cooled. Hydrogen leaks into vacuum vessel. Pressure in the system drops and air might leak into the system if seals are faulty. Active pressure gauge to trigger an alarm. Temperature sensor to trigger an alarm. As above. Intent: To keep hydrogen liquid inside hydrogen absorber module.

9. 9 HAZOP: Node 3 Node 3: Hydrogen absorber vacuum jacket NoParameterGuide wordCauseConsequenceSafeguardsRecommendations 1PressureHigherHydrogen internal vessel leaks. Vacuum jacket or seals are leaking Hydrogen leaks into vacuum jacket Air leaks into vacuum jacket. Pressure in the vacuum jacket goes up and heat load onto hydrogen vessel increases. Pressure relief valve to vent hydrogen outside in case of rapid pressure rise. Pressure gauge to trigger an alarm. Pressure to be continuously monitored. Intent: - To insulate thermally the internal hydrogen vessel. - To provide additional barrier for air.

10. 10 HAZOP: Node 4 Node 4: Buffer tank NoParameterGuide wordCauseConsequenceSafeguardsRecommendations 1PressureLowerHydrogen internal vessel is over- cooled. Potential ingress of air into the buffer tank if it leaks. Temperature control loop in the hydrogen vessel cooling system.. Active pressure gauge triggers an alarm. Pressure to be continuously monitored. Intent: To quickly relief pressure in the test absorber module in case of accidental rapid pressure rise.

11. 11 HAZOP: Node 5 Node 5: Hydrogen enclosure NoParameterGuide wordCauseConsequenceSafeguardsRecommendations 1Hydrogen concentr ation HigherHydrogen leaks out hydrogen pipes. Hydrogen leaks out hydride bed. Venting system stopped working due to power cut. Explosive oxygen- hydrogen mixture can be formed Ventilation system to quickly vent hydrogen out. Hydrogen detector to trigger an alarm and to start a high rate mode for the ventilation system. Fans in the venting system are powered by UPS. Consider installation of additional active hydrogen detector. Intent: To localize and vent hydrogen off in case of hydrogen leakage.

12. 12 HAZOP: Recommendations Hydrogen storage unit: C onsider implementation of active pressure gauge Hydrogen absorber internal vessel: Implement monitoring of pressure temperature and liquid hydrogen level Hydrogen absorber vacuum jacket: Implement monitoring of pressure Buffer tank Implement monitoring of pressure Hydrogen module enclosure Consider implementation of more than one active hydrogen detectors.

13. 13 No.Failure ModeEffectCriticalityComments 1Failure of electricity supply The temperature control of the hydride bed will be lost and the hydride will absorb hydrogen up to its equilibrium point. If there is liquid hydrogen in the system it will be evolved and absorbed by the hydride. The loss of vacuum will accelerate this process. Need to ensure that the hydride bed can accommodate the evolution rate else hydrogen will be lost through the vent line. Normally loss of vacuum is gradual. 2Failure of chiller/heater unit to hydride Temperature control of the hydride will be lost and it will absorb up to its equilibrium pressure. When the pressure in the vessel riches the relief valve setting point, hydrogen venting starts. Hydride bed vessel design pressure is about 30 bar. Failure Mode Effect and Criticality Analysis (FMECA) Preliminary FMECA

14. 14 Preliminary FMECA (2) No.Failure ModeEffectCriticalityComments 3Rupture of line between hydride and absorber Hydrogen will be lost and detected by hydrogen detectors in the vent line. The hydrogen detectors are the only indication of system gas loss. 4Fire in vicinity of hydride This will cause a rise in temperature of the hydride bed leading to evolution of the hydrogen. The pressure will rise leading to venting as soon as the relief valve operates. The hydrogen will be vented at roof level away from the scene of the fire. Is the hydride flammable ?