Risk Analysis for the Infrastructure of a Hydrogen Economy

Transcription

1 Risk Analysis for the Infrastructure of a Hydrogen Economy O.A. Rosyid, D. Jablonski, and U. Hauptmanns Department of Process Design and Safety, Otto-von-Guericke-Universität Magdeburg, Postfach Magdeburg, Germany Abstract Increasing scarcity of fossil fuels makes the deployment of hydrogen in combination with renewable energy sources, nuclear energy or the utilization of electricity from full time operation of existing power stations an interesting alternative. A pre-requisite is, however, that the safety of the required infrastructure is investigated and that its design is made such that the associated risk is at least not higher than that of existing supplies. Therefore a risk analysis considering its most important objects such as storage tanks, filling stations, vehicles as well as heating and electricity supplies for residential buildings was carried out. The latter are considered as representative of the entire infrastructure. The study is based on fault and event tree analyses, wherever required, and consequence calculations using the PHAST code. The procedure for evaluating the risk and corresponding results are presented taking one of the objects as an example. Keywords: hydrogen energy risk, quantitative safety analysis, fire, explosion. 1. Introduction The scarcity of fossil fuels and the resulting price increases have put alternative energies on the agenda. Hydrogen, although not a primary carrier of energy, may play an important role. It enables one to store energy and to put it to an end use at the time and place desired. The original source for the production of hydrogen may be electricity generated by nuclear energy, renewable energy sources such as wind or sun, or perhaps most attractively at present electricity produced during hours of low consumption by a country s electric power system. In this way an additional benefit would be a more balanced load curve. A large-scale introduction of hydrogen into an economy requires the risks associated with it to be at least not larger than those of existing technologies, such as, for example, LPG. For this reason a risk analysis for a hydrogen economy was carried out [1]. The hazards of hydrogen obviously derive from its flammability and the considerable amount of energy released if it burns or explodes. In what follows the salient features of the study are presented along with a more detailed account of the risk analysis of one of the objects investigated. 2. The hydrogen economy In view of the quantities of fuel consumed and environmental protection goals two principal potential applications of hydrogen were identified for Germany: 1

2 (1) cars using hydrogen either in a fuel cell supplying an electric motor or directly in a combustion engine (2) fuel cell combined heat and power units (FC-CHP) providing both electricity and heating to households In order to implement such systems an infrastructure is needed which requires the elements shown in Figure 1. Fig. 1: Hydrogen production, transport, storage and end-use pathways (adapted from [2], GH2: gaseous hydrogen, LH2: liquefied hydrogen) Figure 1 shows that basically the following activities are required: (1) production (2) storage (3) distribution (4) end-use Obviously not all of them can be analyzed in detail, especially since not all the design features of the corresponding installations or equipment are known and industry is reluctant to reveal them. Instead those objects were treated, which are considered to be representative of the hazard potential presented by the cited activities. Given the quantities of hydrogen involved these were mainly the storage tanks. In particular the items given in Table 1 were analyzed. 3. Method of analysis and global result Risk was assessed, i.e. the expected frequency of undesired events and the associated volume of damage were determined. For road tankers and private cars the actuarial approach was used. 2

3 Activity Object of analysis Hydrogen production GH 2 storage Storage at depot LH 2 storage Hydrogen pipeline GH 2 Hydrogen road tanker LH 2 storage Hydrogen private car LH 2 storage CHP-plant LH 2 storage Table 1: Activities of the hydrogen economy and objects representative of their risk Accident rates from the past were directly extrapolated to the future. Typical route lengths for Germany were considered. The conditional probabilities of tank destruction and hence release range from 0.06 to 0.09 depending on the type of road (e.g. motorway, urban street). For the other objects detailed fault tree analyses (cf. [3]) were performed. In view of the lack of reliability data for components in hydrogen installations, data was compiled from several sources related to other industries, mainly [4]-[7]. Uncertainties were propagated through the fault trees. Hazard identification was performed using the HAZOP [8] and FMEA (c.f. [9]) methods. The results are expected frequencies for either puff or continuous releases. Event tree analyses (c.f. [9]) were used to describe the accident scenarios, which normally lead to a fire or an explosion. If there is ignition it is assumed to be instantaneous given the low ignition energy of hydrogen. The tree for GH 2 release is shown in Figure 2 as an example. Fig. 2: Event tree for GH 2 (gaseous hydrogen) release indicating the conditional probabilities of the corresponding events In order to assess the consequences of hydrogen release the PHAST 6.4 software [10] was used. It provides amongst others models for the discharge of liquids and gases, pool formation and evaporation, dense and buoyant gas dispersion, jet and pool fire, BLEVE and vapour cloud 3

4 explosion, as well as Probit equations for assessing the probability of harm, e.g. death as a consequence of heat radiation. The final results are presented in terms of individual risk curves, complementary frequency distributions (FN-curves) or lines of the same risk (Isorisk IR-profiles). A schematic of the overall procedure of risk analysis is shown in Figure 3. HAZARD IDENTIFICATION FREQUENCY ANALYSIS CONSEQUENCE ANALYSIS RISK ANALYSIS HAZOP FMEA Description of complex event scenarios Description of surrounding area, i.e. population, ignition sources, weather FAULT TREE Description of complex event scenarios Event frequencies and descriptions For modelling of release, dispersion and hazardous effects (e.g. fire, explosion) PHAST MODEL RISK MODEL Individual Risk Description of simple event scenarios EVENT TREE Outcome probabilities Fig. 3: The risk assessment model used in the study (adapted from [11]) The overall appreciation in [1] is that the deployment of hydrogen would not impose bigger risks on society than the use of LPG. 4 Example for the analysis Object description and release frequency assessment The object analyzed is a pressurized hydrogen storage (GH 2 ) supplied with hydrogen from an electrolyzer. It is shown in Figure 4. The storage consists of two parallel identical tanks, which can store a maximum of 210 kg each, when operating at their nominal pressure of 30 bar at a temperature of 20 C. The vessels are 9.8 m long and have a diameter of 2.8 m. The diameter of the feed and emptying pipes is 50.8 mm. The storage is in alternating operation. Whilst one of the tanks is being filled the other is ready for delivery. 4

5 Fig. 4: Simplified P&I Diagram of the GH2 storage (based on [12, 13]) The compressor drives the gaseous hydrogen into the tank. The pressure is limited by the pressure reducing regulator PCV-19. Depending on the position of the interlocked valves V 13-1 and V 13-2 either tank I or II is filled. Analogously delivery takes place from tank I or II depending on the position of valves V 12-1 and V The following description of the safety concept refers to tank I and applies analogously to tank II. In case of high pressure during the filling process, which may be the consequence of the failure of PCV-19, pressure switch PSH 1 provides a closing signal to the pneumatic valve PV-20 and stops the compressor. For this and overpressure due to any other cause, the tank is equipped with safety valves SV1-1 and SV1-2, one of which is selected by positioning the three port valve V20-1, and the rupture disk RD-1. In case the overpressure occurs while the tank is being filled additionally safety valve SV3 is available for pressure relief. The necessity for relief is announced by a horn in the control room triggered by pressure indicator and alarm PIA 1. The associated rule for the operator is (1) to turn off the compressor (2) to close the remotely operated valve V13-1. Spontaneous tank rupture, overfilling and fire were identified as potential initiating events. The corresponding fault tree for the undesired event tank rupture is presented in Figure 5. 5

6 Fig. 5: Fault tree for tank rupture causing instantaneous gaseous hydrogen release (* initiating event, PRS pressure relief system, CCF common cause failure) 6

7 The reliability data and periods between functional tests given in Table 2 were used in evaluating the fault tree (operational demands were considered equivalent to functional tests). It was assumed conservatively that filling always takes place. Component failure/ human error/ event Median in 10-6 hr -1 Uncertainty factor K 95 Test interval in hrs x 1 Fire x 2 Fire protection system 0.02 c x 3 Pressure regulator PCV * x 4 Pressure switch PSH x 5 Pneumatic valve PV x 6 Compressor does not stop x 7 Pressure indicator alarm PIA x 8 Signal horn x 9 Pneumatic valve V x 10 Human action c - - x 11 Spring-loaded safety valve SV x 12 Filling does not take place 0 c 1 x 13 Spring-loaded safety valve SV1-1 resp. SV x 14 Three-port valve V20-1 (wrong position) c - - x 15 Rupture disk RD-1 does not open x 16 Spontaneous rupture * x 17 Wrong setpoint * x 18 Common cause SV1-1 / SV3 failure Table 2: Reliability data and test intervals ( - : not applicable; c : constant probability; * : initiating event; frequency per year, + human error probability multiplied by frequency of adjusting the setpoint) The analytical evaluation of the fault leads to 96 minimal cut sets with a numerical solution characterized by the following distribution parameters of the frequencies of release: 5 th centile: yr th centile: yr -1 Expected value: yr th centile: yr -1 K 95 : 9.9 It is evident that the result is dominated by the contribution of spontaneous rupture, which is expected with a frequency of yr -1. Overpressure failures, on the other hand, are extremely rare, which is explained by the high degree of redundancy of the safety devices. As far as overfilling is concerned, the analysis is conservative even for both tanks because of their 7

8 alternating use. With respect to fire a failure of both tanks is conceivable. However, the contribution of a fire, yr -1, is so small that adding this value twice instead of once would not substantially affect the result. Consequence assessment The consequences of tank rupture to be considered are (1) explosion pressure wave, (2) heat radiation from a fireball, (3) missile generation by the explosion. In all cases the intensity of the damaging process has to be related to the probability of being killed by applying a Probit equation (c.f. [9]) The following equations were used: Pressure wave (peak overpressure p 0 0 ): Y ln ( p ) = + (1) 4 4 / 3 Heat radiation from a fireball (intensity I, duration t): Y ln ( 10 t I ) = + (2) The peak overpressure was calculated using the Baker-Strehlow model with ground reflection and 50 m 3 of confined hydrogen. The conditional probabilities for death are given in Figure 6. Fig. 6: Conditional probability of being killed by overpressure following tank rupture as a function of distance 8

9 Heat radiation intensities and durations provided by the fireball model enabled one to calculate the Probit values according to eq. (2). Figure 7 gives the corresponding conditional probabilities for death. Fig. 7: Conditional probability of being killed by heat radiation following tank rupture as a function of distance In case of being hit by a fragment, a conditional probability of 1 for death was assumed given the large amount of kinetic energy of the fragments. Figure 8 shows the results, which were obtained using the program MISSC described in [14]. It is obvious that this effect can be neglected given its low conditional probability. Risk Individual risk is calculated by combining the expected frequency of tank rupture with the conditional probabilities of death from Figures 6 and 7 weighted by the corresponding probabilities of the event tree of Figure 2. The result is shown in Figure 9. The uncertainties of the frequency calculation are reflected there. Although, in principle, the uncertainties of the results for the consequences should be assessed as well this was not done, since this would not modify the conclusions because risk is low anyway. Additionally, risk rapidly decreases with distance and people would rarely stand in the high risk area close to the tanks. 9

10 Fig. 8: Conditional probability of being killed by a tank fragment as a function of distance Fig. 9: Individual risk from tank rupture as a function of distance 10

11 5 Summary and conclusion An account of a risk study for a hydrogen economy is given. It is reported that its global result was that the risk of this economy is not higher than that of a competing option, viz. LPG. The risk analysis of one important object, the storage of gaseous hydrogen under pressure, is presented. The procedure and the results are shown in detail. In line with the global result of the study the risk of this particular object is low and can be tolerated if current international risk objectives, i.e. individual risks around 10-6 yr -1, are used as a yardstick. References [1] Rosyid, O.A.: System-analytic Safety Evaluation of Hydrogen Cycle for Energetic Utilization, Doctoral Dissertation, Otto-von-Guericke-Universität Magdeburg, Germany, (2006) [2] LPG - A study - A comparative analysis of the risks inherent in the storage, transshipment, transport, and use of LPG and motor spirit TNO, Apeldoorn, the Netherlands, [3] Veseley, W.E. et al.: Fault Tree Handbook NUREG-0492 (1981) [4] Hauptmanns, U.: Reliability Data for Process Plants Report No. IAUT-AS 0103, Magdeburg, July 2003 [5] OREDA Offshore reliability data Det Norske Veritas (DNV), Hovik, Norway, [6] T-book: Reliability data of components in Nordic nuclear power plants Vattenfall Support Grafiska, Sweden, 1992 [7] Rijnmond Public Authority: A risk analysis of 6 potentially hazardous industrial objects in the Rijnmond area - a pilot study D. Reidel, Dordrecht, the Netherlands and Boston, 1982 [8] Kletz, T.A.: HAZOP and HAZAN Institution of Chemical Engineers, Rugby

12 [9] Lees, F.P.: Loss Prevention in the Process Industries, Vols. 1-3 Oxford, 1996 [10] PHAST Technical Manual Det Norske Veritas (DNV) Software, UK, 2002 [11] Worthington, D. and H. Witlox: Population impact of toxic and flammable effects (MPACT) DNV, UK, 2003 [13] Hydrogen - energy carrier of the future Linde AG, Industrial gas division [13] Jo, Jan Kie: Risk assessment for the energetic use of hydrogen Master Thesis, Abteilung Anlagentechnik und Anlagensicherheit Otto-von-Guericke-University of Magdeburg, Germany, 2001 [14] Hauptmanns, U.: A procedure for analyzing the flight of missiles from explosions of cylindrical vessels Journal of Loss Prevention in the Process Industries 14 (2001),