Hydrogen Safety

Abstract

Hydrogen Safety is a comprehensive summary of basic safety acumen acquired over the last 60 years from industry and aerospace practice. It is intended to inform technicians, engineers, scientists, and managers who find themselves with the prospect of working in a hydrogen environment in which they have had little experience. It is also set up to provide more experienced hydrogen workers with reminders of how to continue to be safe. Topics introduced include an explanation of the challenges of working with Hydrogen, the basics of how hydrogen hazards are addressed, basic handling, and a compilation of basic component, system and facility considerations. A “Safety Checklist” is provided to be used as suggested, a review of important issues, or to stimulate thinking about how to organize thoughts for setting up a hydrogen activity. Today hydrogen interests are expanding enormously with an explosion of applications. Unfortunately, there have been a spate of serious and deadly accidents involving work with hydrogen across the globe, especially by researchers and developers, that could have been avoided if basic hazards had been better understood. It hoped the information provided in Hydrogen Safety reaches those in need.

6.1 Example Accident

In 1980 at Los Alamos National Laboratory in New Mexico an explosion shook a gas supply facility and hurled shrapnel into property managed by the City of Los Alamos. Two Los Alamos employees suffered extensive burns that would result in 4 months of lost time. City officials demanded an explanation and assurances of safety. The Press dogged laboratory management. The ensuing enquiry found laboratory management grievously at fault for being unaware of the improper hydrogen practice at the gas depot, and for their failure to provide adequate hydrogen training to line management and technicians.

What led to this Accident?

The facility operation refilled gas cylinders for distribution to the various Los Alamos facilities. Technicians operated a bank of valves supplying different pressurized gases through a common manifold. Their inventory included hydrogen and oxygen. The operators had an improvement idea for operations and consulted their line manager. Removal of an isolation valve on the manifold would result in a time savings as one less valve to open. Without hydrogen training the idea seemed sound. The alteration was performed without review by knowledgeable staff or management overview and approval. Immediately upon introducing oxygen into the manifold that retained unvented hydrogen, a mini-explosion resulted that in turn blew out the valve to the tube trailer. An ignition source wasn’t necessary. Hydrogen and oxygen in the right proportions can ignite spontaneously. The oxygen supply with its higher pressure surged into the hydrogen within the trailer. This single point failure led to catastrophic results (Fig. 6.1).

Fig. 6.1

Close up view of tube bank, post-accident [4]

Forensic analysis determined that as the injected oxygen mixed with the hydrogen the higher oxygen pressure adiabatically compressed the mixture, raising its temperature until it exceeded the autoignition temperature, and in an instant, accelerated flames formed and transitioned to detonation at a pressure determined to be 550 psi. The tubes, now subject to detonation, ruptured, and with the consequences that large pieces of shattered steel became shrapnel and a significant cloud of hydrogen was released to form a large fire ball over the parking area.

Two employees who happened to be in the parking lot, were caught by surprise and had no chance to evade injury. Miraculously the shrapnel missed them, but they suffered flash burns over a large portion of their bodies. Hydrogen flash fire combusts very quickly, releasing all its energy in a second or two. Any protective action by the victims would have occurred after exposure to the radiant energy had already happened. One massive piece of shrapnel travelled a quarter mile passing the laboratory perimeter into city property, an event that really caught the public’s attention. Amazingly, and fortuitously the resting spot of the shrapnel was in the city dump! (Figs. 6.2 and 6.3)

Fig. 6.2

View of the scene of the accident from the parking lot [4]

Fig. 6.3

Shrapnel thrown into the City of Los Alamos [4]

This incident underscores several key points regarding hydrogen safety:

• Changes to any system require careful review. Even minor alterations to a hydrogen system or operation can lead to drastic changes in outcome.

• Combustion in confined volumes, in this instance the tubes of the trailer, can lead to high overpressures capable of shattering heavy-duty steel.

• Management responsibility extends to all aspects of hydrogen operations, and certainly those involving hazardous operations. Ultimately, in this accident Los Alamos management was held accountable.

• Appropriate training of staff is critical.

6.2 Acronyms, Terminology and Definitions

The following abbreviations and terms appear in the text.

Abbreviation	Term	Explanation
CJ	Chapman-Jouguet	Denotes a detonation state defined by theoretical thermodynamic parameters
NBP	Normal boiling point	Boiling point at one atmosphere of pressure
NTP	Normal temperature and pressure	20 °C (293.15 K, 68 °F) and 1 atm (101.325 kN/m2, 101.325 kPa, 14.7 psia)

6.3 Introduction

These notes summarize issues where care is required in performing work with hydrogen systems. The intent is to inform those new to hydrogen where to focus their attentions in a hydrogen work environment, and for experienced engineer, scientist or technician to provide a review and checklist to avoid missing an important point. For those who support hydrogen work, either in management, procurement, or other support activities, it can serve to inform. The content may be applied to a variety of hydrogen activities including facility planning, laboratory work, operations, test activities, production, manufacture, use of hydrogen appliances, design work and training , to name a few.

Work in your environment will require training and operational protocols specific to the activity involved. The information provided in this text will provide the background to support that work. “Safety Notes” in brackets are placed wherever considerations warrant extra attention. This text is not a comprehensive source, therefore in addition to the basic physical data and practice information provided other sources of information will be referenced.

In this modern era the applications involving use of hydrogen are multiplying rapidly and with new technologies. This work as it exists today is part science, part engineering and part art, and there is no wrong or right way of application. However, hydrogen is a very energetic fluid, and safety must be considered as an integral part of design and application. One of the early pioneers in our modern era, D.B. Chelton wrote [1], “As in any safety program, an explicit set of adequate rules cannot be given; instead, the general criteria must be studied carefully to ensure that every potential hazard has been considered”, and this is still excellent guidance for today.

6.4 Primary Safety Issues with the Use of Hydrogen

The characteristic behaviors noted in over a century of hydrogen use make clear that safety considerations must be applied in measure equal to any other consideration whether in planning, design, fabrication, installation, operations, disposal, maintenance, and even in shutdown and termination phases of projects or facilities. Hydrogen, while ubiquitous in the universe at large, does not exist in a free state in our natural environment. Hydrogen employed in the myriad applications found today as well as new applications under contemplation must be manufactured, transported to points of use, stored under conditions that meet the requirements of intended applications, and deployed in systems with some care. It is a fair observation that with the accelerating pace of development of new hydrogen applications, hydrogen practice is not a staid static field and may be considered as much art as engineering. There is no one correct way to proceed. It is an artificial material with no natural “safe” state, so we the planners, designers, managers, and operators of systems are all responsible for using hydrogen safely.

The primary issues with hydrogen use may be summed up with four areas of concern, and in order of importance, are:

• 1. Fire and Explosion. Hydrogen is flammable over a wide range of mixtures, readily ignited by a variety of ignition sources which in certain circumstances have energies so small as to be considered spontaneous, and in the presence of typical confinements such as lines, ducts, or any enclosed volume, possesses a propensity to generate damaging overpressures.

• 2. Pressure Systems. Most hydrogen systems operate at elevated pressures, and therefore have all the hazards that attend pressure systems. See also Chap. 3.

• 3. Materials of Construction. Proper system material selection is required for the conditions of use, especially in systems that operate at low temperatures. Materials must possess appropriate ductility, and design must account for material expansion and contraction over the operating range. Electronic properties in sensors must be suitable for the temperatures of use. In addition, certain metals are subject to hydrogen attack that can accelerate stress crack growth resulting in loss of strength, and in the worst of conditions cause dramatic material failure. See also Chap. 1.

• 4. Protection of Personnel and Surroundings. Basic practice dictates that personnel and critical equipment be protected from any possibility of exposure to dangerous combustion and overpressures, usually by isolating the hazard. Operations are permitted around equipment with certified pressure ratings in conjunction with the appropriate personnel protective equipment (PPE) provided to mitigate minor chance exposures. Exposures include flame, ultracold surfaces, eye hazards, possible acoustic hazard, dangers associated with pressure equipment, and asphyxiation, especially where equipment or facilities employ purge gases such as helium or nitrogen.

An additional comment is that safety considerations for hydrogen use involve not only the system elements wetted by hydrogen, but they must include adjacent components and hardware which might be exposed should a release enter their surroundings and cause interaction.

The presentation that follows will address these primary issues. The text identifies issues and their hazards, examines their genesis from physical properties or system characteristics, then notes approaches to addressing hazards and safety guidelines . A focus on the profound influence of confinement is used to hopefully aid the reader’s intuition on how to break down hydrogen hazard complexity.

Topics discussed:

• The Challenge to Working with Hydrogen

• Addressing Hydrogen Hazards

• System Considerations

• Facilities

• Safety Checklist

In each of these topics you’ll see the same issues resurface as they reflect on different areas of interest whether it be design, basic handling, systems, operations or facilities.

6.5 The Challenge to Working with Hydrogen

Hydrogen is a manufactured product not found free in at the earth’s surface as it is chemically bound in organic and inorganic compounds. As a gas at one atmosphere it has low density, so to make it a useful commodity it must be compressed to high pressures, or liquified at cryogenic temperatures, or both, and therefore, its handling has all the attendant concerns of pressurized, and/or cryogenic systems. By itself, hydrogen is not reactive, but if allowed to mix with oxidizing substances it will form highly flammable mixtures. Air is ubiquitous in most use environments and this leads to the primary issue, that of hydrogen’s combustion behaviors in air. Mixtures of hydrogen in air are flammable over a very broad range and combustion is initiated by very low ignition energies such that any unplanned release may lead to fire and explosion hazards. The issues with physical behaviors, combustion, materials usage, health issues are highlighted.

6.5.1 Physical Behaviors

The following material introduces basic hydrogen properties, but also lays out how they can be a challenge to use safely.

Hydrogen States. To date, applications¹ have used hydrogen as a solid (SH₂), liquid (LH₂), slush (SLH₂), and a gas (GH₂). Hydrogen’s physical properties arise from phase transition behaviors at very low temperatures and over a very narrow range:

• The triple point (where all three phases coexist) occurs at a temperature of 13.8 K and pressure 7.2 kPa [Safety note: This is a sub-atmospheric pressure, and it is critical that systems operating at such pressures absolutely prevent in-leakage of atmospheric air (or other oxidizing substance)],

• The normal boiling point (NBP) at an absolute pressure of 1 atmosphere (101.323 kPa) is 20.3 K,

• The critical temperature (the highest temperature at which hydrogen vapor can be liquefied) is approximately 33 K.

Atomic and Molecular Structure. Hydrogen, the most abundant element in the universe, might be consider a basic building block with its first-place entry in the periodic table. There are three known isotopes of hydrogen: protium (AMU 1); deuterium (AMU 2, one neutron); and tritium (AMU 3, two neutrons). The issues discussed in this text focus on molecular hydrogen formed from protium. Atomic hydrogen occurs by ionization or by dissociation of the covalent bond on a metal surface. Deuterium and tritium are constituents in nuclear processes with many specialized safety concerns beyond this treatment. However, if deuterium and tritium are concentrated, then their physical properties will vary according to their greater atomic weights, and because the chemistry of all three isotopes is very nearly identical the safety issues reviewed herein will apply. Only when sufficient quantities of deuterium and tritium are considered does radioactivity become a safety concern.

Concentrated as pure element, hydrogen under normal conditions forms a diatomic molecule with a covalent bond. The interior spin states of the two hydrogen nuclei in the molecule give rise to allotropic forms of hydrogen, ortho- and para-hydrogen. Ortho-hydrogen possesses parallel spin states while para-hydrogen has anti-parallel spin states. The ratio of the populations of molecules with the two spin states varies with temperature such that higher temperature favors greater numbers of orthohydrogen and low temperatures, parahydrogen. This behavior, arising from the arrangement of nuclei within the molecule, has implications for the bulk properties of hydrogen.

General Gaseous Behaviors. Let’s examine hydrogen’s general physical properties at ambient temperatures to get a better appreciation of issues. To human senses hydrogen gas is invisible, tasteless, and has no odor. Aside from requirements that require high purity, adding odorants (like mercaptan used in natural gas) is of no value because hydrogen is so diffusively mobile that it will leave any odorant behind. Basic information is tabulated (Table 6.1).

Table 6.1 Hydrogen general properties

Adding a further edge to these sensory deficit issues is the fact that the flames of this highly flammable gas in air are practically invisible under many ambient lighting conditions. Hydrogen flames emit in the UV and two bands in the mid-IR, but with relatively low amplitude in the visible range. And, there is yet one more sensory deficit twist! This arises from the low emissivity of hydrogen flames, except when large clouds of hydrogen are involved in combusting.

The emissivity is one to 10% of other hydrocarbon flames such that we can’t sense a hydrogen flame’s heat, meaning that we won’t recoil from the heat gradient of the flame because we can’t perceive it. Hydrogen flame temperatures in air are very high 2045 °C (3713 °F), so that without protection [fire resistant gloves] burns are unavoidable. There may be clues to the presence of hydrogen. Under certain lighting circumstances the density gradients formed by release of hydrogen in air or the heat from its combustion produce visible distortions, sometimes readily observed when light, incident upon the mixing of GH₂ in air falls on nearby surfaces. Leaking GH₂ may produce noise. With a sonic velocity nearly three times that of air, amounts of hydrogen mixed in air can alter ambient sounds, shifting their apparent frequency to the human ear (like helium ). These basic physical realities present a real conceptual hurdle to new hydrogen handlers, namely if one can’t rely on their senses to indicate where it is, how can this be safe! For starters, detection instruments are required for work with hydrogen.

Hydrogen does possess characteristics that can be used to advantage. At ambient temperatures hydrogen is the lightest of all gases and has a density a fifteenth that of air. This results in great buoyancy, and if it wasn’t for the flammability , we’d all use hydrogen in our party balloons! The rate of rise in air is remarkable at around 3 m/s under typical conditions, and even greater if the hydrogen is hot or the surroundings cooler. If the system in question is out in the open (outside) this is a boon to safety considerations. However, inside structures or other confining regions released hydrogen will seek the highest points, and where enclosure spaces are connected by lines or ducts will flow to the highest points in the connected regions by simple convection. [Several safety notes:

• If inadvertent release can lead to accumulations that can form flammable mixtures, electrical components (lights, switches, motors, etc.) are potential ignition points. Code requirements may specify explosion proof devices for these areas.

• Ventilation may be enhanced if accumulation point feed into vents.

• Detection instrumentation can be located to advantage in potential accumulation points.

• Electrical conduit in hydrogen use areas that convey control lines to control rooms or other unprotected chambers should be “potted” or sealed to prevent inadvertent hydrogen transport and accumulation].

The high diffusivity of hydrogen often is a benefit to safety. Remember, a concentration of gas, if not confined will always disperse until an equilibrium concentration is achieved. Hydrogen will do this better than any other gas.

Due to the risks of inadvertent release a high premium is placed on using high integrity seals to keep hydrogen in a system. However, hydrogen molecules are small, and in bulk as a gas or liquid possesses low viscosity giving handlers another concern; preventing it from leaking which it does so more readily than other fluids.

Even though at ambient temperatures hydrogen is the lightest of all gases, at cryogenic temperatures near NBP (see below) it can be slightly heavier than ambient air or neutrally buoyant.

General Cryogenic Behaviors. Hydrogen safety considerations vary upon whether cryogenic temperatures are part of the application. Significantly higher densities are achieved with the liquefaction of hydrogen, an important consideration for bulk storage, but in practice entails a whole new dimension of safety issues compared to those of ambient temperature GH₂. Greater densification is achieved by either reducing temperatures, producing 2-phase mixtures (SH₂), or by high pressurization of liquid or gas to 700 bar (10 kpsia) which achieves as much as a 30% densification.

LH₂ is colorless, has no odor, and possesses the lowest density of all liquefied gases (see Table 6.2). It is noncorrosive and is not considered highly reactive. The normal boiling point temperature (NBP) is 20.3 K (423.13 °F) and is less than the freezing point of all other gases, except for helium [Safety note: It is important to minimize impurities in cryogenic systems to avoid blockage in lines and components due to solidified gas impurities]. Hydrogen vapor is neutrally buoyant in air at 23 K. The robust buoyancy previously noted for hydrogen gas doesn’t begin until vapor temperatures warm above cryogenic temperatures, defined at 123 K. Cryogenic hydrogen vapors released into the open will persist along the ground or elevation of release, and can be transported by wind² some distance before rising.

Table 6.2 General cryogenic hydrogen properties

Exposure to ambient heat will result in the expansion of liquid hydrogen [Safety note: the coefficient of volume expansion is greater than that of water (23×). This has implications for the design of ullage volumes, relief equipment, and operations]. Direct exposure to ambient temperatures will cause rapid boiling, vaporization, and expansion as gas until at normal temperature and pressure (NTP) the total expansion over the original liquid volume will be a factor of 845 times greater [2] [Safety note: Safe handling of cryogenic hydrogen requires any hardware containing LH₂ to use redundant pressure relief protection to avoid over-pressurization, container rupture, and explosion hazards. This is a code requirement]. See also Chap. 3.

As a fluid hydrogen has a high heat capacity and coupled with the kinetics offers heat transfer characteristics that are useful in certain applications (cooling electric power transformers is one example). There is a curious detail that comes from spin transitions in the hydrogen nucleus. The heat capacities of ortho- and para-hydrogen differ, and at low temperatures para-hydrogen’s heat capacity is significantly larger. This has implications for processing and storage of liquid hydrogen, as the inevitable self-catalysis of ortho-hydrogen to para-hydrogen at low temperature releases significant amounts of heat, capable of evaporating 1% of condensed product an hour. Therefore, catalysts are used to speed this process and remove this heat before it interferes with storage efficiency. Commercially supplied liquid hydrogen is para-hydrogen.

[Safety notes:

• LH₂ is always isolated from air or other oxidizers to avoid creating highly shock sensitive explosive mixtures formed by their condensation in LH₂.

• Uninsulated surfaces of LH₂ systems can condense air to form liquid air which presents its own hazards. These include frostbite and if liquid air combines with carbonaceous materials (grease, oily rags, plant matter, etc.) highly flammable and shock sensitive mixtures form.

• These low temperatures present a severe frostbite hazard to human tissues if direct exposure occurs. The danger of freezing by exposure to cold vapors is increased due to the high thermal conductivity of gaseous hydrogen.]

6.5.2 Combustion

Several criteria must be met before hydrogen can combust. It must be mixed with an oxidizer to form mixture within flammable limits, typically noted as the lower flammable limit (LFL) and the upper flammable limit (UFL). An ignition source must be present within the flammable mixture, however when the mixtures formed are near optimal, or stoichiometric, ignition is possible with such small sources of energy as to be considered spontaneous. This general statement applies to both gaseous mixtures of hydrogen and oxidizers as well as condensed phase mixtures which would be solid oxidizer mixed in liquid hydrogen.

Combustion of Gaseous Mixtures. Table 6.3 provides basic combustion data for gaseous hydrogen mixed in air. Flammable gaseous mixtures represent the most common hazard. As a point of reference, the minimum ignition energy (MIE) in a static electric discharge is several orders of magnitude below the human threshold of sensation.

Table 6.3 Gaseous combustion properties (para-hydrogen)

Combustion can involve any one or all these processes: fire, subsonic flame acceleration known as deflagration, or supersonic flame propagation, specifically termed as detonation. Confinement of flammable mixtures is implicated in exacerbating hydrogen combustion events and is an important factor. If confinements are sufficiently narrow flame fronts lose enough energy such that combustion ceases, or the flame is quenched. The quenching gaps for hydrogen are narrower than those of other fuel gases.

Fire. Fire is a rapid chemical reaction that produces heat and light and is differentiated from deflagration and detonation by defining it as a stationary flame with the flammable mixture fed into the reaction zone (plume or jet). Fire is characterized by sustained burning and is accompanied by any or all of the following: light, flame, heat, and smoke.

Deflagration. Accelerated flames, or deflagration arise from a common hazard scenario where hydrogen is released within a system or an environment and allowed to mix with an oxidizer such as air to from a flammable mixture over a region. If ignited, flame will propagate through the flammable portions of the release, and typically moves at a subsonic rate with respect to the unburned mixture. Without confinement the flame advances by diffusion processes known as laminar burning which in air under ambient conditions produces propagation rates up to 3 m/s. When confinements have roughly equal dimensions (for example, roughly spherical or cube-like) the resulting pressurization from the combustion typically results in propagation speeds less than 100 m/s.

As a light gas the more rapid kinetics of hydrogen alter its behavior over that of other flammable gases. For example, its sound speed is nearly four times that of air and its diffusivity in air is four times greater than that of methane. The increased diffusivity has implications for the movement of free radicals in flame fronts resulting in higher laminar flame speeds and leading to coupling of combustion and fluid flow processes. This coupling promotes flame acceleration (deflagration, a subsonic process) in a bootstrap fashion. In confinements that focus acceleration along a “long” axis flame acceleration becomes significant. The rapid product gas expansion from combusting hydrogen-oxidizer mixtures readily interacts with any confining surfaces (rigid structures, pipe walls, and even the roughness on these surfaces, etc.) to produce pressurization, drive fluid flow and push the flame front into unburnt gas. In most circumstances the rate of reaction in the flame front is increased by greater mixing, releasing yet more energy (assuming the mixture has the necessary energy, >13% v/v) until further flame front acceleration is limited by choked flow, typically 400–800 m/s where the flame front is advancing relative to the unburned gasses.

Detonation. At this stage, should turbulent flow grow, shock formation can jump-start the deflagration to detonation transition (DDT) process³ and result in a supersonic shock driven combustion, or detonation. In a sense, the energy available throughout a combusting mixture can be leveraged unpredictably against system elements downstream of the flame propagation. A more concrete, yet simple example, is provided to illustrate the possibilities:

Example

Consider ignition of a flammable hydrogen mixture in a steel tube. The confinement of the expanding product gases drives the flame front into the unburned mixture, increasing mixing and combustion and the rate of energy release. The flame propagates and as the hot gases expand and flow down the tube, they are subject to wall friction forcing the flame front to slow near the walls, but “nose” out toward the center of the tube, and in the process stretch the flame front. This increase in the flame front size improves mixing and further increases the rate of energy release. Incidental obstructions (bends in the path, obstacles, etc.) and surface roughness in the path of propagation induce turbulence in the flow that further increase the burning rate. While such interactions are common with a variety of fuel-oxidizer mixtures, with hydrogen they can lead to startling combustion behaviors. A sensitive⁴ hydrogen-oxygen mixture ignited in a 0.5′′ ID smooth walled steel tube can accelerate from a simple match ignition to transition to detonation within a half meter of run-up within the tube creating an overpressure roughly 18 times the initial fluid pressure and a jump in the rate of propagation to 1500 m/s and greater. There are other factors such as pressure piling (the advancing flame front pressurizes the upstream flammable mixture) and superposition of pressure waves (by reflection) that can lead in certain circumstances to combustion induced pressures nearly 1000 times greater than the initial fluid pressure.

This sort of possibility makes hydrogen system design a challenge, and if not properly accounted for, may lead to catastrophe. There are many factors to consider such as the mixture conditions (mixture composition, pressure, temperature, the presence of diluents), the detonation cell⁵ size that provides kinetic information, as well as the confinement dimensions.

In general, simple combustion is more likely than flame acceleration, and flame acceleration is more likely than detonation, but with hydrogen-oxidizer mixtures these combustion proclivities are decidedly skewed towards the more reactive behaviors over that of other fuel-oxidizer combinations. With detonation, the supersonic propagation of the process defeats standard mechanical pressure relief devices which rely on subsonic fluid behaviors.

Condensed Phase Explosions. There are uncommon circumstances in which air or liquid oxygen can encounter liquid hydrogen. These circumstances result in extreme hazard, and while they are unlikely given standard hydrogen practice, they are mentioned specifically so they may be avoided.

The most exciting situation can occur with a rocket launches that fail during lift off, typically falling back to the launch pad, and oxidizer and fuel tankage collide, or a similar sort of occurrence of a violent failure on a rocket test stand. When liquid oxygen rapidly enters liquid hydrogen, it forms solid crystals and the motion of the crystals through the liquid hydrogen induces static discharge. The static discharge initiates combustion spontaneously and an explosion ensues involving the contents of the surface area of mixing. Typically launch accidents only involve a fraction of the inventory, but rocket launches do involve large quantities and the much greater density of the condensed phase over that of gaseous mixtures supports violent explosions.

A more pedestrian accident scenario, but potentially catastrophic is possible with what is called cryo-pumping. In this situation a leak passage in a cryogenic system exposes an internal super cold region to outside air. Liquid hydrogen is colder than all cryogens except liquid helium . The condensation of the air literally forms a vacuum in the passage and some of liquified air enters the hydrogen system. It freezes to form solid air. If this process proceeds undetected as a small steady instream a flammable mixture can build up in the hydrogen. Stoichiometric mixtures formed this way possess greater energy per unit mass than TNT and as a mixture approaches stoichiometry it becomes shock sensitive and can become more shock sensitive than nitroglycerin. A minor shock event, a jarring of a Dewar can initiate an explosion.

Finally, a liquid hydrogen leak onto the ground that persists for some time, can if conditions are right, end in an explosion. If the leak is sufficiently persistent to chill the ground to cryogenic temperature, water vapor will form a slush into which liquid air products along with some liquid hydrogen will accumulate until it becomes shock sensitive. At some point the falling drops of liquid hydrogen initiate a reaction.⁶ This circumstance can only occur if the leak persists unattended. Industry experience is that most spills of liquid hydrogen rapidly flash to gas leaving a little frost behind.

If oxidizer and fuel are always isolated these situations will never arise.

6.5.3 Hazards of Pressurized Systems

Hazards inherent in hydrogen systems come from hydrogen’s low heat of vaporization, its large liquid-to-gas expansion ratio and the large thermal difference between LH₂ and the ambient environment. At high pressure compressed gas possesses significant potential energy. Ultimately the cause of hazards originates with failure of containment components. Rupture and explosive release of hydrogen may arise from failure of the pressurization system, or failure of the pressure relief system.

Fire from an external source can introduce more heat into the system than anticipated in the design. With inadequate venting over pressurization results.

Before large scale commercial production of LH₂, users had to produce their own, and the issues of ortho- to parahydrogen conversion where not well understood.⁷ Relief systems were overwhelmed by the larger than expected boil-off gas production.

Operator error of overfilling creates an inadequate ullage volume. A swing in the internal temperature of the LH₂ can cause liquid expansion into a relief system designed only to accommodate gas. In such a situation the liquid-to-gas phase change creates large overpressures.

A Hypothetical. Theoretically, a scenario in which valves fail shut isolating liquid hydrogen in a line without pressure relief protection, otherwise known as “liquid-lockup”, would result in pressure extremes as ambient thermal energy penetrated the thermal insulation. This may be examined two ways:

• Consider the equivalent volume of gas at NTP per liquid volume at NBP: Ideal gas law predicts a gas to liquid volume of 845.1 times.

• Alternative, one might evaluate what pressure is required at NTP to maintain liquid (NBP): 172 MPa (nearly 25,000 psia).

At some point, depending upon the strength of materials in the piping , the containment will fail at a weak point resulting in a rupture release of hydrogen. Not only is dangerous shrapnel possible, but a rupture event can create hot small metal shards capable of igniting a sensitive hydrogen-air mixture, should the two coincide, and this could result in flash fire.

6.5.4 Materials Considerations

Hydrogen systems incorporate materials for different functions, under a wide range of conditions and must be compatible with hydrogen’s unique properties. Material selection may involve some of the following considerations:

• Design and operating conditions

• Effects of environment or operating conditions

• Change in physical properties over a wide range of temperature (inherent in cryogenic service)

• Corrosion resistance

• Toxicity

• Hydrogen embrittlement

• Cold embrittlement

• Thermal contraction

• Material cost, ease of acquisition, and availability of material’s data

• Ease of fabrication, assembly, and inspection

• Behavior under fault conditions such as fire

The issues associated just mentioned are varied and complex and cannot be addressed comprehensively in this text. The recommendation is that designers consult materials specialist where critical conditions occur. Engineers and technicians working around hydrogen equipment must appreciate that where direct hydrogen exposure occurs selection of materials must involve critical review should substitution of materials be contemplated in a maintenance action or in the custom fabrication of assemblies. General concerns include:

• Hydrogen attack on metals,

• General material behaviors at cryogenic temperatures.

Hydrogen Attack or Embrittlement. Many metals and alloys undergo a decrease in fracture toughness or ductility when exposed to atomic hydrogen. Pure molecular hydrogen, and other hydrogen-containing gas species, particularly hydrogen sulfide (H₂S), hydrogen chloride (HCl) and hydrogen bromide (HBr) molecules. These molecules are adsorbed onto metal surfaces, and the hydrogen dissolves into solution with the metal atoms and diffuses throughout the material. Mechanical properties of tensile strength and ductility can be significantly reduced such that fracture loads may be reduces below the yield strength of the material. In some circumstances this process is rapid, occurring in minutes and in pressurized systems can directly lead to catastrophic failure.

There are three general mechanisms under which the effects of embrittlement occur with susceptible metals and alloys. Environmental embrittlement is seen in metals and alloys that undergo plastic deformation in a H₂ environment. The hydrogen enters through microcracks on surfaces exposed to hydrogen. For example, a vessel undergoing expansion at high pressure. The greatest effects are noted over the temperature range of 200–300 K. Internal embrittlement arises with hydrogen absorbed into the bulk of materials generally as the result of processes such as welding or electro polishing. Water present on work surfaces is electrolyzed, the hydrogen ionized and electrically driven into the metal. The history of components manufactured using such processes should be evaluated to ensure embrittlement is not a concern. This mechanism has its greatest effect with temperatures in the range of 200–300 K. The last mechanism of concern is H₂ reaction embrittlement that can occur within metals at elevated temperatures. The absorbed H₂ chemically combines with constituents such as carbon in steel to form methane or other brittle hydrides. The effect is reduced ductility.

The performance of several notched samples (Charpy Impact test) are tabulated (Table 6.4) to show the effect. Lower strength treatments generally perform better than higher strength counter parts.

Table 6.4 Some examples of embrittlement

There are a variety of factors that influence embrittlement behaviors including the operating environment, temperature, pressure, exposure time, and physical and mechanical properties. More detailed considerations may involve the stress state, stress concentrations, surface finish, microstructure, and existence of cracks. The purity and concentration of hydrogen must be considered. General strategies used with embrittlement issues are:

• Use less susceptible materials.

• Consider that the susceptibility to embrittlement generally increases with increasing tensile stress and alloy ultimate strength.

• Use increased material thickness.

• Reduce hydrogen exposure or purity.

• Account for processes such as electrical discharge machining (which may increase potential for H₂ embrittlement).

• Apply conservative design that accounts for the reduction in strength.

• Apply proper surface finish and welding (Fig. 6.4).

  Fig. 6.4

  

  Rupture disk fails when exposed to hydrogen [4]

Example

A tube trailer was being converted from helium service to hydrogen service. The archived documentation on the system indicated the relief components were rated to 10,000 psia but failed to note a subsequent replacement of burst disks to nickel disks rather than the original 304 SS disks. The hardware was not physically checked with sufficient care to observe the change, and this would not be readily obvious. A leak check with nitrogen at 6000 psi was done without incident. Operations proceeded with charging the tube bank with the plan of reaching 6000 psia. Within approximately 20 min one of the burst disks failed at a gauge reading of 1600 psia. The operation was halted, gas purged, and a new burst disk installed. However, when the operation reached a pressure of 1800 psia a second burst disk failed. At this point all operation was suspended and an investigation of all burst disks was performed.

There are several points illustrated by this incident, beyond this is what hydrogen embrittlement looks like and that care must be observed for proper material selection. Knowing the pedigree of the tube trailer vessel steel (adequate for hydrogen service and had previously been used for hydrogen) would tilt expectation to an assumption that the hardware service corresponded and was selected for hydrogen use. The fact of successful helium service followed by testing with nitrogen at service pressure didn’t provide a clue. A detailed check of installed hardware versus paperwork could have revealed a discrepancy, if the proper component identification was still legible. Should the service modification or repair had been documented, the future users would have been alerted to the change. Note the embrittlement effects occurred quickly, and that fortunately reduced the amount of hydrogen loss and personnel labor on the loading operation over what would have be lost if loading had gone on to yet higher pressures as intended. From a safety perspective, operations of this sort must account by planning for mishaps, because they do happen. And, also realize, that any unexpected high-pressure release entails a greater risk to personnel, even when proper precautions are being observed.

General Materials Service. In general, the materials specified by industry for ambient hydrogen service conditions are not suitable for cryogenic service. General concerns may be summarized as:

• Liquid air formation that occurs when components at cryogenic temperatures are exposed to air.

• Low temperature suitability of materials, including low-temperature embrittlement and loss of ductility of containment materials, differential thermal expansion of materials, especially at sealing junctions and considerations for materials in proximity to the low temperatures. See also Chap. 1.

Liquid Air Hazards. Uninsulated surfaces of a system containing LH₂ can readily condense air as shown in the photograph of an uninsulated chilled duct. It looks like water, but it is not harmless and must be treated with caution (Figs. 6.5 and 6.6).

Fig. 6.5

Liquid air formation [4]

Fig. 6.6

Symptoms of acute LH₂ exposure [4]

Where a cryogenic stream collects, the exposed surface will be chilled to the point where air gases are condensed, and a slushy accumulation of water ice and condensed air gases will develop. Should liquid air come into direct contact with any carbonaceous materials as is typical in work sites (consider oily rags), flammable, even shock sensitive compounds form. When the liquefied air warms, nitrogen preferentially leaves the liquid mixture thereby increasing the concentration of oxygen from its starting concentration of 21% v/v as it exists in air to 50% v/v and greater. Oxygen enriched mixtures possess the same hazards as liquid oxygen!

6.5.5 Health Hazards in Hydrogen Operations

Extreme exposure to combustion or pressure hazards is avoided by system design or operational controls . Where hands on work occurs, hydrogen practice requires personnel use personnel protective equipment to mitigate minor exposures. In order of consideration these exposures are:

• Cryogenic exposure and hypothermia

• Thermal exposure

• High pressure gas or shrapnel impingement

• Shockwave exposure

• Asphyxiation

Cryogenic Exposure can cause symptoms like frostbite , and in more extreme exposures resemble severe burns. To avoid such consequences long sleeved insulating glover are used. In addition, coveralls are supplied without cuffs or pockets to capture liquid splash. Of equal concern is the danger that pressurized leaks of cryogenic hydrogen pose to skin and eyes. Protective glasses and face shields are employed for protection. Theoretically hypothermia is a concern, but this hazard would be difficult to realize in typical operations.

Fire. Because hydrogen flames are difficult to sense hands-on protocol will require personnel wear flame protective gloves and check hydrogen hardware for flames using fire detective instruments. Experienced personnel will apply situational awareness and look for indicators that forewarn of hazard; distortion of light, whistling sounds, knowledge of where leaks are possible, etc. The consequences for not doing so are severe thermal burns. Another combustion hazard is exposure to thermal radiation emitted by large flares, fireballs or UV radiation exposure in close proximity to hydrogen flash fires (but not direct exposure to hot product gases, mainly steam). Large fire balls or flaring of hydrogen produces thermal radiation similar to well characterized hydrocarbon fires and physiological effects may summarized as by noting a cumulative exposure of 2 calories/cm² will produce 2nd degree burns on exposed skin (Effects of Nuclear Weapons). More detailed information on exposure time and escape times is available (AIAA Guide). The effects of flash fire are not well characterized in the literature, but anecdotal accounts describe consequences like sunburn. However, it is important to note that hydrogen flash fires can occur within a second and deliver a total exposure capable to cause severe burns. Human reaction time is not sufficient to mitigate such consequences. Distance from the combustion is a critical factor because water vapor in the air can absorb the UV emissions (AIAA Guide).

Pressurized Components. Operations in proximity to pressurized systems are subject to code requirements. Proximity to pressurized components and fittings is avoided unless they are certified through pressure checks and inspection. Hands on activities require depressurization and removal of hydrogen. Hazards typical involve shrapnel or penetration of tissues by a high-pressure jet. See also Chap. 3.

Exposure to shockwaves (overpressure) over the body has the potential to cause significant physiological harm. Effects drawn from military experience are given in Table 6.5.

Table 6.5 Physiological effects of blast overpressures [4]

The protocols observed by standard hydrogen practice would isolate personnel from such effects. Exposure can only occur as the result of egregious error.

Inhalation. Hydrogen is nontoxic, but in quantity, exposure can induce suffocation by diluting the concentration of oxygen below levels necessary to support life. Asphyxiation hazards may potentially arise from hydrogen leaks, spills, or improper venting, and/or unplanned release of purge gases (He, N₂) all of which can result in an oxygen deficient atmosphere. This possibility is always a concern in confined spaces which are subject to occupational safety regulation but is also possible out in the open upon exposure to a large release. Situational awareness is critical because symptoms of physiological duress from lack of oxygen (12–19% v/v oxygen progress into loss of judgement at lower concentrations. Concentrations below 8% v/v oxygen are fatal within 6 min. Exposure to a highly oxygen deficient atmosphere can result in unconsciousness without warning! See also Chap. 4.

Protocols for hydrogen operation are designed to avoid directly exposing personnel to large amounts of hydrogen due to the fire hazard. However, hydrogen operations can involve inadvertent exposure to purge gases, typically helium or nitrogen. These gases are used to clear hydrogen systems of air or hydrogen depending on the need. Unfortunately, industry case history has many fatal accidents involving asphyxiation by purge gases.

6.5.6 Engineering Management

In organizations with a hierarchical structure such that a division of labors is in place, some consideration must be given to how to operate safely. In a facility scale environment all parties are responsible for safety. Overall responsibility and approval powers typically reside with management. In addition to oversight, management charter includes establishing the authority having jurisdiction (AHJ) for code compliance, managing pressure systems, hazard communications, providing personnel training , and establishing and insuring certification requirements for equipment and personnel are maintained. Conversely, personnel must be proactive regarding safety issues. It is critical that operations be provided adequately knowledgeable safety personnel with hydrogen experience (Chelton).

Other basic safety considerations include understanding physical properties in operating regime, incorporating failsafe design practice (redundancy, fail-safe operational characteristics), insure a “Safe Interface”, that is critical operations and those involving personnel must be “two fault tolerant”. Hazard Communications is based upon design and operation reviews, written and approved procedures , safety communications & training , mishap reporting, and the establishment of normative documents. See also Chap. 2.

6.6 Addressing Hydrogen Hazards

The methods of addressing hydrogen hazards pointed out in this discussion have their basis in aerospace practice and may differ in degree from industry practice. An excellent and comprehensive source of general practice information has been assembled by the U.S Department of Energy and can be found on-line at http://www.h2tools.org. In this section the general strategies and practices that form the basis of hydrogen safety practice are reviewed.

The assumption applied with this material is that the reader is working within a larger organization. Successful safety practice depends upon the decision makers and management exercising responsibility for establishing and enforcing safety policy. This includes ensuring that all applicable statutory and regulatory requirements are identified, documented, and followed.⁸ In addition, management must define, designate, and document the entity, or entities, often referred to as the authority having jurisdiction⁹ (AHJ) that is empowered to implement and enforce safety policies and procedures . However, personnel must also inform management as issues arise. Ultimately, everyone involved with H₂ system or operation is responsible for safety. To the degree necessary, support activities including procurement agents, janitorial staff, facilities maintenance, and anyone otherwise possibly exposed to hydrogen facilities or possibly impacting safe operation should be privy to hazard communications.

There are ample instances in hydrogen work where inadequate communications, a lax working environment and poor management control have led to catastrophe. A culture of written instruction required for safe handling/use of hydrogen. Written instructions or protocols:

• Should be formal (written),

• Approved and enforced by upper level management,

• Available to, and understood by, all personnel involved in H₂ activities,

• And, applied to all phases of system operations.

Personnel that work in hydrogen environments must have general hydrogen training and those who work with hydrogen systems should have specific certification for on the job training on those systems.

Earlier it was pointed out that safety begins with advanced planning so that the worst consequences are avoided. From a pragmatic approach, planners facing a particular issue will ask themselves several questions along the lines of:

• Can we ignore it?

• Is it possible to eliminate it?

• Is this something that might be avoided?

• Or, can it be controlled?

To aid with these questions, and others like it, there is general guidance that can help. Plan to minimize consequences. If possible, site hydrogen work is performed separate from other activities. Limit as needed, the hydrogen work zones to essential personnel. Minimize the quantity of hydrogen involved. Design and operate for inherent safety. This can entail fail-safe design, for example incorporate valves that close upon loss of power. This strategy employed at the system level would lead to an automatic controlled shut down that isolates supply, removes hydrogen from the system and disposes of it safely. Caution and warning devices can advise personnel.

Design, safety, hazard, and operational reviews are applied to new systems as well as modifications to current systems. The results of the reviews are incorporated into approved operating procedures . All activities must include emergency plans that cover egress and response for all outcomes. Where critical oversite of processes is needed approved quality control and maintenance programs are put in place. If these safe principles and practices are used the consequences of operator error and equipment failure will be minimized.

How safe principles and practices are addressed is discussed in the context of:

• The notion of a “control volume “

• Basic Handling

• Systems

• Operations

• Hazards Assessment.

6.6.1 The Notion of a “Control Volume”

A hydrogen component, system, or facility might be considered a collection of confinements or volumes that possesses inherent design properties, sensors, a set of controls and is operated in a certain way to achieve whatever is intended. Figure 6.7 provides an illustration of the concept of a “control volume “. Hypothetically, hydrogen is always contained in some sort of volume whether it is a storage vessel, a transfer line, or process elements such as an electrolysis stack, or a rocket thruster. The “controlled” and therefore “safe” hydrogen activity is not a function of one element in the system, f

Fig. 6.7

Control volume concept illustrates the types of control elements that may be used to safely manage contained hydrogen [4]

For example a control circuit using input from a hydrogen detector but is a consequence of all the elements involved.

This concept may be applied sequentially from component to component or in a nested fashion such as a storage cylinder operated in a laboratory which itself is a control volume (has ventilation, detectors etc.). Even when hydrogen is purposely released to the environment it is done so under control and the environment becomes the control volume . The broader idea is for the hydrogen user to conceptualize their system in this manner.

Some of the benefits to this approach include:

• Understanding the interaction of system elements.

• It can aid in the identification and tracking of potential hazards. Instead of looking at a single fault in a component the effect on the control volume is assessed.

• Improving hazard analysis and hazard communication. A safety issue may arise from a leak from the system into a surrounding enclosed space. Rather than perceive this as a hydrogen system creating a hazard in the enclosure it is easy to make a case that the controls included with enclosure make the enclosure itself a control volume .

6.6.2 Basic Handling Considerations

Basic Handling Considerations. When operations with hydrogen are contemplated the overall goal is to achieve safe outcome regardless of what circumstances occur. This outcome is only achieved through design and careful planning of operations. Release of hydrogen, whether planned or unplanned must meet with adequate continencies. A simplified system is presented, and important implications of hydrogen releases and combustion are explored. Basic safety acumen is discussed as it pertains to components, subsystems, and common hydrogen activities.

Basic Hydrogen Support Elements. What elements make up a system or facility? Aside from the primary hydrogen application, basic support elements are:

• A hydrogen supply which could be a hydrogen generator, a pressurized gas cylinder with manifold and regulator, or an external high-pressure tube bank or cryogenic liquid storage system,

• An inert gas subsystem,

• Ventilation and associated air monitoring,

• Relief systems,

• Vent disposal subsystems,

• Gas and fire detection , and

• Water spray or deluge.

Regardless of the application, the elements shown in the cartoon (Fig. 6.8) will likely play a role in operations. Other elements may be filters , vacuum appliances, sensors, and controls. In most facilities, hydrogen is supplied commercially over roadways either in steel cylinders, pressurized in tube trailers, or liquified in tankers. When hydrogen infrastructure becomes more common pipelines and delivery by ship may become common. The figure depicts outside fixed bulk liquid storage, but tanker trailers, tube trailers, and manifolded cylinders are all common place. Issues with these components and how hazards are addressed are examined.

Fig. 6.8

Basic infrastructure elements in a hydrogen system or facility [4]

General Combustion Issues. Past experience in working with hydrogen has identified combustion issues as by far the greatest concern followed by pressure system hazards, low temperature materials issues and personnel safety. At some point a system will invariably suffer an unplanned release. An understanding of potential hazards begins with identification of potential sources of hydrogen and where mixing with oxidizing substances might occur, knowing how much hydrogen is involved, whether it involves high or low pressures, and into what surroundings a release will go: Total confinement, partial confinement (openings, lattice work of beams or pipes?), or no confinement. The environment is examined for potential sources of ignition, or weather conditions of concern, etc. Other factors may involve the nearby location of energetic materials or systems such as batteries, fuel cell appliances, fuel, liquid oxygen, or volatile chemical storage.

Leakage/Unplanned Release. Certain operations such as loading or venting may inherently involve release of some hydrogen into the open, but in a controlled fashion. Undesired ignition can occur, but with the proper application of controls not present a hazard. There are many possibilities for release mishaps. Aside from operator error, statistics from U.S. industry from the 1970s [3] indicate the relative occurrence of common component failures. Any of these occurrences could lead to the formation of a flammable mixture.

• Leaks and spills either involve external leakage or in-leakage. Situations to look out for include:

  • Leakage between system components, especially when a component may harbor air and active electronics,

  • Secondary accumulation points such as the high points in a ceiling, or nearby rooms connected by conduit or vents,

  • Internal contamination such as air gases entering into a cryogenic system.

Within components there may be a variety of causes for leaks. For example, material causes may come from diffusion/permeation, expansion/contraction, embrittlement , low temperature embrittlement , corrosion, wear, or damage. Leaks can come from mechanical wear due to stress and vibration, deformation, pressure, or temperature. Unfortunately, an even greater cause is operator error 78). Internal contamination can happen with improper purging , introduction of contaminated fluids, pressurization gas, pump oils, and through a buildup of impurities that come in with each new supply of hydrogen over time.

Ignition. The safety strategy is to eliminate sources of ignition or keep them away from hydrogen. Enforcing an exclusion zone around a system is one step. It allows control over personnel and equipment they may inadvertently bring into a hydrogen work area. A sample list of items to be concerned with includes radios, phones and other mobile devices, generators, automobiles, etc. In the exclusion zone all electrical components need to be evaluated as presenting an ignition hazard. Critical components, defined as ones that either will be exposed to hydrogen, or potentially exposed to hydrogen will need to be explosion proof according to code requirements. Note that the term explosion proof refers to equipment with housing, seals and electrical features that will prevent whatever the function of the device from igniting a surrounding flammable gas mixture. The term has nothing to do with the “hardening” of the component to withstand an explosion. As an example, adequate lighting around hydrogen systems is a code requirement and explosion proof lighting fixtures may be needed.

Hydrogen’s low minimum ignition and broad flammability make releases susceptible to ignition. There are a multitude of possible ignition sources in common environments. A few are suggested by the tabulated possibilities (Table 6.6).

Table 6.6 Possible ignition sources in common environments

Highly sensitive hydrogen mixtures which occur near stoichiometry are so prone to ignition that combustion is characterized as spontaneous. Because of this it is recommended that hydrogen training countermand the common concept of the fire triangle taught about fuels in general.

Another aspect of releases is whether they occur between components within a system or constitute a release outside of the system and therefore can interact with the external environment. One such scenario is an external release of a large amount of hydrogen that is carried by the wind until it encounters an ignition source. The combustion then propagates to the source of the release, or “flashback”.

Explosion. There are circumstances that will support explosive hydrogen behavior. The safety strategy is to avoid creating the conditions that can lead to overpressure, and if that isn’t possible, keep personnel away from any such exposure. A summary of such circumstances includes:

• Allowing flammable hydrogen mixtures to accumulate in any confinement. Combustion within a confinement will result in overpressure.

• If the confinement resembles a pipe or duct in terms of relative dimensions flame acceleration is possible, and even higher overpressures are possible, and if conditions are right detonation processes may be supported.

• Situations that would permit mixing of liquid hydrogen and any oxidizing substance to form a condensed phase mixture. An example features an air leak into a line that is part of a cryogenic system. The air condenses and mixes with the hydrogen in a process called cryo-pumping (see item F in Figs. 6.9 and 6.10).

  Fig. 6.9

  

  The relative frequency of mishap causes as a percent of the total [3, 4]

  Fig. 6.10

  

  Simulated spill: 1500 gallons of LH₂ in 30 s at the NASA White Sands Test Facility in 1980 [7]. Condensed water vapor forms the visible cloud

6.6.3 Principles for Addressing Hazards

General. The design process is best served when safety is treated as an integral element and not as an afterthought. The general guidance in preventing leaks or unplanned releases and reducing the consequences when they do happen is to pursue the following general approach. Design and operations should incorporate attributes that work to prevent unwanted fuel/air mixtures. Once a flammable mixture forms it isn’t possible to rely on suppression of ignition sources to maintain safety. Ideally such systems would always keep hydrogen and oxidizers apart from each other, until at the point of use. Using a purge process can help. Purging with an inert gas, typically nitrogen for ambient processes and helium for cryogenic systems is used to isolate hydrogen from oxidizers. Before hydrogen is brought into a system, air is removed using the purge gases. Air has been used as a purge gas, but only in circumstances where it can be done safely (small amounts of hydrogen, small diameter lines, small flames or overpressures do not pose danger, etc.). Before maintenance or repairs are initiated hydrogen is removed by purge from the system. Disposal of purge gases and hydrogen must be done safely. An industrial scale burn stack is used to combust large quantities of hydrogen by using a propane burner. Small releases may be released directly to the atmosphere above roofs or work areas as long as there is sufficient clearance, other exposures (electrical lines, etc.) are avoided and prevailing winds cannot drive hydrogen into ventilation ducts. The criteria of what defines a large quantity for disposal varies with jurisdiction, but NASA defines a threshold disposal rate [4] at 0.5 lbs/s (0.23 kg/s).

Minimize Leaks. Another goal is to have a leak free system. There is no perfect means to avoid leaks as seals and components will fail. In Fig. 6.9 it is clear that connections and valves are the biggest contributors to undesired releases. Therefore, a common-sense strategy is to avoid unnecessary use of valves and to reduce the number of connections to the least amount possible, then to weld as many connections as possible. The remaining valves and connections can be carefully monitored and maintained. The seals in a hydrogen system should be tested prior to putting hydrogen into the system. With gaseous systems a nonflammable gas is used to pressurize the system. To evaluate first for gross leaks, use nitrogen. Then helium , being a light gas and close in physical size to hydrogen is the best gas to use for high pressure tests. If there are small leak passages helium will reveal them better than other gases, nitrogen for example. Helium is expensive, test gas combinations, or equivalent leak measurements have been worked out (DOT).

Permitted Hydrogen Exposure. Because hydrogen is flammable well below the concentrations that would threaten asphyxiation, ventilation and controls are required. A space with limited ventilation is considered a confined space, and there are specific code requirements for the safety of personnel working in those environments. The amount of hydrogen permitted in a confined space environment is usually set at a tenth of the lower flammability limit (North American standards). In standard occupancies the measure of safety is to keep the amount of hydrogen in an air environment below a ¼% by volume. A different but related concern is keeping hydrogen or air, depending on the circumstances, out of an enclosed space. This may be done by maintaining positive pressurization. Liquid hydrogen storage vessels are managed not at 20 K, but at slightly elevated temperatures so that there is a pressurized ullage. A leak, by proactive design, will be a leak of hydrogen into air rather than the reverse which could pose greater hazards. Alternatively, control rooms that might suffer temporary and limited exposure to a hydrogen cloud, are pressurized with air to keep hydrogen out.

Operations. Operations are planned so that personnel are excluded from any situation, and especially circumstances that can occur due to equipment failure. Work is performed with hydrogen removed. Exposure is limited to hazards that can be mitigated with personnel protective equipment, otherwise remote operations are relied upon. Equipment operates according to fail-safe design and redundancy is employed in all critical areas. Exclusion zones are controlled to keep non-essential personnel away from hydrogen operations and storage areas, and to kept personnel out when hazardous operations commence. Examples of routine hazardous operations include:

• Receiving and transfer of hydrogen

• Disposal operations that involve large quantities

6.6.4 Components

The basic elements that support the hydrogen system or process include the hydrogen supply, connecting lines, relief components, inert gas purge, the disposal subsystem, fire and gas detection. Issues for basic components and subsystems and how they might be addressed are discussed by topic.

Joints and Connections. Welded connections are superior to other connection methods and is recommended wherever possible. Threaded connections are discouraged, but using proper thread sealant, may be used with GH₂. However, they are not used for cryogenic service where the sealant will solidify, shrink and crack. Soft-solder joints not permitted because of their low melting point. A small leak if ignited will melt out the solder and result in a larger release. Demountable joints, such as flanges , should be used only when necessary for junctions that need assembly, installation, or maintenance. Bayonet fittings are used for demountable LH₂ connections.

Valves. Valves are used in a variety of important functions. Isolation valves separate a component, typically storage from the remainder of a system. No additional valve is permitted between an isolation valve and the component protected. It is required for emergency and maintenance. Emergency isolation valves are used for manual or automatic shutoff at source. Other functions:

• Excess flow valves are used to isolate from a downstream equipment failure,

• Check valves prevent backflow and prevent contamination. In aerospace hydrogen service poppet types are used with line sizes ≤0.38 in. and swing or lift type for line sizes 0.5 in. When bubble free tightness of components is needed check valves should not be used.

The valve bodies and soft goods must be compatible with the operating conditions. For GH₂ service, most general industry valves are acceptable. Remote actuated valves may be actuated pneumatically or by electric solenoids. Typically. this mechanical function is located directly over the packing such that a hydrogen leak will make contact. Because solenoid valves are an electric component, without applying some mitigation any leak would be readily ignited. If the solenoid valves are sealed. then they may be acceptable for hydrogen service. For LH₂ service, cryogenic globe or globe-type valves are recommended, but plug or ball-type may be used. The ball valve design should preclude trapping liquid in the ball when the valve is closed to avoid a liquid lock-up hazard. Shutoff valves shall not be installed between a relief device and a volume being protected.

Pressure Relief Devices. Relief devices are required for any volume in which LH₂ or cold GH₂ could be trapped and not have an escape path to relieve pressurization should the cryogen warm. Two common designs are a spring-loaded relief mechanism that will close once the pressure has dropped below a set point and a burst disk, designed to rupture open rapidly and permanently when pressure exceeds a certain level for a enough time. Relief devices, including soft goods, must be selected for the conditions of operation. The metal used in burst disk must not be embrittled by hydrogen. Relief devices should be set to limit pressure to maximum allowable working pressure (MAWP) for the volume in question. Given the high possible pressures which if not relieved could result in an explosive rupture, redundancy of relief devices is commonly required, and even redundancy in types (relief valves and rupture disks) is preferred. This practice prevents a single condition (an example would be ice formation) from causing the failure of both devices. A maintenance schedule is required to keep relief systems operating properly. Several notes apply:

• Rupture disks must be routinely replaced due to their finite lifetime,

• Cyclic loading can accelerate the failure of rupture disks. To accommodate this the rated burst pressure should be selected sufficiently above the intended operating pressure to avoid premature failure.

Hydrogen supply pressures are often greater than the MAWP of connected components. Therefore, downstream system elements supplied by a regulator connected to a high-pressure source should be protected by a relief device unless designed for the maximum pressure of the source. Another system element to which this caution might be applied are vacuum systems . Should a cryo-pumping occur with a vacuum jacket a considerable amount of air gases can freeze on cold inner surfaces. If the system is shutdown, and this condition isn’t detected, the air gases can rapidly expand and rupture the vacuum jacket. Therefore, vacuum volumes should be protected with relief devices as depicted in Fig. 6.11.

Fig. 6.11

Illustration of relief protection for typical volumes including liquid storage, interior cryo-cooled volumes and a vacuum annulus [4]

The flow capacity of a relief devices must be sized to cover all phases associated with an operation. Relief device outlets should not impinge on other components or personnel or be manifolded unless pressure effects can be determined. Relief devices should discharge to a properly designed vent and should not discharge where H₂ can accumulate. See also Chap. 3.

Instrumentation and Controls. Modern hydrogen systems use a variety of instrumentation and controls. Consider instrumentation provides way to obtain quantitative measurements of behavior or state of a process while controls provide a way to maintain or change behavior or state of a process (for example, the thermometer vs. thermostat analogy). Any volume containing H₂ should have adequate instrumentation and controls to ensure that operation is within acceptable limits. Given the desirability for inherently safe systems the system must be able to adapt to different operational conditions, even faulted conditions. Typical instrumentation uses include:

• Instrumentation and controls as necessary for automatic operation,

• Minimally adequate instrumentation and controls to monitor and control its operation,

• Provide performance data,

• Provide warnings and alarms for out-of-limits conditions,

• Provide adequate notice when a hazardous condition is indicated.

Hydrogen Detectors. Recall that unaided human senses have difficulty detecting gaseous H₂. It is colorless and odorless, and while operators can be attuned for hearing an unaccountable sound that may be a leak, the leak sounds may be masked by background noises. The wide range of flammability and potential for fire initiation by static discharge from personnel makes this a critical concern that drives a need for caution. Unfortunately, detection isn’t a case of one type suits all occasions.

A variety of factors drive selection of a detector that will suit particular needs. The goal is to provide immediate detection and warning of leakage. Where detection of flammable mixtures is important the detection must be able to indicate at least 1% by volume in air (25% of LFL) and provide signals to enable shutdown at 2%. This is not required on outdoor locations. Consideration of the use requirements, detector characteristics and limitations are necessary. Primary considerations are:

• Response time,

• Minimum gas concentration detection requirements,

• Full-scale range of the detector system,

• Level of concentration for which alarm detection is required,

• Accuracy of sensors,

• Reliability and recalibration frequency,

• Interface to facility safety and shutdown systems,

• Physical interferences, such as water condensation, soot, grease that may affect the sensor’s ability to function?

More detailed factors include the effects of gaseous contaminants, interference against which the system can’t discriminate (for example, a catalyst system may not be able to distinguish volatile vapors that can be present from hydrogen), and poisons that may compromise sensing mechanisms within the detection system. It is important to understand whether oxygen is required for the sensing mechanism to work (for example, catalyst-based sensors need an oxidizer present). For instance, an oxygen-based sensor may not work in a vacuum. Deployment issues may be important if environmental effects such as wind, buoyancy, etc. can affect performance, and even more critical is if the sensor act as an ignition source, a generally undesirable characteristic. There are different types of H-detectors technologies:

• Catalytic,

• Electrochemical,

• Semiconducting oxide,

• Thermal conductivity ,

• Mass spectrometer,

• Sonic,

• Optical,

• Glow plugs.

It is common practice to locate fixed detectors at likely leak locations such as valves or flanged joints. Portable detectors should be used by personnel wherever H₂ might leak or accumulate. Keep in mind, that where large inventories of hydrogen are concerned that the overall status of the system, or facility must be consulted before entering in proximity. The forward path indicated as clear by a portable detector will give no warning of a large eddy positioned to engulf personnel.

There are passive detection tools that have valuable capabilities. Chemochromic silicone tape will change color on exposure. It has the characteristic of “a saran wrap like plastic” and can stretch fit over components and the overwrap will stick to itself without adhesives. The color change visible from a distance.

Fire Detection. Again , human senses are inadequate, and operations must rely on instruments because hydrogen flames nearly invisible in day and the emissivity of H₂ flame is so low that it is difficult to sense radiated heat. It is not uncommon in complex piping arrays for a hydrogen fire to be discovered that must have been burning for some time. There are a variety of detector types, and they work by different technology:

• Temperature sensing

• Heat sensitive cable

• Optical

• Broadband imaging

• Narrowband imaging, for example UV detection

• In proximity to the flame a straw broom or tossed dust

• Fire extinguisher (Fig. 6.12).

  Fig. 6.12

  

  Information from element one, Boulder CO., USA (Disclaimer At this time, this product is unique and worthy of mention (endorsement is not intended) [4]

During the last decade multiband detectors have become common. They avoid inadvertent triggering of UV detectors which easily register false positives to reflected sunlight, welding and lightning. The multiband detectors require line of sight and the response time and field of view can vary with range. With proper fixed positioning they can monitor a considerable region. Another option for improving surveillance is to mount them with a video camera on a motorized gimble for remote operation.

Personnel should use portable detectors where remote monitoring isn’t applicable. The effects of lightning, sunlight, welding on UV/IR detectors should be understood. Also, detectors must not be an ignition source.

Filters. Contaminants and particulate in a system can block passages. In systems with high pressure particulate can be accelerated to high velocities and cause damage to internal lines and vessels. Filters can help solve such issues. They are useful in refill or resupply lines. However, they introduce a pressure drops that interfere with system function. Therefore, use the right quantity and locations to minimize system impurities. It is important to consider operability and seal/seat leakage. The design layout should locate filters where they are accessible for cleaning. Sintered metal elements have been known to shed particulate and should be evaluated to ensure this is not a problem. Non-calendered woven wire mesh filter elements do not have this issue.

Inert Gas Subsystem. The goal is to always separate hydrogen from air. This requires an inert gas subsystem with pressurized purge gases, typically nitrogen for applications above 80 K, and helium where there are cryogenic operations (GN₂ will freeze). A hydrogen system should be capable of being purged and vented. The connections arrangement to the primary system should protect the inert gas subsystem from contamination by backflow of hydrogen. This can be managed by supplying the purge gases at a higher pressure, using check valves , or providing a double block-and-bleed arrangement (a “tee” configuration with 3 valves) (Fig. 6.13).

Fig. 6.13

Means of positive isolation [4]

There are several purge techniques that may be used:

Evacuation and backfill requires a vacuum pump. The vessel in question must be capable of withstanding sub ambient pressures without collapse. An intermediate fill with nitrogen can accelerate the process and dry the inside of the vessel.

Pressurization and venting require repeated pressurization followed by venting. At least three cycles are required to reduce hydrogen concentrations below the flammability limit.

The “flow-through” technique while simple poses a concern when dead head spaces (Figure pp) and complex geometries exist in the system.

A caution is mentioned against simplifying a purge by isolating a system into regions. When evacuation and backfill is used the fluid being removed may leak back into the evacuated region from an adjacent separated volume. Explosions have resulted. In addition, purge gases are often used in venting operations as a means to quench inadvertent burning of vented gas (Figs. 6.14 and 6.15).

Fig. 6.14

Personnel protection for hydrogen [4]

Fig. 6.15

Dead headed space illustrated [4]

Personnel Protection (PPE). Personnel Protective Equipment (PPE) is used to protect personnel from limited exposures to cryogenic or flame temperatures. The equipment is warranted for safety issues of exposure to cold surfaces or small quantities of liquid cryogen, oxygen-deficient atmospheres of inert purge gases (N₂, He), small pressurized jets of hot or cold gases, thermal radiation from H₂ fire, including intentionally flared H₂, and direct contact with inadvertently undetected hydrogen flames.

To protect personnel insulating cold surfaces where personnel are required to work and containment of liquid air with catch pans is recommended. Then it is up to operations to ensure personnel wear protective equipment to minimize injury where exposure is possible. Examples of conditions and PPE include:

• Operations involving cryogenic fluids require eye and hand protection, for example face shields and cold protective gloves,

• When connecting and disconnecting lines/components a face shield is appropriate to protect against emissions, pressurized splatter, etc.

• Insulative coveralls of cotton/Nomex material to be fire resistant. Where cryogenic fluids are involved the coveralls should avoid pockets and cuffs to not inadvertently catch liquid. Note, that fire resistant coating on fabrics wash off after a certain number of uses and must be discarded and replaced.

• Against small undetected flames, fire resistant gloves, safety glasses and face shield are used.

• Feet should be completely enclosed and protect by closed-toe shoes or boots,

• Aside from a generally noisy environment, ignition of a small amount of mixture can result in a loud pop, therefore, hearing protection as appropriate,

• Aside from the usual hazard in an industrial-like setting, liquid air dripping from elevated locations may be carried by wind gusts. Therefore, hard hats as appropriate.

• Portable detection to detect hydrogen gas or fire and to detect oxygen deficiency. A sweep of the broom is effective at safely detecting hydrogen flames over suspect areas (valves , connections, etc.).

6.7 System Considerations

6.7.1 System Considerations

Primary and necessary system attributes and considerations in include its location, failsafe operation, redundancy of critical components, proper placement of sensors and controls. Safety issues are reviewed by topic.

Location. How and where a hydrogen system is located, or how adjacent operations are managed are primary considerations. From the perspective of codes, the best place for a hydrogen system is outside, unencumbered by any enclosing structure, and separated from other activities and exposures. Of course, this isn’t practical for most hydrogen applications. However, practicality of location is usually not the governing criteria in where a system may be installed. The inventory, in-process quantities, type of use and disposal requirements will feed into code assessment of a safe “footprint”. Once the required exclusion zone is understood then search for a location can begin. Considerations will then advance to practicality and issues from pre-existing infrastructure that would interfere with hydrogen system operations. Because of this reality initial planning should ascertain what minimum quantity of hydrogen is necessary at each stage of an operation. Planning should consider minimizing storage, reducing transport quantities and the routes transport will take, minimize transfer quantities in delivery, as well as the end-use quantity. This approach reduces siting and area control requirements, and ultimately will mitigate the consequences of accidents .

Failsafe Operation. Controls the system to a safe mode upon detection of out-of-limit conditions of system functions or the operating environment, component failure or power loss. This can be supported by components that assume a safe state, for example, a valve whose unpowered state is closed. Or, by a control algorithm that move a system to a safe state. It is also accomplished by using redundancy for critical functions like pressure relief , isolation, and detection.

Use Alarms & Warning Devices. Warning devices should provide an alarm for potentially hazardous situation, preferably before it happens. Typical conditions that are monitored are abnormal conditions, malfunctions, and incipient failures. Alarms can flag control systems and can be audible, visible, or both. Some examples are:

• Pressure extremes

• Hydrogen in building ventilation intake

• Flare flameout

• Loss of vacuum insulation

• Valve position

• Pump speed extremes

• Hydrogen leak

• Filter differential pressure

• Fire.

Storage Vessels. From the perspective of regulatory code, the storage system is defined as including all the hardware and components up to the inlet of the hydrogen consuming application. For all but small applications that can operate with the output from hydrogen generation by electrolysis, hydrogen must be procured from commercial gas suppliers. The equipment used to store hydrogen can be systems unto themselves. They range from a single cylinder of gas with a valve, to manifolded groups of cylinders, to tube banks and finally to bulk storage that uses cryogenic storage vessels that may hold anywhere from several thousand gallons to more than one million gallons of liquid hydrogen. The scale of an application will determine what kind of storage is required. Laboratory operations and small-scale processes typically use gaseous hydrogen that is transported by truck to the point of use in carbon steel cylinders. These cylinders meet code requirements for highway transport and typically hold a kilogram of hydrogen under high pressure. Larger scale operations can make use high pressure gas tube banks that are mounted on a trailer suitable for highway travel. Cryogenic bulk storage systems are essentially large thermos bottles that are periodically filled. And, like a thermos bottle if the contents aren’t consumed, they will eventually warm. For liquid hydrogen, even with very effective insulation the heat leak into the system is responsible constantly vaporizing liquid to vapor. This reality has implications that complicate operations. When a liquid hydrogen is first introduced to a vessel the inner containment is warm, so the liquid hydrogen flashes completely producing copious quantities of gas until the inner vessel is chilled to operational temperature. The pressurization and relief subsystems must be able to manage the inner pressure of the vessel over a wide range of temperature conditions. Recall hydrogen’s liquid physical property for a large volume expansion with change in temperature (23 × water). Design requires operation must always keep a certain minimum gas volume, otherwise known as the ullage space, in the vessel. This permits a degree of thermal swing in the system before the liquid specified as the rated capacity would expand into the relief system [Safety note: this is a very dangerous situation that can cause the relief system to fail]. The relief mechanism must handle the great range in vaporization levels without exceeding the systems MAWP . Unless replenished unused liquid will boil away. Advanced insulation techniques and liquid helium chilling systems are being investigated to reduce boiloff and to densify liquid hydrogen in storage [5].

A brief accounting of controls is given. All storage systems are equipped with shutoff valve. Gaseous systems include a regulator, lines that convey the hydrogen to its point of use, relief protection and some means to remove the hydrogen from the line through a vent. An inert gas system may be used. A vaporizer is used to flash liquid where gas is required for operation. The gas is typically accumulated at required pressures in an interim high-pressure gas storage vessel. Generally, controls for automatic operation are used and are located for personnel access near the ground. The storage systems must use approved vent and pressure relief systems. Bulk storage system layouts must provide barriers to protect against the potential failure of rotating equipment, such as pumps , or from vehicles. In cryogenic systems insulation is managed by vacuum jacketing, heat reflective insulating materials and coating, and aerogel insulations. Foam insulations should be self-extinguishing (and not pose fire and explosion hazards when exposed to liquid air). After numerous loadings the trace frozen contaminants residing in liquid hydrogen can accumulate. The system may require periodically warming to remove these solid contaminants. Storage systems are electrically bonded at all joints and grounded to code requirements. Vessels must display their contents, capacity, and MAWP according to code requirements. Fluid direction in the lines are required by code to be labeled. Vessels is required to surrounded by a 15-ft clear space. When large quantities of liquid hydrogen are stored in proximity to other operations the base of the installation will include a catchment to contain a spill. This containment typically contains a bed of rocks into which the liquid would flow whose thermal mass will accelerate vaporization and aid dispersion of the hydrogen.

Safety consideration must consider all of the components in a storage system. A word of caution, where a third party or gas supplier provides the storage system as well as the product hydrogen, care must be taken to properly integrate safety concerns to include both the vendor supplied system and the system which it serves.

Piping Systems. The piping subsystem includes pipe, tubing, flanges , bolting, gaskets, valves , relief valves , fittings, and the pressure-containing portions of other piping components. Other elements included in a piping system are hangers and supports and hardware necessary to prevent overstressing pressure-containing components. The unique properties of hydrogen can require that special consideration be applied in the design and construction. Design considerations not only include pressure and temperature but must include the various forces that might impact the design as in a cryogenic system. The design must account for the most severe conditions. Piping of cryogenic fluids requires appropriate flexibility in expansion joints, loops, and offsets. Supports, guides, and anchors may have to account for expansion driven movements in the piping . The piping system must be electrically bonded across all joints and grounded. Code requirements must be applied to where piping is located including labeling (contents, flow direction). Concerns are that piping not located beneath electric power lines and that it be protected from potential failure of rotating equipment and from vehicles. Burying piping is too be discouraged, and if absolutely necessary, special considerations must be applied. Alternatively, subgrade lines can be placed in trenches covered by removable grating.

---------------------------------------------------------

Applicable U.S. Codes and Standards

• 29CFR1910.103,

• ASME B31.12, ASME B31.3,

• NFPA 55 [Supersedes NFPA 50 A and B],

• CGA G-5.4.

Disposal Subsystems. Discharge is piped to a properly designed vent stack, that is outdoors, directed upward, and not impinging on structures, intakes or personnel. Small venting rates, less than 0.5 lb/s may be discharged as a gas. The discharge point should be located at a safe distance, above surrounding structures. Dispose of large quantities of H₂ by flaring, an operation that requires a burner and consideration for the amount of thermal radiation that will fall on surroundings. Vents shall not discharge where H₂ can accumulate. The discharge point of the vent must be protected from collecting moisture or in some circumstance the intrusion of insect or other nests. In most circumstances a purge capability is needed, therefore access to an inert gas supply is a consideration. The vent system design should account for H₂ vent velocity. Supersonic vent velocities can pose a noise hazard and require that piping be adequately mechanically bolstered against loads created by the expelled gas.

Air entrained in a vent system can cause flammable mixture formation. Ignition by static charge or electrical storm potentials can result in a gas vent becoming a flare. If the flammable mixture forms over some extant in the vent piping accelerated flames and overpressures can occur. This is undesirable, but usually unavoidable. Vent designs must account for such possibilities. Where accelerated flames can’t be tolerated flame arrestors may be used. Vent or flare according to approved methods.

One such method is to use either a molecular seal or flapper to prevent air and precipitation from entering vent/flare system.

A design evaluation is required to ensure relief device connection to manifold does not affect relief pressure (Figs. 6.16 and 6.17).

Fig. 6.16

Hydrogen vent system with propane burner [4]

Fig. 6.17

Illustration of “molecular” seal design for a flare stack inlet [4]

Cryogenic Systems. Hydrogen systems that work at cryogenic temperatures are normally insulated with vacuum jacketed lines and foam to reduce heat input and boiloff. They also prevent liquid air formation and cold surface contact hazard for personnel. Where vacuum jacketing is not practical foam or aerogel insulations may be custom fitted to the element in question. Where flexible coupling is required metal convoluted flexible hoses and bayonet couplings are used. Ice build-up can be tolerated where component function is not impeded. Ice itself acts as an insulator. However, if ice build-up is acceptable personnel must be advised to leave the ice alone and not try to remove it, and not by “banging”!

Other notes and recommendations are:

• To use appropriate seals for cryogenic systems. Do not use thread sealant in LH₂ systems. When placing system elements containing seals back in service, after an initial ambient temperature leak check, “cold shock” and retighten lines and fittings. Then retest leak tightness.

• Both normal flow and cooldown actions need protection suited to their specific needs.

• Sudden pressure decrease on relief valve actuation will cause sudden boiling.

• Avoid thermal cycling on rupture discs which may induce premature failure.

• Moisture collected on or in relief valve can freeze and prevent valve from operating.

• Cracks or openings that expose cold surfaces to air can result in air liquefaction. Certain foams [Safety note: Styrofoam can be explosive if exposed to liquid air] should not be used as an insulation material. Insulating materials should have self-extinguishing fire rating. Factors to evaluate are whether the foam is an open cell or closed cell type, the cell size, what interstitial gas can form, and the effects of joints and gaps (Fig. 6.18).

  Fig. 6.18

  

  Ice built-up on an uninsulated fitting [4]

Vents serving cryogenic systems must be sized to allow for flow under all conditions of operation, including quiescent boiloff, normal flow and cool down . Vents should be at least rated for 150 psig per CGA G5-5. Precautions must be taken to prevent cryopumping and moisture collection in a cryogenic vent system.

Vacuum Subsystems. Incorporated in applications to maintain insulating vacuum or remove unwanted H₂ or other gases as part of a purge process. Vacuum pump exhaust may have concentrated hydrogen, so it must be connected to a proper vent. Other issues:

• Oil vapors from mechanical pumps may need to be vented to prevent back-streaming into the region being evacuated.

• Leaks in an evacuating system can result in system being contaminated with air.

• Be aware that a vacuum pump with ballast valve can result in a combustible mixture within the pump or its exhaust. This can be prevented by replacing the air supplied to the ballast valve with nitrogen.

The insulating vacuum protecting cryogenic systems requires maintenance as well. A buildup in pressure within the insulating vacuum indicates a problem with pumping. The system may need to be purged to remove unwanted H₂ or other gases.

Maintenance. All materials and components should be subject to a comprehensive inspection and be quality-controlled. Maintenance program must be approved and sustained as needed. Inspection should occur at least annually. Maintained by qualified personnel according to approved procedures .

Inspection should be performed only if equipment is made safe for such maintenance:

• Lubrication

• Instrumentation calibration

• Cleaning and painting

• Operational verification of relief and check valves

• Replacement of filter elements

• Repair or replacement of

• Damaged or faulty components

• Components subject to wear (seals , seats, bearings)

6.7.2 Operations

Actions, techniques and considerations that have proved valuable in past hydrogen work are introduced by topic.

Policy. Operations include normal operating procedures , performing modifications, repairs or decommissioning of a system. Policies, safety analysis, and protocols directing work should be written. Prior to introducing hydrogen, or “wetting” a new system/facility all procedures should be reviewed, and participating staff trained and certified. Training should be regularly conducted to ensure continual safe use of H₂. Any system modification, if different from maintenance should be subject to review. Don’t innovate without review. Emergency planning should extend to all contingencies in an operation.

Successful operations pursue a variety of considerations to minimize the severity and consequences of unplanned equipment failure or operator error. This includes using only the amount of hydrogen needed. Control of access to the work area to account for who is present in a potentially hazardous area and to keep nonessential personnel away from harm. Keep the work area ship shape, apply use good housekeeping practices to keep egress paths open. Be rigorous about use of personnel protection, even if working conditions are hot or unpleasant. All operations that would put personnel in intimate contact with hydrogen containing components or component at cryogenic temperatures should provide written instructions directing which PPE is applicable and when it is to be used. Ensure H₂ gas and H₂ fire detection systems are functioning properly and that alarms and warning devices are working.

Situational Awareness. An approach to promoting overall safety is for personnel to apply the control volume concept to “situational awareness” and be aware of controls that make their system safe. In addition, to carefully reviewing the status of system sensors before entering a hydrogen work area, one can apply a “Sherlock Holmes” mind set:

• Observation, do things sound as they should? If not, back away, until the situation is understood.

• Logic, check likely leak points, is the appearance ok. This might be observing frost buildup where it should not occur, or discoloration of metal suggesting heat, or visual distortion of light suggesting flames or plumes, etc.

• Evidence of insipient failure, unusual corrosion, or condensation, etc.

• Be aware of emergency planning, are egress routes clear?

Hazardous Operations. Certain operations are inherently more hazardous, for example; storage and transfers in which large amounts of hydrogen are off-loaded, or disposal of large quantities of hydrogen by flaring. These are activities that shouldn’t be performed without an observer at a safe vantage point and preparations to immediately call for help and initiate rescue. The “buddy system” system is the term given for this strategy. The term does foster erroneous notions like coworkers sharing a task. Nor should personnel assigned observer status proceed to multitask, taking attention away from the hazardous work.

Dangerous Weather Conditions. It is sensible to monitor weather conditions for operations that are conducted out of doors. Heavy rain, excessive wind and electrical storm activity are criteria for cancelling operations. There are lightning detection systems that can notify when strikes are occurring 5, 10 or 15 miles away. Electrical storms can induce dangerous potentials in conductive infrastructure such as cross-country pipelines capable of electrocution, let alone supporting an electrical discharge in a flammable mixture. Work protocols should cover the steps needed for a rapid shutdown and time allowances included. The proper action is to cancel or discontinue operations at the approach of an electrical storms. Put the system in a safe state: Isolate, vent, and purge to remove H₂ or air.

Good Housekeeping Practices. Weeds or similar combustibles are not permitted within 25 ft of LH₂ equipment (29CFR 1910.103, Hydrogen). Access and evacuation routes are to be kept clear of equipment. In an indoor setting conductive and non-sparking floors are to be kept clean of dirt.

Reduction of Ignition Sources. Personnel must recognize unwelcome sources of ignition that might inadvertently show up in their work environment. Examples include:

• Control smoking, open flames, welding, use of mechanical tools, remove equipment that doesn’t belong; generators, automobiles etc.

• Apply preventative action; install lightning protection, ensure continuity in bonding and grounding connections, use conductive machinery belts, and use explosion-proof or purged enclosures for electrical equipment that is likely to be exposed to flammable mixture (a code requirement).

But, no matter how vigilant the effort, always assume an ignition source is present!

Storage and Transfer Operations. These operations are inherently dangerous. At the start operators should notify surrounding workers to avoid the area, then establish area control. Storage and transfer operational areas should be kept clear of nonessential personnel. The buddy system should be in force. During transfers operators should be on heightened alert for leaks. When leaks occur operations should cease, the system made safe, repairs made before resuming the operation.

Vent Fires. Vent fires are a common occurrence and lightning a common cause. With an inert gas system, the procedure for extinguishing vent fire is to:

• Add inert gas flow, such as He,

• Stop H₂ flow,

• Continue inert gas flow until metal cools,

• Restart H₂ venting,

• Stop inert gas flow.

Emergency Procedures. Advanced planning is required to truly handle emergencies. Local emergency services should be informed of hazards and required mitigations. Inviting emergency service personnel to see facilities in advance is recommended. It is also advisable that they be informed in advance of hazardous operations. The operators of hydrogen systems should be kept aware of the onset of dangerous weather conditions and rapid decision making in place to order shutdown activities in a timely fashion. Primary aim of emergency procedures is to protect life and prevent injury. Responses to common situations are summarized:

• Leaks: The primary danger from a leak or spill is fire. Recall, hydrogen flames are difficult to detect and likely are practically invisible in daylight. Because of the low emissivity of the flames human senses cannot prevent inadvertent entry into flames.

  • Leak Procedures: Exclude people and vehicles from leak area. Isolate source, vent, purge, and repair. During this time avoid ignition sources.

  • Do not deliberately flare a leak. If it is dissipating without harm, let it do so.

• Fire Procedures: Let released hydrogen burn until supply can be cut off. To put it out before the release is stopped is to invite worse accumulation and reignition.

  • Use water spray or fog to protect system elements and stop fire from spreading.

  • Do not spray water on vent systems or relief valves . In cryogenic systems this can plug vent systems and set the stage for overpressures, rupture and fireballs.

  • In some instances, for example portable storage, it is desirable to remove a burning vessel from nearby vessels, but only if it can be done safely.

• Avoid Asphyxiation: Areas near spills may be oxygen deficient. While released hydrogen may rapidly rise the contents of damaged inert gas systems will not. Having an oxygen monitoring capability is important.

• Tank entry (H₂, N₂, He) requires applying confined space considerations, some of which are:

  • Having an entry plan, with emergency plans before any work is done,

  • Ensuring a fresh air supply,

  • Monitoring the atmosphere inside the tank, and

  • Following standard safety precautions.

• Medical response: Is to quickly and safely remove the injured from a danger zone. Rendering aid is best performed by trained medical personnel. Call for help.

6.7.3 Hazard Assessment

There are a variety uses for performing hazards assessments. See also Chap. 8. A list of hazard assessment uses might include:

• Design improvement,

• Safety evaluation and failure analysis,

• Formal assessments to communicate to management (obtain “buy-in” and oversight),

• Providing written documentation as a reference for operations,

• And, post mortem assessment, following a failure or accident.

In the development of a complex hydrogen system or a facility assessment, techniques can be applied to all stages of hydrogen work, for example; the initial concept, design reviews, operations, modifications to design or operation, and finally decommissioning .

Beyond identifying obvious concerns, these notes will hopefully provide some additional insight into how to look at hydrogen systems and approach hazard assessment.

First, consider that hydrogen releases differ from other fuels due to the extent of interaction with surroundings:

• A leak at a point can grow into a cloud affecting a large area with many potential combustion hazards,

• Large flammability range and low MIE promote interaction of released hydrogen with just about any conceivable ignition source,

• The kinetics of hydrogen combustion are significantly more rapid than those of most other combustible gases,

• Cryogenic issues are distinct from gaseous issues (releases can begin heavier-than-air and warm to become buoyant) but include all of the issues associated with gaseous hydrogen,

• Hydrogen combustion processes are often intertwined with the geometry of the physical system and surroundings, such that flame acceleration and development of dangerous overpressures can occur and occur rapidly.

For these reasons the complexity of phenomena can obscure identification of hazards, and it is recommended that hazard assessment should be done by personnel with hydrogen experience.

The primary accomplishments expected of safety assessment might be noted as:

• Systematically and objectively identify hazards

• Examine consequences

• Evaluate risk

• Identify mitigations

• Document and communicate

• Provide mechanism for control of hazards.

There are a variety of methodologies have been used for addressing hazards issues, each with features that may be more productive than others depending on the nature of the work (see Engineers workbook). Some examples include:

• Cause Consequence Analysis

• Energy Flow/Barrier Analysis

• Event Tree Analysis

• Fault Tree Analysis

• Risk Assessment Matrix Success Tree Analysis.

From the author’s experience the complex interaction of hydrogen within a system and with the environment when released call for an approach that uses both inductive and deductive reasoning in understanding hydrogen hazards. With inductive thinking, reasoning proceeds from individual cases to a general conclusion and in the case of hazards induces the consequences of an event forwardly (bottom-up). A useful analysis of this kind is a failure modes and effects analysis (FMEA ). When conducted thoroughly every system component is examined for the outcome that would occur from possible failures. For example, a valve might be evaluated for the consequences of failing open, failing closed, or leaking. The consequences for each state are evaluated to see if they directly result in hazard or induce other component failure that results in hazards. This approach addresses hazards that come from system malfunction but doesn’t address more global hazards which might be deduced or determined be reasoning from the general to the specific. One can ask general questions like’ how might a fire hazard arise, or what if the operator commits a certain error. These two approaches to searching for hazards must also account for design or operational actions that mitigate hazards. Ultimately, to be useful the combined analysis should show either how hazardous consequences are reduced, or the likelihood of a hazard occurring is reduced or both. The control volume concept allows an analysis to focus on region of a system and on the elements that provide the control. If an FMEA approach is applied to the elements of the control volume of interest a hybrid approach is created that uses both inductive and deductive components together. The effect of a given component failure can be assessed against all the controls on the volume to evaluate hazards (see HHAP). Simplifications in analysis can be realized by only looking at the control volumes affected by hydrogen and by applying the analysis to a group of similar components.

In aerospace systems hazard scenarios are typically not well characterized (system may be unique) with detailed information on leaks and the potential combustions associated with them, therefore hydrogen hazards assessment has many qualitative aspects. This is addressed with qualitative risk assessment matrices into which the probability of ignition and combustion outcome is evaluated by expert opinion and assessment is grouped into categories (not possible, remote, possible, probable, and highly probable. Consequences are considered in general areas such as personnel safety, program objectives, function capability in which the risk is qualitatively assessed; A negligible, B Marginal, C Critical, and D Catastrophic. The two different sorts of information are arrayed in a matrix form that shows a topography of increasing risk on one axis and increasing consequences on another axis as an aid to decision making. Ultimately health exposure issues, materials issues and environmental concerns must also be included for assessment.

Most institutions provide their own approaches to hazard assessment. The elements described here may be found in their protocols, and if not, they may be incorporated. The primary points are hydrogen hazards are identified by systematic evaluation of the elements that make up a system or facility. The control volume concept focusses analysis on volumes into which hydrogen is released and looks at the controls used to manage the safety.

6.8 Facilities

6.8.1 Safety of Facilities with Hydrogen Systems

A facility is a place, or piece of equipment provided for a particular purpose, and with our interests, either being modified to accommodate a hydrogen activity or being built expressly to support hydrogen work. Codes generally identify hydrogen storage systems as hydrogen systems. However, when pursuing an application, the user will likely view the storage as separate from the hardware at the point of use for the hydrogen. Code direction regarding the point of use system are limited to certain specific applications (examples include fuel cells, electrolysis, thermal spraying, use of special atmospheres, etc.), or will specify to follow the guidelines provided by the manufacturer of the point of use system. Applications not specifically identified by code, that is “custom” or developmental systems are expected to be treated as a hydrogen system (storage) on the basis of the quantities of hydrogen processed within the system. All of the issues and consideration previously reviewed now apply. In some senses a hydrogen facility is just an expanded hydrogen system, that just consider the system concept in Fig. 6.8, now housed in or associated with some structure and particular location. The goals of facility safety involve, most importantly, the protection of the public, workers, and the environment. Secondary concerns are the equipment of value, the importance of the mission or hydrogen work, and public perception.

Facility operations incorporate safety policy which is based upon careful review of hydrogen hazards, use of written protocols, hazards communications and training . There is a specific focus on hazards arising from unplanned release of hydrogen and combustion, the hazards of pressure systems, proper consideration of materials and temperature issues, and protection of employees. Goals are to have safety considered in design and construction, for the implementation to be as foolproof as possible, to incorporate safety and hazard analyses, input from designers, operators, and safety engineers. Facility operations will provide good maintenance and activities are conducted with safety committee oversight.

6.8.2 General Facility Guidelines

Guidelines. When chartered to contemplate a hydrogen facility the many of the topics of interest have already been introduced: Facility siting, buildings and special rooms (test chambers if you’re running a laboratory), piping and storage, and disposal. They are now reconsidered in the context of a facility.

General. The layout of the facility should separate the point of use area from storage and transfer activity in a safe fashion. If the facility features walls, enclosed areas or rooms the structure must meet code specifications that include where the hydrogen system is located relative to the structure, the fire ratings for walls, other structural elements and exposures. The nature of the application and the process quantities involved will impact all electrical hardware, equipment, and installation around the immediate location of the hydrogen system. Safe disposal of the hydrogen can also affect the safety footprint of the facility. Other safety considerations include placarding, posting and labeling of areas, fluid lines and vessels. These common-sense actions must be done according to code requirements. Planning should include where hazardous operations will be conducted, what exclusion zones are needed to protect surroundings, how access control will be managed, and how emergency services will be coordinated.

Siting. When setting up a hydrogen facility the first quandary is usually where, and as in other endeavors it is location. The location decision is governed by the type of application and the quantity. Codes distinguish between gaseous hydrogen and the much denser liquid hydrogen. How systems using storage quantities less than 11 m³ (400 scf) gaseous hydrogen or 150 L (39.7 gal.) of liquid hydrogen are managed is left to the discretion of the AHJ. To get a sense of how to look at applications, in terms of increasing hazard:

• Small quantities such as used in laboratory work, or any process that presents little possibility of mixing hydrogen with an oxidizer are consider minimal risk. The hazards are handling issues readily addressed with appropriate PPE.

• Storage applications or processes can involve large quantities of hydrogen. However, the hydrogen is isolated from any quantity of stored oxidizer leaving the only exposure to be in most situations the surrounding air. The vessel system is a code approved system, possessing redundant controls, and protected by a safe zone. The primary hazard is release of hydrogen into air and the potential for fire. The vessel design and the relief protection are such that external fire leading to vessel rupture and explosion is not considered a credible scenario.

• Activities in which hydrogen is used as a propellant, brought together with oxidizer for combustion, or processes that present a fair risk of release and mixing are considered the most risky and hazardous. The primary hazard is violent explosion and is addressed by large exclusion zones, barriers and remote operation.

The compounding issue is the quantity, and greater quantity translates into greater hazard. By illustration, launching a rocket fueled by a large amount of hydrogen and oxygen is an example of a very hazardous enterprise. Exclusion zones become very large, on the order of thousands of feet^1x and involve issues of controlling air traffic. This thinking doesn’t necessarily apply to hydrogen appliances whose designs minimize hazard for well-defined operates. Examples of appliances would be hydrogen automobiles, fork lifts, batteries, fuel cells or electrolysis systems.

The desirability of preferred location based upon convenience or function must always be subordinate to safety of the facility and surroundings. There are associated factors:

• Determining a safe distance from property boundaries, work areas with personnel, and exposures that are not easily mitigated (open grates to underground drainage lines, fuel depots, overhead powerlines etc.).

• Do the positions of existing facilities drive the choices? Do their activities pose a threat to the hydrogen work, or vice versa?

• How will hydrogen be transported to the point of use storage, by what public routes, and within the facility, by what private route? When supplier’s vehicles approach, is there a safe holding area?

• From where will emergency services come if needed, and how long until they can respond?

• Do the quantities anticipated for use pose an environmental threat, or require disaster response communications with nearby communities?

Candidate locations are selected for comparison of attributes and exposures. Exclusion zones are dictated by code generally on the basis of quantity (quantity-distance), but also including specific exposure criteria. Barricades , dikes and impoundments are mitigations that can be used as protective features for equipment and facilities. The AHJ decides what regulations and codes apply and informs the review process that determines whether overall safety is adequately addressed.

----------------------------------------------------

Relevant Codes:

NFPA 2 Hydrogen Technologies Code

NFPA 55 Compressed Gases and Cryogenic Fluids Code

DOD 6055.9. Department of Defense Ammunition and Explosives Safety Manual (current revision).

Electrical. Component classifications must be evaluated for electrical hardware and components used in vicinity of gas connections. Several regions are specified for North American service:

• Electrical installations that either might be occasionally exposed to flammable mixtures or will as a matter of process be exposed to flammable mixtures (see 1, below)—within 0.9 m (3ʹ) of a connection will require explosion proof rating, or an inert gas purged enclosure.

• Electrical hardware located within 0.9 (3ʹ)–7.6 m (25)ʹ of a liquid hydrogen storage container.

Terminals points should not turn or loosen under use conditions and should be protected from foreign objects and contaminants to avoid shorting.

Other options for class I, Group B, Division 1 locations:

• Purged enclosures per NFPA 496

• Intrinsically safe

• Approved for Class I, Group C atmospheres.

Adequate bonding and grounding provided and verified. Careful attention is directed to reducing known ignition sources and limiting spark generation (consider static charge creation in flowing fluids and moving belts). Facilities must be adequately grounded and protected from lightning. Vent lines may benefit from a vent stack discharge rod. Facilities must have adequate ventilation and lighting.

Facility Rooms, Structures and locations. Test areas, control room, buildings and laboratory spaces are examined.

-----------------------------------------------

NFPA 70, National Electrical Code:

“Class I, Group B, Division 1” locations defined as within 3-ft from flammable mixture sources.

“Class I, Group B, Division 2” locations defined as within 25-ft of LH₂ storage, or potentially subject to flammable mixture exposure from accidental release of hydrogen.

Buildings. The structure and layout is set up to minimize personnel injury and facility damage in case of H₂ fire or explosion. One approach is to construct with lightweight, noncombustible materials according codes and regulations.¹⁰ Other recommended aspects for a hydrogen facility are to avoid unventilated peaks in ceilings, use shatterproof glass or plastic in window frames, provide a 2 hr fire resistance rating for walls, floors, and ceilings, locate explosion venting in exterior walls or roof. Intrinsically safe heating can be accomplished with steam or hot water heating, or other indirect means.

Structures that contain H₂-wetted systems must be adequately ventilated. Whether by active or passive means, the ventilation rate should dilute the cumulative hydrogen leak or release to keep the concentration below 25% of LFL (1% by volume) or less. Operational requirements are to establish ventilation before bringing H₂ into the system and place safeguards to make sure ventilation is not lost during a power failure or emergency shutdown procedure. This may mean removing the hydrogen from the system. The ingestion of hydrogen into building air intakes must be prevented by following code direction on where hydrogen or vents may be located, or by active means, using sensors and controls to automatically close the air intake if H₂ is detected. Install H₂ sensors in building outlet vents if H₂ used inside. Suspended ceilings and inverted pockets are not desirable, but if they are unavoidable these air volumes require separate detection and ventilation. Detection and ventilation capabilities are of limited effectiveness on complex room geometries. Another option where a volume can be sealed to isolate it from hydrogen is to apply an internal positive air pressure. Hydrogen systems in enclosed spaces should be put in a safe mode when idle. This may be accomplished by purging hydrogen from the system or ensuring against air (or other oxidizer) entering the hydrogen system by maintaining a positive hydrogen pressure. This assumes the enclosed space is adequately ventilated. It is important that facility operations and maintenance prevent contamination of purge and vent systems.

Control Rooms. When visual observation of hydrogen activity is necessary at location that does not meet the isolation requirements of code, a bunker or other reinforced structure that can protect personnel from the most severe credible event is advisable. Closed circuit cameras, mirrors, and sliding steel covers can augment protection of windows. Control conduits should be sealed against hydrogen intrusion and ventilation ducts closed off. Positive air pressure is applied to keep hydrogen from entering through small openings.

Laboratories. Work areas in which small inventories of hydrogen are handled (as specified by the AHJ, or code requirements (>45 scfm). Specialized equipment such as vent hood or ventilated cabinets that use high ventilation rates (50–150 air changes/h), detection systems combine with active controls to shut off hydrogen and apply purges, and special procedures combined with PPE are used to control hazards. Primary concerns are limited flash fires, small explosions (think of loud “pops”), and broken glassware.

Test Stands and Chambers. Experimental inventories can be increased by conducting tests remotely either in a concrete walled room or outside at an isolated area or test stand. Outdoor facilities might use a canopy or shelter and walls, but caution should be observed in the arrangement due to hydrogen’s propensity to support accelerated flames with confinement. To avoid overpressures the enclosure should not have more than two walls set at right angles and there should be a vent region between the walls and roof or canopy.

Storage. The use of hydrogen storage systems that support facility work are installed and located according to code requirements. The maximum contained volume and the type of storage are used to determine the minimum distance to specified various exposures as specified by code. Some of those issues are the amount of clear space, the distance to stored flammables, the distance to nearby walls, the distance to public thoroughfares, the presence of overhead power lines or other fluid lines, etc. In the case of liquid hydrogen storage, there is an issue if a spill can enter into a nearby drain or culvert. Storage systems are typically located adjacent to the point of use, but isolated by the minimum allowed space according to the most stringent QD code requirement between the two applications. If liquid storage supplies a gaseous hydrogen application hardware designed to vaporize the liquid hydrogen and manage it at a desired pressure may be co-located with the storage. Another common approach is for the vaporized hydrogen to be transferred to interim gas storage at the desired use pressure. The gas system would be located to code.

--------------------------------------------

Related Codes:

NFPA 2

NFPA 55.

Transfer Piping. Design must provide for adequate mounting (support, guides and anchors) as well as flexibility (expansion joints, loops, offsets) needed in the application. Changes in the pressurization within the line, especially with cryogenic fluids require relief protection for the piping. The piping must be electrical bonded across all joints and adequately grounded. Labeling (contents, flow direction) is required by code.

----------------------------------------------------------------------

Related Codes:

• Design, fabricate, and test to ASME B31.3 and CGA G-5.4

• NFPA 2

• NFPA 55.

Facility Venting. Roof vents located 16 ft above roof can be used to vent up to 0.5 lb/s of hydrogen. Vents must be located so that H₂ does not get into building air intakes. Larger quantities of hydrogen should be disposed of by flaring through a flare stack or burn pond. The quantity and size of combustible cloud should be evaluated for thermal radiation from flame and the flare stack suitably isolated by an exclusion zone away from personnel, buildings, other facilities and exposures. Vent design must accommodate all weather conditions, wind loadings, have adequate lightning protection and charge dissipation against the onset of storms. Vents should not be located under or near electrical power lines or other elevated exposure.

Area surfaces and Roadways. Uninsulated LH₂ piping and components capable of forming liquid air should not be positioned over asphalt surfaces or roadways because of the potential exposure to liquid air and the subsequent formation of explosive compounds. Concrete channels should be inserted in the roadway where an elevated liquid hydrogen line is located.

Description of an enclosed hydrogen work area. As an example, a successful facility, a fuel cell vehicle garage, is described. Hydrogen vehicle work areas have been set up where the vehicle is position optimally for fresh humidified air, ventilation combined with detection draws air from high spots over the vehicle, and a nitrogen purge is plumbed for immediate access to car systems. Ground points for the vehicle and personnel are conveniently located to allow mobility around the vehicle. The vehicle stations are isolated on the garage floor from each other and sources of ignition. Standard tools, electrical outlet, workbench and wall are separated by a distance and well-defined painted regions. Operations are well defined. Vehicles are kept out in the open until they can be worked on. The on-board hydrogen supply is immediately isolated and supply lines purged. Unwanted hydrogen is disposed through roof top vents. Egress from the facility is clear and emergency procedures are simple, exit the work bay area to a safe holding area and allow emergency responders to safe the facility.

6.8.3 Protection of Hydrogen Systems

Protection of H Systems and Surroundings. Running a hydrogen facility entails a number of concerns among which are providing adequate separation of work activities, proper control of vehicles, controlling handling and location of flammables, proper isolation of power infrastructure, and for outdoor operations being able to accommodate harsh weather and react to sudden changes in weather.

Exclusion zones are used to achieve basic safety in a passive fashion as long as operational controls are in effect. An elaboration on the control volume notion is shown below (Fig. 6.19). The various elements that might be part of the overall protection of a component, system, facility, or hydrogen activity are depicted. The vessel walls incorporate design and code requirements. Leak detection may involve direct action of detection sensors, or inferred detection such as pressure drop, or other monitor of internal system logistics. Ventilation may be passive as in an open outdoor environment, or active by fans or other forced air flow. Up to this point intervention can happen to prevent combustion. Fire detection alerts operators to an ignited leak, and a safety hazard, and hopefully before more extensive damage can occur.

Fig. 6.19

Conceptual layers of mitigation [4]

The fire/explosion band represents an exclusion zone which is passive protection against the worst-case scenario; fire balls, explosion and shrapnel. Isolation can be modified, even reduced with the use of barriers. Walls, earthen berms, blast mats can be used successfully to reduce hazards [6]. Hazards that might come from other nearby facilities must also be included in an assessment of safety.

Against Unplanned Release. Site location preferences and necessary exclusion areas are based upon quantity-distance (QD) requirements. The minimum exclusion area is greater than or equal to the QD requirements and is driven by application and quantity:

Miscellaneous use (a one-time activity, or demonstration) is determined by site AHJ.

Laboratory scale operations (small quantities¹¹)

Non-propellant storage, or industry bulk storage

Propellant storage (on-board inventory, or hydrogen storage potentially subject to violence and direct mixing with large amounts of oxidizer

Must consider standard exposures [powerlines, drains, etc.]

• An exclusion area is set up with controls:

• Limit access to personnel with required training and proper protective equipment

• Ensure equipment is not an ignition source

• Operate according to approved procedures

• Personnel must use approved PPE

• Known hazards must be posted

Special Topic—Barricades, Dikes and Impoundments. Barricades can protect personnel and sensitive equipment from shrapnel and fragments. Protection of a liquid hydrogen supply by a blast mat is shown in Fig. 6.20. Earth mounds may also be used for protection, but their deployment must be based upon an understanding of shockwave behaviors [6]. Protective structures with confining walls must not provide confinement that can support transition to detonation.

Fig. 6.20

Blast mat used to protect a LH₂ trailer from shock and shrapnel [4]

Liquid hydrogen inadvertently released in amounts to create a spill may be contained with impoundments or dikes. Keeping the spill to a minimal footprint can limit the vaporization rate. Alternatively, crushed stone placed in the containment volume can add surface area for heat transfer to increase the liquid vaporization rate. Forcing the liquid into a smaller cross-sectional area pool can create a smaller combustion cloud but will take longer time to vaporize. The containment surfaces, or walls of dikes and impoundments should be kept as low as possible to ensure they do not provide confinement capable of supporting detonation in the flammable mixture that forms above the spill (Fig. 6.21).

Fig. 6.21

Generic hydrogen facility/system [4]

6.9 Safety Checklist

A checklist,¹² contrived around a generic application, is noted to help identify considerations necessary to ensure a safe installation. The checklist is not intended to replace or provide guidance on compliance. Rather, it presents a concise table of critical safety measures compiled by some of the hydrogen industry’s foremost safety experts.

It is a common practice for hydrogen applications to locate hydrogen supply systems outdoors for an indoor use as shown illustrated in the following diagram. The general principles in the checklist apply to all types and sizes of hydrogen systems.

Hydrogen safety, much like all flammable gas safety relies on five key considerations:

• 1. Recognize hazards and define mitigation measures (plan).

• 2. Ensure system integrity (keep the hydrogen in the system).

• 3. Provide proper ventilation to prevent accumulation (manage discharges).

• 4. Ensure that leaks are detected and isolated (detect and mitigate).

• 5. Train personnel and ensure that hazards and mitigations are understood and that established work instructions are followed (manage operations).

The checklist is organized using these key considerations and is intended to assist with design and risk assessment. Examples are included to help users identify specific prevention techniques. While these considerations are fairly comprehensive, it is not possible to include all possible variables that need to be considered. The hazard analysis process should therefore include personnel who are familiar with applicable codes and standards in addition to team members that have expertise in the various technical aspects of the specific project.

Consideration	Approach	Examples of actions
Plan	Recognize hazards and define mitigation measures	• Identify risks such as flammability , toxicity, asphyxiates, reactive materials, etc. • Identify potential hazards from adjacent facilities and nearby activities • Address common failures of components such as fitting leaks, valve failure positions (open, closed, or last), valves leakage (through seat or external), instrumentation drifts or failures, control hardware and software failures, and power outages • Consider uncommon failures such as a check valve that does not check, relief valve stuck open, block valve stuck open or closed, and piping or equipment rupture • Consider excess flow valves/chokes to size of hydrogen leaks • Define countermeasures to protect people and property Follow applicable codes and standards
	Isolate hazards	• Store hydrogen outdoors as the preferred approach; store only small quantities indoors in well ventilated areas • Provide horizontal separation to prevent spreading hazards to/from other systems (especially safety systems that may be disabled), structures, and combustible materials • Avoid hazards caused be overhead trees, piping, power and control wiring, etc.
	Provide adequate access and lighting	Provide adequate access for activities including: • Operation, including deliveries • Maintenance • Emergency exit and response
Keep the hydrogen in the system	Design systems to withstand worst-case conditions	• Determine maximum credible pressure considering abnormal operation, mistakes made by operators, etc. Then design the system to Contain or Relieve the pressure • Contain: Design or select equipment, piping and instrumentation that are capable of maximum credible pressure using materials compatible with hydrogen service • Relieve: Provide relief devices that safely vent the hydrogen to prevent damaging overpressure conditions • Perform system pressure tests to verify integrity after initial construction, after maintenance, after bottle replacements, and before deliveries through transfer connections
	Protect systems	• Design systems to safely contain maximum expected pressure or provide pressure relief devices to protect against burst • Mount vessels and bottled gas cylinders securely • Consider that systems must operate and be maintained in severe weather and may experience earthquakes and flood water exposures • De-mobilize vehicles and carts before delivery transfers or operation • Protect against vehicle or accidental impact and vandalism • Post warning signs
	Size the storage appropriately for the service	• Avoid excess number of deliveries/change-outs if too small • Avoid unnecessary risk of a large release from an oversized system
	Provide hydrogen shutoff(s) for isolation	• Locate automatic fail-closed shutoff valves at critical points in the system such as storage exit, entry to buildings, inlets to test cells, etc.) to put the system in a safe state when a failure occurs • Consider redundant or backup controls • Install manual valves for maintenance and emergencies
	Prevent cross-contamination	• Prevent back-flow to other gas systems with check valves, pressure differential, etc.
Manage discharges	Safely discharge all process exhausts, relief valves, purges, and vents	• Discharge hydrogen outdoors or into a laboratory ventilation system that assures proper dilution • Direct discharges away from personnel and other hazards • Secure/restrain discharge piping
	Prevent buildup of combustible mixtures in enclosed spaces	• Do not locate equipment or piping joints/fittings in poorly ventilated rooms or enclosed spaces. Use only solid or welded tubing or piping in such areas • Provide sufficient ventilation and/or space for dilution • Avoid buildup of hydrogen under ceilings/roofs and other partly enclosed spaces
	Remove potential ignition sources from flammable spaces/zones	• Proper bonding and grounding of equipment • No open flames • No arcing/sparking devices, e.g. properly classified electrical equipment
Detect and mitigate	Leak detection and mitigation	• Provide detection and automatic shutdown/isolation if flammable mixtures present, particularly in enclosed spaces • Consider methods for manual or automatic in-process leak detection such as ability for isolated systems to hold pressure • Periodically check for leaks in the operating system
	Loss of forced ventilation indoors	• Automatically shut off supply of hydrogen when ventilation is not working
	Monitor the process and protect against faults	• Provide alarms for actions required by people, e.g., evacuation • Provide capability to automatically detect and mitigate safety-critical situations • Consider redundancy to detect and mitigate sensor or process control faults • Provide ability for the system to advance to a “safe state” if power failures or controller faults are experienced
	Fire detection and mitigation	• Appropriate fire protection (extinguishers, sprinklers, etc.) • Automatic shutdown and isolation if fire detected
Manage operations	Establish and document procedures	• Responsibilities for each of the parties involved • Operating procedures • Emergency procedures • Preventive maintenance schedules for equipment service, sensor calibrations, leak checks, etc. • Safe work practices such as lock-out/tag-out, hot work permits, and hydrogen line purging • Review and approval of design and procedural changes
Train personnel	• Material Safety Data Sheet (MSDS) awareness for hydrogen and other hazardous materials • Applicable procedures and work instructions for bottle change-out, deliveries, operation, maintenance, emergencies, and safe work practices
Monitor	• Track incidents and near-misses and establish corrective actions • Monitor compliance to all procedures and work instructions

6.10 Summary and Best Practices

Hydrogen is not inherently dangerous . It is how we use it where the balance between useful commodity and hazard lies. From this realization we proceed into how hydrogen work is conducted in the 21st century. The short list of best practices is:

• By planning and design that meticulously addresses possible faults,

• Careful review, hazard assessment, preparation of written protocols for operations are all prepared prior to actual use of hydrogen,

• Isolate hydrogen from oxidizers until the point of use,

• We isolate personnel and hardware we don’t want to risk, unless we can adequately mitigate consequences,

• Instrumentation is used to monitor for hydrogen and controls applied to make a system inherently safe,

• Through training make personnel aware of potential hazards. The best safety-feature is a knowledgeable operating staff. Nearly 60 years ago R. B. Scott¹³ observed on safety, “…no installation using liquid hydrogen can be made “idiot-proof”. There is no substitute for intelligence.” This thought can be extended to the use of hydrogen under whatever circumstances.

Bibliography

Looking for specific physical data or practice information? Some useful sources are:

• The U.S. Department of Energy Hydrogen Practice website http://www.h2incidents.org. In addition to best practice information there is a hydrogen Incident Reporting and Lessons Learned Database.

• NFPA 2 Hydrogen Technologies Code: http://www.nfpa.org.

• Edeskuty, Frederick J. and Walter F. Stewart; Safety in the Handling of Cryogenic Fluids. Plenum Press, New York, 1996.

• Berman, Marshall; Hydrogen Behavior and Nuclear Reactor Safety. In: Recent Developments in Hydrogen Technology, Volume II; Williamson Jr., K. D. and Frederick J. Edeskuty; Eds. CRC Press, Inc. Boca Raton, FL, 1986.

• Goldberg, B., Everhart, K., et al. System Engineering “Toolbox” for Design-Oriented Engineers, NASA Reference Publication 1358, NASA, Marshall Space Flight Center, December 1994.

• AIAA. Guide to Safety of Hydrogen and Hydrogen Systems. ANSI/AIAA G-095-2004. American Institute of Aeronautics and Astronautics, 1801 Alexander Bell Drive, Reston, Virginia 20191, 2004.