CET 96 DOI: 10.3303/CET2296033 Paper Received: 10 February 2022; Revised: 25 July 2022; Accepted: 28 August 2022 Please cite this article as: Perelli S., Genna G., 2022, Hazards Identification and Risk Management of Hydrogen Production and Storage Installations, Chemical Engineering Transactions, 96, 193-198 DOI:10.3303/CET2296033 CHEMICAL ENGINEERING TRANSACTIONS VOL. 96, 2022 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: David Bogle, Flavio Manenti, Piero Salatino Copyright © 2022, AIDIC Servizi S.r.l. ISBN 978-88-95608-95-2; ISSN 2283-9216 Hazards Identification and Risk Management of Hydrogen Production and Storage Installations Sara Perelli*, Giovanni Genna DEKRA Italia s.r.l., Process Safety Business Unit, Via Fratelli Gracchi 27, 20122 Cinisello Balsamo (MI) Sara.perelli@dekra.com In recent years, hydrogen use has dramatically increased, mainly due to its growth in status as a transportation fuel. A new wave of interest in hydrogen has also been generated by actions taken by the European Union regarding ecological transition, promoting “hydrogen valleys” for the local production and use of the so-called green hydrogen. To achieve a safe and sustainable growth in the use of hydrogen as an alternative energy vector, every actor in the hydrogen value chain shall be aware of its inherent hazards, so that the appropriate preventive and protective measures required to mitigate the associated risks are enforced. This article shall review the main physical properties of hydrogen, and how these relate to some safety challenges such as its low ignition energy and its unusually wide flammability range. Attention is given also to the high laminar burning velocity of hydrogen-air mixtures, and how this parameter influences the sizing of deflagration vents which shall be protected against confined cloud explosions. Hazards associated with handling of liquified hydrogen are discussed as well (such as the risk of cryogenic burns). Facilities that produce or use hydrogen shall carry out robust hazard analyses, involving multidisciplinary teams, to consider what process deviations or failures may result in situations with intolerable risk. These situations must then be brought back to safety conditions through the implementation of specific safety barriers. In the article, a HAZOP (Hazard and Operability) analysis is carried out on a typical electrolysis unit for hydrogen production, together with its hydrogen storage tank, identifying a number of potentially hazardous scenarios. For each scenario, the effectiveness of existing safety barriers is discussed, also with respect to international codes and engineering best practices, and additional preventive and protective measures are illustrated. 1. Introduction In July 2020, the European Commission issued a Communication on "A hydrogen strategy for a climate-neutral Europe”, an insight about the EU proposed strategy to build a dynamic hydrogen ecosystem in Europe: this includes, among other things, the task of making clean hydrogen into a viable solution to decarbonise different sectors over time, installing at least 6 GW of renewable hydrogen electrolysers in the EU by 2024 and 40 GW of electrolysers by 2030 (eur-lex.europa.eu, 2020). Hydrogen is still mostly produced from fossil fuels such as coal or natural gas, and it’s therefore responsible for the release of 70-100 million t of CO2 per year in the countries of the European Union (eur-lex.europa.eu, 2020). Hydrogen from electrolysers on the other hand represents only a small fraction (less than 4%) of the total hydrogen production in the EU, as shown by the Hydrogen Roadmap Europe (FCH JU, 2019). This renewed peak of interest for hydrogen stems for many reasons. First of all, hydrogen can bridge the future gap between the energy demand of the EU, and the quota of such demand that will be covered by renewable electricity, being a good vector for renewable energy storage and transport. Secondly, most carbon intensive industrial processes, such as chemical or metallurgic sectors, may satisfy their energy demand with hydrogen instead of fossil fuels, thus reducing their emissions of greenhouse gases. Lastly, hydrogen can be used directly in parts of the logistics and transport chain, alongside electrification and other renewable and low-carbon fuels. It follows that, in the overarching goal of achieving a climate-neutral Europe, hydrogen can play its pivotal role only if its production can be fully decarbonised and substantially scaled-up, in a safe and sustainable way. 193 The aim of this study is to present the main findings of a HAZOP (HAZard and OPerability) analysis carried out by DEKRA on a typical electrolysis unit for hydrogen production, highlighting existing safety barriers and potential additional safeguards. 2. Hydrogen physical properties and inherent hazards Hydrogen is a commonly used and understood element, yet it presents unique safety challenges that need to be thoroughly acknowledged in order to quantify and mitigate its risks. Many of those challenges arise from the fact that hydrogen is odourless, colourless, and tasteless, so leaks are not detected by human senses. As other chemicals and fuels, hydrogen is characterized by inherent hazards (such as flammability and reactivity) that may result in serious risk scenarios, but some of hydrogen properties are advantageous in terms of safety. Hydrogen is nontoxic, so leaks or dispersions are harmless to the people and the environment. Hydrogen is also lighter than air, so it dissipates rapidly when released, unlike hydrocarbon-based fuels which tend to accumulate to the ground. 2.1 Flammability The most notable hazard of hydrogen is its flammability, which manifests itself in an unusually wide flammability range and its propensity to be ignited by very small energies. As shown in Figure 1, hydrogen's flammability ranges between 4% and 75% in air, and a hydrogen-air mixture under the optimal combustion condition can be ignited by any ignition source having an energy equal to or greater than 0.02 mJ, an order of magnitude lower than the energies required to ignite other flammable mixtures (h2tools.org, 2022). The first basis of safety to avoid a fire or explosion is to keep hydrogen separated from oxidizers (such as air) by implementing two aspects. The first is proper system design, installation and maintenance to reduce the likelihood of occurrence of leaks. The second is ventilation of enclosures and spaces to help dilute any hydrogen leak below the lower flammability limit, so that the mixture is too fuel-lean to ignite. In this regard, with reference to Figure 1, it may be noted that hydrogen’s LFL higher than that of other common fuels such as propane and gasoline vapor, thus meaning that a fuel-lean mixture can be relatively easier to achieve. 2.2 Volumetric leakage About hydrogen leakages from closed systems (vessels and pipelines), there is a concern that this substance can leak through fittings and joints more easily than other gaseous fuels, due to the molecule small size. Hormaza Mejia et al. (2020) have examined the leakage of hydrogen, natural gas and their blends, finding that pure hydrogen leaks at the same rate as hydrogen / natural gas mixtures and pure natural gas in typical existing low pressure (4 kPa) infrastructures for gas distribution. Additional CFD modelling (Baird et al., 2021) has shown that at higher pressures, leakage of hydrogen can be twice as large as natural gas leakage and approximately 4 times that of air, under the same conditions. When performing hazards assessment of hydrogen systems, it should be always kept in mind that “air-tight” equipment doesn't necessarily mean also “hydrogen-tight”. Conversely, leaked hydrogen dilutes rapidly thanks to fast diffusion, turbulent convection, and buoyancy, thus considerably limiting its persistence in the hazardous zone (Zuettel et al., 2008). Figure 1: Flammability ranges and Minimum Ignition Energies of common gaseous fuels 194 2.3 Burning behavior Upon ignition, hydrogen-air mixtures may result in jet fires (release under pressure), vapor cloud explosions (dispersions into uncongested areas) or confined explosions (within vessels or enclosures). The high laminar burning velocity of H2-air mixtures (2.0 to 3.5 m/s) is an aggravating factor in explosion scenarios: H2 flames are more difficult to confine or arrest, and sizing of deflagration vents becomes more challenging (Dahoe, 2005). Burning scenarios should also account for the consequences of flame temperatures and thermal energy radiation. Zuettel (2008) measured that the flame of H2-air mixture under the optimal combustion condition can reach up to 2,318 K, with severe radiation effects on buildings, infrastructures and personnel. H2 flames can be nearly invisible in daylight, when dust or soot are not present, so fires can burn undetected if sensing equipment is not being used: for this reason, many industrial codes and standards recommend the installation of flame detection equipment where jet fires may originate, so to alert personnel and prevent them from inadvertently contacting the flame. If ignition is delayed, hydrogen can accumulate over time in congested or enclosed spaces, creating a premixed flammable mass that, once ignited, generates an explosion. The consequences of such a scenario are extremely difficult to mitigate, so safety should be achieved through adequate ventilation, as discussed above. 2.4 Hazards from liquefied hydrogen Liquified H2 presents the same hazards as other cryogenic fluids, such as high vapor density and cryogenic burns. Since the boiling point of hydrogen at sea level pressure is 20.3 K (Rigas et Amyotte, 2013), prolonged exposure to liquid hydrogen spills can cause frostbite burns or hypothermia. The saturated vapor above the pool of spilled liquid hydrogen has a very high density, which causes the cold hydrogen cloud to spread horizontally or downward (Rigas et al, 2005). This phenomenon can rapidly displace air in a space without warning, since H2 is both odourless and colourless, and can pose an asphyxiation threat by locally diluting oxygen. In storage systems and plant equipment, the low handling temperatures of liquid hydrogen may lead to ice formation and accumulation on vents and valves, which can become obstructed if the hazard is not adequately assessed during design phase. The storage of liquified hydrogen in a vessel results in continuous evaporation, so gaseous hydrogen must be vented or collected safely in order to equalize pressure. Storage vessels should be kept under positive pressure to prevent entering of air, which may be present within the liquid because of condensed air from the atmosphere or accumulated during the liquefaction process. The quantity of entrained air can increase over time, in case of repeated refilling or pressurization of the vessels, ultimately leading to the formation of an explosive hydrogen-air mixture (Rigas et Amyotte, 2013). 3. The human factor In DEKRA experience, people in the process industry know how to protect plants from heavier-than-air hydrocarbons but are unfamiliar with “looking up” to identify fire and explosion hazards where hydrogen releases can accumulate. Workers may be unaware of the risk associated with hydrogen build-up at high points, so additional safety measures and robust work processes may be necessary to ensure that a thorough job safety analysis is completed before maintenance and nonroutine work is performed. Industrial facilities that produce or use hydrogen should ensure that all workers, both on site personnel and external contractors, receive adequate hazard awareness trainings and understand the risks posed by the buoyant nature of hydrogen. In our experience as Process Safety auditors we often come across the same unsafe practices and habits, related to hydrogen: ceiling-mounted electrical devices that are not ATEX rated for H2 atmospheres, lack of adequate ventilation, issue of hot-work permits without checking the atmospheres at the high-point traps within equipment or enclosure. 4. Risk analysis of an electrolysis unit The production of hydrogen by electrolysis powered with renewable electricity plays a fundamental role for the ecological transition and decarbonisation of the EU. For this reason, it is essential to analyse the safety aspects of this production by taking into account hydrogen properties. Past incidents occurred in electrolysis processes were mostly related to chlorine production, with hydrogen as a by-product, while a smaller number of incidents originated in hydrogen production processes by electrolysis (Azkarate et al., 2021). The main hazards associated with storage and production of hydrogen by electrolysis can be traced back to two categories: formation of explosive mixture inside the equipment, with consequent confined explosion, and release of hydrogen outside the equipment with potential jet fire / explosion. This section reports a summary of the main hazards emerged from the HAZOP (HAZard and OPerability) analysis of a hydrogen production process by electrolysis of a potassium hydroxide solution, illustrated in Figure 2. The analysed system consisted of the following sections: 195 1. potassium hydroxide solution preparation tank 2. electrolyser 3. hydrogen/electrolyte separator 4. oxygen/electrolyte separator 5. hydrogen scrubber and compressor 6. hydrogen treatment section (deoxidizer and dryer) and storage tanks Figure 2: Simplified scheme of hydrogen production by electrolysis of KOH solution Produced oxygen is not discussed further as it is a by-product and vented to the atmosphere: for the purposes of this analysis, only the hazards identified and related to the hydrogen properties are treated. The main hazardous scenarios identified from the HAZOP analysis were: 1. Explosion inside the process equipment due to formation of explosive mixture; 2. Jet fire and / or explosion scenarios due to hydrogen release from equipment. 4.1 Confined explosion scenarios Explosion scenarios identified in the HAZOP are a result of H2/O2 mixing inside the equipment due to process related failures or wrong inerting with nitrogen before start-up and maintenance. Process related failures. Unintended H2/O2 mixing was primarily found within the electrolyser and the separators. In the electrolyser, mixing of the 2 gases can occur in case of damage of the membranes within the electrochemical cell: membrane damage will cause the passage of the gas produced in the anode area towards the cathode area and vice versa, resulting in the formation of a potential flammable mixture that, under the operating conditions of the machine, may ignite and explode. Two potential causes for membrane damage have been identified: high temperature inside the electrolyser and random failure (unspecified cause) of membranes. The high temperature can be caused by: • low level into the electrolyser due to no electrolyte recirculation from the gas/electrolyte separators (electrolyte recirculation pump failure or gas/electrolyte separator level control loop failure); • lack of cooling of the recirculated electrolyte due to loss of cooling water or human errors. Main safeguards identified to prevent the above deviations were: • introduction of temperature control system and independent high temperature interlocks that will shut down the process when system temperature reaches the design temperature of the membranes; • level control systems and independent low level interlocks leading to process shut down; • low electrolyte flow rate indication and interlocks; • manual valves on cooling water networks locked in open positions; • installation of O2 analyser into H2 stream, shutting down the process when the concentration reaches a given value, usually identified with the Limiting Oxygen Concentration (LOC) of H2/pure oxygen; • installation of H2 analyser into O2 stream that will shut down the process in case the concentration reaches a critical value, that can be defined as a safety fraction of hydrogen LFL. Random failure of membranes are generally related to material quality, incorrect design specification, manufacturing defects, poor inspection and maintenance, incorrect installation, etc. To prevent these types of failures it is important to: properly define the design specification; appropriately select the construction materials; define a specific and effective inspection and maintenance plan. Regarding the gas/electrolyte separators, in the analysed system both separators are communicating in the lower part (i.e. in the liquid part) and the level of both is controlled by a single level control loop installed in one of them. This means that the loss of the level of a separator automatically leads to the loss of the level of the 196 second one, with subsequent mixing of hydrogen and oxygen inside the system, leading to a potential explosion scenario. For this system, therefore, the presence of an independent low level interlock plays a fundamental role to avoid the explosion scenario. The configuration of the system has also led to the identification of another scenario: in the event that the gas line outlet of one of the two separators is closed (plugging), its internal pressure would start rising. If the pressure inside the separator exceeds the hydraulic head of the liquid in the bottom of both separators, hydrogen may flow towards the oxygen separator (or vice versa) with formation of an explosive mixture and potential explosion. Again, the inspection and maintenance of these pieces of equipment is extremely important. Wrong inerting: Avoidance of explosive conditions inside all the equipment can be achieved by inerting the entire circuit before the start-up of the plant or before maintenance activities. Incorrect inerting before start-up causes the presence of residual oxygen inside the equipment: once the plant is started and hydrogen starts being produced, a flammable mixture may ensue. Similarly, failure to inert before maintenance could result in the presence of residual hydrogen and successive potential explosion issues during maintenance activities (for example due to sparks, hot works, etc.). Incorrect inerting of the circuit could be caused by: • Human error (incorrect execution of the inerting procedure); • Nitrogen contaminated with oxygen due to an upset of the nitrogen generator. It follows that reliable inerting procedures and gas analysers (both on the nitrogen network and process equipment) are of paramount importance to prevent the scenario. 4.2 Hydrogen release from equipment Emission of hydrogen from a closed pipe or vessel can be caused by: 1. High pressure in hydrogen scrubber due to high H2 flow rate on the compressor recirculation line, causing hydrogen to leak from the water seal of the scrubber and be released inside the building; 2. High pressure at compressor discharge side due to blocked outlet condition (human error closing a manual valve on the discharge side of the compressor) 3. High temperature in the deoxidizer leading to overtemperature 4. Compressor damage due to lack of lubricant oil 5. Leakages from flanged joints (e.g. flanges on manual / control valves) 6. Wrong manual valves management (wrong valve position after maintenance operations) In all the above-mentioned cases, the release of hydrogen inside the building will result in jet fire scenarios (in case of immediate ignition) or potential explosions. The following safeguards (technical or administrative) to prevent or mitigate the examined scenarios can be envisaged: • Installation of hydrogen gas detectors and flame detectors; • High pressure interlock (for scenario #1 and #2) and high temperature interlock (for scenario #3) that will trip the process; • Pressure safety valves (for scenario #2) • Inspection and maintenance plan of equipment (for scenarios # 4 and #5) • Robust maintenance procedures and manual valve management. Another useful safeguard is the natural ventilation of the building or the presence of an emergency forced ventilation, activated by hydrogen detectors, in order to prevent the formation of explosive mixture inside the building. The ventilation must guarantee a certain number of air changes based on the maximum hydrogen release flow rate, so careful assessments shall be made on the worst-case scenarios that lead to the highest volumetric leak flow rate of hydrogen. 4.3 Hydrogen releases at outdoor storage sites The most important scenarios identified during the HAZOP analysis of outdoor storage tanks, and related pipes, are the following: 1. Leakages from flanged joints leading to jet fire scenarios; 2. Storage tanks overpressure due to external fire and consequent domino effects; 3. Storage tanks internal explosion due to wrong inerting (before or after maintenance); 4. Water arrival from the after-compressor treatment section (hydrogen dryer), water freezing leading to equipment damage and consequent fire/explosion scenarios due to hydrogen release; For the above-mentioned scenarios the following safeguards were identified: • Suitable inspection and preventive maintenance of equipment; • Installation of hydrogen gas detectors and flame detectors; • Proper design of tank depressurization system; • Reliable inerting procedures; • Installation of water traps and process interlocks. 197 5. Conclusion In the overarching goal of achieving a climate-neutral Europe, along the path of ecological transition and decarbonisation, the production of hydrogen through electrolysis powered by renewable electricity plays a pivotal role. The safety of this type of production depends strongly on the inherent hazards of hydrogen, such as its high flammability and violent burning behaviour, and what preventive and protective measures are implemented to mitigate the associated risks (Section 2). The potential incident scenarios for hydrogen-producing electrolysers have been studied with a HAZOP analysis, and the most significative ones (with respect to hydrogen hazards) have been listed in Section 4. The most critical consequences of accident scenarios have been recognized as jet fires and explosions: it is therefore very important to provide technical and organizational measures (safeguards) that allow to reduce the risk associated to these types of events to an acceptable level. The first layer of protection is the design of the system, which must consider all the best available technologies and design standards. In the design phase, every potential hazardous source should be accounted for, and significant efforts should be made to remove them (as far as possible), according to an inherently safe design concept. Practical examples are: reducing the number of flanged joints and fittings, proper material selection, facility siting based on the output of a risk assessment (installing high inventory equipment in outdoor areas). An important role is played by the process control system, that allows the plant to be operated in the desired operating condition, and by the safety instrumented system, that prevents hazardous scenarios. It should be emphasized that safety instrumented system must be independent from process control system. Given the wide flammability range of hydrogen, it is essential to establish inerting routines of the equipment before start-up and maintenance operations. The availability and reliability of inerting should be ensured by robust procedures and gas detection, so to identify the early onset of hazardous condition and immediately restore safety conditions (e.g., stop the processing unit). For managing releases of hydrogen inside building and enclosures, adequately designed ventilation helps dilute any hydrogen leak below the lower flammability limit, so that the mixture is too fuel-lean to ignite. Ignition sources in buildings should be effectively managed, mostly by installing electrical and mechanical apparatuses that are properly ATEX rated for hydrogen atmospheres. An additional barrier is represented by fire&gas detection systems, preferably with automatic blocking of the system, in order to reduce the consequences related to hydrogen release scenarios. Lastly, the role of human induced errors in the system should not be underestimated: proper awareness trainings have to be guaranteed to every concerned party (from operators to managers to external contractors) so that risks related to the hydrogen process are understood and the plant can be safely operated. References Azkarate I., Jordan T, Moretto P., 2021, Minutes of the FCH 2 JU Workshop on Safety of Electrolysis on 18 November 2020, Fuel Cells and Hydrogen Joint Undertaking www.fch.europa.eu/news/results-fch-ju- workshop-safety-electrolysis (last access 30.03.2022) Baird A., Glover A., Ehrhart B. (2021). Review of Release Behavior of Hydrogen & Natural Gas Blends from Pipelines. Sandia National Laboratories. Dahoe A.E. (2005). Laminar burning velocities of hydrogen–air mixtures from closed vessel gas explosions. Journal of Loss Prevention in the Process Industries, 18(3), pp.152–166 European Commission, Communication From The Commission To The European Parliament, The Council, The European Economic And Social Committee And The Committee Of The Regions - A hydrogen strategy for a climate-neutral Europe, European Commission, Brussels, 2020 - eur-lex.europa.eu/legal- content/EN/TXT/?uri=CELEX:52020DC0301 (last access 28.03.2022) Fuel Cells and Hydrogen Joint Undertaking (FCH JU), 2019, Hydrogen Roadmap Europe Hydrogen Tools, 2022, www.h2tools.org (last access 25.7.2022). Hormaza Mejia A., Brouwer, J. and Mac Kinnon, M. (2020). Hydrogen leaks at the same rate as natural gas in typical low-pressure gas infrastructure. International Journal of Hydrogen Energy, 45(15), pp.8810–8826. Rigas F., Amyotte P., 2013, Myths and Facts about Hydrogen Hazards, Chemical Engineering Transactions, 31, 913-918. Rigas F., Sklavounos S., 2005, Evaluation of hazards associated with hydrogen storage facilities, International Journal of Hydrogen Energy, 30 1501-1510. Zuettel A., Borgschulte A., Schlapbach L., Eds., 2008, Hydrogen as a Future Energy Carrier, Wiley-VCH Verlag, Berlin, Germany, Chap. 4, p. 90-93. 198 84perelli.pdf Hazards Identification and Risk Management of Hydrogen Production and Storage Installations