DOI: 10.3303/CET24111077 Paper Received: 28 January 2024; Revised: 14 June 2024; Accepted: 20 June 2024 Please cite this article as: Aneziris O., Koromila I., Nivolianitou Z., Venetsanos A., 2024, Hazard Identification of Liquid Hydrogen in Transfer Operations, Chemical Engineering Transactions, 111, 457-462 DOI:10.3303/CET24111077 CHEMICAL ENGINEERING TRANSACTIONS VOL. 111, 2024 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Valerio Cozzani, Bruno Fabiano, Genserik Reniers Copyright © 2024, AIDIC Servizi S.r.l. ISBN 979-12-81206-11-3; ISSN 2283-9216 Hazard Identification of Liquid Hydrogen in Transfer Operations Olga Aneziris, Ioanna Koromila, Zoe Nivolianitou, Alexandros Venetsanos National Center for Scientific Research “Demokritos”, Athens, Greece olga@ipta.demokritos.gr This paper presents a hazard identification analysis for Liquid Hydrogen (LH2) in transfer operations, focusing on identifying sources of LH2 release and the associated initiating events. The analysis involves the loading of an LH2 storage tank from a trailer. The Master Logic Diagram (MLD) methodology, developed for chemical installations, is employed to identify initiating events. Two major categories of events leading to Loss of Containment are further investigated: events that lead in the direct structural failure of the containment, such as overpressure, embrittlement, etc., and events that lead to containment bypass. The development of the MLD is also based on a systematic analysis of previous accidents. Following the identification of initiating events, the paper outlines the possible accident sequences and damage states resulting to LH2 release. 1. Introduction The substantial contribution of transportation to increased air pollution has prompted national and international authorities to issue strict regulations so as to mitigate environmental impacts and reduce harmful emissions (European Commission, 2019). To achieve this objective towards environmentally sustainable transportation practices, liquid hydrogen (LH2) has gained floor in the investigation (Ustolin et al., 2022; Chen et al., 2023). LH2, however, poses various risks in the event of a release, necessitating a comprehensive safety assessment for the pertinent installations (Ahmad et al., 2023). This paper presents a preliminary hazard identification analysis of Liquid Hydrogen in case of transfer operations, such as a trailer loading a storage tank. Hazard identification is the first phase of a quantitative risk assessment. The main objective of “Hazard Identification” is to identify the sources of LH2 and the initiating events (IEs) that can lead to the release of hydrogen to the environment. The Master Logic Diagram (MLD), a method for identifying events initiating accidents in chemical installations will be developed for transfer operations of LH2. It starts with a “Top event” which is the undesired event (like “Loss of Containment”) and continues decomposing it into simpler contributing events in a way that the events of a certain level will in some logical combination, cause the events of the level immediately above. The development continues until a level is reached where events directly challenging the various safety functions of the plant are identified. These are the initiating events. Methodological steps for accident sequence modelling with the help of Event Trees are also developed. Event Trees include all initiators of potential accidents and specific system failures and successes, their timing and human responses. The structure of the paper is as follows: Section 2 presents the methodology for hazard identification which includes the development of a generic MLD for storage and loading operations of LH2, the accident sequence modelling and damage state determination. Section 3 describes a transfer operation which includes an LH2 trailer, a hose, and a storage tank. Initiating events, safety systems, event trees modelling accident sequences and damage states are presented. Finally, conclusions are discussed in section 4. 2. Methodology for hazard Identification Hazard identification consists of analyzing the transfer operations of a facility, so as to identify potential accident initiators, assess the response of the facility to these initiators and establish end damage states of the facility 457 resulting in the release of a dangerous substance in the environment. This phase can be distinguished in the following procedural tasks: (a) Hazard source identification: the main sources of potential hazardous-substance releases are identified and the initiating events that can cause such releases are determined. (b) Accident sequence determination: a logic model for the installation is developed in this step. The model includes each and every initiator of potential accidents and the response of the installation to these initiators. Specific accident sequences are defined (in models called Event Trees) which consist of an initiating event, specific system failures or successes and their timing, and human responses. Accident sequences result in plant damage states, which involve release of the hazardous substance. (c) Plant damage state definition: A plant damage state uniquely characterizes the facility conditions of release of the hazardous substance (LH2). Accident sequences resulting into the same conditions of release are categorised into groups each corresponding to a particular plant damage state. 2.1 Master Logic Diagram for initiating event identification A MLD is developed to describe Loss of Containment (LOC) decomposition for installations handling LH2. On the basis of the generic MLD developed by Papazoglou and Aneziris (2003) and a systematic analysis of accidents which have occurred in the past (Ordin, 1974; Verfondern et al., 2021; Wen et al., 2022; Hydrogen Safety Panel, 2020; Hydrogen Tools Portal-h2tools.org), the LOC is decomposed into simpler contributing events and the initiating events are identified. The generic MLD for LH2 is presented in Figure 1. Figure 1: Generic MLD of Loss of Containment for LH2 The first level of decomposition of the MLD involves two major categories of events that may lead to LOC: (a) events that lead in the direct structural failure of the containment (b) events that lead in containment bypassing because of an inadvertent opening of an engineered discontinuity in the containment. The first major category of causes for LOC, the direct structural failure of the containment, may result from the following five direct causes: (a) overpressure, (b) corrosion, (c) embrittlement, (d) vibration, and (e) external loading. Each of those fundamental physical processes has the potential to induce stresses that will exceed the strength of the containment. Alternatively, they can reduce the strength of the containment to levels low enough that it cannot withstand normal stresses. Each of these failure causes can be considered as the result of an initiating event coupled with the failure of one or more safety functions. The latter are combinations of engineered systems and human actions based on specific procedures aiming at preventing the initiating event from causing the failure of the containment. The second major category of causes for LOC, the containment bypassing, may result from the following two direct causes: (a) operations start while the containment is open (b) the containment is opening during operations All these direct causes for LOC are extensively described in the following sections 2.2 to 2.3. It is noteworthy that hydrogen is flammable and explosive and therefore ignition sources are important causes of accidents. 458 Possible sources of ignition as reported by Ordin (1974) are the following: electric short circuits and sparking, static charges, hot spots, flare of a vent stack, use of welding or cutting torches, grounding failure, impact due to high-velocity fragments and lightning. 2.2 Direct cause of containment failure Overpressure Overpressure describes the phenomenon where the internal pressure increases to such a degree that the stresses induced on the containment overcome its strength. Overpressure may be created in the following ways: (a) internal pressure increase (b) pressure shock Internal pressure increase can be further developed in a third level of decomposition. This event may occur in four ways: cooling malfunction, direct pressure increases from gas material, overfilling, and excess heat. Cooling malfunction may occur due to failure of the insulation allowing air to enter the system causing hydrogen boil-off or, in some cases, due to failure of the vacuum system. Direct pressure may increase in the system, owing to boil off or owing to hydrogen gas entering the system, as in case of failure of pressure builder unit. In some cases, the system is pressurized due to the failure of the pressure relief devices or the venting system. The presence of water creates ice blocks in the venting system or relief devices may fail in closed position. In both cases hydrogen tanks may rupture, owing to overpressure. Overfilling may occur during abnormal operating procedures in loading/unloading LH2 tanks. Excess heat is further decomposed in a fourth level which involves the next two causes: internally generated heat due to internal combustion or application of incompatible material, and externally generated heat due to an external fire. Internal combustion or explosion may occur when inadequate purging process takes place that allows gaseous hydrogen to remain in the system. In addition to internal pressure increase, overpressure may occur due to pressure shock, known as water hammer, which can occur by the rapid closing of a valve and a pressure wave resonance within the pipe/hose system will be developed. Embrittlement Embrittlement, which causes accelerated fatigue crack of instrumentation or the tank shell, can lead to immediate containment failure, if the temperature or pressure exceeds certain levels that significantly affect losses in tensile strength, ductility, and fracture toughness. It is typically a design-based failure due to hydrogen incompatibility of materials used. Corrosion Considerable destruction of metal components or tank shell due to the presence of moisture and/or external ambient temperature, failure of the protective coating, or poor maintenance. Vibration Vibration exists due to systems operation. Vibration may contribute to shell cracks or valve openings. External loading Structural failure of containment owing to external loading occurs whenever such external loads induce stresses to the containment exceeding the strength of its material. This direct cause can be distinguished into three subcategories: (a) loading from natural phenomena (b) failure of tank supports (c) extra loads on the containment The first category can be further subdivided into four types of natural phenomena, namely earthquake, flooding, high winds/storm, and snow or ice. Extra loads, on the other hand, may occur if there is an impact from cranes, or other vehicles, missiles, or overpressure from a neighbour pressure vessel. This category can be divided into two events: dropped object and contact or collision. 2.3 Containment bypassing In addition, LOC may occur in the case the containment has remained open when operations start or opens during operations. In the first case, a manual/ power valve or hatch might have been left open and not closed before operations start. In the second case, a valve or flange may open suddenly due to malfunction or operator error, or due to vibrations occurring during operations. In addition, a pressure relief device may open unexpectedly and remain open. A hose coupling may also fail during the connection of a hose to an LH2 tank resulting to hydrogen release, and finally residual LH2 may be released from a hose during disconnection, if not proper cleaning of the line has taken place. 459 3. Case study 3.1 Installation description A simplified diagram of the system analysed, that address LH2, is presented in Figure 2. It consists of the next three key subsystems: (a) an LH2 trailer, (b) an LH2 storage tank, and (c) the connecting hose. The transfer of liquid hydrogen from the trailer to the storage tank is achieved via pressure difference between these systems, and pressure in the trailer is increased with the operation of a vaporizer. The trailer and the storage tank are equipped with control and safety equipment, including insulation, pressure and level control devices, pressure safety valves, bursting disks, vent system and bumpers for collision protection. Figure 2 also presents the safety systems of the trailer and the storage tank. The current case study uses the MLD approach to identify the initiating hazard events and determines the damage states assuming the bunkering of an LH2 storage tank from a trailer, via a flexible hose. Figure 2: The examined fuelling system 3.2 Initiating events and damage states The generic MLD when applied to the Loss of Containment of the trailer, hose and storage tank during transferring of LH2 from the trailer to the tank results in the direct causes presented in Table 1. All initiating events (IEs) are presented in Table 1 for the trailer, hose, and storage tank respectively. This list was further checked for completeness with initiating events of past recorded accidents and /or studies (check lists). Incidents found in NASA's accident database (Ordin,1974) include cooling malfunction, failure to close vent or relief devices, inadequate purging, embrittlement, corrosion, vibration, extra loading from natural phenomena, extra loading owning to collision or contact, valve left open before operations start, and unexpectedly open of pressure relief device. Table 1: Identified initiating events for the trailer, hose, and storage tank No. Initiating events Trailer tank Hose Storage tank 1) Embrittlement, corrosion    2) Tank insulation failure or vacuum loss   3) Excess external heat owing to nearby external fire    4) Pressure shock in pipelines (Inadvertent valve closure during unloading)  5) Inadequate purging or cooling of hoses  6) High pressure, owing to vaporizer malfunction or not stopped   7) Vibration    8) Earthquake, snow, ice, floods, high winds    9) Supports failure  10) Extra loads    11) Valve left open before unloading starts  12) PSD valve failed open during unloading    13) Containment bypass during loading (e.g. premature hose disconnection)   3.3 Safety functions and safety systems Once the initial list of IEs has been compiled the next methodological step consists in the determination of the safety functions and the systems that serve these functions. Safety functions and systems are incorporated in the design of the facility to prevent and/or mitigate the possible consequences of the IEs. The systems that serve the safety functions directly are called frontline systems. These are the systems that will form the headings 460 of the event trees developed later. Safety functions and safety systems are presented in this section for the case study of tank filling. Table 2 presents the safety functions incorporated in the design of this case study and also systems that have as mission to perform the identified safety functions. Table 2. List of Safety Functions and associated safety systems in LΗ2 trailer, hose and stationary tank Safety Functions Safety systems LH2 trailer Avoid overpressure owing to boil off/ hydrogen gas High Pressure Control System Manual pressure reduction through blow down valve Provide overpressure protection Pressure Safety Valves, Bursting disks, Vent stack Provide vacuum and insulation protection Thermal insulation of tank, Vacuum of insulation Avoid vibrations Maintain structural integrity of pressure boundary under normal pressure conditions Avoid boundary containment by-passing Procedures for Containment bypass protection Corrosion and embrittlement protection Procedures for corrosion protection Fire protection Fire protection system and sprinklers Collision and extra load protection (external impact) Restriction of traffic and warning signs, Tow-away interlock safety system LH2 hose Avoid overpressure owing to pressure shock Pressure Safety Valves Provide sufficient purging Follow procedures for purging and emptying lines Corrosion and embrittlement protection Follow procedures for cooling Avoid vibrations Avoid boundary containment by-passing Boundary containment by-passing protection Collision and extra load protection Restriction of traffic and warning signs, Tow-away interlock Fire protection Fire protection system LH2 storage tank Avoid overpressure owing to boil off/ hydrogen gas Pressure Safety Valves, Bursting disks, Vent stack Avoid overfilling High Level System, Level indicator, Operator stops filling Provide overpressure protection High Pressure System, Manual pressure reduction through blow down valve Provide vacuum and insulation protection Thermal insulation of tank, Vacuum system Maintain structural integrity of pressure boundary under normal pressure conditions Outer pressurized stressed containment, Internal vessel Avoid boundary containment by-passing Procedures for Containment bypass protection Corrosion protection Procedures for corrosion protection Fire protection Fire protection system, Sprinklers Ignition Protection Lightning and earthing protection 3.4 Event sequence modelling and plant damage states This task determines the response of the plant to each and every group of initiating events. The response includes the systems that are called upon to respond and the corresponding required actions, human actions, etc. The combinations of the initiating event with successful or failed system and human responses are assessed, producing event sequences. These sequences lead to either a successful control or mitigation of the initiating event, or to an abnormal event (release of LH2). In the latter case the event sequences are called accident sequences and lead to the damage states. Event Trees (ETs) were constructed for most of the initiating events of Table 1. Example of these Event Trees is the one constructed for the initiating event “Trailer tank insulation failure or vacuum loss”, presented in Figure 3. This model presents the possible response of the trailer tank to insulation failure or vacuum loss, during transfer of LH2 from a trailer to a stationary tank. It comprises the following events (headings): 1. Trailer tank Insulation failure or vacuum loss (IE-1) During unloading of LH2 from a trailer to a storage tank, insulation failure or vacuum loss may cause an additional demand on the boil off removal capacity of the trailer. The extra demand initiates a transient and requires certain safety functions to avoid release of hydrogen. 2. Pressure safety system (PSVs, rupture disks and vent stack) 461 This event models the successful operation of the pressure safety system (PSVs, rupture disks or vent stack) in the event of a continuing pressure rise beyond and above the nominal set points. The event tree determines two accident sequences. One of them (#1) constitutes successful termination of the incident and one (#2) results in rupture of the trailer and release of hydrogen. Trailer Tank Insulation Failure or Vacuum Loss Pressure Safety System (PSVs, rupture disks and vent stack) ΙΕ-1 PSV No. Consequence 1 RELEASE FROM PSV 2 TRAILER TANK RUPTURE Figure 3. Event Tree for initiating event “Trailer tank insulation failure or vacuum loss” The accident sequences (scenarios) analysed within this transfer operation were found to lead to the following damage states: (a) Trailer tank rupture, (b) Hose rupture (Liquid phase), and (c) Storage tank rupture. 4. Conclusions This paper presents the hazard identification analysis and damage state estimation for Liquid Hydrogen (LH2) in transfer operations. This is the first phase of quantified risk assessment, and the focus is to identify causes of LH2 releases, associated initiating events, safety systems and damage states. A case study of LH2 transfer was considered, during loading of a storage tank with hydrogen from a trailer. All initiating events of LH2 storage and transfer systems were identified with the help of the MLD method and the analysis of relevant accidents which have occurred in the past. Damage states were identified, with the help of the Event Trees, which were constructed for the initiating events identified. In the next steps, the consequences will be further assessed, so as to proceed with risk quantification associated with LH2 release. In addition, specific case studies considering other bunkering methods, including ship to ship bunkering, will be further analysed. Acknowledgments This work was undertaken as part of the ELVHYS project No. 101101381 supported by the Clean Hydrogen Partnership and its members and the European Union. UK participants in Horizon Europe Project ELVHYS are supported by UKRI grant numbers 10063519 (University of Ulster) and 10070592 (Health and Safety Executive). References Ahmad S.I., Hisham N., Abidin M.Z., 2023, Inherent Safety and Health Assessment of Hydrogen Storage Process, Chemical Engineering Transactions, 106, 835-840. Chen P.S-L, Fan H., Enshaei H., Zhang W., Shi W., Abdussamie N., Miwa T., Qu Z., Yang Z., 2023, A review on ports’ readiness to facilitate international hydrogen trade, International Journal of Hydrogen Energy, 48, 17351-17369. European Commission, 2019, Resolution on the European Green Deal (2019/2956(RSP)). Belgium. Hydrogen Safety Panel, 2020, Hydrogen Incident Examples: Select Summaries of Hydrogen Incidents from the H2tools.org Lessons Learned Database. United States Department of Energy. Ordin P.M., 1974, Review of hydrogen accidents and incidents in NASA Operations, NASA TM X-71565. ntrs.nasa.gov/api/citations/19740020344/downloads/19740020344.pdf Papazoglou I.A., Aneziris O.N., 2003, Master Logic Diagram: Method for hazard and Initiating event identification in process plants, Journal of hazardous materials, A97, 11-30. Ustolin, F., Campari, A., Taccani A., 2022, An Extensive Review of Liquid Hydrogen in Transportation with Focus on the Maritime Sector, Journal of Marine Science and Engineering, 10, 1222. Verfondern K., Cirrone D., Molkov V., Makarov D., Coldrick S., Ren Z., Wen J., Proust C., Friedrich A., Jordan T., 2021, Handbook of hydrogen safety: Chapter on LH2 safety. Project Pre-normative REsearch for Safe use of Liquid Hydrogen (PRESLHY). Wen J.X., Marono M., Moretto P., Reinecke E., Sathiah P., Studer E., Vyazmina E., Melido D., 2022, Statistics, lessons learned and recommendations from analysis of HIAD 2.0 database, International Journal of Hydrogen Energy, 47, 17082-17096 462 16aneziris.pdf Hazard Identification of Liquid Hydrogen in Transfer Operations