1
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
2
Overview of modes of hazard prevention and mitigation
 A bow tie chart is a graphical representation of the safety measures
which can be implemented to control the risks associated to a
hazardous event. Two kinds of safety measures can be distinguished:
 Safety measures can act on the combination of causes of the
hazardous event, so as to prevent the hazardous event from
happening – they are then called prevention measures. Prevention
measures are the specific measures that reduce the likelihood of
the event.
 Safety measures can be aimed at mitigating (i.e. reducing) the
consequences of the hazardous event – they are then called
mitigation measures.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Mitigation
Prevention
Cause 1
Consequence 1
3
AND
Cause 2
Consequence 2
Cause 3
AND
Cause 4
OR
hazardous
event
Consequence 3
AND
Cause 5
Consequence 4
Condition 4
= safety measure
© HyFacts Project 2013
 The bow tie chart
allows for an
exhaustive overview
of all the safety
measures which can
be applied to prevent
feared events from
happening, or to limit
their consequences.
(Source: Air Liquide)
Funded by FCH JU (Grant agreement No. 256823)
Strong blast
effects
4
Confined
explosive
atmosphere
H2 release
Unconfined
explosive
atmosphere
Flash fire
Blast effects
Loss of
leaktightness
Flame/
Jet fire
Equipment
failure
Kinetic
effects
(Source: Air Liquide)
© HyFacts Project 2013
Injury /
casualty
Escalation
 Hydrogen release is the
main risk induced by
hydrogen use and the
hazardous event most
often feared in hydrogen
systems
 The bow tie chart of
hydrogen release is a
graphical representation
of all the safety
measures related to
hydrogen release.
Funded by FCH JU (Grant agreement No. 256823)
5
 Hydrogen release can be caused either by a loss of leak-tightness of the system, or
by an equipment failure. Consequently, different hazardous phenomena may occur,
generally in combination:
 Depending on the release properties and the presence of ignition sources, the
hydrogen release may ignite immediately or after a certain delay. In the latter
case, if the release takes place in a confined environment, an explosive
atmosphere may build up by accumulation.
 Independently of the hazards of hydrogen, failure of an equipment containing
hydrogen under pressure is likely to result in kinetics effects.
 All these consequences of hydrogen release can impact people - leading to injuries,
or/and impacting equipments. Minor events can turn into catastrophic ones
(escalation of the event) in the absence of appropriate safety measures.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Active and passive prevention measures

Passive
Equipment validation
Physical Protection
Strong blast
effects
6
Active
Periodic leak test
Passive
Equipment validation
Physical protection
Confined
explosive
atmosphere
Injury /
casualty
Flash fire
Active
Periodic inspection
H2 release
Unconfined
explosive
atmosphere
Blast effects
Loss of
leaktightness
Flame/
Jet fire
Equipment
failure
Kinetic
effects
Escalation
Active and passive
prevention measures
can be taken, so as to
prevent hydrogen
releases:

Equipment
validation

Physical protection

Periodic leak test

Periodic equipment
inspection.
(Source: Air Liquide)
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Active and passive mitigation measures
Passive
Explosion venting
Passive
Flow restriction
Active
Detection and Isolation
Excess f low valve
H2 release
Confined
explosive
atmosphere
Active and passive mitigation
measures can be taken:

Measures to mitigate the consequences of
the hydrogen release:
Passive
Active
Strong blast
effects

Separation distance
Emergency response
7
Passive
Avoid unnecessary
conf inement
Natural ventilation
Active
Active ventilation
Detection and active
ventilation
Injury /
casualty

Passive
Flash fire
Separation distance


Active
Emergency response
Unconfined
explosive
atmosphere
Blast effects
Loss of
leak
tightness
Flame/
Jet fire
Equipment
failure
Kinetic
effects
Escalation





Passive
No ignition sources
Active
Detection and power
shut-down
(Source: Air Liquide)
© HyFacts Project 2013

Restricting hydrogen flow / using an
excess flow valve
Detecting and isolating hydrogen
Detecting hydrogen and then shuttingdown the power
Avoiding unnecessary confinement
Using natural ventilation
Using active ventilation
Designing the system with explosion vents
Avoiding ignition sources
Mitigation measures to protect people and
equipments:


Implementing separation distances
Providing emergency response.
Funded by FCH JU (Grant agreement No. 256823)
8
 The release of liquefied hydrogen usually results in the accumulation
and the formation of a liquid pool on the ground. The pool will expand, depending on
the volume spilled and the release rate, radially away from the releasing point and will
immediately start to vaporize.
 At the boiling point, hydrogen in gaseous phase has a higher density (1.3390 kg/m3)
than air at ambient condition (David, 1994). When considering a cryogenic hydrogen
spill, it means the cold gaseous hydrogen will accumulate on the ground, until it warms
up and starts rising.
 In 1980, the NASA released 5,700 L of liquefied hydrogen near ground on sand in a
time span 35-85 s. From the thermocouples deployed at 1, 2 and 3 m distance from the
spill point. Only the inner two were found to have gotten contact with the cold liquid,
thus indicating a maximum pool radius not exceeding 3 m.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
9
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
 Prevention measures related to the mechanical integrity of hydrogen
systems consist in
10


validating equipment design through performance testing and
checking the equipment periodically once it has been put in service.
 Resistance tests are basic tests: all relevant characteristics of a system are tested
(example: hydraulic pressure test).
 Endurance tests are more elaborate: the system is subjected to a cycling loading,
and the time until it fails characterizes its endurance. A factor is applied to establish
service life (requirement to withstand 50 000 test cycles for a specified service life of
10 000 cycles)
 The following equipments are subject to mechanical integrity validation testing:




Gaseous hydrogen containers
Container valves
Flexible hoses
Quick connection devices.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
11
Tubing elements are connected either by welded joints or by fittings
 Welded joints
Welded joints are permanent. They have a better leak-tightness and reliability than
fittings. Their use limits the number of potential leaks. In order to avoid potential leaks,
butt welded pipes having a diameter larger than 15 mm must be tested over their whole
length using x-rays (according to the standard NF EN 13480-5).
Only certified technicians are entitled to weld tubing elements.
 Fittings
In the situations where welding is not appropriate, tubing elements can also be
connected by fittings. For use in hydrogen applications, fittings are made of stainless
steel of the appropriate grade. Different kinds of fittings exist. The type of fittings which
should be used depends on the pressure range of the gas flowing through the piping,
and of the nature of the gas itself.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
12
Examples of providers
Lots of constructors can provide this kind of sealing modes (e.g. Swagelok® and many others). Conical
metal-to-metal sealing is a sealing mode rather than a type of connection: it can be manufactured on an
element (e.g. valve).
Range of applications
For medium and high pressure ranges (from about 2 to 700 bar)
Example of application: on hydrogen cylinders
Leak-tight contact takes place on the thread of the fitting, and is achieved thanks to the conical shape of
Contact to ensure leak- the fitting and requires tightening to a certain level of torque.
tightness
To reduce friction upon mounting and to improve the leak-tightness of the system, a Teflon tape is applied
on the thread. Proper application of the Teflon tape is required to achieve leak-tightness.
(Source: Air Liquide)
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Contact to ensure
leak-tightness
Leak-tight contact takes place on the thread of the fitting, and is achieved due to the conical shape of the
fitting and requires tightening to a certain level of torque.
To reduce friction upon mounting and to improve the leak-tightness of the system, a Teflon tape is applied
on the thread. Proper application of the Teflon tape is required to achieve leak-tightness.
13
This kind of sealing mode requires a strong tightening torque of the fitting to obtain tightness.
Failure modes and
associated safety
measures
Failure modes:

Rupture of fragile cylinder neck (e.g. small cylinder, weaker materials, e.g. aluminum) due to
excessive torque

Leaks due to undertightening or to damages on the threaded area
Safety measures:

Use additional Teflon of great quality on the threaded surface to improve tightness of this kind of
connection

Limit mounting-dismounting cycles.
Advantage:
Advantages /
drawbacks
this kind of fittings is robust and unlikely to leak after proper assembly: if leak tight, will stay leaktight.
Drawback:
it is not suitable for frequent dismounting/remounting.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Examples of providers Swagelok® and Rotarex®
14
Pressure ranges:
Range of applications

Up to 420 bar with “classical” tube fittings for a 6 mm external diameter tube (fittings provided by
Swagelok® or Rotarex® for example)

Up to 1034 bar with Swagelok® medium pressure tube fittings for a ½’’ external diameter tube
Example of application: mainly used for tube connections in hydrogen energy based systems (for the
medium and high pressure sections).
Nut
Back ferrule
Front ferrule
Union
(Source: Rotarex® or Swagelok®)
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
For a classical double ring tube fitting using conical ferrules:
15
Contact to ensure leaktightness
Failure modes and
associated safety
measures
As the nut is turned, the back ferrule radially applies an effective tube grip. The tightening of the nut on
the main part of the fitting also creates a force on the back ferrule which axially advances the front
ferrule. This front ferrule then comes into contact with the main part of the fitting and creates a seal
against the fitting body, on the tubing outside diameter. The leak-tightness takes place mainly on the
conical surfaces of the fitting. The surface where the conical ring and the tube come into contact
reinforces the tightness by assuring the tube grip.
Failure modes:

Extraction of tube – due to improper mounting plus traction

Leak between Front ring and Union – due to damaged or unclean surfaces, or leaks due to
undertightening
Safety measures:

Respect of manufacturer mounting recommendations

Use of specific gauge in order to check the tightening

Limit mounting-dismounting cycles.
Advantage:
this kind of fitting is highly reliable, simple to assemble and not affected by vibrations.
Advantages / drawbacks Drawback:
it has a severe failure mode – i.e. extraction of tube – if not properly assembled (e.g. lack of rings, wrong
order, use of impropriate rings, not sufficiently tightened). This point has been improved for medium
pressure fittings by a pre-assembly cartridge providing the ferrules in the right way.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Examples of providers Maximator, NOVA SWISS, SITEC
16
Suitable for very high pressure applications (up to 1500 bar for 9/16’’ external diameter tubes for
Range of applications example)
Example of application: high pressure hydrogen buffer systems for fuelling stations
Male nut
Tube
Body
Tube end is prepared at time of assembly
after tube has been cut to the right length:
threading and shaping of end of tube for
leak-tight surface.
Threaded ring
Sealing area
(Source: Air Liquide)
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Contact to ensure
leak-tightness
The tightening of the nut on the main part of the fitting the cone-shaped end of the tube comes into contact
with the main part of the fitting. This ensures the required leak-tightness.
17
Failure modes:

Leaks – due to improper preparation of tube end, to undertightening, to an incorrect position of the
screwed ring, to damages on the conical sealing surface by repeated overtightenings
Failure modes and
associated safety
measures
Safety measures:

Strong tightening torque

Correct position of the screwed ring: the ring must be seen through the release hole existing on the
body of this kind of fitting

Limit mounting-dismounting cycles.
Note: for hydrogen applications (transport and/or fuel cell), silicone grease cannot be used to improve
sealing.
Advantage:
very robust and reliable. As the ring is screwed on the tube, the risk of wrenching – which is the main
hazard in the high pressure range – is reduced. These fittings can therefore be used for the high pressure
range.
Advantages /
drawbacks
© HyFacts Project 2013
Drawback:
in order to ensure a good leak-tightness, the conical surface should be properly polished. This kind of
fittings can be either directly bought well manufactured or it can be manufactured on-site. When it is directly
bought well manufactured, a high pressure qualified welder is required. When it is manufactured on-site
(threaded area for screwed ring hosting and conical sealing surface), a qualified operator is required and
this operation is time-consuming. Besides, leak-tightness may be affected by vibrations.
Funded by FCH JU (Grant agreement No. 256823)
Provider
18
Range of applications
Stäubli
Quick-release couplings are adapted to the high pressure range (200-400 bar).
They are appropriate fittings for frequent connections and disconnections.
Contact to ensure leakThe contact which ensures the leak-tightness takes place on the gasket surface.
tightness
O-ring
(Source: website of Stäubli)
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
19
Failure modes:
Failure modes and
associated safety
measures

Large leaks from extrusion of rings – due to connection / disconnection with pressure in the
connection or when the connection is not exactly in the axis of the fitting, when the O-ring is
forgotten

Leaks from aging or damage to o-rings
Safety measures:

Advantages /
drawbacks
© HyFacts Project 2013
Use of a lyre (spiral tube) in order to provide more flexibility to position the connections correctly.
Advantage:
quick-release fittings are user-friendly for applications with frequent connections and disconnections.
Drawbacks:
vulnerability of o-rings. Leak hazards may occur when the fitting is not properly mounted (other types of
fittings are preferred when there is no need for frequent connections and disconnections).
Funded by FCH JU (Grant agreement No. 256823)
Passive
Avoid unnecessary
20
conf inement
Natural ventilation
Active
Active ventilation
Detection and active
ventilation
Passive
Flow restriction
Active
Detection and Isolation
Excess flow valve
H2 release
Confined
explosive
atmosphere
Passive
Explosion venting

Passive
Separation distance
Active
Emergency response
Strong blast
effects
Injury /
casualty
Passive
Flash fire
Separation distance
Active
Emergency response
Unconfined
explosive
atmosphere
Blast effects
Loss of
leak
tightness
Flame/
Jet fire
Equipment
failure
Kinetic
effects
Escalation

Passive
No ignition sources
Active
Detection and power
shut-down
Consequences of hazardous
events occurring in the high
pressure part of a hydrogen
system are very severe.
Therefore, the extension of
high pressure parts inside
the system should be as
limited as possible, and
highly secure.
Once hydrogen has been
released, mitigation measures
have to be taken. Limiting the
amount of hydrogen
released is a mitigation
measure of the hydrogen
release.
(Source: Air Liquide)
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Passive flow limitation (flow restriction)
21

A small-diameter pipe or orifice can be used downstream of the pressure
regulator which lowers the pressure of the hydrogen flow coming from the storage
tank. When such calibrated pipe is used, even in the case of a hazardous
hydrogen release, the flow of hydrogen is limited.
Active flow reduction / isolation devices
Two active mitigation measures aiming at interrupting the hydrogen flow exist:
 The excess flow valve is a valve which closed itself as soon as the hydrogen flow rate
is too high. Its major drawback is that the valve might close inappropriately, as high
instantaneous flows within the system may be normal in certain phases of operation.
 A more sophisticated active mitigation device consists in the combination of a sensor
(such as a hydrogen sensor, or a pressure sensor) with a valve. As soon as an
incident is detected, the valve is automatically closed. Such a measure is applied in
hydrogen dispensing applications in case of hose failure.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
22
 An important aspect of minimizing the risk of fire and explosion is the use of detection
methods to give advance warning of a potentially hazardous situation, for example
arising from a leak or combustion of fuel.
 These detectors must be effective and reliable, because of the safety critical nature of
the application, and inexpensive, to ensure their widespread use.
 Both fixed location (for gas and fire detectors) and personal or hand-held monitors
(typically for gas detectors only) are necessary for protection of personnel and plant.
Additionally, there may be a requirement to fit gas sensors on vehicles to warn of leaks
(on-board sensors).
 The applications for hydrogen sensors cover:



The hydrogen generation process from carbon-containing fuel reforming or electrolysis
Hydrogen storage and distribution, at production sites and filling stations; and
Hydrogen fuel cell/combustion systems. These can be stationary, for example power
production, or mobile, for example automotive.
Hydrogen sensors shall be placed at an elevated point where the possibility of an early
detection of a hydrogen leak is most probable. The instructions for installation
need to be respected.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Advantages
Disadvantages
Electrochemical
Quite selective
Sensitive to 100 ppm
Very low power consumption – no heating
Poison resistant
Some cross-sensitivity to CO
(for example 1000 ppm H2 @ 300 ppm CO)
Narrow temp range
Short lifetime (2 years)
Thin-film hydrogen sensor
(Robust Hydrogen
SensorTM)
Wide detection range
Rapid response
Does not require oxygen
Affected by total gas pressure
(for example altitude)
Poisoned by CO, SO2, H2S
Heating required to ca 150°C
ChemFETs (forms part of
the Robust Hydrogen
SensorTM)
Does not require oxygen
Wide detection range
Low power consumption
Affected by total gas pressure (for example
altitude)
Poisoned by CO, SO2, H2S
Heating required to ca 150°C
Catalytic
Acceptable lifetime
Wide temp range
Not selective
High power consumption – heating
Requires 5-10% oxygen
Poisoning by Pb, Si, P, S
High maintenance
23
Type
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Advantages
Disadvantages
Thermal conductivity
Quite selective
Long term stability
Poison resistant
Does not require oxygen
Cross-sensitive to helium
Not as sensitive as electrochemal/chemFETs
Heating required
Semi-conductor
Commercially available with acceptable
lifetime
Wide temp range
Not selective
High power consumption – heating
Sensitive to humidity and temperature
Mass spectrometry
Low limit of detection
specific
expensive
bulky
fragile
needs skilled operator
Ultrasonic
Not susceptible to poisons, humidity etc
only leak properties
Non-directional?
not specific to hydrogen
interference from background noise
only detects high pressure leaks
24
Type
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
25
 Fire detectors are the second step in the detection chain for minimizing the risk of
death, injury, damage and loss of production due to the flammability of fuels. Gas
detection is the first step but is not totally reliable or cannot, for example due to lack of
100 % coverage, prevent a fire from starting. It is therefore usual for the industry to
install both types of detector. Fire detectors are typically installed in similar situations,
but not necessarily in the same location, as fixed gas detectors.
 There are various approaches to detecting a fire, based on:










Fusible plugs
Heat detection
CCTV based systems.
Rate compensated heat detectors
Optical flame detection (IR and UV and combined IR-UV)
Frangible bulbs (activate directly fire-water deluge valves)
Linear heat detection (cables routed through fire risk areas)
Ionisation smoke detection / Optical smoke (obscuration/line-of-sight) detection
Gaseous products of combustion detection, e.g. CO, volatile organic compounds
High speed and high sensitivity smoke detection - addressable point optical systems and aspirated
optical systems (e.g. Very Early Smoke Detection Apparatus VESDA)
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Advantages
Disadvantages
UV
Very high speed
High sensitivity
Low cost
False alarms, for example lightning, arc
welding, radiation, specific solar radiation not
absorbed by the atmosphere
Blinded by thick smoke and vapours
UV/IR
Moderate speed
Moderate sensitivity
Low false alarm rate, not blinded by CO2 fire
protection discharges
Automatic self test
False alarms, for example combination of
UV and IR sources.
Blinded by thick smoke and vapours
Moderate cost
Triple IR
Very high sensitivity
Very high speed
IR/vis imaging
Images the flame
Systems in use at NASA Stennis
26
Type
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Passive
Avoid unnecessary
confinement
Natural ventilation
Active
Active ventilation
Detection and
active ventilation
Passive
Flow restriction
27
Active
Detection and Isolation
Excess f low valve
H2 release
Confined
explosive
atmosphere
Passive
Explosion venting
Passive
Separation distance
Active
Emergency response
Strong blast
effects
Injury /
casualty
(Source: Air Liquide)
Passive
Flash fire
Separation distance
Active
Emergency response
Unconfined
explosive
atmosphere
Blast effects
Loss of
leak
tightness
Flame/
Jet fire
Equipment
failure
Kinetic
effects
Escalation
Passive
No ignition sources
Active
Detection and power
shut-down
Influence of ventilation in an enclosure:

by buoyant-dominated or momentum-dominated release in an enclosure with one opening  well-mixed regime

in an enclosure with two openings (on the lower and upper parts  a ventilation mode called displacement
ventilation takes place in the volume.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
 Safety objectives (frequency limit for feared event) are translated into practical design
objectives:
28




For expectable leaks, there should be no damage.
For foreseeable leaks, there should be no possible material damage.
For conceivable leaks, mitigation actions should be taken to avoid destruction of the
system. The formation of a flammable atmosphere can be allowed as long as the
destruction of the system or hazardous effects outside of the system are avoided. In this
objective, the hydrogen concentration should be limited to a determined value.
No design objectives are set for unlikely feared leaks. There is no specific measure other
than prevention (material choice...) and for emergency responses.
 To prevent the formation of flammable mixtures and hence meet the safety objectives,
effective ventilation of enclosed spaces should be provided. Several ventilation
configurations exist: one opening, two openings. Enclosures with two openings
allow for better ventilation than enclosures with one opening.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
29
 An enclosed area where hydrogen may be released should be
ventilated by openings, in order to prevent the formation of an explosive
atmosphere.
 If possible, two openings at least should be provided: one in the upper
part of the enclosure, the other in the lower part – the latter conditions
are essential for effective natural ventilation.
 Distribution of vents on different sides would help to decrease
concentration in an enclosure independent on wind direction.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
30
Ventilation
Qv
xV
z
V
H2 release
QS
Air inlet
Qv - QS
A forced ventilation system can be
included in a hydrogen system, if the
natural ventilation is not sufficient or not
reliable.
Two openings are present:
On the upper part of the enclosure, a
ventilation system extracts air at the
ventilation flow rate Qv. This induces a
depressurization in the enclosure, which
makes air come into the system through
the opening on the lower part of the
system.
(Source: Air Liquide)
In this model, the volume below the leak
point does not contain any hydrogen.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
31
 Venting systems are used to pipe outdoors hydrogen flows from
vents and safety relief equipment. Hydrogen should be piped to a
safe location, where it will not generate any hazard for persons or
neighboring structures.
 The design of hydrogen vent stacks should take into account these
three main risks:



The risk of explosion due to the delayed ignition of the explosive hydrogen/air
mixture out of the vent stack.
The risk of thermal radiation generated by the jet fire (the flame out of the vent
stack).
The risk of Deflagration to Detonation Transmission (DDT) inside the stack at the
beginning of the venting.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
32






Conditions on the vent outlet location: Explosion venting shall be provided in exterior walls or
roof only. The vent outlet location should be such that the vent may be used without any
limitations and without creating hazardous conditions for operation, maintenance and
emergency responses. The vent outlet should be away from personnel areas, from electrical
lines and from other ignition sources, air intakes, building openings and overhangs.
The vent outlet location should be such that given limits on maximum hydrogen concentration,
on maximum thermal radiation and on maximum overpressure effects are not exceeded under
any foreseeable venting situation.
The maximum pressure drop resulting from the sum of design flows of all the vent devices
discharging into the common vent system should not exceed 10% of the lowest set pressure of
all the relief valves collected.
The vent piping diameter should not be smaller than the diameter of any pressure-relief valve
outlet, and large enough to avoid exceeding the maximum allowable pressure drop previously
specified.
Design pressure should be such that the stack should withstand the overpressure generated
by an eventual detonation (in the cases where a Deflagration to Detonation Transmission would
occur).
Cryogenic and non-cryogenic hydrogen should be vented through distinct venting systems.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Passive
Avoid unnecessary
conf inement
Natural ventilation
Active
Active ventilation
Detection and active
ventilation
Passive
33
Flow restriction
Active
Confined
explosive
atmosphere
Passive
Explosion venting
Active
Emergency
Strong blast
effects

response
Injury /
casualty
Passive
Flash fire
Detection and Isolation
Excess f low valve
H2 release
Passive
Separation distance
Separation distance
Active
Emergency
response
Unconfined
explosive
atmosphere
Blast effects
Loss of
leak
tightness
Flame/
Jet fire
Equipment
failure
Kinetic
effects
Escalation
Passive
No ignition sources
Safety distances are
a generic means for
mitigating the effect
of a foreseeable
incident and
preventing a minor
incident escalating
into a larger incident.
It can be in principle
applied to any facility
using gaseous
hydrogen.
Active
Detection and power
shut-down
(Source: Air Liquide)
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
Distance in meters
Passive hydrogen systems
Category 1
(SP <= 55 MPa)
Safety distances (m)
Exposures or Sources of hazard
Cat. 3
(Q > 100 kg)
VS
S
C
VS
S
C
S
C
1,5
4,0
6,0
2,0
5,0
8,0
7,0
10,0
Occupied buildings - bay-windows*
-
5,0
8,0
-
7,0
12,0
9,0
15,0
Unoccupied buildings - openable openings and air intakes
-
2,0
3,0
-
3,0
5,0
4,0
5,0
Buildings of combustible material
1,5
3,0
5,0
2,0
4,0
7,0
8,0
8,0
Flammable liquids above ground <= 4000 L
1,0
2,0
3,0
-
2,5
4,0
8,0
8,0
Flammable liquids above ground > 4000 L
1,5
3,0
5,0
2,0
4,0
7,0
8,0
8,0
5,0
5,0
Occupied buildings - openable openings and air intakes
34
Category 2
(55 < SP <= 110 MPa)
Underground flammable liquid storage - vents and fill openings
3,0
-
3,0
-
Stocks of combustible material
1,0
2,0
3,0
-
2,5
4,0
8,0
8,0
Flammable gas storage above ground > 500 Nm3
1,0
2,0
3,0
-
2,5
4,0
8,0
8,0
Facility lot line
-
2,0
3,0
-
3,0
5,0
4,0
5,0
Areas not subjected to restrictions of activity
-
2,0
3,0
-
3,0
5,0
4,0
5,0
Pedestrian and vehicle low-speed passage ways
-
2,0
3,0
-
3,0
5,0
4,0
5,0
High voltage lines and trolley or train power line
-
5,0
-
5,0
10,0
Other overhead power lines
-
5,0
-
5,0
5,0
Roadways
-
5,0
-
5,0
5,0
* non-re-enforced to withstand overpressure effects
Complexity of system: VS: Very simple S: Simple
(Source: Air Liquide)
C: Complex
Note: safety distances are not intended to provide protection against catastrophic events or major
releases. This is to be achieved by other means such as prevention, specific means of mitigation, or
emergency response, which standards also need to address.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
35
Storage classification for determination of clearance distances
(Source: Air Liquide)
100
2
55
y
tit
an
qu kg
ed 0
or > 10
St
Service pressure (MPa)
P > 55 Mpa
P <= 55 MPa
1
3
1k
g
10
100
1000
3000
10000
100000
Water volume (L)
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
The basic steps of the construction of a safety distance are listed hereafter:

Key system characteristics or parameters that determine actual risk impact are selected.
For fuelling stations the following principles were adopted:
Separation distances should not be determined only by pressure and internal diameter.
They need to integrate fundamental factors such as storage system size, operating
pressure (for small systems only), system complexity (reflected by the number of
components of the system), and exposure criticality (high in locations where there is a
risk of affecting many people at once).
Through the application of this categorization scheme, system categories associated to a
graduation of risk impact are defined. Systems belonging to the same category can be
considered to have a roughly similar risk impact, and, therefore, a single set of separation
distance requirements can apply to these. Boundaries can be defined according to
equipment types in use.
For smaller hydrogen installations the classification below based on the quantity of stored
hydrogen in the system, its power and its maximal operating pressure, was adopted in the
French standard NF M58-003.
36




© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
37
Max. operating pressure
Power and mass of
stored hydrogen
< 5 bar
< 50 bar
>50 bar
>500 bar
P < 30 kW and M < 8kg
AA
A
B
C
P < 70 kW and M < 35kg
A
B
C
D
P > 70 kW and M > 35 kg
C
C
D
D
(Source: French standard NF M58-003)
Class of the system
Leak flow rate (g/s)
AA
A
B
C
D
Expectable
0,075
0,24
0,53
0,95
1,48
Foreseeable
0,75
2,23
5,02
8,93
13,95
 Safety distances are defined, depending on the class of the system (AA, A, B, C or
D) and on the potential targets (opening of the ventilation of a building, etc).
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
38

For each system category, a risk model is used to determine the separation distances, by
application of a criterion on estimated residual risk.

The function providing the cumulated frequency of having a leak greater than a given
size. See in the next section how the whole system leak frequency distribution can be
determined, in function of components leak frequency distribution.

The model also includes an evaluation of the conditional probability that the leak will
produce the feared consequences on exposed objects, assuming they are close enough to
be impacted. This probability depends on the probability that the leak will generate
dangerous phenomena (probability of ignition), the probability that the phenomena will
impact the exposure (geometric factor) as well as the probability that the phenomena (flash
fire, fire, overpressure) will have the feared effect on the exposure.

The consequence model enables the estimation of the distance at which a leak of a given
size can produce the feared effects if all the conditions for these effects to materialize are
present (e.g. ignition, jet in the right direction…).

A residual risk criteria is defined for the exposure considered, translated into a frequency
limit. Target value for the feared event frequency is set at 10-5 /yr for non-critical exposure,
and 4 10-6/yr for critical exposure.
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
occ./yr
Separation distance
To be applied
10
3
30
Leaks
Frequency
39
10-1
1
Separation
distance (m)
Cumulated frequency
of feared effects from leaks greater than X g/s
10-2
10-3
10-4
Feared
Effect
Target
10-5
The risk model does
not provide an
accurate evaluation of
risk, but allows taking
into consideration the
main risk factors
consistently.
10-6
0,01
0,1
1
10
100
Leak rate
(g/s)
Reference
leak size
(Source: Air Liquide)
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)
40
 A possible mitigation strategy to reduce exposure to hydrogen hazards is to build
protective barriers (walls). These protective barriers can be used to reduce the
extent of unacceptable consequences in hydrogen energy applications.
 Walls protect from thermal effects in some configurations, but in some other
configurations, walls create additional hazards:





a jet flame can turn back toward the jet source, resulting in an additional hazard
the presence of a barrier induces a higher heat flux front side the barrier and a lower heat
flux behind the barrier.
walls protect people and structures from overpressure effects in a reduced pressure region
behind the wall. On the other hand, it also induces a higher overpressure front side the
barrier.
walls contribute to the formation of a confined atmosphere, and prevent the system from
being easily accessible.
Walls are a protective mitigation strategy which should not be used systematically as they
can simultaneously protect people and structure right behind the wall, but can also create
additional hazards
© HyFacts Project 2013
Funded by FCH JU (Grant agreement No. 256823)