United States
Environmental Protection
Agency
\
Safety and Secur ty Analysi
Investigative Report by
NASA on Proposed EPA
Hydrogen-Po^
Fueling
-------
EPA420-R-04-016
October 2004
Safety and Security Analysis:
Investigative Report by NASA on Proposed
EPA Hydrogen-Powered Vehicle Fueling Station
Assessment and Standards Division
Office of Transportation and Air Quality
U.S. Environmental Protection Agency
NOTICE
This Technical Report does not necessarily represent final EPA decisions or positions.
It is intended to present technical analysis of issues using data that are currently available.
The purpose in the release of such reports is to facilitate an exchange of
technical information and to inform the public of technical developments.
-------
With the exception of minor changes, this Report is identical to National Aeronautics and
Space Administration Report No. WSTF-IR-0184-001-03, titled "Environmental Protection
Agency Hazard Analysis Report" and prepared for EPA by Stephen Woods, Harold Beeson, and
Harry Johnson of NASA Johnson Space Center White Sands Test Facility, Las Cruces, NM,
(September 19, 2003). The Report was prepared under Interagency Agreement No. DW809 39
802-01-0
PREFACE
EPA's Office of Transportation and Air Quality commissioned NASA (National Aeronautics and
Space Administration) to prepare this technical report in support of the Agency's hydrogen and
fuel cell program. EPA's program is a part of the federal government's efforts to encourage the
development and testing of new technologies that may define a path toward an international
hydrogen economy. A key component of the EPA program is a unique partnership with
DaimlerChrysler and UPS that is placing fuel cell powered package delivery vehicles into normal
commercial service in the region surrounding EPA's National Vehicle and Fuel Emissions
Laboratory in Ann Arbor, Michigan. EPA is installing a state of the art hydrogen vehicle fueling
station at its laboratory that will provide the hydrogen fuel for the fuel cell delivery vehicles and
for other hydrogen vehicles that may be operated in Southeast Michigan.
Because of the newness of hydrogen as a fuel and because this is the first hydrogen fueling
station to be installed at a federal facility, it was necessary to very carefully consider each aspect
of this project for a number of factors, including safety and security. NASA has extensive
experience with the handling and use of hydrogen, and EPA commissioned NASA to address a
wide range of issues relating to system safety, security, and siting. This report identifies issues,
discusses them, and makes recommendations. EPA has incorporated essentially all of NASA's
recommendations in the siting and design of our hydrogen fueling station.
While this report focuses on a specific type of hydrogen fueling station at a specific location, we
recognized at the onset that issues applying to the NVFEL setting and facility are much the same
as those applying to other federal and private facilities. Thus, this report is designed to be of
sufficient scope to have broad applicability, and we believe that the information NASA has
assembled and the analysis they have performed will be of interest to others considering working
with hydrogen as a fuel. The report will be particularly useful to parties proposing to site such
fueling stations in close proximity to commercial or residential property or as a part of federal
facilities.
This report represents a significant initial component of a larger comprehensive body of materials
that EPA expects to compile and distribute documenting our experience with hydrogen fueling
infrastructure and the use of hydrogen. Readers will find additional information on EPA's
hydrogen and fuel cell program at www.epa.gov/fuelcell.
-------
Executive Summary
This report addresses primary safety and siting issues associated with the installation of cryogenic
liquid and high-pressure gaseous hydrogen systems in proximity to a laboratory facility,
commercial facilities, a shopping mall, and public thoroughfares.
The U.S. Environmental Protection Agency (EPA) National Vehicle and Fuel Emissions
Laboratory (NVFEL), located in Ann Arbor, Michigan, tests experimental and state-of-the-art
vehicles for emissions and fuel economy. Preparations for a program to evaluate a
hydrogen-powered medium-duty delivery truck and other hydrogen-powered vehicles
necessitate the construction of a vehicle-fueling facility able to dispense up to 40 kg of hydrogen
per day. The bulk of the hydrogen (1500 gal) is to be stored in a conventional pressurized
cryogenic tank designed to American Society of Mechanical Engineers standards. The hydrogen
vehicle fuel is to be dispensed as a gas at ambient temperatures into 5000-psi vehicle fuel tanks.
This facility must coexist safely with existing hazardous materials and operations at NVFEL, and
must not pose unacceptable hazards to nearby commercial concerns.
Facility siting locations and hazards for the proposed design were evaluated according to
aerospace and commercial practice by specialists from the NASA White Sands Test Facility. An
important design consideration for a potentially hazardous facility is the selection of the facility
location. Although there is a low probability for a catastrophic occurrence, selecting a site that
will minimize the effects of such an event is prudent. This document summarizes the potential for
catastrophic hazards arising from the operation of the EPA proposed hydrogen dispensing station
on the EPA site.
Categories of causes and severity were established for equipment failure, operational error, and
the effects of attack or sabotage under weather conditions expected in Michigan. Three regions
with separate safety implications were identified, as follows, to best mitigate the identified
hazards:
1. The region in the immediate vicinity of the equipment should be secure and exclude all but
maintenance personnel, to protect personnel from small leaks.
2. An exclusion zone in the immediate area of the facility, as by defined according to the
National Fire Protection Association (NFPA) SOB, can be adopted to provide protection
against unplanned minor releases of hydrogen and shrapnel. This exclusion zone requires 75
ft of separation. Personnel within the NFPA exclusion zone will typically be fuel suppliers,
maintenance workers, or dispenser operators who are specifically trained to use the
dispensing system equipment. General personnel and the public are not under this category.
3. An additional margin, as large as 175 ft for the 1500-gal quantities planned, is necessary to
protect against a large, potentially catastrophic release of hydrogen, despite its unlikely
ocurrence.
For the purposes of this study, a catastrophic event is one that has the potential to extensively
threaten facilities, general personnel, or the public beyond the immediate area of the dispensing
station. While there are many ways the dispensing system might fail or be assaulted, only failures
or assaults that can release a large portion of the stored liquid hydrogen, or assaults that
11
-------
completely sever pieces of the high pressure system, stand to present a threat beyond the NFPA
exclusion zone.
The planned hydrogen dispensing system will store approximately 1500 gal of liquid hydrogen
and possess three high-pressure gas cylinder assemblies, each with approximately 18 ft3 of 6000-
psi hydrogen for "ready" dispensing to vehicles. The WSTF analysis has identified two general
scenarios for catastrophic events:
1. Any component failure or attack/sabotage which leads to a spill of a significant portion of the
liquid hydrogen storage
2. Violent attack/sabotage capable of completely severing pieces from the high-pressure
assemblies
Summaries for assessment of the two scenarios are provided in the following paragraphs:
First Scenario
Assessment for the first scenario was for spills of 1500 gal1, a worst-case event, under various
weather conditions. In general, the spilled liquid hydrogen, a cryogenic liquid, rapidly vaporizes
and mixes with air, forming a flammable mixture. Initially, the mixture stays on the ground with
the cold hydrogen vapors that are denser than air; but as the hydrogen warms, the mixture
becomes buoyant and soon rises. The potential for a catastrophic scenario can arise if the
flammable mixture impinges upon public spaces and surrounding structures. Weather conditions
that would contribute to hazards beyond the NFPA exclusion zone include wind conditions near
8 mph or greater. Under these circumstances, the flammable mixtures can be borne beyond the
NFPA 75-ft exclusion zone. Analysis based on WSTF liquid hydrogen spill data and combined
with TRACE TM2, an industrial code for the evaluation of the movement of flammable mixtures,
shows flammable mixtures will likely rise 30 ft or more over the nearest surrounding structures.
The closest approach of flammable mixtures to structures was found for wind velocities near 8
mph. The primary hazard is for ignition of the plume and an ensuing flash fire out in the open.
The amount of thermal radiation could burn exposed personnel caught between the NFPA
exclusion zone and adjacent structures, but is unlikely to set structures on fire or threaten the
general public beyond the structures. This threat is short term and will last only several minutes
while the cloud passes overhead. Without ignition, the further rise of flammable cloud and its
continued dispersion will lead to dissipation of the hazard.
A variety of conditions were evaluated and found not to lead to catastrophic scenarios. Low
wind speeds (4 mph or less) and low outdoor temperatures result in rapid rise of the flammable
mixtures. High wind speeds dissipate the hydrogen rapidly. While some portions of the
flammable clouds will possess mixtures with hydrogen-air concentrations that are detonable, the
large energies necessary to initiate detonation are not available after the mixtures form. The
hydrogen dispenser is sited away from buildings and constructed without confining surfaces or
walls. Should a combustible cloud form and be ignited, the resulting deflagration will not
produce significant overpressures or accelerate into a detonation. Moreover, if the hydrogen
dispensing system were breached, the likely outcome would be a fire located within the NFPA
exclusion area. This in itself will prevent a catastrophic situation from developing.
Analysis was performed for 1500-gal quantities of liquid hydrogen. Recent communications with Air Products
system designers indicate that the tank that is actually installed may have a slightly larger capacity, but the fill point
may be set to less than 1500 gal of liquid hydrogen.
TRACEiM (Toxic Release Analysis of Chemical Emissions) SAFER Systems, L.L.C., Camarillo, California.
Ill
-------
Second Scenario
Should an explosive charge strike the pressure assembly in such a way that a cylinder is
simultaneously freed from the assembly and opened on an end, analysis indicates the component
could move with sufficient velocity to clear the NFPA exclusion zone and pose lethal danger to
everything in its path.
This is a theoretical result obtained using the PVHAZARD code.3 It requires precise application
of an explosive force. The high-pressure portions of the system are built to ASME specifications
and are fairly tough and not likely to be severed easily; therefore, this is a highly unlikely
outcome. Small pieces of shrapnel confined to the NFPA exclusion zone are the most likely
result.
Conclusions and Recommendations
In summary, the primary catastrophic hazard is a large release of liquid hydrogen that forms a
large flammable cloud. The cloud can extend over the surrounding facilities and, if ignited, could
expose the surroundings to a flash-fire threat. Analysis shows that the cloud is likely to rise above
the surrounding facilities and harmlessly dissipate. The WSTF report evaluates the potential
outcomes that arise from the release of hydrogen. No attempt is made to numerically determine
risk. It was determined that the best course is to promote the hydrogen to rise as quickly as
possible. An infrastructure incorporating a spill pond with gravel and a vapor barrier is
recommended.
Safety information and training must be coordinated as necessary with NVFEL personnel, non-
NVFEL personnel that may work in proximity to the dispensing system, the Fire Marshall and
first responders, and local authorities.
With these precautions observed, the analysis supports the contention that the hydrogen hazards
accompanying the operation of a hydrogen dispensing station would not pose a risk greater than
the materials and operations already present at NVFEL.
The PVHAZARD Pressure Vessel Hazard Assessment Software was sponsored by the Air Force (45th Space Wing,
PAFB) and NASA, with contributions by General Physics Corporation, ACTA, Inc., and Aerospace Corporation.
IV
-------
Abstract
This report addresses primary safety and siting issues associated with the installation of
cryogenic liquid and high-pressure gaseous hydrogen systems in proximity to a laboratory
facility, commercial facilities, a shopping mall, and public thoroughfares. The US Environmental
Protection Agency National Vehicle and Fuel Emissions Laboratory (NVFEL), located in Ann
Arbor, Michigan, tests experimental and state-of-the-art vehicles for emissions and fuel economy.
Preparations for a program to evaluate a hydrogen-powered medium-duty delivery truck and
other hydrogen vehicles necessitate the construction of a vehicle-fueling facility able to dispense
up to 40 kg of hydrogen per day. The bulk of the hydrogen (1500 gal) is to be stored in a
conventional pressurized cryogenic tank designed to American Society of Mechanical Engineers
standards. The hydrogen vehicle fuel is to be dispensed as a gas at ambient temperatures into
5000-psi vehicle fuel tanks. This facility must coexist safely with existing hazardous materials
and operations at NVFEL, and must not pose unacceptable hazards to nearby commercial
concerns.
Facility siting locations and hazards for the proposed design were evaluated according to
aerospace and commercial practice by specialists from the NASA White Sands Test Facility.
Categories of causes and severity were established for equipment failure, operational error, and
the effects of attack or sabotage under weather conditions expected in Michigan. Three regions
with separate safety implications were identified, as follows, to best mitigate the identified
hazards:
1. The region in the immediate vicinity of the equipment should be secure and exclude all but
maintenance personnel, to protect personnel from small leaks.
2. An exclusion zone, as specified by NFPA SOB, can be adopted to provide protection against
unplanned minor releases of hydrogen and shrapnel.
3. An additional margin, as large as 175 feet for the 1500-gal quantities planned, is necessary to
protect against a large release of hydrogen, despite its unlikely occurrence. The primary threat
from such an event is a flash fire. The best course is to promote the hydrogen to rise as
quickly as possible. An infrastructure incorporating a spill pond with gravel and a vapor
barrier is recommended.
Safety information and training must be coordinated as necessary with NVFEL personnel, non-
NVFEL personnel that may work in proximity to the dispensing system, the Fire Marshall and
first responders, and local authorities.
With these precautions observed, the analysis supports the contention that the hydrogen hazards
accompanying the operation of a hydrogen dispensing station would not pose a risk greater than
the materials and operations already present at NVFEL.
-------
Contents
Section Page
Executive Summary ii
Abstract v
Abbreviations vii
1.0 Introduction l
1.1 Background 1
1.2 Scope 1
2.0 Study of Failure Scenarios 3
2.1 Analysis Approach 3
2.2 Categorization of Hazard Zones 3
2.3 Analysis of Hazards 3
2.4 Analysis of Released Hydrogen 11
3.0 Conceptual Siting Design 19
3.1 General Requirements Review 19
3.2 Code Requirements Review 19
3.3 Siting Review 21
4.0 Conclusions and Recommendations 22
References 23
Bibliography 25
VI
-------
Abbreviations
ASME American Society of Mechanical Engineers
APCI Air Products and Chemicals, Inc.
BLEVE Boiling Liquid Expanding Vapor Explosion
CGA Compressed Gas Association
DoD US Department of Defense
EPA US Environmental Protection Agency
GH2 Gaseous Hydrogen (pressurized)
LH2 Liquid Hydrogen (cryogenic)
MIE Minimum Ignition Energy
mJ MilliJoule
NFPA National Fire Protection Association
NVFEL National Vehicle and Fuel Emissions Laboratory
OSHA Occupational Safety and Health Administration
PPE Personal Protective Equipment
TRACEiM Toxic Release Analysis of Chemical Emissions
WSTF White Sands Test Facility
vn
-------
1.0 Introduction
The United States Environmental Protection Agency (EPA) National Vehicle and Fuel Emissions
Laboratory (NVFEL) located in Ann Arbor, Michigan, is developing the means to demonstrate
and test hydrogen-powered vehicles. A hydrogen-powered vehicle fueling station is planned for
operation in 2004. However, on-site storage of cryogenic liquid and high-pressure gaseous
hydrogen presents serious technical, safety, and security challenges that must be addressed before
actual work on the project can begin. The station, located on the NVFEL facility, will have
neighboring industry laboratories and commercial concerns and will be in proximity to public
thoroughfares. Safety issues in the handling and storage of hydrogen, as well as the consequences
of terrorist attack, must be examined. NVFEL requested engineering support services from
NASA White Sands Test Facility (NASA WSTF) to evaluate safety issues for the planned
hydrogen dispensing station.
1.1 Background
The EPA NVFEL in Ann Arbor tests experimental and state-of-the-art vehicles for emissions and
fuel economy. Recent developments in fuel cell technology have required an expansion of test
capabilities to include fueling and testing of new hydrogen-powered vehicles. Preparations for a
new hydrogen-powered, medium-duty delivery truck test program necessitate the construction of
a vehicle-fueling site capable of dispensing up to 40 kg of hydrogen per day. The bulk of the
hydrogen will be stored as liquid in a pressurized cryogenic tank holding approximately
1500 gal, or 60 fills. Hydrogen vehicle fuel will then be dispensed as a gas at ambient
temperatures into 5000-psi vehicle fuel tanks.
1.2 Scope
The work consisted of engineering services in support of the installation of a hydrogen-powered
vehicle fueling station at the NVFEL. The primary task was to develop siting plans and concept
design options based on 1500 gal of liquid storage and high-pressure cylinders for gas storage.
Review services were also required to assist EPA with proposed vendor layout and equipment
designs and with the resolution of any National Environmental Policy Act and permitting issues
that could arise in the planning process. EPA provided site drawings for the NVFEL and technical
specifications for the proposed equipment, as necessary.
Accomplishing the project objectives included multiple site visits for measurements, verification,
communication, training, analysis, and planning review. Engineering services included site
assessment, code review, detailed equipment and process hazard analyses, assault mode
identification, catastrophic failure characterization, and development of alternative mitigation
strategies.
NASA WSTF developed a draft siting and hazards analysis for the fueling station based on a
typical Air Products and Chemicals, Inc. (APCI) 1500-gal liquid hydrogen (LFfc) storage and
dispensing station, design developed for the California Fuel Cell Partnership. The draft analysis
incorporated the results of:
-------
o Preparatory work
o EPA facility site visit
o Review of code requirements
o Hazard analysis of component and operational failures
o Hazard analysis of catastrophic failures
NASA WSTF presented the draft report, along with the underlying safety and security analyses,
in a meeting with EPA engineering, safety and security personnel, APCI engineers, and other
EPA contracted technical consultants, at the NVFEL on June 10, 2003. The meeting served to
confirm a mutual understanding of the design requirements; educate EPA personnel on technical,
safety, and security risks; identify mitigation strategies for reducing risks; and facilitate
discussion of attendee questions and suggestions. The meeting results and subsequent NASA
WSTF collaboration in the development of the final site design was incorporated into this report.
-------
2.0 Study of Failure Scenarios
The potential consequences of a hydrogen release are directly related to factors inherent in the
environment, the rate of release, and the quantity released. The characteristics of the potential
consequences dictate where and how systems are sited. It should be noted that the cause of the
release, while important in understanding it occurred, may or may not have a bearing on the
potential consequences of the release.
2.1 Analysis Approach
First, three hazard zones are identified, categorized by potential consequences 1) within the
immediate enclosed area; 2) within a 75-ft exclusion zone; and 3) outside the NFPA 75-ft
exclusion zone. Any failure scenario that produces consequences that extend beyond the NFPA
exclusion zones can be considered catastrophic. The following analysis identifies three categories
of likely causes of hydrogen releases for the proposed hydrogen dispenser system: 1) component
failure; 2)operator error; and 3) deliberate sabotage or attack. The analysis then categorizes
potential consequences according to the extent of effects. The categories chosen match
operational requirements and applicable codes and regulations.
2.2 Categorization of Hazard Zones
The potential siting locations, types of hydrogen storage components, and layout of the hydrogen
system on the EPA facility property suggest three hazard zones categorized by potential
consequences. The first is defined by small leaks, hydrogen combustion, or controlled releases of
hydrogen confined within the chain-link fence isolating the system from unauthorized personnel.
This area is accessed only by authorized, specially trained personnel. The second hazard zone
includes scenarios with the potential for threat beyond the fencing but within the general locale of
the equipment. An exclusion zone of a 75-ft radius from storage equipment is required by NFPA
50A and 5 OB, and the functions of the storage components in the hydrogen system are applicable.
The third category represents the greatest threats that come from events with effects that reach to
the buildings and beyond. Any failure scenario that produces consequences that extend beyond
the NFPA exclusion zones can be considered catastrophic.
This analysis does not quantitatively assess the ability of attacks or explosives to inflict damage
or of the equipment to resist damage. The degree of component or equipment failure is simply
assumed, the effects of high pressure are noted, the amount of hydrogen released is estimated, and
the potential effects of hydrogen combustion are evaluated. These are the factors assessed to
determine consequences.
2.3 Analysis of Hazards
Hazards may arise from component failure, from operational mistakes, and through sabotage or
attack. Discussion of each of these potential causes for hydrogen release is given separately.
Code analysis of hydrogen dispersion, mixing, and combustion is deferred until Section 2.4.
-------
2.3.1 Hydrogen Release Hazards Caused by Component Failures
The hydrogen dispensing system design proposed by APCI is to provide up to 40 kg/day of high
pressure gas derived from cryogenic LH2 storage. No attempt is made in this report to describe the
design or operation of the system, except that the system includes an approximate 1500-gal LH2
storage tank, a pressurizing system with 6500-psi storage, and a dispensing system. The proposed
system components have been examined for failures that would lead to significant releases of
hydrogen. The evaluation includes the most probable occurrences of concern, low probability
events with severe consequences, and venting rates.
2.3.1.1 Component Analysis Methodology
The hydrogen fueling station was analyzed for component failure and resultant hydrogen release.
Major components identified in the main flow path of hydrogen are included in the analysis.
Minor components and instrumentation discussed in the following paragraphs are categorized by
subsystem.
2.3.1.2 Analysis of Release by Subsystem
Analysis is considered by subsystem.
Liquid Storage and Vaporizer
Three categories of potential release are noted in the data received from APCI:
o Small leaks at connections much less than 1 fts/min of hydrogen
o Medium leaks at connections and valve stems around 1 to 10 ftVmin
o Large leaks from catastrophic failure of component.
Small leaks at connections are common and may occur at any of the piping connections.
Initially, the leak test required by American Society of Mechanical Engineers (ASME) B31.3
should catch any connection leakage, and regular leak checks at maintenance intervals should
detect leaks early. Small connection leaks are considered the most plausible under normal
conditions, and they would release very small quantities of hydrogen.
Medium-sized leaks from the fill connection, manual valve stems, and liquid vaporizer tubing are
possible but are mitigated. Leaks at cryogenic liquid-fill connections are common. The estimated
leak rate of less than 5 ftVmin would continue until the operator stopped the operation and fixed
the leak. The extended stem on cryogenic liquid valves greatly reduces the chance of stem
leakage, but it still may occur over time due to valve cycling. Initially, the leak test required by
ASME B31.3 will catch any stem leakage. Regular leak checks at maintenance intervals should
detect leaks early.
Large leaks from catastrophic failure of the storage vessel, the liquid isolation valve, and
components such as the liquid strainer and pressure-building regulator are very unlikely without
outside forces acting on the component. Piping components purchased and installed per
ASME B31.3 are rated for the environment (pressure and temperature) they will experience. If
-------
any of the components in this category were to fail catastrophically, the maximum potential
release would be the entire contents of the liquid storage vessel.
Compressor System
Based on the input from APCI, component failures in the compressor system, including the gas
purifier assembly can be grouped into two categories: a very small leak rate (less than
1 ft3/min); or a medium leak rate (less than 5 ftVmin).
A system leak at a connection is much more likely than one caused by a major failure, and it
would result in the release of very small quantities of hydrogen.
Leaks at the connections of the compressors and inter-coolers, or those caused by major failure of
the separators and purifier might have a 5 ftVmin leak develop. The leak would vent until a sensor
closes a supply valve. This large of a leak is possible but unlikely with system leak checks.
Gas Storage and Filling Station
Component failures in the gas storage and filling station areas can also be grouped into two
categories based on the APCI data: small leaks, and leaks that would vent one bank of the storage
cylinders. Small gas leaks at valve stems or connectors are more likely and would result in the
release of very small quantities of hydrogen.
The breakaway fitting seems to be a special case, but it is handled by various safety controls. If
the system works as designed, it seems unlikely that a large release would follow a breakaway
fitting failure.
If the cylinders or the valves attached to either end fail, then one bank of cylinders (13 kg of gas)
would be released. Since the vessels are built to ASME standards and the valves are purchased
and installed per ASME B31.3, this is very unlikely under normal operating conditions.
2.3.1.3 Implications for Release Caused by Component Failure
Not surprisingly, since the system is per ASME standards, the most likely event under normal
operating conditions is that of small leaks at connections.4 Regulators, check valves, the
37-degree flare, the current-to-pressure controller, and the nozzle are also identified as
components that may be expected to leak during the planned period of system performance. The
LH2 vessel and the pressure vessels have a very low probability of failure. With the exception of
the nozzle, all the components in question are only approached by the vendor's maintenance
personnel. Large releases caused by the failure of system components are considered unlikely; but
should they occur, the consequences are explored in Section 2.4.
2.3.2 Hydrogen Release Hazards Caused by Operation-Induced Failure
System operations involving personnel and the potential effects of operations unrelated to
hydrogen dispensing were examined for actions that would lead to significant releases of
4
Small leaks at connections are common, although unwanted. Depending on the kind of leak check that is performed
on a regular basis, these leaks may be found and corrected. A decay lead check may not be sensitive enough to detect
this small of a leak. A portable hydrogen sensor or "bubble" test with a soap film fluid may be more likely to detect the
leak.
-------
hydrogen. These operations include maintenance activities, hydrogen loading operations,
dispensing activities, trespassing, emergency procedures, and accidents involving other EPA
operations. It is well known that human error overshadows equipment failure as the predominant
cause of hydrogen incidents.
2.3.2.1 Discussion
A discussion of maintenance, filling operations, dispensing, trespassing, emergency procedures,
and potential accidents involving other EPA operations is given in the following paragraphs.
Maintenance
Maintenance and repair operations on the hydrogen system are only conducted by vendor-trained
technicians. Standard procedures for repairs involving hydrogen-wetted components require
purging of the hydrogen before personnel start repairs and, if necessary, purging the air before
hydrogen is again introduced to the system. Operations are performed with several personnel on
hand using the "buddy system," appropriate personal protective equipment (PPE), and hydrogen
detectors. Emergency shut-off switches are conveniently located. Only small hydrogen releases
are expected from maintenance operations.
Filling Operations
Supply of hydrogen to the dispensing system is performed by trained vendor crews. Operations
will be coordinated in advance with EPA facility receiving staff, and the vendor crews will use
the "buddy system" during the refueling operation. Barriers protect the LH2 storage tank and
system from collision by the hydrogen tanker truck or other vehicles. Both the hydrogen
dispensing station and the refueling truck possess automatic shutoff equipment, in case
connecting lines fail or disconnect. Hydrogen gas lost during chill-down of system components
during refueling is vented in a controlled manner. Only small hydrogen releases are expected
from refueling operations.
Dispensing
Training is required for vehicle operators who refuel the hydrogen-powered vehicles. The
hydrogen dispensing system requires a security password, and fuel nozzle interconnects must be
electronically verified before hydrogen fueling can commence. The dispensing system is designed
for breakaway and automatic shutdown should a driver inadvertently drive away with the nozzle
connected to the vehicle. Only small hydrogen releases can result.
Trespassing
Trespassing and vandalism are mitigated by EPA area security and system location. Housing of
the liquid and high-pressure gas handling portions of the system is behind a locked security fence.
The controls described under dispensing also serve to protect the system against unauthorized use
and manually inflicted damage. Only small hydrogen releases are expected to result from
intruders who are just curious or bent on minor vandalism.
-------
Emergency procedures
Emergency procedures for system failure modes and for EPA personnel response are not yet
available for review. General system shutdown switches will be provided in accessible locations,
both remote from and at the hydrogen dispensing station. The vendor will control what specific
responses are taken to mitigate failure modes. The vendor's actions to mitigate an emergency
should be carefully reviewed in advance of fuel-dispensing operations by the EPA. The EPA
should also establish facility-wide emergency procedures in response to potentially catastrophic
occurrences. Errors in judgement handling emergency situations, combined with malfunctioning
instrumentation, although very rare, have led to catastrophic failures of hydrogen vessels in the
past (Edeskuty and Stewart 1996). Depending on the circumstances, a large hydrogen release
could occur.
Accidents Involving Other EPA Operations
Operation of heavy vehicles, fuel tankers, and other activities that could threaten the hydrogen
dispensing station should be carefully reviewed and controlled. Failure of the barricades that
protect the hydrogen dispensing station from vehicles could result in a large release of hydrogen.
The circumstances surrounding the release of hydrogen from a vehicle collision could be further
compounded should the colliding vehicle contain fuel, oxidizing materials, or hydrogen. EPA
will consider these factors in siting, design of barriers, and in planning other operations.
2.3.2.2 Implications for Release Caused by an Error in Operations
The operation of the hydrogen dispensing station as a demonstration system is planned to last
several years. For a project of this duration, it is realistic to expect that, from all the operations
considered above, a small leak is likely to occur. A small release of hydrogen poses a safety
hazard in the immediate area of the leak. A catastrophic leak of hydrogen resulting from
operations is very unlikely with this system; however, consequences and considerations for
catastrophic leaks are presented in the sections that consider catastrophic releases Section 2.4.
2.3.3 Hydrogen Release Hazards Caused by Sabotage or Attack
Sabotage or attack differs from other scenarios in that there is a deliberate intent to make the
system fail in a violent manner. There are too many ways attack or sabotage can occur to consider
them individually. Therefore, the approach is to consider several likely means as examples and
group them by their potential consequences.
2.3.3.1 Small Penetration
Any action that causes a small penetration into a hydrogen system and leads to the unplanned
release of hydrogen is considered here. Examples would include rifle fire or the use of a large
crowbar to spear or shear the equipment. Consequences might include:
o Loss of vacuum in the vacuum annulus of the LH2 storage tank, which could lead to a large
heat leak and excessive venting of product through the relief system
o A jet of LH2 or cryogenic gaseous hydrogen (GH2) from the LH2 storage tank
o A jet of GH2 from connecting hardware
-------
o A jet of GH2 from the pressure bottles
o A jet of GH2 from the dispenser or fill line
Considerations can be separated for the cryogenic subsystem and the high-pressure components.
2.3.3.1.1 Cryogenic Vessel Subsystem
Two cases can be considered: penetration of the outer wall, or penetration of both the outer and
inner walls of the LH2 storage vessel.
Outer Wall
Breaching only the outer wall introduces air to the vacuum-jacketed region, but does not release
hydrogen from the inner vessel. The loss of vacuum and introduction of air will increase the heat
impinging on the inner vessel and cause an increase in the rate of GH2 boil-off from the vessel.
A larger heat leak caused by a bridge of frozen water or nitrogen is considered unlikely.5 The
vacuum annulus is filled, to a large extent, with thermal insulating material (pearlite or Mylar®6).
This material, given a penetration of the outer wall, would slow entry of air into the annulus and
significantly reduce the amount of air that can enter by displacing the available volume. Both of
these effects will limit the effect of the heat incursion to the immediate area of the penetration.
The relief system is specifically designed to safely vent hydrogen should vacuum be lost.
Penetration of Inner Wall
With both walls of the vessel breached, air and hydrogen can potentially meet at some point
external to the inner vessel. However, as noted above, the vacuum-jacketed space is filled with
pearlite or Mylar in sufficient quantities to displace most of the volume in which a hydrogen-air
mixture could form, leaving little to combust.7 The hydrogen within the inner vessel is under a
maximum working pressure of 150 psig and will exit in a plume or jet through the hole in the
outer vessel wall. Ignition of the hydrogen outside of the outer wall might lead to further heating
of the system on the outside vessel walls. Given the low emissivity of hydrogen-air reactions,
radiative heating is not a major concern. External regions with direct exposure to the hydrogen
combustion will experience high temperatures, but the ASME vessel design can withstand the
fire. Loss of pressure in the vacuum annulus or heating of the inner vessel if sufficiently extreme,
will lead to an emergency shutdown of the system. Should a fire result in an internal pressure rise
greater than the maximum allowable working pressure for the volume, the relief system will
protect against over-pressure (APCI Proposal).
2.3.3.1.2 Pressure Components
A penetration in a pressurized line, connection, or vessel will result in a high-pressure jet of
hydrogen that can impinge anywhere in the immediate vicinity of the system. Analysis by
Private communication. Walter Stewart's telephone conversation with S. Woods, May 2003.
6 Mylar* is a registered trademark of E.I. Du Pont de Nemours and Company, Wilmington, Delaware.
7 Eichelberger, D.P. APCI Proposal to US EPA RFQ #PR-CI-03-10315. Design, Installation, Operation, and
Hydrogen Supply of a Compressed Gaseous Hydrogen Refueling Station Using Delivered Liquid Hydrogen. Air
Products and Chemicals, Inc., Allentown, Pennsylvania, March 25, 2003.
-------
PVHAZARD shows the 0.75-in. ASME construction of the cylinder walls is likely to prevent
penetration by standard bullets. Smaller lines and fittings would be more difficult to specifically
target. However, should a component failure occur, TRACEiM8 analysis shows that, for a 0.25-in.
diameter penetration of a 6000-psi vessel, the flammable region of a plume will extend no more
than 9 m horizontally from the hole. This represents a worst-case scenario for both the driving
pressure of the plume and the direction of the plume.
2.3.3.1.3 Summary
Penetration in either the cryogenic or pressure subsystems will present a fire and/or pressure
release hazard to personnel, ancillary equipment, or vehicles in the immediate area of the
hydrogen dispensing system. The safety equipment incorporated into the hydrogen dispensing
system will preclude the further escalation of hazards such that the exclusion zones specified by
standards NFPA 50A and NFPA SOB are thought to be adequate. This reasoning applies to
equipment/component failure noted in the component analysis and failures caused by attack or
sabotage.
Additionally, it is noted that, in the opinion of those contributing to this report, the LH2 storage
tank, ASME pressure cylinders, and compressor sections are sufficiently tough to survive an
assault by direct rifle-fire.
2.3.3.2 Explosive Charge
This analysis examines the consequences of the release of hydrogen. Large explosive charges
with yields that far exceed the hazard posed by the hydrogen are not considered here since their
effects would be greater than that of the hydrogen inventory in the dispensing system. Therefore,
explosive-charges of interest might include a rocket-propelled grenade, plastic explosive, or
stick(s) of dynamite. The results are distinguished from the penetrations considered above by the
large size of the opening and attendant shrapnel.
2.3.3.2.1 Effect of Attack on the Liquid Hydrogen Vessel
High explosives can produce a large hole or rupture of the vessel, the worst case leading to a spill
of the entire contents. Ambient surface temperatures, regardless of season, are so high relative to
the temperature of liquid hydrogen that the spilled LH2 will flash to a gas on contact. Heating the
LH2to 300 K will result in an 845-times increase in the volume of the hydrogen. The process of
heating the liquid to a gas is rapid, with the air supplying much of the heat during mixing. The
resultant mixture behaves as a plume, subject to weather conditions. The results of this scenario
are characterized in Section 2.4.
2.3.3.2.2 Effect of Attack on the Pressure Components
The hydrogen dispensing system uses three gas storage modules, each with 12 high-pressure steel
cylinders in a 3- by 4-ft matrix. Each cylinder possesses 1.5 ft3 and in operation will hold
hydrogen at 6500-psig or, if released, approximately 22.2 m3 at 70 °F, 1 atmosphere.
Violent failure of pressure components presents several hazards possibilities:
' TRACEiM (Toxic Release Analysis of Chemical Emissions), SAFER Systems, L.L.C., Camarillo, California.
-------
o Shrapnel due to the explosive
o Shrapnel accelerated by the high-pressure gas
o Rocketing of components
o Shock waves
o Fireball
The design of the modules is such that certain cylinders, should they fail, will act as conduits for
the release of gas from all 12 cylinders. However, shrapnel from the failure of a cylinder will not
penetrate adjacent cylinders; hence, by itself, the violent failure of one cylinder is not likely to
cause a "cascade" failure of the other cylinders in the module. Therefore, the worst case is likely
to be the sudden release of gas from one cylinder, followed by a flow of hydrogen supplied from
all of the other 11 cylinders. Given the placement of the cylinders, other system equipment, and
the chain-link fence, small shrapnel will be dangerous only in the immediate vicinity of the
system.
Should an explosive act cleanly cut through a cylinder and simultaneously sever the cylinder from
its attachments to the module, the free piece will be propelled like a rocket by the compressed
hydrogen. This scenario is distinguished from small shrapnel and is extremely unlikely. The
cylinders are fabricated to ASME specifications and are unlikely to undergo brittle failure.
However, should this event occur, the horizontal orientation of the cylinders increases the risk for
injury and greater damage. In the vertical position, a downward trajectory is stopped by the
ground and upward trajectories with a small pitch will fall back to the ground near the system. It
is conceivable, given the horizontal orientation that a rocketing cylinder could impinge directly
on a sister storage module, and rupture another cylinder. The worst-case outcome in this scenario
would be a larger impulsive release (two cylinders), followed by gas flowing from the other 22
cylinders of both modules.
Any sudden release of a gas at 6500 psig will produce a shock wave that may be deadly to
personnel in close proximity. With any release of hydrogen, ignition is a possibility, so a fireball
of burning hydrogen may follow its release. The explosion may not be the ignition mechanism,
since it will act well before the hydrogen can form a flammable mixture with air.
2.3.3.3 Bonfire
A bonfire may possess sufficient fuel to heat the system beyond the point where the internal
hydrogen pressure trips the relief systems and vents. This could arise by an accident involving the
delivery of other fuels at the facility or by deliberate action.
The system design and ASME construction provide fail-safe operation under considerable heating
and provide redundant relief paths to allow hydrogen to be safely vented without rupture of the
vessel. Boiling liquid expanding vapor explosion (BLEVE) is theoretically possible if the
contents of the Lfktank are heated above the critical point causing a BLEVE, but this is not
considered a reasonable threat.
10
-------
2.3.3.4 Vehicle Collision
Deliberate efforts to use a vehicle collision might succeed in causing extensive damage to the
system. The vehicle barriers planned for this system are designed to prevent inadvertent contact
by a maneuvering vehicle. Acceleration of a large ground vehicle could overcome the barrier.
Impact from a small aircraft could also damage the system and release hydrogen. Either scenario,
or others like it, are likely to cause a release of all the hydrogen.
2.4 Analysis of Released Hydrogen
Hydrogen, with high levels of purity as found in storage systems, must mix with an oxidizer
before any hazardous reaction can take place. In terrestrial hydrogen systems, air provides the
greatest concern, whether hydrogen is released into the air, or air enters the hydrogen system.
One line of reasoning traditionally used to establish the degree of possible hazard is to determine
the greatest quantity of energetic material that can participate in an accident and determine the
range of its effects. This so-called quantity-distance evaluation assumes the energetic material is
premixed to provide a theoretically optimum release of energy, localized at a point, with a
manner of energy release similar to solid explosives. These assumptions seldom fit hydrogen
accident scenarios. Therefore, in the case of hydrogen, the key to a realistic evaluation of hazards
is to determine the following:
o How much of the released hydrogen can participate to form a combustible mixture
o The extent of formation of the combustible mixture
o The type of reaction (fire, deflagration, or detonation)
o The importance of environmental factors such as temperature, wind, and the effects of
confinement
A chemical dispersion code was used to evaluate dispersion of hydrogen from liquid spills and
gas jets. The code also was used to evaluate combustion of hydrogen-air clouds. A pressure code
helped to evaluate the release of hydrogen and shrapnel from pressurized components.
2.4.1 TRACE Computations for the Release of Hydrogen
Toxic Release Analysis of Chemical Emissions (TRACE) is a state-of-the-art chemical dispersion
analysis code maintained by Safer Systems, L.L.C. of Camarillo, California. The code computes
the effect of turbulent diffusion and meteorological conditions upon a chemical emission
according to the Pasquil model of atmospheric dispersion (Pasquil 1961), a model with wide
acceptance (Burgess et al. 1976). This model assumes Gaussian distribution vertically and
horizontally of a wind-borne gas entering the air from a localized source.
2.4.1.1 Liquid Hydrogen Spill Characteristics
A spill could involve the entire cryogenic inventory of the LH2 vessel (approximately 1500 gal).
A typical fill of the vessel would result in a saturation pressure of 60 psig. Given a large rupture,
the sudden exposure of the inventory to ambient pressure or 0 psig will instantly boil or "flash" a
significant portion of the liquid to cryogenic vapor. At 60 psig, 19 percent would flash, leaving
approximately 1200 gal to spill onto the ground.9
9
Farese, David (APCI). Private communication with Don Danyko (EPA), June 13, 2003.
11
-------
Several factors influence the characteristics of cryogenic spills. Liquid hydrogen boils at 20.3 K
under 1 atmosphere of pressure, so any surface at ambient temperatures will have sufficient heat
to vaporize the LH2. The amount of surface to which the spilled cryogen is exposed affects the
rate at which the liquid flashes to vapor and warms. The cross-sectional area of the liquid spill
determines the plume diameter or cross section. At hydrogen's boiling point, the cold hydrogen
vapor is heavier than air until it warms to 23 K, where it becomes neutrally buoyant. As the cold
vapors mix with air, the air is chilled below the dew point, causing condensation and forming a
visible cloud. After dwelling near the ground and warming sufficiently, the visible vapor cloud
forms a plume as it rises.
Time-lapse photographs of LH2 spills conducted at NASA WSTF in 1980 show the general
behavior of cryogenic hydrogen-air plumes (Witcofski, August 1981). For wind speeds ranging
from 1.6 to 6.3 m/s, the water vapor clouds traveled 50 to 100 m near the ground, then rose at a
rate of 0.5 to 1.0 m/s (Witcofski 1981).
2.4.1.2 Hydrogen-Air Cloud Flammability
Several points are of interest concerning the flammability of hydrogen-air mixtures within the
plumes formed by LH2 spills. From the information that follows, it was decided that 4, 8, and 18
percent-by-volume hydrogen in air would be useful levels of hydrogen to depict in TRACE
computations.
The flammability limits for hydrogen-air mixtures range between 4 and 75 percent-by-volume
hydrogen in air. These data are for combustion in the upward direction. It is the convention to
provide this information as representative of hydrogen's flammability limits. However, flame
fronts observed in hydrogen-air mixtures burn less readily when constrained to burn in a
horizontal direction, and even less so in a downward direction. The lower flammability limit for
downward propagation increases to 9 percent-by-volume hydrogen in air, as a direct effect of the
buoyancy of hydrogen (Benz 1988). In uniform mixtures with low hydrogen concentrations (4 to
9 percent-by-volume concentration), combustion of the entire volume of a mixture in an upward
direction is not complete. The combusted region tends to form a volume in the shape of a cone
that expands in the upward direction, but the mixture outside of the cone is left unburned
(Sherman et al. 1981). In general, the release of a large quantity of hydrogen forms a plume that
possesses an increasing concentration of hydrogen towards the centerline of the plume. Initially,
the central region of the plume may be above the upper flammability limit. In addition, the lower-
concentration, hydrogen-air mixtures require greater initiation energy to ignite. Flow and water
vapor will also result in greater initiation energy when compared to the same composition
mixture, but dry and without movement. This fact has importance in the context of a hydrogen
system located where it is desirable for any release of hydrogen to rise above and clear the tops of
nearby structures.
Therefore, as a plume of hydrogen rises, the exterior regions of the plume (the regions likely to
encounter an ignition source) are less likely to ignite when compared to near-stoichiometric
mixtures. Should ignition occur in an exterior region of the plume, only the gas in the immediate
vicinity of the ignition source will tend to burn and the potential for flame propagation or
deflagration throughout the cloud is reduced. Therefore, unless some process rapidly mixes the
hydrogen plume to form a near-stoichiometric mixture with air throughout the cloud, the normal
12
-------
factors that typically influence mixing (diffusion, buoyancy, wind, and turbulence) in a release
will not result in complete combustion of the plume.
The movement of flammable mixtures can be partially deduced by observing the movement of
the vapor cloud associated with a LH2 spill. From the work performed at WSTF, it was
determined that the concentration of hydrogen within the water vapor clouds had to be greater
than 6.8 percent to cool the air below the dew point (Witcofski, March 1981). It must be stated,
however, that there is an invisible region outside of the vapor cloud, with concentrations between
4 and 6 percent hydrogen in air, that is flammable in the upward direction. However, for mixture
compositions in this range, the ignition sources must have energies greater than 1 mJ, or
approximately 100 times greater than the minimum ignition energy (MIE). The presence of wind
or water vapor will further increase the amount of energy needed to ignite the mixture. The direct
initiation of the detonation in hydrogen-air mixtures in free air (or unconfmed by solid surfaces)
requires high-energy shock waves, typically produced from high explosives. With confining
surfaces present, smaller ignition sources initiate a flame that accelerates until a deflagration-to-
detonation transition can initiate detonation. Ignition sources commonly found within buildings
could initiate a detonation, should some portions of a hydrogen-air plume become entrained
within the associated confined spaces or ducts. Under such circumstances, the lower detonability
limit10 is 18 percent hydrogen in air.
2.4.1.3 Limitations of TRACE
The code is designed to compute the dispersion of a gas in air as either a ground release or a low
momentum stack release. The code logic assumes that any release initiated from the ground stays
on the ground and there is no buoyancy. A low-momentum stack release assumes the gas enters
the atmosphere through an orifice with a defined size, a bulk flow, and then buoyancy is
computed. The code further checks the elevation of stack emissions for sufficient height, or it
reverts to a ground computation. These two algorithms do not account for the complete observed
behavior of spilled LFfc. It is possible that should the hydrogen mix and diffuse sufficiently fast
within the air, the bulk mixture could be dominated by the behavior of the air. However,
photographs taken of the 1500-gal LH2 spill tests at NASA WSTF (Witcofski 1981) show a more
complex behavior. When cryogenic hydrogen vapor mixes with air, the air temperature drops
below the dew point and water vapor clouds form. Time-elapsed photographs of the vapor cloud
show a short period of wind-dependent ground travel, always followed by their achieving positive
buoyancy. Therefore, both TRACE algorithms must be used and connected at some point to
simulate the hydrogen vapor cloud behavior.
2.4.1.4 Interpretation of TRACE Computations with NASA WSTF Spill Data
Based on the behavior of hydrogen observed in cryogenic spills, the dispersion of hydrogen,
using TRACE, was evaluated in two steps. The first step, a TRACE ground computation for a
given wind speed, is considered for distances that match ground travel for NASA WSTF data.
The second step is a low momentum stack calculation for an orifice size approximately the
diameter reached by the ground spill and located at the upper elevation reached by the ground
spill. An assumption was used in the selection of the temperature of the hydrogen leaving the
"stack" orifice. While the hydrogen-vapor and hydrogen-air mixture is traveling near the ground,
the hydrogen is warming. This warming is not computed by TRACE. Trial computations
indicated that when the initial temperature of the hydrogen is at least 100 K, the plume would rise
Initiation of detonation is a function of a variety of factors in addition to concentration. The experimentally
measured detonation cell size has been shown to be the critical parameter, most useful in predicting detonation.
13
-------
at a rate simulating the cloud behavior observed during NASA WSTF tests. This is the basis for
the rationale of selecting a temperature of 100 K for the initial temperature of the hydrogen as it
exits the stack. From the two computations, the distance of horizontal travel was computed and
compared to the elevation of cloud rise. This result was then compared to site plan distances and
facility building elevations.
We note that at odds with this rationale is at temperatures below 100 K, TRACE predicted the
cloud would sink back to the ground. This predicted sinking behavior runs counter to our
expectations for the behavior of bulk hydrogen11 above 23 K. This apparent contradiction does
not necessarily mean that TRACE is wrong.12 Clarification of this issue will require further
investigation beyond the scope of this effort. However, the experimental evidence shows only the
vapor cloud moving along the ground then rising.
2.4.2 Extent of Flammable Clouds
There are several general risks presented by a hydrogen plume impinging on a structure. It is
assumed the bulk-air flow would carry the plume around and/or over the structure. The greatest
risk is for flash fire, which is evaluated in Section 2.4.3. Flammable mixtures aspirated into open
windows or ventilation ducts will have the confinement and exposure to ignition sources
necessary to allow accelerating deflagrations or detonation. The fact that most ventilation systems
mix a stream of outside with internal air (make-up) will lead to a dilution of the mixture. This
works to reduce hazards. Spaces created by hard surfaces create confinement that can lead to
deflagration or detonation and the creation of overpressures. Confining walls that cause the wind
to swirl will improve mixing of the hydrogen with the air. However, only the confined portion of
the cloud will contribute to the overpressure, except in cases where the shock strength reaches the
level of explosives and can impinge back on the remainder of the unconfmed cloud.
The TRACE code was run for conditions that pertain to hydrogen-release scenarios in order to
evaluate hydrogen concentrations downwind of the spill point.
2.4.2.1 Ambient Temperature Gas Release
The hydrogen, ready for dispensing, is stored at high pressure under ambient conditions.
Releases coming from this portion of the system will expand into the surrounding air, forming a
buoyant plume. With a density 1/15 that of air, a plume of pure hydrogen can rise as fast as
9 m/s. Combustible regions of hydrogen and air will form at the surface of the plume where
mixing occurs. Small leaks, if not ignited, will diffuse harmlessly into the atmosphere within the
chain-link security fence that is planned to surround the system. Larger penetrations will result in
a high-pressure jet of hydrogen. TRACE analysis of such a jet, released through a 0.25-in.
penetration and oriented to produce a horizontal plume, shows a flammable plume may extend
2 to 3 m from the source. If ignited, this would create a loud jet of nearly invisible flame that
would be extremely dangerous to anything in its path. The jet would only persist as long as high-
It is well known that pure hydrogen vapor is neutrally buoyant in air at 23 K and less dense than air at greater
temperatures.
12
For example, one possible explanation can arise from hydrogen's thermal conductivity being much greater than that
of air. Consider a bubble of hydrogen vapor surrounded by air with mixing between the two gases occurring along
the surface of contact. The thermal conductivity of hydrogen may be sufficient to cool the air and density or even
condense it in the immediate vicinity of the surface. This dense air surrounding the hydrogen would for a time, until
the hydrogen warms further, cause the combined mass of cooled air and hydrogen to sink to the ground.
14
-------
pressure hydrogen is supplied, with the worst case being the entire inventory of a 12-pack
pressure bottle assembly (approximately 45 to 50 Ib of hydrogen at 70 °F). Without ignition, the
release will safely disperse well within the 75-ft exclusion zone specified by NFPA 50B.
2.4.2.2 Large Spills with Little Wind
The tests devised at WSTF in the 1980s constrained the LH2 within a 30-ft diameter pond. The
1500 gal were spilled into the pond over a period of 35 s. In one test, conducted under low wind
speed conditions (4 mph), the vapor cloud initially covered a 20 m (60 ft) diameter area generally
centered over the pond. From the photographs, the outer edge of the vapor cloud appears to rise at
a rate of approximately 1.5 m/s. After 37 s (see the third frame) the outer edge of the vapor cloud
appears approximately 50 to 60 m in elevation over the ground, 60-m distant from the spill point.
Smaller wind speeds or still air will result in the hydrogen plume taking a more vertical ascent,
harmlessly dissipating in the air. In general, given a small wind velocity, the NFPA exclusion
zone will not provide adequate safety for this kind of hydrogen release.
2.4.2.3 Worst-Case Spill Scenarios
Weather effects were evaluated to see what conditions might create greater hazards for the
surrounding area. Greater wind speed will move the plume further across the ground while
increasing turbulence and mixing with air. The WSTF spill tests were conducted under several
different wind conditions. The data show that with an increase in wind speed the vapor cloud is
"dragged" further along the ground in comparison to its elevation. However, there is indication
that the vapor cloud dissipates more rapidly with higher wind speed.
Stack and ground runs were performed using TRACE for wind conditions at 4, 8, 14, and 20 mph
with other parameters held constant and simulating the WSTF spill conditions.13 The 8-mph case
provided the closest encroachment of the hydrogen plume on the surrounding structures. Note the
cloud spreads along the ground at approximately 45 mph.
The cloud cross section on the ground is approximately 20 m in diameter and, based on the
WSTF data, the vapor cloud begins to rise approximately 20 m from the spill. Therefore, the
horizontal axis shown in the plots must be corrected by translating the plume 20 m. A graphical
analysis finds the lower 4-percent edge of the plume approximately 30 m above the ground. Such
a plume originating from the recommended site would clear all neighboring buildings. The
duration for passage of the plumes in all the cases is several minutes. This assessment is closely
based on the results of the WSTF tests. The 1500 gal of LFt was spilled over a 30- to 40-s period
during those tests. An accident or attack might produce different spill results.
2.4.2.4 Release with Mitigation
Two worthwhile strategies are to increase the rate at which the LFk is vaporized and to reduce the
diameter of the plume. Given the positions of facilities surrounding the hydrogen dispensing
station, it is desirable to make a potential release of hydrogen rise as rapidly as possible. Several
features have been discussed for incorporation into the facility design. These include a spill pond
that contains crushed rock to enhance heat transfer to the spilled liquid, and slats inserted within
the chain-link security fence.
This includes a 30-ft diameter spill cross-section and 80 °F.
15
-------
TRACE computations were conducted to assess the effects of crushed rock and slatted fence on
potential spills. Little information was found in the literature on how to use crushed rock to
increase the rate of LH2 boil-off. Preliminary work (Zabetakis and Burgess 1961) suggests that
the boil-off rate of LH2 using crushed rock is double the rate for moist sand. Installing slats within
the security fence that encloses the spill pond should help direct the hydrogen plume upward as it
warms rather than letting it spread out over the ground. This kind of control, known as a vapor
fence or barrier, has been used to reduce vapor travel of flammable cryogenic vapors such as
liquid natural gas (LNG) (Moorhouse and Roberts 1988).
This information was used to set up a TRACE stack run for an 8-mph wind, but with input to
simulate double the vaporization rate. It is assumed that ground travel of the plume is stopped by
the combination of the pond and a 6-ft-high14 slatted fence. A chimney effect lifts the plume off
the ground at the pad, and the plume clears 25m approximately 25 m from the center of the pond.
This is computed to occur within 18s.
Results suggest that the hazard might be contained within the NFPA 50B-exclusion zone should
the pond and slats work as predicted by TRACE.
2.4.3 Flash Fire Hazards
Hydrogen fire has several characteristics of note. Hydrogen flames, unless seeded with
impurities, are very hard to see in daylight. This property, combined with its low emissivity (puts
out very little infrared radiation), makes hydrogen combustion hard to sense until physical contact
is made with the flame. Hydrogen combustion in air also produces ultraviolet (UV) radiation
capable of producing effects similar to overexposure to the sun. Direct exposure to hydrogen
flames produces immediate burns.
Hydrogen is so easily ignited that where it is released, one should expect or be prepared for
ignition and fire. The dispensing equipment is designed to ASME standards that provide
redundant protection in the case of fire. Small leaks may occur and ignite, but go unnoticed until
maintenance personnel enter the secure area. Leaks from a pressurized line will present a greater
hazard that may extend beyond the security fence (see Section 2.3.3.1.2). A pressurized leak,
whether ignited or not, will be audible, even though hard to see. A plume of hydrogen that is
ignited will rapidly flash back to the source of hydrogen. From the perspective of controlling
hazards, hydrogen fire localized to a source or leak is often preferable to a growing hydrogen
plume.
The worst-case scenario is a large plume that, if ignited, can burn personnel or initiate other fires
in readily combustible materials. TRACE computations indicate the thermal flux from an ignited
hydrogen-air mixture will range between 10 to 100 kW/ni2 for exposures at distances from tens of
feet to near contact with the mixture. Combustion of a hydrogen cloud will occur completely
within 1 to 2 seconds. There is not enough deposition of thermal energy to ignite typical
materials of construction. Personnel caught in close proximity may be severely burned; and
flammable liquids, if directly exposed, may be ignited.
14
Woods, Stephen. Telephone conversation with Donald Danyko (EPA) September 10, 2003. Computations were
performed for a 2-m fence; however, for security reasons the height was increased to 10 ft, or approximately 3 m.
This will further improve the "chimney" effect.
16
-------
2.4.4 Deflagration and Detonation Hazards
Deflagration and detonation are two modes of hydrogen combustion capable of producing high
temperatures, shock waves, and high overpressures. Table 1 lists some of the characteristics of
deflagrations and detonations.
Both processes require confinement such as pipes, ducts, narrowly spaced walls, or large
initiation energies to occur. Keeping the hydrogen dispensing system away from structures will
give plumes from a large release a chance to rise. Both detonations and energetic deflagrations
require the formation of mixtures of hydrogen and air that are close to stoichiometric. In the open
air, powerful explosives or very large sparks15 are required to initiate detonation. In the case of
attack on the system, the explosives used in the attack are not considered initiation sources since
they act before the hydrogen mixes with the air. Shorts that occur within the transformer of the
EPA power substation may be sufficient to initiate detonation. Although TRACE and the NASA
data predict hydrogen-air plumes will clear nearby structures, if a plume were to brush up against
intake ducts, a potentially detonable mixture could form in a confined space. A process that might
mitigate the formation of a detonable mixture is the dilution of the mixture (as make-up air) with
air already in the building. Potential spaces outside include small courtyards. Hydrogen-air
mixtures swirling in spaces with walls approximately 15 ft apart or less have produced significant
overpressures when ignited.16 TRACE computation of overpressure for combustion of a
stoichiometric hydrogen-air mixture in free air indicated that pressures less than 0.1 psia would
be produced.
Table 1
Deflagration and Detonation Characteristics
Characteristic
Energy Transport Type
Flame Temperature
Flame Velocity
Rate of Pressure Onset
Range of Final Pressure to Initial
Unburned Gas Pressure
a Values were computed for a stoichiometric
Deflagration
Diffusion of radical species
2045 °C (3713 °F)a
2.7- 1294 m/s
1- 100ms
1-8
mixture at 1 atmosphere and 300 K.
Detonation
Shock wave
2674 °C (4845 °F)a
> 1800 m/s
2-20°cS
15-20
In summary, detonation or energetic deflagration is an unlikely outcome for a large hydrogen
release if the system is located away from structures.
2.4.5 Fragment Hazards
Analysis of potential fragment hazards was conducted using the gas code PVHAZARD. The
results are theoretical in nature and should not be taken literally except to see that, at the storage
pressure used in the system, gas-propelled shrapnel can reach high velocities. The results are
theoretical because the released energy is evenly partitioned between the pieces, as if the vessel or
component simply shattered and all the potential energy was optimally converted into the kinetic
energy of the shrapnel. The code analyzes only the pressurized component and does not include
Initiation source with energy of the order of 5000 Joules.
Beeson, H. Communication concerning GASL accident investigation, August 2003.
17
-------
the mechanical effects of the entire module structure. This is not realistic for components that
meet ASME design criteria. For example, a lot of energy would be absorbed in bending and
severing the metal and colliding with other system components. In addition, a lot of energy would
simply be released in a shock wave and not accelerate shrapnel. Nonetheless, some shrapnel
released in a component failure could attain the energies indicated.
The hazards noted here are not different in nature from the hazards in other areas where gas
cylinders may be stored.
2.4.6 Summary of Release Hazards
The consequences of equipment failure, operational error, accidents, attack, or sabotage can be
categorized as producing one of three types of releases: a leak; a penetration (or very large
leak/jet); or a rupture (a rapid emptying of the containment). If the high-pressure portion of the
system is involved, the hydrogen release may be accompanied by shrapnel. The division seeks to
separate the consequences of the release into three increasing levels of potential hazard to the
surroundings:
o Leaks may pose a hazard to adjacent system components or attending personnel directly
exposed to combustible mixtures in the immediate vicinity of the leak. Here, the concern is
for direct exposure to hot hydrogen reaction products.
o A penetration produces a larger release that can pose a hazard to the entire fueling system and
personnel or equipment near the filling station. The concern includes not only direct exposure
to hydrogen combustion over a larger area, but exposure to thermal and UV radiation capable
of producing burns, minor shrapnel, and the potential for secondary ignition of station
components or nearby materials.
o A rupture in the liquid storage system may pose a hazard to equipment and personnel in the
greater vicinity of the fueling station, and threaten adjacent structures and public spaces
located outside of the exclusion zone as specified by NFPA code. The most likely outcome
from the threat is flash fire.
18
-------
3.0 Conceptual Siting Design
The general requirements, code requirements, and site hazard analysis are examined to evaluate
the several options for siting of the hydrogen dispenser system.
3.1 General Requirements Review
General requirements arise from considerations of functionality, safety, security, and cost. The
primary functional requirement for the hydrogen dispenser system is that ready access be
provided for the vehicles to be fueled and for the tanker truck to refill the station. Additionally, it
is desired that the area given to the dispenser system be as small as possible and that dispensing
operations have minimal impact on parking and surrounding EPA activities. The hydrogen
dispensing system and associated operations should be safe, posing no risks greater than current
EPA operations to the personnel, operations, existing facilities, and surrounding public. The
dispensing station and associated operations should not compromise the level of security at the
EPA facility. The EPA is responsible for providing the pad and power infrastructure for the
hydrogen system equipment leased from APCI. The cost for the infrastructure and cost for its
removal after the project is complete must not be excessive.
3.2 Code Requirements Review
At this time there are no codes or standards published that are specific to hydrogen dispensing
stations to clarify siting requirements. However, a review of relevant existing codes and standards
are provided here to help resolve siting issues.
3.2.1 General Considerations for Siting
A brief discussion of general safety issues as it pertains to siting is provided here as background.
3.2.1.1 Safety and Siting
Hydrogen safety issues can be summarized according to priority as follows:
o Combustion: Unplanned mixing of hydrogen and oxidizing substance results in fire,
deflagration, or detonation.
o Pressure: System confinement fails, releasing high-pressure hydrogen or propelling
fragments.
o Low Temperature: Inadequate design or improper maintenance leads to the use of
inappropriate materials, leading to component failure.
o Embrittlement: Selection of materials susceptible to hydrogen attack leads to component or
vessel wall failure.
o Health: Exposure of personnel to high concentrations of hydrogen, cryogenic temperatures,
fires, overpressures, and shrapnel leads to injury or health hazards. Siting, or the
determination of a safe exclusion zone for operations with hydrogen, is predominantly
influenced by potential combustion and pressure hazards for a given hydrogen system. Proper
siting reduces health hazards, while low-temperature and embrittlement concerns may figure
among the causes of a system failure.
19
-------
3.2.1.2 Approaches to Siting
Site planners have several options in choosing a basis for the determination of an exclusion zone.
The simplest and most conservative approach is to consider the worst-case event conceivable and
place all personnel, vulnerable equipment, and activities out of range of harm. From a military
perspective, the worst-case events are overpressure and shrapnel. To facilitate siting
determinations, the Department of Defense (DOD) has tabulated safe standoff distances for
hydrogen used as a propellant17 for military or aerospace applications. Another option is to
determine siting according to the requirements of a relevant application-based standard. While
there are currently few such standards for hydrogen systems, the standards for commercial
storage of hydrogen are well known.18 The primary assumption is that the intended use and design
of the hydrogen system being sited reasonably match the assumptions inherent in the selected
standard. The final option is to develop a rationale based on a study of potential releases of
hydrogen and their related hazard scenarios. This rationale, usually documented through hazard
analysis, must satisfy the authorities that would grant permission to operate the sited system.19
Often the determination of an exclusion zone to protect personnel and equipment is based on the
traditional quantity-distance approaches to siting, where the quantity of an energetic material
determines the size of an exclusion zone for safe operation. Separation distances are tabulated as
a function of quantity. However, the nature of the hydrogen release, rather than the quantity or
precipitating cause, has the greatest effect on siting.
3.2.2 Review of Mandatory Codes
The primary mandatory regulations that apply to the installation and operation of the proposed
hydrogen dispensing station come from the Occupational Safety and Health Administration
(OSHA), Code of Federal Regulations Title 29. Section 1910.103, Hydrogen, specifies the use of
the following standards:
o NFPA 50A Gaseous Hydrogen Systems at Consumer Sites
o NFPA SOB Liquefied Hydrogen Systems at Consumer Sites
o NFPA 70 National Electric Code
o ASME BPV Boiler and Pressure Vessel Code
o ASME B31 Code for Pressure Piping
The requirements of OSHA 1910.119 (Process Safety Management of Highly Hazardous
Chemicals) and Title III of the Superfund Amendments and Reauthorization Act (SARA) under
Environmental Protection Agency apply only for systems that have 10,000 Ib (16,900 gal) or
more of hydrogen. The DoD-6055.9 document provides directives on the siting and storage of
explosives and liquid propellants for aerospace purposes. Application of DoD directives to the
hydrogen dispensing system is not appropriate, since the hydrogen dispensing system possesses
criteria that more closely match a commercial storage system rather than a propellant system.
DoD 6055.9. Ammunition and Explosives Safety Standards.
1 8
NFPA 50A, Standard for Gaseous Hydrogen Systems at Consumer Sites', and NFPA SOB. Standard for Liquefied
Hydrogen Systems at Consumer Sites.
19
This authority, or the authority having jurisdiction (AHJ), is usually an entity recognized by state and local
authorities, such as the Fire Marshall.
20
-------
3.2.3 Other Requirements, Standards and Guidelines
The USEPA NVFEL as a government facility retains authority over its facilities where other than
federal codes are required. However, it is prudent practice to follow local and state codes where
applicable, keep local government planners and officials aware of potential hazards, and
coordinate with the Fire Marshall.
Compressed Gas Association (CGA) maintains a variety of standards that serve as a good
reference for recommended practice in hydrogen operations. Examples include:
o CGA G-5 Hydrogen
o CGA G-5.4 Standard for Hydrogen Piping Systems at Consumer Locations
o CGA G-5.5 Hydrogen Vent Systems
3.3 Siting Review
The requirements for the siting options identified in Section 2.0 have been reviewed against code
requirements and the findings of the hazard analysis and communicated to EPA.
Selected general NFPA 50A and 5 OB code requirements are given in Table 2.
Table 2
Selected NFPA Storage Guidelines
Type of Exclusion Gas Storage (ft) Liquid Storage (ft)
NFPA 50A NFPA 5 OB
Places of Public Assembly 50 75
Ventilation Equipment 50 75
Inlet to Underground Sewers - 5
Flammable Liquids 20 (above ground) 50
25 (below ground)
Oxidizers - 75
21
-------
4.0 Conclusions and Recommendations
System failures, whether caused by component failure, operational error, or attack, have been
assessed for the quantity of hydrogen released and the severity of consequences. Several
conclusions and recommendations are advanced to help ensure the overall successful use of
hydrogen dispensing system on the NVFEL facility.
This analysis concludes that there are different safety implications for the three regions
surrounding the hydrogen dispenser system. The security fence planned around the storage
equipment defines the first region. The isolation it provides can protect outside personnel from
small hydrogen leaks (likely through connections sometime during the life of the facility), and
from normal, controlled hydrogen releases through the system vent. The inherent safety features
of the vendor-supplied equipment meet accepted industry standards and should provide excellent
service. A second region, as specified by NFPA SOB, is needed for further protection of personnel
against larger releases, potential fire, and minor shrapnel due to component failure. While such
events are deemed unlikely to occur during the period of use planned for the dispensing system,
their occurrence could pose a hazard beyond the security fence. This review concludes that
training of operations personnel and observation of the exclusion zone and other precautions
specified by standard NFPA SOB will provide protection against moderate threats due to
component failure.
Major component failure or significant damage caused by attack, while very unlikely, would
feature the release of significant quantities of hydrogen or large pieces of shrapnel that could
threaten areas beyond the NFPA SOB exclusion zone, which is defined as the third region. Among
these hazards, the greatest concern is for flash fire. Against this possibility, the review of the
NVFEL grounds conducted in April led to the recommendation of a specific site, which was
communicated, to EPA. Further conclusions are that design features such as a spill pond with
gravel, and a slatted security fence to act as a vapor barrier, will improve evaporation of liquid
hydrogen and promote the upward movement of hydrogen vapor above nearby structures during a
large spill. In summary, the storage and dispensing of hydrogen in the planned system does
present hazards, but in the context of the NVFEL facility, the hazards involving hydrogen do not
appear substantially different or new.
To best mitigate the identified hazards, the following recommendations are given:
• The security fence surrounding the system must be locked to exclude all but vendor
maintenance personnel.
• The exclusion zone specified by NFPA SOB should be observed for protection against
unplanned minor releases of hydrogen and shrapnel.
• To provide an additional margin of safety against an unlikely large release of hydrogen, it is
recommended that the infrastructure provided for the equipment incorporate a spill pond with
gravel and a vapor barrier.
• Safety information must be coordinated as necessary with NVFEL personnel, non-
NVFEL personnel that may work in proximity to the dispensing system, the Fire Marshall
and first responders, and local authorities.
22
-------
References
29 CFR 1910.013. Code of Federal Regulations Title 29, Labor; Part 1910 Occupational Safety
and Health Administration; Section 103 Hydrogen. US Printing Office, Washington,
DC, latest edition, www.osha.gov.
29 CFR 1910.119. Code of Federal Regulations Title 29, Labor; Part 1910 Occupational Safety
and Health Administration; Section 119 - Process Safety Management of Highly
Hazardous Chemicals. US Printing Office, Washington, DC, latest edition.
www.osha.gov.
ASME, Code for Pressure Piping. ASME B31. American Society of Mechanical Engineers,
Fairfield, New Jersey, latest edition, www.asme.org.
ASME. Process Piping. ASME B31.3. American Society of Mechanical Engineers, Fairfield,
New Jersey, April 2002.
ASME. Boiler and Pressure Vessel Code. BPVC. American Society of Mechanical Engineers,
Fairfield, New Jersey, 2001.
Benz, Frank J., C. V. Bishop, and M. D. Pedley. Ignition and Thermal Hazards of Selected
Aerospace Fluids. RD-WSTF-0001, NASA Johnson Space Center White Sands Test
Facility, New Mexico, October 1988.
Burgess, D.; J. N. Murphy; M. G. Zabetakis; and H. E. Perlee. Proceedings ofCryo '75 and
Cryo '76, "Volume of Flammable Mixture Resulting from the Atmospheric Dispersion of
a Leak or Spill." S. H. Booth and R W. Vance, Ed. Vol. 8., pp. 182-206, 1976.
Applications of Cryogenic Technology (May 11, 1914), Alameda and Anaheim,
California; Washington, D.C., and Houston, Texas. Flushing, New York: Scholium
International Inc.
CGA. Hydrogen. CGA G-5. 5thEd. Compressed Gas Association, Inc., Chantilly, Virginia,
October 2002.
CGA. Standard for Hydrogen Piping Systems at Consumer Locations. CGA G-5.4. 2nd Ed.
Compressed Gas Association, Inc., Chantilly, Virginia, September 2001.
CGA. Hydrogen Vent Systems. CGA G-5.5. Compressed Gas Association, Inc., Chantilly,
Virginia, December 1996.
DoD. Ammunition and Explosives Safety Standards. DoD 6055.9. US Department of Defense,
2001.
Edeskuty, F. J., and W. F. Stewart. Safety in the Handling of Cryogenic Fluids. Plenum Press,
New York, 1996.
23
-------
Moorhouse, J. and P. Roberts. "Cryogenic spill protection and mitigation." Cryogenics, Vol. 28,
pp. 838 - 846, December 1988.
NFPA. Standard for Gaseous Hydrogen Systems at Consumer Sites. NFPA 50A. National Fire
Protection Association, Quincy, Massachusetts, 1999.
NFPA. Standard for Liquefied Hydrogen Systems at Consumer Sites. NFPA SOB. National Fire
Protection Association, Quincy, Massachusetts, 1999.
NFPA. National Electric Code. NFPA 70. National Fire Protection Association, Quincy,
Massachusetts, 2002.
Pasquil, I. F. "The Estimation of Dispersion of Windborne Material" Meteorological Mag.,
Vol. 90, pp. 33-49(1961).
PVHAZARD. The PVHAZARD Pressure Vessel Hazard Assessment Software, sponsored by
the US Air Force (45th Space Wing, PAFB) and NASA, with contributions by General
Physics Corporation, ACTA, Inc., and Aerospace Corporation. Most recent version.
Sherman, M. P., M. R. Baer, and S. K. Griffiths. Deliberate Ignition and Water Fogs as H2
Control Measures for Sequoyah. Workshop on the Impact of Hydrogen on Water
Reactor Safety, Albuquerque, New Mexico, January 25-28, 1981.
TRACEiM (Toxic Release Analysis of Chemical Emissions); SAFER Systems, L.L.C., Camarillo,
California, most recent version.
Witcofski, R. D. An Overview of Completed Simulated Storage Tank Rupture Experiments and
Proposed Pipe Rupture Experiments. Liquid Hydrogen Spill Experiments, Aeronautical
Systems Division, NASA Langley Research Center, Hampton, Virginia, March 1981.
Witcofski, R. D., NASA Langley Research Center. "Dispersion of Flammable Vapor Clouds
Resulting from Large Spills of Liquid Hydrogen." In 16thlntersociety Energy
Conversion Engineering Conference, Vol. 2, pp. 1436-1443 (Paper No. 819630; AIAA
Paper A82-11789), August 1981.
Witcofski, R. D., NASA Langley Research Center. "Experimental Measurements of the
Dispersion of Flammable Clouds Formed by Liquid Hydrogen Spills." InJANNAF
Proceedings of Safety and Environmental Protection Subcommittee Meeting, 1981.
Zabetakis, M. G. and D. S. Burgess. "Research on the Hazards Associated with the Production
and Handling of Liquid Hydrogen." Report of Investigations 5705, Bureau of Mines, US
Department of the Interior, 1961.
24
-------
Bibliography
Baker, W. E.; Kulesz, J. J.; Ricker, R. E.; Bessey, R. L.; Westine, P. S.; Parr, V. B.; and Oldham,
G. A. Workbook for Predicting Pressure Wave and Fragment Effects of Exploding
Propellant Tanks and Gas Storage Vessels. NASA Contract NAS3-19231, September
1977.
Brewer, G. D.; Wittlin, G.; Versaw, E. F.; Parmley, R.; Cima, R.; Walter, E. G. Assessment of
Crash Fire Hazard ofLH2 - Fueled Aircraft. Lockheed-California Company, NASA
CR-165525, December 1981.
Chirivella, J. E.; Witcofski, R. D. "Experimental Results from Fast 1500-Gallon LH2 Spills." In
Cryogenic Properties, Processes and Applications 1986. Ed. Kidnay, A. J. and Hiza,
M. J. New York: American Institute of Chemical Engineers; Vol. 82: 251, 1986.
(Frederking, T. H. K.; Kerney, P. J.; Wenzel, L. A., co-editors. AIChE Symposium
Series V. Vol. 82:251, 1986).
Chitose, K.; Takeno, K.; Yamada, Y.; Hayashi, K.; Hishida, M. "Activities on Hydrogen Safety
for the WE-NET Project - Experiment and Simulation of the Hydrogen Dispersion."
Proceedings of the 13th World Hydrogen Energy Conference, Beijing 2000.
Hord, J. Is Hydrogen Safe? Cryogenics Division, National Bureau of Standards, 34 pages,
October 1976.
Reichelt, W. (AT-DO, H821); Edeskuty, F. J.; Prenger, F. C; Stewart, W. F. (MEE-13); Durham,
F. J. (DRA/DEW); and Dewart, J. M. (HSE-8). Postulated GTA Cryogenic Cooling
System Accidents. February 7, 1990.
25
------- |