Competence Certainty Quality Hydrogen Applications in the Aircraft

Competence. Certainty. Quality. Hydrogen Applications in the Aircraft Industry Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004 Gerhard Klein & Bernd Zapf (gerhard. klein/bernd. zapf@tuev-sued. de) TÜV Industrie Service Gmb. H TÜV SÜD Group, Germany TÜV Industrie Service Gmb. H TÜV SÜD Group V-ÖA /

Contents • Basic Properties of Hydrogen and its Application for Aircrafts • Basic Aspects of Risk and Safety • Automotive Industry • Tolerable Risk Targets for Hydrogen in the Aircraft Sector • Implementation of Risk Strategy TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Conventional Aircraft Power Architecture Aircraft Power Sources Aircraft Main Power Consumers TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Some properties of hydrogen and other fuels Methane (g) 0. 55 Vapor density relative to air Flammability limit (Vol. %) 6 -36. 5 Diesel fuel (l) 3. 2 -4 7 Propane (g) Kerosene (l) 1. 56 5 -16 0. 6 -8 0. 6 -6. 5 595 220 -280 220 2 -10 Methanol (l) about 1. 5 Hy ( 1. 4 0. 6 -7. 0 4 -75 Ignition temperature (°C) 455 Gasoline (l) 460 about 500 0. 26 about 0. 16 585 min. ignition energy (m. J) 0. 3 0. 24 . /. g = gaseous l = liquid TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004 0. 14

Hydrogen – Current Applications TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Hydrogen Technology for Aerospace Fuel Cell in space Apollo Fuel Cell as APU TÜV Industrie Service Gmb. H TÜV SÜD Group Combustion Engine Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Fuel cells for Aircrafts – Why? ´ More efficient power supply - due to FC technology ´ Low emissions - significant NOx reduction on ground and in flight ´ Low noise - excellent potential for significant on ground noise reduction ´ Fuel economy - up to 75% Fuel Reduction on ground - about 30% Fuel Reduction in flight ´ Heat production ´ Water production TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Fuel Cells as Auxiliary Power Systems Performance evaluation shows two favorable fuel cell processes for aircraft applications: • Proton Exchange Membrane Fuel Cell – PEMFC • Solid Oxide Fuel Cell – SOFC PEMFC 4 e- 2 H 2 O 2 2 H 2 O T 60°C – 80°C TÜV Industrie Service Gmb. H TÜV SÜD Group T 800°C – 1000°C Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Main characteristics of Fuel Cells PEMFC SOFC Operating Temperature approx. 60 – 80°C approx. 800 – 1000°C Efficiency up to 40% up to 60% Fuel kerosene Fuel Processing no residual contamination tolerable Carbon Monoxide CO must be removed less susceptible to CO Sulfur sulfur must be removed less susceptible to sulfur Power Density < 1 kg/k. W Maturity Level pending on system concept improvement necessary TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Utilization of hydrogen onboard GH 2 for Fuel Cell - pressurized tanks Insulated tanks with: - Reformer - high mass - GH 2 filters - high cost - conv. Fuel tanks - shelf life of LH 2 marginal GH 2 LH 2 Veff 400 l/kg(H 2) Weff 24. 2 kg/kg(H 2) Veff 15 l/kg(H 2) Weff 7. 5 kg/kg(H 2) Hydrocarbons Depending on process @ 30 bar TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Kerosene reforming process The main advantages of reforming kerosene onboard the aircraft are: • high density fuel (4 times higher than LH 2) • easily storable • only one fuel type (kerosene) onboard There are several reforming processes: 1) Steam Reforming 2) Partial Oxidation Water Steam 3) Autothermal Reforming Heat Hydrogen rich gas Kerosene Water Steam Air Hydrogen rich gas Hydrogen Kerosene rich gas Heat Temperature: 700 °C Pressure: 2, 5 bar – 30 bar TÜV Industrie Service Gmb. H TÜV SÜD Group Kerosene Temperature: 1300 °C Pressure: 30 bar – 70 bar Temperature: 700 °C Pressure: 1 bar Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Safety Concepts Explicit rules for a new technology ´ Synthesis Safety / Optimization Risk Assessment ´ Analysis System Analysis ´ Requirements ´ Basis Targets: Rules and Regulations Social Requirements Results from Experience from operation Research and Development Quality Standards ’ Acceptance on the part of public and authorities ’ Acceptable safety TÜV Industrie Service Gmb. H TÜV SÜD Group

Our Services for Hydrogen and Fuel Cell Applications Ø Safety consultancy Ø Expertise Ø Certification Ø Qualification, Tests Ø Training TÜV Industrie Service Gmb. H TÜV SÜD Group ü Safety ü Quality ü Reliability ü Economic efficiency

Safety in commercial aircrafts Procedure: - Identify hazards, perform a fault hazard analysis - Trace back the hazards to components & their failure modes - Assign a reliability target to each hazard - Design and manufacture component according to this reliability rates usingle element integrity, fail-safe-design, . . . This procedure has proven to be very successful in the past because - commercial aircraft designs don’t change considerably over time - commercial aircraft industry is very conservative in design approaches - commercial aircraft is tightly regulated TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Safety aspects – Strategies and requirements Strategies for the implementation of “new” technology or “old” technology in a new context Requirements derived from - experiences with similar technology in related areas of application - codes, technical rules - system analysis (probabilities of failures and their consequences) “State of the art” well defined Main weak-points are identified Suitable counter-measures can be taken What‘s the situation for hydrogen? TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Rules - Codes and Standards 94/9/EC 97/23/EC pressure equipment directive 73/23/EEC “ATEX directive“ low voltage directive 89/336/EEC 98/37/EC electromagnetic compatibility industrial machinery directive IEC TC 105 fuel cell technologies IEC 62282 fuel cell technologies ISO TC 197 Hydrogen Technologies ANSI/CSA FC 1 -2004 TÜV Industrie Service Gmb. H TÜV SÜD Group stationary Fuel Cell Power Systems Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Experiences of TÜV SÜD LPG, CNG mobile and stationary applications since 1975 Precommercial Phase Standards Stationary H 2 Applications Solar Hydrogen Plant H 2 MUC MTU PAFC / SOFC / div. PEM / MCFC Mobile H 2 Applications Daimler. Chrysler / VW / BMW / MAN / Proton Motor / Opel / Ford Portable H 2 Applications (FC) Smart Fuel Cell, P 21, En. Kat, Fronius 1990 TÜV Industrie Service Gmb. H TÜV SÜD Group 1995 2000 2005

1 st conclusion • Experiences with hydrogen in the automotive and other sectors are only partly of use for aircrafts with respect to - technical boundary conditions and qualification of users • Standardization is on the way, but - there is no obvious cooperation of the “big 2 players” - the example of automotive industry shows that standardization takes some time TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Tasks Therefore, the following questions arise: - How can we push forward the introduction of hydrogen, simultaneously demonstrating it is “safe”, i. e. free from unacceptable risk? - What is the residual risk for occupants or flight crew? - Will it be accepted by the authorities (and the public)? - How safe is safe enough? What is risk? TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

What is risk? – Risk Analysis Risk = Frequency x Consequence log (Frequency) not acceptable Risk = const. acceptable log (Consequence) TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Performance of Risk Analysis Barriers (defenses to the potential escalation of a critical event) Critical event • internal • external limited defects of barriers E/E/PE safety-related systems Other technology safety-related systems External risk reduction facilities Hazard State Circumstantial / procedural barriers (e. g. operating instructions, unplanned yet beneficial circumstances) Consequence TÜV Industrie Service Gmb. H TÜV SÜD Group 21

IEC 61508: Safety requirements For each hazard state we have to specify the necessary risk reduction in order to determine the safety integrity 1 requirements for the safety-related systems involved: (from IEC 61508, part 5) 1 safety integrity: probability of a safety-related system satisfactorily performing the required safety functions under all stated conditions within a stated period of time. TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

AMC 25. 1309 / AC 25. 1309 -1 What is the “necessary risk reduction” in aircraft industry? • No single failure will result in a Catastrophic Failure Condition • Each Catastrophic Failure Condition is extremely impossible Dealing with hydrogen, we can have catastrophic failure conditions, e. g. leakage of hydrogen to the environment which is not detected by the sensors. So we have to avoid corresponding single failures and have to show that these conditions are extremely impossible TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

AMC 25. 1309 / AC 25. 1309 -1 Allowable Quantitative Probability: Average Probability per Flight Hour on the Order of < 10 -9 Catastrophic TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

AMC 25. 1309 / AC 25. 1309 -1 If it is not technologically or economically practicable to meet the numerical criteria for a Catastrophic Failure Condition, the safety objective may be met by accomplishing all of the following: (1) Utilizing well proven methods for the design and construction of the system (“deterministic approach”) and (2) Determining the Average Probability per Flight Hour of each Failure Condition using structured methods, such as Fault Tree Analysis, Markov Analysis, or Dependency Diagrams (“probabilistic approach”) ; and (3) Demonstrating that the sum of the Average Probabilities per Flight Hour of all Catastrophic Failure Conditions caused by systems is of the order of 10 -7 or less TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

AMC 25. 1309 / AC 25. 1309 -1 If it is not technologically or economically practicable to meet the numerical criteria for a Catastrophic Failure Condition, the safety objective may be met by accomplishing all of the following: (1) Utilising well proven methods for the design and construction of the system (“deterministic approach”) and (2) Determining the Average Probability per Flight Hour of each Failure Condition using structured methods, such as Fault Tree Analysis, Markov Analysis, or Dependency Diagrams (“probabilistic approach”) ; and (3) Demonstrating that the sum of the Average Probabilities per Flight Hour of all Catastrophic Failure Conditions caused by systems is of the order of 10 -7 or less TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Proven methods Failures and Hazards – Scenarios (Munich Airport) Human Error Explosion / Fire Mechanical Stresses • Accident involving a H 2 Vehicle • Separation of H 2 supply lines during filling Technical Failures • Deviations of process parameters Environmental Stresses • H 2 release from safety valves • Leakage, loss of containment TÜV Industrie Service Gmb. H TÜV SÜD Group Outdoor installation Overfilling

Proven methods Consequences – Fire tests with Hydrogen and Gasoline Tank Hydrogen (LH 2) Gasoline TÜV Industrie Service Gmb. H TÜV SÜD Group

Proven methods Human Factor ´Operating instructions ´Alarm and danger avoidance plan ´Short briefings ´Regular trainings ´Maintenance strategy TÜV Industrie Service Gmb. H TÜV SÜD Group

Proven methods General safety equipment for the overall plant • Leak proof design of components, suitable materials • Defined explosion zones and safety areas • Dominant P&I system • Emergency-off control-switch system • Specific process parameters monitored • non technical measures • Gas + Fire alarm system • Infrared camera TÜV Industrie Service Gmb. H TÜV SÜD Group

AMC 25. 1309 / AC 25. 1309 -1 If it is not technologically or economically practicable to meet the numerical criteria for a Catastrophic Failure Condition, the safety objective may be met by accomplishing all of the following: (1) Utilising well proven methods for the design and construction of the system (“deterministic approach”) and (2) Determining the Average Probability per Flight Hour of each Failure Condition using structured methods, such as Fault Tree Analysis, Markov Analysis, or Dependency Diagrams (“probabilistic approach”) ; and (3) Demonstrating that the sum of the Average Probabilities per Flight Hour of all Catastrophic Failure Conditions caused by systems is of the order of 10 -7 or less TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Determining the Probability – Causal Analysis Logical OR-Gate Logical AND-Gate Apportionment of quantitative requirements Basic event („= component + failure mode“) TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

IEC 61508: Safety Integrity Level (SIL) for E/E/PES For E/E/PES we expect that SIL 3 or 2 should be sufficient (see IEC 61508 -1, 7. 6. 2. 9). Existing sensors, PLC, and fire protection systems should be able to fulfil these requirements TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

“Playing with numbers” LNG-data (Center for Chemical Process Safety) Further assumptions: (Logic system) = 10 -7/h; Test period: 1 year Series connection SIL 1 (maybe not sufficient) TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

2 nd conclusion • There seem to be no fundamental difficulties with the introduction of hydrogen for aircrafts • More detailed analyses of the - process technology to be used, - E/E/PES, - state of the art of components and systems - organizational measures - Optimized strategies for maintenance and repair - Regular inspections - Training of personnel are still necessary to guarantee the required level of safety • Learning from existing solutions is encouraged TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

Hydrogen Technology – Ready for Take-off with TÜV Aerospace gerhard. klein@tuev-sued. de TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004

The Fourth Triennial International Aircraft Fire and Cabin Safety Research Conference TÜV Industrie Service Gmb. H TÜV SÜD Group Aircraft Fire and Cabin Safety Research Conference Lisbon, Portugal 15 -18 November 2004