SAFETYBARRIER DIAGRAMS FOR DOCUMENTING SAFETY OF HYDROGEN APPLICATIONS

SAFETY-BARRIER DIAGRAMS FOR DOCUMENTING SAFETY OF HYDROGEN APPLICATIONS F. Markert and N. J. Duijm Systems Analysis Department, Risø National Laboratory, Technical University of Denmark, P. O. Box 49, DK-4000 Roskilde, Denmark nijs. j. duijm@risoe. dk, frank. markert@risoe. dk

Background Barrier diagrams serve two main purposes: 1) Evaluation of adequateness of safety measures 1. (part of accident prevention) Are the barrieres reasonable and independent? Are barriers missing? 2) Communication to all stakeholders Illustrating the possible accident scenarios and safety measures taken to prevent them - Safety-barrier diagrams have been popular in Denmark as a risk analysis tool. - Safety-barrier diagrams are also useful for analysisng the new hydrogen technologies Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 2

Definition of a safety barrier • A barrier function is a function planned to prevent, control, or mitigate • the propagation of a condition or event into an undesired condition or event; A safety barrier is a series of elements that implement a barrier function, each element consisting of a technical system or human action. Level indicator Signal Detection Paper 4. 1. 143 - Alarm Button Signal Operator Diagnosis Powered valve Action 2 nd ICHS, San Sebastian 11 th-13 th September 2007 3

Graphical presentation of a safety barrier Safety barrier Fault tree representation Condition on success is optional Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 4

BARRIER DIAGRAMS Barriers can be of different types: Ø Active versus passive barriers Ø Automatic versus manual barriers Examples of barriers: Ø An alarm for high level in a tank. Ø A sprinkler system in a building to prevent fires in developing. Ø A dike surrounding a tank, designed to contain accidental spillage from the tank. Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 5

CONSTRUCTION OF BARRIER DIAGRAMS The construction of barrier diagrams consists of 4 steps: 1. Construction of e. g. the event chains When constructing barrier diagrams one must start with ignoring all the existing barriers! The main structure of the barrier diagram is the event chains, which may consist of elements from both the event tree and the fault tree method. Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 6

STEPS IN CONSTRUCTING BARRIER DIAGRAMS 2. Inclusion of the barriers. Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 7

STEPS IN CONSTRUCTING BARRIER DIAGRAMS 3. Once the barrier diagram is finished, the level of safety should be evaluated Ø to determine whethere are sufficient barriers against the undesired events happening Ø When evaluating the diagram one must consider: • The frequency/probability of the initiating events • The severity of the end events (consequence assessment) • The number, coverage and reliability of barriers in each of the event chains in the diagram 4. (optional) Classification of barriers according to type or evaluated reliability of the barrier. . Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 8

Safety-barrier diagrams are simpler than fault trees Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 9

Dependency can be included via the ”Common Element” Common Element indicated: ”Single Operator” Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 10

Important properties of safety-barrier diagrams • Barriers may not be bypassed • Events/conditions and barriers are unique • Paths through diagrams can converge and diverge; divergence can be exclusive (as in an event tree) or simultaneous (or parallel) Convergence Divergence Exclusive Paper 4. 1. 143 - Simultaneous/parallel 2 nd ICHS, San Sebastian 11 th-13 th September 2007 11

Important properties (continue) • Diagrams can be split into connected sub-diagrams; Connected • diagrams can be put together into a single diagram that fulfils the above conditions The probability of conditions in a safety-barrier diagram can be derived from the • probability of the initial conditions and • probabilities of failure on demand of the barriers. Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 12

Comparison with other (graphical) risk analysis methods • Barrier diagrams are developed from cause-consequence diagrams • Cause-consequence diagrams combine fault trees and event trees • Barrier diagrams simplify the presentation of safety systems (”and” • gates in fault trees) A ”Bowtie” diagram is a safety-barrier diagram with a single ”Critical Event” Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 13

Example safety-barrier diagram Process flow diagram for a hydrogen refuelling facility with cryogenic delivery Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 14

Safety-barrier diagram for the unloading of a LH 2 -truck Safety-barrier diagram for the unloading of a liquid hydrogen truck at a refuelling station on the basis of the FMEA study by Venkatesh S. , et. al. ; Failure modes and effects analysis for hydrogen fueling options. California Energy Commission; 2004. Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 15

Barrier diagram evaluation & type classification Barrier Name Description Barrier Type Unloading Activated Barrier Inspection Procedural (Observation of local conditions not using instruments) On arrival of the truck, the truck is inspected visually for defects by driver or station operator (need to be decided who). The mitigation action what to do in case defects are noted need to be included. Hydrogen sensors Activated Barrier - Warned Hydrogen sensors are located near the unloading (Human Action based on facility passive warning) The sensors themselves do not mitigate the presence of an explosive atmosphere, so a follow up has to be found in terms of alarms, evacuation, close down of unloading operation, close down of potential ignition sources Inspection of hoses Activated Barrier Inspection of hoses before unloading/connection Procedural (Observation of local conditions not using instruments) Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 16

Barrier diagram evaluation & type classification Inspection of Activated Barrier Connections are inspected before unloading action connections Procedural (Observation is started of local conditions not using instruments) Supervision during unloading Paper 4. 1. 143 - Activated Barrier Procedural (Observation of local conditions not using instruments) The unloading action is monitored by personnel. Note that the personnel may become disabled by freeze burn - consider additional remote monitoring Deviations of the unloading lead to aborting the unloading action 2 nd ICHS, San Sebastian 11 th-13 th September 2007 17

Barrier diagram evaluation & type classification Barrier Name Barrier Type Personal protection Temporary Passive Unloading operator and truck driver have Barrier - Put in place (and donned protective clothing against removed) by person cryogenic burn ("Nomex suit") Limited access Activated Barrier A safety distance around the truck and Warned (Human Action unloading facility where access is based on passive warning) prohibited to third parties and personnel not involved in the unloading action. Venting prior disconnection Activated Barrier Procedural (Observation of local conditions not using instruments) Unloading hoses need to be vented prior to disconnection Collision prevention Temporary Passive Barrier - Put in place (and removed) by person /Permanent Passive Barrier/Activated Barrier warned Temporary Passive Barrier The unloading facility can be protected against external impacts such as third party traffic by: a) caution cones, b) concrete poles, and c) impact resistant movable fences/barriers 18 Paper 4. 1. 143 - Description 2 nd ICHS, San Sebastian 11 th-13 th September 2007

Conclusions The methodology of safety-barrier diagrams has been introduced and exemplified by the safety analysis of two sections of a hydrogen refueling station. • Safety-barrier diagrams offer a good overview of the safety precautions that are included in the different sections, and the consequences of the failure of these precautions. • Safety-barrier diagrams support hazard analysis; they do not support or replace the preceding phase of hazard identification, for which exist a range of more suitable methods, such as FMEA or HAZOP • The logic framework used for safety-barrier diagrams and the use of a classification for the different safety barriers forces the analysts to consider the completeness of the barriers (in terms of the detectdiagnose-act sequence) and the role of the safety barrier in the system. Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 19

Conclusions • The safety-barrier diagrams allow both quantitative and qualitative • • assessments to be made. The presentation by means of safety-barrier diagrams is simpler, and thereby easier to understand by non-experts than other graphical methods such as fault trees or event trees. Therefore safety-barrier diagrams are excellent means for documenting system safety and for communication with authorities and other stakeholders. Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 20

Thank you for your attention Paper 4. 1. 143 - 2 nd ICHS, San Sebastian 11 th-13 th September 2007 21