1. Introduction
The shipping sector makes a considerable contribution to global CO2 emissions, accounting for approximately 2.89% of the total emissions (Faber et al., 2020). Accordingly, the International Maritime Organization (IMO) has established environmental regulations to reduce the impact of maritime shipping emissions on the global environment. In 2018, the IMO adopted the initial greenhouse gas (GHG) strategy toward carbon-free shipping by phasing out GHG emissions from the shipping sector in this century, with a 50% expected reduction in GHG emissions by 2050 compared with the 2008 level (Korean Register, 2022). In July 2023, the IMO adopted a strategy to reduce GHG emissions from international shipping with enhanced targets to address ship-induced emissions. The revised IMO GHG strategy includes an enhanced target of achieving net-zero GHG emissions from international shipping close to 2050 and a commitment to ensure the introduction of alternative zero and near-zero GHG fuels by 2030 (Korean Register, 2023). To accomplish these goals, researchers, shipowners, and shipyards are actively exploring diverse solutions.
Various alternative marine fuels, including green hydrogen, methanol, and ammonia, can be used to meet the IMO ambitious targets. Remarkably, hydrogen fuel cells are attracting increasing attention because of their potential to produce power with zero emissions, no vibration and no toxicity. Given the limited space available on ships, on-board storage systems must have an efficient volumetric density to ensure an adequate cruising range. The volumetric energy density of liquid hydrogen (LH2) is 8.49 GJ/m3, while that of compressed hydrogen is 4.82 GJ/m3, indicating that LH2 is much more space efficient. Therefore, using fuel cell with LH2 as the power source for coastal ships may reduce CO2 emissions.
Because the fuel type and power generator of ships using LH2 fuel cell differ from those of traditional ships fuelled by diesel and liquefied natural gas, different types of hazards may appear. Furthermore, the safety requirements of the fuel gas supply system required for LH2 fuel cell differ from traditional systems because of the cryogenic temperature, low viscosity, and propensity to promote embrittlement of LH2. Therefore, the safety of the fuel gas supply system for ships using LH2 fuel cell should be carefully considered, and a corresponding preliminary risk assessment is required.
Several techniques are available to identify hazardous events, including hazard identification (HAZID) for determining potential hazards in the system; failure modes, effects and criticality analysis (FMECA) to review the system and evaluate the effects of failures of individual components; and hazard and operability (HAZOP) study to systematically review the process design and operating conditions (Berg and Bakke, 2008). Owing to its practicability, HAZOP is widely used in process hazard analysis (Kang and Guo, 2016;Danko et al., 2019;Peng et al., 2021). However, HAZOP provides qualitative risk assessment without numerical estimates of hazard and operability issues, possibly resulting in the over or underestimation of process protection against potential risks (Lee and Chang, 2014). To complement HAZOP study, layer of protection analysis (LOPA), which is a semi-quantitative risk assessment method, can be adopted (Essl et al., 2022). LOPA has been applied to examine scenarios derived from HAZOP study, define the adequacy of existing safety protection layers, and determine whether additional protection layers are required (AIChE, 2001). LOPA provides sufficient precision for quantifying the risk of scenarios.
Prabana applied HAZOP–LOPA method to LNG fuelled ship. Several risks were identified by HAZOP study and were mitigated by LOPA (Prabana, 2018). Lee and Chang applied HAZOP– LOPA method to assess volatile organic compounds recovery system. In particular, HAZOP study identified critical deviations causing hazards, assessed associated risks and qualitatively determined potential incident consequences, followed by LOPA as a more quantitative method (Lee and Chang, 2014). Wang et al. adopted HAZOP–LOPA method and safety integrity level (SIL) analysis to assess acid diallyl ester demulsifier production process. In the analysis, the detailed calculation for determining the SIL of safety instrumented functions (SIFs) using LOPA was demonstrated, and the results indicated that all SIFs have SIL1 (Wang et al., 2023). To the knowledge of the authors, no studies have examined the application of HAZOP–LOPA method on hydrogen fuel gas supply system or LH2 vessels.
This study aimed to assess the risk of a novel hydrogen fuel gas supply system for a ship using LH2 fuel by applying HAZOP –LOPA method to provide information for risk comparisons of scenarios, aiming to help decision-making for improved ship design. Ship design must follow the prescriptive rules of the classification societies. However, increasing environmental regulations are leading to the adoption of new fuels and systems as well as to gaps in the development of prescriptive rules. To address these gaps, we aim to support the verification of new technologies using HAZOP–LOPA.
The remainder of this paper is organised as follows. In Section 2, the conceptual designs of a ship using LH2 fuel cell and a novel hydrogen fuel gas supply system are described. In Section 3, the implementation of HAZOP study and LOPA method for risk assessment is presented. Section 4 presents the results and discussions. Finally, we draw conclusions in Section 5.
2. Conceptual design of ship powered by LH2 fuel cell
2.1 Conceptual ship design
The target ship was a coast guard patrol ship equipped with an LH2 fuel tank, fuel gas supply system, and proton exchange membrane fuel cell (PEMFC). The design concept of the ship was adapted for fuel cell applications and LH2 tank installations. Figure 1 shows the detailed concept of the coast guard patrol ship powered by LH2 fuel cell.
The wheelhouse is in the middle of the ship, as outlined in Figure 1. The spaces under the main deck are divided into forepeak voids, LH2 fuel tank rooms, fuel preparation rooms, crew spaces, propulsion motor rooms, void spaces, and steering gear rooms. The containerised fuel cell are installed on an aft deck. Table 1 summarises the general specifications of the ship design. The ship has electric propulsion with 3.52 MW from the 320 kW from each of 11 PEMFCs with a margin installed in the fuel cell room. This power is obtained from electric load analysis, as listed in Table 2.
2.2 Conceptual design of novel hydrogen fuel gas supply system
Figure 2 shows the process flow diagram of the proposed hydrogen fuel gas supply system. LH2 stored in the fuel tank is vaporised through a pressure build-up unit (PBU), a type of heat exchanger, to increase the pressure within the tank. When the pressure inside the tank reaches 5 bar, LH2 is supplied to the gas valve unit attached to the PEMFC. Then, LH2 vaporises and warms in the vaporiser to meet the temperature requirements of the PEMFC. A glycol–water mixture is used for heating and vaporisation of LH2. The glycol–water mixture is pressurised using a pump and then transported to a glycol heater to undergo heat exchange with the PEMFC cooling water, and which makes this system novel. The heated glycol–water mixture is split into two streams, one supplied to the vaporiser and the other supplied to the PBU for heating and vaporisation.
The fuel consumption in the PEMFC for the required power generation was determined as follows:
where η denotes the efficiency of PEMFC, and it was assumed to be 50% in this study.
REFPROP property package in the Aspen physical property system is used as equation of state. The PEMFC was modelled as a ‘conversion reactor’ in Aspen HYSYS. The chemical energy stored in hydrogen is converted to electricity with an efficiency of 50%, and the remainder is released as heat. By using this heat for LH2 vaporisation, the heat and mass balance were derived using Aspen HYSYS, as shown in Table 3.
3. Risk assessment
3.1 HAZOP
HAZOP is a structured and systematic method for identifying potential hazards and operability problems caused by deviations from the design conditions (Hu et al., 2015;Marhavilas et al., 2019). HAZOP is implemented by a multidisciplinary team. The HAZOP team is composed of carefully selected members, who are experts in their disciplines and have broad knowledge and experience. HAZOP identifies process deviations from the system design and purpose by providing various guidewords, such as none, less, more, high, low, and reverse (Dunjó et al., 2010). The system is divided into several subsections called nodes. For each node, deviations are identified by combining guidewords with process parameters (Dunjó et al., 2010).
Each node in the proposed fuel gas supply system is shown in Figure 2, and its piping and instrumentation diagram is shown in Figure 3. Once a deviation is identified, HAZOP identifies possible causes, consequences, and safeguards. Often, recommendations are made when safeguards are insufficient, which can change the design, training, and manual preparation. We consider three nodes for the analysis based on the functions and conditions of the target process:
A risk index is determined as the product of the frequency of hazards and the severity of their consequences. To evaluate and priorities, the risk levels associated with the identified hazards or hazardous events, specific qualitative risk acceptance criteria and risk matrices are used, as shown in Figure 4. The risk matrix has three regions: negligible, as-low-as reasonably practicable, and unacceptable (Ahn et al., 2019).
Considering that HAZOP derives many hazardous scenarios, including less severe consequences, conducting LOPA for all the scenarios would be time-consuming and inefficient. Instead, we select hazardous scenarios with high risks using a risk matrix and then conduct LOPA. The P&ID of the novel hydrogen fuel gas supply system is shown in Figure 3. The scenarios selected in HAZOP for LOPA are listed in Table 4.
3.2 LOPA
We use LOPA to examine various hazardous scenarios generated by HAZOP. To approximate risk, LOPA typically uses an order-of-magnitude basis for the initiating event frequencies, severity of consequences, and failure frequency of independent protection layers (IPLs) (AIChE, 2001). Similar to the HAZOP team, the team members of LOPA development include process engineers, plant operators, and instrument engineers (Wei et al., 2008). Each scenario in LOPA must establish a cause– consequence pair. The HAZOP-LOPA process are shown in Figure 5.
The causes derived in HAZOP are used as the initiating events, and their frequency is assigned by LOPA. The safeguards identified by HAZOP are investigated using LOPA to determine whether they can be IPLs for that scenario. If they are IPLs, they are assigned a probability of failure on demand (PFD). Although all IPLs can be safeguards, not all safeguards can be IPLs. With the industry risk acceptance criteria typically adopted for fatalities, the consequence frequency would be an order of magnitude between 1.0E−04 and 1.0E−05 per year (Banick and Wei, 2017). The acceptance criterion adopted in this study for consequence frequency is 1.0E−04 fatalities per year and scenario.
We estimate the initiating event frequencies using data from the literature and the assumptions listed in Table 5 (AIChE, 2001).
The heat exchanger tube failure and double-wall tank vacuum loss are assumed to be 1.0E−01 and 8.0E−01 per year, respectively. According to the Center for Chemical Process Safety LOPA guidelines (AIChE, 2001), the frequency range of atmospheric tank failures obtained from the literature is between 1.0E−03 and 1.0E−05. The catastrophic failure frequency of both atmospheric and pressure vessels is assumed to be 1.0E−05 per year (AIChE, 2015). As maintaining a vacuum in the annular space of the tank is assumed to be more difficult, a value of 1.0E−01 per year is reasonable.
An IPL can be a device, system, or human action that can prevent a scenario from progressing to an undesired outcome regardless of the initiating event or actions of other protection layers related to the scenario (AIChE, 2015). IPLs are categorised as passive and active. Passive IPLs include dikes, fireproofing, and open vents without valves, while active IPLs include basic process control systems (BPCSs), relief valves, and SIFs. The PFD assigned to each IPL is listed in Table 6 (AIChE, 2001).
The frequency of BPCS failure is between 1.0E−00 and 1.0E− 02 according to the Center for Chemical Process Safety LOPA guidelines (AIChE, 2015). Considering the cryogenic temperature of LH2, a value of 4.0E−01 is adopted.
The consequence frequency, , is determined by multiplying the frequency of the initiating event by the PFDs of the validated IPLs as follows:
where denotes the frequency of consequence C for initiating event i and Fi denotes the frequency of initiating event i. We use risk criteria as impact terms, namely, fatalities, and conditional modifiers should be considered, including the probability of personnel presence in the affected area, probability of fatality, and probability of ignition. The adjusted frequency of the consequence can be calculated as follows:
Because the area affected by the event is on board the ship, the probability of fatality, Pf, when hydrogen leaks is set to 0.8, that is, 80%. In a ship, because each compartment is segregated by a bulkhead and walls, estimating the probability of fatality is complex and beyond the scope of this study. Unlike onshore plants, the loss of propulsion and blackouts in ships can lead to serious incidents. In particular, when ships navigate through congested areas or heavy waters, incidents become critical and may result in fatalities (Rondon P&I Club, 2018). Therefore, we assume a probability of fatality in the event of propulsion loss of 0.05, despite no hydrogen leaking. The ship does not use shore connections for electricity at the port. Instead, it is assumed to use a PEMFC to meet the electricity demand on board. Therefore, the fuel gas supply system is under operation even at the port, and crew members are on the ship during PEMFC operation. Considering this condition, Pa , which denotes the probability of the crew in the affected area, can be set to 1 and is deemed as a reasonable assumption. Typically, the ignition probability varies depending on several factors, such as the state of fluid released, release location, release rate, ignition location, and degree of confinement (Lee and Chang, 2014). The HyRAM model developed by Sandia National Laboratories recommends an ignition probability of 0.35 when the leak rate exceeds 6.25 kg/s (DSB, 2021). However, as the leakage rate increases, the ignition probability increases drastically (Russo et al., 2018;Aarskog et al., 2020). Because the ignition probability depends on several factors, a more in-depth study should be conducted to obtain a more precise value. Considering ship-specific conditions, such as a higher mass flow rate of fuel, a more confined area than that of onshore facilities, such as refuelling stations, ignition probability Pi was set to 0.5 in this study.
The LOPA results for the hydrogen fuel gas supply system are listed in Table 7. To determine whether the existing IPLs are adequate, the estimated current mitigation is compared with the risk acceptance criterion. If required, additional IPLs are proposed as recommendations to reduce the risk to a tolerable level.
4. Results and discussion
We evaluated several existing IPLs for scenarios identified from HAZOP study and analysed additional IPLs whenever required. As shown in Figure 6, 6 of the 10 scenarios exceeded the selected fatality criterion of 1.0E−04 per year. For scenario 1, which shows an adjusted frequency of consequence of 8.0E−03 per year, additional IPLs with a PFD lower than 1.3E−02, such as the PAHH downstream of PT-103, should be provided. The cause of scenario 3 is an internal PBU leakage, which can be detected by gas detector GD-204 installed in the breathing line of the glycol– water buffer tank. The pressure transmitter installed on the LH2 fuel tank may be considered as an IPL. However, the pressure of the hydrogen line is higher than that of the glycol lines, as listed in Table 3, and it is thus excluded as an IPL. Instead of adding IPLs, reducing the PFD of GD-204 may be recommended because the gap between the criterion and adjusted frequency of consequences is only 6.3E−01.
A loss of vacuum can result in a rapid increase in the temperature of the fuel tank, and the rate of boil-off gas generation may damage the tank integrity. In scenario 6, appropriate measures should be taken to prevent dangerous deterioration of the insulation. Two pressure safety valves (PSVs) installed in the tank are considered as IPLs, and the adjusted consequence frequency is 1.2E−02. PAHH-104 interlocked with a tank isolation valve is not considered as an IPL because isolating a tank is ineffective when the tank pressure increases. The recommendation for this scenario is to install a blowdown valve interlocked vacuum monitoring system with a total PFD below 8.7E−03.
Scenario 7 occurs because TIC-102 fails to drive CV-03 to fully close. Consequently, no glycol–water mixture is supplied to the vaporiser, interrupting LH2 vaporisation and heating. The existing protection layers include a high-pressure alarm (PAH-202) downstream of the glycol–water pump and operator intervention. These two are considered IPLs because an operator intervention without an alarm cannot be considered as an IPL. The recommendation in scenario 7 is providing IPLs with a PFD below 6.25E−03 to establish a buffer tank upstream of the PEMFC installed with a TALL triggering system shutdown. In scenario 8, the electric heater malfunctions and runs at full load, causing CV-03 and CV-04 to close completely, eventually damaging the glycol–water pump. The IPL is the same as that for scenario 7, and it is recommended that an additional bypass line is installed with separate pressure sensors and control valves. In scenario 10, seawater flow control valve CV-06 is closed owing to malfunction. Therefore, the performance of PEMFC cooling is degraded. This can damage the PEMFC and lead to loss of propulsion. The existing IPLs are TAHH-201, which triggers glycol–water pump shutdown, and TAHH-102, which closes XV-02, and they are considered BPCSs. A recommended additional IPL is a temperature transmitter that triggers XV-04 downstream of the seawater cooler, which has a PFD of less than 3.1E−02.
Overall, we evaluated a hydrogen fuel gas supply system using HAZOP–LOPA method for several IPLs, aiming to improve ship design regarding safety. In addition, we found that LOPA could be suitable for assessing novel systems for which no prescriptive rules of classification societies are available because they are newly adopted in the maritime sector.
5. Conculsion
With tightening environmental regulations, the interest in fuel cell and LH2 for maritime applications has grown. Currently, ship design is based on prescriptive rules, but they are not available for hydrogen fuel gas supply systems. To address this gap, we applied HAZOP–LOPA to ship design, aiming to assess a novel hydrogen fuel gas supply system to improve its safety and determine the feasibility of HAZOP–LOPA to assess the newly adopted system in ships under no existing prescriptive rules. HAZOP provided 10 scenarios for evaluation, and 6 scenarios exceeding the criteria were supplemented with additional IPLs. Then, we checked the potential of LOPA to facilitate the quantitative evaluation of novel fuel systems for ships.
The main recommendations derived from the analysis are as follows.
-
For scenario 1, ‘PIC-101 failure driving CV-02 fully open’, additional IPLs with a PFD lower than 1.3E−02, such as the PAHH downstream of PT-103, should be provided.
For scenario 6, ‘Loss of vacuum from tank insulation system’, a blowdown valve interlocked vacuum monitoring system with a total PFD below 8.7E−03 should be installed.
-
For scenario 7, ‘TIC-102 fails to drive CV-03 to fully close’, a buffer tank upstream of the PEMFC installed with a TALL triggering system shutdown should be provided to prevent LH2 supply to PEMFC.
-
For scenario 8, ‘TIC-201 failure driving electric heater full load operation’, an additional bypass line with separate pressure sensors and control valves should be added.
The findings of this study could serve as guidelines for further developments of ships powered by LH2 fuel cell and facilitate the application of HAZOP–LOPA method to marine system evaluation. Furthermore, the proposed concept of hydrogen fuel gas supply system could act as a reference for the design and implementation of ships powered by LH2 fuel cell.