by Brian DeGraff, Cryogenic Engineer at Oak Ridge National Laboratory, degraffbd@ornl.gov

Analysis of oxygen deficiency hazards (ODH) is essential for any facility or laboratory that utilizes significant volumes of cryogenic liquids or gases. The human body is not designed to function in an oxygen deficient atmosphere. Researchers at a recent Cryogenic Safety Workshop conducted at the European Organization for Nuclear Research (CERN) presented information about the effects of an ODH atmosphere [1], including data that showed the decreased “time of useful consciousness” as oxygen levels drop, from several minutes at 13 percent oxygen to only 15 seconds at 6 percent oxygen.

The US Occupational Safety and Health Administration considers oxygen deficient any atmosphere with less than 19.5 percent oxygen, and oxygen enriched any with more than 22 percent [2]. Beyond this there is limited standardization, and thus laboratories have adopted localized safety procedures that complicate any effort to analyze and review complicated ODH documentation.

Standardization of ODH analysis and mitigation policy thus represents an opportunity for the cryogenic community. There are several benefits for industry and government facilities to develop an applicable unified standard for ODH. The number of reviewers would increase, and review projects across different facilities would be simpler. It would also present the opportunity for the community to broaden the development of expertise in modeling complicated flow geometries.

A new solution should seek to combine the best elements of both the risk and probability approaches in analyzing ODH. While these two methods employ different techniques and do not necessarily produce the same mitigation strategies, institutions have successfully implemented both for the protection of personnel. Oak Ridge National Laboratory (ORNL) (CSA CSM), for example, uses a risk-based approach while the Fermi National Accelerator Laboratory (Fermilab) (CSA CSM) uses a probabilistic failure approach.

Risk-Based Method

Engineers at ORNL control for ODH hazards using the lab-wide Standards Based Management System (SBMS) [3]. In 2002, engineers developed the initial SBMS when designing the Spallation Neutron Source. The SNS includes a central helium liquefier and a tunnel enclosure that houses 23 cryomodules filled with liquid helium at 2 K. SBMS details have evolved slightly from the original policy in 2002 to the current version, but the top-down risk-based methodology employed for all ORNL has remained consistent.

The SBMS outlines several decision trees as guidance for engineers evaluating and mitigating potential ODH events. The first step in this method is to determine, at a system level, what the potential hazard level to the enclosure may be. It defines an unlikely event as one ODH incident over the 30-year lifetime of the facility.

For the SNS tunnel, there remains an unlikely but credible ODH scenario that could result from the rapid boiling of liquid helium. It could potentially occur under either loss of insulating or beam line vacuum, and would result in safety reliefs flowing cold cryogenic helium gas into the tunnel.

After determining this potential hazard in 2002, the next step for engineers was to assess the resulting oxygen concentration under a full release of all oxygen displacing gases into the enclosure. There is a table in the SBMS policy for both helium and nitrogen that allows for correlation between the enclosure size and volume of liquid helium to the resulting oxygen concentration after a spill. Using this table and given the tremendous volume of helium present in cryomodules in the tunnel and the CHL system, the resulting oxygen concentration in the tunnel would be near zero percent.

As such, the tunnel would score as a “Medium, Not Acceptable” risk once both the accident frequency of “Unlikely” and the consequence severity of zero percent oxygen have been determined and matched up on the risk matrix (Figure 1). Since only “Extremely Low, OK” risks are acceptable, according to SBMS, engineers were required to consider mitigation strategies for the SNS tunnel.

The next SBMS step is to identify the worst possible release scenario to be used in the mitigation effectiveness modelling. In 2002, engineers determined this to be a cryogenic release from a cryomodule resulting in 300 g/s of helium being spilled into the tunnel. Under this release scenario, the mitigation strategy proposed was to install two 10,000 cubic feet per minute (cfm) exhaust fans, with the expectation that one would start in the event of a measured ODH condition from in-place oxygen monitoring sensors.

Engineers then used these parameters to model how the oxygen concentration varied with height as the release plume propagated down the SNS tunnel. Figure 2 shows the results of this time-dependent modeling. It demonstrated that at a distance of greater than 2m away from the release location, oxygen concentration remained around 20 percent in the breathable range of heights less than 2m.

The results of the mitigation strategy were then used to re-evaluate the ODH risk on the risk matrix. While the probability of release was unchanged under this mitigation strategy of in-place monitoring and on-demand ventilation, the resulting consequence of the risk was changed from “High” to “Extremely Low.” The overall risk assessment also changed to the desired category of “Extremely Low, OK.”

This risk-based model has several advantages, and ORNL’s approach provides a simple process for evaluating the potential ODH risk that promotes effective communication with non-technical personnel. It applies an industry accepted risk strategy to the area of ODH analysis and requires very little work in analyzing simple cryogenic systems. It also gives complete flexibility to the engineer to tailor the mitigation strategy to the needs of the project.

To comply with additional administrative controls in the ORNL policy, oxygen monitors must have an approved safety integrity level (SIL) rating, an industry standard for defining a device’s failure rate [4]. ORNL uses the Ultima MSA 1202040 gas analyzer with a SIL-2 rating for ODH protection in the tunnel [5]. Both the ventilation fans and oxygen monitoring hardware are considered credited engineering controls (CEC) that require annual testing and recertification.

But there are also disadvantages to the risk-based approach. It only considers the worst-case release of cryogens and does not require evaluating other possible release scenarios that may require additional mitigation strategies. The analysis for mitigating the consequence of the release is dependent on modeling that engineers at other facilities have shown to be dependent on appropriate release assumptions and boundary conditions.

A physical spill test with oxygen concentration mapping could be performed to improve the accuracy of the model. In addition, only allowing extremely low-risk categories may require several layers of mitigation.

Probabilistic Failure Method

Scientists at Fermilab currently operate several cryogenic experiments with a variety of cryogenic liquids present—including liquid helium, liquid nitrogen and liquid argon—analyzing each for ODH events according to policies defined in the Fermi Environment, Safety and Health Manual (FESHM) [6].

The FESHM method for evaluating ODH hazards takes a bottom-up component probabilistic approach, a policy that provides a detailed quantitative process for evaluating both the likelihood of a specific component failure and the probability that such a release would result in a fatality. It requires engineers to identify all single component failures and credible double failure scenarios.

Each component in a system is then evaluated separately for its potential for a release into the enclosure. At the heart of this approach is calculating an overall “phi,” defined as the sum of all probability products, as shown in equation 1:

The probability of failure (Pi) is expressed in units of failures/hr and the probability of fatality (Fi) is expressed in units of fatalities/failure. This gives the calculated units of fatalities/hr.

The process for calculating the for an individual component requires several pieces of data about the system. First, engineers must tabulate the number of similar components, like welds on the same piece of pipe, and then second, qualify the type of release. Engineers analyze most components under both a higher probability leak scenario and a lower probability rupture scenario. Third, they use FESHM tables to assign the quantitative Pi failure probability for the component.

Next, engineers must determine the release cross-section area of the flow release. For a weld on a circular pipe, this might be defined as a 1⁄8” wide crack along ¼ of the circumference. The specifics of how to determine this release area is up to the judgment of the subject matter expert. Once the release area is calculated, engineers can calculate the flow into the enclosure using standard engineering practices.

The resulting oxygen concentration inside the enclosure from each component release flow is calculated under these specific assumptions: full mixing throughout the volume, infinite cryogen inventory and steady state oxygen concentration as time approaches infinity. This means that any small flow into an enclosure without ventilation will eventually result in an oxygen concentration of zero. FESHM does provide several equations for calculating the oxygen concentration for a release in the presence of both exhaust and intake ventilation.

With the final steady-state oxygen concentration, the probability of that release resulting in a fatality can be obtained from the FESHM graph shown here in Figure 3:

The graph shows that the calculated fatality factor for oxygen partial pressures less than 65 mmHg (8.8 percent) is one. It also shows that the calculated fatality factor for oxygen partial pressures greater than 135 mmHg (18 percent) is zero. Between these partial pressures, the linear equation on the log scale shown on the graph is used.

One critical element to note for this quantitative approach is that engineers must also take into account the failure probabilities of the mitigation hardware. For example, the calculation of the overall for an enclosure with two on demand ventilation fans must be calculated according to Equation 2.

Once the overall is calculated, engineers can then classify enclosures as either ODH 0, ODH 1 or ODH 2. ODH 0 requires no additional mitigation measures, but a classification of ODH 1 or ODH 2 calls for additional mitigation activities to give the enclosure an equivalent level of safety as an ODH 0 enclosure. These additional mitigation measures include warning signs, fixed area oxygen level monitoring, personal oxygen monitoring, medical approval and personal escape pack.

The probabilistic approach has several advantages. It is a flexible approach that can be used for all cryogenic fluids and gases and it has a proven track record at Fermilab across many different size projects from the large scale Tevatron helium and nitrogen cryogenic system to small liquid argon dewar experiments. The approach also requires engineers to take a detailed look at the system down to the component level, which often results in other issues with the system design being revealed.

As with the risk-based method, however, there are disadvantages to the probabilistic component failure approach. Creating a detailed analysis is time consuming for the engineer preparing the analysis and it is also rather arduous to review since the volume of data can be overwhelming for larger systems. Thus, the reviewer is often relegated to only spot-checking a sampling of individual calculations. And the failure probabilities used are sometimes only based on industry data that may not directly apply when the details of the applications are compared. Defining all the parameters within a single policy document is challenging. Additional industry statistics could be acquired to improve the accuracy of the leak and rupture release areas.

References:
1. https://indico.cern.ch/event/495194/timetable/#20160921.detailed
2. https://www.osha.gov/SLTC/etools/shipyard/shiprepair/confinedspace/oxygendeficient.html
3. https://sbms.ornl.gov/sbms/SBMSearch/subjarea/GSH/pro7.cfm
4. https://www.isa.org/pdfs/microsites195/tr-8402p1/
5. http://us.msasafety.com/Fixed-Gas-%26-Flame-Detection/Gas-Detectors/Ultima%26reg%3B-X-Series-Gas-Monitors/p/000070001800001090
6. http://esh-docdb.fnal.gov/cgi-bin/ShowDocument?docid=38