SELECTIVE CATALYTIC REDUCTION (SCR) SYSTEM DESIGN AND OPERATIONS: QUANTITATIVE RISK ANALYSIS OF OPTIONS

To appear in the CCPS 17th Annual International Conference: Risk, Reliab ility and Security by Stephen D. Unwin, Robert W. Johnson and Steven W. Rudy Unwin Company, Columbus, Ohio (614) 486-2245 www.unwin-co.com

and James E. Delargey and William Rogers The Detroit Edison Company, Monroe, Michigan

ABSTRACT Selective Catalytic Reduction (SCR) technologies provide means of reducing NO emissions x from fossil fuel-burning power plants through injection of ammonia into the flue gases upstream of a catalyst bed. The ammonia source for an SCR can be stored in anhydrous form, stored in aqueous form, or generated on demand. This paper describes risk-based methods developed to assess design and operations options for anhydrous ammonia-based SCRs. Underlying the methods was an integrated quantitative risk model of a site-specific SCR system design addressing both safety and economic risk onsite and offsite, for accident initiating events both internal and external to the plant. Following the precedent set in the EPA Risk Management Program (RMP) Rule, the basis for defining onsite and public health impact was an ERPG-2 threshold exposure level. The probabilistic model systematically captured 350 accidental release scenarios, each analyzed for a bout 200 prospective combinations of meteorological conditions. Risk results were presented as individual and societal point risk estimates, f-N curves, risk contours, and both annual and system lifetime economic risks. The model was developed entirely within an integrated spreadsheet framework, allowing rapid sensitivity analyses to address "what-if?" questions for such diverse issues as system siting, the efficacy and reliability of sheltering in place, ec onomic discount rate assumptions (for estimating system lifetime risk), as well as specific system design and operational options. This paper describes aspects of the methodology underlying the SCR risk model.SCR Design and Operations: QRA of Options Page 2

1. INTRODUCTION The Detroit Edison Company is in the process of installing a selective catalytic reduction (SCR) system for NO control at its 3,000 MW Power Plant in Monroe, Michigan. SCR technology x involves the injection of ammonia into combustion exhaust gas in the presence of a catalyst, reducing the NO to produce water vapor and nitrogen. A preliminary step in this project was x consideration by Detroit Edison of a broad range of options for system design. One set of options was based on a system that would require the onsite storage of anhydrous ammonia. The system would consist of: ï railcar and truck unloading stations ï ammonia storage tanks ï SCR reactors ï transfer piping with various options for equipment siting, design specifics, and operational strategy. Accident risk was to be one consideration in the assessment of options. Unwin Company was contracted to help develop a quantitative risk assessment (QRA) as a decision resource. Among the further objectives of the study was to develop a versatile, updatable risk model that could be used throughout the lifetime of the SCR system to address accident risk issues. To meet this objective, the risk model developed was integrated entirely within a Microsoft ExcelÆ framework, thus eliminating reliance on proprietary risk analysis software, and thereby enhancing the portability and usability of the model.

2. SCOPE AND METHODOLOGY 2.1. Scope The study assessed the health and economic risks associated with nonroutine, episodic releases of anhydrous ammonia to the environment. The endpoint concentration used for determining potential health effects from ammonia vapor inhalation was the emergency response planning guideline level 2 (ERPG-2) of 200 ppm by volume. This choice is consistent with the pr ecedent set by the EPA in using the ERPG-2 as the level of concern in the RMP Rule, 40 CFR Part 68, to define potentially exposed populations. Thus, individuals at a particular location were counted as being receptors of an ammonia release if that location was within an area for which the predictedammonia concentration was 200 ppm or greater, regardless of the exposure duration. The ERPG2 is defined as the maximum airborne concentration below which it is believed that nearly all individuals could be exposed for up to one hour without experiencing or developing irreversible or other serious health effects or symptoms that could impair their abilities to take protective action.SCR Design and Operations: QRA of Options Page 3 Economic consequences addressed in the analysis included potential costs associated with forced plant shutdowns and with off-site emergency response. Economic risks were assessed both as annualized liab ilities and as disc ounted costs over an anticipated 30-year SCR system lifetime. The study covered all onsite handling of anhydrous ammonia in connection with SCR operations, from bulk receipt by rail or truck to unloading, bulk storage, and transfer to the ammonia injection manifolds, to the introduction of vaporized ammonia and dilution air into the flue gas stream upstream of the SCR reactors. From this point, the ammonia would be very dilute, buoyant, and in gaseous form, and as such would not pose a significant inhalation hazard in comparison to the handling of anhydrous ammonia as a liquefied gas. Risks associated with ammonia transportation to the site were also addressed in the study. In addition, a quantitative external events screening assessment (accident-initiating events that are not intrinsic to operation of the ammonia-handling facilities) was c onducted addressing seismic hazard, tornado hazard, aircraft impact, ambient temperature extremes, windstorms and site flooding. In the current paper, we have confined attention to methods for modeling the risk associated with internal accident initiating events at the plant. The study elements i nvolving transportation risk and external event hazards are not the focus of this paper. 2.2. Methodology As in any rigorous QRA, our methodology was based upon the systematic identification of hypothetical accident scenarios - in this case scenarios involving the release of anhydrous ammonia from the SCR system. The model addressed (a) the likelihoods, and (b) the severities of consequence, of the hypothetical scenarios, and integrated this information into various standard risk forms. The risk model was structured within an Microsoft Excel spreadsheet. This spreadsheet Æ automates numerous aspects of the model implementation, thus fac ilitating rapid sensitivity analyses in which the risk-impact of varying input assumptions can be determined. The analysis broke down roughly into two phases, the front-end analysis and the back-end analysis. Figure 1 illustrates the boundary between these two analysis phases for a typical ammonia release scenario. 2.2.1. The front-end analysis The front-end phase involved the systematic identification of accident scenarios, defined up to the point in the time-line when an unmitigated ammonia release occurs. Reflecting the ultimate boolean-based structure of the risk model, each scenario is referred to as a (minimal) cut set of an ammonia release. A cut set is a minimal combination of events that is sufficient to result in an unmitigated release of ammonia from the SCR system boundary. Each cut set is comprised of a

## Impacts

Loss Event Mitigated at source

Unmitigated Ammonia release ( e.g., excess flow valve actuates) Anhydrous ammonia contained and

controlled

within primary containment (vessels and piping systems) (# exposures/ cost impacts, depending on meteorological

conditions) Front-End Analysis Back-End Analysis



## Impacts (# exposures/ cost impacts, depending on meteorological

conditions) SCR Design and Operations: QRA of Options Page 4 time-series of events, the first of which is the so-called initiating event, or initiator . A typical initiator may be external leakage from a system component, or the unanticipated motion of an unloading vehicle leading to rupture of an unloading hose. Subsequent events in the cut set would generally involve failure of the safeguards that are in place to mitigate the initiator, such as failure of isolation valves to close or failure of other system interlocks.

FIGURE 1 TERMINOLOGY USED FOR DESCRIBING A TYPICAL AMMONIA RELEASE SCENARIO

A brainstorming approach, similar to the Hazard and Operability (HAZOP) Study met hod, was used to identify cut sets; although, to meet the needs of the risk model, the information generated was in a more structured and comprehensive form than that typically associated with a HAZOP study. Twenty-one study nodes were examined, resulting in the identification of 350 cut sets. Based on review of design specifics, potential leak/release sources, anticipated operating practices, and generic failure rate data, the likelihood of each cut set was estimated. This cut set quantification process was based on classical Poisson-based reliability modeling met hods. Estimation of release initiator frequencies was based on system component-counts, estimates of release frequencies per component for a range of hole sizes, and consideration of specific operational events that could result in an ammonia release.SCR Design and Operations: QRA of Options Page 5 To provide a practical interface with the back-end analysis (which involved ammonia dispersion modeling), the numerous cut-sets identified in the front-end needed to be consolidated (i.e., grouped) into a series of release bins . A release bin is a grouping of all cut sets that provide equivalent initial conditions for the subsequent evolution of the accident scenario. The factors that govern this equivalence are:

 Approximate location of the release: 8 representative release locations were identified. Cut sets were assigned to release locations depending upon the geographically closest release point associated with the events described in the cut set.

 Rate of release of ammonia vapor: 4 representative release rates were identified, ranging from 90 to 12,000 pounds /minute. The risk model performs an automatic calculation of release rates associated with each scenario based on specified factors such as leak hole size, system pressure, and ammonia phase (vapor or liquid), and then automatically associates each cut set with the closest representative rate.

 Duration of the release: 3 representative release durations were identified: 3, 10 and 30 minutes. Cut sets were assigned to representative release durations based on considerations such as whether the release point is ultimately isolated, whether isolation is automatic or manual, and the available release inventory before/after isolation. These factors, in aggregate, are referred to as the release source term . That is, each release bin defines a representative source term. The release bins then act as surrogates for the cut sets they contain in providing the initial conditions for the back-end analyses. The annual frequency associated with each of the 96 release bins is equal to the sum of the frequencies of the cut sets it contains. 2.2.2. The back-end analysis The interface between the front-end and back-end analyses is the set of release bins along with their associated source terms and frequencies of occurrence. In the back-end analysis, the severity of consequences was estimated for each release bin. Three consequence categories were considered for each release bin: 1. Offsite (public) health consequences, measured as the number of offsite individuals occupying the land area that is affected by the release bin 2. Onsite (Detroit Edison personnel and other individuals on site) health consequences, measured as the number of onsite individuals occupying the landSCR Design and Operations: QRA of Options Page 6 area that is affected by the release bin, including occupants of buildings with air intakes that are within the release plume. 3. Economic consequences, associated with the possibility of the need for emergency response actions, such as offsite actions or plant shut down. Vapor dispersion analyses were conducted for each release bin to assess the area of impact. For each release bin, the range of potential meteorological c onditions was taken into account. Wind rose data (defining various combinations of wind directions, wind speeds, and atmospheric stability classes) provided the basis for defining the range of weather c onditions. These data characterized the joint frequency distribution (i.e., the fractions of time that various combinations of weather conditions prevail) of:

 the atmospheric stability class (Pasquill-Gifford classes A to G, where A is the least stable, and G the most stable)

 the wind speed

 the wind direction (from each of the 16 compass sectors: N, NNE, NE, ..., NNW). The data were consolidated into the following weather categories: Atm. Stability: A/B/C: Unstable D: Neutral E: Slightly stable F/G: Stable Wind Speeds: 0 - 4.5 mph 4.51 - 8.5 mph >8.5 mph Wind Direction: 16 compass sectors (N, NNE, NE, ..., NW, NNW) That is, the total number of combinations of potential weather conditions addressed in the model was 4 x 3 x 16 = 192. A dispersion analysis was conducted for each combination of source term (represented by a release bin) and weather conditions. The dispersion analysis predicted the geographic extent of the resulting ammonia plume coverage, the boundaries defined at a duration-independent concentration of 200 ppm. The annual frequency associated with the outcome predicted by a given dispersion analysis is equal to the frequency of the release bin that defines the source term, multiplied by the fraction of time (probability) that the assumed weather c onditions prevail.SCR Design and Operations: QRA of Options Page 7 The ALOHA model was selected for the dispersion analysis b ecause of its broad acceptance by the emergency response and regulatory communities. Numerous ALOHA calculations were performed to reflect the various combinations of ammonia release rates, release durations, wind speeds, and atmospheric stability classes. The total number of ALOHA runs was 4 release rates x 3 release durations x 4 met stabilities x 3 wind speeds = 144 runs. There was no need to repeat the ALOHA analyses for varying wind directions and release locations since the resultant plume was analytically displaced and/or rotated by the integrated risk model to reflect the varying release locations and wind directions. To facilitate automation of the consequence analyses, the plumes generated by ALOHA were fitted to standardized geometric forms. Review of the plume plots resulted in the selection of an elliptical geometry as generally representative of the plume boundaries. A demographic analysis of the Monroe site environs provided the basis for estimating the number of public receptors associated with each dispersion analysis prediction. The U.S. Census Bureau Landview software and database were used to identify the geographic distribution of prospective offsite residential receptors. Supplementary surveys were c onducted to assess the distribution of prospective industrial, commercial, and marine receptors. An analysis of onsite personnel distribution and air intake locations of occupied structures formed the basis for identifying prospective onsite receptors. In this way, onsite and offsite receptor c ounts could be associated with each calculated release plume. The principal economic consequences assessed for each release scenario were associated with: 1. Power replacement costs resulting from partial or complete shutdown of the plant for the purposes of on-site personnel evacuation, and 2. Recovered costs of community emergency response associated with actions such as the management of public evacuation or sheltering-in-place. For each release bin, consideration was made of whether partial or complete plant shutdown would be initiated, and what degree of offsite response would be expected. Associated costs were then estimated. Power replacement costs were assessed to constitute the dominant ec onomic impact. 2.2.3. Model integration The way in which information produced by the front-end and back-end analyses is integrated by the risk model can be represented in the following simplified form. The frequency F of a given cut-set is given bySCR Design and Operations: QRA of Options Page 8

F = f . Π p j j where f is the frequency of the initiator associated with the cut set, j is an index enumerating the subsequent events in the cut set, p is the conditional probab ility of event j given occurrence of j the initiator, and Π represents repeated multiplication over the index j. j The frequency B of a given release bin is approximated as

B = Σ F k k where k is an index enumerating all cut sets belonging to the subject release bin, F is the k frequency of cut set k, and the summation is effected over all values of k. This expression reflects the so-called small-probab ility approximationcommonly used in risk modeling of rare events. We now define Q as the frequency with which a given release bin occurs (i.e., the associated release source term is realized) in combination with a specific set of weather conditions: Q = B . W where B is the frequency of the subject release bin and W is the fraction of time that the subject combination of weather conditions prevails. With each such combination of source term and weather is associated a set of consequence severities: onsite health, offsite health, and economic. If we enumerate by the index i the set of source term/ weather combinations, such that the frequency of combination i is Q and the i associated consequence severity (for one of the three consequence categories) is C , then the i overall risk, R, with respect to that consequence category (e.g., offsite health risk) is expressed as

R = Σ Q . C ii i where the summation is effected over all combinations of source terms (i.e., release bins) and weather conditions. Plant lifetime economic risk, R', is estimated through application of a discount factor, DF, to future losses (which is a function of an inflation-adjusted discount rate and of the remaining plant lifetime in years), such that

R' = DF . R

where R is the annual economic risk. Another representation of risk is in the form of a complementary cumulative distribution functionSCR Design and Operations: QRA of Options Page 9 (CCDF), sometimes referred to as an f-N curve . A CCDF is a graph showing the frequency (vertical axis) with which a specific severity of consequence (horizontal axis) is exceeded. For instance, consider a level of severity C (such as 100 offsite r eceptors, or a specific level of economic impact). The annual frequency, Q , with which this level of consequence is exceeded is given by Q = Σ ' Q i i where the summation Σ ' is restricted to those release bin/weather combinations i for which

C > C

.

i A CCDF is a plot of Q versus C . A CCDF for each of the risk categories (offsite health, onsite health, and economic) is generated by the model. Another calculated risk type is that of individual risk . This is defined as follows. If we hypothesize a person located continuously at a specific geographic point, the individual risk at that point is defined as the annual frequency with which that person would be an accident receptor. That is, the individual risk, I, at a given geographic point is expressed as

I = Σ " Q i i where the summation Σ " is restricted to those release bin/weather combinations i for which the release plume covers the geographic point at which individual risk is being estimated.

3. REPRESENTATIVE RESULTS For a series of system design, siting, and operational options, Table 1 shows the resultant range of risk estimates. Issues addressed through risk sensitivity analyses included optional ammonia storage locations, annual duration of system operation, means of improving control room habitability in the event of a large ammonia release, alternative testing frequencies for system interlocks, and various hardware options. The values in Table 1 reflect best-estimate model quantification. Additional sensitivity analyses were conducted to address the impact on risk predictions of uncertainties in model structure and quantification. Figure 2 shows a complementary cumulative distribution function (f-N curve) of onsite and offsite receptors for one of the design options considered. Individual isorisk contours were also developed, reflecting the annual frequency with which a hypothetical individual located continuously at a specified point would be exposed to an ammonia vapor concentration exceeding 200 ppm. Figure 3 shows a set of individual isorisk contours for a single design option.1.E-06 1.E-05 1.E-04 1.E-03 1.E-02 1.E-01 1.E+00

1 10 100 1,000 10,000 Number of Individuals in ERPG-2 ZoneAnnual Exceedence Frequency Offsite Onsite Total SCR Design and Operations: QRA of Options Page 10

TABLE 1 RISK RANGES ASSOCIATED WITH SYSTEM SITING, DESIGN AND OPERATIONAL OPTIONS

Risk Parameter Low End High End

Onsite Personnel Risk 1.0 41 (receptors/year) Offsite Public Risk 1.4 13 (receptors/year) Total Health Risk 2.4 49 (receptors/year) Economic Risk 1,900 290,000 ($/year) Lifetime Economic Risk* 24,000 3.7 million (Year 2000 $) * Based on 7% discount factor over 30 year system life

FIGURE 2 COMPLEMENTARY CUMULATIVE DISTRIBUTION FUNCTIONS OF ERPG-2 EXPOSURESSCR Design and Operations: QRA of Options Page 11

FIGURE 3 INDIVIDUAL ISORISK CONTOURS: ANNUAL FREQUENCY OF EXPOSURE TO ERPG-2 CONCENTRATION OR GREATERSCR Design and Operations: QRA of Options Page 12

4. CONCLUSIONS The SCR risk model provided a rapid, convenient but rigorous means of assessing the risk and cost-benefit implications of a series of options for SCR system design specifics, inventory siting, and operating/maintenance strategy. The model was integrated completely within an Excel framework, making use of several custom macros designed to automate various calculational processes. Avoiding the use of proprietary risk analysis software, the resulting model is highly portable and updatable by Excel users. The entire risk model was contained within a single 11MB Excel file. Although not the focus of this paper, the original risk study also addressed risk associated with transportation of anhydrous ammonia to the site, and well as including a quantitative screening study of external hazards, including seismic, tornado, aircraft impact, ambient temperature extremes, windstorms and site flooding hazards. Of the external hazards analyzed, only the tornado hazard revealed the potential to contribute more than a minor fraction of the overall risk of an ammonia release. As in any decision process, accident risk was only one of numerous considerations in the selection of a system design. Ultimately, the decision was taken by Detroit Edison to opt for an SCR system design that does not involve the storage of anhydrous ammonia.