Office of Transportation

and Air Quality

EPA420-R-04-016

October 2004

Safety and Security Analysis:

Investigative Report by

NASA on Proposed EPA

Hydrogen-Powered Vehicle

Fueling Station

Safety and Security Analysis:

Investigative Report by

NASA on Proposed EPA

Hydrogen-Powered Vehicle

Fueling Station
EPA420-R-04-016

October 2004

Safety and Security Analysis:

Investigative Report by NASA on Proposed

EPA Hydrogen-Powered Vehicle Fueling Station

Assessment and Standards Division

Office of Transportation and Air Quality

U.S. Environmental Protection Agency

NOTICE

This Technical Report does not necessarily represent final EPA decisions or positions.

It is intended to present technical analysis of issues using data that are currently available.

The purpose in the release of such reports is to facilitate an exchange of

technical information and to inform the public of technical developments.
With the exception of minor changes, this Report is identical to National Aeronautics and 

Space Administration Report No. WSTF-IR-0184-001-03, titled “Environmental Protection 

Agency Hazard Analysis Report” and prepared for EPA by Stephen Woods, Harold Beeson, and 

Harry Johnson of NASA Johnson Space Center White Sands Test Facility, Las Cruces, NM, 

(September 19, 2003). The Report was prepared under Interagency Agreement No. DW809 39 

802-01-0 

PREFACE 

EPA’s Office of Transportation and Air Quality commissioned NASA (National Aeronautics and 

Space Administration) to prepare this technical report in support of the Agency’s hydrogen and 

fuel cell program. EPA’s program is a part of the federal government’s efforts to encourage the 

development and testing of new technologies that may define a path toward an international 

hydrogen economy. A key component of the EPA program is a unique partnership with 

DaimlerChrysler and UPS that is placing fuel cell powered package delivery vehicles into normal 

commercial service in the region surrounding EPA’s National Vehicle and Fuel Emissions 

Laboratory in Ann Arbor, Michigan. EPA is installing a state of the art hydrogen vehicle fueling 

station at its laboratory that will provide the hydrogen fuel for the fuel cell delivery vehicles and 

for other hydrogen vehicles that may be operated in Southeast Michigan. 

Because of the newness of hydrogen as a fuel and because this is the first hydrogen fueling 

station to be installed at a federal facility, it was necessary to very carefully consider each aspect 

of this project for a number of factors, including safety and security. NASA has extensive 

experience with the handling and use of hydrogen, and EPA commissioned NASA to address a 

wide range of issues relating to system safety, security, and siting. This report identifies issues, 

discusses them, and makes recommendations. EPA has incorporated essentially all of NASA’s 

recommendations in the siting and design of our hydrogen fueling station. 

While this report focuses on a specific type of hydrogen fueling station at a specific location, we 

recognized at the onset that issues applying to the NVFEL setting and facility are much the same 

as those applying to other federal and private facilities. Thus, this report is designed to be of 

sufficient scope to have broad applicability, and we believe that the information NASA has 

assembled and the analysis they have performed will be of interest to others considering working 

with hydrogen as a fuel. The report will be particularly useful to parties proposing to site such 

fueling stations in close proximity to commercial or residential property or as a part of federal 

facilities. 

This report represents a significant initial component of a larger comprehensive body of materials 

that EPA expects to compile and distribute documenting our experience with hydrogen fueling 

infrastructure and the use of hydrogen. Readers will find additional information on EPA’s 

hydrogen and fuel cell program at www.epa.gov/fuelcell. 

i 
Executive Summary 

This report addresses primary safety and siting issues associated with the installation of cryogenic 

liquid and high-pressure gaseous hydrogen systems in proximity to a laboratory facility, 

commercial facilities, a shopping mall, and public thoroughfares. 

The U.S. Environmental Protection Agency (EPA) National Vehicle and Fuel Emissions 

Laboratory (NVFEL), located in Ann Arbor, Michigan, tests experimental and state-of-the-art 

vehicles for emissions and fuel economy. Preparations for a program to evaluate a 

hydrogen-powered medium-duty delivery truck and other hydrogen-powered vehicles 

necessitate the construction of a vehicle-fueling facility able to dispense up to 40 kg of hydrogen 

per day. The bulk of the hydrogen (1500 gal) is to be stored in a conventional pressurized 

cryogenic tank designed to American Society of Mechanical Engineers standards. The hydrogen 

vehicle fuel is to be dispensed as a gas at ambient temperatures into 5000-psi vehicle fuel tanks. 

This facility must coexist safely with existing hazardous materials and operations at NVFEL, and 

must not pose unacceptable hazards to nearby commercial concerns. 

Facility siting locations and hazards for the proposed design were evaluated according to 

aerospace and commercial practice by specialists from the NASA White Sands Test Facility. An 

important design consideration for a potentially hazardous facility is the selection of the facility 

location. Although there is a low probability for a catastrophic occurrence, selecting a site that 

will minimize the effects of such an event is prudent. This document summarizes the potential for 

catastrophic hazards arising from the operation of the EPA proposed hydrogen dispensing station 

on the EPA site. 

Categories of causes and severity were established for equipment failure, operational error, and 

the effects of attack or sabotage under weather conditions expected in Michigan. Three regions 

with separate safety implications were identified, as follows, to best mitigate the identified 

hazards: 

1. The region in the immediate vicinity of the equipment should be secure and exclude all but 

maintenance personnel, to protect personnel from small leaks. 

2. An exclusion zone in the immediate area of the facility, as by defined according to the 

National Fire Protection Association (NFPA) 50B, can be adopted to provide protection 

against unplanned minor releases of hydrogen and shrapnel. This exclusion zone requires 75 

ft of separation. Personnel within the NFPA exclusion zone will typically be fuel suppliers, 

maintenance workers, or dispenser operators who are specifically trained to use the 

dispensing system equipment. General personnel and the public are not under this category. 

3. An additional margin, as large as 175 ft for the 1500-gal quantities planned, is necessary to 

protect against a large, potentially catastrophic release of hydrogen, despite its unlikely 

ocurrence. 

For the purposes of this study, a catastrophic event is one that has the potential to extensively 

threaten facilities, general personnel, or the public beyond the immediate area of the dispensing 

station. While there are many ways the dispensing system might fail or be assaulted, only failures 

or assaults that can release a large portion of the stored liquid hydrogen, or assaults that 

ii 
completely sever pieces of the high pressure system, stand to present a threat beyond the NFPA 

exclusion zone. 

The planned hydrogen dispensing system will store approximately 1500 gal of liquid hydrogen 

and possess three high-pressure gas cylinder assemblies, each with approximately 18 ft 3

 of 6000-

psi hydrogen for “ready” dispensing to vehicles. The WSTF analysis has identified two general 

scenarios for catastrophic events: 

1. Any component failure or attack/sabotage which leads to a spill of a significant portion of the 

liquid hydrogen storage 

2. Violent attack/sabotage capable of completely severing pieces from the high-pressure 

assemblies 

Summaries for assessment of the two scenarios are provided in the following paragraphs: 

First Scenario 

Assessment for the first scenario was for spills of 1500 gal1

, a worst-case event, under various 

weather conditions. In general, the spilled liquid hydrogen, a cryogenic liquid, rapidly vaporizes 

and mixes with air, forming a flammable mixture. Initially, the mixture stays on the ground with 

the cold hydrogen vapors that are denser than air; but as the hydrogen warms, the mixture 

becomes buoyant and soon rises. The potential for a catastrophic scenario can arise if the 

flammable mixture impinges upon public spaces and surrounding structures. Weather conditions 

that would contribute to hazards beyond the NFPA exclusion zone include wind conditions near 

8 mph or greater. Under these circumstances, the flammable mixtures can be borne beyond the 

NFPA 75-ft exclusion zone. Analysis based on WSTF liquid hydrogen spill data and combined 

with TRACE TM 2, an industrial code for the evaluation of the movement of flammable mixtures, 

shows flammable mixtures will likely rise 30 ft or more over the nearest surrounding structures. 

The closest approach of flammable mixtures to structures was found for wind velocities near 8 

mph. The primary hazard is for ignition of the plume and an ensuing flash fire out in the open. 

The amount of thermal radiation could burn exposed personnel caught between the NFPA 

exclusion zone and adjacent structures, but is unlikely to set structures on fire or threaten the 

general public beyond the structures. This threat is short term and will last only several minutes 

while the cloud passes overhead. Without ignition, the further rise of flammable cloud and its 

continued dispersion will lead to dissipation of the hazard. 

A variety of conditions were evaluated and found not to lead to catastrophic scenarios. Low 

wind speeds (4 mph or less) and low outdoor temperatures result in rapid rise of the flammable 

mixtures. High wind speeds dissipate the hydrogen rapidly. While some portions of the 

flammable clouds will possess mixtures with hydrogen-air concentrations that are detonable, the 

large energies necessary to initiate detonation are not available after the mixtures form. The 

hydrogen dispenser is sited away from buildings and constructed without confining surfaces or 

walls. Should a combustible cloud form and be ignited, the resulting deflagration will not 

produce significant overpressures or accelerate into a detonation. Moreover, if the hydrogen 

dispensing system were breached, the likely outcome would be a fire located within the NFPA 

exclusion area. This in itself will prevent a catastrophic situation from developing. 

1 Analysis was performed for 1500-gal quantities of liquid hydrogen. Recent communications with Air Products 

system designers indicate that the tank that is actually installed may have a slightly larger capacity, but the fill point

may be set to less than 1500 gal of liquid hydrogen. 2 TRACETM (Toxic Release Analysis of Chemical Emissions) SAFER Systems, L.L.C., Camarillo, California.

iii 
Second Scenario 

Should an explosive charge strike the pressure assembly in such a way that a cylinder is 

simultaneously freed from the assembly and opened on an end, analysis indicates the component 

could move with sufficient velocity to clear the NFPA exclusion zone and pose lethal danger to 

everything in its path. 

This is a theoretical result obtained using the PVHAZARD code.3

 It requires precise application 

of an explosive force. The high-pressure portions of the system are built to ASME specifications 

and are fairly tough and not likely to be severed easily; therefore, this is a highly unlikely 

outcome. Small pieces of shrapnel confined to the NFPA exclusion zone are the most likely 

result. 

Conclusions and Recommendations 

In summary, the primary catastrophic hazard is a large release of liquid hydrogen that forms a 

large flammable cloud. The cloud can extend over the surrounding facilities and, if ignited, could 

expose the surroundings to a flash-fire threat. Analysis shows that the cloud is likely to rise above 

the surrounding facilities and harmlessly dissipate. The WSTF report evaluates the potential 

outcomes that arise from the release of hydrogen. No attempt is made to numerically determine 

risk. It was determined that the best course is to promote the hydrogen to rise as quickly as 

possible. An infrastructure incorporating a spill pond with gravel and a vapor barrier is 

recommended. 

Safety information and training must be coordinated as necessary with NVFEL personnel, nonNVFEL personnel that may work in proximity to the dispensing system, the Fire Marshall and 

first responders, and local authorities. 

With these precautions observed, the analysis supports the contention that the hydrogen hazards 

accompanying the operation of a hydrogen dispensing station would not pose a risk greater than 

the materials and operations already present at NVFEL. 

3 The PVHAZARD Pressure Vessel Hazard Assessment Software was sponsored by the Air Force (45th Space Wing, 

PAFB) and NASA, with contributions by General Physics Corporation, ACTA, Inc., and Aerospace Corporation. 

iv 
Abstract 

This report addresses primary safety and siting issues associated with the installation of 

cryogenic liquid and high-pressure gaseous hydrogen systems in proximity to a laboratory 

facility, commercial facilities, a shopping mall, and public thoroughfares. The US Environmental 

Protection Agency National Vehicle and Fuel Emissions Laboratory (NVFEL), located in Ann 

Arbor, Michigan, tests experimental and state-of-the-art vehicles for emissions and fuel economy. 

Preparations for a program to evaluate a hydrogen-powered medium-duty delivery truck and 

other hydrogen vehicles necessitate the construction of a vehicle-fueling facility able to dispense 

up to 40 kg of hydrogen per day. The bulk of the hydrogen (1500 gal) is to be stored in a 

conventional pressurized cryogenic tank designed to American Society of Mechanical Engineers 

standards. The hydrogen vehicle fuel is to be dispensed as a gas at ambient temperatures into 

5000-psi vehicle fuel tanks. This facility must coexist safely with existing hazardous materials 

and operations at NVFEL, and must not pose unacceptable hazards to nearby commercial 

concerns. 

Facility siting locations and hazards for the proposed design were evaluated according to 

aerospace and commercial practice by specialists from the NASA White Sands Test Facility. 

Categories of causes and severity were established for equipment failure, operational error, and 

the effects of attack or sabotage under weather conditions expected in Michigan. Three regions 

with separate safety implications were identified, as follows, to best mitigate the identified 

hazards: 

1. The region in the immediate vicinity of the equipment should be secure and exclude all but 

maintenance personnel, to protect personnel from small leaks. 

2. An exclusion zone, as specified by NFPA 50B, can be adopted to provide protection against 

unplanned minor releases of hydrogen and shrapnel. 

3. An additional margin, as large as 175 feet for the 1500-gal quantities planned, is necessary to 

protect against a large release of hydrogen, despite its unlikely occurrence. The primary threat 

from such an event is a flash fire. The best course is to promote the hydrogen to rise as 

quickly as possible. An infrastructure incorporating a spill pond with gravel and a vapor 

barrier is recommended. 

Safety information and training must be coordinated as necessary with NVFEL personnel, nonNVFEL personnel that may work in proximity to the dispensing system, the Fire Marshall and 

first responders, and local authorities. 

With these precautions observed, the analysis supports the contention that the hydrogen hazards 

accompanying the operation of a hydrogen dispensing station would not pose a risk greater than 

the materials and operations already present at NVFEL. 

v 
Contents 

Section Page 

Executive Summary ii 

Abstract v 

Abbreviations vii 

1.0 Introduction 1 

1.1 Background 1 

1.2 cope S 1

2.0 Study of Failure Scenarios 3 

2.1 Analysis Approach 3 

2.2 Categorization of Hazard Zones 3 

2.3 Analysis of Hazards 3 

2.4 Analysis of Released Hydrogen 11 

3.0 Conceptual Siting Design 19 

3.1 General Requirements Review 19 

3.2 Code Requirements Review 19 

3.3 Siting Review 21 

4.0 Conclusions and Recommendations 22 

References 23 

Bibliography 25 

vi 
Abbreviations 

ASME American Society of Mechanical Engineers 

APCI Air Products and Chemicals, Inc. 

BLEVE Boiling Liquid Expanding Vapor Explosion 

CGA Compressed Gas Association 

DoD US Department of Defense

EPA US Environmental Protection Agency

GH2 Gaseous Hydrogen (pressurized) 

LH2 Liquid Hydrogen (cryogenic) 

MIE Minimum Ignition Energy

mJ MilliJoule 

NFPA National Fire Protection Association 

NVFEL National Vehicle and Fuel Emissions Laboratory

OSHA Occupational Safety and Health Administration 

PPE Personal Protective Equipment 

TRACETM Toxic Release Analysis of Chemical Emissions 

WSTF White Sands Test Facility

vii 
1.0 Introduction 

The United States Environmental Protection Agency (EPA) National Vehicle and Fuel Emissions 

Laboratory (NVFEL) located in Ann Arbor, Michigan, is developing the means to demonstrate 

and test hydrogen-powered vehicles. A hydrogen-powered vehicle fueling station is planned for 

operation in 2004. However, on-site storage of cryogenic liquid and high-pressure gaseous 

hydrogen presents serious technical, safety, and security challenges that must be addressed before 

actual work on the project can begin. The station, located on the NVFEL facility, will have 

neighboring industry laboratories and commercial concerns and will be in proximity to public 

thoroughfares. Safety issues in the handling and storage of hydrogen, as well as the consequences 

of terrorist attack, must be examined. NVFEL requested engineering support services from 

NASA White Sands Test Facility (NASA WSTF) to evaluate safety issues for the planned 

hydrogen dispensing station. 

1.1 Background 

The EPA NVFEL in Ann Arbor tests experimental and state-of-the-art vehicles for emissions and 

fuel economy. Recent developments in fuel cell technology have required an expansion of test 

capabilities to include fueling and testing of new hydrogen-powered vehicles. Preparations for a 

new hydrogen-powered, medium-duty delivery truck test program necessitate the construction of 

a vehicle-fueling site capable of dispensing up to 40 kg of hydrogen per day. The bulk of the 

hydrogen will be stored as liquid in a pressurized cryogenic tank holding approximately 

1500 gal, or 60 fills. Hydrogen vehicle fuel will then be dispensed as a gas at ambient 

temperatures into 5000-psi vehicle fuel tanks. 

1.2 Scope 

The work consisted of engineering services in support of the installation of a hydrogen-powered 

vehicle fueling station at the NVFEL. The primary task was to develop siting plans and concept 

design options based on 1500 gal of liquid storage and high-pressure cylinders for gas storage. 

Review services were also required to assist EPA with proposed vendor layout and equipment 

designs and with the resolution of any National Environmental Policy Act and permitting issues 

that could arise in the planning process. EPA provided site drawings for the NVFEL and technical 

specifications for the proposed equipment, as necessary. 

Accomplishing the project objectives included multiple site visits for measurements, verification, 

communication, training, analysis, and planning review. Engineering services included site 

assessment, code review, detailed equipment and process hazard analyses, assault mode 

identification, catastrophic failure characterization, and development of alternative mitigation 

strategies. 

NASA WSTF developed a draft siting and hazards analysis for the fueling station based on a 

typical Air Products and Chemicals, Inc. (APCI) 1500-gal liquid hydrogen (LH2) storage and 

dispensing station, design developed for the California Fuel Cell Partnership. The draft analysis 

incorporated the results of: 

1 
o Preparatory work 

o EPA facility site visit 

o Review of code requirements 

o Hazard analysis of component and operational failures 

o Hazard analysis of catastrophic failures 

NASA WSTF presented the draft report, along with the underlying safety and security analyses, 

in a meeting with EPA engineering, safety and security personnel, APCI engineers, and other 

EPA contracted technical consultants, at the NVFEL on June 10, 2003. The meeting served to 

confirm a mutual understanding of the design requirements; educate EPA personnel on technical, 

safety, and security risks; identify mitigation strategies for reducing risks; and facilitate 

discussion of attendee questions and suggestions. The meeting results and subsequent NASA 

WSTF collaboration in the development of the final site design was incorporated into this report. 

2 
2.0 Study of Failure Scenarios 

The potential consequences of a hydrogen release are directly related to factors inherent in the 

environment, the rate of release, and the quantity released. The characteristics of the potential 

consequences dictate where and how systems are sited. It should be noted that the cause of the 

release, while important in understanding it occurred, may or may not have a bearing on the 

potential consequences of the release. 

2.1 Analysis Approach 

First, three hazard zones are identified, categorized by potential consequences 1) within the 

immediate enclosed area; 2) within a 75-ft exclusion zone; and 3) outside the NFPA 75-ft 

exclusion zone. Any failure scenario that produces consequences that extend beyond the NFPA 

exclusion zones can be considered catastrophic. The following analysis identifies three categories 

of likely causes of hydrogen releases for the proposed hydrogen dispenser system: 1) component 

failure; 2)operator error; and 3) deliberate sabotage or attack. The analysis then categorizes 

potential consequences according to the extent of effects. The categories chosen match 

operational requirements and applicable codes and regulations. 

2.2 Categorization of Hazard Zones 

The potential siting locations, types of hydrogen storage components, and layout of the hydrogen 

system on the EPA facility property suggest three hazard zones categorized by potential 

consequences. The first is defined by small leaks, hydrogen combustion, or controlled releases of 

hydrogen confined within the chain-link fence isolating the system from unauthorized personnel. 

This area is accessed only by authorized, specially trained personnel. The second hazard zone 

includes scenarios with the potential for threat beyond the fencing but within the general locale of 

the equipment. An exclusion zone of a 75-ft radius from storage equipment is required by NFPA 

50A and 50B, and the functions of the storage components in the hydrogen system are applicable. 

The third category represents the greatest threats that come from events with effects that reach to 

the buildings and beyond. Any failure scenario that produces consequences that extend beyond 

the NFPA exclusion zones can be considered catastrophic. 

This analysis does not quantitatively assess the ability of attacks or explosives to inflict damage 

or of the equipment to resist damage. The degree of component or equipment failure is simply 

assumed, the effects of high pressure are noted, the amount of hydrogen released is estimated, and 

the potential effects of hydrogen combustion are evaluated. These are the factors assessed to 

determine consequences. 

2.3 Analysis of Hazards 

Hazards may arise from component failure, from operational mistakes, and through sabotage or 

attack. Discussion of each of these potential causes for hydrogen release is given separately. 

Code analysis of hydrogen dispersion, mixing, and combustion is deferred until Section 2.4. 

3 
2.3.1 Hydrogen Release Hazards Caused by Component Failures 

The hydrogen dispensing system design proposed by APCI is to provide up to 40 kg/day of high 

pressure gas derived from cryogenic LH2 storage. No attempt is made in this report to describe the 

design or operation of the system, except that the system includes an approximate 1500-gal LH2 

storage tank, a pressurizing system with 6500-psi storage, and a dispensing system. The proposed 

system components have been examined for failures that would lead to significant releases of 

hydrogen. The evaluation includes the most probable occurrences of concern, low probability 

events with severe consequences, and venting rates. 

2.3.1.1 Component Analysis Methodology 

The hydrogen fueling station was analyzed for component failure and resultant hydrogen release. 

Major components identified in the main flow path of hydrogen are included in the analysis. 

Minor components and instrumentation discussed in the following paragraphs are categorized by 

subsystem. 

2.3.1.2 Analysis of Release by Subsystem 

Analysis is considered by subsystem. 

Liquid Storage and Vaporizer 

Three categories of potential release are noted in the data received from APCI: 

o Small leaks at connections much less than 1 ft3/min of hydrogen 

o Medium leaks at connections and valve stems around 1 to 10 ft3

/min 

o Large leaks from catastrophic failure of component. 

Small leaks at connections are common and may occur at any of the piping connections. 

Initially, the leak test required by American Society of Mechanical Engineers (ASME) B31.3 

should catch any connection leakage, and regular leak checks at maintenance intervals should 

detect leaks early. Small connection leaks are considered the most plausible under normal 

conditions, and they would release very small quantities of hydrogen. 

Medium-sized leaks from the fill connection, manual valve stems, and liquid vaporizer tubing are 

possible but are mitigated. Leaks at cryogenic liquid-fill connections are common. The estimated 

leak rate of less than 5 ft3

/min would continue until the operator stopped the operation and fixed 

the leak. The extended stem on cryogenic liquid valves greatly reduces the chance of stem 

leakage, but it still may occur over time due to valve cycling. Initially, the leak test required by 

ASME B31.3 will catch any stem leakage. Regular leak checks at maintenance intervals should 

detect leaks early. 

Large leaks from catastrophic failure of the storage vessel, the liquid isolation valve, and 

components such as the liquid strainer and pressure-building regulator are very unlikely without 

outside forces acting on the component. Piping components purchased and installed per 

ASME B31.3 are rated for the environment (pressure and temperature) they will experience. If 

4 
any of the components in this category were to fail catastrophically, the maximum potential 

release would be the entire contents of the liquid storage vessel. 

Compressor System 

Based on the input from APCI, component failures in the compressor system, including the gas 

purifier assembly can be grouped into two categories: a very small leak rate (less than 

1 ft3

/min); or a medium leak rate (less than 5 ft3/min). 

A system leak at a connection is much more likely than one caused by a major failure, and it 

would result in the release of very small quantities of hydrogen. 

Leaks at the connections of the compressors and inter-coolers, or those caused by major failure of 

the separators and purifier might have a 5 ft3

/min leak develop. The leak would vent until a sensor 

closes a supply valve. This large of a leak is possible but unlikely with system leak checks. 

Gas Storage and Filling Station 

Component failures in the gas storage and filling station areas can also be grouped into two 

categories based on the APCI data: small leaks, and leaks that would vent one bank of the storage 

cylinders. Small gas leaks at valve stems or connectors are more likely and would result in the 

release of very small quantities of hydrogen. 

The breakaway fitting seems to be a special case, but it is handled by various safety controls. If 

the system works as designed, it seems unlikely that a large release would follow a breakaway 

fitting failure. 

If the cylinders or the valves attached to either end fail, then one bank of cylinders (13 kg of gas) 

would be released. Since the vessels are built to ASME standards and the valves are purchased 

and installed per ASME B31.3, this is very unlikely under normal operating conditions. 

2.3.1.3 Implications for Release Caused by Component Failure 

Not surprisingly, since the system is per ASME standards, the most likely event under normal 

operating conditions is that of small leaks at connections.4 Regulators, check valves, the 

37-degree flare, the current-to-pressure controller, and the nozzle are also identified as 

components that may be expected to leak during the planned period of system performance. The 

LH2 vessel and the pressure vessels have a very low probability of failure. With the exception of 

the nozzle, all the components in question are only approached by the vendor’s maintenance 

personnel. Large releases caused by the failure of system components are considered unlikely; but 

should they occur, the consequences are explored in Section 2.4. 

2.3.2 Hydrogen Release Hazards Caused by Operation-Induced Failure 

System operations involving personnel and the potential effects of operations unrelated to 

hydrogen dispensing were examined for actions that would lead to significant releases of 

4 Small leaks at connections are common, although unwanted. Depending on the kind of leak check that is performed 

on a regular basis, these leaks may be found and corrected. A decay lead check may not be sensitive enough to detect 

this small of a leak. A portable hydrogen sensor or “bubble” test with a soap film fluid may be more likely to detect the 

leak. 

5 
hydrogen. These operations include maintenance activities, hydrogen loading operations, 

dispensing activities, trespassing, emergency procedures, and accidents involving other EPA 

operations. It is well known that human error overshadows equipment failure as the predominant 

cause of hydrogen incidents. 

2.3.2.1 Discussion 

A discussion of maintenance, filling operations, dispensing, trespassing, emergency procedures, 

and potential accidents involving other EPA operations is given in the following paragraphs. 

Maintenance 

Maintenance and repair operations on the hydrogen system are only conducted by vendor-trained 

technicians. Standard procedures for repairs involving hydrogen-wetted components require 

purging of the hydrogen before personnel start repairs and, if necessary, purging the air before 

hydrogen is again introduced to the system. Operations are performed with several personnel on 

hand using the “buddy system,” appropriate personal protective equipment (PPE), and hydrogen 

detectors. Emergency shut-off switches are conveniently located. Only small hydrogen releases 

are expected from maintenance operations. 

Filling Operations 

Supply of hydrogen to the dispensing system is performed by trained vendor crews. Operations 

will be coordinated in advance with EPA facility receiving staff, and the vendor crews will use 

the “buddy system” during the refueling operation. Barriers protect the LH2 storage tank and 

system from collision by the hydrogen tanker truck or other vehicles. Both the hydrogen 

dispensing station and the refueling truck possess automatic shutoff equipment, in case 

connecting lines fail or disconnect. Hydrogen gas lost during chill-down of system components 

during refueling is vented in a controlled manner. Only small hydrogen releases are expected 

from refueling operations. 

Dispensing 

Training is required for vehicle operators who refuel the hydrogen-powered vehicles. The 

hydrogen dispensing system requires a security password, and fuel nozzle interconnects must be 

electronically verified before hydrogen fueling can commence. The dispensing system is designed 

for breakaway and automatic shutdown should a driver inadvertently drive away with the nozzle 

connected to the vehicle. Only small hydrogen releases can result. 

Trespassing 

Trespassing and vandalism are mitigated by EPA area security and system location. Housing of 

the liquid and high-pressure gas handling portions of the system is behind a locked security fence. 

The controls described under dispensing also serve to protect the system against unauthorized use 

and manually inflicted damage. Only small hydrogen releases are expected to result from 

intruders who are just curious or bent on minor vandalism. 

6 
Emergency procedures 

Emergency procedures for system failure modes and for EPA personnel response are not yet 

available for review. General system shutdown switches will be provided in accessible locations, 

both remote from and at the hydrogen dispensing station. The vendor will control what specific 

responses are taken to mitigate failure modes. The vendor’s actions to mitigate an emergency 

should be carefully reviewed in advance of fuel-dispensing operations by the EPA. The EPA 

should also establish facility-wide emergency procedures in response to potentially catastrophic 

occurrences. Errors in judgement handling emergency situations, combined with malfunctioning 

instrumentation, although very rare, have led to catastrophic failures of hydrogen vessels in the 

past (Edeskuty and Stewart 1996). Depending on the circumstances, a large hydrogen release 

could occur. 

Accidents Involving Other EPA Operations 

Operation of heavy vehicles, fuel tankers, and other activities that could threaten the hydrogen 

dispensing station should be carefully reviewed and controlled. Failure of the barricades that 

protect the hydrogen dispensing station from vehicles could result in a large release of hydrogen. 

The circumstances surrounding the release of hydrogen from a vehicle collision could be further 

compounded should the colliding vehicle contain fuel, oxidizing materials, or hydrogen. EPA 

will consider these factors in siting, design of barriers, and in planning other operations. 

2.3.2.2 Implications for Release Caused by an Error in Operations 

The operation of the hydrogen dispensing station as a demonstration system is planned to last 

several years. For a project of this duration, it is realistic to expect that, from all the operations 

considered above, a small leak is likely to occur. A small release of hydrogen poses a safety 

hazard in the immediate area of the leak. A catastrophic leak of hydrogen resulting from 

operations is very unlikely with this system; however, consequences and considerations for 

catastrophic leaks are presented in the sections that consider catastrophic releases Section 2.4. 

2.3.3 Hydrogen Release Hazards Caused by Sabotage or Attack 

Sabotage or attack differs from other scenarios in that there is a deliberate intent to make the 

system fail in a violent manner. There are too many ways attack or sabotage can occur to consider 

them individually. Therefore, the approach is to consider several likely means as examples and 

group them by their potential consequences. 

2.3.3.1 Small Penetration 

Any action that causes a small penetration into a hydrogen system and leads to the unplanned 

release of hydrogen is considered here. Examples would include rifle fire or the use of a large 

crowbar to spear or shear the equipment. Consequences might include: 

o	 Loss of vacuum in the vacuum annulus of the LH2 storage tank, which could lead to a large 

heat leak and excessive venting of product through the relief system 

o A jet of LH2 or cryogenic gaseous hydrogen (GH2) from the LH2 storage tank 

o A jet of GH2 from connecting hardware 

7 
o A jet of GH2 from the pressure bottles 

o A jet of GH2 from the dispenser or fill line 

Considerations can be separated for the cryogenic subsystem and the high-pressure components. 

2.3.3.1.1 Cryogenic Vessel Subsystem 

Two cases can be considered: penetration of the outer wall, or penetration of both the outer and 

inner walls of the LH2 storage vessel. 

Outer Wall 

Breaching only the outer wall introduces air to the vacuum-jacketed region, but does not release 

hydrogen from the inner vessel. The loss of vacuum and introduction of air will increase the heat 

impinging on the inner vessel and cause an increase in the rate of GH2 boil-off from the vessel. 

A larger heat leak caused by a bridge of frozen water or nitrogen is considered unlikely.

5 The 

vacuum annulus is filled, to a large extent, with thermal insulating material (pearlite or Mylar®6 ). 

This material, given a penetration of the outer wall, would slow entry of air into the annulus and 

significantly reduce the amount of air that can enter by displacing the available volume. Both of 

these effects will limit the effect of the heat incursion to the immediate area of the penetration. 

The relief system is specifically designed to safely vent hydrogen should vacuum be lost. 

Penetration of Inner Wall 

With both walls of the vessel breached, air and hydrogen can potentially meet at some point 

external to the inner vessel. However, as noted above, the vacuum-jacketed space is filled with 

pearlite or Mylar in sufficient quantities to displace most of the volume in which a hydrogen-air 

mixture could form, leaving little to combust.7 The hydrogen within the inner vessel is under a 

maximum working pressure of 150 psig and will exit in a plume or jet through the hole in the 

outer vessel wall. Ignition of the hydrogen outside of the outer wall might lead to further heating 

of the system on the outside vessel walls. Given the low emissivity of hydrogen-air reactions, 

radiative heating is not a major concern. External regions with direct exposure to the hydrogen 

combustion will experience high temperatures, but the ASME vessel design can withstand the 

fire. Loss of pressure in the vacuum annulus or heating of the inner vessel if sufficiently extreme, 

will lead to an emergency shutdown of the system. Should a fire result in an internal pressure rise 

greater than the maximum allowable working pressure for the volume, the relief system will 

protect against over-pressure (APCI Proposal). 

2.3.3.1.2 Pressure Components 

A penetration in a pressurized line, connection, or vessel will result in a high-pressure jet of 

hydrogen that can impinge anywhere in the immediate vicinity of the system. Analysis by 

5 Private communication. Walter Stewart’s telephone conversation with S. Woods, May 2003. 

6 Mylar® is a registered trademark of E.I. Du Pont de Nemours and Company, Wilmington, Delaware. 7 Eichelberger, D.P. APCI Proposal to US EPA RFQ #PR-CI-03-10315. Design, Installation, Operation, and 

Hydrogen Supply of a Compressed Gaseous Hydrogen Refueling Station Using Delivered Liquid Hydrogen. Air 

Products and Chemicals, Inc., Allentown, Pennsylvania, March 25, 2003. 

8 
PVHAZARD shows the 0.75-in. ASME construction of the cylinder walls is likely to prevent 

penetration by standard bullets. Smaller lines and fittings would be more difficult to specifically 

target. However, should a component failure occur, TRACETM8 analysis shows that, for a 0.25-in. 

diameter penetration of a 6000-psi vessel, the flammable region of a plume will extend no more 

than 9 m horizontally from the hole. This represents a worst-case scenario for both the driving 

pressure of the plume and the direction of the plume. 

2.3.3.1.3 Summary 

Penetration in either the cryogenic or pressure subsystems will present a fire and/or pressure 

release hazard to personnel, ancillary equipment, or vehicles in the immediate area of the 

hydrogen dispensing system. The safety equipment incorporated into the hydrogen dispensing 

system will preclude the further escalation of hazards such that the exclusion zones specified by 

standards NFPA 50A and NFPA 50B are thought to be adequate. This reasoning applies to 

equipment/component failure noted in the component analysis and failures caused by attack or 

sabotage. 

Additionally, it is noted that, in the opinion of those contributing to this report, the LH2 storage 

tank, ASME pressure cylinders, and compressor sections are sufficiently tough to survive an 

assault by direct rifle-fire. 

2.3.3.2 Explosive Charge 

This analysis examines the consequences of the release of hydrogen. Large explosive charges 

with yields that far exceed the hazard posed by the hydrogen are not considered here since their 

effects would be greater than that of the hydrogen inventory in the dispensing system. Therefore, 

explosive-charges of interest might include a rocket-propelled grenade, plastic explosive, or 

stick(s) of dynamite. The results are distinguished from the penetrations considered above by the 

large size of the opening and attendant shrapnel. 

2.3.3.2.1 Effect of Attack on the Liquid Hydrogen Vessel 

High explosives can produce a large hole or rupture of the vessel, the worst case leading to a spill 

of the entire contents. Ambient surface temperatures, regardless of season, are so high relative to 

the temperature of liquid hydrogen that the spilled LH2 will flash to a gas on contact. Heating the 

LH2 to 300 K will result in an 845-times increase in the volume of the hydrogen. The process of 

heating the liquid to a gas is rapid, with the air supplying much of the heat during mixing. The 

resultant mixture behaves as a plume, subject to weather conditions. The results of this scenario 

are characterized in Section 2.4. 

2.3.3.2.2 Effect of Attack on the Pressure Components 

The hydrogen dispensing system uses three gas storage modules, each with 12 high-pressure steel 

cylinders in a 3- by 4-ft matrix. Each cylinder possesses 1.5 ft3 and in operation will hold 

hydrogen at 6500-psig or, if released, approximately 22.2 m3 at 70 °F, 1 atmosphere. 

Violent failure of pressure components presents several hazards possibilities: 

8 TRACETM (Toxic Release Analysis of Chemical Emissions), SAFER Systems, L.L.C., Camarillo, California. 

9 
o Shrapnel due to the explosive 

o Shrapnel accelerated by the high-pressure gas 

o Rocketing of components 

o Shock waves 

o Fireball 

The design of the modules is such that certain cylinders, should they fail, will act as conduits for 

the release of gas from all 12 cylinders. However, shrapnel from the failure of a cylinder will not 

penetrate adjacent cylinders; hence, by itself, the violent failure of one cylinder is not likely to 

cause a “cascade” failure of the other cylinders in the module. Therefore, the worst case is likely 

to be the sudden release of gas from one cylinder, followed by a flow of hydrogen supplied from 

all of the other 11 cylinders. Given the placement of the cylinders, other system equipment, and 

the chain-link fence, small shrapnel will be dangerous only in the immediate vicinity of the 

system. 

Should an explosive act cleanly cut through a cylinder and simultaneously sever the cylinder from 

its attachments to the module, the free piece will be propelled like a rocket by the compressed 

hydrogen. This scenario is distinguished from small shrapnel and is extremely unlikely. The 

cylinders are fabricated to ASME specifications and are unlikely to undergo brittle failure. 

However, should this event occur, the horizontal orientation of the cylinders increases the risk for 

injury and greater damage. In the vertical position, a downward trajectory is stopped by the 

ground and upward trajectories with a small pitch will fall back to the ground near the system. It 

is conceivable, given the horizontal orientation that a rocketing cylinder could impinge directly 

on a sister storage module, and rupture another cylinder. The worst-case outcome in this scenario 

would be a larger impulsive release (two cylinders), followed by gas flowing from the other 22 

cylinders of both modules. 

Any sudden release of a gas at 6500 psig will produce a shock wave that may be deadly to 

personnel in close proximity. With any release of hydrogen, ignition is a possibility, so a fireball 

of burning hydrogen may follow its release. The explosion may not be the ignition mechanism, 

since it will act well before the hydrogen can form a flammable mixture with air. 

2.3.3.3 Bonfire 

A bonfire may possess sufficient fuel to heat the system beyond the point where the internal 

hydrogen pressure trips the relief systems and vents. This could arise by an accident involving the 

delivery of other fuels at the facility or by deliberate action. 

The system design and ASME construction provide fail-safe operation under considerable heating 

and provide redundant relief paths to allow hydrogen to be safely vented without rupture of the 

vessel. Boiling liquid expanding vapor explosion (BLEVE) is theoretically possible if the 

contents of the LH2 tank are heated above the critical point causing a BLEVE, but this is not 

considered a reasonable threat. 

10 
2.3.3.4 Vehicle Collision 

Deliberate efforts to use a vehicle collision might succeed in causing extensive damage to the 

system. The vehicle barriers planned for this system are designed to prevent inadvertent contact 

by a maneuvering vehicle. Acceleration of a large ground vehicle could overcome the barrier. 

Impact from a small aircraft could also damage the system and release hydrogen. Either scenario, 

or others like it, are likely to cause a release of all the hydrogen. 

2.4 Analysis of Released Hydrogen 

Hydrogen, with high levels of purity as found in storage systems, must mix with an oxidizer 

before any hazardous reaction can take place. In terrestrial hydrogen systems, air provides the 

greatest concern, whether hydrogen is released into the air, or air enters the hydrogen system. 

One line of reasoning traditionally used to establish the degree of possible hazard is to determine 

the greatest quantity of energetic material that can participate in an accident and determine the 

range of its effects. This so-called quantity-distance evaluation assumes the energetic material is 

premixed to provide a theoretically optimum release of energy, localized at a point, with a 

manner of energy release similar to solid explosives. These assumptions seldom fit hydrogen 

accident scenarios. Therefore, in the case of hydrogen, the key to a realistic evaluation of hazards 

is to determine the following: 

o How much of the released hydrogen can participate to form a combustible mixture 

o The extent of formation of the combustible mixture 

o The type of reaction (fire, deflagration, or detonation) 

o	 The importance of environmental factors such as temperature, wind, and the effects of 

confinement 

A chemical dispersion code was used to evaluate dispersion of hydrogen from liquid spills and 

gas jets. The code also was used to evaluate combustion of hydrogen-air clouds. A pressure code 

helped to evaluate the release of hydrogen and shrapnel from pressurized components. 

2.4.1 TRACE Computations for the Release of Hydrogen 

Toxic Release Analysis of Chemical Emissions (TRACE) is a state-of-the-art chemical dispersion 

analysis code maintained by Safer Systems, L.L.C. of Camarillo, California. The code computes 

the effect of turbulent diffusion and meteorological conditions upon a chemical emission 

according to the Pasquil model of atmospheric dispersion (Pasquil 1961), a model with wide 

acceptance (Burgess et al. 1976). This model assumes Gaussian distribution vertically and 

horizontally of a wind-borne gas entering the air from a localized source. 

2.4.1.1 Liquid Hydrogen Spill Characteristics 

A spill could involve the entire cryogenic inventory of the LH2 vessel (approximately 1500 gal). 

A typical fill of the vessel would result in a saturation pressure of 60 psig. Given a large rupture, 

the sudden exposure of the inventory to ambient pressure or 0 psig will instantly boil or “flash” a 

significant portion of the liquid to cryogenic vapor. At 60 psig, 19 percent would flash, leaving 

approximately 1200 gal to spill onto the ground.9 

9 Farese, David (APCI). Private communication with Don Danyko (EPA), June 13, 2003. 

11 
Several factors influence the characteristics of cryogenic spills. Liquid hydrogen boils at 20.3 K 

under 1 atmosphere of pressure, so any surface at ambient temperatures will have sufficient heat 

to vaporize the LH2. The amount of surface to which the spilled cryogen is exposed affects the 

rate at which the liquid flashes to vapor and warms. The cross-sectional area of the liquid spill 

determines the plume diameter or cross section. At hydrogen’s boiling point, the cold hydrogen 

vapor is heavier than air until it warms to 23 K, where it becomes neutrally buoyant. As the cold 

vapors mix with air, the air is chilled below the dew point, causing condensation and forming a 

visible cloud. After dwelling near the ground and warming sufficiently, the visible vapor cloud 

forms a plume as it rises. 

Time-lapse photographs of LH2 spills conducted at NASA WSTF in 1980 show the general 

behavior of cryogenic hydrogen-air plumes (Witcofski, August 1981). For wind speeds ranging 

from 1.6 to 6.3 m/s, the water vapor clouds traveled 50 to 100 m near the ground, then rose at a 

rate of 0.5 to 1.0 m/s (Witcofski 1981). 

2.4.1.2 Hydrogen-Air Cloud Flammability 

Several points are of interest concerning the flammability of hydrogen-air mixtures within the 

plumes formed by LH2 spills. From the information that follows, it was decided that 4, 8, and 18 

percent-by-volume hydrogen in air would be useful levels of hydrogen to depict in TRACE 

computations. 

The flammability limits for hydrogen-air mixtures range between 4 and 75 percent-by-volume 

hydrogen in air. These data are for combustion in the upward direction. It is the convention to 

provide this information as representative of hydrogen’s flammability limits. However, flame 

fronts observed in hydrogen-air mixtures burn less readily when constrained to burn in a 

horizontal direction, and even less so in a downward direction. The lower flammability limit for 

downward propagation increases to 9 percent-by-volume hydrogen in air, as a direct effect of the 

buoyancy of hydrogen (Benz 1988). In uniform mixtures with low hydrogen concentrations (4 to 

9 percent-by-volume concentration), combustion of the entire volume of a mixture in an upward 

direction is not complete. The combusted region tends to form a volume in the shape of a cone 

that expands in the upward direction, but the mixture outside of the cone is left unburned 

(Sherman et al. 1981). In general, the release of a large quantity of hydrogen forms a plume that 

possesses an increasing concentration of hydrogen towards the centerline of the plume. Initially, 

the central region of the plume may be above the upper flammability limit. In addition, the lowerconcentration, hydrogen-air mixtures require greater initiation energy to ignite. Flow and water 

vapor will also result in greater initiation energy when compared to the same composition 

mixture, but dry and without movement. This fact has importance in the context of a hydrogen 

system located where it is desirable for any release of hydrogen to rise above and clear the tops of 

nearby structures. 

Therefore, as a plume of hydrogen rises, the exterior regions of the plume (the regions likely to 

encounter an ignition source) are less likely to ignite when compared to near-stoichiometric 

mixtures. Should ignition occur in an exterior region of the plume, only the gas in the immediate 

vicinity of the ignition source will tend to burn and the potential for flame propagation or 

deflagration throughout the cloud is reduced. Therefore, unless some process rapidly mixes the 

hydrogen plume to form a near-stoichiometric mixture with air throughout the cloud, the normal 

12 
factors that typically influence mixing (diffusion, buoyancy, wind, and turbulence) in a release 

will not result in complete combustion of the plume. 

The movement of flammable mixtures can be partially deduced by observing the movement of 

the vapor cloud associated with a LH2 spill. From the work performed at WSTF, it was 

determined that the concentration of hydrogen within the water vapor clouds had to be greater 

than 6.8 percent to cool the air below the dew point (Witcofski, March 1981). It must be stated, 

however, that there is an invisible region outside of the vapor cloud, with concentrations between 

4 and 6 percent hydrogen in air, that is flammable in the upward direction. However, for mixture 

compositions in this range, the ignition sources must have energies greater than 1 mJ, or 

approximately 100 times greater than the minimum ignition energy (MIE). The presence of wind 

or water vapor will further increase the amount of energy needed to ignite the mixture. The direct 

initiation of the detonation in hydrogen-air mixtures in free air (or unconfined by solid surfaces) 

requires high-energy shock waves, typically produced from high explosives. With confining 

surfaces present, smaller ignition sources initiate a flame that accelerates until a deflagration-todetonation transition can initiate detonation. Ignition sources commonly found within buildings 

could initiate a detonation, should some portions of a hydrogen-air plume become entrained 

within the associated confined spaces or ducts. Under such circumstances, the lower detonability 

limit10 is 18 percent hydrogen in air. 

2.4.1.3 Limitations of TRACE 

The code is designed to compute the dispersion of a gas in air as either a ground release or a low 

momentum stack release. The code logic assumes that any release initiated from the ground stays 

on the ground and there is no buoyancy. A low-momentum stack release assumes the gas enters 

the atmosphere through an orifice with a defined size, a bulk flow, and then buoyancy is 

computed. The code further checks the elevation of stack emissions for sufficient height, or it 

reverts to a ground computation. These two algorithms do not account for the complete observed 

behavior of spilled LH2. It is possible that should the hydrogen mix and diffuse sufficiently fast 

within the air, the bulk mixture could be dominated by the behavior of the air. However, 

photographs taken of the 1500-gal LH2 spill tests at NASA WSTF (Witcofski 1981) show a more 

complex behavior. When cryogenic hydrogen vapor mixes with air, the air temperature drops 

below the dew point and water vapor clouds form. Time-elapsed photographs of the vapor cloud 

show a short period of wind-dependent ground travel, always followed by their achieving positive 

buoyancy. Therefore, both TRACE algorithms must be used and connected at some point to 

simulate the hydrogen vapor cloud behavior. 

2.4.1.4 Interpretation of TRACE Computations with NASA WSTF Spill Data 

Based on the behavior of hydrogen observed in cryogenic spills, the dispersion of hydrogen, 

using TRACE, was evaluated in two steps. The first step, a TRACE ground computation for a 

given wind speed, is considered for distances that match ground travel for NASA WSTF data. 

The second step is a low momentum stack calculation for an orifice size approximately the 

diameter reached by the ground spill and located at the upper elevation reached by the ground 

spill. An assumption was used in the selection of the temperature of the hydrogen leaving the 

“stack” orifice. While the hydrogen-vapor and hydrogen-air mixture is traveling near the ground, 

the hydrogen is warming. This warming is not computed by TRACE. Trial computations 

indicated that when the initial temperature of the hydrogen is at least 100 K, the plume would rise 

10 Initiation of detonation is a function of a variety of factors in addition to concentration. The experimentally 

measured detonation cell size has been shown to be the critical parameter, most useful in predicting detonation. 

13 
at a rate simulating the cloud behavior observed during NASA WSTF tests. This is the basis for 

the rationale of selecting a temperature of 100 K for the initial temperature of the hydrogen as it 

exits the stack. From the two computations, the distance of horizontal travel was computed and 

compared to the elevation of cloud rise. This result was then compared to site plan distances and 

facility building elevations. 

We note that at odds with this rationale is at temperatures below 100 K, TRACE predicted the 

cloud would sink back to the ground. This predicted sinking behavior runs counter to our 

expectations for the behavior of bulk hydrogen11 above 23 K. This apparent contradiction does 

not necessarily mean that TRACE is wrong.12 Clarification of this issue will require further 

investigation beyond the scope of this effort. However, the experimental evidence shows only the 

vapor cloud moving along the ground then rising. 

2.4.2 Extent of Flammable Clouds 

There are several general risks presented by a hydrogen plume impinging on a structure. It is 

assumed the bulk-air flow would carry the plume around and/or over the structure. The greatest 

risk is for flash fire, which is evaluated in Section 2.4.3. Flammable mixtures aspirated into open 

windows or ventilation ducts will have the confinement and exposure to ignition sources 

necessary to allow accelerating deflagrations or detonation. The fact that most ventilation systems 

mix a stream of outside with internal air (make-up) will lead to a dilution of the mixture. This 

works to reduce hazards. Spaces created by hard surfaces create confinement that can lead to 

deflagration or detonation and the creation of overpressures. Confining walls that cause the wind 

to swirl will improve mixing of the hydrogen with the air. However, only the confined portion of 

the cloud will contribute to the overpressure, except in cases where the shock strength reaches the 

level of explosives and can impinge back on the remainder of the unconfined cloud. 

The TRACE code was run for conditions that pertain to hydrogen-release scenarios in order to 

evaluate hydrogen concentrations downwind of the spill point. 

2.4.2.1 Ambient Temperature Gas Release 

The hydrogen, ready for dispensing, is stored at high pressure under ambient conditions. 

Releases coming from this portion of the system will expand into the surrounding air, forming a 

buoyant plume. With a density 1/15 that of air, a plume of pure hydrogen can rise as fast as 

9 m/s. Combustible regions of hydrogen and air will form at the surface of the plume where 

mixing occurs. Small leaks, if not ignited, will diffuse harmlessly into the atmosphere within the 

chain-link security fence that is planned to surround the system. Larger penetrations will result in 

a high-pressure jet of hydrogen. TRACE analysis of such a jet, released through a 0.25-in. 

penetration and oriented to produce a horizontal plume, shows a flammable plume may extend 

2 to 3 m from the source. If ignited, this would create a loud jet of nearly invisible flame that 

would be extremely dangerous to anything in its path. The jet would only persist as long as high11 It is well known that pure hydrogen vapor is neutrally buoyant in air at 23 K and less dense than air at greater 

temperatures. 

12 For example, one possible explanation can arise from hydrogen’s thermal conductivity being much greater than that 

of air. Consider a bubble of hydrogen vapor surrounded by air with mixing between the two gases occurring along 

the surface of contact. The thermal conductivity of hydrogen may be sufficient to cool the air and density or even 

condense it in the immediate vicinity of the surface. This dense air surrounding the hydrogen would for a time, until 

the hydrogen warms further, cause the combined mass of cooled air and hydrogen to sink to the ground. 

14 
pressure hydrogen is supplied, with the worst case being the entire inventory of a 12-pack 

pressure bottle assembly (approximately 45 to 50 lb of hydrogen at 70 °F). Without ignition, the 

release will safely disperse well within the 75-ft exclusion zone specified by NFPA 50B. 

2.4.2.2 Large Spills with Little Wind 

The tests devised at WSTF in the 1980s constrained the LH2 within a 30-ft diameter pond. The 

1500 gal were spilled into the pond over a period of 35 s. In one test, conducted under low wind 

speed conditions (4 mph), the vapor cloud initially covered a 20 m (60 ft) diameter area generally 

centered over the pond. From the photographs, the outer edge of the vapor cloud appears to rise at 

a rate of approximately 1.5 m/s. After 37 s (see the third frame) the outer edge of the vapor cloud 

appears approximately 50 to 60 m in elevation over the ground, 60-m distant from the spill point. 

Smaller wind speeds or still air will result in the hydrogen plume taking a more vertical ascent, 

harmlessly dissipating in the air. In general, given a small wind velocity, the NFPA exclusion 

zone will not provide adequate safety for this kind of hydrogen release. 

2.4.2.3 Worst-Case Spill Scenarios 

Weather effects were evaluated to see what conditions might create greater hazards for the 

surrounding area. Greater wind speed will move the plume further across the ground while 

increasing turbulence and mixing with air. The WSTF spill tests were conducted under several 

different wind conditions. The data show that with an increase in wind speed the vapor cloud is 

“dragged” further along the ground in comparison to its elevation. However, there is indication 

that the vapor cloud dissipates more rapidly with higher wind speed. 

Stack and ground runs were performed using TRACE for wind conditions at 4, 8, 14, and 20 mph 

with other parameters held constant and simulating the WSTF spill conditions.13 The 8-mph case 

provided the closest encroachment of the hydrogen plume on the surrounding structures. Note the 

cloud spreads along the ground at approximately 45 mph. 

The cloud cross section on the ground is approximately 20 m in diameter and, based on the 

WSTF data, the vapor cloud begins to rise approximately 20 m from the spill. Therefore, the 

horizontal axis shown in the plots must be corrected by translating the plume 20 m. A graphical 

analysis finds the lower 4-percent edge of the plume approximately 30 m above the ground. Such 

a plume originating from the recommended site would clear all neighboring buildings. The 

duration for passage of the plumes in all the cases is several minutes. This assessment is closely 

based on the results of the WSTF tests. The 1500 gal of LH2 was spilled over a 30- to 40-s period 

during those tests. An accident or attack might produce different spill results. 

2.4.2.4 Release with Mitigation 

Two worthwhile strategies are to increase the rate at which the LH2 is vaporized and to reduce the 

diameter of the plume. Given the positions of facilities surrounding the hydrogen dispensing 

station, it is desirable to make a potential release of hydrogen rise as rapidly as possible. Several 

features have been discussed for incorporation into the facility design. These include a spill pond 

that contains crushed rock to enhance heat transfer to the spilled liquid, and slats inserted within 

the chain-link security fence. 

13 This includes a 30-ft diameter spill cross-section and 80 °F. 

15 
TRACE computations were conducted to assess the effects of crushed rock and slatted fence on 

potential spills. Little information was found in the literature on how to use crushed rock to 

increase the rate of LH2 boil-off. Preliminary work (Zabetakis and Burgess 1961) suggests that 

the boil-off rate of LH2 using crushed rock is double the rate for moist sand. Installing slats within 

the security fence that encloses the spill pond should help direct the hydrogen plume upward as it 

warms rather than letting it spread out over the ground. This kind of control, known as a vapor 

fence or barrier, has been used to reduce vapor travel of flammable cryogenic vapors such as 

liquid natural gas (LNG) (Moorhouse and Roberts 1988). 

This information was used to set up a TRACE stack run for an 8-mph wind, but with input to 

simulate double the vaporization rate. It is assumed that ground travel of the plume is stopped by

the combination of the pond and a 6-ft-high14 slatted fence. A chimney effect lifts the plume off 

the ground at the pad, and the plume clears 25m approximately 25 m from the center of the pond. 

This is computed to occur within 18 s. 

Results suggest that the hazard might be contained within the NFPA 50B-exclusion zone should 

the pond and slats work as predicted by TRACE. 

2.4.3 Flash Fire Hazards 

Hydrogen fire has several characteristics of note. Hydrogen flames, unless seeded with 

impurities, are very hard to see in daylight. This property, combined with its low emissivity (puts 

out very little infrared radiation), makes hydrogen combustion hard to sense until physical contact 

is made with the flame. Hydrogen combustion in air also produces ultraviolet (UV) radiation 

capable of producing effects similar to overexposure to the sun. Direct exposure to hydrogen 

flames produces immediate burns. 

Hydrogen is so easily ignited that where it is released, one should expect or be prepared for 

ignition and fire. The dispensing equipment is designed to ASME standards that provide 

redundant protection in the case of fire. Small leaks may occur and ignite, but go unnoticed until 

maintenance personnel enter the secure area. Leaks from a pressurized line will present a greater 

hazard that may extend beyond the security fence (see Section 2.3.3.1.2). A pressurized leak, 

whether ignited or not, will be audible, even though hard to see. A plume of hydrogen that is 

ignited will rapidly flash back to the source of hydrogen. From the perspective of controlling 

hazards, hydrogen fire localized to a source or leak is often preferable to a growing hydrogen 

plume. 

The worst-case scenario is a large plume that, if ignited, can burn personnel or initiate other fires 

in readily combustible materials. TRACE computations indicate the thermal flux from an ignited 

hydrogen-air mixture will range between 10 to 100 kW/m2 for exposures at distances from tens of 

feet to near contact with the mixture. Combustion of a hydrogen cloud will occur completely 

within 1 to 2 seconds. There is not enough deposition of thermal energy to ignite typical 

materials of construction. Personnel caught in close proximity may be severely burned; and 

flammable liquids, if directly exposed, may be ignited. 

14 Woods, Stephen. Telephone conversation with Donald Danyko (EPA) September 10, 2003. Computations were 

performed for a 2-m fence; however, for security reasons the height was increased to 10 ft, or approximately 3 m. 

This will further improve the “chimney” effect. 

16 
2.4.4 Deflagration and Detonation Hazards 

Deflagration and detonation are two modes of hydrogen combustion capable of producing high 

temperatures, shock waves, and high overpressures. Table 1 lists some of the characteristics of 

deflagrations and detonations. 

Both processes require confinement such as pipes, ducts, narrowly spaced walls, or large 

initiation energies to occur. Keeping the hydrogen dispensing system away from structures will 

give plumes from a large release a chance to rise. Both detonations and energetic deflagrations 

require the formation of mixtures of hydrogen and air that are close to stoichiometric. In the open 

air, powerful explosives or very large sparks15 are required to initiate detonation. In the case of 

attack on the system, the explosives used in the attack are not considered initiation sources since 

they act before the hydrogen mixes with the air. Shorts that occur within the transformer of the 

EPA power substation may be sufficient to initiate detonation. Although TRACE and the NASA 

data predict hydrogen-air plumes will clear nearby structures, if a plume were to brush up against 

intake ducts, a potentially detonable mixture could form in a confined space. A process that might 

mitigate the formation of a detonable mixture is the dilution of the mixture (as make-up air) with 

air already in the building. Potential spaces outside include small courtyards. Hydrogen-air 

mixtures swirling in spaces with walls approximately 15 ft apart or less have produced significant 

overpressures when ignited.16 TRACE computation of overpressure for combustion of a 

stoichiometric hydrogen-air mixture in free air indicated that pressures less than 0.1 psia would 

be produced. 

Table 1 

Deflagration and Detonation Characteristics 

Characteristic Deflagration Detonation 

Energy Transport Type Diffusion of radical species Shock wave 

Flame Temperature 2045 °C (3713 °F)a 2674 °C (4845 °F)a 

Flame Velocity 2.7-1294 m/s > 1800 m/s 

Rate of Pressure Onset 1 – 100 ms 2 – 20 ∝s 

Range of Final Pressure to Initial 1-8 15-20 

Unburned Gas Pressure 

a Values were computed for a stoichiometric mixture at 1 atmosphere and 300 K. 

In summary, detonation or energetic deflagration is an unlikely outcome for a large hydrogen 

release if the system is located away from structures. 

2.4.5 Fragment Hazards 

Analysis of potential fragment hazards was conducted using the gas code PVHAZARD. The 

results are theoretical in nature and should not be taken literally except to see that, at the storage 

pressure used in the system, gas-propelled shrapnel can reach high velocities. The results are 

theoretical because the released energy is evenly partitioned between the pieces, as if the vessel or 

component simply shattered and all the potential energy was optimally converted into the kinetic 

energy of the shrapnel. The code analyzes only the pressurized component and does not include 

15 Initiation source with energy of the order of 5000 Joules. 16 Beeson, H. Communication concerning GASL accident investigation, August 2003.

17 
the mechanical effects of the entire module structure. This is not realistic for components that 

meet ASME design criteria. For example, a lot of energy would be absorbed in bending and 

severing the metal and colliding with other system components. In addition, a lot of energy would 

simply be released in a shock wave and not accelerate shrapnel. Nonetheless, some shrapnel 

released in a component failure could attain the energies indicated. 

The hazards noted here are not different in nature from the hazards in other areas where gas 

cylinders may be stored. 

2.4.6 Summary of Release Hazards 

The consequences of equipment failure, operational error, accidents, attack, or sabotage can be 

categorized as producing one of three types of releases: a leak; a penetration (or very large 

leak/jet); or a rupture (a rapid emptying of the containment). If the high-pressure portion of the 

system is involved, the hydrogen release may be accompanied by shrapnel. The division seeks to 

separate the consequences of the release into three increasing levels of potential hazard to the 

surroundings: 

o	 Leaks may pose a hazard to adjacent system components or attending personnel directly 

exposed to combustible mixtures in the immediate vicinity of the leak. Here, the concern is 

for direct exposure to hot hydrogen reaction products. 

o	 A penetration produces a larger release that can pose a hazard to the entire fueling system and 

personnel or equipment near the filling station. The concern includes not only direct exposure 

to hydrogen combustion over a larger area, but exposure to thermal and UV radiation capable 

of producing burns, minor shrapnel, and the potential for secondary ignition of station 

components or nearby materials. 

o	 A rupture in the liquid storage system may pose a hazard to equipment and personnel in the 

greater vicinity of the fueling station, and threaten adjacent structures and public spaces 

located outside of the exclusion zone as specified by NFPA code. The most likely outcome 

from the threat is flash fire. 

18 
3.0 Conceptual Siting Design 

The general requirements, code requirements, and site hazard analysis are examined to evaluate 

the several options for siting of the hydrogen dispenser system. 

3.1 General Requirements Review 

General requirements arise from considerations of functionality, safety, security, and cost. The 

primary functional requirement for the hydrogen dispenser system is that ready access be 

provided for the vehicles to be fueled and for the tanker truck to refill the station. Additionally, it 

is desired that the area given to the dispenser system be as small as possible and that dispensing 

operations have minimal impact on parking and surrounding EPA activities. The hydrogen 

dispensing system and associated operations should be safe, posing no risks greater than current 

EPA operations to the personnel, operations, existing facilities, and surrounding public. The 

dispensing station and associated operations should not compromise the level of security at the 

EPA facility. The EPA is responsible for providing the pad and power infrastructure for the 

hydrogen system equipment leased from APCI. The cost for the infrastructure and cost for its 

removal after the project is complete must not be excessive. 

3.2 Code Requirements Review 

At this time there are no codes or standards published that are specific to hydrogen dispensing 

stations to clarify siting requirements. However, a review of relevant existing codes and standards 

are provided here to help resolve siting issues. 

3.2.1 General Considerations for Siting 

A brief discussion of general safety issues as it pertains to siting is provided here as background. 

3.2.1.1 Safety and Siting 

Hydrogen safety issues can be summarized according to priority as follows: 

o	 Combustion: Unplanned mixing of hydrogen and oxidizing substance results in fire, 

deflagration, or detonation. 

o	 Pressure: System confinement fails, releasing high-pressure hydrogen or propelling 

fragments. 

o	 Low Temperature: Inadequate design or improper maintenance leads to the use of 

inappropriate materials, leading to component failure. 

o	 Embrittlement: Selection of materials susceptible to hydrogen attack leads to component or 

vessel wall failure. 

o	 Health: Exposure of personnel to high concentrations of hydrogen, cryogenic temperatures, 

fires, overpressures, and shrapnel leads to injury or health hazards. Siting, or the 

determination of a safe exclusion zone for operations with hydrogen, is predominantly 

influenced by potential combustion and pressure hazards for a given hydrogen system. Proper 

siting reduces health hazards, while low-temperature and embrittlement concerns may figure 

among the causes of a system failure. 

19 
3.2.1.2 Approaches to Siting 

Site planners have several options in choosing a basis for the determination of an exclusion zone. 

The simplest and most conservative approach is to consider the worst-case event conceivable and 

place all personnel, vulnerable equipment, and activities out of range of harm. From a military 

perspective, the worst-case events are overpressure and shrapnel. To facilitate siting 

determinations, the Department of Defense (DOD) has tabulated safe standoff distances for 

hydrogen used as a propellant17 for military or aerospace applications. Another option is to 

determine siting according to the requirements of a relevant application-based standard. While 

there are currently few such standards for hydrogen systems, the standards for commercial 

storage of hydrogen are well known.18 The primary assumption is that the intended use and design 

of the hydrogen system being sited reasonably match the assumptions inherent in the selected 

standard. The final option is to develop a rationale based on a study of potential releases of 

hydrogen and their related hazard scenarios. This rationale, usually documented through hazard 

analysis, must satisfy the authorities that would grant permission to operate the sited system.

19 

Often the determination of an exclusion zone to protect personnel and equipment is based on the 

traditional quantity-distance approaches to siting, where the quantity of an energetic material 

determines the size of an exclusion zone for safe operation. Separation distances are tabulated as 

a function of quantity. However, the nature of the hydrogen release, rather than the quantity or 

precipitating cause, has the greatest effect on siting. 

3.2.2 Review of Mandatory Codes 

The primary mandatory regulations that apply to the installation and operation of the proposed 

hydrogen dispensing station come from the Occupational Safety and Health Administration 

(OSHA), Code of Federal Regulations Title 29. Section 1910.103, Hydrogen, specifies the use of 

the following standards: 

o NFPA 50A Gaseous Hydrogen Systems at Consumer Sites 

o NFPA 50B Liquefied Hydrogen Systems at Consumer Sites 

o NFPA 70 National Electric Code 

o ASME BPV Boiler and Pressure Vessel Code 

o ASME B31 Code for Pressure Piping 

The requirements of OSHA 1910.119 (Process Safety Management of Highly Hazardous 

Chemicals) and Title III of the Superfund Amendments and Reauthorization Act (SARA) under 

Environmental Protection Agency apply only for systems that have 10,000 lb (16,900 gal) or 

more of hydrogen. The DoD-6055.9 document provides directives on the siting and storage of 

explosives and liquid propellants for aerospace purposes. Application of DoD directives to the 

hydrogen dispensing system is not appropriate, since the hydrogen dispensing system possesses 

criteria that more closely match a commercial storage system rather than a propellant system. 

17 DoD 6055.9. Ammunition and Explosives Safety Standards. 18 NFPA 50A, Standard for Gaseous Hydrogen Systems at Consumer Sites; and NFPA 50B. Standard for Liquefied 

Hydrogen Systems at Consumer Sites. 

19This authority, or the authority having jurisdiction (AHJ), is usually an entity recognized by state and local 

authorities, such as the Fire Marshall. 

20 
3.2.3 Other Requirements, Standards and Guidelines 

The USEPA NVFEL as a government facility retains authority over its facilities where other than 

federal codes are required. However, it is prudent practice to follow local and state codes where 

applicable, keep local government planners and officials aware of potential hazards, and 

coordinate with the Fire Marshall. 

Compressed Gas Association (CGA) maintains a variety of standards that serve as a good 

reference for recommended practice in hydrogen operations. Examples include: 

o CGA G-5 Hydrogen 

o CGA G-5.4 Standard for Hydrogen Piping Systems at Consumer Locations 

o CGA G-5.5 Hydrogen Vent Systems 

3.3 Siting Review 

The requirements for the siting options identified in Section 2.0 have been reviewed against code 

requirements and the findings of the hazard analysis and communicated to EPA. 

Selected general NFPA 50A and 50B code requirements are given in Table 2. 

Table 2 

Selected NFPA Storage Guidelines 

Type of Exclusion Gas Storage (ft) Liquid Storage (ft) 

NFPA 50A NFPA 50B 

Places of Public Assembly 50 75 

Ventilation Equipment 50 75 

Inlet to Underground Sewers - 5 

Flammable Liquids 20 (above ground) 50 

25 (below ground) 

Oxidizers - 75 

21 
4.0 Conclusions and Recommendations 

System failures, whether caused by component failure, operational error, or attack, have been 

assessed for the quantity of hydrogen released and the severity of consequences. Several 

conclusions and recommendations are advanced to help ensure the overall successful use of 

hydrogen dispensing system on the NVFEL facility. 

This analysis concludes that there are different safety implications for the three regions 

surrounding the hydrogen dispenser system. The security fence planned around the storage 

equipment defines the first region. The isolation it provides can protect outside personnel from 

small hydrogen leaks (likely through connections sometime during the life of the facility), and 

from normal, controlled hydrogen releases through the system vent. The inherent safety features 

of the vendor-supplied equipment meet accepted industry standards and should provide excellent 

service. A second region, as specified by NFPA 50B, is needed for further protection of personnel 

against larger releases, potential fire, and minor shrapnel due to component failure. While such 

events are deemed unlikely to occur during the period of use planned for the dispensing system, 

their occurrence could pose a hazard beyond the security fence. This review concludes that 

training of operations personnel and observation of the exclusion zone and other precautions 

specified by standard NFPA 50B will provide protection against moderate threats due to 

component failure. 

Major component failure or significant damage caused by attack, while very unlikely, would 

feature the release of significant quantities of hydrogen or large pieces of shrapnel that could 

threaten areas beyond the NFPA 50B exclusion zone, which is defined as the third region. Among 

these hazards, the greatest concern is for flash fire. Against this possibility, the review of the 

NVFEL grounds conducted in April led to the recommendation of a specific site, which was 

communicated, to EPA. Further conclusions are that design features such as a spill pond with 

gravel, and a slatted security fence to act as a vapor barrier, will improve evaporation of liquid 

hydrogen and promote the upward movement of hydrogen vapor above nearby structures during a 

large spill. In summary, the storage and dispensing of hydrogen in the planned system does 

present hazards, but in the context of the NVFEL facility, the hazards involving hydrogen do not 

appear substantially different or new. 

To best mitigate the identified hazards, the following recommendations are given: 

•	 The security fence surrounding the system must be locked to exclude all but vendor 

maintenance personnel. 

•	 The exclusion zone specified by NFPA 50B should be observed for protection against 

unplanned minor releases of hydrogen and shrapnel. 

•	 To provide an additional margin of safety against an unlikely large release of hydrogen, it is 

recommended that the infrastructure provided for the equipment incorporate a spill pond with 

gravel and a vapor barrier. 

•	 Safety information must be coordinated as necessary with NVFEL personnel, nonNVFEL personnel that may work in proximity to the dispensing system, the Fire Marshall 

and first responders, and local authorities. 

22 
References 

29 CFR 1910.013. Code of Federal Regulations Title 29, Labor; Part 1910 Occupational Safety 

and Health Administration; Section 103 Hydrogen. US Printing Office, Washington, 

DC, latest edition. www.osha.gov. 

29 CFR 1910.119. Code of Federal Regulations Title 29, Labor; Part 1910 Occupational Safety 

and Health Administration; Section 119 - Process Safety Management of Highly 

Hazardous Chemicals. US Printing Office, Washington, DC, latest edition. 

www.osha.gov. 

ASME, Code for Pressure Piping. ASME B31. American Society of Mechanical Engineers, 

Fairfield, New Jersey, latest edition. www.asme.org. 

ASME. Process Piping. ASME B31.3. American Society of Mechanical Engineers, Fairfield, 

New Jersey, April 2002. 

ASME. Boiler and Pressure Vessel Code. BPVC. American Society of Mechanical Engineers, 

Fairfield, New Jersey, 2001. 

Benz, Frank J., C. V. Bishop, and M. D. Pedley. Ignition and Thermal Hazards of Selected 

Aerospace Fluids. RD-WSTF-0001, NASA Johnson Space Center White Sands Test 

Facility, New Mexico, October 1988. 

Burgess, D.; J. N. Murphy; M. G. Zabetakis; and H. E. Perlee. Proceedings of Cryo ’75 and 

Cryo’76, “Volume of Flammable Mixture Resulting from the Atmospheric Dispersion of 

a Leak or Spill.” S. H. Booth and R. W. Vance, Ed. Vol. 8., pp. 182-206, 1976. 

Applications of Cryogenic Technology (May 11, 1914), Alameda and Anaheim, 

California; Washington, D.C., and Houston, Texas. Flushing, New York: Scholium 

International Inc. 

CGA. Hydrogen. CGA G-5. 5th Ed. Compressed Gas Association, Inc., Chantilly, Virginia, 

October 2002. 

CGA. Standard for Hydrogen Piping Systems at Consumer Locations. CGA G-5.4. 2nd Ed. 

Compressed Gas Association, Inc., Chantilly, Virginia, September 2001. 

CGA. Hydrogen Vent Systems. CGA G-5.5. Compressed Gas Association, Inc., Chantilly, 

Virginia, December 1996. 

DoD. Ammunition and Explosives Safety Standards. DoD 6055.9. US Department of Defense, 

2001. 

Edeskuty, F. J., and W. F. Stewart. Safety in the Handling of Cryogenic Fluids. Plenum Press, 

New York, 1996. 

23 
Moorhouse, J. and P. Roberts. “Cryogenic spill protection and mitigation.” Cryogenics, Vol. 28, 

pp. 838 – 846, December 1988. 

NFPA. Standard for Gaseous Hydrogen Systems at Consumer Sites. NFPA 50A. National Fire 

Protection Association, Quincy, Massachusetts, 1999. 

NFPA. Standard for Liquefied Hydrogen Systems at Consumer Sites. NFPA 50B. National Fire 

Protection Association, Quincy, Massachusetts, 1999. 

NFPA. National Electric Code. NFPA 70. National Fire Protection Association, Quincy, 

Massachusetts, 2002. 

Pasquil, I. F. “The Estimation of Dispersion of Windborne Material,” Meteorological Mag., 

Vol. 90, pp. 33-49 (1961). 

PVHAZARD. The PVHAZARD Pressure Vessel Hazard Assessment Software, sponsored by 

the US Air Force (45th Space Wing, PAFB) and NASA, with contributions by General 

Physics Corporation, ACTA, Inc., and Aerospace Corporation. Most recent version. 

Sherman, M. P., M. R. Baer, and S. K. Griffiths. Deliberate Ignition and Water Fogs as H2 

Control Measures for Sequoyah. Workshop on the Impact of Hydrogen on Water 

Reactor Safety, Albuquerque, New Mexico, January 25-28, 1981. 

TRACETM (Toxic Release Analysis of Chemical Emissions); SAFER Systems, L.L.C., Camarillo, 

California, most recent version. 

Witcofski, R. D. An Overview of Completed Simulated Storage Tank Rupture Experiments and 

Proposed Pipe Rupture Experiments. Liquid Hydrogen Spill Experiments, Aeronautical 

Systems Division, NASA Langley Research Center, Hampton, Virginia, March 1981. 

Witcofski, R. D., NASA Langley Research Center. “Dispersion of Flammable Vapor Clouds 

Resulting from Large Spills of Liquid Hydrogen.” In 16th Intersociety Energy 

Conversion Engineering Conference, Vol. 2, pp. 1436-1443 (Paper No. 819630; AIAA 

Paper A82-11789), August 1981. 

Witcofski, R. D., NASA Langley Research Center. “Experimental Measurements of the 

Dispersion of Flammable Clouds Formed by Liquid Hydrogen Spills.” In JANNAF 

Proceedings of Safety and Environmental Protection Subcommittee Meeting, 1981. 

Zabetakis, M. G. and D. S. Burgess. “Research on the Hazards Associated with the Production 

and Handling of Liquid Hydrogen.” Report of Investigations 5705, Bureau of Mines, US 

Department of the Interior, 1961. 

24 
Bibliography 

Baker, W. E.; Kulesz, J. J.; Ricker, R. E.; Bessey, R. L.; Westine, P. S.; Parr, V. B.; and Oldham, 

G. A. Workbook for Predicting Pressure Wave and Fragment Effects of Exploding 

Propellant Tanks and Gas Storage Vessels. NASA Contract NAS3-19231, September 

1977. 

Brewer, G. D.; Wittlin, G.; Versaw, E. F.; Parmley, R.; Cima, R.; Walter, E. G. Assessment of 

Crash Fire Hazard of LH2 – Fueled Aircraft. Lockheed-California Company, NASA 

CR-165525, December 1981. 

Chirivella, J. E.; Witcofski, R. D. “Experimental Results from Fast 1500-Gallon LH2 Spills.” In 

Cryogenic Properties, Processes and Applications 1986. Ed. Kidnay, A. J. and Hiza, 

M. J. New York: American Institute of Chemical Engineers; Vol. 82: 251, 1986. 

(Frederking, T. H. K.; Kerney, P. J.; Wenzel, L. A., co-editors. AIChE Symposium 

Series V. Vol. 82:251, 1986). 

Chitose, K.; Takeno, K.; Yamada, Y.; Hayashi, K.; Hishida, M. “Activities on Hydrogen Safety 

for the WE-NET Project – Experiment and Simulation of the Hydrogen Dispersion.” 

Proceedings of the 13th World Hydrogen Energy Conference, Beijing 2000. 

Hord, J. Is Hydrogen Safe? Cryogenics Division, National Bureau of Standards, 34 pages, 

October 1976. 

Reichelt, W. (AT-DO, H821); Edeskuty, F. J.; Prenger, F. C.; Stewart, W. F. (MEE-13); Durham, 

F. J. (DRA/DEW); and Dewart, J. M. (HSE-8). Postulated GTA Cryogenic Cooling 

System Accidents. February 7, 1990. 

25