Oxygen Deficiency Hazards

Abstract

Oxygen Deficiency Hazards (ODH) are ubiquitous in cryogenic systems. Such hazards can be both insidious and potentially fatal. This chapter describes the nature of the hazard including the physiological effects of oxygen depletion and the mitigations taken to reduce the hazard to acceptable levels. A detailed discussion of how to conduct an ODH Risk Analysis and apply mitigations is presented. The proper response to ODH incidents is discussed along with examples of recent studies, both numerical and experimental, of helium venting scenarios. A list of best practices is included. The chapter appendix contains equipment and human factor failure rates to assist in risk analysis along with a complete example ODH risk analysis.

Appendix

4.1.1 Form Used at SLAC National Accelerator Lab for ODH Scaling Analysis

4.1.2 Equipment Failure Rates Estimates

Systema	Failure mode	Failure rate
Compressor (two-stage Mycom)	Leak	5 × 10−6/h
	Component rupture	3 × 10−7/h
Dewar	Loss of vacuum	1 × 10−6/h
Electrical power failure (unplanned)	Time rate	1 × 10−4/h
	Demand rate	3 × 10−4/D
	Time off	1 h
Fluid line (cryogenic)	Leak	5 × 10−7/h
	Rupture	2 × 10−8/h
Cryogenic magnet (powered, unmanned)	Rupture	2 × 10−7/h
Cryogenic magnet (not powered, manned)	Rupture	2 × 10−8/h
Header piping assembly	Rupture	1 × 10−8/h
U-Tube change (cryogen release)	Small event	3 × 10−2/D
	Large event	1 × 10−3/D
Batteries, Power (UPC) supplies	No output	3 × 10−6/h
Circuit Breakers	Failure to operate	1 × 10−3/D
	Premature transfer	1 × 10−6/h
DIESEL (complete plant)	Failure to start on demand	3 × 10−2/D
Emergency run loads	Failure to run	3 × 10−3/h
Engine only	Failure to run	3 × 10−4/h
Electric motors	Failure to start on demand	3 × 10−4/D
	Failure to run—normal	1 × 10−5/h
	Failure to run—extreme	1 × 10−3/h
Fans (fan, motor & starter)	Failure to run	9 × 10−6/h
Fuses	Premature open	1 × 10−6/h
	Failure to open	1 × 10−5/D
Flanges	Leak, 10 mm2 opening	4 × 10−7/h
With reinforced & preformed gaskets	Rupture	1 × 10−9/h
Flanges with packing or soft gaskets	Leak, 10 mm2 opening	4 × 10−7/h
	Packing blowout	3 × 10−8/h
	Rupture	1 × 10−9/h
Instrumentation (amplification, transducers, calibration, combination)	Failure to operate	1 × 10−6/h
	Shifts	3 × 10−5/h
Motorized louver	Failure in continuous operation	3 × 10−7/h
Piping	Small leak 10 mm2	1 × 10−9/h m
	Large leak 1000 mm2	1 × 10−10/h m
	Rupture	3 × 10−11/h m
Piping weld	Small leak 10 mm2	2 × 10−11(D/t)/h m
D = diameter	Large leak 1000 mm2	2 × 10−12 (D/t)/h m
t = wall thickness	Rupture	6 × 10−13 (D/t)/h m
Pumps	Failure to start on demand	1 × 10−3/D
	Failure to run—normal	3 × 10−5/h
	Failure to run—extreme	1 × 10−3/h
Relays	Failure to energize	1 × 10−4/D
	Failure no contact to close	3 × 10−7/h
	Short	1 × 10−8/h
	Open NC contact	1 × 10−7/h
Solid state Hi Pwr application	Fails to function	3 × 10−6/h
	Shorts	1 × 10−6/h
Solid state Low Pwr application	Fails to function	1 × 10−6/h
	Shorts	1 × 10−7/h
Switches	Limit: fail to operate	3 × 10−4/D
	Torque: fail to operate	1 × 10−4/D
	Pressure: fail to operate	1 × 10−4/D
	Manual: fail to transmit	1 × 10−5/D
	Contact shorts	1 × 10−8/h
Transformers	Open contact	1 × 10−6/h
	Short contact	1 × 10−6/h
Valves (motor operated)	Fails to operate (plug)	1 × 10−3/D
	Fails to remain open	1 × 10−4/D
	External leak	1 × 10−8/h
	Rupture	5 × 10−10/h
Valves (solenoid operated)	Fails to operate	1 × 10−3/D
Valves (air operated)	Fails to operate	3 × 10−4/D
	Fails to remain open	1 × 10−4/D
	External leak	1 × 10−8/h
	Rupture	5 × 10−10/h
Valves (check)	Fails to open	1 × 10−4/D
	Reverse leak	3 × 10−7/D
	External leak	1 × 10−8/h
	Rupture	5 × 10−10/h
Valves (orifices, flow meter)	Rupture	1 × 10−8/D
Valves (manual)	Fails to remain open (plug)	1 × 10−4/D
	External leak	1 × 10−8/h
	Rupture	5 × 10−10/h
Valves (relief)	Fails to open	1 × 10−5/D
	Premature open	1 × 10−5/h
Vessels (pressure)	Small leak, 10 mm2	8 × 10−8/h
	Disruptive failure	5 × 10−9/h
Wires	Open	3 × 10−6/h
	Short to GND	3 × 10−7/h
	Short to Pwr	1 × 10−8/h

1. ^aFrom ESS Guideline for Oxygen Deficiency Hazard (ODH), ESS-0038692 (2016)

4.1.3 Human Error Rate Estimates

Estimated error rate D−1	Activitya
1 × 10−3	Selection of a switch (or pair of switches) dissimilar in shape or location to the desired switch (or pair of switches), assuming no decision error For example, operator actuates large handled switch rather than small switch
3 × 10−3	General human error of commission, e.g., misreading label and therefore selecting wrong switch
1 × 10−2	General human error of omission where there is no display in the control room of the status of the item omitted, e.g., failure to return manually operated test valve to proper configuration after maintenance
3 × 10−3	Errors of omission, where the items being omitted are embedded in a procedure rather than at the end as above
1/x	Given that an operator is reaching for an incorrect switch (or pair of switches), he selects a particular similar appearing switch (or pair of switches), where x = the number of incorrect switches (or pair of switches) adjacent to the desired switch (or pair of switches). The 1/x applies up to 5 or 6 items. After that point the error rate would be lower because the operator would take more time to search. With up to 5 or 6 items he doesn’t expect to be wrong and therefore is more likely to do less deliberate searching
1 × 10−1	Monitor or inspector fails to recognize initial error by operator. Note: With continuing feedback of the error on the annunciator panel, the high error rate would not apply
1 × 10−1	Personnel on different work shift fail to check condition of hardware unless required by check or written directive
5 × 10−1	Monitor fails to detect undesired position of valves , etc., during general walk-around inspection, assuming no check list is used
0.2–0.3	General error rate given very high stress levels where dangerous activities are occurring rapidly
2(n−1) x	Given severe time stress, as in trying to compensate for an error made in an emergency situation, the initial error rate, x, for an activity doubles for each attempt, n, after a previous incorrect attempt, until the limiting condition of an error rate of 1.0 is reached or until time runs out. This limiting condition corresponds to an individual’s becoming completely disorganized or ineffective

1. ^aFrom ESS Guideline for Oxygen Deficiency Hazard (ODH), ESS-0038692 (2016)

4.1.4 Example: Helium and Nitrogen ODH Analysis for a Small Laboratory

4.1.4.1 Introduction

As an example of a simple Oxygen Deficiency Hazards analysis, we consider here ODH potential in a laboratory room which uses small volumes of liquid helium and liquid nitrogen for calibration of instrumentation and various other tests. The liquid helium is provided via transfers from 500 L commercial helium storage dewars, and the liquid nitrogen from 150 L commercial dewars. This analysis examines the oxygen deficiency hazard due to a release of cryogens in the laboratory.

4.1.4.2 Room Data

Lab floor area (= ceiling area) = 56 × 26 ft² – 11 × 11 ft² (subtract for a separate small room in one corner) = 1335 ft² = 124 m²

Ceiling height = 13.75 ft = 4.2 m

Room volume = 18,400 ft³ = 520 m³.

4.1.4.3 Helium ODH Considerations

The maximum liquid helium container volume is 500 L. If released and warmed to room temperature this would fill 377 m³, 72% of the room, down to a little over a meter off the floor if unmixed with the air. If mixed with the remaining air in the room, the concentration of oxygen would be 6%.

Therefore assume for helium:

• (1) The release of the entire contents of a 500 L helium dewar results in a fatality (It is always full and all released).

• (2) The rupture of the dewar insulating vacuum or any vessel or line attached to the dewar releases the entire contents of the dewar.

• (3) A “large event” during a U-tube change is a release of the entire contents.

  From Table I in Fermilab’s ODH standard [9], we have the following relevant probabilities:

  $\begin{array}{*{20}l} { \bullet \,\,{\text{dewar loss of vacuum }}} \hfill & {{{ 1\, \times \, 10^{ - 6} } \mathord{\left/ {\vphantom {{ 1\, \times \, 10^{ - 6} } {\text{h}}}} \right. \kern-0pt} {\text{h}}}} \hfill \\ { \bullet \,\,{\text{cryogenic fluid line leak or rupture }}} \hfill & {{{ 5\, \times \, 10^{ - 7} } \mathord{\left/ {\vphantom {{ 5\, \times \, 10^{ - 7} } {\text{h}}}} \right. \kern-0pt} {\text{h}}}} \hfill \\ { \bullet \,\,{\text{U-tube change release}},{\text{ large event }}} \hfill & {{{ 1\, \times \, 10^{ - 3} } \mathord{\left/ {\vphantom {{ 1\, \times \, 10^{ - 3} } {\text{demand}}}} \right. \kern-0pt} {\text{demand}}}} \hfill \\ \end{array}$

The lab could have as many as two 500 L helium dewars in it at once, each connected to a helium reservoir. Counting each reservoir as a dewar (connected via a transfer line so able to spill 500 L) the total probability of a dewar leak or rupture is 4 × 10⁻⁶/h. There may be a transfer line to each reservoir and a vent line from each reservoir, for a total of 4 lines connected to a 500 L source, so the total probability of a cryogenic fluid line leak or rupture is 2 × 10⁻⁶/h. Workers report 41 liquid helium transfers per year. The 41 LHe transfers per year entail 82 U-tube operations per year (counting stinging and removing as separate). So the total probability of a release (large event) during a U-tube change is 84 × 10⁻³/year = 9.6 × 10⁻⁶/h.

Assuming every line leak or rupture, dewar loss of vacuum, or large U-tube release results in venting a full storage dewar, the total probability of the release of the entire contents of a 500 L helium dewar is (4 + 2 + 9.6) × 10⁻⁶/h = 1.56 × 10⁻⁵/h. Since a fatality factor of 1 has been assumed for these events, the ODH hazard class would be 2. But now consider ventilation.

Suppose a vent fan is connected to an ODH sensor, which is fail-safe, but the vent fan fails to start 5.6 × 10⁻³/demand [9]. If this vent fan is sized to prevent the helium from accumulating in the engineering lab in the event of a 500 L release, then only when there is a release AND the fan fails to run is there a fatality. The probability of this occurring is (5.6 × 10⁻³) × (1.56 × 10⁻⁵/h) = 8.7 × 10⁻⁸/h. This situation is now ODH 0 with very conservative assumptions regarding consequences of failures.

The above analysis narrative is summarized in Table 4.6.

Table 4.6 Small laboratory helium ODH analysis summary

4.1.4.4 Helium Release Rate and Required Fan Size

The maximum flow rate from a 500 L helium storage dewar would result from a loss of insulating vacuum to air and the resultant air condensation on the inner vessel. The venting could occur from a relief valve or another vent valve on the vessel if it happened to be open. We will assume that the reliefs are set and sized to prevent the vessel from exceeding 1.0 bar in the worst case, so that the vessel is not considered to fall under the scope of the ASME pressure vessel code (At the time of writing this analysis, this was the case for industrially supplied dewars and the laboratory’s interpretation of the scope of the ASME pressure vessel code). The vendor does not provide relief valve sizing rationale for the commercially provided dewar, so we will use the above assumptions and back-calculate a flow rate.

The 500 L helium dewars delivered to the laboratory room have two relief valves, one set at 0.55 bar (8 psig) and one at 0.69 bar (10 psig). From the valve literature, the valve cracking 0.55 bar will relieve 4.84 standard cubic meters/minute (std m³/min) helium (60 SCFM air capacity), at 0.97 bar (14 psig). The valve cracking at 0.69 bar will relieve 3.22 std m³/min helium (40 SCFM air capacity). With a loss of vacuum, the large flow rate of helium will result in temperatures much lower than room temperature, close to 5 K. A helium temperature of 20 K is conservatively warm and also enough in the ideal gas range for helium that the flow calculation for gas is still accurate. Scaling the flow with the square root of density from 273 to 20 K gives flow rates of 17.9 std m³/min helium for the 0.55 bar relief and 11.9 std m³/min helium for the 0.69 bar relief. The total flow rate is 29.8 std m³/min helium out of the reliefs with 0.97 bar dewar pressure.

Checking other venting scenarios, we conclude that the dewar loss of vacuum drives the highest helium flow rate into the room. Other leaks provide less flow, having lower driving pressure and/or smaller openings. So the case of gas venting from the reliefs, 29.8 std m³/min helium, is the greatest flow. This is 88 grams/sec or 42.3 L/min, so a full dewar empties in about 12 min.

One full room volume air change per hour would be 520 m³/h (307 CFM). Our experience tells us that the helium will not significantly mix with the air but will rise to the top of the room. Venting the volume flow rate of helium requires venting 29.8 std m³/min × 60 min/h = 1788 m³/h, which is 3.44 air changes per hour. So either a minimum of 1788 m³/h (1054 CFM, 3.44 air changes per hour) venting from the top of the room should be continuously provided or this amount of venting should be triggered by the ODH sensor.

4.1.4.5 Nitrogen ODH Considerations

By far the largest single nitrogen volume which will be brought into the room is that of the 150 L storage dewar, so consider a release of the entire contents of a 150 L LN2 dewar. 150 L warmed to room temperature at one atmosphere would result in 104.5 std m³ of nitrogen gas. If this were slightly cool and covered the 124 m² floor, it would do so to a depth of 0.84 m. If it completely mixed with the remaining air in the room the new oxygen concentration in the room would be 15% or 115 mm Hg. This has a fatality factor of 1 × 10⁻⁵/event according to Fig. 1 of reference [1]. We will use this as the fatality factor for a release of LN2.

From reference [9], we have the following relevant probabilities:

$\begin{array}{*{20}l} { \bullet \,\,{\text{dewar loss of vacuum}}} \hfill & {{{ 1\, \times \, 10^{ - 6} } \mathord{\left/ {\vphantom {{ 1\, \times \, 10^{ - 6} } {\text{h}}}} \right. \kern-0pt} {\text{h}}}} \hfill \\ { \bullet \,\,{\text{cryogenic fluid line leak or rupture}}} \hfill & {{{ 5\, \times \, 10^{ - 7} } \mathord{\left/ {\vphantom {{ 5\, \times \, 10^{ - 7} } {\text{h}}}} \right. \kern-0pt} {\text{h}}}} \hfill \\ \end{array}$

There are no U-tube changes for LN2, but transfers are made through foam-insulated tubing. We will treat those transfers as if they were being done through a U-tube, although the operation is safer than that, in order to get an estimate for the probability of a major release. So suppose the probability of a major release is 1 × 10⁻³/demand. Laboratory workers report 81 transfers per year, which, taking this to be a typical year, and saying a failure can occur during connect or disconnect, as for helium , gives 2 × 81 × 10⁻³/year = 1.8 × 10⁻⁵/h.

As for the helium case, there are at most two dewars at a time in the engineering lab. The total probability of a dewar leak or rupture is therefore 2 × 10⁻⁶/h. A line from each dewar to an experimental apparatus would result in at most two lines which could leak or rupture, for a probability of 2 × 5 × 10⁻⁷/h that an LN2 line ruptures or has a major leak.

The total probability of a major release of nitrogen is then (18 + 2 + 1) × 10⁻⁶/h = 2.1 × 10⁻⁵/h. The probability of a fatality due to a release of LN2 is 2.1 × 10⁻⁵/h × 10⁻⁵/event = 2.1 × 10⁻¹⁰/h. This is much less than 10⁻⁷, resulting in ODH 0 for nitrogen. The above analysis is summarized in Table 4.7.

Table 4.7 Small laboratory nitrogen ODH analysis summary

4.1.4.6 Conclusions

Either a minimum of 1788 m³/h (3.44 air changes per hour) venting from the top of the room to prevent helium accumulation should be continuously provided or this amount of venting should be triggered by an ODH sensor in order to have an ODH 0 rating in the laboratory room. The small amounts of liquid nitrogen present do not present a significant hazard.