CET-vol 105 DOI: 10.3303/CET23105022 Paper Received: 29 January 2023; Revised: 6 July 2023; Accepted: 2 June 2023 Please cite this article as: Navajas J., Badia E., Sala R., Sato H., Paltrinieri N., 2023, Development of a Protocol for the Systematic Analysis of Events at Hydrogen Refuelling Stations, Chemical Engineering Transactions, 105, 127-132 DOI:10.3303/CET23105022 CHEMICAL ENGINEERING TRANSACTIONS VOL. 105, 2023 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: David Bogle, Flavio Manenti, Piero Salatino Copyright © 2023, AIDIC Servizi S.r.l. ISBN 979-12-81206-04-5; ISSN 2283-9216 Development of a Protocol for the Systematic Analysis of Events at Hydrogen Refuelling Stations Joaquín Navajasa*, Eulàlia Badiaa, Roser Salaa, Hitomi Satob, Nicola Paltrinieric aSocio-Technical Research Centre, Centro de Investigaciones Energéticas, Medioambientales y Tecnológicas (CIEMAT). Mòdul de Recerca A. Plaça del Coneixement s/n, Universitat Autònoma de Barcelona, 08193 Bellaterra, Barcelona, Spain. bInstitutes of Innovation for Future Society, Nagoya University. Furo-cho, Chikusa-ku, Nagoya, Japan. cDepartment of Mechanical and Industrial Engineering, Norwegian University of Science and Technology (NTNU), Richard Birkelands vei 2b, Trondheim 7034, Norway. joaquin.navajas@ciemat.es Sustainable hydrogen is transitioning from a future concept to a reality in everyday life, especially in some countries. There are numerous developments and applications of primary use of hydrogen, such as fuel cell vehicles and hydrogen refuelling stations (HRSs). HRSs’ safety is a prerequisite for their successful deployment in society. The expansion of this technology inevitably will depend on its safe operation, thus there is a need to minimize potential risks in the value chain of hydrogen. As part of the international SUSHy project, we aim to identify key parameters and safety requirements to minimize risks and ensure HRS safety. As a first step, an incident analysis protocol has been developed based on proven methodologies from high reliability industries (such as nuclear and offshore). This protocol, Incident Contributing Factors Analysis (ICFA), will guide the systematic analysis of the different factors involved in the events. The ICFA has been validated by a multidisciplinary team of experts through its application to some incidents obtained from various international databases (KHK, HIAD 2.0, ARIA, and H2 LL). This paper briefly describes the basis of the ICFA protocol development and the procedure for its implementation, derived from the results of the pilot study. In the framework of the SUSHy project, it is planned to apply this protocol to a systematic analysis of more than 200 incidents and accidents that occurred in HRS, which have been identified and selected from the previous mentioned international databases. Its systematic application will allow ranking risk factors and gathering lessons learned in order to improve HRS safety. 1. Introduction The energy and transport sectors are being transformed by the current trend of ever-increasing global energy consumption and the urgent need to move away from fossil fuels. Green hydrogen is emerging as an energy carrier that provides a sustainable alternative to oil, coal and natural gas amongst others. The widespread use of this emerging technology not only depends on the cleanliness and affordability of the processes involved, but also on ensuring its safety. This includes the entire hydrogen value chain: production, supply, conversion, storage and final use in applications such as fuel cell vehicles (FCVs). The expansion of FCVs will depend on the establishment of an extensive network of HRSs. The potential development of these HRSs will go hand in hand with the identification of safety parameters and requirements. The present study focuses on the safety of HRSs, with or without hydrogen production. It aims to develop a protocol for the systematic analysis of operational events. These events, collected from different databases, have taken place in HRSs. This analysis provides a comprehensive understanding of the main determinants of incidents and accidents at HRSs according to their actual operation. 1.1 Safety of hydrogen refuelling stations The successful deployment of hydrogen vehicles will depend on the simultaneous development of a network of refuelling stations. Ensuring the safety of these infrastructures will enable to exploit the potential of hydrogen as 127 an energy vector for transport, overcoming the current limitations of a technology "still at an infant stage" (Apostolou and Xydis, 2019, p. 13). The development and implementation of HRSs requires an 'inherent safety design', in which safety is embedded at the design stage (Kletz and Amyotte, 2010). Such a design, must not only address the chemical properties of hydrogen (a highly flammable element that can form explosive mixtures with oxygen), but also the interrelation between technology, organization, and human behaviour (Rasmussen, 1997). Therefore, a safe HRS will require both the most advanced technological features (i.e., leak detection sensors and/or dedicated ventilation systems) and established procedures that guide behaviour during emergencies (i.e., how to act in case of an emergency). With safety as a central element, numerous studies have attempted to identify the most potentially catastrophic risks in HRSs (Zhiyong et al., 2010). Two methodological strategies stand out: the identification of risk scenarios through HAZOP analysis, and the quantitative assessment of potential risks. Pan et al. (2016) performed a HAZOP analysis to establish incident scenarios and calculate failure frequencies at hybrid renewable hydrogen refuelling stations. They identified compressors as the main risk contributors to accidents. Sun et al. (2014) conducted a risk analysis of a mobile HRS and found out that booster compressor leaks are the major risk contributors, while tube storage failures cause the greatest financial losses. Tsunemi et al. (2019) performed a quantitative risk assessment for three accident scenarios. The first scenario was a hydrogen leak from the external piping surrounding an open dispenser in the vicinity of workers and consumers. The second scenario was a hydrogen leak from a high-pressure accumulator connection pipe, and the third was a hydrogen leak from a high-pressure connection pipe/compressor. Other studies have focused their analysis on the probability of human error. Techniques such as HRA (Human Rate Assessment) or HEART (Human Error Assessment and Reduction Technique) have been applied to predict potential failures related to human factors (Castiglia and Giardina, 2013). It should also be noted that some research has attempted to estimate risk based on HRSs events information. Lam et al. (2019) used network theory to analyse hydrogen logistics incidents. They collected 100 hydrogen logistics incidents and identified eight factors and five effects, revealing the interdependencies between them. One of the most notable factors was improper operation, which can lead to a cascade of logistics incidents, with leakage being the most common effect. It is worth mentioning that Moradi and Groth (2019) pointed out that while there is an abundance of experimental research on the reliability of individual components, there is very little data collection on systems. They also noted that another critical aspect of enhancing risk assessment was to improve the quality of incident databases such as HIAD 2.0 and others. 1.2 Event analysis methodologies The analysis of abnormal/upset operations, near-misses and lower-consequence higher-frequency incidents, has helped to strengthen safety in the chemical industry (CCPS, 2019). Systematic incident analyses reveal aspects of the functioning of complex technological systems and allow weaknesses to be identified. There are several existing incident analysis and review methodologies. The interdisciplinary nature and evolution of these techniques, which have been "successfully borrowed" from one field to another, are notable (Livingston et al., 2001, p. 4).The present study takes as a reference two methodologies for establishing an analysis protocol for the systematic review of incidents in HRSs. The two publicly available methodologies (CCPS, 2019) are: a) Management Oversight and Risk Tree (MORT) and b) Systematic Accident Cause Analysis (SACA). The MORT methodology for event analysis dates back to 1973. It was developed by the United States Department of Energy (DOE), as an operational analysis tool to provide a technique for thorough investigation of occupational accidents and analysis of the safety programme. The MORT methodology was considered to be a synthesis of the best safety elements and concepts for event analysis (Solano and Isasia, 2017). This methodology is used in the nuclear industry to try to determine the root causes of events. The application of MORT in practice has shown flexibility in rapid evaluation in different technologies and explanation of abnormal events in terms of risk management (Kingston et al., 2009). It is mainly used for relevant events due to the complexity of its use (it requires a team and a significant amount of time to be implemented). In operational terms, MORT can be thought as a checklist structured in the form of a complex "fault tree" model (de Oliveira et al., 2022). The SACA methodology was developed by Waldram and applied in the offshore industry. It establishes a multi-causal perspective of undesirable events, with four main categories and sixteen causes. SACA is applied in checklist form, which is a user-friendly approach provided that it's applied consistently and with sufficient information (Waldram, 1988, as cited in Livingston et al., 2001). 2. Design of a protocol for the systematic review of abnormal events The following requirements were defined for the design of the protocol: a) it should enable the identification of contributing factors in a systematic way and with the highest degree of objectivity; b) it should include technical, but also human and organisational factors in its identification; and c) its implementation should be aimed at 128 determining what factors contribute to the occurrence of events, rather than creating a "fault tree" or finding the root cause. Based on these three considerations, the protocol is referred to as "Incident Contributing Factors Analysis" (hereafter ICFA). A systematic application of the ICFA protocol to a large number of incidents will allow the identification of the typology of contributing factors and other failures involved in HRSs events. This categorisation should facilitate the establishment of a hierarchy of risk factors that will contribute to effective risk management of HRS.The stages for shaping the incident analysis protocol are shown below (see Figure 1): Figure 1: ICFA protocol development stages. As noted above, the review of incident analysis methodologies used in technologically complex systems led to the identification of MORT and SACA as proven and potentially adaptable methodologies. This review also resulted in the identification of the NRI MORT User's Manual (Kingston et al., 2009), a document of great interest for this study as it provides a broad and accurate categorisation of potential factors involved in events. Based on the NRI MORT Users' Manual and the SACA Methodology, 10 potential contributing factors and 35 sub- factors were established. The list of contributing factors is shown in Table 1. Table 1: List of contributing factors and sub-factors. Factors Sub-factors 1. Technical Information System 1.1. Technical Information 1.2. Data Collection & analysis 1.3. Trigger to Risk analysis 2. Operational Readiness 2.1. Verification of operational readiness 2.2. Technical Support 2.3. Interface between Operations and Maintenance or Testing Activities 2.4. Configuration 3. Inspections 3.1. Planning process 3.2. Execution 4. Maintenance 4.1. Planning process 4.2. Execution 5. Supervision and Staff Performance 5.1. Time 5.2. Continuity of Supervision 5.3. Detection/Correction of Hazards 5.4. Performance Errors 6. Support of supervision 6.1. Help and training supervisors 6.2. Research and fact-finding 6.3. Information exchange 6.4. Standards and directives 6.5. Resources 6.6. Deployment of resources 6.7. Referred risk response 7. Stabilisation and restoration 7.1. Prevention of follow-on accident 7.2. Emergency action (Fire-fighting, etc.) 7.3. Rescue and salvage 7.4. Medical Services 7.5. Dissemination of information 7.6. Restoration and rehabilitation 8. Management and risk policies 8.1. Management policy and implementation 8.2. Risk management policy and implementation 9. Risk analysis Process 9.1. Concepts and requirements 9.2. Design and development 9.3. Risk management assurance programme & review 10. Outside Local Control 10.1. Failure by third part 10.2. Severe weather 10.3. Other factors 129 3. Pilot application of the ICFA protocol The pilot analysis was carried out by a team of three analysts, two researchers with extensive experience in safety and risk management, and a former plant manager and engineer of three different nuclear power plants. Prior to the pilot, the analysts were trained by one of the MORT-NRI Guide authors, Dr John Kingston. The working session reviewed the list of factors and their scope. Standards and guidelines for the development of the pilot analysis were also established in order to minimise variability between analysts. Two general rules were agreed: 1) Principle of minimum inference: Analysts should not fall into cause and effect reasoning when coding. Contributing factors must be related to specific extracts (1 or 2 sentences) of the event information. 2) Principle of analyst consensus: As a collaborative process, the log information must be supported by the team of analysts. Each factor must be agreed by at least two of the analysts. HRSs events were collected from different databases identified from a literature review (Campari et al., 2023; Wen et al., 2022). Each database was specifically screened to identify events that occurred in HRSs. A total of 211 different events were identified. Table 2 shows the information on the databases selected for the study and the number of HRSs events in each of them. The pilot analysis was conducted in five events (1 event from HIAD 2.0 and ARIA database; 2 events from H2 LL database; and 2 events from KHK database). According to the ICFA protocol, a form was used to record the core event, contributing factors, other system failures, and corrective actions/lessons learned (Table 3). Table 2: Database description and HRSs events included. Database Description Access HRSs events Hydrogen Incident and Accident Database (HIAD 2.0) European database developed by the Joint Research Centre (JRC) of the European Commission (EC) which records worldwide hydrogen-related events. https://odin.jrc.ec.europa.eu/ On request 16 Hydrogen Tools Lessons Learned database (H2 LL) American database developed by the Pacific Northwest National Laboratory, supported by the U.S. Department of Energy which includes hydrogen safety event records and shares lessons learned and other relevant information. https://h2tools.org/ Open 13 The High Pressure Gas Safety Institute of Japan database (KHK) Japanese database developed by the High Pressure Gas Safety Institute of Japan at the request of the Ministry of Economy, Trade, and Industry in Japan which records incident information related to high- pressure gases and hazardous substances in Japan. http://www.khk.or.jp/ Open (Japanese version) 186 Analysis, Research and Information on Accidents database (ARIA) French database developed by the Bureau for Analysis of Industrial Risks and Pollution (BARPI) within the Ministry of Environment / General Directorate for Risk Prevention which catalogues industrial and technological incidents or accidents that were, or could have been, deleterious to human health, public safety or the environment. https://www.aria.developpement-durable.gouv.fr/ Open (Further information on request) 4 Table 3: Information to collect in each event form. Elements to collect Description Core event The essence of the event as described in the record (what has happened without considering why) Contributing factors Those aspects that determine in some way the event occurrence Other failures Other deficiencies that occurred at (or after) the event Corrective actions / “Lessons learned” Actions taken, as included in the event description 130 4. Results of the pilot application The pilot application of the ICFA protocol to five events allowed the objective identification (according to the principles of minimum inference and inter-analyst consensus) of the main factors that contributed to its occurrence. It should be noted that 'design and development' accounts for 46% (Figure 2) of the contributing factors identified. The content related to this factor is shown in Table 4. Figure 2: Contributing factors distribution in pilot events. Table 4: ‘Design and development’ issues involved in the events. Factor 9.2 - Design and development It considers the design and implementation of work/process control and related infrastructures 2005-222 KHK Hose kink during the filling (Operational readiness) Threaded part of the flexible hose no fixed (Operational readiness) 1 H2 Tools Lack of automatic control for refuelling speed (Automatic control) Procedure leads to human error (Human factor) 5 H2 Tools Bending hose during use (Specification operational readiness) 2005-120 HHK Fatigue failure due to weight of filler and safety coupling (Operational readiness) The application of the protocol has also permitted the categorisation of the "corrective actions/lessons learned" and the identification of the focus of the action from a socio-technical perspective (Table 5). Table 5: Socio-technical level and focus of the corrective actions and lessons learned. Socio-technical level Action Focus Technical Protective tube installed to prevent bending radius of the filler hose Short the replacement period of filler hose Replace fuelling hoses every 6 months Disable the fuelling process (if the sequence is done improperly) Equip technicians with portable sensors Install a metal fitting to avoid screw loose Full leakage test (each time an alarm is triggered) Human Avoid hose kinks during refuelling Organizational Daily examination of fuelling hoses Improve the fuelling procedure Carry out emergency exercises Inter-organizational Failure investigation by producer (O-ring of the bus tank) 5. Conclusions The application of the ICFA protocol has proved to be effective in the analysis of 5 HRS events from 4 different databases, allowing the identification of 13 contributing factors. Its implementation by different analysts enables valuable and reliable information to be obtained, avoiding the bias of subjectivity. It also helps to identify and categorise the contributing factors, providing relevant safety information, and allowing the collection of the operational experiences (corrective actions/lessons learned) that the different stations have implemented after 46% 15% 15% 8% 8% 8% Design and development Concepts and requirements Performance errors Failure by third part Inspection planning Maintenance plannig 131 the events. Extending the use of the ICFA protocol to all sampled events, will allow the discovery of critical aspects for the safety of HRSs. As a potential limitation, it should be stated that the protocol’s application relies on the quality and quantity of the available information. In some cases, the event information is of high quality but, in others, the information is very synthetic, with limited information about the causal sequence or the different factors involved. Acknowledgments This work was supported by AEI Grant Number PCI2022-132997, Spain, through the European Interest Group (EIG) CONCERT-Japan platform (Grant Number 334340). References Apostolou, D., Xydis, G., 2019. A literature review on hydrogen refuelling stations and infrastructure. Current status and future prospects. Renew. Sustain. Energy Rev. https://doi.org/10.1016/j.rser.2019.109292 Campari, A., Nakhal Akel, A.J., Ustolin, F., Alvaro, A., Ledda, A., Agnello, P., Moretto, P., Patriarca, R., Paltrinieri, N., 2023. Lessons learned from HIAD 2.0: Inspection and maintenance to avoid hydrogen-induced material failures. Comput. Chem. Eng. 173. https://doi.org/10.1016/j.compchemeng.2023.108199 Castiglia, F., Giardina, M., 2013. Analysis of operator human errors in hydrogen refuelling stations: Comparison between human rate assessment techniques. Int. J. Hydrogen Energy 38, 1166–1176. https://doi.org/10.1016/j.ijhydene.2012.10.092 CCPS (Center for Chemical Process Safety), 2019. Guidelines for Investigating Process Safety Incidents, 3rd edition. ed. Wiley Professional, Reference & Trade, New York. de Oliveira, U.R., dos Santos, C.O., Chaves, G.E.L., Fernandes, V.A., 2022. Analysis of the MORT method applicability for risk management in supply chains. Oper. Manag. Res. 15, 1361–1382. https://doi.org/10.1007/s12063-021-00248-2 Kingston, J., Koornneef, F., Ruilt, J.V., Frei, R., Schallier, P., 2009. User’s Manual: for use with the management oversight and risk tree analytical logic diagram, Second Edi. ed. The Noordwijk Risk Initiative Foundation. Kletz, T.A., Amyotte, P., 2010. Process Plants: A Handbook for Inherently Safer Design, Second Edition. ed. CRC Press. Lam, C.Y., Fuse, M., Shimizu, T., 2019. Assessment of risk factors and effects in hydrogen logistics incidents from a network modeling perspective. Int. J. Hydrogen Energy 44, 20572–20586. https://doi.org/10.1016/j.ijhydene.2019.05.187 Livingston, A.D., Jackson, G., Priestley, K., Great Britain. Health and Safety Executive., 2001. Root causes analysis : literature review. HSE Books. Moradi, R., Groth, K.M., 2019. Hydrogen storage and delivery: Review of the state of the art technologies and risk and reliability analysis. Int. J. Hydrogen Energy. https://doi.org/10.1016/j.ijhydene.2019.03.041 Pan, X., Li, Z., Zhang, C., Lv, H., Liu, S., Ma, J., 2016. Safety study of a wind–solar hybrid renewable hydrogen refuelling station in China. Int. J. Hydrogen Energy 41, 13315–13321. https://doi.org/10.1016/j.ijhydene.2016.05.180 Rasmussen, J., 1997. Risk management in a dynamic society: a modelling problem. Saf. Sci. 27, 183–213. https://doi.org/https://doi.org/10.1016/S0925-7535(97)00052-0 Solano, V., Isasia, R., 2017. La Metodología de Análisis de Causa Raíz MORT (Management and Oversight Risk Tree). Propuesta de Modernización y Adaptación a la Realidad Española. Sun, K., Pan, X., Li, Z., Ma, J., 2014. Risk analysis on mobile hydrogen refueling stations in Shanghai, in: International Journal of Hydrogen Energy. Elsevier Ltd, pp. 20411–20419. https://doi.org/10.1016/j.ijhydene.2014.07.098 Tsunemi, K., Kihara, T., Kato, E., Kawamoto, A., Saburi, T., 2019. Quantitative risk assessment of the interior of a hydrogen refueling station considering safety barrier systems. Int. J. Hydrogen Energy 44, 23522– 23531. https://doi.org/10.1016/j.ijhydene.2019.07.027 Wen, J.X., Marono, M., Moretto, P., Reinecke, E.A., Sathiah, P., Studer, E., Vyazmina, E., Melideo, D., 2022. Statistics, lessons learned and recommendations from analysis of HIAD 2.0 database. Int. J. Hydrogen Energy 47, 17082–17096. https://doi.org/10.1016/j.ijhydene.2022.03.170 Zhiyong, L., Xiangmin, P., Jianxin, M., 2010. Harm effect distances evaluation of severe accidents for gaseous hydrogen refueling station. Int. J. Hydrogen Energy 35, 1515–1521. https://doi.org/10.1016/j.ijhydene.2009.11.081 132 129navajas.pdf Development of a Protocol for the Systematic Analysis of Events at Hydrogen Refuelling Stations