DOI: 10.3303/CET24111069 Paper Received: 10 February 2024; Revised: 6 May 2024; Accepted: 6 July 2024 Please cite this article as: Campari A., Nakhal Akel A.J., Giannini L., Pasok J.M., Patriarca R., 2024, Human Errors in the Inspection of Hydrogen Refueling Stations: a Bayesian Network Approach, Chemical Engineering Transactions, 111, 409-414 DOI:10.3303/CET24111069 CHEMICAL ENGINEERING TRANSACTIONS VOL. 111, 2024 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Valerio Cozzani, Bruno Fabiano, Genserik Reniers Copyright © 2024, AIDIC Servizi S.r.l. ISBN 979-12-81206-11-3; ISSN 2283-9216 Human Errors in the Inspection of Hydrogen Refueling Stations: a Bayesian Network Approach Alessandro Camparia,*, Antonio Javier Nakhal Akelb, Leonardo Gianninia, Jac Michael Pasoka, Riccardo Patriarcab a Department of Mechanical and Industrial Engineering, NTNU, Trondheim, Norway b Department of Mechanical and Aerospace Engineering, Sapienza University of Rome, Italy alessandro.campari@ntnu.no The widespread use of hydrogen as an energy carrier for road transport and industrial applications was indicated as a promising solution for reducing pollutant emissions. The high flammability of this substance and its tendency to permeate and embrittle most structural materials make hydrogen handling and storage inherently challenging. Hence, inspection and maintenance activities are essential to guarantee the components' integrity and fitness for service. However, guidelines for inspecting and maintaining hydrogen refueling stations are still under development. The manufacturer is responsible for indicating the optimal inspection procedures for each facility. The lack of a unified regulatory framework and the limited operational experience with these technologies make human errors a potential cause of undesired events. In this context, the study evaluates the probability of human error during the high-pressure storage system inspection procedures in hydrogen refueling stations. The Petro-HRA methodology has been used to quantify the likelihood of unsafe or inappropriate actions. In addition, a Bayesian Network approach is proposed to investigate the conditional dependencies among human errors and performance shaping factors. The critical analysis of the results allowed the authors to provide recommendations regarding safety procedures that operators can adopt to reduce the likelihood of accidents in the hydrogen industry. 1. Introduction The global pursuit of clean and sustainable energy sources imposes a paradigm change in mobility. Hydrogen was largely indicated as a promising energy carrier to mitigate the environmental impact of road transport. Developing a widespread hydrogen distribution infrastructure presents substantial technical and economic challenges. Furthermore, the safety aspects associated with Hydrogen Refueling Stations (HRSs) represent a primary concern for the regulatory institutions, public, and industrial stakeholders (IEA, 2022). Considering the high flammability and low ignition energy of hydrogen gas and its tendency to permeate and degrade most structural materials, preventive maintenance approaches are preferable to corrective ones. Monitoring the presence of structural defects and propagation of cracks guarantees the physical integrity and fitness for service of the components. Inspection activities, commonly performed through Nondestructive Testing (NDT), allow to evaluate the degradation state of the components of the HRS and determine if corrective actions should be taken. Moreover, it was proven that a significant share of the total risk of failure in hydrogen refueling stations is associated with the H2 storage tanks (Campari et al., 2024). Several techniques can detect the presence of cracks and flaws triggered by the synergistic effect of mechanical loads, susceptible material microstructure, and high-pressure hydrogen gas (Campari et al., 2023). Acoustic emission tests are used as a screening technique for the in-service inspection of pressure vessels. Even if performed by specialized personnel, the existing inspection protocols must be better adapted for hydrogen handling and storage equipment. In addition, the lack of operational experience with hydrogen technologies results in a higher risk of human errors, and one-time activities are particularly critical (Castiglia and Giardina, 2013). For example, the incident that occurred in 2019 at the refueling station in Kjørbo 409 (Norway) was caused by a human error during the maintenance of the hydrogen storage system and resulted in significant financial damage and a general loss of trust regarding hydrogen-based mobility. Human Reliability Analysis (HRA) aims to assess the risk of human errors by identifying potential incorrect actions, estimating their likelihood, evaluating the triggering factors, and proposing solutions to reduce the risk. In most cases, the parameters for the HRA are defined by specialists, are subjective, and are affected by high uncertainty. In addition, the consolidated HRA methodologies cannot account for the dependencies of Human Error Probabilities (HEPs) in related tasks. To address these limitations, the present study presents an integrated method for evaluating the impact of different factors on the reliability of an inspection through acoustic emissions of a storage tank in an HRS. A Bayesian Network (BN) complements the Petro-HRA methodology to reduce the inaccuracy in estimating the success probability and consider the conditional dependencies of all the tasks involved. This BN – Petro-HRA approach can increase the reliability of the inspections in hydrogen refueling stations, thus enhancing operational safety. 2. Acoustic emission testing Type II tanks are steel cylinders with carbon or glass fiber filaments wrapped around their straight structure, commonly used in HRSs. They are used for stationary applications at operating pressures around 300 bar. The exposure to high-pressure H2 gas makes these components potentially prone to hydrogen-induced surface or subsurface cracking. If this material damage occurs, there is little evidence of deformations, and crack initiation is typically not visible (API, 2020). Specialized operators can perform inspections through nondestructive testing techniques to detect premonitory signs and allow the intervention before the failure occurs. Acoustic Emission Testing (AET) can detect flaws, cracks, and discontinuities in industrial equipment by measuring the energy released by the examined component under realistic operating conditions. Acoustic emissions originate when the material undergoes tension, and they are particularly intense when the elastic deformation turns to plastic (i.e., approaching the yield stress). Macroscopic cracks and defects in the material act as stress concentrators, emitting acoustic waves that are orders of magnitude more intense than those emitted by the surrounding area (Kumar and Mahto, 2013). The amplitude of the acoustic waves is proportional to the crack growth rate. AET is based on detecting these waves, converting them to electric signals, and analyzing them to locate the material defect. The sensitivity of the system is limited by background noise, which is eliminated by electronic filtering (API, 2018). AET equipment is selected based on the frequency (typically 30 kHz to 1 MHz), sensitivity (maximized at the natural frequency of the piezoelectric element), and working environment (in terms of background noise). Sensors and transducers are piezoelectric crystals that convert mechanical vibration into an electrical signal with the same frequency. Preamplifiers are placed near the transducers and are used to boost the voltage and guarantee sufficient cable drive capability. They are designed to reduce background noise signals. A bandpass filter eliminates low and high frequencies, and the clean signal travels to the system mainframe to be visualized, analyzed, and evaluated (ASME, 2023). The main advantage of AET over other NDTs is the possibility of dealing with changes in the material, such as crack growth, if the load is sufficient to determine the acoustic emissions. In addition, AET allows a complete volumetric inspection of the tank through multiple and properly located sensors. On the other hand, AE devices can only gauge qualitative indications about the degradation of the component. They should be combined with other NDTs (e.g., ultrasonic testing) to quantify the crack size and depth (ASME, 2023). Figure 1: Schematic of the AET setup for pressurized storage tanks 3. Methodology The methodology for evaluating human errors during the inspection of hydrogen storage tanks relies on integrating BN into HRA. Firstly, the Petro-HRA methodology was used to quantify the likelihood of inappropriate actions during the inspection of a high-pressure storage system through acoustic emission Crack AE sensor AE mainframe 410 testing. Secondly, a Bayesian Network approach allowed for investigating conditional dependencies among human errors and Performance Shaping Factors (PSFs). 3.1 Petro-HRA methodology HRA is a structured approach to systematically identify potential undesired events caused by human errors and estimating their probability. This analysis mainly aims to identify the tasks more prone to operators' incorrect actions and the factors influencing the likelihood of human error. The Petro-HRA method comprehends the definition of the scenario, data collection, task analysis, identification, modeling, and quantification of human errors, and the reduction of human error probabilities. It provides quantitative inputs for risk analysis and recommendations for facility management (Blackett et al., 2022). In this study, Petro-HRA is applied to obtain the probabilities for the BN. Therefore, the proposed approach can be roughly divided into six steps: • Scenario definition – It defines the boundaries of the analysis; in this case, inspecting a high-pressure storage tank to detect hydrogen-induced cracks through AET comprehends the test preparation, execution, completion, and data collection and interpretation. • Data collection – It comprehends the collection of qualitative information on the location, external environment, tasks that should be performed, duration of the procedure, systems involved, operational mode of the facility, and personnel roles and responsibilities. • Task analysis – It defines and structures the operators' tasks through a hierarchical task analysis (HTA) following the detect-diagnose-decide-act cognitive-behavioral model; it is based on the section devoted to nondestructive examination of pressure vessels of the ASME BPVC (ASME, 2023). • Human error identification – It identifies potential errors associated with the tasks, describes the consequences, and identifies the main influencing factors for the error probabilities. • Human error modeling – It identifies what human actions contribute the most to the overall risk of incorrect inspection by linking the errors with task steps. • Human error quantification – It quantifies the human error probability for each undesired event based on a nominal value and a set of performance shaping factors. The HEP is calculated by combining a base probability of 1% with nine PSFs accounting for the operator's characteristics, surrounding environment, and organization: 𝐻𝐸𝑃 = 0.01 ∙ 𝑃𝑆𝐹𝑡 ∙ 𝑃𝑆𝐹𝑡𝑠 ∙ 𝑃𝑆𝐹𝑡𝑐 ∙ 𝑃𝑆𝐹𝑜𝑡 ∙ 𝑃𝑆𝐹𝑝 ∙ 𝑃𝑆𝐹ℎ𝑚𝑖 ∙ 𝑃𝑆𝐹𝑎𝑠 ∙ 𝑃𝑆𝐹𝑡𝑤 ∙ 𝑃𝑆𝐹𝑒 (1) where 𝑃𝑆𝐹𝑡 accounts for the available time, 𝑃𝑆𝐹𝑡𝑠 for the threat stress, 𝑃𝑆𝐹𝑡𝑐 for the task complexity, 𝑃𝑆𝐹𝑜𝑡 for the operator training, 𝑃𝑆𝐹𝑝 for the procedure, 𝑃𝑆𝐹ℎ𝑚𝑖 for the human-machine interface, 𝑃𝑆𝐹𝑎𝑠 for the attitude to safety, 𝑃𝑆𝐹𝑡𝑤 for the teamwork, and 𝑃𝑆𝐹𝑒 for the physical working environment (Blackett et al., 2022). 3.2 Bayesian Network BN analysis is a probabilistic graphical model that allows the representation of probabilistic relationships between variables (nodes) and uses probability theory to deal with the uncertainty associated with conditional dependencies between variables (edges). A BN is typically represented as a directed acyclic graph where each node corresponds to a random variable, and each oriented edge connecting one node to another represents the conditional probability for the corresponding random variables (Zhang et al., 2024). According to Bayes’ theorem, considering two independent events (A and B), the conditional probability of A given B can be calculated by Eq. 2: 𝑃𝑟(𝐴|𝐵) = 𝑃𝑟(𝐵|𝐴) + Pr(𝐴) Pr⁡(𝐵) (2) where 𝑃𝑟(𝐴|𝐵) is the conditional probability, i.e., the probability of event A given the event B (with Pr(𝐵) ≠ 0), Pr(𝐴) and Pr(𝐵) are the probabilities of event A and B without any conditions (referred to as prior or marginal probabilities), and 𝑃𝑟(𝐵|𝐴) is the probability of event B given the event A (Sivia and Skilling, 2006). A comprehensive summary of BN is provided in the literature in which the joint probability distribution of a set of random variables is calculated as per Eq. 3 (Leoni et al., 2019): 𝑃(𝑈) =∏𝑃(𝑋𝑖|𝑃𝑎(𝑋𝑖)) 𝑛 𝑖=1 (3) where 𝑃(𝑈) is the joint probability distribution, 𝑃𝑎(𝑋𝑖) is the parent set of variables 𝑋, and 𝑛 is the number of sets.The HTA is mapped into a BN to reproduce the hierarchy of tasks through the graphical representation with edge-connecting nodes. The states of each node are specified by indicating if the task fails or succeeds. 411 The resulting BN is structured into three layers: the sub-tasks constitute the first layer, the tasks are the second, and the AET of the hydrogen storage tank is the third layer. 4. Results and discussion Each task's generic human error probability is calculated by selecting the corresponding performance-shaping factors. Then, the most meaningful PSFs are indicated by a panel of experts. Attitude to safety, physical working environment, and operator experience have the same value for each task. The management is assumed to consider safety aspects during inspection operations, the weather conditions are favorable, the design of the facility is ergonomic, and the inspectors are appropriately trained to perform their activities. Task complexity, human-machine interface, procedure, and teamwork depend on the task considered. At the same time, the other PSFs (i.e., time and threat stress) have a limited impact on the HEP for this case study. Table 1 summarizes the tasks for inspecting the hydrogen tank through AET performed chronologically. The HEP for each sub-task is estimated by combining the nominal task failure rate with nine PSFs. Table 1: Human error probabilities of the sub-tasks for the inspection of the hydrogen tank through AET Tasks Sub-tasks Type HEP 1 Tank isolation and draining 1.1 Close the flow valve to isolate the vessel from the supply line Procedure 0.001 1.2 Open the flow valve to the dispensing unit to drain the tank Procedure 0.001 1.3 Check the pressure sensor on the storage unit to ensure it is empty Knowledge 0.01 1.4 Close the flow valve to isolate the tank from the dispensing unit Procedure 0.001 2 Mounting and check of AET equipment 2.1 Mount the AE sensors on the tank surface Skill 0.025 2.2 Adjust signal processor settings Skill 0.025 2.3 Verify the peak amplitude of the AE sensors and background noise Knowledge 0.05 2.4 Verify if the AE system displays a correct location for the AE sensors Knowledge 0.05 3 Pressurization of the tank 3.1 Open the flow valve between tank and inert gas source Procedure 0.001 3.2 Fill the tank with inert gas at the pressurization rate of 3.45 MPa/h Procedure 0.1 3.3 Check the pressure sensor on the storage unit to verity that the inner pressure is 110% of the service pressure Knowledge 0.01 3.4 Close the flow valve between tank and inert gas source Procedure 0.001 3.5 Verify if the peak amplitude of each sensor is greater than a specified value Knowledge 0.005 4 Data post- processing 4.1 Filter raw AE data to eliminate the background noise Skill 0.05 4.2 Examine the distribution plots to locate the defects Skill 0.25 4.3 Decide if further NTSs are needed to quantify the crack size Skill 0.02 The probabilities of tasks and sub-tasks have Boolean values, either “failure” or “success.” “Failure” indicates an unsuccessful or incomplete task, while “success” indicates a complete task. Figure 2 shows a graphical representation of the three-layered BN. Figure 2: BN model showing the probability of success of each task and sub-task of the AET 412 Figure 2 quantifies the probability of successfully inspecting a hydrogen tank through AET. It is possible to observe that the inspection activity has a probability of 99.882% to be completed and detect an existing crack. This is verified when considering the optimal working environment, adequate attitude to safety, and sufficient training of the operators. However, the test’s performance depends on four steps. They have a relatively high chance of being appropriately performed, considering the HEPs associated with the sub-tasks. Table 2 indicates that the likelihood of unsuccessful tank isolation and draining is extremely low due to the simplicity of the actions involved. In contrast, the data post-processing and interpretation are more critical since the procedure is not well defined, the tasks are inherently more complex, and the human-machine interface might be challenging to interpret. Table 2: Conditional probabilities of the tasks ID Task description Probability of success 1 Tank isolation and draining 99.998 % 2 Mounting and check of AET equipment 99.289 % 3 Pressurization of the tank 98.905 % 4 Data post-processing 93.293 % Figure 3 presents the sensitivity analysis and shows the strength of influence for each task and sub-task of the AET test. The thickness of the arrows indicates the strength of influence, while the colored elements represent the degree of sensitivity. Figure 3: Strength of influence and degree of sensitivity of each task and sub-task of the AET Task 4.2, associated with examining the distribution plots to locate the defects, dramatically influences the overall system performance. Other notable strong influences within the network, such as the route from sub- task 1.3 through task 1 to the AET test, significantly impact the test results. It is related to the draining of the tank and can compromise the inspection completion if it is not performed correctly. Furthermore, strong influences are observed between pairs of sub-tasks and tasks, like sub-tasks 2.3 and 2.4 and task 2 (indicating the verification of the peak amplitude, background noise, and location of the AE sensors), or sub- task 3.2 and task 3 (indicating the pressurization of the tank at controlled rate). The strength of influence indicates the critical interactions within the system. The sensitivity analysis results show that any changes in task 1 significantly influence the outcomes of the AE test. This means that any variations in the PSFs of the sub-task of the tank isolation and draining significantly affect the success rate of the entire inspection activity. Untrained personnel with teamwork and managerial deficiencies could dramatically increase the likelihood of failure of this task. Despite its simplicity, the correct isolation of the tank is fundamental to completing the AET since it allows the pressurization of the tank, the emission of acoustic waves, and the data collection and interpretation. In general, the BN analysis reveals valuable insights into the complex system's dependencies and sensitivities, highlighting the need for clear procedures, trained personnel, and safety-informed management to ensure the reliability of test results. The advantage of this approach over a conventional HRA is that two or more tasks can share the sub-tasks without being considered more than once. In addition, any task or sub-task can be added to the existing BN model and dynamically updated. AET Task 1 Task 2 Task 3 Task 4 Sub-task 1.1 Sub-task 1.3 Sub-task 1.2 Sub-task 2.1 Sub-task 2.2 Sub-task 2.3 Sub-task 2.4 Sub-task 4.3 Sub-task 4.2 Sub-task 4.1 Sub-task 3.1 Sub-task 3.2 Sub-task 3.3 Sub-task 3.4 Sub-task 3.5 413 Further exploration of the relationships between PSFs can enhance the robustness of the analysis. In addition, this research could be improved by integrating the BN into holistic approaches such as system theory or simulation modeling. A system-theoretic approach (e.g., the STAMP model) can analyze system safety, identify hazards, and implement feedback loops to enhance the system’s reliability and resilience (Nakhal et al., Patriarca et al., 2022). In simulation modeling, it is possible to build a digital system to test and identify the criticalities of the system (Simone et al., 2023). The future results will ensure model relevance and accuracy, leading to a more robust and practical approach to understanding and managing complex systems. 5. Conclusion The HRA and BN analysis combination yielded insightful results when applied to the AET in hydrogen-related industrial facilities. The Petro-HRA methodology allowed the determination of the prior probabilities for the BN by considering nine performance shaping factors. Integrating various factors and their conditional dependencies provided a comprehensive understanding of the influence of human errors associated with AET to detect hydrogen-induced cracks. In addition, BN enables a more accurate estimation of the likelihood of failure through probabilistic inference, allowing for informed decision-making regarding safety measures and procedural adjustments. This study offers a quantitative approach to assess uncertainties and interdependencies within the system, thereby enhancing the reliability and effectiveness of risk management strategies in the context of complex inspection activities. Therefore, these findings can improve safety during inspection activities in the hydrogen refueling infrastructure and indicate the procedure's most critical steps. Acknowledgments This work was undertaken as a part of the research project “Sustainability and Cost-Reduction of Hydrogen Stations through Risk-Based, Multidisciplinary Approaches” (SUSHy), and the authors would like to acknowledge the financial support of the EIG CONCERT-Japan platform (Grant No. 334340). References American Petroleum Institute, 2018, API 510 – Pressure Vessel Inspection Code: In-service Inspection, Rating, Repair, and Alteration, Washington DC, USA. American Petroleum Institute, 2020, API RP 571 – Damage Mechanisms Affecting Fixed Equipment in the Refining Industry, Washington DC, USA. American Society of Mechanical Engineers, 2023, ASME Boiler and Pressure Vessel Code – Nondestructive examination, New York, USA. Blackett C., Farbrot J. E., Øie S., Fernander M., 2022, The Petro-HRA Guideline – Volume 1, Kjeller, Norway. Campari A., Darabi M.A., Alvaro A., Ustolin F., Paltrinieri N., 2023, Toward Risk-based Inspection of Hydrogen Technologies: a Methodology for the Calculation of the Damage Factor of Hydrogen Embrittlement, Chem. Eng. Trans., 98. Campari A., Alvaro A., Paltrinieri N., 2024, Comparing Inspection Strategies for Hydrogen Refueling Stations: Time-Based and Risk-Based Approaches, Proceedings of the 34th European Safety and Reliability Conference (ESREL 2024), Krakow, Poland. Castiglia F., Giardina M., 2013, Analysis of operator human errors in hydrogen refuelling stations: Comparison between human rate assessment techniques, Int. J. Hydrogen Energy, 38. Chauhan A., Golestani N., Yazdi M., Njue J.C.W., Abbassi R., Salehi F., 2023, A novel integrated methodology for human reliability assessment in hydrogen fuelling stations, Int. J. Hydrogen Energy, 48. International Energy Agency, 2022, Global Hydrogen Review 2022. Kumar S., Mahto D.G., 2013, Recent trends in industrial and other engineering applications of non-destructive testing: a review, Int. J. Sci. Eng. Res., 4(9). Leoni L., BahooToroody A., De Carlo F., Paltrinieri N., 2019, Developing a risk-based maintenance model for a natural gas regulating and metering station using Bayesian Network, J. Loss Prev. Process Ind., 57. Nakhal A.A.J., Patriarca R., Tronci M., Agnello P., Ansaldi S.M., Ledda A, 2022, A STAMP Model for Safety Analysis in Industrial Plants, Chem. Eng. Trans., 91. Patriarca R., Chatzimichailidou M., Karanikas N., Di Gravio G., 2022, The past and present of System- Theoretic Accident Model and Processes and its associated techniques: A scoping review, Saf. Sci., 146. Simone F., Nakhal A.A.J., Di Gravio G., Patriarca R., 2023, Thinking in Systems, Sifting Through Simulations: A Way Ahead for Cyber Resilience Assessment, IEEE Access, 11. Sivia D., Skilling J., 2006, Data Analysis – A Bayesian Tutorial Second Edition, Oxford, UK. Zhang J., Shi M., Lang X., You Q., Jing Y., Huang D., Dai H., Kang J., 2024, Dynamic risk evaluation of hydrogen station leakage based on fuzzy dynamic Bayesian network, Int. J. Hydrogen Energy, 50. 414 39campari.pdf Human Errors in the Inspection of Hydrogen Refueling Stations: a Bayesian Network Approach