DOI: 10.3303/CET25116028 Paper Received: 2 December 2024; Revised: 26 February 2025; Accepted: 5 May 2025 Please cite this article as: Dueñas Santana J.A., Salzano E., Di Benedetto A., Van Coile R., 2025, Using a Systems Thinking Approach for a Dynamic Hydrogen Risk Assessment, Chemical Engineering Transactions, 116, 163-168 DOI:10.3303/CET25116028 CHEMICAL ENGINEERING TRANSACTIONS VOL. 116, 2025 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Bruno Fabiano, Valerio Cozzani Copyright © 2025, AIDIC Servizi S.r.l. ISBN 979-12-81206-18-2; ISSN 2283-9216 Using a Systems Thinking Approach for a Dynamic Hydrogen Risk Assessment Julio Ariel Dueñas Santanaa,*, Ernesto Salzano b , Almerinda Di Benedetto c, Ruben Van Coile d a Scuola Superiore Meridionale. School for Advanced Studies. Università degli Studi di Napoli Federico II. Largo S. Marcellino, 10, 80138, Napoli, Italia. b Dipartimento di Ingegneria Civile, Chimica, Ambientale e dei Materiali, Università degli studi di Bologna, Via Terracini 28, 40131, Bologna, Italia. c Dipartimento di Ingegneria Chimica, dei Materiali e della Produzione Industriale, Università degli Studi di Napoli Federico II, P.le Vincenzo Tecchio 80, 80125, Napoli, Italia d Department of Structural Engineering and Building Materials, Ghent University, Technologiepark-Zwijnaarde 60, 9052 Ghent, Belgium. julioariel.duenassantana-ssm@unina.it ; julio.duenas94@gmail.com The rising global demand for cleaner energy sources brings an increasing complexity regarding the risk level and safety management of gas fuels. In order to address this complexity, this research adopts a Three-Paradigm integration (considering Sustainability, Complexity, and Systems Thinking) to perform a dynamic hydrogen risk assessment, and proposes an integrated Systems Thinking approach which captures interdependencies linked to the hydrogen risk. In this study, a Causal Loop Diagram is developed to understand the dynamics and the complex behaviour related to hydrogen safety. A System Dynamics model is proposed for computing the dynamic failure probability and the likelihood of domino effects for pressurized vessels. The development of the System Dynamics models offers valuable insights for policymakers, industry stakeholders, and researchers alike. Overall, the integration of a Systems Thinking approach allows for a better understanding of the complex interactions involved in the risk assessment of hydrogen, allowing for informed decision-making and advancements in gas storage technologies. 1. Introduction There is a worldwide effort to move towards the exploration and use of environmentally friendly fuel pathways such as hydrogen (Cipolletta et al., 2022). One of the major concerns regarding the development of hydrogen infrastructures is safety (Dueñas Santana et al., 2024b). Performing informed-risk analysis with traditional approaches often requires the assumption of static failure probabilities. In order to provide a more realistic risk assessment, it is then necessary to include not only dynamic effects (e.g. due to degradation, hydrogen embrittlement) but also connected feedback effects that can positively or negatively affect hydrogen safety. Furthermore, the time-dependency of expected failures and events is a major challenge in communicating risk assessment and safety management solutions. Therefore, it is necessary to provide a clear visualization of the yearly expected failure probability and possible domino effect for decision-makers where the dynamic evolution of these metrics is shown. In the context of sustainable energy production, Dueñas Santana et al., (2024a) suggested the integration of the paradigms: Sustainability, Complexity, and Systems Thinking (Sterman, 2002). Two relevant tools included in a Systems Thinking approach are the Causal Loop Diagram (CLD) and the System Dynamics (SD) modelling. A CLD is related to qualitative modelling, and it aims to develop a conceptual model for capturing the dynamic interaction between system components while an SD modelling provides a quantitative approach. This research aims to develop a Systems Thinking approach (a CLD plus an SD model) for a dynamic hydrogen risk assessment. By using a SD approach, it is possible to model different scenarios in the SD environment. 163 The dynamic nature of the output metrics of SD provides an important additional functionality relative to traditional event tree modelling used in safety engineering. 2. Methodology The proposed Systems Thinking approach consists of two main models: a CLD and an SD. The methodology is divided into three main stages. The first step aims to build a CLD for capturing the complex interactions among the variables that are connected to the risk related to gas hydrogen (GH2) technologies. For this purpose, it is necessary to connect variables following the identified causalities and thus obtain feedback loops. The second stage goal is to develop a System Dynamics model for quantifying the probability of failure of a pressurized vessel (containing H2), the expected cumulative events from this failure, and the probability of escalation to nearby containments. Finally, the third stage focuses on performing a dynamic hydrogen risk assessment by considering the obtained simulations (using Vensim software) of the previous two models. 2.1 Developing a Causal Loop Diagram for addressing the complexity linked to the hydrogen safety (Stage 1) This stage aims to develop a CLD for analysing and visualising the interdependencies linked to GH2 safety. To do so, the main causalities and interconnections are first identified from the literature (Mannan, 2014). The model considers the following six groups of factors: (1) the core model for performing the risk analysis, (2) the hazardous hydrogen-related factors, (3) the hydrogen embrittlement vulnerability, (4) the influence of completed investigations on safety improvements, (5) the consequence analysis, (6) and possible domino effects. The CLD focuses on capturing causality and especially the feedback effects. In a CLD, positive and negative arrows refer to polarity. In other words, a positive causality (Fig. 1, represented with blue colour) between two variables (“A” and “B”) means that (all else remaining equal) an increase in the variable “A” will lead to an increase in the value of the variable “B” above what it would otherwise have been; on the contrary, a negative causality (Fig. 1, represented with red colour) means that an increase in the variable “A” will lead to a decrease of the value of the variable “B” below what it would otherwise have been. 2.2 System Dynamics modelling for performing dynamic risk assessment (Stage 2) SD models contain stocks, flows, and auxiliary variables. Stocks represent the accumulation of quantities of resources at any given point in time within the system. Their level can be increased by the inflow(s) and decreased by outflow(s), considering non-linearities and delays. This section focuses on providing the main equations used for the SD model development. For computing the expected failure rate this research adopts a two-parameter Weibull distribution (recommended by Salzano et al., 2014 and Mannan, 2014) as Eq(1). The use of this model allows for a dynamic failure rate (contrary to the Fault Tree technique) which is more realistic considering the gradual degradation of the vessels during their lifetime and due to specific hazard phenomena associated with hydrogen such as hydrogen embrittlement. 𝑓(𝑡) = 𝛽 𝛼 [ 𝑡 𝛼 ] 𝛽−1 𝑒 [−( 𝑡 𝛼 ) 𝛽 ] (1) The parameter α represents the inverse of the initial failure rate (statistical) while 𝛽 is the shape parameter which represents the hazard rate. For values of 𝛽 < 1 the hazard rate decreases in time, if 𝛽 > 1 the hazard rate increases in time, and for 𝛽 = 1 the hazard rate remains constant. In the case of the event occurring inflows, the “RANDOM POISSON” function in Vensim is used which generates random numbers from a Poisson distribution, which is commonly used for modeling the number of events occurring in a fixed time interval. The mean of the Poisson distribution is defined as the expected number of events over a single simulation step. The main equations used in this model Eq.(2)- Eq.(12) are shown in Table 1. 2.3 Holistic dynamic hydrogen risk assessment (Stage 3) Considering both developed models it is possible the following: (1) to provide a holistic view of the hydrogen risk technology (CLD), and (2) to perform simulations for computing the probability of failure and escalation of a given vessel containing pressurised GH2 (SD). Some additional data for these simulations, as well as, different escalation probabilities (for two scenarios) are shown in Table 2. 3. Results and discussion This section shows the two models developed in this research framework for performing a holistic dynamic hydrogen risk assessment. 164 Table 1: Model equations for the System Dynamics environment Parameter___________ Classification Equation_______________________________ Equation number Probability vessel is working (normal operation) Stock (Initial value=1) INTEG(-Expected failure rate) 2 Expected failure rate Inflow "Prob. Vessel is working (normal operation)" x f(t) 3 Probability vessel has failed Stock (Initial value=0) INTEG(Expected failure rate) 4 Cumulative events associated with the failure of the vessel Stock (Initial value=0) INTEG(Event occurring vessel due to delayed ignition + Event occurring vessel due to direct ignition) 5 Event occurring due to direct ignition Inflow RANDOM POISSON(0, 1e+06, expected event rate immediate ignition*TIME STEP,0,1,0)/TIME STEP 6 Event occurring due to delayed ignition Inflow RANDOM POISSON(0, 1e+06, expected event rate delayed ignition*TIME STEP,0,1,0)/TIME STEP 7 Expected event rate Auxiliary variable "Prob. vessel has failed"*"prob. ignition"/TIME STEP 8 Cumulative events associated with the escalation from v1 to v2 Stock (Initial value=0) INTEG(ERV1DirIg+ERV1DelayIg+"Event occurring v2 due to delayed ignition after the failure of v1- v2"+"Event occurring v2 due to direct ignition after the failure of v1-v2") 9 Event occurring v2 due to direct ignition after the failure of v1-v2 Inflow RANDOM POISSON(0, 1e+06, "EER V1-V2 Dir. Ig."*TIME STEP,0,1,0)/TIME STEP 10 EER V1-V2 Dir. Ig. (Expected event rate due to escalation) Auxiliary variable "Prob. vessel 2 has failed due to escalation from vessel 1"*"prob. immediate ignition"/TIME STEP 11 Prob. vessel 2 has failed due to escalation from vessel 1 Auxiliary variable "Escalation probability 1-2"*"Prob. vessel 1 has failed" 12 Table 2: Additional data for the SD modelling (quantitative input for the model) Scenario Initial failure rate (y-1) (Mannan, 2014) β parameter Hydrogen release rate (kg/s)_____________________ Escalation probability v1-v2 ___________ Escalation probability v2-v1 Time scale (years) S01 4.3e-03 1.5 0.5 0.25 0.15 50 S02 4.3e-03 1.5 0.5 0.75 0.65 50 3.1 Causal Loop Diagram for addressing the complexity linked to hydrogen safety (Stage 1) Figure 1 shows the developed CLD for analyzing risks associated with hydrogen systems, emphasizing failure mechanisms, risk propagation, and the impact of safety measures. It integrates multiple sub-models into a holistic framework, categorized into distinct areas. Figure 1 illustrates an advanced causal loop model designed to comprehensively assess risks in hydrogen systems, integrating multiple subsystems to capture the dynamic interplay between failure mechanisms, risk propagation, and the effectiveness of safety interventions. The model is structured into five key sections. The Hazardous Hydrogen-Related Factors section focuses on material vulnerabilities such as hydrogen embrittlement and permeation, influenced by variables like alloy strength, ambient conditions, and hydrogen purity, which cumulatively increase the risk of mechanical failure in storage vessels and pipelines. The Core Model for Risk Analysis serves as the central framework, analyzing failure propagation through cumulative risks and the potential for domino effects, which are influenced by inspection schedules, maintenance, and the effectiveness of safety barriers. The Influence of Completed Investigations on Safety Improvements highlights the role of feedback loops where incident investigations and lessons learned improve safety measures, reduce perceived risk gaps, and enhance preventive maintenance practices. The Domino Effect Analysis examines cascading failures caused by thermal, mechanical, and pressure stresses, 165 emphasizing how proximity to failures and the integrity of safety barriers dictate escalation risks. Finally, the Consequence Analysis focuses on post-failure outcomes such as hydrogen release, atmospheric dispersion, ignition sources, and resulting thermal or overpressure effects, which could lead to flash fires, explosions, and extensive structural damage. The model integrates positive feedback loops that amplify risks (e.g., increased hydrogen exposure leading to embrittlement and higher failure rates) with negative loops that mitigate risks through actions like regular inspections and preventive measures. It underscores the interdependencies among factors such as material properties, environmental conditions, and operational practices, demonstrating how failures can escalate through mechanical stress, thermal exposure, or cascading domino effects. Figure 1: Causal Loop Diagram (expressed in terms of SD environment) for hydrogen risk analysis Note: a positive causality (blue colour), a negative causality (red colour). The total number of identified feedback loops for the developed CLD is 446 starting from the Cumulative risk, 422 starting from the Leakage hydrogen, and 365 starting from the Domino effect, which means that this is a highly interdependent system. The model has potential practical applications in hydrogen infrastructure safety, enabling the identification of critical intervention points, the design of risk mitigation strategies, and compliance with safety regulations. 3.2 System Dynamics model for dynamic risk assessment (Stage 2) Figure 2 provides the developed SD model for evaluating the likelihood and consequences of cascading failures between two interconnected vessels (vessel 1 and vessel 2) in a process plant, incorporating critical parameters such as failure rates, ignition probabilities, and escalation probabilities. The model consists of eight main stocks considering the probability of failure of two vessels, the probability of working during operation, the expected cumulative events associated with the possible failures, and the cumulative events considering escalation from one vessel to another. The inflows represent the expected failure rate for each vessel, and the events occurring due to immediate and delayed ignition. Relevant auxiliary variables are the estimated escalation probability, the expected event rate, the GH2 release rate, and the immediate and delayed ignition probabilities depending on the release rate. The model begins with the initial probabilities of normal operation for both vessels, which diminish over time due to failures governed by initial failure rates and operational or environmental factors (e.g., stress, degradation). Each vessel's failure not only results in its own risk of hazardous material release but can also escalate to the failure of the other vessel, with escalation probabilities quantifying the likelihood of such interdependence. This escalation mechanism captures the cascading nature of failures which could happen in industrial systems. Upon failure, hazardous releases may lead to either direct ignition, which occurs immediately, or delayed ignition, which happens after some time has passed. Both ignition types are modeled with distinct probabilities and expected event rates, reflecting the dynamics of ignition scenarios and their contribution to overall system risk. 166 Additionally, the model tracks cumulative events caused by failures, escalation, and ignition, presenting a clear picture of the system’s vulnerability to repeated or compounding failures. Escalation event rates are defined for both direct and delayed ignition pathways, further highlighting the risks of failure propagation through interconnected systems. The inclusion of cumulative escalation events, event occurrence probabilities, and escalation rates between the vessels provides a realistic dynamic mechanism for assessing systemic reliability and identifying potential failure hotspots. Figure 2: System Dynamics model for dynamic hydrogen risk assessment 3.3 Holistic dynamic hydrogen risk assessment (Stage 3) Figure 3 illustrates the cumulative events and associated probabilities over time for two vessels (denoted as vessel 1 and vessel 2) under a scenario labeled S01. Figure 3: Results from performed simulations using the SD model for the scenario S01 The probabilities and cumulative events grow over time, with distinct differences in their rates of increase. This visualization effectively combines temporal dynamics of failures and their cascading effects. The connection between the figures is clear: the rising failure probability in Figure 3a (left) directly drives the growth of cumulative events in Figure 3b (right), emphasizing the need for time-based risk management. Together, these insights recommend regular inspections, preventive maintenance, and strengthened safety barriers to mitigate escalating risks, particularly after the 20-year mark. They also stress monitoring early signs of material vulnerabilities to prevent failures from propagating through interconnected systems, ensuring safer operations across the lifecycle of hydrogen infrastructure. Figure 4 analyzes the cumulative escalation events between two vessels (v1 and v2) under two scenarios, S01 (blue lines) and S02 (red lines), over a 50-year period. S02 refers to the scenario with higher escalation probability associated (Table 2). 167 Figure 4: Results from performed simulations using the SD model for comparing scenarios S01 and S02 The stepped curves in each plot reflect discrete escalation events occurring at specific times, with differences in the frequency and timing of these events between the two scenarios. The steeper slopes of the red curves compared to the blue curves in both figures highlight that scenario S02 has a higher escalation probability. The divergence between the scenarios becomes more pronounced after the midpoint of the time horizon, suggesting that the risk of escalation accumulates and accelerates with time under S02. Together, these figures underscore how different scenarios impact the dynamics of failure escalation, with S02 being more severe than S01 in terms of both frequency and magnitude of cumulative escalations between the vessels, highlighting the relevance of the effectiveness of safety barriers for reducing the escalation probability. 4. Conclusions This research developed an integrated Systems Thinking approach for performing a dynamic hydrogen risk assessment. A Causal Loop Diagram is provided, by capturing the complex interdependencies linked to hydrogen safety. Furthermore, a System Dynamics model is proposed to compute the failure probabilities and the expected event rates considering also potential escalation. The advantages of using the developed models and future research lines are as follows: (1) the CLD can be further transformed into several connected SD models, and in this way, it will be possible to quantify the cumulative risk considering all the exposed complex interactions, and (2) the SD-based model can be used in the presented form for comparing different hydrogen storage technologies and can be expanded considering the complexity of the CLD model. The findings advocate for regular inspections, robust safety barriers, and the application of lessons learned from past incidents to mitigate escalating risks and ensure safe operations throughout the system’s lifecycle. These insights offer a strong foundation for improving risk mitigation strategies, designing safer systems, and supporting regulatory compliance in hydrogen-based infrastructures. References Cipolletta M., Casson Moreno V., Cozzani V., 2022, Green Hydrogen Production Routes: an Inherent Safety Assessment, Chemical Engineering Transactions, 90, 55-60. Dueñas Santana J.A., Di Benedetto A., González Gómez O., Salzano E., 2024a, Towards sustainable hydrogen production: An integrated approach for Sustainability, Complexity, and Systems Thinking in the energy sector, Journal of Cleaner Production, 449, 141751. Dueñas Santana J.A., Di Benedetto A., Salzano E., 2024b, An Integrated Systems Thinking Approach for Assessing and Comparing the Safety of Hydrogen and Ammonia Storage, Chemical Engineering Transactions, 111, 385-390. Mannan S., 2014, Lees’ Process Safety Essentials. Hazard Identification, Assessment and Control, UK. Salzano E., Di Nardo M., Gallo M., Oropallo E., Santillo L.C., 2014, The application of System Dynamics to industrial plants in the perspective of Process Resilience Engineering, Chemical Engineering Transactions, 36, 457-462. Sterman J.D., 2002, System Dynamics: Systems Thinking and Modeling for a Complex World, Massachusetts Institute of Technology, Engineering Systems Division. 168 59duenassantana.pdf Using a Systems Thinking Approach for a Dynamic Hydrogen Risk Assessment