Anda di halaman 1dari 7

i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 3 6 ( 2 0 1 1 ) 2 4 0 7 e2 4 1 3

Available at www.sciencedirect.com

journal homepage: www.elsevier.com/locate/he

Challenges to improve condence level of risk assessment of hydrogen technologies


Hans J. Pasman*
Mary Kay OConnor Process Safety Center, Texas A&M University, College Station, TX 88843-3122, United States

article info
Article history: Received 4 January 2010 Received in revised form 4 May 2010 Accepted 5 May 2010 Available online 8 June 2010 Keywords: Risk analysis Hydrogen hazards Scenario uncertainties Failure rates Risk presentation

abstract
Making large-scale distribution and use of hydrogen successful will require adequate risk control. In turn, control requires risk assessment. Despite many years of experience, in general, methods to determine risk lack still robustness: results being much too dependent on choices made by the analyst due to uncertainties, lack of data and different views. This can create frustration amongst people dependent on results. HySafe and other groups work in the right direction. This paper will review existing methodological weaknesses, current improvements in e.g. the context of developing risk-informed standards and emphasize the challenges to raise quality further. The Standard Benchmark Exercise Problems, SBEPs, were a good start but shall produce recommendations for CFD use or even certication of models. Scenario generation shall take advantage of historical incident data and newer methods such as Bayesian belief nets, and cover the entire hydrogen distribution system and not only garages and refueling stations; the analyses shall more explicitly present condence intervals on results. Knowledge gaps on e.g. ignition probability shall be dened and lled. 2010 Professor T. Nejat Veziroglu. Published by Elsevier Ltd. All rights reserved.

1.

Introduction

The perspectives for hydrogen as an energy carrier look great. The world feels a real need to reduce carbon dioxide emissions and to become less dependent on oil. There will be however a transition period of considerable duration in which perception of the hazards of hydrogen may develop one way or the other. Hydrogen is not toxic, but its eagerness to combine with oxygen can turn into a hazard. Safety records of hydrogen processing in process industry are generally well. On the other hand, introduction of production, storage, transportation and use on the widespread scale required to replace present hydrocarbons will undoubtedly bring incidents. The large scale introduction will unavoidably bring many people in touch with the technology and standards of engineering are not everywhere at the high level of present day petrochemical

complexes. The energy carrier is needed not only in industry districts but also in densely populated areas. So, in incidents people may become hurt. Experience shows that one large scale incident with fatalities can throw a new technology backwards for years. The psychological impact of risk, once shown somewhere to occur and witnessed by TV is difcult to erase. Old, misunderstood stories like the one on the Hindenburg will be remembered by the media after an accident happened and will add to fear. Such situation will be worsened if experts contradict each other, express misbelieve in models or show uncertainty. For adequate risk control it will pay to invest in reliable risk analysis methodology. It will help to improve operational safety by designing and installing preventive and protective measures where appropriate and economical, also embodied by standards and codes. Risk-informed standards form key to permitting hydrogen refueling stations [1]. In addition for the

* Tel.: 1(979) 845 3489. E-mail address: hjpasman@gmail.com 0360-3199/$ e see front matter 2010 Professor T. Nejat Veziroglu. Published by Elsevier Ltd. All rights reserved. doi:10.1016/j.ijhydene.2010.05.019

2408

i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 3 6 ( 2 0 1 1 ) 2 4 0 7 e2 4 1 3

purpose of public safety risk analysis will help in land use planning, licensing of installations and emergency planning; the latter with respect to self rescue and effective deployment of emergency response units. The HySafe community already has taken initiatives in drafting standards, educating and training people, performing risk studies and organizing three ICHS safety conferences. There have been numerous papers addressing an aspect of hydrogen risk but there are few attempts to perform overall risk assessments. The reports on risk assessment methods (DNV Research & Innovation, 2008 [2]), and risk studies on refueling stations e.g. IEA [3] and other facilities e.g. [4] are certainly a good step, but cannot be considered matured. Moreover, to remain critical remains necessary as quality standards for risk assessments have not become common yet. Below will be shown why vigilance is needed.

2. Risk analysis: strengths and weaknesses in general


Risk analysis of process and storage installations can be considered as a system analysis focused on dening failure scenarios with release of hazardous material. Each release will have consequences and a probability of occurrence. The release probability has to be derived from failure rates of equipment resulting in spill, the consequences are split into physical effects (severity) and damage (impact) to exposed receptors. For hydrogen the effects will be in rst instance heat radiation of re, and overpressure of explosion and the receptors are people, structures and the environment each with their own vulnerabilities and surface area densities. Calculation requires many models and data. By domino effects in a plant area with involvement of other substances also toxic effects may occur. Strength of risk analysis is undoubtedly obtaining overview of potential hazards of an operation and measures to control risk of mishap. Because of the important decisions to be based on risk analysis, the European Commission has funded twice a comparative risk assessment trial with teams from different countries, the rst by 11 teams reported by Amendola et al. [5] in 1992, the second, project ASSURANCE, with participation of 7 teams by Lauridsen et al. [6] in 2002. Both studies have been on an ammonia storage plant. In terms of individual risk the rst study resulted for a given scenario in values scattering over 5 orders of magnitude. In the second study teams have been more experienced but also selection of scenarios has now been part of the exercise. Fig. 1 A and B show the spread in results of the latter while Table 1 borrowed from the Lauridsen report is providing an overview of the sources of scatter and uncertainty. More or less in parallel efforts have been undertaken also funded in part by the EC to certify dispersion models according to a protocol prepared in the SMEDIS project (Duijm et al., 1997 - Scientic Model Evaluation of Dense Gas Dispersion Models [7]). In addition some years ago the European Working Group on Land Use Planning announced it would take action with respect to scatter in failure rate data. However to date no concrete results are found yet. From Table 1 it is clear that dening scenarios is the largest source of spread in nal result. Yet it is essential to make

a reliable overview of all different possibilities of an unwanted release rst. Regretfully methods to obtain completeness with a guarantee do not exist. In general scenario generation is accomplished by applying hazard analysis techniques such as What- if, Failure Mode and Effect Analysis,(FMEA) or even better HAZOP (Hazard & Operability study). However, even then details of a release still leave open a large variety of possibilities what will be the mode of failure (catastrophic rupture, hole only), release rate, which direction will point a jet, will it hit another component, be deected and become a spray, will further escalation occur etc.? Dispersion, explosion and re models are based on physics with a limited number of condition and state parameters and material properties. The physical models can be validated by reproducible experimental test results in a simple geometrical situation (spherical, cylindrical or plane symmetry) and xed conditions. Problem in application of these models usually is the complexity of the geographical environment and variable conditions of weather (wind, temperature distribution), terrain topology (hills, dykes, ditches), location, type, shape and size of structures, vehicles, vegetation (rows of trees, shrubs) etc. It requires advanced Computational Fluid Dynamics approaches to get a realistic simulation of what can happen taking this all into account. Given sufcient effort within bounds a reasonable picture of reality can be obtained of e.g. the distance to which a toxic or explosive concentration of gas can extend given a source, the overpressure and impulse an explosion of a gas cloud can generate or the radiation intensity, smoke cloud generated by a re. Despite the 30 years or more of work on CFD-models there can be still considerable spread in outcomes and differences with eld tests. For dispersion this may range over roughly a factor of 2 in concentration [8], for explosion models it will be a kind of same [9], whereas for re models the situation is slightly better (e.g. [10]). If beside threshold values or mean concentration values also a time development of the dispersion of cloud or an evolving re is asked, simulation becomes again more difcult, but certainly not impossible, albeit that the models do not allow a ne time resolution. Concentration uctuations at a certain location, for example, can usually not be produced. In case of equipment failure rates uncertainty is even more serious. A large variety of sources is found quoting quite different values. This is because of use of different substances in different environments and many other factors: design of the piping, vessel or other component, materials used, assembling, use of the equipment with uctuations in pressure, temperature and mechanical loading by vibration, pumping, corrosion, maintenance frequency, quality etc. Apart from the material specication and technical factors the rate values are inuenced by management quality which sets safety culture and determines human factor not only in maintenance but also in operation (e.g. overlling). On top of that, literature data in general just quote point values without specifying a condence interval, although failure frequency may be given over a certain range of hole size and component diameter as e.g. in the review paper by Spouge [11] on hydrocarbon leaks in offshore equipment. For determining impact effects on people, structures and the environment given a heat radiation intensity time prole,

i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 3 6 ( 2 0 1 1 ) 2 4 0 7 e2 4 1 3

2409

Fig. 1 e A and B. Results of EU Benchmark exercise ASSURANCE 2002 by Lauridsen et al. [6]. Left: The largest and smallest 10L5/yr individual risk contour found: the smallest contour limited to the plant premises, the largest crossing the river and encompassing part of the township. Right: Societal or group risk results on assumed population density expressed in F-N curves (F is frequency yrL1 of the number of fatalities larger than N ) differing by at least two orders of magnitude.

an overpressure time history or a toxic concentration a limited number of data in the form of probit relations of the probability of being killed is available in e.g. the Green Book [12]. These relations are developed for normal, healthy persons and contain themselves still uncertainty. Data on sustaining injury and their effect on functioning of people in relation to self-rescue are scarce or non-existent. More precise response calculation of structures relies on e.g. Finite Element Models. Beside the full edged risk analysis also more limited approaches are made. A very successful one is Layer of Protection Analysis, LOPA [13]. This method analyzes on the basis of a scenario of an initiating event in team sessions quantitatively the need, effectiveness and reliability of successive, independent protective layers (detection, decision, action e.g. shutdown, emergency measures) and forms a basis for application of IEC 61511 [14]. Yet, even less detailed are semi-quantitative methods of risk ranking expressing results usually just in orders of magnitude. As a conclusion it can be stated that risk analysis is in demand because it provides overview of a complex situation with many hazards on the basis of which assessment and decision making can occur. On the other hand there is quite a reservation to make with respect to the accuracy of the results. Risk estimates contain considerable uncertainty by lack of knowledge, limited computer time and randomness in data, although usually only point values and no indication of condence intervals are given. Some are inclined to take the conservative side; others have an interest to intrude into the area under risk just up to an allowed limit. The variability in outcomes can lead to much debate in case of land use planning or licensing. Disagreement in model outcomes will cause friction amongst planners from both private and public parties with opposing interests. This is providing fertile ground for lawyers, decisions may be delayed or the risk source eliminated all together. Therefore improvements and clarity in decision making are needed. The above not even includes differences in risk acceptance criteria in various countries.

3. Suggestions for risk analysis on hydrogen installations


Based on information published in conference papers, in particular those of the 3rd International Conference on Hydrogen Safety (ICHS-3) [15], in articles of this journal or elsewhere contributions have been made to improve and augment the expertise base to enable reliable risk assessments. A recent report by LaChance et al. [16] focused on risks of pressurized hydrogen leaks and ensuing jet ames in the setting of a refueling station which will represent a majority of incidents. This work aiming to support development of riskinformed standards such as NFPA 2 and 55, proves to be particularly helpful. Other rather intensively studied risks are that of a leak of stored hydrogen from a car in a garage and a trafc collision in a tunnel. The distribution system will however encompass quite a few more facilities such as production facilities (for a particular case studied in [4]), central storage and distribution plants, pipelines, transportation by rail tank, truck and ship. Also, scenarios involving absorbed and (larger quantities) liquid hydrogen are underrepresented.

3.1.

Scenarios

A list of representative descriptions of plant installations both stationary and mobile for which realistic standard scenarios can be generated will be helpful. Experience in what can go wrong is a strong source of information. Hence, reviewing accidents of which information can be retrieved from data bases such as the Hydrogen Accident and Incident Data base, HIAD [17] managed by EU JRC, or the Incident Reporting Tool [18] in the US contributes. On the other hand the number of hydrogen incidents is still relatively small and use of data base information in a predictive sense is not easy. A good information processing structure for that purpose is lacking. As already mentioned also systematic HAZOP, FMEA etc. shall be applied, and scenarios described in bowties or safety-barrier

2410

i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 3 6 ( 2 0 1 1 ) 2 4 0 7 e2 4 1 3

Table 1 e Qualitative assessment of the importance of various contributors to the uncertainty in the risk calculated (the more stars the more important) in EU project ASSURANCE [6]. Uncertainty Factor
Differences in the qualitative analysis Factors relating to frequency assessment: Frequency assessments of pipeline failures Frequency assessments of loading arm failures Frequency assessments of pressurized tank failures Frequency assessments of cryogenic tank failures Factors relating to consequence assessment: Denition of the scenario Modelling of release rate from long pipeline Modelling of release rate from short pipeline Release time (i.e. operator or shutdown system reaction time) Choice of light, neutral or heavy gas model for dispersion Differences in dispersion calculation codes Analyst conservatism or judgment

Importance
**

*** **** **** ***

to derive a posterior distribution applying Bayes theorem for a spectrum of leak sizes as a fraction of component diameter and repeated this for a variety of components (pipes, compressors, valves, hoses etc.). In fact, they apply a prior rst to determine the cumulative probability of hydrocarbon leak versus leak size and its spread and then in a second phase to update it with the available hydrogen leak data. This approach offers perspective for further future updates when more information becomes produced.

3.3.

Probability of ignition

***** *** * *** **** *** ***

diagrams (fault tree-critical event-event tree). As a reaction on ASSURANCE, EU project ARAMIS [20,21] has been designed to get a better, more reproducible handle on scenario development. From the various scenarios obtained a selection has to be made of those which on the basis of estimated consequences and frequencies surpass a certain threshold. This can be performed with the aid of a semi-quantitative risk matrix. The selected ones are called in ARAMIS language reference accident scenarios or RAS. Of the selected ones the severity of effects will be elaborated in more depth. Recently, the directed acyclic graph technique of the bowtie is exploited in an even more exible way by the Bayesian Belief Nets (BBN) approach, which can be further extended with deterministic and decision nodes to an inuence diagram supporting decision making. As such it can form the structure for a complete risk assessment. For hydrogen risk analysis a rst article [19] applying the BBN technique has been published. In contrast to hydrocarbons a leak of H2 in conned space, even a small one, will present a hazard, because a leaking hydrogen connection near the oor will ll up the space with an explosive mixture from the ceiling downward as e.g. shown by Lowesmith et al. [22].

Given a leak and hence a critical event, next question to be answered for an event tree is the probability of ignition. Ignition shall be distinguished in immediate and delayed ignition because of the different consequence this may have; the rst producing jet re, the second ash re or explosion. The probability will depend on the environment which can have many different features (open, semi-open, conned but ventilated, conned). A special property of hydrogen is that in case of a very high pressure store even a small leak may ignite spontaneously because the hydrogen jet from the leak is causing a shock in the surrounding air which heats up the gas while mixing it with oxygen in its wake. Detection, ventilation and recombination can form protective barrier systems [24], but prevention of the leakage remains rst priority. In all, as there is little solid ground to base probability values on, further research how to approach this aspect is urgently needed.

3.4.

Probability of re or explosion

3.2.

Frequency of a leak

The HySafe report [2] pays considerable attention to the fact that because of much higher diffusivity of hydrogen and the embrittlement effect on some materials hydrogen leaks cannot be taken similar to hydrocarbon ones. HYPER, 2008 [23] emphasizes that hydrogen due to its low viscosity is much more prone to leakages from piping connections than hydrocarbons. The IEA report on QRA of re-fuelling stations [3] presents the HyTrec case study, which species frequencies for two leak hole sizes: 1 and 10 mm borrowed from the UK HSE hydrocarbon leak frequency data base mentioned in [11]. LaChance et al. [16] take a better course, derive frequencies from the same hydrocarbon sources, but use it as a prior distribution in combination with scarce actual hydrogen data

Given ignition what type of combustion will take place? A high momentum gas jet from a high pressure source in the open will result in a completely different cloud from one of a slow leak in a conned space or from a spill of cryogenic liquid hydrogen. Also a cloud originating from a same type of source can differ in its effects at ignition, depending on scale of release, power of ignition source, degree of mixing with air, presence of congestion for an expanding ame etc. Effects can range from jet re, ash re, deagration with moderate blast, rapid accelerating ame with medium blast and detonation with strong blast. So, it will be very difcult to give generally applicable probability gures. Each situation has to be judged on its own and the most evident way to proceed is doing a CFD-simulation and producing a deterministic answer. This way in principle the extent of dispersion, global concentration gradients (not the spatial and temporal higher frequency uctuations) can be calculated, and once the cloud ignites, ame propagation and blast derived. By varying details in geometry of release, location, time after release and strength of ignition, wind direction and such like a range of answers can be found and probability values assigned on the basis of likelihood of situations. Hence, a generalized QRA which because of cost looks attractive, is not a good option.

3.5. Physical effects modeling/Computational uid dynamic models


To avoid confusion and to obtain a quality aura CFD models with a stamp are needed just as the EU SMEDIS protocol

i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 3 6 ( 2 0 1 1 ) 2 4 0 7 e2 4 1 3

2411

[7] had as objective. For reliable and reproducible answers programs must be transparent (information on assumptions, equations and boundary conditions readily available, hence no black-box), veriable (sources traceable), and robust (outcome independent of the performer). Reliability of software forms a sector of science in itself. The requirements are simple, but not easily satised. The SMEDIS protocol goes through steps: rst assessment of the physics of the model describing the dispersion phenomena including effect of terrain features e slopes, valleys - and obstacles, and rain-out of aerosols when relevant. Then verication of translation into algorithms in the software code occurs, and nally validation of the results against eld test data. Hanna et al. [8] developed statistical performance measures for that purpose. Variability in outcomes makes application of the requirements even more compelling. The Standard Benchmarks Exercise Problems in the HySafe program carried out each by 6e14 teams, partly published as papers in the three ICHS conferences, were excellent but did not result yet in a formal selection of certied codes.

3.6.

Damage probits

a method to show F, N information on a map in the sense that by colouring local levels societal risk can be shown and so hot spots can be indicated. For a business case other measures matter such as a F, V curve, which is analogue to F, N but with monetized losses instead of fatalities; another one is Expected Annual Loss, EAL which is the loss at a certain scenario multiplied with the expected frequency of that scenario. EAL can be applied in answering the question how safe is safe enough when considering an additional protection layer. In fact, the contribution of each Independent Protection Layer (IPL, preventive barrier or escalation control) can be expressed in risk reduction, hence in saving EAL but also in Cost of Ownership including investment, maintenance, cost of false alarms and spurious trips. For a set of scenarios possible for an installation an EAL spectrum can be shown which will indicate clearly the worst scenarios with respect to losses. Value at Risk, a measure quite popular in nancial risk analysis, is yet another way to characterize risk of an installation [27]. It is the maximum loss to be expected at e.g. 99% condence level. The measures can form together a system of metrics. Few examples have been seen yet in which these measures have been elaborated well.

Data of fatality probability and structural damage of buildings for hydrocarbon res and explosions can be used for hydrogen. Also, here are uncertainties but condence intervals are not known. There is a growing interest in injury probits for estimation e.g. of self-rescue but there is a lack of data.

3.8.

Uncertainties

3.7.

Risk presentation

Uncertainties are either caused by lack of knowledge of effect and damage mechanisms and of possible scenarios incl. human factor, all leading to incompleteness and wrong use of models, or by inaccurate and unreliable data. The effect of the latter shall be shown in the graphical representation of risk gures but there are few examples in which this is actually done, one exception is given in [4].

Both from a public and private point of view hydrogen risks will be judged against the benets. In the public domain risk is usually expressed as the probability of being killed when exposed in unprotected standing position at a certain location with respect to the risk source during one year: individual risk. A risk source can follow different scenarios yielding different risk values. A plant area can contain different risk sources. Points of the same aggregated risk value can be presented as a contour. From the point of view of aversion a more important measure is the frequency f(N) of getting exactly N fatalities per year in the area as a function of the number N. It follows from combining all individual risk points of various scenarios with a population density chart and summing. Integration over N yields a third measure: Expected Value of lives lost per year or Probability of Loss of Life, PLL [25]. A fourth measure is societal or group risk which is the frequency of exceedance, F(!N) of having N or more fatalities in the area per year as a function of N. This measure is derived by summing f(N) starting from the scenario with the largest N-value. The graphs in Fig. 1B show examples of societal risk plots. However, beside the wish to express risk from a source in one F-N gure, there is also the requirement for spatial resolution. Risk contours can be depicted on a map but these do not reect exposure and hence resulting fatalities. By applying a Geographical Information System, GIS with local population density information TNO and RIVM [26] in the Netherlands developed

3.9.

Evaluation/appreciation of risk values

A Risk Matrix consisting of a plot of logarithm of scenario consequences versus logarithm of their frequencies is in risk analysis rather common. Also F, N plots are logarithmic in both variables. Many people have no feel though for the difference between e.g. 105 and 106 or 105 and 106, but know better the difference between 5 and 6. Jaynes [29] in his standard work on Probability Theory quotes repeatedly the law of Weber-Fechner saying that intuitive human sensations tend to be logarithmic functions of the stimulus (e.g. expressed in decibels). Taking this into account it turns out that comparing risk gures on the basis of their logarithms is justied.

3.10.

Decision making

Decision making is not an absolute process. There is always weighing involved of risks against benets. If public safety is at stake such as in land use planning and licensing of plant with potential effects externally legal certainty is important. In some countries therefore decision is made on the basis of a legal risk acceptance criterion, or by judging consequences and probability separately, in others just on an effects threshold value (endpoint) providing a safe distance e.g. a 1% lethality borderline. Stakeholder participation in some

2412

i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 3 6 ( 2 0 1 1 ) 2 4 0 7 e2 4 1 3

form helps acceptance of a decision. QRA and a risk criterion enable optimum use of space, though, by taking into account directional effects of the risk consequences and trading off severity against frequency while accepting a certain threat for workers and inhabitants. In such case the risk calculation shall be fully robust (standardized). It becomes also desirable to involve emergency response in the decision process and to consider self rescue and response possibilities. Injury response probits as function of load intensity will then become needed. For a business case straightforward costebenet analysis can be made with a trade-off of insurance premium and expected annual loss cost against higher investment in protection and maintenance and determine residual risk at lowest cost. On top comes willingness what to pay for preventing fatality and injury. In economic risk analysis one uses utility functions (utility between 0 and 1). In such function a decision maker or body of decision making is calibrated by determining his/their indifference of obtaining a certain sum now versus a potentially larger uncertain prot in the future.

references

4.

Conclusion

For a successful introduction of hydrogen it is crucial to control the risks and for that purpose to determine the risks with an acceptable level of condence. Risk assessment starts with generating credible scenarios using historical data and applying structured thinking with event bowties or even more exible with Bayesian belief nets. Uncertainty is a major stumbling block in risk analysis but it can strongly be reduced by agreeing on credible, situation specic scenarios, use of validated consequence models certied on the basis of a protocol, and expressing spread of data such as of failure rates in condence intervals. Only clear and transparent measures of risk (risk metrics) which can be compared with those of existing fuels, both from a public and business point of view, will be convincing. Decision making under uncertainty coping with variance deserves special attention. How far should one stay at the safe side while knowing the extent results can vary? Decision making for public safety and for business strategy is different but both can be facilitated by having examples ready and comparison with traditional fuels at hand. Although the efforts up to now have been very useful, the work is by far not completed. Creating risk-informed standards and codes is certainly a good way forward, but further work on models and data is indispensable and cooperation a must!

Acknowledgement
The author acknowledges the support by Dr. M. Sam Mannan, director Mary Kay OConnor Process Safety Center, to nd continually ways to improve safety and to make it second nature.

[1] LaChance J, Tchouvelev A, Ohi J. Risk-informed process and tools for permitting hydrogen fueling stations. International Journal of Hydrogen Energy July 2009;34(14):5855e61. [2] DNV Research & Innovation, 2008: Main report e Survey of Hydrogen Risk Assessment methods: Report no.: 2005-1621 Rev 2, January 2008. [3] International Energy Agency, Hydrogen Implementing Agreement, Task 19 e Hydrogen Safety, Risk Assessment Studies of Hydrogen and Hydrocarbon Fuels, Fuelling Stations, Description and Review, Prepared by Andrei V. Tchouvelev, Subtask A "Risk Management" Leader, with input from Koos Ham, TNO, Version R1: January 2008. [4] Rosyid OA, Jablonski D, Hauptmanns U. Risk analysis for the infrastructure of a hydrogen economy. International Journal of Hydrogen Energy October 2007;32(15):3194e200. [5] Amendola A, Contini S, Ziomas I. Uncertainties in chemical risk assessment: results of a European benchmark exercise. Journal of Hazardous Materials 1992;29:347e63. [6] Lauridsen K, Kozine I, Markert F, Amendola A, Christou M, Fiori M. Assessment of uncertainties in risk analysis of chemical Establishments, the ASSURANCE project, nal summary report. Ris National Laboratory, www.risoe.dk/ rispubl/sys/syspdf/ris-r-1344.pdf; May 2002. 52 pages. [7] Duijm NJ, Carissimo B, Mercer A, Bartholome C, Giesbrecht H. Development & test of evaluation protocol for heavy gas dispersion models. Journal of Hazardous Materials 1997;56:273e85. [8] Hanna SR, Hansen OR, Dharmavaram S. FLACS CFD air quality model performance evaluation with Kit Fox, MUST, Prairie Grass, and EMU observations. Atmospheric Environment 2004;38:4675e87. [9] Popat NR, Catlin CA, Arntzen BJ, Lindstedt RP, Hjertager BH, Solberg T, et al. Investigations to improve and assess the accuracy of computational uid dynamic based explosion models. Journal of Hazardous Materials 1996;45:1e25. [10] Grandison AJ, Galea ER, Patel MK. Fire Modelling Standards/ Benchmark, report on SMARTFIRE phase 2 Simulations. SE10 9LS. London: Fire Safety Engineering Group, Univ. of Greenwich; May 2001. AG/010101/Rev 1.0. [11] Spouge J. New generic leak frequencies for process equipment. AIChE Process Safety Progress 2005;24(4): 249e57. [12] Book Green. Publicatiereeks gevaarlijke stoffen pgs 1, methoden voor het bepalen van mogelijke schade. issued by the Dutch Government, Ministry VROM, downloadable from, http://www.publicatiereeksgevaarlijkestoffen.nl/; 2003. [13] CCPS. Layer of protection analysis: simplied process risk assessment", Guideline CCPS. New York: AIChE, http://www. aiche.org/ccps/; 2001. ISBN 0-8169-0811-7. [14] IEC 61511. Functional safety Instrumented systems for the process industry sector", parts 1 to 3, (Draft in Progress). Geneva: International Electrotechnical Commission (IEC); 2001. [15] In particular Session 10: Risk Management/Assessment, 3rd Intl Conf. on Hydrogen Safety, Ajaccio, Corsica, France, September 16-18, 2009. [16] LaChance J, Houf W, Middleton B, Fluer L. Analyses to support development of risk-informed Separation distances for hydrogen codes and standards. Sandia National Laboratories; March 2009. SAND2009e0874. [17] HIAD data base in Odin: Online Data & Information Network for Energy, https://odin.jrc.ec.europa.eu/ [18] S.C. Weiner, B.R. Kinzey, J. Dean, P.B. Davis, and A. Ruiz, Incident Reporting: Learning from Experience, 2nd Intl Conf.

i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 3 6 ( 2 0 1 1 ) 2 4 0 7 e2 4 1 3

2413

[19]

[20]

[21]

[22]

on Hydrogen Safety (ICHS07), San Sebastian -Spain, Sept. 11e13, 2007, paper 1.3.39, abstract p.96, 10 pages. Haugom GP, Friis-Hansen P. Risk modelling of a hydrogen refuelling station using Bayesian Network. International Journal of Hydrogen Energy 2011;36(3):2389e97. vez C, Pipart A, Debray B. ARAMIS project: Delvosalle C, Fie a comprehensive methodology for the identication of reference accident scenarios in process industries. Journal of Hazardous Materials 2006;130:200e19. vez C. ARAMIS project: a more explicit De Dianous V, Fie demonstration of risk control through the use of bowetie diagrams and the evaluation of safety barrier performance. Journal of Hazardous Materials 2006;130:220e33. Lowesmith BJ, Hankinson G, Spataru C, Stobbart M. Gas build-up in a domestic property following releases of methane/hydrogen mixtures. San Sebastian -Spain, Sept. 11e13. 2nd International Conference on Hydrogen Safety; 2007. paper 1.1.62.

[23] HYPER, 2008: HYPER Installation Permitting Guide for Hydrogen and Fuel Cells Stationary Application, WP2 D4.1 IPG 5th Draft, December 2008. [24] Hirst IL, Carter DA. A "worst case" methodology for obtaining a rough but rapid indication of the societal risk from a major accident hazard installation. Journal of Hazardous Materials 2002;A92:223e37. [25] T. Wiersma, H. Boot, and L. Gooijer, Societal risk on a map, 12th Symp Loss Prevention and Safety Promotion in the Process Industries, Edinburgh, U.K., 22e24 May 2007, IChemE SYMPOSIUM SERIES NO. 153, 5 pages. [26] Prem K, Ng D, Sawyer M, Guo Y, Pasman HJ, Guo Y, et al. Risk measures constituting a risk metrics which enables improved decision making: value-at-risk. Journal of Loss Prevention in the Process Industries 2010;23:211e9. [27] Jaynes ET. Fifth Printing. In: Bretthorst GL, editor. Probability Theory: the Logic of science. Cambridge University Press; 2007. 92e95, ISBN 978-0-521-59271-0.