F Fouillen
email: fabien.fouillen@ineris.fr

Bustamante Valencia
email: lucas.bustamante-valencia@airliquide.com

L ' Hostis

FULL SCALE EXPERIMENTAL CAMPAIGN TO DETERMINE THE ACTUAL HEAT FLUX PRODUCED BY FIRE ON COMPOSITE STORAGES -CALIBRATION TESTS ON METALLIC VESSELS

If Hydrogen is expected to be highly valuable, some improvements should be conducted, mainly regarding the storage safety. To prevent from high pressure hydrogen composite tanks bursting, the comprehension of the thermo-mechanics phenomena in the case of fire should be improved. To understand the kinetic of strength loss, the heat flux produced by fire of various intensities should be assessed. This is the objective of this real scale experimental campaign, which will allow studying in future works, the strength loss of composite high-pressure vessels in similar fire conditions to the ones determined in this study. Fire calibration tests were performed on metallic cylinder vessels. These tests with metallic cylinders are critical in the characterization of the thermal load of various fire sources (pool fire, propane gas fire, hydrogen gas fire) so as to evaluate differences related to different thermal load. Radiant panels were also used as thermal source for reference of pure radiation heat transfer. The retained thermal load might be representative of accidental situations in worst case scenarios, and relevant for a standardized testing protocol. The tests performed show that hydrogen gas fires and heptane pool fire allow reaching the target in terms of absorbed energy, regarding the results of risk analysis performed previously. Other considerations can be taken into account that will led to retain an hydrogen gas fire for further works. Firstly, hydrogen gas fire is the more realistic scenario: Hydrogen is the combustible that we every time find near an hydrogen storage. Secondly, as one of the objectives of the project is to make recommendations for standardization issues, it's important to note that gas fires are not too complex to calibrate, control and reproduce. Finally, due to previous considerations, Hydrogen gas fire will be retained for thermal load of composite cylinders in future works.

INTRODUCTION

Context

In the context of global warming, research regarding new energy carriers (NEC) is currently active. Among the different topic of NEC, Hydrogen is expected to be highly valuable energy carrier for the 21 st century as it should participate in answering main societal and economical concerns. To capitalize on its benefits at large scale, further researches and technological developments are required. Mainly, the storage of hydrogen must be secured. Even if burst in service of pressure vessels in composite material is very unlikely, when exposed to a fire, they present safety challenges imposing to correctly design their means of protection.

The present study is part of a project whose main objective is to better characterize the conditions that are required to prevent from bursting. Following this objective, experimental work is done in order to improve the understanding of heat transfer mechanisms and the loss of strength of composite highpressure vessels in fire conditions. The thermo-mechanical behaviour modeling of these vessels will then be possible.

In this context, the objectives of the experimental campaign are the following:

• define the best conditions to ensure reliability, reproducibility and safety of the tests,

• check that the tests performed at large scale in laboratory are representative of real fire scenarii and worst case scenarii, • check the influence of hydrogen release through the wall in case of leakage of H 2 during fire,

• develop and validate the model of thermo mechanical behaviour of a storage in fire,

• optimize the hydrogen release strategy using the cylinder model developed in the project,

• make recommendation for cylinder design to reduce the risk of burst.

The present study deals with the two first items. It corresponds to an experimental campaign, performed on steel cylinders. It allows us to define the parameters of the test to be set-up for composite cylinders in further works. Different applications are to be considered: automotive application, stationary application, transportable cylinders, bundles and tube trailers. A risk analysis has been achieved for each application leading to the definition of optimized safety strategies. The scenarios taken into account in this study are only linked to thermal load of non degraded metallic vessels. It means that were not studied:

• scenarios of thermal load , concomitant with mechanical load,

• scenarios of localized jet fires, where the momentum of gas is very important.

Objectives and methodology

The objective is to determine one or more fire conditions to test the thermo-mechanical behaviour of real composite vessels. Those conditions have to be representative of accidental situations and represent worst case scenarii with regard to the suspected fire vulnerability of the reservoir. They also need to be instrumented and operated in such a way that valuable comparison with the modeling effort is optimized. A further perspective is to be able to adapt the testing protocol so that new standard testing procedures could be proposed. The following progression was performed:

• Selection of critical fire scenarii with regards to the risk analysis and knowing the reservoir vulnerability.

• Theoretical design of testing conditions thought to cover and represent reasonably the above mentioned critical fire scenarii. The fire protocol (fuel, shield, size...) need to be defined but also the instrumentation judged critical to characterize the fire/reservoir interaction. • Building the experimental setups and preliminary testing of the performances (attainment of the target flux, duration, temperatures…) using non pressurized tanks. These preliminary tests were performed using a steel cylinder (similar in size to the composite cylinder) in order to calibrate the heat load measurement method and study the reproducibility of the fire. The main advantages of using metallic vessels in this part of the research are that there are not issues related to the thermal decomposition of the specimen and the thermal properties are well known, which up to now, is not the case for composite vessels.

GENERAL CONCERNS

This chapter is dedicated to the design of the preliminary tests matrix and the presentation of the experimental set up. The methodology that was followed so as to classify the scenarios is also presented.

Input from risk analysis

The risk analysis performed led to a selection of representative scenarios. Regarding the impact of the scenario on the vessel integrity, and its occurrence probability, an analysis was performed, in order to classify these scenarios. This analysis highlights the fact that all type of combustible can lead to a critical scenario, with a high level of risk. In order to retain the designing thermal load, a classification by thermal load level should be performed.

The experimental approach developed in the following chapter will help meet this aim. The risk analysis performed, helps in determining the primary characteristics that the tests to be performed should have. So, in order to have representative bonfire tests with regards to the fires that the hydrogen systems may be exposed to in accidents, the recommendations made are:

• "A liquid source of fire generating a heat flux in the surface of the cylinder of 125 kW.m -2 should be studied. This fuel covers the majority of fuels considered in the fire scenarios. • A gas fire generating a heat flux in the surface of the cylinder of 280 kW.m -2 should be studied.

• The fire should be well ventilated. This allows maximizing the power of fire for a given fuel.

• The passive barriers such as metallic shields should not be used for the bonfire tests.

• The filling piping and the wires of thermocouples in the fire zone should be thermally insulated during test in order to avoid damages. • The ventilation around the vessel should be controlled in order to produce engulfing fire i.e. homogeneous thermal load in the entire surface. • A proper measurement of temperature and heat flux should be done in order to assess the performance to fire of the cylinders."

As for the value of 280 kW.m -2 it has to be noted that it was evaluated considering a flow speed of jet fire around 200 m.s -1 at the impact location, which induces momentum higher than the scope of the present study, as mentioned in chapter 1.1. Thereby, regardless of the type of combustible involved, the target incident heat flux to be applied on the external surface of the vessel is 125 kW.m -2 .

Methodology of classification of thermal load

The methodology developed has two main purposes:

• classify by the intensity the different thermal load that will be performed,

• translate a complex thermal load composed of convection conduction and radiation into a simple incident radiative heat flux.

The first issue will help to highlight the designing scenario that will be applied to the composite vessels. The second point will be useful for modeling purpose, knowing that the input data of thermal numerical tool developed in the project is an incident heat flux. To do so, it has been decided to expose the metallic specimen to a pure and calibrated radiation load at different levels as described in chapter 3.1, and to measure the temperature evolution inside the sample. This will lead to series of curve of temperature evolution along time as a function of the incident radiation heat flux. It will then be possible to superimpose to these curves, the evolution of temperature reached during real fire.

As composite material burns, this approach cannot be applied to composite vessels, as it is not possible to dissociate the heat flux due to external thermal load from the heat flux due to composite ignition. This is the reason why steel cylinders described in chapter 2.4.1, with dimensions representative of those of composite vessels, are used during this preliminary test campaign.

Test matrix

Regarding previous considerations, and results of the risk analysis performed, a preliminary test matrix has been built. It allows studying the behaviour of steel cylinder in various configurations of thermal load, to classify them, and to supply data to apply the "translation" methodology presented previously. The green lines in this table are the reference tests for each sort of thermal load. Yellow boxes highlight the parameters that change regarding the reference case. For radiative tests, F1 to F5 correspond to five levels of emitted heat fluxes. For gas fires, Q1 and Q2 represent two levels of fire energy. This experimental matrix is detailed in Table 1. As indicated in chapter 2.2, steel cylinders have been used for these preliminary tests of fire calibration. Two cylinders have been built, with representative external dimensions of 19 L and 36 L composite cylinders that will be used in further works, as shown in Figure 1. On this figure dimensions of the fictitious 19 L are written in red, and those of the 36 L in black. The sealing of the cylinders is ensured by copper seals, to enable pressure measurements. Weights of the cylinders are about 107 kg for the 19 L one, and 196 kg for the 36 L one. In addition to the pressure measurement, the evolution of temperature is followed using 8 internal thermocouples localized on Figure 1.

Test facilities

For this preliminary campaign, two facilities are used. The first one, is called 80 m 3 room. It is suitable for fire until 2 MW. This room meets perfectly the needs for the envisioned tests. Moreover, it is linked to a smoke cleaning system that enable to purify smoke before casting it away to atmosphere. When hydrogen is used as fire source, tests cannot be performed in this room anymore, and an outdoor explosion cage is used.

RADIANT PANEL TESTS

Test description

The first tests were performed with radiant panels, so as to apply a calibrated and symmetrical thermal load on steel cylinders. The two radiant panels used are composed of 36 infrared halogen lamps; their radiation emitted heat flux is a function of the electrical power input. The electrical power input is then raised from 40 to 100 % of its range. Knowing the received heat flux for each heat fluxmeter and the relative position of fluxmeters and panels, it's possible to estimate the emitted radiative heat flux of each panel. Results obtained highlight that the two radiant panels have the same behaviour, and will allow performing a symmetric load of the cylinder from 30 to 80 kW.m -2 . After these calibration tests, the 36 L steel cylinder was used. As indicated previously, the radiant panels are positioned at 30 cm of the surface of the cylinder, halfway up them as shown in Figure 2. The two panels face, and are too close to each other to be used at full power without damages. A thermal shield is then put in place, in order to protect the apparatus. A 5 cm space is let between the shield and the cylinder, to prevent any disturbing on the top and bottom of the cylinder. Tests are performed with five different emitted heat fluxes, as indicated in the preliminary test matrix, reproduced on Table 2.

Results of preliminary tests

As mentioned in chapter 2.4.1, temperature and pressure evolution are considered. The numbering of internal thermocouples is presented in Figure 1. So as to illustrate the thermal behaviour of the cylinder, results are detailed for the medium heat flux, 55 kW.m -2 . They are presented on Figure 3. As expected, the thermal load of the cylinder is symmetric, and curves are similar on left and right sides. The temperature is also quite homogeneous along the length of the cylinder, with less than 25 °C difference between one side (section AA') and the center (section BB'). There is however a major difference, around 100 °C, between top and bottom thermocouples, and those located in the horizontal plane. This difference is due to the view factor on the received heat flux. It also appears that the temperature is lower in the bottom parts of the cylinder, than in the top. Similar observations can be made on the other load levels. To compare the behaviour of the cylinder for different scenarios, two ways of temperature evaluation can be used, following the average value of temperature given by inside thermocouples, or evaluating the temperature inside the cylinder thanks to pressure evolution and considering air as a perfect gas. The results for the different radiation loads are presented in Figure 4, with the two ways of temperature determination. In this figure, the average calculations are in full lines, and calculations through pressure are in dotted lines. The emissivity of the external skin of the steel cylinder is taken equal to 0.8. During the 78 kW.m -2 test, a pressure sensor malfunction occurred. It appears that in this configuration, the two ways of evaluation give equivalent results for each load level. The approach through pressure will be convenient for characterization of non engulfing scenarios that will be performed during remaining tests with pool and gas fire, involving punctual temperature measurements irrelevant.

Extrapolation of experimental results

Previous results also highlight the fact that the radiant panels used are not powerful enough to reach the temperature rising expected during real fire scenarios. As one of the objectives is to superimpose the results of real fire on radiant panel results for "translation" purpose and modeling requirements, an extrapolation of these data has to be achieved. An analytical model has been developed to compute the evolution of temperature inside the cylinder, considering that the radiant panels are fictitiously able to reach greater levels of emitted radiative heat fluxes.

Parameters taken into account into this model are the dimensions of the radiant panels, the dimensions of the cylinder, the evolution of physical characteristics of steel with temperature and the relative positions of radiant panels and cylinder. The comparison of the model with the results of the radiant panel tests is presented in Figure 5. The error obtained is less than 5 °C and remain acceptable. Results obtained with the model up to a 160 kW.m -2 emitted radiative heat flux are presented in Figure 6. In each case, the initial temperature is assumed to be at 20 °C. Regarding the view factor between the radiant panels and the cylinder, the target of 160 kW.m -2 for the emission leads to a received heat flux of 125 kW.m -2 on the external skin of the 36 L cylinder, which is the representative heat flux define in chapter 2.1.

Figure 6. Extrapolation of experimental results of radiative tests.

REAL FIRE TESTS

This chapter is dedicated to the study of the behaviour of the steel cylinders exposed to real pool and gas fire, in various configurations, as describe in preliminary test matrix presented in Table 1.

Pool fires

Configurations tested

The different pool fires performed are detailed in Table 3, extracted from preliminary tests matrix. Excepted for scenario 4, the cylinder is cleaned before performing the tests. In this table, scenario number 2 corresponds to the configuration actually recommended in standards dedicated to characterization of vessels fire resistance (such EN NF 12 245). Scenario number 4 performed with radiant panels is detailed in chapter 3.1. Two types of pan are used during the poll fire tests. The first one used for scenarios 2, 3 and 7 has a 1 m² surface. The pan used for scenarios 5 and 6 has a 0,5 m² surface.

Results of tests

The first observations performed during the tests are that the flame is strongly impacted by ventilation, and that it is hard to maintain an engulfing fire. Considering the value of 45 MJ.kg -1 for the heat of combustion of heptane, the Table 4 indicates the theoretical heat release rate obtains for each scenario. It appears that the most impacting parameter is the intrusion of the cylinder in the flame area, which induces perturbation on combustion phenomenon. The power of the fire increases of nearly 1 MW when the cylinder is far away from the pool fire. This does not mean that the fire performs a better engulfment of the cylinder, but that the combustion is better achieved. The evolution of internal temperature during the different tests performed is presented in Figure 7. It is remembered that the temperature is calculated with the increase of pressure.

Figure 7. Evolution of temperature during pool fire tests.

The maximal temperature reached regarding the power of the fire helps to determine the efficiency of heating of each configuration. After 10 min, and considering the scenario 2 (red curve) as a reference, it appears that the orientation and the distance of the cylinder to the pool have a quite medium influence, with a temperature below the reference temperature lower than 40 °C. Reducing the impacted surface has on the other hand a huge influence on the energy absorbed by the cylinder, and after 10 min, the temperature is 100 °C below reference. The scale effect is also important, with a 100 °C difference between 19 L and 36 L cylinders, due certainly to a better engulfment of the fire for the smaller cylinder, and a quicker response time due to lower mass of steel to heat up. The best efficiencies are obtained when the cylinder is close to the fuel pan, even if the heat release rate of the fire is lower. So as to characterize the influence of the soot deposit on the thermal behaviour of the cylinder, a radiant panel test is performed on the cylinder after the scenario 3, without cleaning or touching it, but after its natural cooling. With the same experimental setup described in chapter 3.1, the cylinder is exposed to a 78 kW.m -2 emitted heat flux. As highlighted in the risk analysis, the soot deposit tends to modify the emissivity of the external skin of the cylinder. After 15 min of test, the difference of 40°C (from 170 °C without soot to 210 °C with soot) observed corresponds to an increase of 0.1 of emissivity. It cannot be excluded that for longer fire, or fire generating more soot, an insulating behaviour of the soot deposit appears, and led to a lower impact of the fire.

Gas fires

Configurations tested

The different gas fires performed are detailed in Table 5, extracted from preliminary tests matrix. As mentioned previously, jet fires with a localized impact are out of the present scope, as the mechanical aspect can be majorant regarding the thermal load of the scenario. In the previous table, Q1 and Q2 represent the amount energy developed by the gas fire. It means that energies released during scenario 9 and 10 are equivalent. As for hydrogen, the following data has to be considered: D1 = 2.5 g.s -1 , D2 = 6 g.s -1 for mass flow rates and ∆Hc = 140 MJ.kg -1 for the heat of combustion. As for propane gas fire, the following data has to be considered: D1 = 7 g.s -1 and ∆Hc = 50 MJ.kg -1 . Some preliminary tests were performed with only the video, so as to determine visually the best position of the injectors regarding the engulfment of the cylinder. The "cover" mentioned in scenario 12 corresponds to some protections put above the cylinder to maintain as much energy as possible around the cylinder.

Results of tests

Even if the momentum of gas fire is lower than those that could be obtained with jet fire, it remains higher than with a pool fire, implying that the flame is less impacted by ventilation than with pool fire. Figure 8 presents some pictures taken during the tests. The maximal temperature obtained regarding the heat release rate of the fire helps to determine the efficiency of heating of each configuration, as detailed in Table 6. In this table, scenario 8 is considered as the reference scenario. As some tests have not been performed till 10 min, the comparison is done at an earlier time than for pool fire. The impact is low regarding the linearity of the curves. Even if the heating efficiency is better with lower gas fire heat release rate, a strong influence of the flow rate of combustible is observed with a difference of nearly 250 °C after 10 min of fire. It also appears that the vessel size has a lower influence on the temperature increase than with pool fire. In the tested conditions, for the same amount of energy provided, evolution of temperature is similar with propane and hydrogen. The cover seems also to improve the energy transmitted to the cylinder.

Comparison and classifications of thermal load

In this chapter, results for 36 L cylinder and 19 L cylinder are dissociated, so as to allow comparison of thermal load, regardless the impact of heated surface. Concerning the 36 L cylinder, the comparison is done between the majorant scenarios from pool and gas fire tests. The Figure 10 superimposes results of scenarios 2 and 8, to results obtained with the radiant panel tests and their extrapolation. It appears that even if the amount of energy developed by the fire is lower for the gas fire (0.84 MW) than for the pool fire (2 MW) performed during this experimental campaign, the quantity of energy absorbed by the cylinder is nearly the same in the two configurations. The superimposition also highlights the facts that in these two configurations, the thermal response of the cylinder can be considered equivalent as if the thermal load was performed with the radiant panels set up of chapter 3.1, with a radiation emitted heat flux between 150 and 160 kW.m -2 , which is the target proposed on chapter 2.1. Concerning the 19 L cylinder, the comparison is done between the designing scenarios from pool and gas fire tests. As the analytical model has not been validated with experimental results from radiant panels with 19 L cylinder, the superimposition of curves is not relevant. The Figure 11 only superimposes results of scenarios 7, 11 and 12. In the same way than for the 36 L cylinder it appears that even if the amount of energy developed by the fire is lower for the gas fires (0.84 MW) than for the pool fire (2.2 MW) performed during this experimental campaign, the quantity of energy absorbed by the cylinder is nearly the same in the three cases. Nevertheless, even if the evolution of temperature is quite similar for these three scenarios, it can be noted that the use of a cover allow gas fire to be equivalent to pool fire performed. Finally, for 19 L and 36 L cylinders, in the conditions tested, the amount of energy provided by an hydrogen gas fire is at least equivalent to pool bonfires performed during this experimental campaign.

CONCLUSIONS

The tests performed show that hydrogen gas fires and heptane pool fire allow reaching the target in terms of absorbed energy, regarding the results of risk analysis performed previously. Therefore, the designing aspect of the scenario is not sufficient to decide what type of thermal load is the more relevant for the tests that will be performed on composite cylinders during further works. Other considerations can be taken into account that will led to retain an hydrogen gas fire for further works. Firstly, hydrogen gas fire is the more realistic scenario: Hydrogen is the combustible that we every time find near an hydrogen storage … Secondly, as one of the objective of the project is to make recommendations for standardization issues, it's important to note that gas fires are not too complex to calibrate, control and reproduce. Finally, due to previous considerations, Hydrogen gas fire will be retained for thermal load of composite cylinders in future works, with the following characteristics:

• Use of 4 injectors, with at least 1.5 g.s -1 flow rate per injector.

• Use of confinement so as to increase the energy received by the cylinder.

At the beginning of this further work, an optimization work has to be performed on the experimental setup so as to improve the confinement of the cylinder and the fire and the needed hydrogen flow rate. This optimization will lead to ensure the good repartition of energy around the vessel, and to ensure the majorant aspect of the scenario throughout the duration of the test.

Figure 1 .

 1 Figure 1. Steel cylinders description for calibration tests.

Figure 2 .

 2 Figure 2. Experimental setup for radiative load of cylinder.

Figure 3 .

 3 Figure 3. Evolution of temperatures inside the cylinder.

Figure 4 .

 4 Figure 4. Evolution of temperatures in the cylinder.

Figure 5 .

 5 Figure 5. Comparison of experimental results of radiative tests with model.

Figure 8 .

 8 Figure 8. Thermal picture of hydrogen (left) and propane (right) gas fires. The evolution of internal temperature during the different tests performed is presented in Figure 9.

Figure 9 .

 9 Figure 9. Evolution of temperature during gas fire tests (calculated by the increase of pressure).

Figure 10 .

 10 Figure 10. Results for 36 L cylinder.

Figure 11 .

 11 Figure 11. Results for 19 L cylinder.

Table 1 .

 1 Preliminary tests matrix with metallic vessel specimen.

			Sample		Fire condition
	No	Volume [L]	Position	Fire source	Distance heat source/cylinder [mm]	impacted surface [%]
	1a	36	Horizontal	Radiation F1	300
	1b	36	Horizontal	Radiation F2	300
	1c	36	Horizontal	Radiation F3	300
	1d	36	Horizontal	Radiation F4	300
	1e	36	Horizontal	Radiation F5	300
	2	36	Horizontal	Heptane	100
	3	36	Horizontal	Heptane	600
	4	36	Horizontal	Radiation	300	100 (soot from 3)
	5	36	Horizontal	Heptane	600	50
	6	36	Vertical	Heptane	100
	7	19	Horizontal	Heptane	100
	8	36	Horizontal	Hydrogen Q2	/
	9	36	Horizontal	Hydrogen Q1	/
	10	36	Horizontal	Propane Q1	/
	11	19	Horizontal	Hydrogen Q2	/
	12	19	Horizontal + cover Hydrogen Q2	/
	2

.4 Experimental setup

2.4.1 Steel mock up

Table 2 .

 2 Radiant panel tests.

		Sample		Fire condition
	No	Volume [L]	Position	Emitted radiative heat flux [kW.m -²]	Distance heat source / cylinder [mm]	impacted surface [%]
	1a	36	Horizontal	32	300	100
	1b	36	Horizontal	43	300	100
	1c	36	Horizontal	55	300	100
	1d	36	Horizontal	66	300	100
	1e	36	Horizontal	78	300	100

Table 3 .

 3 Pool fire tests.

		Sample		Fire condition
	No	Volume [L]	Position	Fire source	Distance between heat source and cylinder [mm]	impacted surface [%]
	2	36	Horizontal	Heptane	100	100
	3	36	Horizontal	Heptane	600	100
	4	36	Horizontal	Radiation 78 kW.m -² (soot from 3)	300	100
	5	36	Horizontal	Heptane	600	50
	6	36	Vertical	Heptane	100	100
	7	19	Horizontal	Heptane	100	100

Table 4 .

 4 Pool fire heat release rates obtained.

	No	Distance between heat source and cylinder [mm]	Pool surface [m²]	Heptane mass [kg]	Time of fire [s]	Combustion rate [g.m -2 .s -1 ]	Heat release rate Normalised by Total pan surface [MW.m -2 ] [MW]
	2	100	1	29,6	660	45	2.0	2.0
	3	600	1	56,3	940	60	2.7	2.7
	5	600	0.5	28,7	890	64	2.9	1.5
	6	100	0.5	28,9	1275	45	2.0	1.0
	7	100	1	30	620	48	2.2	2.2

Table 5 .

 5 Gas fire tests.

		Sample		Fire condition
	No	Volume [L]	Position	Fire source	Distance heat stress/cylinder [mm]	impacted surface [%]
	8	36	Horizontal	Hydrogen Q2	/	100
	9	36	Horizontal	Hydrogen Q1	/	100
	10	36	Horizontal	Propane Q1	/	100
	11	19	Horizontal	Hydrogen Q2	/	100
	12	19	Horizontal + cover	Hydrogen Q2	/	100

Table 6 .

 6 Gas fire power obtained.

	No Number of injectors	Total mass flow rate [g.s -1 ]	Gas fire heat release rate [kW]	Temperature after 5 min [°C]
	8	4	6.0	840	160
	9	4	2.5	350	100
	10	2	7.0	350	100
	11	4	6.0	840	175
	12	4	6.0	840	200


A Duclos

F Verbecke
email: franck.verbecke@areva.com

ENGINEERING SAFETY IN HYDROGEN-ENERGY APPLICATIONS

Since a few years, hydrogen appears as a practical energy vector and some hydrogen applications are already on the market. However these applications are still considered dangerous, hazardous events like explosion could occur and some accidents, like the Hindenburg disaster, are still in the mind. Objectively, hydrogen ignites easily and explodes violently. Safety engineering has to be particularly strong and demonstrative; a method of precise identification of accidental scenarios ("probabilities"; "severity") is developed in this article. This method, derived from ARAMIS method, permits to identify and to estimate the most relevant safety barriers and therefore helps future users choose appropriate safety strategies.

INTRODUCTION

Since a few years, hydrogen appears as a credible alternative energy-vector and some hydrogen applications such as H 2 -fuel cell cars are already on the market (Toyota Hydrogen Fuel Cell Vehicle: Mirai [1], for example). However hydrogen applications are still considered dangerous, indeed hazardous events like explosion could occur if a hydrogen-air mixture comes to be formed; and some accidents involving hydrogen, like Hindenburg disaster or more recently Fukushima Daiichi nuclear disaster, are still in the mind. And finally the full acceptation of them on the market will go through the public acceptation. And it should be recognised that hydrogen leaks can produce extended explosive clouds because of the broad flammability range, and that hydrogen-air mixtures ignite extremely easily and burn/explode fast and violently [START_REF] Dorofeev | Flame acceleration and explosion safety applications[END_REF], [START_REF] Ciccarelli | Flame acceleration and transition to detonation in ducts[END_REF]. As compared to other fuels (ex: hydrocarbons), the flammability range is 5-10 times larger, the minimum ignition energy is 5-10 times smaller and the maximum burning velocity is also about 5-10 times larger. In other words hydrogeninvolved accident might lead to larger consequences. However, due to its physical properties, hydrogen may offer some appreciable advantages in terms of mitigation: because the flammable mixtures are much lighter than air, they disperse rapidly. Unfortunately, because of the very low minimum ignition energy, the ignition likelihood is much larger than for other common hydrocarbons. Design engineers have to face this reality and the logical consequence is that the safety demonstration has to be very strong and clearly understandable. To do so, experience shows that all the sequences of events leading to an hazardous situation (a leakage) need to be identified and ranked in terms of likelihood and consequences (explosions pressures, fire thermal fluxes). On this basis scenariodedicated "safety barriers" can be chosen and engineered in terms of required reliability and efficiency (level of reduction of the consequences). In this paper, the various risk analysis methods used/developed so far in the field of hydrogen safety are reviewed and assessed. None of them seem to be fully adapted to engineer safety on a practical daily basis. An alternative is presented in the following.

STATE-OF-THE-ART OF EUROPEAN PROJECTS ON RISK MANAGEMENT

The definition of a major accident is, given into the SEVESO Directive [START_REF]The European Parliament and of the Council[END_REF], "an occurrence such as a major emission, fire, or explosion resulting from uncontrolled developments in the course of the operation of any establishment… and leading to serious danger to human health or the environment, immediate or delayed, inside or outside the establishment, and involving one or more dangerous substances". The SEVESO directives are "translated" into national law. In France [START_REF]et seq[END_REF], the notion of major accident is the subject of an a priori classification of industrial installations on the basis of the nature of the products (clean hazards) and the nature of the transformation they are subjected to. For hydrogen applications, the border above which the installation enters into the scope of the regulation for the prevention of major accidents is 100 kg (>1000 kg for the SEVESO thresholds). However for many hydrogen applications, the quantity of stored hydrogen is often below 100 kg (typically 5 kg for the tank of Toyota Mirai) When an installation falls under the scope of the major accident regulation, a demonstration is required showing that the hazards are kept under control. The first step is always "risk assessment" but a number of very different methodologies (Table 1) exist to do this, which were benchmarked throughout Europe to highlight the performances/deficiencies. Table 1. Definitions of the existing approaches for risk assessments. [START_REF] Bouissou | Programme EAT-DRA34-Opération j-Intégration de la dimension probabiliste dans l'analyse des risques, Partie 1: Principes et pratiques[END_REF] Approach Definition Deterministic approach

The scenarios (ex: leak flow rate) are prescribed and often correspond to worst cases (ex: full bore rupture of the pipe). The scenarios may result from a brainstorming exercise (HAZOP, What-if ...) or may be imposed by the authorities. Only the consequences of the scenarios are estimated.

Probabilistic approach

The scenarios are identified using a brainstorming method (HAZOP, Whatif ...) and are ranked according to their probabilities (fault tree for instance). Only those scenarios sufficiently probable and able to create a significant hazard are selected.

Quantitative risk assessment

In the quantitative risk assessment, after a brainstorming phase the consequences and probabilities of each scenario are assessed. The consequences (number of injured people; deaths (most often) or to damages) and the frequencies (number of occurrence per year) are based on facts, database. The QRA lead to the following results representation the individual risk (iso-risk curve) and the societal risk (frequency/severity curve). The QRA is a complicated and time consuming exercise.

Qualitative risk assessment

In the qualitative risk assessment scenarios, frequencies and consequences are extracted from the feedback for past accidents and existing knowledge about the hazards (good practices, hazardous potentials...). The ranking of the scenarios is qualitative (ex for the consequences: no effect minor effects; localized effects; important consequences outside). The result is presented in a risk matrix. The qualitative risk assessment is easy and fast exercise but may be subjective.

Semi-Quantitative risk assessment

A semi-quantitative approach is similar to a QRA but instead of precise frequencies, orders of magnitudes are used.

Benchmark Exercise on Major Hazards Analysis

For the first time in the project Benchmark Exercise on Major Hazards Analysis [START_REF] Contini | Benchmark Exercise on Major Hazard Analysis[END_REF] (BEMHA) from 1988 to 1990, experts (from control authorities, research organizations, engineering companies or industry) could compare their methodologies. Eleven teams of experts analysed a typical ammonia storage facility located on a hypothetical site. The project resulted in a comprehensive overview of currently available methodologies for chemical risk assessment in Europe and highlighted the very strong influence of the assumptions made all along the risk assessment process such as the minimum lethal dose, source flow rates or hole sizes for process pipes. The project underlined the need to harmonize both the content and the format of the risk analysis as well as to establish a standardised language.

Assessment of the Uncertainties in Risk Analysis

Ten years later, the project ASSURANCE [START_REF] Lauridsen | Assessment of uncertainties in risk analysis of chemical establishmentsthe ASSURANCE project[END_REF], [START_REF] Hourtolou | Analyse des risques et prévention des accidents majeurs -ASSURANCE[END_REF] (Assessment of the Uncertainties in Risk Analysis of Chemical Establishment) (1998-2001) studied once again an ammonia storage facility in order to quantify the uncertainties associated with the risk analysis and in particular the incidence of the method of selection of the critical scenarios, the methods to estimate the consequences and the probabilities. It was found that the hazard identification phase was very critical. In particular, depending on the "filter" used (all probabilistic or all deterministic approaches) quite different ranking of the accidental scenarios were obtained (Table 2), particularly for scenarios with intermediate consequences. As for the scenarios' frequency assessment, the estimates were also quite contradictory. After this project, INERIS proposed to center the risk analysis onto the identification of "safety barriers" as a link between the probabilistic and deterministic approaches inasmuch the French authorities would accept a SEVESO plant only if safety barriers were indentified and could be maintained when time passes by. According to INERIS experience, the "safety barrier" approach offers a better transparency and a communication with a better perception by the general public.

Development of an integrated technical and management risk control and monitoring methodology for managing and quantifying on-site off-site Risks

I-RISK [START_REF] Papazoglou | I-Risk: development of an integrated technical and management risk methodology for chemical installations[END_REF], [START_REF] Bellamy | I-RISK development of an integrated technical and management risk control and monitoring methodology for managing and quantifying on-site and off-site risks[END_REF] project ("Development of an Integrated technical and management risk control and monitoring methodology for managing and quantifying on-site off-site Risks" 1996-1998) illustrated the importance of safety barriers into the risk management process. The project I-RISK aimed at developing a safety management model for risk control and monitoring; i.e. a risk assessment method that will takes in consideration not only the technical aspects (identification of the events leading to loss of containment (LOC) and the associated fault and event trees), but also the management system (major hazard management system audit) and their interface (quantification of the effect of this risk managementsafety measureson the risk of LOC).

In this project, Quantitative Risk Assessment (QRA) and management audits were used as 2 integrated tools. It was pointed out that "the integrated technical and management model was very robust and helped audit organizations in a new way" but that using the I-Risk method (QRA) on a full and complete site was much too demanding in terms of resources. I-RISK should be simplified to have a greater opportunity to be applied in the real life.

Accidental Risk Assessment Methodology for Industries ARAMIS

The project ARAMIS [START_REF] Hourtolou | ARAMIS project: Accidental Risk Assessment Methodology for Industries in the framework of SEVESO II directive, Proceeding of LANNOY[END_REF], [START_REF] Salvi | ARAMIS : an integrated risk assessment methodology for SEVESO plants[END_REF], [START_REF] Salvi | Convergence in risk assessment for SEVESO sites from ASSURANCE results to ARAMIS method[END_REF] (2002-2004) aimed at developing a new assessment method for major risks building on the preceding experiences. The ARAMIS project is based on an approach by barriers: identification of all conceivable major accident scenarios and the inventory of all safety equipment or barriers impeding the development of an accident because the final acceptability lies in the demonstration that the proper dimensioning (reliability, performances) of safety barriers is capable of keeping the identified risks under control. Besides, a significant evolution of the "risk perception/safety culture" is acknowledged: • the unrealistic vision of "zero risk" hidden behind the deterministic approaches is ruled out; • decision making is now open since a quantified line is drawn between acceptable and unacceptable accidents; • safety management is possible since not only the technical performances of the barriers are accounted for but also their reliability which includes human/organisational aspects and thus involves responsibilities

This move is perceptible in several countries including France where the acceptance of a new industrial project is openly depending of the design and control of the safety barriers. The French regulatory system resembles ARAMIS methodology [START_REF] French | Circulaire du 29 septembre 2005 relative aux critères d'appréciation de la démarche de maîtrise des risques d'accidents susceptibles de survenir dans les établissements dits[END_REF], [START_REF] French | Circulaire du 10 mai 2010 récapitulant les règles méthodologiques applicables aux études de dangers, à l'appréciation de la démarche de réduction du risque à la source et aux plans de prévention des risques technologiques (PPRT) dans les installations classées en application de la loi du 30 juillet 2003[END_REF].

ARAMIS [START_REF] Delvosalle | ARAMIS project: A comprehensive methodology for the identification of reference accident scenarios in process industries[END_REF] contains two methods. MIMAH (Methodology for Identification of Major Accident Hazards) helps identifying of all accidental scenarios physically conceivable. MIRAS (Methodology for the Identification of Reference Accident Scenarios) helps selecting the reference scenarios to be modelled and entered into the severity map.

The objective of MIMAH is the identification of major accidents i.e. all of the worst accidents likely to occur considering no safety systems and regarding the equipment, hazards and properties linked to substances used. MIMAH is based on the use of bow-tie diagrams (composed of a fault tree and an event tree, built around a critical eventan example is given Fig. 2); the bow-tie diagrams was chosen due their powerful mean of communication especially the visualisation of all causes and their relationship (necessary "AND" and sufficient "OR" conditions) allowing future probability calculations and identification of the potential safety barriers. In practise, the choice of the "critical event" may be difficult. It is formally, the point in the scenario were the succession of the elementary events switch from a causality organisation (event n°3 happens IF events n°1 AND 2 have occurred) to a temporal succession (event n°3 happens WHEN events n°2 HAS occurred). To help end-users, the structures of bow-tie were defined and potential critical events and the associated consequences were listed for typical equipment. It appears that critical events are often a loss of containment or, more generally a loss of physical integrity (leakage, spontaneous decomposition...). What happens AFTER the critical event is organised as an event tree. What occurs AHEAD is organised as a fault tree. In MIMAH, the probability aspect of the scenarios is not taken into account but the bow-tie is used to select the (suspected) required safety barriers, into the MIRAS method, which viability is tested analysing the organisation of the company.

In MIRAS, (the method of selection of reference accident scenarios (RAS)), the probabilities/consequences of each accident are calculated taking into account of the safety barriers.

The MIRAS methodology takes into account the safety systems installed on and around the equipment, the safety management system and the frequency and consequences of the accident.

Firstly the calculation of the frequency (see Table 3) of the critical event is done through the analysis of the fault tree or with generic critical event frequencies (taking into account the safety barriers in the fault tree). Then the frequencies of dangerous phenomena are also calculated (taking into account the safety barriers in the event tree). The performances, efficiencies of the safety barriers influence both the frequencies and consequences. Secondly a qualitative assessment of the consequences of dangerous phenomena is done leading to four classes of consequences (Table 4). This assessment will serve in the selection of RAS using a risk matrix defined by three zones: negligible effects; medium effects and high effects. It turns out that RAS are dangerous phenomena located in the medium or large consequence zones. Finally for each RAS a quantitative assessment is made to calculate the Severity. As conclusion the ARAMIS methodology is a composite of a deterministic and a probabilistic method. ARAMIS follows the suggestions from INERIS formulated at the end of the project ASSURANCE.

At the European level ARAMIS is a "recommended and harmonised tool used by risk experts and recognised by the risk decision-makers in the European Union" [START_REF] Hourtolou | ARAMIS Project: development of an integrated Accidental Risk Assessment Methodology for Industries in the framework of SEVESO II directive[END_REF], covering the requirements of the SEVESO Directive.

International Energy Agency -Hydrogen Implementing Agreement

At the international level, the tasks 19 and 31 of International Energy Agency (IEA) Hydrogen Implementing Agreement (HIA) [START_REF] Paaske | International Energy Agency -Hydrogen Implementing Agreement -Task 19 Hydrogen Safety[END_REF], [START_REF] Hoagland | International Energy Agency -Hydrogen Implementing Agreement -Task 31 Hydrogen Safety[END_REF] The overall outcomes of IEA HIA Task 19 are:

• Because of the specificities of hydrogen; specific ignition probability, low radiant heat… for instance, the use of off-shore or HydroCarbon Release database for hydrogen systems is irrelevant; • But the database HIAD (Hydrogen Incident and Accident Database); established by HySafe; is a valuable tool to estimate the hydrogen-associated event frequencies. • Oil and gas industries risk analysis reflects the importance of safety barriers. Hydrogen systems risk analysis should also reflect the importance of the safety barriers. Taking into account the safety barriers should be included as a best practice for risk assessment. Using fault and event trees can highlight the barriers' importance. • For hydrogen applications safety barriers must: avoid releases, detect gas leak, remove ignition source and/or shut down and isolate part of the process. • For the hydrogen applications, not only those with interface between public users and the technical system, have to include the public risk perception in the risk analysis and risk communication. • The human factors and so the safety culture had to be integrated into risk assessment.

About the methodologies to carry out the risk assessment, QRA exercises stressed out the possibility to calculate the efficiency of safety barriers but full QRA is often too complicated in everyday practise and somewhat "unstable" because of the dependency of the final outcome from the inputs (cf. 5.0)1 and assumptions. A qualitative approach would be more tractable and offers in addition the possibility to present the results in a consequence risk matrix where each scenario is represented as point into the matrix and can be easily compared to the others. Moreover the influence of mitigation measures can be efficiently illustrated. Task 31 of the same project pointed out again the need to adjust the traditional approaches and the leak, failure, ignition frequencies data and to tailor the risk assessment methods and the use of safety measures (prevention and mitigation) to fit hydrogen applications. Especially, the attention is drawn on the importance of evaluating the prevention and mitigations measures.

More recently a JRC report on hydrogen safety [START_REF] Kotchourko | State of the art and research priorities in hydrogen safety[END_REF] identified the state-of-the-art and the knowledge gaps for hydrogen risk assessment, dispersion or combustion, etc. The report highlights that deterministic and engineering methods prevail over probabilistic methods and consequently are currently used for hydrogen safety of particular system or facility. They take over the conclusions of previous projects, i.e. the leak of hydrogen specific data available and the fact that even though the QRA is a useful tool, its application on a system, in the case of a full probabilistic QRA, could be a very expensive practise. Deterministic or probabilistic studies of parts of the system are preferred.

To conclude considering the new hydrogen technologies, a quantitative risk assessment should be too time-demanding and difficult to achieve because of the lack of information such as leak frequencies or ignition probability. A mixture of both might be proposed, producing a semi-quantitative analysis, closed to what is currently done in France. A semi-quantitative analysis would be less demanding than a quantitative risk assessment and the representation of results through a risk matrix is a better mean of communication.

TENTATIVE APPLICATION OF ARAMIS METHOD TO A HYDROGEN APPLICATION

This case study will help to illustrate the risk assessment methodology. This study focuses on a hydrogen-based energy storage system, the Greenergy Box TM as showed in the Figure 1. The Greenergy Box TM is a containerized hydrogen chain comprising an electrolyser, a fuel cell, a water and heat management, and electrical converter systems coupled with a hydrogen and oxygen storages installed aside of the container. The Greenergy Box TM is an integrated modular system that can offer a power from 50 to 500 kW with a storage capacity from 0.2 to 2 MWh. Several systems can be coupled to increase the power and the energetic capacity. The Table 5 presents the input data used for the next steps of the risk assessment.

Identification of accident scenarios

The method used for the identification of the scenarios is based on MIMAH (. This intuitive method is composed of three steps:  Selection of the potential hazards present in this application due to their properties (flammable, oxidant … or not) or their conditions of use (operation pressure for example).

Here are considered three gases i.e. hydrogen; oxygen and nitrogen.  For all of those substances, identification of the potential hazardous equipment i.e. pipes, pressure storage or process equipment (pump, physical separator, energy production equipment).  Selection of the critical event, also called central event. According to the ARAMIS methodology, the central event is defined as a loss of containment; in this case, the central event is either the formation of an explosive atmosphere due to a leak, either the busting of equipment under pressure (collapse of a capacity) for the different hazardous equipment identified. After the identification of critical events (Table 6), the bow-ties can be built associating the fault tree built using the initiating events (left part of Table 6) and the event tree built using the identified hazardous phenomena (right part of Table 6). For each critical event (depending also on the hazardous substances and equipment), a bow-tie is associated (ex: Figure 2 is the bow-tie of a "small leak of hydrogen into the container" scenario). At this stage, the safety barriers are inserted in the bow-tie and are represented by vertical bars (see Figure 2).

Figure 2. Bow-tie of "small leak of hydrogen in the container" scenario

Selection of the reference scenarios

For the selection of reference scenarios, a method similar to MIRAS (calculation of the frequencies and estimation of the consequences) can be used. Nonetheless some changes must be taken into account; the ARAMIS methodology had been created to evaluate the risk of major accidents on industrial sites and is not specific to hydrogen.

The frequencies are estimated via the bow-tie diagrams and taking into consideration the safety barriers. Due to the lack of information about event frequencies or ignition probabilities, some assumptions had been made:

• Ignition probability is equal to 1 (ignition happens in all of cases) • For the initial event frequencies, orders of magnitudes are used instead of precise values (f (small leak) = 10 -5 ; f (large leak) = 10 -6 [START_REF] Lachance | Analyses to Support Development of Risk-Informed Separation Distances for Hydrogen Codes and Standards, SANDIA report[END_REF]; f (valve failure) = 10 -2 [START_REF] Sintef | OREDA, offshore reliability data[END_REF]), as well for the critical event frequencies. Such a choice can qualify the method used as a semi-quantitative risk assessment. • Only the fully developed dangerous phenomena are taken into account (conservative) Given the ignition probability equal to 1 and the lack of information about the explosion and/or jet fire probabilities in the case of hydrogen ignition, the frequencies of the hazardous phenomena will be equal to the frequencies of the critical events. This is of course an accepted and conservative approach for a risk assessment since the worth case will be considered (largest distances of effects). For the assessment of the consequences, the definition of the four classes differs from the ARAMIS method due to the size of the object studied (here the Greenergy Box TM ). In this case, the borders of our system corresponds to the footprint of the whole system i.e. the container and the storage area (Table 7). Using such classes for the assessment of the consequences illustrate the choice of a semiquantitative risk assessment. Table 7. Definition of consequences class used in the case of a containerized hydrogen application.

Ranking Definition C1

Light effect inside C2

Moderate to Important effect inside, no effect outside C3 Important effect inside and light effect outside C4

Important effect outside, leading to dominos effects

The consequences of the different events are assessed according to the feedback given by international online databases: HIAD [28], BARPI [START_REF]BARPI[END_REF] or H2tools.org [START_REF]H2 lessons learned[END_REF]. Accidents related into those online databases can give some idea of the severity of the selected events like, for example the following accidents extracted from the H2tools.org database, "Water Electrolysis System Explosion" [START_REF]H2 lessons learned: Water Electrolysis System Explosion[END_REF] or "Small Fire in Fuel Cell Test Stand" [START_REF]H2 lessons learned: Small Fire in Fuel Cell Test Stand[END_REF].

For instance between a large and a small leak into the container not only the frequency will change but also the class of consequences because the mass flow rate of the leak (i.e. also the quantity of hydrogen released into the container) will also differ. This is also true when the operation pressure change from 35 barg (ELY process pressure) to 2 barg (FC process pressure); the mass flow rate at 2 barg is twenty times smaller than the mass flow rate at 35 barg. Those differences will lead to different levels of consequence.

Knowing the frequencies F and the classes of consequences C of each critical event (identified scenario) are possible to put those one into the risk matrix (Fig. 3 and Table 8) and consequently to determine the reference accident scenarios which are the following ones: Ignition of an explosive atmosphere (small leak)container 10 -7 C2 3

Ignition inside the process (Electrolyser) 10 -6 C3 4

Ignition inside the process (Fuel Cell) 10 -5 C1 5

Ignition of an explosive atmospherestorage 10 -6 C3 6 Bursting 10 -7 C3 7

Fire due to Oxygen 10 -7 C2 8

Fire with an electric origin 10 -6 C2

DISCUSSION

Thus ARAMIS methodology can be implemented on H2 applications. However, some limitations may jeopardize its usefulness.

In particular, the frequencies of the various events in the bow tie depend very much on the past experience of incidents, defaults or accidents. The available databases are either not relevant or too limited and may not represent the state of the art of the technology. This point is particularly crucial when a similar piece, such as valve, is used in a large number inside the same area. A valve for instance can leak. If then of them are used and if the individual frequency of a leakage is 10 -4 /year, the total leak frequency inside the container is 10 -3 /year. If the technology is such that the individual leakage is smaller or if the number of them is much less that ten, then the global frequency of the event "leakage inside the container" could vary by two orders of magnitude. This would depend very much on the architecture of the system and, to be fully operational, the fault-tree needs to be more detailed to accommodate this level of information.

A similar comment could be done about the classes of consequences. Available accident database is limited and may not represent the state of the art. For instance, the severity of the explosion (especially for hydrogen) is known to depend very significantly from the volume/turbulence of the atmosphere and thus from the size of the system and pressures. Consequence models may be used instead to account for the process and environmental conditions.

For example, the event n°5 is classified C3 for the consequences nevertheless the conditions of pressure of the Greenergy Box TM are different from feedback. As shown hereafter, the distance for potential domino effects d3 (Table 9) calculated for the event n°5 (Table 10) is around 10 m and consequently potential domino effects on the container would have to be considered. In case of an ignition of a leak near or in the storage area (Table 10), the most likely event might be the ignition of a jet, resulting in a jet fire and in an explosion. The characteristics of the jet; considering a supersonic release; are a mass flow rate of 0.11 kg/s, after ignition the flame length is 7 m, the flame diameter 1.2 m and the distance to Lower Flammable Limit (LFL) is 1.1 times the flame length that is to say 7.7 m. The jet explosion is calculated considering the largest sphere into the jet. Given the fact this event happens in an open space (storage is outdoor); the index used for the Multi-Energy Method (index of explosion severity) is 6. For the thermal effects calculation, the percent of the radiation flux is equal to 30% (conservative calculation). No domino effects are possible with other capacities due to the presence of protection wall between capacities. The models used for the calculations are drawn from [START_REF] Verbecke | Formation and combustion of non-uniform hydrogen-air mixtures[END_REF] Table 10. Results of the effect distances for the event n°5. Lastly, the question of the "safety barriers" is raised. Again a "strong" demonstration of the safety is required for hydrogen-energy. And this depends on the perceived efficiency of the safety barriers. The latter influences both the frequency of the critical events and, often, their consequences. It is known that limitations exist on both aspects. For instance, a safety barrier may reduce the frequency by two orders of magnitudes but rarely more [START_REF] Miché | Approach for evaluating human safety barriers -Ω 20[END_REF], [START_REF] Ayrault | Evaluation des barrières techniques de sécurité - 10[END_REF]. To make the demonstration, it would be better to start from the situation without barriers and then to add the barriers to demonstrate the performances.

On that specific point, three criteria need to be specifically addressed: the independency of the barrier against the scenario for which it is designed, the failure on demand rate (comparable to the Safety Integrity Level for automatic systems), the response time within the context of the scenario and the efficiency which measures the reduction of the consequences. Good practises were developed, even for human barriers [START_REF] Miché | Approach for evaluating human safety barriers -Ω 20[END_REF], [START_REF] Ayrault | Evaluation des barrières techniques de sécurité - 10[END_REF].

FUTURE WORK

As mentioned above, there is a lack of information concerning the hydrogen-associated probabilities.

In one hand, Astbury and Hawksworth [36] compared ignitions of hydrogen releases with nonhydrogen releases. They showed that on 81 incidents inventoried for hydrogen releases, all of them ignited (4 of them were delayed ignition) in comparison with non-hydrogen releases (around 1440 releases) where 1.5% of them did not ignite. In other terms, the ignition probability is equal to 1. The difference might come from both the low minimum ignition energy (17μJ for hydrogen) and the large flammable range of hydrogen (from 4%vol. to 75%vol in the air).

In another hand, into the project HyQRA leads to the following conclusion about the ignition probability which varies from p = 1 to p = 0.15, while using the same sources. Feedback can be a mean to improve the gaps such as the ignition or leak probabilities. A work through the feedback from accidents and incidents, done via online database as BARPI [28], ODIN/HIAD [START_REF]BARPI[END_REF] or H2incidents [START_REF]H2 lessons learned[END_REF] created by the international hydrogen safety community, will permit to highlight the sequence of events leading to accidents and so to calculate most realistic probabilities.

CONCLUSION

Using and adapting the ARAMIS method permits to use a demonstrative method and to incorporate and to take into account the safety barriers. Indeed the ARAMIS method, based on an approach by barriers which can be defined as an approach that identifies of all conceivable major accident scenarios and inventories of all safety equipment or barriers impeding the development of an accident, proposed a systematic methodology of identification and selection of scenarios and also the generic calculation of the frequencies via the bow-ties.

However due to and considering the quantity and size of hydrogen applications (often below 100kg), the ARAMIS method should be modified. First such an application can not lead to major risk, due to as previously mentioned the quantity of hydrogen involved. Secondly the current databases (of frequencies and consequences), often extracted from off-shore or hydrocarbons databases, are unsuitable for the hydrogen applications. And finally the central character of the barriers is not sufficiently rested on, and particularly the assessment of efficiency (level of reduction) of the safety barriers.

Future works should be done on the calculation of the frequencies via a generator of probabilities with more detailed bow-ties and the establishment of a specific database to hydrogen gathering information on initiating events probabilities (ignition probabilities for example). Before a work on the criteria evaluation of the barriers, should be effectuate in order to assess their influence on both frequencies and consequences. For example the evaluation of the barriers can be based on the evaluation of independence of barriers and the probabilities of failure on demand. Finally the calculations of the effects should also review in order to have a better estimation of the consequences knowing the conditions of use.

Figure 1 .

 1 Figure1. Illustration of the Greenergy Box TM[START_REF] Verbecke | Safety strategy for the first deployment of a hydrogen-based green public building in France[END_REF]

  Figure 3. Risk Matrix Table 8. Frequencies and classes of consequences of each identified scenario. # Symbol Hazardous phenomena F C 1 Ignition of an explosive atmosphere (large leak)container 10 -8 C3 2Ignition of an explosive atmosphere (small leak)container 10 -7 C2 3Ignition inside the process (Electrolyser) 10 -6 C3 4Ignition inside the process (Fuel Cell) 10 -5 C1 5Ignition of an explosive atmospherestorage 10 -6 C3 6 Bursting 10 -7 C3 7Fire due to Oxygen 10 -7 C2 8Fire with an electric origin 10 -6 C2

Table 2 .

 2 Comparison of probabilities calculated in ASSURANCE project[START_REF] Hourtolou | Analyse des risques et prévention des accidents majeurs -ASSURANCE[END_REF]. (Grey tanned cells contain the lower assessments. Black tanned cells contain the upper assessments)

	#		3	5	7
	Scenario	Rupture or disconnection		Rupture of 20" pipe
			between ammonia ship and	Rupture of a ship tank	(distribution line of
			unloading arm		cryogenic tank)
		1	4.8 10 -4	2.8 10 -7	6.0 10 -6
	Partner	2 3 4 5	4.8 10 -6 8.0 10 -3 5.0 10 -3 5.4 10 -5	6.4 10 -10 5.7 10 -5 ---2.3 10 -6	1.0 10 -6 5.0 10 -6 9.0 10 -7 4.0 10 -7
		7	1.3 10 -5	4.9 10 -6	4.0 10 -7
	Range of deviation	4.8 10 -6 -8.0 10 -3	6.4 10 -10 -5.7 10 -5	6.0 10 -6 -4.0 10 -7

Table 3 .

 3 Probability classes.

	Probability	Quantitative estimation (per year)	Qualitative estimation
	F4 Improbable	< 10 -5	Possible but extremely unlikely event
	F3 Extremely rare	10 -4 to 10 -5	Very improbable event
	F2 Rare	10 -3 to 10 -4	Improbable event
	F1 Possible	10 -2 to 10 -3	Likely event
	F0 Occasional	> 10 -2	Common event

Table 4 .

 4 Class of consequences.

	Ranking	Definition Domino effect	Effect on human target
	C1 C2 C3 C4	To take into account domino effects, the class of consequences attributed to the studied dangerous phenomenon will be increased to the class of the secondary dangerous phenomenon that the first can bring about by domino effects	No injury or slight injury with no stoppage of work Injury leading to an hospitalisation > 24h Irreversible injuries or death inside the site, reversible injuries outside Irreversible injuries or death outside the site

  ; started in 2004; are devoted to the implementation of safety in hydrogen-based applications consecrated to a commercial use. During that period of time, IEA worked in close cooperation with Europe and joined the following projects both in view of selecting an appropriate risk assessment method and of identifying knowledge gaps: HyQRA (third internal project of HySafe: Safety of Hydrogen as an Energy Carrier; 2004-2009) and HyApproval (Handbook for Approval of Hydrogen RefuellingStations; 2006[START_REF] Paaske | International Energy Agency -Hydrogen Implementing Agreement -Task 19 Hydrogen Safety[END_REF].The aim of the project HyQRA was the development of a reference QRA methodology applicable to the hydrogen systems; which however used simplified calculation methods for having acceptable answer times. Additional work was also performed to reduce the uncertainties (scenario selection, leak and ignition probabilities …).

Table 5 .

 5 Input data for risk assessment.

Table 6 .

 6 Initiating and critical events and their associated phenomena.

	Initiating event	Critical event	Hazardous phenomena
	Leak on a pipe Rupture of a pipe	Collapse of capacity		Jet fire Explosion
	Failure of a component	Formation of an		Fire
	Increase of the pressure	explosive atmosphere		Missiles
	Sudden variation of pressure			Blast wave
	Premature ageing of the membrane			Flashfire
	Perforation of the membrane			Fireball
	Mechanical aggression
	Natural aggression Mechanical weakening External fire	For a breach or a leak, three size are considered as a percent or size of the	Size Large	Breaches on containers 100mm	Leaks on pipes Full rupture
	Human error (maintenance)	diameter hole (values	Medium	35-50mm	22-44%
		from ARAMIS project)	Small	10mm	10%

Table 9 .

 9 Effects distances in function of the hazardous phenomenon and thresholds.

	Distance	Explosion	Thermal (Fire)
	d1	20mbar	1,8 kW/m²
	d2	50mbar	3 kW/m²
	d3	140mbar	5 kW/m²
	d4	200mbar	8 kW/m²

For instance, within the context of the project HyQRA, a benchmark exercise[START_REF] Hama | Benchmark exercise on risk assessment methods applied to a virtual hydrogen refuelling station[END_REF] was done in order to estimate the differences and similarities in the quantitative risk assessment methodology. In this paper, a summary (Table5) of the adopted values for ignition probabilities for the consequence modeling showed that the probabilities vary considerably, for instance the "no-ignition" probability varies from p = 0 to p = 0.85, while using the same sources (i.e. the deliverable n°71 of HySafe[START_REF] Rødsaetre | An Ignition Probability Model Methodology for Hydrogen Risk Analysis[END_REF] or the Purple Book[START_REF]Comrnittee for the Prevention of Disasters, Guidelines for quantitative risk assessment[END_REF]).