Ju Lynne Saw

Yann Flauw

Marion Demeestere

Valérie Naudet

Pierre Blanc-Vannet

Kate Hollifield

Jill Wilday

The EU FireComp Project and Risk Assessment of Hydrogen Composite Storage Applications using Bow-tie Analysis

Hydrogen is expected to become a highly valuable energy carrier and significant mechanism for meeting future energy needs. The 3-year European FireComp project was initiated in 2013 to explore the thermomechanical behaviour of high pressure vessels in composite materials when exposed to fire conditions. FireComp brings together European partners from diverse disciplines with the main objective to better characterise the conditions that are needed to avoid loss of hydrogen containment. The project comprises six work packages, which include looking at fire protection strategies and providing input into regulations, codes and standards, as well as dissemination activities. The main activities include:



Experimental work in order to improve the understanding of heat transfer mechanisms and the loss of strength of composite high-pressure vessels in fire conditions.



Modelling of the thermo-mechanical behaviour of these vessels.

The current paper briefly outlines the FireComp project, and describes quantitative risk assessments of the hydrogen composite storage systems exposed to fire conditions using bow-tie analysis, based on previous results from earlier tasks. Different applications were considered: stationary applications, transportable cylinders, bundles and tube trailers, and were illustrated by a case study. Risk analyses have been conducted for each application with the aim of leading to the definition of optimised safety strategies; the main goal is to ensure that the composite storage systems are at least as safe as systems using steel cylinders. Further work within the FireComp project will provide bonfire test results to allow refinement of the risk analysis.

N°

Initiating event, Ii Is the initiating event selected for this application? AL Tube trailers type III -on the road AL Tube trailers type III -in a plant HEX type IV trailers -on the road HEX type IV trailers -in a plant AL bundles -in transportation AL bundles -in customer facility HEX bundles -in transportation HEX bundles -in customer facility Refuelling station (H 2 source) Forklift Road accident involving a trailer or a car or forklift during transport I1

Introduction

The current paper briefly outlines the FireComp project, and describes quantitative risk assessments of the hydrogen composite storage systems exposed to fire conditions using bow-tie analysis, based on results from earlier tasks.

The 3-year European FireComp project was initiated in 2013 to explore the thermo-mechanical behaviour of high pressure vessels in composite materials when exposed to fire conditions [START_REF] Firecomp | Description of Work (DoW): Modelling the thermo-mechanical behaviour of high pressure vessel in composite materials when exposed to fire conditions[END_REF]. Experimental work has been carried out to improve the understanding of heat transfer mechanisms, thermal degradation, combustion and the loss of strength of composite high-pressure vessels in fire conditions. The modelling of the thermo-mechanical behaviour of these vessels was also set-up and validated against full-scale fire tests. The FireComp project brings together partners from diverse expertise: a Gaseous Compressed Hydrogen (GCH) technology integrator as a coordinator (AIR LIQUIDE), a pressure vessel supplier (HEXAGON), a leading player in international Standards, Codes and Regulations development ( The ultimate aim of the work described in this paper, that is risk assessment using bow-tie analysis, was to formulate fire protection safety guidelines (in terms of risk reduction measures for hydrogen (H 2 ) composite cylinders) and potentially make recommendations for input into regulations, codes and standards.

Context

This paper summarises the work conducted within one of the FireComp tasks under Work Package 2: Fire Protection Strategy. It presents a quantitative risk assessment of the hydrogen storage systems that use composite technology, being exposed to fire conditions. The systems to be studied were identified, followed by a preliminary risk analysis and identification of relevant fire scenarios. This paper describes the work done using the results of the preliminary risk analysis to conduct a detailed risk analysis, using bow-tie diagrams. As this paper was written whilst the project was still ongoing, some parts of the analysis are still evolving, and thus this paper simply presents a snapshot analysis, i.e. an example study.

A number of hydrogen storage applications were considered, such as a bundle in transportation, or a cylinder in a forklift.

For each application, several bow-tie diagrams were drawn (49 in total, for all applications considered), capturing all known information on the potential thermal aggressors of the storage, and safety barriers used to reduce the risk of a hydrogen leak or burst. Each bow-tie has been quantified, using input data from AIR LIQUIDE (fire scenario frequencies), HSE (probability of failure on demand, PFD, of thermal pressure relief devices, TPRDs) and INERIS (passive safety barriers). Subsequently, within each application, the frequencies of occurrence of a leak and burst were calculated by adding the contribution of each bow-tie. A case study for a 280 kW/m² fire partially impacting a forklift, will be presented in this paper.

When this paper was written, there were some outstanding bonfire tests which were still being carried out by INERIS within Work Package 5. The results of these were to be used to:

 inform the hypotheses regarding the expected behaviour of composite cylinders exposed to a fire;  better understand the behaviour of the cylinders when exposed to fire (hence useful for model calibration); and

 obtain parameters for proper dimensioning of TPRD (time before burst and rupture pressure / internal pressure evolution with time).

The frequencies of a cylinder leak and burst was also assessed for classic technology, and compared to the values computed for composite technology, in order to help define safety objectives that should be implemented.

FireComp Bow-tie diagrams

The bow-tie diagram is a combination of a fault tree on its left-hand side and an event tree on its right-hand side. The link between the two trees is usually called the "top event". The primary causes identified in the fault tree (leftmost events) are referred to as "initiating events" (threats). The event tree starts from the top event and leads to "consequences", which usually are events we want to reduce risks of, either in probability or in severity.

In this paper, we identify three consequences of composite cylinders exposed to a fire:



No effect / leak through the body of the cylinder: when the hydrogen storage is exposed to a sufficiently aggressive fire impact, the fusion of the liner can occur 1 . This phenomenon can create a leak where the storage is supposed to remain airtight, or avoid a burst by allowing a pressure drop through that leak. A leak through the body of the cylinder would feed the surrounding fire without causing more significant effects;

 Leak through TPRD: this means the hydrogen storage leaks through the well-functioning TPRD as a result of a thermal impact;  Burst: this means the hydrogen storage bursts as a result of a thermal impact and a failure to open, of the TPRD 2 .

Figure 1 illustrates how a bow-tie is organized, constructed and used. This is a four-step method, colour coded as red, yellow, green and blue on the figure.

The four steps are applied as detailed below:

 1 st
Step (Red): Identify the top events.

The quantification is concerned with assessing the frequency of a dangerous consequence (leak or burst) of the hydrogen storage when exposed to a thermal impact. The top events must then be a given thermal impact followed by a storage failure. In this regard, the initiating events associated are the fires producing this level of impact on the hydrogen storage.

1 The phenomenon of leak throughout the body of type IV cylinders has been reported by [START_REF] Bustamante-Valencia | Thermal History Resulting in the Failure of Lightweight Fully-Wrapped Composite Pressure Vessel for Hydrogen in a Fire Experimental Facility[END_REF]. Leaks through type IV liners were observed when the cylinder was initially pressurized at "low" levels compared to working pressure. It is produced by the fusion of polymeric liner and the consequent loss of tightness. The degradation of the liner often occurs before the cylinder burst. This effect cannot occur on type III cylinders whose liner is metallic.

2 In theory, a cylinder could burst even if the TPRD opens. In fact, in order to prevent the burst from happening, we must ensure the TPRD enables the pressure inside the hydrogen storage to drop faster than the decrease of the rupture pressure due to the degradation of the envelope. In this paper, and by extension in the whole project, we assume the TPRD to have been properly dimensioned. Step (yellow): List, and position on the fault tree, the safety barriers selected to be involved in reducing the probability of occurrence of the top event.

These barriers will prevent one or more initiating events from having an impact on the storage. This means we do not analyse when the barriers behave properly, since nothing will happen if they do (i.e. we assume a safety barrier is efficient and has been correctly selected). We only assess the cases when they fail to respond on demand, by taking into account their PFD (Probability of Failure on Demand) during the quantification.

 3 rd Step (green): List, and position on the event tree, all the relevant risk mitigation measures; this includes measures reducing the probability of one or more consequences, as well as measures reducing the intensity of the consequences (for example a firewall).

In this work, we do not take into account the latter, since the consequence/ impact of a hydrogen leak or burst is out of the scope of the FireComp project. We simply assess the frequency of occurrence of any leak or burst, whatever the leak flow rate or volume.

 4th

Step (blue): Assess the consequences using all the information displayed on the bow-tie diagram.

Review of the preliminary risk analysis

The first step was to conduct a review of the preliminary risk analysis performed within the FireComp project, to give the elements required for the first step of the construction of bow-ties. The scope of the study needed to be defined first (application and environment), since bow-ties will vary depending on the use of the storage. These need to be paired with the list of initiating events that can have a thermal impact on the storage, and regrouped accordingly.

Applications involving high pressure hydrogen storage

Hydrogen cylinders are not usually used as a single element but integrated in bundles or other type of frames. Ten combinations of an application and an environment needed to be studied, as presented in table 1. For clarity, each combination of an application and an environment will be referred to as an application. For example, an AIR LIQUIDE (AL) bundle used in transportation is an application; the same bundle used in a customer facility is another application.

List of initiating events

Thirteen initiating events (I1-I13) that may have a thermal impact on the hydrogen storage in at least one of its applications were selected. It is important to note that malicious acts of arson are not taken into account in this risk assessment: they are out of the scope of these kinds of assessments since they are impossible to quantify and pertain to a very different field of expertise.

A preliminary risk analysis was carried out by AIR LIQUIDE and HEXAGON to check whether the initiating events were physically possible or not, for each application. Following review by FireComp Partners, some events were discounted for some applications because they were considered too improbable.

gives the updated list of events which was selected for the quantitative risk assessment. "Yes" in the table means that the scenario is physically possible, "No" means that the scenario is physically impossible or has been considered too improbable in the preliminary risk analysis held by AIR LIQUIDE (AL) and HEXAGON (HEX) prior to this study.

I13

Identification of the top events

In order to create relevant fault trees and event trees, we chose, for the top events, all the possible "impact" the hydrogen storage can receive. We define the "impact" as a combination of the heat flux received by the storage and the surface of the storage impacted by the fire. Note: initiating event n°11, building fire, has a special treatment in some of the bow-ties. In fact, when a safety barrier is positioned on a fault tree between an initiating event and a top event, it means this safety barrier is supposed to eliminate completely the impact if it functions properly, and the impact remains unchanged when the barrier is faulty. When this fault tree is quantified, the frequency of occurrence of the initiating event will be multiplied by the probability of failure on demand of the safety barrier to assess the frequency of the top event. However, one of the safety barriers associated with initiating event n°11 is a safety distance ranging from 3 meters to 15 meters. Even if this safety distance is successfully enforced, the impact received by the hydrogen storage does not disappear; it drops from a 125 engulfment (T4) to a 45 partial (T1). The bow-ties constructed will separate initiating event n°11 into 2 sub-events: one with the safety distance enforced, leading to top event T1, and another with the safety distance not enforced, leading to top event T4 and with a frequency of occurrence adjusted to take into account the probability of non-enforcement of the safety distance.

Review of the safety barriers

We needed to position the selected safety barriers involved in reducing the frequency of occurrence of the top events in order to finalize the fault trees. This had to be carried out for each bow-tie. The easiest way to do it was to proceed application by application: for each of them, we started from the list of the selected initiating events from . Then, for each initiating event, the safety barriers identified previously were reviewed and selected only if they help reduce the frequency of occurrence of the related top event.

It is important to note that some barriers have not been taken into account, even if they obviously have a positive impact on reducing the frequency of occurrence of the top event. One example is the bundle fastenings for type III trailers, to prevent fire after roll-over. The safety barrier is efficient and helps to reduce the frequency of that initiating event. However, the fastenings are always installed on type III trailers. Since the frequency of this initiating event is assessed by using an accident database, the safety barrier is already taken into account in the frequency. Hence, it will not be positioned again on the fault tree to avoid double-counting.

Hypotheses on the expected hydrogen storage behaviour when the TPRD fails to open

As mentioned before, when the hydrogen storage is exposed to a sufficient impact, the fusion of the liner can occur and add a random factor to the behavior of that storage. This phenomenon can create a leak where the storage is supposed to remain airtight, or avoid a burst by allowing a pressure drop through that leak. However, the study of the leak by fusion of the liner is not one of the objectives of the FireComp project, and since it is not a very well known and assessed phenomenon yet, it will not be explicitly studied in detail here.

With that in mind, it is assumed that a hydrogen leak leading to significant effects can only happen through a TPRD opening.

We then made the assumption that a hydrogen storage when the TPRD fails to open can either be damaged, but not enough to burst (we will call this scenario "no effect", associated with the "leak through body"), or burst when exposed to a thermal impact. The assumptions are detailed in Table 5.

Hypotheses on the expected TPRD behaviour

Finally, we needed to know how the TPRDs are expected to behave when exposed to each of the top events identified. TPRDs are initiated by fusion of a component which is expected to be very reliable provided the component reaches the fusion temperature. Therefore, it appears that even the lowest impact is able to activate a TPRD if it behaves properly (this is considered later). The thermal relief temperatures of the most usual TPRD range from 85°C to 110°C.

Concerning the TPRD behaviour, two sets of hypotheses can be distinguished, whether the TPRD is efficient i.e. it detects the fire and opens, or not:

 the TPRD is 100% efficient, whatever the type of fire: the TPRD activates when exposed to any of the 7 top events identified in Table 4, including partial fires (for some cases, this means that several TPRD have been placed on the storage);  the TPRD is partially efficient, according to the type of fire:

o for an engulfment fire, the TPRD is 100% efficient;

o for a local fire, the TPRD is inefficient;

o for a partial fire, the efficiency of the TPRD depends on the application: the bigger the hydrogen storage, the less efficient the TPRD (the risk not to detect the fire if there is only 1 TPRD on the storage is higher).

Depending on the set of hypotheses, the frequencies of leak and burst may vary significantly. This will be relevant in one of the final outcomes of the project: the safety recommendations. If the second set of hypotheses leads to unacceptable frequencies, one of the recommendations could be to increase the number of TPRDs to increase the efficiency to 100%.

Moreover, the unexpected opening of a TPRD will not be taken into account for the quantification of the leak and burst of the hydrogen storage, since it cannot happen under these hypotheses. However, the failure of a TPRD to open is studied, and leads to the consequences identified, depending on the top event.

Another aspect to consider is the dimensioning of the TPRD. In order to prevent the burst from happening, we must ensure the TPRD enables the pressure inside the hydrogen storage to drop faster than the decrease of the rupture pressure due to the degradation of the envelope. Proper dimensioning of the TPRD is out of the scope of the FireComp project and hence the starting hypothesis. The results from other work packages may change this hypothesis at the completion of the FireComp project.

Construction of the bow-ties

By putting together all the information, we were able to draw the bow-ties for each application. For clarity, the bow-tie representing top event y for application x is called bow-tie Ax.Ty. The red-cross symbol in the bow-tie diagrams denotes when it is deemed not possible for a top event to escalate into that particular consequence. For the purpose of illustration, only the bow-tie diagrams for application A10 are presented here.

A10: Forklifts

5 bow-ties exist for this application, for top events T1, T2, T4, T6 and T7.

Bow-tie quantification

In order to assess the frequencies of leak and burst for each bow-tie, the frequencies of each top event for each application were first assessed. Then, depending on the expected behaviour of the storage when the TPRD fails to open, the frequency of a leak and a burst was calculated by multiplying the probability of failure on demand of a TPRD when relevant.

To assess the probabilities of occurrence of each top event, the following data were needed:



The frequencies of occurrence of all the 13 initiating events for each application (an initiating event may have different frequencies depending on the application);



The probabilities of failure on demand (PFD) of all the safety barriers positioned before a top event.

Most of these data were provided by AIR LIQUIDE. The remaining data, the probabilities of failure on demand of some safety barriers, were assessed by INERIS based on reference guides [INERIS, 2008]. These probabilities are very conservative and broadly rounded up in order to be as sure as possible the frequencies of major accidents are not underestimated, since the bow-tie model does not facilitate taking uncertainties into account and since there is no real way to quantify those uncertainties. Finally, the probability of failure on demand of the TPRDs was not straightforward to quantify. It was not possible to find failure frequencies for a TPRD, the nearest available being the probability of a failure to open on demand for a conventional pressure safety valve (PSV) from the OREDA Offshore Database [START_REF] Oreda | Offshore Reliability Data[END_REF]. The safety function we want to assess is the opening of a thermally-activated PRD in a degraded state (meaning exposed to a fire), but no such value exists in either public or AIR LIQUIDE internal database.

Thermally-activated Pressure Relief Devices are a technology completely different from pressure-activated rupture discs or safety valves. Based on their knowledge of TPRDs and pressure safety discs, AIR LIQUIDE believes the probability of failure to open on demand of a TPRD when exposed to a fire is lower than the probability of failure on the same demand of a disc.

Moreover, failure rates (λ) characterise all the failures modes of a device: for a TPRD, failure to open in case of fire and unintended opening without fire. This last failure mode is out of the scope of the FireComp project, and not part of the QRA calculations presented here.

To determine the probability of failure to open of a TPRD for a vessel exposed to fire, the following points had to be considered: Based on those considerations, we used the following values:


-For an engulfing fire: public database NPRD (Reliability Analysis Center, 1991) gives a value of λ = 1.38×10 -6 per hour for the failure of rupture disc PRDs. For the reasons above, this value is over-conservative. We used it to calculate the PFD of a TPRD, in the absence of better data. For the calculation of the PFD, a proof test interval of 1 year will be taken as a common basis.

-For a partial fire: With the first set of hypotheses presented earlier, the TPRD has the same PFD as in an engulfing fire. With the second set, this paper considers, for illustrative purposes, that the TPRD is 50% efficient for vehicles, and 33% efficient for trailers and bundles.

-For a local fire: With the first set of hypotheses presented earlier, the TPRD has the same PFD as in an engulfing fire. With the second set, its PFD is 1 since it is deemed inefficient.

When the TPRD is 100% efficient, the probability of failure to open in fire is 6.04×10 -3 (called PFD avg ). If it is only partially efficient (i.e. it is exposed to the fire and then opens in a proportion of the cases, x), the equivalent PFD equals xPFD avg +(1x). It will be multiplied by the frequency of the top events to assess the relevant scenarios, as illustrated by the Case Study below.



The frequency after an "OR" gate is the sum of the frequencies of the initiating events; this supposes the initiating events are all mathematically independent; meaning the occurrence of one does not give any information on the occurrence of another one.



The frequency after a safety barrier is the product of the frequency before the barrier, and the probability of failure on demand of the barrier. For event trees, the frequency on the other branch (when the barrier behaves properly) is equal to the product of the frequency of the top event by 1 minus the probability of failure on demand of the barrier.

Finally, the frequencies of leak and burst were summed within each application to get a single value for each application. For example, for application 10, the frequency of a burst is the sum of the frequencies of a burst obtained from Bow-tie A10.T4, Bow-tie A10.T6 and Bow-tie A10.T7. The calculated values were compared with the values for competitive technology from generic databases. It was assumed that the risk associated with competitive technology is broadly acceptable; if the value for high pressure technology is lower, it will be considered acceptable, if the value is higher, it will be considered unacceptable and safety objectives will be defined to reduce the values to an acceptable threshold. This was to ensure that composite technology does not introduce a higher level of risk than the competitive technology already in place.

Case study

The following case study looks at a 280 kW/m² fire partially impacting a forklift. It is associated with bow-tie A10.T6: Table 4 identifies 2 initiating events corresponding to top event T6: I8 and I12.

confirms these 2 initiating events are physically possible for application A10. The cast-iron envelope is positioned as a safety barrier in the fault tree. As per Table 5, we assume that top event T6 is severe enough to allow a storage burst if there is no TPRD, or if it fails to open. As such, the TPRD failure leads to scenario S3: burst, and its proper functioning leads to scenario S2: Leak through TPRD. The values necessary to quantify this bow-tie are:

• the frequency of initiating event 8 (I8): fire from (HP) fittings, valves or piping connections;

• the frequency of initiating event 12 (I12): fire while filling H 2 / tow-away;

• the probability of failure on demand (PFD) of the cast-iron envelope;

• the probability of failure on demand (PFD) of the TPRD.

The frequencies of the two initiating events are provided by AIR LIQUIDE, based on their own return of experience on these events. The values that were provided to INERIS are 10 -3 /y for the fire from (HP) fittings, valves or piping connections, and 10 -6 /y for the fire while filling hydrogen / tow-away.

The PFD of the cast-iron envelope was assessed based on the Omega 10 method (INERIS, 2008). The envelope is a passive barrier. However, the cast-iron envelope was not designed to protect the hydrogen storage from an incoming fire: it serves as a counterweight. Nonetheless, its efficiency to protect the storage from a thermal impact has been asserted by AIR LIQUIDE. As such, INERIS proposes a corrected PFD of 10 -1 for the cast-iron envelope, instead of 10 -2 . Finally, the PFD of the TPRD is 6.04×10 -3 with the first set of hypotheses and 6.69x10 -1 with the second set of hypotheses, as previously explained. The results of the quantification of bow-tie A10.T6 are presented in Table 6. 6.69x10 -1 (33% efficient) 1.00×10 -4 9.94×10 -5 4.97x10 -5 6.04×10 -7 5.04x10 -5

Conclusions

A methodology to quantitatively assess the risk of hydrogen composite storage systems exposed to fire conditions has been described in this paper. During the preliminary risk analysis phase, a number of hydrogen storage applications were identified and linked to several initiating events, fire scenarios and safety barriers used to reduce the risk of hydrogen leak or burst. This led to the construction of a number of bow-tie diagrams that enable the determination, within each application, of the frequencies of occurrence of a leak and burst using input data from AIR LIQUIDE, HSE and INERIS. The paper illustrates the quantification process through a case study.

Results drawn from the quantitative bow-tie risk assessment will be used to compare between composite and conventional storage, hydrogen leak and burst frequencies when exposed to fire. This will lead to the issuing of recommendations and safety guidelines for input into regulations, codes and standards, about composite hydrogen storage technology, which aims to be at least as safe as existing conventional technology. It is expected that further work will be needed, e.g. to determine the appropriate number and location of TPRDs, but these are not within the scope of the FireComp project.

  UK Health & Safety Executive (HSE)), experts in industrial risks (INERIS), experts in thermal radiation and mechanical behaviour of the composite (CNRS (Pprime & LEMTA), LMS Samtech), experts in thermal degradation and combustion of composites, numerical simulation (Edinburgh University and LMS Samtech) and an expert in European Research & Development collaborative project management (ALMA). The project comprises six work packages, namely:  WP 1 Project management;  WP 2 Fire protection strategy;  WP 3 Thermal properties of composite material exposed to fire;  WP 4 Mechanical properties of composite material exposed to fire;  WP 5 Testing composite reservoir behaviour in reference fires and model validation;  WP 6 Input into Regulations, Codes and Standards and dissemination.

Figure

  Figure 1: Bow-tie diagram (Risktec, 2007)  2 ndStep (yellow): List, and position on the fault tree, the safety barriers selected to be involved in reducing the probability of occurrence of the top event.

Figure

  Figure 2: Bow-tie A10.T1

Figure 7

 7 Figure 7 Bow-tie A10.T6

Table 1 : AIR LIQUIDE (AL) and HEXAGON (HEX) applications involving high pressure hydrogen (H 2 ) storage with its environment

 1

	Application categories Application	Environment	N°
	Trailers	AL Tube trailers type III	On the road	A1
			In a plant	A2
		HEX type IV trailers	On the road	A3
			In a plant	A4
	Bundles	AL bundles	In transportation	A5
			In customer facility (on the ground)	A6
		HEX bundles	In transportation	A7
			In customer facility (on the ground)	A8
	Refuelling stations	Refuelling stations (H 2 source)	In a plant away from the vehicle	A9
	Vehicles	Forklifts	In a plant	A10

Table 2 : Initiating events and applications

 2

	Forest fire	No	No	No	Yes No	Yes No	Yes No	No

Table 3

 3

	N°	Top event	N°	Initiating event
			1	Fire of the tyres
	T1	45 kW/m 2 partial	10	Electric fire
			13	Forest fire
			5	Compartment fire (engine or interior parts)
	T2	45 kW/m 2 engulfment	6	Battery fire (hybrid and fuel cell vehicles)
			9	Pallets fire
			2	Oil or fuel fire (the source of fuel is the one of the truck)
	T3	125 kW/m 2 partial	3	Fire propagation from another car or another truck on the other side of the truck, or at a fuel station
	T4	125 kW/m 2 engulfment	11	Building (combustible walls) fire
	T5	280 kW/m 2 local	7	From TPRD of another bundle or cylinder (normal opening or not) or hydrogen storage
	T6 T7	280 kW/m 2 partial 280 kW/m 2 engulfment	8 12 4	From (HP) fittings, valves or piping connections Fire while filling H 2 / tow-away Fire after Roll-over

details the results of the quantification of the impact, based on elements provided by INERIS.

Table 4 : List of the top events

 4

Table 5 : List of assumptions for the expected storage behaviour when TPRD fails to open

 5

	N°	Top event	Consequence
	T1	45 kW/m 2 partial	No effect / Leak through body
	T2	45 kW/m 2 engulfment	No effect / Leak through body
	T3	125 kW/m 2 partial	No effect / Leak through body
	T4	125 kW/m 2 engulfment	Burst
	T5	280 kW/m 2 local	Burst
	T6	280 kW/m 2 partial	Burst
	T7	280 kW/m 2 engulfment	Burst

  values for pressure-activated PRDs (bursting discs, safety valves...) are not relevant;  probability of failure to open in fire of a thermally-activated PRD (excluding unintended openings) is unknown;  values for thermally-activated PRDs exist in neither public nor AIR LIQUIDE internal database;  like other types of PRDs, TPRDs are devices that rely on a physical phenomenon of its materials to open in case of fire. Hence a very low probability of not opening when exposed to fires.

Table 6 Quantification of bow-tie A10.T6

 6

	I8	I12	Cast-iron envelope	TPRD	T6	S2: Leak through TPRD	S3: Burst
	Formula
				6.04×10 -3
				(100%
	Value		0.1	efficient)

Acknowledgment and disclaimer

The research leading to these results has received funding from the European Union's Seventh Framework Programme (FP7/2007-2013) for the Fuel Cells and Hydrogen Joint Technology Initiative under grant agreement n o [325329]. The work was partially funded by the UK Health & Safety Executive, HSE. The paper is the opinions of the authors and does not necessarily represent HSE policy.

No Yes No Yes Yes I2 Oil or fuel fire (the source of fuel is the one of the truckFire after Roll-over Yes No Yes No Yes No Yes No No Yes I5 Compartment fire (engine or interior parts) No No Yes Yes No No Yes No No No I6 Battery fire (hybrid and fuel cell vehicles) No No Yes Yes No No Yes No No No Hydrogen (H 2 ) Fire on a plant (customer plant or filling plant) No Yes No Yes Yes Yes I10 Electric fire Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes I11 Building (combustible walls) fire No Yes Yes Yes No Yes No Yes Yes Yes I12 Fire while filling H 2 / tow-away

N° Initiating event

Fuel/material involved Based on Table 3, we can identify 7 types of impacts, meaning there are 7 different top events. The list of these top events and the initiating events leading to those is provided in Table 4.


SUBSIDENCE DESCRIPTION AND CONSEQUENCES 1.Subsidence mechanism and components

Subsidence is the consequence of mine excavations, tunnels and the collapse of natural cavity. Subsidence causes ground surface deformation, the subsidence characterized by sagging of the ground surface producing more damage, over larger areas, affecting nearly all structures and infrastructures. The subsidence breaks up classically into a vertical movement of the ground, called subsidence, and a horizontal displacement (Peck, 1964[START_REF] Heib | Influence de la déformation horizontale sur le bâti. Rôle d'une tranchée périphérique[END_REF]. Figure 1 presents the theoretical curves of vertical displacement, tilt, horizontal strain for an underground mine. The vertical displacements are obtained by direct survey measurements. The others parameters are estimated using empirical and analytical approaches (Lack et al., 1992[START_REF] Deck | Taking the soil-structure interaction into account in assessing the loading of a structure in a mining area[END_REF]. The maximum damages observed on structures are located in the zone of maximum horizontal extension strain defined by the broken angle  (Figure 1).

Damages of structures

The Figure 2 idealizes the different movements that can affect the structure due to surface subsidence. The vertical component of subsidence causes changes in ground gradient, which can adversely affect, for example, drainage, tall buildings and machinery in factories. The tilt, horizontal strains (extension and compression) and curvature are the causes of the most commonly observed type of subsidence damage. Extension is characterized by the Efficiency of periphery trench for reducing the impact of surface subsidence on structures using 1g physical modelling M. Al Heib & J-B Kazmierczak INERIS-Parc Technologique Alata -BP 2, 60550 Verneuil en Halatte, France ABSTRACT: Underground mines induce a surface subsidence. The existing structures and infrastructures can be damaged by the strain and settlement of the soil in the subsided zone. Mitigation methods exist for reducing the impact of the subsidence on the existing structures. One of them is the periphery trench, the method consists in cutting the soil around the existing building then filling the trench with a compressible material. The effect of horizontal strain will be absorbed by the partial closure of the trench. Physical modelling (1g) tests were carried out to evaluate the optimal dimensions and to determine the characteristics of the filling materials that can be recommended. Thanks to results the effectiveness of the trench was confirmed; operational recommendations were made. pulled open joints in masonry. The compression strain results in the: squeezing-in of voids such as doors and windows and the horizontal movements of masonry blocks.

Figure 2. Different types of movement affecting a structure [START_REF] Deck | Taking the soil-structure interaction into account in assessing the loading of a structure in a mining area[END_REF].

The Figure 3 shows the effect of compression strain due to the subsidence on an existing structure and the ground around the structure.

Mitigation methods of subsidence consequences

Various mitigation methods have been developed and applied to reduce subsidence influences on numerous surface structures. [START_REF] Bazanzurita | Mitigation and Monitoring of Structural Distress due to Mine Subsidence[END_REF]. The main methods are classified on three categories: i) The reduction of the hazard intensity; ii) The strengthen of the structure by increasing the capacity of the structure to resist against the hazard; iii) The reinforcement of the soil and the foundation.

The trench presents a potential mitigation solution due to the low cost and the application of the method for individual houses. The periphery trench is a vertical slot realized in the existing soil at a horizontal distance from the structure. For security raisons, the periphery trench should be filled with a compressible natural or artificial material (Figure 4).

The paper treats the effectiveness of the periphery trench. Peng et al. (1996) followed the behavior of 12 individual houses to determine the performance of the trench. The houses were under the influence of subsidence induced by a longwall of deep coalmine, the horizontal strain varies between 5 mm/m and 15 mm/m (Figure 5). The trench reduced the tension strain about 35% and 65% for the compression strain.

Figure 5. The effect on the trench on the strain from in-situ measurement in USA (Peng et al. 1996).

PHYSICAL MODELLING

Introduction

Few back analyses exist to demonstrate the efficiency of the method and to give the engineers operational recommendations. However, the following points can be summarized from the bibliography:  The gravel, coke, peat can be used as filling materials, but few data exist of the mechanical proprieties.

 The width of the trench varies between 40 and 60 cm, the distance between the structure and the trench limit is about two meters and the depth of the trench varies between 60 cm and one meter.  The trench is placed under the level of the foundation.

Physical modeling description

INERIS developed a large physical model to study the soil-structure interaction due to the different ground movements. Figure 6 shows the smallscale physical model of soil-structure system (2*3* 1 m). The vertical displacement applied using electric jack. In this physical model, the analogue soil is Fontainebleau sand; This sand is very smooth and for our purposes the category NE 34 sand was chosen. The considered grade of Fontainebleau sand (D 50 = 200 m) has on the one side less negative effects, due to scale ratio of the physical model, on the transfer of movement from soil to structure than another type of sand but on the other side, allows the use of DIC with a satisfying accuracy of the displacements determination (Al [START_REF] Heib | Large-scale soil-structure physical model (1g) assessment of structure damages[END_REF]. The friction angle of the sand varies from 29° to 42° depending on the state of compaction.

Herein, the following remarks related to similarity conditions are addressed: (i) Firstly, this model of the soil does not allow representing the real soil behaviour because of its cohesionless character. (ii) Secondly, the similarity requires the scale factor of the stress σ s and the Young's modulus E s must be reduced by 1/n: σ s * =E s * =1/n (n=40); because the stress and the Young's modulus of a point are increasing with the depth H. However, the values of the stress and the Young's modulus are quite identical when using the small-scale model because of its shallow depth. This means that two parameters σ s and E s do not meet the similarity conditions. (iii) Thirdly, the grain size effect has not been studied deeply. For the modelling in centrifuge (ng), it was found that the ratio between a shallow foundation length L and the mean diameter of grains D 50 should be greater than or equal to 35 so that the grain size effect is negligible (L/D 50 ≥35), see [START_REF] Garcia | Mesure de formes et de champs de déplacements tridimensionnels par stéréocorrélation d'images[END_REF]. However, there is no rule for the case of modelling under normal gravity (1g). The ratio L/D 50 is equal to 1250 (L=250 mm, D 50 =200 μm) and can be reasonably sufficient to neglect the grain size effect. Measurement of surface displacements is achieved by means of stereo digital imagery. Digital Image Correlation (DIC) technique was adopted to determine the displacements and the deformations. This allows monitoring the whole top surface of the ground and more especially where ground movements happen. The relative position of the 2 cameras is very precisely known and allows the determination of 3D displacements and deformations of the soil and structure surfaces (Figure 6). The two highresolution digital cameras have a maximum frequency of 8 images/second at full resolution. They have to be calibrated before the start of a test by the use of a test pattern. A good calibration allows obtaining very precise measurements with an error of 1/100 of a pixel in good conditions: this corresponds to 10 µm when 1 pixel is equal to 1 mm.

Trench physical modelling

Physical model was used to study the impact of the trench in subsidence reduction. The building modeled by two parts. The first one is a hollow slab while the second one is composed of lead powder in a plastic bag. This allows the model to present a stiffness and a stress transmitted to the ground equivalent to the prototype's ones. This small scale model is laying on the ground without any foundation parts. The Table 1 presents the characteristics of the building model (small-scale model and prototype).

Melamine foam was chosen for its ability to deform in compression, its physical aspect, and its ease of implementation. A great difference exists between the elasticity modulus of the melamine (1-2 kPa) trench model and that of the Fontainebleau soil model (5-10 MPa). The melamine foam is about 500 to 2000 times softer than the Fontainebleau sand. The peripheral trench is composed of many blocks lining around the building model (Figure 7). The Figure 7 presents the material used the physical model and the material used to fill the trench. The building was positioned in maximum slope zone and in tensile zone (Figure 8).

Two distances of 1.4 m and 0.4 m between the trench and the building located in tensile zone were tested, whereas only a distance of 1.4 m was assigned for the building in maximum slope zone. The physical model allows estimating the efficiency of the peripheral trench by either comparing the horizontal strain in the building of the ground surrounding it under conditions with and without the presence of the trench. The trench was filled with very compressible material (foam).

The Table 2 presents the obtained results for two positions two in tensile zones and one in the maximum slop zone, with and without trench. For structure located in maximum slope zone, the average compressive strains in Table 2 shows a reduction of almost 70% of the horizontal strain of the ground surrounding the building in the case with trench compared to the case without trench. On the other hand, the reduction is equal to 35% if building strains are considered. For the structure located in tensile zone, the trench reduces about 21 % of the surrounding ground strain. Around 56% and 38% of strain reduction are found for buildings with trenches respectively at 1.4 m and 0.4 m distance.

From the obtained results, we can provide the following judgments:

 The efficiency of the trench depends on the position of the building. In terms of ground strain, the trench is much more effective for the maximum slope position; while it is less effective, regarding to the building strain.

 The closer the distance between the building and the trench, the less effective is the peripheral trench.

The physical model makes it possible to estimate the effectiveness of the peripheral trench by either comparing the horizontal strain in the building or the strain of the ground surrounding it under conditions with and without the presence of the trench.

The efficiency of the trench analysed by physical modelling is very similar to the results from observations in real cases (Peng et al. 1996) and those from numerical modellings. This clearly shows the effectiveness of the trench.

Trench filling materials

The success of the periphery trench to protect building depends on the filling material. The filling material must have the properties to reduce the initial volume (Figure 9). Several requirements must be met: compressibility or compactness, cost embodiment, sustainability, pollution, flammability, etc. The foam cannot be used due to the long term behavior.

Figure 9. Example de peat, limestone and coke material for filling the trench.

We selected several potential materials: coke, gravel, peat/straw, Honeycomb, insulating, used tires. We analyzed their physical and mechanical characteristics. Table 3 presents the advantage and disadvantages of each potential filling material according different technical and cost-effective criteria. Peat, straw and gravel may be considered as very useful material to fill the trench.

CONCLUSION

The small-scale physical modelling (1g) tests were carried out to study the behavior of a mitigation techniquei.e. periphery trench -which may be used to reduce the damage to buildings due to ground movements. The periphery trench described in this paper has proved very effective in reducing the compressive strain in the ground and also in the building. The physical modelling results confirmed the numerical and in-situ experiences.

Its efficiency varies depending on the building location relatively to the subsidence trough, and on the distance from the building. The trench may reduce the horizontal strain by more than 50%. This result confirmed the main interest of periphery trench as mitigation solution.

Different materials were analyzed to fill the trench. Those materials must be enough compressible for short and long term protection. The trench is efficient when the filling material is very compressible, its Young modulus must be about 10% of that of the soil. The using of very deformable material like peat and straw gives acceptable results regarding technical and economic criteria.

Figure 1 .

 1 Figure 1. Subsidence parameters (O: layer open, Am: maximal subsidence,  and : influence angle and maximum strain angle, D: depth, Wc: critical width).

Figure 3 .

 3 Figure 3. Example of serious structure damages due to subsidence -Iron mine -Lorraine -France.

Figure 4 .

 4 Figure 4. Presentation of peripheral trench technique.

Figure 7 :

 7 Figure 7: Trench position and foan material used to fill the trench in physical model.

Figure 6 .

 6 Figure 6. 3D physical model of soil-structure system. (a) Two cameras monitoring the soil surface movement, (b) Two cameras monitoring one facade of the structure, (c) Position of cameras, and (d) Mechanical-electrical jack.

Figure 8 .

 8 Figure 8. Different configurations of the tests: (left) Trench placed at 1.4 m from the building located in maximum slope zone; (centre) Trench placed at 1.4 m from the building located in tensile zone; (right) Trench placed at 0.4 m from the building located in tensile zone.

Table 1 .

 1 Characteristics of building model.

Table 2 .

 2 Average horizontal strains of building and its surrounding ground.

	DTB: Distance between Trench and Building
	hg: ground horizontal strain, hg: building horizontal strain,
	Gr: ground, B: Building
	WOT: Without Trench, WT: With Trench,
	Building's	DTB	hg (mm/m) hb (mm/m) Strain reduc-
	position	(m)				tion (%)
			WOT WT	WOT WT	Gr	B
	Max.	1.4	-2.88 -0.93 -0.20 -0.13 67.7 35.0
	slope
	zone
	Tensile	1.4	-2.26 -1.79 -0.16 -0.07 20.8 56.3
	zone	0.4	-	-	-0.16 -0.10 -	37.5

Table 3 .

 3 Different indicators for the selecting the filling material(+ positive, -negative, = indifferent)

	E: Efficiency, Ec: Ecologic, D: Durability, R: Realization, P:
	Price
	Material	E	Ec	D	R	P
	Coke	-	=	++	+	-
	Gravels	+	=	++	-	++
	Peat/Straw	++	=	=	+	+
	Honeycomb structures	++	=	+	=	-
	Used tires	++	+	+	+	++
	Insulating	+	-	≈	-	-