Clément Atlan

Corentin Chatelier

Maxime Arnaud Viola

Maxime Dupraz

Steven J Leake

J Eymery

Frédéric Maillard

Marie-Ingrid Richard

In situ and operando 3D imaging of Pt and Pd electrocatalytic nanocrystals

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

In situ and operando 3D imaging of Pt and Pd electrocatalytic nanocrystals C. Atlan, 1,2,3 C. Chatelier, 1, 2 A. Viola, 3 M. Dupraz, 1, 2 S. Leake, 2 J. Eymery, 1 F. Maillard, 3 M.-I. Richard Structural properties of transition metal are critical to understand the catalytic behavior of electrochemical processes. Here we show that 200 nm Pt and 500 nm Pd nanocrystals can be probed in situ and operando through Bragg Coherent X-ray Diffraction Imaging. This lens-less technique enables determining the morphology as well as mapping the strain and displacement fields of such nanoparticles. By measuring the Pt 002 Bragg reflection we show evidence of heterogeneous and potential-dependent strain distribution between highly-coordinated ({100} and {111} facets) and under-coordinated atoms (edges and corners) as well as evidence of strain propagation from the surface to the bulk of the nanoparticle. This allows to unveil adsorption sites. We also demonstrate that the formation of highly strained palladium hydride nanocrystals can be tracked under potential control. Even though the beta phase (hydrogen rich) Bragg peak comes and vanishes at relevant potentials, the nanocrystal does not recover its pristine morphology.


Stephanie El-Zahlanieh

Idalba Souza

Dos Santos

David Brunello

Benoit Tribouilloy

Christian Blanchard

Charly Koenig

Alexis Vignes

Olivier Dufaud
email: olivier.dufaud@univ-lorraine.fr

Mist Can Explode, but Still No Standard! Proposal of a Combustible Sprays Test Method

Hydrocarbon mists can explode even at temperatures well below their flashpoints. Nevertheless, fuel mist hazards are often disregarded and improperly classified due to the lack of tools and standards to assess and investigate their occurrence. The aim of this study is to propose a new test method to determine the ignition sensitivity and the explosion severity of fuel mists using a single existing standard equipment already available in laboratories or industries. The standardized 20L explosion sphere was selected and modified: a Venturi mist generation set-up and an automated system controlling the inlet concentrations and allowing an optimum evaluation of explosion results were implemented. Once the technical feasibility was established, seven fluids (ethanol, isooctane, kerosene, diesel, lube oil, light fuel oil, and biodiesel) of both industrial interest and different physicochemical properties were chosen to be tested under a wide range of conditions. Extensive studies were performed on their droplet size distribution (DSD), turbulence level, flammability, and explosion severity. To study the behaviour of the mist before ignition, particle image velocimetry and in-situ DSD measurements were performed. Then, sensitivity studies were carried out to examine the influence of parameters, such as the ignition source (spark or chemical igniters), the ignition energy, the DSD, the initial turbulence, the chemical nature of the fuel, the liquid temperature, and the sphere temperature, on the thermo-kinetic explosion parameters Pmax and dP/dtmax. Results showed that this new procedure permits to measure sensitivity parameters such as minimum ignition energy and lower explosive limit, in addition to the above-mentioned severity parameters. This study establishes that it is indeed possible to assess fuel mist flammability and explosibility using a standardized apparatus based on the 20L explosion sphere, and thus allows a comparative ranking of hydrocarbon mists.

Introduction

Explosive atmospheres can be found in a variety of sectors, including chemical, petrochemical, pharmaceutical, food processing, and power industries, where hazardous areas should be identified and classified as implemented by the European ATEX Workplace Directive 1999/92/EC. All equipment and products used in such environments should fulfil stringent criteria to prevent them from becoming a source of ignition in the case of any flammable release. These releases can comprise gases or dusts, but mist releases should not be disregarded. Indeed, even high flashpoint liquid releases can be considered as flammable, as such fluids, when aerosolized, can ignite and engender an explosion [START_REF] Bowen | Pressurised atomisation of high flashpoint liquids -implications for hazardous area classification[END_REF]. While standards are well established and clear for gases and dusts, it is still not the case for high flashpoint liquid aerosols. Qualitative guidance can be found in some standards including the Energy Institute code of practice EI15 and NF 60079-10-1, but there exists a lack of quantitative methods permitting to correctly assess mist explosions and classify linked hazardous areas. As pointed out by [START_REF] Gant | Generation of flammable mists from high flashpoint fluids: literature review[END_REF], the matter is more complex for mists than for gases and dusts. In addition to the droplet size distribution, turbulence level, and concentration in the case of dusts, mist releases are not usually uniform and stable, mostly due to eventual evaporation, droplet breakup, coalescence, or sedimentation. Moreover, with high flashpoint liquids being multicomponent fuels, the presence of volatile fractions renders studying their flammability and explosivity rather challenging. A significant research effort was made in the past to achieve a better understanding of these aspects. For instance [START_REF] Burgoyne | The effect of drop size on flame propagation in liquid aerosols[END_REF] notably studied the effects of droplet sizes on the flammability of the mist cloud. [START_REF] Ballal | Ignition and flame quenching of quiescent fuel mists[END_REF] conducted several studies to measure and predict the ignition energy and quenching distance of quiescent and turbulent fuel mist clouds. Over the years, a considerable number of mist-related incidents have been reported in parallel. [START_REF] Eckhoff | Chapter 3 -Explosions in clouds of liquid droplets in air (spray/mist)[END_REF] dedicated a chapter of his book to shed light on the explosions of liquid droplets and past related incidents. Other incident reviews were published by [START_REF] Santon | Mist fires and explosions: an incident survey[END_REF] and [START_REF] Lees | Review of recent incidents involving flammable mists in[END_REF]. The list of dedicated studies is far from being exhaustive, but there is still no standard test method for mist ignition and explosion assessment. A first approach could be to use an existing standard. Indeed, [START_REF] Puttick | Liquid mists and sprays flammable below the flash point: the problem of preventative bases of safety[END_REF] proposed that the primary assessment for ambient temperature ignition of mists be performed following a similar approach to that employed for dusts. Consequently, based on the 14034 European standard series for the determination of explosion characteristics of dust clouds, this study proposes a test method for the experimental determination the lower explosive limit (LEL), the maximum explosion pressure Pmax, and the maximum rate of pressure rise dP/dtmax in a single already-standardized test vessel. An experimental approach was also proposed to determine the minimum ignition energy (MIE) in the 20L explosion sphere. The determination of the mentioned parameters provides a framework for hazard identification and explosion prevention. The selected test vessel was a closed 20 L explosion sphere in which mists were injected using a Venturi-based spray nozzle. An area classification system established by [START_REF] Gant | Area classification of flammable mists: summary in[END_REF] served as a basis through which seven fluids were chosen, characterised, and tested. Experiments were performed to prove the feasibility of this proposed test procedure and to highlight the necessity of high-flashpoint fuel mist classification.

Test method

The outline of this article is directly inspired by the structure of international standards such as 14034 series.

Test apparatus

The standard 20 L explosion sphere was employed for this study. As it is mainly used to characterize dust clouds (EN 14034 1-4), some modifications were carried out and will be discussed in the following sections.

Explosion vessel

The 20 L explosion sphere comprises an inlet for purge air, two outlets for exhaust gases and vacuuming, a manometer for the determination of the initial pressure, two piezoelectric pressure sensors for the recording of the pressure-time evolution, two stainless steel electrodes and two electronic valves for the mist injection system described later in the text. It is equipped with a temperature controlling water jacket. The existing outlet valve, rebound nozzle and dust container were removed for the purposes of this study.

Mist injection system

The liquid to be aerosolized was placed in a temperature-controlled metallic reservoir under ambient pressure. Compressed air was injected through a three-way ball valve leading to a Venturi effect forcing the liquid up the tube and through the nozzle where it could be atomized (Figure 1). Two electronic valves were placed on the liquid and the compressed air inlets to control the injected concentration and the liquid/air ratio and to prevent backflow due to the explosion. The body of the nozzle spray was designed to fit into the support ring already used for dust explosion. The height of the vertical sphere support was also modified from 16 to 27 cm to allow for the mist injection system to fit underneath the sphere (Figure 1b). This system was hence placed at the base of the sphere with the nozzle set mounted inside the vessel allowing upward mist injection. The nozzle set was a twin fluid external mixing nozzle comprising an air cap and a fluid cap of different orifice diameters ranging between 0.5 and 4.5 mm (Figure 1a). The DSD, concentration and turbulence level of the mist cloud were varied by controlling the air injection pressure, the injection time, and/or the orifice diameter. This mist generation system was chosen to mimic industrial pressurized liquid releases and generate sufficient mist concentrations while being well adjusted and convenient to a confined, relatively small, vessel.

Ignition sources

The ignition source proposed by the EN 14034 standard comprises two chemical ignitors, each of 5 kJ. Such ignitor contains zirconium metal, barium nitrate, and barium peroxide. In order to widen the range of ignition energies available, two types of ignition sources were tested: chemical ignitors of energies ranging from 100 J to 10 kJ (Sobbe GmbH) and spark ignition. The high-voltage spark ignition system was developed by the LRGP to test lower ignition energies starting from about 100 mJ. This system consisted of a Brandenburg 3590-1320 DC/DC converter 12 V to 10 kV voltage with a total power of 5 W and a maximum input current of 0.5 mA. The output of this converter is adjustable, allowing the variation of the delivered energy to the mist cloud. Throughout this paper, it will be seen that the choice of the ignition source would depend on the type of liquid tested and the intention of the test. The ignition source, whether chemical or spark ignitors, would be placed in the centre of the sphere and be actuated by a new control system bypassing the standard KSEP control box.

Control and data acquisition unit

A control and data acquisition system was developed by the LRGP allowing to operate under different chosen conditions and to ensure safe manoeuvre. This system was based on a Mbed NXP LPC1768 type microcontroller as well as on a National Instruments NI-USB 6002 acquisition card. A software, specifically developed on LabVIEW, was used allowing the control of the electronic valves, hence the mist injection duration, the ignition delay tv, the actuation of the ignition sources, and the start of the recording system. An electromechanical relay ensures authorization of system operation, only if the sphere's safety switch is closed. As for the data recording, the USB acquisition card allows visualization of pressure data and real-time monitoring of the output signal of the low-energy spark ignition source described previously (current, voltage, and ignition duration values). When performing a sequence, the microcontroller sends a synchronization signal to the acquisition card. For this application, the acquisition frequency was limited to 5000 Hz per channel.

Fuel selection and characterization

Fuels were chosen to cover a wide range of physicochemical properties and of industrial use, as explosive mist atmospheres can occur in a variety of industrial sectors. Following an existing classification [START_REF] Gant | Area classification of flammable mists: summary in[END_REF], five fluids were selected: aviation kerosene jet fuel -Jet A1, diesel, light fuel oil (LFO, Total Energies -CPE), biodiesel (Valtris Champlor) and Mobil DTE VG 68 Heavy Medium. They are all complex high-flashpoint liquids with increasing dynamic viscosity. Ethanol and isooctane, two liquids largely used in numerous chemical processes, were added to this study both for their industrial interest and also their single-components liquids of well-known properties and combustion behaviours. Characterization tests were carried out on all seven fluids under ambient conditions. Viscosity measurements were performed using the Hoeppler Falling-Ball Viscometer (Brookfield KF30 model) according to DIN 53015. In addition, surface tension measurements were performed following the Pendant Drop method. As for the flashpoint, tests were performed using the Setaflash Series 3 flashpoint tester according to ASTM D3278-96 standard. The measured physicochemical properties were determined at ambient temperatures and are shown in Table 1; they may differ from one supplier to another and lead to discrepancies in the release classes (R.C.).

Mist cloud characterization

The mist concentration, the DSD, and the level of turbulence being the most influencing factors on a mist cloud, they have been characterized under different conditions in an identical replica of the 20 L sphere equipped with borosilicate glass windows to allow visual access. The fuel mass injected was weighted systematically, which allows the determination of the mist concentration. Wide ranges of mist concentrations are available, depending on the fluid and nozzle type as well as on the injection pressure. For instance at 3 bar, concentrations up to 600 g/m 3 are attainable with a flowrate that varies between 0.2 and 1.1 g/s. Beyond such concentrations, the rain-out of the fuel at the sphere wall becomes non negligible. Measurements were repeated at least 3 times for each specified injection condition and a precision of ± 0.06 g/s. In addition to the aerosolised liquid, compressed air contributes by increasing the pressure inside the closed vessel. For instance, pressure contribution of 0.04 bar/s (0.55 bar/s) was found with 3 bar (5 bar) injections through a 0.5 mm (3 mm) nozzle.

The seven fluids were all tested using different air injection pressures and orifice diameters. Measurements were performed at the height of the ignition sources using an in-situ laser diffraction sensor (Helos KR/Vario) with an acquisition frequency of 2000 Hz. Droplets diameters as low as 5 µm and as high as 100 µm can be reached with an injection pressure maintained between 2 and 5 bar. Higher droplet diameters are reachable when using the twin fluid external mixing nozzles with a larger orifice diameter, but this study was limited to 3 nozzle sets N1, N' and N2 [START_REF] El-Zahlanieh | A step toward lifting the fog off mist explosions: Comparative study of 3 fuels[END_REF]. A correlation linking the Sauter mean diameter (SMD) to the fluid properties, the release velocity, and the orifice diameter was established using a full factorial design.

The level of turbulence of the mist was also determined by performing particle image velocimetry (PIV) and by calculating the root-mean-square velocity vrms. Results showed that vertical velocity vectors reach 15 m/s during injection with a vrms of 2 m/s with an air injection pressure of 3 bar. Finally, a CFD model based on a Euler-Lagrange approach was developed to study the biphasic flow development inside the test apparatus and assess conditions prevailing to the fragmentation and the coalescence of the dispersed phase.

Test procedure

For every ignition sensitivity or explosion severity test, the following steps were taken. The liquid was prepared and placed in its metallic reservoir. An air injection pressure was then chosen as well as the required injection duration (or mist average concentration). The temperature-controlled sphere was vacuumed to a calculated initial pressure allowing the attainment of an atmospheric pressure after injection. The mist injection was launched and then the chosen ignition source was actuated after a specific delay time. According to the EN 14034 standard, when the observed overpressure Pex (effect of chemical igniters taken into consideration) is greater than or equal to 0.5 bar, an explosion is regarded to have occurred (same criterion for LEL tests).

Exhaust gases were then evacuated, and the sphere was thoroughly cleaned and prepared for the following experiment. dP/dtex is determined by calculating a five-point derivative of the pressure rise. Pmax, dP/dtmax are the highest values of the maximum pressure and rate of pressure rise over a range of mist concentrations.

Calibration and verification: determination of mists ignition sensitivity and explosion severity

Tests were performed thrice with a good repeatability. Figure 2 shows some examples of explosion curves obtained for ethanol mists at various concentrations and for 100 J ignition energy. Pmax reaches 9 barg and a dP/dtmax of 795 bar/s. Verification tests were performed by igniting ethanol vapours and comparing the explosion thermo-kinetic parameters with the literature as well as the CEA NASA program [START_REF] El-Zahlanieh | A step toward lifting the fog off mist explosions: Comparative study of 3 fuels[END_REF]. The results presented here are non-exhaustive and only serve as examples of the possible outcomes of such a test method. It should be highlighted that an extensive parametric sensitivity analysis has been performed, which represents more than 350 explosion tests. The influences of the following parameters were studied: a) the ignition delay time; b) the liquid temperature; c) the sphere temperature; d) the ignition energy; e) the nature of the ignition source; f) the droplet size distribution; g) the mist concentration and h) the nature of the fuel. In summary, the following trends were observed, respectively: a) maximum safety parameters were found at tv = 3 ms after injection. In a conservative approach (worst-case scenario), this delay was usually chosen; b) the thermal equilibrium time of the fine droplets is very small, which highlights the influence of the sphere temperature; c) when increasing the temperature, even below the flashpoint, a significant increase in the explosion severity is observed; d) strong chemical igniters can lead to DSD modification and overdriving; e) the ignition energy and source nature affect the local temperature of the mist and therefore the vapour/liquid ratio; f) the explosion severity globally decreases with increasing droplet diameters; g) maximum of the explosion severity is reached at rather low concentration for volatile fuels, but is harder to identify for fuels with high flashpoint; h) parameters such as the vapor pressure and flashpoint are key elements driving the mist ignitability. Similarly, tests were performed on isooctane mists using two injection pressures. As seen in Figures 4a and4b, the increase of the turbulence level tends to slightly elevate the explosion severity of isooctane mists and decreases their LEL. This shift can notably be explained by the slight decrease in the DSD of the mist cloud, which promotes its ignition sensitivity. For isooctane aerosols, Pmax and dP/dtmax reach 7.8 bar and about 700 bar/s for a fuel equivalence ratio of 1.7. These values are conservative, especially with regard to the results obtained by [START_REF] Yuan | Experimental and thermodynamic study of aerosol explosions in a 36 L apparatus[END_REF] for n-octane for a fuel equivalence ratio of 1: 6.2 bar and 75 bar/s, respectively.

Lower explosive limit

Figure 3a shows the evolution of LEL of some mists at 40°C. Table 2 presents the LEL determined for the fuels at 20°C with 100 J chemical ignitors (5 kJ for biodiesel). It notably appears that the LEL of hydrocarbon mists is slightly greater than the LEL of the corresponding vapours (39 g/m 3 for isooctane and 66 g/m 3 for ethanol).

Minimum ignition energy

Table 3 clearly shows the flammability difference, in particular for the MIE, between the seven fluids tested. Some ignite at energies below 100 mJ, others above 1 kJ. Therefore, the ignition energy should be adapted to avoid overdriving the flame propagation.

Conclusion and perspectives

This study is a step forward towards establishing a standardized procedure to test mist clouds explosions. It proposes a procedure using a single apparatus available in most laboratories, accepted by researchers, standardized, and proven to be versatile. The reproducibility and repeatability of this test method were verified with hundreds of tests. Ignition sensitivity (LEL, MIE) and explosion severity tests were conducted on seven different industrial fluids under varying conditions allowing to compare their behaviour. Tests conditions were adapted to the fluid properties (ease of atomization, flashpoint…). This benchmark will be exploited to classify industrial liquids and help industries to meet requirements for ATEX and DSEAR regulations. Nevertheless, this test method is appropriate for mist explosion testing and adaptable to industrial or conservative conditions. As warned by Eichhorn more than 60 years ago: 'mist can explode', but new assessment tools are now ready!

Figure 1 :

 1 Figure 1: (a) Scheme of the mist injection system, (b) Mist injection system adapted to the 20L sphere, (c) 20L sphere modified for mist testing

Figure 1 :

 1 Figure 1: Pressure-time evolution of ethanol mists explosion (N2 nozzle, injection pressure: 8 bar, T: 27 °C)

Figure 2 :

 2 Figure 2: (a) Variation of the explosion overpressure (b) Variation of the maximum rate of pressure rise of three fuels: LFO, diesel and Jet A1 mists of 8 -10 µm at T = 40 °C (sphere temperature) and Pinj = 3 barFor illustrative purposes, Figures3a and bcompare the evolution of the explosion severity of Jet A1, diesel, and LFO mists generated under the same conditions at 40 °C. These tests show that kerosene mist explosions are much more severe than for LFO or diesel mists. In general, maximum pressures are reached on the tested concentration range, while dP/dtex reaches a plateau for diesel and LFO but continues to increase for Jet A1. Similarly, tests were performed on isooctane mists using two injection pressures. As seen in Figures4a and 4b, the increase of the turbulence level tends to slightly elevate the explosion severity of isooctane mists and decreases their LEL. This shift can notably be explained by the slight decrease in the DSD of the mist cloud, which promotes its ignition sensitivity. For isooctane aerosols, Pmax and dP/dtmax reach 7.8 bar and about 700 bar/s for a fuel equivalence ratio of 1.7. These values are conservative, especially with regard to the results obtained by[START_REF] Yuan | Experimental and thermodynamic study of aerosol explosions in a 36 L apparatus[END_REF] for n-octane for a fuel equivalence ratio of 1: 6.2 bar and 75 bar/s, respectively.

Figure 3

 3 Figure 3: a) Variation of the explosion overpressure and b) variation of the maximum rate of pressure rise of isooctane mists of 8 -10 µm at T = 27 °C and Pinj = 2 and 3 bar (ignition energy: 100 J)

Table 1 :

 1 Physicochemical properties of the seven chosen fluids

	Fluid	Ethanol Isooctane Jet A1	Diesel	LFO	Biodiesel	Mobil DTE
	Density (kg.m -3 )	870	690	850	880	880	920	930
	Dynamic viscosity	1.31	0.45	1.23	2.95	2.88	6.3	154.28
	(mPa.s)
	Surface tension	0.022	0.018	0.026	0.027	0.025	0.031	0.03
	(kg.s -2 )
	Flashpoint (°C)	13	-12	> 38	65	58	250	220
	HSE Release Class -	-	R.C. I	R.C. I	R.C. I	R.C. IV	R.C. III
	R.C.	-	-		More volatile		Less volatile	Less volatile
	(Gant et al., 2016)			/ more atomising	/ more atomising	/ less atomising

Table 2 :

 2 Lower explosive limit of the seven fluids under ambient conditions

	Fluid	Ethanol	Isooctane	Jet A1	Diesel	LFO	Biodiesel*	Mobil DTE
	LEL (g.m -3 )	77	64	94	123	113	103 (5 kJ)	No ignition

Table 3 :

 3 Minimum ignition energy of fuels under ambient conditions and a droplet size of about 8 -10 µm

	Fluid	Ethanol	Isooctane	Jet A1	Diesel	LFO	Biodiesel	Mobil DTE
	MIE (J)	< 0.1	< 0.1	0.2	0.3	0.3	5000	> 10000

Acknowledgments

This work was supported financially by the French Ministries for the Ecological and Solidary Transition and for Higher Education and Research. The authors thank Total Energies for LFO and Valtris Champlor for biodiesel.


Jean-Christophe Le Coze
email: jean-christophe.lecoze@ineris.fr

Thomas Marcon

Agnès Vallée

François Massé

Emmanuel Plot

Chabane Mazri

Marine Boutillon

Risk Analysis: Challenges and Perspectives

. Drawing on work in science and technology studies (STS), many authors emphasise the subjective, constructed and historically situated nature of risk analysis as opposed to a vision that would be objective and purely rational, detached from contexts. This methodological, reflective and critical knowledge is particularly important in a context of major global changes (Le Coze, 2020). In France, RA is framed by regulations which require operators to produce a safety case. The AZF accident (2001) changed the regulations (Bachelot law of 2003) integrating the probability and greater consideration of the territories and their issues through consultation mechanisms. For the past ten years or so, there have been few developments or questioning of these post-AZF developments. However, RA are confronted with new changes, this time no longer regulatory but digital and environmental. These changes tend to modify the threats, vulnerabilities, expectations and objectives of RA. The purpose of this text is to explore this new context. In the first part, critical work on RA is introduced in order to consider its limits. This clarification is followed by a presentation of initiatives that develop new perspectives on RA then by a discussion.

Risk analysis, an analysis from a STS perspective

In recent years, social sciences and philosophy have explained that RA is not an objective practice, but a construction whose limits are intrinsic [START_REF] Jasanoff | Bridging the two cultures of risk analysis[END_REF]. RA depends on the knowledge available, the models used, the choices on the parameters, the expertise mobilized when identifying the scenarios, etc. However, this assertion that RA is constructed and not purely objective, perfectly accepted from a research point of view, is regularly a source of tension. After Fukushima, a series of arguments were advanced to preserve RA's rationality [START_REF] Downer | Disowning Fukushima: Managing the Credibility of Nuclear Reliability Assessment in the Wake of Disaster[END_REF]. First, the accident took place because the event fell outside the design provided for by the RA. The 20m wave was well outside what was admitted as possible, and without the wall, the damage would have been much greater. Second, if the accident occurred, it is because the engineers who made the calculations were wrong, and their errors are not representative of the industry, whose standards are higher than those observed in this accident. A third rhetoric relates to the lack of compliance of the company in question (here Tepco for the Fukushima plant). The validity of the calculations are not intrinsically challenged because the operators did not do what was expected of them, thus distorting the calculations, which remain valid. Finally, the last rhetoric, if the accident did happen, it is indeed important to learn the lessons so that it does not happen again. The design and calculations must therefore incorporate this experience feedback to be more able to comply with the reality of the risks. In other words, the AR is improving. These four arguments help soften the criticism that RA are not objective. However, for each of them, it is highly questionable. Let's go through them, one by one. A scenario beyond design of what was planned is indeed proof of the limits since it amounts to admitting that the RA did not take this possibility into account, for various reasons. The approach is therefore not objective and contains an element of subjectivity. Calculations errors by engineers who would in practice be unrepresentative of the profession is a possibility, but Japan was until then considered to be at the forefront (with plants based on American designs). The lack of compliance of the operator with what was planned tends to protect RA but also exposes its limits. If RA only considers an ideal that is unrealistic given the concrete operational realities of systems, then such limitations are intrinsic. Finally, if RAs need to learn from their failures, the question remains whether this learning cycle remains an endless one, because the mistake of the past is unlikely to be the mistake of the future. Protecting the plant better against a tsunami will not help against a meteorite or cyber attack. From Downer's insights based on these 4 arguments, we can retain four limits of the AR: the intensity of scenarios (1), the limits of probability calculations (2), the question of the compliance of practices with the expectations of the AR (3) and finally the endless learning quest (4). This subjective side, or constructed approach to risk analysis makes a lot of sense in current evolutions in the context of safety critical industry and includes issues of cybersecurity, alignment of RA with practices, natech, domino effects or environmental consequences of major events.

Risk Analysis Challenges

Digitalisation and cybersecurity

Today's control systems, developed in the era of Industry 4.0 and Industrial Internet of Things (IIoT), are highly digitalised and connected systems. They rely on communication technologies similar to those found in the IT systems with which they are interconnected. These systems, which have an action in the physical world, manipulate more and more data. They are therefore subject, like all sectors of activity, to more and more cyber attacks. A study by the French Senate shows a multiplication by 4 of ransomware targeting companies in the first half of 2021 compared to the first half of 2020. These attacks can have direct or indirect physical consequences on populations, production assets or the environment. This context leads us to consider cyber threats in the overall analysis of the risks that industrial facilities present to people and the environment. Well-defined regulatory frameworks, standards and methods exist for the analysis and control of accidental risks, but they are not adapted to the consideration of cyber security. Indeed, the assessment and control over time of risks linked to known accidental phenomena, or at least for which we assume that knowledge is progressing, and risks linked to a conscious and evolving threat are fundamentally different. In addition, the safety of industrial installations only partially takes into account the ICS: the analysis is limited to sensors, actuators and logic controllers (PLCs) whose failures are identified as causes of major accident scenarios or to safety PLCs which operate as risk reduction measure on these scenarios. Finally, accidental RA focuses on the major risks to people, while cybersecurity must also take into account attacks on the availability of production systems and data confidentiality. On the basis of the risk analysis and assessment -which allows the identification of attack or accident scenarios and the evaluation of their severity and likelihood -technical, human and organizational measures must be implemented to maintain the operation of the installation within the framework defined during the risk analysis. Here again, the control of accidental risks and cybersecurity risks are different: in the first case, the aim is to verify that the hypotheses used for the analysis are verified in the field and that there is no deviation in the set of elements identified for the control of risks; in the second case, it is also necessary to be able to take into account the evolution of the threat, for example by monitoring the publication of vulnerabilities in equipment or software integrated into the industrial control system. To take into account these new challenges, INERIS has developed a general methodology for the combined analysis of cybersecurity risks and major accident risks. The objective of the approach is to identify attack scenarios with potentially serious consequences for people and the environment. It allows to take into account the physical process and the occupational risk in an extended way in a cybersecurity approach. This approach is based on the coordination of existing methods for the analysis of accidental risks on the one hand and the analysis of risks linked to cyber security on the other: an analysis of physical risks for people and the environment, derived from Preliminary Risk Analysis methods, whose scope of analysis is extended to take into account the specificity of scenarios related to attacks on the industrial control system [6], and an approach derived from computer security focused on the identification of scenarios that may have physical consequences. The articulation of these two approaches leads to a unique representation model called AT/BT (Attack Tree / Bow Tie) [START_REF] Kriaa | A survey of approaches combining safety and security for industrial control systems[END_REF]. This articulation requires the use of new skills, linked to computer security, during the risk analysis of an industrial installation to extend the scope of the analysis. This can cause practical difficulties, as the principles, vocabulary, metrics and objectives can sometimes diverge. The common analysis framework between safety and security allows to deal with these antagonisms, to enhance the mutual reinforcements and to reach a more complete vision of the risks generated by hazardous industrial installation [START_REF] Massé | Comment intégrer les cyberattaques dans l'évaluation globale des risques pour les installations classées? Proposition d'un cadre général d'analyse des risques[END_REF]. This new analysis framework introduces new complexities and requires a systemic vision of the installation. Moreover, the control of cybersecurity relies on a permanent monitoring of the threats and vulnerabilities related to the equipment and software used. Digital tools for system description, risk analysis and operational monitoring are necessary to reach these objectives. Ineris' developments on digital management of RA presented in the following paragraph could help to address these new issues.

Digitalisation and RA Management

Since 2014, INERIS, with several industrial partners, has been developing an approach on the use of digital technology to improve RAs and their uses. The idea is the following. The more RAs are integrated into operational safety practices, as close as possible to the installations, the more they will be able to improve by coming into contact with the empirical knowledge of operators (design, maintenance, production, logistics, etc.). At the same time, the more the RAs can be criticized and amended, the more they will be able to blend in with the subtleties of singular realities, and the more they will be able to help operators in their daily decisions. Understood as a subjective intellectual construct, RAs face a well-known challenge in management science being the one of actionability. Said simply, actionability refers to the extent to which a knowledge produced by or for an organization is implementable by the intended final users [START_REF] Antonacopoulou | Actionable knowledge[END_REF] in a way that improves their ability to carry their tasks. The question is how to do this? Information technology can help to link and develop safety reports and operational documents (procedures, operating methods, records, etc.). Let's take the example of the management of level detectors for hydrocarbon storage tanks. Several dimensions are to be articulated:

• Regulatory requirements • The RA which specifies:

-The functions performed by these detectors within a barrier, and the critical nature of their proper operation given the overall safety architecture -The requirements specific to these detectors, which must be respected to qualify them as reliable technical elements • The management rules for these detectors, throughout their life cycle • Evidences of compliance with these rules • Learning from events • Management of change The computer tool can facilitate qualitative checks, checks on overall consistency, by facilitating rapid navigation between all these dimensions, to enable the following questions to be answered. Is the response time of the detectors, specified in the analysis of the safety barrier, considered in the choice of equipment? And in the monitoring program? And in the training of the operators in charge? Does the operational management ensure a satisfactory control of all the requirements of the barrier? The IT tool can facilitate quantitative inputs, for example, verification that, over a given period, maintenance actions not carried out or possible malfunctions of the detectors do not jeopardize the achievement of an acceptable criticality from the point of view of accidental and chronical risks. The IT tool can also facilitate the management of modifications, allowing easy navigation in the history of safety cases and operating documents, in order to prepare and trace modifications. For the study and management of a single detector, IT is not useful (it would even be counter-productive). But when you have to manage dozens of detectors, with specificities linked to contexts of use, with dozens of studies, dozens of procedures or operating modes, and hundreds of annual records... and when you have to manage thousands of pieces of equipment... paper documents obscure readability, controls and traceability. And then, what could be better than to be able to go to the field with a tablet providing the history of the data on the equipment, as well as the procedures and the related RA, and the possibility of entering, directly, in the right place in the computer system, the results of the controls, and to record photos showing the compliance or the possible defects? From this point of view, in no case does the computer system replace the safety case or the operational documents. It only facilitates the control of their coherence, and thus their elaboration. This point is important, because it specifies the scope of the tool, its added value, but also the pace of its implementation and evolution. The use of the IT tool, on which INERIS is currently conducting its operational research moves towards an improvement of safety management.

RA and Natech

Climate change is another category of change along with the digital which requires reflection on the adaptation of RA. The impact of natural hazards on technological risks (Natech) has been a growing concern for several years now, in a context that has resulted in extreme weather phenomena in certain regions of the world. Like the WHO, which in a recent report underlined the increase in the frequency and intensity of natural disasters as a consequence of climate change, many international bodies, such as the OECD and UNECE for example, have taken up the issue to alert public decision-makers and risk managers. Although relatively dated studies have shown that Natech accidents constitute only 5% of industrial accidents reported in accident databases [START_REF] Rasmussen | Natural events and accidents with hazardous materials[END_REF] this value is probably underestimated because some minor events are not counted [START_REF] Moreno | Analysis of Past Accidents Triggered by Natural Events in the Chemical and Process Industry[END_REF] In view of the increasing trend of climatic disasters, the occurrence of Natech accidents will probably increase accordingly [START_REF] Mahan | Managing the risk associated with severe wind and flood events in the chemical processing industries[END_REF]. This global trend does not spare French industrial sites since, as BARPI points out in its inventory of technological accidents in 2018, 107 of them were impacted by natural phenomena (rain-flooding, lightning, strong heat and intense cold), which represents almost 9% of the events recorded in the ARIA database, on the same perimeter and in the same year. In this same report, BARPI also indicates that since 2010, the number of meteorological events impacting industrial sites in France has been constantly evolving, underlining to a certain extent the increase and intensity of these phenomena. The prevention and control of industrial risks is based on a risk analysis that must take into account both the risks intrinsic to industrial installations and the potential aggressors linked to the local context of the site, whether man-made or natural. Unlike the risks inherent in the production tool, which since 2003 have had to be quantified in terms of probability, the French regulations currently in force authorise special treatment for certain natural events and thus allow:

• to exclude certain external and extreme initiating events (e.g. flooding greater than the reference flood according to the rules in force, climatic events of greater intensity than historically known or foreseeable events that could affect the installation, according to the rules in force, etc.) • not to consider certain natural events in the probabilistic quantification of major accidents if the associated regulatory elements or good practices are respected (e.g. the case of flooding if the industrialist provides justification for the sizing of these installations for their protection against the reference flood (as defined, for example, to date in the guide to flood risk prevention plans (PPRi) of the Ministry of Sustainable Development)) The intensification of certain natural events, in terms of frequency and amplitude, raises the question of whether such a position should be maintained in future RA. Indeed, do the reference levels used in the existing Natural Risk Prevention Plans (PPRN) take into account the increase in these phenomena? If, since 2011, the Natural Coastal Risk Prevention Plans (PPRL) have had to include a level surge in the definition of the reference level to take into account the increase in sea level linked to climate change, is this also the case for the other flood management plans at the territorial level? Are we able to predict the intensification of climatic events sufficiently to define a reference level in the case of phenomena that are, in essence, extreme? Are the accidental sequences identified for foreseeable floods still relevant in this type of situation? It is on the basis of the previous work carried out and driven by these questions that Ineris is continuing its work to take better account of Natech in the analysis of the risks of industrial systems.

RA and Environmental consequences

In the current context of climate change beyond the natech concern developed in section 3.3, loss of biodiversity and the collapse of living populations. A reflection is in progress concerning safety cases, to evaluate the severity of a potential industrial accident on the Environment. The Seveso III Directive aims to "prevent major accidents which could have possible consequences on industrial activities and to limit the consequences for human health and the environment". However, French regulations mainly focuses on the number of humans affected (see the definition of the effect thresholds in the decree of September 29, 2005). To our knowledge, there is no national rule for estimating environmental severity. Ineris aims to develop a method that allows any voluntary industrialist to estimate the environmental consequences that a potential accident could have on their site. The method follows the different stages of the hazard study so that it can be easily integrated into it. However, it must be self-supporting so that an operator of a site not subject to safety case can also use it. The method's guideline is quite simple: hazardous substances present on the site could, due to an accident (pipe leak, fire, retention bowl overflow, explosion, etc.) be transferred outside the site and impact receptors. However, from these first three stages, technical difficulties emerge. Hazardous substances properties are defined through their flammable, explosive, toxic, infectious nature, etc parameters. If these properties vary with the substance phase (aqueous, solid, gaseous), then possible phase evolution during transfer has to be taken into account. Toxical properties and threshold are deeply linked on the species used for the experiment (which are not necessarily the species impacted by the substance when the accident occurs). Besides, reactions between the substance and the crossing medium can occurs, eventually leading to formation of secondary products with own hazardous properties. According to the accidental scenario, transfer routes can be multiple: fumes (particles in the air), cloud (substance in gaseous form), watercourses (solid substance dissolved or transported in small particles, liquid substance), elution in soils (liquid or solid substance dissolved or transported in small particles), etc. The extent then depends on an infinite number of parameters: meteorological conditions, type of soil, characteristics of rivers, substance density, etc. At this stage, we come up against the limits of current scientific knowledge (eg: the elution of pesticides is not yet systematically known).

Identifying and prioritization of sensitive issues is also complex. Defining all the receivers present within a given area is nearly impossible and selecting the species of interest for the study (eg: protected or threatened species) raises ethical questions. Not less questionable is to choose for a more macroscopic scale taking into account only protected areas, national reserves, etc. Indeed, can we only estimate the tonnages of dead animals and hectares of vegetation, as is frequently done in post-accident situations? Consideration of resources also comes with a lot of questions: What and how resources should be taken into account (eg does polluted agricultural land translate into the number of unemployed farmers or should we consider the degradation of this artificialized living space in a different way?). Another way of thinking could be considering the Environment's resilience. Then come the issues relating to scoring and the determination of severity, or even acceptability. On this point, a benchmark of the methods developed elsewhere at the international level is in progress. In order to enrich the RA usually carried out in hazard studies by integrating the effective preservation of the environment, it emerges that technical and scientific obstacles will have to either be removed or be the subject of approximations. Likewise, the method raises ethical questions and consensus must be found. The advantages of this method are multiple: easily integrated into the RA approach with which engineers in industries are familiar, an educational communication tool, and support for continuous improvement for the preservation of biodiversity.

RA and Dominos effects

The last theme to consider is domino effects. Good knowledge of domino effects and their control is a real issue both within an industrial establishment and within industrial zones, where several installations or establishments using hazardous substances are close. Accidents involving domino effects are indeed among the most destructive and can cause serious consequences for people, buildings / infrastructures or / and natural environment in the vicinity of the installations. As proof, reference should be made to the accidents of Feyzin (1966), San Juan in Mexico (1984) andTianjin in China (2015). Domino effect is the action of a dangerous phenomenon (thermal effect, overpressure and projection) occurring on a first equipment, impacting a second equipment and causing a second dangerous phenomenon on the latter equipment, causing an aggravation of the consequences generated by the first equipment. For more than ten years, methodological developments have been undertaken by Ineris to integrate domino effects into the risk analysis of industrial processes. More extensive work has been carried out on the resistance of structures to accidental aggressions. Ineris has developed a method for evaluating domino effects. The process for domino effect sequences analysis consists, first of all, in identifying aggressive industrial equipment likely to cause dangerous such as fires, explosions and causing damage to other equipment located nearby, as well as industrial equipment likely to be attacked and which in turn could lead to dangerous phenomena. The possible domino effect sequences are then determined by crossing the intensity of the effects of the dangerous phenomena that occur on the aggressive equipment and the vulnerability of the receiver equipment. To do this, standard equipment vulnerability thresholds can be used, as a first approach (for example, the domino effects thresholds of 8 kW/m 2 for thermal effects and of 200 mbar for overpressure). But it is also possible to make a more complex analysis based on charts or more precise models of the behavior of the attacked equipment according to the characteristics of the potential accidental aggressions. This step is crucial in the identification of domino effect sequences, but currently, it is based, in the majority of cases, on the standard thresholds. The numerical data for assessing more precisely this vulnerability, according to the type of equipment studied, are still little available and used. The risk associated with each of the domino effect sequences can then be characterized by determining the severity of the consequences and the probability of occurrence of the accidents. The positioning of the different accidents in a gravity / probability crossover grid will make it possible to judge the assessment of the domino effect sequences, and to initiate, if necessary, a risk reduction process. For unacceptable sequences of domino effects at first glance, it may be necessary to have a new RA by refining the hypotheses for the assessment of vulnerability or the assessment of thermal or overpressure effects for example and / or by studying the measures put in place or to be put in place to reduce the risks (safety barriers, etc.). In addition to the risk assessment process, identify potential domino effects can be very interesting in the context of drawing up emergency plans for industrial sites, because it is useful to establish priority in the actions to be taken during the accident. The notion of dynamics, i.e. the time for a first dangerous phenomenon on a equipment to lead to other dangerous phenomena on neighboring equipment, also takes on its full meaning here but is difficult to assess. The analysis of domino effects can be complex when the number of installations and dangerous phenomena to be analyzed is large, hence the need for tools to automate certain steps of the process.

Discussion

One aspect which emerges of this study is the systemic nature of these threats. Cybersecurity requires maintaining an overview of the facilities because attacks are likely to simultaneously affect all prevention and protection devices (up to emergency resources). Likewise, natechs (e.g. a flood) potentially expose an entire industrial site almost simultaneously rather than part of it (just as they can thwart emergency response). For these two themes, domino effects are also at the heart of this systemic dimension. Seeking to anticipate the interaction of several equipments and phenomena more or less concomitantly is at the heart of domino effects. If we add to this theme the question of environmental consequences, we also see that the systemic dimension of the challenge expands. Taken together, these themes show the interest of questioning the evolutions of RA and the limits thereof, in a context of change.

Conclusion

This article questions the evolution of RA in France. It introduces works questioning the limits of RAs, showing that they are based on choice of scenarios, causality models and calculation principles which are always questionable. These limits challenge the nature and extent of potential adjustments to current RA practice and use. Several questions can be asked following the presentation of the different themes (cybersecurity, natech, digital management, domino effects and environmental consequences). A first point to note is that the themes addressed cover several of the limitations identified by [START_REF] Downer | Disowning Fukushima: Managing the Credibility of Nuclear Reliability Assessment in the Wake of Disaster[END_REF]. The type and intensity of scenarios ( 1) is dealt with by domino effects and environmental consequences (sections 3.4, 3.5). The problem of probability calculation (2) and compliance (3) are covered by the digital approaches (sections 3.2). Finally, the limits from the perspective of new scenarios (4) are addressed by the themes of cybersecurity and natech (sections 3.1, 3.3).


Sylvaine Pique
email: sylvaine.pique@ineris.f

Sebastien Quesnel

Benno Weinberger

Quentin Nouvelot

Deborah Houssin

Elena Vyazmina

David Torrado

Ju Lynne Saw

Preliminary Risk Assessment of Hydrogen Refuelling Stations in a Multifuel Context

The MultHyFuel Project [1], funded by the Fuel Cells and Hydrogen Joint Undertaking (FCH JU), aims to achieve the effective and safe deployment of hydrogen as a net-zero alternative fuel, by developing a common strategy for implementing Hydrogen Refuelling Stations (HRS) in multifuel context. The project contributes to the harmonization of existing regulations code and standards (RCS) for industrial applications by generating practical, theoretical and experimental data related to HRS, embedding regulatory and industrial stakeholders to the project progress. This paper presents a preliminary risk assessment performed for three different hydrogen refuelling configurations, presented in project Deliverable 3.1 [2], each intended to be integrated into a multifuel station. In terms of the hydrogen refuelling configurations, we discuss the following points:

• detail on typical components of hydrogen refuelling stations, such as compressor, high pressure buffer storage, cooling system and dispenser, • different modes of supply of hydrogen (high-pressure storage (trailers or bundles), hydrogen production by electrolysis, and stationary liquid hydrogen storage), • different operating conditions of the dispenser -i.e. flow and pressure -but only delivering compressed gaseous hydrogen. The objective of this preliminary risk assessment is not limited only to the identification of the major hazardsand the consideration of various prevention and protection measures specific to the hydrogen installation -but also, the mitigation measures to limit the potential of domino effects due to the potential hazards from other fuels within the multifuel refuelling station. In this preliminary risk assessment, Hazards Identification (HAZID) for hydrogen was implemented following the three steps below:

• the description of typical HRSs,

• the characterization of the potential hazards (substance, process...),

• and a previous H2 facility incident review to formulate lessons learned. This example preliminary risk assessment illustrates how potential major accident scenarios were identified, and presents proposed prevention or protection measures in order to reduce the occurrence of these scenarios and mitigate the escalation of hazardous events". In addition, some prevention and protection measures were recommended when it was not possible to determine if they were universally implemented in Hydrogen Refuelling Stations. Finally, knowledge gaps for the determination of Hazardous Area Classifications, likelihood of hydrogen leaks and extent of consequences were highlighted, in order to be analysed and investigated experimentally within future steps of the MultHyFuel Project [1].

Introduction

The MultHyFuel Project [1], funded by the Fuel Cells and Hydrogen Joint Undertaking (FCH JU), aims to achieve the effective and safe deployment of hydrogen as a net-zero alternative fuel, by developing a common strategy for implementing Hydrogen Refuelling Stations (HRS) in multifuel context. The project contributes to the harmonization of existing regulations, standards and industry codes by generating practical, theoretical and experimental data related to HRS, embedding regulatory and industrial stakeholders to the project progress. In order to achieve these objectives, this project will develop good practice guidelines that can be used as the basis of a common approach to risk assessment for addressing the safe design of HRS in a multifuel context. Different configurations are defined in order to assess the risks in the vicinity of different conventional fuels and for various supply chains options for hydrogen. Using relevant risk assessment techniques, combined with the data from experimental programs provided by the project, risks will be assessed, considering the additional control/mitigation methods that could be expected to be used in hydrogen dispensers. This project will investigate whether any of these measures should be recommended, and if any of the measures should have priority compared to the others. One of the first steps of the project is to achieve a preliminary risk assessment on HRS for three different configurations in order to have an appreciation of the main major hazard scenarios implemented in a more conventional multifuel station considering the whole of alternative fuels and energies for light and heavy duty vehicles (LDV, HDV).

Methodology

Firstly, a benchmarking of risk assessment methods and tools for hydrogen applications, allowed selecting the HAZID (Hazard identification) as the approach to achieve a preliminary risk assessment of hydrogen dispensers in a multifuel environment. Simultaneously, a state-of-the-art review of the technologies on fuel stations was conducted in order to define the most representative configurations for the project. The following steps were followed in order to achieve the preliminary risk assessment:

• definition of methodology to conduct the risk assessment, including the definition of risk matrix and categories for likelihood and consequences, • characterization of the potential hazards from materials (H2, gasoline, natural gas, LNG, LPG…) and process related, • analysis of the lessons learned from past accidents on H2 and conventional fuel stations available in openaccess databases, • HAZID workshops for critical discussions of the three configurations,

• results of the HAZID (the identified hazards, the potential safety critical scenarios and the recommendations on mitigation measures to improve the safety of hydrogen refuelling stations. A statistical analysis was conducted with hazards identified from lessons learned to find out:

• which piece of equipment is most frequently mentioned for major hazards or highest risk ranked scenarios,

• what would be the main causes and consequences of accidents in conventional filling stations. The HAZID method was achieved through working groups and applied on the three configurations presented in the next section.

Presentation of configuration studied

The MultHyFuel Project studied three different configurations, see for more details [2] :

• the first configuration, called "Ready-to-deploy multifuel station" aims to provide hydrogen for vehicles with hydrogen supplied -gaseous -by trailers or bundles, • the second configuration, called "On-site H2" aims to provide hydrogen for vehicles with an on-site gaseous hydrogen production by electrolysis, • the last configuration, called "High capacity multifuel refuelling station" aims to provide a large amount of hydrogen supplied by stationary liquid hydrogen storage. The main equipment on each configuration are summed up in the table hereafter.

Config. 1 X X X X X X Config. 2 X X X X X X Config. 3* X X X X X X X *
The production, liquefaction and delivery process have not been included in configuration 3. Liquid hydrogen stored in a stationary vessel was considered, refilled by a liquid hydrogen trailer by bunkering

Potential hazards

The main hazard potentials are linked to:

• the substances: hydrogen, oxygen, the other fuels (gasoline, LPG, CNG…) on refuelling stations or the other substances present in the installations, such as catalysts or zeolites for the purification of H2 after electrolysis, oil in compressors or coolant in the exchanger; • the process and equipment summarised in Table 1.

An analysis of these elements highlights the following potential hazards on hydrogen equipment:

(ATEX) formation inside equipment X X X X X X X X Loss of containment X X X X X X X X X X Release at vent line or TPRD X X X X X X X X X Equipment burst X X X X X X X X X
6. Lessons learned on hydrogen refuelling station and related equipment

Hydrogen refuelling stations

Data on hazardous scenarios have been collected from different sources [3] [4] , enabling a statistical review of the lessons learned for the HRS. The purpose of the statistical analysis was to know which equipment is the most frequently involved in accidents and what would be the main causes and consequences. Hence, thanks to the analysis, we observed that pipework and valves, dispensers and filling hoses, compressors, and tube trailers are the types of equipment that are the most commonly involved in hydrogen accidents. Electrolysers can also generate specific scenarios such as internal explosion according to the few lessons on this equipment [4]. These accidents are most frequently caused by equipment or component failures related to human error (e.g. design flaw or manufacturing error, lack of process control, or maintenance error). Finally, hydrogen accidents do not always involve ignition, but if these leaks get ignited, explosions or fires can occur. Finally, some recommendations on safety measures are provided by the EHSP report [5]. For example, it is recommended to have periodic training of personnel, leak detection, adequate Explosive Atmosphere (ATEX) zoning and to keep the equipment and systems up to date and clean with appropriate inspection and maintenance.

Conventional refuelling stations

Data collected from [3] enabled to set up a statistical analysis on the lessons learned for gasoline, diesel and LPG refuelling stations. Additional potential critical scenarios for LNG and CNG refuelling were identified from HAZOP studies held by MultHyFuel partners on such stations. We observed that irrespective of the fuel types in a conventional fuel station, the storage would be the piece of equipment that would be involved in most of the accidents especially due to the filling operations. Nevertheless, these conventional fuel storages such as gasoline are usually underground thus it limits the impact or domino effects between the fuel storages.

In addition, equipment failure would be the cause of accidents that is mentioned the most frequently for all the mentioned fuels in a conventional filling station. Other causes such as external aggressions and operating errors would also be the sources of an accident. Besides these, maintenance and supply operations also appear as common causes of the analysed accidents, and hence it is recommended that operators pay a careful attention to them. Finally, some recommendations on safety barriers are given in ARIA's report regarding accidentology on filling stations from 1958 to 2007 [3]. For example, it is recommended to install leak detection systems and appropriate means of containment in case of discharge.

Results of HAZID

HAZIDs were conducted for each of the three configurations. The results are presented in the following sections by describing potential causes, dangerous phenomena and identifying safety barriers.

Causes

The main root causes identified from the HAZIDs are summarized below:

• equipment and/or instrumentation failure (erosion, corrosion, metal embrittlement due to hydrogen, welding failure, cycle fatigue, vibrations), • human error due to maintenance (check not done, parts missing, inadequate sealing, non-compliance of screwing procedures...), • domino effects due to overpressure (projection, for example) or fire due to other fuels, • blockage of discharge lines, downstream valve or vent, • impact like crash, dropped objects, • back flow between equipment with different pressures, • presence of air in equipment during transient phases (start/stop) that can lead to Explosive Atmosphere (ATEX) scenarios, • natural hazards, • malicious acts.

Dangerous Phenomena

The main Dangerous Phenomena (DPh) were identified and listed by equipment hereafter for each configuration.

Figure 1 :

 1 Figure 1: Example of the studied configuration (configuration 1)

Table 1 :

 1 Main equipment on each configuration

		Hydrogen supply				Process steps		Refuelling
	Trailers	Bundle	PEM Electrolyser	Stationary liquid	storage	Cryopump	Vaporizer	Compressor	Buffer storage	Heat exchanger or	Cooling system	Dispenser

Table 2 :

 2 Potential hazards by equipment

		Hydrogen supply		Process steps	Refuelling
	Trailers	Bundle	PEM Electrolyser	Stationary liquid	storage	Cryopump	Vaporizer	Compressor	Buffer storage	Heat exchanger or	cooling system	Dispenser

Acknowledgments

This work has been achieved in the framework of a project which has received funding from the Fuel Cells and Hydrogen 2 Joint Undertaking under Grant Agreement ID: 101006794. We thank all partners of the MultHyFuel project (https://multhyfuel.eu/) for their contribution to this work, namely: Air Liquide, ENGIE, HSE, Hydrogen Europe, INERIS, ITM, KIWA, Shell, SNAM, and ZSW.

Table 3: Dangerous phenomena identified for each hydrogen refuelling station configuration

Dangerous phenomena

Configuration #1 Configuration #2 Configuration #3 Jet fire X X X Flash fire X X X Vapour Cloud Explosion (VCE) X X X Unconfined Vapour Cloud Explosion (UVCE) X X X Burst (e.g. physical explosion inside the equipment or overpressure or thermal aggression) X X X Asphyxiation (no ignition) X X X Cryogenic risks X Liquid H2 pool fire X Whipping of hose X X X Unexpected fire due to over oxygenation X

Recommendations

Many recommendations were identified during the HAZIDs and the main topics are detailed below with some examples of prevention and protection barriers.

Conclusion

The MultHyFuel Project aims to achieve the effective and safe deployment of hydrogen as a net-zero alternative fuel, by developing a common strategy for implementing Hydrogen Refuelling Stations (HRS) in a multifuel environment. In this framework, a HAZID study has been conducted for three HRS configurations supplied by gaseous or liquid hydrogen.

This analysis benefited from a review of lessons learned from different accidents records for HRS and conventional filling stations. As a result, major hazard scenarios as well as a list of preventative, control or protective barriers against these scenarios were identified for HRS intended to be integrated with conventional and alternative energies filling stations.

Highlights of the risk analysis

During the HAZID sessions of configurations #1, #2 and #3, the following Dangerous Phenomena (DPh) were identified: jet fire, Flash fire, Vapour Cloud Explosion (VCE), Unconfined Vapour Cloud Explosion (UVCE), Burst (e.g. physical explosion due to overpressure), Asphyxiation (no ignition) and Other DPh (i.e. whipping of hose, cryogenic risks, unexpected fires due to oxygen enrichment…).

The HAZIDs have led to the formulation of a list of 258 DPh to be studied in a dedicated and upcoming Task of the MultHyFuel Project entitled 'detailed risk assessment'. In addition, a list of preliminary recommendations of safety barriers for the prevention and mitigation of these DPh have been identified. These recommendations are set to be input into several tasks of the project and will be checked on for completeness and practicability in the final stages of the project. The following points of the recommendations are highlighted:

• technical safety barriers (flame and H2 detection with emergency shutdown ESD) shall be installed due to the fast kinetics of the DPh, • isolation systems (e.g. break-away, shut-off valves) shall be installed to reduce the H2 inventory released in case of loss of containment, • a smart review of the layout of equipment shall be carried out to avoid/minimize domino effects, • a systematic materials selection process shall be implemented to guarantee hydrogen compatible systems,

• the definition of a maintenance regime and periodic control plan shall be conducted for H2 equipment.

Next steps

The 258 DPh identified during the preliminary risk assessment need to be studied in detail in the next tasks within the MultHyFuel project in order to:

evaluate the severity by consequence modelling and estimate the likelihood -when possible -of these scenarios (MultHyFuel "Detailed risk assessment" Task), -identify which scenarios and related safety barriers are critical (MultHyFuel "Identification of critical scenarios" Task) and require experimental tests (MultHyFuel "Experimentation" Work Package), -study the potential domino effects on the dispensers. Based on these upcoming assessments and experimental programs, the MultHyFuel Project will develop good practice guidelines that will be easily understandable and can be used as a common approach to risk assessment for addressing the safe design of HRS in order to support the deployment -in suburban and urban areas, for light and heavy-duty vehicles -of numerous multifuel stations offering conventional and alternative energies to gradually move towards a net-zero mobility.