E Noret
email: noret@phimeca.com

G Prod'homme
email: gaetan.prodhomme@ineris.fr

T Yalamas

M Reimeringer

J- L Hanus

D-H Duong

Safety of atmospheric storage tanks during accidental explosions

Keywords: domino effect, blast, impact, atmospheric tank, reliability, sensitivity analysis. MOTS-CLÉS : effet domino, explosion, impact, réservoir, fiabilité, analyse de sensibilité

The occurrence of a chain reaction from blast on atmospheric storage tanks in oil and chemical facilities is hard to predict. The current French practice for SEVESO facilities ignores projectiles and assumes a critical peak overpressure value observed from accident data. This method could lead to conservative or dangerous assessments. This study presents various simple mechanical models to facilitate quick effective assessment of risk analysis, the results of which are compared with the current practice. The damage modes are based on experience of the most recent accidents in France. Uncertainty propagation methods are used in order to evaluate the sensitivity and the failure probability of global tank models for a selection of overpressure signatures. The current work makes use of these evaluations to demonstrate the importance of a dynamic analysis to study domino effects in accidents.

RÉSUMÉ. L'occurrence de réaction en chaîne, dite réaction par effets dominos, sur les réservoirs de stockage atmosphérique suite à une explosion accidentelle dans les installations pétrochimiques est difficile à prévoir. La pratique actuelle française pour les installations SEVESO consiste à ignorer les projectiles et à assumer une valeur de surpression maximale admissible pour les effets de souffle. Cette méthode est susceptible de conduire à des évaluations conservatrices ou dangereuses. Cette étude présente divers modèles mécaniques simples pouvant permettre une évaluation efficace et rapide des risques d'effet dominos. Les modes de comportement des réservoirs sont basées sur l'expérience des plus récents accidents en France. Plusieurs méthodes de propagation des incertitudes sont utilisées afin d'évaluer les sensibilités et la probabilité de défaillance des modèles de réservoir pour une sélection de signaux de surpression. L'étude aboutie sur la sélection de paramètres et de modèles dynamiques pertinents pour l'étude des effets dominos.

Introduction

Many severe accidents have occurred as a result of blast from one equipment causing multiple secondary fires [START_REF] Barpi | Explosion de gaz dans les unités craquage catalytique et gas plant d'une raffinerie -La mède[END_REF] [START_REF] Barpi | Explosion d'un nuage dérivant issu d'une capacité contenant des effluents chargés en hydrocarbures -Italie[END_REF], vapour cloud explosions (A.g.r., 2007) [START_REF] Evanno | Expertise des explosions survenues le 03/09/01 dans le parc de stockage d'alcool des installations de Sucreries Distilleries des Hauts de France à Lillers[END_REF] (CSB, 2005) or container explosions [START_REF] Barpi | Explosion d'un nuage dérivant issu d'une capacité contenant des effluents chargés en hydrocarbures -Italie[END_REF]. Many concern atmospheric storage tanks caught up in a chain of explosion or fires which we call the domino effect.

Several works [START_REF] Bernuchon | Méthode pour Identification et Caractérisation des effets Dominos[END_REF] have shown the importance of domino effects due to overpressure or impact and have proposed several methodologies. Some critical values are proposed in the literature, they are summarized in table 1. Some work on generalized model is based on finite element analysis [START_REF] Schneider | Survivability study on vertical cylindrical steel shell structures under blast load[END_REF] and most of other is based on accidental feedback or probit methodologies [START_REF] Cozzani | Threshold values for domino effects caused by blast wave interaction with process equipment[END_REF]. After an analysis of these works, two statements are made:

impact loadings are barely treated in domino effect assessment, literature overpressure critical values are scattered and determined from very different types of blast (nuclear, oil, gas…). These are peak values and neglect the overpressure signature.

On these considerations, an accidental feedback review is led to determine the mechanical motions of a tank under both overpressure and impact. Then, simple analytical models taking into account all the characteristic of overpressure signatures or projectiles motions are confronted with deterministic and probabilistic analyses.

Overpressure maximal value

Damages Reference 0.007 MPa Failure of tank roof (TNO, 1989) 0.0075 MPa Minor leak in the tank shell [START_REF] Cozzani | Threshold values for domino effects caused by blast wave interaction with process equipment[END_REF]) 0.016 MPa substantial leak in the tank shell 0.020 MPa Major leak in the tank shell 0.02.0 to 0.05 MPa Failure of atmospheric storage tank [START_REF] Petit | Les mélanges explosifs, Guide pratique[END_REF]) 0.025 MPa Failure of atmospheric storage tank [START_REF] Lannoy | Analyse des explosions air-hydrocarbures en milieu libre : étude déterministe et probabiliste du scénario d'accident. Prévision des effets de surpression[END_REF] 0.0205 to 0.0275 MPa Failure of atmospheric storage tank (Laboratoire central de l 'armement, 1966) Table 1. Classical overpressure critical values for damage on atmospheric storage tank

A preliminary study listing all recent major accidents as the Unconfined Vapour Cloud Explosion (UVCE) at the oil storage site of Saint-Herblain (Barpi, 1991) and the blast occurred at the chemical site of Toulouse [START_REF] Mouilleau | Première analyse des dommages observés à Toulouse après le sinistre du 21 septembre 2001 survenu sur le site AZF de la société Grande Paroisse[END_REF] has shown that two different types of mechanical loadings have to be considered, namely explosion and impact.

The experience from these accidents shows that loadings have different effects on tanks:

explosions can cause global deformations which result in a combination of the following failure modes: knock over of the whole tank (figure 1 [START_REF] Mouilleau | Première analyse des dommages observés à Toulouse après le sinistre du 21 septembre 2001 survenu sur le site AZF de la société Grande Paroisse[END_REF] 2. Deterministic models

Aboveground vertical steel storage tanks, geometric models

Atmospheric storage tanks represent the vast majority of the large capacity containment for flammable liquids in the world. It is simply a vertical steel shell and typically has a large diameter and thin walls. The shell is made of several rings of different thicknesses formed by welded or riveted steel plates. The roof can be fixed or floating and they may be anchored. Most atmospheric tanks are stiffened by one or more wing girders.

The design of these tanks generally meets one of the three main design and building codes established by national bodies, respectively the Société Nationale de la Chaudronnerie et de la Tuyauterie [START_REF] Snct Codres Div | 1 et Div.2, Code de Construction des Réservoirs de Stockage Cylindriques Verticaux[END_REF], the British Standard Institution (BS, 1989) and the American Petroleum Institute (API, 2007). An atmospheric vertical tank is defined by its diameter and volume which can vary respectively from 10 m to 100 m and 1000 m 3 to 100 000 m 3 . For a given volume and diameter the design codes give various formulas to calculate the thickness of each ring depending on height, product density stored, service pressure and materials parameters. The height is limited to 25 m, product density can vary from 0.7 to 1.1 and service pressure varies from 0.002 MPa to 0.005 MPa above atmospheric pressure.

Carbon steels used for vertical cylindrical tank construction meet EN 10025 standards and can be considered to have a yield strength σ y between 235 and 355 MPa. The dynamic material strength shall be computed by applying a Dynamic Increase Factor (DIF) that accounts for the increase in material strength, due to strain rate effects. For accidental loads, common values between 1.1 and 1.3 are generally used (UFC, 2008).

In the study, a tank is considered as a cylindrical shell of uniform thickness fixed at its base and cylindrically pinned at the top submitted to an internal hydrostatic pressure due to the stored liquid. In order to study realistic configurations of tanks, a discrete representation of the storages typically found in oil and chemical facilities has been constructed on the basis of average dimension values in industrial area. The volume stored is linked to the hazard attributed to each product corresponding mainly to its toxicity, evaporability and flammability. Three representative categories have been selected: chemical (1500 m 3 ), light hydrocarbon (10 000 m 3 ) and heavy hydrocarbon (100 000 m 3 ) products. The main tank parameters height, diameter and ring thickness are given in table 2 for each configuration. , 2009) shows that the explosion signature usually chosen in the studies as potential sources of domino effect are mainly detonation (e.g.: pressure tank explosion) and deflagration (e.g.: Unconfined Vapour Cloud Explosion [START_REF] Ineris | Cahier applicatif du complement technique de la vulnérabilité du bâti à la surpression -Version 1[END_REF], each defined by two main parameters: a peak overpressure and a positive time duration depending on the initial energy of explosion and on the distance from the centre of the explosion.

The detonation produces a shock wave of short duration with a sudden rise in pressure. On chemical sites, peak overpressure and time duration t + can vary respectively from 0.0005 to 0.5 MPa and 10 to 200 ms depending on products and volumes stored on site. Neglecting the negative part of the signal, the shock wave pressure P(t) can be idealized by the time dependant function [1].

[1] with the atmospheric pressure and b a parameter taken from 0 to 1.

The deflagration produces a blast wave of long duration with a slow pressure decrease. For deflagration, according to INERIS expertise [START_REF] Ineris | Cahier applicatif du complement technique de la vulnérabilité du bâti à la surpression -Version 1[END_REF], peak overpressure and positive time duration can vary respectively from 0.0005 to 0.2 MPa and 10 to 1000 ms on oil and chemical sites. Introducing a parameter on time , time pressure diagram can be assumed to be represented by function [2].

{

[2]

The terms and correspond respectively to the overpressure maximal amplitude and duration, taken at the first contact point between the tank and the wave front. These values are considered to be constant over the length of the tank. They are calculated with the multi-energy method [START_REF] Baker | Explosion hazards and evaluations[END_REF]) (Van den Berg, 1985a) considering various sources and distances. The parameter b is set to a pair of values (0, 1) in eq. [1] and [2] generating four different overpressure signatures (figure 2) representing positive parts of an exponential detonation (signal 1), a typical vapour cloud deflagration (signal 2), a quick deflagration (signal 3) and a classical linear signature used for detonation (signal 4). Considering a cylindrical shell engulfed in a blast wave due to a major explosion of chemicals or hydrocarbon products, the blast load results from the reflected pressure and the drag loading based on the dynamic pressure. The effective pressure depends on time and the angle between the wave front and the cylindrical wall:

[3]
The tank is considered to be in far fields from the explosion origin so that drag loading is neglected ( . The pressure will be assumed to be positive and constant along the height. The function is considered uniform around the shell for buckling behaviour. For the global behaviour of the tank, is considered as a cosine function. In both cases, fluid-solid interactions are neglected.

To analyse flexure or knocking over, the side-on overpressure P r needs to be integrated numerically over the geometry to produce an equivalent force F p (t) in the wave direction. The pressure wave front is considered to be plan and to move at the speed of sound.

Mechanical models

Several damage mechanisms were noticed during the accidental events. All of them can be represented both by simple static and dynamic models. The selection of representative models is complex due to the physics of fluid-structure interactions, large deformations and multi nonlinear dynamic motions. Considerations concerning the choice of mechanical models are detailed in a companion paper (Duong et al., 2011). Nevertheless, all the mechanical models tested are briefly presented in the following part and their limit criteria are given.

Flexure

A classical static flexural beam model is used for the shell assuming constant section over length and fixed-free boundary conditions. The yield strength f y is calculated and compared with the maximum value of the integrated overpressure signal F p (t).

To evaluate the dynamic flexural behaviour of the tank under external pressure we consider a classical Single Degree Of Freedom model (UFC, 2008). The equation of motion for the spring-mass model representing initial flexural behaviour of a beam is expressed in equation [4]. Parameters expressed in (UFC, 2008) are used to calculate the maximum displacement in order to compare it with the maximum elastic displacement .

[4] with the equivalent elastic-plastic flexural stiffness, the equivalent damping constant and m the equivalent mass of the cylindrical tank.

Buckling

Concerning buckling behaviour, Donnell's theory and Batdorf's simplified equations [START_REF] Batdorf | A simplified method of elastic-stability analysis for thin cylindrical shells[END_REF] were chosen for the analysis of both static and timedependent cases.

These equations [START_REF] Batdorf | A simplified method of elastic-stability analysis for thin cylindrical shells[END_REF] can be derived in an analytical simplified form [5] giving the static critical pressure P cr for circumferential buckling of a fixedpinned shell of radius R, thickness e, height h and Young modulus E [START_REF] Teng | Buckling of thin metal shells[END_REF]:

[5]
In the dynamic case, the Donnell's theory can be developed to estimate the postbuckling elastic behaviour of a thin shell (Duong et al., 2011).

Knocking over

In order to simulate the rigid behaviour observed, the tank can be considered as a rigid cylindrical shell filled with various level of liquid. Equilibrium of moments is calculated considering an unanchored shell without sliding. The criterion is based on the comparison between moment due to maximal overpressure calculated from [START_REF]References API 650[END_REF] and resistive moment due to liquid and tank weight .

[6]

A time-dependant tilting angle due to blast wave can also be determined by solving the equation of moments on the rigid body versus time [7]. No sloshing is considered to calculate the maximal angle θ m . It is then compared with the maximum admissible angle taken from code acceptance for settlement θ e [START_REF] Snct Codres Div | 1 et Div.2, Code de Construction des Réservoirs de Stockage Cylindriques Verticaux[END_REF].

[7] with moment of inertia, moment due to overpressure, moment due to shell weight and moment due to liquid.

Impact

Projectiles

Another potential source of domino effect comes from projectiles produced by equipment cracking under overpressure [START_REF] Mebarki | Structural fragments and explosions in industrial facilities: Part I -Probabilistic description of source terms[END_REF]. Over all the oil and chemical facilities, the shape, the number and the speed of projectiles resulting from an explosion and impacting an atmospheric tank may vary with the critical pressure, the constitutive materials, the crack propagation of the source equipment and the distances between source and target equipment. According to previous research [START_REF] Mebarki | Structural fragments and explosions in industrial facilities: Part I -Probabilistic description of source terms[END_REF], typical explosions at petrochemical sites usually produce a very limited number of massive fragments (e.g. Boiling Liquid Expanding Vapor Explosion, known as BLEVE). Smaller fragments can also be produced by UVCE or by light equipment subjected to high overpressure loading. Most of the equipment (storage vessels, transport canalization) are cylindrical shells and tubes.

Considering these observations, limits for geometrical parameters of projectiles were assumed for the study, they are presented in the table 3. The fragments produced by all the equipment on petro-chemical sites might have various shapes. Holden gives a mere classification of fragment types according to the number of linked caps and number of circumferential cracks [START_REF] Holden | Assessment of missile hazards: review of incident experience relevant to major hazard plant[END_REF]. The types of fragments are similar to those collected from INERIS [START_REF] Bernuchon | Méthode pour Identification et Caractérisation des effets Dominos[END_REF]. For the deterministic and probabilistic studies, the projectiles are assumed to be perfectly cylindrical shells. The fragment projectile speed is considered subsonic. For impacts with a defined projectile, with known parameters (kinetic energy, dimensions, incidence angle on the target, etc.), the local effect on the target requires mechanical models that may be sophisticated or simplified. In this part, the authors choose to keep the simple models provided in the literature.

The classic empirical formulas from [START_REF] Nielson | Empirical equations for the perforation of mild steel plates[END_REF], White [START_REF] Florence | Interaction of projectiles and composite armour, part II[END_REF], [START_REF] Schneider | Structural response to thin steel shell structures due to aircraft impact[END_REF] and many others (Guengant, 2002) give the critical energy E cr of minimal perforation of a steel plate by a cylindrical rigid projectile. Other empirical formulas are based on a penetration depth calculation as shown in (Cox et al., 1985) or ( Van den Berg, 1985b). Another specific model was developed in a previous ANR research program called IMFRA [START_REF] Mebarki | A probabilistic model for the vulnerability of metal plates under the impact of cylindrical projectiles[END_REF] based on plastic limit analysis. Each model can be expressed as a dimensionless equation of the following form [8].

[8] with the ultimate stress of target material, d the projectile diameter, the target thickness and L t the target length.

The failure criterion is based on the comparison between the critical energy E cr and the kinetic energy of the projectile E c . The different perforation models considered are listed in table 4.

Model name

Reference Model name Reference Cox (Cox et al., 1985) Schneider [START_REF] Schneider | Structural response to thin steel shell structures due to aircraft impact[END_REF]) HSE (Guengant, 2002) SCI (Guengant, 2002) IMFRA [START_REF] Mebarki | A probabilistic model for the vulnerability of metal plates under the impact of cylindrical projectiles[END_REF] Van de Berg (Van den Berg, 1985b) Neilson [START_REF] Nielson | Empirical equations for the perforation of mild steel plates[END_REF] White [START_REF] Florence | Interaction of projectiles and composite armour, part II[END_REF] Table

Local impact models and references

Safety of atmospheric storage tanks during accidental explosions 9

The empirical formulas have a restrained domain of validity, detailed in each reference; the only models used are those in the accident projectile domain (subsonic speed). A parametric study is led on tank #1, considering solid steel projectiles of various lengths, diameters and velocities. Any kinetic energy increase of the projectile (velocity or mass) leads to a higher failure risk. Some penetration models give incomplete results, because of their restricted validity domain (figure 3). It can be concluded from the comparison of results coming from different models, that some models give close results (IMFRA / Schneider / Cox for instance, on figure 3). Studying different tank geometries would not give much more information since only local effects are concerned. The tank models in this case only depend on one parameter (the tank thickness). Changing the parameter value will only move the limit state, making the failure domain bigger or smaller.

The influence of impact angle may also be studied, but only two models take into account this parameter: IMFRA and Van den Berg models (figure 4). For both models, the most penalizing case corresponds to a perpendicular impact angle, and increasing this angle implies a penetration depth decreasing. The IMFRA model is more conservative than the Van den Berg Model.

Equivalent Riera force

The Riera approach [START_REF] Riera | Stress analysis of structures subjected to aircraft impact forces[END_REF]) is a common method in the nuclear industry for defining a loading curve F R (t) for an impact of a deformable projectile on a structure. The principle is to calculate the time dependent loading of a projectile on a structure which corresponds to the dissipation of its kinetic energy. A coefficient α determines the portion of the kinetic energy dissipated in plastification of the projectile and the portion transmitted to the target as kinetic energy [START_REF] Rambach | Airplane crash modelling: assessment of the Riera model[END_REF]. Calculations of loading curves are completed by finite differences method with a temporal discretization, considering perfectly cylindrical soft projectiles impacting perfectly rigid bodies. The loading curve F R (t) is then integrated into the global mechanical models of knocking over [7] and flexure [4] in the same way as time-pressure equivalent force F p (t).

Numerical model implementation and metamodel construction

All the mechanical models were implemented as Scilab programs (Consortium Scilab, 2010) and were coupled to Phimecasoft [START_REF] Phimeca Engineering | [END_REF] in order to carry out parametric and probabilistic studies. Each program j, that estimates the behaviour of a mechanical model , returns an output giving the failure criterion ( ) ⁄ for the input parameter set { }.This margin factor shall be compared to 1. The limit state functions are calculated as follows:

( ) ⁄ [9]
Mechanical limit states used in the study are summarized below for the overpressure loading (table 5) as for the impact loading (table 6).

Overpressure models -Input Loading: P(t) and F p (t)

Failure mode Static Model Output Dynamic Model Output

Flexure -eq. [4] A positive value of g means that the criterion Crit j has not attained the limit Limit j . Conversely a negative value means "failure". To reduce the number of calculation, and increase the flexibility of the result post-processing, metamodels are used in some cases. They are aimed at getting a function that can be used as a substitution of each mechanical model . Here, one metamodel is associated to each mechanical model, all the metamodels being built using the Kriging method, and making the assumption that the covariance function of the Gaussian process is stationary and centered at a tendency, whose shape is linear:

g 1 = 1-max(F p ) / f y g 4 = 1-x m / x e Knocking over -eq. [6] - [7] g 2 = 1-M fs / (M ws +M ls ) g 5 = 1-θ m / θ e Buckling -eq. [5] g 3 = 1-max(P r ) / P cr g 6 = 1-(w n /δ n ) / α max
∫ d { | ( ) } [14]
The probability of failure may be evaluated by Monte Carlo simulation. However when small probabilities of failure are sought, this approach is very expensive in terms of number of evaluations of the model . Approximation methods such as FORM/SORM (First/Second Order Reliability Method) have been developed to compute efficiently the probability of failure [START_REF] Lemaire | Structural reliability[END_REF].

Uncertainty propagation methodssensitivity analysis method

The mechanical model output considered is still the quantity corresponding to a limit state function, (see §2.4.2 for details), that defines the probability of failure ( §3.1), but will be used to give information on how the input parameters have an influence on the model response; in other words, the goal is to know how input parameters affect the reliability.

The method using the estimation of Sobol' indices was chosen. In this case, the goal is to know what is the part of the variance, due to other input variable variances or other input variable set variances. General information on sensitivity analysis and Sobol' indices can be found in [START_REF] Sobol | Sensitivity estimates for nonlinear Mathematical models[END_REF][START_REF] Saltelli | Making best use of model evaluations to compute sensitivity indices[END_REF][START_REF] Saltelli | Sensitivity analysis in practice[END_REF].

Sobol' indices are based on the model variance decomposition, which is a unique decomposition. Thus, first order indices may be defined:

[ | ] [15]
Second order indices, measuring the variance sensitivity of Y in relation to variables X i and X j , which is not taken into account in the first order, may be calculated using the same method, up to the n order:

, , … [16]
The indice number increases very quickly with the variable number. Sobol' (1993) then introduced total indices. These indices regroup each variable weight in the variance, each single variable weight, as well as its weight in the interactions with other.

∑ [17]

where #i represents the indice sets containing i. This indices can be efficiently computed by means of the simulation technique proposed by [START_REF] Saltelli | Making best use of model evaluations to compute sensitivity indices[END_REF] or as the post-processing of a polynomial chaos expansion as proposed by [START_REF] Sudret | Global sensitivity analysis using polynomial chaos expansions[END_REF]. The results presented in this paper were obtained by means of the simulation technique of [START_REF] Saltelli | Making best use of model evaluations to compute sensitivity indices[END_REF] on Kriging metamodels.

Sensitivity analysis

Stochastic model

Geometry

Three different realistic standard tank configurations were established and studied (table 2). In the interest of limiting the number of parameters in the uncertainty analysis, only two geometrical parameters were retained as stochastic parameters. The choice was made on the most variable parameters, the shell thickness and the filling percentage. They were chosen to be uniformly distributed over their interval, from the top ring to the bottom ring value for the thickness of each tank, and from 0 to 100 percent of the volume for the liquid filling. Spatial deviation of the tank thickness is also ignored, because no data matching the studied tanks exist, and because this deviation cannot be modelled in the mechanical models used in this study.

Material properties

Material parameters E (Young modulus) and σ y (yield strength) were also taken as uniformly distributed stochastic parameters with values respectively between 200000 and 210000 MPa and between 200 and 355 MPa.

Overpressure

A statistical evaluation of the overpressure signals that can be received by atmospheric tank all over the chemical facilities is a nearly impossible task. Two signal shapes were retained (#1 and #3 on figure 2), and the two parameters, maximal overpressure and positive duration, were chosen to be uniformly distributed. Maximal and minimal values were chosen by consulting INERIS experts of the Accidental risk division [START_REF] Ineris | Cahier applicatif du complement technique de la vulnérabilité du bâti à la surpression -Version 1[END_REF] and are given in table 7.

Projectiles

To study all possible scenarii of impacts on a tank placed on an oil and chemical site, the projectiles considered in the stochastic model are defined by uniform laws (see table 7). The impact velocity is also considered uniform.

The choice of uniform laws for every stochastic yield variable is consistent with global sensitivity analysis of a very large domain of loadings in oil and chemical storage facilities. Nevertheless, these laws can lead to overestimation of sensitivities; a pertinent statistical study could get to a more representative stochastic model.

Buckling

Results for the buckling failure mode (g 3 and g 6 ) are presented on figure 9. These failure modes are more sensitive to the thickness which means that the response will vary along the height of tanks built with plates of gradually varying thickness. According to the models, the internal liquid hardly influences the buckling response. This can be explained both by the model hypothesis not taking inertial effects from liquid into account and by the wide interval considered for external pressure clearly more important than the interval for internal hydrostatic pressure. Considering dynamic model, the positive duration is as important as the overpressure while this parameter is not considered for static buckling.

Sensitivity analysis to impact loading

Only one tank is studied for local effect failure modes related to impacts, as only the thickness matters. Only models with a wide validity domain are considered, to rank the sensitivity of input parameters.

Penetration

First a metamodel is built (g 7 ) for each penetration model considered, and the sensitivity analysis is based on Sobol' indices estimated by simulations. Tank #1 was chosen to be impacted by a solid cylindrical projectile. Results are presented on figure 10. The projectile velocity is the most important parameter, followed by parameters defining the projectile volume (length and diameter). For three of the models, length is as important as diameter while the Van den Berg model neglects the influence of the length on the structural response. Given the wide range of possible projectiles, the variation of the thickness on the tank #1 does not influence the result.

Reliability analysis

The sensitivity analysis was based on precise tank configurations (table 2), which enabled the ranking of input parameters for different failure modes and for different tank shapes. However, it is interesting to be able to generalize the study to any possible tank shape: this is why a tank modelling based on the height/diameter ratio is proposed to estimate reliabilities.

Geometric stochastic model

In order to pursue a generalized reliability study, it was then necessary to create a geometric model, representative of the design generally used on oil and chemical sites. The different typical configurations defined in table 2 are used, as well as the French design code [START_REF] Snct Codres Div | 1 et Div.2, Code de Construction des Réservoirs de Stockage Cylindriques Verticaux[END_REF]. The following equation [18] is used, which gives the thickness e for a ring of radius R at a distance h from the top of the tank (the volume Vol int is then ); the regression parameters a and b are estimated for the different available tank configurations (figure 12.a), and u is an error parameter used to adjust the thickness (typically a normal centered random parameter defined by a standard deviation  e ( ln ) e

[18]

The interpolation used for regression is decent (R²=0.95), and the French design code, which gives recommended minimum and maximum thickness, is used to check the validity of the thickness prediction:

{ [19]
with p the service pressure (0.005 MPa), ρ the liquid density (1), σ y the material yield strength (235 MPa) and c the extra thickness dedicated to corrosion (0, to be pessimistic).

The thickness prediction is consistent with the design code recommendations (figure 12.b), which validates the model.

The tank height is considered as a constant (two values will be tested: H=10 m and H=20 m). Instead of making the tank radius a random parameter, the height/diameter ratio is used instead (taken as uniformly distributed with values between 0.2 and 3.0). The error parameter u is set as a centred normal parameter, with a standard deviation of 0.05. The different failure modes (flexure, knocking over, circumferential buckling) are considered. Depending on the failure mode, Monte Carlo simulation is used to estimate the probability of failure (only for large values, higher than 0.1), and FORM analysis for small failure probabilities. FORM results revealed accurate for high probabilities with respect to Monte Carlo simulation. Results are given in table 10.

Firstly, the high probabilities of failure encountered in the study have to be balanced with the failure hypothesis based on plasticity and the way the input parameters were modelled, possibly pessimistically due to the lack of statistical information. Indeed, trying to generalize the study to all possible tank dimensions generates unlikely configurations which probably do not occur. In the same way, overpressures with long positive durations are probably less likely than short ones. Lastly, studying tank failures through a stochastic model, with respect of existing design codes, implies estimating conditional probabilities of failure. The probabilities of failure estimated in this study are hence related to a maximal event, and are logically high. An accurate risk assessment of the tank should at least take into account both the conditional probability of failure and the occurrence probability.

Nevertheless, these calculations permit the observation of significant differences between static and dynamic models. For knocking over and buckling, the static consideration is conservative while for flexure it is not. Moreover, failure modes estimated by dynamic simplified models revealed a high sensitivity to the explosion time parameters: The overpressure signature has a major influence, triangular deflagration being much more critical than detonation.

Secondly, a classification of the failure mode consistent with observation can be made. Whatever the overpressure signature or geometry considered, the circumferential buckling gives the highest probability of failure, followed by knocking over, the flexure and the axial buckling. Therefore an effective risk engineering study should focus on, the analysis of circumferential buckling. For this last mode, the probabilities given by static models are more conservative than the probabilities calculated with dynamic models. This can be explained because static model criteria are derived from when buckling pressure is reached while the dynamic model is based on post buckling plasticity, which is closer to the actual failure mechanism. The probabilities of failure for global effect modes are about the same as those estimated for the overpressure study (same decade) so impact failure modes should not be neglected.

The sensitivity of failure probabilities to height increase can be explained by the tank inertia: the smaller the tank height, the smaller the tank volume, meaning it will be easier to generate a failure mode with the same loading. The choice of data modelling based on a random height/diameter ratio seems to be consistent in that case.

The knocking over failure mode is the prevailing failure mode, considering only global effects (as in the overpressure study). The penetration failure mode gives the highest probabilities of failure, meaning perforation is the most critical mode considering the same loading (in kinetic energy terms). Nevertheless, local and global failure modes represent different failure scenarios. Given the way the projectile impacts the tank, the penetration failure mode is not always possible.

Local and global effects remain complementary, and they should be studied in parallel. The real probability of failure concerning penetration has to be balanced by its probability of occurrence, which remains smaller than the one characterised by an overpressure: the typical dimension of a shock wave is bigger than the tank dimensions, which is not the case for a penetration scenario, implying a projectile hitting a specific tank.

As some physical behaviours are similar (knocking over, flexure), making the tank resistance better from an overpressure study will also have positive effects on the tank resistance to global effects of impacts, even if the priority set for one given phenomenon may vary depending on the type of tank and where it will be located.

Conclusion

Some stochastic models are developed based on accident observation and expertise to complete parametrical studies, sensitivity indices and reliability analyses of tank behaviour for impact and blast loading on oil and chemical sites. Simple analytical models are compared and failure probabilities are calculated.

First, a classification is made and two main modes are considered. Penetration seems to be the most penalizing mode for projectiles whilst circumferential buckling is the most prevailing failure mode for the overpressure domain considered.

Secondly, considering the severe disturbances, the tank safety appears mostly driven by the dynamic loading characteristics. On the one hand, the study shows that a satisfying analysis needs a detailed loading, no parameters can be neglected and their variability is better known. On the other hand the study confirmed that domino effect evaluation using static models can lead to both conservative and unconservative conclusions considering the wide domain of loading and geometry.

Considering calculated failure probabilities, specifying a unique recommendation based on a maximal overpressure value for both impact and blast effect on several tank geometries does not seem relevant to avoid domino effects.

On the one hand, the high probabilities of failure encountered in the study have to be balanced with the plasticity consideration and the way the input parameters were pessimistically modelled, due to a lack of statistical information. But, on the other hand, these probabilities seem consistent with a lack of consideration of accidental loadings in the classical design of storage tanks, and with the fact that the probabilities estimated here are conditioned by the occurrence of an extreme event.

Based on these considerations and on the sensitivity indices determined during the study, an experimental program is established to improve understanding of both loading and mechanical behaviour of atmospheric tanks to accident loadings (Duong et al., 2011).

  .a), global flexure (figure 1.b) and buckling (figure 1.c), impacts can also cause global deformations on the tank or local damage such as perforation (figure 1.d).

Figure 1 .

 1 Figure 1. (a) Knocking over of a tank (b) Deflection of two slender tank (c) Global buckling (d) Local deformation[START_REF] Mouilleau | Première analyse des dommages observés à Toulouse après le sinistre du 21 septembre 2001 survenu sur le site AZF de la société Grande Paroisse[END_REF]

Figure 2 .

 2 Figure 2. Various overpressure signatures (P(t)-P 0 ) ( =0.050 MPa, t + =50 ms)

Figure 3 :

 3 Figure 3: Limit states (a) IMFRA (b) Schneider (c) Van den Berg (d) White (e) Cox (f) HSE

Figure 4 .

 4 Figure 4. Limit states depending on impact angle (a) IMFRA (b) Van den Berg

Figure 5 .

 5 Figure 5. Input parameter rankings for flexure (g 1 and g 4 ) for tank #1

Figure 6 .Figure 7 .Figure 8 .

 678 Figure 6. Input parameter rankings for flexure, tank #3

Figure 9 .

 9 Figure 9. Input parameter rankings for buckling, tank #1, overpressure signature #1

Figure 10 .

 10 Figure 10. Input parameter rankings on local effect models (a) IMFRA (b) Schneider (c) White (d) Van den Berg

Figure 11 .

 11 Figure 11. Input parameter rankings on global effect models (a) flexure (b) Knocking over

Figure 12 .

 12 Figure 12. (a) Thickness regression (b) Thickness regression validation with French design code formulas[START_REF] Snct Codres Div | 1 et Div.2, Code de Construction des Réservoirs de Stockage Cylindriques Verticaux[END_REF]

Table 2 .

 2 Main

geometrical parameters for each tank configuration 2.2 Overpressure 2.2.1 Loading A synthesis of risk analyses realized by INERIS (INERIS

Table 3 .

 3 Geometric

and speed parameters for projectiles

2.3.2 Local effect

Table 5 .

 5 Overpressure limit states

Impact models -Input Loading: E c and F R (t)

	Failure mode	Model Output
	Perforation models -eq. [8]	g 7 = 1-E c / E cr
	Flexure -eq. [4]	g 8 = 1-x m / x e
	Knocking over -eq. [6] -[7]	g 9 = 1-θ m / θ e

Table 6 .

 6 Impact limit states

Table 10 .

 10 Overpressure reliability results: probabilities of failure3.4.6 Impact reliabilityThe following failure modes are considered: flexure, knocking over and perforation. An estimation of the probabilities of failure is given in table 11.

		Tank height	H=10 m	H=20 m
		Flexure	0.40	0.05
	Global effect
		Knocking over	0.78	0.26
	Local effect	Penetration	0.94	0.90

Table 11 .

 11 Impact reliability results: probabilities of failure

∑

[10]

The first term corresponds to the regression part, which implies choosing a set of functions . The second term is the stationary Gaussian process, with a 0 mean, a constant variance , and using the covariance function:

where l is a parameter vector defining R

The parameters l, and have to be estimated, taking into account the autocorrelation function R and regression base . The most common autocorrelation function is the generalized exponential function:

The autocorrelation model choice is based on the regularity of the model . . Details can be found in [START_REF] Lophaven | A Matlab Kriging Toolbox[END_REF][START_REF] Santner | The design and analysis of computer experiments[END_REF][START_REF] Welch | Screening, predicting, and computer experiments[END_REF].

Uncertainty analysis

Considering the mechanical models presented in §2, and a stochastic model of input parameters (see §3.3.1, and §3.4.2 to §3.4.4), the whole range of uncertainty analysis can be considered. Two different types of probabilistic studies are presented:

reliability analysis, giving the probability of failure, and possibly information on how the input parameters are ranked near the failure point,

sensitivity analysis, giving information on how the input parameters of the models have an influence on the model response through the computation of sensitivity indices; this type of analysis addresses the central tendencies. In order to compare all sensitivity indices, the values given a method are scaled.

Uncertainty propagation methodsreliability analysis methods

The mechanical model output considered is a quantity corresponding to a limit state function, (see §2.4 for details). In this setting, a negative value of g means "failure". The probability of failure is thus defined as follows:

Denoting by the joint probability density function of the input random vector, the probability of failure reads:

Sensitivity analysis to overpressure

Different failure modes estimated using static and dynamic simplified models, are studied: First a metamodel is built for each simplified model, and the sensitivity analysis is based on Sobol' indices estimated by simulations.

The most important parameters are the positive duration and the maximum overpressure in most cases and to a lesser extent, the yield strength and the filling level. Static models (g 1 , g 2 and g 3 ) used with geometrical integration of the timepressure signal F p underestimate the positive duration dependency, and thus overestimate the influence of maximum overpressure compared with dynamic models (g 4 , g 5 and g 6 ).

Flexure

Results for the flexure failure mode (g 1 and g 4 ) are presented on figures 5-6. Flexure static model (g 1 ) ignores inertia effects of the inside liquid which influences strongly the dynamic response (g 4 ). These effects are more important for large height/diameter ratio and slower loading (deflagration). The others parameters have no or very little influence on the models.

Knocking over

Results for the knocking over failure mode (g 2 and g 5 ) are presented on figures 7-8. Static model (g 2 ) seems to overestimate filling level importance when the height/diameter ratio is large (tank #1) while the positive duration strongly influence the dynamic response (g 5 ). Considering a low height/diameter ratio (tank #3), the static and dynamic models obtain similar sensitivity indices for main parameters except for positive duration which is more important in dynamic models.

Material stochastic model

Material parameters E and σ y are taken as uniformly distributed stochastic parameters with values respectively between 200000 and 210000 MPa and between 200 and 355 MPa.

Overpressure stochastic models

French practice for safety studies of hazardous liquids and gas storage sites ignores the consideration of domino effect as a scenario if the maximal incident overpressure on a tank is less than 0.020 MPa. This value is consistent with classical values taken from incident feedback and probit models (Cozzani et al., 2006) that are often used to make quick assessment of domino's effect possibility.

In order to evaluate the probability of domino effect for generalized geometry with respect to the intensity limit, a stochastic model was constructed with a normal distribution of nearly 95 % of the maximal overpressure value between 0.01 and 0.02 MPa for both overpressure signatures. To be consistent with French practice where time duration is ignored, the positive time duration of the overpressure is kept uniformly distributed over the whole interval.

Projectiles stochastic models

To produce a more realistic model than the severe uniform model proposed previously, a stochastic model is built based on feedback, expertise and consideration of [START_REF] Bernuchon | Méthode pour Identification et Caractérisation des effets Dominos[END_REF] and [START_REF] Guengant | Document de référence pour l'évaluation des effets de projection en cas d'accident dans une installation classée[END_REF]. The stochastic variable using mainly normal distribution are presented in table 9.

Acknowledgements

This research has been performed with the financial support of the French Agency (ANR PGCU 2007), which is gratefully acknowledged.


D Jamois

S Ruban

STUDY OF POTENTIAL LEAKAGE ON SEVERAL STRESSED FITTINGS FOR HYDROGEN PRESSURES UP TO 700 BAR

In order to improve risk analyses and influence the design of the future hydrogen systems, an experimental study on leaks qualification and quantification was performed. In H 2 energy applications, fittings appear as a significant leakage potential and subsequently explosion and flame hazards. Thus, as part of the "Horizon Hydrogène Energie" French program [1], four kinds of commercial fittings usually employed on H 2 systems were tested thanks to a new high pressure test bench -designed, setup and operated by INERIS -allowing experiments to be conducted for H 2 pressures up to 700 bar. The fittings underwent defined stresses representative of H 2 systems lifetime and beyond. The associated leaks -when existing -are characterized in terms of flow rate.

CONTEXT

Risks induced by H 2 use are first the leakage, and then explosion or fire due to ignition of a flammable mixture. Thus consequences having to be assessed for risk management of systems using hydrogen are the following:

1. In case of leakage, two possible scenarii depending on release properties: indoor build-up: reached hydrogen concentration versus ATEX formation fixed at 4% H 2 , self-ignition: jet fire characteristics.

2. If explosive atmosphere is formed: reached levels of overpressure in case of ignition and explosion of flammable mixture versus distance from explosion ignition point, and associated consequences on:

structures (e.g. collapse), and humans (e.g. overpressure effects, missiles). jet fire follows.

The aim of the present study is to improve risk assessment of H 2 energy systems -existing (see Figure 1) or for future developments -by better knowing the leak causes and the associated flow rates.

Presently, assumptions are taken on the leak source -critical parameter for risk analyses of potentially hazardous systems -in order to assess a representative H 2 concentration.

The few data available in the literature concern hypotheses on leak diameter for build-up assessment of flammable gases, but they are generally not complete since they do not cover all the technical configurations that may exist (large variety of connection types, diameters of pipes and equipment, external stresses on equipment...). The IGC DOC 134/05 issued by EIGA (European Industrial Gases Association) provides a release source hypothesis of 0.1 mm leak diameter at a pressure of 200 bar [START_REF]IGC Document 134/05/E: Potentially Explosive Atmosphere[END_REF] which is also mentioned in several references [START_REF]A Risk-Based Approach to Hazardous Area Classification[END_REF][START_REF]Area Classification Code for Installations Handling Flammable Fluids[END_REF].

Experimental tests can bring important information and knowledge on this subject, which could be integrated in available modeling tools. In view of the H2E applications, the fittings -by their function, their principle and their large number in the systems -appear as a primary source of leak. That is the reason why in this work several kinds of tube fittings and of stresses were considered to establish a realistic test matrix close to the real-life conditions of the hydrogen-based applications in order to determine associated flow rates.

This type of experiments was performed at moderate pressures (< 35 bar) and mainly for 1/4'' pipe fittings [START_REF] Gentilhomme | Outcomes from the French National Project DRIVE[END_REF] as normally used in mobile applications for moderate powers. It showed that these fittings have a very low leak rate in normal conditions (< 10 -3 cm 3 .s -1 ), but could be an important source of release in specific cases (e.g. leak rate up to 800 cm 3 .s -1 at 20 bar for hand tightening of the fitting).

Work in the present study aims at extending knowledge on this thematic to other possible applications considering not only other fittings (with a larger diameter range) but also higher pressures (up to 700 bar) and other fatigue conditions in particular when much stresses are applied (during mounting or H 2 based-system use for instance).

Expected outcomes of this study are a better definition of fittings resilience and of maintenance frequency to ensure an appropriate level of safety for hydrogen-based systems.

In the following sections, firstly the tests carried out on stressed fittings are described, then the characteristics of the test bench specifically designed are presented along with the operating conditions, and to conclude the results obtained in this work are discussed.

TESTED CONFIGURATIONS

Studied fittings

Test configurations were chosen based on H 2 energy existing systems and their conditions of use.

Four kinds of commercial fittings usually employed on H 2 systems, described in Table 1, were experimentally tested thanks to a specific H 2 high pressure test bench. In this work, note that the 6 mm double ring tube fittings (Swagelok ® and Rotarex ® ), although recommended for a maximal working pressure of 420 bar, are tested up to 700 bar H 2 only in order to investigate their sealing behaviour for higher pressure conditions.

Stress configurations

A reliability approach, through fault tree analyses, was used to determine all causes of leak for these kinds of fittings. The primary cause of leakage should be strongly linked to mounting and maintenance operations and most of the present work was devoted to these aspects.

For a few configurations, the stress had to be applied when the fitting was under pressure. This special situation is referred to as "dynamic stress". In most cases, the fitting was conditioned (e.g. screwed, unscrewed several times) before the pressure was applied ("static stress").

An analysis of the H 2 systems extreme conditions of use enabled to determine magnitude orders of probable maximal stresses on these fittings. Furthermore conditions for the fittings qualification tests of the constructors were considered. Based on this information, a test matrix was established and defined stresses were experimentally reproduced in order to quantify the level of leak they led to. Note that maximal stress levels which were tested are significantly higher than the conditions encountered by the systems in use or than the conditions of qualification tests provided by the fittings constructors.

Table 2 presents in details scenarii which were retained for experimental tests. The normal conditions of use recommended by the constructors, and the maximal tested stress levels for each fitting and stress were reported hereafter.

"Dynamic stresses" were applied only on 6 mm tube fittings. Actually the maximal force available on the experimental test bench for these conditions of stress, although high, is not strong enough to have significant effects on the 1/2'' and the 9/16'' tube fittings. (2) in fitting axis direction (1) recommended by Maximator ® to improve the sealing (2) representing a mass of 32 kg attached to the fitting Figure 3 represents "dynamic stresses" applied by a pneumatic jack on the 6 mm double ring tube fittings under H 2 pressure (see "dynamic stress" module in Figure 6, Section 2.2).

Flexion

EXPERIMENTAL DEVICE

Main test bench

An experimental installation was specially designed and built up by INERIS enabling leakage testing under hydrogen up to 700 bar in safe conditions (see Figure 4).

Experimental test bench is mainly composed of:

-a H 2 compressor to reach the maximal pressure of 700 bar, -a thermostatic 1 m 3 enclosure to ensure thermal stability during leakage tests, -a primary high pressure reservoir of 2.4 L, -a secondary reservoir of 30 L to increase the accuracy of leak flow rate determination, -3 Autoclave ® pneumatic valves, -2 Kistler ® pressure transducers (accuracy ± 0.1%): 0-1000 bar on the 2.4 L reservoir, and 0-200 bar on the 30 L reservoir.

According to previous experiences, the temperature inside the testing chamber need to be very stable.

In the 1 m 3 enclosure, the temperature is measured by three thermocouples (accuracy ± 0.2°C) and regulated at 30°C; this parameter is of prime importance for gas leakage studies and determination of the associated flow rates.

Sensitivity of the test bench in terms of leak detection and quantification is assessed to be around 10 -2 cm 3 .s -1 . This threshold sensitivity value is based on potential residual leakages of the test bench equipments (e.g. valves and other fittings correctly assembled…), on the uncertainties of each transducer and on a test duration of 5 h. For safety aspects -because tests are carried out with hydrogen and an explosive atmosphere could be generated in case of non negligible release -the enclosure is constantly flushed with nitrogen. Valves are pneumatic in order to limit ignition sources.

Additional module for "dynamic stress"

It can be recorded that in a number of situations, the fitting was conditioned before the tests (static stresses) but that in a few instances, the stress (traction, flexion, torsion) needed to be applied during the pressure test (dynamic testing). For this purpose, a specific additional module was designed to be inserted in the climatic enclosure. This module comprises a pneumatic jack (which can produce a force up to 320 N) and a bracket to strongly maintain the fitting during the stress applied by the jack. This module, according its settling, can be used for flexion, rotation or traction stresses (see Figure 6).

Figure 1 .

 1 Figure 1. Examples of H2E hydrogen-based existing systems.

Figure 2 Figure 2 .

 22 Figure2presents three of the four fittings which were tested; Swagelok ® and Rotarex ® (see Figure2(A)) 6 mm double ring tube fittings being very similar in terms of both design and sealing principle.

Figure 3 .

 3 Figure 3. Scheme of "dynamic stresses" applied on 6 mm double ring tube fittings.

Figure 4 .

 4 Figure 4. Scheme of the experimental installation for high pressure leak tests on stressed fittings.

Figure 5 .

 5 Figure 5. Pictures of the INERIS experimental installation. (A) climatic enclosure, (B) climatic enclosure with device for tests.

Table 1 .

 1 Selected fittings for H 2 high pressure leakage experiments.

	Fittings	External tube size	Maximal working pressure recommended by the constructor	Maximal tested pressure
	Swagelok ® double ring tube fitting (316 SS * )	6 mm	420 bar	700 bar
	Rotarex ® double ring tube fitting (316 SS)	6 mm	420 bar	700 bar
	Swagelok ® medium-pressure double ring tube fitting (316 SS)	1/2''	1035 bar	700 bar
	Maximator ® threaded ring tube fitting (316 SS)	9/16''	1500 bar	700 bar

* Stainless Steel

Table 2 .

 2 Selected stress scenarii.

				Tested stress level
		Stresses	Normal conditions of use	considered as maximal
				in situation
		Assembly-	Around 20 cycles, for 6 mm double ring tube fitting	100 cycles
		dismantling cycles	< 20 cycles, for high pressure fittings (double and threaded ring tube fittings)	50 cycles
	Static stresses	Under-tightening	1 1/4 turn, for 6 mm double ring tube fitting 1 1/4 turn, for 1/2'' double ring tube fitting 80 N with silicone grease (1) on conical sealing surfaces, for 9/16'' threaded ring tube fitting	1 turn 3/4 turn and 1 turn 60 N with silicone grease
		Over-tightening	1 1/4 turn, for 6 mm double ring tube fitting	1 1/2 turn
				Crimping at 100°C
		Thermal effects	+60 to -20°C	and leakage test
				at 30°C
	Dynamic stresses	Counter-clockwise rotation Flexion Traction	0 turn 0° 0 N	1/8 turn compared to initial position 10° from fitting initial axis 320 N

ACKNOWLEDGMENTS

The results presented in this paper have been obtained within the frame of the Horizon Hydrogène Energie (H2E) program. The authors acknowledge the French agency for innovation support OSEO and the Air Liquide Group for their financial support of this research, and also INERIS for the technical and experimental means.

Jack

Experimental procedure

The hydrogen (200 bar from a bundle of cylinders) is compressed up to 700 bar and the 2.4 L reservoir is filled. When temperature homogeneity is reached, the pneumatic valve, V 1 , is opened for the leakage test on the studied fitting at the desired pressure (see Figure 4).

If the leakage is too high, the pneumatic valve V 2 is opened to improve accuracy on flow rate determination by using the 30 L reservoir.

When the test is finished, the pneumatic valve V 3 is opened to evacuate H 2 from the gas lines of the test bench and from the reservoirs.

During the test, the pressure is controlled and recorded in order to detect leakage and assess associated flow rate.

The flow rate of the leakage is estimated by knowing the quantity of hydrogen lost during the time of the leakage. This quantity can be assessed measuring the variation of pressure in the high pressure reservoir.

RESULTS AND DISCUSSION

Several tests were performed as described in Section 1.0. Surprisingly, only two test configurations showed small leakages; the other stress scenarii did not exhibit detectable leakage given experimental installation sensitivity. Table 3 presents releasing configurations and associated leak flow rates experimentally determined which appear close to the threshold sensitivity value of 10 -2 cm 3 .s -1 previously noted in section 2.1.

These values are very low compared to the flow rates usually considered for risk analyses of potentially hazardous systems, and would be detected by normal control procedures particularly for these types of stresses. Moreover a re-tightening would certainly stop these leakages.

Note that for a predictable risk, the usual "0.1 mm -200 bar" leak [START_REF]IGC Document 134/05/E: Potentially Explosive Atmosphere[END_REF][START_REF]A Risk-Based Approach to Hazardous Area Classification[END_REF][START_REF]Area Classification Code for Installations Handling Flammable Fluids[END_REF] would correspond to a release around 900 cm 3 .s -1 and by analogy a "0.1 mm -700 bar" would be around 3500 cm 3 .s -1 . Even at very high pressures, the fittings under considerations rarely leak. Apart from the very specific situations where the fitting is not tightened (only by hand) or when the seals are damaged as reported in literature [START_REF] Gentilhomme | Outcomes from the French National Project DRIVE[END_REF], some low leaks were found after 50 of assembly/dismantling cycles for the 1/2" Swagelok ® . An additional test showed that the leakage detected at 700 bar on the Swagelok ® mediumpressure double ring tube fitting disappears when pressure is decreased down to 450 bar. Note also that under similar stresses, smaller Swagelok ® fittings did not leak suggesting a scale effect.

For the Maximator ® fittings at tested tightening couples, sealing is not easily reached if silicone grease is not applied on sealing contact surfaces. Higher tightening couples should be tested in order to check if, beyond 80 N and without grease, the sealing for this kind of fittings can be obtained.

Note also that the 6 mm double ring tube fittings are very resilient against dynamic stresses. To some extent, this means that the "pre-stress" applied on the fittings during tightening is well above the superimposed dynamic stresses.

From this work it is interesting to retain that:

-Despite a high pressure level for the tests (700 bar), very few scenarii gave rise to leaks;

-Even if the constructor recommended limit of working pressure for 6 mm double ring tube fittings (Swagelok ® and Rotarex ® ) is 420 bar, tests performed at 700 bar did not show detectable leak, whatever the stress;

-When existing, determined leak flow rates are very low compared to flow rates considered in risk assessment of potentially hazardous systems and associated equivalent leak diameters would be very small compared to the usual "0.1 mm".

A follow-up to this work could be to determine critical stress levels giving rise to significant and quantifiable leaks or test combinations of stresses.

CONCLUSIONS

A specific experimental installation was designed and set-up by INERIS in order to study potential leakages on fittings commonly used in H 2 existing systems. This test bench enables:

-to accurately quantify, when existing, leakages with a flow rate above 10 -2 cm 3 .s -1 , -to carry out the tests with hydrogen in safe conditions, -to reach test pressures up to 700 bar, -to perform stresses on fittings under H 2 pressure (i.e. "dynamic stresses").

Four kinds of fittings -double ring tube fittings of different trade marks or sizes, and threaded ring tube fitting -were tested in different stress configurations representing forces or damages due to lifetime of the system, maintenance actions, non conforming assembly or use etc.

Surprisingly, but reassuringly, very few scenarii gave rise to quantifiable leaks; because nonexistent or under test bench detectable thresholds.

Only two stress configurations with the highest fitting sizes showed measurable but low leak flow rates compared to values usually employed for risk assessment:

-0.05 cm 3 .s -1 for the Swagelok ® 1/2'' medium-pressure double ring tube fitting after 50 cycles of assembly-dismantling, -and 4.3 cm 3 .s -1 for a 25% under-tightening of the Maximator ® 9/16'' threaded ring tube fitting.

The potential hazard arising from these leaks depends on the ability of the confinement surrounding the fitting to accumulate or disperse any flammable hydrogen-air mixtures. For considered hydrogen systems in H2E project, the present leakage rates are much too low to produce locally a slightly flammable atmosphere; a leakage rate of a few tens of cm 3 .s -1 would be required. A different conclusion may be given for other types of confinement.

To complete this work, some tests could be performed to determine critical stress levels giving rise to significant leaks, or other kinds of stresses -like vibrations for example or some combinations of stresses -could be applied on fittings in order to assess their effects.