# Design and implementation of the safety system of a solar-driven smart micro-grid comprising hydrogen production for electricity & cooling co-generation

Franco Ferrucci

► To cite this version:

Franco Ferrucci. Design and implementation of the safety system of a solar-driven smart micro-grid comprising hydrogen production for electricity & cooling co-generation. International Journal of Hydrogen Energy, 2024, 51, pp.1096-1119. 10.1016/j.ijhydene.2023.09.318. hal-04448007

HAL Id: hal-04448007

https://hal.science/hal-04448007v1

Submitted on 8 Feb 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

# Design and implementation of the safety system of a solar-driven smart micro-grid comprising hydrogen production for electricity & cooling co-generation

Franco Ferrucci

GEPASUD Laboratory, University of French Polynesia, BP 6570, 98702 Tahiti, French Polynesia

## ARTICLE INFO

**Keywords:**

- Safety system design
- Hydrogen safety
- Experimental
- Microgrid
- ATEX
- Heat recovery

## ABSTRACT

This article presents a comprehensive description of the safety system of a real installation that comprises PV panels, lithium-ion batteries, an electrolyzer, H₂ storage, a fuel cell, and a barium chloride/ammonia thermo-chemical prototype for heat recovery and cooling production. Such a system allows for the increase of the overall efficiency of the H₂ chain by exploiting the waste heat and transforming it into a cooling effect, particularly useful in tropical regions like French Polynesia.

The study provides a great deal of detail regarding practical aspects of the system implementation and a consistent reference to the relevant standards and regulations applicable to the subject matter. More specifically, the study covers the ATEX classification of the site, the safety features of each component, the electrical power distribution, the main safety instrumented system, fire safety and the force ventilation system. The study also includes safety assessment and a section on lessons learned that could serve as guidance for future installations. In addition, an extensive amount of technical data is readily available to the reader in repository (P&ID, electrical diagrams, etc.).

## 1. Introduction

The energy situation in tropical insular regions, such as French Polynesia, poses several challenges, including heavy reliance on imported fuel, expensive mainland transport, and weak electricity grids. However, these regions boast abundant renewable energy resources, making them well-suited for smart microgrids and energy storage technologies. In terms of electricity demand, the consistently high temperatures in these areas result in a significant portion of energy usage (about 40%) dedicated to space cooling.

French Polynesia encompasses over one hundred islands and atolls, spanning an area roughly equivalent to Western Europe [1]. A significant portion of these islands remains uninhabited, while others have sparse populations. The region's primary energy imports account for more than 94% of total energy consumption, rendering it vulnerable to fluctuating oil prices [2]. Additionally, the cost of electricity for a small household (3000 kWh/year) stands at around 0.50 USD/kWh [3], surpassing prices in North America [4] and Europe [5] by two to threefold.

On a positive note, French Polynesia boasts abundant renewable resources, particularly solar energy. For instance, the average global solar horizontal irradiation across the most populated islands amounts

to 5.8 kWh/m²/day [6]. Such high solar potential makes solar energy exploitation in French Polynesia an enticing prospect, especially for photovoltaic technology due to its maturity, decreasing costs, and suitability for projects of varying scales. Refer, for instance, to the work of Bosetti [7] for insight into the future prospects of photovoltaic technology, and to the article by Zhang [8] for an assessment of PV technologies from the sustainability perspective.

Despite the aforementioned points, the inherent stochastic nature of solar energy poses a challenge as its production cannot be easily regulated to meet electricity demands. However, the integration of smart electricity grids with energy storage systems has emerged as a successful solution to overcome these difficulties [9]. In this context, Lamnatou [10] provides a review of smart-grids state-of-the-art in relation to photovoltaic electricity, storage systems, buildings and the environment.

Concerning electricity storage, Koohi-Fayegh [11] provides a review of energy storage types, applications, and recent developments, including thermochemical and hydrogen technologies, both of which are employed within the context of this study. Among the array of available storage technologies, hydrogen is being increasingly explored as a viable alternative to lithium-ion (Li-ion) batteries for various applications, such as seasonal storage, power systems [12] and

<footnote>E-mail address: franco.ferrucci@upf.pf.</footnote>
Nomenclature & abbreviations

1oo2 One-out-of-two configuration (in the context of safety systems with redundancy)

316L Marine grade stainless steel

AC Alternating current or Air conditioning

ASHRAE American Society of Heating, Refrigerating and Air-Conditioning Engineers

ATEX Explosive atmosphere (from the French *ATmosphere EXPlosible*)

atm atmosphere

ASTM American Society for Testing and Materials

AVG Average

B10 Bearing life (i.e. the point at which 10% of units in a population will fail)

BaCl₂ Barium chloride

barg bar gauge (i.e. pressure referenced to atmospheric pressure)

Buna-N Nitrile butadiene rubber (tubing material)

CCF Common cause failure

coord Coordinates (used in the text to identify elements in the figures)

DC Direct current or Diagnostic coverage

EN European Standard (from the German name *Europäische Norm*)

ENG Expanded natural graphite

EU European Union

FP French Polynesia

H Height

H₂ Hydrogen

HVAC Heating, ventilating and air conditioning

IEC International Electrotechnical Commission

INERIS French National Institute for Industrial Environment and Risks (from the French *Institut national de l'environnement industriel et des risques*)

ISO International Organization for Standardization

L, l Liter or length

LFL Lower flammability limit

MCB Miniature circuit breaker

MPP Maximum power point

MPPT Maximum power point tracking

MTTF Mean time to failure

MVC Mechanical vapor compression refrigeration cycle

N Normal (see NTP)

N₂ Nitrogen gas

NC Normally closed

NE Negligible extent

NF French standard (from the French name *Norme Française*)

NH₃ Ammonia

NIST National Institute of Standards and Technology (United States Department of Commerce)

NO Normally open

NOP Number of operations

NTP Normal temperature and pressure (NIST definition)

P Pressure

PA Polyamide (tubing material)

PEM Proton-exchange membrane

PFH Probability of a dangerous failure per hour

PL Performance level (ISO 13849-1 standard)

PLr Required performance level (ISO 13849-1 standard)

PLC Programmable logic controller

PV Photovoltaic

R-717 Ammonia (ASHRAE refrigerant code)

PRV Pressure relief valve

P&ID Piping & instrumentation diagram

RECIF Micro-Réseau isolé de Cogénération Intelligente d'électricité/Froid French for *isolated micro-grid for smart cogeneration of electricity/cold*)

SCADA Supervisory control and data acquisition

SIL Safety integrity level (IEC 61508 standard series)

SIS Safety instrumented system

SIF Safety instrumented function

T Temperature

TPRD Thermal pressure relief device

TR Thermochemical reactor

UFL Upper flammability limit

v/v Volume fraction

W Width

Greek letters

λ Failure rate

Subscripts

D Dangerous or Detected

U Undetected

transportation [13]. Another benefit is the fact that hydrogen systems can be easily scaled up to meet growing energy demands. Furthermore, hydrogen can be produced from renewable energy using electrolyzers which split water into its constituent elements, hydrogen and oxygen. Subsequently, electricity can be produced from hydrogen in a fuel cell. However, electrolyzers and fuel cells have a limited efficiencies (~40.80%), meaning that a non-negligible amount of energy is released as heat into the environment. For a critical review of hydrogen energy systems, including applications, trends, and challenges, see the work by Yue [14].

In this context, the RECIF project [15] was launched in 2018 with the objective of studying and implementing a smart micro-grid that couples a *hydrogen chain* (electrolyzer + storage + fuel cell) with a *thermochemical unit* in the tropical insular region of French Polynesia. The thermochemical unit is designed to recover waste heat from the electrolyzer and fuel cell to enable deferred cooling production for air conditioning purposes. This coupling permits an improvement in the overall efficiency of the installation, distinguishing it from other installations that release heat into the environment (refer to, for example,

the work of N. Endo [16]).

In broader terms, the RECIF project revolves around the integration of hydrogen in smart buildings and smart grids. In that context, readers can refer to the work by Lin [17], which provides a comprehensive overview of the subject. Moving to a more practical aspect, Valverde [18,19] presents an example of an experimental set-up focusing on the modeling & real-time control of an installation that comprises a hydrogen chain. It's important to note that the proposed set-up does not include heat recovery.

Thermochemical processes enable the storage of energy in the form of chemical potential with virtually no losses, which can be used to produce cold during the evening hours without the need for running a compressor. These processes are implemented using thermochemical reactors, where a reversible chemical reaction between a solid compound and a gas takes place. This technology has found its footing in solar cooling applications, where it is mainly utilized in conjunction with solar thermal collectors. Detailed reviews of these systems are provided by Kim [20] and Ferreira [21]. A recent application of this technology is seen in the MiniStor project [22] (2019–2024), which
combines photovoltaic thermal systems, solar collectors, thermochemical technology, and phase-change materials for thermal energy storage, heating, and cooling production.

The thermochemical solid/gas pair used in the RECIF installation is barium chloride salt (BaCl₂) reacting with ammonia (NH₃), which also serves as the coolant fluid in the refrigeration circuit [6]. This pair has the advantage of being able to work with heating sources of relatively low temperature (55 °C), making it compatible with PEM electrolyzers and fuel cells. A comprehensive review of PEM fuel cells and electrolyzers heat recovery methods has been conducted by Wilberforce [23].

The RECIF installation is located on the campus of French Polynesia University and it comprises a hybrid inverter, PV panels, a PEM electrolyzer for H₂ production, a H₂ storage tank, a PEM fuel cell for electricity production from stored H₂, a Li-ion battery pack for power balance and short-term energy storage, a controllable electrical load, and a custom-made air conditioning system with a barium chloride/ammonia thermochemical unit. All these components are installed in a 20-foot container.

The commissioning of such an installation was very challenging, mainly due to the lack of experience in the territory with this type of installation and an unclear regulatory context regarding safety systems and explosive atmospheres. It is worth mentioning that the fuel cell from RECIF project is the only one installed in French Polynesia so far. Based on the author's experience in safety systems, the project team decided to undertake in-house the development of the safety system, with the valuable support and expertise of an international inspection and certification company.

This article focuses on the technical, practical and regulatory aspects of the safety system of RECIF installation. Readers can also refer to other research works for a more in-depth understanding of ventilation aspects in relation to other hydrogen installations, such as the studies performed by Dixit [24], Lee [25], Cerchiara [26] and Patel [27]. In the former three articles, the ventilation design and sensor placement are analyzed with the aid of computational fluid dynamics (CFD), while the latter takes a more experimental approach. Other researchers focus their attention on the analysis of incidental events databases and the lessons learned from them. Refer, for example, to the work of J. Wen [28] and M. West [29] for more information. In a similar theme to that of this work, Nieto [30] presents a preliminary study regarding the adequacy of a laboratory to accommodate electrolyzers, hydrogen storage, and fuel cells, covering hazardous area classification and ventilation design.

The rest of this work is organized as follows. Section 2 presents the regulatory context of installations involving H₂ and NH₃, where an explosive atmosphere may be formed. Section 3 provides a description of the RECIF installation and site. Section 4 offers a comprehensive examination of the safety system. Section 5 presents the discussions. Section 6 lays out the conclusions of the work. Finally, the Appendix provides additional information about the installation and the safety system.

## 2. Regulatory context

### 2.1. Explosive atmospheres

In the European regulatory context, the use of hydrogen is governed by various regulations and standards aimed at ensuring safety, environmental protection, and harmonized practices. They include European Union (EU) Directives, safety standards and harmonized certification and approval. The regulations for hazardous locations are covered by the ATEX (Atmosphères Explosibles) directives, which set out the requirements for equipment and protective systems intended for use in potentially explosive atmospheres. The standards that cover explosive atmospheres corresponds to the EN 60079 series.

In France, the EU ATEX directives was transposed into law by a number of decrees amending the Labor Code, notably 4216-31 and 4227-42 to 4227-54 articles [31].

French Polynesia has a Labor Code that slightly differs from the French one and some of the articles related to explosive atmospheres have been left out. This unclear regulatory context produced an initial confusion about the legal requirements of the installation regarding explosion prevention & safety. Finally, in concertation with the inspection and certification company that was commissioned to validate installation, it was decided to follow the French code.

### 2.2. Use of ammonia in refrigeration systems

Ammonia (NH₃) is an efficient refrigerant due to its superior thermodynamic properties. Using NH₃ has the advantages of being readily available, inexpensive, does not contribute to ozone layer depletion, greenhouse effect or global warming, and is biodegradable [32]. However, its toxicity is such that it requires taking unique safety measures. Ammonia is a lighter than air gas with a unique pungent odor and can be easily detected by smell when the concentration is well below any dangerous level.

In Europe, the use of NH₃ as a refrigerant is governed by EN 378 standard series [33–35] which sets the safety and environmental requirements for refrigeration systems and heat pumps. According to this standard, ammonia is classified in the safety group B2L, which means that it is considered mild flammability and high toxicity. Table 11 in the Appendix gives information about the flammability and occupational exposure limits of ammonia.

## 3. Installation description

### 3.1. Overview

Fig. 1 shows a block diagram of RECIF installation, comprising the following components: a hybrid inverter, PV panels, a Li-ion battery pack, a PEM electrolyzer for H₂ production, a H₂ storage tank, a PEM fuel cell for electricity production from stored H₂, a controllable electrical load and a custom-made air conditioning system with a thermochemical unit for thermal energy storage and deferred cold production. Table 1 summarizes the technical specifications of the system components.

The inverter is connected to the grid and it can also work off-grid (hence the term *hybrid* inverter), producing a 3-phase voltage generator. When connected to the grid, the inverter can either draw power to supply the inverter's AC output, or it can channel power generated by the PV panels into the grid. The electrical load corresponds to a custom-made single-phase AC load emulator, comprising an array of power resistors controllable by a network link. The thermal load shown in Fig. 1 corresponds to the space inside the container in which the components are installed, which needs air conditioning.

The inverter also features a DC connection, where the Li-ion battery pack and the fuel cell are linked. This input serves to draw power from the battery (with a fast response time) and/or the fuel cell (with a slower response time) when there is insufficient PV power to meet the load demand, and when the grid is inaccessible or deliberately avoided. In this scenario, the fuel cell functions as a controllable current source connected in parallel to the battery pack (refer to Fig. 11 for a detailed illustration of this arrangement), charging the battery while potentially supplying power to the inverter. Conversely, the inverter's DC connection is also utilized for charging the Li-ion batteries using surplus electricity generated by the PV panels.

The air conditioning system corresponds to an ammonia-refrigerant mechanical vapor compression (MVC) refrigeration unit (i.e. evaporator, compressor, condenser, reservoir and throttling valve) for instantaneous cold production and a thermochemical unit for energy storage and deferred cold production. The thermochemical storage covers heat from the electrolyzer and fuel cell and transforms it into chemical potential energy that is used later to produce a cooling effect without the need to run the electrical compressor. The unit is a prototype
<figure><img src="image_3.png" /><figcaption>Fig. 1. General block diagram of RECIF installation.</figcaption></figure>

built by the author of this article during his PhD studies [36].

The power flow between all the components is controlled by a supervisory control and data acquisition (SCADA) system that implements an optimization strategy and it is enhanced by a weather short-term forecasting (sky imaging and a neural network algorithm) and an electrical & thermal load forecasting. The forecasting and optimization work was the subject matter of two PhD thesis under RECIF project (see Refs. [37, 38]). While not depicted in Fig. 1, the SCADA system receives information from all system components to enable its operation. This includes data such as instantaneous electrical power from all components, battery state of charge, available H₂ mass, thermal heat transfers, and more.

In broad terms, the primary goal of the installation is twofold: to provide power to the electrical load and maintain a suitable level of thermal comfort inside the container. All of this must be achieved while minimizing, or even avoiding, power drawn from the grid and optimizing the system performance, thereby extending the lifespan of key components such as the fuel cell, electrolyzer, and Li-ion batteries.

## 3.2. Site

The RECIF facility is located on the campus of the University of French Polynesia, in Punaauia, Tahiti, French Polynesia. It consists of a conventional 20-foot container (LxHxW 6 m x 2.60 m x 2.44 m) specially fitted out, installed on a concrete slab inside a fenced enclosure whose access is strictly reserved for operators. Fig. 2 shows some photographs of the installation and Fig. 3 represents isometric sketch with all the main components. Note that the PV panels do not appear in the photographs since their installation in ongoing. The container is located ~10 m away from a pre-existing machine room that contains the chiller system of one of the buildings of the University.

The container has a side access door and two hinged doors at both ends and it is divided into two by a metallic wall that provides a physical separation against gas leaks. The division creates two isolated spaces, namely closed space and open space. The former (~25 m³) contains most of the equipment (electrolyzer, fuel cell, etc.) and it is where the operators work (2 people). The latter (~8 m³) has two openings of 2 m² each, protected by a wire mesh, and contains a distilled water tank, an 850L H₂ reservoir and a number of maneuver, safety and instrumentation devices. Fig. 4 shows some photographs of the container close and open spaces.

## 3.3. Piping & instrumentation

In this section the piping & instrumentation diagram (P&ID) of the installation is described (Figs. 5–9). Note that all the components have a distinct nomenclature which is listed in Appendix, Table 12.

Fig. 5 depicts the P&ID of the container, open space, where the H₂ tank is located. There are two H₂ wall crossings between the open and closed space of the container that connect to the electrolyzer and fuel cell. Since this zone is classified as Zone 2 (see Sec. 4.1), all the instrumentation installed there is ATEX-certified. The pressure and temperature transmitters TT001 and PT001 (D5 coord.) allow for an estimation of the content of gas in the H₂ tank while the flow rate meter FT001 (D3 coord.) is used to compute the fuel cell gas consumption (0.30 N L/min, 5bar max). The pressure regulator PV001 is used to fix the fuel cell inlet pressure to 4bar. The solenoid valve FV002 is part of the safety system and interrupts the gas supply to the fuel cell. A number of other components shown in Fig. 5 also belong to the safety system of the installation and are further developed in Sec. 4.5.1.

Fig. 6 shows the water circuit that feeds the electrolyzer. It is composed by two demineralized water tanks, a pump and a demineralizer. Water from the first tank (1 m³ reservoir with demineralized water, <50 µS/cm) passes through the pump and demineralizer and it is stored at the second tank (100L, reservoir with ASTM type-II demineralized water). An outlet of this second tank is connected to the electrolyzer water inlet. Additionally, the condensed humidity extracted by the H₂ dryer is recycled back to the first tank.

Figs. 7 and 8 show the electrolyzer/dryer and the fuel cell, respectively. The electrolyzer and fuel cell are cooled by a common water circuit, as described below.

The path of H₂ flow, from production to storage, is as follows: H₂ gas exits the electrolyzer (Fig. 7, coord. D7) through a stainless-steel tube and passes through the metallic wall that separates the container’s close space from the container’s open space (refer to bulkhead union fitting X106 in Fig. 5, coord. C2) to reach the H₂ reservoir, shown in Fig. 5, coord. E6.

The H₂ flow path from storage to consumption is as follows: H₂ from the reservoir crosses the same metallic wall (refer to bulkhead union fitting X004 in Fig. 5, coord. D2) and reaches the fuel cell, as indicated in Fig. 8, coord. B3. Most of this path is comprised of stainless-steel tubing, except for the last meter, which employs a flexible connection (refer to component X 111 in Fig. 8, coord. B4) compatible with pressurized H₂ gas circuits.
<table><caption>**Table 1**
System components specifications.</caption><thead><tr><th>Function</th><th>Component</th><th>Specifications</th></tr></thead><tbody><tr><td>H<sub>2</sub> production</td><td>PEM electrolyzer</td><td>Nominal: 5.5 kW<sub>elec</sub> (AC input with internal AC/DC converter), 1Nm<sup>3</sup>/h H<sub>2</sub>, 50bar max, 5L/h demineralized water, water-cooled, 1.3kW<sub>th</sub>, 70 °C max.<br>Operating point: 2.1kW<sub>elec</sub>, 0.64Nm<sup>3</sup>/h H<sub>2</sub> (53 g/h H<sub>2</sub>), 25bar max, η = 0.71.<br>O<sub>2</sub> and water removal: 0.4 kW<sub>elec</sub> nominal, 1.8 kW<sub>elec</sub> at startup, 1Nm<sup>3</sup>/h H<sub>2</sub>, 50bar max.</td></tr><tr><td>H<sub>2</sub> storage</td><td>H<sub>2</sub> dryer</td><td>850L, 50 bar max. Type IV pressure vessel.</td></tr><tr><td>H<sub>2</sub> utilization</td><td>PEM fuel cell</td><td>P = 0.14kW<sub>elec</sub>. Stack: 0.80A, 0.18VDC, followed by an internal DC/DC converter to interface with the 48VDC battery bus. η<sub>max</sub> ≈ 53%, 1Nm<sup>3</sup>/h H<sub>2</sub> (80 g/h H<sub>2</sub>), water-cooled, 70 °C max. Input pressure: 4 bar.</td></tr><tr><td>Water storage and demineralization</td><td>Water tanks & demineralizer</td><td>1000L untreated water tank, 100L demineralized water tank. Demineralization capacity: 7L/min.</td></tr><tr><td>Electrical storage</td><td>Li-ion batteries</td><td>LiFePO<sub>4</sub>, 2 × 2.4 kWh (parallel connection), 48V, 25A charge/discharge nominal, <6000 cycles.</td></tr><tr><td>Generic electrical load</td><td>Electrical load</td><td>Custom-made AC load emulator, comprising an array of power resistors. Range: 0.3 kW in steps of ~11W, controllable via Modbus protocol.</td></tr><tr><td>Electricity flow management</td><td>Inverter</td><td>Output: 10 kW (400V ~3AC, 3.3 kW per phase). PV: 2 MPPT inputs, 15kW<sub>PV,max</sub>. Grid: 10 kW grid input (400V ~3AC).<br>Battery: 48VDC, 200A<sub>max</sub>.</td></tr><tr><td>Renewable electricity production</td><td>PV panels</td><td>4.9kW<sub>MPP</sub>, 23m<sup>2</sup> (12 panels, three different models, bifacial, 17° elevation, north-oriented). PV panels shared with PVCAM program [39].</td></tr><tr><td>NH<sub>3</sub>-based air conditioning</td><td>Thermochemical prototype</td><td>3kW<sub>e</sub> compressor (variable speed); 6kW<sub>th</sub> cooling capacity; cooling temperature range: 15°.+10°.</td></tr><tr><td>Thermochemical storage</td><td>Thermochemical reactor</td><td>Salt pair: BaCl<sub>2</sub>/NH<sub>3</sub>, 13.6 kg BaCl<sub>2</sub>, 2.21 kg ENG, 9 kg NH<sub>3</sub>, 100 L, 3 kWh<sub>th</sub> of cooling production @ 7 °C.</td></tr></tbody></table>

Fig. 9 shows the cooling water system of the installation and the thermochemical prototype. The water system has two main functions: (a) to extract heat from the electrolyzer and fuel cell (which are never turned on at the same time) and transports it either to the thermochemical reactor (TR) for energy storage or, if the TR cannot absorb any more heat, to a water-air heat exchanger installed outside the container (HX101, C1 coord.); (b) to cool-down the TR (by connecting it to HX101) when the thermochemical prototype is using the energy previously stored to produce a cooling effect (without the need of the electrical compressor of the MVC cycle). A detailed working principle of the thermochemical prototype can be found in Ref. [6] and an its basic operating modes are also described in Appendix A.4.

As indicated in Table 1, the thermochemical prototype has 9 kg of NH<sub>3</sub>. This charge agrees with the limits imposed by EN 378-1 [33] for a site with access category 'c' (reserved access), site classification 'class IV', i.e. ventilated enclosure, machine room (see EN 378-1, §C.1). As 'class IV', the site respects the requirements for a ventilated enclosure stated in EN 378-2 [34], §6.2.15 (requirements for ventilated enclosures).

## 4. Safety system

As mentioned in the introduction, the RECIF installation has an automatic safety system that protects the facility and personnel from the following risks: i) fire hazard, ii) explosion risks related to H<sub>2</sub> and NH<sub>3</sub> gases and iii) poisoning risk associated with NH<sub>3</sub>.

This section describes the safety system and is organized as follows. Sec. 4.1 gives an overview of the risk analysis performed during the project conception and the resulting ATEX zone classification retained. Sec. 4.2 describes the electrical power distribution. Sec. 4.3 details the container ventilation system and its operating modes. Sec. 4.4 presents the fire safety measures. Sec. 4.5 describes the safety system integrated into the individual equipment. Lastly, Sec. 4.6 discusses the automatic safety instrumented system that protects the overall installation.

### 4.1. Classification of ATEX areas & risk analysis

The methodology adopted to determine the presence of ATEX zones is divided into three steps:

<figure><img src="image_4.png" /><figcaption>**Fig. 2.** Photographs of RECIF site (installation of PV panels is ongoing). Site geolocation: 17°34'34.2"S 149°36'33.7"W.</figcaption></figure>

a. Identify substances that may release flammable gases or vapors implemented at the RECIF site.

b. Locate areas where explosive atmospheres may occur based on the implemented processes.

c. Through the application of standard IEC 60079-10-1 [41], define the nature of ATEX zones (Z0, Z1, Z2, Z2-NE [negligible extent] or non-hazardous zone) and their extent. See example E.3 from that standard. In certain situations, validate the contribution of forced ventilation in conjunction with the safety system operation in diluting potential emissions of NH<sub>3</sub> and H<sub>2</sub> through a simulation, as it will be shown in Sec. 5.2.

The resulting hazardous area classification is commonly depicted in two-dimensional views of the installation, as shown in Fig. 10 for the RECIF installation. In these views, each hazardous area is displayed using a distinctive hatch pattern.

The application of the aforementioned standard led to the identification of eight hazardous areas (#1 to #8 in Fig. 10). Many of the hazardous areas have a spherical shape (possibly limited by walls, floor, ceiling, etc.), centered around the potential leak origin or gas discharge source. This configuration applies to areas #2, #4, #5, #6 and #8. The radii of the spheres were determined by the aforementioned standard (refer to Figure D.1 of [41]). Area #1 pertains to the container's open space, where H<sub>2</sub> storage and distribution are carried out (refer to the bottom-center photograph in Fig. 4). Area #3 refers to the regions
<figure><img src="image_5.png" /><figcaption>Fig. 3. Isometric view of RECIF site once the solar panels and the corresponding structure will be installed.</figcaption></figure>

<figure><img src="image_6.png" /><figcaption>Fig. 4. Photographs of container open and close spaces: (1) Fuel cell (2) Electrolyzer (3) Dryer (4) Thermochemical reactor (5) Extractor #1 (6) H₂ transmitter #1 (7) NH₃ transmitter (8) H₂ transmitter #2 (9) Automatic fire extinguisher (10) Water demineralizer (11) Bottom air vent (12) Top air vent (13) 100L distilled water tank (14) Inverter (15) CAB-3 cabinet(*) (16) Transformer(*) (17) Cooling water system (18) Air conditioner(**) (19) Visual alarm (20) Extractor #2 (21) Thermochemical prototype (22) Network rack (23) PC with SCADA (24) CAB-2 cabinet, exterior (25) 1 m³ water tank (26) H₂ tank (27) H₂ purges (28) H₂ distribution. (*)See electrical diagram in Ref. [46]. (**) Does not correspond to the thermochemical unit; used to acclimatize the room when the thermochemical prototype is not in operation.</figcaption></figure>

immediately outside the two 2 m² ventilation grids placed on each side of the container's open space. Lastly, area #7 corresponds to the container's close space, where the main components are situated (refer to the three upper photographs in Fig. 4). It's important to note that this area is classified as a non-hazardous zone due to the combined operation of the forced ventilation and the safety system (see Sec. 5.2).

Regarding the quantitative risk analysis, it followed a procedure suggested by the inspection & certification company specialized in ATEX installations commissioned to validate RECIF installation, using a number of matrices, namely: *explosion probability matrix*, *ignition sources probability matrix*, *severity matrix* and *explosion risk matrix*. This analysis made it possible to define the measures to be taken (both technical and
<figure><img src="image_7.png" /><figcaption>Fig. 5. P&ID, hydrogen storage and distribution.</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Fig. 6. P&ID, water storage and demineralization to feed the electrolyzer.</figcaption></figure>

organizational) to ensure that the ignition of a possible explosive atmosphere cannot occur within the framework of the normal use of the equipment and the installation.

## 4.2. Electrical power distribution

Fig. 11 shows a simplified view of the electricity distribution of RECIF installation. The complete electrical diagram of the installation is fully available at [46].

The installation has two distinct power supplies, namely conventional

AC power and safety system AC power, which comes from the same connection point to the 3-phase AC utility power. This connection is done in 'CAB-1' electrical cabinet, installed in a pre-existing machine room that is located 10 m away from the container (see Fig. 3).

The two power supplies are protected against short-circuits and overcurrent by electromagnetic MCB (-Q.1.1 & -Q.1.2), which are mechanically linked to undervoltage release coils. These last devices are commanded by an emergency stop button (-S.1.0, Fig. 11, B2 coord.) which triggers a power trip when pushed. The use of this emergency button is in case of a maintenance operation or, for instance, in case of a
<figure><img src="image_9.png" /><figcaption>Fig. 7. P&ID, electrolyzer & dryer.</figcaption></figure>

<figure><img src="image_10.png" /><figcaption>Fig. 8. P&ID, hydrogen fuel cell.</figcaption></figure>

fire hazard, where the operator can produce an AC power trip while staying away from the installation.

The two power supplies are connected to ‘CAB-2’ electrical cabinet

through underground cables. Fig. 12 shows a front view of CAB-2, which is installed on the front outside wall of container (see the isometric view of Fig. 3). This cabinet contains all the safety instrumentation, such as
<figure><img src="image_11.png" /><figcaption>Fig. 9. P&ID, fuel cell and electrolyzer cooling system & thermochemical prototype for cooling production and storage.</figcaption></figure>

<figure><img src="image_12.png" /><figcaption>Fig. 10. ATEX zones definition of RECIF installation.</figcaption></figure>

AC/DC power, safety PLC, contactors and relays.

The safety system AC power line enters CAB-2 cabinet and supplies electricity to the extractors, lights and all the 24VDC safety instrumentation (Fig. 11, C3 coord.).

Inside the container the inverter distributes all the power sources/sinks (utility, PV, Li-ion battery, fuel cell, electrolyzer, NH₃ prototype and general electrical loads) according to an optimizing algorithm.

Fig. 11 shows that these components can be disconnected through a number of contactors which are controlled by the safety PLC (see Sec. 4.6.2). Table 2 gives a description of each of these contactors, which are all installed in CAB-2, outside the container (so the contactors can switch in an environment where an explosive atmosphere is extremely unlikely to happen).

Regarding the operation of the inverter, Fig. 13 illustrates its
<figure><img src="image_13.png" /><figcaption>Fig. 11. Electricity and hydrogen supply to container.</figcaption></figure>

<figure><img src="image_14.png" /><figcaption>Fig. 12. “CAB-2” electrical cabinet that contains the safety PLC; it is installed on the front outside wall of container. Some of the components coding (e.g. -S.2.40, -PF.2.14) can also be found in Figs. 11, Figs. 14 and 15.</figcaption></figure>

<caption>Table 2</caption>

Description of all the contactors used to disconnect the power flow in the container.

<table><thead><tr><th>ITEM</th><th>DESCRIPTION</th></tr></thead><tbody><tr><td>①</td><td><strong>Solenoid valve of fuel cell H<sub>2</sub> supply.</strong><br>24Vdc power interrupted via safety relay -K.2.54 (relay with supervised internal safety function, category 4/PL e). -K.2.54 is commanded by the safety PLC.</td></tr><tr><td>②</td><td><strong>Power supply to electrolyzer (H<sub>2</sub> production).</strong><br>Single-phase power interrupted via contactors -K.2.50 and -K.2.51 connected in series (230VAC, 25A; with NC mirror contacts). Contactors commanded by the safety PLC.</td></tr><tr><td>③</td><td><strong>Connection between fuel cell, Li-ion batteries and inverter.</strong><br>These components are isolated from each other via -K.2.06 contactor (75VDC, 32A; with NC mirror contact). Contactor commanded by the safety PLC.</td></tr><tr><td>④</td><td><strong>Conventional AC power.</strong><br>Three-phase power interrupted via contactor -K.2.04 (400VAC, 25A; with NC mirror contact). Contactor commanded by the safety PLC.</td></tr><tr><td>⑤</td><td><strong>Connection of PV solar panel strings to inverter.</strong><br>Strings 1 and 2 are interrupted via contactors -K.2.40 and -K.2.41 respectively (900VDC, 50A, commanded by the safety PLC). These contactors do not have mechanically linked NC auxiliary contacts (almost non-existent on the market for the application of >800V DC). Therefore, the verification procedure for non-soldered contacts is done via periodic tests.</td></tr><tr><td>⑥</td><td><strong>Safety system AC power.</strong><br>Three-phase power interrupted via contactor -K.2.42 (400VAC, 25A; with NC mirror contact). Contactor commanded by a safety relay (see SIF #3 in Sec. 4.6.2 and Fig. 15).</td></tr><tr><td>⑦</td><td><strong>Conventional and Safety System AC power.</strong><br>Miniature circuit breakers -Q.1.1 (4 × 50A “D”) and -Q.1.2 (4 × 32A “D”) with under-voltage release coils wired to stop button -S.1.1.</td></tr></tbody></table>

permissible operating modes. It's worth noting that the power harvested from the PV panels can be fed back into the grid in what is commonly referred to as “grid-tied” mode.
<figure><img src="image_15.png" /><figcaption>Fig. 13. Permissible operating modes of the inverter. The arrows correspond to the direction of power flow.</figcaption></figure>

### 4.3. Forced ventilation system

The closed space of the container (where the electrolyzer, fuel cell, battery and thermochemical prototype are installed) has a forced ventilation system with two operating modes: *continuous air renewal* and

*emergency ventilation*. The safety PLC controls these two operating modes, as it will be explained further below (see Fig. 14).

The system is implemented by two identical turret-type extractors (extractor # 1 and #2) installed on the roof of the container. Each extractor has a 3-phase AC induction motor and has a nominal flow rate of 1080 m³/h. The container air inflow is through four 20 × 20 cm air vents mounted at the bottom of the side walls (two on each side). There are also four 4 × 4 cm air vents installed at the top of the side walls to allows for natural ventilation (buoyancy-induced ventilation) when the forced ventilation system is not active. The estimated net air volume inside the container is 22 m³.

Both extractors are powered through the safety system AC power (Fig. 11, B4 coord.). Extractor #1 is energized through a variable speed drive unit and extractor #2 is connected to the 3-phase input power.

*Continuous air renewal* mode is manually controlled by the user (-S.2.04 rotary switch on the front of CAB-2, Fig. 12) and must be activated when the installation is in operation, otherwise the safety system will cut-off all the power supplies to the container, including the lights and the H2 solenoid valve that feeds the fuel cell. In this mode, an airflow of 460 m3/h is obtained using extractor #1 (via its variable speed driver unit), while extractor #2 is turned-off. This airflow value

<figure><img src="image_16.png" /><figcaption>Fig. 14. Block diagram of the logic solver of the SIS implemented in the safety PLC. Note that a logic ‘1’ represents a normal condition and ‘0’ a triggered condition (for the inputs, outputs and internal states).</figcaption></figure>

<figure><img src="image_17.png" /><figcaption>Fig. 15. Block diagram of the logic solver that implements SIF #3. Note that a logic ‘1’ represents a normal condition and ‘0’ a triggered condition.</figcaption></figure>
<table><caption>**Table 3**
Airflow of forced ventilation system specifications.</caption><thead><tr><th colspan="3">Airflow of forced ventilation system</th></tr><tr><th>Operating mode</th><th>Air flow (m³/h)</th><th>Renewal rate (air changes per hour)</th></tr></thead><tbody><tr><td>Continuous air renewal</td><td>460</td><td>20 (1 air change per 180 s)</td></tr><tr><td>Emergency ventilation</td><td>2160 (2 × 1080)</td><td>94 (1 air change per 38 s)</td></tr></tbody></table>

was established taking into account three parameters: i) the minimal allowed extractor motor speed (20 Hz), ii) a noise level inside the container compatible with a workplace and iii) the value recommended by the electrolyzer manufacturer (100 m3/h minimum).

To verify that the continuous air renewal mode is operational when activated by the user, a differential pressure transmitter for HVAC applications (±50 Pa) is installed inside ‘CAB-2’ cabinet. This device reads the pressure difference between two inlets (high & low pressure) and sends a 4.20 mA signal to a signal conditioner, which controls a NO contact that closes when the pressure difference is high. Each pressure inlet is connected to a Ø8mm PVC tube that enters the container. The low-pressure tube end is positioned close to extractor #1 air intake and the high-pressure tube end is located away from the extractors. This way, the safety system verifies that the aforementioned contact closes when the user activates the continuous air renewal system (thus creating a pressure difference) and that it opens when deactivated by the user (both cases with a 10-s delay), otherwise, a safety action is triggered (see Sec. 4.6.2).

In emergency ventilation mode, the two extractors work at their nominal speed, producing a total airflow of 2160 m³/h. Table 3 summarizes the airflow parameters of the forced ventilation system.

The extractors are ATEX-certified, adapted to work with a variable speed drive unit. Their motors have thermistors in contact with their stator windings to detect any overheating, particularly important when they are not operated at their nominal speed (see IEC 60079-14 [42], §11.3.4). Each motor thermistor is connected to an ATEX-certified thermistor-controlled relay that commands a contactor that disconnects the motor in case of an overheating detection.

Finally, the variable speed unit of extractor #1 has an integrated circuit breaker that protects the extractor motor and extractor #2 has a dedicated motor circuit breaker.

### 4.4. Fire safety and personnel protection

The fire safety is composed by fire extinguishers (manual & automatic), an ATEX-certified smoke detector inside the container, a manual call point and a sound alarm. All these three last components are connected to the University fire alarm system, whose interaction with RECIF safety system is detailed in Sec. 4.6.2. Table 4 gives the characteristics of the fire extinguishers.

Regarding personnel protection, the staff that operates the installation are equipped with antistatic clothing and footwear and portable H₂ and NH₃ detectors (ATEX-certified) with integrated sound and visual alarms. Furthermore, they have received ATEX training with an independent and certified organization.

<table><caption>**Table 4**
List of fire extinguishers of RECIF installation.</caption><thead><tr><th colspan="5">Fire extinguishers</th></tr><tr><th>Number</th><th>Class (agent)</th><th>Agent quantity (kg/L)</th><th>Manual/automatic</th><th>Localization</th></tr></thead><tbody><tr><td>#1</td><td>AB (H₂O + AFFF)</td><td>6 L</td><td>Manual</td><td>Exterior</td></tr><tr><td>#2</td><td>B (CO₂)</td><td>5 kg</td><td>Manual</td><td>Exterior</td></tr><tr><td>#3</td><td>ABC (ADEX K)</td><td>6 kg</td><td>Automatic, passive (68 °C)</td><td>Inside container, closed space</td></tr></tbody></table>

### 4.5. Safety systems integrated into individual equipment

#### 4.5.1. Hydrogen storage and distribution

The H₂ storage is located in the open space of the container, comprising an 850L H₂ tank at a maximum pressure of 60 bar, equipped with a set of maneuvering and safety elements and instrumentation devices. Fig. 5 shows the P&ID from which a number of safety devices are identified, namely:

1. FSV 001 (E8 coord.), manual emergency relief valve. The action on this valve allows the release of almost all the H₂ contained in the installation (except perhaps for the gas trapped inside the electrolyzer and the fuel cell) through a pipe that leads to the rear top of the installation (area #4 in Fig. 10), where a H₂ gas discharge does not present any danger. Possible uses of this valve are: a) before certain maintenance operation, b) in the event of a fire in the facility itself or in its surroundings (so if the fire reaches the tank, it would already be empty), c) an uncontrolled H₂ leak in some part of the installation.

2. TSV 001 (D6 coord.), thermal pressure relief device (TPRD) set at 110 °C with irreversible opening. It empties the H₂ in case of overheating. The discharge is done in the open space of the container.

3. PSV 001 (E7 coord.), H₂ tank pressure relief valve, set to 60 bar. Protection of the tank against overpressure. The discharge is through a pipe that follows the same path that the discharge of FSV 001 valve.

4. PSV 002 (D3 coord.), pressure relief valve set to 15 bar, installed downstream of the pressure regulator PV 001. Protection of the H₂ supply to the fuel cell. The release is through the same pipe of FSV 001 valve.

5. X 007 (B4 coord.), nitrogen gas cylinder. Use to for nitrogen purging of H₂ piping before certain maintenance operations and to inert the H₂ piping before a long period without operating the installation.

6. FV 003 (D3 coord.), downstream purge valve. Used to purge the gas trapped between the H₂ tank and the fuel cell, where several instrumentation devices are installed, allowing for maintenance operations on them.

7. FV 004 (A3 coord.), upstream purge valve. Used to purge the electrolyzer.

#### 4.5.2. Fuel cell

This device has an internal H₂ sensor set to 25% of the LFL. In the event of a gas detection, its internal safety system automatically cuts off its gas supply (solenoid valve, Fig. 8, B5 coord.), a red LED on the front panel lights up and an error flag is raised in the Modbus interface so the SCADA system can read it. The reset of the system after such an event is manual. The device also has an emergency stop push button for manual shutdown.

#### 4.5.3. Electrolyzer

This device also has an internal H₂ sensor set to 25% of the LFL which performs the following action upon a gas detection: i) interruption H₂ production if applicable, ii) activation of the extractor fan installed at the back of the device housing, iii) raise of an error flag in the Modbus interface that communicates to the SCADA, iv) lunch of its shutdown procedure that produces a purge of H₂ in order to depressurize the device.

In order to protect the electrolyzer against uncontrolled rise in pressure, the H₂ outlet that connects to the dryer has a 55 barg pressure-
relief valve whose discharge is connected to the H₂ purge line (Fig. 7, C5 coord.).

### 4.5.4. Air conditioner with thermochemical storage

This prototype has all the components of a conventional ammonia heat pump (compressor, condenser, ammonia tank, expansion valve, evaporator), with the addition of a thermochemical reactor which is heated by a water circuit at a maximum temperature of 70°.

The prototype is placed in a metal structure which protects all the components of the ammonia circuit against shocks. Additionally, to prevent ammonia spill reaching surface waters and to reduce the evaporating surface in case of a liquid leak, a catchment system was installed (in accordance to EN 378-3 [35], §5.14.3: Additional requirements for R-717).

From a safety point of view, the most critical element when the prototype is in operation corresponds to the compressor. To avoid accidental conditions due to an operation error, a number of transmitters (pressure, temperature and refrigerant level) were installed to implement a safety system that interrupts the power supply to the compressor when a dangerous condition is detected. The reset of the safety system is passive. The prototype also has a dedicated NH₃ gas detector that automatically shuts down the prototype (see Table 5) and an emergency stop push button for manual shutdown. Ref. [36] §A4.10.10 contains the description of the prototype safety logic.

### 4.5.5. SCADA system

The SCADA system is implemented in a desktop computer installed inside a container and it performs real-time data acquisition & control (both in automatic & manual mode) of the following elements: fuel cell, electrolyzer, thermochemical prototype, inverter, water cooling system and hydrogen storage. It also verifies the following safety conditions:

- that the pressure and temperature of the H₂ tank does not exceed 55 bar and 60 °C respectively (PT001 and TT001 transducers, Fig. 5, D5 coord.);

- that the fuel cell and electrolyzer do not indicate a hydrogen leak alarm (via their Modbus links).

If at least one of these conditions is not met, the supervisory system will send Modbus commands to turn off the electrolyzer and fuel in a safe manner and it will also energize a relay called the “SCADA interface relay” whose main contact is connected to the safety instrumented system (the corresponding action is explained in Sec. 4.6.2).

## 4.6. Safety instrumented system (SIS)

A safety instrumented system (SIS) is a specialized control system used to detect hazardous conditions and prevent accidents. It monitors process parameters and initiates safety responses when dangerous or abnormal states are detected. It is composed of sensors (gas detectors, emergency stop buttons, etc.), a logic solver (implemented in a safety PLC), and final elements. As it will be shown shortly, the SIS has a number of safety-related tasks, each one implemented in a separate safety instrumented function (SIF). The rest of this section is organized as follows: first, a description of the installed fixed gas detectors is given,

<table><caption>**Table 5**
Gas transmitters and trigger thresholds.</caption><thead><tr><th>Gas</th><th>Detector name</th><th>Location</th><th>Measuring principle</th><th>Alarm level (% of LFL)</th></tr></thead><tbody><tr><td rowspan="4">H<sub>2</sub></td><td>H<sub>2</sub> transmitter #1 (-B1)</td><td>Container, closed space</td><td>Catalytic combustion (CC)</td><td>10% (4000 ppm)</td></tr><tr><td>H<sub>2</sub> transmitter #2 (-B3)</td><td>Container, closed space</td><td>Electrochemical (EC)</td><td>5% (2000 ppm)</td></tr><tr><td>N/n</td><td>Inside fuel cell cabinet</td><td>Catalytic combustion (CC)</td><td>25% (10,000 ppm)</td></tr><tr><td>N/n</td><td>Inside electrolyzer cabinet</td><td>Not available</td><td>25% (10,000 ppm)</td></tr><tr><td rowspan="2">NH<sub>3</sub></td><td>NH<sub>3</sub> detector</td><td>Container, closed space</td><td>Electrochemical (EC)</td><td>0.015% (25 ppm)</td></tr><tr><td>N/n</td><td>Thermochemical prototype</td><td>Semiconductor (SC)</td><td>0.015% (25 ppm)</td></tr></tbody></table>

<table><caption>**Table 6**
Description of the blocks in Figs. 14 and 15.</caption><thead><tr><th>Block</th><th>Description</th></tr></thead><tbody><tr><td>AND gate</td><td>The output is '1' only if all inputs are '1', otherwise the output is '0'.</td></tr><tr><td>Memory element</td><td>The output is set to '0' at the negative edge of RESET input. The output is set to '1' if RESET input is '1' and there is a positive pulse (positive edge followed by a negative edge) into SET input. The output is initialized to '0' at system startup.</td></tr><tr><td>NOT gate</td><td>NOT gate followed by an indicator light. The light is 'on' if the input is '0', otherwise it is 'off'.</td></tr></tbody></table>

then the SIS structure is described and all the SIF are detailed; the section ends with some notes on the instrumentation used to implement the SIS.

### 4.6.1. Fixed gas detectors

Besides the gas detectors installed inside the equipment, there are two H₂ detector and one NH₃ detector installed in the close to the container ceiling (since both gases are lighter than air). These three detectors are part of the SIS and are connected to the safety PLC. The H₂ detectors are of different brands (Table 7) and measuring principle, which greatly reduces the common cause failures (CCF) (see Table 8). Table 5 summarizes all the gas detectors installed inside the container.

Regarding the alarm set points of the gas detectors, the French regulation was followed. More specifically, the circular of May 9, 1985 of the French Labor Code stays that [.] when substances are flammable gases or vapors, their concentration must be kept as low as possible and remain below 25% of the LFL [.] and at 10% of the LFL if people work in that atmosphere [40]. Note that the European regulation does not enforce any specific value (see IEC 60079-29-2 [44] regarding the installation, use and maintenance of gas detector for flammable gases, §8.11.3, Adjustment of alarm set points). With all this taken into consideration, a value of 5% and 10% of the LFL was established for the two H₂ detectors respectively and a much lower value for the NH₃ detector (due to its toxicity danger as previously stated in Table 11). The reason of the disparity of the set points of the H₂ detectors is due to equipment availability at the moment of the purchases.

### 4.6.2. Safety instrumented functions (SIF)

The SIS implements a number of safety instrumented functions (SIF), namely:

- SIF #1: disconnection of H₂ supply and electricity supply to container, comprising the following sub-functions:

#1a disconnection of fuel cell H₂ solenoid valve power supply (FV002, Fig. 11, D4 coord.);

#1b disconnection of electrolyzer power supply (-K.2.50 & -K.2.51, Fig. 11, E7 coord.);

#1c disconnection of all the electricity supplies in or toward the container: AC utility, PV, Li-ion battery, fuel cell;

- SIF #2: activation of the forced ventilation system in emergency mode (i.e. start of extractors #1 & #2), accompanied by a visual alarm;
<table><caption>**Table 7**

Reliability data of components of the safety functions shown in Fig. 18.</caption><thead><tr><th>Component</th><th>Brand & model</th><th>Parameter (Unit)</th><th>Value</th><th>Notes</th><th>Source</th></tr></thead><tbody><tr><td rowspan="2">H<sub>2</sub> transmitter #1 (-B1)</td><td rowspan="2">GfG, CC28</td><td>λ<sub>D</sub> (1/h)</td><td>6.31E-8</td><td>MTTF<sub>D</sub> = 1809 y</td><td>Manufacturer</td></tr><tr><td>DC (%)</td><td>81.4</td><td>–</td><td>Manufacturer</td></tr><tr><td rowspan="2">H<sub>2</sub> transmitter controller (-K.2.30)</td><td rowspan="2">GfG, GMA 44</td><td>λ<sub>D</sub> (1/h)</td><td>2.59E-8</td><td>MTTF<sub>D</sub> = 3869 y</td><td>Manufacturer</td></tr><tr><td>DC (%)</td><td>89.5</td><td>–</td><td>Manufacturer</td></tr><tr><td rowspan="2">H<sub>2</sub> transmitter #2 (-B3)</td><td rowspan="2">DEGA, NSH-EL II LCD RE</td><td>MTTF<sub>D</sub> (year)</td><td>3</td><td>No information from manufacturer, so a very low value of MTTF<sub>D</sub> was considered.</td><td>–</td></tr><tr><td>DC (%)</td><td>60</td><td>Processing unit: self-test by software.</td><td>ISO 13849-1:2015 [51], Table E.1</td></tr><tr><td>Safety PLC (-K.2.53)</td><td>ABB, Pluto B46 v2</td><td>PFH<sub>D</sub> (no units)</td><td>2.0E-9</td><td>Manufacturer ensures PL e compliance.</td><td>Manufacturer</td></tr><tr><td>Safety expansion relay (-K.2.54)</td><td>ABB, BT50</td><td>PFH<sub>D</sub> (no units)</td><td>1.22E-8</td><td>Manufacturer ensures PL e compliance.</td><td>Manufacturer</td></tr><tr><td rowspan="2">Trip contactor #1 & #2 (-K.2.50 & -K.2.51)</td><td rowspan="2">Schneider electric, LC1DT40BL + LAD4TBDL</td><td>B10<sub>D</sub> (cycles)</td><td>1,369,863</td><td>NOP = 12 cycles/year</td><td>Manufacturer</td></tr><tr><td>DC (%)</td><td>99</td><td>Direct monitoring (monitoring by mechanically linked contact elements).</td><td>ISO 13849-1: 2015 [51], Table E.1</td></tr></tbody></table>

<table><caption>**Table 8**

Reliability data of the sub-systems of Fig. 18, computed by SISTEMA. The CCF points where calculated according to ISO 13849-1:2015 [51], Table F.1. See Table 6.2 of [56] for more information about the column 'category'.</caption><thead><tr><th>Sub-system</th><th>MTTF<sub>D</sub> (years)</th><th>PFH<sub>D</sub> (1/h)</th><th>DC<sub>AVG</sub> (%)</th><th>CCF (points)</th><th>Category</th><th>PL</th></tr></thead><tbody><tr><td>H<sub>2</sub> transmitters</td><td>66.7</td><td>1.9E-07</td><td>60.1</td><td>90</td><td>3</td><td>d</td></tr><tr><td>Safety PLC</td><td>Not relevant</td><td>2.0E-09</td><td>Not relevant</td><td>Not relevant</td><td>4</td><td>e</td></tr><tr><td>Safety expansion relay</td><td>Not relevant</td><td>1.2E-08</td><td>Not relevant</td><td>Not relevant</td><td>4</td><td>e</td></tr><tr><td>Two-trip contactors</td><td>100</td><td>2.5E-08</td><td>99</td><td>75</td><td>3</td><td>d</td></tr></tbody></table>

- SIF #3: disconnection of all electricity power sources of the installation: conventional AC power and safety system AC power (in case of maintenance or fire hazard).

Fig. 14 shows a block diagram of the logic solver implemented in the safety PLC and Table 6 gives a description of all the blocks used in the figure. Note that, as in all safety logic functions, a '1' state represents a normal condition (e.g. emergency button not pressed, alarm not initiated, etc.), while a '0' means a triggered condition.

The inputs to the SIF are the following (from top to bottom on the left side of Fig. 14):

* H<sub>2</sub> and NH<sub>3</sub> detectors discussed in Sec. 4.6.1;

* a potential-free contact of the SCADA interface relay previously discussed in Sec. 4.5.5;

* an emergency button installed outside the container, on the front of CAB-2 cabinet (-S.2.02, Fig. 12);

* an emergency button installed inside the container, close to the door;

* an Extractors OK signal that indicates if the extractors are operational;

* a contact of the rotary switch that activates the air renewal mode of the force ventilation system.

The Extractor OK signal is '1' if and only if all of the following conditions are met: (a) the extractor #1 variable speed unit has no error (overcurrent, loss of phase, software fault, etc.), (b) extractor #2 motor circuit breaker is not tripped, (c) the extractors thermistor protection are not tripped (Sec. 4.3), (d), the differential pressure transmitter that verifies the operation of extractor #1 in the air renewal mode indicates the correct output (Sec. 4.3).

Besides the SIF, the logic solver has signaling outputs (i.e. non-safety functions) that activate a sound alarm and an indication to the University general fire system alarm. Fig. 14 also shows that the logic solver implements an interlocking logic that triggers SIF #1 if the operator does not activate the air renewal mode of the forced ventilation system (-S.2.04 rotary switch on the front of CAB-2), thus preventing any useful utilization of the installation.

The re-initialization of all the SIF and alarm & status signaling requires manual intervention (by pressing the corresponding push button on the front of CAB-2 cabinet).

Fig. 15 shows a block diagram of the SIF #3. Note that there are two ways of interrupting AC power to the container. The first one is by pushing the emergency button -S.1.1 in the machine room next to the RECIF installation, which interrupts both AC power supplies as previously shown in Fig. 11, B2 coord. The second way is by de-energizing (via a safety relay) -K.2.42 contactor which interrupts the safety system AC supply and, by cascading effect, opens -K.2.04 contactor, thus disconnecting the conventional AC power (Fig. 11, B3 coord.).

As indicated in Fig. 15, the University fire system alarm disconnects AC power to RECIF installation if one of the following conditions are met: (a) a smoke detection inside container, (b) a trigger signal from the University general fire system alarm (e.g. as a preventive action due to a fire hazard in another building of the University), and (c) a manual activation of the fire alarm by a button press of the call point installed outside the container, next to the door.

As a reminder, the shutdown of the safety system due to a fire hazard is necessary since the extractors are not adapted to work as a smoke extraction system (Sec. 4.4).

More detailed information of how the PLC safety outputs interact with the final safety components (H<sub>2</sub> solenoid valve, extractors, etc.) can be found in the electrical diagrams of the installation, available in the GitHub project repository [46].

### 4.6.3. Notes on instrumentation & electrical components

#### 4.6.3.1. ATEX-certified equipment.
As previously stated in Sec. 3.3, all the electrical components installed in the open space of the container are at least category 3 equipment, suitable for use in ATEX Zone 2.

Additionally, all the components inside the closed space of the container that remain energized after a safety system trigger (e.g. H<sub>2</sub> detection) are also at least category 3 equipment. They include the H<sub>2</sub> & NH<sub>3</sub> gas transmitters, the extractors, the emergency stop button, the lights (normal light & battery-equipped emergency light), the visual alarm and the smoke detector. The rest of the components (electrolyzer
& dryer, fuel cell, inverter, thermochemical prototype) are not ATEX-certified since they are turned-off upon a safety system trigger.

#### 4.6.3.2. Safety PLC.
Safety PLC are controllers that have a number of safety features not found in regular PLC and that allow for the implementation of safety functions. They feature failsafe inputs with dynamic signals (as opposed to static 24V input signals) for short-circuit detection and they normally have two separate processors that compute the same logic function and a final voting circuit that command the safety outputs. Additionally, the manufacturers certify their safety parameters (PL, MTTF, etc.) in accordance with the corresponding standards.

The safety PLC used in RECIF installation corresponds to the ABB Pluto B46 v2 model. The connections of the inputs sensors to the controller followed the manufacturer recommendations (see Ref. [59], §6).

#### 4.6.3.3. Contactors and relays.
Contactors and relays are considered as well-tried components as switching devices to trip a safety action in accordance with Table D.3 of ISO 13849-2 standard [52] as long as they comply with some additional conditions, such as protection against vibration, overcurrent protection and having contacts that are positively mechanically guided.

Positively mechanically guided contacts are linked with one another in such a way that the normally close (NC) contacts and normally open (NO) contacts can never be closed at the same time, even in case of contact welding, which represents one of the most dangerous accidental conditions of these devices. See Ref. [57], §3.5.1 for more information.

Relays with positively mechanically guided contacts allow for detection of a welded NO contact during a test procedure by de-energizing the coil and reading back a NC contact. In this way, if the NC contact fails to close, it means that one of the NO contacts is still close thus the fault is detected.

The standards that regulate the positively driven operation are IEC 60 947-4-1 [47], appendix H for contactors and IEC 60 947-5-1 [48], amendment 2, annex L for relays. All the contactors and relays used to implement RECIF safety system comply with these standards.

#### 4.6.3.4. Cabling.
IEC 60079-14 standard [42] (§9, Cables and wiring systems) covers general requirements of cable types used in explosive atmosphere, such as sheathed material, flame propagation properties, protective earthing, cable entries, etc. The standard does not specify voltage ratings, except for intrinsically safe circuits, for which only cables with rated insulation between the conductor to earth, conductor to screen and screen to earth of at least 500 V AC or 700 V DC shall be used.

Additional requirement may come from national standards. For instance, French standard NF C15-100 [54] defines in §424 the external influence class BE3 as the locations where an explosive atmosphere may occur. In that section, requirements regarding cable voltage ratings are stated: power cables must have a nominal voltage of 1000V for rigid connections (such as U1000 R2V cables), or 750V when flexible connections are needed (such as 07RN-F cable). The complete list of accepted power cables is found in Table 52D of the standard ("Conditions of use of insulated conductors and cables, BE3 class"). Regarding instrumentation cables, they must comply with NF M 87-202 French code [55], although the standard is somewhat ambiguous in that case (see point 5 of §424.8 of NF C15-100).

All the power cables of ATEX-certified components of RECIF installation comply with the aforementioned French standard and IEC standards and all the instrumentation cables are shielded and with a voltage rating of at least 500V.

Finally, the cables of ATEX components with intrinsically safe mode of protection (marking "ia/ib/ic") have their inductance and capacitance computed in order to complete the descriptive system document (according to IEC 60079-25 [43]). Fig. 16 shows an extract of such a document (the complete version can be found in Ref. [46], in French).

## 5. Discussion

### 5.1. Reliability computation of the gas detection system

The inspection & certification company specialized in ATEX installations that was commissioned to validate RECIF installation, based on the risk analysis of the installation, gave advice on the required

<figure><img src="image_18.png" /><figcaption>**Fig. 16.** Extract of the Descriptive System Document (DSD) of all the ATEX components with intrinsically safe mode of protection (see IEC 60079-25 [43], §4 and Annex E). The complete DSD can be found in Ref. [46] (in French).</figcaption></figure>
integrity of the safety system. More specifically, they recommended to give SIL-2 capability to the safety function that stops the production of H₂ from the electrolyzer and shutdown the H₂ gas supply to the fuel cell (which corresponds to SIF #1a and #1b) in case of a gas detection triggered by one of the two H₂ transducers installed inside the container.

To provide some regulatory context, IEC 60079-29-3 [45] gives recommendations regarding the functional safety of fixed gas detection systems. In that standard, the safety integrity requirements are expressed in a parameter called safety integrity level, SIL, which is based on IEC 61508 standard series [50] and is directly associated with the probability of failure of a safety function. The standard stays that it is rare for any risk study to determine a SIL higher than SIL 2 for a fixed gas detection system.

To compute the SIL of the aforementioned SIF, it was decided, in concertation with the inspection & certification company, to follow the method from ISO 13849-1 standard [51] that relates to safety of machinery, and then to trace an equivalency with the SIL method from the IEC 61508 series.

ISO 13849-1 standard provides safety requirements and guidance on the principles for the design and integration of safety-related parts of control systems; it defines a performance level (PL) of a SIF in terms of probability of failure per hour and gives guidance in the determination of the required PL (PLr) based on the severity of injury (S), the frequency and/or exposure time to hazard (F) and the possibility of avoiding hazard or limiting it harm (P).

The analysis of the PL of SIF #1a and #1b was conducted using SISTEMA tool [49], a free piece of software developed by DGUV (German Social Accident Insurance) which provides support in the evaluation of safety in the context of ISO 13849-1 standard. The SISTEMA project is available for the reader from RECIF safety system GitHub repository [46].

The determination of the required performance level was fixed based on a decision tree called “risk graph” from ISO 13849-1. Fig. 17 shows a screen capture of the risk graph of SIF #1a and #1b from SISTEMA tool, which resulted in a PLr of ‘d’.

Once the PLr has been determined, the next step is to propose a compatible instrumentation architecture. In the case of the SIF analyzed, this is fulfilled by a two-channel gas detection system in a one-out-of-two configuration (1oo2), followed by a safety PLC and an expansion safety relay. An additional 1oo2 two-channel contactor array is necessary for the SIF #1b since in that case the safety function must disconnect a power circuit (~2 kW). All this is depicted in Fig. 18, which shows the reliability block diagram of SIF #1a and #1b (left) and the corresponding tree structure of the project build with SISTEMA (right).

Table 7 shows the reliability parameters of all the components from Fig. 18. This information was entered into SISTEMA project and the tool computed the reliability parameters of each sub-system, as shown in Table 8.

<figure><img src="image_19.png" /><figcaption>Fig. 17. Risk graph of SIF #1a and #1b (image extracted from SISTEMA [49] project).</figcaption></figure>

Table 9 shows the final result of the analysis performed by SISTEMA tool, which indicates that both SIF have obtained the required PL d. The table also shows the equivalency with the SIL method, indicating a SIL-2 value. The equivalency follows IEC 62061 standard [53], Table 3 (also found in Ref. [56], Figure 3.2).

Note that the complete study of performance level is out of the scope of this article. However, a full study was conducted as part as the documentation of the RECIF safety system. The study followed the structure of the examples given in Ref. [56] §8, describing the corresponding functional description, its design features and the calculation of the probability of failure.

## 5.2. Forced ventilation system simulation

This Section presents the study of an estimate of the evolution of the gas concentration inside the container in the event of a leak. The objective is to have an order of magnitude of the time it takes for the leak to stop and for the ventilation system to reduce the gas concentration. This study takes into account not only the leak process itself by also the safety system response. The results of this sections helped the declassification of the interior of the container from a possible Zone 2 to non-hard zone by showing that the leak is promptly detected and bounded and the safety system quickly reduces the gas concentration to negligible levels.

Fig. 19 depicts the overall concept. In the event of a H₂ leak, there are two possible situations: (a) a leak in the fuel cell supply line, and (b) a leak in the H₂ production system (electrolyzer). In the event of an NH₃ leak, the entire content of the fluid is, in a worst-case scenario, released inside the container. The figure indicates that, following a gas detection, the safety system will instantly and simultaneously close the H₂ supply and turn off the electrolyzer and the remaining trapped gas in the equipment will be progressively released.

The leak release rate model uses the equations from IEC 60079-10-1 [41], §B.7.2.3, “Release rate of gas or vapor” (which are nothing but the compressible flow equations in a converging nozzle) for an ideal gas with sonic (chocked) and subsonic (non-chocked) flow, namely:

$$mg, in = CdSP \sqrt{\frac{M2Y}{ZRT\nu - 1} \left[1 - \left(\frac{Pa}{P}\right)^{\nu-1/\nu}\right] \left(\frac{Pa}{P}\right)} \frac{1}{\nu} (\text{non-chocked flow}) \quad (1)$$

$$mg, in = CdSP \sqrt{\nu \frac{M}{ZRT} \left(\frac{Pa}{P}\right) \nu + 1} / \nu - 1 \quad (\text{chocked flow}) \quad (2)$$

where $\dot{m}_{g,in}$ (kg/s) is the gas flow rate toward the container, $C_d$ is a dimensionless flow coefficient (0.50–0.75 for sharp-edged orifices and 0.95 to 0.99 for rounded orifices), S is the section of the leak hole (m²), T and P are the gas temperature and pressure upstream of the leak (K, Pa), Pa is the pressure downstream of the leak, equal to atmospheric pressure (Pa), $\gamma$ is the adiabatic index of the gas upstream of the leak (dimensionless), Z is the gas compressibility factor upstream of the leak (dimensionless and equals to 1.0 for ideal gases) and R is the Universal gas constant (8314 J/kmol-K). The critical pressure $P_{crit}$ at which the mass flow changes from sub-sonic to sonic is determined by the following equation ([41] eq. B.2):

$$P_{crit} = P_a \left( \frac{\gamma + 1}{2} \right)^{\gamma/\gamma - 1} \quad (3)$$

The trapped gas inside the electrolyzer and fuel cell is treated as an ideal gas at constant temperature T (K) in a constant volume V (m³). As a result, the relationship between pressure P (Pa), temperature T and mass m (kg) is governed by the ideal gas law, which can be solved for the pressure P, resulting in:
<figure><img src="image_20.png" /><figcaption>Fig. 18. Reliability block diagram of SIF #1a and #1b. Left: graphical representation. Right: SISTEMA [49] project tree structure.</figcaption></figure>

<caption>Table 9</caption>

Performance level (PL) computation results of safety functions shown in Fig. 18. (*) SIL equivalency according to IEC 62061 [53], Table 3 (also found in Ref. [56], Figure 3.2).

<table><thead><tr><th>Safety function</th><th>PL obtained</th><th>PFH<sub>D</sub> (1/h)</th><th>SIL equivalency <sup>(s)</sup></th></tr></thead><tbody><tr><td>SIF #1a. Disconnection of fuel cell H<sub>2</sub> solenoid valve power supply</td><td>d</td><td>2.0E-7</td><td>SIL 2</td></tr><tr><td>SIF #1b. Disconnection of electrolyzer power supply</td><td>d</td><td>2.3E-7</td><td>SIL 2</td></tr></tbody></table>

$$PV = \frac{m}{M} RT \Rightarrow P = \left( \frac{RT}{MV} \right) m \qquad (4)$$

where *M* corresponds to the molar mass of H₂ (2.016 10⁻³ kg/mol). Note that all the variables inside the parenthesis in eq. (4) are considered constant.

The pressure rate of change *dP/dt* can be obtained by differentiating both sides of eq. (4) with respect to time, yielding:

$$\dot{P} = \frac{RT}{MV}\dot{m} \qquad (5)$$

In this last eq., the term *ṁ* equals the negative of *ṁg*<sub>in</sub> from eqs. (1) and (2), since gas is coming *out* of the trapped volume and entering the container, that is,

$$\dot{P} = - \frac{RT}{MV} \dot{m}_{g,in} \qquad (6)$$

Combining eq. (6) with (1), (2) and (3) yields a first-order ordinary differential equation (ODE) whose solution describes the evolution of *P* (*t*) inside the trapped volume and the gas flow rate toward the container *ṁg*<sub>in</sub>(*t*).

In order to evaluate the instantaneous gas concentration, the container is modeled as a control volume with an input flow of fresh air, another input of leaked gas and an output flow of the mix air/gas through the extractors. The model assumptions are the following: (a) the temperature is constant; (b) the air in the room is incompressible; (c) the air/gas mixture is considered as an ideal gas, therefore, Amagat's law of

<figure><img src="image_21.png" /><figcaption>Fig. 19. Model of a leak process inside the container used to simulate the evolution of gas concentration. After detection of a gas leak, the safety system will turn on the extractors and the quantity of gas trapped inside the equipment will progressively leave the container.</figcaption></figure>
partial volumes applies; (d) an imperfect mixing of air and gas is assumed, expressed in the form of the safety coefficient 'f'; (e) the extractors are a source of volumetric flow which removes the air/gas mixture from the room. Note that (b) represents a basic assumption in HVAC engineering, which means, for example, that the addition/subtraction of gas does not modify the pressure of the room, considered at atmospheric pressure. Viewed differently, any increase/decrease in pressure will be immediately balanced by airflow through the openings. Finally, the equations of the model are the following:

$$ \dot{V}_{g,in} = \dot{m}_{g,in} \frac{1}{\rho_g} \qquad (7) $$

$$ \dot{V}_{g,out} = \frac{\dot{V}_{extr}}{f} X_g \qquad (8) $$

$$ \frac{dV_g}{dt} = \dot{V}_{g,in} - \dot{V}_{g,out} \qquad (9) $$

$$ X_g = V_g \frac{1}{V_{mix} f} \qquad (10) $$

where $\dot{V}_{g,in}$ is the flow rate of the leaked gas (in m³/s, equal to the mass flow rate divided by the gas density $\rho_g$ at atmospheric pressure), $\dot{V}_{g,in}$ is the flow rate of the gas out of the container (m³/s), $V_g$ is the instantaneous partial volume of gas in the container (m³), $\dot{V}_{extr}$ is the extractors flow rate (m³/s), $V_{cont}$ is the container volume (m³) and $f$ is the safety coefficient (>1) that accounts for imperfect mixing (see Ref. [41], §C.3.6.2). This last factor is considered twice: it reduces the air/gas mixing volume and it decreases the effective air/gas mix flow rate out of the container (note that $f \times V_{g,in}/\dot{V}_{extr} = \dot{V}_{g,in}$ corresponds to the eq. of the background concentration of IEC 60079-10-1 [41], eq. C.1, where the factor $f$ is defined).

Fig. 20 shows the block diagram of all the equations presented so far, with the addition of the safety system that changes the extractor flow rate when the gas concentration $X_g$ reaches the alarm level $X_{alarm}$. This model was implemented in MATLAB/Simulink with the parameters presented in Table 10.

Fig. 21 shows the simulation results for the case of a H₂ leak in the fuel cell circuit (left) and electrolyzer (right). The case of a NH₃ leak is not presented in this article; however, the complete study which includes the case of NH₃ is available in Ref. [46] and shows that the values of $X_g$ remains very low ($X_g<2.5\%$ LFL throughout the release of ~9 kg of NH₃), so the danger of explosion is negligible in comparison to the toxicity hazard.

Fig. 21 (a) shows the case of a fuel cell leak, which starts at 0:30 and a min later the concentration reaches 10% of LFL. Before the detection, the leak flow rate remains constant (~33 Nl/min) since gas is supplied by the H₂ tank through a pressure regulator (4 bar). After detection, the H₂ solenoid valve FV002 is closed so the flow rate starts descending (i.e. the pressure in the trapped volume starts dropping). Simultaneously, the extractor flow rate increases to the emergency set point. The leak stops 1 min after the detection, when the pressure of the trapped volume attains 1 atm. The spike of the H₂ flow rate out of the container (orange curve) is explained by the raise of the ventilation flow rate. Finally, 4 min after the start of leak, the concentration attains negligible values (<1%).

Fig. 21 (b) depicts the case of a leak in the electrolyzer, which is initially turn on and producing H₂ (~11 Nl/min, 25 bar, yellow curve). The leak at 0:30 produces a spike of H₂ flow rate toward the container (blue curve) that rapidly decreases due to the depressurization of the electrolyzer volume that contains the gas, reaching an equilibrium between the gas produced and the gas leaked (blue & yellow curves). Note that during this initial phase the concentration does not attain the alarm level, which finally happens 3:30 after the start of the leak. The rest of the evolution is analog the case of a fuel cell leak previously analyzed, attaining a negligible value of $X_g$ 6 min after the leak started.

The simulation results offer a means of observing that smaller leaks cannot be detected with detectors that trigger at 10% or even 5% of the LFL. For those cases, leak search during period test is the appropriate course of action. Additionally, the SCADA system could also implement an algorithm that correlates the pressure change in the H₂ tank with the production and utilization of H₂ to early detect anomalies.

Finally, the reader can refer to Ref. [46] to find additional study cases, particularly leak events combined with failures in the safety system (one extractor fails to start, H₂ valve fails to close, etc.).

### 5.3. Lessons learned and guidance for future installations

The implementation of RECIF project was very challenging due to the initial lack of experience in H₂ installations. In this regard, provided below is a list of recommendations for any laboratory or research center that wants to start implementing a system that integrates a chain of production and use of H₂. These recommendations result from the lessons learned during the design and commissioning of RECIF installation.

- In order to comply with the regulations of the corresponding country or region, get in contact with an inspection & certification company specialized in ATEX installations at the earliest stage of the project and budget their services.

<figure><img src="image_22.png" /><figcaption>Fig. 20. Simplified block diagram of the model of a leak of a reservoir at initial pressure $P_0$ into the container.</figcaption></figure>
<table><caption>**Table 10**
Simulation parameters of a gas leak.</caption><thead><tr><th colspan="4">Simulation parameters</th></tr><tr><th>Parameter</th><th>Value</th><th>Unit</th><th>Notes</th></tr></thead><tbody><tr><td>Pressure in the volume of trapped H<sub>2</sub> (electrolyzer)</td><td>25</td><td>bar</td><td>Worst-case scenario: maximum working pressure found on the electrolyzer. See Table 1.</td></tr><tr><td>Pressure in the volume of trapped H<sub>2</sub> (fuel cell)</td><td>4</td><td>bar</td><td>H<sub>2</sub> fuel cell inlet pressure.</td></tr><tr><td>Total volume of trapped H<sub>2</sub> (electrolyzer)</td><td>1</td><td>L</td><td>Value deduced from information received from electrolyzer & dryer supplier.</td></tr><tr><td>Total volume of trapped H<sub>2</sub> (fuel cell)</td><td>5</td><td>L</td><td>0.6g of trapped H<sub>2</sub> @ 1.5bar (manufacturer data)</td></tr><tr><td>Section of the leak hole</td><td>0.25</td><td>mn<sup>2</sup></td><td>Hypothesis of a valve leak. Value according to IEC 60079-10-1 [41], Table B.1 "Suggested hole cross sections for secondary grade of releases": valve stem packing (release opening will not expand).</td></tr><tr><td>Flow coefficient C<sub>d</sub></td><td>0.75</td><td>Dimensionless</td><td>Hypothesis of a sharp orifice. Value according to IEC 60079-10-1 [41], §B.1.</td></tr><tr><td>Temperature</td><td>30</td><td>°C</td><td>Air and H<sub>2</sub> temperature.</td></tr><tr><td>Extractors flow rate, continuous air renewal mode</td><td>460</td><td>m<sup>3</sup>/h</td><td>See Table 3.</td></tr><tr><td>Extractors flow rate, continuous air emergency mode</td><td>2 × 10<sup>8</sup> = 2160</td><td>m<sup>3</sup>/h</td><td>See Table 3.</td></tr><tr><td>H<sub>2</sub> detection threshold</td><td>10</td><td>% of LFL</td><td>Worst case scenario between detector #1 & #2 (Table 5)</td></tr><tr><td>Extractor time constant when flow rate set-point change</td><td>2</td><td>s</td><td>0-99% in 5τ, thus startup time = 10s.</td></tr><tr><td>Detection chain delay</td><td>1</td><td>s</td><td>Electronic detection circuit, relays, contactors, etc.</td></tr><tr><td>Container volume</td><td>22</td><td>m<sup>3</sup></td><td>Net volume.</td></tr><tr><td>Ventilation inefficiency, safety factor 'f' according to IEC 60079-10-1 [41], Annex C.</td><td>3.0</td><td>Dimensionless</td><td>Inefficient mixing (note that IEC 60079-10-1 [41], §C.3.6.2 establishes f = 1.5 for a mildly inefficient mixing and 5 for very inefficient mixing.).</td></tr></tbody></table>

- Regarding the selection of ATEX-certified components,

■ When possible, avoid "category 3" components (marking "II 3"). Manufacturers of category 3 devices follow a self-certification procedure that does not require any submission of documentation to a notified body. As a consequence, sometimes theirs ATEX certificates have inconsistencies.

■ Read and comply with special conditions of utilization section found in the EC-type examination certificates (max ratings, use of special fuse, etc.).

■ The EU defines, in the guide for the application of directive 2014/34/EU, a list of equipment for which the application of the directive could be misinterpreted. This is the "Borderline List". Check this list when there is a doubt about the need or not to use ATEX-certified material.

- Make sure that all the components used in the gas detection chain in the safety system comply with standards for functional safety, such as EN 61508 standard series [50]. Their corresponding certificates will provide safety parameters such as MTTF, λ<sub>DU</sub>, etc., required to evaluate the safety integrity level of the installation.

- Plan and implement a documentation system with a revision coding for documents, electrical diagrams, P&IDs and program codes. This will allow traceability control. Store all the documentation in a server.

- Budget and provide ATEX training to the staff that will work in the design or implementation of the installation and to the personnel that will operate and maintain it.

As a concluding note, the subsequent paragraphs describe key design choices and challenges encountered during the installation's design phase. These discussions encompass not only the safety system's alternatives but also broader considerations regarding the general installation.

### 5.3.1. Technology for implementing safety logic

At the outset of the project, a decision was made to employ a hard-wired logic, primarily utilizing relays, to execute the safety instrumented function. While this choice simplified the process by avoiding the need for expertise in PLC programming and manipulation, it presented challenges in conforming to the ISO 13849-1 standard for assessing installation safety levels. Additionally, a hard-wired logic lacked flexibility for post-implementation modifications. Subsequently, the decision was made to transition to a safety PLC to address these concerns.

### 5.3.2. Design of the water cooling circuit

The design of the water cooling circuit, depicted in Fig. 9, represents a non-negligible aspect of the installation. An alternative option explored involved the incorporation of a water buffer tank (~30L) between the components responsible for heating water (fuel cell & electrolyzer) and the thermochemical reactor, which relies on hot water for its endothermic reaction. While the buffer tank offers advantages as a decoupling component that simplifies the control strategy, it also introduces complexities such as the requirement for additional pumps and potential extended transients at the beginning of each experimentation. Ultimately, a solution without a buffer tank was adopted.

### 5.3.3. Electrolyzer operating mode

The electrolyzer acquired for the RECIF installation is designed to operate under nominal conditions and is not adaptable to variable power levels due to the significant risk of generating an explosive atmosphere at its purge outlet during low-power operation. Consequently, the H<sub>2</sub> production cannot align with the instantaneous power output of the PV panels. While this design simplifies the electrolyzer operation, it introduces additional constraints to the optimization strategy governing the installation, which were not foreseen at the initial stage of the project.

## 6. Conclusions

This article provides a thorough description of the safety system of a real installation of a smart microgrid that includes PV panels, Li-ion batteries, an electrolyzer, H<sub>2</sub> storage, a fuel cell, and a BaCl<sub>2</sub>/NH<sub>3</sub> thermochemical prototype for heat recovery and cooling production for air conditioning purposes. The installation is part of RECIF project and is located in French Polynesia, where a significant portion of energy usage is dedicated to space cooling.

The study offers comprehensive information on the practical aspects of system implementation and consistently refers to the relevant regulations, particularly the IEC 60079 standard series related to explosive atmospheres. The interconnection of components is carefully detailed through process and piping diagrams (P&ID), which highlight the safety features of each component, as well as the operational, maintenance, and emergency gas purging systems of the installation.

This work is notable for its extensive treatment of safety instrumented logic implementation and detailed electrical power distribution from diverse sources (grid, PV panels, fuel cell, Li-ion battery). Supplementary information, listed in Sec. A1.4, is accessible to readers via a
<figure><img src="image_23.png" /><figcaption>Fig. 21. Simulation results of a gas leak process inside the container. (a) Fuel cell leak that starts at 0:30 and a minute later the concentration reaches 10% of LFL. (b) Electrolyzer leak that starts at 0:30 and at 04:00 the concentration reaches 10% of LFL. On both cases, once the concentration reaches the alarm level, the safety system turns off the fuel cell and electrolyzer, closes the fuel cell $H_2$ supply and raise the ventilation flow rate.</figcaption></figure>

GitHub repository [46]. Additionally, the study establishes the reliability of the gas detection system, affirming its adherence to safety integrity level SIL-2 based on risk analysis and recommendations from the specialized inspection and certification company overseeing RECIF installation validation.

The operation of the forced ventilation system is presented in detail, along with a thorough description of the instrumentation used for malfunction detection. Furthermore, the simulations conducted demonstrate that the safety system promptly detects and stops any leaks inside the container, effectively reducing the gas concentration to negligible levels.

The study also presents valuable lessons learned from the design and commissioning of the installation, providing guidance for future projects, especially for laboratories or research centers aiming to implement a system that integrates a hydrogen chain.

The next step in this research will involve completing the commissioning of the PV panels and operating the micro-grid under various conditions, while utilizing different optimization algorithms. This will allow for the validation of the theoretical work already performed as part of the RECIF program.

As final remarks, from a techno-economic standpoint, hydrogen technology's promising future rests on its potential for growth in diverse sectors. Advancements in production, storage, and fuel cell efficiency will drive broad adoption, reinforced by supportive government policies

and infrastructure investments that facilitate industry decarbonization and emission reduction. Additionally, ammonia's adoption as a refrigerant is expected to rise in the small and medium refrigeration systems market [60], enhancing component availability and affordability. This shift also aligns with the focus on environmental impact reduction, a critical aspect of modern energy systems.

## Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

## Acknowledgements

This study was founded by the French National Research Agency (ANR) under project identifier 'ANR-18-CE05-0043'. The author wishes to acknowledge the partners of RECIF project: $H_2SYS$ (fuel cell integrator, France), FCLAB (Fuel cell laboratory, CNRS, Franche-Comté University, France) and PROMES laboratory (CNRS, France). Special thanks to Pascal Ortega (GEPASUD laboratory, University of French Polynesia) and Fabien Harel (fuel cell research engineer, $H_2SYS$ scientific advisor).

# A1 Appendix.

## A1. $1H_2$ and $NH_3$ flammability and occupational exposure limits

Table 11 summarizes the flammability and occupational exposure limits of hydrogen and ammonia. The practical limit of a refrigerant represents the highest level of concentration in an occupied space that does not result in an acute adverse effect for emergency evacuation and does not create a risk of refrigerant ignition. The ILV-8h (8-h vapor limit index, EU) and TWA (time-weighted average, USA) are the maximum average exposure on the basis of 8 h/day, 40 h/week work. The ILV-15min and STEL (short-term exposure limit, USA) are a 15-min exposure that should not be exceeded during a workday. The SER-1 min. (1-min reversible effects threshold) represents the maximum exposure during 1 min that does not cause any lasting health effects. Finally, the SP (perception threshold) refers to the lowest concentration that a person can detect through senses; its low value indicates that ammonia can be detected by smell before it could produce any negative effect on the health.
<caption>**Table 11**</caption>

Flammability and occupational exposure limits for hydrogen and ammonia. Note: the unit 'kg/m³' refers to mass of gas divided by the volume of air/gas mix. The last six parameters refer to occupational exposure limits.

<table><thead><tr><th>Parameter</th><th>H<sub>2</sub> [61]</th><th>NH<sub>3</sub></th></tr></thead><tbody><tr><td>CAS number</td><td>1333-74-0</td><td>7664-41-7</td></tr><tr><td rowspan="3">Lower flammability limit (LFL)</td><td>4% v/v</td><td>16% v/v [62]</td></tr><tr><td>40,000 ppm</td><td>160,000 ppm</td></tr><tr><td>0.003,560 kg/m<sup>3</sup></td><td>0.116 kg/m<sup>3</sup></td></tr><tr><td rowspan="3">Upper flammability limit (UFL)</td><td>77% v/v</td><td>25% v/v [62]</td></tr><tr><td>770,000 ppm</td><td>250,000 ppm</td></tr><tr><td>0.068,500 kg/m<sup>3</sup></td><td>0.187 kg/m<sup>3</sup></td></tr><tr><td>Auto-ignition temperature</td><td>560 °C</td><td>630 °C ([33], Annex E)</td></tr><tr><td rowspan="2">Practical limit</td><td>n/a</td><td>0.05% v/v</td></tr><tr><td></td><td>467 ppm</td></tr><tr><td></td><td></td><td>0.000,350 kg/m<sup>3</sup> ([33], Annex E)</td></tr><tr><td>ILV 8h (EU)</td><td>n/a</td><td>20 ppm</td></tr><tr><td>TWA (USA)</td><td>n/a</td><td>25 ppm</td></tr><tr><td>ILV 15 min. (EU)</td><td>n/a</td><td>50 ppm</td></tr><tr><td>STEL (EU)</td><td>n/a</td><td>35 ppm</td></tr><tr><td>SER 1 min (France)</td><td>n/a</td><td>280 ppm [62]</td></tr><tr><td>SP (France)</td><td>n/a</td><td>5–50 ppm [62]</td></tr></tbody></table>

## A1.2 P&ID components list

Table 12 shows the list of all the elements found in the P&ID of Figs. 5–9.

<caption>**Table 12**</caption>

P&ID components list.

<table><thead><tr><th>Code</th><th>Description</th><th>Function</th></tr></thead><tbody><tr><td>FCV 001</td><td>Check valve</td><td>Prevents flow from fuel cell toward H<sub>2</sub> tank</td></tr><tr><td>FCV 002</td><td>Check valve</td><td>Prevents flow from H<sub>2</sub> tank toward electrolyzer</td></tr><tr><td>FSV 001</td><td>Ball valve</td><td>H<sub>2</sub> manual emergency relief valve.</td></tr><tr><td>FT 001</td><td>H<sub>2</sub> flow transmitter</td><td>H<sub>2</sub> gas flow measurement</td></tr><tr><td>FT 101</td><td>Flow transmitter</td><td>Fuel cell/electrolyzer/thermo-chemical reactor cooling system</td></tr><tr><td>FT 102</td><td>Flow transmitter</td><td>Thermo-chemical prototype, chiller circuit</td></tr><tr><td>FV 001</td><td>Gate valve</td><td>H<sub>2</sub> tank isolation</td></tr><tr><td>FV 002</td><td>Solenoid valve</td><td>Enabling of H<sub>2</sub> flow to fuel cell</td></tr><tr><td>FV 003</td><td>Ball valve</td><td>Downstream purge</td></tr><tr><td>FV 004</td><td>Ball valve</td><td>Upstream purge</td></tr><tr><td>HX 101</td><td>Air-water heat exchanger</td><td>Heat removal from fuel cell/electrolyzer/thermo-chemical reactor</td></tr><tr><td>HX 102</td><td>Water-glycol/air heat exchanger</td><td>Thermo-chemical prototype, chiller</td></tr><tr><td>P 101</td><td>Water pump</td><td>Water pumping from 1m<sup>3</sup> water tank to demineralizer</td></tr><tr><td>P 102</td><td>Water pump</td><td>Fuel cell/electrolyzer/thermo-chemical reactor cooling system</td></tr><tr><td>P 103</td><td>Water-glycol pump</td><td>Thermo-chemical prototype, chiller circuit</td></tr><tr><td>PG 001</td><td>Pressure gauge</td><td>H<sub>2</sub> tank pressure measurement & display</td></tr><tr><td>PG 002</td><td>Pressure gauge</td><td>Fuel cell inlet pressure measurement & display</td></tr><tr><td>PG 003</td><td>Pressure gauge</td><td>N<sub>2</sub> cylinder pressure measurement & display</td></tr><tr><td>PG 004</td><td>Pressure gauge</td><td>N<sub>2</sub> pressure regulator, pressure measurement & display</td></tr><tr><td>PSV 001</td><td>Pressure safety valve</td><td>H<sub>2</sub> tank overpressure protection (60 bar)</td></tr><tr><td>PSV 002</td><td>Pressure safety valve</td><td>Fuel cell overpressure protection (15 bar)</td></tr><tr><td>PT 001</td><td>Pressure transmitter (4.20 mA)</td><td>H<sub>2</sub> tank pressure measurement</td></tr><tr><td>PV 001</td><td>Downstream pressure regulator</td><td>Fuel cell input pressure regulation</td></tr><tr><td>PV 002</td><td>Downstream pressure regulator</td><td>N<sub>2</sub> pressure regulation</td></tr><tr><td>TE 101</td><td>Thermocouple</td><td>Electrolyzer cooling system, water inlet temperature</td></tr><tr><td>TE 102</td><td>Thermocouple</td><td>Electrolyzer cooling system, water outlet temperature</td></tr><tr><td>TE 103</td><td>Thermocouple</td><td>Fuel cell cooling system, water inlet temperature</td></tr><tr><td>TE 104</td><td>Thermocouple</td><td>Fuel cell cooling system, water outlet temperature</td></tr><tr><td>TE 105</td><td>Thermocouple</td><td>HX 101 heat exchanger, fluid temperature</td></tr><tr><td>TE 106</td><td>Thermocouple</td><td>HX 101 heat exchanger, fluid temperature</td></tr><tr><td>TE 107</td><td>Thermocouple</td><td>Thermo-chemical reactor, water inlet temperature</td></tr><tr><td>TE 108</td><td>Thermocouple</td><td>Thermo-chemical reactor, water outlet temperature</td></tr><tr><td>TE 109</td><td>Thermocouple</td><td>Thermo-chemical prototype, chiller circuit, “cold” temperature</td></tr><tr><td>TE 110</td><td>Thermocouple</td><td>Thermo-chemical prototype, chiller circuit, return temperature</td></tr><tr><td>TT 001</td><td>Temperature transmitter (4.20 mA)</td><td>H<sub>2</sub> temperature measurement</td></tr><tr><td>X 001</td><td>H<sub>2</sub> tank, 850 L</td><td>H<sub>2</sub> storage</td></tr><tr><td>X 002</td><td>Micron filter</td><td>Dirt & debris removal from H<sub>2</sub> circuit</td></tr><tr><td>X 003</td><td>Water tank, 1m<sup>3</sup></td><td>Electrolyzer feed water</td></tr><tr><td>X 004</td><td>Bulkhead union fitting</td><td>Wall crossing for H<sub>2</sub> tube toward fuel cell</td></tr><tr><td>X 005</td><td>Tube gland</td><td>Wall crossing for water tube toward electrolyzer</td></tr></tbody></table>

(continued on next page)
<table><caption>**Table 12 (continued)**</caption><thead><tr><td>Code</td><td>Description</td><td>Function</td></tr></thead><tbody><tr><td>X 006</td><td>Gas diffuser</td><td>Fuel cell purge</td></tr><tr><td>X 007</td><td>Nitrogen cylinder</td><td>Piping passivation</td></tr><tr><td>X 101</td><td>Water tank, 100 L</td><td>Demineralized water storage</td></tr><tr><td>X 102</td><td>Water demineralizer</td><td>Water demineralization before storing in X 101 reservoir</td></tr><tr><td>X 103</td><td>Tube gland</td><td>Water return from dryer to 1m³ water tank</td></tr><tr><td>X 106</td><td>Bulkhead union fitting</td><td>Wall crossing for H₂ tube from electrolyzer</td></tr><tr><td>X 107</td><td>Bulkhead union fitting</td><td>Wall crossing for fuel cell purge</td></tr><tr><td>X 108</td><td>Tube gland</td><td>Wall crossing for electrolyzer & dryer H₂ purge</td></tr><tr><td>X 109</td><td>Tube gland</td><td>Wall crossing for electrolyzer O₂ purge</td></tr><tr><td>X 111</td><td>Flexible tube</td><td>Flexible connection of fuel cell H₂ gas inlet.</td></tr></tbody></table>

### A1.3 Periodic tests

Table 13 shows the list of periodic test of RECIF installation.

<caption>**Table 13**</caption>

Safety system periodic tests.

<table><caption>Safety system periodic tests</caption><thead><tr><th>Element</th><th>Period</th><th>Notes</th></tr></thead><tbody><tr><td>Visual & sound alarm</td><td>Beginning of every experimentation</td><td>Actuation of selector switch mounted on the door of CAB-2 (-S.2.45).</td></tr><tr><td>Safety system electrical cabinet lamp test</td><td></td><td>Same actuation as "emergency extractors test" (-S.2.03).</td></tr><tr><td>Emergency extractors test</td><td></td><td>Actuation on dedicated selector switch mounted on the door of CAB-2 (-S.2.03).</td></tr><tr><td>'SCADA - safety system' interface relay</td><td>Monthly</td><td>Actuation on a test button to energize interface relay.</td></tr><tr><td>Search for gas leaks</td><td></td><td>Use of gas leak detector.</td></tr><tr><td>Stop buttons: 1. machine room 2. outside container 3. inside container</td><td>6 months</td><td>Manual action on corresponding buttons.</td></tr><tr><td>Gas transmitters</td><td></td><td>Burn tests using calibrated sample gas bottles.</td></tr><tr><td>Power disconnection toward container</td><td></td><td>Specific protocol to rule out soldered contacts of relays & contactors.</td></tr><tr><td>Extractors thermistor thermal protection</td><td>Annual</td><td>Actuation on test buttons on thermistor relays.</td></tr><tr><td>Extractors motors circuit breakers test</td><td></td><td>Actuation on test buttons on motor circuit breakers.</td></tr><tr><td>Verification of airflow</td><td></td><td>Use of anemometer at the container air intake openings.</td></tr><tr><td>Smoke detector inside container</td><td></td><td>Use of smoke detector test equipment.</td></tr><tr><td>Fire alarm call point</td><td></td><td>Manual action on button.</td></tr><tr><td>Hydrogen supply solenoid valve (FV 002)</td><td></td><td>Specific protocol to rule out valve internal leak.</td></tr><tr><td>Emergency manual H₂ discharge valve (FSV 001)</td><td></td><td>Specific protocol to rule out valve jamming.</td></tr><tr><td>Earth resistance verification (piping, instruments, container, fenced enclosure, metallic doors, etc.)</td><td></td><td>Use of an earth ground resistance tester.</td></tr><tr><td>Insect barrier at tube outlets</td><td></td><td>Visual inspection.</td></tr><tr><td>Pressure relief valves (PSV 001 @ 60bar, PSV 002 @ 15 bar)</td><td>3 years</td><td>Use of N₂ cylinder X007 (see Fig. 5, coord. B4).</td></tr></tbody></table>

### A1.4 Supplementary material

Listed below is additional information available to the reader in a GitHub repository [46], which includes:

- All the electrical diagrams (power and control), including the brand and model of all the components (bill of material).

- The description of the safety PLC programming code developed in *Ladder* language, accompanied by the corresponding PLC project file (using ABB Pluto Manager software [58]).

- The *descriptive system document* for the intrinsically safe circuits (according to IEC 60079-25 [43]).

- The project file created with SISTEMA tool [49] used to compute the safety system reliability.

- A list of all ATEX equipment, including brand, model and ATEX marking.

- The complete study of the evolution of the gas concentration inside the container due to a gas leak, with the corresponding Matlab/Simulink files.

### A1.5 Thermochemical prototype operating modes

Table 14 describes the operating modes of the thermochemical prototype, composed by a MVC unit (i.e. evaporator, compressor, condenser, reservoir and throttling valve) that uses NH₃ as refrigerant and a BaCl₂ TR for energy storage and deferred cold production. The TR recovers heat from the electrolyzer and fuel cell and transforms it into chemical potential energy that is used later to produce a cooling effect without the need to run the electrical compressor.
<table><caption>**Table 14**

Thermochemical prototype operating modes.</caption><thead><tr><th rowspan="2">Operating mode</th><th rowspan="2">Reactor state</th><th rowspan="2">NH<sub>3</sub><br>compressor</th><th rowspan="2">Chiller<br>(HX102)</th><th colspan="4">Valves arrangement</th><th rowspan="2">Notes</th></tr><tr><th>V01</th><th>V02</th><th>V03</th><th>V04</th></tr></thead><tbody><tr><td>Traditional air<br>conditioning</td><td>Not in use</td><td>ON</td><td>ON</td><td>Closed</td><td>Closed</td><td>Open</td><td>Open</td><td>Traditional MVC cycle: evaporator → compressor → condenser → reservoir → evaporator.</td></tr><tr><td>Storage (i.e. heat<br>recovery)</td><td>Desorbing (NH<sub>3</sub><br>leaving the<br>reactor)</td><td>OFF</td><td>OFF</td><td>Open</td><td>Open</td><td>Closed</td><td>Closed</td><td>The salt/NH<sub>3</sub> pair inside the TR is heated thus the NH<sub>3</sub> gas leaves the TR (endothermic reaction), passes through the condenser and accumulates into the liquid reservoir.</td></tr><tr><td>Cooling production<br>from storage<br>energy</td><td>Synthesis (NH<sub>3</sub><br>entering the<br>reactor)</td><td>OFF</td><td>ON</td><td>Open</td><td>Closed</td><td>Closed</td><td>Open</td><td>The accumulated liquid NH<sub>3</sub> evaporates and returns to the TR to reacts with the salt in an exothermic manner (hence the need for cooling using HX101).</td></tr></tbody></table>

References

[1] Institute of Statistics of French Polynesia. French Polynesia at a glance. 2020 (in French and English). Available online here (accessed June 2023).

[2] Polynesian Energy Observatory. Key energy figures in French Polynesia. 2021. edition" (in French). Available online here (accessed June 2023).

[3] Électricité de Tahiti (EDT). "Les tarifs". Available online here (accessed June 2023).

[4] Energy Information Administration, U.S. Department of energy (accessed June 2023).

[5] Statistical office of the European Union, Eurostat. Electricity prices (including taxes) for household consumer, first half. 2022. Available online here (accessed February 2018).

[6] Ferrucci F, Stitou D, Ortega P, Lucas F. Mechanical compressor-driven thermochemical storage for cooling applications in tropical insular regions. Concept and efficiency analysis. Appl Energy 2018;219:240–55. https://doi.org/10.1016/j.apenergy.2018.03.049. ISSN 0306-2619.

[7] Bosetti Valentina, Catenacci Michela, Fiorese Giulia, Elena Verdolini. The future prospect of PV and CSP solar technologies: an expert elicitation survey. Energy Pol 2012;49:308–17. https://doi.org/10.1016/j.enpol.2012.06.024.

[8] Zhang Dianfeng, Li Yanlai, Chin Kwai-Sang. Photovoltaic technology assessment based on cumulative prospect theory and hybrid information from sustainable perspective. Sustain Energy Technol Assessments 2022;52:102116. https://doi.org/10.1016/j.seta.2022.102116. Part B.

[9] Clastres C. Smart grids: another step towards competition, energy security and climate change objectives. Energy Pol 2011;39(9):5399–408. https://doi.org/10.1016/j.enpol.2011.05.024.

[10] Lamnatou Chr, Chemisana D, Cristofari C. Smart grids and smart technologies in relation to photovoltaics, storage systems, buildings and the environment. Renew Energy February 2022;185:1376–91. https://doi.org/10.1016/j.renene.2021.11.019.

[11] Koohi-Fayegh S, Rosen MA. A review of energy storage types, applications and recent developments. J Energy Storage 2020;27:101047. https://doi.org/10.1016/j.est.2019.101047.

[12] Egeland-Eriksen Torbjørn, Amin Hajizadeh, Sartori Sabrina. Hydrogen-based systems for integration of renewable energy in power systems: Achievements and perspectives. Int J Hydrogen Energy 2021;46(63):31963–83. https://doi.org/10.1016/j.ijhydene.2021.06.218.

[13] Hwang Joonsik, Maharjan Krisha, Cho HeeJin. A review of hydrogen utilization in power generation and transportation sectors: Achievements and future challenges. Int J Hydrogen Energy 2023. https://doi.org/10.1016/j.ijhydene.2023.04.024.

[14] Yue Meiling, Lambert Hugo, Pahon Elodie, Roche Robin, Jemei Samir, Hissel Daniel. Hydrogen energy systems: a critical review of technologies, applications, trends and challenges. Renew Sustain Energy Rev 2021;146. https://doi.org/10.1016/j.rser.2021.111108.

[15] RECIF program website. https://recherche.upf.fr/fr/projet/recif/.

[16] Endo Naruki, Shimoda Eisuke, Goshome Kiyotaka, Yamane Toshihiro, Nozu Tsuyoshi, Maeda Tetsuhiko. Construction and operation of hydrogen energy utilization system for a zero emission building. Int J Hydrogen Energy 2019;44(29):14596–604. https://doi.org/10.1016/j.ijhydene.2019.04.107.

[17] Lin Rong-Heng, Zhao Ying-Ying, Wu Bu-Dan. Toward a hydrogen society: hydrogen and smart grid integration. Int J Hydrogen Energy 2020;45(39):20164–75. https://doi.org/10.1016/j.ijhydene.2020.01.047.

[18] Valverde L, Rosa F, Del Real AJ, Arce A, Bordons C. Modeling, simulation and experimental set-up of a renewable hydrogen-based domestic microgrid. Int J Hydrogen Energy September 2013;38(27):11672–84. https://doi.org/10.1016/j.ijhydene.2013.06.113.

[19] Valverde L, Rosa F, Bordons C, Guerra J. Energy management Strategies in hydrogen smart-grids: a laboratory experience. Int J Hydrogen Energy August 2016;41(31):13715–25. https://doi.org/10.1016/j.ijhydene.2016.05.279.

[20] Kim DS, Infante Ferreira CA. Solar refrigeration options – a state-of-the-art review. Int J Refrig 2008;31(1):3–15. https://doi.org/10.1016/j.ijrefrig.2007.07.011. ISSN 0140-7007.

[21] Ferreira Infante, Kim Dong-Seon. Techno-economic review of solar cooling technologies based on location-specific data. Int J Refrig 2014;39:23–37. https://doi.org/10.1016/j.ijrefrig.2013.09.033.

[22] Zisopoulos Georgios, Nesiadis Athanasios, Atsonios Konstantinos, Nikolopoulos Nikos, Stitou Driss, Coca-Ortegón Adriana. Conceptual design and dynamic simulation of an integrated solar driven thermal system with thermochemical energy storage for heating and cooling. J Energy Storage 2021;41:102870. https://doi.org/10.1016/j.est.2021.102870.

[23] Wilberforce Tabbi, Olabi AG, Muhammad Imran, Abed Alaswad, Enas Taha Sayed Ahmed G, Abo-Khalil, Maghrabie Hussein M. Khaled Elsaid, Mohammad Ali Abdelkareem, "Recovery of waste heat from proton exchange membrane fuel cells – a review". Int J Hydrogen Energy 2022. https://doi.org/10.1016/j.ijhydene.2022.08.069.

[24] Dixit Marm, Fulpagare Yogesh, Shukla Jalay, Basarkar Pratik, Parikh Dhrupad, Jain Rajat, Bhargav Atul. Design of fuel cell systems laboratory for hydrogen, carbon monoxide and hydrocarbon safety. Int J Hydrogen Energy 2014;39(31):17929–40. https://doi.org/10.1016/j.ijhydene.2014.08.094.

[25] Lee Jaewon, Cho Sunghyun, Cho Hyungtae, Cho Seungsik, Lee Inkyu, Moon Il, Kim Junghwan. CFD modeling on natural and forced ventilation during hydrogen leaks in a pressure regulator process of a residential area. Process Saf Environ Protect 2022;161:436–46. https://doi.org/10.1016/j.psep.2022.03.065.

[26] Cerchiara GM, Mattei N, Schiavetti M, Carcassi MN. Natural and forced ventilation study in an enclosure hosting a fuel cell. Int J Hydrogen Energy 2011;36(3):2478–88. https://doi.org/10.1016/j.ijhydene.2010.03.124.

[27] Patel Parth, Baalisampang Til, Arzaghi Ehsan, Garaniya Vikram, Abbassi Rouzbeh, Salehi Fatemeh. Computational analysis of the hydrogen dispersion in semi-confined spaces. Process Saf Environ Protect 2023;176:475–88. https://doi.org/10.1016/j.psep.2023.06.019.

[28] Wen Jennifer X, Marono Marta, Moretto Pietro, Reinecke Ernst-Arndt, Sathiah Pratap, Studer Etienne, Vyzamina Elena, Melideo Daniele. Statistics, lessons learned and recommendations from analysis of HIAD 2.0 database. Int J Hydrogen Energy 2022;47(38):17082–96. https://doi.org/10.1016/j.ijhydene.2022.03.170.

[29] West Madison, Al-Douri Ahmad, Hartmann Kevin, Buttner William, Groth Katrina M. Critical review and analysis of hydrogen safety data collection tools. Int J Hydrogen Energy 2022;47(40):17845–58. https://doi.org/10.1016/j.ijhydene.2022.03.244.

[30] Nieto Beatriz, Manjavacas Gonzalo, Merino Carlos, Quintana Rubén. Preliminary study for the adequacy and implementation of a hydrogen laboratory. Int J Hydrogen Energy 2014;39(8):4143–9. https://doi.org/10.1016/j.ijhydene.2013.02.132.

[31] French Institute for Research and Security (INRS). ED945 document. Implementation of regulations relating to explosive atmospheres (ATEX) - Methodological guide December 2020 (in French). Regulatory context, page 4. Available online here (last accessed June 2023).

[32] ASHRAE position document on ammonia as a refrigerant. February 1, 2017. Available online here (accessed June 2023).

[33] EN 378-1. Refrigerating systems and heat pumps - safety and environmental requirements - Part 1: basic requirements, definitions, classification and selection criteria. 2020.

[34] EN 378-2. Refrigerating systems and heat pumps - safety and environmental requirements - Part 2: design, construction, testing, marking and documentation. 2017.

[35] EN 378-3. Refrigerating systems and heat pumps - safety and environmental requirements - Part 3: installation site and personal protection. 2020.

[36] Ferrucci F. PV-driven vapor compression cycle integrating a solid-gas thermochemical storage for cooling applications. PhD manuscript. March 2020. Available online here (accessed June 2023).

[37] Sansine V. Implementation of a forecasting tool for solar energy production, to modelize and optimize a micro-grid. PhD thesis. University of French Polynesia; 2022. https://www.theses.fr/s296668.

[38] Lambert H. Modeling, control and optimization of a trigeneration system based on renewable energies and hydrogen-energy. PhD thesis. France: Bourgogne Franche-Comté University; 2022. https://www.theses.fr/s227131.

[39] PVCAM program. Plateforme Photovoltaïque pour la Caractérisation et la Modélisation. 2020. https://recherche.upf.fr/fr/projet/pvcam/.

[40] French labor code. Circular of 09/05/85 relating to the technical commentary of decrees 84-1093 and 84-1094 of 7/12/1984 concerning the ventilation and sanitation of workplaces. Available online here (accessed June 2023).
[41] IEC 60079-10-1. Explosive atmospheres – Part 10-1: classification of areas -Explosive gas atmospheres. 2020.

[42] IEC 60079-14. Explosive atmospheres – Part 14: electrical installations design, selection and erection. 2013.

[43] IEC 60079-25. Explosive atmospheres – Part 25: intrinsically safe electrical systems. 2020.

[44] IEC 60079-29-2. Explosive atmospheres - Part 29-2: gas detectors - selection, installation, use and maintenance of detectors for flammable gases and oxygen. 2015.

[45] IEC 60079-29-3. Explosive atmospheres - Part 29-3: gas detectors - guidance on functional safety of fixed gas detection systems. 2015.

[46] RECIF project - "RECIF_safety_system" GitHub repository, available online here (accessed June 2023).

[47] IEC 60947-4-1. Low-voltage switchgear and controlgear – Part 4-1: contactors and motor-starters – Electromechanical contactors and motor-starters. 2018.

[48] IEC 60947-5-1. Low-voltage switchgear and controlgear – Part 5-1: control circuit devices and switching elements – Electromechanical control circuit devices. 2016.

[49] DGUV, Deutsche Gesetzliche Unfallversicherung (German Social Accident Insurance). Software-assistant SISTEMA: safety integrity software tool for the evaluation of machine applications. A tool for the Easy application of the control standard EN ISO 13849-1. Software version 2.04 build 4. Available online here (accessed June 2023).

[50] IEC 61508-2. Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 2: requirements for electrical/electronic/ programmable electronic safety-related systems. 2010.

[51] ISO 13849-1. Safety of machinery — safety-related parts of control systems — Part 1: general principles for design. 2015.

[52] ISO 13849-2. Safety of machinery — safety-related parts of control systems — Part 2: validation. 2012.

[53] IEC 62061. Safety of machinery - functional safety of safety-related control systems. 2021.

[54] NF C-15 100. Low voltage electrical installations. French standard; 2015.

[55] NF M87-202. Petroleum industry - instrumentation cables - specifications. French standard; 1987.

[56] Hauke M, Schaefer M, Apfeld R, Bömer T, Huelke M, Borowski T, Büllesbach K-H, Dorra M, Foermer-Schaefer HG, Uppenkamp J, Lohmaier O, Heimann K-D, Köhler B, Zilligen H, Otto S, Rempel P, Reuß G. Functional safety of machine controls – application of EN ISO 13849 – (IFA Report 2/2017e). Berlin. In: Deutsche Gesetzliche Unfallversicherung e. V. (DGUV); 2019. ISBN: 978-3-86423-232-9. ISSN: 2190-7994. Available online here (accessed June 2023).

[57] Ferrucci F. Design and reliability assessment of the final actuation logic of a nuclear reactor protection system. Thesis for Master of Systems Optimization and Security, UTT. Advisor: Anne Barros March 2014. https://doi.org/10.13140/ RG.2.1.1895.6323.

[58] ABB Pluto manager software, available online here (accessed June 2023).

[59] ABB PLUTO Safety-PLC Operating instructions hardware v12A. Document code 2TLC172001M0212_A.

[60] Ciconkov R. Refrigerants: there is still no vision for sustainable solutions. Int J Refrig 2018;86:441–8. https://doi.org/10.1016/j.ijrefrig.2017.12.006.

[61] Air Liquide safety datasheets database. Hydrogen safety datasheet. Site available here. Specific safety datasheet available here (accessed June 2023).

[62] INERIS document DRC-08-94398-11812A. French national Institute for industrial environment and risks. Chemical substances portal. Information on ammonia, available online here (accessed June 2023).