127
A publication of

CHEMICAL ENGINEERING TRANSACTIONS
VOL. 105, 2023

The Italian Associationof Chemical Engineering
Online at www.cetjournal.it

Guest Editors: David Bogle, Flavio Manenti, Piero Salatino
Copyright © 2023, AIDIC Servizi S.r.l.
ISBN 979-12-81206-04-5; ISSN 2283-9216

DOI: 10.3303/CET23105022

Development of a Protocol for the Systematic Analysis of
Events at Hydrogen Refuelling Stations
Joaquín Navajasa*, Eulàlia Badiaa, Roser Salaa, Hitomi Satob, Nicola PaltriniericaSocio-Technical Research Centre, Centro de Investigaciones Energéticas, Medioambientales y Tecnológicas (CIEMAT).
Mòdul de Recerca A. Plaça del Coneixement s/n, Universitat Autònoma de Barcelona, 08193 Bellaterra, Barcelona, Spain.
bInstitutes of Innovation for Future Society, Nagoya University. Furo-cho, Chikusa-ku, Nagoya, Japan.
c
Department of Mechanical and Industrial Engineering, Norwegian University of Science and Technology (NTNU), Richard
Birkelands vei 2b, Trondheim 7034, Norway.
joaquin.navajas@ciemat.es

Sustainable hydrogen is transitioning from a future concept to a reality in everyday life, especially in somecountries. There are numerous developments and applications of primary use of hydrogen, such as fuel cellvehicles and hydrogen refuelling stations (HRSs). HRSs’ safety is a prerequisite for their successful deployment
in society. The expansion of this technology inevitably will depend on its safe operation, thus there is a need tominimize potential risks in the value chain of hydrogen. As part of the international SUSHy project, we aim to
identify key parameters and safety requirements to minimize risks and ensure HRS safety. As a first step, an
incident analysis protocol has been developed based on proven methodologies from high reliability industries(such as nuclear and offshore). This protocol, Incident Contributing Factors Analysis (ICFA), will guide thesystematic analysis of the different factors involved in the events. The ICFA has been validated by amultidisciplinary team of experts through its application to some incidents obtained from various international
databases (KHK, HIAD 2.0, ARIA, and H2 LL). This paper briefly describes the basis of the ICFA protocol
development and the procedure for its implementation, derived from the results of the pilot study. In theframework of the SUSHy project, it is planned to apply this protocol to a systematic analysis of more than 200
incidents and accidents that occurred in HRS, which have been identified and selected from the previous
mentioned international databases. Its systematic application will allow ranking risk factors and gathering
lessons learned in order to improve HRS safety.

1. Introduction
The energy and transport sectors are being transformed by the current trend of ever-increasing global energy
consumption and the urgent need to move away from fossil fuels. Green hydrogen is emerging as an energy
carrier that provides a sustainable alternative to oil, coal and natural gas amongst others. The widespread useof this emerging technology not only depends on the cleanliness and affordability of the processes involved, butalso on ensuring its safety. This includes the entire hydrogen value chain: production, supply, conversion,storage and final use in applications such as fuel cell vehicles (FCVs). The expansion of FCVs will depend on
the establishment of an extensive network of HRSs. The potential development of these HRSs will go hand inhand with the identification of safety parameters and requirements.
The present study focuses on the safety of HRSs, with or without hydrogen production. It aims to develop a
protocol for the systematic analysis of operational events. These events, collected from different databases,
have taken place in HRSs. This analysis provides a comprehensive understanding of the main determinants ofincidents and accidents at HRSs according to their actual operation.
1.1 Safety of hydrogen refuelling stations
The successful deployment of hydrogen vehicles will depend on the simultaneous development of a network ofrefuelling stations. Ensuring the safety of these infrastructures will enable to exploit the potential of hydrogen as

Paper Received: 29 January 2023; Revised: 6 July 2023; Accepted: 2 June 2023
Please cite this article as: Navajas J., Badia E., Sala R., Sato H., Paltrinieri N., 2023, Development of a Protocol for the Systematic Analysis of
Events at Hydrogen Refuelling Stations, Chemical Engineering Transactions, 105, 127-132 DOI:10.3303/CET23105022

128

an energy vector for transport, overcoming the current limitations of a technology "still at an infant stage"(Apostolou and Xydis, 2019, p. 13).
The development and implementation of HRSs requires an 'inherent safety design', in which safety is embedded
at the design stage (Kletz and Amyotte, 2010). Such a design, must not only address the chemical properties
of hydrogen (a highly flammable element that can form explosive mixtures with oxygen), but also the interrelation
between technology, organization, and human behaviour (Rasmussen, 1997). Therefore, a safe HRS will
require both the most advanced technological features (i.e., leak detection sensors and/or dedicated ventilation
systems) and established procedures that guide behaviour during emergencies (i.e., how to act in case of an
emergency). With safety as a central element, numerous studies have attempted to identify the most potentiallycatastrophic risks in HRSs (Zhiyong et al., 2010). Two methodological strategies stand out: the identification ofrisk scenarios through HAZOP analysis, and the quantitative assessment of potential risks. Pan et al. (2016)
performed a HAZOP analysis to establish incident scenarios and calculate failure frequencies at hybrid
renewable hydrogen refuelling stations. They identified compressors as the main risk contributors to accidents.
Sun et al. (2014) conducted a risk analysis of a mobile HRS and found out that booster compressor leaks are
the major risk contributors, while tube storage failures cause the greatest financial losses. Tsunemi et al. (2019)
performed a quantitative risk assessment for three accident scenarios. The first scenario was a hydrogen leakfrom the external piping surrounding an open dispenser in the vicinity of workers and consumers. The second
scenario was a hydrogen leak from a high-pressure accumulator connection pipe, and the third was a hydrogenleak from a high-pressure connection pipe/compressor.
Other studies have focused their analysis on the probability of human error. Techniques such as HRA (Human
Rate Assessment) or HEART (Human Error Assessment and Reduction Technique) have been applied to
predict potential failures related to human factors (Castiglia and Giardina, 2013). It should also be noted thatsome research has attempted to estimate risk based on HRSs events information. Lam et al. (2019) used
network theory to analyse hydrogen logistics incidents. They collected 100 hydrogen logistics incidents andidentified eight factors and five effects, revealing the interdependencies between them. One of the most notablefactors was improper operation, which can lead to a cascade of logistics incidents, with leakage being the mostcommon effect. It is worth mentioning that Moradi and Groth (2019) pointed out that while there is an abundanceof experimental research on the reliability of individual components, there is very little data collection on systems.
They also noted that another critical aspect of enhancing risk assessment was to improve the quality of incident
databases such as HIAD 2.0 and others.
1.2 Event analysis methodologies
The analysis of abnormal/upset operations, near-misses and lower-consequence higher-frequency incidents,
has helped to strengthen safety in the chemical industry (CCPS, 2019). Systematic incident analyses reveal
aspects of the functioning of complex technological systems and allow weaknesses to be identified. There areseveral existing incident analysis and review methodologies. The interdisciplinary nature and evolution of thesetechniques, which have been "successfully borrowed" from one field to another, are notable (Livingston et al.,2001, p. 4).The present study takes as a reference two methodologies for establishing an analysis protocol forthe systematic review of incidents in HRSs. The two publicly available methodologies (CCPS, 2019) are: a)Management Oversight and Risk Tree (MORT) and b) Systematic Accident Cause Analysis (SACA).
The MORT methodology for event analysis dates back to 1973. It was developed by the United States
Department of Energy (DOE), as an operational analysis tool to provide a technique for thorough investigationof occupational accidents and analysis of the safety programme. The MORT methodology was considered to
be a synthesis of the best safety elements and concepts for event analysis (Solano and Isasia, 2017). Thismethodology is used in the nuclear industry to try to determine the root causes of events. The application of
MORT in practice has shown flexibility in rapid evaluation in different technologies and explanation of abnormal
events in terms of risk management (Kingston et al., 2009). It is mainly used for relevant events due to thecomplexity of its use (it requires a team and a significant amount of time to be implemented). In operationalterms, MORT can be thought as a checklist structured in the form of a complex "fault tree" model (de Oliveira
et al., 2022). The SACA methodology was developed by Waldram and applied in the offshore industry. It
establishes a multi-causal perspective of undesirable events, with four main categories and sixteen causes.
SACA is applied in checklist form, which is a user-friendly approach provided that it's applied consistently andwith sufficient information (Waldram, 1988, as cited in Livingston et al., 2001).

2. Design of a protocol for the systematic review of abnormal events
The following requirements were defined for the design of the protocol: a) it should enable the identification ofcontributing factors in a systematic way and with the highest degree of objectivity; b) it should include technical,
but also human and organisational factors in its identification; and c) its implementation should be aimed at

129

determining what factors contribute to the occurrence of events, rather than creating a "fault tree" or finding theroot cause. Based on these three considerations, the protocol is referred to as "Incident Contributing Factors
Analysis" (hereafter ICFA). A systematic application of the ICFA protocol to a large number of incidents willallow the identification of the typology of contributing factors and other failures involved in HRSs events. This
categorisation should facilitate the establishment of a hierarchy of risk factors that will contribute to effective risk
management of HRS.The stages for shaping the incident analysis protocol are shown below (see Figure 1):

Figure 1: ICFA protocol development stages.
As noted above, the review of incident analysis methodologies used in technologically complex systems led tothe identification of MORT and SACA as proven and potentially adaptable methodologies. This review also
resulted in the identification of the NRI MORT User's Manual (Kingston et al., 2009), a document of great interestfor this study as it provides a broad and accurate categorisation of potential factors involved in events. Basedon the NRI MORT Users' Manual and the SACA Methodology, 10 potential contributing factors and 35 subfactors were established. The list of contributing factors is shown in Table 1.
Table 1: List of contributing factors and sub-factors.
Factors
1. Technical Information System

Sub-factors
1.1. Technical Information
1.2. Data Collection & analysis
1.3. Trigger to Risk analysis

2. Operational Readiness2.1. Verification of operational readiness2.2. Technical Support
2.3. Interface between Operations and Maintenance or Testing Activities
2.4. Configuration

3. Inspections

3.1. Planning process
3.2. Execution

4. Maintenance4.1. Planning process
4.2. Execution

5. Supervision and Staff Performance

5.1. Time5.2. Continuity of Supervision
5.3. Detection/Correction of Hazards
5.4. Performance Errors

6. Support of supervision

6.1. Help and training supervisors
6.2. Research and fact-finding
6.3. Information exchange
6.4. Standards and directives
6.5. Resources
6.6. Deployment of resources
6.7. Referred risk response

7. Stabilisation and restoration

7.1. Prevention of follow-on accident
7.2. Emergency action (Fire-fighting, etc.)
7.3. Rescue and salvage
7.4. Medical Services
7.5. Dissemination of information
7.6. Restoration and rehabilitation

8. Management and risk policies

8.1. Management policy and implementation
8.2. Risk management policy and implementation

9. Risk analysis Process

9.1. Concepts and requirements
9.2. Design and development
9.3. Risk management assurance programme & review

10. Outside Local Control

10.1. Failure by third part10.2. Severe weather
10.3. Other factors

130

3. Pilot application of the ICFA protocol
The pilot analysis was carried out by a team of three analysts, two researchers with extensive experience insafety and risk management, and a former plant manager and engineer of three different nuclear power plants.
Prior to the pilot, the analysts were trained by one of the MORT-NRI Guide authors, Dr John Kingston. The
working session reviewed the list of factors and their scope. Standards and guidelines for the development of
the pilot analysis were also established in order to minimise variability between analysts. Two general rules
were agreed:
1) Principle of minimum inference: Analysts should not fall into cause and effect reasoning when coding.
Contributing factors must be related to specific extracts (1 or 2 sentences) of the event information.
2) Principle of analyst consensus: As a collaborative process, the log information must be supported by theteam of analysts. Each factor must be agreed by at least two of the analysts.
HRSs events were collected from different databases identified from a literature review (Campari et al., 2023;
Wen et al., 2022). Each database was specifically screened to identify events that occurred in HRSs. A total of
211 different events were identified. Table 2 shows the information on the databases selected for the study andthe number of HRSs events in each of them.
The pilot analysis was conducted in five events (1 event from HIAD 2.0 and ARIA database; 2 events from H2
LL database; and 2 events from KHK database). According to the ICFA protocol, a form was used to record thecore event, contributing factors, other system failures, and corrective actions/lessons learned (Table 3).
Table 2: Database description and HRSs events included.
Database
Description
AccessHRSs events
Hydrogen Incident and European database developed by the Joint Research On request
16
Accident Database
Centre (JRC) of the European Commission (EC)(HIAD 2.0)
which records worldwide hydrogen-related events.
https://odin.jrc.ec.europa.eu/
Hydrogen Tools
American database developed by the Pacific Open13
Lessons Learned
Northwest National Laboratory, supported by the U.S.
database
Department of Energy which includes hydrogen safety(H2 LL)
event records and shares lessons learned and otherrelevant information.
https://h2tools.org/
The High Pressure
Japanese database developed by the High Pressure Open186
Gas Safety Institute of Gas Safety Institute of Japan at the request of the (JapaneseJapan database
Ministry of Economy, Trade, and Industry in Japan version)(KHK)
which records incident information related to highpressure gases and hazardous substances in Japan.
http://www.khk.or.jp/
Analysis, Research
French database developed by the Bureau for Analysis Open
4and Information onof Industrial Risks and Pollution (BARPI) within the (Further
Accidents database
Ministry of Environment / General Directorate for Risk information(ARIA)
Prevention
which
catalogues
industrial
and on request)
technological incidents or accidents that were, or could
have been, deleterious to human health, public safetyor the environment.
https://www.aria.developpement-durable.gouv.fr/
Table 3: Information to collect in each event form.
Elements to collectCore event
Contributing factors
Other failures
Corrective actions / “Lessons learned”

Description
The essence of the event as described in the record (what has
happened without considering why)Those aspects that determine in some way the event occurrence
Other deficiencies that occurred at (or after) the event
Actions taken, as included in the event description

131

4. Results of the pilot application
The pilot application of the ICFA protocol to five events allowed the objective identification (according to theprinciples of minimum inference and inter-analyst consensus) of the main factors that contributed to its
occurrence.
It should be noted that 'design and development' accounts for 46% (Figure 2) of the contributing factors
identified. The content related to this factor is shown in Table 4.

Design and development

8%
8%
8%

Concepts and requirements
46%

15%

Performance errors
Failure by third part

15%

Inspection planning
Maintenance plannig

Figure 2: Contributing factors distribution in pilot events.
Table 4: ‘Design and development’ issues involved in the events.
Factor 9.2 - Design and development
It considers the design and implementation of work/process control and related infrastructures
2005-222 KHK
Hose kink during the filling (Operational readiness)
Threaded part of the flexible hose no fixed (Operational readiness)
1 H2 Tools
Lack of automatic control for refuelling speed (Automatic control)
Procedure leads to human error (Human factor)
5 H2 Tools
Bending hose during use (Specification operational readiness)
2005-120 HHKFatigue failure due to weight of filler and safety coupling (Operational readiness)
The application of the protocol has also permitted the categorisation of the "corrective actions/lessons learned"
and the identification of the focus of the action from a socio-technical perspective (Table 5).
Table 5: Socio-technical level and focus of the corrective actions and lessons learned.
Socio-technical level
Technical

Human
Organizational

Inter-organizational

Action Focus
Protective tube installed to prevent bending radius of the filler hose
Short the replacement period of filler hose
Replace fuelling hoses every 6 months
Disable the fuelling process (if the sequence is done improperly)
Equip technicians with portable sensors
Install a metal fitting to avoid screw loose
Full leakage test (each time an alarm is triggered)
Avoid hose kinks during refuelling
Daily examination of fuelling hoses
Improve the fuelling procedure
Carry out emergency exercises
Failure investigation by producer (O-ring of the bus tank)

5. Conclusions
The application of the ICFA protocol has proved to be effective in the analysis of 5 HRS events from 4 different
databases, allowing the identification of 13 contributing factors. Its implementation by different analysts enables
valuable and reliable information to be obtained, avoiding the bias of subjectivity. It also helps to identify andcategorise the contributing factors, providing relevant safety information, and allowing the collection of theoperational experiences (corrective actions/lessons learned) that the different stations have implemented after

132

the events. Extending the use of the ICFA protocol to all sampled events, will allow the discovery of criticalaspects for the safety of HRSs.
As a potential limitation, it should be stated that the protocol’s application relies on the quality and quantity of
the available information. In some cases, the event information is of high quality but, in others, the informationis very synthetic, with limited information about the causal sequence or the different factors involved.
Acknowledgments
This work was supported by AEI Grant Number PCI2022-132997, Spain, through the European Interest Group(EIG) CONCERT-Japan platform (Grant Number 334340).
References
Apostolou, D., Xydis, G., 2019. A literature review on hydrogen refuelling stations and infrastructure. Current
status and future prospects. Renew. Sustain. Energy Rev. https://doi.org/10.1016/j.rser.2019.109292
Campari, A., Nakhal Akel, A.J., Ustolin, F., Alvaro, A., Ledda, A., Agnello, P., Moretto, P., Patriarca, R.,
Paltrinieri, N., 2023. Lessons learned from HIAD 2.0: Inspection and maintenance to avoid hydrogen-induced
material failures. Comput. Chem. Eng. 173. https://doi.org/10.1016/j.compchemeng.2023.108199
Castiglia, F., Giardina, M., 2013. Analysis of operator human errors in hydrogen refuelling stations: Comparison
between human rate assessment techniques. Int. J. Hydrogen Energy 38, 1166–1176.
https://doi.org/10.1016/j.ijhydene.2012.10.092
CCPS (Center for Chemical Process Safety), 2019. Guidelines for Investigating Process Safety Incidents, 3rdedition. ed. Wiley Professional, Reference & Trade, New York.
de Oliveira, U.R., dos Santos, C.O., Chaves, G.E.L., Fernandes, V.A., 2022. Analysis of the MORT method
applicability for risk management in supply chains. Oper. Manag. Res. 15, 1361–1382.
https://doi.org/10.1007/s12063-021-00248-2
Kingston, J., Koornneef, F., Ruilt, J.V., Frei, R., Schallier, P., 2009. User’s Manual: for use with the management
oversight and risk tree analytical logic diagram, Second Edi. ed. The Noordwijk Risk Initiative Foundation.
Kletz, T.A., Amyotte, P., 2010. Process Plants: A Handbook for Inherently Safer Design, Second Edition. ed.
CRC Press.
Lam, C.Y., Fuse, M., Shimizu, T., 2019. Assessment of risk factors and effects in hydrogen logistics incidents
from a network modeling perspective. Int. J. Hydrogen Energy 44, 20572–20586.
https://doi.org/10.1016/j.ijhydene.2019.05.187
Livingston, A.D., Jackson, G., Priestley, K., Great Britain. Health and Safety Executive., 2001. Root causes
analysis : literature review. HSE Books.
Moradi, R., Groth, K.M., 2019. Hydrogen storage and delivery: Review of the state of the art technologies andrisk and reliability analysis. Int. J. Hydrogen Energy. https://doi.org/10.1016/j.ijhydene.2019.03.041
Pan, X., Li, Z., Zhang, C., Lv, H., Liu, S., Ma, J., 2016. Safety study of a wind–solar hybrid renewable hydrogen
refuelling
stationin
China.
Int.
J.
Hydrogen
Energy41,13315–13321.
https://doi.org/10.1016/j.ijhydene.2016.05.180
Rasmussen, J., 1997. Risk management in a dynamic society: a modelling problem. Saf. Sci. 27, 183–213.
https://doi.org/https://doi.org/10.1016/S0925-7535(97)00052-0
Solano, V., Isasia, R., 2017. La Metodología de Análisis de Causa Raíz MORT (Management and Oversight
Risk Tree). Propuesta de Modernización y Adaptación a la Realidad Española.
Sun, K., Pan, X., Li, Z., Ma, J., 2014. Risk analysis on mobile hydrogen refueling stations in Shanghai, in:International
JournalofHydrogen
Energy.
ElsevierLtd,
pp.
20411–20419.
https://doi.org/10.1016/j.ijhydene.2014.07.098
Tsunemi, K., Kihara, T., Kato, E., Kawamoto, A., Saburi, T., 2019. Quantitative risk assessment of the interiorof a hydrogen refueling station considering safety barrier systems. Int. J. Hydrogen Energy 44, 23522–
23531. https://doi.org/10.1016/j.ijhydene.2019.07.027
Wen, J.X., Marono, M., Moretto, P., Reinecke, E.A., Sathiah, P., Studer, E., Vyazmina, E., Melideo, D., 2022.
Statistics, lessons learned and recommendations from analysis of HIAD 2.0 database. Int. J. Hydrogen
Energy 47, 17082–17096. https://doi.org/10.1016/j.ijhydene.2022.03.170
Zhiyong, L., Xiangmin, P., Jianxin, M., 2010. Harm effect distances evaluation of severe accidents for gaseoushydrogenrefuelingstation.
Int.
J.
Hydrogen
Energy35,
1515–1521.
https://doi.org/10.1016/j.ijhydene.2009.11.081