SYSTEM SAFETY PLAN FOR COMMERCIAL 

VEHICLES USING HYDROGEN AS AN 

ALTERNATIVE FUEL 

 November 2007
FOREWORD 

This System Safety Plan (SSP) guidance document was the result of Task 4 of a project to help 

ensure overall safety of commercial vehicle fleets that implement hydrogen systems and 

equipment. System safety planning and management are considered important activities required 

to successfully implement and safely operate hydrogen systems on commercial vehicles. This 

guidance document is intended to serve the following purposes: 

• To provide guidance on recommended elements of an SSP for commercial vehicle fleet 

operators that plan to implement hydrogen systems and equipment 

• To establish a recommended format for an SSP 

• To document the means and expertise of the commercial vehicle fleet operator for 

implementing a sound, effective, proactive SSP to reduce accidents related to hydrogen 

systems 

This report provides guidance in the development of system safety programs for commercial 

vehicle fleet operators interested in or operating hydrogen systems and equipment. The key 

aspects of preparing an SSP include: 

• Policies, authority, and administration 

• Hazard identification and management 

• Operating rules, training and procedures 

• System safety reviews and audits

This report is not intended to be an in-depth specification to be used by Original Equipment 

Manufacturers (OEMs) or other vendors/suppliers in order to design and build hydrogen systems 

and equipment. The responsibility for safety design standards, including hydrogen systems and 

equipment, falls under the jurisdiction of the National Highway Traffic Safety Administration 

(NHTSA). However, once hydrogen systems and equipment are placed in service in a 

commercial vehicle fleet, regulatory responsibility for operations and maintenance falls under the 

FMCSA. 
NOTICE 

This document is disseminated under the sponsorship of the Department of Transportation in the 

interest of information exchange. The United States Government assumes no liability for its 

contents or the use thereof. 

The contents do not necessarily reflect the official policy of the Department of Transportation. 

This report does not constitute a standard, specification, or regulation. 

The United States Government does not endorse products or manufacturers. Trade or 

manufacturers’ names appear herein only because they are considered essential to the objective 

of this document. 
Technical Report Documentation Page (Form 1700.7) 

1. Report No.

FMCSA-RRT-07-025

2. Government Accession No. 3. Recipient's Catalog No. 

4. Title and Subtitle: 

System Safety Plan for Commercial Vehicles Using Hydrogen as an 

Alternative Fuel 

5. Report Date: 

November 16, 2007 

6. Performing Organization Code 

MC-RRT 

7. Author(s): 

John M. Simon, CSP, Booz Allen Hamilton Inc. 

Stephen Brady, Booz Allen Hamilton Inc. 

Dana Lowell, M. J. Bradley & Associates 

Michael Quant, Booz Allen Hamilton Inc. 

8. Performing Organization Report No. 

9. Performing Organization Name and Address: 10. Work Unit No. (TRAIS) 

Booz Allen Hamilton Inc. 

444 S. Flower Street, Suite 1850 

Los Angeles, California 90071 11. Contract or Grant No. 

GS-23F-0025K 

13. Type of Report and Period Covered 

Final Report 

12. Sponsoring Agency Name and Address: 

U.S. Department of Transportation 

Federal Motor Carrier Safety Administration – Technology Division (MCRRT) 

1200 New Jersey Ave. SE 

Washington DC 20590 

14. Sponsoring Agency Code 

FMCSA 

15. Supplementary Notes: 

Contracting Officer’s Technical Representative: 

Quon Y. Kwan, Program Manager 

16. Abstract: 

Over the next 50 years, hydrogen use is expected to grow dramatically as an automotive and electrical power source fuel. As 

hydrogen becomes commercially viable, the safety concerns associated with hydrogen systems, equipment, and operation are of 

concern to the motor vehicle industry. This report is intended to provide guidance for the development of a System Safety Plan 

that would be used by a commercial vehicle fleet operator to ensure long-term safe operation of commercial vehicles utilizing 

hydrogen, regardless of the number of commercial vehicles in the fleet. 

17. Key Words: 

Hydrogen Safety, System Safety Plan, Hydrogen 

18. Distribution Statement 

No restrictions. 

19. Security Classif. (of this report) 

 Unclassified 

20. Security Classif. (of this page) 

 Unclassified 

21. No. of Pages: 

 37 

22. Price 
SI* (MODERN METRIC) CONVERSION FACTORS 

APPROXIMATE CONVERSIONS TO SI UNITS APPROXIMATE CONVERSIONS FRO

Symbol When You Know Multiply By To Find Symbol Symbol When You Know Multiply By 

LENGTH LENGTH 

in Inches 25.4 millimeters mm mm millimeters 0.039 incft Feet 0.305 meters m m meters 3.28 feeyd Yards 0.914 meters m m meters 1.09 Yami Miles 1.61 kilometers km km kilometers 0.621 mi

AREA AREA 

in2 square inches 645.2 square millimeters mm2 mm2 square millimeters 0.0016 squft2 square feet 0.093 square meters m2 m2 square meters 10.764 squyd2 square yards 0.836 square meters m2 m2 square meters 1.195 squac Acres 0.405 hectares ha ha hectares 2.47 acrmi2 square miles 2.59 square kilometers km2 km2 square kilometers 0.386 squ

VOLUME VOLUME 

fl oz fluid ounces 29.57 milliliters ml ml milliliters 0.034 flugal Gallons 3.785 liters l l liters 0.264 gaft3 cubic feet 0.028 cubic meters m3 m3 cubic meters 35.71 cuyd3 cubic yards 0.765 cubic meters m3 m3 cubic meters 1.307 cu

MASS MASS 

oz Ounces 28.35 grams g g grams 0.035 oulb Pounds 0.454 kilograms kg kg kilograms 2.202 poT short tons (2000 lbs) 0.907 megagrams Mg Mg megagrams 1.103 sh

TEMPERATURE (exact) TEMPERATURE (exac

°F Fahrenheit 5(F-32)/9 Celsius °C °C Celsius 1.8 C + 32 

Temperature or (F-32)/1.8 temperature temperature 

ILLUMINATION ILLUMINATION 

fc foot-candles 10.76 lux lx lx Lux 0.0929 fl foot-Lamberts 3.426 candela/m2 cd/m2 cd/m2 candela/m2 0.2919 

FORCE and PRESSURE or STRESS FORCE and PRESSURE or S

lbf pound-force 4.45 newtons N N newtons 0.225 psi pound-force per square inch 6.89 kilopascals kPa kPa kilopascals 0.145 

* SI is the symbol for the International System of Units. Appropriate rounding should be made to comply with Section 4 of ASTM E380.
TABLE OF CONTENTS 

ACRONYMS...............................................................................................................................III

EXECUTIVE SUMMARY ........................................................................................................ IV

1. SYSTEM SAFETY PLANNING AND ADMINISTRATION..........................................1

1.1 POLICY STATEMENT FOR SYSTEM SAFETY PLAN ...........................................1 

1.2 GOALS FOR THE SYSTEM SAFETY PROGRAM...................................................2 

1.3 SCOPE ...........................................................................................................................3 

1.4 SYSTEM SAFETY PROGRAM MANAGEMENT.....................................................3 

1.5 PLAN UPDATE PROCEDURES .................................................................................3 

2. HAZARD ANALYSIS..........................................................................................................5

2.1 THE POTENTIAL SAFETY HAZARDS OF HYDROGEN .......................................5 

2.2 FIRE AND EXPLOSION HAZARD ............................................................................5 

2.3 MINIMAL ASPHYXIATION HAZARD .....................................................................6 

2.4 PERMITTING PROCESS.............................................................................................6 

2.5 INDOOR FACILITY REVIEWS..................................................................................6 

2.6 FUELING STATION REVIEW....................................................................................8 

2.7 HAZARD ANALYSIS ..................................................................................................9 

2.8 HAZARD RESOLUTION PROCESS ..........................................................................9 

2.9 REPORTING A SAFETY INCIDENT .......................................................................10 

3. OPERATING RULES, TRAINING, AND PROCEDURES ..........................................11

3.1 OPERATING RULES AND PROCEDURES.............................................................11 

3.2 TRAINING AND CERTIFICATION .........................................................................12 

3.3 MAINTENANCE PROGRAM ACTIVITIES ............................................................12 

4. SYSTEM SAFETY REVIEWS AND AUDITS................................................................13

5. CONFIGURATION MANAGEMENT ............................................................................14

5.1 DRAWING CONTROL ..............................................................................................14 

5.2 CHANGE MANAGEMENT.......................................................................................14 

6. EMERGENCY CALL-OUT PROCEDURES .................................................................15

i 
LIST OF APPENDICES 

APPENDIX A: OUTLINE OF SYSTEM SAFETY PLAN.....................................................17

CHAPTER 1 SYSTEM SAFETY PLANNING AND ADMINISTRATION .....................17 

CHAPTER 2 HAZARD ANALYSIS...................................................................................17 

CHAPTER 3 OPERATING RULES, TRAINING, AND PROCEDURES.........................18 

CHAPTER 4 SYSTEM SAFETY REVIEWS AND AUDITS ............................................18 

CHAPTER 5 CONFIGURATION MANAGEMENT .........................................................18 

CHAPTER 6 EMERGENCY CALL-OUT PROCEDURES ...............................................18 

APPENDIX B: TYPICAL INDOOR FACILITY CHECKLIST...........................................19

APPENDIX C: TYPICAL FUELING FACILITY CHECKLIST.........................................21

APPENDIX D: SAMPLE FAILURE MODES AND EFFECTS ANALYSIS (FMEA).......23

APPENDIX E: HAZARD RESOLUTION PROCESS ...........................................................24

HAZARD IDENTIFICATION.............................................................................................25 

HAZARD SEVERITY .........................................................................................................26 

HAZARD PROBABILITY ..................................................................................................26 

HAZARD RESOLUTION....................................................................................................27 

LIST OF TABLES 

Table 1. Sample Policy Statement .................................................................................................. 2 

Table 2. Sample Emergency Call-Out Procedure......................................................................... 16 

Table 3. Sample Failure Modes and Effects Analysis (FMEA): Unload and store 2,000 gal. 

of liquid hydrogen at 10 psig and -420° F .............................................................................. 23 

Table 4. Hazard Resolution Matrix............................................................................................... 28 

LIST OF FIGURES 

Figure 1. Typical Indoor Vehicle Maintenance and Storage Facility............................................. 8 

ii 
ACRONYMS 

CCIL Critical/Catastrophic Items List 

FMCSA Federal Motor Carrier Safety Administration 

FMEA Failure Modes and Effects Analysis 

GCW Gross Combined Weight 

GCWR Gross Combined Weight Rating 

GVW Gross Vehicle Weight 

GVWR Gross Vehicle Weight Rating 

HAZOP Hazard and Operability Analysis 

MIL-STD 

882 

Military Standard 882 

NHTSA National Highway Traffic Safety Administration 

OEM Original Equipment Manufacturer 

OHA Operating Hazard Analysis 

PHA Preliminary Hazard Analysis 

SSP System Safety Plan 

iii 
iv 

EXECUTIVE SUMMARY 

Over the next 50 years, hydrogen use is expected to grow dramatically as an automotive and 

electrical power source fuel. As hydrogen becomes commercially viable, the safety concerns 

associated with hydrogen systems, equipment, and operation are of concern to the motor vehicle 

industry. 

As a result of the President’s Hydrogen Fuel Initiative, the Federal Motor Carrier Safety 

Administration (FMCSA) initiated a project to facilitate the use of hydrogen as an alternative 

fuel in commercial vehicles with a focus on safety during vehicle operations and maintenance. 

As a result of that project, FMCSA developed “Guidelines for the Use of Hydrogen in 

Commercial Vehicle,” “Recommended Changes to the Federal Motor Carrier Safety Regulations 

and North American Inspection Procedures to Accommodate Hydrogen as an Alternative Fuel,” 

and this report. 

This particular report, which results from Task 4 of the FMCSA project, is intended to provide 

guidance for the development of a System Safety Plan (SSP) that would be used by a commercial 

vehicle fleet operator to ensure long-term safe operation of commercial vehicles utilizing 

hydrogen, regardless of the number of commercial vehicles in the fleet. 

Specifically, this report provides guidance in the areas of hydrogen safety planning and 

management, including: 

• System safety planning and administration 

• Hazard analysis 

• Operating rules, training, and procedures 

• Reviews and audits 

• Emergency call-out procedures 

Appendix A includes a generic outline for a System Safety Plan, which identifies all of the 

elements, or sections, that should be included. The remainder of this document discusses each of 

these elements, and is arranged in the same order as shown in Appendix A. 
1. SYSTEM SAFETY PLANNING AND ADMINISTRATION 

System safety is defined as “the application of engineering and management principles, criteria, 

and techniques to achieve acceptable mishap risk, within the constraints of operational 

effectiveness and suitability, time and cost, throughout all phases of the system lifecycle.”1 The 

fundamental principles of system safety were initially developed in the late 1960s by the United 

States Department of Defense in the form of Military Standard 882 (MIL-STD-882D). Preparing 

a written System Safety Plan defines the activities that will be conducted in order to ensure safe 

and reliable operation of a system. 

Chapter 1 of the System Safety Plan (SSP) should describe the commercial vehicle fleet 

operator’s organization and the roles and responsibilities of various personnel with respect to 

ensuring system safety. Implementing the SSP requires the support of all employees and 

contractors, as well as the endorsement of the fleet operator’s top management. This chapter 

describes the contents of the SSP that are intended to provide the authority, and to delineate 

responsibility and accountability, for implementing hydrogen safety throughout the organization. 

1.1 POLICY STATEMENT FOR SYSTEM SAFETY PLAN 

The SSP should contain a policy statement endorsed by senior management. The commercial 

vehicle fleet operator should establish the SSP as a living, guiding document that has been 

prepared for and approved by the commercial vehicle fleet operator’s top management. Top 

management approval should be indicated by signing the title page. The signature should be that 

of the highest level within the organization (e.g., fleet manager, facility manager, or owneroperator). Table 1 presents a sample policy statement. 

 1

 MIL-STD- 882D: Standard Practice for System Safety, February 10, 2000. 

1 
Table 1. Sample Policy Statement 

POLICY STATEMENT 

It is the policy of John Doe Trucking Company to operate safely and reliably its 

commercial vehicle fleet incorporating hydrogen systems and equipment. This System 

Safety Plan (SSP) forms the foundation of this policy and is intended to promote the 

highest level of safety, reliability, and quality in all aspects of the John Doe Trucking 

Company’s activities. By signing below, John Doe Trucking Company’s management 

fully supports the System Safety Program and requires the full support, participation, and 

compliance of the Plan by all supervisors, operators, employees, and contractors. 

Sincerely, 

John Doe (signature) 

Date 

John Doe Trucking Company, Owner-Operator 

1.2 GOALS FOR THE SYSTEM SAFETY PROGRAM 

A section of the SSP should be devoted to describing the overall goals for a program of system 

safety by the commercial vehicle fleet operator. 

A statement of goals for a SSP describing the program of system safety might include language 

similar to the following: 

The goal of the SSP is to define system safety activities, responsibilities, management 

controls, and monitoring processes to ensure that: 

• Safety considerations are incorporated into the design of facilities, operations, and 

maintenance practices for hydrogen systems and equipment. 

• Hazards associated with hydrogen systems and equipment are identified, analyzed, 

and then eliminated or minimized, to achieve an acceptable level of safety. 

• Identified hazards will be mitigated by following accepted system safety practices, 

including using the following order of precedence for reducing hazards: 

– Design to eliminate or control the hazard 

– Add safety devices 

– Provide warning devices 

– Institute special procedures and training 

2 
1.3 SCOPE 

A section of the SSP should describe the scope of the hydrogen safety program. 

For a fleet operator interested in implementing hydrogen systems and equipment, the scope of 

the SSP will include considerations for storage of hydrogen, fueling of vehicles, and storage and 

maintenance of vehicles with onboard hydrogen systems. During operation and maintenance, the 

emphasis of the System Safety Program will be to eliminate, minimize, and control hazards 

through design analysis, review, and equipment selection activities. The SSP will also provide 

the basis for developing safety-related rules, operations, and maintenance procedures, and 

training programs to be used during the life of the hydrogen vehicle fleet. The scope section of 

the SSP should also include: 

• A brief description of the hydrogen systems and equipment installed on the fleet 

• The number of commercial vehicles in the fleet that use hydrogen 

• A description of the operations, maintenance and fueling facilities 

• A brief description of safeguards that have been installed to prevent hydrogen accidents 

(e.g., gas monitoring equipment, fire detection system, etc.) 

1.4 SYSTEM SAFETY PROGRAM MANAGEMENT 

In order for a System Safety Program to be effective, specific responsibility for the system safety 

function must be identified in the company’s organization. A section of the SSP should describe 

the company’s organization and the reporting lines of communication. This information is 

usually presented in an organization chart. 

In the organization chart, a single person responsible for system safety should be identified as the 

custodian for the SSP. Additionally, it is desirable to have the system safety staff person report to 

the highest level practicable within the organization in order to ensure that system safety issues 

are communicated to top management. In a large commercial vehicle fleet organization, a system 

safety manager may be identified as reporting to the Chief Executive Officer. In a single owneroperator company, the owner-operator will likely be responsible for the SSP implementation. 

1.5 PLAN UPDATE PROCEDURES 

A section of the SSP should discuss how and when the SSP will be updated. 

Updates to the SSP must be documented to reflect changes in the fleet, changes in operations, or 

additional identified hazards. The person identified as the custodian of the SSP should review 

and update the SSP on an as-needed basis. At a minimum, the SSP should be formally reviewed 

and updated annually. 

3 
Updates should be tracked by annotating the revised plan with a new effective date and/or 

version number (i.e., SSP v.1 effective 01/01/06; SSP v.2 effective 01/01/07, etc.). 

4 
2. HAZARD ANALYSIS 

Prior to implementing hydrogen systems and equipment in a fleet or vehicle, the fleet owner 

must perform planning activities to ensure that the hazards of hydrogen systems and equipment 

are managed so as to reduce the risk of potential harm to the fleet operator and the public. 

This chapter discusses general safety considerations associated with hydrogen and recommended 

system safety activities. 

2.1 THE POTENTIAL SAFETY HAZARDS OF HYDROGEN 

A section of the SPP should give an overview of the potential hazards associated with hydrogen. 

All employees should be aware of the unique characteristics of hydrogen. In particular, hydrogen 

has the following properties that relate to potential hazards: 

• Colorless and odorless gas—thus, a hydrogen detector may be required to locate leaks 

• Nontoxic 

• Very light element—1/15th the density of air; consequently, rises when released 

• Broad flammability range of 4–74 percent H2 concentration in air (as compared to 

narrower ranges of flammability for traditional fuels, such as gasoline, diesel, and natural 

gas) 

• Low ignition energy—even static electricity can ignite H2

• An almost invisible flame when ignited, and does not smoke or radiate heat like a normal 

flame 

• Potential thermal explosion hazard when released into a confined space 

• Potential for explosive container failure when stored under high pressure 

• Severe frostbite hazard when stored as a cryogenic liquid 

• An asphyxiant 

More details on the safety hazards of hydrogen are described in a separate report.2

 

2.2 FIRE AND EXPLOSION HAZARD 

The most common hydrogen hazard is the possibility of fire when leaking hydrogen is ignited. 

Hydrogen’s high flammability and low ignition energy make it susceptible to a variety of 

ignition sources.2 Flames from burning hydrogen are generally invisible in daylight, but if a 

hydrogen fire ignites other nearby materials, then flames and smoke from these other materials 

 2

 Guidelines for the Use of Hydrogen Fuel in Commercial Vehicles, FMCSA, Chapter 2. 

5 
would be visible. An explosion—which is a rare event—is possible if a large enough quantity of 

hydrogen is trapped in a confined area and there is an ignition source. 

Because you may not be able to see, hear, or smell a hydrogen fire, any facility used to fuel, 

store, or maintain hydrogen vehicles should be equipped with special hydrogen detection 

systems. These systems should be able to detect a hydrogen leak, and alert personnel to leave the 

building before concentrations reach one-quarter of hydrogen’s lower flammability limit (1 

percent in air). 

2.3 MINIMAL ASPHYXIATION HAZARD 

Hydrogen can also be an asphyxiant. This means that when hydrogen is present in a confined 

area in large concentrations, it can displace oxygen from the atmosphere. This lack of oxygen 

can lead to dizziness, drowsiness, nausea, loss of consciousness, or even death to exposed 

personnel. 

While it is possible that a large hydrogen release in a vehicle maintenance bay could displace 

enough oxygen to achieve asphyxiation, it may be very unlikely for two reasons. First, for this 

situation to occur, there would have to be a failure of the hydrogen detection system. Second, 

because hydrogen tends to rise, it would concentrate near the ceiling. This might mean that the 

height of the bay would still allow sufficient oxygen, which is heavier than hydrogen, to remain 

at the same level as personnel on the floor. 

2.4 PERMITTING PROCESS 

A section of the SSP should be devoted to discussing coordination with the local fire safety and 

emergency responder agencies. Prior to implementing a hydrogen program, the fleet operator 

should review and comply with all local city, county, and state fire safety/emergency response 

codes and regulations. It is the responsibility of the fleet operator to inform, and obtain any 

necessary permits from, the city planning and emergency responder agencies relating to the use 

of hydrogen systems on their commercial vehicles and any indoor facilities. 

As often as is practical, the local Fire Department and Police Department staff should be invited 

to tour the facility and discuss the facility’s safety systems, procedures, and emergency plans. 

These meetings, as well as other contacts with city and state officials, should be documented and 

kept on file for at least one year. 

2.5 INDOOR FACILITY REVIEWS 

A section of the SSP should be devoted to procedures for review of indoor operations and 

maintenance facilities. 

6 
Fleet operators interested in converting from traditional automotive fuels (e.g., diesel and 

gasoline) to hydrogen fuel, or incorporating hydrogen systems, must consider the hazards 

associated with operating and maintaining hydrogen-fueled vehicles in an indoor facility, if 

hydrogen will not be de-fueled from the vehicles before they are brought inside. Particular 

attention must be paid to indoor operation and maintenance facilities, as well as fueling stations 

(see the next section, Section 2.4, for highlights on hazard and hazard mitigation that should be 

considered with regard to fueling stations). 

The fundamental hazards associated with hydrogen should be considered in the facility design to 

ensure that the hazards of hydrogen systems and equipment are managed so as to reduce the 

potential risk of harm to the fleet operator and the public. It is advisable for any commercial 

vehicle fleet operator to seek the advice and guidance of a safety professional with hydrogen 

expertise to conduct an independent facility review. The facility review should identify the safety 

requirements for maintenance facilities and fueling stations. Appendix B of this report provides a 

sample checklist for review of indoor facilities. 

Typical modifications to indoor facilities to accommodate hydrogen-fueled vehicles include the 

following: 

• Incorporation of appropriate signs (e.g., “Hydrogen vehicle may be present,” “No 

smoking,” and “No use of cell phones”) 

• Enforcement of rules (e.g., “No smoking” and “No use of cell phones”) 

• Elimination of ignition sources, especially at ceiling level (e.g., prohibition of open-flame 

heaters and nonsealed electrical equipment) 

• Upgrades to electrical utilities and equipment to make them intrinsically safe 

• Isolation of high-hazard operations (e.g., welding and grinding) 

• Utilization of nonsparking tools 

• Modification to architectural features to eliminate potential confined spaces where leaked 

hydrogen could collect 

• Installation of ventilation equipment 

• Installation of hydrogen leak and fire detection and alarm systems 

Figure 1 presents a typical facility upgraded for hydrogen use.3

 3

 See Guidelines for the Use of Hydrogen Fuel in Commercial Vehicles, FMCSA, for a detailed discussion on indoor facility 

recommended practices. 

7 
Annunciator 

Panel

= Working

= Alarm

Heat Detector

Flammable

Gas Detectors

2 speed Fans

6 AC PH

Motors (spark proof)

Class 1

Div 1

Outlets Class 1

Div 2

Lighting

Display

(H,%)

Sealed 

Joints

Fire Detector

Alarm/Strobe

Calibration 

Tubes

Annunciator 

Panel

= Working

= Alarm

Heat Detector

Flammable

Gas Detectors

2 speed Fans

6 AC PH

Motors (spark proof)

Class 1

Div 1

Outlets Class 1

Div 2

Lighting

Display

(H,%)

Sealed 

Joints

Fire Detector

Alarm/Strobe

Calibration 

Tubes

Figure 1. Typical Indoor Vehicle Maintenance and Storage Facility 

2.6 FUELING STATION REVIEW 

If fueling is provided at the fleet operator’s facility, a section of the SSP should discuss the 

hydrogen fueling station, and a fueling station review should be conducted. A typical fueling 

facility review includes investigation of: 

• Hazards associated with the type of fueling station (e.g., liquid hydrogen with vaporizers, 

water electrolysis, natural gas reforming, portable tube trailer, etc.) 

• Property line setback requirements 

• Fire detection and suppression requirements (including emergency fuel shut-off) 

• Electrical considerations (including grounding and bonding to control static electricity) 

• Foundation pad requirements 

As noted with the indoor facility review, it is advisable for any commercial vehicle fleet operator 

to seek the advice and guidance of a safety professional with hydrogen expertise to conduct a 

fueling station review. Appendix C contains a typical checklist for a fueling station review.4

 4

 See Guidelines for the Use of Hydrogen Fuel in Commercial Vehicles, FMCSA, for a detailed discussion on fueling station reviews. 

8 
2.7 HAZARD ANALYSIS 

A section of the SSP should be devoted to defining procedures for ongoing hazard analysis and 

assessment. 

Prior to implementing a hydrogen program, the commercial vehicle fleet operator should initiate 

a hazard analysis process designed to identify hazards.5

 The petrochemical and transportation 

industries have developed and used several types of hazard analysis tools, including: 

• Preliminary Hazard Analysis (PHA), used to identify top-level system hazards 

• Hazard and Operability Analysis (HAZOP), used to identify safety-critical operation 

activities 

• Failure Modes and Effects Analysis (FMEA), used to identify the effects of failures 

It is advisable for a commercial vehicle fleet operator to seek the advice and guidance of a safety 

professional with hydrogen expertise to conduct a formal safety analysis. An example of an 

FMEA hazard analysis is provided in Appendix D of this document. The goal of the hazard 

analysis process will be to formally: 

• Provide the operator with an understanding of the hazards associated with the hydrogen 

systems and equipment 

• Document hazards and required safeguards 

• Identify safety-critical operations and maintenance activities 

• Identify the need for special policies and procedures 

• Identify training requirements 

While the most detailed hazard analysis will be performed prior to initial implementation of a 

hydrogen program, it is important to recognize that the identification and analysis of hazards is 

an ongoing process. The SSP should delineate responsibilities and procedures to analyze 

proposed changes in vehicles, equipment, facilities, and procedures to determine whether they 

will present any new hazards not previously identified, and to identify required new mitigation 

strategies. 

2.8 HAZARD RESOLUTION PROCESS 

A section of the SSP should be devoted to resolving the hazards identified in the hazard analysis. 

The hazard resolution process is perhaps the most crucial aspect of any system safety program. 

Each fleet operator must tailor a hazard resolution program for his or her organization. It is an 

individual matter for each fleet operator to fit the proper process to its particular organization. 

The important element, which must be included in a fully developed system safety program, is 

the mechanism, accessible to all levels of the organization, by which hazards are identified, 

 5

 See Guidelines for the Use of Hydrogen Fuel in Commercial Vehicles, FMCSA, for a detailed discussion on hydrogen hazards. 

9 
10 

analyzed for potential impact on the operating system, and resolved in a manner acceptable to 

general management. 

The most general hazard resolution process takes into account the probability and the severity of 

the hazard. Based on these two characteristics, the hazard must be designated as acceptable, 

unacceptable, or acceptable with mitigation. Safeguards designed to prevent certain hazards from 

becoming accidents are applied to controlling those hazards that are acceptable with mitigation. 

Appendix E describes a hazard resolution process that could be implemented by a fleet operator. 

2.9 REPORTING A SAFETY INCIDENT 

A section of the SSP should be devoted to procedures for reporting safety incidents. 

Should an incident occur, a written report must be prepared that identifies the source, time, and 

scale of the incident, and describes the incident, any damage to the facility, fuel station, vehicles, 

any injuries, and other relevant details. The incident report should be provided to the safety staff 

within 24 hours of the incident. 

The SSP should define what types of incidents must be reported, as well as delineating 

responsibility for completing the incident report. It may also include a standard reporting form. 

At a minimum, incidents that must be reported include any event that involves a hydrogen 

release, safety system failure, property damage, emergency shutdown of the facility, or personal 

injury or death. 

.
3. OPERATING RULES, TRAINING, AND PROCEDURES 

3.1 OPERATING RULES AND PROCEDURES 

A section of the SSP should be devoted to the process for developing operating and maintenance 

procedures. Operating procedures should be considered an important part of the system safety 

process, and they should be initiated only after all hazards have been resolved by elimination, 

minimization, or mitigation. This section should address the process to develop, review, and 

revise rules and procedures with safety in mind. 

The SSP must contain a methodology for ensuring uniform, coordinated development and 

implementation of operating rules and procedures. Maintenance departments must do the same 

for maintenance rules and procedures. In the case of maintenance, this applies not only to rules 

for preventive maintenance, but also to procedures for conducting inspections of, and making 

repairs to, equipment. 

Examples of operating rules and procedures that might be put in place to implement safety 

precautions when hydrogen is potentially present include: 

• Never smoke in hydrogen storage areas. 

• Keep all open flames away from hydrogen. 

• Never tamper with relief valves. 

• Never bring any vehicle with a known hydrogen leak into any building. 

• Do not bring a hydrogen vehicle into any building that is not equipped with a hydrogen 

detection/alarm system unless the vehicle has first been de-fueled to remove all onboard 

hydrogen. 

• Before working on any hydrogen fuel system or component, turn off the vehicle’s main 

power switch and isolate hydrogen in the storage tank by closing manual valves. Use 

lock-out/tag-out procedures. 

• Authorized personnel should open and close valves slowly, as a sudden change in 

pressure can cause a fire. 

• Use only manufacturer-approved replacement parts when repairing hydrogen systems, as 

non-approved parts may be made from materials which are incompatible with hydrogen 

and subject to hydrogen embrittlement. 

Manufacturer’s maintenance manuals and advice should be used to develop operating and 

maintenance rules and procedures. 

11 
3.2 TRAINING AND CERTIFICATION 

A section of the SSP should be devoted to personnel training and certification. 

Persons who work with and around hydrogen must be trained on proper hydrogen handling 

procedures and practices, as well as the hazards of hydrogen. Each fleet operator will be 

responsible for training its own personnel. Proper qualification of operating and maintenance 

personnel is a vital part of a safe transportation environment. 

The SSP should specify what hydrogen safety training is required for each category of employee 

(e.g., mechanics, drivers, fueling technicians, and management personnel) and how often the 

training will be repeated (e.g., initial training upon hire and annual/biennual refresher training). 

The SSP should also specify that completion of all required training be documented in personnel 

files. Not only should complete and accurate certification records of operations and maintenance 

personnel be maintained, but the content and presentation of material and tests, including grading 

(i.e., pass/fail), should have clearly articulated requirements that ensure consistency, uniformity, 

and fairness. While the level of detail presented in the SSP for training/certification requirements 

is at the discretion of the fleet operator system, a training/certification policy/procedure should 

be in place and referenced in this section. 

3.3 MAINTENANCE PROGRAM ACTIVITIES 

A section of the SPP should be devoted to maintenance activities. This section should address the 

safety responsibilities and requirements for all employees/groups performing maintenance. 

Issues such as the content, frequency, and documentation of required preventive maintenance 

and safety inspections should be addressed here. This can be done by referencing other 

documents such as maintenance plans and directives. 

This section of the SSP should also address management responsibility for oversight of 

maintenance activities, including inspections and review and approval of repairs. Requirements 

to follow appropriate maintenance practices and use proper tools and test equipment are other 

issues to be addressed. 

This section should also address required frequency and procedures for testing and recalibration 

of hydrogen safety equipment such as hydrogen detectors and alarm systems. Typical 

maintenance activities for a hydrogen facility include periodic: 

• Calibration of gas-monitoring equipment 

• Testing of fire detection and suppression systems and equipment 

• Hydrogen-leak-sensing with hand-held detector 

• Trouble indication responses 

12 
13 

4. SYSTEM SAFETY REVIEWS AND AUDITS 

A section of the SSP should be devoted to formal system safety reviews and audit. 

System safety is the formal process of managing a system to ensure that all identified safety 

elements in a given environment are in place and are performing as designed. In a commercial 

vehicle fleet operational environment, it is difficult to identify any elements which are not safetyrelated, even if only indirectly so. The Internal Safety Management Assessment Process thus 

becomes extremely important in determining whether all organizational elements, equipment, 

procedures, and functions are performing as intended, from a system safety perspective. It 

requires constant attention and activity. 

The commercial vehicle fleet operator should develop a checklist from the SSP that identifies 

each safety element. On an annual basis, an independent auditor of the fleet operator’s choice 

should conduct an audit of each aspect of the SSP to ensure that all safety-critical functions are 

being performed as they should be. 

The findings and recommendations of the audits should be reviewed by the top management for 

the commercial vehicle fleet operations and used to implement improvements to enhance the 

safety of the system. System safety improvements that may arise from audit findings may 

include: 

• Developing remedies to address system weaknesses 

• Budgeting for resources to implement remedies 

• Implementing remedies 

• Monitoring how well remedies are working 
5. CONFIGURATION MANAGEMENT 

A section of the SSP should be devoted to procedures and policies related to managing the 

configuration of the commercial vehicle fleet that uses hydrogen as an alternative fuel. There are 

two important features associated with configuration management: (1) drawing control and (2) 

change management. Each of these features is discussed below. 

5.1 DRAWING CONTROL 

Drawing control refers to management of technical documentation about the hydrogen systems 

installed on the commercial vehicle fleet, to ensure that this documentation is always up-to-date 

and available to operations and maintenance personnel. A complete set of manuals, parts books, 

drawings, and specifications for the hydrogen system(s) must be maintained by the commercial 

vehicle fleet operator. These drawings and manuals should be obtained from the hydrogen 

system manufacturer and should provide a detailed description of the onboard hydrogen system. 

The SSP should address the question of how/where these documents will be stored so as to be 

accessible to all relevant personnel, as well as delineating specific responsibility for periodically 

reviewing these documents to ensure that they are complete and up-to-date. 

5.2 CHANGE MANAGEMENT 

Onboard hydrogen systems and equipment are designed and constructed of materials tested to be 

compatible with hydrogen, and they incorporate numerous intrinsic safety features and pieces of 

equipment that address the unique physical and chemical properties of hydrogen. Seemingly 

small changes to these systems could have unintended negative consequences. For this reason, 

modifications to hydrogen equipment should be prohibited unless a comprehensive system safety 

analysis is completed. Before implementing changes, any modifications identified by the fleet 

operator as necessary should undergo a change management process, including: 

• Consultation with the hydrogen system Original Equipment Manufacturer (OEM) 

• A hazard analysis as discussed in Chapter 2 of this report 

• Preparation of a report that documents: 

– Description of the change 

– Discussion of applicable codes and standards 

– Approval from OEM 

– Management approval 

The SSP should delineate specific responsibility for conducting the required hazard resolution 

process, the required steps involved, how the results must be documented (i.e., by providing a 

standard outline or forms), and required management approvals. 

14 
6. EMERGENCY CALL-OUT PROCEDURES 

The SSP should contain a chapter on safety-critical emergency response communication 

procedures. In the event of an emergency, establishing quick and clear communication with 

local emergency responders is an important system safety activity. There should be a one-page 

emergency response procedure with all critical emergency response information. The call-out 

procedures should be clear and concise. 

This emergency call-out procedure should be prominently posted in all areas where hydrogen 

vehicles will be fueled, stored, or maintained. 

Table 2 presents a sample emergency response call-out procedure. 

15 
Table 2. Sample Emergency Call-out Procedure 

EMERGENCY CALL-OUT PROCEDURE 

In the event of an emergency, all employees should 

follow these procedures:

STEP 1. Call ext. XXXX. (This is the internal coordinator for all emergencies.) 

It is important for all employees and contractors to FIRST notify the 

internal coordinator of all emergencies, rather than notifying any 

external point of contact, such as 911. The internal coordinator may be 

aware of any mitigating circumstances, such as maintenance, repair, or 

testing work that may obviate the need for an external response. Second, 

in the event of an emergency, the internal coordinator will arrange to 

have someone unlock any gates, meet the external responders, and show 

them the fastest way to the location where they are needed. Third, in the 

event of an emergency, the internal coordinator will notify and arrange 

for support resources, such as safety, security, plant, facilities 

management, and other personnel, who may be needed. 

STEP 2. If the internal coordinator is not available, then call 911. 

Explain to the operator the nature of emergency (medical, fire, explosion, 

hydrogen leak, hazardous material spill, bomb threat, other) and location 

of the facility: 

John Doe Trucking Company 

111 Main Street 

Big City, CA 

Major Cross Streets: Main Street and Elm Avenue 

In the event of a fire, explosion, hydrogen leak, or bomb threat, 

advise that we are a hydrogen facility, and ask for a full response. 

STEP 3. For fires, leaks, spills, or bomb threats, evacuate all nonessential 

personnel. Proceed to a predetermined safe area away from the facility. 

STEP 4. If the emergency involves an outdoor hydrogen leak without fire, 

designated technical personnel should de-energize the facility and shut 

off all sources of hydrogen. 

STEP 5. Account for all staff and visitors at the facility. 

STEP 6. Assist emergency response personnel as requested. 

16 
APPENDIX A: 

OUTLINE OF SYSTEM SAFETY PLAN 

CHAPTER 1 SYSTEM SAFETY PLANNING AND ADMINISTRATION 

1.1 Policy Statement 

– Endorsed by upper management 

1.2. System Safety Program Goals 

1.3 Scope of System Safety Plan 

– Description of facilities and equipment 

– Description of hydrogen safety systems 

1.4 System Safety Program Management 

– Specific organizational roles and responsibilities for system safety 

– Organizational lines of authority and reporting 

1.5 Plan Update Procedures 

– Responsibility for update 

– Frequency of update 

CHAPTER 2 HAZARD ANALYSIS 

2.1 Safety Hazards of Hydrogen 

2.2 Permitting Process 

– Coordination with local agencies 

2.3 Indoor Facility Review 

2.4 Fuel Station Review 

2.5 Hazard Analysis 

– Responsibility 

– Procedures 

2.6 Hazard Resolution Process 

– Responsibility 

– Procedures 

2.7 Reporting a Safety Incident 

– Types of incidents which require reporting 

– Specific information required for a report 

– Responsibility 

17 
CHAPTER 3 OPERATING RULES, TRAINING, AND PROCEDURES 

3.1 Operating Rules and Procedures 

– Process to develop/review procedures with safety in mind 

3.2 Training and Certification 

– Required training 

– Frequency of training 

– Training documentation 

3.3 Maintenance Program Activities 

– Preventive maintenance and safety inspections 

– Oversight of maintenance operations 

– Testing/recalibration of hydrogen safety systems 

CHAPTER 4 SYSTEM SAFETY REVIEWS AND AUDITS 

CHAPTER 5 CONFIGURATION MANAGEMENT 

5.1 Drawing Control 

– Ensure technical documentation of hydrogen systems is complete and up-to-date 

5.2 Change Management 

– Process to review/approve proposed changes to hydrogen systems to ensure safety 

CHAPTER 6 EMERGENCY CALL-OUT PROCEDURES 

– Notification process in the event of an emergency 

18 
APPENDIX B: 

TYPICAL INDOOR FACILITY CHECKLIST 

• Prevent the formation of ignitable concentrations of hydrogen: 

– Eliminate the possibility of hydrogen being leaked in a facility (vehicle-storagesystem-dependent). 

– Incorporate capability to increase the ventilation rate to dilute any leaked hydrogen to 

well below its flammable limit. 

• Provide hydrogen leak detection: 

– Add leak detectors and alarms. 

– Incorporate automatic responses to the presence of increased hydrogen 

concentrations. 

• Remove all sources of ignition in the facility, particularly at ceiling level, where leaked 

hydrogen might collect: 

– Electrical system (remove or seal) 

– Fuel-fired heaters 

– Spark-producing operations (e.g., welding, grinding) 

– Personnel activities (e.g., prohibition against smoking and cell phone use) 

• Add facility signs to remind personnel of restrictions on open flames, hot-work, smoking, 

cell phone use. 

• Make preparations for protection from certain adverse environments (e.g., freeze 

protection, seismic). 

• Consider structural/architectural facility features, including the following: 

– Eliminate confined spaces that may accumulate hydrogen. 

– Design flat ceiling with no traps, cavities, or deep ridges that may accumulate 

hydrogen. 

– Specify noncombustible roof materials. 

– Install fire-rated walls. 

– Incorporate explosion or deflagration venting. 

• Install hydrogen leak detection system: 

– Use flammable gas detection system, calibrated for hydrogen. 

– Design to activate warning systems and ventilation equipment at a predetermined 

level of detection (e.g., 25 percent of lower explosive limit). 

– Install warning systems (e.g., audible and visual alarms). 

– Deactivate potentially hazardous systems (e.g., heating system, non-emergency 

electrical equipment). 

– Activate mechanical ventilation system, provided with back-up power supply. 

– Ensure fail-safe design (i.e., failure activates mechanical ventilation and deactivates 

other systems). 

19 
– Ensure ease of maintenance and calibration of sensor systems. 

• Consider electrical system upgrades: 

– Electrical equipment in immediate vicinity of ceiling (e.g., within 3 feet) suitable for 

locations similar to those of NFPA Group B, Class I, Division 2 (explosion-proof) 

– Grounding and bonding system for all hydrogen equipment on the vehicle 

• Evaluate the ventilation system: 

– Passive ventilation capacity (e.g., windows, vents, etc.) 

– Ventilation system dedicated to mitigating the leak hazard, independent of the heating 

and air conditioning systems 

– Coordinated activation with the gas detection system 

– Circulation of only fresh make-up air (i.e., air from outside the facility) 

– Suitability of motors and other electro-mechanical equipment for locations similar to 

those of NFPA Group B, Class I, Division 2 

– Back-up power 

– Manual switching capability 

– Ventilation model to ensure that adequate airflow is provided for various leak 

scenarios

20 
APPENDIX C: 

TYPICAL FUELING FACILITY CHECKLIST 

• Consider types of fueling stations and their associated hazards: 

– Liquid hydrogen with vaporizers 

– Electrolysis 

– Reformer technologies 

– Natural gas 

– Methanol gas 

– Gaseous fuel supplied from portable unit (e.g., tube trailer) 

• Consider fueling operations: 

– Ability to accommodate tanker truck deliveries 

– Capability for emergency shut-off (both near dispenser and at remote location) 

– Capability to de-fuel vehicles 

– All general provisions for fire safety (e.g., fire extinguisher) 

– Facility security provisions (e.g., fencing, bollards, etc.) 

– Provide protection for storage 

– Mitigation measures for gas leaks (e.g., hand-held leak detectors) 

• Consider setback requirements (property setbacks are minimum distances that must be 

maintained between the facility and a potentially hazardous areas). Established setbacks 

normally include minimum required distance from: 

– Fixed ignition sources (e.g., light poles, unclassified electrical lines) 

– Open flames and welding 

– Public roads 

– Railroads 

– Other buildings or structures 

– Places of public assembly 

– Property lines 

– Underground sewers 

– Wall openings 

– Air compressor intakes 

– Inlets for air conditioning or ventilating equipment 

– Weeds, grass, brush, trash, and other combustible materials 

• Consider fire detection and suppression: 

– Hydrogen leak detection system 

– Flame detection system 

– Fire extinguishers (for secondary fires) 

– Easy access to fire hydrant 

21 
22 

• Consider electrical requirements: 

– Electrical equipment in immediate vicinity of fueling area suitable for locations 

similar to those of NFPA Group B, Class I, Division 1 

– Electrical equipment in area surrounding fueling area suitable for locations similar to 

those of NFPA Group B, Class I, Division 2 

– Grounding and bonding system for vehicle 

– Grounding and bonding of hydrogen storage, dispensing, and defueling system 

• Consider fueling station foundation: 

– A noncombustible pad to install hydrogen storage equipment 

– Weight accommodation for fully loaded commercial vehicle or hydrogen delivery 

tractor-trailer rig 

– Weight considerations for lifts and jacks 

• Consider implementing operations requirements: 

– Training considerations 

– Management controls must be in place to ensure that personnel are trained regarding: 

▪ Hazard recognition (e.g., high voltage, high pressure) 

▪ Personal conduct (e.g., restrictions on open flames, hot-work, smoking, and cell 

phone use) 

▪ Routing considerations—for indoor garaging facilities, ensure that the area 

surrounding the driving route is clear of ignition sources 

▪ Equipment operating procedures 

▪ Diagnostics, alarms, and fault codes 

▪ Proper response to hydrogen events 

▪ Fueling and defueling procedures 

▪ Maintenance procedures 

– Ensure that staff are qualified and trained to perform maintenance on commercial 

vehicle 

• Eliminate hazardous ignition operations: 

– Welding 

– Grinding 

– Sanding 

– Sawing 

– Smoking 

– Using nonspark-proof tools when working near hydrogen systems 
APPENDIX D: 

SAMPLE FAILURE MODES AND EFFECTS ANALYSIS (FME

Table 3. Sample Failure Modes and Effects Analysis (FMEA): Unload and store 2,000 gal. of liquid hydrogen at 

No Failure Mode Cause Effects Controls F 

1 Liquid trailer leak Mechanical failure due to 

road vibration 

Potential fire Unloading inspection by 

station rep or driver Hydrogen leak detectors in area 

M 

2 Liquid trailer leak Vehicle impact to truck while 

unloading damages hydrogen piping 

Potential fire/explosion Driver puts caution cones 

around truck. 

M 

3 Unloading hose 

connection leaks 

Mechanical failure or improper connection 

Cryogenic burn Unloading is continuously 

monitored by both driver and station rep. Driver wears a Nomex suit. 

M 

4 Release from 

connecting hose 

Hose not vented prior to disconnect—human error 

Cryogenic burn Driver training and 

unloading checklist, using standard established procedures for unloading cryogenics 

L 

5 Overfill storage tank Human error or instrument 

failure. Truck may contain up to 10,000 gal. or hydrogen and only 2,000 gal. might be unloaded to storage tank 

Liquid hydrogen release from pressure relief valve with potential fire 

Driver training and established procedure for unloading cryogenics 

H 

6 Inner storage tank 

leak 

Mechanical failure Loss of vacuum between 

inner and outer vessel. Release from outer vessel pressure relief device set at 0 psig 

PSV vents at elevated location 

L 

Date: July 7, 2003—Process: 1. Liquid Hydrogen—Study Section: 1A. Liquid Delivery, Storage and Vaporization—Design Intent: se

23 
APPENDIX E: 

HAZARD RESOLUTION PROCESS 

The Hazard Identification/Resolution Process is perhaps the heart of a program of system safety. 

While much has been written about the level of formality needed for this section of the program, 

it remains an individual matter for each fleet operator to fit the proper process to its particular 

organization. The important element, which must be included in a fully developed program of 

system safety, is the mechanism, accessible to all levels of the organization, by which hazards 

are identified, analyzed for potential impact on the operating system, and resolved in a manner 

acceptable to general management. 

A Hazard Resolution Process consists of three primary components: 

• Hazard identification 

• Hazard categorization 

• Hazard resolution 

The process offered here is taken from MIL-STD-882D. This standard offers a formal 

manner of addressing hazard resolution and provides a good way of ensuring that all 

hazards are addressed adequately, and that the resolution process is documented properly. 

It is emphasized, however, that this method is offered as a sample only. Each fleet 

operator must ensure that its safety methodologies are tailored to the unique capabilities 

of its organization. It should therefore not be construed that the hazard categorization 

methodology offered by MIL-STD-882D is a mandatory part of all programs of system 

safety. However, a properly functioning program of system safety must explain how the 

Hazard Resolution Process of the particular fleet operator is carried out and documented. 

24 
HAZARD IDENTIFICATION 

In its Hazard Identification Process, a fleet operator describes the methods used for ensuring that 

as many hazards as possible can be identified and entered into the Hazard Resolution Process 

before they cause problems. While it is virtually impossible to identify every hazard, there are 

various formal processes, as well as the time-tested method of direct observation and input from 

field personnel on situations and designs which could cause accidents or injuries. 

These methods may include such exercises as Preliminary Hazard Analysis (PHA), Operating 

Hazard Analysis (OHA), Critical/Catastrophic Items List (CCIL), Fault Tree Analysis, 

Subsystem Interface Analysis, and various Human Factors Analyses. 

These formal Hazard Analysis Processes prove most useful in new systems, which need to 

analyze as completely as possible all aspects of system design. As there is no “history” to 

provide other means of analyzing the operation, a new system should have the necessary hazard 

analyses built into both design consulting and procurement contracts. 

Conversely, systems in operation, especially those which have been operating for a long time, 

may not necessarily need to be subjected to such formal levels of hazard analysis on a regular 

basis. Usually, the input of operating and maintenance personnel can provide the type of data 

that can be used for an adequate Hazard Analysis Process. The key factor, however, is that 

whatever process is used, it must be as a minimum, formal enough to have been documented in a 

procedure, available to all units of the organization, reviewed and administered on a routine basis 

(usually by System Safety staff), and have high-level visibility and participation. Any formal 

process must have appropriate sign-offs and checks and balances built into it. 

It should be noted that Hazard Identification is an ongoing process, viable throughout the system 

lifecycle. Accordingly, it needs to be coordinated with such other activities as Accident/Incident 

Investigation so that accidents and incidents which result from previously unidentified hazards 

are subsequently entered into the Hazard Resolution stage of the process, with all essential 

documentation of such situations maintained. 

The following sections represent a methodology adapted from Military Standards, which can be 

used to develop a formal process for determining which hazards are acceptable, which are 

acceptable with certain conditions applied, and which are unacceptable. Once again, while other 

methods are available for hazard resolution, the key factors are a formal procedure with normal 

determination made in advance as to which types of hazards must have which type of resolution. 

It is also extremely important to design in advance a process for handling exceptions to the 

established procedure, as it is virtually impossible to anticipate every situation. Included in this 

section is a method for categorization of each and every identified hazard. 

25 
HAZARD SEVERITY 

Hazard severity is defined as a subjective measure of the worst credible mishap resulting from 

personnel error, environmental conditions, design inadequacies, and/or procedural efficiencies 

for system, subsystem, or component failure or malfunction, categorized as follows: 

I (Catastrophic) Death or system loss 

II (Critical) Severe injury, severe occupational illness, or major system damage 

III (Marginal) Minor injury, minor occupational illness, or minor system damage 

IV (Negligible) Less than minor injury, occupational illness, or system damage 

HAZARD PROBABILITY 

Hazard probability is defined as the probability that a specific hazard will occur during the 

planned life expectancy of the system element, subsystem, or component. It can be described 

subjectively in potential occurrences per unit of time, events, population, items, or activity, 

categorized as follows: 

A (Frequent) Likely to occur frequently (individual); continuously experienced 

(fleet/inventory) 

B (Probable) Will occur several times in life of an item; will occur frequently in 

fleet/inventory 

C (Occasional) Likely to occur sometime in the life of an item; will occur several 

times in fleet/inventory 

D (Remote) Unlikely but possible to occur in life of an item; unlikely but can be 

expected to occur in fleet/inventory 

E (Improbable) So unlikely that it can be assumed that occurrence may not be 

experienced; unlikely to occur, but possible in fleet 

Once a hazard is identified, an analysis of its potential severity and probability of occurrence is 

performed. The process for this analysis should be standardized by the fleet operator and 

documented by an approved procedure. This procedure must be followed as prescribed. 

While it is possible to develop a qualitative methodology for this type of analysis, the most 

practical method for fleet operator application is simple deductive reasoning, applied on a 

collective or organizational basis. 

The composite management staff of all key line and staff departments, administered by the safety 

unit, can effectively determine the severity of all but the most difficult or unusual hazards. 

26 
It is important, however, to determine in advance the exact mechanism for implementation of 

this process, as well as some type of administrative appeal process, should consensus on 

categorizing a specific hazard prove too difficult to achieve. A mechanism for outside assistance 

should also be provided. 

Hazards identified in the course of normal operations should be entered into the formal process, 

the same as those identified by formal analysis techniques associated with new procurement and 

new system construction. All employees involved in the hazard identification process should 

know and understand their respective roles. 

HAZARD RESOLUTION 

Hazard Resolution is defined as the analysis and subsequent action taken to reduce to the lowest 

level practical, the risk associated with an identified hazard. Hazard Resolution is not 

synonymous with hazard elimination. In a fleet operator environment, there are some hazards 

which are impossible to eliminate and others which are highly impractical to eliminate. 

Reduction of risk to the lowest practical level can be accomplished in a variety of ways, from 

protective and warning devices to special procedures. There are, however, some hazards which 

present a risk which cannot be accepted because of its severity and the high probability of its 

occurrence; these hazards must be eliminated. 

Part of the Hazard Resolution Process should be construction of a predetermined matrix 

prescribing which identified hazards are acceptable, which are acceptable with mitigation, and 

which are unacceptable. Once this matrix is defined by the fleet operator, deviation from the 

prescribed Resolution Process should occur only through approved, predetermined channels. A 

sample Hazard Resolution Matrix might look like that contained in Table 4. 

In addition to the Hazard Resolution Matrix, a companion procedure must describe exactly how 

hazards defined as “unacceptable” and “undesirable” will be reduced to an acceptable level. In 

addition, any prescribed review by management staff must be predefined to ensure that the 

process cannot be bypassed, although provision can be made for allowing exceptions to the 

process in an approved manner. 

It should be noted that the entire Hazard Resolution Process is nothing more than a formalized, 

predetermined procedure for risk acceptance by the fleet operator management staff. It allows for 

a systematic hazard identification process and a coordinated hazard effects minimization process. 

Management of the Hazard Resolution Process should reside with the safety unit of the fleet 

operator organization, which should be responsible for all supporting documentation and 

coordination. 

27 
28 

Table 4. Hazard Resolution Matrix 

Hazard Probability 

Hazard 

Severity 

I 

Hazard 

Severity 

II 

Hazard 

Severity 

III 

Hazard 

Severity 

IV 

A UN UN UN AC/WR 

B UN UN UD AC/WR 

C UN UD UD AC 

D UD UD AC/WR AC 

E AC/WR AC/WR AC/WR AC 

Codes: UN—Unacceptable; UD—Undesirable; AC/WR—Acceptable with review by management staff; 

AC—Acceptable. 

The coordination process can take on many different forms, such as Safety Committees and 

internal communications mechanisms; however, the key to its success still lies in the 

predetermined, administered process.