Hydrogen refuelling stations in the Netherlands: An intercomparison of quantitative risk assessments used for permitting

Abstract As of 2003, 15 hydrogen refuelling stations (HRSs) have been deployed in the Netherlands. To become established, the HRS has to go through a permitting procedure. An important document of the permitting dossier is the quantitative risk assessment (QRA) as it assesses the risks of the HRS associated to people and buildings in the vicinity of the HRS. In the Netherlands, a generic prescribed approach exists on how to perform a QRA, however specific guidelines for HRSs do not exist. An intercomparison among the QRAs of permitted HRSs has revealed significant inconsistencies on various aspects of the QRA: namely the inclusion of HRS sub-systems and components, the HRS sub-system and component considerations as predefined components, the application of failure scenarios, the determination of failure frequencies, the application of input parameters, the consideration of preventive and mitigation measures as well as information provided regarding the HRS surroundings and the societal risk. It is therefore recommended to develop specific QRA guidelines for HRSs.


Introduction
The number of hydrogen refuelling stations (HRSs) in Europe is steadily growing. In 2016, 106 HRSs were operational in Europe, out of which four are situated in the Netherlands [1]. In total, 15 HRSs were inaugurated between 2003 and 2016 in the Netherlands, whereas 11 HRSs ceased operation in that period. The evolution of operational HRSs in the Netherlands is shown in Fig. 1.
According to Dutch law [2e4], HRSs have to go through a permitting process to become established. One of the main aims of the permit is to limit the risk to people and the environment associated to storing, dispensing and, possibly, generating hydrogen at the HRS. Permits are provided by permitting authorities, typically the municipality in which the HRS will be located. Guidelines for the permitting of HRSs exist for these authorities as of 2010 through NPR 8099:2010 [5] which provides practical guidance for the design, installation, management and maintenance of HRSs and its successor, PGS35:2015 [6], which contains all provisions of relevant laws related to HRSs and as such provides a reference to permitting authorities to determine to which safety related rules and conditions these HRSs have to comply. The applicant of the permit, typically the owner or operator of the HRS, has to submit a permitting dossier to the permitting authority. This dossier consists of documents related to the HRS itself and to the environment in which it will be built. The quantitative risk assessment (QRA) is an important document of that dossier as it assesses the risks of the HRS associated to people and buildings in the vicinity of the HRS. Although at present no regulatory necessity exists to provide a QRA for HRSs with a storage capacity below 5000 kg, it has become good practice for permitting authorities to request a QRA as part of the permitting dossier to allow an assessment of the safety risks associated to establishing and operating HRSs. In ISO/TS 19880-1 [7], a generic methodology for the quantitative risk assessment of HRSs is provided. It recommends also that risk assessments for HRSs should be (semi-) quantitative. In the Netherlands, prescribed guidelines, which are in line with the methodology proposed in ISO/TS 19980-1, exist on how to generically perform a QRA but specific QRA guidelines for HRSs do not yet exist.
An HRS consists of various interconnected sub-systems and protection mechanisms, so the development and assessment of a QRA can be a complex matter especially as there is little experience due to limited deployment of HRSs in the Netherlands. Therefore, permitting authorities may face difficulties in assessing these QRAs without specific guidance.
In order to provide permitting authorities with specific QRA guidance for HRSs, this paper assesses the QRAs of the majority of HRSs established in the Netherlands and based on that analysis provides: permitting authorities with technical background on HRSs in relation to the QRA lessons learned on how QRAs are performed recommendations on how QRAs can be improved support to national authorities in developing specific QRA guidelines for HRSs Additionally, an intercomparison of QRAs of permitted and established HRSs provides a new dimension to the research performed on risk assessments for HRSs. Literature has so far focused on the application of risk assessment methodologies, using quantitative [8e14] and non-quantitative approaches [15e21], for HRSs in other countries than the Netherlands (like China [10,11], Japan [16] and South Korea [17,18]) as well as the comparison thereof [22e30] and the improvement of models and tools [27,31e34], and data inputs [35e37] that are used in the risk assessment of HRSs. QRA literature can thus be divided in three main areas. Firstly, the application of different risk assessment methodologies for HRSs contributes to the improved understanding of the risks associated with operating HRSs and the reflection towards the development of failure scenarios (and failure frequencies) for specific HRS configurations and designs. The aim is typically to improve the system design of the HRS in order to increase the level of safety associated to the HRS. However, QRAs used for the permitting of HRSs are primarily oriented towards informing permitting authorities about consequences of establishing the HRS for its surrounding environment. Secondly, countries and jurisdictions were HRS are sited have different approaches towards the application of risk assessment methodologies. Intra-jurisdiction comparisons therefore provide deeper insights into the coherence of governing methodologies, whereas inter-jurisdiction comparisons provide a wider perspective on the impact of applying different methodologies. Permitting authorities are typically concerned about the coherence to their governing methodology. Thirdly, improvements of software models and tools to realistically simulate hydrogen releases as well as the quality of (hydrogen specific) data are beneficial for all types of risk assessments, but need to take stock of the influx of relevant research outcomes. Recent developments, for example the development of the HyRAM tool [31], shows that this is an evolving area, i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 3 ( 2 0 1 8 ) 1 2 2 7 8 e1 2 2 9 4 however, QRA developers may not have the flexibility to deviate from mandated software packages. This paper is contributing to expanding the literature in the second area, especially since an intra-jurisdiction comparison of QRAs for permitted HRSs has so far not been performed.
In the Netherlands, a prescribed risk assessment approach exists on how to generically perform a QRA [38], how to consider effects of releases of hazardous substances [39e47], how to consider probabilities [48], how to consider subsystems and components in terms of release scenarios and failure frequencies [49e51] as well as which software package should be used [51]. This approach is thus also mandatory for HRSs. A QRA that has followed the above mentioned prescribed approach was performed by RIVM, an agency of a Dutch Ministry and the main developer of the prescribed national risk assessment approach, for a virtual HRS in the Netherlands [52]. However, for a real HRS going through a permitting process, the QRA is performed by a vendor that applies the generic prescribed methodology for the HRS. As such, this paper also provides fundamental insights into how the applicants interpret and apply the generic prescribed QRA approach to HRSs. This provides permitting authorities feedback on areas in which inconsistencies or deviations from the prescribed approach are observed. This paper has applied the following methodology. The intercomparison of QRAs on permitted HRSs is based on assessment criteria that are common to all permitting authorities. The QRA report includes six mandatory sections [50], including a detailed map in which the HRS is to be located within its surroundings, a description of the surrounding (population density, neighbouring activities and possible dangers coming from it, possible ignition sources), a general description of the HRS, the risk assessment of the sub-systems and components (scenarios, frequencies, assumptions), the results of the risk assessment showing the individual and societal risk and a detailed description of the scenarios. The key sections of the QRA report that are relevant for comparison and directly concern the HRS are Fig. 2 e Overview of permitted HRSs in the Netherlands [53]. i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 3 ( 2 0 1 8 ) 1 2 2 7 8 e1 2 2 9 4 the risk assessment of the sub-systems and components of the HRS and the detailed description of scenarios, and, to a lesser extent, the general description of the HRS. Chapter 3 and 4 provides the necessary background information to enable the intercomparison in chapter 5. Chapter 2 introduces the HRSs that were/are established in the Netherlands and provides a historical perspective including the reasoning of establishment and the applications that it served. Chapter 3 introduces for all established HRSs in the Netherlands, its technical specifications, the sub-systems and components and the configurations. The identified sub-systems and components are assessed from a QRA perspective in Chapter 4 following the prescribed QRA approach in the Netherlands in terms of considered failure scenarios and frequencies. Relevant parameters and typical values belonging to the HRS sub-systems and components that are considered as inputs to the QRA are introduced in this chapter as well. This provides the comparative framework against which these key sections in the QRA reports of the established HRSs in the Netherlands are compared upon. Chapter 5 shows the results of the intercomparison for all sections of the QRA, but with an emphasis on key sections. On the basis of this intercomparison, recommendations are provided for improvements.
The QRAs were obtained through visits and requests to municipalities in which the HRSs were/are sited. The majority of the dossiers were obtained and only few could not be retrieved due to expiration of archive dates or inability to track dossiers related to the HRSs. The QRA reports have been compared and assessed in a similar manner as permitting authorities (or the experts of regional safety expertise centres) do. The results are presented as much as possible anonymously.

Historical overview of HRS deployment in the Netherlands
In this chapter, the Dutch HRSs are introduced in a historical perspective in order to provide background information on the timing and reasoning of the establishment of HRSs in the Netherlands. Between 2003 and 2016, 15 HRSs have been realised in the Netherlands. The locations and operational status in 2016 of these HRSs are shown in Fig. 2.
The first HRS in the Netherlands was inaugurated at the bus depot of the public transport operator in Amsterdam in 2003 as part of the Clean Urban Transport for Europe project. This project was among the first European projects to demonstrate first generation hydrogen buses and refuelling infrastructure in ten European cities. A follow-up project was initiated in 2006 to enable a prolonged deployment of these buses. In these projects, three buses of Mercedes were deployed. An additional two hydrogen buses of APTS/VDL were deployed as of 2011. To facilitate a two months demonstration project of a bus of Van Hool in Delft in fall 2008, an HRS was established at the premises of bus operator Connexxion. Inaugurated in 2006 and dismantled in 2011, the Energy Research Centre (ECN) operated an HRS on its premises in Petten to facilitate a field trial of a delivery vehicle for transporting small goods at the site. The demonstration of a canal cruise boat in Amsterdam has resulted in three HRSs, one at the commissioning site in Meppel and two in Amsterdam. The first publically accessible HRS in the Netherlands was inaugurated in 2010 in Arnhem and was integrated in an existing refuelling forecourt supplying traditional transportation fuels. This HRS served a bus of HyMove and two demonstration cars. The HyMove bus also refuelled at the HRS i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 3 ( 2 0 1 8 ) 1 2 2 7 8 e1 2 2 9 4 in Apeldoorn in 2011 at the premises of the certification institute KIWA. During the commissioning of the buses from APTS/VDL, that were operated in Amsterdam, in Helmond in 2011, an HRS was used for testing these buses. In 2010, an HRS was operated during a six weeks field trail of a baggage tow truck at Amsterdam Schiphol Airport. A similar HRS is operated as of 2013 by WaterstofNet in Kamperland to facilitate leisure boats. As of 2013, WaterstofNet also operates the first 700 bar HRS in the Netherlands and serves a second generation bus of APTS, a hydrogen waste collection truck of E-trucks and fuel cell cars. The first publicly accessible 700 bar HRS is in operation as of 2013 and is located in Rhoon and fuels cars and buses. In 2014, an HRS was erected at the premises of Linde in Schiedam to refuel a car. In 2015, an HRS was established in Hoogezand at the Holthausen premises to fuel a car and bus.
The current hydrogen refuelling infrastructure is expected to be expanded in 2017 with HRSs in Den Haag, Arnhem and Breda [54]. In Oude Tonge, a permit is given to build an HRS as part of a multi-fuel station. Other HRS locations are being considered as well [54].

Sub-systems and configurations of HRSs in the Netherlands
In this chapter, the HRS configurations and sub-systems and its technical specifications are provided to introduce relevant parameters to be used subsequently for the intercomparison of the QRAs of the HRSs. Fig. 3 provides an overview of HRS subsystems and configurations and Table 1 gives an overview of the technical specifications of these sub-systems of the HRSs.
An HRS is a system of interconnected sub-systems that combined determine the configuration of the HRS. A sub-system consists of (main) components and auxiliaries. The main sub-systems of an HRS are: an on-site hydrogen generator (either an electrolyser (converting water to hydrogen by using electricity), or a reformer (converting natural gas to hydrogen by using steam)) or a hydrogen supply system (either a hydrogen pipeline or a tube/cylinder trailer), a compressor and/or booster (to increase pressure), a buffer storage (to store hydrogen), a pre-cooler (to cool hydrogen to enable fast-filling) and a dispenser (to transfer hydrogen to the applications). A more detailed description of these subsystems is provided in chapter 4. A simple HRS configuration is manually operated by applying a cascade refuelling strategy (consecutively opening and closing of bundle valves) and consists of few of the aforementioned sub-systems, typically a trucked-in transportable buffer storage (typically multipleelement gas containers), dispenser components (nozzle, hose, break-away, pressure gauges) and simple auxiliaries (piping, valves, etc.). These simple HRS configurations benefit from low capital costs but have high operational costs (especially costs for hydrogen and transportation and rental of the bundles) as a drawback. These HRSs allow hydrogen demonstration projects to kick-start without the need to invest in capital intensive infrastructure. Eight HRSs in the Netherlands  have/had such a configuration: Petten, Meppel, Haarlemmermeer, Amsterdam-2, Helmond-2, Amsterdam-3, Kamperland and Schiedam (stations 8 to 15 in Fig. 3 and Table 1). A complex HRS configuration is automatedly operated and consists, besides the buffer storage and the dispenser, of additional sub-systems, such as an on-site hydrogen generator, a compressor/booster and/or a pre-cooler. Seven HRSs in the Netherlands have/had such a configuration: Helmond-1, Rhoon, Amsterdam-1, Arnhem, Delft, Apeldoorn and Hoogezand (stations 1 to 7 in Fig. 3 and Table 1). The HRS in Helmond applies an automated cascade refuelling strategy in which two compressors fill the medium and high pressure buffer storage repetitively. Hydrogen is produced via on-site electrolysis and delivered via pre-coolers to two dispensers. The HRS in Rhoon applies a booster assisted cascade refuelling strategy for both the 350 and 700 bar refuelling line, in which an automated cascade refuelling strategy is applied and when necessary is assisted by a booster (e.g. to complete a filling or to facilitate back-to-back refuelling). The hydrogen is supplied by a hydrogen pipeline and delivered pre-cooled to three dispensers. The HRS in Amsterdam applied a booster refuelling strategy in which the buffer storage was used to equalise the pressure with the application and then used the booster to complete refuelling. The hydrogen was produced on-site through electrolysis and supplied to one dispenser. The station in Arnhem used a cascade refuelling strategy in which the compressor was used to fill two medium pressure buffer storages. The hydrogen was produced via on-site natural gas reforming and supplied to one dispenser. The HRS in Delft made use of a hydrogen tube trailer and a medium pressure buffer storage that both are used to equalise the pressure with the application. After pressure equalisation, a booster was used to complete the refuelling (in slow-fill mode) via one dispenser. After the fill, the compressor was used to replenish the partially depleted medium pressure buffer storage from the tube trailer. The HRS in Apeldoorn used a large buffer storage to apply a manual single bank overflow principle after which, when approaching pressure equalisation, a booster was used to complete the filling through one dispenser. The HRS in Hoogezand applies a slow-fill booster refuelling strategy in which a transportable buffer storage is used to supply hydrogen through either the 350 bar or the 700 bar dispenser.

HRS sub-system and component assessment from a QRA perspective
In this chapter, the HRS sub-systems and configurations identified in Chapter 3 are assessed from a QRA perspective. The sub-systems are assessed on 1) technical parameters including operating pressure, hydrogen mass within component boundaries and hydrogen throughput of the component as input parameters for the QRA and 2) sub-system failure scenarios in terms of hydrogen release scenarios and failure frequencies based on the prescribed QRA approach in the Netherlands [50]. This assessment provides the comparative framework for the QRA intercomparison in Chapter 5.
In the Netherlands, a prescribed approach exists on how to perform a QRA [38], how to consider effects of releases of hazardous substances [39e47], how to consider probabilities i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 3 ( 2 0 1 8 ) 1 2 2 7 8 e1 2 2 9 4 [48], how to consider sub-systems and components in terms of release scenarios and failure frequencies [49e51] as well as which software package should be used [51]. The QRA results in the evaluation of two risk metrics associated to the HRS: individual risk and societal risk. The individual or local risk is used as a measure to guarantee a basic level of protection of a single person. It is used to investigate small accident scenarios and is independent of the surrounding environment. This risk is typically visualised by a 1E-6 risk zone around the source of the hazard, expressed in meters, within which a single person continuously exposed to the hazard has a chance to become seriously or fatally injured once in every 1 million years due to an incident. The societal risk is used as a measure to understand the consequences of a catastrophic incident on a group of people. The societal risk is expressed with a F(N)-graph which shows the frequency that a group of people of different sizes fall victim to a serious or fatal accident. An HRS is a system of interconnected sub-systems comprising (main) components and auxiliaries. As such, an HRS is considered by its sub-systems and, occasionally, (main) components in the QRA. HRS sub-systems and components are assessed on the basis of the prescribed QRA approach for predefined sub-systems and components [51]. These subsystems are common to many other systems than HRSs. Failure scenarios and basic failure frequencies for predefined sub-systems and components relevant to HRSs are provided in the next sections as well as relevant sub-systems and component parameters for the QRA, including contained mass (relevant parameter for instantaneous release scenarios [19]), mass throughput and operating pressure (relevant parameters for continuous releases and leaks scenarios [19]). The sub-systems and components can be protected by preventive and mitigation measures (e.g. blocking systems) which, when activated, limit the release of hydrogen from sub-system and component failure. These measures also have failure frequencies. It is important to note that the failure frequencies of sub-systems, components and measures are not based on operational data, due to the limited availability thereof with hydrogen and are therefore considered as generic. An overview of relevant QRA literature is provided below the tables on how sub-systems or components have been treated differently from the prescribed QRA approach in the Netherlands. This literature does not include the QRAs of the permitted HRSs in the Netherlands as these will be compared in chapter 5.
On-site hydrogen production e natural gas reformer A natural gas reformer produces hydrogen by catalytically converting natural gas and steam and/or oxygen into a syngas. A natural gas reformer is used as on-site hydrogen production unit in one HRS in the Netherlands (Arnhem). Although the production capacity (0.5 kg/h) is small, larger onsite units exist (>13 kg/h) [55]. An on-site reformer is typically containerised and automated. In fact, a reformer consists of many components including a reactor vessel, desulphurisation vessel, purifier, off gas vessel, heat exchanger, internal hydrogen storage vessel, natural gas compressor, external hydrogen and nitrogen vessels/cylinders [56]. Hydrogen reformate (mixture of H2, CO2 and CO) is found in nearly all processing equipment which by itself is partially occupied by sorbent or catalyst beds. Some of the aforementioned components are considered as predefined components in the QRA, but the reformer as a sub-system is not. The relevant subsystem data for a reference reformer with a production capacity of 100 Nm 3 /h [56] is summarised in Table 2.
Reformers have been treated in QRA literature differently, either as a single component or as a multi-component subsystem. When considered as a single component, the reaction vessel is representing the reformer as a whole [52] and the accompanying failure scenarios for the QRA mentioned in Table 2 are applied, whereas considered as a multi-component sub-system, the failure scenarios that are considered for the QRA are: a natural gas supply line leak, a natural gas line leak between the compressor and reformer and a catastrophic failure of the hydrogen line between purification unit and hydrogen compressor [26] or small and medium sized holes and full bore rupture of the desulphurisation vessel, heat exchanger, reformer vessel, hydrogen purification system and purge gas buffers [57]. It has been concluded by Ref. [26] that producing hydrogen on-site by electrolysis presents a lower risk than producing hydrogen on-site by steam methane reforming, due to the complexity of the reformer and the presence of natural gas and hydrogen in the reformer.
On-site hydrogen production e water electrolyser A water electrolyser produces hydrogen by electrochemically splitting water molecules into their constituents. A water electrolyser is used as on-site hydrogen production unit in two HRSs in the Netherlands (Amsterdam, Helmond). Like reformers, electrolysers are containerised, automated and available in different sizes. An electrolyser consists of many components including electrolyser stacks, a purifier, a heat exchanger, gas/ liquid separators, internal hydrogen storage vessel and external nitrogen cylinders [58]. Although the majority of these components are considered as predefined components in the QRA, the electrolyser stack may be considered as the reactor vessel as predefined component as it changes the chemical characteristics of substances, however in practice it is not a vessel. The relevant sub-system data for a reference electrolyser with a production capacity of 60 Nm 3 /h is summarised in Table 3. The volumes and mass are estimated based on [58].
Electrolysers have been treated in QRA literature, either as a single component or as a multi-component sub-system. When considered as a single component, the reaction vessel as predefined component is used to represent the electrolyser as a whole [52] and accompanying failure scenarios for the QRA as mentioned in Table 2 are applied, whereas considered as a multi-component sub-system, the failure scenarios that are considered for the QRA are: a catastrophic failure of the hydrogen purification system and the venting of the released hydrogen through the exhaust fan [26]. Besides the conclusion provided in Section 4.1 by Ref. [26] regarding electrolyser systems, Ref. [52] concludes that when the electrolyser is considered as reaction vessel only, it has no significant influence on the 1E-6 risk contours.
i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 3 ( 2 0 1 8 ) 1 2 2 7 8 e1 2 2 9 4 Hydrogen supply e hydrogen pipeline The Netherlands has 237 km of underground hydrogen pipeline infrastructure (internal pipe diameter between 5 and 20 cm [59], operating pressure around 100 bar and flow rate around 50 kg per second [60] [61]) that provides industrial endusers in the Netherlands and Belgium with hydrogen produced by large steam methane reforming facilities in the Rotterdam industrial area. One HRS in the Netherlands (Rhoon) is directly connected to a branch of the hydrogen pipeline infrastructure of Air Liquide and part of the pipeline is considered to be inside the boundaries of the HRS. This pipeline is connected aboveground to the HRS. An aboveground and underground pipeline is considered as predefined component in the QRA. The diameter and the length of the pipeline within the boundaries of the HRS determine the failure frequencies. In Table 4, the relevant component data is provided. The failure frequencies are provided in the unit per meter per year.
Hydrogen supply e tube/cylinder trailer Hydrogen tube or cylinder trailers are used to distribute hydrogen from production facilities to end-users and can also be used by HRSs as a permanent storage in which the trailer is being replaced when empty, as a temporary storage which is used to fill up the stationary storage, or as a back-up storage that can be called upon when the on-site hydrogen production unit is out of operation, e.g. during maintenance. The total amount of hydrogen stored in trailers is dependent on the storage pressure (typically 200 or 300 bar) and amount of cylinders or tubes on the trailer, but typically ranges between 350 and 550 kg (e.g. Ref. [62]). Tube trailers consist of multiple pressurised tubes or cylinder (s)(bundles) that are connected through a manifold and may have individual closing valves per tube or cylinder bundle (section). The trailer is connected to the HRS by a flexible unloading hose. The HRS in Delft used the tube trailer as a permanent storage, whereas other HRSs consider it as a back-up storage. The tube trailer sub-system   can be considered as a combination of a predefined subsystems and a predefined component in the QRA, namely as a road tanker with a pressurised tank and an unloading hose. The failure frequency of the hose is dependent on the unloading time or the time that it is pressurised connected. The relevant sub-system and component data is summarised in Table 5.
Tube trailers have been treated in the QRA literature with different failure scenarios: catastrophic failure of a single tube, a leak from tube trailer fittings (all content released) and a full bore rupture of the flexible hose [10] and catastrophic failure and leak during unloading [26].

Hydrogen compressor/booster
Pressure elevation up to 1000 bar in an HRS is obtained by using a hydrogen compressor and/or booster. A compressor is not involved in the refuelling process itself and is located upstream of the buffer storage, whereas a booster is involved in the refuelling process and is located downstream of the buffer storage. Boosters have therefore higher capacities than compressors, but both have integrated heat exchangers for thermal management. The compressor/booster is used in seven HRSs in the Netherlands: a compressor is used in two HRSs (Helmond, Arnhem), a compressor that is also used as a booster in three HRSs (Rhoon, Amsterdam, Delft) and a booster is used in two HRSs (Apeldoorn, Hoogezand (slowfill)). Compressors/boosters are considered as a predefined sub-system in the QRA, however only for reciprocating compressors. Besides these piston compressors, other positive displacement compressor types are being used in HRSs (e.g. ionic liquids, membrane/diaphragm). The relevant subsystem data for a reference compressor (e.g. Ref. [63]) is summarised in Table 6.  i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 3 ( 2 0 1 8 ) 1 2 2 7 8 e1 2 2 9 4 Compressors have been treated in QRA literature with different failure frequencies even though the standard component considerations have been applied. The basic failure frequencies, that are taken from the ANIMAL database [64] and the UK HSL database [65], for the catastrophic failure scenario are 1.9E-2 by Ref. [52] and 6.5E-3 by Ref. [10] and for the leak scenario is 5.9E-2 by Ref. [10].

Hydrogen buffer storage
The hydrogen buffer storage sub-system consists of one or more sections of interconnected vessels or cylinders that can either be permanently or temporary located in the HRS. All 15 HRSs have a buffer storage but the capacity and pressure level differ significantly among the HRSs. The hydrogen storage capacity ranges between 25 and 220 kg (between 1600 and 10250 L) at pressures between 200 and 950 bar (see Table 1). A buffer storage sub-system can be considered as a predefined sub-system in two ways: as aboveground pressurised storage tank for volumes above or equal to 0.15 m 3 or as a gas cylinder for volumes smaller than 0.15 m 3 . The release scenarios for these sub-systems are different (see Table 7) especially in view of the compartmented arrangement of the storage tubes/cylinders. For a gas cylinder bundle, the continuous release scenario is considered through a 5 mm hole (3.3 mm for only one cylinder) instead of a 10 mm hole for the aboveground pressurised storage system. It is noted that for plastic tanks the instantaneous release and fire scenario may need to be considered differently [49].
Hydrogen pre-cooler/heat exchanger To limit the temperature rise of hydrogen in the storage of the application during refuelling and therefore to enable fast filling, hydrogen should be pre-cooled. As this sub-system is located before the dispenser, it has the same mass throughput and pressures as the dispenser sub-system. Two HRSs have a precooler installed (Helmond, Rhoon). There are several cooling concepts (e.g. co-axial tubes, shell and tubes, cold metal blocks) and cooling media available (e.g. brine, glycol, liquid nitrogen, liquid hydrogen, CO 2 ) [66]. The pre-cooler will need to withstand high hydrogen pressures so coaxial tube evaporator configurations, in which the coolant material is in the outer tube, are more suited than brazed plate or plate and shell designs. The design pressure of the coolant tubes (co-axial design) is typically lower than that of the high pressure hydrogen tube. The precooler/heat exchanger of the shell-and-tube type is then considered as a predefined sub-system in the QRA. Another cooling concept that can be applied in (typically highly utilised) HRSs (but not in the Dutch HRSs yet) is a cooling block with hydrogen and coolant tubes routed through separately [67]. It is not clear if such a pre-cooler/heat exchanger type can be considered as a predefined sub-system in the QRA. The relevant sub-system data is summarised in Table 8 (based on [66]).

Hydrogen dispenser
The hydrogen dispenser sub-system, which includes typically components like a cabinet, metering device, piping, breakaway, hose, nozzle, pressure relief device, communication interface etc. [7] may include one or several types of nozzles, like a 350 bar normal flow nozzle (internal nozzle pipe diameter ± 4 mm), a 350 bar high flow nozzle (internal nozzle pipe diameter ± 8 mm) and/or a 700 bar normal flow nozzle (internal nozzle pipe diameter ± 5 mm) [68]. The hose length should not exceed 5 m [7]. All HRSs have dispensers, but the nozzle type(s) differ per HRS. As required by ISO/TS 19880-1:2016, the dispenser should terminate refuelling of light duty vehicles if the fuel flow rate goes beyond 60 g/s or the maximum operating pressure rises above 125% of the nominal working pressure (so 875 bar for an HRS with a service pressure of 700 bar) [7]. The dispenser hose is considered as a predefined component in the QRA. The scenarios are the same as the unloading hose of the tube trailer (see Section 4.4). The failure frequency of the hose is dependent on the unloading time. The relevant sub-system data is summarised in Table 9.

Hydrogen process piping
Pipes that connect the different sub-systems of the HRS together are considered as a predefined component in the QRA. The QRA considerations are the same as for the pipeline (see Table 4).

Preventive and mitigation measures
HRSs employ blocking components as preventive and mitigation measures (e.g. detection with automatic shut-off valves) to minimise the hydrogen release from sub-system or component failure. As these measures have a failure frequency as well, this results in failure scenarios for continuous releases with combined failure probabilities for the relevant sub-systems and components. According to the PGS 35, blocking components need to be applied between all subsystems [6]. Other preventive and mitigation measures that can be applied are non-return valves and excess flow valves. The failure frequency and the considered reaction time for these measures are shown in Table 10.
In contrast to the reaction time considered for a predefined blocking components in the QRA, according to the PGS35 [6], the response time of an emergency shutdown device (ESD) should not be greater than 5 s.

Intercomparison of QRAs of HRSs in the Netherlands
In this chapter, the results of the intercomparison of ten QRAs of HRSs in the Netherlands, including 1 permitted but not yet established HRS, are presented. The ten QRAs are developed by   i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 3 ( 2 0 1 8 ) 1 2 2 7 8 e1 2 2 9 4 seven different vendors. The QRA report includes six mandatory sections [50], including a detailed map in which the HRS is to be located within its surroundings, a description of the surrounding (population density, neighbouring activities and possible dangers coming from it, possible ignition sources), a general description of the HRS, the risk assessment of the sub-systems and components (scenarios, frequencies, assumptions), a detailed description of the scenarios and the results of the risk assessment showing the individual and societal risk. The intercomparison addresses all sections, but focusses mainly on the key sections in the QRA that directly concern the HRS and the risk assessment. Therefore, paragraph 5.2 is dedicated to the risk assessment of the HRS sub-systems and components (scenarios, frequencies, assumptions) and the detailed description of the scenarios. The reference framework to which the HRS sub-systems and components and the scenario description are qualitatively compared to is provided in chapter 4.

Intercomparison results for complementary QRA sections
The complementary sections of the QRA are the detailed map, a description of the surrounding, the general description of the HRS and the (visualisation of the) QRA results regarding the individual and societal risk. The sections are important for the QRA but receive less priority for the intercomparison as these do not directly concern the risk assessment of the HRSs. Although the detailed location map in which the HRS is to be located is provided in all QRAs, the description of the HRS surroundings is not always included. When it is included, information regarding the surrounding built environment and its functionality, the description of the people present in its surrounding, the surface roughness length and the weather conditions considered is provided.
All QRAs provide a general description of the HRS, but the level of detail varies. The description should be clear enough to enable identification of all sub-systems, components and accompanying technical parameters. Some sub-systems and component descriptions contain too limited information to understand why certain technology and scenario selections have been made (e.g. for the heat exchanger and the compressor). Some QRAs provide block diagrams, whereas others provide process descriptions. In some occasions, a description of the refuelling strategy is provided.
The provision of input parameters for the HRS sub-system and component consideration varies among the QRAs. All QRAs provide the operating pressure, however QRAs differ with regards to the release duration (actual or considered) and the mass/volume released (actual or maximum). The temperature, release hole diameter and release flow are parameters that are only occasionally provided.
The results of the risk assessment should be presented for the individual and the societal risk. In all QRAs, the individual risk is presented according to the requirements, being a map with 5 risk zones (1E-4, 1E-5, 1E-6, 1E-7 and 1E-8) depicted on it. Not all QRAs provide the mandatory F(N)-graph for the societal risk. The societal risk has also been presented as an area of influence and a 1% lethality zone on a map, or simply with a statement that the societal risk is negligible without providing the means to verify it. The contribution of the individual failure scenarios to the individual and societal risk is not systematically provided.
In conclusion, information regarding the HRS surroundings and the QRA results for the societal risk are occasionally omitted whereas this is a mandatory reporting requirement. The level of detail in the general description of the HRS varies significantly among the QRAs with some insufficiently detailed descriptions. Also the input parameters for HRS subsystems and components are not sufficiently reported as key parameters are occasionally omitted and different interpretations of parameter notations are observed. The detailed map and the QRA results for the individual risk are properly included in the QRAs.

Intercomparison results for key QRA sections: HRS subsystems and components and scenario descriptions
The HRS sub-systems and components are assessed in terms of inclusion in the QRA, sub-system and component considerations in general (system boundaries, selection of "Yes" indicates that at least on one occasion an inconsistency is observed. i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 3 ( 2 0 1 8 ) 1 2 2 7 8 e1 2 2 9 4 predefined subsystem and components), predefined subsystem and component characteristics (input parameters), failure scenarios and failure frequencies. If at least one inconsistency is found among the QRAs, it is labelled as "yes" in Table 11. An inconsistency is defined as a deviation from the guidelines of the prescribed QRA approach. The results of the intercomparison are summarised in Table 11 and per subsystem/component further elaborated in Section 5.2.1e5.2.10.
On-site hydrogen production e natural gas reformer One HRS in the Netherlands was equipped with a reformer. In the relevant QRA it is stated that the reformer has been included in the risk assessment, but that its contribution to the individual risk zone is very small when compared to the contribution of the hydrogen buffer storage. No further details are provided on how the reformer is considered in the QRA, so it is not possible to verify sub-system considerations, applied failure scenarios and frequencies and subsequent results for the risk zone. In Section 4.1, it is highlighted that reformers have been considered differently in QRA literature (as a single component or as a multi-component sub-system). It therefore remains unclear how a reformer, as a multi-component subsystem, should be considered in the QRA.

On-site hydrogen production e water electrolyser
Two HRSs in the Netherlands are/were equipped with an electrolyser. In the relevant QRAs, the electrolyser has been recognised as a sub-system of the HRS, but it has not been included in the QRA. The reasoning provided for excluding the electrolyser from the QRA is the limited amount of hydrogen mass contained within the sub-system. In QRA literature however (see Section 4.2), electrolysers have been considered but in different ways. It is therefore remains unclear how an electrolyser, as a multi-component sub-system, should be considered in the QRA.
Hydrogen supply e hydrogen pipeline One HRS has a connection to a hydrogen pipeline. In the relevant QRA, the pipeline complies with the description and considerations provided in Section 4.3.
Hydrogen supply e tube/cylinder trailer The tube or cylinder trailer has been included in the relevant QRAs when it is considered as a permanent storage of the HRS. In that case, the trailer is considered simultaneously as two sub-systems: a hydrogen buffer storage sub-system with a compartmented aboveground pressurised storage tank (no time fraction applied on the failure frequency to indicate the permanent allocation) and as a road tank with hose subsystem comprising a road tanker with a pressurised tank and a unloading hose (time fraction applied to the failure frequency to indicate a non-continuous use). Consequently, seven failure scenarios have been applied (see Section 4.4 and 4.6) in the relevant QRAs. However, the aboveground pressurised storage tank failure scenarios are considered to apply for each tube, resulting in an adjustment of the failure frequency by the number of tubes. This approach coincides with the adjusted failure frequencies approach that is applied to gas cylinder bundles. The time fraction applied to the failure scenarios for the trailer hose is according to its actual usage.
Although in reality the trailer is equipped with blocking components (see Section 4.10) that are used when the trailer is not operated, such blocking components are not considered in the relevant QRAs. Incorporating blocking components to the failure scenarios of the trailer would result in a reduction of the amount of hydrogen released and an adjustment of failure frequencies. However, the physical appearance of blocking components explains why the trailer has been considered as an aboveground storage tank when not being in operation. Consequently however, applying this approach has resulted in time fractions greater than 1 (appearance time and active time) for similar failure scenarios (e.g. instantaneous failure scenario) in some of the relevant QRAs, resulting in an overestimation of the risk.
When the trailer is considered as a back-up storage that will only be called upon when the primary hydrogen production or supply is not available, it is treated differently among the relevant QRAs. In some QRAs, the back-up trailer is excluded on the basis that it is not considered part of the HRS configuration during normal operation. In some QRAs, the trailer is included following the failure scenarios for a road tanker (see Section 4.4). In that case, the total amount of stored hydrogen in the trailer is considered to be released in the instantaneous release scenario of the trailer. The failure frequencies are adjusted by a time fraction which is in line with the actual use of the trailer and the hose. The time fractions applied are the same for the hose and the trailer. Hoses are considered with and without blocking components.
In conclusion, hydrogen trailers have been considered differently in the relevant QRAs in terms of sub-system/ component considerations, inclusion or exclusion (with motivation) of back-up trailers, applied failure scenarios when considering multiple pressurised tubes, applied failure frequency (adjustments for time fraction of usage and number of tubes as well as applying preventive and mitigation measures) and input parameters (released mass inventory). These different considerations are partially caused by the lack of guidance for compartmented pressurised storage sub-systems.

Hydrogen compressor/booster
The HRSs with a complex configuration include a compressor or booster but these sub-systems have not always been included in the relevant QRAs. The argumentations used to exclude the compressor from the QRA are that it is not considered among the failure scenarios that have an important contribution to the risk zone and that the hydrogen mass within the sub-system boundaries is small. For the QRAs that have included the compressor or booster, the technology type is not mentioned in the description of the sub-system, leaving it to assume that piston compressors are applied as this is the predefined technology in the QRA. A remark is made in one of the QRAs that it is not clear how to consider the compressor as a predefined sub-system as the compressor consists of several components, like compression tubes (or stages) with inbetween heat exchangers. Also, the operating parameters of the compressor or booster (pipeline diameter, pressure, mass released) are not systematically provided among the QRAs. When the compressor/booster is included, the failure scenarios as described in Section 4.5 are applied and the rupture and leak scenarios are considered on the incoming piping of i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 3 ( 2 0 1 8 ) 1 2 2 7 8 e1 2 2 9 4 the compressor/booster. In some QRAs, a time fraction is applied to the failure frequencies when the compressor is not operated continuously. When the operating time of the compressor is not assessed, continuous operation is assumed. No blocking components have been applied to the compressor in the QRA.
In conclusion, hydrogen compressors have been considered differently in the relevant QRAs in terms of the inclusion or exclusion (with motivation) and applied failure frequency (adjustments for time fraction or not). In one of the QRAs, a question is being raised about the sub-system boundaries of the compressor.

Hydrogen buffer storage
All HRSs include a hydrogen buffer storage and all QRAs include the buffer storage has as a sub-system. In the majority of the QRAs, the volumetric differentiation between the aboveground pressurised storage tank (!0.15 m 3 ) and gas cylinder (<0.15 m 3 ) is correctly applied. When this is not correctly applied, it is done without explanation or it has been argued that the permanent cylinder bundle possesses the characteristics of the aboveground pressurised storage tank because transportation and de-/coupling actions do not occur. Compartmentation of the hydrogen buffer storage in bundles, banks or sections has resulted in the selection of a different set of failure scenarios. For gas cylinder bundles, the failure scenarios presented in Section 4.6 are generally well applied. Deviations have been observed by including an extra continuous release scenario of the entire content from a hole with an effective diameter of 3.3 mm (this hole size is relevant if the storage sub-system consisted of only 1 cylinder) and by adjusting failure frequencies for the continuous release scenario, as in some QRAs the failure frequency is not adjusted by the remaining number of cylinders (N-1), as it should be, but by all cylinders (N). Also the amount of hydrogen that is released differs among the QRAs. In some QRAs, it is assumed that all content is released, even though the cylinder bundles are physically and operationally separated from each other and, according to the refuelling procedure, are never opened at the same time. It is unclear how the QRA should consider the existence of banks during operation, e.g. during cascade refuelling. Also, for simple HRS configurations (see chapter 3), it is conservatively assumed in the QRAs that the storage buffer is always full even though refuelling takes place. Some QRAs consider for the instantaneous and continuous release scenario, besides the release of remaining hydrogen in the storage buffer, also the subsequent supply of hydrogen from neighbouring sub-systems. Blocking components are then used to adjust the failure frequencies for the amount of hydrogen that is released.
For compartmented aboveground pressurised storage tanks, no QRA guidance exists in Ref. [50]. Several approaches have been applied including A) applying the failure scenarios of the aboveground pressurised storage tank and adjusting the failure frequency for all scenarios by the number of aboveground pressurised storage tanks, B) applying the failure scenarios of the gas cylinder bundle to the aboveground pressurised storage tanks, C) applying the instantaneous release scenario of the gas cylinder bundle to a section of interconnected compartmented aboveground pressurised storage tanks and, for the continuous release scenarios, the release of hydrogen contained in only one section. The failure scenario due to fire has only been considered applicable to the gas cylinder bundle and not to the aboveground pressurised storage tank.
In conclusion, the hydrogen buffer storage sub-system has been considered in different ways among the QRAs. It is not clear how the compartmented aboveground pressurised tank sub-system should be considered, which has resulted in a variety of approaches being applied. Also for the gas cylinder bundles, differences are observed in the application of failure scenarios, the adjustment of failure frequencies for the number of relevant affected cylinders and the consideration of operationally independent storage sections consisting of interconnected bundles. Also, it should be considered whether the failure scenario due to fire should also be applied as a failure scenario for the aboveground pressurised storage tank.
Hydrogen pre-cooler/heat exchanger Two HRSs in the Netherlands are equipped with a pre-cooler/ heat exchanger. The hydrogen pre-cooler has not always been included in the relevant QRAs even when the HRS includes it as a sub-system. When it is excluded, it is done without providing any additional reasoning. When it is included, it is considered as described in Section 4.7. Possible failure scenarios related to the coolant fluid are not considered to be part of the QRA. Section 4.7 highlights that different pre-cooling concepts exist and that it is not clear how these should be considered if it deviates from the predefined technology.

Hydrogen dispenser
The hydrogen dispenser sub-system has not always been included in the QRAs even though all HRSs include it as a subsystem. When it is not included, there is no explanation provided why it is not included. When it is included, the failure scenarios are applied per each hose in accordance with Section 4.8. However, in one QRA, the dispenser has been considered as an unloading arm instead of an unloading hose. This is done without providing a justification for it. Although the failure scenarios are the same, the failure frequencies for the arm are approximately a factor 100 times less than the failure frequencies for the hose, leading to a significant underestimation of the associated risks (3E-08 vs 4E-06 per hour for the rupture scenario and 3E-7 vs 4E-5 for the leak scenario). In one QRA for a simple HRS configuration, the flexible piping that connects the hydrogen storage buffers to the central hydrogen collection tube is considered as a hose. The calculation of the number of operational hours per year and the transferred mass or volume to the application is provided in the QRA. In one QRA, a multiplication factor of 2 has been used for the failure frequency to represent a rupture on the side of the HRS and the application. The preventive and mitigation measures that have been applied to the failure scenarios of the dispenser are non-return valves for simple HRS configurations and excess flow valves and blocking components for complex HRS configurations. Especially in the latter case, this has a significant effect on the failure frequency applied to the failure scenario in which the preventive and mitigation measure fails to intervene (1E-03 for the blocking components vs 6E-2 for the excess flow valve). In some QRAs, no preventive i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 3 ( 2 0 1 8 ) 1 2 2 7 8 e1 2 2 9 4 and mitigation measures have been considered. The excess flow valve has been applied as a preventive and mitigation measure in one occasion and rejected in the other based on the argumentation that the maximum effect distances are already reached before the excess flow valve is activated. The amount of hydrogen that is released in the failure scenario is often considered to be a part of or the total storage capacity of the hydrogen buffer storage. It should be noted that the preventive and mitigation measures are not applied to the leak scenario in the QRAs.
In conclusion, hydrogen dispensers have mainly been considered in the QRA as hoses but occasionally as arms. Several preventive and mitigation measures have been used to limit the release of hydrogen but these differ in failure frequencies and reaction time.

Hydrogen process piping
All HRSs include piping to connect the individual sub-systems and components but not all QRAs include the piping as a predefined component. When it is included, the failure scenarios provided in Section 4.3 are correctly applied and the piping (length between 10 and 50 m) is considered between the compressor and the buffer storage and between the buffer storage and the dispenser. As process piping is only sporadically considered in the QRAs, it is not clear under which conditions process piping should be considered and if so, where or between which sub-systems it should be considered.

Applications
Some of the QRAs include the applications (e.g. boat, bus, car) that are expected to be refuelled at the HRS. These applications are then treated as a road tanker (application containing fuel) or compartmented aboveground pressurised storage system (storage system of the application). The applications considered in the QRA contain at least 25 kg when completely filled and as such it is claimed that the inclusion of the application in the QRA is justified as it adds a significant source of additional mass within the boundaries of the HRS when being refuelled. However, the majority of the QRAs do not include the applications. It is therefore not clear under which conditions applications should be considered as part of the QRA for HRSs.

Conclusions, recommendations and discussion
In this paper, the intercomparison of the QRAs of permitted HRSs in the Netherlands has revealed significant inconsistencies. These inconsistencies are found on various aspects of the QRA and include the inclusion of HRS subsystems and components, the HRS sub-systems and component consideration as predefined components, the application of failure scenarios, the determination of failure frequencies, the application of input parameters, the consideration of preventive and mitigation measures as well as the information provided regarding the HRS surroundings and the societal risk.
It is therefore recommended to develop specific QRA guidelines for HRSs to improve the consistency and coherence of these QRAs for HRSs. Such guidelines could include: o It should be clear for permitting authorities what the HRS consists of and how it operates. A checklist of HRS subsystems and components and an extensive description of sub-systems, components, preventive and mitigation measures, configurations (including piping and instrumentation diagrams) and input parameters is recommended. The HRS configurations shown in chapter 3, as mentioned in PGS 35 or a P&ID can be taken as a starting point, followed by a thorough description of each individual sub-system/component of the HRS, its operating parameters (mass, mass flow, mass contained, volume, pressure, temperature) and the preventive and mitigation measures applied. The intercomparison has revealed that HRS sub-systems and components are sometimes not included or even ex ante excluded without assessing the risks associated to these components. This should be avoided even if the time fraction is small. o An explanatory note on how to consider predefined subsystems of the HRS and refuelling applications at the HRS is necessary. The intercomparison revealed that some HRS sub-systems that are regarded as predefined sub-systems require further explanation on how to be considered in the QRA. This is especially required for the hydrogen tube/ cylinder trailer (failure scenarios and frequencies for compartmented pressurized sections, consideration of the trailer hose, applied safety measures), compressor/booster (sub-system boundaries), and the hydrogen buffer storage (failure scenarios and frequencies for compartmented aboveground pressurised tanks). It is recommended that further guidance is provided under what conditions refuelling applications should be considered in the QRA. o a harmonised approach for non-predefined and not-inscope HRS sub-systems/components is necessary: the intercomparison has revealed that the reformer and electrolyser are not or in part considered in the QRA. These sub-systems consist of a several components and include different gases or gas-mixtures so a dedicated approach is required on how to consider these multi-component subsystems in the QRA. QRA literature (like [26,52,57]) provides examples on how these sub-systems could be considered from a QRA perspective. Exclusion of these sub-systems from the QRA should be avoided as the risk associated may not be negligible [26].
In addition to the predefined, conventional sub-systems, HRSs may employ state-of-the-art sub-systems that do not fit the scope of the predefined sub-system and would require guidance or a dedicated approach. This may hold for the compressor (membrane compressor), heat exchangers (cooling block) and hydrogen buffer storage (composite type III or type IV tubes or cylinders). Similarly, HRSs may employ innovative sub-systems/components over state-of-the-art sub-systems/components which may require guidance on how to be considered (e.g. electrochemical or metal hydride compressors).
Additionally, considering the inconsistencies observed in the QRAs with the application of failure scenarios, the adjustment approaches of failure frequencies, the presentation of risks and risk contributors and the inclusion of information regarding the HRS surroundings, it could be i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 3 ( 2 0 1 8 ) 1 2 2 7 8 e1 2 2 9 4 recommended, besides applying more careful checks by permitting authorities of the compliance of the QRA to the prescribed approach, to establish a knowledge entity at national level that provides assistance to permitting authorities in reviewing the QRAs of HRSs or provides an independent review of the QRAs of HRSs. Such an entity could become a centre of expertise that could collect existing and future QRAs of HRSs to monitor the progress towards the consistent application of the approach as well as provide guidance to permitting authorities on how to apply the approach for HRSs. This is justifiable considering the early stage and municipality fragmented deployment of HRSs. In that view, it could be considered to reinforce the second opinion service [69] that RIVM is offering for permitting authorities dealing with QRAs. Another option could be (and this is currently considered in the Netherlands [70]), to apply, mandatory safety distances for HRS configurations. r e f e r e n c e s