Statistics, lessons learned and recommendations from analysis of HIAD 2.0 database

incidents and accidents currently in HIAD


Introduction
The global energy system must undergo a profound transformation to achieve the targets in the Paris Agreement. In this context, low-carbon electricity from renewables is expected to decarbonize a large share of the EU energy consumption by 2050. However, reaching the total decarbonisation of certain sectors, e.g., transport and some industrial sectors, which require high-grade heat, maybe difficult purely by means of electrification. This challenge can be addressed by clean hydrogen, which involves large amount of renewable energy being channelled from the power sector into the end-use sectors. Hydrogen can therefore be the missing link in the energy transition, as a vector for renewable energy storage and transportation, alongside batteries and transport, ensuring backup for seasonal variations and connecting production locations to more distant demand centres. Hydrogen, related fuel cell and water electrolysis technologies can potentially support the long-term strategy and meet energy security needs in several sectors of the energy system, such as heavy goods transport, the heavy industry as well as residential sectors.
Hydrogen has already been used and safely handled for decades in several industrial application areas, e.g. in aerospace technology, chemical processing including refineries, fertilisers, food and electronic industries, etc. However, to play a role as an energy vector, the fuel cell and hydrogen technologies need to be deployed broadly outside the initial industrial frame, the aspect of public safety needs to be addressed to ensure at least the same level of safety as the incumbent technologies. Compared with the current fossil energy carriers, hydrogen introduces some different safety issues, which need to be understood and tackled with specific preventive and mitigating approaches. Together with fundamental safety research and applied studies, one of the most fruitful methods used in industry to develop and improve safety strategies for a specific technology is the return of experience obtained from its previous deployments. For example, in the petrochemical industry, it is standard practice to learn from past incidents to devise mitigation and precautionary measures to avoid the reccurrence of similar events and improve the overall safety of the facilities. However, in the case of hydrogen, previous scarce penetration in the market and society does not yet allow reliable statistics to be achieved and in-depth knowledge about incidents and near misses is still not fully widely accessible. It is, therefore, important to collect and structure all available information on accidental hydrogen behaviour along its supply chains, up to end uses, to maximise the lessons learned from the past and develop a future-proof safety strategies to help ensure safe handling of hydrogen and inform standards and regulations.
Several studies were published in the past decades, dedicated to the accidentology of hydrogen. One of the first studies, in 1974, consists of the review of 96 hydrogen accidents that occurred during the space program by the US National Aeronautics and Space Administration (NASA) until 1974 [1]. In this pioneering work, the conclusions and recommendations deduced from the analysis of hydrogen incidents were performed one specific sector, which uses predominantly liquid hydrogen, and were mainly related to its storage and transport. A broader study was published by the US Department of Energy in 1978 [2], based on the collection of approximately 400 individual reports on hydrogen incidents that occurred mainly in an industrial environment in the 1965e1977 period. The report provided not only overarching recommendations based on statistics but also generic case history while it was almost exclusively based on industrial hydrogen uses, i.e. hydrogen as feedstock in chemical and metallurgical industries, including production, storage and road transport. More recently, researchers widened the study to capture lessons learned from additional uses. The work of Ringland [3]in 2010 was one of the first to focus on safety issues of hydrogen-powered vehicles. However, the analysis was largely based on the events covered by the previously mentioned works from industrial and NASA incidents while it included some limited return of experience from the US research programs dedicated to hydrogen vehicles. This is also the case of the work of analysis of Cadwallader et al. [4], which was also dedicated to hydrogen as a fuel for airships in the first part of the 20th century. Also in 2010, the US National Highway Traffic Safety Administration (NHTSA)broadcasted an analysis of published hydrogen safety research with a section dedicated to incidents that occurred to compressed natural gas tanks, lacking any data related to hydrogen tanks [5].
As recommended by Zalosh and Short [2] in their 1978 review, "Additional hydrogen accident data should be collected periodically as proposed new hydrogen uses are implemented". To be useful, an incident repository or database should be regularly maintained and populated over a long period and made available to a large range of stakeholders. Several industrial sectors and individual companies (especially insurance companies) maintain incidents repositories, but these are often restricted in scope and not publicly accessible. In addition, some local and national authorities i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y x x x ( x x x x ) x x x collect incidents that occurred in sectors for which they have a regulatory mandate, for example in the US: In the UK, the Institution of Chemical Engineers (IChemE) was used to maintain an accidental database [11]. It contains summaries of industrial accidents that occurred worldwide, with a predominance of UK-related events. It was active and publicly available online between 1997 and 2000. IChemE is now closed, but all events are still available. In Japan, an important example of industrial incidents database was the Relational Information System for Chemical Accidents Database RISCAD of the Japanese Institute for Advanced Industrial Science and technology [12]. It is now unavailable.
These repositories and databases are publicly available and cover a broad range of sectors and societal activities. They contain cases where hydrogen plays a role, but the databases are not specifically built for hydrogen technologies. Nevertheless, their hydrogen-related datasets have enabled hydrogen-specific recommendations. For example, the ARIA team published in 2008 a report on hydrogen accidentology [13], eMARS dedicated one of its lessons learned bulletin to hydrogen cases history [14] and RISCAD presented a detailed root cause analysis for one of its events [15].
As mentioned above, a collection of lessons learned from incidents and accidents occurring during the use of hydrogen technologies is a critical tool to understand hazards and develop preventive and mitigating measures. The first idea of a structured database exclusively dedicated to hydrogen incidents, with descriptors aiming at characterising the hydrogen behaviour in case of accidental releases, is reported in 1994 by Kreiser et al. [16]. The report collected 287 incidents from several sources and developed a database to produce statically relevant conclusions. Unfortunately, the database was never made publicly available and was discontinued. The European Hydrogen Incident and Accident Database (HIAD) was designed in the frame of the European Commission-funded network of excellence on hydrogen safety (HySafe) and developed by the JRC in 2006 [17]. Around the same time, the Hydrogen Incident Reporting and Lessons Learned was launched by the US DOE, originally called H2incidents [18]. Nowadays this became the H2TOOLS Lesson Learned, developed by the Pacific Northwest National Laboratory under the sponsorship from the U.S. Department of Energy [19]. In 2017, the JRC developed a new version of HIAD (HIAD 2.0) [20]. The two databases share many events and have the same overarching goal, to provide the hydrogen scientific, standardisation and regulatory communities with a publicly available and as far as possible complete incidents database dedicated to hydrogen systems. Their scope as well as collection and validation mechanisms are not the same: where H2TOOLS aims principally at providing a tool for the selected and detailed lesson learned, HIAD 2.0 has a broader acceptance range aiming also to bring a broad basis for statistics. In this sense, the two datasets are complementary to each other.
Thanks to the previously mentioned general industrial repositories and the two hydrogen databases, it became possible more recently to perform studies on hydrogen uses beyond the traditional industrial sectors. Mirza et al. [21] for example, has used 32 events from H2TOOLS to perform causes and consequences analysis to inform a risk assessment checklist. Sakamoto et al. [22] used H2TOOLS and HIAD 2.0 together with additional Japanese sources to study leakagebased incidents in hydrogen refuelling stations.
The current article presents the results of the analysis of over 700 incidents in HIAD 2.0. The authors, all belonging to the European Hydrogen Safety Panel (EHSP) of the Fuel Cells and Hydrogen Joint Undertaking (FCH 2 JU) have assessed and classified each incident according to a specified methodology, deduced lessons learned and proposed recommendations for a large range of hydrogen applications. To the author's' knowledge, it is the first time that such a large number of incidents is used for this type of analysis. The manuscript should make an important contribution to the safety of different systems involving hydrogen. The work in this paper will benefit organisations operating hydrogen production plants, hydrogen refuelling stations and liquid hydrogen terminals, etc. In particular, the manuscript will assist technical safety engineers, emergency responders and fire fighters. The lessons learned and the discussion derived from the statistics can also be used in training and risk assessment studies and of equal importance to inform managers to promote, develop and maintain sound safety culture in their organisations.

Data, analytical approaches and procedure
This section starts with the description of the data collection and validation, which are followed by an overview of the data in HIAD 2.0. It also contains a brief description of the analytical approaches and procedures followed by the EHSPwhile the description of the methodology used in deriving lessons learned and formulation of recommendations are described in Sections Lessons learned and Recommendations, respectively.

Data collection and validation
As already mentioned, HIAD 2.0 is a database collecting systematic data on hydrogen-related incidents, accidents or near misses. It relies exclusively on publicly available primary or secondary sources. HIAD 2.0 dataset is publicly available. However, at the moment of writing, the database is temporarily inaccessible online, but the dataset is delivered offline upon request using the function mail address: JRC-PTT-H2SAFETY@ec.europa.eu. Fig. 1 shows the hydrogen applications used to classify an event and its principal descriptors. Each incident is further characterised by additional qualitative and quantitative descriptors: examples of the latter are the date of occurrence, data characterising the physical masses involved, and the classification and quantification of the consequences. The qualitative descriptors are those related for example to the description of the technical systems involved, the application, the root cause analysis, the lessons learned, the emergency actions and the adopted corrective measures. A more detailed list of the descriptors and their hierarchical interdependence is available in Cristina Galassi et al. [23]for the original version HIAD. Melideo et al. [20] describe the modification implemented for HIAD 2.0.
The major sources of incidents in HIAD 2.0 come from the following sources: An additional 9% is provided by scientific articles, which report and analyse in detail individual events. The rest comes from online news of local or technological newspapers. Most of the events are traceable back to the source.
All these sources have different approaches to the description of incidents. In some cases, incidents descriptors are already structured similarly to the structure of HIAD 2.0. In other cases, only specific aspects are provided in a more storytelling narrative.
The structure of HIAD 2.0 was firstly designed almost 20 years ago and events have been collected in a time span of more than 15 years. The composition of the events providers' team and the validators' team changed several times. Moreover, some of the original descriptions and their relationships became dated. Despite the continuous improvement of the quality in HIAD 2.0, it is not possible to modify all events descriptions radically due to the need to maintain compatibility with old data. This result in a certain amount of shortcomings. For example, event descriptions entered over a period of a decade do not appear fully coherent. Certain descriptors classes are obsolete. In some cases, it would be desirable to have the possibility to choose a more articulate set of choices, but the validator can only choose one. For example, HIAD 2.0 allows choosing only one of the predefined causes, while it is known that often multiple causes, often in a hierarchical dependence, can be identified for one incident. This limitation was partially overcome by using free texts to provide a narrative. However, this ad-hoc solution does not make it easy for quantitative statistics. This is the reason why the EHSP reanalysed each event, adopting a more modern approach, as described in the next section.
The process governing the input of events in HIAD 2.0 is based on the four-eyes principle. The members of the EHSP are responsible for the identification of new events by means of continuous scanning of various information channels (meetings, conferences, scientific literature, etc.). The incident addition in HIAD 2.0 is a two-step process. The EHSP members play the role of the event provider, while JRC is a validator. As a first step, the EHSP members deliver to the JRC the description of the incidents using a template containing the same i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y x x x ( x x x x ) x x x event descriptors used in the database. During this step, EHSPmembers provide an expert assessment and interpretation of the data contained in the source(s). In the second step, the JRC decides if the event descriptors have the minimum qualifications required to become a new entry in HIAD 2.0. This step consists of an independent expert assessment of the data by JRC. This step often involves an improvement feedback loop with the event provider. In both steps, the most important elements are the root cause analysis and the derivation of a lesson learned. If not already delivered by the sources in a convincing way, an expert assessment is required to reach conclusions in these two critical elements. In many cases, the quality of the descriptors is not good enough to reach any conclusion, and the two descriptors remain empty. In that case, the new event is accepted or rejected. Once an event is accepted in HIAD 2.0, the validator in JRC validates the event and assign a quality label. Non-validated events also remain in HIAD 2.0, but are not visible to users and cannot be used for analyses. They remain 'hidden' in case new sources become available to provide more insight.
The quality label provides users with a refined tool to perform more accurate analysis and assessment on a subset of the overall database. The quality criteria are listed in Table  1. The EHSP analysis covered events belonging to quality from 2 to 5. The quality of the descriptions depends on the quality and the level of details offered by the sources. Incident investigation reports prepared by a multidisciplinary team of experts offer the highest level of quality. However, for very complex incidents, even careful and expert investigation may not be able to identify clear root causes and clear sequence of the events. This is often the situation in the presence of multiple domino effects. Moreover, if the investigation of the incident implies legal aspects the investigations will never become public. The other extreme of the quality spectrum is the description of events provided by local journalists immediately after the occurrence. These many report only the final visible consequences and in the input of eyewitnesses.

Overview of the data in HIAD 2.0
The distribution over time of the considered events is plotted in Fig. 2. Most of the events contained in HIAD 2.0 occurred in the period from the 1990s to the 2000s. One of the causes of reduction of the incidents after 2000 is attributed to the improved safety design and operative provisions in chemical and petrochemical industries. Other causes might also include under-reporting or delay in reporting of the events even though there is no evidence to support this.
Geographically as illustrated in Fig. 3, more than half of the considered events occurred in Europe while one quarter occurred in North America. Asia accounts for less than a sixth of the events while the events from other regions account for only 2%. Although recently occurred events have been closely monitored and uploaded to HIAD 2.0, sources are scarce concerning historical events in Asia and other regions. For this reason, this geographical distribution should not be generalised as indicative of the real geographical distributions of historical events in the world. Fig. 4 illustrates the percentages of events initiated by hydrogen or non-hydrogen systems (outer circle) and those related to different consequences (the inner circle). The outer circle illustrates that the majority 75% of the events were initiated by hydrogen systems. The inner circle reveals that apart from the 15% unignited releases and 6% near misses, hydrogen was ignited in 79% of the events with 48% involving explosions. Excluding the events, which involved fires following explosions, 31% of the considered events involved only fires. A combination of reasons was attributed to the 15% unignited releases, including prompt termination of the unintended releases and the releases being very small, etc. The 6% near misses give a promising message that early detection and prompt mitigation of any potential releases can successfully avoid escalation of the event following an unwanted release.

The analytical approaches and procedure
The analysis reported here is based on the 706 incidents, which were in the database as of May 2021. The authors of the analysis are members of the EHSP, each with long-standing expertise in hydrogen safety in their respective organisations, which include energy companies, higher education institutions, research laboratories and emergency services. A two-step methodological approach was applied by the EHSP to the HIAD 2.0 dataset. As a first step individual analysis was performed. During the individual analysis, the authors identified whether an event is worth being included in the statistics. The decisive factor for inclusion in the statistics was the quality of the database entries, which should at least allow relevant information to be confidently concluded from the description. A total of 576 of these events were considered to be statistically relevant and formed the basis for the statistical analysis to inform lessons learned and recommendations. In the subsequent sections, references are made to event ID#, which represents the unique number used to identify each event in HIAD 2.0.
To ensure consistency, a guidance document was prepared by some of the authors with input and comments from all.  The document was subsequently followed in the individual analysis by the authors when entering input in the spreadsheet to generate statistics. Six cause categories were adopted in the analysis. The first three are related to system design, material, manufacturing, and installation: -System design error: The system was not properly designed for the operating conditions or the use of hydrogen. Examples include components not compatible with hydrogen, lack of ATEX components when required, the unforeseen occurrence of the hazardous gas mixture, unforeseen pressure or temperature loads, wrong type of solenoid/electromechanical valve selected, etc. -Material/manufacturing error: Although the correct component was selected and implemented, it did not work properly due to material failure or due to a manufacturing error. -Installation error: Although the correct component was selected and implemented, it malfunctioned due to improper installation or maintenance. For example, a thermally activated pressure relief device (TPRD) was not installed on a gas bottle or cylinder or installation instructions of a safety device were disregarded.
Another three cause factors relate to human factors, for which the definition of the Health and Safety Executive (HSE) [24] includes three interrelated aspects: the job, the individual and the organisation. In the Seveso Directive [25], "organisation" is referred to as "safety management system factors". In several events, the root causes were traced back to the absence of adequate safety culture. For example, when a chemical plant sent the wrong information to a subcontractor, the actions of which then resulted in an explosion, this also indicates a lack of effective leadership, clear responsibility, and operational procedure. In another explosion incident ID 306, the vessel was wrongly cleaned with sulphuric acid (20%), which reacted with the vessel metal and accidentally generated hydrogen. This also reflects the absence of safety culture, clear instruction and staff training.
It is recognised that the definition of each of these categories can vary in different situations and by different analysts. To ensure consistency, the following examples were used by the authors to illustrate how they are classified in the subsequent analysis: -   In the first step of the analysis, the authors worked individually. The causes of the incidents or near misses were studied first along with the lessons learned which were documented when the event was reported. For those events, which did not contain such descriptions, the authors analysed the available event descriptions carefully with the aim to deduce some edlessons learned, which could have helped to avoid the recurrence of such events. For some events where additional supplementary materials were uploaded in HIAD 2.0 in the form of reports or published papers, the authors also studied those to aid the analysis.
In the second step, systematic cross-checking was conducted. This involved continuous discussion between the authors on each event with regards to the root cause(s), lessons learned and recommendations. Such procedure help to improve the quality and harmonize the decision making among the authors.

Lessons learned
The prevention of incidents requires that safety issues be considered as early as possible, generally at the design stage but also throughout the entire lifecycle. A powerful tool for this prevention is the lessons learned from past incidents. By examining the events contained in the HIAD2.0 database, different incidents were often found to have the same or similar causes. This further indicates that the sharing of lessons learned can help to improve safety. Fig. 5 compares the percentages related to the different causes of the events. As most incidents had multiple causes, the individual percentages add up to more than 100%. About half of the events were related to organizational and management factors. Material/manufacturing errors are the second main cause with a share of 35%. Other main factors include individual and human factors 29%, system design errors 27% and job factors 14%. Only 11% of the incidents were related to installation errors. An important message from this analysis is that the "soft factors" play just as big a role in the causes of incidents as technical factors.
The authors then re-examined the events with similar causes as clusters to deduce common lessons which can be learned from them. This process was also informed by the statistics gathered from the analysis of 576 events as described in Section The analytical approaches and procedure.
For clarity, the lessons learned are grouped into the following four main categories: System design System manufacturing, installation, and modification Human factors Emergency response In each category, the specific lessons learned are described and some significant incidents are highlighted. Some examples linked to specific lessons learned are mentioned and those events which warrant special attention by those in similar operations are highlighted. The last category is related to emergency response.
The overarching lesson learned is that incidents might consist of several causal events, which if occurred separately, might be trivial but if these minor events occurred simultaneously, they could still result in serious consequences. This echoes James Reason's Swiss Cheese theory. Lessons learned related to system design A number of design issues were identified as the causes of a series of incidents. An important lesson learned is that the potential consequence of not ensuring inherently safer design could be high. Some incident was caused by a design problem.
Corrosion related: Considerable number of incidents were related to corrosion, the occurrence of which was not detected through regular inspection, prevented from maintenance, or lack of due consideration of the hydrogen compatibility of materials used  Design related: Lack of precaution during the design stage to limit hydrogen inventory, placement of large inventory outdoor and adequate protection of vessels against thermal attacks, etc. were all found to result in some incidents, e.g., event IDs 542, 179, etc.
Venting: Some incidents were caused by the lack of provisions for the safe venting of hydrogen, inappropriate ventilation, and inappropriate detection system, for example by not being adequately connected to an automatic alarm. Related examples include event IDs 674 and 680, etc.
Fatigue: Some events related to a partial loss of mechanical integrity were traced back to the fatigue of components. A series of incidents were caused by a lack of periodic verification/audit of the structural integrity of the hydrogen tank. This is an important lesson to learn.
Extreme weather conditions: Lack of consideration during the design stage for adequate protection against extreme weather incidents also triggered some events. Icing could result in blockage and cause over-pressurization in some systems, e.g., event ID552. Heavy rains could lead to water accumulation and its dissociation could lead to an accidental generation of hydrogen, e.g.,eventID558.
Second-order redundancy on critical systems: Lack of secondorder redundancy in some hydrogen facilities to limit the gas flows due to malfunction of the key component, e.g.,eventID553.
Pressure relief valves: Inadequate design and/or installation of pressure relief valves in pressure systems also resulted in some incidents, e.g., event Ids 808 and 562.
Hydrogen accumulation in confined/semi-confined spaces: Several lessons can be learned in relation to this: (1) Explosive mixture with hydrogen in the stagnant zone of pipe systems are prone to cause incidents, e.g. event IDs 533 and 571; (2) Internal pump might create a vacuum inside tanks with possible air ingress to form an explosive atmosphere, e.g. event ID551; (3) Dead legs, which are sections of process piping that have been isolated and no longer maintain a flow of liquid or gas, were identified as weak points in event ID568; and (4) Pipe trench with hydrogen pipes near other hot pipes is a potential hazard, e.g. event ID544 and requires clear separation with due consideration for specific firefighting.
Hydrogen generation due to malfunction: Several incidents were caused by inadequate design which was vulnerable to accidental hydrogen generation by water splitting (ID522), radiolysis of reactor water (ID492), chemical decomposition of the heavy alcohol component in some cleaning agents (ID510).
Equipment factor: Equipment factor and poor apparatus were the causes of several incidents, e.g., event IDs 609, 612 and 613.
Interoperability: Some incidents were caused by the lack of safety design for the interconnections during hydrogen transfer.

Lessons learned related to system manufacturing, installation and modification
System-related issues such as manufacturing, installation, and modification, were identified as the causes of numerous incidents. The statistical analysis, as shown in Fig. 6, illustrates that two-thirds of the incidents occurred during normal operation, while one third occurred outside normal operation i.e., during maintenance, special services or immediately after returning from maintenance to normal routine operation.
In the following, they are grouped according to relevance. It should, however, be recognised that many incidents were caused by multiple malfunctions and some system manufacturing issues were indeed also related to design.
Material compatibility: Event ID534 in 1994 was the first reported incident related to the use of materials incompatible with hydrogen. This incident triggered the development of the German pressure vessel code and standards. Incident ID615 involving vapour cloud explosion was traced back to the crack in a storage tank releasing gaseous hydrogen to the atmosphere most likely due to the use of materials not compatible with hydrogen and the lack of periodic audit and maintenance to detect the defect promptly.
Venting system: Hydrogen venting system malfunctioning could lead to severe consequences, e.g., in eventID536, a road tanker carrying 125,000 cubic feet of liquid hydrogen caught fire when the tanker's vent stack malfunctioned. The area within a one-mile radius had to be evacuated.
Weak points: Weak points, including gauge glass for liquid tank level monitoring, flange connections, welded junctions, etc. resulted in a series of incidents.

Lessons learned related to human factors
Human error is unavoidable. However, when handling hydrogen or any other flammable gases, the consequences of human error can be severe. Small mistakes can also cascade into more serious incidents. As shown earlier in Fig. 5, the "soft factors" which include organisation and management,

Lessons learned related to job factors and individual/human factors
Most incidents reported under this category were caused by a lack of regular/appropriate maintenance and inspection. Some could also be attributed to unclear instructions. The lessons learned include: Lack of regular and timely maintenance and inspection: This was frequently identified causes of incidents, e.g., event IDs 101, 106,185,194,196,241,405,410, 621, 661, 702, 703 and 708.
Special attention for safety devices during maintenance: Fittings, gaskets, flanges, valves, etc. were often identified as weak points in hydrogen systems. Lack of special care on these components during maintenance and inspections as well as lack of periodic audit on such devices resulted in serious consequences, e.g., event IDs 156, 249, 542, 547, 559, 601 and 678.
Individual/human factors: These were found to result in fault in equipment and procedures, e.g., incorrectly installed pipes (ID679) and non-compliance with company procedure (ID 675).
Lack of clear instructions: Some incidents were caused by a lack of adequate process instructions or such instructions were not readily available. Examples include event IDs 321 and 672.
Accidentally generated hydrogen: Wrong identification of chemical components led to the accidental generation of hydrogen in some incidents due to unwanted chemical reactions, e.g.between acids and metals (event IDs 49, 192, 234, 321 and 530) or others (event ID 123).
Reoperation after repair: There were 23 incidents, which occurred due to a lack of appropriate checking to confirm that it was safe to resume operation after repairing/maintenance. For example, the fire in event ID579, which resulted from an escape of liquid hydrogen from a joint between an isolating block valve and a relief valve on one of the separations columns preheaters, occurred when the relief valve was firstly brought back into operation following repair.
Re-use of tanks or pipes previously contained flammable liquid or gas: Lack of thorough degasification and appropriate safety procedure was responsible for several incidents. Examples include event IDs 531, 631, 673, 750 and 752.
Lack of adequate staff training resulted in a relatively large number of incidents. Some incidents occurred because the training procedure was insufficiently stringent or updated in line with operational changes, leading to a significant number of incidents due to human errors. Examples include: Some key interventions critical for plant operation were bypassed, ignored, or silenced by the responsible personnel (blockage devices, alarms of extreme intervention, etc.), e.g., event ID538. Some drivers of hydrogen tankers were not adequately trained on the associated hazards (event IDs 754, 755 and 756) and were unaware of the need to avoid routes in the vicinity of buildings and populated areas. Drivers failed to monitor the pressure of the filter, e.g., event ID 661. The system was not purged regularly, e.g., event ID 661 or thoroughly, e.g., event ID 663. The design and operation conditions were not adequately verified, e.g., event ID 664. Emergency procedures were not updated or followed, e.g., event IDs 665 and 666. Lack of training about the procedures to handle accidentally generated hydrogen, e.g.event IDs 681, 685 and 688. Some incidents, e.g., event IDs 495 and 686, were caused by a lack of efficient communication between shift and day staff, and inadequacy in key routine tasks like plant inspection. Some incidents were caused by workplace safety violations, e.g., event ID 429.

Lessons learned related to the safety system management factors
Lessons learned due to inadequacy in this sub-category of factors include: Lack of up-to-date inspection plan, infrequent inspection frequency and insufficient scope of the inspected components. Insufficient check of safety equipment, leakage tests and lack of inspection for hydrogen embrittlement. Inappropriate safety procedures for the modification/ improvement of the plants, especially when external companies. Lack of safety supervision during certain repairing works and the need for extreme precautions when soldering, using a grinding machine or impact wrench. Lack of adequate procedures for fast isolation of the release sources.
Lack of clear guidance about the lifetime of critical components in addition to their regular inspection and replacement. Lack of explosivity control before maintenance on a running plant. Lack of clear distinction between emergency and operating alarms in hydrogen system units.

Lessons learned for the emergency service
The lack of insight and knowledge due to insufficient training of the technical personnel, mentioned in Section Chemical/ petrochemical sector is also applicable to the personnel of the emergency services. As hydrogen energy applications are still relatively new, first responders are generally less equipped with the knowledge about the various accident scenarios they may encounter and do not know enough about how to respond. This statistical analysis has therefore directly contributed to the updating of the European Emergency Response Guide [14].
Quick action to limit inventories could help prevent the escalation of an incident. In responding to event ID487, which involved 60 feet jet flames from compressed hydrogen gas inside a tanker truck, firefighters climbed on the tanker truck during the incident to shut off the other nine tubes so their contents would not burn off as well. Quick action to limit inventories is an important lesson to be learned. Of course, this is only possible if, together with the emergency services, prior intervention plans are provided on the basis of crucial and relevant technical information. The installation and the specific emergency operation in the function of the different incident scenarios must be known to the intervening emergency service. Dedicated consultation and common exercises and training are very important.
Poor drainage can inhibit the effectiveness of the emergency response. Event ID547 indicated that firewater drainage is a longstanding problem at many disaster sites. The installation of a draining system in the construction plans of the plant (fire prevention advice) will help to improve the effectiveness of emergency response in case of an incident.
Lack of sufficient evidence gathering has hindered some investigations. The explosion in ID575 was one of the largest industrial hydrogen explosions reported to date. The accident occurred due to a combination of operational error, technical failures, and weakness in the design. The explosion caused a large number of fragments representing a severe hazard with window glasses being broken up to 700 m from the centre of the explosion. Domino incidents such as fires were behind the severity of this incident, and common after many gas explosions. The investigators drew some important lessons including delayed documentation of the damage; lack of involvement from explosion experts and structure engineers; lack of photographic evidence covering both area view and specific damages to aid the investigations; and insufficient collection of fragments, their original and landing positions and damage indicators to aid accident investigation.
Extinguishing the fire while hydrogen was still escaping could result in more serious hydrogen explosions. This is an important lesson to be learned as hydrogen is highly flammable. Event ID539 clearly indicated the importance of an efficient safety crew to manage some fire incidents.

Recommendations
In order to facilitate the formulation of recommendations, analysis was conducted to establish how the occurrence of the events was linked to the violation of safety procedures and good safety practices. This was conducted on the basis of the guidance document for "Safety Planning for Hydrogen and Fuel Cell Projects" published by the EHSP [25]. The document was based on the safety principles developed by the international hydrogen safety community. A list of 10 safety principles was extracted by Task Force 1 of the EHSP from several widely used safety strategies and grouped in tiers according to the actions required to prevent an escalation of prototypical hydrogen accidents as shown in Fig. 7. During the present analysis, the ten safety principles were firstly applied with the view to formulating recommendations from the events in HIAD 2.0. To reflect on the fact that a significant number of events shared a common cause related to the poor design of the hydrogen system or the use of material that is not compatible with hydrogen, an additional principle SP0 has hence been added.
The 576 incidents in HIAD 2.0considered to be of statistical value as of May 2021 were individually analysed by the authors based on the available incident information. The recommendations were provided against each incident based on Safety Principles (SP0-SP10). However, it has been noted that for some events, the safety principle suggested by an individual expert is the best guess based on the information available from HIAD 2.0 database. The EHSP has since devised a consistent methodology to determine the relevance of the incidents to specific safety principles to be implemented next year for further harmonisation of the analysis by different experts.
The results of the analysis are shown in Fig. 8. Out of the 576 incidents considered, the major contributing factors were from SP9 (53%), SP0 (31%) and SP10 (28%). The data clearly shows that lack of training of operators/plant personnel and lack of understanding of hydrogen hazards is a key area that needs further improvement. In addition, the lack of a system to report near misses/incidents and apply learning from it for further development of a safety plan is another area that has contributed to these incidents. The results also show that poor design of the hydrogen system and the use of incompatible material are frequent causes of many accidents (31%).
The recommendations are subsequently derived by combining the above analysis and the lessons learned described in Section Lessons learned. The recommendations have been obtained for each sector. They also incorporate some recommendations which were available in the event descriptions. Table 2 illustrates how the recommendations are grouped. Due to the space limit, the "Nuclear" sector is not included as there is ample technical literature concerning hydrogen safety in the nuclear sector. It should be mentioned that the importance of inherently safer design is embedded in these

Recommendations for different operational modes
Approximately two-thirds of the considered incidents occurred during normal operations while around one third took place outside normal operations during testing, maintenance, starting after maintenance, etc. The key recommendations include: -Adequate training of personnel is key (SP9) and of utmost importance. -Both passive and active safety measures should be given a crucial role. Leak detection (SP4) and ATEX zoning (SP3, SP5) should be applied to reduce the opportunities for incidents. -It is necessary to keep the equipment and systems up to date and clean with appropriate surveillance and maintenance. Updating maintenance procedures to consider changes is crucial (SP8).
Finally, a thorough risk/hazards assessment should be performed during the design phase and before any process or equipment change.

Hydrogen energy applications
An important goal of the EHSP is to promote and facilitate safety in all FCH 2 JU funded projects and further in other hydrogen energy applications. This section includes recommendations for the sector of the highest interest to fuel cell and hydrogen energy applications, which are subject to improvement in the future.
Hydrogen transport, distribution and storage. The general recommendations are that effective safety training of the personnel should be enforced (SP9). Learning from incidents and near misses in the past (SP10) is essential to avoid new incidents. Inherently safer design should consider both the stand-alone system as well as the interconnections, e.g. while transferring hydrogen it is necessary that appropriate systems fittings work perfectly on both sides of the transfer. Maintenance should be performed by qualified personnel and there is the need to install some extra safety barriers such as hydrogen sensors and other leakage detection equipment, breakaway devices and a second strap for cylinder hold (e.g., SP2, SP8).
Recommendations to reduce traffic incidents: The Drivers should be trained about hydrogen safety. Special consideration needs to be given to the training of drivers for liquid hydrogen trailers (SP9), which is relatively new to many drivers. The driver must at least know enough about firefighting, to inform the first responders arriving on site. This would guarantee that the knowledge of the vehicle and the transported gas is passed to the locals. Drivers should be reminded about the need to avoid fatigue through regular   It should be noted that in certain incidents, this resulted in the need to change standards/codes for pressure vessel (SP8); and -Install high fidelity leak detection and other extra mitigation barriers (e.g., SP4, SP8).
Recommendations related to material failure: Regular inspection and maintenance should be carried out. The installation mitigation barriers such as hydrogen and pressure sensors should be installed for the early detection of hydrogen leaks (SP4, SP8). Care should be taken to avoid any ignition sources in the areas with hydrogen leaks as well as the correct functioning of hydrogen venting devices.
Hydrogen-powered vehicles. Currently, there are relevant incidents in HIAD 2.0. For example, event ID82, which involved a postal service mail truck trailer, was a near-miss caused by a traffic accident. The near-miss nature was very much because relevant safety principles were followed. The other events mainly included 8 near-missed related to hydrogen fuel cell buses and 1 hydrogen leak on a fuel cells bus in a confined space. It is recommended that responsible personnel should be adequately trained and educated about hydrogen safety (SP9)and all near-misses should be reported (SP10).
Laboratory/R&D. It is necessary for safety to be adequately addressed in R&D laboratories involving hydrogen. Thirteen incidents were reported by this sector. Two of these occurred outside normal operation and the rest happened during R&D operations. The explosion was the most frequent consequence. Recommendations to minimize the occurrence of such incidents include: Comprehensive risk analysis for each specific activity to identify safety measures required, including leak detection.
Periodically update safety procedures, appropriate measures to ensure adherence to such procedures and adequate training for personnel involved. Periodic inspection and maintenance of equipment, especially safety devices (valves) and testing protocols.
Power generation. The many years of operational experience in this sector, which included a series of incidents involving hydrogen, provides a valuable basis for recommendations to benefit not only this sector but also other sectors. There are currently twelve incidents involving hydrogen in the nonnuclear power generation sector in HIAD 2.0. The following recommendations were derived from their analysis: -Periodic and frequent inspection and maintenance of equipment, giving particular consideration to material failure and malfunctioning of systems. -Regularly updated testing procedures, including ATEX requirements, especially in case of changes.

Other industrial sectors
Aerospace Aerospace is one of the first industrial sectors for hydrogen application. The aviation sector is also at the forefront of the global move towards net-zero emissions. The 6 incidents in HIAD 2.0 involved space shuttles as well as aerospace applications with 1 unignited hydrogen release and 5 explosions followed by fires. Excluding the Hindenburg disaster, which was not fuelled by hydrogen, the severity level of other accidents was high, e.g.there were 7 fatalities in one space shuttle explosion.  i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y x x x ( x x x x ) x x x Chemical/petrochemical sector More than 60% of the events in HIAD 2.0 occurred in the chemical/petrochemical sector. In formulating the recommendations, care was taken to highlight the safety principles, which linked to greater occurrence rates as shown in Fig. 8.
As already mentioned, most incidents had multiple causes. Many incidents were triggered by a combination of technical failure, design, material and human errors. Several recommendations can sometimes be drawn from one event alone. Equally, several events may also form the basis for one specific recommendation. For example, inadequate leak and fire detection as well as passive safety countermeasures (SP4/SP8) were related to 26% of the events. For clarity, a comprehensive range of recommendations formulated are grouped into several categories: Recommendation related to reduce H2 leaks leading to fire/ explosion Early identification of leaks with hydrogen sensors, appropriate provisions of fire/simple alarms and automatic control of the shutdown systems by leak or fire detectors (SP4). Monitoring of critical process parameters such as pressure, temperature and hydrogen concentration. This is of critical importance for early identification of initiating events such as corrosion, fatigue, overpressure, thermal stress as well as fouling or blockage. Periodic inspections are essential to prevent incidents in equipment that has undergone repairment (SP8). Always use inert gas for testing and cleaning equipment (SP8).
Recommendation related to reduce the impact of consequences in case of fire and/or explosion Implement mitigation measures such as protective walls. Enforce safety distances to avoid/minimize domino effects (SP8).

Recommendations for specific process equipment
Inherently safer design is critical. Equipment must be fit for the specific process requirements and materials used need to be compatible with hydrogen and other streams processed. Provide mitigation measures and enforce safety distances. Ensure that inspection and maintenance, including cleaning and other outside normal operation activities, are carried out under an inert atmosphere. Enforce ATEX zoning.

Specific recommendations for pipelines
It is essential to carry out periodic inspections of pipelines and associated connections for the early identification of problems like corrosion or embrittlement. Regular inspection and maintenance of components like seals, flanges and elbows.
Monitor process parameters. Provide adequate shutdown systems to limit inventory in the event of leak/rupture.

Recommendations concerning human factors
Regular and updated training (SP9) Regular training of personnel about safety procedures during operation and maintenance. Establish safety protocol(s) and enforce staff to follow. Training on safe operational management covering: o criticality of using only ATEX equipment in the "proximity" of a hydrogen venting, oconnection procedures of gas cylinders, oimportance of pre-start safety checks, and oregular inspection of pressure vessels against permitted operating conditions. ospecial procedures to avoid extreme operational changes. Additional training on safety-critical areas and aspects such as pressure equipment and substances which may be mixed with hydrogen under operational and/or accidental conditions. Updated training following any changes in the procedures for start-up, inspection, maintenance, shut-down and emergency plans. Repeated training at regular intervals. Extend the training to relevant external emergency services. Establish an effective permitting system for personnel involved with maintenance activities.
Promote safety culture, report events and develop a safety plan (SP10) Frequent, including random inspections and updating the start-up, inspection, operation, maintenance and shutdown procedures in case of any changes. Ensure operating procedures are appropriate and compatible with all operating/maintenance conditions. Ensure that the equipment and materials are compliant with operator requirements. Any deviations on working procedures should only be allowed after thorough evaluation. Any deviations on process changes should only be allowed after thorough evaluation. Determine, document and inform relevant staff about the safe operating window of process parameters like temperature, pressure and flow rate, etc. Updated and appropriate safety management procedures should be in place. Adequate supervision for critical repair/maintenance works. Communicate any changes in procedures to staff and subcontractors promptly. Implement lessons learned from past events in the safety plan.
i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y x x x ( x x x x ) x x x