Why Research into Explosion Mechanisms of Flammable Cloud Is Still

Sep 8, 2011 - Why Research into Explosion Mechanisms of Flammable Cloud Is Still Necessary: Reducing Uncertainty Will Make Risk Assessment and Decisio...
0 downloads 4 Views 892KB Size
Download PDF
ARTICLE pubs.acs.org/IECR

Why Research into Explosion Mechanisms of Flammable Cloud Is Still Necessary: Reducing Uncertainty Will Make Risk Assessment and Decision Making Stronger Hans J. Pasman Mary Kay O’Connor Process Safety Center, Artie McFerrin Department of Chemical Engineering, Texas A&M University, College Station, Texas 77843-3122, United States ABSTRACT: Maintaining the process industry, including power plants, has become crucial to our way of life. The process industry, however, involves large quantities of hazardous substances that when spilt may present a threat to cause an explosion, a sustained fire, or a toxic cloud. These potential threats to life, structures, and the environment can be balanced by a variety of measures and ultimately by sufficient space. The central problem in spatial planning and licensing of plants containing substantial amounts of hazardous substances or planning transportation routes of these substances is to make decisions about safe distances in an environment of conflicting interests and large uncertainties, which are sometimes accompanied by emotions and “strong” perceptions. The uncertainties are due to incomplete knowledge about what can go wrong, how wrong it can go, and how likely it can go wrong. Improvements are sought in accordance with the International Risk Governance Council framework, learning from experiences elsewhere, maintaining robustness, but where required taking account of case specifics, including safety measures, improved models, and data and stakeholder outreach. Separate judgment of severity of consequences including injuries and other damage, and of likelihood categorized in probability classes accounts to some extent for uncertainty. Where possible the system of analysis shall be kept simple and affordable. Simplicity presumes, however, detailed knowledge of the mechanisms.

1. INTRODUCTION With the growing world population, the process industry has become indispensable by providing even elementary commodities such as energy in different forms, materials of all kinds, water, food, and waste removal/recycle. The process industry, however, inherently involves large amounts of substances that for a rather large extent are flammable, toxic, and sometimes oxidizing or explosive. Explosions of dispersed flammables in air are by far the largest damage causing phenomena. Notorious are the vapor cloud explosions (VCE), which have raged through refineries and chemical plants. The VCE phenomenon became very widely known with the accident at the Buncefield oil storage and transfer depot, Hemel Hempstead, U.K. on December 11, 2005, and the disaster of the Transocean Deepwater Horizon offshore platform in the Gulf of Mexico on April 20, 2010, also started with a vapor cloud explosion. The Buncefield VCE was the result of simply overfilling a gasoline tank, however the violence of the explosion was entirely unexpected and still after very intensive investigation not fully explained.1 In the aftermath, more stringent regulation will have a quite significant impact on protective equipment investment and space requirements. The University of Naples Frederico II and the Institute of Research on Combustion (IRC CNR) directed by Prof. G. Russo contributed actively to elucidate the mechanisms involved in gas explosions. The present paper will present a possible future case that shows why further research will help to make the world safer. This will be done by focusing on a potential vapor cloud explosion example in a broad context of considering, assessing, and perceiving risks rather than going into technical details. r 2011 American Chemical Society

2. ENERGY NEEDS AND CURRENT TRENDS For various human activities, energy is needed and especially with increases of living standards in growing amounts. Physical constraints, economics, and ease of use determine whether the supply is in the form of electricity or some type of fuel. In contrast to fuels, electricity is difficult to store, which makes fuels in many applications such as driving vehicles the preferred option. Therefore close to population centers, huge amounts of fuels are generally stored and distributed to selling points. Unlike radioactive materials and explosives, fuels produce energy at the instant their vapor reacts with oxygen from the air. This rapid conversion of fuel to energy is why fuels are called energy carriers. In case the fuel is volatile and accidentally a volume of vapor premixed with air is formed, this reaction can become uncontrolled and can lead to explosion with disastrous effects. This is why most fuels are classified as hazardous materials in higher hazard classes with higher volatility (e.g., based on flash point). As a society we are familiar with fuels such as gasoline and diesel (gasoil), and although classified as such they are not considered to be particularly hazardous. Gaseous fuels like natural gas, hydrogen, and to a lesser extent LPG, however, are more hazardous. Storage and transportation of these fuels are so far mostly under pressure, which at loss of containment produces a cloud that disperses while mixing with air. Certainly in a situation of Special Issue: Russo Issue Received: May 31, 2011 Accepted: September 8, 2011 Revised: September 4, 2011 Published: September 08, 2011 7628

dx.doi.org/10.1021/ie201165g | Ind. Eng. Chem. Res. 2012, 51, 7628–7635

Industrial & Engineering Chemistry Research semiconfinement, ignition of such a cloud can cause explosion and damage. Large-scale storage dictated by high fuel consumption rates in cities enhances both the probability of loss of containment and the mass escaping, and therefore many measures and safeguards embodied in standards and codes are devised to counter this threat. These standards also require sufficient distance between stores and among the depot and other industrial activities and dwellings. Of compressed gases, most experience has been obtained with natural gas, which has been transported by pipeline at pressures up to 100 bar over large distances and stored in large cryogenic tanks as liquefied natural gas, LNG. For many years this transport has been practiced with few incidents, although pipelines have to be continuously surveyed to avoid damage by digging activities. A well-known large pipeline explosion and fire accident is the one at Ghislenghien or Gellingen, Belgium, in 2004 with 24 fatalities and 132 injured. The direct cause of this incident was damage caused to the pipeline by digging work, whereas the large number of victims was due to inadequate land-use planning and lack of coordination. Transportation by pipeline over distances larger than 3000 km becomes economically unfavorable compared to liquefaction (LNG) and transport by ship tanker. Because of huge amounts of shale gas that have been found around the world in the past few years, cryogenic LNG transportation is expected to increase. Hydrogen would be an ideal renewable fuel from the point of view of combustion without carbon dioxide production as it has a high specific caloric value of 142 MJ/kg, hence per unit of mass about three times that of a hydrocarbon. An overview of organizations and platforms active in promoting hydrogen as a fuel can be obtained from the EU.2 Demand can be expected to grow in particular where, in view of sustainability renewable (wind or solar), electricity is available in fluctuating quantities and conversion to hydrogen will enable energy storage and use as an automotive fuel, as well as a fuel for cooking and heating/ powering homes and work places (fuel cells). Use could go up as high as 1 kg per inhabitant per day (with no other energy means and including industrial activities). Mixing of hydrogen with natural gas and making use of existing facilities may, however, also be a serious option. Distribution per pipeline would be helpful. The disadvantages of H2 are its low density and high leak proneness and—because of its high reactivity—low degree of inherent safety. Hydrogen has wide explosion limits (4 75 vol%) and extremely low ignition energy (∼ 0.02 mJ). Three storage modes are in principle available: compressed (CH2), liquefied (LH2), and absorbed. Compression for containers in cars is envisaged to pressures as high as 700 bar (density ca. 35 kg/m3), but for larger containers pressures remain much lower. The boiling point of liquefied hydrogen at atmospheric pressure is 20 K with density of 71 kg/m3. Because absorption would be the best solution from a storage density and safety point of view, experiments with various hydrides have been performed for many years. An economically viable solution of easy absorption and desorption while in use, however, has yet to emerge. Nanotechnology offers new possibilities, and also a concept is being developed to convert CO2 and H2 reversibly to formic acid, HCOOH, over a catalyst3 claiming a hydrogen density of 53 kg/m3. Attempts are being made to compensate for the low inherent safety of compressed and liquefied states by providing risk based standards and codes for storage and processing equipment together with site layout and application of the appropriate materials and designs. Training of personnel and learning from previous incidents also are important factors.

ARTICLE

There is a tendency within the public to regard new hazards with mistrust, and the reputation of hydrogen is not unblemished. One mishap can throw the introduction of a technology back for years. Risk assessment will be the basis for optimum land-use planning. A timely safety review of a project considering necessary safeguards and determining under which conditions a license can be issued can prevent damage and irreparable loss of image. Therefore, we shall briefly review measures to curb risks of hydrogen as a potentially useful energy carrier and uncertainties with respect to its risks.

3. HAZARDOUS SUBSTANCES REGULATION To protect workers, the public, and the environment against damaging effects of hazardous substances in case of mishap and leakages, governments promulgate regulations, which is usually initiated by catastrophic events. In general, the main division in a body of regulation is to protect the health and safety of the worker on the one hand and the safety of the public and the environment on the other. The worker can be exposed to more direct contact hazards such as, e.g., in case of hydrogen asphyxiation and cold burns, while the hazards of explosion and fire in particular for large scale releases will have impact on workers but also the public at larger distances from the source. OSHA, the Occupational Safety and Health Administration of the U.S. Department of Labor, triggered by the Bhopal disaster in 1984, initiated various laws with the aim of protecting workers against the potential effects of hazardous materials. The organization issued the PSM, Process Safety Management, rule 1910 of February 24, 1992 (29 CFR § 1910.119).4 It states that Process Hazard Analysis must be performed to determine measures necessary to protect workers, the community, and the environment. Some years later EPA, the Environmental Protection Agency, devised regulations to protect specifically the public and the environment. The agency published in 1994 the EPA List of Substances and Threshold Quantities for accident prevention program (40 CFR 68.130). Hydrogen is included in this list at a threshold amount of 10 000 lbs. Subsequently, in 1996 the Accidental Release Prevention Requirements: Risk Management Program Rule (RMP, 40 CFR Part 68)5 was issued. The latter was mandated by the U.S. Congress in the 1990 Clean Air Act Amendments and built on the Emergency Planning and Community Right To Know Act of 1986 (EPCRA). The RMP rule contains three components: 1 A Hazard Assessment, which includes off-site consequence analysis on the basis of a worst case scenario and serves as a basis for land-use planning. 2 A Prevention Program. 3 An Emergency Response Program. In Europe the Directives of the Commission provide a compelling collection for the national regulation of the Member States. To protect workers, the European Framework Directive on Safety and Health at Work (Directive 89/391 EEC) was created in the late 1980s. This directive was followed by several others among which the Machinery Directive 2006/42/EC (formerly 98/37/EC) provided the harmonization of essential health and safety requirements for machinery. Also issued in 2006, the ATEX directives6 aimed to provide protection against explosive atmospheres: • ATEX 95 equipment directive 94/9/EC, Equipment and protective systems intended for use in potentially explosive atmospheres; 7629

dx.doi.org/10.1021/ie201165g |Ind. Eng. Chem. Res. 2012, 51, 7628–7635

Industrial & Engineering Chemistry Research • ATEX 137 workplace directive 99/92/EC, Minimum requirements for improving the safety and health protection of workers potentially at risk from explosive atmospheres. By these ATEX directives, employers must classify areas into zones where hazardous explosive atmospheres may occur. The classification given to a particular zone, and its size and location, depends on the likelihood of an explosive atmosphere to occur and its persistence if it does occur. The Seveso-directives focused on protection of the public and the environment. The reactor run-away accident at Seveso in Italy resulting in spreading highly toxic dioxin gave rise in 1982 to the European Union Directive 82/501/EEC known as Seveso I, which was replaced in the mid 1990s by Directive 96/82/EC, nicknamed Seveso II,7 upon which, subsequent to the 2001 Toulouse ammonium nitrate explosion disaster, a first Amendment followed in 2003.8 The directive first defines for a hazardous substance a mass threshold above which the directive will apply and operators of an establishment must notify the competent authority. For hydrogen this threshold is 5000 kg for Tier 1 establishments, which only have to demonstrate they have a major accident prevention policy, and 50 000 kg for Tier 2 or Top Tier establishments, which have to draft a full safety report. Article 12 Seveso II introduced the new requirement for land-use planning. In general, the trend has been a migration from a prescriptive to a risk-based regulatory approach. Regarding transportation, the United Nations Economic and Social Council issued the UN Recommendations on the Transport of Dangerous Goods.9 This document forms the basis for most regional and national regulatory schemes. The recommendations group dangerous goods into classes with different properties. Gases belong to UN Class 2, with flammable gases in Division 2.1. The Recommendations include labeling and packaging prescriptions, which in case of compressed hydrogen will be pressure receptacles. In line with these recommendations, there are road, rail, waterway, and sea transportation regulations in the ADR/RID/ADN and IMDG codes, respectively. For an overview, see ref 10.

4. STANDARDS AND CODES FOR SAFETY Small amounts of hydrogen are usually stored in the compressed state. Because of the small size of a hydrogen molecule and therefore its low viscosity and high diffusivity, hydrogen is very leak prone. There is even the phenomenon of permeation in which the molecule diffuses through materials such as metals, so that even without physical leaks it can escape slowly from its containment. Hydrogen also weakens metals, e.g., austenitic stainless steels, by embrittlement, blistering, and stress corrosion cracking, so that special coatings are needed. Because of its low density, it has high buoyancy. In the open air this is an advantage, because it disperses easily, but inside containment (buildings) it fills up the space from the top (ceiling) down with a concentration within the explosive range. It therefore requires adequate ventilation to prevent buildup of a hazardous mixture. Properties of hydrogen can be found, e.g., in Hyper IPG11 together with an overview of codes and safety measures. In general, a large body of safety standards and codes of practice for compressed gases has been created by several (international) committees, such as the Compressed Gas Association, CGA, in the U.S. and the European Industrial Gases Association, EIGA. The latter organization also issued recommendations for constructing a tank station.12 Because compressed

ARTICLE

Figure 1. Risk analysis flow scheme known for several decades showing the calculation steps of physical effects and damage and the respective probabilities of the scenario events.

gases are contained in pressure vessels, pressure vessel codes such as the EU Pressure Equipment Directive (97/23/EC)13 also apply. More specifically for hydrogen, the National Fire Protection Association (NFPA) in the United States developed NFPA 2 Hydrogen Technologies Code, NFPA 50A Standard for Gaseous Hydrogen Systems at Consumer Sites, and NFPA 50B Standard for Liquefied Hydrogen Systems at Consumer Sites.14 The CGA recently reaffirmed Guidelines for the Classification and Labeling of Hydrogen Storage Systems with Hydrogen Absorbed in Reversible Metal Hydrides15 and issued earlier several other installation standards for compressed and liquefied hydrogen applications. In Europe, over the last ten years within the EU Framework Programme 6 (FP6 2002 2006), several research projects within the EC Network of Excellence HySafe16 have been carried out to investigate the safety of hydrogen systems. This resulted, e.g., in documents such as D113, Initial Guidance for Using Hydrogen in Confined Spaces,17 and HYPER Installation Permitting Guidance for Hydrogen and Fuel Cells,11 mentioned before. Summarizing, there is a solid body available of practical safety guidelines, standards, and codes for various modes of storage and use of hydrogen. Material Safety Data Sheets are readily available from the web. It may also be expected that when the scale of use of hydrogen is increasing, hydrogen-compatible pipe connectors and other components will become available on the market for use in both industrial installations and homes.

5. RISK ASSESSMENT AND ITS LIMITATIONS The most comprehensive way of obtaining an overview of the risks posed by a stationary installation or a transportation system containing hazardous materials is to perform a risk analysis and make an overall safety assessment. Over the years the tools for risk assessments have been refined and applied on many cases,18 but they also suffer from weaknesses. During the HySafe project, various risk assessment studies on hydrogen tank station were performed.19,20 Recently, a study was carried out by Moonis et al.21 with respect to hydrogen bulk transportation, storage, and distribution infrastructure. The analysis on which an assessment is based can be done in various degrees of depth and detail. Qualitative risk ranking is the 7630

dx.doi.org/10.1021/ie201165g |Ind. Eng. Chem. Res. 2012, 51, 7628–7635

Industrial & Engineering Chemistry Research most superficial way, although to avoid ambiguity (semi)quantitative intervals should be estimated for ordinal or linguistic scales of likelihoods and effects. On the other hand, in-depth quantitative risk assessment to take into account cascading and escalating scenarios with extensive failure rate determination and use of sophisticated computational tools to predict possible effects and consequences is the other effort-intensive extreme. The appropriate level of detail depends on the purpose of the assessment and the circumstances. To discuss the strength but also the weakness of risk assessment and with that the way opponents of a project always try to make the results disputable, the most extensive version will be briefly described. In Figure 1 a flow scheme of the analysis is given. More detailed descriptions of risk assessment methodology are available in various textbooks or in the series of articles on the EU project ARAMIS.22 A risk analysis starts with an inventory of possible mishaps. This is not the easiest step in the analysis, rather the most difficult one, and its reliability depends on experience gained from the installations under examination. In describing scenarios, risk analysts can overlook possibilities, and variability in outcome can occur where one analyst thinks of a certain possible scenario and another does not. For hydrogen, experience is limited, but a database of incidents has been established23 and can be consulted to stimulate the mind. A structured way to go forward is to consider all individual components of an installation and perform a failure mode and (semiquantitative) effect analysis, FMEA, in combination with sectioning the installation in parts from a process point of view and perform an analysis of possible process deviations and their (semiquantitative) effects: a hazard and operability study, HAZOP. These studies should be done by a multidisciplinary team. The combination of the two may reveal failure possibilities and resulting effects on components produced by qualified manufacturers in regular use, also failures induced by wrong operations, e.g., overfilling, overpressurizing, failing to keep the temperature range, and bad maintenance. Once scenarios of loss of containment of hydrogen have been identified and defined, the rate of leaking must be calculated (source term), and the spectrum of possible follow-on consequence events must be analyzed. For an overview of probabilities of occurrence of various phenomena given a release condition, an event tree can be drawn. Possible phenomena following an accidental gaseous hydrogen release, once ignited, are jet fire, flash fire of a cloud (short ignition delay), fire ball if the rupture of the vessel was catastrophic, confined explosion of a premixed hydrogen air gas in a closed volume, and explosion of a hydrogen air cloud in the open. The latter can occur only after considerable ignition time delay and depending on conditions of total explosive mass, concentration, confinement, and congestion, such an explosion can produce a violent blast. In case of a liquid hydrogen spill, in addition to the possibilities already mentioned, a pool fire will be possible. Prediction of the effects of these phenomena by computational tools has been the subject of many studies. Known are the Standard Benchmark Exercises Problems (SBEPs) on dispersion and explosion collectively worked on by partners in the EU HySafe network24 of which several results have been published in the International Journal of Hydrogen Energy. Also, much work has been done by others, e.g., at Sandia National Laboratories (jet flames) and at other institutions in the United States as well as in Japan. Given the effects of a release in terms of heat radiation intensity as a function of distance to a flame, possible blast overpressure, and impulse from an explosion, distances can be

ARTICLE

determined at which certain levels of harm can be inflicted to exposed people (light and heavy injury, death) and of damage to structures (light, repairable, irreparable, catastrophic). The probability of sustaining a certain level of harm or of damage given the intensity of the threat is derived by means of appropriate probit relations. The widest harm distances can be by toxic cloud, but toxic incidents are much less frequent than explosions. The hardest to estimate is the probability of occurrence of a scenario over the time of use of the installation, hence the expected initiating release event frequency via that particular scenario. In principle this can be found by building a fault tree starting at the base from failing basic components up through the branches of the tree connected by AND and OR gates representing subsystems to the top initiating event, taking account at the same particular time the functioning or failing of safeguards. Independent or dependent failure rates of basic components such as pipes, pumps, and vessels are based on experience and extracted from database collections. However, apart from the various modes in which a component can fail, another problem arises if one is discriminating according to the cause of the failure: Has it been a design failure, was it a material failure that escaped the quality inspection, has the part been mounted wrongly, are the plant conditions unforeseen hostile, e.g., vibrating, did the operator overstress the component, or has it been maintained badly? A way out is to split the factors into two groups: one group of residual defects remaining after qualified design, component production, and mounting according to specification and based on best practices, and another group of defects introduced during operation and maintenance. The latter is influenced by the management quality of the operating unit. It is clear that the data collected in the database have to be scrutinized accordingly. For hydrogen systems, an additional problem is the relative lack of data, and moreover, manufacturers and users are reluctant to publish data because of legal implications in case of accident. Fortunately, a reasonable inventory of failure data has been collected over the years of hydrocarbon installations, in particular off-shore data. LaChance et al.25 used these data as a prior distribution in a Bayesian approach and combined the prior with scarce hydrogen data to a posterior distribution applicable to a hydrogen installation. The Bayesian approach to combine all available information is certainly the best that can be done to support optimum decision making. Fault trees and event trees are today often combined to a socalled bow-tie or butterfly diagram with the critical release event in the center, in which also the preventive, protective, and mitigative safeguards in the various branches can be made visible. One can ask whether past major accidents in the process industry would have been predicted by risk analysis. The answer is not confirmative. This is not so much because the effects are different, since the number of possibilities in the phenomena is rather limited, but because of the scenario through which the release occurred was not foreseen. Therefore the expected probability of occurrence will in general be higher than estimated. The human factor has quite an influence on this underestimation of risk. Summarizing, risk assessment is a powerful tool but it is not providing very accurate answers. The uncertainty in effects and damage is at least a factor 2 and larger than this for explosion pressures, while the frequency may be off by at least an order of magnitude due primarily to unforeseen scenarios. To be scientifically correct, one can draw a confidence interval on the result of an analysis and present it as such. However, for legal purposes, such as for land-use planning and licensing, 7631

dx.doi.org/10.1021/ie201165g |Ind. Eng. Chem. Res. 2012, 51, 7628–7635

Industrial & Engineering Chemistry Research matters become less simple. Moreover the likelihood of occurrence is usually expressed as a very low frequency. This number cannot be validated, because it is statistical in nature, which implies the law of large numbers. The number of a particular type of mishap under the same conditions even on a worldwide scale will remain much too low to obtain sufficient statistical evidence that the calculated frequency is right. One has to rely on the occurrence of nonfatal failures of components, potential precursors, and near-miss incidents to validate analysis results as good as possible. The final result of the analysis is usually the risk figure of becoming killed by an incident as a function of the location with respect to the release point (individual risk) and the total number of fatalities to be expected at an incident given the population density as a function of the expected frequency (per year) of exceeding that number (group or societal risk). Other outputs such as figures on structural damage may be generated. For emergency response planning, there is also a need to predict the nature and seriousness of injuries and possibilities of self-rescue and optimal deployment of emergency response forces. Timeresolved scenario analysis is a suitable tool for emergency response, but unfortunately information is lacking at present to perform such analysis with numerical data.

6. LAND-USE PLANNING AND RISK CRITERIA Land-use planning (LUP) or spatial planning is greatly needed in our densely populated countries and urban communities. Various economic activities compete with each other for the use of space, on ground level, in the air above, and even below ground, while residential areas set strict requirements to safety, noise levels, and air quality. The planning occurs at more than one level of authority: the lowest is local, such as the municipality, where local interests may become subordinate to regional as, e.g., a certain activity passes municipal borders and finally will have a final say for purposes of national interest such as defense national government. LUP can take place when a former agricultural area will be turned into an industrial estate with residential areas, new roads, schools, hospitals, utilities, and public transport facilities at the borders. LUP is needed also when changes are made in an existing situation. The latter may be more often the case when hydrogen becomes introduced as an energy carrier. Article 12 of the EU Seveso II Directive7,8 puts a clear requirement to land-use planning policy for an assessment of the risks of major accidents for activities with hazardous materials both in a preventive sense and with respect to possible consequences. Because consequences may have a destructive effect outside the premises of a plant, public safety (and today also security) is at stake but also neighboring industrial facilities due to the so-called domino effect (Article 8). At the same time there is a requirement for emergency response planning (Article 11). The competent authority will have the decisive power whether a certain activity can be permitted. This process can proceed in stages. In an initial planning stage for “virgin” land, stakeholders can be limited to municipal representatives, and project developers and the destination given may be generic. In a later stage or in an existing situation in which a new activity has to be fit in, when a facility operator comes in, the plans become more detailed and an exact layout of the facility becomes available. In such cases besides a LUP modification, a license to operate a facility will be required. In that stage worker safety also is of interest as well

ARTICLE

as management quality. Emergency responders including a fire brigade will be involved from the start because of, e.g., access road planning to sites and deployment possibilities but also in later stages they will be involved in the role of authority with respect to infrastructural fire preventing measures. In the latest French implementation of the Seveso II Directive, one therefore has in the committee of stakeholders (Comite local d’information et de concertation, CLIC) five types of representatives: administration, local authorities, operators, local residents, and employees. If space is not a limiting factor, one can apply the worst case accident effect threshold circles (off-site consequences) around a potential source to assess acceptability of the activity as in the American Risk Management Program regulation (RMP rule, 40 CFR Part 68).5 Alternatively, one can in coordination with stake holders and introducing safety measures, consider a more credible alternative scenario. However, in many densely populated European situations, directional effects (dominating wind direction, protection walls, etc.) and probability of occurrence of an event must be taken into account to take the best advantage of available space, and the results of a full risk analysis are plotted on a geographical map to examine consequences. To be more specific on hydrogen: in case real large scale (pure) hydrogen energy is required, absorbed hydrogen not yet an option as a proven technology, liquefied storage near, e.g., a harbor will be indispensable. (Transport by high-pressure pipeline in cities is expensive and also risky). A three-days buffer storage for a town of 100,000 inhabitants, each person consuming on average 1 kg/day, yields a cylindrical tank containing 300 tonnes of H2 (about 17.5 m diameter with height to diameter ratio of 1). In that case H2 will be transported to, say, ten redistribution points (refueling stations) partly also in liquefied form. The worst credible case implies catastrophic rupture of the storage container, be it at a very low frequency. The spilled liquid will rapidly spread, boil, and evaporate, and an initially cold, dense cloud will disperse, which will lift while heating up to ambient temperature. If the cloud just burns, the effect area will be relatively small and just a bit larger than the pool; for a 300 000 kg (188 m3), 17.5-m-diameter storage tank, the maximum pool radius will be about 40 m and for a 4000 kg (2.5 m3) tank truck that radius will be just a few meters, because liquid hydrogen will be evaporating extremely fast.26 Upon delayed ignition, the vapor cloud may explode due to hydrogen’s high reactivity in air. The 0.1 bar blast consequences (1% lethality inside dwellings, minor and 10% structural damage to houses) ranges to over 1500 m for the storage tank and to 400 m for the tank truck. This estimate assumes half of the amount spilled participating in the explosion and strength of the explosion at a scale 7 10 of the Multi-Energy Model.27 No test results with this kind of quantity of LH2 are available, so validation is missing. With hydrogen, a detonation cannot be excluded. It is clear that these ranges are not easy to accommodate. The distance for a tank truck accident to 0.3 bar blast overpressure (U.K. 50% lethality inside dwellings; Dutch lethality criterion) is still 180 m. In case the rupture occurs on an urban road near an average population density of 6000 per km2, there could be 150 fatalities. Although the figures shown may be conservative, for this consequence level to be acceptable, the failure rate has to be proven extremely low (