Financial Risk Factor Analysis for Facility Gas Leakages of H 2 and NG

: Fuel cells may be the key to a more environmentally-friendly future because they emit low carbon dioxide per unit of energy supplied. However, little work has investigated the potential ﬁnancial risks pertaining to fuel cell systems. Often used in the analysis of the safety of systems involving ﬂammable or hazardous materials, risk factor analysis has recently been used to analyze the potential ﬁnancial losses that may occur from industrial hazards. Therefore, this work undertakes a ﬁnancial risk factor analysis to determine the costs of leakages of hydrogen and natural gas, which are used in fuel cell systems. Total leakage was calculated from an analysis of several leakage rates and modes. The impact of applying appropriate detection and prevention systems was also investigated. The ﬁndings were then used to analyze the consequences for various sections of the system and to calculate the overall cost based on facility outage or damage, and the cost of taking safety precautions. This provides a basis for comparison among proposed potential reactionary measures.


Introduction
Fuel cells are energy-conversion devices that directly convert a fuel's chemical energy to electrical energy via chemical reactions [1]. Unlike conventional batteries, which require charging, fuel cells can continuously supply electricity as long as they have a supply of fuel [2]. Fuel cells consist of an electrolyte material sandwiched between two electrodes, which are surrounded by oxygen and hydrogen (H 2 ), respectively. Hydrogen ions and electrons cross the electrolyte to produce electricity and water. Various fuels-including natural gas (NG), methanol, and gasoline-can be used to produce H 2 via a fuel reformer [3]. The potential for decreased emissions of carbon dioxide per unit of electricity supplied has given rise to fuel cells that are being touted as a core technology for a low-carbon, green-growth society that is more dependent on new and renewable energy sources and less dependent on fossil fuels [4].
In the Republic of Korea, several large companies are developing and testing fuel cell systems in industrial research facilities. However, systems that include H 2 fuel cells or processes that use H 2 as a fuel source risk significant losses from accidental explosions caused by H 2 leaks. Despite these risks, research and investments in H 2 energy mainly focus on technological development and commercialization of the technology and less so on the associated safety aspects.
To ensure sustainable management of the fuel cell system, this research investigates the potential financial costs of H 2 and NG leakage from fuel cell systems. The theoretical leakage rates, and modes of leakage were used to calculate the total leakage amount, which was then adjusted according to and modes of leakage were used to calculate the total leakage amount, which was then adjusted according to whether various appropriate detection and prevention systems were in place. The findings were then used to analyze the consequences for various sections of the system and to calculate the overall cost based on facility stoppage or damage, and the cost of taking safety precautions.

Problem Statement
Risk analyses on existing facilities have been conducted using qualitative analysis methods; however, these have mostly been limited to calculating the potential frequency and magnitude of accidents that may occur. Even though an accident at an industrial facility would likely also carry significant financial risk, no analyses of costs arising from accidents in industrial facilities in Korea have been reported. The studies on risk analysis of the associated H2 gas have been mainly devoted to hazard evaluation by Event Tree Analysis [5] or extraordinary phenomena associated with the release of hydrogen in a hydrogen fueled vehicle [6][7][8]. However, little research has been reported that implements exemplar case studies to investigate the consequences of accidents related to H2 gas facilities. In addition, it is necessary to analyze processes (including the production, installation, and operation of these facilities) that generate H2 from NG using reforming technology [9]. Because leaks of these two gases can lead to severe accidents such as fires, explosions, and the poisoning of ecosystems, quantitative risk evaluation analyses including financial consequences and the implementation of appropriate safety prevention mechanisms to address any risks must be carried out.

Methodology
The schematic diagram shown in Figure 1 outlines the methodology used to calculate the potential financial consequences of a leak of H2 or NG. The leakage scenario, characteristics of the fluids, nominal leakage rate, gas inventory, mode of release, and impact of any detection/isolation systems are necessary to determine leakage rate and leakage mass. These results were then used to estimate the magnitude of the associated consequences and the associated costs.

Physiochemical Characteristics of NG and H 2
Quantifying the leakage impact of H 2 or NG requires the fluids' physical properties, such as the normal boiling point (NBP), molecular weight (MW), specific heat of the ideal gas (k), heat capacity (C p ), and auto-ignition temperature (AIT). The physical properties of NG and H 2, shown in Table 1, were sourced from the American Petroleum Institute (API) [10]. The heat capacities of the fluids were calculated using Equation (1): where C p is the heat capacity of the ideal gas (J/mol·K), A, B, C, and D are coefficients of C p [11], and T is the process temperature (K).

Determining Leakage Hole Size and Pipe
To accurately assess the magnitude of the accident consequence, the leakage hole size must be selected within the range of an actually implementable size, but this is not always realistic. Therefore, it is recommended to use leakage holes that have been assessed as possible through previous experience and practice, and the leakage holes are classified as small, medium, large and rupture hole sizes according to API categorization [10]. Table 2 shows the size of the leakage holes defined in order to predict the consequence in accordance to the guidelines of API. The upper limit of the range (6.4 mm) was used for small holes. The midpoint of the respective ranges was used for medium and large holes. For ruptures (>152 mm) smaller than the pipe diameter, 406 mm was chosen.

Leakage Rate Calculation
The leakage rate is related to the physical characteristics of the gas, the initial state, and the physical conditions of the fluid in the process. The rate was calculated using Bernoulli and Torricelli's equation [12]: where W L is the fluid leakage rate (kg/s), C d is the leakage coefficient (0.60-0.64), A is the cross-sectional area of the leakage hole (mm 2 ), ρ is the density of the fluid (kg/m 3 ), ∆P is the pressure gradient, and g c is the transfer factor (1.0 kg·m/N·s 2 ). In addition, the leakage may be either characterized as sonic or subsonic. When the pressure in the facility is greater than P trans , as defined by Equation (3) and the flow was, therefore, sonic, Equation (4) was employed. Otherwise, when the flow was subsonic, Equation (5) was used [11].
where W n is the gas leakage rate (kg/s), P is the operating pressure (kPa), P a is the atmospheric pressure (kPa), k is the ratio C p / C p − R , MW is the molecular weight (kg/kmol), and R is the ideal gas coefficient (8.314 kJ/kmol·K).

Calculation of Potential Leakage Capacity
The leakage capacity of a system can be calculated by summing the individual inventories of gas in each process unit. For the leakage capacity, the smaller value between the summation of the capacity of all the facilities within the inventory group, and the additional leakage capacity to the inventory of each of the individual facilities, is used. In the event of an accident, the actual leakage capacity can be limited by separating the fluid flow using detection and isolation systems. The maximum capacity of the inventory group is calculated from the sum of the inventory capacities of the individual facilities, as shown in Equation (6) and the limiting capacity of the individual facilities. The additional capacity in the event of an accident is computed by Equation (7) with leakage rate W n associated with n-th release hole size and W max8 , which is the maximum flow rate that can be added to the release as contributed from the surrounding equipment in the inventory group. The release hole size of W max8 is limited to a maximum diameter of 8 inches because this diameter represents a practical maximum value for a release calculation with consideration of the leakage diameter 406 mm (16 inches) by rupture in Table 2 and disintegration of the equipment item together. Then, the unique inventory capacity and additional capacity of the individual facilities are summed together to calculate the capacity. The additional mass presented in Equation (7) was computed by assuming leakage for three minutes from the component's inventory group. Accordingly, the coefficient 180 is the factor converting the unit of leakage rate W n and W max8 (kg/s) into required amount of released material.
The inventory capacity and the limiting capacity were then compared and the smallest of the two was taken as the mass available to leak (Mass avail,n ): mass avail,n = min mass comp + mass add,n , mass inv (8)

Determination of Leakage Type
Leakages were determined to be instantaneous or continuous according to the standard given in Figure 2. For small holes, the leakage was considered to be continuous. For larger holes, if more than 4536 kg of fluid was released in a 3 min, the leakage was considered to be instantaneous [10].

Determination of Leakage Type
Leakages were determined to be instantaneous or continuous according to the standard given in Figure 2. For small holes, the leakage was considered to be continuous. For larger holes, if more than 4536 kg of fluid was released in a 3 min, the leakage was considered to be instantaneous [10].

Detection and Isolation Systems
Fault detection usually refers to identifying the presence of a fault in a system, in this case a leak, and fault isolation represents the separation of the faulty component among the hazards. Most process facilities have detection and isolation systems installed to minimize the consequences of accidents that may occur. Consequently, both the detection and isolation systems have a direct influence on the leakage duration ( ld ). API [10] classified the type of the detection and isolation systems as shown in Table 3, and recommended the use of the reduction factor, di fact . Table 4 shows the leakage adjustment rate with graded activation of detection and isolation. The practical and empirical leakage reduction rates, according to the detection level of Table 3, were assumed as 0.5 (A), 0.375 (B), and 0 (C), respectively. This means that when the leakage is observed by the naked eye, the leakage reduction by detection cannot be achieved. The release rates lowered by isolation were presumed to be 0.5 (A), 0.4 (B), and 0.2 (C), which gives a better reduction rate compared with detection. The multiplications of these two detection and isolation rates provide the values presented in the last column of Table 4. With this information, the leakage rate associated with the n-th release hole size ( n rate ) is corrected by the reduction factor as shown in Equation (9), and the leakage mass for n-th release hole size ( n mass ) is obtained by Equation (10).
The actual duration of the release for n-th release hole size ( n ld ) is determined by Equation (11). It is quantified by selecting a minimum value between the release mass divided by the release rate and the maximum leak duration ( max,n ld ) for each of the selected release hole sizes presented in Table 5. API [10] implemented a series of consequence analysis by a PHAST software program with release durations of 5 min, 10 min, 20 min, 30 min, 40 min, and 60 min, and evaluated the consequence area for varying release hole sizes.

Detection and Isolation Systems
Fault detection usually refers to identifying the presence of a fault in a system, in this case a leak, and fault isolation represents the separation of the faulty component among the hazards. Most process facilities have detection and isolation systems installed to minimize the consequences of accidents that may occur. Consequently, both the detection and isolation systems have a direct influence on the leakage duration (ld). API [10] classified the type of the detection and isolation systems as shown in Table 3, and recommended the use of the reduction factor, f act di . Table 4 shows the leakage adjustment rate with graded activation of detection and isolation. The practical and empirical leakage reduction rates, according to the detection level of Table 3, were assumed as 0.5 (A), 0.375 (B), and 0 (C), respectively. This means that when the leakage is observed by the naked eye, the leakage reduction by detection cannot be achieved. The release rates lowered by isolation were presumed to be 0.5 (A), 0.4 (B), and 0.2 (C), which gives a better reduction rate compared with detection. The multiplications of these two detection and isolation rates provide the values presented in the last column of Table 4. With this information, the leakage rate associated with the n-th release hole size (rate n ) is corrected by the reduction factor as shown in Equation (9), and the leakage mass for n-th release hole size (mass n ) is obtained by Equation (10).
The actual duration of the release for n-th release hole size (ld n ) is determined by Equation (11). It is quantified by selecting a minimum value between the release mass divided by the release rate and the maximum leak duration (ld max,n ) for each of the selected release hole sizes presented in Table 5. API [10] implemented a series of consequence analysis by a PHAST software program with release durations of 5 min, 10 min, 20 min, 30 min, 40 min, and 60 min, and evaluated the consequence area for varying release hole sizes. ld max,n is the sum of the time to detect and isolate the leak, time to analyze the incident and decide upon corrective actions, and time to complete appropriate response measures. In Table 5, the maximum leak duration is confined by 60 min because it is expected that the personnel will shut down the plant and take appropriate actions to limit the release, and will move out or evacuate workers within 60 min of the initial exposure. The unit of ld n in Equation (11) is seconds while ld max,n has minute dimension, and hence ld max,n is multiplied by 60 to meet the dimensional homogeneity. ld n = min mass avail,n rate n , 60ld max,n (11) Table 3. Detection and isolation system rating guidelines.

System Type Descriptions Classification
Detection Instrumentation designed specifically to detect material losses by changes in operating conditions in the system. A Suitably located detectors to determine when the material is present outside the pressure-containing envelope. B Visual detection, cameras, or detectors with marginal coverage. C

Isolation
Isolation or shutdown systems activated directly form process instrumentation or detectors, with no operator intervention. A Isolation or shutdown systems activated by operators in the control room or other suitable locations remote from the leak. B Isolation dependent on manually-operated valves C

Impact of an Accident and Its Consequences
API [10] provides guidelines for predicting the consequences of accidental continuous (CA CONT ) and instantaneous (CA I NST ) leakages, such as fires and explosions, as follows: where CA is the impacted area (ft 2 ) and a and b are coefficients determined by the conditions in Table 6. The Continuous Auto-Ignition Not Likely (CAINL), Continuous Auto-Ignition Likely (CAIL), Instantaneous Auto-Ignition Not Likely (IAINL), and Instantaneous Auto-Ignition Likely (IAIL) shown in Table 6 differentiate between instantaneous and continuous leakages and also between flammable and non-flammable fluids. For leakages that lie between the instantaneous and continuous leakages as they have been defined, the correction factor, f act IC , was calculated using Equation (14), and the magnitude of the consequences (CA IC−blend ) was corrected by Equation (15).
A further correction factor ( f act AIT ) with normal operating temperature (T s ) and auto-ignition temperature (AIT) was introduced to represent the portion of gas that cannot spontaneously combust.
The value of f act AIT was set as 0 when T s + 55.6 > AIT and as 1 when T s − 55.6 < AIT. The weighted average was then computed by Equation (18) with the generic failure frequency for n-th release hole size (g f f n ) and the total generic failure frequency defined by g f f total = 4 ∑ n=1 g f f n .
The summation from 1 to 4 is used because it is usual to evaluate four release hole sizes.

Calculation of Financial Impact
The total cost that could be attributed to an accident's consequences (FC) included: Maintenance and replacement costs (FC cmd ); damage costs to facilities affected by the consequences of any leak (FC a f f a ); facility stoppage or outage costs (FC prod ); industrial costs (FC inj ); and environmental cleaning costs (FC environ ).
FC cmd was calculated using Equation (20), by taking into consideration the leakage hole size and the material of the facility: where Holecost is the damage-related cost according to the type of facility for each leakage scenario and Matcost is a conversion factor that accounts for the facility material.
FC a f f a was calculated using Equation (21) with the damaged area and the facility cost (Equipcost) obtained by the density of the facilities in the range.
FC prod was calculated by summing the duration for which the facility itself (Outage cmd ) and the wider affected processes (Outage a f f a ) were out of service and multiplying this sum by the cost of lost production (prodcast).
FC inj was calculated by Equation (25) using the damaged area, population density (Popdens) and per capita human-related costs of an accident (Injcost).
FC environ represents the fee associated with cleaning up residue material after the leaked fluid had evaporated. The evaporation rate was calculated using Equation (26). The amount of fluid remaining after evaporation was calculated using Equation (27). FC environ was then calculated using Equation (28).
where f rac evap is the evaporation rate; vol env is the volume of the residue after evaporation; and envcost is the cleaning cost associated with cleaning 1 kg of residue. Other subjective factors such as reputational damage were not considered.

Case Study
An example scenario was created according to the procedure in Figure 1 and the parameters in Table 7 were used to analyze the potential impacts of fire and explosion caused by leakage of H 2 or NG from a fuel cell system. Pipe size, vessel type, temperature, pressure, and gas inventories were selected to represent typical operating conditions. Automatic internal (A), external (B), and naked eye (C) detection systems were considered. Three isolation systems were also analyzed: One was automatically connected to the detection device (A); one required manual intervention by a worker in a control room (B); and one required the worker to isolate the leak manually (C). Because the financial loss differs significantly depending on the material used to construct the facilities, the analysis was conducted using carbon steel (CS, 1.25Cr-0.5Mo, 5Cr-0.5Mo) and stainless steel (304SS, 316SS). Delphi by Embarcadero Technologies (Ver. 7.0) was used to calculate the magnitude of the impacts and the associated costs arising from leakages of H 2 and NG according to the parameter ranges described above (see Figure 3).

Discussion
Two methods are widely used to assess the financial consequence of a leakage accident. The first one is the worst scenario method. In this method, rupture is involved in the analysis, and the results are generally unrealistic with an overestimated prediction. In contrast, the weighted average method by Equation (18) is usually preferred because it uses a frequency concept for each leakage hole size, and hence provides appropriate evaluations.
In this study, the weighted average was calculated as follows. The release by small leakage and rupture was considered in 1 inch pipe. For 2 inches and 4 inches pipe, small, medium, and rupture leakage were implemented. The weighted average of vessel type included small, medium, large, and rupture leakage. As for the leakage by rupture of the vessel, the hole size was configured to 406 mm according to the guidelines presented by API [10].

Leakage Rate
The impacts of the leakage rates of NG and H2, by varying the temperature and pressure, are shown in Figure 4. Pressure influenced the leakage rate more significantly than temperature, and at low pressures, changing the temperature had no noticeable influence on the leakage rate. However, at higher pressures, a decrease in temperature caused a moderate increase in leakage rate. This can be explained by considering that at high temperatures, the mass flow rate decreases even if the volumetric flow rate increases. The leakage rate from the 4-inch pipe was approximately 10 times higher than that from the 1-inch pipe. This disparity is explained by considering that the 1-inch pipe only permitted small leaks and ruptures while the larger pipe also permitted leakage from

Discussion
Two methods are widely used to assess the financial consequence of a leakage accident. The first one is the worst scenario method. In this method, rupture is involved in the analysis, and the results are generally unrealistic with an overestimated prediction. In contrast, the weighted average method by Equation (18) is usually preferred because it uses a frequency concept for each leakage hole size, and hence provides appropriate evaluations.
In this study, the weighted average was calculated as follows. The release by small leakage and rupture was considered in 1 inch pipe. For 2 inches and 4 inches pipe, small, medium, and rupture leakage were implemented. The weighted average of vessel type included small, medium, large, and rupture leakage. As for the leakage by rupture of the vessel, the hole size was configured to 406 mm according to the guidelines presented by API [10].

Leakage Rate
The impacts of the leakage rates of NG and H 2 , by varying the temperature and pressure, are shown in Figure 4. Pressure influenced the leakage rate more significantly than temperature, and at low pressures, changing the temperature had no noticeable influence on the leakage rate.
However, at higher pressures, a decrease in temperature caused a moderate increase in leakage rate. This can be explained by considering that at high temperatures, the mass flow rate decreases even if the volumetric flow rate increases. The leakage rate from the 4-inch pipe was approximately 10 times higher than that from the 1-inch pipe. This disparity is explained by considering that the 1-inch pipe only permitted small leaks and ruptures while the larger pipe also permitted leakage from medium-sized holes.   The leakage rates for H 2 (Figure 4a,c) were lower than those of NG (Figure 4b,d). This was because, at the same temperature and pressure, the molecular weight of NG (MW = 16) is eight times greater than that of H 2 (MW = 2). Because the leakage rate is proportional to the square root of the molecular weight, this resulted in a leakage rate of NG that was approximately three times greater than that of H 2 . The amount of gas in the inventory and the detection and isolation systems were confirmed to have no effect on the leakage rate. Instead, these factors only affected the financial losses by influencing how long the leakage continued.
The weighted average leakage rates of H 2 and NG from vessels are shown in Figure 5, which represented similar trends to those observed in Figure 4 for leakage from pipework. The leakage rate of NG was a factor of three greater than that of H 2 . However, the actual rates of leakage from the vessels were significantly higher than those observed from pipework because, unlike for pipework, leakage from all hole sizes was possible. For scenarios with leakage through large holes and ruptures, representative sizes of 102 and 406 mm were used, respectively.

Impact of Various Factors on Total Cost
Because both NG and H 2 evaporate completely upon being leaked, there was no need to consider the environmental cleaning costs. Consequently, the total financial losses were calculated from the costs of stopping the facility, damage to the facility, and safety costs. Figure 6 shows the weighted total financial costs for 1-and 4-inch pipe. Similar results were obtained for the individual components (not shown). For leakage from the 1-inch pipe, the maximum costs for H 2 and NG were USD (The United States Dollar) 2.61 × 10 5 and 2.53 × 10 5 , respectively. The respective amounts for the 4-inch pipe were USD 4.75 × 10 5 and 5.60 × 10 5 . It is remarkable that the cost of H 2 leakage was higher than that of NG in the case of the 1-inch pipe, but lower for the 4-inch pipe case. Additionally, the total costs were much more influenced by the costs associated with stopping production and safety than the costs associated with damage to the facility.

Impact of Various Factors on Total Cost
Because both NG and H2 evaporate completely upon being leaked, there was no need to consider the environmental cleaning costs. Consequently, the total financial losses were calculated from the costs of stopping the facility, damage to the facility, and safety costs. Figure 6 shows the weighted total financial costs for 1-and 4-inch pipe. Similar results were obtained for the individual components (not shown). For leakage from the 1-inch pipe, the maximum costs for H2 and NG were USD (The United States Dollar) 2.61 × 10 5 and 2.53 × 10 5 , respectively. The respective amounts for the 4-inch pipe were USD 4.75 × 10 5 and 5.60 × 10 5 . It is remarkable that the cost of H2 leakage was higher than that of NG in the case of the 1-inch pipe, but lower for the 4-inch pipe case. Additionally, the total costs were much more influenced by the costs associated with stopping production and safety than the costs associated with damage to the facility.
The costs of leakages from vessels are shown in Figure 7. Costs associated with leakages from the reactor (USD ). The facility stoppage or outage costs were higher for the filter than those associated with the heat exchanger. The order was reversed for costs associated with damage to facilities, but these costs were less important to the total costs.   The costs of leakages from vessels are shown in Figure 7. Costs associated with leakages from the reactor (USD 1.4 × 10 6 ) were greatest, followed by those from the drum (USD 8.0 × 10 5 ), filter (USD 3.6 × 10 5 ), and heat exchanger (USD 2.2 × 10 5 ). The facility stoppage or outage costs were higher for the filter than those associated with the heat exchanger. The order was reversed for costs associated with damage to facilities, but these costs were less important to the total costs. Figure 8 shows the results for leakages from pipes with H 2 inventories of 1000 and 2000 kg. For the basal conditions (H 2 inventory of 1400 kg), the total cost was USD 4.7 × 10 5 (Figure 6c). The total cost appeared to change with the inventory: The total cost was slightly lower than the baseline value for an inventory of 1000 kg (USD 4.6 × 10 5 ) and slightly higher for an inventory of 2000 kg (USD 4.9 × 10 5 ). When the leakage occurred from the drum under the standard conditions, the total cost was insensitive to the inventory amount at USD 8.0 × 10 5 (Figure 7a).
In normal qualitative risk analysis, increasing the size of the inventory increases the impact of any leakage. However, such analyses rarely consider the detection and isolation systems, instead modeling only the worst-case scenarios. Here, the leakage duration (and thus the ultimate leakage amount) was limited by these systems, as denoted in the methodology. Incorporating these systems decreased the total cost and negated any impact on it from changing the inventory amount. Because the leakage rate from pipes was lower than that from vessels, pipes required a longer leakage duration to achieve the maximum leakage amount and they were therefore more impacted by the implementation of detection and isolation systems. The results for leakages from pipes and vessels were similar to the trends shown in Figure 8. Figure 9 shows the total costs associated with various detection and isolation systems. Changes in temperature and pressure produced results that compared with the baseline trends (see Figures 6c and 7a). For a leak from a 4-inch pipe, the maximum total costs, when using detection/isolation sets A, B, and C, were USD 4.7 × 10 5 , 5.0 × 10 5 , and 5.8 × 10 5 , respectively. For leakage from a drum, the respective values were USD 8.0 × 10 5 , 8.8 × 10 5 , and 9.5 × 10 5 . The ability of automatic detection and isolation systems to decrease the leakage duration by accelerating both detection and isolation decreased the amount of gas leaked, the fire and explosion risk the leak posed, and ultimately the total cost of the leak. The opposite was true when detection and isolation were carried out manually. These results suggest that minimizing the consequences of leakages in H 2 fuel cell systems requires a system that can monitor the gas flow within the system and can automatically isolate any leakages that occur.   ) was limited by these systems, as denoted in the methodology. Incorporating these systems decreased the total cost and negated any impact on it from changing the inventory amount. Because the leakage rate from pipes was lower than that from vessels, pipes required a longer leakage duration to achieve the maximum leakage amount and they were therefore more impacted by the implementation of detection and isolation systems. The results for leakages from pipes and vessels were similar to the trends shown in Figure 8.  . The ability of automatic detection and isolation systems to decrease the leakage duration by accelerating both detection and isolation decreased the amount of gas leaked, the fire and explosion risk the leak posed, and ultimately the total cost of the leak. The opposite was true when detection and isolation were carried out manually. These results suggest that minimizing the consequences of leakages in H2 fuel cell systems requires a system that can monitor the gas flow within the system and can automatically isolate any leakages that occur.  The higher cost of stainless steel meant that damage to a facility constructed of this material was more costly than one constructed of carbon steel. For leakage from a 4-inch pipe made of 304SS type stainless steel (Figure 10a) or 316SS, the total costs were USD 5 4.7 10  , higher than those for a facility constructed of carbon steel. However, because costs related to facility damage were a relatively small portion of the total costs, changing the material only had a negligible impact on the total cost. However, the change was more clearly shown in the case of damage to the drum because the cost of vessels was higher than that of pipes. Here, the total costs when using the 316SS type

Summary and Conclusions
Fuel cell systems in industrial facilities have the potential risk of leaking H2 or NG, and risk evaluation analysis, and the implementation of appropriate safety prevention mechanisms must be carried out. This study investigated the financial risk factors for leakages of H2 and NG from fuel cell systems by considering various leakage rates, modes, and total amounts. The impact of The higher cost of stainless steel meant that damage to a facility constructed of this material was more costly than one constructed of carbon steel. For leakage from a 4-inch pipe made of 304SS type stainless steel (Figure 10a) or 316SS, the total costs were USD 4.7 × 10 5 , higher than those for a facility constructed of carbon steel. However, because costs related to facility damage were a relatively small portion of the total costs, changing the material only had a negligible impact on the total cost. However, the change was more clearly shown in the case of damage to the drum because the cost of vessels was higher than that of pipes. Here, the total costs when using the 316SS type stainless steel (Figure 10d), 304SS type stainless steel (Figure 7a), and carbon steel (Figure 10c) for the drum material were USD 8.2 × 10 5 , 8.05 × 10 5 , and 7.8 × 10 5 , respectively.

Summary and Conclusions
Fuel cell systems in industrial facilities have the potential risk of leaking H 2 or NG, and risk evaluation analysis, and the implementation of appropriate safety prevention mechanisms must be carried out. This study investigated the financial risk factors for leakages of H 2 and NG from fuel cell systems by considering various leakage rates, modes, and total amounts. The impact of applying appropriate detection and prevention systems was also presented. The total cost for each scenario was determined according to the costs of facility outage or damage, and the costs of taking safety precautions. This study has reached the following conclusions: (1) The leakage rates of H 2 and NG in fuel cell systems were more significantly influenced by pressure than by temperature: At low pressures, the influence of temperature on leakage rate was very small, but, at high pressures, the leakage rate was higher for lower temperatures. For identical temperatures and pressure conditions, the leakage rate of NG was higher than that of H 2 .
(2) The reactor was the most costly vessel in terms of outage costs, followed by the drum, filter, and the heat exchanger. In terms of costs related to damage to equipment, the order was reactor > drum > heat exchanger > filter. For leaks from pipes, safety costs increased with pipe diameter but were unaffected by the type of vessel from which the leakage occurred.
(3) Systems with automatic detection and isolation systems decreased the leakage duration and total cost. The use of such systems is therefore recommended to ensure optimal safety levels and to protect against financial losses.