Assessing the Quantitative Risk of Urban Hydrogen Refueling Station in Seoul, South Korea, Using SAFETI Model

Abstract

Hydrogen refueling stations (HRS) operating at high pressures pose a higher risk of leakage than conventional gas stations. Therefore, in this study, a quantitative risk assessment (QRA) was conducted using DNV-GL SAFETI v.8.9. The impact of the shutoff valve was quantitatively assessed, and step-by-step mitigation was applied to propose the minimum installation requirements for the valve necessary to achieve broadly acceptable risk levels. The QRA includes sequence analysis (CA), individual risk (IR), and societal risk (SR), with accident scenarios consisting of catastrophic ruptures and three leak scenarios. The research results indicate that the application of a dual shutoff valve system resulted in an IR of 7.48 × 10⁻⁵, effectively controlling the risk below the as low as reasonably practicable (ALARP) criteria of the Health and Safety Executive (HSE). The SR was analyzed based on the ALARP criteria in the Netherlands, and the application of the dual shutoff valve system effectively controlled the risk below the ALARP criteria. Consequently, this study suggests that applying a dual shutoff valve system with a mitigation value exceeding 1.21 × 10⁻² can successfully mitigate the risk of urban hydrogen refueling stations to broadly acceptable levels.

1. Introduction

In response to climate change caused by greenhouse gas emissions, the international community is focusing on the development of renewable energy sources with lower carbon dioxide emissions [1]. Hydrogen is one of the most promising renewable energy sources to replace conventional fossil fuels. Hydrogen has a higher energy density (143 MJ/kg) than conventional fossil fuels such as gasoline (46.4 MJ) and diesel (45.4 MJ). It can be produced from renewable energy sources, such as fossil fuels, biomass, wind, and solar energy. Hydrogen is versatile and utilized in various fields, including households, industries, and transportation, for applications such as liquid fuel for ships and fuel cells in fuel cell vehicles (FCVs). Green hydrogen, produced through the electrolysis of water using only electrical energy, is considered a highly promising energy source with zero greenhouse gas emissions [2,3,4,5]. Consequently, South Korea announced its Hydrogen Economy Activation Roadmap in 2019, aiming to deploy 2.9 million hydrogen vehicles and establish 1200 hydrogen refueling stations (HRSs) by 2040 [6]. Hydrogen is a molecule with a very low density (0.089 g/L at 101.325 kPa, 0 °C). Therefore, in an HRS, where high-pressure processes are employed, gaseous hydrogen is compressed to enhance fluid energy density or liquefied below the boiling point of hydrogen (−253 °C or lower) through cryogenic processes for storage [7]. Currently, cryogenic processes for liquefied hydrogen refueling stations (LHRS) have not yet been commercialized in South Korea, and most HRSs operate as gaseous hydrogen refueling stations (GHRSs). Owing to its high-pressure operation, a GHRS poses the risk of hydrogen leakage through small cracks or joints in target facilities, such as tube trailers and storage tanks. Hydrogen leaked at high pressure can easily mix with ambient air because of its wide flammability range (4–75%) and low ignition energy (0.02 mJ), leading to spontaneous ignition and potential hazards, such as jet fires, fireballs, and vapor cloud explosions (VCEs) [8,9,10]. To minimize potential damage, South Korea applies separation distance criteria under the annex 5 for “Enforcement Regulations of High-Pressure Gas Safety Management Act” to HRS, securing the safety of nearby facilities [11].

Despite the increased risk of leakage compared with traditional gas stations [10,12], as HRSs have become more widespread, quantitative risk assessments (QRAs) have been conducted to demonstrate their safety. Kwak and Jongbeom [13] analyzed the safety of HRS based on jet fire modeling and overpressure modeling of PHAST 8.0, and HyRAM, along with an analysis of the suitability of HRS sites using French land use planning (LUP). They proposed the implementation of all possible safety measures during the HRS installation. Jeon et al. [9] performed a safety assessment of an operational urban HRS based on accident risk range and societal risk (SR). Based on the accident frequency analysis, the calculated risk impact range results were evaluated using a probit model, concluding that the risks of jet fires and overpressure during accidents were lower than the as low as reasonably practicable (ALARP) level. Sun et al. [14] conducted a QRA for a mobile HRS by dividing the study into operators, customers, and pedestrians. They found that the risks for operators and customers were acceptable, and for pedestrians, road risks were acceptable as long as well-planned routes and limited transportation times were implemented. Gye and Hye-Ri [15] performed a QRA on an urban HRS system to determine risk. To validate the need to apply a safety barrier system for risk reduction, they performed and compared the results of a frequency analysis. The application of a passive safety barrier system reduced the failure rate by ten times, resulting in a tenfold reduction in individual risk (IR) from 10⁻⁶ to 10⁻⁵, and the SR also confirmed its location within the ALARP range. Kikukawa et al. [16] conducted a risk assessment for an HRS that could use 70 MPa based on hydrogen station experiments at 40 MPa. Assuming explosion and jet fire scenarios were measured at distances of 1 m and 6 m from the leakage point, the results suggested that 6 m is a sufficient distance for the outer perimeter of the hydrogen station. Suzuki et al. [17] discovered through an IR analysis that the risk of jet fires accounts for over 90% of the HRS risk. To position the 10⁻⁶ risk contour within the boundary of the HRS site, the authors suggested the need for corresponding mitigation measures. Tsunemi and Kiyotaka [18] calculated the accident probability of hydrogen leakage by considering the failure probability and operating time of the valves and leak detectors in the event of an accident involving high-pressure gas compressor connection piping. They quantified the mitigation effects of firewalls and barriers and proposed the need for safety measures, such as firewalls, to protect devices and pipes. Park et al. [19] combined Layers of Protection Analysis (LOPA) and RiskCurve software to derive the IR and SR for HRS, assessing and comparing the risk and mitigation of applying independent protection layers (IPLs). Both the IR and SR showed high-risk contributions from the dispenser and tube trailer. In the case of IR, with the risk around the HRS sidewalk at 2.54 × 10⁻⁴, a passive IPL reduced it to 4.15 × 10⁻⁸, and an active IPL reduced it to 9.66 × 10⁻⁷. Similarly, the entry risk decreased from 7.63 × 10⁻⁵ to 7.13 × 10⁻⁹ with a passive IPL and 7.18 × 10⁻⁸ with an active IPL. The application of passive IPL met the ALARP criteria in the UK, Netherlands, and Hong Kong. While the active IPL contributed to a decrease in SR compared to having no IPL, its effectiveness was found to be less significant than that of a passive IPL. Therefore, the passive IPL was confirmed to be a more efficient mitigation measure that secured safety more effectively than an active IPL. Zhiyong L. I. et al. [20] divided the targets of the risk acceptance criteria for HRS into station personnel, customers, and parties. They compared the IR and SR before and after the application of safety barrier systems, such as leak detection and shutdown systems connected to emergency shutdown (ESD) systems on the dispenser and tube trailer, hydrogen sensors connected to the station’s automatic ESD system, and manual ESD buttons. For station personnel, there were no areas with a TR exceeding 10⁻⁴, and the maximum IR inside the station did not exceed 5 × 10⁻⁴. For customers, the probability of one or more fatalities decreased to 10⁻⁶ from 1.20 × 10⁻³ or 1.17 × 10⁻³. For the parties, safety distances were calculated and reduced from 23 m to 9 m, indicating a 61% reduction. Yoo et al. [7] derived the IR and SR for the GHRS and LHRS while proposing the installation of safety barrier systems, such as separated coupling, hydrogen detection sensors, and automatic and manual emergency shutdown buttons. The IR for LHRS (8.09 × 10⁻⁵) was lower than that of the GHRS (1.02 × 10⁻⁴), and the tube trailer accounted for 40% of the LHRS IR and 46% of the GHRS IR. Moreover, depending on the safety barrier system, the SR of the GHRS and LHRS decreased to 10⁻³.

In previous HRS studies, research on HRSs located in densely populated urban areas was limited, and QRAs were conducted to assume the hypothetical safety barrier system effects to achieve a risk level of 10⁻³ if the risk exceeded the ALARP criteria. In this system, where hydrogen leakage is fundamentally prevented, and fire or explosion is prevented, the quantitative performance of the valve has not been thoroughly studied. Therefore, this study aimed to quantitatively assess the risk of urban HRSs through a QRA, thereby proving the safety of urban HRSs. In this process, the study quantified the impact of a valve acting as an Active IPL, applied it as a single mitigation step, and compared the mitigation results. Finally, this study proposes the minimum installation requirements necessary to achieve the ALARP level and the minimum level of risk tolerance for urban HRS. This research is expected to be utilized as a study providing standards for minimum safety device installation for future urban HRSs and as fundamental data for designing safety-barrier systems, including valves. Furthermore, based on the results of the study, various levels of mitigation for safety barrier systems, including valves, can be designed.

2. Methodology

This study evaluated the risk of an HRS installed in the downtown area of Seoul, South Korea, and examined the mitigation effects of risk with the application of safety devices. Based on the necessary information for HRS in this study, risk was quantitatively assessed using QRA. DNV’s SAFETI v.8.9 was utilized for the QRA.

2.1. Scenario

2.1.1. HRS Selection

The research site is the Seosomun Government Complex in Seoul, South Korea. The target HRS, inaugurated on 7 October, 2022, is the first urban HRS in Seodaemun-gu, Seoul. Due to its failure to meet the required 17 m separation distance from a Grade 1 protected facility under South Korea’s “High-Pressure Gas Safety Management Act”, the operation of the target HRS was permitted with the condition of additional safety device installation through a regulatory exception granted by the Ministry of Trade, Industry and Energy. Figure 1 depicts the Seosomun Building HRS and its surrounding areas. To the west of the HRS is the Seoul Metropolitan Art Museum, which is designated as a Grade 1 protected facility under the High-Pressure Gas Safety Management Act. To the east are Seosomun Building 2 and the Seoul Metropolitan Council Building, and to the north are the Seosomun Building Welfare Center. To the south are Seosomun Building 5, commercial spaces, and various businesses.

2.1.2. HRS Specification

The operating conditions of the target HRS were established based on the process flow diagram (PFD) announced by Seoul Metropolitan City and the operation service task order provided by Seoul Energy Corporation [21,22]. The operating conditions of the target HRS are presented in

Table 1. Operating conditions for Seosomun HRS [21,22].

Facility	Operating Pressure (bar)	Operating Temperature (°C)	Storage Mass (kg)
High-pressure storage tank	870	21	72.6
Medium-pressure storage tank	630	21	85.7
Tube trailer	200	21	200

, and those of the PFD are shown in Figure 2. This HRS receives hydrogen as an offsite station through tube trailers pressurized at 200 bar. Subsequently, the hydrogen was compressed and stored in storage tanks pressurized to 870 and 630 bar and supplied to the dispenser through the central control panel. The hydrogen supplied to the dispenser is cooled down to −40 °C through pre-coolers and chiller, and it charges hydrogen vehicles at 700 bar using pressure differentials. The operating conditions are listed in Table 1.

The accident scenarios for the HRS are presented in

Table 2. Accident scenarios of HRS [10,23].

Facility	Accident Scenario	Leak Diameter (mm)	Leakage Frequency $({\mathbf{y}\mathbf{r}}^{-1}$)
High-pressure storage tank	Catastrophic rupture	-	5.00 × 10−7
	Large leak	7.16	1.02 × 10−4
	Medium leak	2.26	2.09 × 10−4
	Small leak	0.72	1.23 × 10−3
Medium-pressure storage tank	Catastrophic rupture	-	5.00 × 10−7
	Large leak	7.92	1.02 × 10−4
	Medium leak	2.50	2.09 × 10−4
	Small leak	0.79	1.23 × 10−3
Tube trailer	Catastrophic rupture	-	5.00 × 10−7
	Large leak	12.70	1.80 × 10−4
	Medium leak	4.02	3.21 × 10−4
	Small leak	1.27	4.14 × 10−4

. The leak size and frequency of the HRS leakage scenario were referenced from Sandia National Laboratories’ (SNL) “SANDIA REPORT, SAND2009-0874 [10]”. According to SAND2009-0874, leakages in high-pressure storage tanks and tube trailers can stem from various components, including compressors, joints, cylinders, valves, pipes, and hoses. The leakage frequency for the target facility was calculated by aggregating the frequencies of all occurrences of these components. The leakage is assumed to originate from a circular leakage orifice, and the “leak size” denotes the diameter of the leakage orifice. The occurrence frequency of the catastrophic rupture scenario was determined based on the loss of containment frequency from the National Institute for Public Health and the Environment (RIVM)’s “Purple Book”, considering continuous all release within 10 min for stationary pressurized tanks and vessels [23].

To assess the potential risk based on the leakage frequency of the targeted facilities in a hydrogen refueling station (HRS), a comparison was conducted with the leakage frequency of existing gas station facilities. The leakage probabilities of the gas stations are listed in

Table 3. Leakage probability of gas station [12].

Facility	Accident Scenario	Leak Diameter (mm)	Leakage Frequency $({\mathbf{y}\mathbf{r}}^{-1}$)
Pressurized vessel	Catastrophic rupture	over 152.4	6.00 × 10−7
	Large leak	101.6	2.00 × 10−6
	Medium leak	25.4	2.00 × 10−5
	Small leak	6.4	8.00 × 10−6
Atmospheric tank	Catastrophic rupture	over 152.4	1.00 × 10−7
	Large leak	101.6	5.00 × 10−6
	Medium leak	25.4	2.50 × 10−5
	Small leak	6.4	7.00 × 10−5
Pipe (8 to 16 inch)	Catastrophic rupture	over 152.4	6.00 × 10−7
	Large leak	101.6	2.00 × 10−6
	Medium leak	25.4	2.00 × 10−5
	Small leak	6.4	8.00 × 10−6

. The leak diameter and leakage frequency for the gas stations were obtained from the American Petroleum Institute (API) API 581 [12]. Leakage frequency data originated from the failure data of pressure vessels in petrochemical companies in Europe and the U.S. Similarly to SAND2009-0874, it was assumed that leakage occurred through a circular hole. For comparative analysis, the leakage frequency data for the HRS and gas station facilities considered only the large-leak scenario in the HRS and the small-leak scenario in gas stations with similar leak diameters. The results revealed that the targeted facilities in the HRS, operating under high pressure, exhibited a higher leakage frequency than those in the gas stations. This emphasizes the necessity of conducting quantitative risk assessments to derive the risks associated with an HRS and demonstrate its safety, especially when compared with gas station facilities.

2.1.3. Weather Condition

In this study, we aimed to verify the reduction in risk by applying safety devices based on the conservatively derived risk of the HRS. Consequently, we assessed the level of risk reduction and minimum installation requirements for safety devices. Therefore, weather conditions were assumed to be the worst-case scenario, according to the Chemical Accident Prevention and Management Plan of the National Institute of Chemical Safety (NICS) for South Korea [24]. The weather conditions in the worst-case scenarios are listed in

Table 4. Worst case weather conditions [24].

Weather Conditions	Wind Speed	Atmospheric Temperature	Atmospheric Stability	Humidity
Worst case	1.5 m/s	25 °C	F	50%

.

2.1.4. Population Density

Population density in the research area was significantly influenced by the operating hours of the Seosomun Government Complex and the Seoul Museum of Art, with the resident population inside the buildings being dominant. The population density within the buildings was high during the operating hours from 09:00 to 18:00, when government officials at the Seosomun Government Complex and visitors to the Seoul Museum of Art were present. After 20:00, when these individuals remained, the population density decreased significantly. Therefore, population density was considered based on the ratio of day and night hours to the population inside the buildings. The surrounding indoor population ratios are presented in

Table 5. Population of HRS and surrounding buildings [22,25].

Buildings	Population Category	Day Population	Night Population	Indoor Fraction
Seosomun HRS	Operator	2 (Resident) 2 (Non-resident)	2 (Resident)	0.9
Seosomun Government Complex 2	Public	95	0	0.9
Seosomun Annex Building 5		133	0	0.9
Parliamentary Hall		86	0	0.9
Seosomun Welfare		195	0	0.9
Seoul Museum of Art	Public	175 (1746/10 h *)	0	0.9
Total	-	688	2	-

* Weekday operating time = 10 h.

[22,25], and the day-to-night ratios are presented in

Table 6. Fraction of day and night.

Time	Time Period	Fraction
Day	09:00~20:00 (11 h)	0.4583
Night	20:00~09:00 (12 h)	0.5417

.

2.1.5. Mitigation Selection

The risks of jet fire, fireballs, and VCE are determined by factors such as the duration of hydrogen leakage, immediate ignition, and time to ignition [26]. In particular, the effective distance is significantly influenced by the duration of hydrogen leakage. Therefore, this study quantitatively evaluates the impact of emergency shutdown devices capable of preventing hydrogen leakage. The failure probabilities and operating times of the valves acting as emergency shutdown devices are listed in

Table 7. Failure probabilities and operating times of the valves [18,27,28,29].

Valve	Failure Probability (${\mathbf{y}\mathbf{r}}^{-1}$)	Operating Time (Seconds)
Check valve	0.0009	0
Excess flow valve	0.0009	0.1
Shutoff valve	0.11	30

[18,27,28,29].

Owing to the very short failure probability and operating time of check valves and excess flow valves, the quantitative evaluation of their impact based on their operation is challenging. Therefore, a shutoff valve was selected as the active IPL (independent protection layer) to mitigate the HRS risks.

2.2. QRA Program for HRS

In this study, the impacts of radiant heat and explosion overpressure resulting from jet fires, fireballs, and VCE were assessed using DNV-GL SAFETI v.8.9. Accordingly, the radiant heat and explosion overpressure calculation formulas for jet fires, fireballs, and VCE were selected and analyzed. An explanation of the quantitative risk assessment program used in this study can be found in Appendix A. Please refer to

Table A1. Parameters used in the calculation formulas.

Name	Units	Description
$A$	${\mathrm{m}}^2$	Total surface area of the flame
$B_M$	m	Flame momentum length
$E$	J	Total combustion energy of the explosion
$E_{fireball}$	kW/${\mathrm{m}}^2$	Surface emissive power of fireball
$F$	-	Radiant heat fraction of horizontal flame
$F_i$		Fatality probability defined by accident scenario
$f$	-	Fraction of the total available heat energy
$\Delta H_{c,gas}$	kJ/kg	Heat of combustion of gas
$\Delta H_{c,fuel}$	kJ/kg	Heat of combustion of the fuel
$IR\left(x,y\right)$	-	Total probability of fatality at a specific location $(x,y)$
$i$	-	Accident scenario
$L_B$	m	Flame length for leak hole to flame tip
$L_{B0}$	m	Zero wind flame length
$L_f$	m	Flame center line length
$L_y$	m	Flame lift due to buoyancy
$M$	kg	Mass of fuel involved in the fireball
$\dot{m}$	kg/s	Mass discharge rate
$P_a$	Pa	Atmospheric pressure
$P_{dyn}^{\prime }$	Pa	Dynamic overpressure
$P_i$	-	Frequency of events defined by accident scenario
$P_s$	Pa	Peak side on overpressure
$P_s^{\prime }$	Pa	Scaled peak side on overpressure
$Ri$	-	Richardson number
$R_L$	m	Flame wind buoyancy section length
$r$	m	Distance from center of explosion
$r^{\prime }$	m	Scaled distance from center of explosion
$r_{fireball}\left(t\right)$	m	Fireball radius at elapsed time
$r_{max}$	m	Maximum fireball radius
$\mathrm{t}$	seconds	Elapsed time
$t_d$	seconds	Fireball duration of dynamic model
$t_{lo}$	seconds	Lift-off time of fireball
$W_{surface}$	kW/${\mathrm{m}}^2$	Surface emissive power of horizontal jet flame
${\delta }_{horizontal}$	radians	Horizontal lift angle
${\delta }_{vertical}$	radians	Vertical lift angle
${\phi }_{flame}$	radians	Angle between the vertical planes cutting the release source and jet flame, respectively, into symmetrical halves

in the Appendix B for a list of the parameters used in the calculation formulas.

2.2.1. Jet Fire Model

In this study, the impact of jet fires was evaluated using the Miller model [30,31]. For horizontal releases, Equation (1) represents the flame momentum length, Equation (2) represents the flame lift due to buoyancy, and Equation (3) represents the horizontal lift angle between the flame axis and the horizontal.

$$Flame momentum length, B_M=MAX\left(0,MIN\left(e^{-0.13Ri\left(L_{B0}\right)},1\right)\right)L_{BO}$$

(1)

$$Flame lift due to buoyancy, L_y=MAX\left(0,MIN\left(0.05Ri\left(L_{B0}\right),1\right)\right)$$

(2)

$${\delta }_{horizontal}=MAX\left(0,MIN\left\{{\sin }^{-1}\left(\frac{L_y}{L_f-B_M}\right),\left(\frac{\pi }{2}-{\delta }_{vertical}\right)\right\}\right)$$

(3)

Equation (4) represents the horizontal flame centerline length, which is independent of wind and has the same value as the zero-wind flame length. Equation (5) represents the flame wind buoyancy section length.

$$Flame center line length, L_f=L_{B0}=B_M+R_L$$

(4)

$$Flame wind buoyancy section length, R_L=L_f-B_M$$

(5)

Equation (6) expresses the horizontal flame length from the leakage hole to the flame tip.

$$\begin{gathered} Flame length for leak hole to flame tip, \\ {L}_B=\sqrt{L_y^2{+B}_M^2+{\left(R_L\cos {\delta }_{horizontal}\right)}^2+2R_L{B}_M\cos {\delta }_{horizontal}\cos {\phi }_{flame}} \end{gathered}$$

(6)

Equation (7) represents the surface emissive power of the horizontal flame.

$$Surface emissive power, W_{surface}=\frac{F\dot{m}\Delta H_{c,gas}}{A}$$

(7)

2.2.2. Explosion Model

In this study, the Netherlands Organisation for Applied Scientific Research (TNO) Multi-Energy model was used [32]. The TNO Multi-Energy method, developed by Van den Berg, is an equation for calculating the explosion overpressure. It distinguishes explosion classes based on the scaled distance and intensity of the explosion overpressure, and derives the maximum overpressure of the explosion. The maximum overpressure and distance were scaled to non-dimensional parameters, as shown in Equations (8) to (10).

$$Scaled peak side on overpressure,\hspace{1em}{P}_s^{\prime }=\frac{\Delta P_s}{P_a}$$

(8)

$$Dynamic overpressure, P_{dyn}^{\prime }=\frac{P_{dyn}}{P_a}$$

(9)

$$Scaled distance from center of explosion,\hspace{1em}{r}^{\prime }=\frac{r}{{\left(\frac{E}{P_a}\right)}^{\frac{1}{3}}}$$

(10)

Subsequently, using a graph depicting the scaled overpressure based on the explosion class and scaled distance, the maximum overpressure of the explosion was determined. The explosion class is considered to be 1 for open spaces and 10 for the presence of obstacles, and is typically assumed to be 7 for general calculations. The peak side of the overpressure was calculated as shown in Figure 3.

2.2.3. Fireball Model

In this study, the impact of fireballs was evaluated using Martinsen and Marx’s dynamic models [33]. The fireball radius at elapsed time is represented by Equation (11).

$$r_{fireball}\left(t\right)=4.332M^{1/4}{t}^{1/3},\hspace{1em}\mathrm{f}\mathrm{o}\mathrm{r} t\le t_{lo }$$

(11)

The surface emissive power was proposed based on Robert’s correlation, with an upper limit of 400 kW/m². The surface emissive power is given by (12).

$$E_{fireball}=Min\left(\frac{fM\Delta H_{c,fuel}}{0.8888\times 4\pi r_{max}^2{t}_d}, \mathrm{400,000}\right)$$

(12)

Equation (12) can be written as Equation (13).

$$Surface emissive power, E_{fireball}=Min\left(0.0118f{M}^{1/12}\Delta H_c , \mathrm{400,000}\right)$$

(13)

2.3. SR Analysis Method

2.3.1. Probit Model

The vulnerability of humans to toxicity, overpressure, and radiative heat can be calculated using a probit function [34]. The basic function of the probit model is given by Equation (14), where $k_1$ and $k_2$ are constants, and $V$ represents the intensity based on the exposure time to radiant heat or overpressure.

$$Pr=k_1+k_2\times ln\left(V\right)$$

(14)

For the radiation heat vulnerability model of SAFETI v.8.9, an equation was used based on the constants provided by the purple book of RIVM [23,35]. The vulnerability function of radiation heat is given by Equation (15), where Q represents the radiative heat.

$${Pr}_{Heat}=-36.38+2.56\times \mathrm{l}\mathrm{n}(t\times Q^{4/3})$$

(15)

For the overpressure vulnerability model in SAFETI v.8.9, the equation was based on constants provided by the Health and Safety Executive (HSE) [36,37]. The vulnerability function of the overpressure is given by Equation (16), where $P_s$ represents the peak overpressure.

$${Pr}_{Overpressure}=1.47+1.35\times \mathrm{l}\mathrm{n}\left(P_s\right)$$

(16)

The criteria for radiation heat and overpressure intensity used to estimate human casualties were established as follows: The damage based on the radiant heat intensity is presented in

Table 8. Damage of radiation heat on humans [38,39].

Radiation Heat (kW/m2)	Damage on Humans
4	Pain and swelling occur if not protected for more than 20 s
12.5	Fatalities occur within minutes
37.5	Instant death

, and that based on overpressure is listed in

Table 9. Damage of overpressure on humans [40].

Overpressure (psi)	Damage on Humans
1	Ruptured eardrum
3	Physical injury may occur
5	Risk of injury and even a possibility of death

[38,39,40].

2.3.2. Ignition Probability

The immediate ignition probability of hydrogen was obtained from analyses conducted using the SANDIA REPORT, SAND2009-0874 [10]. The ignition probabilities provided by SNL are listed in

Table 10. Ignition probabilities for hydrogen [10].

Release Rate (kg/s)	Ignition Probability
	Immediate	Delayed
<0.125	0.008	0.004
0.125−6.25	0.053	0.027
>6.25	0.230	0.120

. The SNL distinguishes the ignition probabilities based on the hydrogen release rate. The peak release rates for the leakage scenarios of the target facilities are listed in

Table 11. Peak release rate for target HRS facility.

Facility	Peak Release Rate (kg/s)
	Large Leak	Medium Leak	Small Leak
High-pressure storage tank	1.63	0.16	0.02
Medium-pressure storage tank	1.50	0.15	0.02
Tube trailer	1.32	0.13	0.01

. In this study, to obtain conservative results, the immediate and delayed ignitions were calculated as 0.053 and 0.027, respectively, based on the release rate of the large-leak scenario.

3. Results

3.1. CA of Leak Scenario

3.1.1. Results of Jet Fire

CA was performed using SAFETI v.8.9, deriving the effective distance to human casualties based on radiant heat and overpressure intensity without considering geographical features. In the leakage scenario, jet fires and VCEs occurred because of the restricted leak orifice. Because there was no significant difference in the peak flow rate of hydrogen according to the leakage scenarios of the target facilities, the impacts of radiation heat and overpressure due to jet fires and VCE showed similar results for all target facilities. The results of the jet fire in the leakage scenario are listed in

Table 12. Radiation heat data of jet fire in leak scenario.

Facility	Leak Size	Flame Length (m)	Distance Downwind to Radiation Heat (kW/m2)
			4	12.5	37.5
High-pressure storage tank	Large	21.07	34.28	25.95	21.28
	Medium	7.32	11.19	8.52	6.81
	Small	2.53	3.28	-	-
Medium-pressure storage tank	Large	20.53	33.57	25.34	20.74
	Medium	7.14	10.92	8.30	6.61
	Small	2.45	3.16	-	-
Tube trailer	Large	19.88	33.22	24.97	20.29
	Medium	6.95	10.85	8.19	6.49
	Small	2.39	3.15	-	-

.

For the high-pressure storage tank, in the scenario of a large leak, the length of the jet flame for the large leak was observed to be 21.07 m. The radiation heat impact extended downwind, influencing a distance of 34.28 m for 4 kW/m². In the medium-leak scenario, the jet flame was 7.32 m, causing radiative heat impacts up to a downwind distance of 11.19 m for 4 kW/m². In the small-leak scenario, the length of the jet flame was 2.53 m, resulting in radiation heat impacts up to a downwind distance of 3.28 m for 4 kW/m². At a downwind distance of 1.62 m, the maximum radiation heat of 11.98 kW/m² was observed.

For the medium-pressure storage tank, in the scenario of a large leak, the length of the jet flame for the large leak was observed to be 20.53 m. The radiation heat impact extended downwind, influencing a distance of 33.57 m for 4 kW/m². In the medium-leak scenario, the length of the jet flame was 7.14 m, causing radiation heat impacts up to a downwind distance of 10.92 m for 4 kW/m². In the small-leak scenario, the length of the jet flame was 2.45 m, resulting in radiation heat impacts up to a downwind distance of 3.16 m for 4 kW/m². At a downwind distance of 1.57 m, the maximum radiation heat of 11.41 kW/m² was observed.

For the tube trailer, in the scenario of a large leak, the length of the jet flame for the large leak was observed to be 19.88 m. The radiation heat impact extended downwind, influencing a distance of 33.22 m for 4 kW/m². In the medium-leak scenario, the length of the jet flame was 6.95 m, causing radiation heat impacts up to a downwind distance of 10.85 m for 4 kW/m². In the small-leak scenario, the length of the jet flame was 2.39 m, resulting in radiation heat impacts up to a downwind distance of 3.15 m for 4 kW/m². At a downwind distance of 1.53 m, the maximum radiation heat of 11.82 kW/m² was observed.

3.1.2. Results of VCE

The results of the VCE in the leak scenario are presented in

Table 13. Overpressure data of VCE in leak scenario.

Facility	Leak Size	Explosion Center (m)	Diameter of Overpressure (psi)
			1	3	5
High-pressure storage tank	Large	40	35.55	15.24	11.05
	Medium	20	8.03	3.44	2.50
Medium-pressure storage tank	Large	40	34.99	15.00	10.88
	Medium	10	7.50	3.21	2.33
Tube trailer	Large	40	33.36	14.30	10.37
	Medium	10	7.25	3.11	2.25

. In the small-leak scenario, no explosions occurred. For the medium-scale leakage, explosions occurred at downwind distances of 10 m and 20 m, and for the large-leak scenario, an explosion occurred at a downwind distance of 40 m.

For the high-pressure storage tank, in the scenario of a large leak, an overpressure of 1 psi was observed within a radius of 35.55 m from the explosion center. In the medium-leak scenario, an overpressure of 1 psi was observed within a radius of 8.03 m from the explosion center.

For the medium-pressure storage tank, in the scenario of a large leak, an overpressure of 1 psi was observed within a radius of 34.99 m from the explosion center. In the medium-leak scenario, an overpressure of 1 psi was observed within a radius of 7.50 m from the explosion center.

For the tube trailer, in the scenario of a large leak, the overpressure of 1 psi was observed within a radius of 33.36 m from the explosion center. In the medium-leak scenario, an overpressure of 1 psi was observed within a radius of 7.25 m from the explosion center.

3.2. CA of Catastrophic Rupture Scenario

3.2.1. Results of Fireball

Fireballs and VCEs occur during the catastrophic rupture scenario. Unlike the leak scenario, the catastrophic rupture scenario does not calculate the peak flow rate based on factors, such as the size and pressure of the leak orifice. Therefore, the effective range owing to the fireball and VCE was determined using the tube trailer, which had the highest mass of hydrogen within the target facilities, yielding the largest results. The fireball results for the catastrophic rupture scenario are listed in

Table 14. Radiation heat data of fireball in catastrophic scenario.

Facility	Fireball Diameter (m)	Radiation Heat
		Level (kW/m2)	Diameter (m)
High-pressure storage tank	12.10	4	100.24
		12.5	57.58
		37.5	33.02
Medium-pressure storage tank	12.79	4	105.58
		12.5	60.91
		37.5	34.80
Tube trailer	16.96	4	137.87
		12.5	80.37
		37.5	45.48

.

For the high-pressure storage tank, the fireball diameter was 12.10 m and radiation heat of 4 kW/m² was observed within a radius of 100.24 m from the fireball center.

For the medium-pressure storage tank, the fireball diameter was 12.79 m and the radiation heat of 4 kW/m² was observed within a radius of 105.58 m from the fireball center.

For the tube trailer, the fireball diameter was 16.96 m and the radiation heat of 4 kW/m² was observed within a radius of 137.87 m from the fireball center.

3.2.2. Results of VCE

The VCE results for the catastrophic rupture scenarios are presented in

Table 15. Overpressure data of VCE in catastrophic scenario.

Facility	Explosion Center (m)	Overpressure
		Level (psi)	Diameter (m)
High-pressure storage tank	10	1	81.69
		3	35.20
		5	25.33
Medium-pressure storage tank	10	1	86.96
		3	37.24
		5	29.85
Tube trailer	20	1	113.18
		3	47.13
		5	34.38

. The effective range of the explosion due to catastrophic rupture was calculated as the worst-case scenario based on the downwind distance in the direction of the human casualty criteria from the explosion center. For the high- and medium-pressure storage tanks, explosions occurred at downwind distance of 10 m and the tube trailer, explosion occurred at a downwind distance of 20 m.

In the high-pressure storage tank, an overpressure of 1 psi was observed within a radius of 81.69 m from the explosion center.

For the medium-pressure storage tank, an overpressure of 1 psi was observed within a radius of 86.96 m from the explosion center.

In the tube trailer, an overpressure of 1 psi was observed within a radius of 113.18 m from the explosion center.

3.3. IR Analysis

IR represents the probability of fatality at a specific location, calculated by multiplying the frequency of events defined by accident scenarios with the probability of those events causing fatalities. $IR(x,y)$ denotes the total probability of fatality at a specific location $(x,y)$ and can be expressed as in Equation (17). The total IR at each location represents the sum of the IR for all possible accident scenarios that can occur at that location, as calculated and expressed in Equation (18) [41].

$$IR\left(x,y\right)=F_i{P}_i\left(x,y\right)$$

(17)

$$IR(x,y)=\sum _{i=1}^n{F}_i{P}_i(x,y)$$

(18)

In this study, the frequency of event occurrence was defined based on the accident scenarios listed in Table 2. Subsequently, the frequency of events with the applied mitigation was also determined, considering the failure probability of the selected shutoff valve as a mitigation device (as defined in Table 7). Furthermore, considering the population density presented in Table 5 for day and night and the ratios provided in Table 6 for day and night, the IR results for day and night were combined and presented. The calculated IR results based on the application of the shutoff valve are presented in

Table 16. IR data for each case.

Case	Facility	$\mathbf{Risk} ({\mathbf{y}\mathbf{r}}^{-1}$)	Percentage (%)
Without shutoff valve	HP Storage tank	1.67 × 10−5	26.72
	MP Storage tank	1.63 × 10−5	26.17
	Tube trailer	2.93 × 10−5	47.11
	Total	6.24 × 10−5	100.00
With single shutoff valve	HP Storage tank	1.82 × 10−6	26.77
	MP Storage tank	1.78 × 10−6	26.13
	Tube trailer	3.20 × 10−6	47.10
	Total	6.80 × 10−6	100.00
With dual shutoff valve	HP Storage tank	2.00 × 10−7	26.77
	MP Storage tank	1.96 × 10−7	26.13
	Tube trailer	3.52 × 10−7	47.10
	Total	7.48 × 10−7	100.00

.

Risks expressed with a very low probability are distinguished by the as low as reasonably practicable (ALARP) concept. The ALARP concept is a crucial element in the risk assessment framework used to regulate and manage industrial risks, signifying that it is reasonably achievable or practicable [42,43]. ALARP evaluates risks into three levels defining the unacceptable and broadly acceptable risk levels: unacceptable (intolerable), acceptable (tolerable), and broadly acceptable. The risk-level criteria vary from country to country. In this study, the IR of HRS facilities was analyzed by evaluating the IR for operators and the public separately based on the HSE’s ALARP standards. HSE sets the acceptable risk level at 1 × 10⁻³ for operators and 1 × 10⁻⁴ for the public, considering risks below 1 × 10⁻⁷ as negligible for both operators and the public [44].

The analysis of IR for the HRS facilities revealed that, irrespective of the application of the shutoff valve, the influence of tube trailers was significant in all cases. The primary accident scenario for tube trailers was a jet fire in the case of a massive leakage scenario, constituting 99.92% of the accidents originating from tube trailers and contributing 76.32% of the total IR for tube trailers. The analysis results based on the scenarios showed that the risk associated with fireballs in the catastrophic rupture scenario was 99%, whereas in the leak scenario, jet fires accounted for over 99% of the total IR. The risk associated with jet fires and fireballs varies based on the amount of material involved in the fire and explosion and is heavily influenced by the leakage rate of the material. Consequently, the IR for the tube trailer with the highest leakage rate was the highest, whereas the IR for the HP and MP storage tanks with similar leakage rates were nearly identical. Without a shutoff valve, the total IR was 6.24 × 10⁻⁵, with the tube trailer IR at 2.93 × 10⁻⁵, constituting 47.11% of the total IR. With a single shutoff valve system, the total IR was 6.80 × 10⁻⁶, with tube trailer IR at 3.20 × 10⁻⁶, also constituting 47.11% of the total IR. With a double shutoff valve system, the total IR was 7.48 × 10⁻⁷ with tube trailer IR at 3.52 × 10⁻⁷, constituting 47.10% of the total IR. The total IR without a shutoff valve and with a single shutoff valve system is recommended to be within the acceptable risk range according to the HSE ALARP standards. The application of a double shutoff valve system mitigated the risk to levels below HSE’s broadly acceptable risk threshold.

Based on the calculated IR for each facility,

Table 17. IR of operator and public.

Case	Group	Total Risk Integral
Without shutoff valve	Operator	6.16 × 10−5
	Public	7.91 × 10−7
With single shutoff valve	Operator	6.75 × 10−6
	Public	5.21 × 10−8
With dual shutoff valve	Operator	7.43 × 10−7
	Public	5.73 × 10−9

presents the IR for operators and the public. The IR for the Public was found to be at a broadly acceptable risk level even without mitigation through a shutoff valve. However, for the operators, the risk level was not within a broadly acceptable range, and mitigation through the application of a shutoff valve was deemed necessary.

In the case where the shutoff valve is not applied, the risk for the public is 7.91 × 10⁻⁷, and the risk for the operator is 6.16 × 10⁻⁵. The IR for the public was broadly acceptable, and that for the operator was at an acceptable risk level, which is recommended as a level within the acceptable risk range according to HSE standards.

With a single shutoff valve applied, the risk for the public is 5.21 × 10⁻⁸, and the risk for the operator is 6.75 × 10⁻⁶. The IR for the public decreased to a broadly acceptable risk level, while the IR for the operator still remained at an acceptable risk level, which is recommended to be mitigated to below 1 × 10⁻⁶.

In the case of applying a double shutoff valve system, the risk for the public is 5.73 × 10⁻⁹, and the risk for the operator is 7.43 × 10⁻⁷. Therefore, the application of a double shutoff valve system ensured that the IR for the public and the operator was secured at broadly acceptable levels and below broadly acceptable levels.

The contours of Outdoor and Indoor IR based on the application of the shutoff valve are presented in Figure 4, Figure 5 and Figure 6 and present the contours of Outdoor and Indoor IR based on the application of the shutoff valve. The IR contour reduced in size and frequency based on the application of the shutoff valve, and the double shutoff valve system significantly decreased the frequency of IR contours to below 1 × 10⁻⁷, with the range of contours not contacting the external walls of surrounding buildings.

3.4. SR of Each Case

SR is expressed as a relationship between the frequency of occurrences and the number of fatalities. It is determined based on the sum of total IR for the facilities within the accident scenarios, considering the number of fatalities [41]. The SR for the case with the shutoff valve is shown in Figure 7. The SR is assessed based on the acceptable risk level and broadly acceptable level according to the ALARP. The UK HSE’s ALARP criteria set the maximum acceptable risk for the probability of one fatality at 1 × 10⁻² and the broadly acceptable risk at 1 × 10⁻⁴. In contrast, the ALARP criteria in the Netherlands set the maximum acceptable risk for the probability of one fatality at 1 × 10⁻³ and the minimum acceptable risk at 1 × 10⁻⁵ [45,46]. Therefore, in this study, the SR was analyzed using the ALARP criteria from the Netherlands to conservatively evaluate the reduction level of risk and propose minimum installation requirements for the shutoff valve.

The SR analysis results showed that the SR for the HRS without shutoff valve installation was within the ALARP criteria of the Netherlands, with a probability of one fatality of 5.22 × 10⁻⁵. When applying a single shutoff valve system, the probability of one fatality decreased to 5.75 × 10⁻⁶, placing the SR below the ALARP criteria. In particular, in the case of a dual shutoff valve system, the probability of one fatality significantly dropped to 6.32 × 10⁻⁷, well below the ALARP criteria, thus reducing the risk to a broadly acceptable level of 1 × 10⁻⁶. Therefore, to manage the risk of the target HRS below an acceptable level, it was confirmed that risk mitigation through the application of IPL with a value of 1.21 × 10⁻² or higher for the dual shutoff valve system is necessary.

4. Conclusions

In this study, a QRA for catastrophic rupture and leakage scenarios of a high-pressure storage tank, medium-pressure storage tank, and tube trailer in an HRS was conducted using SAFETI v.8.9. The QRA was performed using CA, IR, and SR analyses. This study examined the risk mitigation effects of applying a shutoff valve as a safety device in an HRS, proposed the minimum installation requirements for the shutoff valve to meet the ALARP criteria, and suggested the minimum mitigation requirements for other safety devices. The key findings are as follows.

• In the CA analysis results for the leakage scenarios, there was little difference in the effective range of the jet fire and VCE among the target facilities because of their similar maximum leakage rates. However, for catastrophic rupture scenarios, the effective range was proportional to the mass, with the tube trailer having the largest impact range for fireballs and VCE. In the leakage scenarios, jet fire and VCE occurred, with jet fires occurring in all leak scenarios. The flame length of jet fires was around 20.5 m, and the impact distance up to 4 kW/m² was around 33.5 m. VCE occurred only in large- and medium-leak scenarios, with the explosion occurring downwind at a distance of 40 m in the large-leak scenario and downwind distances of 20 m and 10 m in the medium-leak scenario. The impact distance of up to 1 psi was approximately 34 m for the large-leak scenario and approximately 7.5 m for the medium-leak scenario. In the catastrophic rupture scenario, fireball and VCE occurred, with fireball diameters of 12.1 m and 12.79 m for the HP storage tank and MP storage tank, respectively, and 16.96 m for the tube trailer. The impact distances up to 4 kW/m² were approximately 100.24 m and 105.58 m for the HP storage tank and MP storage tank, respectively, and 137.87 m for the tube trailer. VCE occurred downwind at 10 m for both the HP storage tank and MP storage tank, with impact distances of approximately 81.69 m and 86.96 m, respectively. For the tube trailer, the VCE occurred downwind at 20 m, with an impact distance of up to 113.18 m.
• In the IR analysis, regardless of the application of the shutoff valve, the tube trailer had the highest risk in all cases, contributing to over 47% of the total IR. The total IR for cases with and without a single shutoff valve system is recommended as an acceptable risk level within the HSE ALARP criteria. For the double shutoff valve system, the application effectively controlled the IR below the HSE ALARP criteria. The Total IR for the without shutoff valve case was 6.24 × 10⁻⁵, with IRs for the HP storage tank, MP storage tank, and tube trailer being 1.67 × 10⁻⁵, 1.63 × 10⁻⁵, and 2.93 × 10⁻⁵, respectively. For the single shutoff valve system case, the Total IR was 6.80 × 10⁻⁶, with IRs for the HP storage tank, MP storage tank, and tube trailer being 1.82 × 10⁻⁶, 1.78 × 10⁻⁶, and 3.20 × 10⁻⁶, respectively. In the double shutoff valve system case, the Total IR was 7.48 × 10⁻⁷, with IRs for the HP storage tank, MP storage tank, and tube trailer being 2.00 × 10⁻⁷, 1.96 × 10⁻⁷, and 3.52 × 10⁻⁷, respectively. Furthermore, the operator and public IRs were 6.16 × 10⁻⁵ and 7.91 × 10⁻⁷, respectively, for the without shutoff valve case, 6.75 × 10⁻⁶ and 5.21 × 10⁻⁸ for the single shutoff valve system case, and 7.43 × 10⁻⁷ and 5.73 × 10⁻⁹ for the double shutoff valve system case.
• The SR for cases with and without the shutoff valve fell within the ALARP criteria in the Netherlands. The SR of the double shutoff valve system was effectively controlled below the Netherlands ALARP criteria. This indicates that the application of the double shutoff valve system or safety devices with a mitigation value exceeding 1.21 × 10⁻² can successfully manage the risk of urban HRS to a level below the broadly acceptable risk according to the Netherlands ALARP criteria.

Based on the research results, the installation of a dual shutoff valve system in urban hydrogen refueling stations (HRSs) is recommended to safely control the risk below the as low as reasonably practicable (ALARP) criteria. Additionally, installing a detector with the same mitigation value as the dual shutoff valve system is recommended to alleviate the frequency of accidents. In cases where accident prevention and mitigation devices with a value exceeding 1.21 × 10⁻² are not installed in urban HRS, additional protective barriers should be installed to directly mitigate the impact of accidents, or emergency evacuation manuals should be strengthened to minimize human casualties. This study can serve as fundamental data for designing safety barrier systems, including valves, in future research, and can be used as a basis for designing safety barrier systems with various levels of mitigation. Although this study aimed to compare the risk of an HRS with that of gas stations through a preliminary QRA using gas station leakage frequency, the lack of accident scenario regulations and resulting data in the preliminary research prevented a comprehensive evaluation. Therefore, in future research, we plan to utilize this study method to quantitatively assess the risk of existing gas stations and compare it with the risk of the HRS are required.