Evaluation of Safety Measures of a Hydrogen Fueling Station Using Physical Modeling

Hydrogen fueling stations are essential for operating fuel cell vehicles. If multiple safety measures in a hydrogen fueling station fail simultaneously, it could lead to severe consequences. To analyze the risk of such a situation, we developed a physical model of a hydrogen fueling station, which, when using, the temperature, pressure, and flow rate of hydrogen could be simulated under normal and abnormal operating states. The physical model was validated by comparing the analytical results with the experimental results of an actual hydrogen fueling station. By combining the physical model with a statistical method, we evaluated the significance of the safety measures in the event wherein multiple safety measures fail simultaneously. We determined the combinations of failures of safety measures that could lead to accidents, and suggested a measure for preventing and mitigating the accident scenario.


Introduction
Hydrogen is widely considered a clean source of energy from the viewpoint of reduction in carbon dioxide emissions.If hydrogen can be produced from renewable energy, it can make a big contribution to the realization of a sustainable society.Various efforts have been made to develop a hydrogen energy society.Among them, the pioneering work has been on social implementation of fuel cell vehicles (FCVs) and hydrogen fueling stations.Hydrogen fueling stations are essential for operating FCVs.FCVs have been sold commercially since December 2014, and several hydrogen-fueling stations have been constructed and are in operation worldwide [1].However, approximately 50 accidents and incidents involving hydrogen-fueling stations have been reported [2].Sakamoto et al. [2] analyzed accidents and incidents at hydrogen fueling stations in Japan and the USA to identify the safety issues.Most types of accidents and incidents are small leakages of hydrogen, but some have led to serious consequences, such as fire.Most of the leakages occurred at the joint parts due to inadequate torque and inadequate sealing.Other causes include design error of the main bodies of apparatuses and human error.For the commercialization of FCVs, it is essential to identify and assess the overlooked risks.
Figure 1 shows a schematic of the risk assessment of hydrogen fueling stations.The risks involved in two types of hydrogen fueling stations were identified using a hazard identification (HAZID) study [3,4].The leakage of hydrogen due to an accident is important for the consequence analysis.Many studies focused on the hydrogen release behavior [5][6][7].It is necessary to evaluate the maximum amount of hydrogen released from each facility to conduct the consequence analysis of the worst-case scenario for which the consequence is the highest.The risk assessment based on the maximum amount of hydrogen released was conducted [8][9][10][11].Moreover, the rate of hydrogen released from each facility is necessary for risk assessment considering the frequency [12][13][14].With regard to the hydrogen release rate, experiments were conducted and the results were reported [15][16][17][18][19].Although the risk assessments of each component, such as pipes and accumulators, have been conducted, quantitative risk assessments considering the entire hydrogen fueling station are lacking.For example, if multiple safety measures in a hydrogen fueling station fail simultaneously, it could lead to serious accidents.Only a few studies have been conducted regarding the relationship of operative and/or inoperative safety measures with the hydrogen release behavior.
In this study, we developed a physical model, capable of simulating the entire operation of a hydrogen fueling station.Physical modeling is a method used to express the physical phenomena via mathematical equations using mechanics, thermodynamics, and fluid dynamics.Reddi et al. [20] developed a physical model of a hydrogen fueling station to obtain high efficiency during the normal operation and reduce cost.The model was used for normal operation wherein the hydrogen-release behavior was neglected.
We developed a physical model that can reflect the hydrogen-release behavior occurring in a hydrogen fueling station.The physical modeling can contribute to the risk identification and consequence analysis in Figure 1.For example, using the physical model, we can calculate the hydrogen-release rate for the estimation of the consequences of hydrogen explosion and fire accidents.In this study, we used the physical model for risk identification.In Section 2, we described the method of developing the physical model.In Sections 3-5, we evaluated the significance of safety measures using the physical model and statistical methods considering that multiple safety measures fail simultaneously because of accidents.In this study, we applied the method to the risk identification of a hydrogen fueling station.
Sustainability 2018, 10, x FOR PEER REVIEW 2 of 17 inadequate torque and inadequate sealing.Other causes include design error of the main bodies of apparatuses and human error.For the commercialization of FCVs, it is essential to identify and assess the overlooked risks.
Figure 1 shows a schematic of the risk assessment of hydrogen fueling stations.The risks involved in two types of hydrogen fueling stations were identified using a hazard identification (HAZID) study [3,4].The leakage of hydrogen due to an accident is important for the consequence analysis.Many studies focused on the hydrogen release behavior [5][6][7].It is necessary to evaluate the maximum amount of hydrogen released from each facility to conduct the consequence analysis of the worst-case scenario for which the consequence is the highest.The risk assessment based on the maximum amount of hydrogen released was conducted [8][9][10][11].Moreover, the rate of hydrogen released from each facility is necessary for risk assessment considering the frequency [12][13][14].With regard to the hydrogen release rate, experiments were conducted and the results were reported [15][16][17][18][19].Although the risk assessments of each component, such as pipes and accumulators, have been conducted, quantitative risk assessments considering the entire hydrogen fueling station are lacking.For example, if multiple safety measures in a hydrogen fueling station fail simultaneously, it could lead to serious accidents.Only a few studies have been conducted regarding the relationship of operative and/or inoperative safety measures with the hydrogen release behavior.
In this study, we developed a physical model, capable of simulating the entire operation of a hydrogen fueling station.Physical modeling is a method used to express the physical phenomena via mathematical equations using mechanics, thermodynamics, and fluid dynamics.Reddi et al. [20] developed a physical model of a hydrogen fueling station to obtain high efficiency during the normal operation and reduce cost.The model was used for normal operation wherein the hydrogen-release behavior was neglected.
We developed a physical model that can reflect the hydrogen-release behavior occurring in a hydrogen fueling station.The physical modeling can contribute to the risk identification and consequence analysis in Figure 1.For example, using the physical model, we can calculate the hydrogen-release rate for the estimation of the consequences of hydrogen explosion and fire accidents.In this study, we used the physical model for risk identification.In Section 2, we described the method of developing the physical model.In Sections 3-5, we evaluated the significance of safety measures using the physical model and statistical methods considering that multiple safety measures fail simultaneously because of accidents.In this study, we applied the method to the risk identification of a hydrogen fueling station.

Model of Hydrogen Fueling Station
Figure 2 shows the schematic of on-site and off-site hydrogen-fueling stations.The hydrogen-fueling stations can be roughly classified into two types: An on-site hydrogen fueling station and an off-site hydrogen fueling station.In the on-site hydrogen fueling stations, it is possible to produce hydrogen using the water electrolysis method, organic chemical hydride method, and steam reforming method with methane, liquefied petroleum gas, liquefied natural gas, and naphtha wherein the hydrogen production facilities are located inside the station.However, in the off-site hydrogen fueling station, there is no hydrogen production facility in the station, and the hydrogen produced outside the station is transported to the station.In the two types of hydrogen refueling stations, the common components are compressors, accumulators, and dispensers.The chemical substance involved with the common components is just hydrogen.In this study, the common components, pipes, and safety measures were modeled as one system.The inner diameter of the pipe was 6.5 mm.The safety measures were modeled in accordance with the Article 7-3 of the High Pressure Gas Safety Act as listed in Table 1.The High Pressure Gas Safety Act is a Japanese regulation and its purpose is to prevent disasters caused by high pressure gas and secure public safety.The modeling and analysis were conducted using 1D multi-domain physical modeling software (SimulationX ver.3.7, ESI ITI GmbH, Dresden, Germany).Figure 3 shows the schematic of the model of the hydrogen fueling station.

Model of Hydrogen Fueling Station
Figure 2 shows the schematic of on-site and off-site hydrogen-fueling stations.The hydrogenfueling stations can be roughly classified into two types: An on-site hydrogen fueling station and an off-site hydrogen fueling station.In the on-site hydrogen fueling stations, it is possible to produce hydrogen using the water electrolysis method, organic chemical hydride method, and steam reforming method with methane, liquefied petroleum gas, liquefied natural gas, and naphtha wherein the hydrogen production facilities are located inside the station.However, in the off-site hydrogen fueling station, there is no hydrogen production facility in the station, and the hydrogen produced outside the station is transported to the station.In the two types of hydrogen refueling stations, the common components are compressors, accumulators, and dispensers.The chemical substance involved with the common components is just hydrogen.In this study, the common components, pipes, and safety measures were modeled as one system.The inner diameter of the pipe was 6.5 mm.The safety measures were modeled in accordance with the Article 7-3 of the High Pressure Gas Safety Act as listed in Table 1.The High Pressure Gas Safety Act is a Japanese regulation and its purpose is to prevent disasters caused by high pressure gas and secure public safety.The modeling and analysis were conducted using 1D multi-domain physical modeling software (SimulationX ver.3.7, ESI ITI GmbH, Dresden, Germany).Figure 3 shows the schematic of the model of the hydrogen fueling station.

Safety Measure Position
Figure 3. Schematic of the physical model of a hydrogen fueling station.

Compressor Modeling
Figure 4 shows the model of compressor in the Simulation X.The discharge flow rate of the compressor is 1200 Nm 3 /h, which is maintained at a constant regardless of the pressure at the inlet and outlet sides by providing feedback control to the rotation speed of the compressor.The pressure of the hydrogen trailer, which is the suction pressure of the compressor, is 45 MPa, which is increased to 85 MPa using a compressor.When the internal pressures of all the accumulators fall below 82 MPa, the switching valve between the compressor and the accumulator opens automatically and the compressor sends compressed hydrogen to the accumulator.Subsequently, the valve closes when the pressures in all the accumulators reach 82 MPa.

Compressor Modeling
Figure 4 shows the model of compressor in the Simulation X.The discharge flow rate of the compressor is 1200 Nm 3 /h, which is maintained at a constant regardless of the pressure at the inlet and outlet sides by providing feedback control to the rotation speed of the compressor.The pressure of the hydrogen trailer, which is the suction pressure of the compressor, is 45 MPa, which is increased to 85 MPa using a compressor.When the internal pressures of all the accumulators fall below 82 MPa, the switching valve between the compressor and the accumulator opens automatically and the compressor sends compressed hydrogen to the accumulator.Subsequently, the valve closes when the pressures in all the accumulators reach 82 MPa.

Compressor Modeling
Figure 4 shows the model of compressor in the Simulation X.The discharge flow rate of the compressor is 1200 Nm 3 /h, which is maintained at a constant regardless of the pressure at the inlet and outlet sides by providing feedback control to the rotation speed of the compressor.The pressure of the hydrogen trailer, which is the suction pressure of the compressor, is 45 MPa, which is increased to 85 MPa using a compressor.When the internal pressures of all the accumulators fall below 82 MPa, the switching valve between the compressor and the accumulator opens automatically and the compressor sends compressed hydrogen to the accumulator.Subsequently, the valve closes when the pressures in all the accumulators reach 82 MPa.

Accumulator Modeling
To efficiently fill hydrogen into the FCV, three different accumulators are employed in terms of the pressure: A high-pressure tank, a medium-pressure tank, and a low-pressure tank.First, the FCV tank is pressurized to 65 MPa using the low-pressure tank.The filling tank switches from the low-pressure tank to the medium-pressure tank by switching the valve.Second, the FCV tank is pressurized to 75 MPa using the medium-pressure tank.Finally, the FCV tank is pressurized to 80 MPa using the high-pressure tank.When the pressure in the FCV tank reaches 80 MPa, the filling-selector valve closes and the filling is completed.While the FCV is being filled using the accumulator, hydrogen is charged from the compressor to the accumulator, and each tank is pressurized to 82 MPa in the following order: The low-pressure tank, the medium-pressure tank, and the high-pressure tank.Because the pressure difference between the high-pressure tank and the FCV tank is small, it is impossible to boost the FCV tank.Thus, toward the end, the hydrogen is directly pushed from the compressor to the FCV tank.

Dispenser Modeling
A direction-control valve in the dispenser closes when the pressure in the FCV tank reaches 80 MPa.Although the actual filling flow rate depends on the pressures of the FCV tank and accumulator, the filling flow rate in the model is maintained at a constant by adjusting the degree of opening of the flow control valve using a feedback control with the help of a flow meter.The FCV tank is filled with hydrogen from 10 MPa to 80 MPa in 3 min.Considering the capacity of the FCV tank (122.4L), the flow rate required to fill the tank in 3 min is approximately 1000 Nm 3 /h.In this model, the filling flow rate is maintained at a constant at 1000 Nm 3 /h by adjusting the following flow control valves: A flow control valve with a high flow rate (900 Nm 3 /h), and a flow control valve with a low flow rate (100 Nm 3 /h).
As the FCV tank is being rapidly filled with hydrogen, the temperature inside the tank increases, with the possibility of exceeding the design criteria.Thus, a general dispenser is provided with a heat exchanger to cool the charged hydrogen.A heat-exchanger model is developed so that the temperature of hydrogen during the filling would be approximately −40 • C. If the pressure inside the dispenser remains high after the filling, the coupler cannot be removed from the FCV.Therefore, after the filling, the pressure is generally reduced by releasing the hydrogen to the atmosphere using a relief valve.In this model, the hydrogen is vented to the atmosphere between the coupler and the directional control valve.

Validation
The model was validated by comparing its results with the experimental results [21] in the filling of the FCV in an actual hydrogen station.Figure 5 shows the simulation results using Simulation X and experimental results [21] in the filling of the FCV. Figure 5 shows the tank pressure, tank temperature, inlet pressure, inlet temperature, and inlet mass flow rate with respect to time.As shown in Figure 5, the analyzed values have the same trend as the experimental values with respect to the tank pressure, tank temperature, and inlet mass flow rate.The tank capacity of the simulation is slightly lower than that of the experiment.The tank capacities of the simulation and experiment are 122.4L and 129 L, respectively.Therefore, the inlet mass flow rate of the simulation becomes smaller than that of the experiment from approximately 90 s.In the simulation, the temporary increase of the inlet mass flow rate at approximately 120 s and 140 s is due to the accumulator switching.On the other hand, the temporary increase of the inlet mass flow rate at approximately 170 s is due to a start of direct-pushing from the compressor.This is because the difference of the pressure between the accumulator (82 MPa) and FCV tank (80 MPa) is extremely small and the pressure of the accumulator decreases during the fueling.The temporary increase of the inlet mass flow rate is very small.However, the tendency between the analytical and experimental values differs with respect to the inlet pressure and inlet temperature.The inlet pressure calculated using the simulation reaches 80 MPa in the initial stage of the filling, and thereafter, exhibits the same tendency as that of the experimental values.The inlet temperature calculated using the simulation rapidly drops to −40 • C immediately after the filling, and thereafter, becomes largely constant.This is because the location of the inlet chosen in the simulation is different from that in the experiment.That is, although the exact location of the inlet in the experiment is unknown, the location of the inlet in the simulation is assumed to be closer to the switching valves than that in the experiment.Therefore, the temperature and pressure of the inlet rapidly change.As shown in Figure 5, the changes in the inlet pressure and inlet temperature at approximately 120 s and 140 s are due to the Joule-Thomson effect, which can be reproduced using the simulation.The maximum/minimum values of various parameters in the simulation roughly agree with those of the experiment.Although there are some differences, we used the hydrogen-fueling-station model in this study.
as that of the experimental values.The inlet temperature calculated using the simulation rapidly drops to −40 °C immediately after the filling, and thereafter, becomes largely constant.This is because the location of the inlet chosen in the simulation is different from that in the experiment.That is, although the exact location of the inlet in the experiment is unknown, the location of the inlet in the simulation is assumed to be closer to the switching valves than that in the experiment.Therefore, the temperature and pressure of the inlet rapidly change.As shown in Figure 5, the changes in the inlet pressure and inlet temperature at approximately 120 s and 140 s are due to the Joule-Thomson effect, which can be reproduced using the simulation.The maximum/minimum values of various parameters in the simulation roughly agree with those of the experiment.Although there are some differences, we used the hydrogen-fueling-station model in this study.

Leakage Model
The leakage model considering the accidents was defined such that the analysis value was consistent with the experimental value [15,16].We compared the analysis values to the experimental values for two types of flow conditions: A subsonic flow wherein the pressure in the pipe is low and a choked flow wherein the pressure in the pipe is high.Figure 6 shows the leakage model developed using Simulation X.In this study, the throttle element was used for the leakage model.Table 2

Leakage Model
The leakage model considering the accidents was defined such that the analysis value was consistent with the experimental value [15,16].We compared the analysis values to the experimental values for two types of flow conditions: A subsonic flow wherein the pressure in the pipe is low and a choked flow wherein the pressure in the pipe is high.Figure 6 shows the leakage model developed using Simulation X.In this study, the throttle element was used for the leakage model.Table 2 lists [15].They measured the leakage behavior using a pipe internal pressure of 40 kPa (gauge) for two pinhole diameters of 0.8 mm and 2.0 mm.Their experimental results [15] are plotted in Figure 7.In this study, we simulated the leakage behaviors under the same conditions as in their experiments.Figure 7 shows the analysis results obtained using the values of 0.8C and 0.7C.As shown in Figure 7, it was found that the value obtained by multiplying C by 0.8 is closer to the experimental value with respect to the leakage model wherein the leakage diameters are 0.8 mm and 2.0 mm.[15].They measured the leakage behavior using a pipe internal pressure of 40 kPa (gauge) for two pinhole diameters of 0.8 mm and 2.0 mm.Their experimental results [15] are plotted in Figure 7.In this study, we simulated the leakage behaviors under the same conditions as in their experiments.Figure 7 shows the analysis results obtained using the values of 0.8C and 0.7C.As shown in Figure 7, it was found that the value obtained by multiplying C by 0.8 is closer to the experimental value with respect to the leakage model wherein the leakage diameters are 0.8 mm and 2.0 mm.[15].They measured the leakage behavior using a pipe internal pressure of 40 kPa (gauge) for two pinhole diameters of 0.8 mm and 2.0 mm.Their experimental results [15] are plotted in Figure 7.In this study, we simulated the leakage behaviors under the same conditions as in their experiments.Figure 7 shows the analysis results obtained using the values of 0.8C and 0.7C.As shown in Figure 7, it was found that the value obtained by multiplying C by 0.8 is closer to the experimental value with respect to the leakage model wherein the leakage diameters are 0.8 mm and 2.0 mm.

Choked Flow
Figure 8 shows the simulation results for leakage diameters of 2, 1, and 0.5 mm.In the leakage model, the initial internal pressure of the pipe was set to 50 MPa.These are the results obtained by multiplying the sonic conductance by 0.8.The plots in Figure 8 show the experimental results for leakage diameters of 2, 1, and 0.5 mm [16].The hydrogen-release flow is obtained for pipe internal pressures of approximately 40, 30, 20, and 10 MPa.As shown in Figure 8, it was found that the simulation results are in good agreement with the experimental results as in the case of the subsonic flow.We chose the sonic conductance as 0.8 times the theoretical value to reflect the influence of the pressure loss due to the shape of the nozzle.Thus, the hydrogen-release flow was estimated using the model wherein the theoretical value of the sonic conductance is multiplied by 0.8.In this model, the simulation result was verified to be in good agreement with the experimental result of the hydrogen behavior for a pipe internal pressure of 50 MPa, but it was not verified for a pressure of 50 MPa or more.8 shows the simulation results for leakage diameters of 2, 1, and 0.5 mm.In the leakage model, the initial internal pressure of the pipe was set to 50 MPa.These are the results obtained by multiplying the sonic conductance by 0.8.The plots in Figure 8 show the experimental results for leakage diameters of 2, 1, and 0.5 mm [16].The hydrogen-release flow is obtained for pipe internal pressures of approximately 40, 30, 20, and 10 MPa.As shown in Figure 8, it was found that the simulation results are in good agreement with the experimental results as in the case of the subsonic flow.We chose the sonic conductance as 0.8 times the theoretical value to reflect the influence of the pressure loss due to the shape of the nozzle.Thus, the hydrogen-release flow was estimated using the model wherein the theoretical value of the sonic conductance is multiplied by 0.8.In this model, the simulation result was verified to be in good agreement with the experimental result of the hydrogen behavior for a pipe internal pressure of 50 MPa, but it was not verified for a pressure of 50 MPa or more.

Evaluation of Safety Measures in the Event of Accidents
In this section, we evaluated the significance of the safety measures for the case wherein multiple safety measures fail simultaneously.We combined the physical model and the response surface methodology (RSM), which is a collection of mathematical and statistical techniques used to develop an empirical model.The accident scenarios for evaluating the safety measures were divided into two cases, as shown in Figure 9.In the first case, as shown in Figure 9a, the safety measures are arranged in series with respect to the accident scenario.In the second case, as shown in Figure 9b, the safety measures are arranged in parallel with respect to the accident scenario.In the first case, we can analyze all the accident scenarios.However, in the second case, it is difficult to analyze all the accident scenarios because the number of combinations of safety-measure failures is considerable.Thus, design of experiments (DOE) was additionally employed for the second case.

Evaluation of Safety Measures in the Event of Accidents
In this section, we evaluated the significance of the safety measures for the case wherein multiple safety measures fail simultaneously.We combined the physical model and the response surface methodology (RSM), which is a collection of mathematical and statistical techniques used to develop an empirical model.The accident scenarios for evaluating the safety measures were divided into two cases, as shown in Figure 9.In the first case, as shown in Figure 9a, the safety measures are arranged in series with respect to the accident scenario.In the second case, as shown in Figure 9b, the safety measures are arranged in parallel with respect to the accident scenario.In the first case, we can analyze all the accident scenarios.However, in the second case, it is difficult to analyze all the accident scenarios because the number of combinations of safety-measure failures is considerable.Thus, design of experiments (DOE) was additionally employed for the second case.The following is the procedure for evaluating the significance of the safety measures when they are arranged in series with respect to the accidents.
1. Determination of initial event; 2. Identification of effective safety measures against the initial event; 3. Creation of event tree diagram using initial event and safety measures; 4. Calculation of hydrogen-release rate of each event using physical model; and 5. Evaluation of safety measures using RSM.
The following is the procedure for evaluating the significance of the safety measures when they are arranged in parallel with respect to the accidents.
1. Determination of initial event; 2. Identification of effective safety measures against the initial event; 3. Creation of design matrix of DOE; 4. Calculation of hydrogen-release rate of events using physical model; and 5. Evaluation of safety measures using RSM.

Results of Safety Measures for Accidents Arranged in Series
The initial event is defined when, as shown in Figure 9a, hydrogen leaks through a leakage hole with a diameter of 1 mm of the dispenser nozzle during the filling of the FCV with hydrogen.The initial value of the pressure is 82 MPa.The following is the procedure for evaluating the significance of the safety measures when they are arranged in series with respect to the accidents.
Identification of effective safety measures against the initial event; 3.
Creation of event tree diagram using initial event and safety measures; 4.
Calculation of hydrogen-release rate of each event using physical model; and 5.
Evaluation of safety measures using RSM.
The following is the procedure for evaluating the significance of the safety measures when they are arranged in parallel with respect to the accidents.
Identification of effective safety measures against the initial event; 3.
Creation of design matrix of DOE; 4.
Calculation of hydrogen-release rate of events using physical model; and 5.
Evaluation of safety measures using RSM.

Results of Safety Measures for Accidents Arranged in Series
The initial event is defined when, as shown in Figure 9a, hydrogen leaks through a leakage hole with a diameter of 1 mm of the dispenser nozzle during the filling of the FCV with hydrogen.The initial value of the pressure is 82 MPa.
In Figure 9a, the blue line indicates the path of hydrogen when the hydrogen leaks.The safety measures on this line are considered effective against the initial event, as listed in Table 3.The overfill preventing valve of the dispenser has the same function as that of the isolation valve in case of an emergency.At the time of filling the FCV with hydrogen, the accumulator is concurrently boosted using the compressor, and the isolation valve between the compressor and the accumulator is in effect.In Figure 9a and Table 3, numbers are assigned to the safety measures.Figure 10 shows the event tree diagram of the accident scenario.The final events were classified into two types: Small leakage and large leakage.The small leakage was defined as the state wherein the line was interrupted between the accumulator and the leakage hole.With respect to the small leakage events, the same amount of hydrogen release was defined.The large leakage was defined as the state wherein the line was connected between the accumulator and the leakage hole.As shown in Figure 10, numbers were assigned to the events.
Sustainability 2018, 10, x FOR PEER REVIEW 10 of 17 In Figure 9a, the blue line indicates the path of hydrogen when the hydrogen leaks.The safety measures on this line are considered effective against the initial event, as listed in Table 3.The overfill preventing valve of the dispenser has the same function as that of the isolation valve in case of an emergency.At the time of filling the FCV with hydrogen, the accumulator is concurrently boosted using the compressor, and the isolation valve between the compressor and the accumulator is in effect.In Figure 9a and Table 3, numbers are assigned to the safety measures.Isolation valve (compressor-accumulator) Prevention of boost Figure 10 shows the event tree diagram of the accident scenario.The final events were classified into two types: Small leakage and large leakage.The small leakage was defined as the state wherein the line was interrupted between the accumulator and the leakage hole.With respect to the small leakage events, the same amount of hydrogen release was defined.The large leakage was defined as the state wherein the line was connected between the accumulator and the leakage hole.As shown in Figure 10, numbers were assigned to the events.The amounts of hydrogen released in the events, 1-7, were calculated by simulating the physical model, which is given in Section 2. In the simulation, the amount of hydrogen released in 240 s was calculated.Figure 11 shows the hydrogen-release behaviors of the events, 1-7.The amounts of hydrogen released in the events, 1-7, were calculated by simulating the physical model, which is given in Section 2. In the simulation, the amount of hydrogen released in 240 s was calculated.Figure 11 shows the hydrogen-release behaviors of the events, 1-7.To evaluate the significance of the safety measures, the consequence effects due to the failure combinations of the safety measures were evaluated using the RSM.The response surface is a function used to express the variation in a characteristic value with the help of an explanatory variable.The characteristic value, y, is obtained using Equation (2).An: Coefficient Using one of the two functions, i.e., x1 and x4, the hydrogen release can be shut off.When both x2 and x3 functions are applicable, the hydrogen release can be shut off.In this case, the first term in Equation ( 3) is zero.Equation ( 4) is obtained by expanding and rearranging Equation (3) with new coefficients.
x1x2x4, x1x2x4x5, x1x3x4, and x1x3x4x5 are regarded as variables.In Equation ( 4), the coefficient, Bn, reflects the degree of influence of a failure combination of the safety measures.Considering Equation (4) and Figure 11, Table 4 lists the matrix.The response surface was obtained using the multiple regression To evaluate the significance of the safety measures, the consequence effects due to the failure combinations of the safety measures were evaluated using the RSM.The response surface is a function used to express the variation in a characteristic value with the help of an explanatory variable.The characteristic value, y, is obtained using Equation (2).
A i (i = 1, 2 . . ., n) is the constant, x i (i = 1, 2 . . ., n) is the explanatory variable, and ε is the error.In this study, y is the amount of hydrogen released in 240 s, and x i is the function of the safety measures.Equation (3) represents the response surface of the accident scenario.
y: Amount of hydrogen released in 240 s [kg].
A n : Coefficient Using one of the two functions, i.e., x 1 and x 4 , the hydrogen release can be shut off.When both x 2 and x 3 functions are applicable, the hydrogen release can be shut off.In this case, the first term in Equation ( 3) is zero.Equation ( 4) is obtained by expanding and rearranging Equation (3) with new coefficients.
x 1 x 2 x 4 , x 1 x 2 x 4 x 5 , x 1 x 3 x 4 , and x 1 x 3 x 4 x 5 are regarded as variables.In Equation ( 4), the coefficient, B n , reflects the degree of influence of a failure combination of the safety measures.Considering Equation ( 4) and Figure 11, Table 4 lists the matrix.The response surface was obtained using the multiple regression analysis with the matrix listed in Table 4. Table 5 lists the results of the multiple regression analysis.By substituting the values of B n in Equation ( 4), we obtained Equation (5).
Considering B n , the influence degree of x 1 x 2 x 4 is found to be the highest.Therefore, in the accident scenario considered during this time, the combination of failures of the overfill preventing valve, flow control valve (high flow rate), and isolation valve (compressor-dispenser) has the highest influence degree.However, the influence degrees of x 1 x 3 x 4 and x 1 x 3 x 4 x 5 are relatively low.The RSM is used to quantitatively evaluate the influence degree of the accident scenario.This might contribute to the design of safety measures in the detailed design stage.For example, if the risk due to a combination of failures of the safety measures cannot be tolerated, the safety measures should be controlled using different electrical systems.

Results of Safety Measures for Accidents Arranged in Parallel
The initial event is defined when, as shown in Figure 9b, hydrogen leaks through a leakage hole with a diameter of 1 mm of the pipe between the accumulator and the dispenser.The initial pressure is 82 MPa.
The safety measures, listed in Table 6, are considered effective against the initial event.Table 6 lists the functions of the safety measures.In Figure 9b and Table 6, numbers were assigned to the safety measures.(2 6 ) orthogonal array table, to which the safety measures are allocated, and the analysis results.We set 1 and 0 as dummy variables for failure and success of the safety measures, respectively.The simulation analysis was conducted with the failure combinations of 12 types of safety measures, as listed in Table 7.

Conclusions
To analyze the risk of a hydrogen fueling station, we developed a physical model of a hydrogen fueling station, which, when using, the temperature, pressure, and flow rate of the hydrogen could be simulated under normal and abnormal operating states.The physical model was validated by comparing it with the experimental results of an actual hydrogen fueling station.Using the physical model and statistical methods, we evaluated the significance of the safety measures in the case wherein multiple safety measures fail simultaneously.We determined the combinations of failures of safety measures that could lead to severe consequence of accidents and proposed a measure for preventing and mitigating the accident scenario.In particular, in the case of the safety measures for accidents arranged in series, the combination of failures of the overfill preventing valve, flow control valve (high flow rate), and isolation valve (compressor-dispenser) had the highest influence degree.If the risk due to the combination of failures of the safety measures cannot be tolerated, the safety measures should be controlled using different electrical systems.

Conclusions
To analyze the risk of a hydrogen fueling station, we developed a physical model of a hydrogen fueling station, which, when using, the temperature, pressure, and flow rate of hydrogen could be simulated under normal and abnormal operating states.The physical model was validated by comparing it with the experimental results of an actual hydrogen fueling station.Using the physical model and statistical methods, we evaluated the significance of the safety measures in the case wherein multiple safety measures fail simultaneously.We determined the combinations of failures of safety measures that could lead to severe consequence of accidents and proposed a measure for preventing and mitigating the accident scenario.In particular, in the case of the safety measures for accidents arranged in series, the combination of failures of the overfill preventing valve, flow control valve (high flow rate), and isolation valve (compressor-dispenser) had the highest influence degree.If the risk due to the combination of failures of the safety measures cannot be tolerated, the safety measures should be controlled using different electrical systems.

Figure 1 .
Figure 1.Schematic of risk assessment of hydrogen fueling stations.Figure 1.Schematic of risk assessment of hydrogen fueling stations.

Figure 1 .
Figure 1.Schematic of risk assessment of hydrogen fueling stations.Figure 1.Schematic of risk assessment of hydrogen fueling stations.

Figure 2 .
Figure 2. Schematic of on-site and off-site hydrogen fueling stations.

Figure 4 .
Figure 4. Model of compressor in Simulation X.

Figure 3 .
Figure 3. Schematic of the physical model of a hydrogen fueling station.

Sustainability 2018 , 17 Figure 3 .
Figure 3. Schematic of the physical model of a hydrogen fueling station.

Figure 4 .
Figure 4. Model of compressor in Simulation X.

Figure 4 .
Figure 4. Model of compressor in Simulation X.

Figure 5 .
Figure 5. Simulation results using Simulation X and experimental results obtained by Immel and Mack-Gardner [21].
lists the parameters of the leakage model.The C-b description was used in the flow equation of the leakage model.The C-b description is expressed using Equation (1).

Figure 5 .
Figure 5. Simulation results using Simulation X and experimental results obtained by Immel and Mack-Gardner [21].
the parameters of the leakage model.The C-b description was used in the flow equation of the leakage model.The C-b description is expressed using Equation (1).

Figure 7 .
Figure 7. Simulation results of hydrogen release behavior under the subsonic flow in terms of different diameters of the leakage hole: (a) d = 0.8 mm, and (b) d = 2.0 mm.

Figure 7
Figure 7 shows the simulation results indicating the relationship between the flow rate and the pipe internal pressure in terms of the diameters of the leakage hole, d: (a) d = 0.8 mm, and (b) d = 2.0 mm.The National Institute of Advanced Industrial Science and Technology (AIST) reported the experimental results of the leakage tests[15].They measured the leakage behavior using a pipe internal pressure of 40 kPa (gauge) for two pinhole diameters of 0.8 mm and 2.0 mm.Their experimental results[15] are plotted in Figure7.In this study, we simulated the leakage behaviors under the same conditions as in their experiments.Figure7shows the analysis results obtained using the values of 0.8C and 0.7C.As shown in Figure7, it was found that the value obtained by multiplying C by 0.8 is closer to the experimental value with respect to the leakage model wherein the leakage diameters are 0.8 mm and 2.0 mm.

Figure 7 .
Figure 7. Simulation results of hydrogen release behavior under the subsonic flow in terms of different diameters of the leakage hole: (a) d = 0.8 mm, and (b) d = 2.0 mm.

Figure 7 .
Figure 7. Simulation results of hydrogen release behavior under the subsonic flow in terms of different diameters of the leakage hole: (a) d = 0.8 mm, and (b) d = 2.0 mm.

Figure 8 .
Figure 8. Simulation results of hydrogen release behavior under the choked-flow condition for different diameters of the leakage hole of 2.0, 1.0, and 0.5 mm.

Figure 8 .
Figure 8. Simulation results of hydrogen release behavior under the choked-flow condition for different diameters of the leakage hole of 2.0, 1.0, and 0.5 mm.

9 of 16 17 Figure 9 .
Figure 9. Safety measures for accident scenarios arranged in (a) series and (b) parallel.

Figure 9 .
Figure 9. Safety measures for accident scenarios arranged in (a) series and (b) parallel.

Figure 10 .
Figure 10.Event tree diagram of the accident scenario shown in Figure 8a.

Figure 10 .
Figure 10.Event tree diagram of the accident scenario shown in Figure 8a.

Figure 13 .
Figure 13.Average values of hydrogen release for safety measures (diameter of leakage hole is 5.0 mm).

Figure 13 .
Figure 13.Average values of hydrogen release for safety measures (diameter of leakage hole is 5.0 mm).

Table 1 .
Safety measures installed by adhering to the High Pressure Gas Safety Act.

Table 2 .
Analysis conditions used to verify the leakage model.

Table 2 .
Analysis conditions used to verify the leakage model.

Table 2 .
Analysis conditions used to verify the leakage model.

Table 3 .
Effective safety measures against the initial event.

Table 3 .
Effective safety measures against the initial event.

Table 4 .
Analysis conditions and results.

Table 5 .
Result of multiple regression analysis.

Table 6 .
Effective safety measures against the initial event.

Table 7
lists the L 12