Risk Analysis of Hydrogen Leakage at Hydrogen Producing and Refuelling Integrated Station

Abstract

Hydrogen energy is considered the most promising clean energy in the 21st century, so hydrogen refuelling stations (HRSs) are crucial facilities for storage and supply. HRSs might experience hydrogen leakage (HL) incidents during their operation. Hydrogen-producing and refuelling integrated stations (HPRISs) could make thermal risks even more prominent than those of HRSs. Considering HL as the target in the HPRIS, through the method of fault tree analysis (FTA) and analytic hierarchy process (AHP), the importance degree and probability importance were appraised to obtain indicators for the weight of accident level. In addition, the influence of HL from storage tanks under ambient wind conditions was analysed using the specific model. Based upon risk analysis of FTA, AHP, and ALOHA, preventive measures were obtained. Through an evaluation of importance degree and probability importance, it was concluded that misoperation, material ageing, inadequate maintenance, and improper design were four dominant factors contributing to accidents. Furthermore, four crucial factors contributing to accidents were identified by the analysis of the weight of the HL event with AHP: heat, misoperation, inadequate maintenance, and valve failure. Combining the causal analysis of FTA with the expert weights from AHP enables the identification of additional crucial factors in risk. The extent of the hazard increased with wind speed, and yet wind direction did not distinctly affect the extent of the risk. However, this did affect the direction in which the risk spreads. It is extremely vital to rationally plan upwind and downwind buildings or structures, equipment, and facilities. The available findings of the research could provide theoretical guidance for the applications and promotion of hydrogen energy in China, as well as for the proactive safety and feasible emergency management of HPRISs.

1. Introduction

Hydrogen energy can reduce environmental pollution and energy shortage to a certain extent [1,2,3]. Hydrogen has been widely recognised as one of the most promising energy sources in the 21st century due to its cleanliness and efficiency, as well as its abundance [4,5,6]. Numerous countries have prioritised hydrogen development in production, preservation, transportation, and utilisation to better achieve low-carbon economies. Hydrogen refuelling stations (HRSs) play a pivotal role in the future of hydrogen energy [7,8]. Data from the H2 station and the China Hydrogen Energy Alliance indicate that there are over 800 HRSs worldwide, with China accounting for 245 by the end of 2022, as illustrated in Figure 1. China has rapidly developed various types of HRSs, as depicted in Figure 2. Hydrogen-producing and refuelling integrated stations (HPRISs) integrate hydrogen production, preservation, and utilisation for various typical applications. HPRISs could mitigate the risks associated with transport to some extent. Hydrogen exhibits a wide inflammability range (4–75%) and low ignition energy (0.018 mJ) [9]. These properties tend to trigger spontaneous combustion, jet fires, flash fires, combustion, and explosions, resulting in additional personal casualties and property losses [10,11]. Moreover, hydrogen in the high temperatures and pressures (typically 35 to 70 MPa) of HPRISs is prone to leakage. In recent years, hydrogen incidents have attracted distinct attention worldwide. Norway experienced a hydrogen safety incident in 2019 that resulted in two injuries. In the USA, North Carolina experienced a hydrogen explosion, causing approximately 60 houses to be damaged. Implementing immediate safety measures during the initial stages could minimise the risk of hydrogen incidents.

The European Union has painstakingly devised the European Norm 17127 standard [12,13]. This standard provides a regulatory scaffold for HRSs, covering the entire process from design conceptualisation to construction and daily operation. With risk mitigation as the key focus, it effectively strengthens safety protection. In the United States, the main reliance is on the NFPA 2 standard [14,15]. This standard covers a wide range of hydrogen energy technology aspects and sets out safety management rules for HRSs in a comprehensive and systematic way. It includes detailed regulations about equipment safety standards and operation procedures. In China, the safety design of HRSs stringently complies with the national standard [16,17]. This standard focuses on the crucial aspects of hydrogen storage and distribution and analyses potential safety perils in depth. It also formulates highly specific safety measures and regulatory prescriptions to ensure the HRSs operate securely and stably. Consequently, nations and regions across the globe have swiftly responded by enacting hydrogen energy safety standards that are customised to meet their specific requirements [18,19]. The main purpose of these actions is to proficiently handle the wide variety of potential risks related to hydrogen energy infrastructure. Presently, the international hydrogen safety standard regime is undergoing continuous enhancement. However, there are still notable differences. These differences can be seen in the specific provisions and focal points of the regulatory frameworks. The reasons for these differences are the disparities in national circumstances, energy strategies, and industrial development trajectories.

Risk assessment (RA) methods encompass quantitative risk assessment (QRA), fault tree analysis (FTA), analytic hierarchy process (AHP), Bayesian networks, and other methodologies [20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35]. Kim et al. [22] proposed the RA model of hydrogen energy infrastructure using a relative risk index. They assessed the risk associated with hydrogen-related processes and technology and determined the relative risk levels of each infrastructure. Tsunemi et al. [23] considered ignition probability and failure probability. They conducted QRA to not only assess risks to human life during the operation of HRSs, but also calculate the probability of accidents in three accident scenarios. Kang et al. [24] constructed a multilevel variable-weight fuzzy Petri net. They also identified the evolutionary paths of the explosion risk and determined the most likely accidental root causes. According to the findings derived from these studies, the characteristics of FTA, QRA, AHP, and Bayesian networks are compared and summarised, as presented in

Table 1. The characteristics of FTA, QRA, AHP, and Bayesian networks.

FTA	The accident causation is depicted by a tree diagram [25,26].
	FTA has simple operability and convenient utilisation. FTA can systematically and comprehensively identify the paths that cause malfunctions [27].
	FTA is graphic and very clear [28].
QRA	The focus is on the quantification of risk levels [29].
AHP	The focus is the assessment of the relative weight of multiple criteria or multiple options. Furthermore, a pairwise comparison was applied to quantify subjective judgements [30,31].
	The focus is priority ranking of importance on key factors. It also focuses on the multiple decision-making [32].
Bayesian networks	The accident causation is depicted by graph theory and probability theory [33].
	It encompasses prior information and the construction of conditional probability distributions, which is relatively complex [34,35].

.

The diffusion characteristics of hydrogen leakage (HL) in HRSs are influenced by factors such as wind speed, wind direction, leakage volume, and ventilation facilities [36,37]. Li et al. [38] employed CFD software to investigate the impacts of ventilation scenarios and ambient wind on the diffusion characteristics of HL in mobile hydrogen refuelling stations. Li et al. [39] utilised ANSYS Fluent software to scrutinise hydrogen diffusion characteristics under constant and variable wind speeds. Cui et al. [40] scrutinised the effects of wind direction, temperature, and humidity on the diffusion characteristics of HL at Ningbo seaport, Zhejiang Province, PR China. They found that the risk of HL was higher when the wind direction was opposite to the leakage; however, the influence of temperature and humidity on HL risk was minimal instead. As indicated by these studies, a variable wind speed could result in larger gas cloud sizes and increased risk. The influence of wind speed on the radial diffusion of hydrogen volume concentration is notable.

As the research needs to clearly and intuitively present the causation of the fault, and it also needs to be simple and easy, the FTA is selected for fault analysis. There are subjective factors in FTA fault analysis. A decision is made to quantify subjective judgment factors. Specifically, the research introduced the AHP on the basis of FTA. The method formed was a combined FTA-AHP analysis. The following steps have two advantages through this integration. First, the strengths of FTA in systematically organising the fault logic structure can be maximally harnessed. Second, with the aid of AHP, the subjective insights of experts or decision-makers can be effectively translated into quantifiable weights. Consequently, fault risks can be appraised in a more comprehensive and precise manner by FTA-AHP analysis.

In this study, the AHP method was introduced and combined with the FTA method to better assess the risk of HL in HPRISs. The research also investigated the influence of uncontrollable environmental factors, such as wind, on HL accidents in HPRISs. The study’s findings could offer valuable insights into how to forestall leakage incidents in HPRISs.

2. Method and Simulation

2.1. Analysis of Fault Tree Analysis

FTA is primarily used to analyse potential accidents and failures in engineering systems or processes, as well as to identify the root causes of such accidents [41]. Furthermore, FTA can analyse paths and likelihoods of accidents by constructing logical fault tree structures, which further aid in the identification and assessment of potential risks in the system [42]. This method can derive minimum cut sets and minimal path sets, conduct importance degree analysis, and perform probabilistic importance analysis using FTA.

The construction of a fault tree is divided into six parts.

(a)

The first part is the objective or top accident [43]. The target of this research is HL.

(b)

The second part is the identification of factors contributing to accidents [44].

(c)

The third part is the classification of these factors [45].

(d)

The fourth part is the identification of the root cause [25]. These root causes are basic events.

(e)

The fifth part is the establishment of causal relationships between all factors by logic gates [43].

(f)

The sixth is the formation of a fault tree [46]. According to fault theory, certain rules should be adhered to during the process [27].

The following steps are for the identification of the minimum cutting set [47].

(a)

First, start with the top event and employ the top-down approach to convert the fault tree into equivalent Boolean equations.

(b)

Second, two Boolean laws should be applied to eliminate redundancies. Two Boolean laws are the distributive law and the law of absorption.

(c)

Third, enumerate all the simplified minimal combinations. These combinations are the minimum cutting set of fault trees.

The minimum cut set indicates the hazard level of the system, whereas the minimum path set reflects the safety level [48]. The difference in hazard will be indicated by the sign. An increase in the count of minimal cut sets tends to elevate the overall hazard level in an accident tree. More minimal path sets indicate a safer system.

The importance degree is a qualitative evaluation. The following steps are for calculating the degree of importance [47,48,49,50].

(a)

First, determine all minimum cut sets in the fault tree.

(b)

Second, the cutting set in which the basic event $X_i$ will be contained will be determined.

(c)

Third, calculate the weight value $1/2^{n_j-1}$ of each cutting set where the basic event $X_i$ is located. $n_j$ is the total number of basic events in the cut set where the basic event is located.

(d)

Fourth, calculate the product $1-(1/2^{n_j-1})$ of the contributing values for each cutting set.

(e)

Fifth, subtract the product of the previous step from 1. In addition, derive the importance degree of the root causes $X_i$. The formula for calculating the structural importance is given in Equation (1).

$$I_{\Phi (i)}=1-{\displaystyle \prod _{X_i\in k_j}(1-1/2^{n_j-1})}$$

(1)

The probabilistic importance degree is a quantitative evaluation. The following steps are for calculating the probabilistic importance degree [49,50]. This is to further assess the extent to which variations in the occurrence probabilities of basic events can affect the occurrence probability of the top–level event. Then, there is a need to analyse the probability and importance of basic events. The occurrence probability function of top events has a specific property, which is a multiple linear function. The multilinear function is the sum of the products of the elementary events of each minimal cut set. By taking the first-order partial derivative with respect to the independent variable, the probability importance coefficient of each basic event can be simply obtained, as illustrated in Equation (2).

$$I_g(X_i)={\displaystyle \frac{\partial \mathrm{g}(P)}{\partial P_{X_i}}}$$

(2)

2.2. Analysis of Analytic Hierarchy Process

The AHP method, which combines both quantitative and qualitative elements, is useful in the analysis of multi-criteria decision-making. It is commonly used to model the hierarchy, construct judgment matrices (JM), and conduct consistency tests [48,51].

The following steps are for the construction of a hierarchy [32,52,53,54,55].

(a)

The first step is the objective. This objective is also the target level. The target layer is represented by the letter A. The letter A refers to HL, which will be mentioned.

(b)

The second step is the intermediate factors that affect the objective. The origins of intermediate factors are derived by categorising the results of the FTA analysis. Intermediate factors are refinements and decompositions of the objective. These are independent of each other and comprehensively cover all aspects affecting the objective. The standardised layer is also the set of all intermediate factors. The standardised layer is represented by $B_m(m=1,2,\dots ,m)$. $m$ is the total number of intermediate factors.

(c)

The third step is the specific solution. The index layer is also the set of all specific options. The index layer factors are represented by $C_{mn}$$(m=1,2,\dots ,m$; $n=1,2,\dots ,n)$. $n$ is the total number of factors in the index layer where intermediate factor $B_m$ is located.

(d)

The fourth step is to arrange the objective, the intermediate factors and the scheme in an order from the top to the bottom.

(e)

The fifth step is the formation of a structural model.

(f)

The sixth step is to establish relationships between objective and intermediate factors and between intermediate factors and scheme by lines.

(g)

The seventh step is to form a hierarchy, as illustrated in Figure 3.

The following steps are for the creation of a judgement matrix [56,57,58].

(a)

The first step is the definition of the scale of comparison; the scale of comparison is the commonly used 1–9 scale [58], as listed in

Table 2. The scale of comparison.

Scale	Implication
1	Factor i was parallel with factor j.
3	Factor i was slightly more important than factor j.
5	Factor i was notably more important than factor j.
7	Factor i was much important than factor j.
9	Factor i was absolutely important with factor j.
2, 4, 6, and 8	Intermediate value of above five values.

.

(b)

The second step is the determination of comparison values. When the intermediate factor is a $B_m$, the schemes are $C_{m1}$, $C_{m2}$, …, $C_{mn}$. If $i$ and $j$ are both the scheme $C_{mn}$ of $B_m$, then comparison value is $c_{ij}=1/c_{ij}=1$. And $i$ is the scheme $C_{mn}$ of $B_m$, $j$ is the other scheme $C_{mn}$ of $B_m$, then comparison value is $c_{ij}$ or $1/c_{ij}$. The comparative values are determined based upon comparative scales, $i\in$ ($C_{m1}$, $C_{m2}$, …, $C_{mn}$), $j\in$ ($C_{m1}$, $C_{m2}$, …, $C_{mn}$).

(c)

The third step is the derivation of the other values of the scheme on $B_m$ ($m$ = 1, 2, …, $m$), in turn, as the fourth step. The matrix $B_x$ is obtained as follows: Equation (3). These matrices are known as JM.

$$B_x=\left[\begin{array}{cccc}1& {\mathrm{c}}_{12}& \dots & {\mathrm{c}}_{1n}\\ 1/{\mathrm{c}}_{12}& 1& \dots & {\mathrm{c}}_{2n}\\ \dots & \dots & 1& \dots \\ 1/{\mathrm{c}}_{1n}& 1/{\mathrm{c}}_{2n}& \dots & 1\end{array}\right]$$

(3)

A consistency test means that the judgements of the scheme in the JM should be logically consistent. Furthermore, the degree of importance is in accordance with a certain logical relationship. The consistency test includes three parameters: consistency index (CI), consistency ratio (CR), and random consistency index (RCI).

The steps hereinafter are for the calculation of CR.

(a)

The first step is to obtain the largest eigen-root ${\lambda }_{\max }$ of each JM, where the intermediate factor $B_m$ is located by mathematical calculation [50].

(b)

The second step is the calculation of CI, as follows in Equation (4), and $y$ is the matrix order.

$$CI={\displaystyle \frac{({\lambda }_{\max }-y)}{(y-1)}}$$

(4)

(c)

Finally, the CR is calculated through Equation (5). Based upon the order $y$ of the JM, the corresponding RCI value is obtained from the table of RCI, as presented in

Table 3. RI standard value [31].

Matrix order	1	2	3	4	5	6	7	8	9	10
RCI	0	0	0.58	0.90	1.12	1.24	1.32	1.41	1.45	1.49

.

$$CR={\displaystyle \frac{CI}{RCI}}$$

(5)

The CR can be checked by calculating the CI and the RCI. If CR < 0.1, the JM is considered acceptable [59]. The research is concerned with risk factors. At this point, the weights of the risk factors calculated on the basis of this scoring matrix are reliable. Limited resources are allocated proportionally to the various defence and control measures on the basis of these weights. If CR > 0.1, the values need to be readjusted. After several iterations, the CRs of all matrices finally meet the requirement CR < 0.1. The new weights are then used to allocate resources.

If CR < 0.1, the following steps are for the calculation of the weight values of the scheme in the matrix.

(a)

The first step is to calculate the sum of the absolute values on each row element. The value of the sum is denoted by $s_i$. $i$ is the JM row count. $s_i$ is shown in Equation (6).

$$s_1=1+\left|c_{12}\right|+\dots +\left|c_{1n}\right|,s_2=\left|1/c_{12}\right|+1+\dots +\left|c_{2n}\right|,\dots ,s_i=\left|1/c_{1n}\right|+\left|1/c_{2n}\right|+\dots +1$$

(6)

(b)

The second step is to carry out the normalisation, and the normalised matrix is represented by $B_x^{\prime }$, as presented in Equation (7). $b_{1j}^{\prime }=c_{1n}/(1+\left|c_{12}\right|+\dots +\left|c_{1n}\right|)$.

$$B_x^{\prime }=\left[\begin{array}{cccc}{b}_{11}^{\prime }& b_{12}^{\prime }& \dots & b_{1j}^{\prime }\\ b_{21}^{\prime }& b_{22}^{\prime }& \dots & b_{2j}^{\prime }\\ \dots & \dots & \dots & \dots \\ b_{n1}^{\prime }& b_{n2}^{\prime }& \dots & b_{nj}^{\prime }\end{array}\right]$$

(7)

(c)

The third step is the determination of the weight vector $\omega$ of $B_x^{\prime }$ [59], as presented in Equation (8).

$$\omega =\left[\begin{array}{c}{\omega }_1\\ {\omega }_2\\ \dots \\ {\omega }_n\end{array}\right]$$

(8)

(d)

The fourth step is to take the value of ${\omega }_1$, ${\omega }_2$, …, ${\omega }_n$. ${\omega }_1=(b_{11}^{\prime }+b_{12}^{\prime }+\dots +b_{1j}^{\prime })/j$, and other values of $\omega$ can be calculated in a similar way.

(e)

The fifth step is the determination of the weight values of the scheme, that is, ${\omega }_{C_{1n}}={\omega }_n$.

2.3. Simulation by Areal Location of Hazardous Atmosphere

ALOHA, known as a calculation program, was jointly developed by the Environmental Protection Agency (EPA) and the National Oceanic and Atmospheric Administration (NOAA) of the USA for the comprehensive assessment of the impact of hazardous chemical leakage [60,61]. It can be used to calculate the expansion process of hazardous chemicals in space to obtain the distribution of hazardous chemicals after leakage and the radiation range of potential accidents [62]. The critical concentration of fuel in the air is the inflammability level of concern. Fuel may pose a risk of inflammability when the concentration exceeds a certain threshold. The default indexes for the inflammable gas cloud of unignited HL were 40,000 ppm, 10% LEL, and 60% LEL.

Accidental HL may be a prominent contributor to explosion accidents. The consequences and impact of the accident closely depend on the diffusion mode [63]. According to data disclosed by the Chinese government, the major accidents involving hazardous chemicals are primarily concentrated from July to September yearly [64]. Therefore, various inflammable and hazardous chemicals are more prone to volatilisation and leakage during the high-temperature season.

There are several fundamental parts that typically need to be taken into account when employing ALOHA [61,65].

(a)

The initial part is to specify the city in which the chemical release takes place, together with the exact date and time.

(b)

The second part is about extracting chemicals from ALOHA’s chemical information database. Extract hydrogen from ALOHA’s chemical database, which is none other than CAMEO Chemicals 3.0.0.

(c)

The third step is to enter details pertaining to the prevailing weather conditions. Enter the parameters that indicate weather conditions, including wind speed, wind direction, temperature, humidity, and environment.

(d)

The fourth part is to provide a description of how the chemical substance manages to escape from the containment. Configure the type and storage status of the storage tank, along with the location and size of the leak port. The relevant parameters are presented in Table 4. Choose the type of dispersion calculation for ALOHA.

(e)

The fifth part involves instructing ALOHA to generate a threat-zone map. This map delineates regions where one or multiple hazards, such as toxicity, inflammability, thermal radiation, or destructive overpressure, have the potential to surpass the critical level of concern (LOC). These areas can pose a notable threat to both human lives and property.

(f)

In the sixth part, ALOHA is capable of presenting this threat-zone map on the MARPLOT^®-supplied electronic map of the city where the incident took place.

The initial part encompasses the following elements:

(a)

Input the date and time when the accident occurred.

(b)

Input the latitude, longitude, and altitude of the accident site to enable precise positioning on the satellite map. Specifically, we have selected a HPRIS situated in Dalian City, Liaoning Province, PR China. Its geographical coordinates are the location and the altitude of the storage tank in Table 4.

(c)

Identify the type of building that the toxic gas release might penetrate.

The limitations of the ALOHA 5.4.4 software:

(a)

It is of utmost necessity to have detailed information concerning local atmospheric conditions, the attributes of chemicals, and the leakage scenarios.

(b)

ALOHA is designed to provide a close upper bound to the threat distances associated with chemical spills. Wherever uncertainty is unavoidable, ALOHA will err in favour of overestimating rather than underestimating threat distances. In some cases, ALOHA will notably overestimate threat zones.

(c)

Typical scales for threat zones are in the range of 102 to 105 m, with durations of up to an hour.

Basic assumptions:

(a)

Given that the density of hydrogen is lower than that of air, the Gaussian model is selected by default.

(b)

Given that the HPRIS is in a suburban area, a bungalow-type building has been chosen.

Dalian, in general, features a temperate monsoon climate that is characterised by warm summers and relatively cold winters. As per the data furnished by the China Meteorological Administration, the average summer temperature at the HPRIS is 29 °C, with a relative humidity of 87%. Therefore, the initial ambient temperature of the storage tank is configured at 29 °C, and the relative humidity is adjusted to 87%. When comprehensively considering factors like compression energy consumption, the safety of the storage tank, and the investment in filling equipment, it is determined that the pressure of the high-pressure hydrogen storage tank is set at 45 MPa. A leakage aperture of 10 mm in the hydrogen storage tank aligns more closely with real-world scenarios. Tank diameter, tank height, and tank number are determined by referring to relevant literature sources [66,67,68].

Table 4. Input parameters.

Condition	Parameter
Location (latitude and longitude)	121.77° E, 39.17° N.
Altitude of the storage tank	72 m
Storage tank ambient temperature	29 °C
Relative humidity	87%
Tank diameter	4 m
Tank height	5 m
Tank number	4
Storage pressure	45 MPa
Leakage hole shape	Circular
Leakage hole diameter	10 mm

Table 4. Input parameters.

Condition	Parameter
Location (latitude and longitude)	121.77° E, 39.17° N.
Altitude of the storage tank	72 m
Storage tank ambient temperature	29 °C
Relative humidity	87%
Tank diameter	4 m
Tank height	5 m
Tank number	4
Storage pressure	45 MPa
Leakage hole shape	Circular
Leakage hole diameter	10 mm

This software can determine the hazardous area of the cloud following the leakage of storage tanks in Dalian City, Liaoning Province, PR China. The parameters of the simulation scenario in HPRISs are summarised in Table 4.

3. Results and Discussion

3.1. Assessment of FTA for Hydrogen Leakage

Essential equipment and facilities used in this study included dispensers, compressors, storage tanks, and other components. Hydrogen can readily leak and lead to explosions due to the sufficient energy available in these scenarios. While HPRISs mitigate the risks commonly associated with the fill-transport-unloading process, they elevate the risks related to hydrogen production equipment and cooling systems.

First, the intermediate events and basic events of the fault tree will be investigated and determined. Based on the literature review [9,24,69,70,71,72,73,74], the common intermediate events of hydrogen leakage in HRSs are summarised. Subsequently, the purification device of the HPRIS is taken into account through the disclosed data. Then, redundant events are removed. Thus, the intermediate events and basic events of the fault tree are determined. The top event, intermediate events, and basic events are replaced by symbols T, M, and X, respectively. It includes one top-level event, nine intermediate events $M_1$–$M_9$, and 15 basic events $X_1$–$X_{15}$. The basic meaning and description of each event are presented in

Table 5. Symbols and events expression for the fault tree of HL.

Symbol	Event Type	Symbol	Event Type
T	Hydrogen leakage	$X_4$	Switch failure
$M_1$	Overpressure	$X_5$	Compressor failure
$M_2$	Overcooling	$X_6$	Bleeder mal-functioning
$M_3$	Purification unit leakage	$X_7$	Refrigerant pipeline clogging
$M_4$	Overfilling	$X_8$	Pump default
$M_5$	Safety relief device leakage	$X_9$	Reactor coolant deficiency
$M_6$	Pressure relief device failure	$X_{10}$	Wrong parameter setting
$M_7$	Filling instruction signal reception failure	$X_{11}$	Sensor failure
$M_8$	Cooling system failure	$X_{12}$	Actuator failure
$M_9$	Control system failure	$X_{13}$	Misoperation
$X_1$	Heat	$X_{14}$	Inadequate maintenance
$X_2$	Valve failure	$X_{15}$	Material ageing
$X_3$	Improper design

. Finally, the top events, intermediate events, and basic events obtained are plotted in accordance with the logical gate relationships. The fault tree diagram is drawn using the freeFTA V1.0 software. In addition, the resulting fault tree is shown in Figure 4. The limitation of freeFTA software, the meaning described by the symbols M1–M9 is consistent with that of $M_1$–$M_9$. Furthermore, the meaning described by the symbols X1–X15 is consistent with that of $X_1$–$X_{15}$.

The minimum cut set and the minimum path set of FTA for HL were obtained using the Boolean algebra simplification method. The minimal cut sets are 14, and the minimal path sets are 8. The minimum cut sets and minimum path sets are listed in

Table 6. Minimum cut sets and minimum path sets of HL in FTA.

No.	Minimum Cut Set	No.	Minimum Cut Set	No.	Minimum Path Set
1	$(X_1{X}_2{X}_4{X}_5)$	9	$(X_8{X}_{10})$	1	$(X_1{X}_3{X}_7{X}_8{X}_9{X}_{13}{X}_{14}{X}_{15})$
2	$(X_{13})$	10	$(X_8{X}_{11})$	2	$(X_1{X}_3{X}_{10}{X}_{11}{X}_{12}{X}_{13}{X}_{14}{X}_{15})$
3	$(X_{14})$	11	$(X_8{X}_{12})$	3	$(X_2{X}_3{X}_7{X}_8{X}_9{X}_{13}{X}_{14}{X}_{15})$
4	$(X_{15})$	12	$(X_9{X}_{10})$	4	$(X_2{X}_3{X}_{10}{X}_{11}{X}_{12}{X}_{13}{X}_{14}{X}_{15})$
5	$(X_3)$	13	$(X_9{X}_{11})$	5	$(X_3{X}_4{X}_7{X}_8{X}_9{X}_{13}{X}_{14}{X}_{15})$
6	$(X_7{X}_{10})$	14	$(X_9{X}_{12})$	6	$(X_3{X}_4{X}_{10}{X}_{11}{X}_{12}{X}_{13}{X}_{14}{X}_{15})$
7	$(X_7{X}_{11})$			7	$(X_3{X}_5{X}_7{X}_8{X}_9{X}_{13}{X}_{14}{X}_{15})$
8	$(X_7{X}_{12})$			8	$(X_3{X}_5{X}_{10}{X}_{11}{X}_{12}{X}_{13}{X}_{14}{X}_{15})$

.

Minimal cut sets containing 1, 2, and 4 basic events are represented by sets 1, 4, and 9, respectively. Examination of the fault tree structure reveals 14 fundamental causes for HL events. The minimal path sets reveal eight feasible approaches to forestall the top event from occurring. Notably, none of the individual basic events within any of the minimal path sets occurred simultaneously, enabling stations to forestall leakage. Table 6 also illustrates the involvement of numerous basic events in the minimal path sets, indicating multiple viable methods for forestalling leakage. Therefore, further research is required to conduct an important degree analysis to better determine the impact of each basic event on the top event.

3.1.1. Analysis Regarding the Importance of a Degree in Basic Events

There is an insufficiency of effective data regarding hydrogen-related facilities and components within the HPRIS. Based on the literature review [9,21,24,69,70,71,72,73,74], the failure probability of each basic event is summarised. The failure probability of each basic event is presented in

Table 7. The failure probability of each basic event.

Symbol	Event Type	Basic Event Failure Probability	Symbol	Event Type	Basic Event Failure Probability
$X_1$	Heat	1.00 × 10−7	$X_9$	Reactor coolant deficiency	6.89 × 10−4
$X_2$	Valve failure	9.30 × 10−6	$X_{10}$	Wrong parameter setting	4.80 × 10−3
$X_3$	Improper design	6.00 × 10−5	$X_{11}$	Sensor failure	8.96 × 10−4
$X_4$	Switch failure	9.30 × 10−6	$X_{12}$	Actuator failure	7.45 × 10−4
$X_5$	Compressor failure	1.40 × 10−6	$X_{13}$	Misoperation	1.00 × 10−2
$X_6$	Bleeder malfunctioning	0	$X_{14}$	Inadequate maintenance	1.00 × 10−4
$X_7$	Refrigerant pipeline clogging	4.73 × 10−3	$X_{15}$	Material ageing	4.00 × 10−4
$X_8$	Pump default	6.40 × 10−5

.

Through calculations by Equation (1), the importance degree ranking of basic events followed: I(X₁₅) = I(X₁₄) = I(X₁₃) = I(X₃) > I(X₁₂) = I(X₁₁) = I(X₁₀) = I(X₉) = I(X₈) = I(X₇) = I(X₆) > I(X₅) = I(X₄) = I(X₂) = I(X₁).

The basic events are arranged in the colour-coded diagram by descending the degree of importance. Colours and arrows denote the degree of influence on the top event. A darker colour indicates a more important basic event, which has a greater influence on the top event. In the figure, the second column is the basic events, and the first column is the symbol of the basic event. The arrows pointing upwards signify relatively large impacts, while the arrows pointing downwards indicate relatively small impacts. Figure 5 presents the colour-coded diagram of the degree of importance of each basic event.

The compiled importance degree (Figure 5) indicates that there are four basic events with the highest importance in the fault tree: Material ageing, inadequate maintenance, misoperation, and improper design. Similarly, there are four basic events of the lowest importance: Compressor failure, switch failure, valve failure, and heat losses. This part of the study suggests that material ageing, misoperation, and inadequate maintenance are distinct contributors to accidents during the operation and maintenance of the HPRISs.

Based upon accident causation theory, the measures of control accidents include four factors: Operator, machine, management, and medium. Combining accident causation theories, material ageing is attributed to unsafe machine conditions, improper design, and misoperation belonging to unsafe anthropogenic behaviours; inadequate maintenance falls under inadequate management [75]. Consequently, research indicates that measures to alleviate leakage events and mitigate severe consequences should prioritise addressing issues related to anthropogenic, machine, and management.

However, individuals are influenced by psychological, physiological, organisational management, and other external environmental factors. Anthropogenic factors account for the highest proportion of accidents [76,77], and this highlights the primary importance of addressing unsafe human behaviours in leakage safety management. This is followed by addressing unsafe machine conditions and inadequate management.

3.1.2. Analysis Regarding the Probabilistic Importance in Basic Events

Through calculations by Equation (2), the probability importance of each basic event can be acquired where $g(P)=X_1{X}_2{X}_4{X}_5+X_{13}+X_{14}+X_{15}+X_3+X_7{X}_{11}+\dots +X_9{X}_{12}$. The probability importance values of each basic event and their symbols are presented in

Table 8. Probabilistic importance of $I_g(X_i)$.

${\mathit{I}}_{\mathit{g}}({\mathit{X}}_{\mathit{i}})$	Probability Importance	${\mathit{I}}_{\mathit{g}}({\mathit{X}}_{\mathit{i}})$	Probability Importance	${\mathit{I}}_{\mathit{g}}({\mathit{X}}_{\mathit{i}})$	Probability Importance
$I_g(X_1)$	1.1980 × 10−16	$I_g(X_6)$	0	$I_g(X_{11})$	5.3940 × 10−3
$I_g(X_2)$	1.2883 × 10−19	$I_g(X_7)$	6.3600 × 10−3	$I_g(X_{12})$	5.3932 × 10−3
$I_g(X_3)$	9.8947 × 10−1	$I_g(X_8)$	6.3300 × 10−3	$I_g(X_{13})$	9.9941 × 10−1
$I_g(X_4)$	1.2882 × 10−19	$I_g(X_9)$	6.3340 × 10−3	$I_g(X_{14})$	9.8951 × 10−1
$I_g(X_5)$	8.5574 × 10−19	$I_g(X_{10})$	5.4151 × 10−3	$I_g(X_{15})$	9.8981 × 10−1

.

Based upon the probability importance values of each basic event, the probabilistic importance follows the order: $I_g(X_{13})>I_g(X_{15})>I_g(X_{14})>I_g(X_3)>I_g(X_7)>I_g(X_9)>I_g(X_8)>I_g(X_{10})>I_g(X_{11})>I_g(X_{12})>$$I_g(X_1)>I_g(X_5)>I_g(X_2)>I_g(X_4)>I_g(X_6)$. The order shows that misoperation, material ageing, inadequate maintenance, and improper design are prominently predominant among all factors. These basic events can severely compromise HL safety in the HPRIS.

Additionally, HPRISs are characterised by abundant storage, extensive high-pressure equipment, and high heat [72]. HPRIS equipment (hydrogen storage tank and dispenser) operates in a high-pressure environment. The dispenser machine generates heat during the filling process. When the aforementioned equipment is operated repeatedly, HL becomes more frequent in various components, such as flanges, valves, instruments, compressors, filters, and other parts [78,79]. Frequent leakage of these components is indicative of unsafe machine conditions. HL accidents often occur under unstable conditions, both internally and externally, according to the trajectory intersection theory. The instability condition results from the interaction between unsafe human behaviours and unsafe machine conditions. The conclusion regarding probabilistic importance aligns with the degree of importance. Therefore, in conjunction with the analysis of Table 8 and Figure 5, it is evident that unsafe human behaviour is the primary concern in management and operation. The unsafe machine conditions and inadequate management are slightly less prominent than the unsafe behaviours of individuals [80].

3.2. Assessment of AHP for Hydrogen Leakage

3.2.1. Construction Model and Judgment Matrix of AHP

Based upon the qualitative and quantitative analysis results of FTA, operators, machines, medium, and management are selected as the intermediate factors in the standard layer of the AHP. The basic events within the FTA are selected as the scheme for the index layer. The intermediate factors are replaced by symbol $B$. It includes 1 objective and 4 intermediate events $B_1$–$B_4$. There are two schemes associated with $B_1$, eight schemes for $B_2$, two schemes for $B_3$, and three schemes for $B_4$. The two schemes within $B_1$ are described by the letters $C_{11}$–$C_{12}$. The eight schemes within $B_2$ are described by the letters $C_{21}$–$C_{28}$. The two schemes within $B_3$ are described by the letters $C_{31}$–$C_{32}$. The three within $B_4$ are described by the letters $C_{41}$–$C_{43}$. The AHP model is illustrated in Figure 6.

The JM for operators $(B_1)$, machine $(B_2)$, medium $(B_3)$, and management $(B_4)$ are as illustrated in Equation (9).

$$B_1=\left[\begin{array}{cc}1& 1/3\\ 3& 1\end{array}\right],B_2=\left[\begin{array}{cccccccc}1& 3& 5& 5& 4& 2& 3& 9\\ 1/3& 1& 3& 3& 1& 2& 3& 9\\ 1/5& 1/3& 1& 1/2& 1& 1/3& 1& 2\\ 1/5& 1/3& 2& 1& 1/2& 1& 2& 2\\ 1/4& 1/4& 1& 2& 1& 1/3& 1& 3\\ 1/2& 1/2& 3& 1& 3& 1& 2& 3\\ 1/3& 1/3& 1& 1/2& 1& 1/2& 1& 3\\ 1/9& 1/9& 1/2& 1/2& 1/3& 1/3& 1/3& 1\end{array}\right],B_3=\left[\begin{array}{cc}1& 7\\ 1/7& 1\end{array}\right],B_4=\left[\begin{array}{ccc}1& 1/5& 1/9\\ 5& 1& 1/3\\ 9& 3& 1\end{array}\right]$$

(9)

3.2.2. Consistency Test of Judgment Matrix

The maximum eigenvalue and eigenvector were obtained from matrices. The computation of the consistency for the judgment matrices is presented in

Table 9. Consistency test for JM.

Consistency Test	${\mathit{B}}_1$	${\mathit{B}}_2$	${\mathit{B}}_3$	${\mathit{B}}_4$
Maximum eigenvalue (${\lambda }_m$)	2.000	8.681	2.000	3.030
Matrix order ($y$)	2.000	8	2.000	3
Random consistency index (RCI)	0	1.410	0	0.580
Coincidence indicator (CI)	0	0.097	0	0.015
Coincidence ratio (CR)	0	0.069	0	0.026

.

As indicated in Table 9, all CR values of the JM are less than 0.1. This suggests that the weights are reasonably allocated and that the judgment matrices meet the consistency requirement. The weight vectors of each matrix are obtained through normalisation calculation, as illustrated in Equation (10).

$${\omega }_{B_1}=\left[\begin{array}{c}0.25\\ 0.75\end{array}\right],{\omega }_{B_2}=\left[\begin{array}{c}0.311\\ 0.255\\ 0.058\\ 0.080\\ 0.075\\ 0.128\\ 0.064\\ 0.029\end{array}\right],{\omega }_{B_3}=\left[\begin{array}{c}0.833\\ 0.167\end{array}\right],{\omega }_{B_4}=\left[\begin{array}{c}0.063\\ 0.265\\ 0.672\end{array}\right]$$

(10)

The correlation between the elements of the standardised layer and the factors of the index layer is listed in the table according to the values of the weight matrix. Factor weighting of the index layer can be seen in

Table 10. Factors weighting of index layer.

Element of Standardised Layer	Factor of Index Layer		Weight $\left({\mathbf{\omega }}_{{\mathbf{X}}_{\mathbf{i}}}\right)$
Operators	X3	Improper design	0.250
	X13	Misoperation	0.750
Machine	X2	Valve failure	0.311
	X4	Switch failure	0.255
	X5	Compressor failure	0.058
	X8	Pump default	0.080
	X11	Sensor failure	0.075
	X12	Actuator failure	0.128
	X15	Material ageing	0.064
	X6	Bleeder malfunctioning	0.029
Medium	X1	Heat	0.833
	X7	Refrigerant pipeline clogging	0.167
Management	X9	Reactor coolant deficiency	0.063
	X10	Wrong parameter setting	0.265
	X14	Inadequate maintenance	0.672

. The meaning described by the symbols $C_{11}$–$C_{12}$ is consistent with that of $X_3$ and $X_{13}$. The meaning described by the symbols $C_{21}$–$C_{28}$ is consistent with that of $X_2$, $X_4$, $X_5$, $X_8$, $X_{11}$, $X_{12}$, $X_{15}$, $X_2$, $X_{13}$, and $X_6$. The meaning described by the symbols $C_{31}$–$C_{32}$. Is consistent with that of $X_1$, and $X_7$. The meaning described by the symbols $C_{41}$–$C_{43}$. Is consistent with that of $X_9$, $X_{10}$, and $X_{14}$.

The factors can be ordered as follows in terms of their weights: ${\omega }_{X_1}>{\omega }_{X_{13}}>{\omega }_{X_{14}}>{\omega }_{X_2}>{\omega }_{X_{10}}>{\omega }_{X_4}$ ${\omega }_{X_3}>{\omega }_{X_7}>{\omega }_{X_{12}}>{\omega }_{X_8}>{\omega }_{X_{11}}>{\omega }_{X_{15}}>{\omega }_{X_9}>{\omega }_{X_5}>{\omega }_{X_6}$. Hence, factor $X_1$ (heat) is the largest weight, whereas factor X6 is the smallest weight. It can be observed from Table 10 that heat ($X_1$), misoperation ($X_{13}$), inadequate maintenance ($X_{14}$), and valve failure ($X_2$) are noticeable causes of accidents. These factors result from poor medium, unsafe operator behaviour, inadequate management, and unsafe conditions of machines, respectively. Based upon the theories of accident causation and trajectory intersection theory, accidents primarily depend on these factors. Medium serves as the prerequisite condition for unsafe operator behaviour and unsafe conditions of machines [81,82,83]. The results of FTA and AHP are presented in

Table 11. The results presented of FTA and AHP.

FTA	AHP
Misoperation (9.9941 × 10−1)	Heat (0.833)
Material ageing (9.8981 × 10−1)	Misoperation (0.750)
Inadequate maintenance (9.8951 × 10−1)	Inadequate maintenance (0.672)
Improper design (9.8947 × 10−1)	Valve failure (0.311)

.

It can be found by comparing the results of FTA and AHP that the FTA method primarily emphasises the factors directly associated with the probability of accident occurrence, such as misoperation, material ageing, inadequate maintenance, and improper design. These factors are predominantly grounded in the logical connections of the fault tree, enabling a quantitative analysis of the causal relationships among events. The AHP utilises expert scoring in conjunction with weight calculation techniques to comprehensively evaluate the relative importance of various environmental and human-induced factors. The obtained results through AHP demonstrate that heat holds the most position within the AHP analysis, with a weight value of 0.833. This is followed by misoperation, which is assigned a weight of 0.750, and inadequate maintenance, having a weight of 0.672.

The utilisation of FTA or AHP methods alone makes it difficult to fully identify causal relationships and relative weights of complex accident factors [84,85]. This research brings together the FTA and AHP methods. It maintains the logical derivation traits of FTA and simultaneously incorporates the subjective assessment of factor weights from AHP. As a result, the risk assessment results become more comprehensive and accurate [86,87]. The FTA analysis finds that misoperation and material ageing are the principal causes of accidents, while the AHP further gauges the importance of heat and valve failure. Note that this outcome is partially consistent with certain results obtained from the FTA. However, the AHP approach introduces additional crucial factors, with heat being one of them. The AHP result prominently features heat (0.833) as a crucial risk factor, which is not adequately represented in the standalone FTA analysis, thereby suggesting that the combined approach is capable of identifying certain important factors that are challenging to quantify by FTA alone.

3.3. Simulation of Hydrogen Storage Tank Leakage Dispersion

3.3.1. Impact Zones of Ambient Wind Speed on HL for Hydrogen Storage Tanks

The meteorological data collected from these areas of Dalian City, Liaoning Province, PR China, was examined, and the wind speed was set to 3.0, 4.0, 5.0, and 6.0 m/s. The measurement point height was 3 m above the ground. The influence of wind speed on the HL was primarily reflected in cloud transport, concentration dilution, and air entrainment. The impact zones of the inflammable gas cloud movement and dispersion at wind speeds of 3.0, 4.0, 5.0, and 6.0 m/s, respectively, are demonstrated in Figure 7.

As depicted in Figure 7, when the wind speeds changed from 3.0 to 6.0 m/s, the distances from the inflammable gas clouds diffused in the yellow zone to the leakage source were 462, 394, 348 and 315 m, respectively. The distances decreased rapidly with the wind speed. A similar swift decrease was obtained for the other zones (orange zone and red zone). The width of the inflammable gas cloud also decreased when the wind speed increased. This trend can be attributed to the high flow rate in the early stage of the jet [88,89]. Higher ambient wind speeds resulted in a shift in the direction of the jet flow, thereby causing the combustible gas cloud to move along the downwind direction. This exacerbated diffusion and ambient air entrainment in all directions, led to a reduction in the volume of the combustible cloud and thus formed a short diffusion distance. Conversely, lower ambient wind speeds predominantly affected the low-speed flow at the end of the jet and at the boundary of the gas mixture. This, therefore, resulted in a farther distance due to strengthened disturbing turbulence. Another reason for this was that an under-expanded jet region was formed after the leakage of high-pressure hydrogen [89,90]. The Froude number of the gas cloud in this region might be larger, leading to diffusion controlled by momentum, which consequently caused a relatively far horizontal distance. As the Froude number decreased, diffusion was influenced by both momentum and buoyancy, enabling hydrogen to keep advancing a certain distance. In addition, hydrogen gradually rose upwards and forward due to buoyancy and wind speed, thereby resulting in a longer diffusion distance.

As can be seen from Figure 7, for a given ambient wind speed, the inflammable gas cloud diffused in the three zones, showing an ellipse. A similar zone at different wind speeds also showed an ellipse. This might be attributed to the high pressure of the storage tanks and the high momentum of hydrogen [91]. When leakage occurred, hydrogen was driven by momentum to eject forward and further spread forward by wind speed. Simultaneously, hydrogen continued to diffuse upwards by buoyancy, which resulted in a larger radial distance. The concentration was diluted by wind speed and buoyancy, leading to a narrower width of the combustible gas mixture. It is also evident that the red zone was the most dangerous among the three zones, so this required heightened attention during loss prevention management. The presence of sufficient energy in this zone could not only lead to ignition but also directly cause fatalities and substantial property damage.

3.3.2. Impact Zones of Ambient Wind Direction on HL for Hydrogen Storage Tanks

The next step was to investigate the meteorological data for the region where Dalian City, Liaoning Province, PR China, was located. The prevailing wind directions in the area are southwest, south, northwest, north, and northeast. The measurement point of this study was 3 m above the ground. The wind directions (southwest, south, northwest, north, and northeast) were chosen. The impact of wind direction on HL diffusion is shown in Figure 8.

As seen in Figure 8, for a given constant parameter (e.g., wind speed, release direction, and release rate), there is negligible variation in the effects of wind direction upon the inflammable gas clouds diffusing in three zones (horizontal distance and inflammable size). The direction of inflammable gas clouds is the same as the wind direction because the release direction of tanks was consistent with the wind direction; hydrogen migrated and spread in the downwind direction [92,93,94]. The HPRISs were surrounded by a series of equipment and precision manufacturers in the southeast and northeast, and residential areas lay in the southwest and northwest. The HPRIS includes hydrogen production units, gas transmission pipelines, and associated systems. The red area indicates the highest concentration, posing a potential threat of death to individuals within its vicinity if an ignition source is present. Notably, the hydrogen production unit and the gas delivery pipe are situated upwind of the cloud gas in the storage tank, where the high temperature generated by the production unit might serve as an ignition source. Consequently, the hydrogen production unit and the gas delivery pipe could trigger an explosion or flash fire.

The prevailing regulations in China clearly stipulate that a fire interval of 15, 10, and 8 m between primary, secondary, and tertiary storage containers and production areas should be considered. In addition, the fire interval between primary, secondary, and tertiary storage containers and dispensing facilities was 10, 8, and 6 m, respectively [95]. As depicted in Figure 8, the red area represents the highest level of danger, with the orange area following closely behind. Consequently, even if hydrogen-related systems within the red zone maintain the prescribed fire separation distances, the risk remains noteworthy.

3.4. Prevention Countermeasures of HL for HPRISs

As one of the future hydrogen energy facilities, the integrated HPRISs should be well-prepared for both prevention and response to leakage incidents.

3.4.1. Technical Measures

(1)

The implementation of a heat conduction model is required to model and analyse the heat distribution of critical equipment to detect potential hotspot areas. Temperature monitoring methods and systems for core equipment, such as compressors, need to be developed with the aim of detecting potential hot spots. The relevant technologies have already been implemented in the temperature monitoring of photovoltaic modules.

The basic principle of this technology is as follows [96]:

(a)

The utilisation of infrared thermal imaging and visible light image acquisition.

(b)

The conduction of spatial registration and preprocessing by the edge computing unit, obtaining standardised temperature data, and storing the historical data set.

(c)

The performance of a wavelet transforms on the historical data and combining graph convolution with deep neural networks to train a temperature prediction model.

(d)

The entrance of the standardised and predicted temperature data into models like hierarchical clustering to identify abnormal areas.

(e)

The entrance of the characteristics of these abnormal areas and comparing them with historical fault data.

(f)

The diffusion range is calculated through graph neural networks and other methods.

(g)

The generation of early warning information through fuzzy inference.

(h)

The early warning information is sent to the operation and maintenance platform, thus achieving comprehensive and intelligent temperature monitoring and fault warning.

This shows the next step, where the previously obtained standardised and predicted temperature data is fed into models, such as hierarchical clustering, for the purpose of identifying abnormal areas.

(2)

Utilisation of a highly efficient cooling system [97], such as mixed refrigerant refrigeration or pre-cooling refrigerants, should be essential for maintaining the equipment within a safe operating temperature range. The adoption of a mixed refrigerant cooling system is recommended to ensure the equipment operates within a safe temperature range. The system achieves efficient temperature control by optimising the composition ratio, or pre-cooling refrigerants like liquid nitrogen can be applied as auxiliary coolants. The refrigeration system is utilised to achieve cooling during the hydrogen compression and refuelling process.

The basic principle of this technology is as follows [98].

(a)

A heat exchange jacket is installed on the outside of the 20 and 45 MPa gas cylinder groups. The heat exchange jacket is connected to a cooling tower through a circulating pipe and a water pump. The connection is applied to cool and insulate the hydrogen in the gas cylinder groups, thus alleviating the temperature rise during compression.

(b)

The hydrogen enters the first-stage compressor through the hydrogen buffer tank for pressurisation and, after being pre-cooled by the first-stage cooler, it is stored in the 20 MPa gas cylinder group. Then, it is pressurised again by the second-stage compressor and, after being pre-cooled by the second-stage cooler, it is stored in the 45 MPa gas cylinder group.

(c)

A hydrogen refuelling cooler is installed on the pipeline connecting the 45 MPa gas cylinder group and the hydrogen dispensers, and the hydrogen is cooled as needed during hydrogen refuelling. All links work together to ensure the safety of hydrogen refuelling.

(3)

The implementation of a modern automation control system employing logic control and preset parameters is necessary to automate key operations [99]. This approach is able to curtail manual intervention and mitigate the risk of leakage caused by human error.

There is automation in the distributed energy system for hydrogen from methanol coupled with fuel cells. Based upon this system, in the event of hydrogen leakage, the safety system will carry out the following operations [100].

The hydrogen leakage interlock alarm device is designed to promptly detect any abnormal hydrogen concentration. Once detected, it immediately sends out an alarm signal, which is swiftly transmitted to the programmable control subsystem. Upon receiving this signal, the programmable control subsystem activates the fire extinguishing device, causing carbon dioxide (CO₂) to spray out from the nozzles. This effectively dilutes the explosive mixture formed by the leaked hydrogen, substantially diminishing the risk of explosion.

Meanwhile, safety components, such as the solenoid valve, safety valve, and flame arrester, installed on the buffer tank vent pipeline play crucial roles in preventing the further escalation of potential danger. In addition, within the containerised skid-mounted unit, the electrostatic grounding box and the equipment’s lightning protection grounding device are in place to forestall secondary accidents that could be caused by static electricity or lightning strikes. In this way, they ensure the overall safety and integrity of the system.

3.4.2. Management

(1)

Human factors

The measures of reducing manual intervention are as follows.

(a)

During the facility planning phase, it is essential to implement cross-departmental collaborative training. This measure aims to guarantee that both the design team and the operation team share a unified comprehension regarding environmental variables and layout optimisation.

(b)

The automation system should be designed with ergonomic principles to ensure easy operation of the man-machine interface and diminish operator fatigue. Meanwhile, operators should be provided with regular training on their operation skills to enhance their emergency response capabilities.

(c)

The establishment of a specialised training program that covers thermal conduction, cooling system equipment operators, material properties, equipment replacement plans, and so on. Specifically, for special types of work, the annual training hours should be no less than 20 h.

(2)

The environmental risk of hydrogen leakage. The installation of temperature sensors and the implementation of a data monitoring system are imperative for monitoring equipment temperature changes. Upon abnormal temperature increases, the cooling mechanism should be automatically activated to effectively mitigate the upward trend of hydrogen pressure. Concentration sensors should be arranged in a circular formation, with the centre being the highest temperature heat source point and the radius being the minimum ignition distance.

The arrangement of sensors is as follows:

(a)

For the main risks of hydrogen energy facilities, the sensor arrangement follows the high-risk priority principle. Hydrogen leakage sensors are placed around hydrogen storage tanks, purification devices, and pressure relief devices to form closed-loop monitoring.

(b)

Pressure sensors are set at key pipeline nodes and high-pressure areas.

(c)

Temperature sensors cover the outer walls of storage tanks, refrigeration systems, and hot spots.

(d)

Hydrogen concentration sensors are arranged in a circular layout around hot spots.

(e)

Vibration sensors are applied for compressors and high-frequency equipment.

(f)

Material ageing sensors are installed at pipeline connection points and equipment surfaces. Flow sensors are placed at refrigerant pipeline inlets and outlets.

4. Conclusions

HPRISs can integrate various typical utilisation scenarios, including hydrogen storage, production, and supply. The pronounced thermal risks associated with HPRIS should be the focus of the research on HL in HPRISs. We employed the methods of FTA and AHP to evaluate the degree of importance, probability importance, and indicator layer weights. In addition, a model was constructed for the accident hierarchy analysis of HL risk in AHP. This research also employed ALOHA software to analyse the hazardous area of hydrogen post-leakage. The strategies proposed for preventing HL are as follows.

• The qualitative analysis of minimal cut sets, minimal path sets, and degree of importance in FTA of HL indicated that the accident tree contained 14 minimal cut sets and 8 minimal path sets. It also revealed that material ageing, inadequate maintenance, misoperation, and improper design were vital quantitative factors that led to HL accidents.
• The results generated from the quantitative analysis of probability importance in FTA of HL suggest the top four risk factors of misoperation, material ageing, poor maintenance, and improper design.
• Based upon the results obtained from the model designed for the accident hierarchy analysis for HL events and the weight calculation of index layer factors made. Clearly, heat, misoperation, inadequate maintenance, and valve failure are noticeable contributors to accidents as well.
• By comparing the results of FTA and AHP, the FTA method emphasises factors related to accident occurrence, relying on fault tree logic for causal analysis. The AHP employs expert scoring and weight calculations, where heat is the most notable factor (with a weight of 0.833). By combining the two methods, the traits of FTA are retained, and the subjective assessment of AHP is incorporated. This combination can identify additional crucial factors.
• By referring to the ALOHA analysis of the uncontrollable factor, ambient wind, on the HL gas cloud of HPRISs, it was found that the wind speed and direction primarily influenced the horizontal diffusion distance and diffusion direction of the gas cloud. The greater the wind speed, the closer the horizontal distance of HL gas. Three hydrogen-related equipment areas were identified as the key monitoring areas within HPRISs. Downwind of the hydrogen storage tanks, hydrogen production facilities upwind, and ignition area are also the centre of point management. Moreover, HPRISs need to arrange hydrogen concentration sensors in some zones. Among the scenarios considered were the furthest distance where hydrogen is most likely to ignite and the corners of the area where hydrogen accumulation is most likely to occur.
• Based upon the risk analysis made of FTA, AHP, and ALOHA, the findings suggest preventive and control measures at the HPRISs. These measurements are as follows: Utilising infrared thermal imaging and visible light image acquisition in the heat conduction model. A hydrogen refuelling cooler will be installed on the pipeline connecting the 45 MPa gas cylinder group and the hydrogen refuelling machine. A programmable control subsystem to activate the fire extinguishing device, enabling the nozzle to release carbon dioxide (CO₂). Hydrogen leakage sensors, purification devices, and pressure relief devices should be placed around hydrogen storage tanks to form closed-loop monitoring. Installing material ageing sensors at pipeline connection points and equipment surfaces. Placing flow sensors at refrigerant pipeline inlets and outlets.