1. Introduction
In the challenging circumstances of global warming and energy shortage, energy technologies such as hydrogen energy are rapidly advancing [
1]. Hydrogen fuel cell vehicles (HFCVs) are more aligned with the current demands for green energy development than conventional internal combustion engines. Countries worldwide have taken hydrogen energy and HFCVs into national strategy and have already achieved a considerable technological advantage [
2]. In China, the construction of hydrogen refueling stations (HRSs) has accelerated significantly since 2016, with more than 270 HRSs established. Among the different types of HRSs, hydrogen–gasoline hybrid refueling stations are regarded as one of the optimal options for the simultaneous supply of conventional and new energy due to their ability to conserve land resources and their lower construction and maintenance costs [
3].
Hydrogen has a wide flammable range and low minimum ignition energy compared with conventional energy sources such as natural gas and gasoline and is a flammable and explosive light gas [
4]. In addition to the high probability of fire and explosion, existing hydrogen infrastructure also has safety issues, such as an increased risk of leakage and vulnerability to hydrogen embrittlement [
5,
6]. It is worth noting that all vehicle fuels in hydrogen–gasoline hybrid refueling stations are combustible liquids or gases, each must be handled carefully, and the parties concerned must allow for new risks arising from fuel diversification [
7]. Many hazards, such as failure of valves, flanges and pressure relief devices; human error; and inadequate organizational management threaten the safety of hydrogen storage [
8]. In addition, due to the proximity of the facilities, one sudden environmental risk can easily lead to another sudden environmental risk, and this domino effect will bring severe consequences to accidents. In 2020, a blast in a diesel hydrogenation unit in Malaysia resulted in five fatalities and one severe injury. The following year, in 2021, another similar accident occurred at a refinery in Romania. This time, three additional explosions happened one after the other due to the presence of hazardous substances such as diesel and hydrogen, resulting in one death and four injuries. Therefore, assessing the risk of hydrogen infrastructure, such as HRSs, is essential in various situations [
9].
Significant efforts have been put into researching security and risk analysis of separate HRSs using empirical models and numerical simulation software. For example, CFD tools Flame Acceleration Simulator (FLACS) [
10,
11,
12,
13,
14], Ansys Fluent [
15,
16,
17,
18,
19], and Phast/Safeti [
20,
21,
22,
23] have been used to study the potential effects of hydrogen dispersion, jet flames, and explosions at HRSs for more accurate results, and thus enable truly effective mitigation measures to improve safety. Hybrid stations pose a higher risk compared to separate stations. Therefore, it is crucial to conduct a risk analysis to fully consider the potential hazards of various HRSs, especially for stations built in urban areas with high population density and heavy traffic. Sakamoto et al. [
24] analyzed the temperature and thermal stress caused by a gasoline pool fire in a hydrogen–gasoline hybrid refueling station based on TRACE and ANSYS. They discussed the safety distance and precautions for adjacent liquid hydrogen storage tanks. Sustained pool gasoline fires could damage processing equipment, and thermal radiation could cause pressurized hydrogen tanks to rupture [
25]. Due to these studies, Kuroki et al. [
26] further evaluated the effect of installing vessel walls around the cylinders on the fire propagation mechanism. Other studies have addressed the qualitative analysis approach [
27,
28,
29], and some have revealed the unique mixing risks for systems involving hydrogen and gasoline and future directions for safety and security [
28]. However, although these studies have promoted the improvement and development of the safety of hydrogen energy systems, probabilities of incident occurrence have not been considered, and few quantitative risk assessments for hydrogen–gasoline hybrid refueling stations have been conducted [
28]. Thus, while empirical and modeling tool-based approaches are widely used, not considering the possibility of accidents is perceived as a weakness of these methods [
30].
To more accurately measure risk, it is necessary to consider CFD-based consequence analysis complemented with quantitative risk assessment in the case of a complex system such as hybrid refueling stations [
31]. At present, risk analysis of hydrogen infrastructure has been carried out with qualitative [
28,
32,
33,
34], quantitative [
7,
24,
35,
36], and integrated methods [
37,
38,
39,
40] that include traditional risk-assessment approaches such as FMEA, HAZOP, and Bayesian Network models. In these approaches, two parameters are important, accident frequency and consequences, and these approaches tend to assume that risk is positively related to the probability of accidents and the severity of the consequences [
30]. The probability of accidents can be obtained from experiments and experience estimates, but the consequences of accidents are uncertain since similar accidents can hardly lead to the same consequences. In addition, for multi-fuel systems such as hybrid refueling stations, it is essential to consider the impact of chain reactions on the amplification effect of accidents. Therefore, the EU proposed the Accident Risk Assessment Method for Industrial System (ARAMIS) in 2005 in the framework of the Seveso II Directive. Compared with the previous risk-assessment methods, this approach focuses more on quantifying the risk consequences, which considers the consequences of an accident as the effect of the remaining energy intensity on the system’s vulnerability under various types of safety barriers after the energy is unexpectedly released. It also determines the comprehensive risk level of the system by considering the coupling effect of multiple hazards and superimposing the risk values of different risks. Nima Khakzad et al. [
41] implemented ARAMIS real-time and dynamic risk analysis relying on Bayes’ theory and a computer simulation approach. J. Tixier et al. [
42] discussed the setting of vulnerability weights for the surrounding environment of an industrial site in ARAMIS and determined the rationality of the vulnerability weights for human, environmental (or natural), and material stakes. However, traditional ARAMIS requires extensive underlying data and a complex computational process as support for probabilistic analysis, while the data of hydrogen incidents are limited. In addition, although ARAMIS proposes a dimensionless calculation for the impact range of the consequences caused by hazardous substances, additional calculations are required for the risk value at any point of the device based on the leakage and dispersion model and the explosion model, and it does not provide an effective means for presenting the results. Quantitative risk assessment studies have not been conducted for hybrid refueling stations, especially for hydrogen–gasoline hybrid refueling stations.
In this study, the simplified and improved Accident Risk Assessment Method for Industrial Systems (ARAMIS) was used as a tool for quantitative risk assessment to perform effective quantitative identification and prevention [
43]. Due to the limitations of the traditional ARAMIS, the event frequency estimated by the Hydrogen Risk Assessment Model (HyRAM) was used instead of the complex probabilistic calculation process, and the consequence simulation analysis provided by Gexcon’s CFD tool FLACS was used instead of the traditional empirical model to make the method more suitable for hydrogen infrastructure. This study aims to reveal the unique accident scenario of the coexistence of gasoline and hydrogen and to assess the integrated risk level of the hybrid refueling stations with quantitative risk assessment. By risk identification and scenario selection, we identified hazardous accident scenarios relevant to hydrogen dispenser leaks and calculated their occurrence probabilities. Then, to make the accident consequences more accurate and reliable, the fire explosion simulation software FLACS was used to quantify the consequences of the accident and to calculate the risk values for hazardous locations near the refueling area. Furthermore, we suggested improving the emergency response and handling capabilities at the accident site to reduce or avoid the aggravation of the accident.
3. Methodology
ARAMIS is a valuable method to analyze the integrated risk of a system, and it has been widely utilized in risk analysis of complex systems such as chemical industry parks and large storage tanks [
44,
45,
46,
47]. It needs to quantify the intensity of the energy source release and the vulnerability of the system within the impact range to quantify the severity of the accident consequences, combine it with the probability of the accident occurring, and thus quantify the specific risk values. The risk was defined with ARAMIS using the annual mortality rate, and it could be determined with the following formula [
48]:
where
R is the risk value for any location in the system,
Ri is the risk value of various types of hazardous accidents at this location,
S is the severity of accident consequences,
V is the system’s vulnerability within the impact area of the accident,
P is the probability of an accident, and
I is the intensity of accident consequences.
Figure 2 shows the framework of the simplified methodology used for ARAMIS. The method comprises four main stages, which will be explained in detail in the following section.
Stage 1: Risk Identification
Stage 2: Scenario Selection
Stage 3: Severity Calculation
Stage 4: Vulnerability Assessment
3.1. Risk Identification
The main objective of risk identification is to identify potential accident scenarios which are likely to occur in the industry based on the equipment involved, and the properties of substances handled [
49]. This approach identifies possible Dangerous Phenomena (DPs). It selects related accident scenarios by constructing a Bow-Tie (BT) diagram centered on Critical Events (CEs), where scenarios are selected in detail in
Section 3.2.
3.1.1. Identifying Critical Events
The CEs associated with each piece of hazardous equipment in the system should be identified [
48]. This paper focuses on the hydrogen dispenser, a crucial piece of equipment in hydrogen–gasoline hybrid refueling stations. These stations’ refueling areas are crowded with humans and vehicles, and the dispensers are frequently used, increasing the chance and severity of hydrogen dispenser accidents [
27]. The risk of fire and explosion incidents is exceptionally high because of potential ignition sources such as electrostatic sparks and vehicle exhaust. The 20 incidents relevant to HRS refueling areas were collected from the European Hydrogen Incident and Accident Database (HIAD) and the Hydrogen Incident Reporting Database (HIRD), and analyzed for details of failure positions and parts, as shown in
Figure 3. Unignited hydrogen leaks were the main accident type, followed by equipment failure, while there were only two fire and explosion accidents. The failed equipment in
Figure 3 are generally components commonly used in all types of HRSs, such as joints, valves, and filling hoses, with the filling hose being the most accident-prone component. One typical incident was a hydrogen dispenser leak reported by HIRD. The incident was caused by a hydrogen filling hose getting caught on the vehicle as the driver pulled away from the station, which bent the hydrogen distribution manifold and resulted in hydrogen leaking from a screw joint and the filling hose. For these reasons, the hydrogen leak is determined as the CE of the hydrogen dispenser.
3.1.2. Constructing a Bow-Tie Diagram
To construct the BT diagram for each CE, both a fault tree analysis (FTA) and an event tree analysis (ETA) are needed. The FT is created using logical reasoning to identify and assess system hazards based on the hydrogen dispenser’s operating conditions and to determine potential causes of hydrogen leaks. The ET, which is located on the right side of the BT diagram, tracks the chronological progression of the incident starting from the CE. The possible consequences of the incident are estimated by considering barriers, sequential failures of relevant safety features, and the types of ignition. In turn, the DPs are selected from the consequences, and 13 DPs are defined in ARAMIS: pool fire, tank fire, jet fire, vapor cloud explosion (VCE), flashfire, toxic cloud, fire, missile ejection, overpressure generation, fireball, environmental damage, dust explosion, boil over, and resulting pool fire [
48]. The BT diagram constructed in this study was implemented through interviews with experts, logical reasoning, and review of operational drawings and relevant documents.
Figure 4 demonstrates the BT diagram of a hydrogen leak from a hydrogen dispenser, which reflects the entire accident scenario from cause to effect. First, the FTA diagram of hydrogen leaks from the hydrogen dispenser was created. The major causes of hydrogen leaks from the hydrogen dispenser were identified through interviews with experts and review of operational drawings and related documents. The results identified four main causes, including human factors, process factors, mechanical factors, and environment factors. After that, the intermediate and basic causes are further obtained using logical reasoning. A total of 56 causes or defects (34 basic and 22 intermediate causes) were detected which contributed to hydrogen leaks from the dispenser. To determine the chronological sequence of possible events after the critical event, ETA was performed by considering six safety barriers: automatic control system, immediate ignition barrier, manual emergency cut-off system, delay ignition barrier, congestion barrier, and flammable hazardous substance avoidance. With regard to failure or success of the safety barriers, the hydrogen leak scenario provided six final results that included safe diffusion, jet fire, explosion, flash fire, hydrogen accumulation, and domino accident (gasoline fire).
3.2. Scenario Selection
Scenario selection aims to choose Reference Accident Scenarios (RAS) by considering the likelihood of accidents and their potential impact. This will be achieved by following three steps: frequency calculation, consequence assessment, and risk matrix construction, which are explained as follows.
3.2.1. Frequency Calculation
The frequency of CEs is generally calculated using FTA, which is mainly based on the probability of initial events in the FTA and considers the safety barriers affecting the initial events [
48]. Due to the short development time of the hydrogen energy industry, a dedicated database of hydrogen system failure frequencies has not been established at home or abroad. Thus the frequencies of basic events were determined using expert elicitation, reference literature reviews, and existing databases such as HyRAM [
50] and reliability Information Analysis Center (RIAC), as shown in
Appendix A. HyRAM has the probabilities of equipment failures for different components for gaseous and liquid hydrogen, gaseous and liquid methane, and propane systems. Leakage failure of hydrogen dispensers may occur due to either the overpressure leakage of the filling process or mechanical leakage, which is the main risk factor, including equipment failure, fatigue, and corrosion. Such frequencies are usually available from HyRAM, and for components not considered by HyRAM such as Pressure Relief Devices (PRDs) and sensors, the conservative eigenvalues of their failure probabilities are presented in the public database RIAC [
51]. In addition, the reliability data used for human and environmental factors in the FTA model were obtained from expert elicitation and reference literature reviews [
52,
53,
54]. For each branch of the ETA on the right-hand side of the BT diagram, the probability of the incident’s consequences can be determined with probability transfer [
55].
Table 2 shows the transmission events and probabilities from CE to incident consequences, which are determined based on the hydrogen system ignition probabilities published by HyRAM, the performance of the safety system, and the actual layout of the hydrogen–gasoline hybrid refueling station. The probabilities of incident consequences can then be obtained by calculating the likelihood of transmission events, as shown in
Table 3.
3.2.2. Consequence Assessment
The identification of accident scenarios is based on the probabilities and consequences of DPs. Therefore a rough qualitative assessment of the level of incident consequences is required in addition to calculating the probability [
49]. For the 13 common DPs, ARAMIS gives the corresponding “fully developed” consequence levels [
49]. This study refers to the recommended values and fully considers the domino effect of getting the levels of incident consequences in the BT diagram, as shown in
Table 4.
3.2.3. Risk Matrix Construction
Figure 5 demonstrates the modified risk matrix diagram, which assesses the magnitude of risk for incident consequences based on the frequency and consequence levels. Incidents with consequences in the “medium effects” (yellow) and “high effects” (red) zones were identified as DPs, including jet fires, explosions, and gasoline fires. These incidents will be outlined in scenarios and subjected to quantitative analysis to determine their risk severity.
Table 5 shows that the RASs were assumed based on the DPs identified through the risk matrix. The analysis of the qualitative FTA diagram in
Figure 4 shows that the hydrogen leaks from dispenser are concentrated in the joint between the hydrogen dispenser and filling hose, the joint between the filling hose and the HFCV’s separation unit, and the filling hose itself. These main risk components correspond to historical hydrogen incidents in
Figure 3. Possible risk factors include abnormal operation, overpressure leaks, equipment failure, and corrosion. Thus, the hydrogen jet fire and explosion are supposed to be caused by immediate ignition and delayed ignition of high-pressure hydrogen leaks in the filling hose, respectively. The gasoline fire is supposed to have been a domino accident caused by the hydrogen jet fire igniting the fuel tank while the refueling operation was underway. In addition, hydrogen is assumed to leak in different directions to consider the level of risk at various locations inside and outside the station. It is worth noting that this risk matrix is only a tool for selecting RASs, not risk acceptability criteria, and should not be used blindly.
3.3. Severity Analysis
3.3.1. Severity Index Definition
A risk severity index (
S) is used to quantify the risk level of equipment or area of impact. For each DP or CE, their risk severity index
SDP or
SCE can be determined, and then the risk severity of the selected Reference Accident Scenarios (RASs) is calculated using
SDP or
SCE [
56].
Table 6 shows the formula for the linear variation of
SDP with distance
x, divided into four impact levels according to the range of
SDP. Different thermal radiation intensity and explosion overpressure correspond to different characteristic distances
d0-
d4, respectively, as shown in
Table 7.
The sum of the products of risk severity and probability for all DPs is defined as
SCE(
d), which is the risk severity index of the CE at distance
d, following Equation (3):
In the formula, n is the total number of DPs, PDPi is the probability of occurrence of a DPi, and SDPi(d) is the risk severity index of a DPi at distance d.
The Severity of Risk Index
S for the entire research object is the sum of the products of risk severity and frequencies for all CEs, following Equation (4):
where
m is the total number of CEs,
fCEj is the frequency of
CEj, and
SCEj is the risk severity index of
CEj.
S takes values in the range of 0–1000.
3.3.2. Simulation Model
To make the accident consequences more accurate and reliable, we simulated the characteristics of flames, the contours of thermal radiation from hydrogen jet and gasoline pool fires, and the distribution of overpressure from hydrogen explosions under different scenarios using FLACS. FLACS is the world’s leading fire and explosion risk-assessment software, and with 3D modeling the consequences of accidents can be more accurately predicted [
12]. In FLACS, hydrogen and gasoline are set as the materials, the wind velocity is 3.0 m/s, the wind direction is SSE, the hydrogen pressure is 350 bar and the hose diameter is 6.35 mm. The hydrogen state of leakage location in Scenarios 1–4, such as temperature, pressure, and mass flow rate, is mainly determined by the hydrogen fueling pressure and the leakage aperture [
13]. Since most high-pressure hydrogen leaks are sub-expansion jets in the initial stage [
55], the ideal gas state equation is no longer applicable when the hydrogen pressure is higher than 100–200 bar. Thus, this paper determines a hydrogen mass flow rate of 0.6 kg/s based on the Abel-Noble equation and the equations of energy and mass conservation [
57]. For the hydrogen jet fire simulation, the grid size of 0.3 m × 0.3 m × 0.3 m is taken, and the vertical direction of the leakage hole jet direction is locally encrypted. The explosion simulation calculation area is the same as the jet fire simulation calculation area, but the grid is divided uniformly with a grid interval of 0.5 m.
Assume that the location of gasoline combustion is the tank, the tank’s volume is 45 L, the height of the tank from the ground is 1.0 m, and the density of gasoline takes the value of 0.725 g/mL. Performing pool fire simulation may lead to the pulsation of the flame. Thus, the grid size of 0.5 m × 0.5 m × 0.5 m is chosen in the core area of leakage to provide better simulation results.
3.4. Vulnerability Assessment
Vulnerability is the maximum tolerable capacity of a system within the area affected by an incident at the time of the incident [
43]. Accidents simultaneously damage individuals, materials, and the environment, but traditional analysis methods tend to analyze the three independently. Thus, to ensure a uniform measure of losses in all three aspects, during the development of the ARAMIS assessment methodology, the EU expert group invited 38 risk experts from different industries to carry out a dimensionless analysis study on individuals, material, and environment [
58]. Ultimately, an analytic hierarchy process was used to derive unified quantitative formulas for humans, materials, and the environment, which is represented in Equations (5)–(8).
where
Vglobal is the global vulnerability index;
VH is human vulnerability;
VE is environment vulnerability;
VM is materials vulnerability; the quantification factors
Hi,
Mi, and
Ei are the proportion of exposed receptors in the research area and are dimensionless data. The classification of vulnerability assessment receptors is shown in
Table 8.