Evaluation of Safety Measures of a Hydrogen Fueling Station Using Physical Modeling

Abstract

Hydrogen fueling stations are essential for operating fuel cell vehicles. If multiple safety measures in a hydrogen fueling station fail simultaneously, it could lead to severe consequences. To analyze the risk of such a situation, we developed a physical model of a hydrogen fueling station, which, when using, the temperature, pressure, and flow rate of hydrogen could be simulated under normal and abnormal operating states. The physical model was validated by comparing the analytical results with the experimental results of an actual hydrogen fueling station. By combining the physical model with a statistical method, we evaluated the significance of the safety measures in the event wherein multiple safety measures fail simultaneously. We determined the combinations of failures of safety measures that could lead to accidents, and suggested a measure for preventing and mitigating the accident scenario.

1. Introduction

Hydrogen is widely considered a clean source of energy from the viewpoint of reduction in carbon dioxide emissions. If hydrogen can be produced from renewable energy, it can make a big contribution to the realization of a sustainable society. Various efforts have been made to develop a hydrogen energy society. Among them, the pioneering work has been on social implementation of fuel cell vehicles (FCVs) and hydrogen fueling stations. Hydrogen fueling stations are essential for operating FCVs. FCVs have been sold commercially since December 2014, and several hydrogen-fueling stations have been constructed and are in operation worldwide [1]. However, approximately 50 accidents and incidents involving hydrogen-fueling stations have been reported [2]. Sakamoto et al. [2] analyzed accidents and incidents at hydrogen fueling stations in Japan and the USA to identify the safety issues. Most types of accidents and incidents are small leakages of hydrogen, but some have led to serious consequences, such as fire. Most of the leakages occurred at the joint parts due to inadequate torque and inadequate sealing. Other causes include design error of the main bodies of apparatuses and human error. For the commercialization of FCVs, it is essential to identify and assess the overlooked risks.

Figure 1 shows a schematic of the risk assessment of hydrogen fueling stations. The risks involved in two types of hydrogen fueling stations were identified using a hazard identification (HAZID) study [3,4]. The leakage of hydrogen due to an accident is important for the consequence analysis. Many studies focused on the hydrogen release behavior [5,6,7]. It is necessary to evaluate the maximum amount of hydrogen released from each facility to conduct the consequence analysis of the worst-case scenario for which the consequence is the highest. The risk assessment based on the maximum amount of hydrogen released was conducted [8,9,10,11]. Moreover, the rate of hydrogen released from each facility is necessary for risk assessment considering the frequency [12,13,14]. With regard to the hydrogen release rate, experiments were conducted and the results were reported [15,16,17,18,19]. Although the risk assessments of each component, such as pipes and accumulators, have been conducted, quantitative risk assessments considering the entire hydrogen fueling station are lacking. For example, if multiple safety measures in a hydrogen fueling station fail simultaneously, it could lead to serious accidents. Only a few studies have been conducted regarding the relationship of operative and/or inoperative safety measures with the hydrogen release behavior.

In this study, we developed a physical model, capable of simulating the entire operation of a hydrogen fueling station. Physical modeling is a method used to express the physical phenomena via mathematical equations using mechanics, thermodynamics, and fluid dynamics. Reddi et al. [20] developed a physical model of a hydrogen fueling station to obtain high efficiency during the normal operation and reduce cost. The model was used for normal operation wherein the hydrogen-release behavior was neglected.

We developed a physical model that can reflect the hydrogen-release behavior occurring in a hydrogen fueling station. The physical modeling can contribute to the risk identification and consequence analysis in Figure 1. For example, using the physical model, we can calculate the hydrogen-release rate for the estimation of the consequences of hydrogen explosion and fire accidents. In this study, we used the physical model for risk identification. In Section 2, we described the method of developing the physical model. In Section 3, Section 4 and Section 5, we evaluated the significance of safety measures using the physical model and statistical methods considering that multiple safety measures fail simultaneously because of accidents. In this study, we applied the method to the risk identification of a hydrogen fueling station.

2. Physical Modeling of Hydrogen Fueling Station

2.1. Model of Hydrogen Fueling Station

Figure 2 shows the schematic of on-site and off-site hydrogen-fueling stations. The hydrogen-fueling stations can be roughly classified into two types: An on-site hydrogen fueling station and an off-site hydrogen fueling station. In the on-site hydrogen fueling stations, it is possible to produce hydrogen using the water electrolysis method, organic chemical hydride method, and steam reforming method with methane, liquefied petroleum gas, liquefied natural gas, and naphtha wherein the hydrogen production facilities are located inside the station. However, in the off-site hydrogen fueling station, there is no hydrogen production facility in the station, and the hydrogen produced outside the station is transported to the station. In the two types of hydrogen refueling stations, the common components are compressors, accumulators, and dispensers. The chemical substance involved with the common components is just hydrogen. In this study, the common components, pipes, and safety measures were modeled as one system. The inner diameter of the pipe was 6.5 mm. The safety measures were modeled in accordance with the Article 7-3 of the High Pressure Gas Safety Act as listed in

Table 1. Safety measures installed by adhering to the High Pressure Gas Safety Act.

Safety Measure	Position	High Pressure Gas Safety Act
Isolation valve	Compressor—accumulator	Article 7-3, paragraph 2, item 5
Isolation valve	Compressor—accumulator Accumulator—dispenser	Article 7-3, paragraph 2, item 7
Isolation valve	Dispenser	Article 7-3, paragraph 2, item 8
Pressure relief valve	Accumulator Dispenser	Article 7-3, paragraph 2, item 10
Overflow preventing valve	Accumulator—dispenser	Article 7-3, paragraph 2, item 12
Overfill preventing valve	Dispenser	Article 7-3, paragraph 2, item 28
Non-return valve	Compressor—accumulator Accumulator—dispenser	Article 7-3, paragraph 2, item 34
Safety valve	Accumulator	Article 7-3, paragraph 2, item 35

. The High Pressure Gas Safety Act is a Japanese regulation and its purpose is to prevent disasters caused by high pressure gas and secure public safety. The modeling and analysis were conducted using 1D multi-domain physical modeling software (SimulationX ver. 3.7, ESI ITI GmbH, Dresden, Germany). Figure 3 shows the schematic of the model of the hydrogen fueling station.

2.1.1. Compressor Modeling

Figure 4 shows the model of compressor in the Simulation X. The discharge flow rate of the compressor is 1200 Nm³/h, which is maintained at a constant regardless of the pressure at the inlet and outlet sides by providing feedback control to the rotation speed of the compressor. The pressure of the hydrogen trailer, which is the suction pressure of the compressor, is 45 MPa, which is increased to 85 MPa using a compressor. When the internal pressures of all the accumulators fall below 82 MPa, the switching valve between the compressor and the accumulator opens automatically and the compressor sends compressed hydrogen to the accumulator. Subsequently, the valve closes when the pressures in all the accumulators reach 82 MPa.

2.1.2. Accumulator Modeling

To efficiently fill hydrogen into the FCV, three different accumulators are employed in terms of the pressure: A high-pressure tank, a medium-pressure tank, and a low-pressure tank. First, the FCV tank is pressurized to 65 MPa using the low-pressure tank. The filling tank switches from the low-pressure tank to the medium-pressure tank by switching the valve. Second, the FCV tank is pressurized to 75 MPa using the medium-pressure tank. Finally, the FCV tank is pressurized to 80 MPa using the high-pressure tank. When the pressure in the FCV tank reaches 80 MPa, the filling-selector valve closes and the filling is completed. While the FCV is being filled using the accumulator, hydrogen is charged from the compressor to the accumulator, and each tank is pressurized to 82 MPa in the following order: The low-pressure tank, the medium-pressure tank, and the high-pressure tank. Because the pressure difference between the high-pressure tank and the FCV tank is small, it is impossible to boost the FCV tank. Thus, toward the end, the hydrogen is directly pushed from the compressor to the FCV tank.

2.1.3. Dispenser Modeling

A direction-control valve in the dispenser closes when the pressure in the FCV tank reaches 80 MPa. Although the actual filling flow rate depends on the pressures of the FCV tank and accumulator, the filling flow rate in the model is maintained at a constant by adjusting the degree of opening of the flow control valve using a feedback control with the help of a flow meter. The FCV tank is filled with hydrogen from 10 MPa to 80 MPa in 3 min. Considering the capacity of the FCV tank (122.4 L), the flow rate required to fill the tank in 3 min is approximately 1000 Nm³/h. In this model, the filling flow rate is maintained at a constant at 1000 Nm³/h by adjusting the following flow control valves: A flow control valve with a high flow rate (900 Nm³/h), and a flow control valve with a low flow rate (100 Nm³/h).

As the FCV tank is being rapidly filled with hydrogen, the temperature inside the tank increases, with the possibility of exceeding the design criteria. Thus, a general dispenser is provided with a heat exchanger to cool the charged hydrogen. A heat-exchanger model is developed so that the temperature of hydrogen during the filling would be approximately −40 °C. If the pressure inside the dispenser remains high after the filling, the coupler cannot be removed from the FCV. Therefore, after the filling, the pressure is generally reduced by releasing the hydrogen to the atmosphere using a relief valve. In this model, the hydrogen is vented to the atmosphere between the coupler and the directional control valve.

2.2. Validation

The model was validated by comparing its results with the experimental results [21] in the filling of the FCV in an actual hydrogen station. Figure 5 shows the simulation results using Simulation X and experimental results [21] in the filling of the FCV. Figure 5 shows the tank pressure, tank temperature, inlet pressure, inlet temperature, and inlet mass flow rate with respect to time. As shown in Figure 5, the analyzed values have the same trend as the experimental values with respect to the tank pressure, tank temperature, and inlet mass flow rate. The tank capacity of the simulation is slightly lower than that of the experiment. The tank capacities of the simulation and experiment are 122.4 L and 129 L, respectively. Therefore, the inlet mass flow rate of the simulation becomes smaller than that of the experiment from approximately 90 s. In the simulation, the temporary increase of the inlet mass flow rate at approximately 120 s and 140 s is due to the accumulator switching. On the other hand, the temporary increase of the inlet mass flow rate at approximately 170 s is due to a start of direct-pushing from the compressor. This is because the difference of the pressure between the accumulator (82 MPa) and FCV tank (80 MPa) is extremely small and the pressure of the accumulator decreases during the fueling. The temporary increase of the inlet mass flow rate is very small. However, the tendency between the analytical and experimental values differs with respect to the inlet pressure and inlet temperature. The inlet pressure calculated using the simulation reaches 80 MPa in the initial stage of the filling, and thereafter, exhibits the same tendency as that of the experimental values. The inlet temperature calculated using the simulation rapidly drops to −40 °C immediately after the filling, and thereafter, becomes largely constant. This is because the location of the inlet chosen in the simulation is different from that in the experiment. That is, although the exact location of the inlet in the experiment is unknown, the location of the inlet in the simulation is assumed to be closer to the switching valves than that in the experiment. Therefore, the temperature and pressure of the inlet rapidly change. As shown in Figure 5, the changes in the inlet pressure and inlet temperature at approximately 120 s and 140 s are due to the Joule–Thomson effect, which can be reproduced using the simulation. The maximum/minimum values of various parameters in the simulation roughly agree with those of the experiment. Although there are some differences, we used the hydrogen-fueling-station model in this study.

2.3. Leakage Model

The leakage model considering the accidents was defined such that the analysis value was consistent with the experimental value [15,16]. We compared the analysis values to the experimental values for two types of flow conditions: A subsonic flow wherein the pressure in the pipe is low and a choked flow wherein the pressure in the pipe is high. Figure 6 shows the leakage model developed using Simulation X. In this study, the throttle element was used for the leakage model.

Table 2. Analysis conditions used to verify the leakage model.

Analysis Conditions	Diameter of Leakage Hole [mm]	Sonic Conductance [L/(bar·s)]	Modified Sonic Conductance [L/(bar·s)]	Critical Pressure Ratio
No. 1	0.5	0.15	0.12	0.528
No. 2	0.8	0.38	0.30	0.528
No. 3	1	0.60	0.48	0.528
No. 4	2	2.39	1.91	0.528

lists the parameters of the leakage model. The C-b description was used in the flow equation of the leakage model. The C-b description is expressed using Equation (1).

m = C∙p₁∙ρ_n∙√(T_n/T₁)∙√(R₁/R_n)    for p₂/p₁ ≤ b
m = C∙p₁∙ρ_n∙√(T_n/T₁)∙√(R₁/R_n)∙√{1 − (p₂/p₁ − b)²/(1 − b)²}    for p₂/p₁ > b

(1)

• m: Mass flow rate [kg/s].
• C: Sonic conductance [m³/Pa·s].
• ρ_n: Density of standard condition, 0.0899 [kg/m³] (const.).
• p₁: Inlet pressure [Pa].
• p₂: Outlet pressure, 101,325 [Pa] (const.).
• T_n: Temperature of standard condition, 293.15 [K] (const.).
• T₁: Temperature of hydrogen gas [K].
• R_n: Gas constant of standard condition, 4120 [J/(kg·K)] (const.).
• R₁: Gas constant [J/(kg·K)].
• b: Critical pressure ratio, 0.528 (const.).

2.3.1. Subsonic Flow

Figure 7 shows the simulation results indicating the relationship between the flow rate and the pipe internal pressure in terms of the diameters of the leakage hole, d: (a) d = 0.8 mm, and (b) d = 2.0 mm. The National Institute of Advanced Industrial Science and Technology (AIST) reported the experimental results of the leakage tests [15]. They measured the leakage behavior using a pipe internal pressure of 40 kPa (gauge) for two pinhole diameters of 0.8 mm and 2.0 mm. Their experimental results [15] are plotted in Figure 7. In this study, we simulated the leakage behaviors under the same conditions as in their experiments. Figure 7 shows the analysis results obtained using the values of 0.8C and 0.7C. As shown in Figure 7, it was found that the value obtained by multiplying C by 0.8 is closer to the experimental value with respect to the leakage model wherein the leakage diameters are 0.8 mm and 2.0 mm.

2.3.2. Choked Flow

Figure 8 shows the simulation results for leakage diameters of 2, 1, and 0.5 mm. In the leakage model, the initial internal pressure of the pipe was set to 50 MPa. These are the results obtained by multiplying the sonic conductance by 0.8. The plots in Figure 8 show the experimental results for leakage diameters of 2, 1, and 0.5 mm [16]. The hydrogen-release flow is obtained for pipe internal pressures of approximately 40, 30, 20, and 10 MPa. As shown in Figure 8, it was found that the simulation results are in good agreement with the experimental results as in the case of the subsonic flow. We chose the sonic conductance as 0.8 times the theoretical value to reflect the influence of the pressure loss due to the shape of the nozzle. Thus, the hydrogen-release flow was estimated using the model wherein the theoretical value of the sonic conductance is multiplied by 0.8. In this model, the simulation result was verified to be in good agreement with the experimental result of the hydrogen behavior for a pipe internal pressure of 50 MPa, but it was not verified for a pressure of 50 MPa or more.

3. Evaluation of Safety Measures in the Event of Accidents

In this section, we evaluated the significance of the safety measures for the case wherein multiple safety measures fail simultaneously. We combined the physical model and the response surface methodology (RSM), which is a collection of mathematical and statistical techniques used to develop an empirical model. The accident scenarios for evaluating the safety measures were divided into two cases, as shown in Figure 9. In the first case, as shown in Figure 9a, the safety measures are arranged in series with respect to the accident scenario. In the second case, as shown in Figure 9b, the safety measures are arranged in parallel with respect to the accident scenario. In the first case, we can analyze all the accident scenarios. However, in the second case, it is difficult to analyze all the accident scenarios because the number of combinations of safety-measure failures is considerable. Thus, design of experiments (DOE) was additionally employed for the second case.

The following is the procedure for evaluating the significance of the safety measures when they are arranged in series with respect to the accidents.

• Determination of initial event;
• Identification of effective safety measures against the initial event;
• Creation of event tree diagram using initial event and safety measures;
• Calculation of hydrogen-release rate of each event using physical model; and
• Evaluation of safety measures using RSM.

The following is the procedure for evaluating the significance of the safety measures when they are arranged in parallel with respect to the accidents.

• Determination of initial event;
• Identification of effective safety measures against the initial event;
• Creation of design matrix of DOE;
• Calculation of hydrogen-release rate of events using physical model; and
• Evaluation of safety measures using RSM.

4. Results and Discussion

4.1. Results of Safety Measures for Accidents Arranged in Series

The initial event is defined when, as shown in Figure 9a, hydrogen leaks through a leakage hole with a diameter of 1 mm of the dispenser nozzle during the filling of the FCV with hydrogen. The initial value of the pressure is 82 MPa.

In Figure 9a, the blue line indicates the path of hydrogen when the hydrogen leaks. The safety measures on this line are considered effective against the initial event, as listed in

Table 3. Effective safety measures against the initial event.

No.	Safety Measure	Function
1	Overfill preventing valve	Isolation
2	Flow control valve (high flow rate)	Isolation
3	Flow control valve (low flow rate)	Isolation
4	Isolation valve (compressor—dispenser)	Isolation
5	Isolation valve (compressor—accumulator)	Prevention of boost

. The overfill preventing valve of the dispenser has the same function as that of the isolation valve in case of an emergency. At the time of filling the FCV with hydrogen, the accumulator is concurrently boosted using the compressor, and the isolation valve between the compressor and the accumulator is in effect. In Figure 9a and Table 3, numbers are assigned to the safety measures.

Figure 10 shows the event tree diagram of the accident scenario. The final events were classified into two types: Small leakage and large leakage. The small leakage was defined as the state wherein the line was interrupted between the accumulator and the leakage hole. With respect to the small leakage events, the same amount of hydrogen release was defined. The large leakage was defined as the state wherein the line was connected between the accumulator and the leakage hole. As shown in Figure 10, numbers were assigned to the events.

The amounts of hydrogen released in the events, 1–7, were calculated by simulating the physical model, which is given in Section 2. In the simulation, the amount of hydrogen released in 240 s was calculated. Figure 11 shows the hydrogen-release behaviors of the events, 1–7.

To evaluate the significance of the safety measures, the consequence effects due to the failure combinations of the safety measures were evaluated using the RSM. The response surface is a function used to express the variation in a characteristic value with the help of an explanatory variable. The characteristic value, y, is obtained using Equation (2).

y = A₁x₁ + A₂x₂ + … +A_nx_n + ε

(2)

A_i (i = 1, 2…, n) is the constant, x_i (i = 1, 2…, n) is the explanatory variable, and ε is the error. In this study, y is the amount of hydrogen released in 240 s, and x_i is the function of the safety measures. Equation (3) represents the response surface of the accident scenario.

y = A₁x₁ (A₂x₂ + A₃x₃)∙x₄∙(A₅x₅ + A₆) + A₇

(3)

• y: Amount of hydrogen released in 240 s [kg].
• x₁: Function of overfill preventing valve (safety measure No. 1 in Figure 9a) (0: Success, 1: Failure).
• x₂: Function of flow control valve (high flow rate) (safety measure No. 2 in Figure 9a) (0: Success, 1: Failure).
• x₃: Function of flow control valve (low flow rate) (safety measure No. 3 in Figure 9a) (0: Success, 1: Failure).
• x₄: Function of isolation valve (compressor—dispenser) (safety measure No. 4 in Figure 9a) (0: Success, 1: Failure).
• x₅: Function of isolation valve (compressor—accumulator) (safety measure No. 5 in Figure 9a) (0: Success, 1: Failure).
• A_n: Coefficient

Using one of the two functions, i.e., x₁ and x₄, the hydrogen release can be shut off. When both x₂ and x₃ functions are applicable, the hydrogen release can be shut off. In this case, the first term in Equation (3) is zero. Equation (4) is obtained by expanding and rearranging Equation (3) with new coefficients.

y = B₁x₁x₂x₄ + B₂x₁x₂x₄x₅ + B₃x₁x₃x₄ + B₄x₁x₃x₄x₅ + B₅

(4)

x₁x₂x₄, x₁x₂x₄x₅, x₁x₃x₄, and x₁x₃x₄x₅ are regarded as variables. In Equation (4), the coefficient, B_n, reflects the degree of influence of a failure combination of the safety measures. Considering Equation (4) and Figure 11,

Table 4. Analysis conditions and results.

	x1x2x4	x1x2x4x5	x1x3x4	x1x3x4x5	Hydrogen Released in 240 s [kg]
Event 1	0	0	0	0	0.20
Event 2	0	0	1	0	1.12
Event 3	0	0	1	1	1.12
Event 4	1	0	0	0	4.27
Event 5	1	1	0	0	5.35
Event 6	1	0	1	0	4.37
Event 7	1	1	1	1	6.37

lists the matrix. The response surface was obtained using the multiple regression analysis with the matrix listed in Table 4.

Table 5. Result of multiple regression analysis.

	Bn	Standard Error	t	p-Value	Lower 95%	Higher 95%
Intercept	0.56 (=B5)	0.46	1.22	0.44	−5.29	6.41
x1x2x4	3.56 (=B1)	0.43	8.20	0.077	−1.95	9.07
x1x2x4x5	1.39 (=B2)	0.43	3.20	0.19	−4.12	6.90
x1x3x4	0.41 (=B3)	0.43	0.94	0.52	−5.10	5.92
x1x3x4x5	0.31 (=B4)	0.43	0.71	0.61	−5.20	5.82

lists the results of the multiple regression analysis. By substituting the values of B_n in Equation (4), we obtained Equation (5).

y = 3.56x₁x₂x₄ + 1.39x₁x₂x₄x₅ + 0.40x₁x₃x₄ + 0.31x₁x₃x₄x₅ + 0.56

(5)

Considering B_n, the influence degree of x₁x₂x₄ is found to be the highest. Therefore, in the accident scenario considered during this time, the combination of failures of the overfill preventing valve, flow control valve (high flow rate), and isolation valve (compressor—dispenser) has the highest influence degree. However, the influence degrees of x₁x₃x₄ and x₁x₃x₄x₅ are relatively low. The RSM is used to quantitatively evaluate the influence degree of the accident scenario. This might contribute to the design of safety measures in the detailed design stage. For example, if the risk due to a combination of failures of the safety measures cannot be tolerated, the safety measures should be controlled using different electrical systems.

4.2. Results of Safety Measures for Accidents Arranged in Parallel

The initial event is defined when, as shown in Figure 9b, hydrogen leaks through a leakage hole with a diameter of 1 mm of the pipe between the accumulator and the dispenser. The initial pressure is 82 MPa.

The safety measures, listed in

Table 6. Effective safety measures against the initial event.

No.	Safety Measure	Function
1	Isolation valve (Compressor—low-pressure accumulator)	Prevention of boost
2	Isolation valve (low-pressure accumulator—dispenser)	Isolation
3	Isolation valve (Compressor—middle-pressure accumulator)	Prevention of boost
4	Isolation valve (middle-pressure accumulator—dispenser)	Isolation
5	Isolation valve (Compressor—high-pressure accumulator)	Prevention of boost
6	Isolation valve (high-pressure accumulator—dispenser)	Isolation

, are considered effective against the initial event. Table 6 lists the functions of the safety measures. In Figure 9b and Table 6, numbers were assigned to the safety measures.

Table 7. L₁₂ (2⁶) orthogonal array table and analysis results.

Analysis Condition No.	Safety Measure No. 1	Safety Measure No. 2	Safety Measure No. 3	Safety Measure No. 4	Safety Measure No. 5	Safety Measure No. 6	Analysis Results: Hydrogen Released in 240 s [kg]
1	1	1	1	1	1	1	11.8
2	1	1	1	1	1	0	10.0
3	1	1	0	0	0	1	9.39
4	1	0	1	0	0	1	3.11
5	1	0	0	1	0	0	3.08
6	1	0	0	0	1	0	0.01
7	0	1	0	0	1	1	9.37
8	0	1	0	1	0	0	6.13
9	0	1	1	0	0	0	3.08
10	0	0	0	1	1	1	9.37
11	0	0	1	0	1	0	0.01
12	0	0	1	1	0	1	9.38

lists the L₁₂ (2⁶) orthogonal array table, to which the safety measures are allocated, and the analysis results. We set 1 and 0 as dummy variables for failure and success of the safety measures, respectively. The simulation analysis was conducted with the failure combinations of 12 types of safety measures, as listed in Table 7.

Figure 12 shows the average values of the hydrogen released at each level for each safety measure. A safety measure having a large difference between the average values, i.e., a large inclination in the graph in Figure 12, indicates that the influence degree of the safety-measure failure is high. As shown in Figure 12, the influence degrees of the failures of the safety measures, No. 2, 4, and 6, are larger than those of the safety measures, No. 1, 3, and 5. Although the failure of the safety measure, No. 6, is the highest among those of the safety measures, No. 2, 4, and 6, the capacities and initial pressures are the same for the three accumulators in this model. Thus, it is unlikely that the influence of the failure of only the safety measure, No. 6, is high. This is because of the existence of non-significant factors in the six safety measures. If the non-significant factors are included, it may lead to erroneous results. When the safety measures, No. 2, 4, and 6, are not opened, the safety measures, No. 1, 3, and 5, cannot affect the amount of hydrogen released. In this verification, it is not possible to consider the interaction between the factors. Moreover, whether the level is statistically significant can be judged using the p-value, which is a correlation coefficient. In general, when the p-value of a factor is high, the factor is considered non-correlated and non-significant.

Table 8. Results of multiple regression analysis.

	Coefficient	Standard Error	t	p-Value	Lower 95%	Higher 95%
Intercept	−0.93	1.10	−0.84	0.44	−3.8	1.9
No. 1	−0.0076	0.83	−0.0092	0.99	−2.1	2.1
No. 2	4.1	0.83	5.0	0.0043	2.0	6.3
No. 3	−0.010	0.83	−0.013	0.99	−2.1	2.1
No. 4	4.1	0.83	4.9	0.0043	2.0	6.3
No. 5	1.0	0.83	1.3	0.26	−1.1	3.2
No. 6	5.0	0.83	6.0	0.0018	2.9	7.2

lists the results of the multiple regression analysis. The p-values of the safety measures, No. 1, 3, and 5, are higher than those of the safety measures, No. 2, 4, and 6. Thus, we conducted an additional analysis neglecting the non-significant safety measures (safety measures, No. 1, 3, and 5) as listed in

Table 9. Analysis conditions and analysis results without non-significant safety measures (safety measures, No. 1, 3, and 5) for the accidents.

Analysis Condition No.	Safety Measure No. 2	Safety Measure No. 4	Safety Measure No. 6	Analysis Results: Hydrogen Released in 240 s [kg]
1	1	1	1	17.8
2	1	1	0	12.1
3	1	0	1	12.0
4	1	0	0	6.1
5	0	1	1	12.0
6	0	1	0	6.1
7	0	0	1	6.1
8	0	0	0	0.01

. To make the difference clearer, the diameter of the leakage hole was changed from 1 mm to 5 mm. The initial value of the pressure is 82 MPa. Table 9 lists the analysis results. Figure 13 shows the average values of the amount of hydrogen released for safety measures, No. 2, 4, and 6. As shown in Figure 13, the influence of the safety measure, No. 6, is slightly lesser compared to that of other safety measures. This is because of the difference in the pressure loss due to the length of the pipes between the safety measures and the leakage point. That is, it was found that the influence degree of the accident was slightly larger when the safety measures closer to the leakage point failed. The significance of the safety measures is evaluated by excluding the non-significant factors. By taking this evaluation procedure, it is possible to evaluate the significance of safety measures when they are arranged in parallel with respect to the accidents. Although it is shown that this evaluation method is effective for the simple case in this study, it is expected to demonstrate further effectiveness in cases where the evaluation target is complicated.

5. Conclusions

To analyze the risk of a hydrogen fueling station, we developed a physical model of a hydrogen fueling station, which, when using, the temperature, pressure, and flow rate of the hydrogen could be simulated under normal and abnormal operating states. The physical model was validated by comparing it with the experimental results of an actual hydrogen fueling station. Using the physical model and statistical methods, we evaluated the significance of the safety measures in the case wherein multiple safety measures fail simultaneously. We determined the combinations of failures of safety measures that could lead to severe consequence of accidents and proposed a measure for preventing and mitigating the accident scenario. In particular, in the case of the safety measures for accidents arranged in series, the combination of failures of the overfill preventing valve, flow control valve (high flow rate), and isolation valve (compressor–dispenser) had the highest influence degree. If the risk due to the combination of failures of the safety measures cannot be tolerated, the safety measures should be controlled using different electrical systems.