Risk Analysis of Fire and Explosion of Hydrogen-Gasoline Hybrid Refueling Station Based on Accident Risk Assessment Method for Industrial System

Abstract

Hydrogen–gasoline hybrid refueling stations can minimize construction and management costs and save land resources and are gradually becoming one of the primary modes for hydrogen refueling stations. However, catastrophic consequences may be caused as both hydrogen and gasoline are flammable and explosive. It is crucial to perform an effective risk assessment to prevent fire and explosion accidents at hybrid refueling stations. This study conducted a risk assessment of the refueling area of a hydrogen–gasoline hybrid refueling station based on the improved Accident Risk Assessment Method for Industrial Systems (ARAMIS). An improved probabilistic failure model was used to make ARAMIS more applicable to hydrogen infrastructure. Additionally, the accident consequences, i.e., jet fires and explosions, were simulated using Computational Fluid Dynamics (CFD) methods replacing the traditional empirical model. The results showed that the risk levels at the station house and the road near the refueling area were 5.80 × 10⁻⁵ and 3.37 × 10⁻⁴, respectively, and both were within the acceptable range. Furthermore, the hydrogen dispenser leaked and caused a jet fire, and the flame ignited the exposed gasoline causing a secondary accident, considered the most hazardous accident scenario. A case study was conducted to demonstrate the practicability of the methodology. This method is believed to provide trustworthy decisions for establishing safe distances from dispensers and optimizing the arrangement of the refueling area.

1. Introduction

In the challenging circumstances of global warming and energy shortage, energy technologies such as hydrogen energy are rapidly advancing [1]. Hydrogen fuel cell vehicles (HFCVs) are more aligned with the current demands for green energy development than conventional internal combustion engines. Countries worldwide have taken hydrogen energy and HFCVs into national strategy and have already achieved a considerable technological advantage [2]. In China, the construction of hydrogen refueling stations (HRSs) has accelerated significantly since 2016, with more than 270 HRSs established. Among the different types of HRSs, hydrogen–gasoline hybrid refueling stations are regarded as one of the optimal options for the simultaneous supply of conventional and new energy due to their ability to conserve land resources and their lower construction and maintenance costs [3].

Hydrogen has a wide flammable range and low minimum ignition energy compared with conventional energy sources such as natural gas and gasoline and is a flammable and explosive light gas [4]. In addition to the high probability of fire and explosion, existing hydrogen infrastructure also has safety issues, such as an increased risk of leakage and vulnerability to hydrogen embrittlement [5,6]. It is worth noting that all vehicle fuels in hydrogen–gasoline hybrid refueling stations are combustible liquids or gases, each must be handled carefully, and the parties concerned must allow for new risks arising from fuel diversification [7]. Many hazards, such as failure of valves, flanges and pressure relief devices; human error; and inadequate organizational management threaten the safety of hydrogen storage [8]. In addition, due to the proximity of the facilities, one sudden environmental risk can easily lead to another sudden environmental risk, and this domino effect will bring severe consequences to accidents. In 2020, a blast in a diesel hydrogenation unit in Malaysia resulted in five fatalities and one severe injury. The following year, in 2021, another similar accident occurred at a refinery in Romania. This time, three additional explosions happened one after the other due to the presence of hazardous substances such as diesel and hydrogen, resulting in one death and four injuries. Therefore, assessing the risk of hydrogen infrastructure, such as HRSs, is essential in various situations [9].

Significant efforts have been put into researching security and risk analysis of separate HRSs using empirical models and numerical simulation software. For example, CFD tools Flame Acceleration Simulator (FLACS) [10,11,12,13,14], Ansys Fluent [15,16,17,18,19], and Phast/Safeti [20,21,22,23] have been used to study the potential effects of hydrogen dispersion, jet flames, and explosions at HRSs for more accurate results, and thus enable truly effective mitigation measures to improve safety. Hybrid stations pose a higher risk compared to separate stations. Therefore, it is crucial to conduct a risk analysis to fully consider the potential hazards of various HRSs, especially for stations built in urban areas with high population density and heavy traffic. Sakamoto et al. [24] analyzed the temperature and thermal stress caused by a gasoline pool fire in a hydrogen–gasoline hybrid refueling station based on TRACE and ANSYS. They discussed the safety distance and precautions for adjacent liquid hydrogen storage tanks. Sustained pool gasoline fires could damage processing equipment, and thermal radiation could cause pressurized hydrogen tanks to rupture [25]. Due to these studies, Kuroki et al. [26] further evaluated the effect of installing vessel walls around the cylinders on the fire propagation mechanism. Other studies have addressed the qualitative analysis approach [27,28,29], and some have revealed the unique mixing risks for systems involving hydrogen and gasoline and future directions for safety and security [28]. However, although these studies have promoted the improvement and development of the safety of hydrogen energy systems, probabilities of incident occurrence have not been considered, and few quantitative risk assessments for hydrogen–gasoline hybrid refueling stations have been conducted [28]. Thus, while empirical and modeling tool-based approaches are widely used, not considering the possibility of accidents is perceived as a weakness of these methods [30].

To more accurately measure risk, it is necessary to consider CFD-based consequence analysis complemented with quantitative risk assessment in the case of a complex system such as hybrid refueling stations [31]. At present, risk analysis of hydrogen infrastructure has been carried out with qualitative [28,32,33,34], quantitative [7,24,35,36], and integrated methods [37,38,39,40] that include traditional risk-assessment approaches such as FMEA, HAZOP, and Bayesian Network models. In these approaches, two parameters are important, accident frequency and consequences, and these approaches tend to assume that risk is positively related to the probability of accidents and the severity of the consequences [30]. The probability of accidents can be obtained from experiments and experience estimates, but the consequences of accidents are uncertain since similar accidents can hardly lead to the same consequences. In addition, for multi-fuel systems such as hybrid refueling stations, it is essential to consider the impact of chain reactions on the amplification effect of accidents. Therefore, the EU proposed the Accident Risk Assessment Method for Industrial System (ARAMIS) in 2005 in the framework of the Seveso II Directive. Compared with the previous risk-assessment methods, this approach focuses more on quantifying the risk consequences, which considers the consequences of an accident as the effect of the remaining energy intensity on the system’s vulnerability under various types of safety barriers after the energy is unexpectedly released. It also determines the comprehensive risk level of the system by considering the coupling effect of multiple hazards and superimposing the risk values of different risks. Nima Khakzad et al. [41] implemented ARAMIS real-time and dynamic risk analysis relying on Bayes’ theory and a computer simulation approach. J. Tixier et al. [42] discussed the setting of vulnerability weights for the surrounding environment of an industrial site in ARAMIS and determined the rationality of the vulnerability weights for human, environmental (or natural), and material stakes. However, traditional ARAMIS requires extensive underlying data and a complex computational process as support for probabilistic analysis, while the data of hydrogen incidents are limited. In addition, although ARAMIS proposes a dimensionless calculation for the impact range of the consequences caused by hazardous substances, additional calculations are required for the risk value at any point of the device based on the leakage and dispersion model and the explosion model, and it does not provide an effective means for presenting the results. Quantitative risk assessment studies have not been conducted for hybrid refueling stations, especially for hydrogen–gasoline hybrid refueling stations.

In this study, the simplified and improved Accident Risk Assessment Method for Industrial Systems (ARAMIS) was used as a tool for quantitative risk assessment to perform effective quantitative identification and prevention [43]. Due to the limitations of the traditional ARAMIS, the event frequency estimated by the Hydrogen Risk Assessment Model (HyRAM) was used instead of the complex probabilistic calculation process, and the consequence simulation analysis provided by Gexcon’s CFD tool FLACS was used instead of the traditional empirical model to make the method more suitable for hydrogen infrastructure. This study aims to reveal the unique accident scenario of the coexistence of gasoline and hydrogen and to assess the integrated risk level of the hybrid refueling stations with quantitative risk assessment. By risk identification and scenario selection, we identified hazardous accident scenarios relevant to hydrogen dispenser leaks and calculated their occurrence probabilities. Then, to make the accident consequences more accurate and reliable, the fire explosion simulation software FLACS was used to quantify the consequences of the accident and to calculate the risk values for hazardous locations near the refueling area. Furthermore, we suggested improving the emergency response and handling capabilities at the accident site to reduce or avoid the aggravation of the accident.

2. Description of the Hydrogen–Gasoline Hybrid Refueling Station

The hydrogen–gasoline hybrid refueling station is an efficient solution for providing energy to HFCVs. It is generally divided into five main sections: the refueling equipment area, the hydrogen refueling equipment area, the hydrogen refueling area, the gasoline refueling area, and the commercial area. The hydrogen is generated outside the station and transported as high-pressure gas via hydrogen tube trailers, and the gasoline is brought via tanker trucks. Figure 1 and

Table 1. Description of basic parameters of the hydrogen–gasoline hybrid refueling station equipment.

Equipment	Temperature (K)	Design Pressure (Bar)	Working Pressure (Bar)	Mass Flow	Capacity (m3)	Total Storage Capacity (kg)
Tube trailer	298	220	200	-	26.25	380.12
Compressor	298~323	250/450	250/450	500 kg/d (12 h)	-	-
Hydrogen storage tank	298	500	450	-	15	426.6
Gasoline storage tank	298	-	-	-	30	21750
Hydrogen dispenser	298	350	350	3.6 kg/min	-	-
Gasoline dispenser	298	4.5	3	50 L/min	-	-

, respectively, show the details of the layout and basic process parameters of a typical hydrogen–gasoline hybrid refueling station. The station’s hydrogen equipment area was modular in design and includes tube trailers, unloading columns, compressors, hydrogen storage tanks, chillers, and other facilities. The hydrogen refueling area contains two hydrogen fueling dispensers, with 350 bar hydrogen pressure and reserved space for 700 bar refueling. The gasoline refueling area is equipped with four gasoline refueling dispensers. Due to the general adoption of buried storage tanks, the gasoline from the tanker truck enters the buried tank through the closed pipeline, and the buried tank setting is safer; the tank capacity and risk are not considered for the time being. In this study, the equipment layout and spacing of the hydrogen–gasoline hybrid refueling station were set by referring to related technical standards and information regarding the actual hybrid refueling station.

3. Methodology

ARAMIS is a valuable method to analyze the integrated risk of a system, and it has been widely utilized in risk analysis of complex systems such as chemical industry parks and large storage tanks [44,45,46,47]. It needs to quantify the intensity of the energy source release and the vulnerability of the system within the impact range to quantify the severity of the accident consequences, combine it with the probability of the accident occurring, and thus quantify the specific risk values. The risk was defined with ARAMIS using the annual mortality rate, and it could be determined with the following formula [48]:

$$R=S\times V=P\times I\times V$$

(1)

$$R={\displaystyle \sum R_{\mathrm{i}}}$$

(2)

where R is the risk value for any location in the system, R_i is the risk value of various types of hazardous accidents at this location, S is the severity of accident consequences, V is the system’s vulnerability within the impact area of the accident, P is the probability of an accident, and I is the intensity of accident consequences.

Figure 2 shows the framework of the simplified methodology used for ARAMIS. The method comprises four main stages, which will be explained in detail in the following section.

• Stage 1: Risk Identification
• Stage 2: Scenario Selection
• Stage 3: Severity Calculation
• Stage 4: Vulnerability Assessment

3.1. Risk Identification

The main objective of risk identification is to identify potential accident scenarios which are likely to occur in the industry based on the equipment involved, and the properties of substances handled [49]. This approach identifies possible Dangerous Phenomena (DPs). It selects related accident scenarios by constructing a Bow-Tie (BT) diagram centered on Critical Events (CEs), where scenarios are selected in detail in Section 3.2.

3.1.1. Identifying Critical Events

The CEs associated with each piece of hazardous equipment in the system should be identified [48]. This paper focuses on the hydrogen dispenser, a crucial piece of equipment in hydrogen–gasoline hybrid refueling stations. These stations’ refueling areas are crowded with humans and vehicles, and the dispensers are frequently used, increasing the chance and severity of hydrogen dispenser accidents [27]. The risk of fire and explosion incidents is exceptionally high because of potential ignition sources such as electrostatic sparks and vehicle exhaust. The 20 incidents relevant to HRS refueling areas were collected from the European Hydrogen Incident and Accident Database (HIAD) and the Hydrogen Incident Reporting Database (HIRD), and analyzed for details of failure positions and parts, as shown in Figure 3. Unignited hydrogen leaks were the main accident type, followed by equipment failure, while there were only two fire and explosion accidents. The failed equipment in Figure 3 are generally components commonly used in all types of HRSs, such as joints, valves, and filling hoses, with the filling hose being the most accident-prone component. One typical incident was a hydrogen dispenser leak reported by HIRD. The incident was caused by a hydrogen filling hose getting caught on the vehicle as the driver pulled away from the station, which bent the hydrogen distribution manifold and resulted in hydrogen leaking from a screw joint and the filling hose. For these reasons, the hydrogen leak is determined as the CE of the hydrogen dispenser.

3.1.2. Constructing a Bow-Tie Diagram

To construct the BT diagram for each CE, both a fault tree analysis (FTA) and an event tree analysis (ETA) are needed. The FT is created using logical reasoning to identify and assess system hazards based on the hydrogen dispenser’s operating conditions and to determine potential causes of hydrogen leaks. The ET, which is located on the right side of the BT diagram, tracks the chronological progression of the incident starting from the CE. The possible consequences of the incident are estimated by considering barriers, sequential failures of relevant safety features, and the types of ignition. In turn, the DPs are selected from the consequences, and 13 DPs are defined in ARAMIS: pool fire, tank fire, jet fire, vapor cloud explosion (VCE), flashfire, toxic cloud, fire, missile ejection, overpressure generation, fireball, environmental damage, dust explosion, boil over, and resulting pool fire [48]. The BT diagram constructed in this study was implemented through interviews with experts, logical reasoning, and review of operational drawings and relevant documents.

Figure 4 demonstrates the BT diagram of a hydrogen leak from a hydrogen dispenser, which reflects the entire accident scenario from cause to effect. First, the FTA diagram of hydrogen leaks from the hydrogen dispenser was created. The major causes of hydrogen leaks from the hydrogen dispenser were identified through interviews with experts and review of operational drawings and related documents. The results identified four main causes, including human factors, process factors, mechanical factors, and environment factors. After that, the intermediate and basic causes are further obtained using logical reasoning. A total of 56 causes or defects (34 basic and 22 intermediate causes) were detected which contributed to hydrogen leaks from the dispenser. To determine the chronological sequence of possible events after the critical event, ETA was performed by considering six safety barriers: automatic control system, immediate ignition barrier, manual emergency cut-off system, delay ignition barrier, congestion barrier, and flammable hazardous substance avoidance. With regard to failure or success of the safety barriers, the hydrogen leak scenario provided six final results that included safe diffusion, jet fire, explosion, flash fire, hydrogen accumulation, and domino accident (gasoline fire).

3.2. Scenario Selection

Scenario selection aims to choose Reference Accident Scenarios (RAS) by considering the likelihood of accidents and their potential impact. This will be achieved by following three steps: frequency calculation, consequence assessment, and risk matrix construction, which are explained as follows.

3.2.1. Frequency Calculation

The frequency of CEs is generally calculated using FTA, which is mainly based on the probability of initial events in the FTA and considers the safety barriers affecting the initial events [48]. Due to the short development time of the hydrogen energy industry, a dedicated database of hydrogen system failure frequencies has not been established at home or abroad. Thus the frequencies of basic events were determined using expert elicitation, reference literature reviews, and existing databases such as HyRAM [50] and reliability Information Analysis Center (RIAC), as shown in Appendix A. HyRAM has the probabilities of equipment failures for different components for gaseous and liquid hydrogen, gaseous and liquid methane, and propane systems. Leakage failure of hydrogen dispensers may occur due to either the overpressure leakage of the filling process or mechanical leakage, which is the main risk factor, including equipment failure, fatigue, and corrosion. Such frequencies are usually available from HyRAM, and for components not considered by HyRAM such as Pressure Relief Devices (PRDs) and sensors, the conservative eigenvalues of their failure probabilities are presented in the public database RIAC [51]. In addition, the reliability data used for human and environmental factors in the FTA model were obtained from expert elicitation and reference literature reviews [52,53,54]. For each branch of the ETA on the right-hand side of the BT diagram, the probability of the incident’s consequences can be determined with probability transfer [55].

Table 2. Transmission probabilities.

Transmission Event	Probability (Year−1)
Automatic control system normal (S1)	0.670
Immediate ignition (S2)	0.053
Manual emergency cut-off system normal (S3)	0.670
Delayed ignition (S4)	0.027
Confined space (S5)	0.600
Hazards exist nearby (S6)	0.720

shows the transmission events and probabilities from CE to incident consequences, which are determined based on the hydrogen system ignition probabilities published by HyRAM, the performance of the safety system, and the actual layout of the hydrogen–gasoline hybrid refueling station. The probabilities of incident consequences can then be obtained by calculating the likelihood of transmission events, as shown in

Table 3. Probabilities of incident consequences.

Incident Consequences	Probability (Year−1)
Safe diffusion	3.25 × 10−2
Jet fire	6.19 × 10−4
Explosion	5.90 × 10−5
Flash fire	3.90 × 10−5
Hydrogen accumulation	2.13 × 10−3
Domino accident (gasoline fire)	5.17 × 10−4

.

3.2.2. Consequence Assessment

The identification of accident scenarios is based on the probabilities and consequences of DPs. Therefore a rough qualitative assessment of the level of incident consequences is required in addition to calculating the probability [49]. For the 13 common DPs, ARAMIS gives the corresponding “fully developed” consequence levels [49]. This study refers to the recommended values and fully considers the domino effect of getting the levels of incident consequences in the BT diagram, as shown in

Table 4. Level of incident consequences.

Incident Consequences	Level
Safe diffusion	C1
Jet fire	C3
Explosion	C4
Flash fire	C2
Hydrogen accumulation	C1
Gasoline fire	C3

.

3.2.3. Risk Matrix Construction

Figure 5 demonstrates the modified risk matrix diagram, which assesses the magnitude of risk for incident consequences based on the frequency and consequence levels. Incidents with consequences in the “medium effects” (yellow) and “high effects” (red) zones were identified as DPs, including jet fires, explosions, and gasoline fires. These incidents will be outlined in scenarios and subjected to quantitative analysis to determine their risk severity.

Table 5. Scenario Assumptions.

Scenarios	RASs	Leakage Direction
1	Hydrogen jet fire	+Y
2		−Y
3	Hydrogen explosion	+Y
4		−Y
5	Gasoline fire (Domino)	+Y

shows that the RASs were assumed based on the DPs identified through the risk matrix. The analysis of the qualitative FTA diagram in Figure 4 shows that the hydrogen leaks from dispenser are concentrated in the joint between the hydrogen dispenser and filling hose, the joint between the filling hose and the HFCV’s separation unit, and the filling hose itself. These main risk components correspond to historical hydrogen incidents in Figure 3. Possible risk factors include abnormal operation, overpressure leaks, equipment failure, and corrosion. Thus, the hydrogen jet fire and explosion are supposed to be caused by immediate ignition and delayed ignition of high-pressure hydrogen leaks in the filling hose, respectively. The gasoline fire is supposed to have been a domino accident caused by the hydrogen jet fire igniting the fuel tank while the refueling operation was underway. In addition, hydrogen is assumed to leak in different directions to consider the level of risk at various locations inside and outside the station. It is worth noting that this risk matrix is only a tool for selecting RASs, not risk acceptability criteria, and should not be used blindly.

3.3. Severity Analysis

3.3.1. Severity Index Definition

A risk severity index (S) is used to quantify the risk level of equipment or area of impact. For each DP or CE, their risk severity index S_DP or S_CE can be determined, and then the risk severity of the selected Reference Accident Scenarios (RASs) is calculated using S_DP or S_CE [56].

Table 6. S_DP linear variation formula.

Injury Level	SDP	x	Linear Relationship
1	0–24	d1 < x < d0	$S_{DP}=\frac{25}{d_1-d_0}\left(x-d_0\right)$
2	25–49	d2 < x < d1	$S_{DP}=\frac{25}{d_2-d_1}\left(x-2d_1+d_2\right)$
3	50–74	d3 < x < d2	$S_{DP}=\frac{25}{d_3-d_2}\left(x-3d_2+2d_3\right)$
4	75–100	d4 < x < d3	$S_{DP}=\frac{25}{d_4-d_3}\left(x-4d_3+3d_4\right)$

shows the formula for the linear variation of S_DP with distance x, divided into four impact levels according to the range of S_DP. Different thermal radiation intensity and explosion overpressure correspond to different characteristic distances d₀-d₄, respectively, as shown in

Table 7. Threshold for S_DP risk severity index.

Characteristic Distance	d0	d1	d2	d3	d4
Thermal radiation (kW/m2)	1	1.8	3	5	8
Overpressure (bar)	0.001	0.03	0.05	0.14	0.25

.

The sum of the products of risk severity and probability for all DPs is defined as S_CE(d), which is the risk severity index of the CE at distance d, following Equation (3):

$$S_{CE\mathrm{i}}\left(d\right)={\displaystyle \sum _{i=1}^n\left(P_{DPi}\cdot S_{DPi}\left(d\right)\right)}$$

(3)

In the formula, n is the total number of DPs, P_DPi is the probability of occurrence of a DP_i, and S_DPi(d) is the risk severity index of a DP_i at distance d.

The Severity of Risk Index S for the entire research object is the sum of the products of risk severity and frequencies for all CEs, following Equation (4):

$$S\left(\mathrm{d}\right)={\displaystyle \sum _{j=1}^m\left(f_{CEj}\cdot S_{CEj}\left(\mathrm{d}\right)\right)}={\displaystyle \sum _{j=1}^m{\displaystyle \sum _{i=1}^n\left(f_{DPi,j}\cdot S_{DPi,j}\left(\mathrm{d}\right)\right)}}$$

(4)

where m is the total number of CEs, f_CEj is the frequency of CE_j, and S_CEj is the risk severity index of CE_j. S takes values in the range of 0–1000.

3.3.2. Simulation Model

To make the accident consequences more accurate and reliable, we simulated the characteristics of flames, the contours of thermal radiation from hydrogen jet and gasoline pool fires, and the distribution of overpressure from hydrogen explosions under different scenarios using FLACS. FLACS is the world’s leading fire and explosion risk-assessment software, and with 3D modeling the consequences of accidents can be more accurately predicted [12]. In FLACS, hydrogen and gasoline are set as the materials, the wind velocity is 3.0 m/s, the wind direction is SSE, the hydrogen pressure is 350 bar and the hose diameter is 6.35 mm. The hydrogen state of leakage location in Scenarios 1–4, such as temperature, pressure, and mass flow rate, is mainly determined by the hydrogen fueling pressure and the leakage aperture [13]. Since most high-pressure hydrogen leaks are sub-expansion jets in the initial stage [55], the ideal gas state equation is no longer applicable when the hydrogen pressure is higher than 100–200 bar. Thus, this paper determines a hydrogen mass flow rate of 0.6 kg/s based on the Abel-Noble equation and the equations of energy and mass conservation [57]. For the hydrogen jet fire simulation, the grid size of 0.3 m × 0.3 m × 0.3 m is taken, and the vertical direction of the leakage hole jet direction is locally encrypted. The explosion simulation calculation area is the same as the jet fire simulation calculation area, but the grid is divided uniformly with a grid interval of 0.5 m.

Assume that the location of gasoline combustion is the tank, the tank’s volume is 45 L, the height of the tank from the ground is 1.0 m, and the density of gasoline takes the value of 0.725 g/mL. Performing pool fire simulation may lead to the pulsation of the flame. Thus, the grid size of 0.5 m × 0.5 m × 0.5 m is chosen in the core area of leakage to provide better simulation results.

3.4. Vulnerability Assessment

Vulnerability is the maximum tolerable capacity of a system within the area affected by an incident at the time of the incident [43]. Accidents simultaneously damage individuals, materials, and the environment, but traditional analysis methods tend to analyze the three independently. Thus, to ensure a uniform measure of losses in all three aspects, during the development of the ARAMIS assessment methodology, the EU expert group invited 38 risk experts from different industries to carry out a dimensionless analysis study on individuals, material, and environment [58]. Ultimately, an analytic hierarchy process was used to derive unified quantitative formulas for humans, materials, and the environment, which is represented in Equations (5)–(8).

$$V_{global}=0.752\cdot V_H+0.197\cdot V_E+0.051\cdot V_M$$

(5)

$$V_H=0.265H_1+0.383H_2+0.222H_3+0.130H_4$$

(6)

$$V_E=0.234E_1+0.154E_2+0.285E_3+0.327E_4$$

(7)

$$V_M=0.237M_1+0.315M_2+0.218M_3+0.230M_4$$

(8)

where V_global is the global vulnerability index; V_H is human vulnerability; V_E is environment vulnerability; V_M is materials vulnerability; the quantification factors H_i, M_i, and E_i are the proportion of exposed receptors in the research area and are dimensionless data. The classification of vulnerability assessment receptors is shown in

Table 8. Vulnerability assessment receptor classification.

Receptor Category	Category 1	Category 2	Category 3	Category 4
Human	On-site employees (H1)	Residents (H2)	Inside public buildings (H3)	On transportation (H4)
Environment	Agricultural land (E1)	Natural areas (E2)	Nature reserves (E3)	Marshes, reservoirs (E4)
Material	Industrial sites (M1)	Public Foundation (M2)	Private buildings (M3)	Public buildings (M4)

.

4. Results and Discussion

4.1. Simulation Results

4.1.1. Hydrogen Jet Fire

Figure 6 and Figure 7 illustrate the temperature field of a jet flame resulting from the sudden ignition of hydrogen that has leaked in different directions. The temperature of the external flame shape is set at 1200 K [59]. In Scenario 1, the hydrogen’s buoyancy causes the flames to tilt upwards and spread to the adjacent HFCV and gasoline dispenser. In Scenario 2, the maximum distance of the jet flame reaches 16.7 m because there are no obstructions. This means that the road located 15 m from the leak is affected by the thermal radiation from the jet fire, which can damage vehicles and cause harm to humans if they are exposed to it for prolonged periods.

Since hydrogen–gasoline hybrid refueling stations are usually built next to roads with a frequent flow of humans and vehicles, the extent of damage to station personnel and nearby residents would be a significant consideration in the event of a fire or explosion. Therefore, the adjacent road and the station house are selected as critical hazard locations in this study. Figure 8 shows the variation with time of the thermal radiation impact of the hydrogen jet fires at each risk location for Scenarios 1 and 2. The ignition time of jet fires is 10.2 s, and the thermal radiation value of the jet fire increases sharply after ignition, and the jet fire gradually tends to steady state after 2–4 s. The thermal radiation fluctuates up and down in a range under the influence of ambient wind.

The thermal radiation effect of the jet fire for scenario 1 is observed in Figure 8a, and this jet fire is ejected into the hybrid refueling station. After the flame stabilization, the gasoline dispenser 6.6 m away from the leak point was exposed to an average value of 116.1 kW/m² of heat radiation, while the station house was exposed to 7.7 kW/m² of heat radiation due to the distance. According to the damage criterion for radiation heat on humans and equipment [60], the gasoline dispenser could be damaged, and employees at the station house could feel pain and swelling of the skin. Figure 8b shows the jet fire of Scenario 2 ejected in the direction of the road, and the road 15 m away from the leak is exposed to a radiant heat flow of 48 kW/m². Any vehicle be parked in this area will be damaged, and worse, there is a 1% fatality for humans within that range in 10 s.

4.1.2. Hydrogen Explosion

Figure 9 and Figure 10 show the overpressure distribution of the hydrogen explosion accident with different leakage directions. The car smoke vent with a height of 0.32 m is set as the ignition resource for delayed ignition in the explosion simulation. The hydrogen gas in Scenario 3 leaks in the +Y direction of the jet and mainly accumulates between the gasoline dispensers. The maximum blast shock overpressure in this localized area is 0.55 bar. According to the overpressure guidelines, this pressure can cause severe structural damage to the surrounding gasoline dispensers, leading to gasoline leaks and, consequently, secondary accidents, which may cause irreversible injuries to personnel.

In Scenario 4, the explosion pressure in the south of the HFCV after ignition is relatively low due to the ample surrounding space and the quick diffusion of the hydrogen gas after leakage. Although hydrogen combustion takes place, the resulting pressure can be quickly relieved. As the flame propagates between the hydrogen refueler and the hydrogen fuel cell vehicle, the area here is relatively congested, raising the pressure in this local area to 0.47 bar. The explosion pressure profile expanded from the hydrogen dispenser exceeds 0.13 bar within the range of 29 m in the radial direction; it does not reach either the adjacent roads or the station house, and the only possibility of severe structural damage is to the surrounding gasoline dispenser.

Figure 11 shows transient changes in hydrogen explosion pressure with time at the gasoline dispenser and station house for Scenarios 3 and 4. The transient pressures over four scenarios exhibit a kind of oscillation ranging from negative to positive gauge pressures and then end up with atmospheric pressure; the duration of the entire explosion process is about 0.4 s. It can be obtained in Figure 11a that the maximum pressures of the neighboring dispenser and the station house in Scenario 3 are 0.225 bar and 0.156 bar, respectively. It can be found according to the damage criterion for explosion overpressure that in this scenario, the steel structure of the building within the range of the gasoline dispenser will be distorted, while the eardrum of the exposed workers near the station house will be ruptured. Figure 11b shows maximum pressures of 0.137 bar and 0.082 bar for the neighboring dispenser and the station house, respectively, which are lower than the pressure values in Figure 11a. This is because the hydrogen gas in Scenario 4 leaks towards the road without the blocking effect of the equipment, and the space is more open compared to inside the hybrid refueling station.

4.1.3. Gasoline Fire

Figure 12 shows the thermal radiation field of a gasoline fire under the domino effect. The adjacent gasoline fueling dispenser and the station house are covered by thermal radiation above 37.5 kW/m². At this value, the structural integrity of the gasoline fueling dispenser will be compromised, and prolonged exposure may lead to a third accident.

4.2. Severity Calculation

Table 9. Characteristic distance of DPs.

Scenarios	DP	Effect	Direction	d0	d1	d2	d3	d4
1	Hydrogen jet fire	Thermal radiation	+Y	29	25	23	20	17
2	Hydrogen jet fire	Thermal radiation	−Y	36	28	23	21	19
3	Hydrogen explosion	Overpressure	+Y	27.3	17.1	17.1	8.9	8.2
			−Y	25.2	16.5	12.6	5.9	5.6
4	Hydrogen explosion	Overpressure	+Y	34	28.3	25.4	25.4	9
			−Y	30.2	13.2	13	9.9	5.8
5	Gasoline fire (Domino)	Thermal radiation	+Y	23	18	15	13	11
			−Y	22.2	16.7	14.1	11.8	9.9

shows that the characteristic distances of various DPs that occurred from hydrogen leakage under different S_DP were simulated using FLACS software, which considers the most unfavorable scenarios. The significant effect of hydrogen jet fire and gasoline fire accidents is thermal radiation, and the considerable impact of hydrogen explosion is explosion shock wave overpressure.

From Table 6 and Table 7 and Equations (3) and (4), it can be calculated that the severity S_CE of the road 15 m away from the hydrogen dispenser is 0.1176, and the severity S_CE of the station 25 m away from the hydrogen dispenser is 0.0203. In addition, the integrated severity S for these two locations can be calculated with Equation (4), which is 4.16 × 10⁻³ and 7.17 × 10⁻⁴, respectively. According to the severity classification scale [56], the severity index of both the adjacent road and the station house belongs to the low severity level.

4.3. Vulnerability Calculation

No receptors such as farmland, natural areas, nature reserves, swamps, and reservoirs are located around the study subject in this paper. Thus, environmental vulnerability targets are not considered. The vulnerability of humans and materials was analyzed and calculated according to the basic information of the hydrogen–gasoline hybrid refueling station. The vulnerability of humans and materials was analyzed, and the ratio of on-site employees (H₁) was selected as 0.2813, on transportation (H₄) as 0.1949, public foundation (M₂) as 0.1217, public buildings (M₄) as 0.1198, and other receptors were 0 due to not being included in the research area. Then, the vulnerability index for humans and materials is 0.1033 and 0.0655, respectively, from Equations (5)–(8). Next, from Equation (5), the integrated vulnerability of the hydrogen–gasoline hybrid refueling station can be calculated as 0.08102.

4.4. Integrated Risk Value Calculation

According to the definition of risk in the ARAMIS framework system, multiplying the severity with the vulnerability, the risk values for the adjacent road and station house can be obtained as 3.37 × 10⁻⁴ and 5.80 × 10⁻⁵, respectively, following Equations (9) and (10):

$$R_1=S_1\times V=4.16\times {10}^{-3}\times 0.08102=3.37\times {10}^{-4}$$

(9)

$$R_2=S_2\times V=7.17\times {10}^{-4}\times 0.08102=5.80\times {10}^{-5}$$

(10)

where R₁ is the risk of the adjacent road, R₂ is the risk of the station house.

The UK Health and Safety Executive (HSE) emphasizes the obligation to reduce risk to “As Low As Reasonably Practicable (ALARP)”, even if the risk assessment shows that the safety level is within the specified acceptable standards [61]. Risk criteria are defined at three levels: acceptable, ALARP (As Low As Reasonably Practicable), and unacceptable, with acceptable risk at 10⁻⁶ per year, ALARP at 10⁻⁵ per year, and unacceptable risk at 10⁻³ per year [62]. Comparing the obtained risk results with the risk assessment ALARP guidelines, the integrated risk value of the two critical hazard locations in this study is within the acceptable range. The same method can be used to calculate the risk value for any site to assess the safety of that typical hydrogen–gasoline hybrid refueling station.

5. Conclusions

A risk-assessment model was developed to better evaluate scenarios of hydrogen leakage from hydrogen refueling stations, considering the domino effect. The overall risks to the station and its surrounding roads were calculated by combining the individual risk values from different scenarios, considering the amplification of risk and vulnerability caused by the domino effect. The findings can be summarized as follows:

(1)

The maximum jet flame distance from the hydrogen dispenser was found to be 16.7 m for a 6.35 mm jet fire. This jet fire has the potential to cause severe structural damage to a gasoline dispenser located 7 m away, leading to gasoline leakage and further accidents that can cause harm to humans.

(2)

The explosion pressure is largely determined by the level of obstruction in the area. In open refueling areas, the explosion pressure is quickly generated and dispersed, with a maximum pressure of up to 0.55 bar.

(3)

The calculated risk values for the surrounding road and station house were magnified by considering the domino effect, at 3.37 × 10⁻⁴ and 5.80 × 10⁻⁵, respectively, which better reflects the true risk level. The risk is within the acceptable range based on the ALARP guidelines for risk assessment.

In conclusion, it is possible to safely construct hydrogen–gasoline hybrid refueling stations within acceptable risk levels according to current laws. Measures can be taken to shorten the safety distance and optimize the spatial layout based on the risk-assessment results. Additionally, stations refueling with multiple fuels simultaneously should improve emergency response capabilities to minimize the impact of accidents. The risk-assessment approach in this paper can also be applied to other types or layouts of hybrid refueling stations to evaluate the integrated risk level within the stations. In future research, we will consider the accident risk for newly built hybrid plants or partially converted hybrid plants where there is usually a hydrogen charging zone separate from the oil charging zone. The effects of ambient wind conditions on the outcome of accidents at these stations will also be studied.