A methodology for quantitative risk assessment of a high-capacity hydrogen fueling station with liquid hydrogen storage

Author: Suroosh Mosleh * , Cristian Schaad , Ruochen Yang , Katrina M. Groth

Keywords: Systems Risk and Reliability Analysis Lab (SyRRA), Center for Risk and Reliability, Mechanical Engineering, University of Maryland, College Park, MD, US

Internation Journal of Hrdrogen Energy 112 (2025) 554-553

Article and Origin Information : Please Click this  link

Abstract 

Hydrogen fueling stations are critical infrastructure for deploying zero emission hydrogen fuel cell electric vehicles (FCEV). Stations with greater dispensing ca pacities and higher energy efficiency are needed, and cryogenic liquid hydrogen (LH2) has the potential to meet these needs. It is necessary to ensure that hazards and risks are appropriately identified and managed. This paper presents a Quantitative Risk Assessment (QRA) methodology for high-capacity (dispensing >1000 kg/day) hydrogen fueling stations with liquid hydrogen storage, and presents the application of that methodology by presenting a Failure Mode and Effect Analysis (FMEA) and data curation for the design developed for this study. This methodology offers a basis for risk and reliability evaluation of these systems as their designs evolve and as operational data becomes available. We developed a generic station design and process flow diagram for a high-capacity hydrogen fueling station with LH 2 storage. Following the system description is hazard identification done from FMEA to identify the causes of hydrogen releases and the critical components causing the releases. Finally, data collection and curation is discussed, including challenges stemming from the limited public availability of reliability data on components used in liquid hydrogen systems. This paper acts as an introduction to the full QRA presented in its companion paper, Schaad et al. [1].

1. Introduction

Hydrogen is a promising option for decarbonizing key economic sectors such as transportation, energy storage, and chemicals production [2]. The U.S. national network of hydrogen fueling stations is set to expand significantly in the next 5–10 years as government, research, and academic institutions work closely with industry to deploy hydrogen technologies to decarbonize the transportation sector in the U.S. Environmental and emission reduction benefits span across light-, medium-, and heavy-duty as well as off road, rail, maritime, and aviation transportation modes which combined account for a total of 33% of the U.S. greenhouse gas (GHG) emissions [3].

A key focus of the hydrogen infrastructure research activities has been to enable the wide distribution of fueling infrastructure and to accommodate fueling needs for multiple vehicle classes with different onboard storage configurations, pressures, and fueling rates. Failures in hydrogen systems can cause property damage, system downtime, injuries, and loss of life. This could damage public trust, which may in turn inhibit decarbonization efforts. Enabling the wider adoption of hydrogen technologies requires diligent investigation and quantification of associated risks to develop measures to mitigate and prevent failures. The U.S. National Clean Hydrogen Strategy and Roadmap emphasizes that safety and reliability concerns are key issues for the development,  commercialization, and implementation of new technologies and  infrastructure [2]

Codes and standards for the deployment of hydrogen fueling stations are continuously evolving. The 2014 Society of Automotive Engineers (SAE) J2601 included a separate document establishing safety limits and performance requirements for 35 MPa dispensing systems used for transit buses [4]. Advanced fueling protocols for medium- and heavy-duty trucks, however, are under continuous evolution and have yet to be standardized for a wider deployment of fuel cell electric trucks. In addition to higher flow rates and advanced bi-directional vehi cle-to-station communications, stations must increase storage capacities and precooling capabilities to support back-to-back fueling of large tanks. Because heavy-duty trucks accommodate larger onboard storage capacities of up to 100 kg, station storage capacity will need to scale up from hundreds to thousands of kg of hydrogen onsite. Risk analysis of these newer heavy-duty liquid hydrogen-based systems is necessary to develop and maintain appropriate codes and standards, and ensure safe deployments as the technology progresses.

The U.S. National Clean Hydrogen Strategy and Roadmap points to a need for safety and reliability data generation, collection, analysis, and use to close knowledge gaps and ensure that best practices are imple mented in future deployment plans [2]. Quantitative risk assessment (QRA) plays a key role in enabling safe and reliable technology and infrastructure throughout the system lifecycle. It is a rigorous method ology used to estimate risks posed by industrial systems or processes to provide information for decision making about system design and op erations [5]. QRA has been used to build a systematic and science-based foundation for the design and implementation of key hydrogen codes and standards. This includes multiple aspects of both the National Fire Protection Agency (NFPA) 2 Hydrogen Technologies Code [6] and the international standard for hydrogen fueling stations, International Or ganization for Standardization (ISO) 19880-1 [7]. QRA has been used to risk-inform various requirements for gaseous hydrogen (GH 2 ) stations including separation distances [8], indoor refueling provisions [9], and performance-based compliance options for fueling stations [10] of NFPA 2. Underpinning the ability to do QRA for hydrogen systems is the HyRAM toolkit [11]. QRA has also been applied to additional hydrogen technologies in a limited manner (e.g., GH 2 refueling stations [12,13], a hydrogen production facility [14], and a distribution network [15]).

While the petrochemical industry has a plethora of experience safely using hydrogen, much of that experience cannot be directly transferred to scenarios where the general public is in contact with hydrogen (e.g., hydrogen vehicle fueling or operating hydrogen vehicles) or where scales are vastly different (e.g., the large amount of information about a large production facility isn’t directly relevant to end-use systems, much like how an oil refinery and a gas station are different). Additionally, any QRA is by nature system-specific – the risks presented by a system depend in part on its design, but also on its location, operation, main tenance, and environment. Thus, it is important to study the safety as pects of hydrogen systems to gain risk-informed insights that will allow the hydrogen industry to develop preventive and protective measures to reduce the occurrence of incidents. Section 2 provides a detailed liter ature review of the existing QRAs of hydrogen fueling stations.

This paper describes the current state of the art in QRA on hydrogen fueling stations, defines a clear methodology for conducting a QRA on an LH station, and presents the basis for the application of that method ology to a high-capacity dispensing (>1000 kg/day) design that is described. Following the QRA, we identified key R&D gaps necessary to address, including the need for failure frequency data for critical com ponents, consequence analysis for liquid hydrogen releases, and opera tional data collection.

1.1 Previous hydrogen fueling station QRAS

To frame this investigation, we first sought to establish the state-of- the-art in hydrogen fueling stations QRA and identify the existing ca pabilities and pertinent gaps. We identified relevant articles in the most high-impact relevant journals including the International Journal of Hydrogen Energy, Reliability Engineering and System Safety (RESS), Journal of Loss Prevention in the Process Industry (JLPPI), Process Safety and Environmental Protection (PSEP). Table 1 shows the number  of relevant papers identified in the journals. We focused on papers that undertook a safety risk, and/or reliability assessment of hydrogen fueling stations, specifically works where the scope of analysis encom passed the entire station rather than specific sub-system analysis, although those sources were consulted as references while conducting the QRA on the system presented in this paper. We further looked closely at the specific risk assessment modeling methodologies used, and the underlying data used to parameterize those models.

Table 1 Keyword search terms and number of publications found in relevant journals for hydrogen fueling station risk and reliability analysis.

Table 2 provides a methodological overview of relevant papers that present a QRA on the entire hydrogen fueling station system. Groth et al. [9] detailed a framework and initial QRA analysis of indoor hydrogen fueling stations, with a detailed FMEA evaluating the consequences of a hydrogen gas release from the refueling dispenser. Correa [16] provides another detailed FMEA describing scenarios involving a rupture of a double-walled 800 kg LH 2 storage tank. Gye [12] presents failure fre quency data obtained from actual operational data from hydrogen fueling station accident reports, ranking a large leak (rupture) from the compressed gas facility as the top contributor to risk events. Suzuki 2021 and Pirbalouti 2023 begin their QRA analyses on hydrogen fueling stations with a Hazard and Operability (HAZOP) study [13,17]. Hoseyni et al. [18] analyze risk mitigation for hydrogen fueling stations from a high-level perspective using structured what-if analysis (SWIFT) and a classic bowtie risk model. Suzuki et al. [13] base their GH 2 hydrogen leakage frequency assessment on frequencies from Groth et al., 2017 [11], whereas Pirbalouti [17] introduce spherical fuzzy sets based on expert elicitation to estimate LH 2 leakage frequencies and component probabilities of failure. Both papers indicate a jet fire as the most likely consequence of an H 2 leakage. Wang et al. [19] propose Deterministic Risk Assessment (DRA) as a method for complimenting traditional QRA by emphasizing worst case scenarios. They demonstrate their method ology on a model of a large-scale hydrogen fueling station with eight dispensers located in Beijing, China. Xing et al., 2022 analyze GH 2 hydrogen fueling stations by presenting a model combining FTA and event tree analysis (ETA) with a fuzzy Bayesian network (BN) to conclude that the “refueling” unit of the hydrogen fueling station system provides the highest risk value [20]. Zhang [21] utilizes fuzzy sets and expert elicitation for prior leakage probabilities and creates a dynamic Bayesian network (DBN) to obtain dynamic leakage probabilities for hydrogen fueling stations concluding that the most likely contributor to hydrogen leakage comes from improper system maintenance. Lu et al. [22] also employ a DBN to analyze consequences of fires and explosions at hydrogen fueling stations; the authors identified pressure relief device failure and valve damage among the top probable contributors to hydrogen leaks.

Any hydrogen leakage event has the potential of resulting in cata strophic harm to people operating the system or people nearby. Bae et al. consider an ammonia-derived hydrogen fueling station and indicate leakage from the storage tank both exceeds acceptable risk criteria and is the most likely accident scenario [23]. Analysis conducted by Kobayashi et al. showed a correlation between temperature and risk for releases of cryogenic hydrogen; the equations presented for flame length and heat f lux were considered for this analysis [24]. Also, Moonis et al. conducted a semi-quantitative risk assessment of a commercial H 2 supply-chain. Their consequence analysis classifies a catastrophic failure of an LH 2 storage tank at a hydrogen fueling station leading to a vapor cloud ex plosion or jet fire as extremely unlikely, low risk events [25]. The Eu ropean Union co-funded HyResponder project describes the release behavior of cryogenic hydrogen based on experimental releases. The HyResponder reports are developed to provide response training to safety specialists in the field [26].

From the collection of papers reviewed, we found those studies have incorporated parts of the methodology some of outlined in Section 2 of this paper, and that analysis has been conducted on smaller systems, with consequence analysis predominantly focusing on gaseous hydrogen releases. This study shows there is an ability to complete an appropriate early-stage QRA given the current knowledge and capabilities available (Table 3). We know initiating events for both LH 2 2 risk scenarios can be developed, and logic models developed from that basis. However, there is a gap in the literature: no published QRA study has been completed on a fully documented a hydrogen fueling station with liquid storage designed to operate at an industrial scale. The aforementioned gap, as well as our assessment that the requirements are present to conduct a QRA on an LH 2 system from front to end based on the methodology outlined in Section 2 motivated our study. This paper will outline our methodology to conduct failure mode quantification for both GH 2 and LH 2 components, consequence evaluation of hydrogen release with HyRAM+ and physical models, a quantitative evaluation of risk, and an evaluation of results. Our results are communicated in Schaad et al. [1]

2. Fueling station QRA methodology

The methodology for the QRA developed in this study closely follows the methodology proposed in HyRAM and Groth 2012 [9,11], which is tailored for assessing the safety of hydrogen systems, and the general QRA methodology described in Modarres and Groth [5], which provides a concise outline of a full process designed to inform decision making. As shown in Fig. 1, the described methodology starts with defining the scope of the analysis including system design and the operational environment. The system description is defined by the system compo nents, their parameters, and the safety strategy including active and passive safety measures [11]. Then, the frequencies of the releases and their physical characteristics are calculated, which leads to calculating the probabilities for the release scenarios. It should be noted that the focus of this QRA is on uncontrolled releases of GH 2 and LH 2 ; controlled vents are not considered in our risk analysis. This aligns with past safety codes and standards, which develop safety distance requirements based on uncontrolled releases scenarios [8].The consequences of each release scenario and probability for potential loss of life due to thermal harm and overpressure harm are then calculated, and finally the total risk of the system is communicated. The results of our full QRA are presented in Ref. [1].

System Description: This step of the methodology defines the sys tem to be analyzed in terms of its functional requirements, internal and external operational parameters, components, and other pertinent design features. The scope and objectives of the QRA analysis are also defined in this step. The QRA process of a (high-capacity) hydrogen fueling station faced several challenges, one being the lack of publicly available informative diagrams describing the process flow of a hydrogen fueling station (with LH 2 storage) to perform an in-depth QRA. Most system descriptions lack information about the complete range of components necessary for the station operation, particularly in stations that use LH 2 for temperature control. To solve this issue, the current study created a generic hydrogen fueling station capable of dispensing 1000 kg/day with on-site LH2 storage for high-capacity and high usage rates. The station design followed from proposed designs presented in previous studies as well as current station designs under construction [29]. It is described in details in Section 3.

Problem Scope: Once the system is defined, we identify what ele ments of the system will be analyzed with the QRA. Our study’s scope is a QRA of uncontrolled hydrogen releases from the system [1].

Hazard Identification: The main activity in this step is identifica tion of various ways that each of the components of the systems can fail (functional failure models and corresponding failure mechanisms) and how such failures may result in system failure or degradation of its function. A detailed FMEA was conducted for the developed high- capacity fueling station in this study to understand the failure mecha nisms. The analysis results and conclusion can be found in Section 4. It forms the foundation of the formal QRA study [1].

The FMEA identifies the possible failure scenarios and the root causes associated with hydrogen fueling station. In this study, the FMEA for the studied system follows guidelines from Modarres and Groth [5] and IEC-60812 [30]. The risk associated with each failure scenario was semi-quantitively categorized based on the occurrence rate and severity. As the station contains two identical dispensing lines, the FMEA on identical components from both lines are duplicated.

Considering the specific failure mechanism of hydrogen systems, the component failure modes identified originated from the taxonomy proposed for HyCReD [31] and were generally coupled with the failure mechanisms identified in Table 4. For the identified failure scenarios (pair between failure mode and its consequence), the failure mechanism that led into that specific scenario was then identified. The likelihood of this mechanism was then estimated based on the expected occurrence in individual facilities or in the general hydrogen fueling station population.

The consequence severity is estimated based on the expected harm to people near the station.

Failure Causal Modeling: The purpose of this step is to establish the specifics of the paths from component failures to failure of the system. This step develops the set of risk scenarios of the system, describing how component failures or other anomalies would lead to undesired conse quences (system failure). Typical techniques for “logic modeling” include fault tree analysis (FT) and event sequence diagrams (ESD) methods. FTs relate system failures to failures of its constituent com ponents based of the functional “logic” of system. A top event in a fault tree, such as “major release of liquid hydrogen”, is branched out to reveal its probable causes by using logical connections of basic events such as “pressure relieve valve fail to open”. The top events of FTs can be used to inform ESD structure and end-states. ESDs analyze the sequence of events (system or sub-system failure, safeguards, or human actions).

They have been successfully applied in the analysis of various industries [5]. Due to this reason, they are selected in this study for logic modeling. Human Reliability Analysis (HRA) can also be a useful tool for a detailed risk assessment of human interface with complex systems such as hydrogen fueling stations; for example assessing risks involved in stan dard maintenance operations or the refueling process. The FMEA results provide essential engineering insights needed to develop the FTs. The “logic modeling” process includes linking the various FTs to the risk scenario ESD(s). Based on the FMEA results, we developed six FTs, modeling LH 2 and GH 2 releases as well as failures to isolate those releases, followed by two ESDs for to show the sequence of LH2 and GH2 release events. An example of the logic models developed for this study is shown in Fig. 2. Given the characteristics of the station selected, releases can occur in the form of compressed LH 2 pressed GH 2 or com , so the QRA is developed for each of these two types of releases and the magnitude of the releases is further categorized into two sizes: minor and major. A minor release (also referred to as “leak” fail ure) will correspond to a release of 1% of the pipe flow area for the typical pipe in the node, while a major release (also referred as “rupture” failure) will correspond to a 100% pipe flow release. This categorization allows us to assess minor releases that could regularly happen during the operational lifetime of the station, and major releases that could lead to catastrophic failures under events such as the complete rupture of components, accidents caused by users, external fires, and natural haz ards. This sets a total of four unintended release scenarios as the top events.

Component Reliability Data Collection: Probabilities of events in the FTs and ESDs (logic model) are estimated in this step. One of the main challenges of QRA of hydrogen systems is the lack of failure data. Estimates may be obtained from existing reliability databases or devel oped based on data from field operations or tests of the components, or subject matter experts.

The basic events in each fault tree used for frequency estimation of the four types of hydrogen releases are quantified using several reli ability databases such as: Offshore and onshore reliability database (OREDA) [32], Oil & Gas Producers (OGP) 434 [33], and HyRAM + [34]. As more hydrogen specific data becomes available from testing and operation, a Bayesian updating algorithm can be used to improve confidence in failure estimations.

The primary method for estimating probabilities in many QRAs of engineering systems is Bayesian inference. Central to this approach is Bayes theorem: where π(x|I) is the uncertainty distribution of quantity x, given infor mation I (field or test data or expert opinion), π0(x) is the uncertainty distribution of x prior to adding information |I, and L(I|x) is the likeli hood of information I [5]. Our method for this study uses mean values for failure probabilities. Incorporating uncertainty propagation is an important step for future analysis especially as some confidence can be established in priors.

Event Frequency Quantification: The data that collected is attached to the corresponding logic model basic events. Using a FT modeling software (Trilith for this study), the top event frequencies are calculated [35]. The sequence of events leading into the possible out comes are modeled through quantification of the FT top events, including separate FT for the failure to detect and isolate the releases. These results are then incorporated into Event Sequence Diagrams that describe the possible scenarios of the aftermath of a hydrogen release. These events are then quantified, and the final release probabilities are estimated.

Component Importance Analysis: To identify and assess the criti cality of components and events that are more influential than others in the system in increasing the likelihood of a harmful scenario occurrence, we utilize importance measures. Risk reduction worth (RRW) and risk achievement worth (RAW) are two popular importance measures used for QRA. RRW measures the change in risk or unavailability when an input variable, for example a system component, is changed to have a zero failure probability. The result will show how system performance may improve when the selected variable performance improves [5]. The expression Fs(Q(t)|Qi(t)=x)represents the system unreliability when the unreliability of event i is set to a value of x. The ratio equation for RRW importance is:

The RRW ratio will show the factor of improvement in system risk or reliability. RAW importance measures the effect of the chosen input variable when it is set to one, thus it is the inverse of RRW. The RAW ratio equation is:

The greater the value of the RAW metric, the greater the significance of the event for the whole system “achieving” the risk, and it is used to prioritize the events which need to be prevented.

Consequence Characterization: The consequence of the end state of the ESD need to be analyzed to measure its severity. Among various consequence from a hydrogen release, Here, modeling software such as HyRAM and phenomenological models are used to estimate the magnitude of the end states including jet fires, pool fires, and explosions. In our study, gaseous releases were modeled with HyRAM. Liquid re leases were described using the methodology presented below.

LH2 explosions: Maximum overpressure present after an explosion is inversely proportional to distance L and linearly proportional to the hydrogen mass flow rate ˙ m, at a constant k (k=150 in Ref. [1]) pro portion [36].

LH2 jet fire: Cryogenic jet ignitions show flame length and radiative heat flux show an increase with mass flow rate and decreasing release temperatures [37]. At a release temperature of 50K, flame length is described by a constant multiplied by the square root of mass flow rate ˙ m, seen in Equation (5)[24].

Cryogenic H2 jet flames produce heat flux; Equation (6) shows a point model describes the heat flux q in (W/cm2) as the proportion of mass flow rate ˙ m in (gr/s) to the radial distance r (cm) to the center line of the jet flame [36].

LH2 Pool Fire: To model a pool fire, the equilibrium radius of the pool can be described by the square root of the proportion of ˙ m to π times steady-state evaporation rate Gevap shown in Equation (7)[38].

LH2 Flash Fire: To find the maximum distance for a flammable cloud with at least 4% hydrogen concentration, and considering a wind speed of 1.75 m/s, Equation (8)describes the maximum distance xd as a power law model [38]

The end state results of H2 releases in our study are detailed in Ref. [1].

Consequence Analysis: After characterization of the physical haz ard, the effect of that specific risk on property and/or population is analyzed. These effects can be communicated through probabilities of harm occurrence and/or expected values of asset loss or human loss [5]. Our QRA study presents two metrics: fatal accident rate (FAR) and average individual risk (AIR) [1]. The FAR metric represents the ex pected number of fatalities per 100 million of exposed hours and it is calculated according to Equation (9). The AIR metric represents the average number of fatalities per exposed individual (Equation (10)).

In these equations, n is one of the potential risk scenarios, j is the type of consequence to people, fn is the frequency of the risk scenario n, cn is the expected number of fatalities for risk scenario n, Npop is the average number of people exposed to the potential hazard, and H is the annual number of hours people are exposed to the hazard.

Fatality Estimation & Harm Models:

From the potential hydrogen releases in the station, two phenomena produce physical harm to people: overpressure and thermal harm. Liquid hydrogen releases, and the subsequent cryogenic plume, could add freezing hazards given the low temperatures of the initial release. However, when considering the dispersion of the cloud, this can be ignored due to the exposure times being insufficient to cause damage to human skin [39]. Models that estimate the probability of a fatality to an individual are used to calculate the harm due to overpressure or thermal burns. For this analysis, a probability of 50% or over is considered a fatality.

atality. The probability of a human fatality from an explosion is estimated using the Eisenberg lung damage model [40], which gives a fatality probability calculated from the peak overpressure. Equation (11)is the probit equation in terms of peak overpressure Ps (in Pa), and the fatality probability is expressed in Equation (12).

Given this, a peak overpressure of 144.5 kPa is the threshold for a human fatality.

Thermal harm caused by fire is calculated using the Tsao & Perry probit model [41], based on the thermal dose unit (TDU) received by an individual. The TDU (Equation (13)) is calculated from the heat flux I expressed in (W/m2), and the exposure time(s) t.

The probit equation based on the TDU for the Tsao & Perry thermal harm model is presented in Equation (14), and the probability of a fa tality is then calculated with Equation (15).

Given this, a of 1.05×107 TDU is the threshold for a human fatality. Total Risk and Risk Communication: Quantified risk measures and ranked risk drivers are summarized in tabular form or through other data visualization form to provide insights and recommendations to designers, operators, owners, and regulators in making decisions such as design modifications to improve safety. Results from our study are communicated in Ref. [1]

3. System description

We created a generic hydrogen fueling station capable of dispensing 1000 kg/day with on-site LH2 storage for high-capacity and high usage rates, such as in support of heavy-duty transportation networks and high demand port or aviation operations. The process flow diagram for the generic station is shown in Fig. 3. To conduct our Failure Modes and Effects Analysis (FMEA) and logic models, the station is defined by four nodes based on the state of hydrogen (liquid or gaseous), operating pressure, and temperature. Our study considers this station to be located outdoors for truck filling operation.

In the first node, low pressure cryogenic LH2 (0.1 MPa [~14.5 psi], ~20 K) is contained in a double-walled 1000 kg LH2 storage tank. In the second node, the low-pressure cryogenic LH2 is pressurized through three cryogenic pumps (two acting as a backup), outputting high- pressure cryogenic LH2 at 90 MPa (~13,000 psi) with temperature remaining at ~20 K. The high-pressure cryogenic LH2 then flows into the two vaporizers resulting in high-pressure, moderate-temperature GH2 (90 MPa (~13,000 psi), ~15 ◦C (288 K)) in the third node. The high-pressure moderate-temperature GH2 is then cooled by an LH2 line to reach the appropriate temperature for dispensing in the fourth node. The dispensed GH2 is high-pressure 90 MPa (~13,000 psi) and low temperature ~ -37 ◦C (236 K). There are a total of 74 components in the system (not including joints) compromising LH2 storage, GH2 storage, pipes, valves, cryogenic pumps, sensors, filters, and dispensers. This also includes safety mechanisms including sensors, venting stacks, and pressure relief valves (PRVs)

4. FMEA results

In the station design under consideration, a total of 449 failure causes were identified, out of which 269 involved a release of hydrogen (either as GH2 or LH2) from a component in the system. As summarized in Table 5, the most prevalent failure mode is the external leak or rupture of any of the hydrogen-containing components, followed then by a failure to open (which involves the PRV and check valves) and then structural damage to a component.

These results point towards the importance of designing and manufacturing each station component to a standard necessary to avoid the release of hydrogen. As shown in Fig. 4, components in the dispensing area of the station such as the nozzle, solenoid valve, and pressure regulator deserve careful consideration as their failures contribute to a high percentage of high-risk release scenarios.

The FMEA produced a total of 210 high risk scenarios. Following is an example of a high risk scenario for each of the top five high risk scenario susceptible components:

1. Dispensing nozzle NZ-401 fails to close, causing a failure to stop outflow of GH 2 , resulting in a major release of GH 2 to the external environment with possibility of ignition.

2. Shut-off valve SV-401 is bent/warped/damaged, causing a dislodg ing of the component leading to a major release of GH 2 to the external environment with possibility of ignition.

3. Pressure regulator PR-401 leak/rupture causes a major release of GH 2 in external enclosure with possible ignition.

4. Pressure relief valve PRV-201 fails to open causing an overpressure in the vaporizer pipeline, leading to rupture of pipeline components and a major LH 2 release.

5. Vaporizer HX-201 is bent/warped/damaged and its dislodging leads to a full release of LH 2 /GH 2 mixture with a possible ignition.

The results from the FMEA were used as a starting point for modeling the root causes leading to liquid and gaseous hydrogen releases and the consequences of those releases, presented in FT and ESD found in Ref. [1]. Additional results from the FMEA detailing high risk scenarios will be published in future articles.

5. Data collection

5.1. Component release frequencies

Hydrogen release frequencies for the leak and rupture of the com ponents of the station were primarily extracted from HyRAM, which provides generic frequencies of releases of various sizes from vessels, valves, pipes, hoses, and joints working with either LH2 and GH2 and for filters and instruments working with GH2 only.There is some avail component reliability, however Operational data on GH2 stations still shows the cause of the majority of leaks coming from the dispenser are “undetermined” Release frequency data for three critical components were not found in the available literature; the cryogenic LH pump, the high-pressure LH 2 vaporizer, and the mixing valve. Their release events were estimated from the IOGP Report 434 [33] for equipment in the oil and gas industry, considering them as pump and an air-cooled heat exchanger, respectively.

The frequencies of controlled releases, such as H PRVs and H 2 2 boil-off venting from LH 2 2 venting from the storage tanks, the frequencies are estimated as 100 times per year and 1825 times per year, respectively. GH venting from PRV is assumed to happen twice a week due to aborted refueling processes, while LH2 boil-off is estimated to  happen five times a day due to the unavoidable boiling of LH2 during storage. Release event probabilities were then calculated from the release frequencies as the probability of zero (0) failures occurring within a year. Assuming that the release rate is constant, the probability is calculated from Pr (t) = 1 e λt where λ is the frequency of events per year and t = 1 year. Table 7 (shown in Appendix) summarizes the probabilities for all basic events and their corresponding sources [29,32,33,42–44].

5.2. Hydrogen ignition and evaporation probabilities

In a previous QRA done by Groth et al. at Sandia [9], the ignition probabilities for gaseous hydrogen were reported based on the mass flow rate of the release; these are presented in Table 6.

For an LH2release case, the probabilities of immediate evaporation, pool ignition and vapor cloud ignition are also needed, but to the best of authors knowledge, no models have been developed for these proba bilities. Therefore, for the immediate evaporation, we assume a 90% probability of evaporation, and based on the expert elicitation value given by Pirbalouti et al., a 1% probability of occurrence is assumed for the pool and vapor cloud ignition [17]. After an immediate evaporation, the same probabilities of Table 6 are used.

Data curation and quality

The QRA results (presented in Ref. [1]) highly rely on the quality of the data used to quantify the events. There are challenges associated with the data related to the QRA of hydrogen fueling station:

The venting stacks for the GH controlled releases and the LH 2 2 boil- off losses were challenging to quantify. These two events are of common occurrence in an operational station, and moreover, can become a safety barrier with critical importance during an emer gency (controlled) release procedure.

• Two failure modes present in the vent stacks - leak and internal plugging - were of particular challenge to quantify. In our study, leak was estimated as the leak probability of a piping segment, and plugging was estimated with a fraction of that value. These events were estimated to occur infrequently, however it is important to

consider that as these stacks are open and exposed to the external environment, the rates could be higher than used in this work. The issue of plugging has long been recognized by the industry, and standards for designs that avoid the ingress of foreign material have already been developed.

Release and failure data for the components working with LH 2 is currently lacking. HyRAM + v5.1 does provide release data for valves, joints and the storage tank [34], but for the first two it is assumed that the frequency is the same as for components working with GH 2 , and for the latter the uncertainty around the estimate is large as the error bars span several orders of magnitude.

• Release data is lacking for three critical LH 2 components: the cryo genic pump, the high-pressure hydrogen vaporizer, and the mixing valve for temperature control. The first were assumed to possess the same release frequency as reciprocal pumps and air-cooled heat ex changers used in the oil and gas industry, and for the mixing valve the same release rate as GH 2 solenoid valves was assumed. For the remaining components working with LH 2 , the release and failure frequencies were assumed to be equal to similar components work ing in the oil and gas field

Generally, for gaseous hydrogen systems, HyRAM is an accepted and widely source to calculate the probabilities of releases for generic equipment. Nevertheless, there is a lack of data on release rates and failure rates (particularly decomposed by failure modes) for key com ponents working in a LH 2 environment; these include the high-pressure air-cooled vaporizer, filters, solenoid valves, and non-return valves. Failures of these components have been identified by the FMEA and FTA as causes for potential ignition and other safety-related consequences. For stations using compressed LH2 to control GH2 dispensing temperature, the mixing valve and the surrounding components are subjected to extreme pressure and temperature cycling while dispensing. Therefore, the fatigue of these components is likely to be an important failure mechanism.

Another critical piece of information missing was the evaporation and ignition probabilities of LH 2 releases. Several studies have addressed the consequences of an ignition, but no work has quantified these probabilities. A sensitivity analysis could be carried out to assess the influence of this over the scenario’s probabilities. Further discussion on gaps can be found in [1]

Concluding Remarks

This paper presented a methodology for conducting a comprehensive, front to end QRA for a high-capacity LH2 storage fueling station. Each step in the proposed QRA framework included details on how they were applied in our study on analyzing uncontrolled H2 releases from an LH2 storage hydrogen; they can act as a reference and guide for subsequent QRAs that will analyze similar systems as data becomes available and technology advances. The QRA steps outlined are as follows: defining the scope of the analysis, describing and documenting the system being analyzed, a qualitative analysis identifying hazard scenarios, collecting and curating data needed for quantitative analysis, creating causal models for the hazard scenarios, conducting frequency and consequence analysis, and communicating those risks. The basis for the application of the methodology was also presented: results of an FMEA and the following data curation for the identified failure modes to set up the logic modeling quantification for the defined station design. From the FMEA, we found 210 high-risk scenarios and identified the dispensing nozzle, dispensing shut-off valve, pressure relief valve, and the vaporizer as susceptible to high-risk scenarios. We also showed the current best-available data to be used for QRA of liquid-storage hydrogen fueling stations and discussed areas of improvement for data quality.

The proposed methodology, and the results presented in this paper and its companion paper detailing the full QRA serve as the foundation for critical work to be conducted in future years. Areas for expansion include uncertainty propagation, a rigorous HRA analysis of operator and customer interaction with H2 fueling stations, as well as techno- economic analysis to estimate and mitigate potential losses from risk events. This work can improve the state of the art in the QRA necessary to support the wider deployment of these systems. This paper also provides early insights into system failure scenarios and their conse quences, risk-significant components and their failure modes. These results enable developing strategies that minimize the number of fail ures and their impact at the design and installation stage. A detailed demonstration of a QRA on the system described and based on the framework and hazard identification outlined in this paper is discussed thoroughly in our companion paper Schaad et al. [1].

Acknowledgement

This research was supported in part by the Electric Power Research Institute. The views expressed herein are those of the authors and do not reflect the official policy or position of any sponsor. The authors thank Annette Rohr, Alex Gupta and Eladio Knipping for support and discus sion throughout the project.

Appendix A. Supplementary data

Supplementary data to this article can be found online at https://doi. org/10.1016/j.ijhydene.2025.02.169