Introduction

The global temperature has been steadily rising due to greenhouse gas emissions, and relative to the pre-industrial period, the global temperature has already increased by 1 °C. Due to global warming, critical climate changes, such as melting polar glaciers, rising sea levels, and frequent forest fires, are taking place. If the global temperature increase is not controlled and exceeds 1.5 °C, handling temperature rises after that will become more difficult [1]. To reduce the greenhouse effect, the world has been taking action to replace fossil fuels with renewable energy sources [2, 3]. However, since renewable energy is affected by climatic and geographical features, the problems of intermittency [4] and regional production differences have arisen [5].

Hydrogen is a promising clean energy candidate for solving the disadvantages of renewable energy. Through water electrolysis, steam reforming reaction, ammonia cracking, among others, and using renewable energy sources (e.g., solar, hydro and wind), reactants and raw materials can be converted to hydrogen which can then be stably stored. Moreover, the produced hydrogen can be converted back into energy and used whenever required. If the demand for hydrogen increases, new methods should be considered for large-scale hydrogen transportation. Regarding the amount of a large hydrogen carrier, the on-site generation of chemicals and hydrogen distribution in the form of liquid hydrogen, ammonia and liquid organic hydrogen carriers (LOHCs) have been extensively researched [6]. Liquid hydrogen does not need a separation process since only hydrogen gas is used for generating. However, major limitations are a high energy requirement to refrigerate gaseous hydrogen below − 253 °C and the occurrence of boil off gas [7]. Since ammonia contains no carbon molecules, it can provide zero-carbon hydrogen generation via the ammonia cracking reaction. Furthermore, ammonia can be stored in the liquid phase under atmospheric pressure and the temperature required for liquefaction (− 33 °C) is much higher than that required for liquid hydrogen. However, ammonia liquid has disadvantages such as high toxicity when it is vaporized [8]. LOHCs such as benzene-cyclohexane or toluene-methylcyclohexane (MCH) with their development from the research stage to the commercialization stage already in progress can feasibly be used to store hydrogen for transportation. In addition, the chemical separated through dehydrogenation can be recycled for hydrogenation or other uses [9]. Among the LOHCs, toluene-MCH has advantages such as high availability and straightforward handling [10]. Besides, it has offered an economical and environmentally effective storage method for the large-scale intercontinental seaborne hydrogen supply chain since 2020 [11].

Hydrogen plays a vital role as a fuel for transportation. From a global breakdown of greenhouse gas emissions by sector, the contribution of the transportation sector (16.2%), while lower than that for industry (24.2%) and higher than that for buildings (17.5%), is still significant [12]. Therefore, fuel-cell electronic vehicles (FCEVs) are increasingly being supplied to the market to reduce carbon emissions from transport. The global share of FCEVs is expected to be more than 25% by 2050 [3], so the infrastructure capable of charging hydrogen must be increased accordingly.

At the end of 2021, around 685 hydrogen refueling stations (HRSs) were being operated globally [13]. Currently, the most used type of HRS contains compressed gaseous hydrogen. However, this method is inefficient because of the high specific volume of hydrogen (11.9 m3/kg) under ambient conditions [11]. To cope with this, physical and chemical storage technologies have been applied to hydrogen storage and transportation. Physically, hydrogen can be liquefied by cooling it to  − 253 °C under atmospheric pressure, or it can be compressed to up to 900 bar for storage as a compressed gas. Since hydrogen can be generated from other chemical compounds, it can be stored in the form of ammonia by reacting it with nitrogen or in the form of liquid organic material by reacting it with organic compounds. Among the hydrogen storage methods, liquefied hydrogen, ammonia, and LOHCs can be stored as liquids with low volumetric density and used in hydrogen transportation systems. Especially, ammonia and LOHCs are strongly recommended from an economic and environmental perspective because both have large hydrogen storage capacities and can be transported using existing industrial infrastructure [11, 14].

Following this trend, the input material for an HRS is determined depending on what type of storage method is applied in the transportation sector. In Germany, hydrogenous benzyl-toluene is used in an LOHC-based HRS system at a capacity of 1.5 t/d [15]. On the other hand, ammonia-based HRSs have not yet been commercialized, and research on the process design is being actively conducted. Lin et al. [16] provided a techno-economic analysis of an ammonia-based on-site HRS (AHRS) system. They concluded that their system has lower hydrogen production costs by around 15% compared to a methane steam reforming system with carbon capture and storage.

As such, most of the studies on the new types of HRSs are in the demonstration or planning stage, and research is being focused on the technical and economic points of view. However, a high risk is associated with HRS, particularly if it is located in a highly populated urban area [17]. Dehydrogenation of MCH occurs at high temperatures and requires more safety precautions. Furthermore, toluene and MCH are both dangerous because of their flammability and toxicity. Therefore, a risk assessment of HRSs should be undertaken to ensure the safety of citizens.

In a previous HRS risk assessment study, Gye et al. [17] designed and analyzed the quantitative risk of an urban gaseous HRS(GHRS) concerning population and mitigation. Their quantitative risk assessment (QRA) provided unacceptable results and significant consequences for various scenarios. When a safety barrier system was applied for risk mitigation, the individual risk (IR) was consequentially decreased 10 times and the societal risk (SR) became acceptable. Li et al. [18] conducted a QRA and revealed that leaks from compressors and dispensers are the main risk contributors. To prevent probable danger, an additional safety barrier was added to the compressors and dispensers, which reduced the risk at the HRS to an acceptable level. Tsunemi et al. [19] used event tree analysis (ETA) to reveal potential risks when considering the failure probability of the safety barrier system. Furthermore, they assessed the risk reduction due to the barrier placement and the separation distance to achieve the required risk level under the existing law. Suzuki et al. [20] defined an HRS model for Japanese HRSs and identified the most significant scenarios posing the greatest risk to the physical surroundings. To reduce the risk of unacceptable QRA results, the risk mitigation measures such as by shortening the release time of the jet to prevent continuous jet fires and using fire protection walls were considered.

Yoo et al. [21] designed a liquid HRS and conducted a QRA of the worst possible accidents, such as the catastrophic rupture of a tube trailer or a liquefied hydrogen tank. Furthermore, they compared the risk with a conventional GHRS. According to their results, both HRSs require risk reduction measures. To make the risk acceptable, three safety barrier devices were installed: detachable coupling, a hydrogen detection sensor, and automatic and manual emergency shutdown (ESD) systems.

Bae et al. [22] designed an AHRS process through simulation and obtained design data for conducting a QRA. Since the release of ammonia from the storage tank would cause significant damage to the surrounding community using a dike as a mitigation measure was provided to limit the spread of ammonia gas to prevent the formation of a pool and to reduce the maximum dispersion distance.

Nakayama et al. [23] identified critical scenarios of MCH-based HRS (MHRS) combined with conventional gasoline refueling stations and conducted a QRA. Furthermore, they analyzed the thermal characteristics of the hydrogen tank. A pool fire of MCH and toluene damage the compressed hydrogen tank and made it rupture [24, 25]. Therefore, safety walls and ESD systems were considered [26]. Tsunemi et al. [27] estimated the risks of an MHRS due to explosion, heat radiation, and toxicity and found that the mortality risk due to heat radiation and high-pressure leakage from the pipe connected to the cylinders and compressors was critical.

In many prior quantitative risk assessment (QRA) studies centered on MCH (methylcyclohexane), the focus has predominantly been on individual risk, specifically the probability of death for individuals, without addressing societal risk factors such as population density. This study introduces a distinctive approach by conducting a comprehensive QRA for two types of hydrogen refueling stations (HRSs): MCH-based HRS (MHRS) and gas-based HRS (GHRS). Employing a commercial simulator, both HRS types were intricately modeled. The analysis of individual risk (IR) and societal risk (SR) involved utilizing extracted equipment data and heat and mass balance (HMB) information from the simulator. The novelty of this study lies in its exploration of both individual and societal risk aspects, providing a more holistic understanding of the safety implications associated with MHRS and GHRS. Furthermore, the risk ranking of HRSs was performed by considering the most influential piece of equipment and a single safeguard, showcasing the originality and novelty of the methodology employed in this research.

The Process Design

Figure 1 shows a schematic of an on-site MHRS. It consists of two main processes: dehydrogenation and refueling. The dehydrogenation process extracts hydrogen from MCH via a catalytic dehydrogenation reaction and purifies the product of the reactor to achieve pure hydrogen. Subsequently, the obtained pure hydrogen is pressurized for refueling FCEVs. The MHRS system was designed using Aspen HYSYS (V.12) under the following assumptions:

  • The refueling station produces 600 kg of hydrogen per day.

  • The operating cycle of the MCH and toluene tanks takes three days.

  • The MCH and toluene tanks have sufficient storage capacity to produce up to 1800 kg of hydrogen [28].

  • The pressure swing adsorption (PSA) unit provides hydrogen with up to 99.99% purity and 86% recovery [29].

  • The buffer tank consists of three tanks that can each hold 50 kg of hydrogen.

Fig. 1
figure 1

A schematic of the on-site MHRS

Full size image

The process flow diagram (PFD) of the MHRS process is shown in Fig. 2.

Fig. 2
figure 2

The process configuration and operating conditions for the MHRS

Full size image

Ni and Pt-based catalysts supported by Al2O3 are mainly used in MCH dehydrogenation[30,31,32,33,34]. Since Pt catalyst activates C-H bond formation without C–C bond cleavage several of them have been considered [35,36,37]. The Okada and Chiyoda corporation provided research results of using Pt-based catalyst that provide toluene conversion and selectivity of above 95% and 99%, respectively [36, 38]. In the present study, the same catalyst and the same conversion rate were applied to the dehydrogenation process. The stored MCH at room temperature and under atmospheric pressure is heated up by using heat exchangers HX-1 and HX-2 to reach temperature of 320 °C, and then, toluene and hydrogen are produced in the reactor via an endothermic reaction. The products are used as the hot media for HX-1 and are then cooled down to 25 °C through HX-3. The separation process of gaseous hydrogen and liquid toluene is carried out through a separator, and then, compression and cooling in three stages are performed until the PSA operating pressure is reached. PSA is then used to obtain high-purity hydrogen. The operating pressure was set at 20.97 bar, and the production was defined with a purity of 99.99% and 86% recovery [29]. The refueling process is the same as an off-site GHRS and can pressurize hydrogen up to 900 bar [17, 21]. The pressurized hydrogen is stored in three buffer tanks. The hydrogen pressure is reduced to 700 bar through a valve and cooled down to − 41 °C through an indirect cooling process before being used to fill FCEV [39, 40]. Validation of the process was conducted by comparing the energy efficiency of the dehydrogenation process with reference [41] (66.45%); the energy efficiency of the process in the present study was 70.75%. The energy efficiency was calculated as follows:

$$\eta =\frac{{E}_{{\text{HHV}},{{\text{H}}}_{2}}}{{E}_{{\text{HHV}},{\text{MCH}}}+E }\times 100(\%)$$
(1)
$$E=\sum_{n=1}^{3}{W}_{C-n}+{W}_{{\text{PSA}}}+{Q}_{{\text{HX}}-2}+{Q}_{R-1}$$
(2)
$${E}_{{\text{HHV}}}=m\times {\text{HHV}}$$
(3)

where \(\eta\) is the energy efficiency (%), E is the energy rate(kJ/hr), W is the power consumed by each unit (kJ), Q is the heat consumed by each unit (kJ/hr), m is the molar flow rate (kmole/hr), and HHV is the higher heating value (kJ/kmole).

Methodology

The QRA Procedure

QRA evaluates the risk associated with equipment by combining the consequences of an accident occurring with tis frequency of occurrence [17, 18, 21, 22, 42, 43]. Figure 3 depicts the QRA procedure. First, the targeted system was be defined and designed. Hazard identification was performed based on the HMB of the designed process [44]. Subsequently, possible accident scenarios based on the hazardous materials and equipment were defined, after which consequence and frequency analyses were performed. The consequence analysis using PHAST (V8.23) was conducted to estimate the extent of the accident scenarios and lethality due to heat radiation, toxicity, and overpressure. At the same time, the frequency analysis of the accident scenarios was conducted based on the wind roses, event trees, and initial frequencies of leak accidents. In the last step, the IR and SR were obtained by combining the consequence and frequency analysis results. Unreasonable risk levels require the consideration of risk reduction methods.

Fig. 3
figure 3

The QRA procedure

Full size image

Details of HRS

The HRS definition used in this QRA is based on one located in Yangjae-dong, Seoul, Korea [17]. As shown on the left side of Fig. 4, there are three different environments outside of the HRS: a residential area, a parking lot, and highway. The residential area with a high population density (515.2 people/km2), parking lot, and highway are located south, west, and east of the HRS, respectively. The operating room and dispenser are located inside the HRS, while a bus stop is located close to it. It is assumed that the HRS operates 24 h a day, supplies 600 kg of hydrogen per day, and can simultaneously refuel five FCEVs, capacity of 5 kg.

Fig. 4
figure 4

The geographical characteristics of the HRS

Full size image

To reflect the local weather characteristics, a wind rose, which describes the wind speed and probability of wind blowing from each direction, was considered and substituted it into the probability function of the IR and SR.

Hazard Identification

Hazard identification involves equipment and materials that can adversely affect people or processes in the event of an accident [45]. A GHRS comprises high-pressure storage equipment and tube trailers located within the refueling station. On the other hand, an MHRS does not have tube trailers but includes a dehydrogenation reactor operating at a high temperature instead. High-pressure storage equipment, such as compressors and dispensers, is dangerous because of the high risk of leakage.

The materials used in the study were evaluated based on whether they pose a danger by using risk diamonds. Table 1 reports the NFPA 704 codes, emergency response planning guide (ERPG) levels and flash points of MCH, toluene, and hydrogen. Each risk code consists of four categories: flammability, health hazard (i.e., toxicity), instability, and special (i.e., reactivity with water, oxidizing agents, etc.). The high the number in each category (excluding special), the worse the hazard. For instance, the flammability level of hydrogen is class 4, which means it is very hazardous because it can catch fire easily. MCH is more hazardous because it must be heated to a high temperature for the dehydrogenation reaction. Toluene has the same flammability as MCH but a higher health hazard level than it.

Table 1 The NFPA 704 codes and flash points of MCH, toluene and hydrogen
Full size table

Scenario Definition

After determining the hazardous materials and equipment in the hazard identification stage, the probable accident scenarios were established accordingly. An MHRS does not contain a tube trailer (a major risk in GHRS [17, 21]) but does have a chemical storage tank, heat exchanger, and reactor. Accordingly, scenarios for the dehydrogenation process for hydrogen production and the refueling process for the generated hydrogen were established. Details of the equipment inventory, temperature, pressure, and accident scenarios are presented in Table 2. The scenarios for each piece of equipment are divided into leak and rupture. A leak means that the material in the storage tank or equipment comes out continuously through a hole, which can be small or large leaks; the leak scenario and hole diameter were determined according to the Purple Book for the dehydrogenation process and PSA [43]. The hole diameter for a small leak was set as 10 mm, while that of a large leak was determined as the hole diameter through which the substances in the equipment could be completely expelled within 10 min. In the case of a rupture, all of the substance is immediately released, and in contrast to a leak, there is no need to designate a hole size. The heat exchanger, reactor, and PSA were assumed to have a leak and a rupture in one of the pipes. According to the Purple Book, the scenarios were divided into a small leak of 10% of the nominal diameter and rupture [43]. Scenarios and leak size in the refueling process (excluding PSA) were established by referring to previous hydrogen refueling station studies [17, 18, 21, 22, 42], an Sandia National Laboratory (SNL) report [46], and HyRAM data.

Table 2 Release scenarios for MHRS
Full size table

Consequence Analysis

The procedure for the consequence analysis is shown in Fig. 5. After defining the scenarios, the impact of various events (fire, explosion, and toxicity) on substance release was analyzed, and a fatality calculation was performed. The effects are different depending on the event. The effects were analyzed in the form of heat radiation for fire, overpressure for an explosion, and concentration for toxicity. Several events may occur for a material that is both toxic and flammable. Heat radiation, overpressure, and toxic concentrations have different effects on people and the environment, and the results were analyzed accordingly. Translating human effects into fatalities is also necessary for QRA. In this case, probit function equations (Eqs. (5 – 9) were used.

Fig. 5
figure 5

The consequence analysis procedure

Full size image

As shown in Fig. 5, heat radiation, overpressure, and toxic concentration according to distance were derived through the consequences effect model and these values were substituted into the probit function. Subsequently, the risk of fatality was derived by substituting the value calculated through the probit function into the probability of death function [43].

$$P = 0.5 \times \left[ {1 + {\text{erf}}\left( {\frac{{Pr - 5}}{{\sqrt 2 }}} \right)} \right]$$
(4)

where P is the probability of death, and Pr is the probit function [43].

The probit function equations for each effect consequence model are derived as follows:

  • Fire

$$Pr=-36.38+2.56\times {\text{ln}}({Q}^\frac{4}{3}\times t)$$
(5)

where Pr is the probit corresponding to the probability of death (-), Q is the heat radiation (W/m2), and t is the exposure time (s).

According to the TNO Green Book [47], the probit equations for the different types of fire (jet fire, pool fire, and fireball) are the same as Eq. (5).

  • Explosion

The probit equation shelters because of structural damage:

$$Pr=-23.8+2.92\times {\text{ln}}({P}_{o})$$
(6)

The probit equation for estimating deaths from lung hemorrhaging:

$$Pr=-77.1+6.91\times {\text{ln}}({P}_{o})$$
(7)

where Po is the overpressure (Pa).

The probit equation for an explosion is expressed as overpressure [48].

  • Toxic Exposure

$$Pr=a+b\times {\text{ln}}({D}_{{\text{Toxic}}})$$
(8)
$${D}_{{\text{Toxic}}}={C}^{n}\times t$$
(9)

where DToxic is the toxic dose (–); Cn is the concentration (mg/m3); t is the exposure time (s); and a, b, and n are constants for describing the toxicity (–).

The probit expression for a toxic substance is expressed as a function of the toxic dose [43].

Frequency Analysis

Frequency analysis identifies the frequencies associated with each incident. The first parameter is the initial frequency at which a leak or rupture occurs. This is usually used as data accumulated in related traditional industrial sites, and the unit is per year. The initial frequencies for each scenario referenced from a database of the existing literature are reported in Table 3. For the dehydrogenation process, the Purple Book and the refueling process were referenced from SNL [46]. The leak size and initial frequency of the dispenser were referenced from HyRAM.

Table 3 The initial frequency data for MHRS
Full size table

The second factor is the wind direction. The wind rose discussed in Sect. "The QRA Procedure" is used to define the probability of the wind blowing in each direction.

Figures 6 and 7 show the event trees for flammable liquid and hydrogen. The event trees were used to identify all possible outcomes when a leak or rupture occurs. They are divided into immediate ignition and delayed ignition with yes/no for each section to indicate the final accident type. In the case of toxic substances leakage, the probability is taken as 1 and multiplied by the other frequency values.

Fig. 6
figure 6

The event tree for a flammable liquid leakage/rupture accident

Full size image
Fig. 7
figure 7

The event tree for an H2 leakage/rupture accident

Full size image

The frequency analysis multiplies all probabilities from the 1st to the 3rd and is expressed as the frequency of deaths for both IR and SR.

Results and Discussion

The Consequences of a Release Accident

Table 4 shows the results of the consequence effect model analysis of the HRS and summarizes the main results for each scenario. Since the results of the refueling process are well known from previous studies, the focus is on the consequences of the dehydrogenation process. MCH and toluene are flammable liquids. Hence, a pool is created, and radiant heat from a pool fire is derived as the consequence effect model. The distance according to the radiant heat level for each accident scenario is summarized in Table 4, and the effect on people and surroundings is summarized in Table 5 [49]. Since toluene is also toxic, the results were evaluated according to the ERPG criteria. A jet fire can occur due to a small leak in the heat exchanger and reactor, but because of their small size, the distance at which radiant heat of 4, 12.5, or 37.5 kW/m2 appears was not derived. Still, in the case of a rupture, these radiant heat magnitudes at various distances due to the resulting fireball appear almost instantaneously. The worst-case scenario is a pool fire due to a large MCH leak. The MHRS stores flammable materials in large quantities. The NFPA 704 code for the flammability level of MCH is classified as class 3 [50, 51], which means that it can burn in a general atmospheric environment. As such, this shows that the leakage scenario of flammable substances can lead to the worst-case scenario. When liquid MCH in the storage tank leaks, it forms a pool that can ignite when the ignition conditions (i.e., fuel, air, and ignition source) are met [52]. In the case of a pool fire, a lot of oxygen is required for combustion, and thus, it is characterized as incomplete combustion accompanied by a lot of smoke. As the size of the pool increases, the range of the fire is enhanced, thus increasing the risk to surrounding equipment and people. If all of the material in the MCH tank leaks out, the pool's diameter will be 99.68 m. At this size, the material can spread throughout the charging station. In Sect. "Scenario Definition," it was mentioned that fire is derived in the form of radiant heat through a consequence effect model. Table 5 reports the damage types according to the heat radiation level. Figure 8 shows the danger radius according to the radiant heat level derived from the fire effect model in the worst-case scenario (a pool fire after an MCH tank rupture). In Table 5, exposure to thermal radiation of 4 kW/m2 for 20 s results in first-degree burns, and the maximum distance at which individuals can be affected is 385.7 m in the worst-case scenario. This distance encompasses the surrounding residential and parking areas, as well as the road. In the case of 12.5 kW/m2, which is the minimum radiation that can melts plastic under normal conditions, the mortality rate is 1% per one-minute exposure for humans. In the worst-case scenario, this distance is 240.7 m. Thermal radiation of 37.5 kW/m2 can damage all of the equipment within a distance of 154.2 m. Hence, this could affect the equipment in the refueling station and cause secondary damage. In addition, people inside the charging station and passers-by could die if exposed for 1 min or more.

Table 4 Consequence analysis results for MHRS [m]
Full size table
Table 5 The damage/failure criteria for various thermal radiation intensities [49]
Full size table
Fig. 8
figure 8

Consequence analysis results for the worst-case scenario showing the heat radiation radius

Full size image

Risk Assessment

Quantitative risk is evaluated by combining the consequence and frequency analysis results. Consequence represents the degree of damage caused by an accident as a function of the lethality and the number of deaths, as described in Sect. "Scenario Definition," while the frequency takes into account all probabilistic data associated with the accident. SAFETI V8.23 was used for the QRA of HRSs. The risk assessment results were derived from the IR and SR levels. The SRs for GHRS and MHRS were compared and analyzed.

Risk acceptance criteria for the results are required for QRA. The acceptance criteria were taken from the European Integrated Hydrogen Project 2 (EIHP-2), the values of which are reported in Table 6 [53]. The IR results are displayed as a contour by connecting places with the same lethality. The risk acceptance criteria for each party are different with the first party (a refueling station operator) having the highest acceptance criteria. The SR is derived from an Fatality-Numbers (F-N) curves, with the number of deaths on the horizontal axis and the frequency on the vertical axis [43]. In addition, the acceptable risk range corresponds to the as low as reasonably practicable (ALARP), deviation from which requires additional risk mitigation measures.

Table 6 The risk acceptance criteria
Full size table

Individual Risk

Individual risk shows the risk of multiple equipment accidents on one person in a specific location. [54] The annual number of fatalities at a specific location is calculated, and points with the same value are connected and expressed as a contour, as shown in Fig. 9: The 1×10–5 contour (purple) is around the refueling station and the 1×10–6 (red) contour is around the surrounding roads and residential areas. Within the red contour, there is a probability of 1×10–6 or more, which is consistent with the third party’s risk acceptance criteria. Table 7 reports the IR ranking at the operator position and indicates which equipment hazards have the greatest impact. The accident scenario involving the MCH storage tank is number one, accounting for around 68% of the total individual risk ranking. Accidents in the stored MCH area in large quantities account for a greater overall risk than accidents those caused by hydrogen leakage, with those involving the compressor and dispenser are coming next and 7%, respectively.

Fig. 9
figure 9

The IR results

Full size image
Table 7 IR ranking for the accident scenarios
Full size table

Societal Risk

SR is an assessment of risk affecting a group of people. In Fig. 10, the area between the red and yellow lines is called the ALARP region in which the risks are considered acceptable, but beyond that, additional risk mitigation measures are required.

Fig. 10
figure 10

Comparison of the SR results for the MHRS and GHRSs

Full size image

In Table 8 and Fig. 10, the SR of MHRS is compared with a GHRS. The process design was carried out while assuming that all of the refueling stations have the same capacity (600 kg/day). Figure 10 shows the F–N curves of the MHRS and GHRSs, which are outside the ALARP region. Risk is expressed as a product of consequence and frequency, and SR integral values were compared to determine out which refueling station is the most dangerous. When comparing the total risk reported in Table 8, these values are GHRS 2032.83 and 665.96 \(\times\) 10–6/yr for the GHRS and MHRSs, respectively. The commonality in the QRA of the two HRS is that both of them are outside the ALARP region, and the highest risk part is the storage tank. Tube trailers and MCH account for more than 90% and around 85% of the total risk, respectively. However, the type of accident is different for the storage material at each refueling station: High-pressure hydrogen is stored in the GHRS which poses an explosion risk, while a flammable liquid is stored in the MHRS which poses a fire risk. Nevertheless, the comparison between the existing commercialized GHRS and the unconventional MHRS indicated that the former has a higher risk than the letter because the danger of gaseous hydrogen stored at high pressure is significantly greater. As shown in Fig. 10, the GHRS (depicted in orange) shows a reached number of fatalities, registering below 50 on the x-axis, while the MHRS (illustrated in mint green) approaches approximately 100. Furthermore, for the GHRS, the frequency of N fatalities surpasses that of the MHRS, positioning it at an elevated point on the y-axis. Thus, accident mitigation must be conducted on the GHRS to reduce the frequency of hydrogen leakage, such as installing a safety barrier [17]. In terms of risk ranking, the fire risk for MCH is higher than toxicity or explosion due to its chemical characteristics. The accident type is pool fire because MCH is a liquid phase at 1 bar and 25 °C in the MHRS. The effects of a pool fire are defined in terms of combustion heat, molecular weight, pool diameter, etc. Moreover, the pool diameter can increase rapidly due to the spreading of the leaked flammable liquid. Since the pool diameter is the governing parameter of the pool fire effect, a mitigation plan should involve minimizing it.

Table 8 SR ranking of MHRS(a) and GHRS(b)s
Full size table

Risk Mitigation

Reduction of the MCH Tank Capacity

According to SR results, the most dangerous scenarios in the MHRS are a large leak from rupturing the MCH storage tank. Risk mitigation should be carried out to decrease the effect of the MCH storage tank because the associated risk account for around 85%. Thus, for risk mitigation, three scenarios involving reducing the capacity of the MCH storage to 50%, 33%, or 25% of the original capacity were investigated. Table 9 reports the consequences of this on the pool fire diameter and heat radiations due to a large leak from each of the MCH tanks. The trend in the fire effect shows that the correlation between the storage capacity and pool diameter is not direct despite the reduction in the amount of stored chemical. Since the chemical is liquid under the storage pressure and temperature, the material will be spread over the surrounding land area in the leakage case. The SR results for several cases are shown in Fig. 11, revealing that an effective method to reduce the risks of operating the MHRS is necessary.

Table 9 The pool fire diameter and heat radiation with various-sized MCH storage tanks
Full size table
Fig. 11
figure 11

SR results according to the MCH storage tank size

Full size image

Dike Installation

To reduce the pool diameter (the main disaster risk in an MHRS), the installation of a dike at the MCH storage tanks is proposed herein. It is essential to reduce the diameter of the pool to decrease the range of the heat radiation caused by the fire. The sizing of the dike was optimized by using Korea’s legally permitted installation standard as an objective function in such a way that the maximum dike height can minimize the pool size. The dike height and the distance between the MCH tanks and the dike are shown in Fig. 12. The distance between the tanks and the dike must be greater than one-third of the tank height [55], with the dike being 110% of the tank capacity. The volume of the tank equals the capacity of MCH with a replacement cycle of three days. This set-up was optimized using MATLAB, the results of which are reported in Table 10. The optimized maximum dike height was 1.50 m for a tank height of 3.06 m. Table 11 reports the pool diameter and heat radiation before and after dike installation; after dike installation, the effective distance of a heat intensity of 37.5 kW/m2 was reduced from 154.2 to 12.80 m and the fire damage was decreased by around 93% compared to before installation. Thus, the effects on personnel injury (1% dead within 10 s) and all dead within 1 min measures are restricted to within the MHRS. Figure 13 shows the heat radiation from the pool fire after dike installation in the worst-case scenario, a large leak of MCH. The MCH does not spread outside of the dike because it is highly flammable and does not evaporate quickly. Table 12 reports the risk and risk ranking after installing dike; the primary risk is changed from a large leak from the MCH storage tanks to one from the dispenser. Building a dike near the MCH tank resulted in a  reduction of the SR by over 85%. Consequently, the number of fatalities is reduced and the risk is restricted to within the ALARP region, as shown in Fig. 14.

Fig. 12
figure 12

A schematic diagram of the dike

Full size image
Table 10 The optimal dike design specifications
Full size table
Table 11 The risk mitigation effect of dike installation
Full size table
Fig. 13
figure 13

The consequence analysis results of the worst-case scenario showing heat radiation

Full size image
Table 12 SR results after dike installation
Full size table
Fig. 14
figure 14

The F-N curves for the MHRS with and without the dike

Full size image

Conclusions

In this study, the risk of using an HRS based on the toluene-MCH process was assessed because of its environmental and economic advantages over GHRS for large-scale hydrogen transportation. The MHRS was designed to produce 600 kg of hydrogen per day and comprised two processes: dehydrogenation using a Pt-based catalyst and refueling. QRA was conducted based on the design data obtained from process modeling to identify and evaluate potential hazards associated with the station. The estimated risk of MHRS was approximately 33% of that of the existing commercialized GHRS.

The results of the QRA indicate that storage capacity had a more critical effect on the risk than the operating conditions of the process. Based on this, a risk mitigation plan involving the installation of a dike to contain the liquid MCH in the event of a pool fire was proposed as it was found to be a more effective strategy than reducing the storage capacity. Implementing this measure reduced the risk by 86%. However, the QRA did not consider the environmental and economic impacts of the HRS accidents, which are also important factors for evaluating the feasibility and sustainability of the HRSs. Therefore, it is necessary to comprehensive cost–benefit analysis and life cycle assessment of the HRSs should be conducted to compare their performance and potential for future work.