An advanced framework for leakage risk assessment of hydrogen refueling stations using interval-valued spherical fuzzy sets (IV-SFS)

(cid:1) Proposing an advanced decision-making framework for risk management. (cid:1) Integrating the Bow-tie analysis and Interval-value Spherical Fuzzy Sets. (cid:1) Demonstrating the application of study on a real hydrogen generation plant.


Safety barriers
Probabilistic risk assessment Decision-making a b s t r a c t The extensive population growth calls for substantial studies on sustainable development in urban areas.Thus, it is vital for cities to be resilient to new situations and adequately manage the changes.Investing in renewable and green energy, including high-tech hydrogen infrastructure, is crucial for sustainable economic progress and for preserving environmental quality.However, implementing new technology needs an effective and efficient risk assessment investigation to minimize the risk to an acceptable level or ALARP (As low as reasonably practicable).The present study proposes an advanced decisionmaking framework to manage the risk of hydrogen refueling station leakage by adopting the Bow-tie analysis and Interval-Value Spherical Fuzzy Sets to properly deal with the subjectivity of the risk assessment process.The outcomes of the case study illustrate the causality of hydrogen refueling stations' undesired events and enhance the decisionmaker's thoughts about risk management under uncertainty.According to the findings, jet fire is a more likely accident in the case of liquid hydrogen leakage.Furthermore, equipment failure has been recognized as the most likely cause of hydrogen leakage.Thus, in order to maintain the reliability of liquid hydrogen refueling stations, it is crucial that decision-makers develop a trustworthy safety management system that integrates a variety of risk mitigation measures including asset management strategies.
© 2023 Hydrogen Energy Publications LLC.Published by Elsevier Ltd.All rights reserved.

Context and background
As the world's population grows and people try to improve their quality of life, the demand for clean fuels rises.Hydrogen has been designated as one of the future clean energy sources because of its significant reduction in pollutant emissions and the availability of a diverse variety of generation sources [1e3].Hence, vast attention has been drawn to hydrogen as a key parameter in fuel cell vehicles in the automotive industry.
Given that the number of hydrogen refueling stations is growing in the world, extensive research is required on hydrogen safety issues and effective risk analysis to ease the public concern about hydrogen dangers.
The hydrogen infrastructure accidents are quite different due to the specific characteristics of hydrogen.For instance, difficult detection based on inherent hydrogen features such as odorless and colorless properties, low ignition energy, rapid burning velocity, high-temperature flame, and rapid diffusion rate lead to the spontaneous potential ignition of hydrogen leakage and the possibility of easy leakage from sealing devices (e.g., valves and flanges) [4e6].As evident, the vapor cloud explosion (VCE) caused by hydrogen release at a polyethylene facility in Pasadena, Texas, killed 22 persons and injured 1000 more [7].The Chornobyl nuclear power plant disaster, in which hydrogen was involved in the accidents, caused considerable short-term and long-term damages to the region's people [8].The rupture of a pressurized hydrogen tank at Hanau, Frankfurt [9] and the explosion at the Fukushima nuclear power plant are two other catastrophes caused by hydrogen leakage [10].
A number of accidents in hydrogen facilities, such as the explosion of a high-pressure hydrogen tank in Norway in 2019 and the explosion of a liquid hydrogen tanker in Santa Clara, California [11] have increased, since the use of hydrogen infrastructures in residential areas is growing.As a result, it has raised global concerns about the possibility of disasters in these facilities [12e14].Hence, it would affect the rapid development of hydrogen-related technologies.Therefore, providing safe and reliable hydrogen infrastructure decreases the rate of accidents and increases human willingness and acceptance of using these facilities [15].Accurate identification and assessment methods are essential to determine potential accidents and enhance the reliability and safety of hydrogen infrastructures [16].
Hydrogen refueling stations are among the most crucial and dangerous hydrogen-related facilities in cities filled with fuel cell vehicles.According to Ref. [17], hydrogen refueling stations are the most vulnerable non-laboratory infrastructure components.Three factors exacerbating concerns about the safety of hydrogen refueling stations are (i) the station's high hydrogen pressure, (ii) hydrogen's natural tendency to leak and consequently the risk of fire and explosion occurrence, and (iii) the physical hazard of hydrogen leading to metal embrittlement [1,18].As a result, it is essential to address safety issues in hydrogen refueling stations to avoid catastrophic accidents [19].

Literature review
A brief bibliometric and meta-data analysis is carried out to examine the occurrence of the most frequent keyword related to "Hydrogen Refueling Station" dynamically.In this regard, the Biblioshiny (a user interface for the R package Bibliometrix) [19], as a flexible and robust bibliometric analysis tool, is adopted.The outcomes of bibliometric analysis would provide valuable understanding for researchers and practitioners working in this area.It also sheds light on the topic's shortcomings in the existing literature and illustrates an overall trend of hotspots in this field.Analyzing published articles with the keywords "Hydrogen Refueling Station" AND "System safety", OR "Risk assessment" OR "Reliability" OR "Fire and Explosion" in the Scopus database by the end of August 2022 indicated that there are only 282 studies focused on the system safety and reliability of hydrogen refueling stations.Fig. 1 depicts the most frequent keywords investigating "Hydrogen Refueling Station" based on the "Keywords Plus" analysis.The "Keywords Plus" analysis is derived according to the references' titles of a published article using a unique algorithm [21,22].The "Keywords Plus" analysis is more predominantly descriptive than keywords analysis.As can be seen, the "Hydrogen Refueling Station" is located in the center, indicating its significance and how much it is common in the field of hydrogen safety.It is then closely margined by a requirement of risk assessment methods and safety measurement approaches, such as Failure Mode and Effective Analysis (FMEA) and quantitative risk assessment tools.Therefore, it is required to seek and study further risk assessment applications for improving hydrogen safety over time, using fault tree analysis (FTA), event tree analysis (ETA), and the integration of them as the Bow-tie analysis.In addition, Fig. 2 shows the dynamic variation of frequent keywords over time.It is crystal clear that the importance of risk analysis has dramatically declined over time and ended in 2020.However, numerical simulations and leakage accident scenario studies have emerged in the last few years, indicating their significance to be further investigated.
Some articles focused on performing quantitative risk assessments in hydrogen refueling stations to develop related regulations and standards [23e29].Kikukawa et al. [23,24] performed quantitative risk assessments on the liquid and gaseous hydrogen refueling stations to identify required safety measures.In the presented research experimental results and historical data were used for risk assessment.A comparative risk assessment was presented to determine the risk of gaseous hydrogen refueling stations and liquid hydrogen refueling stations (LHRSs).The results showed that LHRSs have lower risk hazards than gas refueling stations [25].Gye et al. [26] and Zhiyong et al. [27] performed quantitative risk assessments for leakage scenarios in a hydrogen refueling station for identification of required measurements and mitigation plans during accidents.A quantitative risk assessment was performed on refueling stations to identify the required safe distance from other facilities [28].Suzuki et al. [30] conducted a quantitative risk assessment to identify the most significant scenarios with the greatest risk to the surrounding facilities in Japanese hydrogen refueling stations.
Park et al. [31] evaluated the individual and social risks of hydrogen refueling stations by analyzing the performance of safety layers in hydrogen refueling stations.Tsunemi et al. [32] presented consequence modeling research on an organic hydride hydrogen refueling station to estimate the potential damages of explosions, fires, and toxic releases on the surrounding population.A Bayesian-based risk model was provided by Haugom and Friis-Hansen [33] for identifying the different outcomes of Hydrogen leakage in hydrogen refueling stations by analyzing the effect of various leakage sizes on final consequences.Additionally, some articles focused on safety assessment to analyze accident scenarios and determine safety measures to prevent and mitigate accidents.A safety analysis was carried out by Casamirra et al. [34] on high-pressure storage equipment in hydrogen gas refueling stations using a combination of FMEA, Hazard Identification and Operability study (HAZOP), and FTA methods.Kim et al. [35] presented a framework by combining FTA and HAZOP to conduct a safety assessment and determine safety measures for Korea's on-site and offsite hydrogen refueling stations.A hazard identification study was performed on an organic hydride hydrogen refueling station by Suzuki et al. [36] to identify accident scenarios resulting from process deviations.Sakamoto et al. [37] analyzed the performance of safety measures in preventing and mitigating accidents in a hydrogen refueling station by employing an event tree analysis.Correa-Jullian and Groth [38] presented a framework for liquid hydrogen leakage scenarios on a hydrogen storage system located on a hydrogen fueling station using FTA, FMEA, and Event Sequence Diagrams (ESD) methods.

The contribution of present study
Even though research on the leakage of LHRSs and safety assessment of LHRSs is necessary due to their superiority over gaseous refueling stations [38], they are hard to discover in the   literature.A comprehensive hazard identification study in liquid refueling stations is still lacking.Therefore, this study aims to focus on hydrogen leakage in LHRSs.Based on the outcomes of the conducted risk analysis, the criticality of safety barriers is then analyzed, and the critical events that require more attention are identified.Eventually, several safety measures are recommended to develop the system safety.The HAZOP study method is used for process hazard analysis in this framework.Probabilistic risk assessment is applied to evaluate the leakage potentials in LHRSs and possible consequences that could result from hydrogen leakage.To perform the probabilistic risk assessment, the assessors can use several types of data sources to derive the failure probability of basic events (BEs) and safeguards.However, due to the novelty and different challenges of hydrogen fueling infrastructure, special operational process conditions, and reliability data inaccuracy; such mentioned approaches might introduce uncertainty and error to the study.Spherical fuzzy sets are the most recent development of fuzzy sets, offering an independent hesitation degree from the other factors [39].Here, the Interval-Valued Spherical Fuzzy Sets method is adopted for the computation process.Eventually, regarding the research findings, some safety measurements are presented to enhance the safety of LHRSs.
The following is the structure of the present paper.The methodology for this study is described in Section Material and methods.Section Application of study explains the application of the methods.The key findings and discussion are presented in section Conclusion.Finally, Section 5 is dedicated to the article's conclusion, highlighting remarks, and suggesting directions for future studies.

Material and methods
Regarding the importance of safety barriers, numerous studies and publications have focused on safety barriers in industries which can be inspirational for the aim of this research in hydrogen infrastructure.Table 1 presents a brief overview of some of these studies, which have significantly attracted in the state of arts.
According to Table 1, the barrier analysis plays a critical role in the risk assessment of processes, conducted in the initial phase of various processes to enhance safety and identify the requirements.Hence, the barrier analysis is considered in the safety assessment of LHRSs.
A brief overview of the framework used in this article for the probabilistic risk assessment of hydrogen leakage in the  LHRS is presented in Fig. 3.The framework consists of an organized hazard identification framework, probabilistic risk assessment, Bow-tie modeling, and mathematical computation.

Hazard analysis
Hazard identification consists of identifying threats and undesired events that could lead to adverse outcomes and analyzing the event's mechanisms and outcomes [56,57].Identification of hazards is an essential step in safety development.Numerous methods are used for hazard identifications, such as Job hazard analysis (JHA), FMEA, "What if?" analysis, and checklists [58,59].Hazard and operability study (HAZOP) is a systematic hazard identification method widely used in processes.The method's central concept is that operating in a normal situation will not result in unwanted events [60,61].In other words, the HAZOP study analyzes the deviations of process variables from the operational design domain and investigates the possible undesirable consequences in the process [62].

Development of bow-tie
After identifying potential causes of leakage and possible consequences, the cause-consequence analysis is performed for the risk analysis of the hydrogen leakage.The Bow-tie model (BT) is a probabilistic cause-consequence method in safety studies, including a Fault tree (FT) and an Event tree (ET).The FT depicts the correlation between BEs and the path of top event occurrence.On the other hand, ET analyses various possible consequences regarding the operation of safety barriers [63].The probability of the top event is evaluated by Eqs. ( 1)e(3) in the FT.Consequence occurrence probabilities are evaluated by multiplying the TE probability by the likelihood of failure (or success) of safety barriers.It can be assumed that there is an "AND" gate correlation between the Fig. 3 e The framework for leakage risk analysis of the LHRS.
i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 8 ( 2 0 2 3 ) 2 0 8 2 7 e2 0 8 4 2 safety barriers in ET, and Eq. ( 1) can be used for evaluating the probability of occurrence of consequences [64,65].
where P i is the probability of basic event i and G i is the group of basic events in the FT and j ∊ M.

Interval-valued spherical fuzzy sets
The fuzzy set theory is used to overcome the uncertainty limitations that can be introduced using existing probability data.The Fuzzy set theory was introduced by Zadeh [66], and various models used over the past decades are shown in Table 2 [67e69].
The Spherical Fuzzy Sets (SFS) have been recently used by Refs.[80,81].SFS can allow experts to express their hesitations independently during the evaluation process and provide a larger space for membership assignments.Here, Interval-Valued SFS is used in the framework, which is firstly used in Ref. [82] to evaluate the performance of healthcare services and also used in Ref. [83] for safety and risk analysis.As presented in Eq. ( 4), an Interval-Valued SFS (P) of the domain of discourse X is defined by three intervals: membership ðm ÃS ðxÞÞ, non-membership (v ÃS ðxÞÞ, and hesitance ðp ÃS ðxÞÞ.
where m L P ðxÞ, v L P ðxÞ, and p L P ðxÞ are the lower limits of the intervals.m U P ðxÞ, v U P ðxÞ and p U P ðxÞ denote the upper limits of the intervals, and all of the limits are between 0 and 1. and To simplify, the Interval-Valued SFS (P) is denoted by b Let b j ¼ {[x j , y j ], [p j , q j ], [w j , z j ]} be a set of Interval-Valued, SFS and m j ¼ (m 1 , m 2 , … m n ) depicts the importance of b j, then Interval-Weighted Spherical Arithmetic Mean is defined as follows: The definition of the score function of IVSF number b is: The IVSF number ðbÞ accuracy function is defined as: Table 2 e Fuzzy sets and their extension models.

Publication Fuzzy sets models
Zadeh [70] Type-2 fuzzy sets Sambuc [71] Interval-Value Spherical Fuzzy Sets Atanassov [72] Intuitionistic fuzzy sets Yager [73] Fuzzy bags Garibaldi and Ozen [74] Nonstationary fuzzy system Smarandache [75] Neutrosophic fuzzy sets Torra [76] Hesitant fuzzy set Yager [77] Pythagorean fuzzy subsets Yager [78] Generalized Ortho-pair Fuzzy Sets Cuong and Kreinovich [79] Picture fuzzy sets i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 8 ( 2 0 2 3 ) 2 0 8 2 7 e2 0 8 4 2 The proposed Interval-Valued SFS is used in the following steps: Step one: Building the system hierarchy.In the first step, a hierarchy consisting of several levels is constructed.The first level presents an objective.Several criteria support the objective in level 2, C ¼ {C1, C2, …, Cn}.Level 3 consists of several sub-criteria, which are defined for criteria.At the following levels, alternatives a ¼ {a 1 , a 2 , …, a m } that affect sub-criteria are defined.
Step two: Pair-wise comparison.A pair-wise comparison using linguistic terms and constructing criteria is provided in Table A1 in Appendix for Interval-Valued SFS.
Step three: Evaluating IVSWAM of criteria and alternatives using Eq. 17.According to the existing literature [84,85] and to the best of the authors' knowledge, the following factors are taken into account in order to determine the profile quality of expert's score: professional position, job tenure experience, educational level, and age.Table 3 is used to assess the expert score ratings.
Step four: Building hierarchal structure for finding overall weights.Considering the hierarchal form for comparison and aggregation of experts' weights in different levels from the bottom to the top leads to a final ranking of alternatives and objectives.
Using a modified scoring function, Eq. ( 15) is used for the defuzzification of expert judgment (fuzzy possibilities) into scores (corresponding crisp possibilities).
The criterion weights are normalized using Eq. ( 16): The decision matrix is weighted using Eq. ( 10), and the final spherical fuzzy score is evaluated by the spherical fuzzy set and presented in Eq. ( 8).
Step five: Defuzzification and transferring scores into corresponding failure probabilities.After calculating the final spherical fuzzy score, Eq. ( 15) is used for defuzzification.Based on the calculated scores, which are crisp failure possibilities (CFP), the value of the alternatives depicts their ranks.In order to evaluate corresponding failure probabilities for each BE, Eq. ( 17) is presented by Onsawa [87].

Barrier development
To develop the safety of a system, it is required to determine its weakness.After constructing the BT and conducting a probabilistic risk assessment, the critical BEs are identified using Birnbaum importance measures (BIM).The BIM BE i introduces the importance of the ith basic event by considering the influence of occurrence of BE i on the top events (TE).That is, Eq. ( 18) can be defined for BIM [88].
After analyzing the criticality of events and safeguards, possible safety measures are identified, and each identified safety measure's effectiveness is evaluated using fuzzy expert judgments.

Validation
Since the significant goal of safety measure consideration is to enhance the system's safety and decrease the risk of accidents, it is essential to assess the risk reduction of possible accidents during hydrogen leakage.Risk reduction requires evaluating each accident's probability of occurrence after considering safety measures and evaluating new risk numbers.

Plant description
Liquid hydrogen is stored in the double-walled storage tank at roughly À253 C and 4 bar pressure.In an isothermal process, the liquid hydrogen is pumped to a vaporizer with 900 bar pressure.The vaporizer is used to transmit the phase of hydrogen into gas.The temperature of hydrogen increases to À40 C and then is transferred to a highpressure storage tank or buffer.Before transferring to the dispenser, hydrogen pressure decreases to 700 bar by mixing with low-pressure hydrogen to regulate pressure for injecting.Fig. 4 illustrates the process flow diagram of the hydrogen refueling station.In this research, the LHRS design is modeled using [89].
Table 3 e The score ratings are based on the characteristics of the expert [86].

Hazard identification of hydrogen refueling station
Hydrogen leakage reported as the reason for 50 accidents and incidents occurring in hydrogen refueling stations [90].Therefore, identifying hazards that could lead to hydrogen leakage is essential in such facilities.Hydrogen leakage can result from operational or mechanical failures.
Overpressure is one of the most significant operational failures leading to leakage in LHRSs.A HAZOP study has been conducted on the station to identify the operational reasons that could lead to hydrogen overpressure.As far as HAZOP analysis is concerned, it allows for identifying the station hazards and accidental scenarios.For this study, the station has been divided into two nodes for completing the study (Node classification is presented in Appendix, Fig A1 .).
First node: from the liquid hydrogen storage tanks to the vaporizer Second node: from buffer storage tanks to dispenser According to the HAZOP outcome, reported in table A2 of the Appendix, thirteen process scenarios were determined.Regarding the specific situation of LHRSs, besides the overpressure, material and mechanical failures in these facilities can be caused due to the high concentration of hydrogen and the high-pressure process in LHRSs, and the diffusion of hydrogen into the container.In addition, hydrogen stress cracking is another possible damage in such facilities.Regarding the low temperature of liquid hydrogen in LHRSs, stress corrosion cracking is another type of damage resulting in containers [91].Pipelines and storage tanks located in exposed environments or buried are at risk of external corrosion [24].
Moreover, Hydrogen can leak due to mechanical failures in different components such as equipment and valve sealing surfaces, sealing rings, and gaskets [92].Factors like aging, improper equipment selection, and inadequate maintenance programs can lead to such leakage.The following reasons can cause hydrogen leakage from welded parts [93,94].First, hydrogen-induced cracking in the heat-affected welding zone can result from failure of preheating, failure post-welding heating, or incorrect fitting.Second, excessive welding current, improper alignment, moisture, and contaminants in the welding zone are other reasons for welding defects [95,96].Improper decision-making in material selection and operation can damage equipment, pipelines, and materials.Equipment is more prone to cracks, which leads to hydrogen leakage.These effects will increase over time, and some measurements must be predicted to prevent these defects.

Construction of bow-tie
The bow tie for hydrogen leakage is constructed based on the FTA and ETA of Hydrogen Leakage in an LHRS.Fig. 5 depicts a fault tree analysis with the top event of hydrogen leakage in the LHRS.The FTA has been built based on the conducted hazard identification outcomes.Regarding hazard identification outcomes, three main events could lead to hydrogen leakage.These primary factors are then subdivided into intermediate events and primary events.In addition, the overpressure event is the consequence of failing pressure control systems, presented as a preventive safeguard in the FTA.The symbols, events, and primary events are presented in Table 4.By using Eqs.( 1)e( 3), the probability of occurrence of top event (hydrogen leakage) is estimated to be 0.025 per year.
In addition, after a Hydrogen leakage in the LHRS, three safeguards are considered to prevent and mitigate hydrogen leakage from evolving into serious outcomes.These barriers include the shutdown systems, including detection and   emergency shutdown systems (S1) and ignition prevention barriers (S2).Note that an inherently safe design barrier is considered for hydrogen equipment.However, this safeguard would be helpful in the prevention of domino accidents.In the LHRS, the existence of different Hydrogen physics increases the ETA's complexity.Different scenarios may occur regarding hydrogen's liquid or gas phase [38].However, the lack of comprehensive research about the effect of operational conditions on the leaked liquid hydrogen increases the study's complexity.Here, considering the performance of safeguards, the phase of leakage hydrogen, and the type of leakage, an ETA is presented in Fig. 6.
The ETA is divided into two parts regarding the existence of both liquid and gas hydrogen.GH 2 release and the existence of an ignition source could lead to fire and explosion [97].Since the leaked gas hydrogen dilutes, only an immediate ignition source can cause fire and explosion in the plume when the shutdown system works.If S2 works and immediate ignition exists, a flash fire is assumed for the sake of a small amount of hydrogen.The type of leakage from liquid hydrogen containers is essential in the consequences.Suppose the liquid hydrogen is released due to a catastrophic rupture, and the accumulation of liquid forms a pool on the ground [98,99].
Meanwhile, hydrogen flash evaporation occurs by absorbing heat from the ambient.Liquid hydrogen starts vanishing, and cryogenic plume forms after a time in the atmosphere.Therefore, an immediate ignition can lead to pool fire and, in late ignition, causes an explosion [100,101].Eventually, If the isolation does not work, the pool fire and explosion are possible according to the type of ignition sources.The consequence analysis of hydrogen leakage in the LHRS is carried out in Fig. 4 based on the performance of safeguards and some circumstances and factors presented in Table 5.

Computing probabilities and criticality analysis of events and barriers
In this research, the probabilities of equipment are extracted from databases such as OREDA.For non-equipment events, these amounts are obtained based on literature and expert judgment.To evaluate the probabilities with the help of experts, a questionnaire was sent to a group of 4 experts who were engaged in researching and designing the LHRS.Table 6 illustrates the characteristic of each expert and their related weights.The questionnaire consisted of the built Bow-tie and the reports of Hazard identification.A fuzzy technique is adopted to compute the probability of events.Failure Fig. 6 e Event tree analysis of hydrogen leakage in the LHRS.
i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 8 ( 2 0 2 3 ) 2 0 8 2 7 e2 0 8 4 2 probabilities of each event and safeguards are presented in the table.The probability of TE and each consequence are then evaluated using FT and ET numerical equations.
Regarding the importance of identifying critical events in LHRS accidents, critical events are determined according to the method presented in Ref. [40] for the critical analysis.The results of the critical analysis are presented in Table 7.

Implementation of additional safety measures for LHRS
Although the research uses a general case study and expert judgments for numerical results, it attempts to present a leakage risk assessment of LHRS using framework probabilistic approaches.In addition, the findings of criticality analysis BEs can aid decision-makers in attaining required measures and strategies to decrease the possibility of hydrogen leakage.
Although the inherent safe design is the most effective way to develop safety in every infrastructure, other safety measures, engineering, and administrative controls must be considered to reduce the risk associated with the operational phase [102].
Safety measures can be discovered by literature review, historical incidents analysis, modeling other industries, and audits with safety specialists.It is evident from the results that since the process operates under high pressure, designers and safety engineers use numerous engineering controllers to prevent and mitigate causes that can lead to overpressure.Meanwhile, the criticality of leakage causes that are resulted from equipment failure is more significant and must be prioritized during safety measure consideration.The process safety management system is a system for integrating engineering and administrative measurements implemented in process industries containing the threshold amounts of hazardous materials [103].According to Ref. [104], hydrogen is a flammable substance subject to PSM regulation.In the hydrogen refueling station, it is essential to implement such regulations according to the high pressure of the process and the existence of a high amount of hydrogen in different phases.Therefore, some measures are selected based on process safety management system (PSM) regulations and the research results.The following measures are confirmed by expert elicitation, questioning the team of experts in the present investigation.
-According to the most critical BEs (BE 25, BE24), it is evident that regular inspection and attaining proper maintenance   strategies are required to prevent such primary events.According to the Risk-based process safety management system (RBPS), the asset integrity element ensures that equipment is correctly designed, operates, and sustains fit during the process's lifecycle [105].Therefore, the implementation of this element can decrease the possibility of these events.-Low technicians' competency is the second most important challenge that can lead to BE30, BE31, and BE32.Solving this obstacle, improving the competency of engineers training, and implementing a robust training program can be considered a constructive solution.-Since material selection plays an essential role in preventing hydrogen leakage in hydrogen infrastructure, during changes, there must be a systematic process for managing changes and evaluating possible associated risks.Management of change (MOC) [106] is a suitable measure that helps engineers' decision-making during changes with consciousness about possible risks.-Operational readiness (OR) is another PSM element that should be considered in LHRS.This element describes practices for pre-startup reviewing new, modified, or shutdown processes.The OR assures that the process meets the requirement of standards and explores possible mistakes or material or equipment selections before the system's startup.
In addition to the presented administrative measures, engineering considerations include a pressure safety valve, low flow alarm, and minimum flow stream for cryogenic pumps.Since overpressure is possible during the blocked outlet of the pump, an internal pressure safety valve for the pump decreases the consequences of overpressure in the pump.Furthermore, the safety measures "flow alarm low" and "minimum flow stream" prevent the pump damage for times.Besides, considering the impacts of natural hazards such as earthquakes and floods on the design of LHRSs is the sole measure for facing BE18 and BE20.Table 8 compares the effectiveness and cost of presented barriers in qualitative terms, which are resulted from experts' opinions.For engineering control, the cost terms are gathered from design engineers, and the administrative costs include the annual cost allocated for implementing and maintaining the elements.

Conclusion
This study presents a novel probabilistic framework for leakage risk assessment in LHRSs.In this framework, the HAZOP study is used to identify process hazards and deviations that can lead to hydrogen leakage.The Bow-tie model is adopted for the cause-consequence analysis of hazards.Since hydrogen infrastructure is cutting-edge technology and there is a lack of quantitative data for risk analysis, a novel fuzzy method is used to quantify BEs and safety measures in the Bow-tie model.The presented framework can effectively solve the quantification challenges of different basic events.Based on the ability of the presented framework, the criticality degree of the causes of hydrogen leakage is evaluated, which facilitates decision-making more effectively.Regarding the study findings, jet fire is the most likely scenario which can happen in liquid hydrogen leakage in LHRS with the probability of 1.521 Â 10 À5 per year.In addition, it is concluded that causes that result from equipment failure have a more significant share in hydrogen leakage occurrence.Therefore, it is evident that to develop the system's safety, the priority of safety measure consideration is to control equipment failure measures.According to the hydrogen leakage risk assessment finding, since hydrogen is an explosive and LHRS operates at high pressure, a discussion is initiated about the significant development of a safety management system based on the specific characteristic of hydrogen.For providing such a system, several constructive measures and elements shall be presented based on the finding of the research.The presented measures can be taken from similar industrial safety management systems, such as process safety management systems.According to the results, the existence of a safety management system can directly decrease the possibility of several critical events.The second issue, which is extracted from the results and requires more concentration, is the effect of natural hazards on hydrogen infrastructure.The standards that focus on the design of the liquid hydrogen infrastructure shall be clarified, attending to the possible natural hazards in the region.However, during the study, a couple of challenges and limitation have been faced, which needs to be considered as a direction for future works: (i) there is still a comprehensive lack of knowledge about the behavior of leaked liquid hydrogen, (ii) there is a lack of objective data sources for failure of equipment in hydrogen infrastructure, since the age of hydrogen stations are still partial therefore, and (iii) there is no evidence of HRS in places with different weather conditions which affect failure probabilities.This study is a step forward in developing safety in LHRSs.The result presented a significant reason for hydrogen leakage in LHRS and highlighted the required safety measures to decrease such events.

Fig. 1 e
Fig. 1 e The most frequent keywords-plus analysis.

Fig. 2 e
Fig. 2 e The thematic evolution of published articles over time.
i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 8 ( 2 0 2 3 ) 2 0 8 2 7 e2 0 8 4 2

Fig. 4 e
Fig. 4 e Process flow diagram of LHRSs.

Fig. 5 e
Fig. 5 e Fault tree analysis of Hydrogen leakage in the LHRS.
i n t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 8 ( 2 0 2 3 ) 2 0 8 2 7 e2 0 8 4 2

Table 1 e
A brief review of safety barrier research.
a According to the Web of Science (WoS) citation index.

Table 4 e
The experts' opinions and probability of basic events.

Table 5 e
The experts' opinions and probability of Safeguards and Circumstances.

Table 6 e
Experts' characteristics and weighting.

Table 7 e
The criticality analysis of BEs.

Table 8 e
The analysis of suggested safety measures.in t e r n a t i o n a l j o u r n a l o f h y d r o g e n e n e r g y 4 8 ( 2 0 2 3 ) 2 0 8 2 7 e2 0 8 4 2