CGH2 cylinder rupture

A small hydrogen cylinder was beeing filled at a facility for high-pressure testing. The cylinder had a nominal working pressure of 2000 psi (approximately 140 bar) and the filling a target pressure was 1500 psi (approximately 100 bar) . The cylinder failed during filling, at an indicated pressure of 1500 psi. However, pressure gauge was defective, indicating a pressure much lower than the real filling pressure, which allowed the cylinder to be over-pressurised.

The cylinder was being filled in a test vault specially designed for the high-pressure burst testing of pressure vessels and components. Therefore, there were no safety consequences due to the failure and no damage to the facility or equipment.

The INITIATING CAUSE was the over-pressurisation of a compressed hydrogen cylinder due to wrong pressure reading.
The post-incident investigation revealed that the pressure transducer was defective, and the actual pressure could have been more than five times the indicated pressure.
The high-pressure manifold was equipped with a rupture-disk protection, but the rupture disk was not adequately sized to provide protection for this type of cylinder. Therefore, the only safeguard against over-pressurisation was the failed digital pressure instrument. Lack of calibration, lack of a correct safety design and also a lack of effective risk assessment contributed to the ROOT CAUSE.

cylinder, burst disk, pressure reducer.

no damage. The testing room was designed for high pressure failure events.

The failure of a compressed hydrogen cylinder can have severe consequences. In this case, however, the test was performed designed for possible cylinders failure, so that there were no consequences.
Nevertheless, this case highlighted the importance to perform a risk assessment able to consider all possible accidental scenarios, considering worst case of multiple malfunctioning of components affecting the whole system. It is also important to be able to distinguish between non-safety-related equipment from those having a critical safety function. The non-safety-related ones should not be considered as contributing to safety. In this case, the primary safeguard was the burst disk, which was however not designed for the cylinder which ruptured. Probably, also the pressure reducer equipment had been considered as contributing to safety, however, without adopting the required measures (calibration plan and execution, independent pressure assessment with another gauge, et.) aiming at guaranteeing its proper functioning. It is probable that these aspects were given less attention than required, thanks to the existence of a major mitigating element, the testing room itself.