Hydrogen release and ignition on hydrogen sea-vessel

A fire broke out on the world’s first hydrogen carrier vessel. The ship had just completed the loading of the cargo (approximately 75 ton of liquid hydrogen) and was setting sail from Australia to Japan carrying to accomplish the world’s first international shipment of liquefied hydrogen.
The fire was the consequence of the action to burn excess boil-off gas from the liquid hydrogen cargo tank, by operating the GCU. A flame was seen coming from the gas combustion unit’s (GCU) exhaust on deck. The unit was immediately shut down and isolated, so that the emergency terminated before the crew implemented the fire prevention response plan.

The GCU working principle was the controlled mixing, ignition and combustion of air and hydrogen. On the day of the event, a valve responsible for the air flow malfunctioned and did not open. The hydrogen-air combustion still occurred, but outside the operative condition its confinement inside the GCU. The burning mixture shifted outside he GCU and produced a flame outside the vent, at the level of the ship deck.

The INITIATING CAUSE of the event was the failure of a solenoid valve responsible for providing air to the system designed to burn the boil-off gas. It did not open when the system was started, and this caused an abnormal hydrogen-air flame outside the vent.
The ROOT CAUSE was that incorrect specification of the solenoid valve. Consequently, 24 V direct current (DC) solenoid valves were installed, which were incompatible with the 230 V alternating current (AC) supply from the system. The valve responsible for the fire was able to work during the commissioning tests and the first journey, but failed at a cycle life much shorter than the one expected for the correct valves.
Another element of the root cause was an ineffective automated safety system. Two flame detectors were available inside the gas combustion unit to spot flames and shut down the machine but did not detect abnormalities.

LH2 storage, boil-off system, gas combustion unit, exhaust, automation system

The ship had departed Kobe loaded with 55 t of LH2, mainly to test its cargo and monitoring systems. The ship was to load additional LH2 from the gas liquefaction facility at the harbour of Hastings in Australia, and to deliver it back to the harbour of Kobe in Japan
During 800 hours of service, the GCU was operated whenever it was necessary to reduce the LH2 cargo tank pressure through combustion of boil-off gas . After the GCU start sequence was initiated, the operation was managed automatically by the unit’s programmable logic controller.

DESCTIPTION OF THE GAS COMBUSTION UNIT (GCU)
The GCU had the role to burn in a controlled way the excess hydrogen produced by boil-off of the liquid hydrogen storage tank. Its design was based on similar unit used for boil-off treatment of liquefied natural gas.
Two fans had the function to provide the volume of air required for the operation of the GCU. Normal operation of the GCU was requiring the function of only one fan. The fan delivered air to a distribution drum. The drum split the incoming air flow, feeding 3 automatically operated control vanes required for the 3 different functions of the GCU: combustion, cooling and dilution.
A discharge air damper was installed between each fan outlet and the air distribution drum. The dampers were designed to be either fully open when the corresponding fan was running or fully closed when it was stopped. Each damper was controlled by an actuator equipped with a pneumatic solenoid valve. When energised by the GCU control system, the solenoid valve directed compressed air into the actuator to open the damper. When the solenoid was not energised, the valve closed, and the spring-loaded damper actuator returned the damper to its closed position.

SAFEGUARDS AND ALARMS
Among the fire prevention controls established onboard, there was the elimination of any potential ignition sources on its outer decks. The ship was also fitted with gas detectors throughout, and the crew carried portable gas detectors and wore anti-electrostatic boiler suits and boots on deck.

Several operation monitors were guaranteeing a safe operation of the GCU: 2 ultraviolet flame scanners and various temperature and pressure transmitters to detect deviations from normal operating parameters. They were triggering system alarms and automatic shut down the GCU as required.

No further abnormalities were reported and there were no injuries, damage or pollution.

The Australian Transport Safety Bureau (ATSB), the federal agency responsible for investigating air, sea and rail accidents, completed an investigation into what was labelled a “serious incident”.

The ship Suiso Frontier was the first waterborne liquid hydrogen carrier able to transport large quantities on long distance. The first also to receive a classification stating its compliance with the International Code for the Construction and Equipment of Ships Carrying Liquefied Gases in Bulk of the International Maritime Organisation (IMO). This incident is the only publicly mishap known and did not have any consequence, although it is not reported which consequences could have been, without the prompt shut down of the combustion unit (GCU).

The first, almost obvious first lesson, is the importance of manufacturer quality controls. The correct installation of system sub-components into a highly complex full system is always a delicate point, because it requires the management and control of the design along the whole supply chains. Tier 1 and 2 suppliers are not necessarily experts in hydrogen-based design and must provide one or few products, for which the quality control and the level of maturity typical of big production lines do not fit. Mishaps during design integration and installation could be caused by a lack of coordination, or communication, and differences in quality control approaches and safety cultures between companies.

The hydrogen boil-off GCU was especially built for the Suiso Frontier ship and was the first of its kind. Its design was taken from that of GCU’s already installed on LNG ship and modified to consider the different combustion characteristics of hydrogen flame. It had also been reduced in dimension due to the limited space on board. Although carefully tested, it had to be design without the support of a return of experience coming from the operation of other units already installed.
In this event the alarm was given by a member of the crew who saw the fire, and not earlier, by one of the several measuring and alarm systems installed to detect deviation from normal operation and to trigger automatic responses.
The GCU design had been the object of a through Failure Mode and Effect Analysis, and the specific case of a failure to provide air to the GCU had been considered by installing pressure transmitter able to detect air pressure below specification. Flame scanner and temperature transmitter were installed to detect flame anomalies. These safeguards were interlocked with an automatic shutdown of the system but failed to detect it abnormal operation. As stated by the ATSB investigation report (see references), the control and safety system of the GCU was designed to work fully automatically. The operators were inherently removed from its control loop. Therefore, they were unable to identify abnormalities promptly and respond to them. System safeguards should be appropriate for promptly alerting operators to any issues or automatically stopping the operation to prevent damage or injury.

In agreement with the Suiso Frontier’s operator, the produce of the gas combustion unit (GCU) installed limit switches to the air fan discharge dampers of th GCU. These switches were designed to monitor the position of the dampers. Moreover, the system’s control logic was programmed to automatically stop the GCU if an ‘open’ signal from the dampers is not detected.
The modifications were confirmed to be functioning as designed and approved by the ship’s classification society.