LH2 leak when fuelling a rocket tank

In 1990 the Space Shuttle fleet was grounded for several months by an elusive hydrogen leak occurring during the procedure of fuelling of the liquid hydrogen tank of a space shuttle.
The Columbia launch was scheduled on the 30th of May 30, when personnel discovered a hydrogen leak during tanking. The external fuel tank was loaded through an orbiter. Liquid hydrogen flowed through a 17-inch umbilical between the orbiter and the tank. During fuelling, the aft fuselage was purged with gaseous nitrogen to reduce the risk of fire. Moreover, a leak-detection system was installed on the mobile launch platform, sampling the atmosphere in and around the vehicle, and bringing it to the ground to a mass spectrometer for ga composition analyses. When starting the tanking with liquid hydrogen, hydrogen concentration approached four percent-the limit above which it would become flammable. Various attempts were executed to identify the location and the cause of the leak.
(1) Personnel performed tanking tests, i.e. instrumenting the suspected leak sources, and cryo-loading the external tank to try to isolate components and identify precisely where the leak originated.
(2) Umbilicals were switched off.
(3) The seals between the umbilical and the orbiter were replaced. These seals were investigated microscopically and found no flaws.
(4) Re-circulation pumps were replaced.
(5) When nothing helped, orbiters were switched between Columbia and the Atlantis shuttle.
(6) New leak sensors, up to twenty at a time were installed and personnel followed a methodical approach in their placements to narrow down the possible sources of the problem.

Eventually, a series of leak detectors installed outside the orbiter, where the umbilical was connected to the external tank showed the greatest concentration of hydrogen. The leak had to be at the seal which has already been replaced and rigorously inspected.
The personnel could then draw conclusions on the cause. The leak was not occurring with cold gaseous hydrogen (used to chill the system), but only in presence of liquid hydrogen. At that temperature, the metal of the joint was contracting unevenly, creating small gaps for hydrogen to escaped.

After the adoption of measures to avoid the repetition of this occurrence, the 6th of October 1990, the discovery was able to take off, the first launch since April.

The INITATING CAUSE was the reduced sealing capacity of a flange at the temperature of the liquid hydrogen.
The flanges had passed the qualification test at the manufacturer site, because the manufacturer tested it with liquid nitrogen, instead of liquid hydrogen. The latter was not permitted at the site.
ROOT CAUSES can be identified in an inadequate qualification procedure by the manufacturer, and in a lack of management safety and quality control of contractors by the plant owner.

groundtank, connection line

DESCRIPTION OF THE EXTERNAL LH2 TANK
The orange external propellants tank held approximately 2025 m3 of liquid propellant in total, with the LH2 tank being the larger of the two internal tanks, located at the bottom (1420 m3 for LH2, approximately 100,000 kg ). It was the largest component of the shuttle stack (its insulation was redesigned after the 2003 Columbia accident to prevent the shedding of foam).
The Space Shuttle's liquid hydrogen (LH2) first-stage tank fueling began about 10 hours before launch and took approximately 150 minutes to complete. The entire process of loading both propellants was completed within the first 3 hours of the 10-hour fuelling window. The remaining 7 hours were a stable replenishment mode to maintain the necessary fuel levels.
If the launch was aborted (‘scrubbed’), the LH2 was drained and returned to ground storage, a process that took 1-2 hours.

DESCRIPION OF THE FUELLING SYSTEM
The fuelling consisted of three stages: Slow fill (up to an initial level of 73 m3 of LH2), Fast fill (quicker filling to the flight level of 1,420 m3of LH2 ), Topping (a final topping up to the precise flight quantity). The LH2 to be fuelled was provided by an ' orbital' , i.e. a mobile tank able to fuel the rocket onboard tanks.
A space rocket umbilical is a group of cables and hoses that connects the rocket to the launch pad before launch, providing essential services like power, data, and fuel. At launch, the umbilical is detached or cut, allowing the rocket to ascend while the services it delivered are then provided by the rocket's onboard systems. The one involved in this event was an umbilical providing liquid hydrogen for the fuelling rocket tanks and "topping off" them tanks before launch.

The Space Shuttle fleet was grounded for six months.

This event confirms how difficult is to identify the exact location of hydrogen leak in complex technical systems. Due to its volatility, the leaking hydrogen quickly diffuses into the space around the leak, so that several fixed detectors placed in different positions can detect hydrogen simultaneously.

Another lesson is related to the relationship between manufacturers and the plant operators. Why had the seal of the leaking flange passed all its tests at the contractor? This manufacturer worked in close collaboration with the operator. Once the leaking component was identified, the manufacturer was able to supply the answer. They had tested the seals with liquid nitrogen, not liquid hydrogen. It was not possible for them to use hydrogen due to vicinity of densely populated areas. Liquid nitrogen was a safe alternative, with the consequence that the flange was tested at -196°C instead of -253°C. On top of that, nitrogen molecules are much bigger than hydrogen ones, and diffuse less easily.
According to P. Weber in his article “The summer of hydrogen”, the lessons taken from this experience, were:
(1) Don't take anything for granted.
(2) Stay in constant communication with the hardware manufacturer.
(3) Test as you fly.

To fix the problem, two technical modifications were adopted:
(1) spacers were installed outboard of the bolts in the umbilical flange; they made that the inside diameter of the flange squeezed down tighter on the seal, when the bolts were tightened.
(2) The loading sequence was slowed, to reduce the cold shock on the joint.