Fire from a from a hydrogen storage hose

The incident occurred at a hydrogen storage unit serving a catalytic reformer, during transfer of hydrogen from the storage unit to the reformer. A flexible hose was over-pressurised and caught fire.

The hydrogen storage consisted of 3 compressed cylinders modules each made of 12 compressed hydrogen cylinders at 150 bar. The modules were connected via a pressure regulator and flexible supply lines to a hydrogen recycle compressor. On the day of the incident, due to a too slow pressure building in the reformer, the workers obtained the permission to connect the supply line to the filling inlet of one cylinder module. While the measure was successful, an erroneous execution of the sequence of closure and opening of the supply line valve caused the over-pressurisation of the flexible. Its connection failed with a whip-effect, and the leaking hydrogen ignited.

DETAILED ACCIDENTAL SEQUENCE
The normal sequence of hydrogen injection was:
(a) to open the block valves starting at the recycle gas compressor downstream from the injection point, and after that
(b) to open the needle valve on the hydrogen module after the regulator.
Whenever the operation is stopped these block valves are closed in the reverse sequence.
The was only one line equipped with a pressure relief valve (PRV), and this line was already used by another module.
On the day of the incident, the operators were supplying hydrogen to the reformer from the module connected without PRV. Since the unit was building up too slowly, the shift supervisor decided to connect the flexible directly to the module's filling line, not equipped with a pressure regulator. This was the line without the PRV also at the otehr end, by the injection point.
The operation was successful in achieveing the desired pressured of 7 bar in the reformer. One operator then isolated the module by the correct sequnece, by executing first (b) and then (a).
When the reformer's pressure decreased, this operator was busy with another task and shift supervisor decided to reconnect the module by himself. However, he forgot that the block valves downstream to the compressor were shut (b) and opened one cylinder discharge needle valve and the module's filling valve (a). This caused the flexible steel hose to be subjected to the full cylinder pressure of 150 bar.

The INITATING CAUSE of the accident was an error in operating the hydrogen supply system valves in the correct sequence.

Several factors contributed to the ROOT CAUSES.
(1) The system had been deprived of a possible risk mitigating factor, by bypassing the pressure regulator and connecting the line directly to the cylinders module. Anyhow, pressure regulators are not primary safety devices: the absence of a pressure relief valve at the compressor's injection point was a safety design weakness. It is unclear why only one of the connection points to the recycle gas compressor had a PSV fitted upstream of the block valves. This was already connected to another module and could not be used on the line which failed.
(2) The operators had used the module's filling line connection before, every time they had difficulty with the pressure regulator at the correct discharge connection of the module. The post-accident investigation found the reason for the malfunctioning of the regulator: broken pieces of Teflon seats from the needle valves were blocking the pressure regulator's passages. The needle valves were damaged due to over tightening with wrenches.
(3) The flexible hoses used for the transfer of hydrogen from the modules to the plant had been tested to 70 bar (4 times their normal working pressure, probably the maximal allowed pressure declared by the manufacturer), but the hose which failed was exposed to 150 bar.
(4) There was no operating procedures manual covering the discharge of hydrogen from the modules to the plant.

flexible hose, needle valve

On the day of the incident, two modules were connected to the injection line using the correct outlet points after the pressure regulators. Module 2 was emptied and replaced by module 3. Hydrogen from module 2 module was connected on the injection point without the PSV. Three cylinders of module 2 had been emptied into the unit.

DESCRIPTION OF THE PROCESS
In this plant, hydrogen was supplied to the catalytic reformer from three storage modules each consisting of 12 x 1m3 cylinders at 150 bar (2205 psig) pressure. THis give approximately 130 kg /module and a total stroage capacity of approximately 400 kg of hydrogen.

Each cylinder was fitted with a needle valve, and the twelve cylinders were connected by steel tubing.

Each module had a filling connection (with no pressure regulator) and a discharge connection equipped with a pressure regulator and a pressure relief valve (PRV) set at 14 bars (206 psig) pressure. The reformer had two hydrogen connecting points to the
recycle gas compressor's discharge line which was normally used to charge the unit. Only one of these connecting points was fitted with a pressure relief valve in addition to the PSV’s fitted to the individual modules.

The hydrogen modules were connected to the reformer's injection points through 1-inch flexible steel hoses from the outlet of their pressure regulators.

One fatality, material damage unknown

The following lessons could be drawn from this incident.

(1) Non routine (start-up, shutdown, etc.) and maintenance activities must be included in the periodic hazard analysis (e.g., HAZOPS) of the process units.
(2) Stepwise operating instructions must be available for all activities identified as high-risk activities. In this plant, guidelines covering the discharge of hydrogen from the modules were not available, despite their highly manual character which made it sensitive to confusion and misunderstanding. These instructions must be fed with and guided by the results of the above-mentioned hazard analysis.
(3) Changes to normal operating practices must be subject to a formal "Management of Change" review with the appropriate level of management approval. The operation was authorised as a ‘cold work permit’ which probably covered a very broad range of standard activities.
(4) The operator had already performed several times the bypass of the standard connection and its safety measures. In absence of a Management of Change review, should have been identified as a "Near Miss" and its occurrence investigated in respect of its potential severity.
(5) Finally, several elements converge in identifying a general lack of safety culture at all operation levels.
(a) The shift supervisor was not wearing a cotton shirt with trousers made of special material at the time. Although these suits (jacket and trousers) were provided to all process personnel, there were many complain about wearing the complete suits in hot weather. The consequence was that workers tended to not use them. This witnesses either a lack of enforcement or failing to find better solution, or both.
(b) The maintenance department personnel in charge to execute the line bypass had warned the shift supervisor against it. This warning should have been taken more seriously, and brough up to the management instance which issued the permit.
(c) the line bypass operation was decided to get rid of the malfunctioning pressure regulator. A much more obvious and safer option would have been the investigation of the reason of the malfunctioning and/or the replacement of the regulator.