Water electrolyser explosion

The incident occurred during the verification operation of a water electrolyser, a high-pressure PEM prototype. This prototype was part of a demonstration project for a hydrogen refuelling station with onsite hydrogen production.
An abnormal reaction took place in the electrolytic cells, which caused an explosion and a fire. The temperature was estimated at 400C and the pressure at a value above 200 MPa. The reaction escalated by involving the oxygen separation tanks and the vents. The electrolysis cell burned down, the pipes of the oxygen circuit burst and the peripheral equipment were scattered all over the facilities.

There was no injury.

The analysis of the incident differ slightly between sources (see References): they agree on the fact that the cause was an abnormal reaction inside the electrolytic cells. They agree in identifying the first cause of the reaction either (i) in the exposure of the titanium electrode in to oxygen, or (ii) in the cross diffusion of hydrogen into oxygen forming an explosive mixture. They differ however in assuming which one of the two reactions started first.
The voltage to the generator was shut down in an early phase of the incident. Later on, also the water recirculation pump was shutdown. Nevertheless, the pressure inside the cell kept raising from a nominal value of 40 MPa to a value estimated to more than 100 MPa, despite the activation of the safety valve.

The INITIATING cause was probably the reaction between oxygen and the titan electrode, or the re-combination of oxygen and hydrogen.

The ROOT CAUSE was a ill-design, due to lack of in-depth knowledge of material behaviour in a high-pressure electrolytic cell. This was further worsened by a badly performed risk assessment, and ill-functioning project governance: the University was employing part-time professors in charge of the safety management. Since the safety manager and safety technology manager, were not covering full-time positions, it was difficult to actually carry out their duties as required by law.

high pressure electrolyser; titan electrode; oxygen separation tank; hydrogen and hydrogen vent pipes.

The event occurred when 'verifying' or 'commissioning' the prototype high-pressure electrolyser at a university campus.
This was the third design version of the prototype.
(1) A first prototype had been developed in 2003, which experienced an explosion due to the cross-diffusion of oxygen and hydrogen, and the ignition of the flammable mixture.
(2) A second prototype had been completed in 2004, improving the first design to avoid the occurrence of the same incident.
This second system was damaged few months later by a too high pressure difference. The third prototype was designed with an improved flow control approach.

DESCRIPTION of THE SYSTEM
The prototype consisted of an electrolytic cell installed at the top of a tank, with the cathode side open to the gas space of the tank and the water was entering and exiting from above. A pressure differential controller of a cylindrical piston type was installed between the high-pressure electrolysis tank and the oxygen separation tank.
The electrolysis tank was made of stainless steel. The nominal pressure was 40 MPa
and the operation temperature: 35 C.
The nominal production was expected to be 1,080m³/day

There were no injuries. Extensive material damage extended to cars parked outside the installation.

[A] There were research issues still to be resolved regarding the behaviour of the electrolysis cell in the high-pressure region, for which there was almost no literature information. This lack of fundamental knowledge affected in general the design, operation and safety of the high-pressure electrolyser prototype. In particular, they hindered the identification of the processes, which could take place in case of abnormal conditions during pressurisation and rapid decompression. It is necessary:
(1) To know the durability of cell components (titanium, MEA, seals, etc.) at the operating pressure.
(2) To understand the fundamental physical properties of water, hydrogen, oxygen, etc. under operating pressure. For example, high-pressure oxygen possesses different oxidizing properties than at normal conditions. other example: the fluorine-base rubber used in the electrolytic cell seals had not been investigated for high-pressure deterioration, such as blistering and swelling.
(3) To take in consideration in the design of the electrolytic cell local fluctuations in operative and boundary conditions (this would avoid immediately escalation during fluctuations).
(4) To design the components considering abnormal conditions: for example, an operation transient can generate pressure waves in a pipe, exceeding the pipe strength and causing damage.

[B] This project was consisting in a consortium of several companies led by the University, but it appeared affected by this lack of coordination. The electrolysis cell, the pressure vessel, the piping, the pressure storage tank and the filling system were all ordered and manufactured by different companies. A responsible for the safety of the entire system had not been identified.
(5) When developing innovative, first-of-its-kind equipment, a comprehensive coordination between individual technologies and system development is crucial.

[C] A risk assessment has to be performed even if the operation is the first-of-its-type. In term of safety, the design and operation of a prototype should receive exactly the same attention as the one dedicated to commercial systems. Therefore, it is necessary:
(6) To consider well-functioning automatic system able to prevent abnormal build-up of pressure.
(7) To establish develop a quantitative approach able to assess the reliability and safety of the prototype and, based on it, to carry out a thorough risk assessment.
(8) Based on the results of the risk assessment, to adopt passive safety measures, such as the isolation of the equipment from the surrounding area,
(9) Still based on the risk assessment, to install continuously devices able to measures all the critical operational parameters, and to use them to develop an integrated preventing and mitigating systems.
(10) To ensure a safety governance system at universities, able to guarantee the safety throughout the operative life of the installation, even if this is of an experimental, temporary nature.
(11) Learning from previous incidents is crucial. The two previous prototypes had experienced incidents which where not properly elaborated in an improved design.

After three incidents at three different prototypes, the university decided to discontinue operation of the prototype, and a commercial hydrogen production system was used to supply the hydrogen refuelling station.