Fire when refilling a cylinder at a hydrogen storage facility

While filling a 9 litre gas cylinder with pressurised hydrogen in the hydrogen storage area, a blast occurred which destroyed the low pressure gauge, followed by a jet fire which damaged the surface of the cylinder.
The cylinder to be filled, including pressure gauge and control system, had been provided by a third party. Its nominal pressure was 35 MPa, however the maximal pressure of this filling would have been much lower, less than 20 MPa, corresponding to the maximal pressure of the bulk storage available.
The pressure regulator system at the inlet of the cylinder consisted of a classic setup with a needle valve able to control the gas flow, and two pressure gauges for the high pressure (storage side) and low pressure (cylinder outlet). The blast occurred when the cylinder was approximately at 8 MPa, destroying the low-pressure gauge. The hydrogen started leaking through the damaged gauge, ignited forming a jet flame directed downwards, melting the plastic protective external layer of the gas cylinder, and probably starting damaging the carbon-reinforced epoxy layer of the cylinder.

The INITIATING CAUSE was the release and ignition of hydrogen during the filling of a small cylinder.

The reason for the leak was the catastrophic failure of the pressure regulator, which created a direct connection between the high- and the low-pressure sections. How this could happen has never been clarified by the producer of the regulator or the producer of the tank assembly. It was suspected that the regulator was affected by a design weakness or a bad quality control.

The ignition cause was mostly likely the electrostatic sparks generated by the metallic and glass debris produced by the mechanical failure of the pressure gauge. Other possible cause could be friction of the gas high flow through the gauge pipe.

The ROOT CAUSE was the execution of an unplanned operation not covered by a specific procedure informed by a proper risk assessment. This a shared responsibility of (1) the management, which failed in supervision of technicians and in enforcing the general rules, and of (2) the technician, who decided to execute the anomalous operation without informing superiors and the safety department, and without respecting the site rules.

Pressure control system, pressure gauge, type-4 cylinder

The filling of the tank occurred upon request of a customer. It was not part of the routine operation of the laboratory. Two fillings of the same type had already been performed in the previous weeks, without any remarkable difficulty.

The technician executing the filling had a light disturbance to the ears for some days, du to the blast overpressure noise.

The operation which brought to the incident was not part of the normal practices and not covered by a proper risk assessment and the safety measures put in place for the laboratory operation. The filling of small cylinders had been done regularly before, but the set-up was simpler, there was no pressure regulator between the bundled and the cylinder to be filled, the operation was naturally ending when the pressure difference between the bundles and the cylinders had reached 20 MPa. The cylinders involved in this incident were of a different type, and the usual practice had to be modified. On top of that, they belonged to a third party, who had not provided any technical information.

The technician involved in the incident was a very experienced operator and acted effectively to reduce escalation. Nevertheless, the incident revealed the difference between theoretical knowledge of the possible risks and consequences, and the practical realisation of the same.

Three lessons are worth a mention:
(1) The technician did not feel the need to discuss before hands within the team and his superiors the new activity, despite safety aspects of the experimental activities were a fixed point on the agenda of weekly team meetings. An over-confidence in its own experience on previous operations. Several previous fillings were without incidents; however, set-up and hardware were not the same.
(2) the possible existence of a completely transparent hydrogen flame was not considered as a possibility by the technician at the start of the chain of events. He realised this possibility only when he ‘felt’ by hand a high temperature on the pressure regulator and saw the development of fumes on the tank. In the first instance after the explosive failure of the pressure control and pressure gauge, he did not realise the nature of eh emergency.
(3) After the sudden rupture of the pressure control system on the cylinder, the technician moved to the control panel of the storage facility, installed at the wall behind the cylinders bundles. In this way, he stopped the flow and avoid that the whole content of the hydrogen bundles would feeding the fire, avoiding further escalation. However, he exposed himself to high risk to be involved, ‘trapped’ between the wall and the hydrogen flame, instead of stepping away of the facility and moving to a safe distance, as the emergency rules require.

(1) The safety measures in place in the storage facility have been thoroughly reviewed, including the standard connection procedures.
(2) A basic training was provided on compressed gases handing, including how to deal with pressure reduction devices, not only to technician directly involved with hydrogen, but to all technicians on site. A list of additional, more advanced and more specific exercises has been collected and sent for prioritisation to the training officer.
(3) The refilling of bottles provided by customers and for customers’ use has been prohibited at the storage facility. The reason is that it is impossible to independently control and assess the quality of the components delivered, often manufactured by different 1st and 2nd Tier producers and assembled by customers.
(4) For the regular use of hydrogen by G.I.4 laboratory, other, safer solutions shall be used (for example the delivery of already filled cylinders with the required size by a contractor).
(5) The possibility of filling hydrogen cylinders at the storage facility for JRC-internal purposes will be maintained, but it will remain a ‘special’ operation, to be executed ad-hoc, when special circumstances requires it.
(6) Therefore, a dedicated Task Instruction document will be prepared beforehand for the activity at (5), describing in detail the series of actions required. Only components will be used certified according to the European Pressurised Equipment Directive. The Control Panel will be also placed in the most favourable place to facilitate a quick evacuation.
(7) The Task instruction will explicitly mention that the filling can only be performed by directly connecting the hydrogen storage system to the receiving cylinder by means flexible connector (cascade filling), without the use of pressure regulator or other pressure conditioning systems.