Because the bottle was located outside at the time of the event, and the hydrogen did not find a source of ignition while venting through the relief valve, nothing serious happened. The failed regulator was replaced and operations continued. However, if this had happened indoors or an otherwise enclosed space, the outcome could have been much worse.

The installed pressure relief valve and the small size of the orifice in the regulator (although allowing high-pressure gas to the low-pressure side of the regulator the mass flow rate is rather low) should be adequate protection of the rest of the system.

The key aspects of what can be learned from this near-miss can be emphasized as follows:

1. A regulator is not a safety device. Without additional protection, downstream components can be exposed to pressures exceeding the set pressure up to the full bottle pressure. If items downstream of the regulator are not rated for full bottle pressure, it is recommended that protection be added to the system.
2. Pressure relief device discharges need to be routed to a safe location. In the event of a pressure relieving event, it is important for the flow to be directed away from personnel, preferably such that the shut-off valve can be accessed safely.
3. Adequate ventilation is an important consideration in the layout of a compressed gas system. Inert gases (as potential asphyxiants), toxic and flammable gases can pose a significant hazard if not properly ventilated.

As stated on the MSDS and also on the container labels, LiAlH4 should be handled under argon. LiAlH4 is advertised and sold as a powder. If the researcher had to scrape it out of the jar, then it was no longer a powder, which seems indicative of past reaction that may have been due to exposure to atmospheric moisture.

The manufacturer stated that they do not have any first-hand data suggesting that friction alone could cause ignition. All of their handling of LiAlH4 is performed inside a glove bag under an argon atmosphere, so they have never had a fire during the packaging process. They recommend handling LiAlH4 under argon in a glove box or glove bag to minimize oxygen and moisture contact and, therefore, minimize the chance of a fire.

The university ES&H department did some searching online and found several relevant websites that provide confirmation that friction alone in the presence of air may be able to ignite LiAlH4.

http://cameochemicals.noaa.gov/chemical/989

http://www.chemicalbook.com/ChemicalProductProperty_EN_CB7318252.htm

http://www.erowid.org/chemicals/dmt/dmt_synthesis1.shtml (scroll down to step 3)

http://web.princeton.edu/sites/ehs/labsafetymanual/cheminfo/lah.htm

Since the university has adopted the following standard operating procedures, there has not been a reoccurrence of this type of incident:

1. Only non-metal spatulas are to be used with metal hydrides.
2. All work with metal hydrides must be done under an inert gas atmosphere (either argon or nitrogen).

During charging, most batteries will off gas hydrogen, making adequate ventilation and the elimination of ignition sources critical attributes of the charging area. Data from the battery manufacturer should be consulted to determine appropriate ventilation requirements for the specific battery being used.

In the future, the battery compartment on the boat will be ventilated to prevent another incident from occurring.

1. Include the tanks in a regular inspection program. Evaluate their condition and replace if necessary.
2. Fill the tanks only half full with leach material.
3. Keep the material completely submerged in solution.
4. Install a fiberglass grating on top of light material to keep it submerged.

1. The trailer involved in the incident used a frangible burst disk based upon the proprietary metal compound designated as Inconel #600. Random sampling of similar pressure relief devices from the same trailer showed that all of them failed at pressures below design specification, indicating that all were adversely affected by exposure to the combination of stresses and the product lading (hydrogen). Examination of all other hydrogen trailers in the supplier's fleet confirmed that different (Carpenter 20-based) pressure relief devices were in service.

2. There has been no specific industry guidance on the type of pressure relief device materials in terms of their metallurgical makeup, but only the pressure ratings associated with the DOT rating of the tubes to which they are attached. This is based upon 5/3 of the marked DOT service pressure of the tube (e.g., 2400 psi tube X 5 ÷ 3 = 4000 psi pressure relief device rating).

3. The cause of the frangible disk failure was an anomaly. All frangible disks on the trailer were replaced. Prior to placing tube trailer back into hydrogen service, all tube trailer appurtenances were examined for leaks using nitrogen at two succeeding pressures and standard leak detection fluid. A third and final examination was performed at full settled pressure before releasing the tube trailer back into hydrogen service.

LESSONS LEARNED:

1. Compressed gas cylinder caps can be very difficult to open as rust often occurs in the threads.
2. There are wrenches specifically designed to remove compressed gas cylinder caps. The lab had such a wrench and it was the one used by staff at the time of the incident. (See attached photos.)
3. The wrench designed for the cylinder caps is short and often does not provide enough leverage to easily open the cylinder caps. Staff indicated that they often reverse the wrench, pushing it through one of the cylinder cap openings to gain additional leverage on cylinder cap lids. They indicated this was a common practice with exceptionally difficult cylinder cap lids and they did not believe it could interfere with the cylinder valve.
4. The training program did not prohibit using the valve cap wrench in the manner it was used.
5. The cylinder was empty when it was received by the hydrogen supplier. The valve and pressure relief device did not show any leaks when the cylinder was pressurized with helium. The supplier believes that on the day of the incident, the cylinder valve was bumped open with the wrench used to remove the cap.
6. Other laboratory staff noted that they only heard part of the page to evacuate the lab due to background noise in their labs, but they did evacuate immediately anyway.
7. The company maintains written descriptions of how to safely handle compressed gas cylinders in their job safety analysis sheets and their safe work practices handbook. Neither reference prohibited the valve cap wrench being used in the manner it was.
8. Visual inspection of the analytical lab was done to confirm that all staff had exited the laboratory, but formal written accountability was not conducted.
9. Facilities staff determined that it was not possible to adjust air flow within the analytical lab from outside the lab because all the controls are located inside the lab.

CORRECTIVE ACTIONS:

1. Obtain different wrench that provides adequate torque on cylinder cap, but cannot interfere with valve.
2. Train staff on how to use new wrench.
3. Have staff loosen cylinder caps outside of the building before bringing the cylinder into the lab.
4. Install cylinder station outside of the building to hold cylinders with difficult-to-open cylinder caps.
5. Update job safety analysis sheet to reflect new cylinder handling procedures.
6. Emergency pages should be made twice. For any event that could lead to a fire or explosion, staff should immediately evacuate the area and pull the closest fire alarm box.
7. Share lessons learned with other facilities.
8. Reinforce with staff the need to check offices, conference rooms, and rest rooms as they are evacuating to ensure that all staff are aware of the emergency.
9. Reinforce with incident commanders the need to ensure that formal written accountability is taken during an emergency.
10. Investigate the feasibility of relocating critical building controls outside of the analytical lab.

1. Increase physical protection, shielding, and securing of transported hydrogen tube valves, piping, and fittings from multi-directional forces that are likely to occur during accidents, including rollovers. Reference: 49 Code of Federal Regulations [CFR] 173.301.

2. Provide training to emergency responders on the unique chemical and flammability properties of hydrogen, including its nearly invisible flame during daylight hours and its tendency to rise quickly since it is 14 times lighter than air.

1. Upgrade the liquid hydrogen pump control system to shut down operation of the pump and protect the system when malfunctions like leaks, pump cavitation, or loss of purge gas occur.
2. Verify that maintenance procedures used for liquid hydrogen systems meet the requirements of the manufacturer. Ensure that personnel performing maintenance have the necessary training to work on liquid hydrogen pumps. Ensure that liquid hydrogen pump maintenance procedures are in the training system and that work performed is documented in the maintenance system.
3. Install an hour meter in pump systems to ensure that maintenance can be performed based on hours of service instead of on a fixed schedule. Program the recommended maintenance interval into the maintenance system.
4. Communicate the incident to all company team members through the safety bulletin and discussions at safety meetings/conference calls.
5. Share best practices with other company entities that have liquid hydrogen pumping installations. Send this report to other company entities operating or installing this type of equipment.
6. Make changes required by the fire department to resume operation and have drawings approved by state PE.
7. The operator’s quick response and training of emergency shutdown procedures at this facility prevented this from developing into a much larger and more serious incident.
8. Remember that gaseous hydrogen typically propagates much faster in air than cold liquid hydrogen. Cold liquid hydrogen has a density near air and instead of dissipating up quickly, it may propagate more slowly from the source of the leak. In this incident, the cold liquid hydrogen remained near ground level until it was warmed by the surrounding conditions.

1. It is important to understand the requirements and standards associated with safe equipment design (especially electrical equipment containing an internal ignition source with flammable gas) in potentially explosive atmosphere environments. Misinterpretation of requirements and standards can lead to serious consequences. If the application of a standard is not fully understood, it is advisable to contact the author of the standard to remove any misunderstanding and not try to interpret the rules.
2. Gas detection instrument location is critical to proper functioning. Light gases like hydrogen rise in air, and gas detection needs to be at the high point in the potential source area so that even small leaks can be detected. Various alarm/action thresholds below the lower flammability limit (LFL) of the flammable gas give additional warning of a possible problem in the event of a gas leak. The following is a summary of how equipment involved in this incident should have been installed.
3. The gas chromatograph should not be installed in a sealed cabinet, but should follow explosive atmosphere design standards to have forced ventilation with a minimum flow rate of 12 times the cabinet volume per hour and to exhaust outside the building. With this change, the analysis room can remain in its current configuration and it does not fall under the explosive atmosphere regulations.
4. The fixed gas detector must be installed in the cabinet sealed volume, and must comply with explosive atmosphere regulations. The gas detector must be connected to an interlock system and set with two threshold levels; the first at 25% of the LFL (which sends an alarm) and the second at 50% of the LFL (which closes the hydrogen isolation safety valve). For this gas detector, the 100% LFL threshold level is set at 4% hydrogen in air.
5. To minimize the consequences of a possible leak of hydrogen inside the cabinet, it is recommended that the hydrogen isolation safety valve be installed outside the analysis room.
6. The explosive atmosphere regulations also require the installation of a door switch that stops the supply of electricity and flammable gases whenever the door is opened (for example, when performing maintenance). This door switch limits the risk of creating an explosive atmosphere in the room that is not regulated under explosive atmosphere standards.

1. Management must ensure that operating decisions are not based primarily on cost and production. Performance goals and operating risks must be effectively communicated to all employees. Facility management must set safe, achievable operating limits and not tolerate deviations from these limits. Risks of deviation from operating limits must be fully understood by operators. Also, management must provide an operating environment conducive for operators to follow emergency shutdown procedures when required.

2. Process instrumentation and controls should be designed to consider human factors consistent with good industry practice. Hydroprocessing reactor temperature controls should be consolidated with all necessary data available in the control room. Some backup system of temperature indicators should be used so that the reactors can be operated safely in case of instrument malfunction. Each alarm system should be designed to allow critical emergency alarms to be distinguished from other operating alarms.

3. Adequate supervision is needed for operators, especially to address critical or abnormal situations. Supervisors need to ensure that all required procedures are followed. Supervisors should identify and address all operating hazards and conduct thorough investigation of deviations to determine root causes and take corrective action. Equipment and job performance issues related to operating incidents should be corrected by management.

4. Facilities should maintain equipment integrity and discontinue operation if integrity is compromised. Hydroprocessing operations especially need to have reliable temperature monitoring systems and emergency shutdown equipment. Equipment should be tested regularly and practice emergency drills should be held on a regular basis. Maintenance and instrumentation support should be available during start up after equipment installation or major maintenance.

5. Management must ensure that operators receive regular training on the unit process operations and chemistry. For hydrocrackers, this should include training on reaction kinetics and the causes and control of temperature excursions. Operators need to be trained on the limitations of process instruments and how to handle instrument malfunctions. Facilities need to ensure that operators receive regular training on the use of the emergency shutdown systems and the need to activate these systems.

6. Management must develop written operating procedures for all phases of hydrocracker operations. The procedures should include operating limits and consequences of deviation from the limits. The procedures should be reviewed regularly and updated to reflect changes in equipment, process chemistry, and operation. As appropriate, the procedures should be updated to include recommendations from process hazard analysis and incident investigations.

7. Process hazard analysis must be based on actual equipment and operating conditions that exist at the time of the analysis. The analysis should include the failure of critical operating systems, such as temperature monitors or emergency operating systems. A Management of Change review should be conducted for all changes to equipment or processes, as necessary, and should include a safety hazard review of the changes.

More information on management of change can be found in the Lessons Learned Corner and also in the Hydrogen Safety Best Practices Manual.

1. Incorporate external operating experience lessons learned into site program controls. Other nuclear plants had similar strand failures and back-of-core issues that were not evaluated for impact on procedures or system/component health plans.
2. Be more sensitive to precursor indications of declining system/component health; in this case the main generator. Insensitivity resulted in material condition deficiencies and elevated risks to generation that are undesirable given the economic importance of this high-value asset.
3. Follow OEM and industry recommendations for component (stator) preparation for testing and lay-up.
4. Have a detailed component (generator) Life-Cycle Management Plan.

Additional details regarding probable causes and lessons learned can be found in Attachment 2.

The following corrective actions have been taken:

• The non-return valve was dismantled, cleaned, and tested. Following positive testing, the system was restarted and pressurized without any further malfunctioning.
• The hydrogen discharge pipe was extended from the low roof of the compressor building (2.5 m) to the higher roof of a neighboring building (6 m). With this modification, any potential hydrogen ignition would occur at approximately 6 meters from ground, farther from personnel than the 2.5 meters of the previous situation.
• The compressor was sent to the manufacturer for preventive maintenance in order to lower the frequency of component malfunctioning.
• Plans for regular maintenance of the non-return valve will be recorded in the next revision of the Design and Safety Report.
• A flame arrestor was purchased and mounted at the end of the exhaust pipe on top of the building.

1. Specific response drills/exercises need to be conducted yearly. In this case, all safety systems worked as they should and outside emergency responders were not needed.
2. Performing other tasks while filling hydrogen tube trailers, such as mechanic work, should be avoided. Most premature failures of hydrogen tube trailer PRD burst discs occur during the fill process.
3. Grounding, as was done in the incident, should always be done during hydrogen filling. However, even when the fill vessel is grounded, it is not unusual for a hydrogen release to immediately ignite.
4. The facility safety deluge water system should be checked periodically for coverage. In this case, a water cannon was a little off target from the last time it was operated and has now be repositioned and stabilized to ensure that it does not move in the future.
5. Emergency responders assumed that adjacent tube trailers were heating up from single-cylinder vent flare as a 300°F (149°C) reading was obtained with a thermal device. This slightly delayed the closing of the cylinder isolation valves on the tube trailer. After-incident investigation found no paint discolored or burnt, so the temperature taken by the emergency responders was likely near the flaming vent discharge point.
6. Securing hydrogen fill valve(s) at the back of the tube trailer was not dependent on the temperature at the vent stack, as this area was covered by deluge nozzles and located 40 feet (12.2 meters) away from the vent stack.
7. Media involvement and resulting speculation can portray a situation as being much worse than it actually is.

1. Evaluate any change in normal procedures or conditions for storage of aluminum hydride products. In this case, the aluminum hydride material was typically stored at -35°C in the glove box freezer. However, due to a change in glove boxes, this was no longer an option. Since commercially available aluminum hydride compound is shipped in glass bottles at room temperature, it was assumed that this was considered safe handling. The vial was stable for 6 weeks before the near miss occurred.

2. Limit aluminum hydride materials to small quantities as needed for immediate use. Larger samples have the potential to caused more damage.

3. Do not store aluminum hydride materials for extended periods of time and promptly dispose of any remaining material after use.

4. In-process aluminum hydride material should be stored at lower temperatures (i.e., in a freezer) and in an air-free contained environment (i.e., inside an air-free glove box) to reduce or slow decomposition into volatile materials (e.g., hydrogen, aluminum metal, and similar). In this case, if the aluminum hydride material had been stored in air, it is likely that a fire may have started.

5. Store aluminum hydride material in plastic containers instead of sealed glass containers to avoid catastrophic failure of containment. In this case, it is likely that the decomposition process of the aluminum hydride compound slowly built up pressure sufficient to destroy the glass vial.

Additional discussion about working with reactive metal-hydride materials in the laboratory can be found in the Lessons Learned Corner on this website and in the Hydrogen Safety Best Practices Manual.

The packing in the flow control valve should be replaced periodically. A planned investigation will determine the optimum time period for packing replacement.

1. Inadequate Safeguards - The system was designed with low-point drains to facilitate water removal, however, these were found to be inadequate in both location and size. The fact that the mixed feed pre-heat coil was not self-draining was unknown prior to the incident. After a thorough review of the entire reformer furnace feed system was completed, existing drains were increased in size and others added to ensure that the entire feed system could be drained.
2. Inadequate Procedure - The startup procedure did not account for a startup of a cold furnace with no hold points for catalyst reduction or refractory dry out. As a result, the time to reach the critical "steam in" temperature of 350°C (662°F) was short as compared to previous startups. Also, the procedure provides little direction for confirming that the reformer furnace feed system is dry. Modifications to the procedure were completed that included a longer heat-up period, the addition of more detailed guidance for verifying that the feed system is dry, and a formal sign-off by both operations and engineering personnel. Also, a separate cold-eyes review by external experts was completed as part of the pre-startup safety review.
3. Lack of Change Management - a. The startup procedure had two hold points for refractory dry out and new catalyst reduction during the heat-up phase prior to introducing the 4.1 mPa (600 psig) startup steam. These hold points were not utilized, since it appeared that neither was required. Consequently, the heat-up cycle was artificially shortened. It became apparent that this alteration to the startup sequence was not viewed as a change by operations. Several sections of the procedure were not performed, since they did not apply to this startup. b. Shutdown and startup procedures are designed to take a unit from safe operation to a zero energy state and then return it to safe operation. Changing these sequences by an intentional omission is a change and must be properly assessed for risk. The decision to leave some steam flow in the steam-generating system for this winter shutdown was made to keep the system warm and prevent freezing. However, no formal risk assessment was performed and no management of change (MOC) was generated. A risk assessment was performed prior to the startup, but the change in status of the steam system was not evaluated. In fact, the decision to leave steam in was seen as a safeguard from the risk of freezing. This provided an opportunity for water to accumulate upstream of the reformer furnace.
4. Non-essential Personnel - At the time of the incident, there were seven people on the furnace structure. Only the operations personnel were essential. Changes have been made to ensure that non-essential personnel are cleared from the area during startup activities.

More information on management of change can be found in the Lessons Learned Corner and also in the Hydrogen Safety Best Practices Manual.

The following recommended actions were identified:

1. Reemphasize the current lab management policies and practices on how process changes are evaluated for direct/indirect impacts on the process.
2. Reinforce with lab workers the expectations for bringing issues and concerns to management's immediate attention for evaluation of reporting needs.
3. Increase the purge gas flow rate to ensure complete purging of the system.
4. Extend the inert gas purging time of the reactor system before the run and use oxygen chemical indicator strips to indicate the quality of inert atmosphere in the enclosed system.
5. After the run, extend the inert gas purging time of the installed glove bag above the chamber lid and use a high purge gas flow rate.
6. Use oxygen chemical indicator strips to indicate the quality of inert atmosphere in the glove bag before opening the collection chamber.

The importance of purging hydrogen piping and equipment is discussed in the Lessons Learned Corner on this website.

Additional discussion about working with reactive metal-hydride materials in the laboratory can be found in the Lessons Learned Corner on this website and in the Hydrogen Safety Best Practices Manual.

1. All samples with potential for hydrogen buildup should be limited to ground shipment only. (This shipment was by ground and air. If this incident were to have happened in an airplane, the consequences may have been worse.)

2. All samples must be properly labeled before shipping. Hazard label warnings need to be located on the outside of the shipment package.

3. The following safety information should be included with the shipment: the material safety data sheet (MSDS), applicable standard operating procedures (SOPs), and detailed information for the safe handling of the materials.

4. Improper labeling can result in improper handling and storage. Lack of proper labels allowed the sample to be delivered to an office rather than a laboratory, where the material can be properly handled and stored in an approved location.

5. For hazardous material shipments, do not ship material in quantities beyond what is needed by the receiver. Lesser material quantities lead to reduced risks in the event of a failure. In this incident, the analysis only required 0.1-0.2 gram of material, but 5 grams of the material were shipped. The receiver suggests that future sample sizes for this analysis be limited to a maximum of 0.5 gram (10% of what was shipped in this incident).

6. Samples that have the potential for hydrogen generation should use a pressure-rated container with the following features:

    a.  Head space to contain the maximum possible gas release from the sample below the container's maximum safety pressure limit.

    b.  Pressure relief mechanism (such as a release valve) that can be slowly opened within a glove box to safely equalize any pressure build-up.

    c.  Outer shell capable of containing any flying debris. A secondary metal container outside the pressure-rated container is suggested as a possible solution for containing potential flying debris.

7. Sealed glass containers should not be used to store samples that could generate pressure over time. These types of glass containers are not rated for pressure. Capped glass vials, bottles, or metal cans are alternate options to consider.

8. Safe transport and handling procedures for these types of materials need to be followed. The receiver requested that all shipments from the shipper of this sample be stopped until safety concerns from this incident are addressed.

9. Store these types of materials in proper approved storage. MSDSs should be available either locally or at a central location.

10. If a sample shipment lacks proper documentation, treat it as potentially hazardous until proper documentation is obtained.

11. DO NOT become comfortable with handling these types of aluminum hydride materials. Routine handling of these samples without problems can lull users into shortcuts that could result in more damaging results than this incident. If this incident had happened with personnel present, there was a potential for personnel injury.

Additional discussion about working with reactive metal-hydride materials in the laboratory can be found in the Lessons Learned Corner on this website and in the Hydrogen Safety Best Practices Manual.

1. A hydrogen tube pressure indication system needs to be developed that is robust enough to withstand an accident, indicates hydrogen pressure regardless of valve position, and would be visible from a safe distance during an accident situation. Hydrogen system pressure is very important in determining incident response actions. Centralizing the system pressure indicators on a highly visible information panel located in a protected area of the hydrogen cylinder package is a possible solution to increase visibility.
2. Hydrogen valves should have a visible means to show that they are in the closed position. A highly visible lock or pin that can only be used when the valves are closed may help guarantee valve closure prior to transport. If the valve positions are visible, an operating procedure could be added that requires a final valve line-up check just prior to transport trailer departure.
3. Hydrogen cylinders grouped together and secured for transport as packaged assemblies should be designed for potential accident conditions. The package tie-down system should be designed with adequate safety margins to assure that hydrogen cylinder packages remain secured to the transport trailer under adverse conditions. However, the package design should assume that the package might fall from a moving transport vehicle and impact the ground, but the hydrogen cylinders should still be contained within the package. A program to test hydrogen cylinder packages under hypothetical accident conditions would be useful for developing designs that could be certified to survive potential accident conditions.

1. Increased structural protection is needed at the back of a hydrogen tube trailer to protect the vulnerable hydrogen systems components in this location (valves, pressure-indicating devices, manifolds, piping) in case of an accident. Side protection is especially important.
2. A system of designated lifting features is needed on hydrogen tube trailers to aid in accident recovery operations if the trailer is overturned or requires lifting. Typically, these types of accidents require the use of a crane for moving and lifting hydrogen tube trailers using lifting devices like slings. These lifting features should be designed to lift the hydrogen tube trailer with a full load of hydrogen cylinders and located at protected points. The current method for tube trailer lifting using slings around the hydrogen tube trailer at undefined locations and assumed centers of gravity is more hazardous and less safe.