Based on the results of the company investigation and analysis of an amateur video, the company determined that the incident could have been caused by the failure of one of the following plant components:
· pipes leading to the reactor pressure gauges
· the recycled quench gas pipe at the bottom of the reactor
· the diathermic oil pipe (hot oil) entering or exiting the heat exchanger
· the heat exchanger flanged joints and connection lines.

The company determined that a release from the hot oil circuit could not have triggered the fire, based on the evidence from the pressure data in the circuit, which showed that the failure occurred 30 minutes after the fire started. The video confirms the pipe rupture 30 minutes after the fire began. For the same reason, a release from the hydrogen pipes is not considered likely, as the records demonstrate that the hydrogen pipe failed seven minutes after the fire began. When the heat exchanger flanged joints were dismantled, it was seen that the joint gaskets were not damaged. Thus, the company considers the failure of a pipe from the reactor pressure measurement gauges to be the most likely cause of the accident (although there is no conclusive evidence to identify the specific failure that caused the pipe to rupture). This assumption is supported by the following facts:
· This pipe is located in the area corresponding to the epicenter of the fire.
· The area corresponds to the area visually identified by the witnesses.
· The product release (hydrogen and fuel oil) from one of these pipes can cause a 6-meter long jet flame, as occurred.
· The product supposedly released would have had a high enough temperature and pressure to self-ignite or ignite against a plant hot spot (e.g., the hot oil circuit).
· The damages recorded were caused by overheating (flame exposition) and were not caused by overpressure or explosion. The pressure measurement records confirm no significant pressure changes at the beginning of the event.

The company decided to rebuild the hydrotreatment plant, in compliance with regulations, and to introduce the following process design changes:
· complete separation of the light fuel oil section and the heavy fuel oil section to avoid the possibility of "domino effects"
· lowering the maximum height of the heat exchanger installations from 25 meters to 15 meters to facilitate fire-extinguishing operations
· redesign of the piping system to minimize adjacencies
· relocation of the valves on the hydrogen quench line to enable depressurization
· reduction of the number of measurement gauges
· insertion of valves in a safe area for depressurizing the hot oil circuit.

The root cause of the fire that burned the evaporator pad and distorted the plastic evaporator pad bracket remains unknown. The initial investigation did not reveal any obvious signs of an ignition source in the vicinity of the forklift operation. The on-board data acquisition system did not indicate any abnormalities in the operating parameters of the fuel cell system (e.g., temperature, pressure, voltage, current). The fuel cell was disassembled, but no evidence was found of any electrical shorts or other potential ignition sources. Thus it was concluded that the fuel cell unit itself was not the ignition source for this incident.

One theory presented the possibility of a spark (caused by static electricity) being the source of the ignition that caused the fire. Due to the proximity of the fuel cell unit to a shrink-wrap packaging machine at the time of the incident, this seemed to be a plausible hypothesis. However, sparking tests on evaporator pad materials failed to confirm this, and it seems highly unlikely that a wet evaporator pad would ignite from static electricity. The true ignition source for this incident remains unknown.

After the initial investigation, the company used a hydrogen meter to monitor hydrogen levels near the evaporator pad during fuel cell start-up (which they expected to be the highest, due to a system purge). They also wanted to investigate if hydrogen could become trapped near the vent covering the evaporator pad. The tests indicated hydrogen levels well below the lower flammability limit (0.022%). Similar readings were also detected from the exhaust on the other make/model fuel cells operating in the facility. They detected no sign that high levels of hydrogen were trapped near the vent of any fuel cell make/model.

It appears that this was an isolated event caused by human error. The lessons learned are: (1) to caution workers to maintain their focus during fuel cell stack assembly, (2) to require verification that all tools and spare parts are accounted for prior to closing up the system, and (3) to review quality control procedures and assembly procedures with an eye toward improvement.

Because the bottle was located outside at the time of the event, and the hydrogen did not find a source of ignition while venting through the relief valve, nothing serious happened. The failed regulator was replaced and operations continued. However, if this had happened indoors or an otherwise enclosed space, the outcome could have been much worse.

The installed pressure relief valve and the small size of the orifice in the regulator (although allowing high-pressure gas to the low-pressure side of the regulator the mass flow rate is rather low) should be adequate protection of the rest of the system.

The key aspects of what can be learned from this near-miss can be emphasized as follows:

1. A regulator is not a safety device. Without additional protection, downstream components can be exposed to pressures exceeding the set pressure up to the full bottle pressure. If items downstream of the regulator are not rated for full bottle pressure, it is recommended that protection be added to the system.
2. Pressure relief device discharges need to be routed to a safe location. In the event of a pressure relieving event, it is important for the flow to be directed away from personnel, preferably such that the shut-off valve can be accessed safely.
3. Adequate ventilation is an important consideration in the layout of a compressed gas system. Inert gases (as potential asphyxiants), toxic and flammable gases can pose a significant hazard if not properly ventilated.

As stated on the MSDS and also on the container labels, LiAlH4 should be handled under argon. LiAlH4 is advertised and sold as a powder. If the researcher had to scrape it out of the jar, then it was no longer a powder, which seems indicative of past reaction that may have been due to exposure to atmospheric moisture.

The manufacturer stated that they do not have any first-hand data suggesting that friction alone could cause ignition. All of their handling of LiAlH4 is performed inside a glove bag under an argon atmosphere, so they have never had a fire during the packaging process. They recommend handling LiAlH4 under argon in a glove box or glove bag to minimize oxygen and moisture contact and, therefore, minimize the chance of a fire.

The university ES&H department did some searching online and found several relevant websites that provide confirmation that friction alone in the presence of air may be able to ignite LiAlH4.

http://cameochemicals.noaa.gov/chemical/989

http://www.chemicalbook.com/ChemicalProductProperty_EN_CB7318252.htm

http://www.erowid.org/chemicals/dmt/dmt_synthesis1.shtml (scroll down to step 3)

http://web.princeton.edu/sites/ehs/labsafetymanual/cheminfo/lah.htm

Since the university has adopted the following standard operating procedures, there has not been a reoccurrence of this type of incident:

1. Only non-metal spatulas are to be used with metal hydrides.
2. All work with metal hydrides must be done under an inert gas atmosphere (either argon or nitrogen).

During charging, most batteries will off gas hydrogen, making adequate ventilation and the elimination of ignition sources critical attributes of the charging area. Data from the battery manufacturer should be consulted to determine appropriate ventilation requirements for the specific battery being used.

In the future, the battery compartment on the boat will be ventilated to prevent another incident from occurring.

1. Include the tanks in a regular inspection program. Evaluate their condition and replace if necessary.
2. Fill the tanks only half full with leach material.
3. Keep the material completely submerged in solution.
4. Install a fiberglass grating on top of light material to keep it submerged.

1. The trailer involved in the incident used a frangible burst disk based upon the proprietary metal compound designated as Inconel #600. Random sampling of similar pressure relief devices from the same trailer showed that all of them failed at pressures below design specification, indicating that all were adversely affected by exposure to the combination of stresses and the product lading (hydrogen). Examination of all other hydrogen trailers in the supplier's fleet confirmed that different (Carpenter 20-based) pressure relief devices were in service.

2. There has been no specific industry guidance on the type of pressure relief device materials in terms of their metallurgical makeup, but only the pressure ratings associated with the DOT rating of the tubes to which they are attached. This is based upon 5/3 of the marked DOT service pressure of the tube (e.g., 2400 psi tube X 5 ÷ 3 = 4000 psi pressure relief device rating).

3. The cause of the frangible disk failure was an anomaly. All frangible disks on the trailer were replaced. Prior to placing tube trailer back into hydrogen service, all tube trailer appurtenances were examined for leaks using nitrogen at two succeeding pressures and standard leak detection fluid. A third and final examination was performed at full settled pressure before releasing the tube trailer back into hydrogen service.

LESSONS LEARNED:

1. Compressed gas cylinder caps can be very difficult to open as rust often occurs in the threads.
2. There are wrenches specifically designed to remove compressed gas cylinder caps. The lab had such a wrench and it was the one used by staff at the time of the incident. (See attached photos.)
3. The wrench designed for the cylinder caps is short and often does not provide enough leverage to easily open the cylinder caps. Staff indicated that they often reverse the wrench, pushing it through one of the cylinder cap openings to gain additional leverage on cylinder cap lids. They indicated this was a common practice with exceptionally difficult cylinder cap lids and they did not believe it could interfere with the cylinder valve.
4. The training program did not prohibit using the valve cap wrench in the manner it was used.
5. The cylinder was empty when it was received by the hydrogen supplier. The valve and pressure relief device did not show any leaks when the cylinder was pressurized with helium. The supplier believes that on the day of the incident, the cylinder valve was bumped open with the wrench used to remove the cap.
6. Other laboratory staff noted that they only heard part of the page to evacuate the lab due to background noise in their labs, but they did evacuate immediately anyway.
7. The company maintains written descriptions of how to safely handle compressed gas cylinders in their job safety analysis sheets and their safe work practices handbook. Neither reference prohibited the valve cap wrench being used in the manner it was.
8. Visual inspection of the analytical lab was done to confirm that all staff had exited the laboratory, but formal written accountability was not conducted.
9. Facilities staff determined that it was not possible to adjust air flow within the analytical lab from outside the lab because all the controls are located inside the lab.

CORRECTIVE ACTIONS:

1. Obtain different wrench that provides adequate torque on cylinder cap, but cannot interfere with valve.
2. Train staff on how to use new wrench.
3. Have staff loosen cylinder caps outside of the building before bringing the cylinder into the lab.
4. Install cylinder station outside of the building to hold cylinders with difficult-to-open cylinder caps.
5. Update job safety analysis sheet to reflect new cylinder handling procedures.
6. Emergency pages should be made twice. For any event that could lead to a fire or explosion, staff should immediately evacuate the area and pull the closest fire alarm box.
7. Share lessons learned with other facilities.
8. Reinforce with staff the need to check offices, conference rooms, and rest rooms as they are evacuating to ensure that all staff are aware of the emergency.
9. Reinforce with incident commanders the need to ensure that formal written accountability is taken during an emergency.
10. Investigate the feasibility of relocating critical building controls outside of the analytical lab.

1. Increase physical protection, shielding, and securing of transported hydrogen tube valves, piping, and fittings from multi-directional forces that are likely to occur during accidents, including rollovers. Reference: 49 Code of Federal Regulations [CFR] 173.301.

2. Provide training to emergency responders on the unique chemical and flammability properties of hydrogen, including its nearly invisible flame during daylight hours and its tendency to rise quickly since it is 14 times lighter than air.

1. Upgrade the liquid hydrogen pump control system to shut down operation of the pump and protect the system when malfunctions like leaks, pump cavitation, or loss of purge gas occur.
2. Verify that maintenance procedures used for liquid hydrogen systems meet the requirements of the manufacturer. Ensure that personnel performing maintenance have the necessary training to work on liquid hydrogen pumps. Ensure that liquid hydrogen pump maintenance procedures are in the training system and that work performed is documented in the maintenance system.
3. Install an hour meter in pump systems to ensure that maintenance can be performed based on hours of service instead of on a fixed schedule. Program the recommended maintenance interval into the maintenance system.
4. Communicate the incident to all company team members through the safety bulletin and discussions at safety meetings/conference calls.
5. Share best practices with other company entities that have liquid hydrogen pumping installations. Send this report to other company entities operating or installing this type of equipment.
6. Make changes required by the fire department to resume operation and have drawings approved by state PE.
7. The operator’s quick response and training of emergency shutdown procedures at this facility prevented this from developing into a much larger and more serious incident.
8. Remember that gaseous hydrogen typically propagates much faster in air than cold liquid hydrogen. Cold liquid hydrogen has a density near air and instead of dissipating up quickly, it may propagate more slowly from the source of the leak. In this incident, the cold liquid hydrogen remained near ground level until it was warmed by the surrounding conditions.

1. It is important to understand the requirements and standards associated with safe equipment design (especially electrical equipment containing an internal ignition source with flammable gas) in potentially explosive atmosphere environments. Misinterpretation of requirements and standards can lead to serious consequences. If the application of a standard is not fully understood, it is advisable to contact the author of the standard to remove any misunderstanding and not try to interpret the rules.
2. Gas detection instrument location is critical to proper functioning. Light gases like hydrogen rise in air, and gas detection needs to be at the high point in the potential source area so that even small leaks can be detected. Various alarm/action thresholds below the lower flammability limit (LFL) of the flammable gas give additional warning of a possible problem in the event of a gas leak. The following is a summary of how equipment involved in this incident should have been installed.
3. The gas chromatograph should not be installed in a sealed cabinet, but should follow explosive atmosphere design standards to have forced ventilation with a minimum flow rate of 12 times the cabinet volume per hour and to exhaust outside the building. With this change, the analysis room can remain in its current configuration and it does not fall under the explosive atmosphere regulations.
4. The fixed gas detector must be installed in the cabinet sealed volume, and must comply with explosive atmosphere regulations. The gas detector must be connected to an interlock system and set with two threshold levels; the first at 25% of the LFL (which sends an alarm) and the second at 50% of the LFL (which closes the hydrogen isolation safety valve). For this gas detector, the 100% LFL threshold level is set at 4% hydrogen in air.
5. To minimize the consequences of a possible leak of hydrogen inside the cabinet, it is recommended that the hydrogen isolation safety valve be installed outside the analysis room.
6. The explosive atmosphere regulations also require the installation of a door switch that stops the supply of electricity and flammable gases whenever the door is opened (for example, when performing maintenance). This door switch limits the risk of creating an explosive atmosphere in the room that is not regulated under explosive atmosphere standards.

1. Management must ensure that operating decisions are not based primarily on cost and production. Performance goals and operating risks must be effectively communicated to all employees. Facility management must set safe, achievable operating limits and not tolerate deviations from these limits. Risks of deviation from operating limits must be fully understood by operators. Also, management must provide an operating environment conducive for operators to follow emergency shutdown procedures when required.

2. Process instrumentation and controls should be designed to consider human factors consistent with good industry practice. Hydroprocessing reactor temperature controls should be consolidated with all necessary data available in the control room. Some backup system of temperature indicators should be used so that the reactors can be operated safely in case of instrument malfunction. Each alarm system should be designed to allow critical emergency alarms to be distinguished from other operating alarms.

3. Adequate supervision is needed for operators, especially to address critical or abnormal situations. Supervisors need to ensure that all required procedures are followed. Supervisors should identify and address all operating hazards and conduct thorough investigation of deviations to determine root causes and take corrective action. Equipment and job performance issues related to operating incidents should be corrected by management.

4. Facilities should maintain equipment integrity and discontinue operation if integrity is compromised. Hydroprocessing operations especially need to have reliable temperature monitoring systems and emergency shutdown equipment. Equipment should be tested regularly and practice emergency drills should be held on a regular basis. Maintenance and instrumentation support should be available during start up after equipment installation or major maintenance.

5. Management must ensure that operators receive regular training on the unit process operations and chemistry. For hydrocrackers, this should include training on reaction kinetics and the causes and control of temperature excursions. Operators need to be trained on the limitations of process instruments and how to handle instrument malfunctions. Facilities need to ensure that operators receive regular training on the use of the emergency shutdown systems and the need to activate these systems.

6. Management must develop written operating procedures for all phases of hydrocracker operations. The procedures should include operating limits and consequences of deviation from the limits. The procedures should be reviewed regularly and updated to reflect changes in equipment, process chemistry, and operation. As appropriate, the procedures should be updated to include recommendations from process hazard analysis and incident investigations.

7. Process hazard analysis must be based on actual equipment and operating conditions that exist at the time of the analysis. The analysis should include the failure of critical operating systems, such as temperature monitors or emergency operating systems. A Management of Change review should be conducted for all changes to equipment or processes, as necessary, and should include a safety hazard review of the changes.

More information on management of change can be found in the Lessons Learned Corner and also in the Hydrogen Safety Best Practices Manual.

1. Incorporate external operating experience lessons learned into site program controls. Other nuclear plants had similar strand failures and back-of-core issues that were not evaluated for impact on procedures or system/component health plans.
2. Be more sensitive to precursor indications of declining system/component health; in this case the main generator. Insensitivity resulted in material condition deficiencies and elevated risks to generation that are undesirable given the economic importance of this high-value asset.
3. Follow OEM and industry recommendations for component (stator) preparation for testing and lay-up.
4. Have a detailed component (generator) Life-Cycle Management Plan.

Additional details regarding probable causes and lessons learned can be found in Attachment 2.

The following corrective actions have been taken:

• The non-return valve was dismantled, cleaned, and tested. Following positive testing, the system was restarted and pressurized without any further malfunctioning.
• The hydrogen discharge pipe was extended from the low roof of the compressor building (2.5 m) to the higher roof of a neighboring building (6 m). With this modification, any potential hydrogen ignition would occur at approximately 6 meters from ground, farther from personnel than the 2.5 meters of the previous situation.
• The compressor was sent to the manufacturer for preventive maintenance in order to lower the frequency of component malfunctioning.
• Plans for regular maintenance of the non-return valve will be recorded in the next revision of the Design and Safety Report.
• A flame arrestor was purchased and mounted at the end of the exhaust pipe on top of the building.

1. Specific response drills/exercises need to be conducted yearly. In this case, all safety systems worked as they should and outside emergency responders were not needed.
2. Performing other tasks while filling hydrogen tube trailers, such as mechanic work, should be avoided. Most premature failures of hydrogen tube trailer PRD burst discs occur during the fill process.
3. Grounding, as was done in the incident, should always be done during hydrogen filling. However, even when the fill vessel is grounded, it is not unusual for a hydrogen release to immediately ignite.
4. The facility safety deluge water system should be checked periodically for coverage. In this case, a water cannon was a little off target from the last time it was operated and has now be repositioned and stabilized to ensure that it does not move in the future.
5. Emergency responders assumed that adjacent tube trailers were heating up from single-cylinder vent flare as a 300°F (149°C) reading was obtained with a thermal device. This slightly delayed the closing of the cylinder isolation valves on the tube trailer. After-incident investigation found no paint discolored or burnt, so the temperature taken by the emergency responders was likely near the flaming vent discharge point.
6. Securing hydrogen fill valve(s) at the back of the tube trailer was not dependent on the temperature at the vent stack, as this area was covered by deluge nozzles and located 40 feet (12.2 meters) away from the vent stack.
7. Media involvement and resulting speculation can portray a situation as being much worse than it actually is.

1. Evaluate any change in normal procedures or conditions for storage of aluminum hydride products. In this case, the aluminum hydride material was typically stored at -35°C in the glove box freezer. However, due to a change in glove boxes, this was no longer an option. Since commercially available aluminum hydride compound is shipped in glass bottles at room temperature, it was assumed that this was considered safe handling. The vial was stable for 6 weeks before the near miss occurred.

2. Limit aluminum hydride materials to small quantities as needed for immediate use. Larger samples have the potential to caused more damage.

3. Do not store aluminum hydride materials for extended periods of time and promptly dispose of any remaining material after use.

4. In-process aluminum hydride material should be stored at lower temperatures (i.e., in a freezer) and in an air-free contained environment (i.e., inside an air-free glove box) to reduce or slow decomposition into volatile materials (e.g., hydrogen, aluminum metal, and similar). In this case, if the aluminum hydride material had been stored in air, it is likely that a fire may have started.

5. Store aluminum hydride material in plastic containers instead of sealed glass containers to avoid catastrophic failure of containment. In this case, it is likely that the decomposition process of the aluminum hydride compound slowly built up pressure sufficient to destroy the glass vial.

Additional discussion about working with reactive metal-hydride materials in the laboratory can be found in the Lessons Learned Corner on this website and in the Hydrogen Safety Best Practices Manual.

The packing in the flow control valve should be replaced periodically. A planned investigation will determine the optimum time period for packing replacement.

1. Inadequate Safeguards - The system was designed with low-point drains to facilitate water removal, however, these were found to be inadequate in both location and size. The fact that the mixed feed pre-heat coil was not self-draining was unknown prior to the incident. After a thorough review of the entire reformer furnace feed system was completed, existing drains were increased in size and others added to ensure that the entire feed system could be drained.
2. Inadequate Procedure - The startup procedure did not account for a startup of a cold furnace with no hold points for catalyst reduction or refractory dry out. As a result, the time to reach the critical "steam in" temperature of 350°C (662°F) was short as compared to previous startups. Also, the procedure provides little direction for confirming that the reformer furnace feed system is dry. Modifications to the procedure were completed that included a longer heat-up period, the addition of more detailed guidance for verifying that the feed system is dry, and a formal sign-off by both operations and engineering personnel. Also, a separate cold-eyes review by external experts was completed as part of the pre-startup safety review.
3. Lack of Change Management - a. The startup procedure had two hold points for refractory dry out and new catalyst reduction during the heat-up phase prior to introducing the 4.1 mPa (600 psig) startup steam. These hold points were not utilized, since it appeared that neither was required. Consequently, the heat-up cycle was artificially shortened. It became apparent that this alteration to the startup sequence was not viewed as a change by operations. Several sections of the procedure were not performed, since they did not apply to this startup. b. Shutdown and startup procedures are designed to take a unit from safe operation to a zero energy state and then return it to safe operation. Changing these sequences by an intentional omission is a change and must be properly assessed for risk. The decision to leave some steam flow in the steam-generating system for this winter shutdown was made to keep the system warm and prevent freezing. However, no formal risk assessment was performed and no management of change (MOC) was generated. A risk assessment was performed prior to the startup, but the change in status of the steam system was not evaluated. In fact, the decision to leave steam in was seen as a safeguard from the risk of freezing. This provided an opportunity for water to accumulate upstream of the reformer furnace.
4. Non-essential Personnel - At the time of the incident, there were seven people on the furnace structure. Only the operations personnel were essential. Changes have been made to ensure that non-essential personnel are cleared from the area during startup activities.

More information on management of change can be found in the Lessons Learned Corner and also in the Hydrogen Safety Best Practices Manual.

The following recommended actions were identified:

1. Reemphasize the current lab management policies and practices on how process changes are evaluated for direct/indirect impacts on the process.
2. Reinforce with lab workers the expectations for bringing issues and concerns to management's immediate attention for evaluation of reporting needs.
3. Increase the purge gas flow rate to ensure complete purging of the system.
4. Extend the inert gas purging time of the reactor system before the run and use oxygen chemical indicator strips to indicate the quality of inert atmosphere in the enclosed system.
5. After the run, extend the inert gas purging time of the installed glove bag above the chamber lid and use a high purge gas flow rate.
6. Use oxygen chemical indicator strips to indicate the quality of inert atmosphere in the glove bag before opening the collection chamber.

The importance of purging hydrogen piping and equipment is discussed in the Lessons Learned Corner on this website.

Additional discussion about working with reactive metal-hydride materials in the laboratory can be found in the Lessons Learned Corner on this website and in the Hydrogen Safety Best Practices Manual.