It is characteristic of silver/zinc batteries to outgas both hydrogen and oxygen for several hours after discharge. Also, in the future, the battery should be properly secured inside the container.

Refueling operations need to be conducted in a careful and attentive manner, and operators need to be aware of the potential consequences of their actions.

The site needs to implement a good Operational and Readiness Inspection procedure. System inspection deficiencies need to be identified, and (if possible) reviewed by a second party before future tests are conducted. This inspection could include the following:

• Check all relief valve set points
• Check potential design flaws
• Check all other relevant operational characteristics

A proper vent system design is as important as the relief valve itself. A vent system should be able to operate with no consequence at all. Proper facility design and venting to a safe location would have made this a near-miss instead of an incident.

Proper bolt identification can prevent similar occurrences in the future. This can be achieved by simply painting the critical bolt heads a certain color (or by purchasing bolts with painted bolt heads). An explanation form should then be clearly posted, which indicates which bolts are critical, and which aren't. This information should then be disseminated to all of the relevant technicians.

Extra caution should be taken when working around elevated pressure storage tanks. Pressure relief valve settings should be checked and then verified by a second party if possible. Proper procedures need to be followed at all times.

• Facilities housing battery charging systems need to ensure the ventilation systems are operational, and delivering enough outdoor air to properly ventilate the enclosure.
• Operators need to be aware of safe practices and proper battery charging instructions for the nickel cadmium batteries they work on. This information needs to be disseminated to all of the technicians working on the batteries and battery charging systems.

Adequate ventilation of battery charging facilities is addressed in the Lessons Learned Corner on this website.

Normally hydrogen fires are not extinguished until the supply of hydrogen has been shut off due to the danger of re-ignition and explosion. During a gas leak/fire, it is important to shut off the source of the hydrogen if it is safe to do so. If the leak cannot be stopped, the danger of a fire (or an explosion if the unburned hydrogen gas is leaking into a poorly ventilated confined space) would be very high. If a leak cannot be stopped, fire extinguishing is impossible and only prevention of fire spreading is possible. It is also difficult to detect a gas leak from thermally insulated piping at an early stage.

Countermeasures which were employed to prevent future occurrences include:

• Improving management of construction at turnaround to prevent improper gasket installations.
• To detect gas leaks in piping systems covered with thermal insulation, inspection windows were installed in the insulation and gas leak checks were strengthened.

1. Follow the rules (e.g., using a torque-amplifying device requires supervisor approval).
2. Some valves are susceptible to disassembly, with potentially significant consequences, if excessive torque is applied to the handwheel.

The investigation team concluded that hydrogen gas was released through a failed 19-inch diameter gasket and ignited under the roof of the compressor shed where it was partially confined. Some gas escaped from the shed prior to the explosion, but it was confined beneath the deck of an adjacent structure and overhead piping. The compressor shed was originally just a roof over the compressors, but over time, walls were added to aid winter operation and maintenance. These walls resulted in confinement of the hydrogen and contributed to the violent explosion.

Unauthorized modifications played a major role in this incident. The team discovered that the original design specifications called for a spiral-wound gasket, but for the previous 7 or 8 years, only compressed asbestos fiber (CAF) gaskets had been used. It appears that the risk of the gasket disintegrating or blowing out during a high-pressure leak had not been identified.

Actions taken as a result of the incident included the following:

• Checklists for startup and shutdown procedures, and design and engineering safety were updated and became mandatory.
• Pressure testing at operating pressure became mandatory prior to process startup.
• Process hazard analysis was introduced. - Gasket material specifications were revised.
• Separation standards were developed and implemented for all site buildings and facilities.
• Shatter-resistant windows and doors were installed.
• Process enclosures were minimized in new designs and existing enclosures were opened up and/or forced ventilation was upgraded.
• A formal modification procedure was instituted (i.e., management of change).
• Additional combustible gas detectors were installed, with frequent calibration and maintenance required. - Emergency shutoff valves were installed on vessels with critical hydrocarbon inventories.
• Awareness of chemical processing hazards was increased among all employees through better communication and training.

The investigation determined that hydrogen was formed by the reaction of hot aluminum and water, air was admitted via the inspection door, and the mixture was ignited by the hot clinker or sparks from the chisel. Aluminum should have been separated from the refuse prior to feeding it to the incinerator, and this incident could have been avoided. Specific lessons learned included:

• Incineration of crushed material with a high aluminum content was stopped.
• Nitrogen should be used for purging combustible gas generated when blockage is removed.
• Sufficient cooling time and safety confirmation steps must be completed prior to removing any blockage.
• Water injection is no longer allowed. - An industrial camera and thermometer were installed for early detection of blockage.
• The capacity of the ash pusher was increased.
• Standard operating procedures were prepared for employees to follow.
• A warning was issued to the public emphasizing the need for complete separation of combustibles and non-combustibles from their refuse.

The ignition of the fireball could have been caused by any of the following mechanisms:

• The inverse Joule-Thompson effect of hydrogen (i.e., heating upon expansion)
• Some of the oil and light ends were above their auto-ignition temperatures
• Contact with hot surfaces of the autoclave
• Static electricity
• Electrostatic discharge of the mixture.

The possibility that the explosion may have been caused by the hydrogen discharged from the autoclave was thoroughly investigated. However, there were no signs of combustion in the upper part of the cell. Also, the explosion occurred approximately five minutes after the rupture disc release, long after the hydrogen source had been shut off and more than one air exchange had occurred in the cell.

The following were identified as lessons learned from the incident:

• The reactor outlet line was plugged with viscous oil, which resulted in over-pressurization of the system. If the plug had been in the feed line, the rupture disc on the reactor would never have been over-pressurized. If the staff had added a second rupture disc near the pump outlet to relieve pressure before the reactor rupture disc, with a check valve in between the two, the release might have been avoided. This design change was incorporated into the system rebuild.
• The fixed-catalyst-bed tubular reactor system should have been reviewed and approved by health and safety, facilities engineering, or building management staff.
• The inadequate hazard analysis of the installation resulted in failure to anticipate the need for containment or remote discharge of the rupture disc effluent. A thorough hazard analysis should have been done before operating the system.
• The operators were not adequately trained on the hazards of the system. - Combustible materials and gas lecture bottles should not have been stored in the autoclave cell (i.e., poor housekeeping).
• The fire failed to activate the sprinkler system because the exhaust fan was turned on within seconds of the rupture disc release, so the air change volume minimized the temperature rise within the cell.
• The roof pressure vent panel failed to adequately relieve the explosion pressure.

• Carefully revise the risk assessment process to evaluate any confined areas where hydrogen is handled.
• Separate the fire and gas detection alarm system from the process information to provide easy and clear identification.
• Refresh and re-enforce personnel training on fire and gas identification and interpretation.
• Retrain personnel on emergency procedures and enhance their understanding and awareness of risky, flammable, explosive, and/or toxic substances. Avoid underestimation of the hazards and complacency.
• Re-enforce training and review training courses for recently hired personnel.

Process changes have been implemented for development and review of safety basis documents that focus on a collaborative effort between the preparer and reviewers in order to provide a more in-depth review. This change is anticipated to provide new perspectives that may compensate for human error.

1.  Combustible gas detectors calibrated for hydrogen can falsely report hydrogen alarms due the presence of other gases the detector may pick up, such as carbon monoxide from engine exhaust or other sources. Since this event occurred, two hydrogen-specific alarms have been installed at this facility to eliminate false hydrogen alarms.

2.  A building's ventilation system can be a source of gases that can trigger a hydrogen alarm, especially a combustible gas detector used for hydrogen detection. In this case, there were multiple sources of non-hydrogen gases that likely triggered the hydrogen alarm. A boiler needing maintenance that was operating near the building ventilation inlet was a possible source of non-hydrogen gas getting into the building, and it has subsequently undergone repairs to minimize the likelihood of it being a gas source. The loading dock that is partially inside of the building is used to start equipment like snow-blowers during cold weather and is also a possible gas source. Finally, when the fire department arrived with 15 fire vehicles operating near the building for 4 hours, some of the exhaust gases were likely sucked into the building ventilation system as the hydrogen alarms continued to alarm even though all the hydrogen bottles had been removed from the building by order of the fire department after the first alarm response.

3.  Hydrogen storage capacity must meet storage regulations as defined by various agencies, including OSHA. Subsequent investigation by OSHA after this event found a violation in the building construction related to the 3,000 cubic feet (CF) of hydrogen being stored in ten 300-CF bottles. One cubic foot less of hydrogen storage capacity would have complied with the OSHA hydrogen storage standard for this construction type (reference OSHA regulation 1910.103(b)(2)(ii)(c) Table H-2, that has three storage capacities: less than 3,000 CF, 3,000-15,000 CF, and in excess of 15,000 CF). In this event, the building did not meet the minimum distance in feet for 3,000 CF and greater hydrogen storage, so subsequently the storage capacity was reduced by the removal to two bottles to bring the hydrogen storage capacity under 3,000 CF.

4.  Personnel should follow procedures for reporting hydrogen alarms to minimize outside personnel being unnecessary activated. Procedures in place for reporting hydrogen alarms had the following three levels of action: 1) for up to 10% of the LFL, the system is to be shut down and the Safety Department (on 24-hour call) notified, 2) for above 10% to 20% of the LFL, the premises are to be evacuated and the Safety Department notified, and 3) above 20% of the LFL, the fire department is to be called. Note that above 25% of the LFL, the alarm system automatically calls the fire department. In this event, the alarm levels were below 10% of the LFL, but the fire department was notified unnecessarily by the operating personnel. The research facility and other involved entities incurred additional expenses for emergency response that could have been avoided if reporting procedures had been followed.

Based on the results of the company investigation and analysis of an amateur video, the company determined that the incident could have been caused by the failure of one of the following plant components:
· pipes leading to the reactor pressure gauges
· the recycled quench gas pipe at the bottom of the reactor
· the diathermic oil pipe (hot oil) entering or exiting the heat exchanger
· the heat exchanger flanged joints and connection lines.

The company determined that a release from the hot oil circuit could not have triggered the fire, based on the evidence from the pressure data in the circuit, which showed that the failure occurred 30 minutes after the fire started. The video confirms the pipe rupture 30 minutes after the fire began. For the same reason, a release from the hydrogen pipes is not considered likely, as the records demonstrate that the hydrogen pipe failed seven minutes after the fire began. When the heat exchanger flanged joints were dismantled, it was seen that the joint gaskets were not damaged. Thus, the company considers the failure of a pipe from the reactor pressure measurement gauges to be the most likely cause of the accident (although there is no conclusive evidence to identify the specific failure that caused the pipe to rupture). This assumption is supported by the following facts:
· This pipe is located in the area corresponding to the epicenter of the fire.
· The area corresponds to the area visually identified by the witnesses.
· The product release (hydrogen and fuel oil) from one of these pipes can cause a 6-meter long jet flame, as occurred.
· The product supposedly released would have had a high enough temperature and pressure to self-ignite or ignite against a plant hot spot (e.g., the hot oil circuit).
· The damages recorded were caused by overheating (flame exposition) and were not caused by overpressure or explosion. The pressure measurement records confirm no significant pressure changes at the beginning of the event.

The company decided to rebuild the hydrotreatment plant, in compliance with regulations, and to introduce the following process design changes:
· complete separation of the light fuel oil section and the heavy fuel oil section to avoid the possibility of "domino effects"
· lowering the maximum height of the heat exchanger installations from 25 meters to 15 meters to facilitate fire-extinguishing operations
· redesign of the piping system to minimize adjacencies
· relocation of the valves on the hydrogen quench line to enable depressurization
· reduction of the number of measurement gauges
· insertion of valves in a safe area for depressurizing the hot oil circuit.

The root cause of the fire that burned the evaporator pad and distorted the plastic evaporator pad bracket remains unknown. The initial investigation did not reveal any obvious signs of an ignition source in the vicinity of the forklift operation. The on-board data acquisition system did not indicate any abnormalities in the operating parameters of the fuel cell system (e.g., temperature, pressure, voltage, current). The fuel cell was disassembled, but no evidence was found of any electrical shorts or other potential ignition sources. Thus it was concluded that the fuel cell unit itself was not the ignition source for this incident.

One theory presented the possibility of a spark (caused by static electricity) being the source of the ignition that caused the fire. Due to the proximity of the fuel cell unit to a shrink-wrap packaging machine at the time of the incident, this seemed to be a plausible hypothesis. However, sparking tests on evaporator pad materials failed to confirm this, and it seems highly unlikely that a wet evaporator pad would ignite from static electricity. The true ignition source for this incident remains unknown.

After the initial investigation, the company used a hydrogen meter to monitor hydrogen levels near the evaporator pad during fuel cell start-up (which they expected to be the highest, due to a system purge). They also wanted to investigate if hydrogen could become trapped near the vent covering the evaporator pad. The tests indicated hydrogen levels well below the lower flammability limit (0.022%). Similar readings were also detected from the exhaust on the other make/model fuel cells operating in the facility. They detected no sign that high levels of hydrogen were trapped near the vent of any fuel cell make/model.

It appears that this was an isolated event caused by human error. The lessons learned are: (1) to caution workers to maintain their focus during fuel cell stack assembly, (2) to require verification that all tools and spare parts are accounted for prior to closing up the system, and (3) to review quality control procedures and assembly procedures with an eye toward improvement.

A hydrogen release of this type is a significant event. The event highlighted a number of procedural contributing factors that will influence the manner in which these fuel cell systems will be serviced in the future. A complicating factor in this event was that multiple companies were involved, and communications among them were inadequate. It is likely that the condition existed from the original manufacture of the fuel cell systems, and may even have been understood by the Company A fuel cell team, but the history is not fully known since that team no longer exists. Company B’s investigation also discovered that a similar leak had been experienced at the same facility and a similar replacement had been required, but there was no corporate memory of the repair or the underlying failure mode.

If a situation arises as a result of consolidation or equipment transfer wherein another entity takes ownership or service and support responsibility for fuel cell systems, the full design history and operating records of the systems must be fully documented and accessible. This will allow for proper knowledge transfer of underlying design considerations or problematic reliability or safety-related issues, and potentially prevent this type of avoidable incident from occurring again.

Another lesson relates to how high-pressure components within the hydrogen fuel storage system are qualified following a repair. It is envisioned that in the near future, there will likely be regional service centers equipped with re-manufacturing capabilities to support commercial fuel cell deployments. These repair shops would be equipped with the infrastructure to properly purge and pressurize equipment with small-molecule gas to test for leaks.

Procedures for safe handling of compressed gas cylinders, marking design of gas cylinders and connecting lines, and arrangement of cylinders were reviewed and modified as necessary. The spectrometer was returned to the manufacturer for a careful examination to assess the full extent of the damage. The affected laboratory area was taken out of service. Additional conspicuous markings were added to flammable gas cylinders and connecting lines. Specific training on safe handling of compressed gases was provided for all compressed gas users. The FTIR spectrometer was physically moved to a different laboratory where hydrogen cylinders were not used. All hydrogen lines and valve connections were color-coded red.

In addition to the probable causes listed above, the lack of a standard operating procedure for hydrogen leak detection was one of the probable causes of this incident. Additional contributing factors included the following:
- Severe pipe corrosion due to the presence of hot water in the pipe trench
- Hydrogen piping located in a concealed space
- Limitations of the flash-fire-resistant garments worn by plant employees.

Key findings noted in the CSB report included:

1. Significant accumulations of combustible iron powder fueled fatal flash fires when lofted near an ignition source.
2. Facility management were aware of the combustibility hazard two years earlier but did not mitigate the hazard with engineering controls or housekeeping.
3. The plant did not institute combustible gas monitoring or employee training to help avoid flammable gas fires and explosions.
4. OSHA did not include iron and steel mills in its Combustible Dust National Emphasis Program.
5. The 2006 International Fire Code (IFC) does not require enforcement of the more comprehensive and rigorous NFPA standards for the prevention of dust fires and explosions.
6. The state and city did not enforce recommended IFC practices.
7. The local fire department inspected the facility just months before the fatal hydrogen explosion and dust flash fire but did not cite or address the combustible dust hazards that were present.
8. The flame-resistant clothing provided to the plant employees did not adequately protect them from the hydrogen explosion and dust flash fires.
9. There was no corporate oversight regarding the management of combustible dusts even though there had been a succession of serious accidents at the facility in the past.

The CSB made recommendations regarding combustible dust hazards to OSHA, the International Code Council, the state, the company, the Metal Powder Producers Association, the city, and the local fire department. Recommendations to the company covered both combustible dust and flammable gases as shown below.

1. Conduct periodic inspection audits of the facility for compliance with the relevant NFPA standards (484, 499, 497, 2, and 2113), using knowledgeable experts, and implement all recommended corrective actions.
2. Develop a training program for combustible dust hazards for all employees and contractors.
3. Implement a preventive maintenance program and leak detection/mitigation procedures for all flammable gas piping and gas processing equipment.
4. Implement a near-miss reporting and investigation policy.