Lessons Learned Bulletin No. 1

June 2012
JRC 72109

pdf version (en) Wasserstoff (de pdf)
Return to Lessons Learned Home Page

Chemical Accident Prevention & Preparedness

Issue on Accidents Involving HYDROGEN

This is the inaugural issue of the JRC-MAHB Lessons Learned Bulletin for chemical accident prevention and preparedness. The aim of the bulletin is to provide insights on lessons learned from accident reported in the European Major Accident Reporting System (eMARS) and other accident sources for both industry operators and government regulators. In future the CAPP Lessons Learned Bulletin will be produced on a semi-annual basis. Each issue of the Bulletin will focus on a particular theme.

Summary --------------------------------------- Most often, accidents are the result of human error associated with design or organisational errors or insufficient instructions or operating procedures. ----------------------------------------- The installation’s safety fundamentally relies on the operators’/contractors’/subcontractors’ training and experience, as well as the quality of the instructions and operating methods. ------------------------------------------ Issuing the permit-to-work is crucial part of the repair work/maintenance. Please note: ------------------------------------------- The accident descriptions and lessons learned are reconstructed from accident reports submitted to the EU’s Major Accident Reporting System emars.jrc.ec.europa.eu as well as other open sources. EMARS consists of over 800 reports of chemical accidents contributed by EU Member States and OECD Countries.	Accident 1 Release of hydrogen due to broken pipework Plastics and rubber manufacture While deplugging a cooling circuit, a blockage suddenly set loose, causing an uncontrolled movement of a flexible hose connected to the system. The flexible hose hit several small pipes nearby. Due to the broken pipe work there was a release of hydrogen and butene that lasted about five minutes. Sprinkler systems were activated; no ignition occurred. One employee standing nearby was hit by the flexible hose, causing a severe cut on the upper leg. The estimated production loss was 7 days. Causes: Human and organizational The cooler was destroyed by the use of wa- ter at high pressure. During the day, a nitro- gen feed had been temporarily opened due to concerns that an explosive atmosphere could develop in the receiving tank-truck. When the water pressure was returned to the system, it is suspected that the pressure had caused compression of a nitrogen plug. When the blockage released, the plug suddenly was ejected at high speed, causing the flinging of the connected flexible hose. Lessons Learned From the information on this accident, it seems likely that deviations on working procedures should only be allowed after thorough evaluation. [EMARS Accident # 27]	Accident 2 Release of hydrogen from a rector General chemicals manufacture Hydrogen escaped when a venting valve was opened for the inspection of a cap. A hydrogen leak under 300 bar and 300 °C occurred during the uncorking of a circuit while 6 employees dismantled a blank flange and an open drain valve. The escaped hydrogen caught fire (jetfire), resulting in the death of 4 people, injuries to others 3 and damages to the plant. No offsite emergency measures were necessary; no offsite effects were detected. Causes: Other The cause of the accident could not be precisely identified despite a general test of the equipment involved in the fire and/or suspected to have caused the accident. However it was assumed that the leak was due to the failure of an isolation valve. Lessons Learned Lessons learned were not provided because the judicial procedure was ongoing. How- ever there are some features of this accident that have often been associated with hydrogen accidents. The operator must pay attention to the fact that valves could be critical elements for plant safety and maintenance operations should be carried out strictly following the pre-established set of procedures. [EMARS Accident # 288]
TIPS ------------------------------------------- Against corrosion regular obligatory pressure test of the tank could be carried out. -------------------------------------------- Before starting work, training of the contractors is needed. -------------------------------------------- In case of modification of the process, a new permit to work is recommended. -------------------------------------------- In many cases following measures are given instead of lessons learned. A Lesson Learned is a change in the operational behaviour as a result of experience. -------------------------------------------- Constant alertness must be called for at all hierarchical levels in the facility-management, supervisory staff, technicians, subcontractors – bearing in mind that there is a permanent risk of ignition in the presence of hydrogen. --------------------------------------------	Accident 3 Explosion in a fertilizer plant Production and storage of pesticides, biocides, fungicides A minor leak had been detected in a flange on the piping of the ammonia synthesis loop. The company called a specialised external contractor to perform an on-stream repair of the valve, selected both for the limited extent of the leakage and the economic cost and effort associated with shutdown of a very complex system. The onstream repair consisted of a fabrication of a special bracket in two parts adapted to the dimen- sions of the flange of the valve and injection of filling material in the bracket around the flange. (The material had to be injected at a pressure higher than the operating pressure inside the pipe). During the repair some stud bolts broke causing the escape of a jet of a gaseous mixture of hydrogen and nitrogen at 250 bars. The escaping mixture exploded, killing 2 workers. Causes: Component/machinery failure Two causes contributed to the accident: 1. the flange stud-bolts of the valve had been replaced by others made of a ma- terial not equivalent to the one originally specified; 2. the maintenance company performing the repair have not taken into account the overpressure on the stud-bolts due to the injection of the filling materialin the bracket. Lessons Learned When replacing equipment careful attention should be paid to the selection of equipment materials that they be of sufficient grade to tolerate process conditions. This can prevent the untimely formation of leakages in critical process equipment. Secondly, mainte- nance procedures should be established in writing with an emphasis on safety issues. Following this accident, the operator also included a description in the maintenance procedures of the proper sequence of operations to be followed during repair of the valves in question. [EMARS Accident # 287]	Accident 4 Explosion during electrical network repair works General chemicals manufacture In the electrical network of the installation there were repair works in execution. At some point the safety fuse wire was accidently fused (presumably closing the electrical circuit). Thereby the shutoff valve which was mounted to the output of a gas- ometer jacket towards the collector over the piston-compressor, closed. The gasometer jacket was filled with electrolytic hydrogen. The hydrogen control valve was closed for having reached peak load in the storage vessel. In the condenser aspiration pipe an underpressure was formed. In the gas aspi- ration line a water trap was installed, whose drain had a stopped-up plastic tube that in turn was submerged in the bottom of a plastic tube filled with water. Due to the underpressure the water was aspirated out of the plastic tube, but deposits remained in the lower parts. The underpressure protection also triggered failure of the mean pressure condenser. Subsequently, the back flowing air arrived at the high pressure condenser. Together with the air the hydrogen formed an explosive gas mixture which auto-ignited. Plant workers (2 people) in a nearby building were seriously injured by pieces of iron falling into the building. The building (assembled of heavy bricks), two pressure vessels, pipes and other parts of the plant were considerably damaged. Causes: Human failure During repair works the safety fuse wire fused and closed the shutoff valve. Lessons Learned Electrical repair work should be carefully supervised by the operator following stan- dard procedures. Due to the high explosiv- ity of hydrogen, the operator also chose to re-construct the damaged building with a lighter brick composition as a mitigation measure. [EMARS Accident # 121]
KEYWORDS -------------------------------------------- External contractor/subcontractor -------------------------------------------- Organizational/human factor -------------------------------------------- Maintenance/upkeep operation -------------------------------------------- Repair works -------------------------------------------- Leakage/release -------------------------------------------- Explosion/jet fire -------------------------------------------- Shutoff valve/venting valve -------------------------------------------- Corossion --------------------------------------------	Accident 5 Explosion due to material defect Ceramics (bricks, pottery, glass, cement) The accident occurred in a ceramics industrial site and the component involved was a valve on the hydrogen storage tank. A valve on a hydrogen tank (100 m3 capacity) containing about 370 kg hydrogen leaked and the released gas exploded. The pressure wave caused damages to buildings outside the plant area (in particular windows were broken). The explosion (VCE) was followed by a fire that threatened acetylene and hydrogen fluoride containers. The debris from the tank was found several hundreds metres away. Outside the establishment 23 people were slightly injured by the explosion; the police delimited an area (500m large) around the plant. Also historic buildings were damaged by the explosion. Causes: Corrosion/fatigue The release of hydrogen was caused by a tank material defect. It seemed that corners along the welding had caused enhanced tensions and cracks appeared. Under the influence of hydrogen they grew much faster than normally, until the tank could no longer resist even its normal operating pressure. Lessons Learned A general rule of safety is that material properties of process equipment should be appropriately selected for process conditions. This includes taking account of the properties of substances involved, such as hydrogen, that may increase the rate of material degradation. Following this accident, all comparable tanks in the country were checked for similar risks. Manufacturing rules have been revised (establishing upper tolerance limits for corners). The calculation method for the residual life time under cyclic stress was also modernized. New test methods are now able to detect cracks at earlier stages. [EMARS Accident # 95]	Accident 6 Explosion of ammonia synthesis gas General chemicals manufacture A leak of synthesis gas (containing primarily 75% hydrogen) from a 250mm diameter valve (known as V5312) joint occurred at high pressure and it was ignited. This led to ductile failure of the pipe work and the in- stantaneous large release of synthesis gas, resulting in an explosion. The fire continued to burn for about two hours. The ruptured pipe work was attached to the valve body. The damage caused by the fire and explosion placed the plant out of action for about six weeks. Two employees suffered minor injuries during the explosion. Repair costs were estimated by the company to be in region of 2 million euros. Causes: Component/machinery failure The accident was caused by a gas leak on the valve joint between the top and bottom halves of the valve on a pipe work transporting synthesis gas. Following inspection of the valve indicated that gas had leaked in two spots at bolts prior to ignition. 4 years before the accident as a part of maintenance performed by subcontractors, the cap had been separated from the valve and it was observed that inadequate clamping of nuts was achieved. Lessons Learned It is notable that this accident also involved a failure of a valve joint. The operator must pay careful attention to the fact that the valve is a critical element for plant safety, especially the bolts hold the two parts of the valve together. In this case it appears that proper maintenance procedures were not followed. It is crucial that subcontractors are provided the proper procedures for mainte- nance and fully understand the associated risks. Moreover, maintenance work should be checked by the operator. As a follow-up to this accident, the operator replaced the valve involved with a different manufac- tured type. [EMARS Accident # 535]

Summary

---------------------------------------

Most often, accidents are the result of human error associated with design or organisational errors or insufficient instructions or operating procedures.

-----------------------------------------

The installation’s safety fundamentally relies on the operators’/contractors’/subcontractors’ training and experience, as well as the quality of the instructions and operating methods.

------------------------------------------

Issuing the permit-to-work is crucial part of the repair work/maintenance.

Please note:

-------------------------------------------

The accident descriptions and lessons learned are reconstructed from accident reports submitted to the EU’s Major Accident Reporting System

emars.jrc.ec.europa.eu
as well as other open sources. EMARS consists of over 800 reports of chemical accidents contributed by EU Member States and OECD Countries.

Accident 1

Release of hydrogen due to broken pipework

Plastics and rubber manufacture
While deplugging a cooling circuit, a blockage suddenly set loose, causing an uncontrolled movement of a flexible hose connected to the system. The flexible hose hit several small pipes nearby. Due to the broken pipe work there was a release of hydrogen and butene that lasted about five minutes. Sprinkler systems were activated; no ignition occurred. One employee standing nearby was hit by the flexible hose, causing a severe cut on the upper leg. The estimated production loss was 7 days.

Causes: Human and organizational
The cooler was destroyed by the use of wa- ter at high pressure. During the day, a nitro- gen feed had been temporarily opened due to concerns that an explosive atmosphere could develop in the receiving tank-truck. When the water pressure was returned to the system, it is suspected that the pressure had caused compression of a nitrogen plug. When the blockage released, the plug suddenly was ejected at high speed, causing the flinging of the connected flexible hose.

Lessons Learned
From the information on this accident, it seems likely that deviations on working procedures should only be allowed after thorough evaluation.

[EMARS Accident # 27]

Accident 2

Release of hydrogen from a rector

General chemicals manufacture
Hydrogen escaped when a venting valve was opened for the inspection of a cap. A hydrogen leak under 300 bar and 300 °C occurred during the uncorking of a circuit while 6 employees dismantled a blank flange and an open drain valve. The escaped hydrogen caught fire (jetfire), resulting in the death of 4 people, injuries to others 3 and damages to the plant. No offsite emergency measures were necessary; no offsite effects were detected.

Causes: Other
The cause of the accident could not be precisely identified despite a general test of the equipment involved in the fire and/or suspected to have caused the accident. However it was assumed that the leak was due to the failure of an isolation valve.

Lessons Learned
Lessons learned were not provided because the judicial procedure was ongoing. How- ever there are some features of this accident that have often been associated with hydrogen accidents. The operator must pay attention to the fact that valves could be critical elements for plant safety and maintenance operations should be carried out strictly following the pre-established set of procedures.

[EMARS Accident # 288]

TIPS

-------------------------------------------

Against corrosion regular obligatory pressure test of the tank could be carried out.

--------------------------------------------

Before starting work, training of the contractors is needed.

--------------------------------------------

In case of modification of the process, a new permit to work is recommended.

--------------------------------------------

In many cases following measures are given instead of lessons learned. A Lesson Learned is a change in the operational behaviour as a result of experience.

--------------------------------------------

Constant alertness must be called for at all hierarchical levels in the facility-management, supervisory staff, technicians, subcontractors – bearing in mind that there is a permanent risk of ignition in the presence of hydrogen.

--------------------------------------------

Accident 3

Explosion in a fertilizer plant

Production and storage of pesticides, biocides, fungicides
A minor leak had been detected in a flange on the piping of the ammonia synthesis loop. The company called a specialised external contractor to perform an on-stream repair of the valve, selected both for the limited extent of the leakage and the economic cost and effort associated with shutdown of a very complex system. The onstream repair consisted of a fabrication of a special bracket in two parts adapted to the dimen- sions of the flange of the valve and injection of filling material in the bracket around the flange. (The material had to be injected at a pressure higher than the operating pressure inside the pipe). During the repair some stud bolts broke causing the escape of a jet of a gaseous mixture of hydrogen and nitrogen at 250 bars. The escaping mixture exploded, killing 2 workers.

Causes: Component/machinery failure
Two causes contributed to the accident:
1. the flange stud-bolts of the valve had been replaced by others made of a ma- terial not equivalent to the one originally specified;
2. the maintenance company performing the repair have not taken into account the overpressure on the stud-bolts due to the injection of the filling materialin the bracket.

Lessons Learned
When replacing equipment careful attention should be paid to the selection of equipment materials that they be of sufficient grade to tolerate process conditions. This can prevent the untimely formation of leakages in critical process equipment. Secondly, mainte- nance procedures should be established in writing with an emphasis on safety issues. Following this accident, the operator also included a description in the maintenance procedures of the proper sequence of operations to be followed during repair of the valves in question.

[EMARS Accident # 287]

Accident 4

Explosion during electrical network repair works

General chemicals manufacture
In the electrical network of the installation there were repair works in execution. At some point the safety fuse wire was accidently fused (presumably closing the electrical circuit). Thereby the shutoff valve which was mounted to the output of a gas- ometer jacket towards the collector over the piston-compressor, closed. The gasometer jacket was filled with electrolytic hydrogen. The hydrogen control valve was closed for having reached peak load in the storage vessel. In the condenser aspiration pipe an underpressure was formed. In the gas aspi- ration line a water trap was installed, whose drain had a stopped-up plastic tube that in turn was submerged in the bottom of a plastic tube filled with water. Due to the underpressure the water was aspirated out of the plastic tube, but deposits remained in the lower parts. The underpressure protection also triggered failure of the mean pressure condenser. Subsequently, the back flowing air arrived at the high pressure condenser. Together with the air the hydrogen formed an explosive gas mixture which auto-ignited. Plant workers (2 people) in a nearby building were seriously injured by pieces of iron falling into the building. The building (assembled of heavy bricks), two pressure vessels, pipes and other parts of the plant were considerably damaged.

Causes: Human failure
During repair works the safety fuse wire fused and closed the shutoff valve.

Lessons Learned
Electrical repair work should be carefully supervised by the operator following stan- dard procedures. Due to the high explosiv- ity of hydrogen, the operator also chose to re-construct the damaged building with a lighter brick composition as a mitigation measure.

[EMARS Accident # 121]

KEYWORDS

--------------------------------------------

External contractor/subcontractor

--------------------------------------------

Organizational/human factor

--------------------------------------------

Maintenance/upkeep operation

--------------------------------------------

Repair works

--------------------------------------------

Leakage/release

--------------------------------------------

Explosion/jet fire

--------------------------------------------

Shutoff valve/venting valve

--------------------------------------------

Corossion

--------------------------------------------

Accident 5

Explosion due to material defect

Ceramics (bricks, pottery, glass, cement)
The accident occurred in a ceramics industrial site and the component involved was a valve on the hydrogen storage tank. A valve on a hydrogen tank (100 m3 capacity) containing about 370 kg hydrogen leaked and the released gas exploded. The pressure wave caused damages to buildings outside the plant area (in particular windows were broken). The explosion (VCE) was followed by a fire that threatened acetylene and hydrogen fluoride containers. The debris from the tank was found several hundreds metres away. Outside the establishment 23 people were slightly injured by the explosion; the police delimited an area (500m large) around the plant. Also historic buildings were damaged by the explosion.

Causes: Corrosion/fatigue
The release of hydrogen was caused by a tank material defect. It seemed that corners along the welding had caused enhanced tensions and cracks appeared. Under the influence of hydrogen they grew much faster than normally, until the tank could no longer resist even its normal operating pressure.

Lessons Learned
A general rule of safety is that material properties of process equipment should be appropriately selected for process conditions. This includes taking account of the properties of substances involved, such as hydrogen, that may increase the rate of material degradation. Following this accident, all comparable tanks in the country were checked for similar risks. Manufacturing rules have been revised (establishing upper tolerance limits for corners). The calculation method for the residual life time under cyclic stress was also modernized. New test methods are now able to detect cracks at earlier stages.

[EMARS Accident # 95]

Accident 6

Explosion of ammonia synthesis gas

General chemicals manufacture
A leak of synthesis gas (containing primarily 75% hydrogen) from a 250mm diameter valve (known as V5312) joint occurred at high pressure and it was ignited. This led to ductile failure of the pipe work and the in- stantaneous large release of synthesis gas, resulting in an explosion. The fire continued to burn for about two hours. The ruptured pipe work was attached to the valve body. The damage caused by the fire and explosion placed the plant out of action for about six weeks. Two employees suffered minor injuries during the explosion. Repair costs were estimated by the company to be in region of 2 million euros.

Causes: Component/machinery failure
The accident was caused by a gas leak on the valve joint between the top and bottom halves of the valve on a pipe work transporting synthesis gas. Following inspection of the valve indicated that gas had leaked in two spots at bolts prior to ignition. 4 years before the accident as a part of maintenance performed by subcontractors, the cap had been separated from the valve and it was observed that inadequate clamping of nuts was achieved.

Lessons Learned
It is notable that this accident also involved a failure of a valve joint. The operator must pay careful attention to the fact that the valve is a critical element for plant safety, especially the bolts hold the two parts of the valve together. In this case it appears that proper maintenance procedures were not followed. It is crucial that subcontractors are provided the proper procedures for mainte- nance and fully understand the associated risks. Moreover, maintenance work should be checked by the operator. As a follow-up to this accident, the operator replaced the valve involved with a different manufac- tured type.

[EMARS Accident # 535]

Motto of the semester

Hydrogen processes and typical accident causal factors

---------------------------

Underestimation of
the risk is the start
of the accident!

MAHBulletin

ContACt

For more information related to this bulletin on lessons learned from major industrial accidents, please contact

zsuzsanna.gyenes@jrc.ec.europa.eu or jrc-emars@ec.europa.eu

Security Technology Assessment Unit
European Commission Joint Research Centre Institute for the Protection and Security of the Citizen
Via E. Fermi, 2749
21027 Ispra (VA) Italy https://minerva.jrc.ec.europa.eu

If your organisation is not already receiving the MAHBulletin, please contact jrc-emars@ec.europa.eu Please include your name and email address of your organisation’s focal point for the bulletin.

Hydrogen is used in a large number of activities to produce or store the gas, such as chemical, pharmaceutical, oil refining, nuclear or transport industries, metal processing.

Typical properties of hydrogen including its tendency to escape due to its low molecular weight, wide flammability range, low ignition energy and ability to detonate easily make it especially dangerous in confined or semi-confined spaces. Thus accidents involving hydrogen often result in fires and/or explosions with serious hu- man consequences. Hydrogen rises rapidly but diffusion makes it disperse in all directions. It is also light and disappears rapidly but when cryogenic hydrogen escapes there is a mixture cloud consisting of hydrogen, air, and water; this mixture can ignite with very low energy input. As a point of reference, an invisible spark or a static spark from a person can cause ignition.

Moreover, hydrogen reacts spontaneously and violently at room temperature with chlorine or fluorine. In many accidents the appearance of hydrogen results from the accidental production of the gas by contact between water and molten metal, formation of water gas, reactions involv- ing hydrides or by corrosion of steels due to use concentrated acids (hydrogen sulfate) or chlorine. Completely dust-free hydrogen released from a pipe or tank does not catch fire easily, ignition follows when the escaping gas comes into contact with dust particles or water droplets in the air. A better understanding of such dangerous reactions by operators and rescue staff is needed.

Recommendation for safe handling and storage of hydrogen

The accidents profiled in this bulletin occurred due to a combination of organizational and human factors, maintenance (repair)/upkeep operations (see Accidents 1-4) coupled with material defect/quality problems (see Accidents 3 and 6)/corrosion (see Accident 5).

It is important at all costs to avoid any release of hydrogen because there is usually no time to react to prevent an accident. A high volume of hydrogen can be released in a very short time and it often self detonates (no ignition source is needed). It is important to implement safe equipment design and construction as well as proper procedures for handling hydrogen in order to prevent the loss of life and property. All these procedures should be understood and followed exactly by the technicians without applying any ad-hoc modification (see Accidents 1 and 2). In case of modification in a working process, a new permit-to-work should be issued. Also accident analysis shows that in many cases problems occur during maintenance work such as electrical failures, safety fuse wire fusion (see Accident 4) etc. Given the physical characteristics of hydrogen increased risk awareness in the facility in regard to the permanent risk of ignition is needed especially because the flame of hydrogen can hardly be observed because it is either invisible or light blue (missing emission peak of CO2 due to the lack of carbon in the flame).

Maintenance work at installations generates specific risk that needs to be analysed for prevention (see Accident 6). In most cases accidents may be avoided with preventive maintenance of the safety equipment (valve, gasket, etc.). Moreover, to reduce corrosion risks, more frequent inspection than recommended standards may be advisable under certain circumstances where hydrogen is present (e.g., type of equipment, material quality, process conditions, criticality of function, etc.), due to the increased corrosion risk associated with the presence of hydrogen and also the need to avoid hydrogen releases due to its highly reactive nature at room temperature. Valves are in particular demonstrated to be very critical elements to plant safety. In particular the bolts that hold the two parts of the valves together seem very sensitive to high pressure. The pressure of a hydro- gen storage tank is quite high (300-600 bar) so it is no surprise that also given the special escaping characteristic of hydrogen these two circumstances may cause higher risk in case of hydrogen involved processes than others.

Lessons Learned Bulletin No. 1

June 2012JRC 72109

Chemical Accident Prevention & Preparedness

Issue on Accidents Involving HYDROGEN

Accident 1

Accident 2

Accident 3

Accident 4

Accident 5

Accident 6

Motto of the semester

Hydrogen processes and typical accident causal factors

---------------------------

Underestimation of the risk is the start of the accident!

MAHBulletin

Recommendation for safe handling and storage of hydrogen

June 2012
JRC 72109

Underestimation of
the risk is the start
of the accident!