Explosive Lessons in Hydrogen Safety

By Russel Rhodes

 

The Centaur program, which developed a high-energy second-stage rocket in the early sixties, marked NASA’s first effort to use large quantities of liquid hydrogen.

Following in parallel, and using a second stage fueled with liquid hydrogen, was the Saturn I block II vehicle. I was selected to be the engineer responsible for the design and operation of the new liquid storage and transfer systems these rockets needed. Even small amounts of liquid hydrogen can be explosive when combined with air, and only a small amount of energy is required to ignite it. Both its explosiveness and the extremely low temperatures involved make handling it safely a challenge. It has taken a lot of experience, including the experience of dramatic failures, to teach us just how dangerous it is and how carefully we need to treat it.

August 30, 1963. We were ready to fuel the Saturn I block II vehicle, our first configuration with a liquid-hydrogen-and-oxygen-powered second stage. The stage had six RL-10 engines, and the launch complex to support it contained a 125,000-gallon dewar for storing liquid hydrogen about 600 ft. from the launchpad. For additional safety, we had two ponds where hydrogen that was vented during preparation could be safely burned off.

We began filling the transfer line and chilling the stage tank while venting hydrogen down to its burn pond. Everything seemed to be working fine when Al Zeiler, who was watching the process through a periscope (we had very little closed-circuit television in those days), told us we’d had an explosion at the pad. Inside the blockhouse, we hadn’t heard a thing, but Al reported seeing steel trench covers, which weighed about 300 lbs. each, flying several hundred feet in the air.

We immediately closed the vehicle tank vent valve and activated a helium purge to eliminate any hydrogen gas in the line and put out the fire. The system operator did not understand the severity of the situation, however. He closed the helium purge and vented the vehicle tank, which restarted the flow of hydrogen and reignited the fire. I instructed the operator to shut the vent valve and again turn on the helium purge.

 

 

There was considerable damage to the vent system, and about 200 ft. of trench covers were blown off. We ended up using the Labor Day weekend to remove the damaged system and clean up the area. Some of the damaged hardware was placed on the floor of the operational butler building, including aluminum bellows sections—which allowed the vent line to expand and contract—that had been cut out of the line. The following Tuesday morning, I gave one of the bellows a kick and water spilled out. That was the first clue to what had happened.

With the vehicle venting helium, closing the vehicle tank vent valve creates a partial vacuum in the ground system vent line. This triggers a siphoning effect that starts filling the vent line with water from the burn pond. This may have been the source of the water in the bellows. The other possible cause may have been from another crew’s prior attempt to clean the vent system.

The bellows were fully expanded during our first test; flowing in liquid hydrogen made the line cold, causing it to shrink about 30 in. This allowed water to freeze and fill the bellows with ice. As the pipe expanded during warm-up after the flow test, the bellows tried to collapse to their minimum dimension before the ice melted, resulting in a rupture and a large leak path into the trench. So water from either the cleaning or siphoning incidents created conditions that resulted in the failure.

The solution involved replacing the original design with a solid line with no bellows sections. Instead, a bellows flex hose was installed at the end of the line where it connected to the base of the tower, which gave 30 in. of freedom to accommodate expansion and contraction.

Hydrogen has a very broad flammability range—a 4 percent to 74 percent concentration in air and 4 percent to 94 percent in oxygen; therefore, keeping air or oxygen from mixing with hydrogen inside confined spaces is very important. Also, it requires only 0.02 millijoules of energy to ignite the hydrogen–air mixture, which is less than 7 percent of the energy needed to ignite natural gas. That is why a burn pond using a 1-in. water seal was considered safer than a flare stack. Experience over the next several years showed us that keeping air out of the vent system was difficult and required strict procedural control and maintenance.

More often than not, fears about the potential for explosions were justified. Designers at Kennedy Space Center were concerned about using a hydrogen flare stack to manage waste hydrogen because they believed air could enter it and lead to an explosion. During the developmental testing of the SII stage of the Saturn V moon rocket at the Mississippi Test Facility (now Stennis Space Center), their concern was validated.

Test operations had removed a problematic vent valve and installed a blanking plate to seal the opening. When the vent valve was removed, low-density helium flowed out of the high-elevation opening on the test stand, causing air to be drawn into the system through the flare-stack opening. One morning, a high-pressure relief valve vented hydrogen gas into the system.

 

A helium purge pushed gases from the system to the flare stack. When the gaseous hydrogen reached the top of the stack, it burned; however, because there was air in the system, the flame flashed back into the system to burn any flammable gases. Operational personnel having lunch in the nearby control room heard the flame flash back with a screeching sound. This flashback occurred several times until it found a hydrogen–air mixture that was detonable. The resulting explosion destroyed several hundred feet of the vent system.

From our experience at the hydrogen production facility in West Palm Beach, Florida, and our first Saturn storage facilities at Launch Complex 37, we learned that unflared vent stacks used for disposing low volumes of gas could be ignited by a static charge in the air. The first time the vent caught fire from a static charge, the techs tried to use a fire hose to extinguish it. Of course, this didn’t work, and the valve was closed while purging the system with nitrogen gas to remove any fuel present.

To prevent static charge, a lightning rod was mounted directly to the vertical vent system with its tip above the flammable hydrogen–air mixture. But when the lightning rod grounding connection became slightly corroded and lost its continuity, the vent system outlet caught fire again, melting the metal rod. We replaced it with a fiberglass rod, and operators learned they must maintain a good ground connection to avoid fires.

During the design and activation of the LC-39 Pad A liquid-hydrogen facility, concern about hydrogen leaking from the seal on a supply-line shutoff valve drove the need for a fault-tolerant solution. Since the tanker-replenishment operation was performed with personnel in the area, our concern was great because the valve was the last opportunity to isolate the tank’s hydrogen from personnel.

The valve used an extended bonnet (or valve cover) that had two sets of seals separated by a ring that had a port to allow for hydrogen purging if the valve needed maintenance. The fault-tolerant solution was a high-pressure helium purge ported into this bonnet and controlled by a panel located about 100 ft. from the valve. This purge was supplied at a pressure slightly higher than the intended operating pressure of the liquid-hydrogen line. Some operations personnel didn’t believe this capability was needed, though, so they did not set up the pressure accordingly while replenishing liquid hydrogen.

During a transfer, a leak developed at the valve bonnet seals and prevented anyone from getting close enough to the valve to close it. This provided us an opportunity to not only verify our fault-tolerant solution, but also educate the technicians on the need for safety backup systems and the importance in following procedures to use them as directed.

We instructed the technicians to go to the helium-purge control panel located safely away from the storage tank and activate the system that would supply ambient helium gas to the valve bonnet and warm the shaft seals, making them expand and seal. The system stopped the leak in less than a minute.

We have made progress on safely and surely detecting hydrogen leaks. In the early days of launching ballistic liquid rockets, vehicle propulsion systems were visually checked for leaks by launch personnel at ambient temperatures before propellant was loaded, after a small quantity of cryogenic propellants were chilled and loaded, and after we completed cryogenic loading.

My responsibility as the launch operations fuels section chief was to safely load the fuel propellants on the Saturn vehicles. Because of requirements for cryogenic propellants, I was looking for an automatic process to verify that exposed systems were purged dry of moisture and liquid-hydrogen systems were purged of air or incompatible gases.

I approached my division chief for permission to purchase a small mass spectrometer to provide this capability. He was more concerned about developing a leakage-verification capability of the vehicle’s closed compartments and asked if I thought this mass spectrometer technique could perform leakage verification instead. I told him I was sure it had great possibilities. He passed on the idea of using this technique to the design organization in Huntsville, Alabama.

Before the mass-spectrometer system was ready, a visual leak check was performed by launch-site personnel wearing Scott air-packs and an external light source. This practice was discontinued as soon as the hazardous-gas detection system (HGDS) was ready for use. This system is still used on all launch vehicles using liquid hydrogen for fuel.

Although we have learned a great deal about safely handling liquid hydrogen, the challenges continue. The RS-68 engine being considered for use in a new cargo launch vehicle has a 2-second hydrogen flow for start-up, compared with the Space Shuttle main engine 100-millisecond lead. A launchpad shutdown of a vehicle with five such engines could generate enough unburned hydrogen in the exhaust to create a very large fireball rising around the entire vehicle and the mobile launch tower—obviously not a safe operating environment.

 

To help make safety for future launches more affordable, research was initiated for hydrogen and helium visualization techniques. A study led by Glenn Sellar, University of Central Florida, and supported by Sandra Clements, a summer facility professor from Florida Tech, identified two very promising techniques: “Rayleigh Scattering” and “RAMAN/LIDAR.” The idea is to replace the many-point sensors covering the ground hydrogen systems with a visual scanning system that can better detect, visually locate, and quantify the hydrogen present. If the system can operate as a helium detector as well, it can also be used to verify leak-free fluid systems.

This single system would replace not only the hydrogen sensors, but also the many methods of performing leak checks on the fluid systems. The HGDS currently used for monitoring a vehicle’s confined spaces will not indicate where the leak or leaks are located within the compartment. The visual technique would provide this vital information to allow for quick assessment and corrective action. This same technique would also be used to perform the fluid systems functional verification for leak tightness prior to its operation. This would take us one step closer to a fully automated safe approach to managing the perils of liquid hydrogen.

 

About the Author

 

Russel Rhodes has been employed for more than fifty years at Kennedy Space Center. During this time, he has been engaged in the design, development, testing, and operation of ballistic missiles and space transportation systems, and has specialized experience in space vehicle propellant loading, cryogenic, hydraulics, high-pressure gases, and other propulsion systems.