Gas control equipment malfunction on board the gas tanker Suiso Frontier, at Western Port, Hastings, Victoria, on 25 January 2022

Executive summary

What happened

On the evening of 25 January 2022, a gas control equipment malfunction occurred on the liquified hydrogen tanker, Suiso Frontier, while the ship was berthed in the Port of Hastings, Victoria. The fault resulted in a gas flame briefly propagating onto its deck, however, it did not result in a fire or explosion. 

What the ATSB found

It was found that the ship’s gas combustion unit’s (GCU) air fan discharge damper actuators were fitted with the incorrect type of electrical solenoid valves, which subjected the valves to damage during service. During operation on 25 January, one of the solenoid valves failed, resulting in the fan damper closing. With no air, the GCU overheated and the hydrogen flame inside it became unstable and propagated outside the unit’s vent on the ship’s deck. 

The ATSB also found that the GCU control system was not equipped to detect a damper closing during operation, and that automated safety controls intended to detect a malfunction to prevent such an incident were not effective.

What has been done as a result

The manufacturer of the GCU has advised the ATSB that limit switches have been fitted on each air fan discharge damper to monitor damper position. In addition, the system’s control logic has been programmed to stop the unit if a fault is detected. 

Safety message

This incident highlights the importance of ensuring automated shipboard operating systems are equipped with safety controls to prevent hazardous consequences in the event of a malfunction. Since operators may be inherently removed from the control loop of automated systems, there is a heightened risk that they will not be able to identify abnormalities promptly and respond to them. Therefore, system safeguards should be appropriate for promptly alerting operators to any issues, or automatically stopping the operation to prevent damage or injury.    

The incident also shows the importance of stringent manufacturer quality controls to ensure correct system components are specified and fitted to equipment.

The investigation

At 1330 Eastern Standard Time[1] on 20 January 2022, the liquified hydrogen (LH₂) tanker, Suiso Frontier, berthed at Bluescope berth number 2 in the Port of Hastings, Victoria. The ship was on its maiden voyage, having departed Kobe, Japan on 25 December with 55 t of LH_2, loaded for the purpose of testing its cargo and monitoring systems. The ship was to load additional LH₂ from the gas liquefaction facility at Hastings for Kobe, as part of a pilot program associated with the carriage of LH₂ by sea. 

After 3 days of preparation, the transfer of LH₂ to Suiso Frontier began at 0715 on 24 January. The transfer was completed by 1500 that day, with the ship scheduled to depart on 27 January.

While berthed on the evening of 25 January, the chief mate and cargo engineer made plans to start the ship’s gas combustion unit or GCU (see the section titled Gas combustion unit and Figure 1) to burn excess boil-off gas (BOG) from the LH₂ cargo tank.[2] They notified the wharf operator and followed standard procedures for preparing the GCU, including conducting required safety checks. The ship was equipped with 2 radial fans to supply combustion, cooling and dilution air to the GCU, and fan number 1 was pre‑selected for use. 

Figure 1: The gas combustion unit

Source: Suiso Frontier   

At 1947, the chief mate and cargo engineer initiated the starting sequence of the GCU from the unit’s compartment in the ship’s forecastle space. The unit’s control system then performed a series of automated function tests to ensure the correct parameters were present for stable hydrogen combustion. By 2007, the GCU was in operation.

Over the next 8 minutes, the cargo engineer gradually increased the hydrogen flow until the maximum combustion rate of 40 kg of hydrogen per hour was reached. All GCU parameters and temperatures were observed to be within their normal range. Meanwhile, the third mate had started their watch and was assigned to monitor the GCU from the cargo control room (CCR).

At about 2147, an able seaman (AB) was conducting routine safety rounds on deck when they saw a 1 m high yellow flame propagate for about 5 seconds from the GCU vent stack on the port side of the ship’s foredeck (Figure 2). The AB immediately notified the third mate in the CCR via handheld radio. Seconds later, the GCU flue gas temperature reached 450°C, triggering the high flue gas temperature and common alarms in the CCR. The third mate quickly shut down the GCU and closed its main hydrogen supply valve. After confirming with the AB that there was no flame from the vent stack, the third mate telephoned the chief mate, master and cargo engineer.

Figure 2: Location of the GCU vent stack

Source: Online photo from hydrogen-central.com and inset photo from Suiso Frontier 

When the chief mate arrived in the CCR, the GCU was going through its programmed shutdown sequence. When the GCU stopped at 2149, the chief mate ventured out on deck to investigate. Moments later, the master arrived in the CCR and was informed that the GCU had been stopped and inspections were underway. The master then proceeded to the bridge, raised the fire alarm and used the ships public address system to make an announcement to muster the crew. Crew members promptly responded, mustering at their emergency stations and began preparing fire hoses as per standard procedures. 

Meanwhile, the chief mate was joined by the cargo engineer on deck where they inspected the GCU and adjacent compartments. They closed additional gas valves to isolate the GCU and checked temperatures with an infrared thermometer. While temperatures around the GCU vent stack appeared to be abnormally high at 160‑180°C, there were no significant hot spots or signs of fire.    

At 2249, after confirming that the temperature of the GCU was steadily decreasing, the master determined that there was no risk of fire and stood down the crew. As a precaution, regular inspections of the GCU were carried out throughout the rest of the evening.        

Post-incident inspections 

Following the incident, the ship’s engineers inspected the GCU under guidance from its manufacturer. They did not identify any significant damage to the GCU.

A review of the GCU data log from the time of the incident revealed that the GCU combustion chamber and flue gas temperatures had started rising at 2144, about 3 minutes before the AB sighted the flame.

Further inspections identified that the solenoid valve for one of the GCU’s air fan discharge damper actuators had burnt-out and was no longer operational. It was concluded that the solenoid valve had failed at about 2144 and caused the damper to close, cutting off the GCU’s air supply for combustion, cooling and dilution.

Suiso Frontier

Suiso Frontier is a 116 m liquefied hydrogen (LH₂) tanker registered in Japan. The ship was built in 2021 by Kawasaki Heavy Industries, Japan and classed with Nippon Kaiji Kyokai. It was built as a prototype ship for assessing the technical aspects of transporting large volumes of LH₂ by sea. A 1,250 m³ vacuum-insulated double-shell cargo tank permits the carriage of LH₂ at 1/800 of its gas-state volume at a temperature of -253°C.

The ship was owned and operated by the multi-company consortium Hydrogen Energy Supply‑chain Technology Research Association (HySTRA) and managed by the Shell International Trading and Shipping Company (STASCO).

Crew

Susio Frontier had a crew of 24, comprising Indian, Croatian, British and Filipino nationals. The master and crew were appropriately qualified and had experience on various ship types, including gas tankers. 

The master had 20 years of seagoing experience, most of which was on board gas tankers, including liquid petroleum gas (LPG), liquid natural gas (LNG) and ammonia tankers. They were first assigned to Suiso Frontier during its building in November 2020, before joining the ship as master in December 2021.

The chief mate had 16 years of seagoing experience and had worked on oil, product, chemical and LNG tankers. They joined Susio Frontier as chief mate in August 2021.           

The cargo engineer had 16 years of seagoing experience and had worked on bulk carriers, container ships and LPG, LNG and chemical tankers. They first became involved with Suiso Frontier during its building in November 2020, before joining the ship as cargo engineer and second engineer in December 2021.

The third mate had 16 years of seagoing experience and had worked on container ships and LNG, chemical and oil tankers. They first became involved with Suiso Frontier during its construction in December 2020, before joining the ship as third mate and extra chief officer in November 2021.

The able seaman (AB) had 27 years of seagoing experience and had worked on LNG tankers before joining Suiso Frontier in December 2021. 

Hydrogen safety precautions

Hydrogen gas has a wide flammability range of between 4‑75% concentration in air. It is easily ignited by various ignition sources, including flames, sparks, static electricity and hot surfaces. While pure hydrogen burns with a barely visible flame, it reacts with impurities such as dust or sodium resulting in a yellow flame. Due to the volatility of hydrogen, robust fire prevention controls were established on Suiso Frontier, including the elimination of any potential ignition sources on its outer decks. The ship was also fitted with gas detectors throughout, and the crew carried portable gas detectors and wore anti-electrostatic boiler suits and boots on deck. 

Gas combustion unit

Suiso Frontier’s gas combustion unit (GCU) was built by the German company Saacke, which manufactures numerous industrial and marine combustion systems, including GCUs for LNG tankers.

It was routine on board the ship to start the GCU whenever it was necessary to reduce the LH₂ cargo tank pressure through combustion of boil-off gas (BOG). After the GCU start sequence was initiated, the operation was managed automatically by the unit’s programmable logic controller.

As the ship had departed Kobe partially loaded, the GCU had been operated regularly during the voyage to Australia, logging about 800 hours of service. 

Fan air supply

Saacke GCU models for LNG tankers were commonly fitted with 4 independent air fans, each providing a separate air supply for combustion, cooling and dilution. Although Suiso Frontier’s GCU was a similar design to those, it was required to be smaller in size due to limited space on board the ship. Hence, Saacke designed the unit to operate with 2 radial air fans.

During operation, only one fan was required to be operating. The fan provided a large volume of air via a distribution drum to 3 automatically‑operated control vanes which split the air supply into different parts of the GCU for the combustion, cooling and dilution functions (Figure 3).

Figure 3: GCU and fan air supply

Source: Saacke, annotated by the ATSB

A discharge air damper was installed between each fan outlet and the air distribution drum. The dampers were designed to be either fully open when the corresponding fan was running or fully closed when it was stopped. Each damper was controlled by an actuator equipped with a pneumatic solenoid valve. When energised by the GCU control system, the solenoid valve directed compressed air into the actuator to open the damper. When the solenoid was not energised, the valve closed and the spring-loaded damper actuator returned the damper to its closed position.

An investigation by Saacke identified that the specifications it had issued for the vent damper actuator solenoid valves were incorrect. As a result, the 24 V direct current (DC) solenoid valves which had been installed on the actuators (Figure 4) were incompatible with the 230 V alternating current (AC) supply from the GCU control system.

Figure 4: The vent damper actuator solenoid valve

Source: Suiso Frontier

Unlike DC solenoids, AC solenoids feature a conductive shading ring which minimises vibrations and helps keep the solenoid’s armature open as the supply current continuously changes polarity (alternates). The structural components used in a 230 V AC solenoid, such as the insulated wire used for the coil, were constructed differently and rated for higher loads than those used in a 24 V DC solenoid.

Safeguards and alarms

The risk assessment carried out by Saacke for GCU operation was based on existing documents for its LNG tanker GCU models. The resulting Failure Mode and Effect Analysis (FMEA) documented the potential consequences of various component failures, and the safeguards to mitigate them. The safeguards relied on 2 ultraviolet flame scanners and various temperature and pressure transmitters to detect deviations from normal operating parameters. These were designed to trigger system alarms and shut down the GCU as required.

The FMEA included a failure study involving the discharge damper being in the wrong position or closed, causing the hydrogen flame inside the GCU to become unstable. The flame scanners were intended to detect this and trigger an automatic shut-down of the GCU.

The GCU was also fitted with transmitters to monitor the flue gas and combustion chamber temperatures. If the flue gas temperature reached 450°C, a high temperature alarm would activate, and if it reached 513°C, the GCU was programmed to automatically shut down.  

A display on the GCU control panel in the CCR indicated whether the damper actuator solenoid valve for the selected supply air fan was receiving a command signal. However, the system could not detect whether the dampers were open or closed. 

A low-pressure transmitter had been installed between each radial fan and the corresponding damper (Figure 5). The transmitter was intended to detect any drop in air pressure from the fan during operation. There were no other air pressure transmitters between the damper and the GCU.     

Figure 5: Location of the low air pressure transmitter

Source: Saacke, annotated by the ATSB

Failure of damper actuator solenoid

The solenoid valves installed on the gas combustion unit’s air fan discharge damper actuators were of the incorrect specification.

Due to the mismatched specifications between the 24 V DC solenoid valves and the control system’s 230 V AC power supply, the solenoid valves had been subjected to damaging vibrations and high temperatures during operation. After a relatively short 400-hour service life, one of the solenoids eventually failed at the time of the incident, most probably due to overheating and material fatigue, leading to a short circuit or functional fault.[3]

Closing of vent damper

Following the failure of the damper actuator solenoid valve during GCU operation, the damper closed, significantly restricting air supply to the GCU for combustion, cooling and dilution.

Due to the wide flammability range of hydrogen gas, enough air remained within the GCU to support combustion of the gas for several minutes after the damper closed. However, as the airflow for cooling and dilution was significantly restricted by the closed damper, temperatures in the GCU began to rise. Following the restriction of air to the GCU, the hydrogen flame gravitated towards the ambient air outside of the vent. As the flame rose up from the vent, it probably reacted with sodium chloride (salt from the environment at sea) ingrained on the inner flue surfaces resulting in the yellow flame that the AB reported.

Gas combustion unit design

The GCU’s safety systems did not detect and respond to the malfunction in time to prevent the hydrogen flame propagating from the vent stack.  

The manufacturer’s failure mode and effect analysis (FMEA) predicted that, in the event of the damper closing during operation, the GCU’s 2 flame scanners would detect the resulting instability of the hydrogen flame and shut down the GCU. However, when the damper closed, the scanners did not detect any abnormality despite the hydrogen flame transitioning out of the vent stack.

The GCU was not equipped to detect the failure of the vent damper solenoid valve or the subsequent closing of the damper. A low air pressure transmitter was fitted to the GCU but was located between the fan and the damper. As a result, it did not activate when the damper closed since the air pressure on the fan side of the damper did not drop.

From the evidence available, the following findings are made with respect to the gas control equipment malfunction on board the liquid hydrogen tanker Suiso Frontier at the Port of Hastings, Victoria on 25 January 2022.

Contributing factors

• An incorrect type of solenoid valve had been installed on the pneumatic damper actuators for the gas combustion unit's (GCU) 2 air fans. The 24 V direct current solenoid valves installed were incompatible with the system's 230 V alternating current power supply.
• During operation of the GCU, the fan discharge damper providing combustion, dilution and cooling air closed when the damper's actuator solenoid valve failed. Consequently, the temperature in the GCU increased, making the hydrogen flame unstable, which then propagated from the unit's vent stack on the ship’s deck.
• The GCU was not equipped to detect an air damper closing during operation, and its flame scanners were ineffective in detecting the abnormal condition as per the manufacturer’s risk assessment. As a result, the GCU alarm and shut-down mechanisms did not activate in time to prevent the flame propagating from the vent on deck.

Safety action by Saacke

On 12 October 2022, Saacke advised the ATSB that it has installed limit switches to the gas combustion unit’s air fan discharge dampers as agreed with the Suiso Frontier’s manager, Shell International Trading and Shipping Company. The limit switches are designed to monitor the position of the dampers and the system’s control logic has been programmed to automatically stop the GCU if an ‘open’ signal from the dampers is not detected. The modifications were confirmed to be functioning as designed and approved by the ship’s classification society.