Safety design of the piston rod seal structure for submerged high-pressure liquid hydrogen pump

Abstract

Graphical Abstract

Open in new tabDownload slide

1. Introduction

In recent years, hydrogen energy and its key equipment have seen rapid development in China [1]. During the development process of domestically independent submerged high-pressure liquid hydrogen pumps, considering the importance of liquid hydrogen core transportation equipment in terms of safety [2], various analytical methods and tools have been employed to conduct extensive analysis and research on the liquid hydrogen pump itself. This has been done to enhance its reliability and safety, as well as to improve its performance. High-pressure liquid hydrogen pumps are mechanical devices that compress liquid hydrogen to perform work. Liquid hydrogen is the second coldest liquid on Earth, next to helium, with a temperature as low as −253°C, only 20K above absolute zero. At such cryogenic temperatures, most materials become brittle and fragile, with weakened strength. Structures manufactured at room temperature will contract significantly at low temperatures, leading to changes in tolerances. No lubricant can function effectively at such low temperatures. No sealing material can maintain good sealing elasticity at such cryogenic temperatures. Materials in contact with hydrogen also face the risks of hydrogen permeation, hydrogen corrosion, and hydrogen embrittlement. Under these extreme conditions, the high-pressure liquid hydrogen pumps must deliver an output pressure of up to 45 MPa, and with the demand for downstream hydrogen refueling, its pressure also undergoes periodic pulsations [3], making the design and manufacturing of the high-pressure liquid hydrogen pump extremely challenging and difficult [4].

Due to the fact that international hydrogen energy research still relies on further development [5], the data and information disclosed by the few companies that manufacture liquid hydrogen pumps are also very limited [6]. The civilian application of liquid hydrogen is still in its early stages in China, and the installation quantity and usage experience of liquid hydrogen pumps in China are limited [4]. The reliability data and failure probability data referenced in safety analyses published by both domestic and international institutions are based on the equipment as a whole [7], and there are no publicly available statistical data on the failure probabilities of individual components.

In the energy industry, to design processes that are more rational and safer, analyses and research are conducted on the process flow to identify potential risks. By referring to typical equipment failure probability data within the industry, the likelihood of accidents in specific scenarios is assessed. Semi-quantitative methods are used to evaluate the level of risk, and risk mitigation measures are formulated [8]. During the overall HAZOP (hazard and operability) analysis [9] of the refueling process at hydrogen refueling stations, it was also found that safety consequences arising from failures of the liquid hydrogen pump itself are relatively severe. It is necessary to determine the failure modes, causes, probabilities, and frequencies of internal components of the liquid hydrogen pump, clarify the consequences caused by failures, thereby identifying weak points prone to failure in the liquid hydrogen pump and key components affecting its safe operation. Appropriate optimization and improvement measures should be taken to reduce the frequency of failures, mitigate safety risks brought by failures, increase the fault-free operating time of the liquid hydrogen pump, and enhance its reliability. This holds special significance for the safe operation of liquid hydrogen pumps.

The equipment failure probabilities referenced in HAZOP [8, 9] are typically obtained through the following steps and methods:

Theoretical Calculation: The failure probability is calculated by combining the probabilities of enabling conditions with the frequency of initial events.

Data Verification: The numerical values of failure probabilities are based on reliable data sources, such as accurate meteorological statistics, extensive long-term equipment maintenance and repair records, etc. The accuracy of the failure probability values is verified through long-term actual monitoring and analysis of a large amount of historical data.

Reliability data published by institutions are scientifically reasonable, but they only apply to nonspecific general operating conditions and target industry equipment categories rather than specific equipment. Furthermore, they are not applicable to the failure of individual components within the equipment [7].

1.1. Safety analysis based on component failures of liquid hydrogen pumps

In the safety analysis and development design of liquid hydrogen pumps, an attempt was made to introduce typical failure probability data from the energy industry into the structural research, safety analysis, and design process of liquid hydrogen pump machinery. Design calculations and experimental data were combined to assess and validate the failure probabilities of pump components. Potential faults that may occur in liquid hydrogen pump parts were identified, and the consequences of component failures were determined, leading to a list of key components. Special designs and improvements were made to these critical parts to reduce failure rates, extend safe operation cycles, and enhance pump performance.

The specific approach follows the basic principles of the HAZOP method. Based on the design calculation data of the liquid hydrogen pump components and with reference to experimental data from the testing process, failures that are applicable to submerged liquid hydrogen pumps and have the potential to occur are selected as valid failures. Starting from the function of the components with valid failures, an analysis model is established to determine the analysis nodes, and then appropriate guide words combined with suitable parameters are selected to form deviations. The causes of these deviations are analyzed, and the consequences resulting from the failures are deduced. A comprehensive assessment of their typical failure probability values is conducted [10]. An analysis table of potential failures, their frequencies, and consequences for the liquid hydrogen pump components is obtained, see Table 1 for details. For an example of the analysis process, refer to the case of piston rod seal failure in Section 1.3.

The typical failure probability data in Table 1 reference general statistical data from the energy industry [11]. It is based on a vast amount of historical and experimental data from the energy industry, obtained through the establishment of mathematical models for simulation and calculation, and derived after statistical analysis and expert evaluation. It reflects the likelihood of failure for equipment or systems under general conditions without special design. The consequence analysis table indicates that the failure with the highest probability is pump seal failure. There are as many as 22 locations for pump seals, using more than 40 different types of seals. By classifying the seals of the entire pump, the study found that different types of seals have different failure consequences [12]. Further research and analysis of the seals of the entire pump revealed the failure causes and consequences of three major categories of important seals. See Table 2 for details.

From Table 2, it can be seen that among the three major categories of important seals, the failure of piston rod seals and pump flange seals can cause leaks, leading to unacceptable consequences such as fire and explosion. However, the failure of piston seals only affects volumetric efficiency and performance, without posing safety risks. Further analysis also revealed that the failure of pump casing and flange seals is relatively easy to detect, and their occurrence and development can be monitored more easily. Moreover, due to the lower pressure (below 1 MPa) at the pump flange seal, the time until an unacceptable consequence develops after failure is relatively long, providing ample time for detection and handling. In contrast, failure of the piston rod seal is more concealed because both sides of the seal are inside the pump, making it difficult to detect regardless of the leakage direction. Due to the frequent impact of reversing peak pressures [13] at the piston rod seal, the time from failure to disaster is not long, and the consequences are severe.

Based on the above analysis, it is known that seal failures are the most common failures in the entire pump, with severe and unacceptable consequences. Among them, the highest-risk failure is the failure of the piston rod seal.

To further verify the validity of the typical failure probability data, the system data recorded by the reliability-centered maintenance (RCM) system used during the prototype pump testing process were reviewed and analyzed [14].

During the prototype pump testing, RCM software was employed for the collection, archiving, and analysis of maintenance and reliability. The software’s database contains hundreds of components, with sufficient resolution to identify faulty parts and demonstrate how each component affects overall reliability. The software allows for the creation of work orders to track and schedule maintenance, including detailed information on parts replaced during testing, such as tag numbers and maintenance times. The work orders record the faults that occurred with the parts and the analysis of their causes. The software includes records for each piece of equipment, as well as supplier information, part numbers, and maintenance records [15]. This is of great reference value for further equipment improvements and preventing the recurrence of faults.

In the failure maintenance records captured by the RCM software, the number of work orders for handling seal leak repairs accounts for ~30% of the total, as shown in Fig. 1. Compared to the prototype pump’s testing cycle, it can be seen that under nonspecific conditions, the typical failure probability values for seal leaks are reasonable.

Figure 1.

Classified statistics of failure maintenance records logged in RCM software.

Open in new tabDownload slide

1.2. Safety analysis of piston rod seal structure in liquid hydrogen pump

The medium above the piston rod seal is the hydraulic oil inside the hydraulic cylinder, and the medium below is the hydrogen gas above the piston of the cold-end cylinder. The piston rod seal serves the dual function of sealing the hydraulic oil above and the hydrogen gas below. The failure of the piston rod seal is considered an effective failure, with several initial causes, including wear and erosion during liquid hydrogen pump operation, as well as temperature and pressure pulsations. Assembly and quality are also potential factors. The functional model of the piston rod seal is to seal the hydraulic oil inside the hydraulic cylinder above, preventing the hydraulic oil from leaking downward along the piston rod; at the same time, it seals the hydrogen gas below, preventing the hydrogen gas from leaking upward along the piston rod. An analysis node is set in the center of the piston rod seal. Under normal conditions when the seal is intact, there should be zero flow at the gap in the center of the piston rod seal. When there is an overflow deviation in any direction, it indicates seal failure. The analysis node and deviations are shown in Fig. 2.

Figure 2.

The piston rod seal structure of liquid hydrogen pump.

Open in new tabDownload slide

The consequences of piston rod seal failure can be analyzed as the following scenarios:

When the gas seal fails independently, hydrogen can leak upward into the two annular spaces inside and outside the seal bushing. As the piston rod moves, hydrogen continuously permeates into the hydraulic oil system, eventually accumulating in the hydraulic oil tank. This can lead to an explosion of the hydraulic oil tank. If the inspection hole is open, the leaking hydrogen mixes with oxygen in the air, forming an explosive gas mixture in the annular space of the seal bushing. Under ignition sources such as static electricity, a local explosion may occur, rapidly damaging the oil seal and gas seal, causing greater harm [16]. The consequences are unacceptable.

When the oil seal fails independently, hydraulic oil leaks downward due to pressure and the movement of the piston rod. Due to pressure peaks in the hydraulic oil, small amounts continuously break through the gas seal and enter the extended section cavity of the liquid hydrogen pump and the annular space around the piston rod [16], mixing with the hydrogen gas inside. The hydraulic oil also moves downward due to gravity and the action of the piston rod, solidifying in the lower cold zone into solid particles that contaminate the liquid hydrogen in the storage tank, rendering the entire tank’s liquid hydrogen unusable. In severe cases, solidified particles of hydraulic oil can cause jamming of the check valves at the inlet and outlet of the liquid hydrogen pump and downstream process, resulting in abnormal operation of the liquid hydrogen pump, high-pressure backflow into the low-pressure, and other issues.

When both the gas seal and oil seal fail, hydraulic oil and hydrogen mix throughout the entire system, contaminating and rendering the entire tank of liquid hydrogen unusable, leading to an explosion of the hydraulic oil tank. The consequences are unacceptable.

In the safety analysis of the piston rod seal structure, it was found that the failure probability of the piston rod seal is high and the consequences are severe. Actual experimental tests have also verified the possibility and mode of its failure. For example, during the disassembly inspection after a normal pressure liquid nitrogen test (liquid nitrogen cold-end temperature: −196°C, pump outlet pressure: 42 MPa, output flow: 1600 kg/h), it was discovered that multiple piston rod seals in several liquid hydrogen pumps had experienced torsional failure within the seal groove positions as shown in Fig. 3.

Figure 3.

Two hydrogen seal rings experienced torsional failure.

Open in new tabDownload slide

The reason analysis indicates that the seals in this batch were made of ordinary standard materials, which contracted and weakened in strength at low temperatures, leading to substandard quality performance. If such a failure occurred during the liquid hydrogen test, it would cause hydrogen gas to leak upward into the hydraulic oil tank, resulting in an explosion of the hydraulic oil tank. The hydraulic drive system is located on the public auxiliary skid, arranged together with the distribution cabinet, programmable logic controller (PLC) control cabinet, air compressor system, etc., making it a high-frequency area for personnel access and exposure, with unimaginable consequences.

1.3. The optimization and safety design of the sealing structure for the piston rod

Safety analysis and experimental testing have both demonstrated the likelihood of piston rod seal failure and the severity of its consequences. To address this, technical optimization and upgrade measures have been taken for the design of the sealing pair and the performance quality of the seals. Special designs have been made for the sealing pair, with enhanced technical requirements and higher standards for the material of the seals, as well as strengthened quality and performance inspections of the seal rings. The following technical measures have been implemented: (i)ensuring the surface roughness of the piston rod processing [17], (ii) ensuring the coaxiality of the piston rod, seal sleeve, and flange holes during design, manufacturing, and assembly, (iii) reasonably designing the sealing clearance and tolerance between the seal sleeve and the piston rod and flange holes, (iv) ensuring the material of the seal ring meets the requirements, guaranteeing its wear resistance and self-lubricating properties, (v) precisely designing the dimensions and shape of the seal ring to ensure its strength and toughness, (vi) reasonable matching of the seal ring and seal groove dimensions.

In addition, a detailed study and safety design were conducted on the piston rod sealing structure.

The prototype pump is designed with an inspection hole between the gas seal and oil seal at the piston rod seal location, as shown in Fig. 2, to facilitate performance checks on the sealing components on both the upper and lower sides [18], while also balancing pressure changes due to temperature variations. The initial idea was to utilize this inspection hole to prevent the mixing of hydraulic oil and hydrogen gas in case of seal failure, which could pose hazards. After detailed analysis, the following conclusions were drawn:

The original inspection hole has a diameter of only 5 mm, and its channel extends from the outer side of the flange to the central piston rod seal sleeve, with a length of 258 mm. Deep inside and outside the seal bushing, there are two annular spaces: one between the seal bushing and the pump flange center hole, and the other between the seal bushing and the piston rod. Even if the plug on the inspection hole is removed to keep the interior in constant communication with the external environment, the internal space remains relatively closed. Once hydrogen leaks, it cannot freely diffuse and will still accumulate in this space, forming an explosive mixture in the presence of oxygen. Similarly, if hydraulic oil leaks, it cannot freely flow out of the pump but will accumulate in the annular space and seep towards the cold end of the liquid hydrogen pump, thus the risk remains.

Can the diameter of the original inspection hole be enlarged to a sufficiently open size? The original inspection hole is constrained by various structures and components around the flange, making it impossible to enlarge its size. Moreover, enlarging the inspection hole would affect the strength of the original pump flange, reducing its strength. The internal structure of the flange would need to be redesigned and calculated, which involves significant workload and great difficulty in implementation.

Utilizing the inspection hole for purging with air or nitrogen is considered. Due to the need for pressurization during purging, and the working pressure range of the liquid hydrogen storage tank being 0-1.0 MPa, the pressure of the pressurized air or nitrogen would exceed the pressure of the liquid hydrogen storage tank, entering the tank when its pressure is low. The entry of air would directly form an explosive gas mixture, leading to an explosion of the liquid hydrogen pump well, causing the liquid hydrogen storage tank to fail, and ultimately resulting in the explosion of the liquid hydrogen storage tank. This is unacceptable. Nitrogen entry will cause solidification resulting in the formation of solid nitrogen, which will contaminate the liquid hydrogen, cause the check valves to jam and fail, allow high-pressure hydrogen to backflow into the low-pressure liquid hydrogen storage tank, and lead to more severe consequences.

Install hydrogen and hydraulic oil detectors using the inspection hole. Analysis shows that the inspection hole is too small and cannot be enlarged, leaving insufficient space for installing sensors internally. The hole is located on the side of the flange; even if sensors are installed externally, it further increases the installation space requirements for the pump, leading to additional engineering issues. Transporting the pump with extended sensors protruding from the flange side is more inconvenient and prone to damage, causing sensor failure. Even if sensors are installed, they only address the detection issue without solving the mixing problem. There is still a chance of oil and gas mixing before maintenance or after sensor failure, posing unacceptable hazards.

Based on the above analysis, the original design’s inspection hole has limited utility and is difficult to utilize. After repeated evaluation and consideration, it has been decided to abandon the idea of using this hole.

To completely reduce the hidden risks associated with piston rod seal failure, following the inherent safety design philosophy and adhering to the ALARP (as low as reasonably practicable) principle for risk control [11], the sealing structure of the piston rod has been re-optimized. The new structure separates the hydraulic oil seal and hydrogen gas seal on the piston rod, with an added vented section in between. The vented section consists of a connector with numerous ventilation channels, exposing a short segment of the piston rod directly to the external environment through its many channels. A comparison of the old and new sealing structures for the submerged liquid hydrogen pump’s piston rod is shown in Fig. 4.

Figure 4.

The comparison of the old and new sealing structures.

Open in new tabDownload slide

2. Conclusion

After the aforementioned improvements and safety design, the submerged high-pressure liquid hydrogen pump underwent a series of long-duration actual operation tests, including multiple water tests (ambient temperature water, pump outlet pressure 0–45 MPa, flow rate 0–2800 kg/h), multiple atmospheric pressure liquid nitrogen tests (liquid nitrogen, cold-end temperature −196°C, pump outlet pressure 0–45 MPa, flow rate 0–1800 kg/h), multiple pressurized liquid nitrogen tests (liquid nitrogen, cold-end temperature −196°C, pump outlet pressure 0–45 MPa, flow rate 0–2300 kg/h, storage tank pressure 0–0.8 MPa), and liquid hydrogen tests (LH₂ cold-end temperature −253°C, pump outlet pressure 0–45 MPa, flow rate 0–240 kg/h, storage tank pressure 0–0.8 MPa). The cumulative sealing travel exceeded 15.3 km, with no further occurrences of piston rod seal failure. After the tests, disassembly and inspection revealed the maximum mass loss of the seal ring to be 0.045 g. Assuming a linear wear rate proportional to the number of cycles, with a wear rate of 0.015 g per 10 000 cycles, the seal is expected to withstand over 4.9 million cycles. Assuming multiple seals share the sealing function on average, the total number of cycles before the complete failure of the piston rod seals would be around 30 million. Estimating for a 1000 kg/d scale hydrogen refueling station, if two pumps are installed and used alternately, these pumps would be able to run continuously without failure for over 35 years [19]. The failure probability of the piston rod seal is reduced, and the estimated service life is increased. Actual tests have proven that its performance metrics meet the design requirements.

The added exposed section completely separates the hydraulic oil seal from the hydrogen gas seal. When the hydrogen gas seal fails, the hydrogen will freely disperse into the ambient air within the exposed section, without accumulating near the pump or permeating into the hydraulic oil system. When the hydraulic oil seal fails, the hydraulic oil will freely flow outside the pump, preventing it from entering the liquid hydrogen storage tank and causing harm. In this way, even in the event of seal failure, hydraulic oil and hydrogen gas will only freely disperse into the external environment of the pump, without mixing within the liquid hydrogen pump system. There will be no infiltration of hydrogen into the hydraulic oil system, nor will there be contamination of the liquid hydrogen in the storage tank or blockage of the liquid hydrogen pump by solid particles. This innovative design is safety-compatible with the failure of the piston rod seal. The dispersed hydrogen is also detected by the hydrogen sensor located above the pump. Hydraulic oil leaks are easily noticeable and monitorable by personnel, allowing for quick detection. The original hidden faults have now become apparent faults, making them easier to detect and repair in a timely manner. This avoids the hidden risks associated with piston rod seal failure. Personnel will take various measures based on the extent of the leak, and if necessary, maintain the pump and replace the failed seals to ensure the safety and integrity of the pump. This aligns with the principle of inherent safety. Comprehensive reevaluation [20] results show a significant reduction in the harmful consequences of piston rod seal failure.

Utilizing the technical principles of safety analysis in the energy industry [11], effective faults that could occur in liquid hydrogen pumps are identified. Typical failure probability data are referenced and evaluated [21]. Based on component functions, an analysis model is established, and critical nodes are selected for failure scenario analysis. The consequences of liquid hydrogen pump faults are then deduced. This results in a list of key components affecting the safe operation of the pump. This list guides further optimization and improvement of mechanical equipment reliability and safety, as well as safety design. Special design and optimization techniques are used to reduce failure frequency. Combining the principle of inherent safety, the piston rod seal structure of the submerged high-pressure liquid hydrogen pump was innovatively designed and developed, successfully implementing improvements to the seal structure. This enhances equipment reliability, reduces fault risks and the severity of its consequences, and ensures long-term safe operation of the equipment.

Author contributions

Feng Zhang (Conceptualization [lead], Data curation [lead], Formal analysis [lead], Investigation [lead], Methodology [lead], Project administration [equal], Resources [equal], Software [equal], Validation [lead], Visualization [lead], Writing—original draft [lead], Writing—review & editing [lead]), Xuan Li (Funding acquisition [lead], Project administration [lead], Resources [lead], Supervision [equal]), Xin Zhang (Data curation [equal], Formal analysis [equal], Methodology [equal], Software [equal]), Xue Xiong (Formal analysis [equal], Investigation [equal], Methodology [equal], Resources [equal]), Xin Cui (Conceptualization [equal], Investigation [equal], Validation [equal], Visualization [equal]), Xingye Cai (Funding acquisition [equal], Project administration [supporting], Resources [equal], Validation [equal]), and Guangli He (Conceptualization [supporting], Funding acquisition [equal], Methodology [supporting], Project administration [supporting], Resources [equal], Supervision [lead])

Conflict of interest

There is no conflict of interest.

Funding

None declared.

Data availability

The data that support the findings of this study are available from the corresponding author upon reasonable request.

References