CNG Cylinder Rupture at Philadelphia Gas Works (PGW)
J. B. Dimmick January 22, 2009
This report is organized in three major sections:
The results of the initial site examination at Philadelphia Gas Works (PGW)
Discussion of the results of subsequent laboratory examinations of the metal liner and
composite overwrap of the ruptured cylinder and a later site examination of the PGW fill
A discussion of conclusions and recommendations.
The Clean Vehicle Education Foundation is grateful for the extensive support of PGW in
allowing and facilitating the site examinations and funding the laboratory examinations
of the ruptured cylinder. Dan Hillman of NHTSA also provided valuable assistance in
conducting the inspection and photo documentation during the initial site examination.
Initial Site Examination and Incident Information:
The vehicle involved in the incident is a 1998 dedicated OEM CNG Ford van. The
vehicle’s fuel system appeared to be as-delivered from the factory except for incident
damage and no modifications to the original system were noted. The fuel storage
consists of three Type 2 cylinders provided by Lucas Aerospace to Ford. These cylinders
have alloy steel liners and are hoop-wrapped with a composite of E-glass and epoxy.
One long cylinder (12” x 72”) is mounted alongside the driveshaft on the driver’s side
and the other two (14” x 34”) are mounted transversely behind the rear axle. Each
cylinder is equipped with an internal solenoid valve and internal pressure relief device
(PRD). According to PGW, the van was used as a general service vehicle and would
have visited residential, commercial and industrial sites. Several pieces of “furniture”
(shelves, bench, etc) were installed in the van. These were secured by a number of bolts
through the van floor. The van had not been involved in any traffic accidents.
Date: June 9, 2008 1:45 pm
The driver reported that he had refueled the van at the PGW Tioga station and that he
noted the dispenser gage showing 3,200 psi at the end of fill. No unusual noises were
noted during the fill. The van was then driven across the lot and left idling while the
driver went inside. The tank ruptured while he was gone.
The van was severely damaged by the cylinder rupture. A piece of the driver’s side
frame rail was blown from the vehicle and there was considerable bulging of the body.
The floor was bulged up and split. A dome from the cylinder was found inside the
vehicle. The fill receptacle was blown free and damaged an adjacent shipping container.
There was also damage to nearby vehicles and considerable glass breakage in the area.
All of the damage appears to have been to the property of PGW or its employees.
PGW moved the vehicle to their garage facility and stored it outside beneath a ramp. The
fueling station was shut down pending investigation.
Vehicle Examination: (July 17-18, 2008)
The examination of the vehicle and the removal of the ruptured tank were carried out
with the presence of John Dimmick representing the CVEF and Dan Hillman
representing NHTSA. All work was carried out by PGW employees in their facility.
Preliminary Vehicle Examination:
The tarp covering the vehicle was removed and observations with photographs were
made. Figure 1 shows the driver’s side with the damage from the rupture. The mid-ship
cylinder located under the floor and between the driveshaft and the driver’s side frame
rail had ruptured. It was clear that a large portion of the cylinder had ruptured and the
steel liner opened up nearly flat. Another portion was still cylindrical and contained the
cylinder valve. The opposite dome of the cylinder had become detached and was
projected into the vehicle through a rupture in the floor. A large portion of the composite
hoop wrap had failed and come loose from the cylinder. Most of these wrap fragments
had been secured from the scene and conserved. Some fragments of composite and a
strap were removed from beneath the vehicle to allow access.
Remaining Intact Tank Examination and Residual Pressure Measurement:
The OEM Ford van was fitted with three CNG cylinders. The other two cylinders were
mounted transversely behind the rear axle. The first step in disassembly was to access
these cylinders, determine their condition and whether they were safe and then to
measure their residual fuel pressure. Each individual cylinder was fitted with a normally
closed cylinder valve that should have closed automatically as a result of the rupture. The
valve control logic will de-energize the solenoid if the engine stops or a collision-sensing
impact switch is activated. The tanks were installed with a sheet metal shield underneath
to prevent damage from road debris.
The van was raised and supported on jack stands to allow access under the rear cylinders.
The metal shield was removed and it was determined that the cylinders appeared
undamaged. Each rear cylinder had an inspection sticker (Figure 2) indicating that the
next inspection was due in August of 2009. The maximum inspection interval for CNG
fuel cylinders is three years.
A pressure gage was connected to the cylinder valves and the solenoids were energized to
pressurize the gage. The residual tank pressures were recorded 1,300 psi and 1,400 psi.
Based on the driver’s report, a reading closer to 3,000 psi was expected if the solenoid
valve closed immediately after the rupture. The valve control circuit is designed to de-
energize the solenoid if the engine stops. The fuel line was severed when the receptacle
was blown off and the engine would have stopped very soon after the rupture. It is
possible that the gas downstream of the regulator was enough to keep the engine idling
for a period of time after the rupture. This may explain how fuel could have vented
through the solenoid valves. It is also possible that the valves did not close completely,
perhaps due to debris or wear of the valve seat although it was decided not to dismantle
the valves at this time. It was decided that pending the results of the laboratory
examination of the cylinder, it may become necessary to sample the gas composition in
these tanks in the event that internal corrosion is indicated. Valve leakage could have led
to a loss of pressure in the two-plus months since the incident. The fact that the tank
pressures were nearly the same seems to make the pressure loss a result of a common
Removal of the Ruptured Cylinder:
After taking a number of photos of the cylinder in situ, the remaining mounting bracket
was removed along with the main portion of the cylinder. The detached dome was also
removed from the van and all of the cylinder parts relocated indoors for closer
examination. It was noted that the bracket had worn through the anti-skid tape on the
cylinder circumference and may have been wearing into the composite. A number of
straight flat translaminar fractures were also noted in the composite wrap. These
fractures are perpendicular to the fiber direction and were present both in the broken
composite rings and in the composite remaining around the intact cylindrical portion.
Visual Examination of the Ruptured Cylinder:
The manufacturer’s label (Figure 14) on the ruptured cylinder contained the following
Manufactured in 03/1998 DOT
Service Pressure 2070 kPa (3000 psi) @ 70oF (21oC)
NGV2-2 / 3000 psi Design Temp -40oF to 180oF
CSA B51 CNG-2 200 Bar 15oC (59oF) CRN H9908.1
Lucas Serial Number AR148-4 PRD:CG-9
P/N: F7UA-901D-DB WC: 106L WT: 96KG
The labels on the two transverse rear-mounted cylinders were also consistent with the
model year of the vehicle.
All cylinders were Type 2 meaning that the metal liner is reinforced with composite only
in the hoop or circumferential direction. They were certified to three parallel standards,
ANSI NGV2, CSA B51 and Federal Motor Vehicle Safety Standard 304 a DOT
(National Highway Transportation Safety Administration) standard.
The composite over a length of about 36 inches was fractured into many detached rings
that were separated from the liner during the rupture (Figure 3). The detached composite
rings from the ruptured portion of the cylinder showed both flat translaminar and broom-
type fractures. The flat translaminar fracture is commonly associated with stress
corrosion cracking of the glass fiber composite. The broom-type fracture is typical of a
tensile overload fracture. Fractures due to stress rupture do not exhibit the flat
translaminar appearance but are more broom-like in appearance.1
The composite remaining on the intact cylindrical portion exhibited the expected color
and gloss for this particular design. It also showed the circumferential matrix cracks that
commonly occur during manufacturing and are normal in Lucas cylinders. These cracks
are parallel to the glass fiber and are generally considered normal for Type 2 cylinders.
There were also a number of the flat translaminar cracks typical of stress corrosion
cracking damage to the composite during service. These flat translaminar cracks are
perpendicular to the fiber and form a very straight crack with the crack surface square
with the glass fiber direction. Some of these cracks had penetrated the entire thickness of
the composite and an open crack was easily visible. At other locations the crack was
only part way through and the crack had not opened. The composite on the intact
cylindrical section showed flat translaminar cracks on a portion of the circumference.
(Figures 11 and 12)
The orientation of the cylinder in the vehicle was established by comparing the valve
orientation found on an exemplar vehicle. From an orientation looking from the rear of
the vehicle (valve end of the cylinder) forward, the composite cracks are predominantly
on the top outside facing the driver’s side.
On the intact cylindrical section, an area of wear from the bracket at the anti-skid tape
location was examined and an exemplar vehicle was placed on a hoist and examined for
reference. Figure 4 shows a view of the exemplar vehicle bracket where the rubber
isolator is too short. Figure 5 shows the opposite end of the rubber isolator on the
exemplar. Note that only in Figure 5 is the rubber extrusion between the metal bracket
and the anti-skid tape on the outside of the composite. Figure 6 shows the resulting wear
pattern on the exemplar cylinder, very similar to the wear on the ruptured cylinder. In
both vehicles, it appears that the rubber strip did not extend far enough and the bolting
load on the bracket was pressing the metal bracket into the composite without the rubber
strip isolation. Further examination disclosed that both rubber strips in the exemplar
vehicle were probably too short and not just misplaced. If the strip were repositioned
enough to cover the short end, the other end of the bracket would contact the composite.
This defect would be cause for rejection according to the visual inspection criteria found
in CGA C-6.49. The inspection stickers were current, indicating that the cylinder and
installation were found to be acceptable. It is possible that the inspector thought that the
anti-skid tape under the rubber was in fact an isolator, but this is not the intent. This
possible confusion of the tape and the isolator may be a weakness in the training of
inspectors. The rubber strip is not disturbed during normal inspection unless the rubber
has shrunk in service. In either case, the rubber was not long enough when new to
prevent contact between the steel bracket and the cylinder composite for the vehicle life.
Internal Solenoid Valve:
The exterior of the valve shows some impact damage but the solenoid mechanism on the
inside is destroyed with a loose snarl of copper wire and the other components. This has
been observed in two other cylinder ruptures that used this type of valve. It is estimated
that either the mechanical shock of the rupture breaks the solenoid loose or else the high-
pressure gas inside the solenoid causes the solenoid enclosure to rupture when the
cylinder pressure outside the solenoid suddenly drops. It appears that this is likely an
effect, not a cause.
Pressure Relief Device (PRD):
This device is integrated into the internal solenoid valve. It is a CG-9 PRD as designated
on the cylinder label. A CG-9 PRD is activated only by elevated temperature, not by
excess pressure, and is intended to protect against rupture of the cylinder in a fire. The
manufactured date on the cylinder is the same as the publication date for ANSI/IAS
PRD12, a standard developed explicitly for CNG pressure relief devices. It is likely that
this PRD would have met the requirements of PRD1 if tested.
The steel cylinder liner was in two pieces with the solid dome detached. The cylinder
was originally about 72 inches long with a diameter of about 12 inches. The general
appearance of the liner is as would be expected for a rupture due to gas pressure. The
liner split longitudinally for a distance of approximately 3 inches. Part of one side of this
split was resting on the pavement after the vehicle was relocated and shows considerable
corrosion, probably from contact with the moist pavement. The matching fracture edge
on the other side shows no significant corrosion. The longitudinal split appears to have
turned 90 degrees upon approaching the near end dome and then propagated
circumferentially until the dome detached. The other end of the split turned similarly
when it encountered a region of largely uncracked composite. The circumferential crack
at this end was not complete and a few inches of intact liner join the flattened section of
ruptured liner to the still-cylindrical section with the valve. This type of crack
propagation in a pneumatic rupture of a metal cylinder is not unusual.
The liner fracture surface is slanted at about a 45 degree angle (Figure 13) throughout the
length of the cracks. This slant fracture is considered indicative of a desirable ductile, not
brittle fracture of the metal. There are some areas where the slant angle reverses for a
short portion, but this too is not unusual. The rusted portion of the longitudinal split
appears to be bulged slightly. This may indicate the origin of the fracture.
An unaided visual examination of the fracture faces did not disclose any evidence of a
significant a pre-existing flaw. Preexisting flaw discontinuities large enough to reduce
the rupture pressure of metal cylinders are generally visible in the fracture face. This is
true whether the flaw is a manufacturing flaw such as a lap or a service-induced fatigue
The thickness of the liner along the crack appeared generally uniform but later thickness
measurements would disclose thickness variations. It is normal for the thickness to be
reduced slightly at the fracture by the ductile yielding of the metal.
The outside surface of the liner showed rusting. The paint coating on the liner had
adhered to the composite and was stripped from the steel by the rupture. The inside
surface showed the expected scale from production heat treating and a small amount of
rust color. Except for the crack edge that was resting on the pavement, there was no
apparent significant metal corrosion (see discussion of laboratory examination, below).
The driver removed all of the contents from the van after the ruptured cylinder was
removed. This van is a sort of rolling workshop so there was a great deal of material to
remove. The interior of the van is shown in Figure 7 and an undamaged exemplar in
Figure 8. Since the appearance of the composite cracks seemed to indicate chemical
attack, particular attention was paid to any liquids or powders that might be corrosive.
All of these items were tabulated and quarantined in the PGW lab for correlation to
MSDS data. The only obviously strong corrosive solution was a chemical cleaner for air
conditioning coils. The corrosive ingredient was sodium metasilicate, a heavy-duty alkali
cleaner. The concentrate was stored in a plastic jug and then diluted 1:3 in a plastic
pressure pump sprayer like a common garden sprayer. A storage unit had been located
over the floor above the ruptured cylinder and one of its mounting bolts penetrated the
van floor above the cylinder. The bolt was not found. The alkali cleaner jug and sprayer
were found on the floor of the van.
As mentioned previously, a section of the frame rail alongside the cylinder was blown
from the van (Figure 9). The driveshaft on the opposite side of the cylinder was also
blown off. The intact cylindrical portion of the cylinder was propelled rearwards about
12-18 inches until it was deflected downwards by the rear axle. The fuel line above the
missing frame rail was intact but was open at the tee to the fill receptacle and at the
connection to the ruptured cylinder. The wiring harness parallel to the fuel line was
broken. The sheet metal shield that was mounted under the cylinder was torn into pieces
and severely deformed. The forward mounting bracket was broken when the cylinder
ruptured but the rear bracket continued to support the cylinder portion.
The floor of the van was bulged up in a more or less smooth dome. The floor is split and
a section is torn open by the cylinder dome that penetrated the floor (Figure 10). There is
some light corrosion on both sides of the floor panel. The bolt hole for mounting the
interior storage unit was located over the cylinder in the general vicinity of the rupture
and above the outside potion of the cylinder, corresponding to the general area of
observed composite flat translaminar cracking. Various portions of the floor surface
were checked for chemical residue using Ph paper and deionized water but only a neutral
Ph was found.
The cylinders on the van were labeled in accordance with ANSI NGV2-19923, CSA B51,
Part 2-19954 and FMVSS 3045.
The cylinder’s service pressure is 3000 psi. The cylinders were manufactured for Ford
by Lucas Aerospace in the UK. Lucas ceased cylinder operations after the 1998 model
The basic design is known as “Type 2”. In this design a seamless metal liner, steel in this
case, is reinforced in the hoop direction only by filament winding. No design
specifications or drawings were available but the following information is probably close.
The liner was produced by deep drawing and ironing from a steel plate circle. The neck
end was then hot spun for closing. The liner was quenched and tempered after forming.
The maximum tensile strength permitted in NGV2-1992 was 140,000 psi.
CSA B51 requires a hardness test of each liner after heat treat and this was probably
performed close to the center of the sidewall using a reduced load Brinell test. The test
impression may be visible on close examination of the liner surface.
CSA B51 also requires an ultrasonic test of the cylindrical sidewall for defects. This test
was probably calibrated to reject any crack-like discontinuity or defect with a depth
greater than 5% of the wall thickness. This depth of a defect is widely considered benign
in a metal gas cylinder.
The minimum burst pressure for the liner of a 3,000 psi Type 2 cylinder is 3,750 psi as
demonstrated in a design qualification burst test of a single sample.
The filament wound composite is composed of commercial E-glass fiber roving in a
fairly conventional epoxy resin matrix. This was the common composite used on Type 2
CNG cylinders at the time. The resin is somewhat darker than usual, probably reflecting
a higher-than normal cure temperature to improve heat resistance in the finished
composite. The required label is embedded under the last layer of glass fibers. The
finished cylinder is coated with a clear varnish over all exposed surfaces.
The final manufacturing operation is referred to as auto frettage. The cylinder is filled
with water and then pressurized to a pressure that will cause plastic expansion in the steel
liner. The composite is not plastic but responds in a completely elastic manner. After the
pressure is relieved the steel liner is under compression in the hoop direction and the
composite is under tension. This operation is necessary because the elastic modulus of
the steel liner is nearly five times greater than the composite modulus.
The auto frettage operation complicates the understanding of the operating stresses, but
the standards require that the stress in the composite at ultimate, burst, pressure must be
at least 2.65 times the operating composite stress at service pressure. A type 2 cylinder
nearly always has a minimum design burst pressure that is at least 2.5 times the service
pressure (7,500 psi). The expected burst pressure of the Lucas design is higher, most
likely above 8,000 psi.
A brief visit was made to the fuel station. It had been removed from service immediately
after the incident. The compressor enclosures are labeled Sulzer, a major supplier of
CNG compression equipment. The pressure-controlling dispensers are labeled Air & Gas
Industries. The station used a conventional three-bank cascade. There are four
dispensers, three for 3,000 psi vehicles and one for 3,600 psi vehicles. One of the 3,000
psi hose assemblies was missing. The nozzles on the two intact 3,000 psi dispensers are
properly marked with the rated service pressure. The nozzle on the 3,600 psi dispenser
was not marked with a visible pressure rating.
The dispensers apparently have no safety relief valve to prevent over-pressurization in the
event that the control system fails. NFPA 52 is the voluntary industry standard for CNG
stations but it is not explicit in requiring a separate, redundant safety device to prevent
over-pressurization. NFPA 52 could be interpreted as satisfied by only the primary
dispensed pressure control. No label indicating listing or approval of the dispensers in
accordance with ANSI NGV 4.110 was evident. NGV 4.1 is a standard for CNG
dispensers and requires a safety valve set for a maximum of 3,750 psi in the US for 3,000
psi dispensers. 4,500 psi is the maximum for 3,600 psi dispensers.
The CNG dispenser nozzles and vehicle receptacles are designed to prevent a higher-
pressure dispenser from connecting to a lower-pressure vehicle. PGW has both 3,000 psi
dedicated Ford vehicles and 3,600 psi bi-fuel GM Cavaliers. The Cavaliers have been
used exclusively on gasoline for some time.
Findings from Later Laboratory Examinations and Fill Station Site Examination:
Three other reports are referenced in this section; two from Stork-Technimet, a laboratory
with extensive experience in failure analysis of both metal and composites and a report of
the fill station site examination by Marathon Technical Services, an authority on the
design and operation of CNG fill stations.
Discussion of Findings from the Liner Examination:
The Stork Technimet liner report 6 provides several significant findings beyond those
apparent at the site examination. These are:
The liner was manufactured of quenched and tempered 4130 alloy steel with an elevated
level of manganese. This composition is consistent with standard practice for high-
pressure steel compressed gas cylinders. The specific alloy is designated as 4130X in the
authorized materials for DOT 3AA seamless steel cylinders.7
There is no evidence of any significant manufacturing flaw in the fracture zone of the
There is no evidence that fatigue cracking preceded the rupture of the liner.
There is pitting corrosion along the top portion of the sidewall of the liner and the
fracture resulting in the rupture of the liner originated in this pitted area. Pits up to about
0.012 inch in depth (5% of the measured wall thickness) were found in this area. There
are also streaks of superficial rust on the sides and bottom of the liner.
There is some evidence of partial decarburization of the inside surface of the liner.
The tensile strength and measured hardness were in the expected range.
There was only slight thinning of the liner near the fracture, probably due to some plastic
yielding just before rupture. This is a common occurrence as a ductile metal vessel
The fracture appearance is ductile with no evidence of brittle fracture.
The fracture originated in the sidewall and propagated lengthwise before turning and
running circumferentially. This is a very common fracture pattern when steel cylinders
are burst pneumatically.
Chemical analysis of the rust deposits from the pitted area of the liner under the area of
composite cracks showed chlorine levels consistent with corrosion of steel due to
exposure to road salt. No elements indicative of specific acid or alkali corrosive agents
The Ph of corrosion products near the fracture was measured as 5 to 6, slightly acidic.
Discussion of Findings from the Composite Examination:
The Stork Technimet composite report8 provides several significant findings as follows.
The laboratory examination found that the pre-rupture cracks in the composite are
consistent with stress corrosion cracking (SCC) that is normally due to acid or alkali
The SCC was extensive and existed prior to the actual rupture of the cylinder. The SCC
cracks are present in the wrap on the intact cylindrical portion as well as in the detached
composite rings from the ruptured portion of the cylinder.
The SCC cracks are located along the top portion of the cylinder in the same general area
as the pitting corrosion of the steel liner.
Some of the rust deposits adhered to the inside of the composite when it was cut from the
intact cylindrical section and SCC cracks were found to have started from the inside
surface of the composite where the rust was removed.
Chemical analysis of the rust deposits was consistent with the liner analysis, also showing
chlorine that was attributed to road salt exposure. Barium was also found in the rust
deposits near the starting SCC cracks. The source of the barium is not known. No
elements clearly indicating an acid exposure were identified. The analysis also
confirmed that a zinc phosphate conversion coating was applied to the liner before
painting. Type 2 cylinders manufactured by Lucas are the only ones known to use this
liner coating system.
The pH of the rust deposits removed from the composite surface was found to be 8.4,
slightly basic. The difference compared to the pH measurement of the liner is thought to
be due to different analysis techniques.
The state of cure of the epoxy resin was measured and it was found to be fully cured.
Although not addressed explicitly in the text of the Stork Technimet report, some of the
composite micrographs exhibit a void content greater than would be normal for most
References indicate that crevice corrosion of the steel liner under the wrap could result in
a local acid environment sufficient to initiate stress corrosion cracking of the composite
without exposure to any external acid or alkali. Stork-Technimet concludes that “The
SCC failure mechanism appeared to be the direct result of the corrosion that occurred to
the steel liner.”
The composite under damaged anti-skid tape that is located under the cylinder mounting
bracket was examined. No significant damage to the composite was found.
Findings from the Fill Station Site Examination (October 14-15, 2008):
The most significant findings from the station examination were that it was not possible
to determine that the fill pressure supplied to vehicles conformed to the specified
maximums. There were no redundant safety relief valves in the Tioga dispensers and fill
trials indicated that the dispensers did not shut off properly. The safety relief valves of
the 3,000 psi dispensers at the Porter station (another PGW site uses to fuel both 3,000
psi and 3,600 psi CNG vehicles) showed evidence of adjustment on-site, not at an
authorized service facility.
The maximum fill pressure for a CNG cylinder is not a constant but depends on the
average temperature of the CNG in the cylinder after filling. As discussed in the
Marathon report, CNG stations are designed to estimate this temperature based on the
ambient temperature and the cylinder pressure before filling, assuring that any errors in
the estimate will not cause the cylinder to be overfilled.
On the day of the site examination, the Tioga compressors could not be set to deliver
more than 3,800 psi as indicated on an uncalibrated gage. Several gages were later
verified by PGW but the discharge pressure switch was found to be inoperable until
repaired. PGW personnel stated that the maximum compressed pressure had been
reduced prior to the incident and that the station had not been adjusted since the incident.
Marathon concluded that the station behavior during the incident was represented by the
station behavior during the examination three months later and that significant
overpressurization during the incident was therefore very unlikely. “Even if we assume
that the temperature compensation system was not functional or that the dispenser Safety
Relief Valve did not close, we know that the maximum pressure available from storage at
the time was approximately 3700 psig. Thus, we conclude that it is unlikely that the
cylinder rupture was caused by a single overfill event.”
Analysis of Liner Burst Pressure:
As mentioned in the initial site discussion, the liner of a Type 2 cylinder is designed to
withstand the maximum allowable fill pressure without rupture even in the absence of
reinforcement from the composite wrap. Since different designs may be more
conservatively designed than others, the dimensional and properties data from the liner
examination were used to calculate a predicted burst pressure for the liner. Two
calculations were compared:
The Barlow formula is the simplest formula for burst pressure of a cylindrical vessel.
The von Mises yield criteria is a more complex calculation that considers stresses in all
three principal directions.
The input values from the liner examination were;
Liner Inside Diameter: 11.140 inches
Liner Thickness: 0.258 inch
Pit Depth: 0.012 inch
Liner Thickness Under Pit: 0.246 inch
Measured Transverse Tensile Strength: 135,000 psi
Measured Transverse Yield Strength: 109,000 psi
The portion of the liner from which the tensile specimens were taken had been plastically
deformed after the actual rupture, first by the flattening of the section as the liner opened
up and later as the specimen was flattened for testing. This plastic deformation after the
rupture would have increased the yield strength slightly and the yield strength used in the
calculations was therefore reduced to 107,000 psi. This is an estimate based the small
amount of apparent plastic deformation...
The Barlow formula is the familiar S=PD/2T. When the Barlow formula is used, it is
common to use a stress value termed flow stress. This value is the mean of the yield
strength and the tensile strength, 121,000 psi in this case. The burst pressure predicted in
this calculation is 5,344 psig
The burst pressure calculated using the triaxial von Mises yield criteria is 5,339 psig.
The mean radial component of stress was set equal to one-half the calculated rupture
pressure for this calculation.
These values should be considered close estimates of the burst pressure that the liner
would have demonstrated in a normal burst test in accordance with NGV2. This burst
test is not strictly analogous to the incident scenario because the pressure in the test is
normally increased rapidly until burst occurs. This is different from the incident scenario
where the pressure was increased more slowly and then allowed to remain high for some
minutes until the liner ruptured. It probably took several minutes to fill the vehicle and
then some additional time to drive across the lot and park it. It is generally accepted that
the measured burst pressure will increase with a faster rate of pressurization. This is the
rationale for a maximum pressurization rate of 200 psi/sec (18.75 seconds from zero to
3,750 psi) in the NGV2 burst test. The actual rupture pressure in the incident scenario
would be expected to be somewhat less, but no quantified reference values are known.
It is also possible that there were some still-intact strands of composite when the cylinder
was filled for the last time but that these were highly stressed due to the failure of many
other strands and broke due to stress rupture in the time between filling and rupture.
Strand breakage is normally accompanied by popping or pinging noises, but the driver
reported no unusual sounds.
Since the maximum allowable fill pressure for the failed cylinder is 3,750 psig, a von
Mises calculation was performed to determine the yield strength that would result in that
predicted burst pressure. The calculated value is 75,157 psi, only about 70% of the
estimated pre-burst yield strength of 107,000 psi. Quenched and tempered alloy steel
loaded to 70% of its yield strength would be expected to endure indefinitely under this
static load and not fail.
The Barlow and von Mises calculations do not account for any stress concentration from
the corrosion pits. Stress concentrations could reduce the burst pressure further. ISO TR
228949 reports on work done to validate the use of API 579 to predict by analysis the
effect of various defects on the burst pressure of seamless metal cylinders. Actual burst
test results were compared to the API 579 predicted values for both longitudinal notches
and broader local thin areas. The longitudinal notch should be considered similar in
effect to a line of corrosion pits of equal magnitude. The steel cylinder tested for the ISO
report was manufactured in accordance with DOT-E9421, an exemption for a high-
strength steel cylinder with a tensile strength range of 155,000 to 175,000 psi,
substantially higher than the 135,000 psi of the ruptured cylinder. It is generally accepted
that steels become more sensitive to stress concentrations as the tensile strength is
increased and this was one reason for the ISO TR 22894 work. The lower tensile
strength in the ruptured liner would be expected to result in reduced sensitivity to stress
concentrations when compared to the cylinder tested for ISO TR 22894.
The outside diameter of the ISO test cylinder was 9.25 inches, smaller than the ruptured
liner but the wall thickness was very similar to the burst liner at 0.248 to 0.278 inches.
The smallest notch tested was 0.026 inch deep by 2.53 inches long, about twice the depth
of the deepest corrosion pit measured in the laboratory examination of the liner. The
burst pressure reduction attributable to the ISO notch was 9%, about the same as the
percentage of original wall thickness represented by the notch depth. This indicates that
any stress concentration from the notch had negligible effect in comparison to a thickness
that was uniformly reduced as modeled in the preceding Barlow and von Mises
Estimate of Glass Composite Working Stress:
The dimensions and properties of the liner were combined with the thickness and
estimated tensile strength of a typical E-glass composite to estimate the operating stress
in the composite. The calculation was based on classical lamination theory for the
composite and two dimensional von Mises yield criteria for the steel liner. NGV2
requires that the stress achieved in the composite during a sample burst test must be at
least 2.65 times the stress in the composite at the labeled service pressure of 3,000 psi.
This corresponds to a service stress maximum of 37.7% of the ultimate strength of the
composite. This requirement is important to prevent premature stress rupture of the glass
fiber in service. The calculated estimate must be considered approximate because actual
values for the composite strength were not available and the condition of the ruptured
cylinder did not allow measurement. Based on a best estimate of the composite strength
and of the likely auto frettage pressure, the estimated stress in the composite at service
pressure is 19.2% of the stress at burst, very conservative compared to the NGV2
maximum of 37.7%.
Since the estimated burst pressure of the liner strongly implies that a pressure around
5,000 psi is necessary to burst this particular liner, the composite stress calculation was
repeated at an increased service pressure of 5,000 psi and was found to be 26.8% of the
estimated stress at burst, still very conservative compared to the NGV2 maximum of
The rupture of the cylinder appears to have been the result of two occurrences. First, the
destruction of the composite reinforcement by chemical exposure resulting in progressive
SCC and then second, overpressurization at the time of the rupture. The chemical attack
may have resulted from crevice corrosion of the steel liner beneath the composite
reinforcement or from some unknown external corrosive chemical that left only chlorine
as an identifiable residue. The alkali cleaner carried in the van and muriatic acid
(hydrochloric) are two such common maintenance chemicals. The evidence from the
liner examination clearly points to an ultimate failure due to a single final overload. The
overpressurization most probably resulted from a malfunction of the filling station in the
absence of any redundant backup pressure limiter. There is reason to believe that this was
a chronic condition affecting any 3,000 psi vehicle using either the Tioga or Porter
stations. However, when the station was subjected to a detailed examination three
months after the incident, it would not produce its maximum design pressure of 5,000 psi
and PGW personnel stated that no changes had been made after the incident. We know
of no way to reconcile the condition of the ruptured liner, without any evidence of
progressive failure such as a fatigue crack, with the observed failure of the station to
provide its maximum rated pressure during the later site examination and the statements
by PGW personnel. It seems more likely that the liner condition was essentially
unaltered in the time between the incident and the examination and than that the station
operated in the same manner during both the incident and the later site examination. The
conclusion that the composite reinforcement of the cylinder was destroyed by stress
corrosion cracking sometime before the actual rupture has no contraindications.
The liner was very robustly designed compared to the minimum requirements of ANSI
NGV2-1992. The estimated short-term burst pressure of the unreinforced liner is more
than 41% greater than the minimum requirement and also 41% greater than the maximum
allowable fill pressure. The operating stress in the composite was probably similarly
conservative. No significant manufacturing or fatigue flaws that contributed to the
rupture of the liner were detected, but pitting corrosion of the liner resulted in about a 5%
local reduction of burst pressure compared to a liner with no pits. This was apparently
sufficient to cause the fracture to originate in the pitted area of the liner. The 5%
reduction is not considered significant in the overall incident.
Both the pitting of the liner and the SCC of the composite are located along the top of the
cylinder, indicating that one may be the cause of the other or that both are the result of a
common cause. The SCC cracks apparently initiated on the inside surface of the
composite shell next to the steel liner and in the vicinity of corrosion pits in the exterior
of the steel liner. These SCC cracks would not have been visible until they propagated
through the entire thickness of the composite shell, rendering the primary in-service
inspection technique of external visual inspection ineffective. The area of the cylinder
composite that is severely cracked is also much larger than the corrosive exposure areas
in the ANSI NGV2 Environmental Test. Some other SCC cracks on the exterior
apparently do not penetrate to the inner surface of the composite.
As concluded by Stork-Technimet, crevice corrosion of a metal liner beneath a composite
of E-glass may provide an acid environment that will cause SCC of the glass fibers. It
should also be noted that crevice corrosion is often even more severe in metals that
normally form a protective oxide film such as aluminum and stainless steel.
An alternate explanation for the coincidence of SCC and pitting could be spillage of a
corrosive liquid in the van. This corrosive could have drained onto the cylinder through
the bolt hole in the van floor. The corrosive would then attack the composite over time
and produce the observed SCC cracks. These cracks would increase the access of road
salt to the liner, accounting for the more severe local corrosion even if the spilled
corrosive did not attack the steel liner. If the corrosive were the coil cleaner found in the
van, it would not leave a distinctive chemical signature. Another common corrosive that
would leave no distinctive chemical signature is muriatic acid (hydrochloric), a common
industrial chemical. The chemical signature would be chlorine, just as in the case of road
SCC cracks growing from the inside towards the outside have been noted in other
examinations of ruptured E-glass cylinders that were exposed to external acid. This was
previously accounted for on a theoretical basis because the working stress in the
composite is not uniform through the thickness, being about 7% higher on the inner
The composite cross sections in Figures 34 and 35 of reference 77 appear to have an
unusually high void content. A composite with a high void content is considered more
susceptible to liquid corrosives that can more easily penetrate to the susceptible glass
The exposure to similar SCC cracking depends on the specific source of the corrosive.
If the chemical source was external via a spill, any other cylinder with E-glass composite
could be expected to crack if exposed to a similar spill. The frequency of cracking will
be the same as the frequency of such spills. Cylinders made with corrosion resistant E-
glass (after about 1999) are much less likely to crack if exposed to a spill.
If the corrosive was produced as a result of road salt induced crevice corrosion under the
composite, any other metal lined cylinder E-glass reinforced (Type 2 or 2) cylinder could
be susceptible to the same cracking is exposed to road salt. The population of susceptible
cylinders may be reduced if:
• The high void content noted in the composite of the ruptured cylinder was a
necessary condition for the development of the cracks. In this case it would be
important to know whether this void content was characteristic of the Lucas
design or a result of unintended process variation. It will also be necessary to
know the void content of other manufacturer’s composite.
• If the steel Lucas liner was more susceptible to corrosion than other liners from
manufacturers who used a different protective coating system, the other cylinders
may not be susceptible to this failure mode.
Periodic visual inspection in accordance with NGV2 and CGA C-6.410 would likely not
have detected the composite SCC cracks before they grew to significant size. This is due
to their initiation on the inside surface of the composite and the fact that these cracks can
grow large in much less than the 3-year inspection interval.
The fill station control of the pressure dispensed to the vehicle before the rupture was not
in accordance with the standards. The pressure control logic of the particular dispenser is
not explicitly known, but the cut seal wires on dispenser pressure relief valves at the other
station indicates that overpressurization of the vehicle cylinders may have been chronic
throughout the fleet for some unknown period of time. CGA C-6.4 requires that
cylinders that have been overpressurized be condemned.
There is no established industry test method by which to fully verify the proper operation
of an installed CNG dispenser. This is because the maximum fill pressure is not a simple
single value but also depends on the average temperature of the gas in the filled cylinder.
The fill stations are equipped with multiple safety relief valves with settings of 5,000 psi
and it is unlikely that the pressure dispensed to PGW vehicles exceeded this level. The
design of the burst cylinder was conservative enough that it should not have been
damaged even if repeatedly pressurized to 5,000 psi if the composite was still intact.
This and the calculated stress estimate indicate that chronic overpressurization probably
did not overstress the composite beyond the limits of NGV2.
The Tioga station dispensers may overpressurize the vehicles if any one of several
control components fails. The maximum overpressurization is probably about 5,000 psi,
enough to rupture a 3,000 psi Type 2 cylinder with damaged composite but probably not
enough to rupture a 3,600 psi Type 2 in the same condition. This single-point failure
mode is now generally considered unacceptable. A parallel safety relief valve as installed
at other PGW stations is a minimally redundant safety feature.
The lack of any indications of growing fatigue cracks in the fracture zone of the steel
liner also indicates that chronic repeated overpressurization did not cause significant
damage to the liner prior to the sudden rupture.
The liner rupture pressure was probably somewhat less than the calculated value,
probably less than the 5,000 psi set pressure of the safety relief valves but greater than the
maximum allowable fill pressure.
Any of the other 3,000 psi cylinders on PGW vehicles may have experienced
The fill stations should not be recomissioned unless the dispensed pressure controls are
corrected and shown to work properly and redundant safety relief valves are added to
protect against a single point failure.
The 3,000 psi cylinders on PGW NGVs should be removed and condemned. The
removed cylinders should be visually inspected for composite damage and to try to
determine whether crevice corrosion, or external chemicals, is damaging the composite of
PGW should consider offering some of the condemned cylinders without first destroying
them, and perhaps other vehicle components for industry research as recommended
below. NHTSA has offered to consider storing a supply of cylinders, including the
ruptured cylinder, pending further research.
For other CNG Operators:
The CNG industry should be notified of several actions that are recommended as a result
of this investigation.
Periodic inspections of underbody CNG tanks should allow for examination of the
underbody composite tanks to detect SCC. This may require special lighting or vision
aids, but the fact that the ruptured tank was damaged only on its top, the most hidden,
quadrant is significant. This should detect extensive cracking that could reduce the
cylinder burst pressure to near the maximum fill pressure. No periodic inspection can
protect against glass SCC because the time required for cracks to develop after acid
exposure is between a few hours to a few weeks.
Inspectors should be alerted to look for a short rubber isolator on Ford E-van cylinder
brackets and to know that the anti-skid tape is not functioning as an isolator. Although
the bracket abrasion on the ruptured tank did not result in structural damage, bracket
contact with the cylinder is not acceptable and should be detected and corrected.
Station operators should be alerted to the need to inspect and periodically verify the
proper operation and condition of dispensed pressure controls.
A proposal should be submitted to NFPA 52 requiring that all dispensers be fitted
retroactively with a redundant safety pressure relief valve to prevent the dispensed
pressure from exceeding 125% of the service pressure in the event of a failure of the
primary pressure control. This PRV should also be periodically verified for correct
operating pressure as required for Code relief valves in NFPA 52.
A second proposal should be submitted to NFPA and also to ANSI NGV 4.111 to require
periodic verification of the accuracy of the fill pressure control. This would add a very
common industrial control practice to this critical variable.
For CNG Industry Research:
This investigation has identified several areas where specific knowledge is not available.
These information gaps should be prioritized and recommended for additional research.
If PGW makes them available, the industry should secure and stockpile a supply of the
condemned cylinders from PGW to support such research.
The industry should develop a specific test method, including equipment schematics that
can be used to periodically verify the proper operation of CNG dispensers, including both
maximum pressure regardless of temperature and maximum temperature compensated
pressure. This should be a generic test, independent of the maker of the dispenser.
Additional cylinders from the PGW fleet should be examined for evidence of SCC. If the
SCC is confirmed to be the result of corrosion of the liner from road salt as concluded by
Stork Technimet, we would expect to see more cylinders with SCC. If the SCC was
caused by a chemical spill, we may not see other cylinders with SCC, or we may find
cylinders at an earlier stage which can be examined for a corrosive agent.
The failure mode of E-glass cylinders when exposed to a strong alkali should be
characterized. This might be started by exposing a removed PGW cylinder in apparently
pristine condition to the coil cleaner found in the van and then holding at elevated
temperature and pressure for an extended period.
The NGV2 standard should consider requiring increased resistance to glass SCC. This
could be accomplished by:
• Requiring that only corrosion-resistant E-glass (or other fiber such as carbon or
aramid) may be used. This glass has become commercially available since the
PGW cylinders were produced and is far more resistant to both acid and alkali.
• Increase the severity of the existing NGV2 Environmental Test to preclude E-
glass designs that will not support maximum fill pressure after extensive chemical
exposure. This could involve a longer exposure time and larger exposure areas.
For Hydrogen Vehicle Standards:
Assuming that the proximate cause of the rupture was overpressurization by the fill
station, it should be understood that this is a very rare cause of rupture outside the US.
This is because almost all foreign CNG fill stations are designed for a single dispensed
pressure. These stations normally have multiple redundant pressure controls and pressure
relief valves and are designed to allow only 130-140% of the dispensed service pressure
anywhere in the station in order to protect the compressor and station pressure vessels.
This configuration requires several independent pressure limiting systems to fail
simultaneously before the vehicle cylinder is in imminent danger of rupture. This is not
the situation in the US NGV industry where three different service pressures are used,
2,400, 3,000 and 3,600 psi. US multi-pressure fill stations are commonly designed for a
maximum compressed pressure of about 5,000 psi as was the case with the PGW stations.
When a lower-pressure vehicle is filled the dispenser pressure control becomes more
critical since it is not effectively backed up by the other compressor pressure controls. In
the PGW incident, a single component failure could overpressurize the vehicle
The present intentions for high-pressure hydrogen storage include at least 5,000 psi (350
bar) and 10,000 psi (700 bar) vehicle systems. Station cascade storage vessel pressures
as high as 15,000 psi are contemplated for the 10,000 psi vehicles. If the NGV industry
practice is followed and both pressures are provided at the same station, and a failure in
dispenser control occurs, an undamaged 5,000 psi cylinder could be burst by a dispenser
pressure failure with a compressor system designed to also supply 10,000 psi vehicles.
Safety relief valves (SRV) are commonly considered the most important appurtenance of
a pressure vessel, but they are not perfectly reliable. ANSI NB-2312 recommends at least
two parallel SRVs in systems where safety is critical. A 5,000 psi hydrogen dispenser
operating from a 15,000 psi compressor would surely be such a critical safety item.
Codes for hydrogen dispensers should either establish a maximum compressed pressure
that is not more than 140% of the maximum dispensed pressure or require added
redundant safety relief valves with rigorous periodic verification.
Private conversation with Joe Wong, Powertech Laboratories, Surrey, British Columbia
ANSI/IAS PRD 1-1998, American National Standard for Basic Requirements for Pressure Relief Devices
for Natural Gas Vehicle (NGV) Fuel Containers, International Approval Services, Cleveland, OH
ANSI/AGA NGV2-1992, American National Standard for Basic Requirements for Compressed Natural
Gas Vehicle (NGV) Fuel Containers, American Gas Association Laboratories
CSA B51-95 Part 2, High Pressure Cylinders for the On-Board Storage of Natural Gas as a Fuel for
Automotive Vehicles, Canadian Standards Association, Rexdale (Toronto) Ontario
49CFR§571.304 Standard No. 304; Compressed natural gas fuel container integrity, Code of Federal
Regulations, Title 49, Office of the Federal Register
Report No. 0809-25278, METALLURGICAL EVALUATION OF A COMPRESSED NATURAL GAS
TANK CYLINDER LINER FROM PGW #3436, Craig C. Brown, December 3, 2008, Stork Technimet, Inc.,
New Berlin, WI
49CFR§178.37 Specification 3A and 3AAX seamless steel cylinders , Code of Federal Regulations, Title
49, Office of the Federal Register
Report No. 0810-25584, FAILURE ANALYSIS OF A COMPOSITE WRAP ON A COMPRESSED
NATURAL GAS TANK FROM PGW #3436, Niles G. Stenmark, December 8, 2008, Stork Technimet, Inc.,
New Berlin, WI
ISO/TR22694, Gas cylinders – Methods for establishing acceptance/rejection criteria for flaws in
seamless steel and aluminum alloy cylinders at time of periodic inspection and testing, International
Organization for Standardization
CGA C-6.4 -2003, Methods for External Visual Inspection of Natural Gas Vehicle, (NGV) Fuel
Containers and Their Installations, Compressed Gas Association, 2003
ANSI/AGA NGV 4.1-199, American national Standard for NGV Dispensing Systems, CSA America,
ANSI/NB-23, National Board Inspection Code, The National Board of Boiler and Pressure Vessel
Inspectors, Columbus, OH
Figure 1- Side View of Van and Ruptured Cylinder
Figure 2 – Rear Cylinder with Inspection Label
Figure 3 - Ruptured Cylinder with Detached Composite Rings
Figure 4 - Exemplar Cylinder Bracket with Short Rubber Isolator
Figure 5 – Exemplar Cylinder Bracket with Correct Rubber Isolator
Figure 6 – Wear Pattern from Exemplar Bracket with Short Rubber Isolator
Figure 7 – Interior of Van with Contents
Figure 8 – Interior of Exemplar Van with Contents
Figure 9 – Broken Frame Rail
Figure 10 – Inside View of Ruptured Floor
Figure 11 – Through-Thickness Stress Corrosion Crack of Fiberglass Composite
Figure 12 – Partial-Thickness Stress Corrosion Cracks in Fiberglass Composite
Figure 13 – Ductile Slant Fracture of Ruptured Cylinder Liner
Figure 14 – Cylinder label