WE report an oxygen supply tank failure at our institution that occurred during the morning of a busy operating room schedule when medical center oxygen use was maximal.
The bulk oxygen supply at our facility consists of three cryogenic oxygen storage tanks: a primary tank, A ; a secondary tank, B ; and a reserve tank, C (fig. 1.). Tanks A and B are physically situated next to each other. The reserve tank (C) is located approximately 1 block (approximately 305 m) away and normally serves as the primary oxygen source for our hospital’s second large inpatient bed facility. Valves, piping, and regulators between the primary tank and primary reserve were installed in compliance with the National Fire Protection Association’s guidelines and commonly accepted installation practices. 1,2The tank failure and resulting major liquid oxygen spill were caused by the separation of a brazed joint between the stainless steel primary tank A and a brass pipe fitting. The resulting sudden release of approximately 8,000 gallons of liquid oxygen from tank A precluded the initial use of the adjacent secondary tank B. Tank B was inaccessible because of massive ice and vapor cloud formation, which initially made it impossible to determine whether the tank was stable and functional (fig. 2). As the pressure in the primary tank rapidly decreased, an automatic switch-over valve opened tank B to provide oxygen to our medical center. With uncertainty regarding the integrity of the reserve system (because of inability to immediately assess the secondary tank), an adjacent valve was immediately closed to isolate both tanks until the damage could be assessed.
Our hospital engineers reacted almost immediately, closing the valves to isolate both the primary tank A and secondary tank B. At the same time, valves were opened to bring the reserve tank C online as the alternate supply source. Fire and police officials were notified of the situation, and personnel in critical areas (intensive care units, operating rooms, and chiefs-of-staff) also were simultaneously notified. Reserve oxygen E-cylinders were collected and distributed to critical areas within the medical center. Our bulk oxygen supplier was notified, and a supply tanker was dispatched to provide additional liquid oxygen. Fortunately, we never experienced total loss of pipeline supply pressure. However, in the operating rooms, the pipeline pressure was noted to be decreased from 55 to 48 psi gauge. This decreased pressure was thought to be most likely a result of relatively high friction losses as the oxygen was routed through regulators near the distant reserve tank C to the main hospital and operating room facility. Forty-five minutes after the failure, the secondary tank B was determined to be functional and was put back into service. The valves to the reserve tank C were then closed.
The failure of our primary oxygen supply tank could have caused complete oxygen pipeline system failure if the secondary tank had been damaged concurrently. The redundancy in our system with the remote reserve tank provided a continuous supply during the event. Very soon after the failure occurred, the low liquid oxygen volume alarms were activated at the engineering control center. Because of the design of our alarm system, however, these alarms alone would not have given enough advance warning to prevent loss of pipeline pressure. The inability of our alarm system to provide timely warning in this situation was due to the rapid rate at which the liquid oxygen was lost. These alarms were set to communicate when the level fell below a preset threshold value and were not designed to give engineers ongoing, quantitative information on the level of liquid oxygen within the tank. Typical alarm systems do not provide this quantitative information. 2,3Furthermore, if the main and reserve tanks had not been situated in a location that was readily visible, then engineers might have believed that the low oxygen level alarm was simply a result of normal use. The rapid response time to this system failure at our facility was at least partially because of easy visibility of the tanks and the quick reaction of our engineers, who were at the bulk oxygen storage facility at the time of the failure.
The failure of the liquid oxygen pipeline that caused this event was determined to be due to both electrolysis of the stainless steel-to-brass joint and thermal expansion damage. The primary tank A and piping were 12 yr old at the time of the event. After the event, the joint was replaced with a stainless steel-to-stainless steel welded joint. The repaired primary tank was subsequently tested and put back in service as the primary supply within 10 h.
Our review of the literature uncovered instances of bulk oxygen system failures secondary to events such as pipeline crossover, filling with the wrong gas, faulty installation, modification of the pin index or diameter index safety systems, contamination, and other factors. 4,5We were unable to find a similar reported case of oxygen supply failure secondary to a scenario such as described above.
Cataclysmic bulk liquid oxygen supply failure is problematic not only for anesthesiologists but also for the entire medical center. At the time of this failure, oxygen use in our medical center was at peak. All 30 operating rooms (24 noncardiac, 6 cardiac) were in use. Several patients were in the postanesthesia care unit, and nine separate intensive care units were filled to capacity. The emergency department was busy, and many patients were receiving oxygen by facemask or nasal cannula in their hospital rooms throughout the medical center. Complete loss of oxygen supply could have been disastrous.
In the operating room suite, several actions were taken as soon as a problem was identified. First, all anesthesia care providers were informed about the possibility of a bulk oxygen system failure. Additional E-cylinders were delivered to all anesthetizing locations. Low-flow anesthesia techniques were used where possible. Attempts were made to keep oxygen flowmeter flow below 1,000 ml/min. Mechanical ventilation was discontinued, and manual bag ventilation was instituted. Finally, all elective procedures were postponed until the problem was isolated.
When using gas-driven anesthesia ventilators such as the Datex-Ohmeda models 7800, 7810, 7100, or 7900 (Madison, WI), the drive gas used to compress the bellows is normally 100% oxygen, and the drive gas volume consumed equals the minute ventilation. 6,7Thus, in adult patients with a minute ventilation of 8–10 l, an equal quantity of drive gas can be conserved per minute by discontinuing mechanical ventilation and switching to manual ventilation. Interestingly, some newer ventilators may be switched between using either oxygen or air as their drive gas, and doing so would also conserve oxygen supplies. When one compares oxygen consumption in a low-flowmeter setting with manual ventilation and an intermediate-flowmeter setting with mechanical ventilation, the difference is dramatic. With fresh gas flow of 500 ml/min in conjunction with manual ventilation, a total of 500 ml/min oxygen is consumed. In contrast, when an intermediate-oxygen flowmeter setting of 2 l/min is used in conjunction with mechanical ventilation, providing 10 l/min of minute ventilation, the total oxygen utilization is 12,000 ml/min. In this scenario, manual ventilation with low oxygen flow would consume only 4.2% of the amount of oxygen that would be used during mechanical ventilation with intermediate flow. For anesthesia workstations that use a push drive (piston type) ventilator rather than a gas-driven one (e.g. , Narkomed 6000, North American Dräger, Telford, PA), oxygen use would be comparable to the manual ventilation scenario described above.
The failure of the oxygen supply system at our facility was caused by multiple factors. As is the case in many institutions, the main and reserve bulk oxygen storage tanks of our medical center are owned by the bulk oxygen supplier. The plumbing to the tanks and the rest of the oxygen supply system is owned and maintained by our medical center. This connection between the vendor-owned tank and the hospital-owned pipeline was the point of failure in our system. Maintenance and upkeep of all components should be coordinated and documented between all parties involved. 2
The problem resulting from the close proximity of the primary and secondary tanks would have been much more difficult to manage if we did not have a reserve tank. In our case, if there had been either a spatial or physical barrier between the primary and secondary tanks, engineers could have more easily and quickly assessed the status of the secondary tank. As it was, the liquid oxygen spill produced massive ice and vapor on and around the secondary tank, precluding inspection of its integrity. Usually, hospitals have only two liquid oxygen sources. If these two are somehow isolated from each other, a problem such as the one we encountered could be avoided. Separation of the primary tank and reserve tanks could be achieved simply by construction of a noncombustible barrier between the tanks and creation of a sloping surface away from the tanks and barrier wall for runoff. In addition, consideration should be give to providing enough room for runoff of the amount of liquid oxygen stored in the tanks.
Continuous measurement of the quantity of oxygen in the cryogenic tanks may provide an earlier warning of a massive system failure. This alarm monitor should communicate not only when the volume falls below a threshold level but also when the rate of volume loss is excessive.
We were fortunate that during this event, our cryogenic oxygen system failure was noted very soon after it occurred and that it was limited to only one tank. No adverse patient outcome or even significant delay in the elective surgery schedule resulted. Predetermined oxygen system failure protocols were immediately implemented. 8Careful planning and thoughtful consideration to the design of the bulk oxygen supply system most likely prevented a catastrophic failure of the oxygen supply system at our institution. Tying together bulk oxygen systems in large facilities that use more than one such system adds redundancy to the system that can allow continued use even when a major system failure has occurred.
To summarize, based on this case and review of the literature, we have several specific observations regarding possible bulk liquid oxygen supply system failure. (1) The events outlined in this case reinforce the importance of having a thoroughly prepared hospital-wide disaster plan available. It is critical to be able to identify key individuals in a timely manner to deal with the various responsibilities required to avoid making an already bad situation worse. (2) Anesthesia care providers who serve in leadership roles in the operating room are responsible for the safety of all patients within the surgical facility. As such, they should have a comprehensive understanding of their own hospital’s oxygen delivery system and associated disaster plans. Anesthesia care providers should know the locations of all major bulk oxygen supply components such as the tanks and associated shutoff valves. (3) Anesthesiology leaders must be involved in any new construction or remodeling planning. (4) Medical center leadership might consider separating the location of primary and secondary oxygen supply tanks or building a barrier between them to isolate one from the other in the event of a tank failure. (4) The National Fire Protection Association’s Standard for Bulk Oxygen Systems at Consumer Sites (NFPA-50) addresses both “Location of Bulk Oxygen Systems” (2.1–2.1.5) and “Distances Between Bulk Oxygen Systems and Exposures” (2.2–2.2.14). 9However, it does not specifically address the placement of an isolation barrier between bulk storage tanks, which could have been helpful in our case. Furthermore, in addition to primary and secondary tanks, large medical centers with high oxygen use should consider having an additional reserve tank in the event that the primary and secondary tanks are simultaneously unusable, as in our case. (6) Finally, if catastrophic bulk oxygen supply failure does occur, oxygen consumption conservation techniques as described above should be instituted. Adequate oxygen cylinder supplies must be on-site, and a disaster plan that includes obtaining an additional supply of cylinders must be readily available in the event that the bulk oxygen supply system cannot be rapidly restored.