The Row She Cannot Close
It is a Tuesday in the second week of her hazard analysis review, and the safety case lead at a small underground-equipment integrator has forty-one rows closed and one open.
The open row is mechanical breach. Her machine is a battery-converted loader that works a decline nine hundred meters below the surface. The pack sits behind the operator, low and center, where the diesel tank used to be, because that is the volume her frame gave her and it gave her no other. Rock falls in that decline. Not often, and not usually onto the machine, but her analysis does not get to assume otherwise, and the residual-risk column does not accept "not usually."
What she needs from that row is a bounded answer to a narrow question: if the pack is opened by a falling rock or by the corner of a scoop at the end of a long shift, what comes out of it, how fast, and can the crew walk past it. Her drift has one route out on foot, and it runs by the machine.
She has the cells that meet her energy budget. To finish a full shift without a mid-shift swap, which is the entire reason her customer is not simply buying another diesel loader, she needs the pack to hold energy at a density that puts a great deal of chemical energy inside a volume the size of a footlocker, a meter from a seated operator, in a space with forced ventilation and no sky. She has the datasheets. She does not have a breach answer she is willing to put her name against.
By Friday she has to either sign the row closed or write the derate that takes the machine below a shift.
What Signing It Costs
If she signs, she cannot unsign. That is the whole shape of her problem.
Her hazard analysis is the document that the mine's own safety organization will rely on when it writes the operating procedure, and the operating procedure is what tells a crew of six where to stand and how to get out. Once her name is on the residual-risk column, the assumption propagates into a training deck she will never see, into a rescue plan she is not consulted on, and into the habits of people who will walk past that machine four hundred times a year without thinking about her.
A fire in her decline would not be a recoverable event the way a fire in her firm's surface yard would be. Her drift has one path out, the smoke would go where her ventilation sends it, and the people who would respond are the same six people who would need to leave. If her row is wrong, the correction does not arrive at her desk as a warranty claim. It arrives once, and afterward the design question is closed for her firm, for her customer, and for that decline.
The other direction costs her differently and just as permanently. If she writes the derate, her machine no longer completes a shift, the customer keeps the diesel loader, and her firm loses the reference installation that the next three bids depend on. She does not get a second design cycle to recover it, because the frame geometry and the ventilation certificate were fixed a year ago against a pack volume she can no longer change. Her freedom to trade volume for safety was spent before she arrived on the project.
So she is choosing, this week, between a machine that does not sell and a hazard she has not bounded, and both choices are one-way.
Why Her Two Variables Are Actually One
The structural difficulty in her deployment is that the quantity she needs and the quantity she fears are the same quantity.
The reason her pack can finish a shift is that it holds a large amount of chemical energy in a small volume. The reason her breach row will not close is that a large amount of chemical energy is in a small volume, a meter from an operator, under rock. Every increment of range she buys is an increment of energy that has to go somewhere if the enclosure is opened, and in her machine there is no design move that increases one without increasing the other. She cannot separate them by putting the pack elsewhere, because there is no elsewhere in that frame.
Her second difficulty is that a breached pack in her drift presents her with two hazards at once, and nothing she has been able to write into her own mitigation column speaks to both of them at the same time. If the cells she selects hold their charge behind an internal insulating barrier, then in her installation a physical disruption of that barrier is simultaneously an electrical event and a chemical one, and her rescue procedure has to speak to a machine that may be both burning and live. Writing a procedure for a crew that has to make one decision in poor visibility, on foot, with a light, is not something she can do against a two-headed failure description.
Her third difficulty is what the products of a breach do in her ventilation. Heat in her drift is bounded by what the pack holds. Flammable vapor is not bounded the same way for her purposes, because in her geometry it can travel and find an ignition source that is not the pack. Were her machine on a surface yard, she would treat those two outcomes as differing in degree. Nine hundred meters down, with one walking egress, she has to treat them as differing in kind.
Engineering the Breach Instead of Tolerating It
U.S. Provisional Application No. 64/055,649 discloses a sealed electrochemical cell built around a bulk volume of dual-domain proton-conducting carbon gel (130) filling a hermetic enclosure (100) between two carbon current collectors (110, 120), with a population of metal nanoflakes (140) dispersed through the gel. In embodiments described there, energy is stored as electron-stabilized metal-hydrogen surface bonds at the flake surfaces rather than by intercalation into a host lattice, and the cell holds charge without an internal separator: the gel is itself both electronically and ionically conductive, and the disclosed retention principle is saturation of that continuous medium to a uniform electrochemical potential, in which the filed text describes no internal driving force for charge to redistribute while the external circuit is open.
Against mechanical breach, Section 9.12 describes a response that the filing frames as engineered rather than merely survived. In described embodiments, breach of the hermetic enclosure by puncture or crush admits atmospheric oxygen into the gel volume, and that oxygen ingress drives rapid oxidation of the cell's stored chemical energy into gaseous products: aluminum metal to aluminum oxide at the flake surfaces, bonded hydrogen to water vapor, and carbon framework species to carbon dioxide at the framework boundaries. The filing recites those reactions as proceeding on timescales of approximately 0.01 to 1 second, which it describes as substantially faster than the cell's stored electrical energy can flow as discharge current through any conductive pathway external to the cell.
The consequence the filing draws from that timescale is a change of hazard character. Because the gel has high electronic conductivity and the cell holds stored charge, the filing states that a breached cell would otherwise present an electrocution risk; where the described oxidation proceeds as recited, the filing describes it as converting the principal hazard to a thermal one, bounded by the total stored chemical energy of the cell, with breach-response gas products recited as non-flammable, namely water vapor, carbon dioxide, and solid aluminum oxide particulates. The filing describes this as comparable in magnitude to, but distinct in character from, conventional lithium-ion thermal runaway.
The disclosure also describes making that response predictable by design rather than waiting on it. Embodiments include frangible enclosure regions configured to fail in an oxygen-permeable mode under impact, and oxygen-bearing reservoir capsules within the cell that rupture on impact and release stoichiometric oxygen for rapid oxidation.
Several other described elements bear on what is inside the enclosure before any breach. The innermost enclosure layer in described embodiments is an aluminum or aluminum alloy layer (102) that floats at the gel's bulk potential, is electrically isolated from both terminals by dielectric feedthrough seals, and naturally passivates to an aluminum oxide layer of approximately 2 to 10 nanometers, which the filing recites as admitting oxygen partial pressures below approximately 10 parts per million inside the cell. In embodiments described in Chapter 5, the metal nanoflakes carry like surface potentials, mutual electrostatic repulsion maintains spatial separation between them, and the filing describes that separation as preventing cross-flake recombination of bonded hydrogen into molecular hydrogen, with the repulsion recited as stronger in the charged state than in the discharged state.
What the Filing Leaves to Her
The disclosure is candid that its numbers are projections. Section 13B.4 states that the recited cell-level performance ranges are projected from the disclosed operating mechanisms and from published data on the underlying materials, and are not empirical measurements on prototype cells; Section 13B.2 lists architectural elements of the disclosed cell and states that they have not been empirically demonstrated in this specific combination. For her purposes, that means the breach description is a mechanism description, not a test report, and her qualification program would have to generate the evidence her hazard analysis actually consumes.
The filed text also does not remove the thermal hazard. It describes converting one hazard into another and bounding the second by the cell's total stored chemical energy. Heat and gas still leave a breached cell in the described response, and what her pack enclosure, her machine, and her ventilation do with that heat and gas is integration work the filing does not undertake for her. Nor does it address cell-to-cell behavior within a pack of the size she would need, or the ventilation modeling her drift would require.
Some of the described protections are conditional in the filing's own terms. The breach response as recited depends on oxygen reaching the gel volume, and the disclosure describes engineering that ingress deliberately in some embodiments rather than assuming it in all. The peak power mode of Chapter 9B is recited as operating within engineering-defined limits enforced by external control circuitry that monitors voltage, current, internal resistance, and cumulative peak event count, which in her build would be her circuitry to specify and validate. Section 7.7A describes a long-term aluminum leakage degradation mode and its mitigations, on timescales the filing describes as long relative to normal operation.
None of that closes her row. It changes what the row is about: from a failure she would be left to characterize after the fact to a described response with named products, a recited timescale, and stated conditions she could design a test around.
Disclosure Scope
This article is a technical description of subject matter disclosed in U.S. Provisional Application No. 64/055,649, "Bulk-Equipotential Electrochemical Energy Storage Cell with Hydrogen-Activated Metal Nanoflakes in a Dual-Domain Proton-Conducting Carbon Gel." Mechanism descriptions here refer to embodiments described in that filing and use its own terminology and reference numerals.
Nothing in this article characterizes the scope of any claim in that application or in any application claiming priority to it, and nothing here is an admission regarding the state of the art. The scenario described is illustrative and does not refer to any actual party, deployment, or product. Quantitative ranges referenced above are as recited in the filing, which itself states that its cell-level performance ranges are projections subject to refinement upon prototype construction and testing.
