MICE Hazard Overview and Analysis Elwyn Baynham Tom Bradshaw Yury Ivanyushenkov

2 MICE Hazard Overview Scope Overview of Hazards for MICE Hydrogen system Summarise proposals for design and implementation to minimise risk Address major fault scenarios and describe system response Describe qualitative studies to identify the potential HAZard and OPerating problems in the system – HAZOP Brief overview of the other aspects of MICE safety Conclusions

3 MICE Hazard Overview The MICE safety case (hazard assessment) should: Identify the most credible accidents Analyse probability and consequence Define the steps needed to reduce the risks to be as low as reasonably achievable.

4 MICE Layout

5 MICE Hazards Overview Beam Radiation Fire Explosion Overpressure Material brittleness Skin burn Solid absorber toxic Be Li Radiation (electrons, X-rays) HV=> Sparks Beryllium HV RF LH 2 TrackerLH 2 Tracker Particle detectors High magnetic field => High mechanical forces Magnetic stray fields Quench voltage Helium / overpressure Photo detectors and front-end electronics Optical fibres Photo detectors and front-end electronics Optical fibres HV TOF

6 Hydrogen Hazards The potential hazards of liquid hydrogen stem mainly from three important properties: 1.Its wide range of flammable limits and detonation limits after vaporising to gas Flammability in air 4 – 75% Detonation in air 18 – 58% 2. Its very large liquid to gas expansion ratio 1:800 20K-300K leading to risk of overpressure 3. Its extremely low temperature Intrinsic risks - metal brittleness – skin burn Consequent risks – cold surfaces can cryopump oxygen as a storage mechanism

7 Hydrogen hazards (2) A fire can result from two scenarios Hydrogen is released, - mixes with an oxidizer, - forms a combustible mixture, The hydrogen system is contaminated with an oxidizer (as a result of improper purging and/or in leakage of an oxidizer, such as air), - the hydrogen and the oxidizer form a combustible mixture; The combustible mixture contacts an ignition source; Ignition occurs. So this is a two way process Stop hydrogen releases Stop oxidiser ingress

8 Hydrogen – Safety Realisation How do we propose to achieve the high standard of safety and low risk required : Baseline Principles Implement everywhere a double barrier between hydrogen and air(oxygen) Double vacuum or vacuum + inert gas such as argon Avoid ignition sources in direct contact with hydrogen

9 Hydrogen - Safety Realisation Design Modular systems Separate hydrogen system from magnet / rf / detectors Absorber to allow maximum stage testing - spare Hydrogen absorber Eliminate cold surfaces where oxygen can be cryopumped Design with adequate safety margins for overpressure Linked to R&D programme to verify and qualify designs of windows and seals Hydrogen system: Closed system concept keeps hydrogen venting to a minimum Hydrogen is stored as a solid compound in a hydride bed Passive pressure relief system to extract H2 to a buffer tank Hydrogen zone is localised; Ignition sources are kept outside hydrogen zone.

10 Hydrogen – Safety Realisation Implementation Manufacture Component manufacture to strict QA and design code. Certification of all materials and traceability of process. Test Tests of components, sub-assemblies and assemblies off-line Tests at integration of the absorber Tests of complete system Qualitative studies To identify worst case scenarios and feedback to design process. Failure mode analysis HAZOP Analysis

11 Hydrogen System – Failure Modes Failure Mode Scenarios/Fault Conditions Major Failures Absorber Vacuum Failure Hydrogen Window failure Low Level Faults Low level Hydrogen leak Low level Vacuum leak Support system failures Power Failure Refrigerator Failure Hydride Bed chiller system failure Interactive system failures Magnet Quench

12 Loss of Absorber Vacuum 18 K He to Compressor via Radiation shield 14 K He from Cold box Liquid level gauge LH 2 Absorber Vacuum Vacuum vessel LHe Heat exchanger Internal Window Safety window Fill valve Metal Hydride storage unit (20m 3 capacity) Vent outside flame arrester He Purge system Vent outside flame arrester Purge valve H 2 Detector P P P Evacuated vent buffer tank VP P X 2 VP Purge valve H 2 Gas bottle P P Chiller/Heater Unit 1 bar Cold P 1 bar P H 2 Detector Ventilation system Vent outside flame arrester 2.0 bar 1.6 bar 2.0 bar 1.6 bar 1.4 bar

13 Inner Window Rupture 18 K He to Compressor via Radiation shield 14 K He from Cold box Liquid level gauge LH 2 Absorber Vacuum Vacuum vessel LHe Heat exchanger Internal Window Safety window Fill valve Metal Hydride storage unit (20m 3 capacity) Vent outside flame arrester He Purge system Vent outside flame arrester Purge valve H 2 Detector P P P Evacuated vent buffer tank VP P X 2 VP Purge valve H 2 Gas bottle P P Chiller/Heater Unit Cold P 1 bar P H 2 Detector Ventilation system Vent outside flame arrester 2.0 bar 1.6 bar 2.0 bar 1.6 bar 1.4 bar

14 Cross section of Absorber a)Windows are mounted off RT interface – see thermal model later b)Space for change in pipe dimension close to magnet c)Large “bucket” at base to contain any rupture

15 Inner window Rupture Initial Analysis Vacuum window - local cooling by hydrogen spillage does not cause excessive stresses Magnet Bore – hydrogen spillage does not cause excessive stress End Plate Shell and seals – significant overall thermal deflections but within the elastic range – deflections at the seal plate ~ 10micron – effects can be reduced by incorporating a copper spillage bucket Extraction pipework – pipe work can be sized to keep pressure drops ~ 0.3 bar – overall pressure should not exceed vacuum window test pressure Conclusions The rupture of a hydrogen window will not initiate a chain of events which will release hydrogen into MICE

16 Hydrogen System – Failure Modes Low level Faults Hydrogen Leak Vacuum leak Detected by sensors – interlocks initiate shut down process Stage 1 return of H2 to hydride bed – stage 2 venting Support system failures Power Failure Refrigerator Failure Normally handled by return of H2 to hydride bed Or ultimately safe venting Hydride Bed chiller to be on secure supply Hydride Bed chiller system failure Will depend on details of Hydride design – ultimately safe venting Interactive system failures Magnet Quench Minor interactive effects on the absorber system

17 HAZOP Process HAZard and OPerability Study Qualitative study to identify the potential hazards and operating problems of a process Assumption that a hazard or operating problem can only occur when there is a deviation from the design or operating intention :eg no flow when there should be flow Process examined Line by line Vessel by vessel Section by section Aim to identify safety and operability problems

18 Inputs to HAZOP Study Process and Instrumentation Diagrams Normal operating conditions purge fill commissioning disassembly Parameters pressure,temperature,flow,level,services... Guide words more,less,reverse,etc...

19 Process and Instrumentation diagram Normal mode of working Node definition HAZOP process Recommendations Implementation HAZOP Process (2)

20 Preliminary HAZOP Node Definition

21 Preliminary HAZOP: Node 3 Node 3: Hydrogen absorber vacuum jacket with safety windows NoParameterGuide wordCauseConsequenc e SafeguardsRecommendations 1PressureHigher1. Hydrogen window broken 2. Vacuum pump failure 1. Hydrogen bursts into vacuum jacket 2. Pressure slowly increases Pressure relief valve to dump hydrogen into a buffer tank and then to vent it outside. Monitor pressure and have spare pump. Implement a buffer tank. Implement vacuum gauge with alarm and have spare pump ready. 2Hydrogen concentratio n HigherHydrogen gets in due to window is broken or seal is leaking An explosive mixture can be formed if there is an air leak in as well. Active hydrogen sensor detects hydrogen and trigger s an alarm. Implement an active hydrogen detector.

22 Preliminary HAZOP: Node 5 Node 5: Hydrogen enclosure NoParameterGuide wordCauseConsequenc e SafeguardsRecommendations 1Hydrogen concentratio n Higher1. Hydrogen leaks out absorber module 2. Hydrogen leaks out hydrogen pipes 3. Hydrogen leaks out storage unit Explosive oxygen- hydrogen mixture can be formed Ventilation system to quickly vent hydrogen out. Hydrogen detector to trigger an alarm and to start a high rate mode for the ventilation system. Implement ventilation system equipped with hydrogen detector.

23 Preliminary HAZOP: Recommendations Metal hydride storage unit Implement: - active pressure gauge; - pressure regulator; - pressure relief valve. Hydrogen absorber internal vessel with hydrogen windows Implement: - active pressure gauge; - temperature sensor; - active liquid level meter (additional). Hydrogen absorber vacuum jacket with safety windows Implement: - active hydrogen detector. Buffer tank Implement: - active pressure gauge; - active oxygen sensor. Hydrogen enclosure Implement: - ventilation system equipped with a hydrogen detector. These are the basis for a more detailed HAZOP in the engineering phase based on final P&ID

24 MICE Hazards Radiation Beam Radiation RF LH 2 TrackerLH 2 Tracker Radiation Particle detectors Radiation safety is achieved by: - shielding the beam line; - no access to the experimental hall when RF power is on; - local shielding of some cryogenics equipment such as control electronics, cold boxes and valve boxes; - local shielding of detectors front-end electronics

25 MICE Hazards Magnetic Field Beam RF LH 2 TrackerLH 2 Tracker Particle detectors High magnetic field => High mechanical forces Stray magnetic field Magnetic field safety is achieved by: - passive magnetic shielding the MICE (brings magnetic field down to below 5 gauss-level in the public areas outside the experimental hall); - restricted access to the experimental hall. High mechanical forces on the MICE components are: - analysed and understood ; - taken into the account in the MICE design.

26 cellar 1 m services zone Concrete radiation shielding Steel magnetic shielding stay clear zone Scale: Main gate * Exit * High level exit * 5.6 m door cold box 3.8 m * All doors are normally blocked when MICE is running MICE Layout Option: All the hall is a MICE restricted area

27 Conclusions Absorber Meets the primary objectives To separate hydrogen and oxygen To avoid source of ignition Defined a route to qualification, test and implementation Hydrogen System Modularity Closed system Essentially passive Basic operating modes defined Major fault conditions analysed H2 zones defined and localised Formal analysis of system begun Proposed system is a sound basis to move forward to the engineering design

28 Preliminary HAZOP: Nodes and parameters Node Intent Parameters 1.Metal hydride storage unit. To keep hydrogen gas in the tank-absorber Pressure. closed system. 2. Hydrogen absorber internal To keep hydrogen liquid inside hydrogen Temperature; vessel with hydrogen window. absorber module. Pressure. 3. Hydrogen absorber vacuum To insulate the hydrogen vessel thermally and to Pressure; jacket with safety window. provide an additional oxygen barrier. Hydrogen concentration. 4. Buffer tank. To quickly relieve pressure in the absorber module Pressure in case of window burst. 5. Hydrogen enclosure. To localize and vent hydrogen in case of Hydrogen hydrogen leak. concentration.

29 Preliminary HAZOP: Node 1 Node 1: Metal hydride storage unit NoNo Paramete r Guide word CauseConsequenceSafeguardsRecommendations 1PressureHigher1. Fill valve is accidentally open or leaking. 2. Tank is overheated Absorber windows can break. Pressure regulator to reduce the pressure on the line to the absorber. Pressure relief valve to vent outside. Active pressure gauge to trigger an alarm. Implement a pressure regulator on the line to the absorber. Implement a pressure relief valve. Implement an active pressure gauge.

30 Preliminary HAZOP: Node 2 NoParameterGuide word CauseConsequenceSafeguardsRecommendations 1TemperatureLowerToo much cooling power from the He cooling system. 1. Pressure in the hydrogen system drops. Pressure gauge to trigger an alarm. Temperature sensor to trigger an alarm Additional: Liquid hydrogen level meter to trigger an alarm. Implement both the active pressure gauge and the temperature sensor. Additional: Implement an active liquid level meter. 2TemperatureHigher1. Not enough cooling power from the He cooling system. 2. Power cut Liquid hydrogen evaporates and LH2 level goes down Hydrogen pressure rises. Temperature sensor to trigger an alarm Additional: Liquid hydrogen level meter to trigger an alarm. Pressure gauge to trigger an alarm. Implement both the active pressure gauge and the temperature sensor. Additional : Implement an active liquid level meter. 3PressureLower1. Window is leaking or broken. 2. Pipe is leaking. 3. Hydrogen storage unit is leaking. 4. Absorber is over cooled. 1. Hydrogen leaks into vacuum vessel Hydrogen is leaking out. 4. Pressure in the system drops and air can leak in the system in case if the system seal is broken. Hydrogen detector to trigger an alarm. Hydrogen ventilation system collects and vents hydrogen out. Temperature sensor to trigger an alarm. Implement an active hydrogen detector. Implement hydrogen collection and ventilation system. Implement a temperature sensor. 4PressureHigherTemperature is increased.Windows can break. Pressure relief valve to dump hydrogen into a buffer tank Implement a pressure relief valve and a buffer tank. Node 2: Hydrogen absorber internal vessel with hydrogen windows

31 Preliminary HAZOP: Node 4 Node 4: Buffer tank NoParameterGuide wordCauseConsequenceSafeguardsRecommendations 1PressureHigher1. Venting path is blocked. 2. Tank is leaking. 3. Vacuum pump failure Absorber vacuum jacket windows can break. Buffer tank can’t be used for dumping hydrogen in case of accident with absorber. Active pressure gauge triggers an alarm. Oxygen sensor triggers an alarm. Use a spare pump. Implement an active pressure gauge. Implement an active oxygen sensor. Keep a spare pump.

32 MICE Layout Option: MICE restricted area is inside a roofed blockhouse

33 MICE Layout