1. Cryogenic Safety and Oxygen Deficiency Hazards (ODH) at Fermilab Tom Peterson ESS Cryogenic Safety Workshop 11 February 2016

2. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 2 Introduction Pressure safety for vessels with a niobium pressure boundary –This is excerpted from a presentation which I gave to the Department of Energy as part of the process of obtaining approval for our procedures. ODH analysis Assessing worst-case venting flow rates for pressure vessel protection and ODH safety A few supplemental slides Outline

3. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 3 Safety/compliance issue In the U.S., Europe, and Japan, these helium containers and part or all of the RF cavity fall under the scope of the local and national pressure vessel rules. Thus, while used for its superconducting properties, niobium ends up also being treated as a material for pressure vessels. For various reasons, it is not possible to completely follow all the rules of the pressure vessel codes for most of these SRF helium vessel designs

4. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 4 9-cell elliptical cavity Niobium cavity under external pressure. Helium vessel sees internal pressure. Features of a dressed RF cavity

5. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 5 Issues for code compliance Cavity design that satisfies level of safety equivalent to that of a consensus pressure vessel code is affected by –use of the non-code material (niobium), –complex forming and joining processes, –a shape that is determined entirely by cavity RF performance, –a thickness driven by the cost and availability of niobium sheet, –and a possibly complex series of chemical and thermal treatments. Difficulties emerge pressure vessel code compliance in various areas –Material not approved by the pressure vessel code –Loadings other than pressure Thermal contraction Tuning –Geometries not covered by rules –Weld configurations difficult to inspect

6. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 6 Pressure Safety Requirements Governing Law –Code of Federal Regulations (CFR) Pressure Safety - 10 CFR 851 Appendix A (4) Governing Codes –Pressure Vessels The applicable American society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code including applicable Code Cases –Pressure Piping The applicable ASME B31 standards including applicable Code Cases

7. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 7 Exceptional vessels In the U.S., the Code of Federal Regulations (10 CFR 851 Appendix A Section 4C) allows national laboratories to use alternative rules which provide a level of safety greater than or equal to that afforded by ASME Boiler and Pressure Vessel Code when the pressure code cannot be applied in full. Similarly, in Europe and Japan, methods exist for handling exceptional cases like these vessels made partly from niobium.

8. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 8 General solution In applying ASME code procedures, key elements demonstrating the required level of design safety are –the establishment of a maximum allowable stress –And for external pressure design, an accurate approximation to the true stress strain curve Apply the ASME Boiler and Pressure Vessel Code as completely as practical –Exceptions to the code may remain –We have to show the risk is minimal Satisfy the requirement for a level of safety greater than or equal to that afforded by ASME code. Fermilab, Brookhaven, Jefferson Lab, Argonne Lab, and others in the U.S. have taken a similar approach

9. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 9 Fermilab has developed a standard and guidelines for vessels which cannot fully meet the pressure vessel code Design drawings, sketches, and calculations are reviewed and approved by qualified independent design professionals. Only qualified personnel must be used to perform examinations and inspections of materials, in-process fabrications, non-destructive tests, and acceptance tests. Documentation, traceability, and accountability is maintained for each pressure vessel and system, including descriptions of design, pressure conditions, testing, inspection, operation, repair, and maintenance.

10. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 10 SRF Pressure Safety Superconducting RF cavities and cryomodules are subject to comply with pressure vessel, vacuum vessel, pressure piping and cryogenic system requirements of the Fermilab Environmental, Safety and Health Manual (FESHM) –Cryostat – FESHM Chapter 5033 –Cavities – FESHM Chapter 5031, 5031.6 and 5034 –Piping – FESHM Chapter 5031.1 –System – FESHM Chapter 5032 link to FESHM http://esh.fnal.gov/xms/FESHM

11. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 11 Fermilab Cryogenic and Mechanical Safety Subcommittees Laboratory Safety Committee –Mechanical Safety Subcommittee (MSS) –Cryogenic Safety Subcommittee (CSS) –Many other safety subcommittees MSS and CSS formed an SRF pressure vessels safety committee

12. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 12 SRF Pressure Safety Committee Use of Nb for SRF cavities makes immediate compliance of Fermilab cavities with ASME BPV code impractical To address SRF cavity pressure safety at Fermilab, an SRF Pressure Safety Committee was formed The Committee developed a consistent set of rational engineering provisions to govern the construction and use of SRF cavities at Fermilab. A new FESHM chapter 5031.6 was adopted

13. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 13 FESHM 5031.6 The chapter applies to any Dressed SRF Cavity that is designed or used at Fermilab “Dressed SRF Cavity –An integrated assembly wherein a niobium cavity has been permanently joined to a cryogenic containment vessel, such that niobium is part of the pressure boundary and the cavity is surrounded by cryogenic liquid during operation.” The chapter references specially developed engineering guidelines An Engineering Note is prepared for all Dressed SRF cavities A panel specifically assigned to SRF cavity engineering note reviews ensures uniformity in preparation and review

14. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 14 Guidelines The procedures contained in the guidelines have been developed by Fermilab engineers, and represent their current understanding of best practice in the design, fabrication, examination, testing, and operation of the Dressed SRF cavities The guidelines comply with Code requirements to the extend possible For non-Code features, procedures were established to produce a level of safety consistent with that of a Code design

15. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 15 Summary for Fermilab A consistent set of rules and procedures (guidelines) for the design, construction, review, approval, and use of superconducting RF cavities at Fermilab was developed These guidelines comply with Code requirements wherever possible, and for non-Code features, procedures were established to produce a level of safety consistent with that of a Code design These procedures do not cover all possible aspects of SRF cavities. It may be necessary in some cases to use different approach.

16. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 16 Oxygen Deficiency Hazard (ODH) Oxygen Deficiency Hazard (ODH) is caused due to oxygen displacement. ODH is a serious hazard usually occur without any warning ODH is addressed by Fermilab’s FESHM 5064, which is available via the Fermilab web site. The cold, heavy gas from evaporating cryogenic liquid does not disperse very well and can group together in surrounding areas and will displace air. Some gases (He, H2) while cold may be lighter than air. They may partially mix with surrounding air, or stratify as they warm up. A hazard with helium and other inert gases is to have a pockets of trapped gas up high in a building, which may cause ODH. (A concern is that a person could pass out and fall off a ladder when replacing a lamp, for example.) Be aware of the hazards associated with large volumes of cryogens in a small space (for example, rolling a 160 liter LN2 dewar into a small room) 16

17. ODH analysis Reference: Fermilab ES&H manual (FESHM) Chapter 4240 (was 5064) http://esh-docdb.fnal.gov/cgi- bin/ShowDocument?docid=387http://esh-docdb.fnal.gov/cgi- bin/ShowDocument?docid=387 I can provide a PDF copy ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 17

18. Determining ODH Risk For each use of cryogenic liquids or inert gases a formal written analysis of the risk ODH posed should be done. The details of this may vary from institution to institution and may be driven by regulatory requirements. One technique used by many US laboratories (Fermilab, Jlab, SLAC, BNL) is the calculation of a ODH Fatality Rate. The size of this rate is then tied to a ODH class and each class is linked to specific required mitigations ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson Slide 18

19. ODH Fatality Rates ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson Slide 19 where:  = the ODH fatality rate (per hour) P i = the expected rate of the ith event (per hour), and F i = the probability of a fatality due to event i. Sum up for all n possible events

20. ODH Fatality Rates Probability of an event ( P i ) may be based on institutional experience or on more general data –Fermilab’s chapter 4240 contains extensive tables of event probabilities from various sources Probability of a given event causing a fatality ( F i ) is related to the lowest possible oxygen concentration that might result from the event ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson Slide 20

21. F i vs. Oxygen Concentration (note limits) from “Cryogenic and Oxygen Deficiency Hazard Safety: ODH Risk Assessment Procedures” SLAC ES&H Manual ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson Slide 21

22. ODH Mitigations Best solution: Eliminate the hazard by design choices –Reduce inventory of cryogenic fluids & compressed gases –Don’t conduct cryogenic activities in small spaces –Don’t use LN 2 underground Training –Everyone working in a possible ODH area should be made aware of the hazard and know what to do in the event of an incident or alarm This includes periodic workers such as security staff, custodial staff and contractors Visitors should be escorted –Medical examination (see next slide) Signs –Notify people of the hazard and proper response –Indicate that only trained people are authorized to be there ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson Slide 22

23. Medical approvals (FESHM 4240) ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 23

24. ODH Mitigations --Ventilation Ventilation systems to increase air exchange and reduce the possibility of an oxygen deficient atmosphere forming –Warning If this approach is taken, the ventilation system must now be treated as a safety system with appropriate controls and redundancies What happens during maintenance or equipment failure? How do you know ventilation system is working? ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson Slide 24

25. ODH Mitigations – Simple ducts For our Horizontal Test System (HTS) cave, relief ports are ducted out of the cave via simple PVC pipe –Large diameter –Insignificant back pressure –Not perfectly leak tight ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 25

26. ODH Mitigations -- Monitors and Alarms Fermilab uses both portable O2 monitors and fixed monitors to indicate when a hazard exists Very valuable in showing if a area has become dangerous during off hours Alarms generally set to trip at 19.5% Oxygen Fixed alarms include lights & horn as well as an indicator at entrance to area Alarms should register in a remote center (control room or fire dept) as well As a safety system it requires appropriate controls & backups (UPS, redundancy etc) ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 26

27. Response to Alarms & Emergencies All employees entering an ODH-1 or greater hazard level area are required to have had ODH training and a medical exam In the event of an alarm or other indication of a hazard, people are trained immediately to leave the area –Even where we have ODH-0 areas contiguous with ODH-1 areas (such as ODH-1 near the ceiling due to a helium risk), people evacuate with an alarm. Only properly trained and equipped professionals should attempt a rescue in an ODH situation –At Fermilab, this means fire department personnel ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson Slide 27

28. Tunnel access and evacuation For the Tevatron, inventory was naturally not very large –Each 6.4 meter magnet held only about 40 liters total, that split between each of the two magnet lines (single phase and two-phase) Maintenance work which might result in a release, such as a valve change, required inventory reduction (replace liquid with gas) and pressure reduction Fermilab instructions were to evacuate away from any visible cloud to the nearest exit (circular tunnel, always feasible) We carried escape packs in the tunnel and in ODH areas except where the travel time to a nearest exit was estimated to be shorter than that needed to put on the escape pack ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 28

29. ODH Summary Oxygen Deficiency is a significant hazard in cryogenic installations both large and small. It must be taken seriously Lethal conditions can exist without prior warning or symptoms ODH can managed by awareness, analysis of risk and appropriate mitigations Everyone working in a cryogenic facility should be aware of the risk and know what to do in the event of a problem There is a significant amount of experience & help available from laboratories and industry to reduce the ODH risk ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson Slide 29

30. Evaluating the venting flow rate and conditions Worst-case (maximum) flow generation for SRF cryomodules generally due to air condensation on liquid helium temperature surface with dense (liquid or supercritical helium) on the other side of the metal –< 1 W/cm 2 through MLI –~ 4 W/cm 2 for air condensation on bare metal surface (for example niobium with loss of beam vacuum) Total power limit for air condensation may be due to the following factors: –Surface area exposed to air –Treatment of surface exposed to air –Build-up of ice layer on exposed surface –Liquid helium area exposed to air –Air inlet flow rate ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 30

31. Heat flux due to loss of insulating vacuum as a source of pressure W. Lehman and G. Zahn, “ Safety Aspects for LHe Cryostats and LHe Transport Containers, ” ICEC7, London, 1978 G. Cavallari, et. al., “ Pressure Protection against Vacuum Failures on the Cryostats for LEP SC Cavities, ” 4th Workshop on RF Superconductivity, Tsukuba, Japan, 14-18 August, 1989 M. Wiseman, et. al., “ Loss of Cavity Vacuum Experiment at CEBAF, ” Advances in Cryogenic Engineering, Vol. 39, 1994, pg. 997. T. Boeckmann, et. al., “ Experimental Tests of Fault Conditions During the Cryogenic Operation of a XFEL Prototype Cryomodule, ” DESY. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 31

32. Heat flux conclusions Lehman and Zahn –0.6 W/cm 2 for the superinsulated tank of a bath cryostat –3.8 W/cm 2 for an uninsulated tank of a bath cryostat Cavallari, et. al. –4 W/cm 2 maximum specific heat load with loss of vacuum to air Wiseman, et. al. –3.5 W/cm 2 maximum peak heat flux –2.0 W/cm 2 maximum sustained heat flux ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 32

33. Other heat flux comments T. Boeckmann, et. al. (DESY) –Air inflow into cavity beam vacuum greatly damped by RF cavity structures Various authors also comment about layer of ice quickly reducing heat flux Heat flux curves for liquid helium film boiling with a delta-T of about 60 K agree with these heat flux numbers (next slide) I use 4 W/cm 2 for bare metal surfaces ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 33

34. E. G. Brentari, et. al., NBS Technical Note 317 ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 34

35. Atmospheric air rushing into a vacuum space and condensing on a surface deposits about 11 kW per cm 2 of air hole inlet area. In many cases, heat flux will be limited by this air hole inlet size rather than low-temperature surface area. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 35

36. Example of design to mitigate worst-case flow rate For LCLS-II, all process lines vent outside the tunnel via the distribution system –Only vacuum reliefs vent to the tunnel –Our 300 mm helium gas return pipe serves naturally as a large venting duct for the dressed cavities (next slide) Venting flow rate is a determining factor for distribution line sizes and relief sizes The worst-case loss of vacuum accident would be loss of insulating vacuum to air –We have long continuous strings of cryomodules with common insulating vacuum –Although heat flux is lower than for beam vacuum loss with bare metal, total available area which can immediately receive air is much larger –The most likely air inlet port would be a pumping port due to break or disconnection of a pumping line or portable pumping cart –Insulating vacuum pump-out ports were reduced in size from the original 100 mm design diameter to 75 mm in order to reduce the required sizes of distribution lines and relief system ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 36

37. LCLS-II cryomodule schematic ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 37

38. Conclusions Cryogenic vessels and piping generally fall under the scope of the ASME pressure vessel and piping codes Protection against overpressure often involves not only sizing a rupture disk or relief valve but sizing vent piping between those and the vessel, and also perhaps further ducting downstream of the reliefs Loss of vacuum to air can drive not only the design of the venting system but pipe sizes within the normally operational portions of the cryostat Piping stability due to forces resulting from pressure around expansion joints is sometimes overlooked and may also significantly influence mechanical design ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 38

39. Supplementary slides ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 39

40. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 40 Code Compliance Issues for SRF Vessels Including Non-code Materials Materials Joining Examination

41. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 41 Materials Whenever possible, use Code materials and the properties listed in the Code tables If a non-code material is used, material properties may be established by either –Material testing, or –Use of suggested accepted minimum values properties listed in the guidelines Allowable stresses for all non-Code materials used for construction of dressed SRF cavities shall be determined in accordance with the Code, Section II, Part D, Mandatory Appendix 1. All values of the allowable stress shall be de- rated by a factor of 0.8 (reduced by 20%)

42. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 42 Joining In each case, if the welded or brazed joint is not a standard ASME Code joint, the development must include sufficient analysis and mock-up testing to support the conclusion of equivalent safety Guidelines outline procedures for EB and GTAW welded joints as well as Brazed joints

43. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 43 Examination The examination and inspection of the helium vessel shall meet the requirements of the ASME Boiler and Pressure Vessel Code The SRF cavity is constructed of non-Code materials and examination per the ASME BPV is not practical. The ASME Process Piping Code, B31.3, does allow for construction with non-Code materials and is deemed more applicable to the SRF cavity. Therefore, the examination and inspection of the cavity shall follow the requirements of the ASME B31.3 Code

44. Vacuum relief Typically very low pressure –Vacuum vessel not a code-stamped pressure vessel, so MAWP < 0.5 - 1 atm –Flow may be subsonic –Valve not officially approved –Sizing may be difficult, must be conservative –We often include redundancy (multiple valves in parallel) But the most difficult task may be deciding on the worst-case incident for which the vacuum valve must be sized Since we always try to vent cryogens from process reliefs out of our enclosures, the most likely source of ODH for an accelerator system may be internal rupture and subsequent venting via vacuum relief ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 44

45. Fermilab parallel plate vacuum relief ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 45

46. Example: Summary ODH Analysis for Fermilab MTA Hall ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson Slide 46

47. Two MRI system event videos http://www.youtube.com/watch?v=1R7Ksfo sV-ohttp://www.youtube.com/watch?v=1R7Ksfo sV-o http://www.youtube.com/watch?v=sceO38i djic&feature=relatedhttp://www.youtube.com/watch?v=sceO38i djic&feature=related ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 47

48. References -- 1 Fermilab ’ s ES&H Manual (FESHM) pressure vessel standard, FESHM 5031 –http://esh-docdb.fnal.gov/cgi-bin/ShowDocument?docid=456http://esh-docdb.fnal.gov/cgi-bin/ShowDocument?docid=456 FESHM Chapter 5031.6 - Dressed Niobium SRF Cavity Pressure Safety –And associated document: “ Guidelines for the Design, Fabrication, Testing and Installation of SRF Nb Cavities, ” Fermilab Technical Division Technical Note TD-09-005 –http://esh-docdb.fnal.gov/cgi-bin/ShowDocument?docid=1097http://esh-docdb.fnal.gov/cgi-bin/ShowDocument?docid=1097 ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 48

49. References -- 2 W. Lehman and G. Zahn, “ Safety Aspects for LHe Cryostats and LHe Transport Containers, ” ICEC7, London, 1978 G. Cavallari, et. al., “ Pressure Protection against Vacuum Failures on the Cryostats for LEP SC Cavities, ” 4th Workshop on RF Superconductivity, Tsukuba, Japan, 14- 18 August, 1989 M. Wiseman, et. al., “ Loss of Cavity Vacuum Experiment at CEBAF, ” Advances in Cryogenic Engineering, Vol. 39, 1994, pg. 997. T. Boeckmann, et. al., “ Experimental Tests of Fault Conditions During the Cryogenic Operation of a XFEL Prototype Cryomodule, ” DESY. ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 49

50. References -- 3 E. G. Brentari, et. al., “ Boiling Heat Transfer for Oxygen, Nitrogen, Hydrogen, and Helium, ” NBS Technical Note 317, 1965. NBS Technical Note 631, “ Thermophysical Properties of Helium-4 from 2 to 1500 K with Pressures to 1000 Atmospheres ”, 1972. Vincent D. Arp and Robert D. McCarty, “ Thermophysical Properties of Helium-4 from 0.8 to 1500 K with Pressures to 2000 Atmospheres, ” National Institute of Standards and Technology (NIST) Technical Note 1334, 1989. HEPAK (by Cryodata, Inc.) ESS, 11 Feb 2016Cryogenic Safety, Tom Peterson 50