1. Hydrogen Hazard Summary and Preliminary FMECA and HAZOP Yury Ivanyushenkov Elwyn Baynham Tom Bradshaw

2. 2 Hydrogen properties The potential hazards of liquid hydrogen stem mainly from three important properties: 1.Its extremely low temperature 2.Its very large liquid to gas expansion ratio 3.Its wide range of flammable limits after vapourising to gas

3. 3 Hydrogen Hazards Consequences (hazards) of these properties: 1. => - severe burns can be produced upon contact with the skin; - some materials can become brittle and easily broken 2.=> overpressure => - excessive deformation of a vessel; - rupture of the pressure vessel 3.=> fire => - injury of personnel - damage to equipment / property Fire is a primary hydrogen hazard !

4. 4 Hydrogen hazards (2) Fire is a primary hydrogen hazard ! A fire can result from two scenarios [1]: (1)- Hydrogen is released, - mixes with an oxidizer, - forms a combustible mixture, - the mixture contacts an ignition source, - and ignition occurs. (2)- The hydrogen system is contaminated with an oxidizer (as a result of improper purging and/or in leakage of an oxidizer, such as air), - the hydrogen and the oxidizer form a combustible mixture; - the combustible mixture contacts an ignition source; - and ignition occurs. [1] Guide for Hydrogen Hazards Analysis on Components and Systems, NASA TP-WSTF-937

5. 5 MICE Hydrogen system layout PP VP Vacuum pump Bursting disk Pressure relief valve Valve Pressure regulator Pressure gauge 18 K He to Compressor via Radiation shield 14 K He from Cold box Liquid level gauge LH 2 Absorber Vacuum Vacuum vessel LHe Heat exchanger Internal Window 70 K Safety window H 2 Gas bottle P P Fill valve Metal hydride hydrogen storage unit (20 m 3 capacity) Vent outside flame arrester He Purge system Non-return valve Vent outside flame arrester Vent valve 1.7 bar 2.1 bar H 2 Detector P P P P Evacuated vent buffer tank VP P X 2 VP H 2 Detector Ventilation system Vent outside flame arrester Chiller/ heater unit Node 1 Node 2 Node 3 Node 4 Node 5

6. 6 Preliminary FMECA No.Failure modeEffectCriticalityComments 1Leakage of inner window – detected from hydrogen detectors and or vacuum gauge. Rise in pressure in interspace between windows. Will cause a heat load on the absorber leading to rapid evolution of hydrogen. System design should take into account thermal conductance and thermal short circuit. We need to consider the effect of hydrogen in the region between the windows in the thermal design. Need to know heat load on absorber and hydrogen evolution rate. 2Leakage on outer window No effect except in the event of rupture of the inner window. How do we detect leakage on outer window? Can training of rf `cavities puncture the window ? Failure Mode Effect and Criticality Analysis (FMECA)

7. 7 Preliminary FMECA (2) 3Vacuum failure to inner window This will increase the heat load to the hydrogen and initiate a rapid boil-off. Calculations (ref Bradshaw, Baynham and Green) indicate that the pressure drop in the connecting pipework will not cause a large pressure rise. 4Vacuum failure to outer window This will cause plating of some condensibles on the window as the temperature is fairly low. Need to ensure that oxygen does not plate out on the outer window. Need good thermal design and analysis. Note that it is not possible to measure the temperature of the outer window directly.

8. 8 Preliminary FMECA (3) 5Failure of electricity supply The temperature control of the hydride bed will be lost and the hydride will absorb hydrogen up to its equilibrium point. If there is liquid hydrogen in the system it will be evolved and absorbed by the hydride. The loss of vacuum will accelerate this process. Need to ensure that the hydride bed can accommodate the evolution rate else hydrogen will be lost through the vent line. Normally loss of vacuum is gradual. What is the absorbtion rate of the hydride bed ? 6Failure of chiller/heater unit to hydride Temperature control of the hydride will be lost and it will absorb up to its equilibrium pressure. This will reduce pressure on the hydrogen and lower its temperature, at which point the flow of helium to the absorber heat exchanger will be reduced. Need to ensure that the hydride chosen has a low pressure at room temperature. What is the pressure above the hydride bed at room temperature ?

9. 9 Preliminary FMECA (4) 7Rupture of line between hydride and absorber Hydrogen will be lost and detected by hydrogen detectors in the vent line. The hydrogen detectors are the only indication of system gas loss. 8Fire in vicinity of hydride This will cause a rise in temperature of the hydride bed leading to evolution of the hydrogen. The pressure will rise leading to venting as soon as the relief valve operates. The hydrogen will be vented at roof level away from the scene of the fire. Is the hydride flammable ?

10. 10 Preliminary FMECA (5) 9Magnet quench – eddy current heating This will induce eddy currents in the absorber windows and forces on the magnet support structure. There will be an evolution of hydrogen which needs to be absorbed by the hydride. The influence of a quench on the absorber has been studied (ref Rochford and Witte) and the eddy current heating is low – enough to boil off a few litres of hydrogen. Need to check that the hydride can absorb the hydrogen quickly enough or that the volumes are such that the system pressure does not exceed the rated value for the inner window.

11. 11 Preliminary FMECA (6) 10Magnet quench – forces on structure A magnet quench will put large forces on the structure. In the event of mechanical failure the connecting pipework may rupture emptying the hydrogen into the MICE experiment and RF cavities There is a large margin of safety in the force calculations and steps need to be taken to make sure that the magnets are not operated past the design limits with hydrogen in the system. Reference Rochford and Baynham. What are the consequences of having hydrogen in the rf cavities ?

12. 12 Preliminary HAZOP: Node 1 NoParamete r Guide word CauseConsequenceSafeguardsRecommendations 1PressureLower1. Storage unit is leaking. 2. Pipe is leaking. 3. Absorber vessel is leaking. 1-2. Hydrogen is leaking out in the experimental hall. 3. Hydrogen is leaking into vacuum jacket. Pressure gauge to trigger an alarm. Hydrogen ventilation system collects and vents hydrogen out. Hydrogen detector to trigger an alarm. Implement an active pressure gauge. Implement ventilation system. Implement an active hydrogen detector. 2PressureHigher1. Fill valve is accidentally open or leaking 2. Storage unit is overheated 1-2. Absorber windows can break. Pressure relief valve to vent outside. Temperature sensor triggers an alarm. Implement a pressure relief valve. Implement a temperature monitor. Node 1: Hydrogen storage unit

13. 13 Preliminary HAZOP: Node 2 NoParameterGuide word CauseConsequenceSafeguardsRecommendations 1TemperatureLowerToo much cooling power from the He cooling system. 1. Pressure in the hydrogen system drops. Pressure gauge to trigger an alarm. Temperature sensor to trigger an alarm Additional: Liquid hydrogen level meter to trigger an alarm. Implement both the active pressure gauge and the temperature sensor. Additional: Implement an active liquid level meter. 2TemperatureHigher1. Not enough cooling power from the He cooling system. 2. Power cut. 1-2. Liquid hydrogen evaporates and LH2 level goes down. 1-2. Hydrogen pressure rises. Temperature sensor to trigger an alarm Additional: Liquid hydrogen level meter to trigger an alarm. Pressure gauge to trigger an alarm. Implement both the active pressure gauge and the temperature sensor. Additional : Implement an active liquid level meter. 3PressureLower1. Window is leaking or broken. 2. Pipe is leaking. 3. Hydrogen storage unit is leaking. 4. Absorber is over cooled. 1. Hydrogen leaks into vacuum vessel. 2-3. Hydrogen is leaking out. 4. Pressure in the system drops and air can leak in the system in case if the system seal is broken. Hydrogen detector to trigger an alarm. Hydrogen ventilation system collects and vents hydrogen out. Temperature sensor to trigger an alarm. Implement an active hydrogen detector. Implement hydrogen collection and ventilation system. Implement a temperature sensor. 4PressureHigherTemperature is increased.Windows can break. Pressure relief valve to dump hydrogen into a buffer tank Implement a pressure relief valve and a buffer tank. Node 2: Hydrogen absorber internal vessel with hydrogen windows

14. 14 Preliminary HAZOP: Node 3 Node 3: Hydrogen absorber vacuum jacket with safety windows NoParameterGuide wordCauseConsequenc e SafeguardsRecommendations 1PressureHigher1. Hydrogen window broken 2. Vacuum pump failure 1. Hydrogen bursts into vacuum jacket 2. Vacuum drops. Pressure relief valve to dump hydrogen into a buffer tank and then to vent it outside. Implement a buffer tank. 2Hydrogen concentratio n HigherHydrogen gets in due to window is broken or seal is leaking An explosive mixture can be formed if there is an air leak in as well. Active hydrogen sensor detects hydrogen and trigger s an alarm. Implement an active hydrogen detector.

15. 15 Preliminary HAZOP: Node 4 Node 4: Buffer tank NoParameterGuide wordCauseConsequenceSafeguardsRecommendations 1PressureHigher1. Venting path is blocked. 2. Tank is leaking. 3. Vacuum pump failure Absorber vacuum jacket windows can break. Buffer tank can’t be used for dumping hydrogen in case of accident with absorber. Active pressure gauge triggers an alarm. Oxygen sensor triggers an alarm. Use a spare pump. Implement an active pressure gauge. Implement an active oxygen sensor. Keep a spare pump.

16. 16 Preliminary HAZOP: Node 5 Node 5: Hydrogen module enclosure NoParameterGuide wordCauseConsequenc e SafeguardsRecommendations 1Hydrogen concentratio n Higher1. Hydrogen leaks out absorber module 2. Hydrogen leaks out hydrogen pipes 3. Hydrogen leaks out storage unit. 1-3. Explosive oxygen- hydrogen mixture can be formed Ventilation system to quickly vent hydrogen out. Hydrogen detector to trigger an alarm and to start a high rate mode for the ventilation system. Implement ventilation system equipped with hydrogen detector.

17. 17 Preliminary HAZOP: Recommendations Hydrogen storage unit Implement: active pressure gauge temperature monitor Hydrogen absorber internal vessel with hydrogen windows Implement: active pressure gauge temperature sensor active liquid level meter (additional) Hydrogen absorber vacuum jacket with safety windows Implement: active hydrogen detector Buffer tank Implement: active pressure gauge active oxygen sensor Hydrogen module enclosure Implement: ventilation system equipped with hydrogen detector.