1. CERN - European Organization for Nuclear Research Fabio Corsanego CERN SC/GS Protection against internal Hazards in the Review of Nuclear Physics Experiments 5 th International High Energy Physics Technical Safety Forum SLAC 11-15 May 2005

2. How can we make safety discussion more efficient?

3. Milestones for the realization of an experiment 1.Approval of the research board 2.Appointment of GLIMOS (group leader in matter of safety= Mr. Safety) 3.ISIEC (Initial Safety Information on Experiments at CERN) 4.Safety talks 5.Risk analyses 6.Early safety inspections 7.Safety Reception 8.Exercise.

4. ..world wide collaborations.. (Example: list of Collaborators to (N-TOF 11)) Japan, Tsukuba (Ibaraki-Ken) High Energy Accelerator Research Organization (KEK) Spain, Barcelona Universidad Politecnica de Cataluña Spain, Sevilla Universidad de Sevilla Dept. de Fisica Atómica Molecular y Nuclear Switzerland, Geneve European Organization for Nuclear Research (CERN) United Kingdom, Didcot, Oxon Rutherford Appleton Laboratory United States of America, Oak Ridge, Tn Oak Ridge National Laboratory (ORNL) United States of America, Princeton, Nj Princeton University Joseph Henry Laboratories United States of America, Upton, Ny Brookhaven National Laboratory (BNL) We propose to perform a proof-of-principle test of a target station suitable for a Neutrino Factory or Muon Collider source using a 24-GeV proton beam incident on a target consisting of a free mercury jet that is inside a 15- T capture solenoid magnet. This test could be performed in the TT2A tunnel of the nTOF proton line (upstream of the spallation target). The tests would require only 100 fast-extracted pulses of full PS intensity, delivered in a pulse-on-demand mode of operation over about 2 weeks. The main piece of apparatus is the LN2-precooled, 15- T copper magnet of total volume slightly over 1 m with a 15-cm- diameter warm bore. The principle diagnostic is a high-speed optical camera. The mercury jet is part of a closed mercury loop that includes an insert into the bore of the magnet

5. RESEARCH INSTITUTIONS …Collaborators to CMS Detector

6. Safety talks ”…a discussion between the GLIMOS and the safety authorities about hazards, based on the information given on the ISIEC Form” too much focus on too few topics lack of perception of the accident interaction between different system lack of perception of the concurrent play of countermeasures The main risks of the discussion on risk :

7. What are the basic subsystems of an experiment? Cryogenic system Cooling system Electric System Gas supply system Magnets …. Beam

8. So what to make sure that all safety aspects are covered since first talks? Checklists –interesting but one-dimensional and sequential: difficult to formalize concurrences and correlations between topics HAZOP, FMECA –nice tools, but need to know already the design in details, and take months to give results Can we imagine something intermediate?

9. Major Accident Scenarios Fire Explosion Chemical accident Cryogenic accident Nuclear accident Collapse …. Wrong operation Control system failure Electric failure Mechanical failure Earthquake

10. Failure Causes Where could each scenario come from? Cranes Missile or rotor fragment impact SCADA malfunctioning and overpressures Ice formation Nuclear induced ageing, fragility, gas overpressures etc Design Construction usage

11. Causes List of possible causes for mechanical failure of a vessel “Independent” mechanical failure (..all that is related to bad design, bad construction and exercise, independent from the rest of the environment) Fall of static loads located above or aside Collision with crane bridges, vehicles or other mobile loads Earthquake Missile, high speed flying fragment Formation of ice in piping or cryogenic embrittlement Overpressures induced by nuclear transmutation Overpressures induced by SCADA faults ….

12. Consequences For any scenario, possible outcomes that could be even more severe have to be investigated Bleeve - fireball Injuries, victims Air pollution Water pollution Blast, explosion Nuclear accident Electric accident flooding

13. Example of consequences of collapse of a pressurized component Blast or Explosion Injuries to occupants Intoxication of occupants Nuclear Contamination Fluid leakage/flooding Cryogenic fluid outbreak Fire Formation of secondary missiles hitting other components …

14. Layer of protection analysis (LOPA) SIS= safety interlocked system ESD= emergency Shutdown system

15. In-depth defense: Barriers have to be: (Big I) I ndependent (3D) Able to Detect, Decide, Deflect (3E) Fast Enough, Strong Enough, Big Enough

16. Protective barriers for our example sub-case: lift mishandling-> vessel failure-> nuclear accident Cranes Vessel rupture Nuclear accident Which are the safeguards applicable to the cause jth ? Which are the safeguards stopping the accidents scaling up in the direction ith ?

17. Safeguards (Independent Protective Layers) Crane bridge inside? Cranes outside? Fork lifts? Inherent safety: does the problem exist?

18. Safeguards (Independent Protective Layers) Keys managing Planning and backup resource allocation Procedure Training Daily operation

19. Panic button Working field Overload limiter Protection cage Bumpers Traffic barriers Safeguards (Independent Protective Layers) Corrective Operational measures Barriers

20. Safeguards (Independent Protective Layers) Emergency preparedness

21. How to summarize all this ? Independent protective layers (to prevent accident) origin DesignBasic controls, alarm, operator Supervision Critical alarm, operator supervision and manual intervention Automatic safety interlock Emergency shutdown system Physical protection (relieves and barriers) Emerge ncy respon se Collision due to mobile loads, crane bridges, vehicles Answers: Applicable Not applicable Can a crane bridge move above the experiment? Can a wheeled vehicle collide with the experiment? Answers: YES / NO / To be investigated Are the operators trained and certified to use the tools? Are procedures for moving loads in place? Do crane bridge have overload protections? Can they be easily bypassed? Do the crane bridges have an electronic mapping of the working field? Is it regularly updated for the used space? Are keys and controls of lifting devices removed after use? Do lifting and movement devices have emergency stops? Do the crane bridges have physical blocks preventing movement above the experiment? Are protective barriers in place above the experiment? Are barriers preventing collision with vehicles in place? Are emergency procedures adapted to the nature of the loads lifted? …….

22. How to describe protection against the worsening of the consequences: (Table similar to the previous one, BUT with consequences) Pressure vessel failure Independent Protective layers (to fight consequence scaling up) ConsequenceDesignBasic controls, alarm, operator Supervision Critical alarm, operator supervision and manual intervention Automati c safety interlock Emergency shutdown system Physical protection (reliefs and barriers) Emergency response Nuclear contaminatio n Do vessels contain radio nuclides that can be ejected in case of accident? Is it possible to modify their status of aggregation in order to limit their dispersion potential? Does a radiation level monitoring exist? Does a pressure control loop exist that might reduce the pressure in case of incipient failure? Is the operator able to recognize immediately an increase of radiation level and to give alarms? Is a shutdown maneuver effective to limit or stop the flow incase of vessel failure? Does the vessel rupture expose the content directly to air? Is ventilation separated from the rest of the building? Do emergency relief valves have a recuperation system? Do recuperation pits exist for heavy gases or liquids? Are shutoff valves located in a position accessible in emergency? Is the maximum potential of the the event limited to the room or external too? …..

23. “How many” independent protective layers do we need? Hard to say in few words…but in principle “big events” shall be kept under 10 -6, 10 -8 occurrences per year (same chance as a big asteroid hitting our planet)

25. Advantages All the possible sources are systematically treated Failure of further multiple levels are required to worsen the consequences Rudimental probabilistic assessment are sometimes possible Domino effects between systems are, up to a certain extent, treatable More defined focus on specific aspects to be treated with HAZOP and FMECA further analysis

26. …..Is that all?