1. A presentation at the MICE Video Conference on Wednesday the 5 th of May 2004 Response to the Safety review comments by Wing Lau -- Oxford

2. Hydrogen Gas Handling & Venting system Remove buffer tank and vent the hydrogen out directly - implemented Remove relief valves in the hydrogen vent lines and have burst disks only – retained Completely separate vent system for the absorber and vacuum spaces - implemented Detail specification of the Relief valve – work in progress Is hydrogen detector appropriate in the vacuum line – still under consideration Hydrogen detectors are needed in the ventilation system and in the personnel space around the experiment – will be implemented Examine the level to which piping should be Argon jacketed – will be addressed Replacing the flame arrestor with a vent pipe with an inert atmosphere - implemented Adopt Fermilab requirement vacuum system volume 52x H2 liquid volume – not implemented Safety Review Panel – Main Points – status review

3. R & D on the Metal Hydride system The use of hydride system requires active control. The panel suggested a scaled model test. It also asked the group to examine the safety issues associated with this system R&D proposal defined and submitted Safety Review Panel – Main Points

4. Practicality of using intrinsically safe electrical equipment – response already drafted Pipe joints – will be as requested Detection of Hydrogen in Personnel areas – agreed Attention to Interlocks, alarms and control system - ongoing. Continuation of HAZOP assessment – agreed Response to Absorber system leak scenario - ongoing Potential of liquid hydrogen sloshing in warmer part of the feed pipe – to be addressed in level control. Leak between the helium and hydrogen compartment in Absorber unit - ongoing Safety Review panel – Additional Points

5. Here is the final version of the report – printed in Powerpoint format for the purpose of this presentation, but will be in MS WORD format in the actual report.

6. 3 main comments made by the Review Panel The issueThe Safety Review panel’s commentsOur Reply 1Hydrogen Gas Handling & Venting system Can we do without the buffer tank and just vent the hydrogen out directly? This is now implemented. See Appendix 1. Can we get rid of the relief valves in the hydrogen vent line and have burst disk only? The issue of having relief valves as well as burst discs is that the relief valves will close again after activation and prevent back streaming into cold spaces. For this reason, we do not recommend getting rid of the relief valves. See Appendix 2 for details Completely separate vent system for the absorber and vacuum spaces There is no reason why we can not have separate vent lines for the Absorber and Vacuum space. In particular if the bilge space at the base of the Absorber is implemented then the hydrogen release in the event of a catastrophic event will be more controlled. See Appendix 2 Detail specification of the Relief valve Is hydrogen detector appropriate in the vacuum line? Work is in progress to have detail specification of the Relief valve. The issue of how effective the hydrogen detectors are and where they are placed needs to be considered further and we are aware of the problem. Work is in progress to address this issue. The panel suggested that hydrogen detectors are needed in the ventilation system and in the personnel space around the experiment We are aware of this need. Hydrogen detectors will be placed in the ventilation system and around the equipment. It is just that they were not shown on the diagram. Refer to Appendix 2 for diagram.

7. The issueThe Safety Review panel’s commentsOur Reply Examine the level to which piping should be Argon jacketed. Argon jacket will be placed around any portion of the absorber vacuum space that may come into direct contact with the air. The pipes that connect from the absorber vacuum vessel to the relief devices or the vacuum pump should also be argon jacketed. The vacuum pump should pump from the absorber vacuum to a space with inert gas (argon or nitrogen) so that no back streaming of oxygen occurs back through the vacuum pump. The exit pipe from the pump should have an inert gas between the pump and a check valve in the line at eventually leads to air. As long as there is a relief valve or a burst disc between the absorber vacuum and the buffer vacuum, one does not have to argon jacket the buffer vacuum. If there is no relief device between the buffer vacuum and the absorber vacuum the buffer vacuum has to be argon jacketed. Piping outside the ventilation hood, i.e. on the lines between the hood and the experiment will be argon jacketed Replacing the flame arrestor with a vent pipe with an inert atmosphere This will be implemented in our design Possibility of adapting the Fermilab requirement concerning the vacuum system volume relative to the liquid volume We have looked at the adapting the Fermilab requirement and concluded that this will not apply to the RAL requirement. Please also see additional comments in Appendix 2 below 2R & D of the Metal Hydride system The use of hydride system requires active control. The penal suggested an scaled model test. It also asked this group to examine the safety issues associated with this system. We have developed a plan for testing the hydride system. The plan involves the building of the hydrogen system for the first MICE Absorber cell. As part of this process we have been looking at how the system will be controlled which has led to some small changes in the instrumentation. We have received better information from the supplier on the behaviour of the hydride in the beds. A plan has been submitted for inclusion in the development programme for the coming financial year – see appendix 3.

8. 3Window development Continue development of the welded seal. Demonstrate performance of Indium seal is reliable and repeatable under thermal cycling conditions. What actions to take if pressure is detected in the inter-space between the double seal. Monitoring and interlock triggers to be more specific. The R&D programme on the welded Window option has already addressed this point. Thermal couples will be attached to the window to flange junction and on various locations at the window to see what temperature they can get to during welding. The selection of a bolted window will be conditioned to the satisfactory demonstration of the reliable and repeatable. If the leak rate is larger than 10 -2 torr /s, we stop the cold-He cooling and warm up immediately. If the H2 leak is smaller than 10 -2 torr /s, we continue the monitoring, and repair the seal at next chance. This means that we can pump the H2 gas at the vacuum better than 10 -4 torr using 100 litre/s pump. The issueThe Safety Review panel’s commentsOur Reply

9. 11 further safety issues recommendations by the Review panel The issueThe Safety Review panel’s commentsOur Reply APracticality of using intrinsically safe electrical equipment This may not always be possible. We should consider turning off all the electric power without causing additional hazard whenever hydrogen gas is detected Most of the standard cryogenic probes are well within the “intrinsically safe” power limits set by the NEC. In addition, pressure valves and other equipment can be made “intrinsically safe” by straightforward modifications (usually, a sealed cover or container). We have to carefully consider what the thresholds for some minor action (increase or decrease the metal hydride bed) as opposed to major action (system purge, power shut-off). A similar set of questions are being reviewed for the “forced-flow” LH2 absorber test at FNAL. BEffect of stray magnetic field Hazard with stray magnetic field which causes tools and other equipment to become projectiles. Access into the experimental hall will be restricted and the area around the experimental hall will be fenced. The Operating Procedure will request that a scientist / engineer on shift before switching on power supply for magnet to go into the fenced area and to check and remove all the tools or subjects which might become projectile. CExposure of thin window Equipment shall not be operated with thin absorber / vacuum windows exposed The Operating Procedures will contain this requirement. DPipe jointsAll hydrogen gas system should be welded pipes, VCR, conflate and other flanged connections. No Swagelocks and plastic tubing allowed. All hydrogen Gas system are welded pipes, VCR, conflate and other flanged connections. Please see Table 1 below for pipe joint details. We have agreed to the Panel’s suggestion and will make sure that no Swagelocks and plastic tubing be applied to the hydrogen piping and pipe joints. EDetection of Hydrogen in Personnel areas Hydrogen Gas detector should be installed in the personnel areas around the experiment. Actions taken if hydrogen is detected should be thought out. Hydrogen detectors will be installed in various places inside the experimental hall.. In case hydrogen is detected these sensors will trigger the personnel evacuation alarm and a high rate mode of the ventilation system.

10. FAttention to Interlocks, alarms and control system. Interlocks, alarms and controls should be carefully thought out and specified. Response to alarm must not increase the hazard and unnecessarily affect the operation. The design of MICE safety system will take this recommendation into the account. GContinuation of HAZOP assessment HAZOP analysis to be continued and expanded to include a scenario of the absorber and vacuum window failing at the same time. The HAZOP presented at the Review was only preliminary. We need the operating modes to be more fully defined before we can go into the next stages of HAZOP. We will also do the FMECA type analysis for all the failure modes we can think of. HResponse to Absorber system leak scenario To plan in advance how we respond to leaks or problems of various level with the absorber system. A number of possible levels and scenarios of absorber leaks will be analysed and the appropriate response procedures will be specified in the MICE Operation Procedures. IPotential of liquid hydrogen sloshing in warmer part of the feed pipe. Consequence of liquid hydrogen sloshing as a result of it being pushed to the warm pipe needs further looking in. This is being addressed together with our design philosophy on the Level Control. See our Appendix 4 for our further comments JLeak between the helium and hydrogen compartment in Absorber unit An understanding of what happens if there is a leakage developed between the helium and the hydrogen compartment of the Absorber unit needed. This is an on-going activity. We need to assess this problem and how to deal with it and how to detect the leak etc. The helium system will be design for 18 bar, leak tested to a high standard after the necessary thermal cycling as specified in our leak test requirement table. KQC on window thickness QC standards for window thickness should be developed. This is now prepared and will be implemented once approved by the MICE Project manager.

11. Appendix 1 ----- Buffer Volumes Original Design One evacuated buffer volume for both absorber and vacuum space venting Separated from volumes by relief valves Assessment from the review Buffer volume is more effective if directly connected Vacuum space RAL safety does not require 12 x volume for vacuum space around absorber Current design gives ~ 8 –10 x volume Absorber volume Design includes buffer volume in the absorber line Window protection – response time Simplification of control

12. Appendix 2 --- Changes in MICE hydrogen system In summary the AFC Safety Review Panel recommendations are implemented: Original buffer vessel is removed Vent manifold is added. The manifold is filled with nitrogen. Venting lines are separated. Other changes: Buffer vessel is added in between absorber vessel and hydride bed. Ventilation system is removed. Most of the equipment is now sits under hydrogen extraction hood.

13. Appendix 2 -- Hydrogen system baseline layout PP VP Vacuum pump Bursting disk Pressure relief valve Valve Pressure regulator Pressure gauge 18 K He 14 K He from Cold box Liquid level gauge LH 2 Absorber Vacuum Vacuum vessel LHe Heat exchanger Internal Window Safety window Fill valve Metal Hydride storage unit (20m 3 capacity) Vent outside flame arrester He Purge system Non-return valve Vent outside flame arrester Purge valve 1.6 bar 2.0 bar H 2 Detector P P P Evacuated vent buffer tank VP P X 2 VP Version: 21/11/2003 H 2 Detector Ventilation system Vent outside flame arrester Purge valve H 2 Gas bottle P P Chiller/Heater Unit 1 bar P P 2.0 bar 1.6 bar1.4 bar

14. Zone 2: An area within which any flammable or explosive substance whether gas, vapour or volatile liquid, although processed or stored, is so well under conditions of control that the production (or release) of an explosive or ignitable concentration in sufficient quantity to constitute a hazard is only likely under abnormal conditions. PP VP Vacuum pump Bursting disk Pressure relief valve Valve Pressure regulator Pressure gauge 18 K He out 14 K He in Safety window Metal Hydride storage unit (20m 3 capacity) Non-return valve Purge valve 0.5 bar 0.9 bar H 2 Detector P P P VP1 VP2 Purge valve Chiller/H eater Unit 1 bar P P 0.5 bar 0.9 bar Helium supply Windows: Design pressure 1.6 bar abs Test pressure 2.0 bar abs Burst pressure 6.4 bar diff Hydrogen supply High level vent Buffer vessel Vent outside flame arrester Extract hood H 2 Detector P P Nitrogen supply P P P P 1 m 3 Hydrogen zone 2 Vent manifold P1 PV1 PV7 PV8 PV2 PV3 PV4 HV1 Fill valve Tbed Tchill HV2 HV3 P3 P2 PV6 High level vent Non return valve 0.1 bar Absorber window Appendix 2 -- Hydrogen system revised baseline layout Tabs

15. Appendix 3 --- R&D programme on metal hydride storage system Conceptual question: a small-scale rig vs. a full-scale prototype ? Decision: go for a full-scale system which later will be used in MICE. R&D goals: Establish the working parameters of a hydride bed in the regimes of storage, absorption and desorption of hydrogen. Absorption and desorption rates and their dependence on various parameters such as pressure, temperature etc. Purity of hydrogen and effects of impurities. Hydride bed heating/cooling power requirements. What set of instrumentation is required for the operation of the system? Safety aspects including what is the necessary set of safety relief valves, sensors and interlocks. Status Programme on hold pending funding approval for 2004/05

16. Level Control – what variations do we need to respond to: Level will vary due to temperature changes in the absorber Variation in density of LH2 could give ~ 1 – 2 liters volume change Such changes cannot be accommodated in small pipes 25mm dia = 2.2m/liter Such level changes will be relatively slow under normal operating conditions Energy to go from 14 – 18K ~ 50kJ for 20 liters Nominal heat load /absorber is few W Time 14 – 18K is ~ 5 – 10 hrs Most significant effect will be intermittent gas boil off due to changes in level – especially so for the horizontal pipe Appendix 4 -- Hydrogen level control – design considerations

17. Level Control – Where is best place to monitor/control level Absorber neck tube Insufficient volume Horizontal pipe Not practical Vertical pipe Need to thermalise the horizontal pipe Small volume available Main absorber volume Ullage - 2 liters is 10% Temperature of absorber body will be uniform Increase in volume will cause very little boil off Less active role for control system – hydride bed External buffer volume 1m^3 could absorb ~ 0.5 –1 litre before activating the relief system – assuming no return to the hydride bed - need further work Appendix 4 --- Hydrogen level control – design considerations