MICE Hazard Overview and
Analysis
Elwyn Baynham
Tom Bradshaw
Yury Ivanyushenkov
MICE Hazard Overview
Scope
Overview of Hazards for MICE
Hydrogen system
•
Summarise proposals for design and
implementation to minimise risk
•
Address major fault scenarios and describe
system response
•
Describe qualitative studies to identify the
potential HAZard and OPerating problems in the
system – HAZOP
Brief overview of the other aspects of MICE safety
Conclusions
2
MICE Hazard Overview
The MICE safety case (hazard assessment)
should:
Identify the most credible accidents
Analyse probability and consequence
Define the steps needed to reduce the risks to
be as low as reasonably achievable.
3
MICE Layout
4
MICE Hazards Overview
High magnetic field =>
High mechanical forces
Magnetic stray fields
Quench voltage
Helium / overpressure
Radiation
Fire
Explosion
Overpressure
Material brittleness
Skin burn
Solid absorber
toxic Be Li
Radiation (electrons, X-rays)
HV=> Sparks
Beryllium
HV
TOF
Beam
Tracker
Optical fibres
HV
Photo detectors
and front-end
electronics
LH2
RF
LH2
RF
LH2
Tracker
Particle
detectors
Optical fibres
Photo detectors
and front-end
electronics
5
Hydrogen Hazards
The potential hazards of liquid hydrogen stem mainly from
three important properties:
1. Its wide range of flammable limits and detonation
limits after vaporising to gas
Flammability in air 4 – 75%
Detonation in air 18 – 58%
2. Its very large liquid to gas expansion ratio
1:800 20K-300K leading to risk of overpressure
3. Its extremely low temperature
Intrinsic risks - metal brittleness – skin burn
Consequent risks – cold surfaces can cryopump oxygen as a
storage mechanism
6
Hydrogen hazards (2)
A fire can result from two scenarios
Hydrogen is released,
- mixes with an oxidizer,
- forms a combustible mixture,
The hydrogen system is contaminated with an oxidizer
(as a result of improper purging and/or in leakage of an
oxidizer, such as air),
- the hydrogen and the oxidizer form a combustible mixture;
The combustible mixture contacts an ignition source;
Ignition occurs.
So this is a two way process
Stop hydrogen releases
Stop oxidiser ingress
7
Hydrogen – Safety Realisation
How do we propose to achieve the high standard of
safety and low risk required:
Baseline Principles
• Implement everywhere a double barrier between hydrogen
and air(oxygen)
•Double vacuum or vacuum + inert gas such as argon
•Avoid ignition sources in direct contact with hydrogen
8
Hydrogen - Safety Realisation
Design
Modular systems
Separate hydrogen system from magnet / rf / detectors
Absorber to allow maximum stage testing - spare
Hydrogen absorber
Eliminate cold surfaces where oxygen can be cryopumped
Design with adequate safety margins for overpressure
Linked to R&D programme to verify and qualify designs of
windows and seals
Hydrogen system:
Closed system concept keeps hydrogen venting to a minimum
Hydrogen is stored as a solid compound in a hydride bed
Passive pressure relief system to extract H2 to a buffer tank
Hydrogen zone is localised;
Ignition sources are kept outside hydrogen zone.
9
Hydrogen – Safety Realisation
Implementation
Manufacture
Component manufacture to strict QA and design code.
Certification of all materials and traceability of process.
Test
Tests of components , sub-assemblies and assemblies off-line
Tests at integration of the absorber
Tests of complete system
Qualitative studies
To identify worst case scenarios and feedback to design process.
Failure mode analysis
HAZOP Analysis
10
Hydrogen System – Failure Modes
Failure Mode Scenarios/Fault Conditions
Major Failures
Absorber Vacuum Failure
Hydrogen Window failure
Low Level Faults
Low level Hydrogen leak
Low level Vacuum leak
Support system failures
Power Failure
Refrigerator Failure
Hydride Bed chiller system failure
Interactive system failures
Magnet Quench
11
Loss of Absorber Vacuum
VP
P
He Purge system
P
P
18 K He
to Compressor
via Radiation shield
14 K He
from Cold box
X2
Vent outside
flame arrester
Metal Hydride storage
unit
(20m3 capacity)
Cold
Chiller/Heater
Unit
1 bar
Fill valve
P
P
X2
1.6 bar
P
2.0 bar
Purge valve
Liquid level gauge
H2 Detector
Vent outside
flame arrester
P
Vacuum
Ventilation
system
H2 Detector
Internal Window
H2 Gas bottle
LH2 Absorber
H2 Detector
Safety window
P
Purge valve
LHe Heat
exchanger
2.0 bar
Vacuum vessel
Vent outside
flame arrester
Evacuated vent
buffer tank
1.6 bar
1.4 bar
VP
VP
12
Inner Window Rupture
VP
P
He Purge system
P
P
18 K He
to Compressor
via Radiation shield
14 K He
from Cold box
X2
Vent outside
flame arrester
Metal Hydride storage
unit
(20m3 capacity)
Cold
Chiller/Heater
Unit
1 bar
Fill valve
P
P
X2
1.6 bar
P
2.0 bar
Purge valve
Liquid level gauge
H2 Detector
Vent outside
flame arrester
P
Vacuum
Ventilation
system
H2 Detector
Internal Window
H2 Gas bottle
LH2 Absorber
H2 Detector
Safety window
P
Purge valve
LHe Heat
exchanger
2.0 bar
Vacuum vessel
Vent outside
flame arrester
Evacuated vent
buffer tank
1.6 bar
1.4 bar
VP
VP
13
Cross section of Absorber
a) Windows are
mounted off RT
interface – see
thermal model
later
b) Space for change
in pipe dimension
close to magnet
c) Large “bucket” at
base to contain
any rupture
14
Inner window Rupture
Initial Analysis
Vacuum window - local cooling by hydrogen spillage does not
cause excessive stresses
Magnet Bore – hydrogen spillage does not cause excessive stress
End Plate Shell and seals – significant overall thermal deflections
but within the elastic range – deflections at the seal plate ~
10micron – effects can be reduced by incorporating a copper
spillage bucket
Extraction pipework – pipe work can be sized to keep pressure
drops ~ 0.3 bar – overall pressure should not exceed vacuum
window test pressure
Conclusions
The rupture of a hydrogen window will not initiate a chain of events
which will release hydrogen into MICE
15
Hydrogen System – Failure Modes
Low level Faults
Hydrogen Leak
Vacuum leak
Detected by sensors – interlocks initiate shut down process
Stage 1 return of H2 to hydride bed – stage 2 venting
Support system failures
Power Failure
Refrigerator Failure
Normally handled by return of H2 to hydride bed
Or ultimately safe venting
Hydride Bed chiller to be on secure supply
Hydride Bed chiller system failure
Will depend on details of Hydride design – ultimately safe venting
Interactive system failures
Magnet Quench
Minor interactive effects on the absorber system
16
HAZOP Process
HAZard and OPerability Study
Qualitative study to identify the potential hazards and operating
problems of a process
Assumption that a hazard or operating problem can only occur
when there is a deviation from the design or operating
intention :eg no flow when there should be flow
Process examined
Line by line
Vessel by vessel
Section by section
Aim to identify safety and operability problems
17
Inputs to HAZOP Study
Process and Instrumentation Diagrams
Normal operating conditions
purge
fill
commissioning
disassembly
Parameters
pressure,temperature,flow,level,services...
Guide words
more,less,reverse,etc...
18
HAZOP Process (2)
Node definition
Process and
Instrumentation
diagram
HAZOP
process
Normal mode of
working
Recommendations
Implementation
19
Preliminary HAZOP Node Definition
VP
P
He Purge system
Metal Hydride storage
unit
(20m3 capacity)
P
P
14 K He
from Cold box
Node 5
18 K He
to Compressor
via Radiation
shield
X2
Vent outside
flame arrester
Node 1
1 bar
Chiller/Heater
Unit
Fill valve
P
P
X2
1.6 bar
P
2.0 bar
Purge valve
Liquid level gauge
H2 Detector
Vent outside
flame arrester
P
Vacuum
LH2 Absorber
Ventilation
system
H2 Detector
Internal Window
Node 2
H2 Detector
Safety window
P
Purge valve
LHe Heat
exchanger
Node 3
H2 Gas bottle
Vent outside
flame arrester
Evacuated vent
buffer tank
2.0 bar
Vacuum vessel
1.6 bar
1.4 bar
Node 4
VP
VP
P
Pressure
gauge
P
Pressure
regulator
Valve
Pressure
relief valve
Non-return
valve
Bursting disk
VP
Vacuum pump
20
Preliminary HAZOP: Node 3
Node 3: Hydrogen absorber vacuum jacket with safety windows
No
Parameter
Guide word
Cause
Consequence
Safeguards
Recommendations
1
Pressure
Higher
1. Hydrogen window broken
2. Vacuum pump failure
1. Hydrogen bursts
into vacuum jacket
2. Pressure slowly
increases
Pressure relief valve to dump
hydrogen into a buffer tank and
then to vent it outside.
Monitor pressure and have spare
pump.
Implement a buffer tank.
Hydrogen gets in due to
window is broken or
seal is leaking
An explosive
mixture can be
formed if there is an
air leak in as well.
Active hydrogen sensor detects
hydrogen and trigger s an alarm.
Implement an active hydrogen
detector.
2
Hydrogen
concentration
Higher
Implement vacuum gauge with
alarm and have spare pump
ready.
21
Preliminary HAZOP: Node 5
Node 5: Hydrogen enclosure
No
Parameter
Guide word
Cause
Consequence
Safeguards
Recommendations
1
Hydrogen
concentration
Higher
1. Hydrogen leaks out absorber
module
1-3. Explosive
oxygen-hydrogen
mixture can be
formed
Ventilation system to quickly vent
hydrogen out.
Implement ventilation system
equipped with hydrogen
detector.
2. Hydrogen leaks out hydrogen
pipes
3. Hydrogen leaks out storage
unit.
Hydrogen detector to trigger an
alarm and to start a high rate
mode for the ventilation system.
22
Preliminary HAZOP: Recommendations
•
Metal hydride storage unit
Implement:
- active pressure gauge;
- pressure regulator;
- pressure relief valve .
•
Hydrogen absorber internal vessel with hydrogen windows
Implement:
- active pressure gauge;
- temperature sensor;
- active liquid level meter (additional).
•
Hydrogen absorber vacuum jacket with safety windows
Implement: - active hydrogen detector.
•
Buffer tank
Implement: - active pressure gauge;
- active oxygen sensor.
•
Hydrogen enclosure
Implement:
- ventilation system equipped with
a hydrogen detector.
These are the basis for a more detailed HAZOP in the engineering phase based
on final P&ID
23
MICE Hazards Radiation
Radiation safety is achieved by:
- shielding the beam line;
- no access to the experimental hall when RF power is on;
- local shielding of some cryogenics equipment such as control electronics,
cold boxes and valve boxes;
- local shielding of detectors front-end electronics
Radiation
Beam
Radiation
Tracker
LH2
RF
LH2
RF
LH2
Tracker
Particle
detectors
24
MICE Hazards Magnetic Field
Magnetic field safety is achieved by:
- passive magnetic shielding the MICE
(brings magnetic field down to below 5 gauss-level in the public
areas outside the experimental hall);
- restricted access to the experimental hall.
High mechanical forces on the MICE components are:
- analysed and understood ;
- taken into the account in the MICE design.
High magnetic field =>
High mechanical forces
Stray magnetic field
Beam
Tracker
LH2
RF
LH2
RF
LH2
Tracker
Particle
detectors
25
MICE Layout
Option: All the hall is a MICE restricted area
Exit *
Main gate *
cold box
door
3.8 m
stay clear zone
cellar
door
services zone
5.6 m
High level exit *
* All
Concrete radiation shielding
doors are normally blocked when MICE is running
Steel magnetic shielding
Scale:
1m
26
Conclusions
Absorber
Meets the primary objectives
To separate hydrogen and oxygen
To avoid source of ignition
Defined a route to qualification, test and implementation
Hydrogen System
Modularity
Closed system
Essentially passive
Basic operating modes defined
Major fault conditions analysed
H2 zones defined and localised
Formal analysis of system begun
Proposed system is a sound basis to move forward to the
engineering design
27
Preliminary HAZOP: Nodes and parameters
Node
Intent
Parameters
1. Metal hydride storage unit.
To keep hydrogen gas in the tank-absorber
closed system.
Pressure.
2. Hydrogen absorber internal
vessel with hydrogen window.
To keep hydrogen liquid inside hydrogen
Temperature;
Pressure.
absorber module.
3. Hydrogen absorber vacuum
jacket with safety window.
To insulate the hydrogen vessel thermally and to
provide an additional oxygen barrier.
4. Buffer tank.
To quickly relieve pressure in the absorber module
in case of window burst.
5. Hydrogen enclosure.
To localize and vent hydrogen in case of
hydrogen leak.
Pressure;
Hydrogen
concentration.
Pressure
Hydrogen
concentration.
28
Preliminary HAZOP: Node 1
Node 1: Metal hydride storage unit
No
Parameter
Guide word
Cause
1
Pressure
Higher
1. Fill valve is accidentally open
or leaking.
2. Tank is overheated.
Consequence
1-2. Absorber windows can
break.
Safeguards
Recommendations
Pressure regulator to reduce
the pressure on the line to
the absorber.
Pressure relief valve to vent
outside.
Active pressure gauge to
trigger an alarm.
Implement a pressure regulator
on the line to the absorber.
Implement a pressure relief
valve.
Implement an active pressure
gauge.
29
Preliminary HAZOP: Node 2
Node 2: Hydrogen absorber internal vessel with hydrogen windows
No
Parameter
Guide word
Cause
Consequence
Safeguards
Recommendations
1
Temperature
Lower
Too much cooling power from
the He cooling system.
1. Pressure in the
hydrogen system drops.
Pressure gauge to trigger an
alarm.
Temperature sensor to trigger
an alarm
Additional: Liquid
hydrogen level meter to
trigger an alarm.
Implement both the active
pressure gauge and the
temperature sensor.
Additional:
Implement an active liquid level
meter.
2
Temperature
Higher
1. Not enough cooling power
from the He cooling system.
2. Power cut.
1-2. Liquid hydrogen
evaporates and LH2 level
goes down.
1-2. Hydrogen pressure
rises.
Temperature sensor to trigger
an alarm
Additional: Liquid
hydrogen level meter to
trigger an alarm.
Pressure gauge to trigger an
alarm.
Implement both the active
pressure gauge and the
temperature sensor.
Additional : Implement an
active liquid level meter.
3
Pressure
Lower
1. Window is leaking or
broken.
2. Pipe is leaking.
3. Hydrogen storage unit is
leaking.
4. Absorber is over cooled.
1. Hydrogen leaks into
vacuum vessel.
2-3. Hydrogen is leaking
out.
4. Pressure in the system
drops and air can leak in
the system in case if the
system seal is broken.
Hydrogen detector to trigger
an alarm.
Hydrogen ventilation system
collects and vents hydrogen
out.
Temperature sensor to trigger
an alarm.
Implement an active hydrogen
detector.
Implement hydrogen collection
and ventilation system.
Implement a temperature sensor.
4
Pressure
Higher
Temperature is increased.
Pressure relief valve to dump
hydrogen into a buffer tank
Implement a pressure relief valve
and a buffer tank.
Windows can break.
30
Preliminary HAZOP: Node 4
Node 4: Buffer tank
No
Parameter
Guide word
Cause
Consequence
Safeguards
Recommendations
1
Pressure
Higher
1. Venting path is blocked.
Absorber vacuum jacket
windows can break.
Active pressure gauge triggers
an alarm.
Implement an active pressure
gauge.
Buffer tank can’t be used for
dumping hydrogen in case of
accident with absorber.
Oxygen sensor triggers an
alarm.
Implement an active oxygen
sensor.
Use a spare pump.
Keep a spare pump.
2. Tank is leaking.
3. Vacuum pump failure
31
MICE Layout
Option: MICE restricted area is inside a roofed blockhouse
Exit
cold box
Door
Path way >= 0.8 m
Sliding
lead
door
3.8 m
Main gate
Sliding lead door
stay clear zone
cellar
door
Bridge
5.6 m
services zone
Door
High level exit
Concrete radiation shielding
Steel magnetic shielding
Scale:
1m
32
MICE Layout
33