FAILURE AND HAZARD ANALYSIS OF THE NPDGAMMA LH2 TARGET SYSTEM Revision: 0.00 Edited by: Seppo Penttila, November 10, 2010 1. General The RSS 8305.0 Installation, Commissioning, and Operation of the NPDGamma Experiment at the FNPB deals with general hazards of the NPDGamma experiment at the BL13B. Below we focus to failure and hazard analysis of the liquid hydrogen target system. Hazards of the target have been analyzed in different documents, some of them require updates, some of them are not any more valid at FNPB. Therefore, the scope of this document is to collect our hazard analysis under one document. 1. LOV; a loss of vacuum The isolation vacuum failure (LOV=loss of vacuum) caused by a rupture of the isolation vacuum chamber, a leaking vacuum joint or seal, a rupture of a beam window, a failure of one of the three feedthroughs or an operator error. In these failure modes air gets into the isolation vacuum. Another possibility is to have a leak in the inner hydrogen boundary and hydrogen gas is leaking into isolation vacuum. In both cases the leaking gas will cause high heat flow to the LH2 and thus a fast boil off of the hydrogen liquid which then creates a possible over pressure in the hydrogen vessel. A high pressure in the hydrogen vessel followed by a rupture of the hydrogen vessel or connected piping and then a flow of the liquid hydrogen into the isolation vacuum, see Hazard case 2. During operation a small amount of air and hydrogen can leak unnoticed into isolation vacuum and then condense on the cold surfaces. During a warm up of the target, the hydrogen and air will vaporize and fill the vacuum volume. If the ratio is correct 4% hydrogen in air or more, there is a change, if an ignition exists, a deflagration. A lot of effort has gone to the proper structural design and analysis of the isolation vacuum chamber, proper sizing of the connecting piping and relief devices, and thorough reviews of designs and calculations. The design has been done for the worst possible LOV scenario. Even a deflagration is considered in the design by forming a one-timeevent 150psig boundary. The chamber, LH2 vessel, and interconnected piping has been built according to approved QA plan. Prior to a cooldown a thorough leak check of the LH2 vessel and the isolation vacuum will be performed and documented and the
functionality of the relief/check valves are performed. Operations are performed under the Procedures. Components connected to the chamber are tested or certified according to approved QA plan (e.g., use certified materials, use certified welders, inspect welds, pressure test final assembly, etc.). A small leak to the vacuum can be developed through a vacuum joint but any large flow of gas into isolation vacuum is not probable. The status of vacuum is monitored by a sensitive pressure gauge and by RGA. An operator error is minimized by using approved procedures, target experts are performing critical operations, target shift specialist are OJTed and they are present in the experiment 24/7.There is no single target operation that could produce a big air flow into the isolation vacuum. 2. Rupture of the target vessel The elevated pressure in the hydrogen vessel can cause a rupture of the vessel and consequently liquid helium flow into the isolation vacuum chamber, see Hazard case 1). A high pressure in the hydrogen vessel followed by a rupture of the vessel or connected piping and then a flow of the liquid hydrogen into the isolation vacuum and very fast boil off of LH2 in the vacuum space and a consequent high pressure in isolation vacuum space, see Hazard case 1). Proper structural design and analysis of the hydrogen vessel, the LH2 vessel is a code approved pressure vessel, proper sizing of the connecting piping and relief devices, the thorough FEA and testing of neutron beam windows in the vacuum chamber, a thorough reviews of design and calculations. The vessel and piping built according to Code and approved QA plan. Before any cooldown a thorough leak check will be performed and documented. Components connected to the isolation vacuum jacket are tested or certified according to approved QA plan (e.g., use certified materials, use certified welders, inspect welds, pressure test final assembly, etc. An operator error is minimized by use of approved procedures, target experts are performing critical operations, target shift specialists are OJTed and they are present in the experiment 24/7. If a rapid boil off takes place, then the hydrogen vessel and piping are protected by a large capacity relief valve and a parallel rupture disk. 3. Leak in the hydrogen fill/vent line A leak in the hydrogen fill/vent line. If the leak is inside the isolation vacuum, see Hazard case 1). The leak can also be in a short section inside the relief cabinet. In this case, depending on the pressure in the fill/vent line, air can leak into the fill/vent line or hydrogen gas can leak out from the line into the relief cabinet. If air leaks into the fill/vent line, it will flow down the fill/vent line and condense on the first cold enough surface, if the leak is large, the condensing air can even block the fill/vent 2
line and isolate the LH2 from the relief devices, see Hazard case 10). If hydrogen leaks into the relief cabinet, the vent line conducts the gas outside the Target Building. If the leak into the cabinet is very large, it can form a 4% mixture with air in the cabinet and followed by a deflagration. Proper structural design, analysis, reviews of the interconnected lines. The piping built according to Code and approved QA plan. The 150-psig one-time-event boundary. Certified components and welds. Before any cooldown a thorough leak check performed. Hydrogen sensors are in the cave and in the cabinets. Target shift specialist present 24/7 to observe any abnormal target behavior. The possibility of a leak is reduced by the use of welded joints. Most of the demountable joints and weldments are surrounded by helium channels or they are inside the two cabinets. The target parameters for the normal run established, if parameters are out of the selected range, the DAQ will alert. For the blockage see Hazard case 10). 4. Overpressure in the hydrogen fill/vent line The hydrogen gas pressure in the fill/vent line rises. The high pressure causes a failure of the line or components. The hydrogen line possesses a relief valve and rupture disk in parallel. The diameter of the line is sized to accommodate pressure rises experienced in serious accident scenarios as well as normal venting. The thickness of all line components is sufficient to prevent deformation of the line outside the elastic regime. The bellows are protected from bellows squirm by external mechanical guards. The demountable Conflat joint at the end of the line has been successfully tested at an internal pressure of 200 psid. 5. A small leak in the vacuum/vent line Air leaks into the main vacuum system, thereby breaching triple containment and introducing oxygen in the air closer to the hydrogen. Also frozen air in the vacuum system can expand upon warm up and generate high transient pressures, see Hazard case 1). During a warm up of the target, the condensed air will vaporize and fill the vacuum volume and can produce a pressure transient or high pressure in vacuum. Warm up according to Procedure, MV203 and RD201 forms a low-pressure relief path. RD201 and RD202 protect the vacuum for higher pressures. The vacuum system uses welded components and standardized commercial flanges wherever possible. The possibility of a leak is reduced by the use of welded joints. Helium leak testing will be required in the operating procedure to be performed before introduction of hydrogen gas into the fill/vent line. Pressure gauges on the main vacuum 3
chamber are present which would indicate any large leak. Helium gas is introduced outside all the non-welded joints inside the experimental cave to catch any such leaks immediately with RGA. A sensitive pressure gauge PT204 monitors pressure in the vacuum. 6. Overpressure in the isolation vacuum If pressure in the isolation vacuum increases, the cause can be an air or a hydrogen leak. Over pressure can burst the vacuum chamber beam windows, which have the lowest MAWP in the vacuum system. The isolation vacuum possesses two low-pressure, 7 psid, rupture disks in parallel, RD201 and RD202. The diameter of the vacuum line between target and vent exit line is sized to accommodate pressure rises in the vacuum chamber experienced in the worst accident scenarios. The calculated and tested maximum internal pressure of a single beam window is 46 psia. The 6 bellow in the vacuum/vent line is partially protected from bellow squirm by external mechanical guards. The both ends of the vacuum/fill line are anchored, one end is connected to the cryostat, which is bolted to floor and the other end of the line is welded to the relief cabinet to hold stresses from different events. 7. Damage of the vacuum/vent line and/or fill/vent line from thermal contraction During an accidental rapid venting of the hydrogen gas through the vacuum/vent line, the cold gas cools down the vacuum/vent line, which consequently becomes shorter, the contraction can be up to 1.2. This will produce large axial forces that can damage or rupture the line or break the vacuum chamber/line CF joint. The vacuum/vent line possesses 6 diameter bellow, which is operated so that it accommodates any axial stresses caused by vacuum or thermal contraction. The fill/vent line has several bellows in both the horizontal and vertical sections, which suffice to relieve the stress while remaining within the operating envelope of the bellows well over their expected lifetime for expansions and contractions. 8. Loss of one or both cryo-refrigerators In the case of a failure of one or both target refrigerators without vacuum failure, the LH 2 target starts slowly warm up causing the hydrogen to boil off and a slow pressure increase in the 1.5-inch fill/vent line up to 35 psia, which is the opening pressure of RV104, the gas will be conducted out outside the Target Building by Vent stack. 4
A possible high pressure in the LH2 target vessel and in the fill/vent line and consequently a rupture of the LH2 vessel or fill/vent line. Proper and well reviewed designed of lines and the relief system. RV104 (20 psid) and RD101 ( 30psid) are parallel. Target shift specialist present 24/7 in the experiment. During the target warm up the target shift specialist can get advice from the target expert to open MV128 and thus have even lower pressure, 5 psid, relief path through CV104 CV105. 9. Damage of the fill/vent line from earthquake A seismic event damages or ruptures the 1 st or/and 2 nd hydrogen boundary. LOV, see Hazard case 1), rupture of LH2 vessel, see Hazard case 2). Complete destruction of the target and the hydrogen flows into the cave. Consequences depend on the mass flow rate of hydrogen into the cave. These situations have been analyzed. The worst possible event is a deflagration of hydrogen in the cave. This is analyzed not to break the cave shielding structure. If the cave is destroyed by earthquake, the escaped hydrogen will flow to the ceiling of the Target Building and a possible deflagration. The target system has been designed, built, analyzed, and reviewed for DOE-STD-1020, PC-2 seismic requirements.the fill/vent line has several alignment spiders which limit the motion of the line transverse to the axis of the vacuum/vent line. The fill/vent line is mechanically connected at the 90-degree bend location to the cold head of the precooling cryo-refrigerator. The internal components of the relief system that the fill/vent line connects to are tack-welded and mechanically limited where needed to limit relative motions of massive objects inside. Between the relief chamber and the fill/vent line is a short piece of a flex line. The LH2 vessel s motion is constrained by G-10 spacers and mechanical connections to the cryostat refrigerators. The vacuum/vent line has the both ends coupled down to the cryostat or to the relief chamber and also the mid section of the line is clamped down to the beam stop. The cryostat is bolted to a stand that is bolted to floor. The relief cabinet platform meets seismic requirement. 10. Air blockage in the fill line If in the 1 st hydrogen boundary has a leak in the relief cabinet, and the leak is large enough, there is a possibility that leaked air condenses on cold surface of the fill/vent line and blocks the line completely isolating the liquid hydrogen from the relief system, see Hazard case 5). The leakage has to be very large and or stay on for a long time since the line has inner diameter of 1.35. 5
When the target is warmed up the blockage prevents gas to flow out from the fill/vent line and causing a pressure build up in the vessel. If the pressure further increases either the blockage will open or there is a rupture of the LH2 vessel, see Hazard case 2). The formation of the blockage in the fill/vent line is made unlikely by thorough leak checking before each cool down, the liquid nitrogen cold trap upstream of the fill/vent line cleans the incoming gas, and the target running parameters are followed all the time and the build up of a blockage will change the mode of the target which the target shift specialist would observe. Should the fill/vent line become blocked despite these precautions an effort can be done to open/remove the blockage. An operating procedure has been written to describe options to open the blockage. 11. Deceptive RGA readings The RGA signal is contaminated by false background signals. Consequence Target shift specialist will be confused and can make a wrong conclusion. The vacuum system is designed to high vacuum standards without major sources of out gassing or virtual leaks. Vacuum system is kept clean and has been most of the time under vacuum. The target shift specialist is not allowed to change the target parameters without consulting first with the target expert. When there is a RGA warning; the helium partial pressure in the isolation vacuum has increased over the set point, the target shift specialist will have a warning and can investigate further the cause of the warning. 12. Production of long-lived radioactive nuclei Production of long-lived radioactive nuclei such as tritons. The intense neutron beam at FNPB and scattered neutrons from the beam interact with materials in the cryostat mainly aluminum and air producing radioactive nuclei. Every effort has been done to minimize the production of any radioactive nuclei during the lifetime of the experiment. Activated solid materials can be controlled but radioactive nuclei in gases are more difficult. Our special concern is the tritium production. There are five tritium production sources in the experiment: (1) neutron capture on deuterium impurities in the liquid hydrogen, (2) neutron capture in 3 He impurities in the hydrogen, (3) neutron capture in the 4 He gas flowing between the double beam windows (the main source), and (4) neutron capture in 3 He in air. The production rate of tritium in these processes is discussed in NPDGammaTritiumProduction.pdf. A dose to the personnel from the activated materials and released tritium. Any components or piece of material removed from the experimental cave must be surveyed and then stored accordingly. The helium gas flow from the helium channels has to be connected to the hot gas exhaust line. 6
13. Loss of electrical power Loss of electrical power. The target will loose cooling, the pneumatic valves will close, pumps will stop, and the instrumentation stops working. The hydrogen relief system is passive, it does not need electricity. An UPS will power for an hour or so a few pressure and temperature sensors so that the target shift specialist can monitor the target system behavior. Target Signal Processing System has its own UPS and some of the target parameters can be followed, like PT106, hydrogen pressure. 14. Fire at the end of the vent stack Hydrogen fire at the end of vent stack. Hydrogen flame emits mainly UV radiation and is therefore not visible to the naked eye. The vast majority of normal flames are from burning of organic compounds. The constant-pressure adiabatic flame temperature of such flames in air is in a relatively narrow range around 1950 C. For hydrogen the corresponding temperature is 2210 C. The flame at the end of the vent stack can ignite other fires. The fire will burn out when the hydrogen is consumed. If the fire is observed, pull the fire alarm, inform Instrument Hall Coordinators. If possible stop the hydrogen relief by cooling the target to lower the pressure in the vessel. 15. Frozen hydrogen in the vessel or lines The melting temperature of the solid hydrogen is 14 K. Our refrigerators maybe have a capacity to reach this temperature and thus solidify some part of the target. In the worst possible case the solid hydrogen will block the fill/vent line. Since the main cooling coupling is to the vessel, it is very difficult to freeze hydrogen in the start of the fill/vent line next to the vessel. If hydrogen is frozen in the vessel, it can be melted by using a heater or switching off the cryo-refrigerator. 16. RV104 opens partially or does not reseal Relief valve RV104 opens partially or does not reseal after opening. 7
If RV104 does not open properly and the pressure in the fill/vent line increases, the rupture disk RD101 will burst at 30 psid to protect the vessel. If RV104 after opening does not reseal properly, there will be a flow of gas back into the fill/vent line from the vent stack buffer volume when the pressure in the fill/vent line is less than pressure in the buffer volume. The vent stack buffer volume is filled with helium. After RV104 has opened and closed in the buffer volume has mainly hydrogen gas with little left helium. If there is a leak back into the fill/vent line, the leaking gas is mainly hydrogen. PT107 is monitoring the pressure in the buffer volume and would indicate decreasing pressure and a possibility of a leak into the fill/vent line or into the vent stack. As a preparation for each cool down, the RV104 tightness is checked. taken for various alert and alarm system failures? 8
9