PRELIMINARY RISK ANALYSIS OF THE LHC CRYOGENIC SYSTEM

EUROPEAN ORGANIZATION FOR NUCLEAR RESEARCH European Laboratory for Particle Physics Large Hadron Collider Project LHC Project Report 324 PRELIMINARY RISK ANALYSIS OF THE LHC CRYOGENIC SYSTEM M. Chorowski, 1 Ph. Lebrun, 2 and G. Riddone 2 Abstract The Large Hadron Collider (LHC), presently under construction at CERN, will require a helium cryogenic system unprecedented in size and capacity, with more than 1600 superconducting magnets operating in superfluid helium and a total inventory of almost 100 tonnes of helium. The objective of the Preliminary Risk Analysis (PRA) is to identify all risks to personnel, equipment or environment resulting from failures that may accidentally occur within the cryogenic system of LHC in any phase of the machine operation, and that could not be eliminated by design. Assigning a gravity coefficient and one analyzing physical processes that will follow any of the recognised failure modes allows to single out worst case scenarios. Recommendations concerning lines of preventive and corrective defence, as well as for further detailed studies, are formulated. 1 Wroclaw University of Technology, 50-370 Wroclaw, Poland 2 CERN, LHC Division, 1211 Geneva, Switzerland Presented at the 1999 Cryogenic Engineering and International Cryogenic Materials Conference (CEC-ICMC'99), 12-16 July 1999, Montreal, Canada Administrative Secretariat LHC Division CERN CH - 1211 Geneva 23 Switzerland Geneva, 1 December 1999

PRELIMINARY RISK ANALYSIS OF THE LHC CRYOGENIC SYSTEM M. Chorowski, 1 Ph. Lebrun, 2 G. Riddone 2 1 Wroclaw University of Technology 50-370 Wroclaw, Poland 2 CERN, LHC Division 1211 Geneva, Switzerland ABSTRACT The Large Hadron Collider (LHC), presently under construction at CERN, will require a helium cryogenic system unprecedented in size and capacity, with more than 1600 superconducting magnets operating in superfluid helium and a total inventory of almost 100 tonnes of helium. The objective of the Preliminary Risk Analysis (PRA) is to identify all risks to personnel, equipment or environment resulting from failures that may accidentally occur within the cryogenic system of LHC in any phase of the machine operation, and that could not be eliminated by design. Assigning a gravity coefficient and one analyzing physical processes that will follow any of the recognised failure modes allows to single out worst case scenarios. Recommendations concerning lines of preventive and corrective defence, as well as for further detailed studies, are formulated. INTRODUCTION The safety philosophy of the LHC cryogenic system 1 rests on specific design features that differ from the options chosen for the cryogenic systems of other large superconducting accelerators, 2 and contribute to make the LHC cryogenic system inherently safe, with a limited number of possible risks and failures. These features are: the presence of a high-capacity, cold recovery header D (see Figures 1 and 2) which has a nominal working pressure of 1.3 bar (design pressure of 20 bar), a nominal working temperature of 20 K and a volume of about 60 m 3 per 3.3 km sector of the collider. Helium expelled from the magnet cold mass after a loss of insulation vacuum or magnet resistive transitions will discharge into header D. The header will also accommodate helium relieved from other cryogenic distribution line (QRL) headers 1

after degradation of insulation vacuum. The only header protected with safety valves venting directly to underground areas is header B because of its low design pressure. the absence of nitrogen (liquid or gaseous) in the tunnel, in any operating mode; liquid nitrogen is only used for helium pre-cooling at ground surface during cool-down. the absence of forced helium flow by mechanical devices (pumps) in cooling loops, resulting in limited discharge of fluid in case of header rupture. The cryogenic flow-scheme considered in the PRA is that described in reference 3. The LHC operation modes have been defined on the basis of a tentative yearly operation schedule 4 : machine warm, drifting, 75 K stand-by, cool-down, 1.9 K stand-by, system test or ramp down, normal operation, warm up. Additionally, operation modes that will not happen on a regular basis have also been considered: short intervention on a cold sector and limited quench of a maximum of 8 cells of the LHC machine. ELEMENTS OF PRELIMINARY RISK ANALYSIS The cryogenic system of LHC is treated as being composed of separate helium enclosures, called nodes in the following. Each node is characterised by the amount and thermodynamic parameters of the helium enclosed. For the enclosures that are vacuum insulated, the volume of the vacuum space is also relevant. This conceptual scheme based on nodes is shown in Figure 3. LHC Standard Cell (106.9 m) F Thermal shield B D C Z TCV943 QV920 TCV920 TCV915 TCV910 HX910 TCV947 Cryogenic Distribution Line Valve Box TCV943 QV923 QV927 TCV915 TCV910 HX910 TCV947 Jumper Connection K W KD2 LD1 CC' CY XB KD1 Beam screens KD2 LD2 LD1 CC' CY XB KD1 MQ C' Supports MB MB MB MQ MB MB MB MQ MB MB MB MQ MB MB MB MQ MB X Y M L E N Supports and thermal shield LHC magnet cryostat Legend: TCV= Temperature Control Valve HX= Heat Exchanger MQ= main Quadrupole QV= Quench Relief Valve hydraulic plug MB= main Dipole Figure 1. Flow-scheme of LHC elementary cooling loop 2

IP IP QUI medium-pressure storage tanks safety valve safety valve directly blowing to the tunnel QRL LHC cryomagnets F C B E QRL Return Module medium-pressure storage tanks Tunnel Caverns and shaft Surface DFB cold mass Warm recovery line Figure 2. Simplified flow-scheme of a LHC sector (3.3 km) showing safety valve locations. He 4 I Insulation vacuum air 1 He 6 Helium enclosure (>1 atm) Q 8 9 He 2 I 5 air Beam vacuum 7 He Sub-atmospheric helium air I 3 He/air Mass transfer Q Energy release 3 Failure mode I Instrumentation Figure 3. A generic view of the nodes in the LHC cryogenic system. 3

A cryogenic-related failure mode is defined as an accidental event (see Table 1) that may involve mass transfer of helium or air between helium enclosure, insulation or beam vacuum space and environment, a result of any constructional element break or malfunction (eg. broken bellows or leaking valve). A cryogenic failure mode may also be an unexpected energy release to helium in the magnet cold mass as a result of an extended resistive transition or an electrical arc. It is then possible to split a complex cryogenic system into a moderate number of nodes and perform a PRA even in the early stage of the system design. From their consequences, the LHC cryogenic related failures have been classified into three groups of increasing gravity, numbered from 1 to 3: Gravity 1: failure does not involve helium relief from the machine, Gravity 2: helium is blown out of the machine directly to the environment at ground surface, Gravity 3: helium is blown out of the machine to the confined area (e.g. tunnel). For each cryogenic related failure mode, an attempt to assign a probability of mishap has been made and with following descriptive scale of probability used 5 : A (Frequent): failure likely to occur repeatedly during the life-cycle of the system. B (Occasional): failure likely to occur several times in the life-cycle of the system. C (Occasional): failure likely to occur sometimes in the life-cycle of the system D (Remote): failure not likely to occur in the life-cycle, but nevertheless possible. E (Improbable): probability of failure occurrence cannot be distinguished from zero. The Preliminary Risk Analysis of the LHC cryogenic system has been performed in three steps: The first step (Identification) has consisted of listing all the machine nodes, cryogenics related failures and operation modes. Data have been collected through dedicated hearings, discussions and experience gathered at CERN. The objective of the second step (Combination) has been to list all potential failures for every node in any mode of the collider operation. The third step (Analysis) has been conducted in two parts. First, for each potential failure a YES/NO decision has been made, with the aim of retaining credible failures only. Then a descriptive analysis of the causes and consequences of each credible failure has been made and to each event a gravity level, as defined above, has been assigned. For the failures of gravity 2 and 3, the associated risks have been described and recommendations formulated. Finally worst case scenarios for the nodes located in the tunnel, caverns, shafts and surface have been identified and a descriptive probability for each of the mishaps estimated. The technique used for performing the PRA of the LHC cryogenic system is based on FEMECA (Failure Mode and Effect Criticality Analysis) 6. It fulfils the general requirements of the Preliminary Risk Analysis of a complex technical system, and in particular of a superconducting cryogenic system 7, 8. Table 1: Cryogenic failure modes No. Cryogenic failure No. Cryogenic failure 1 Air flow to insulation vacuum 6 Helium flow to beam vacuum 2 Helium flow to insulation vacuum 7 Pressurised helium flow to sub-atmospheric helium 3 Air flow to sub-atmospheric helium 8 Energy release to cold mass helium due to a sector quench 4 Helium flow to environment 9 Energy release to cold mass helium due to electrical arc 5 Air flow to beam vacuum 10 Oil flow to environment (in case of helium compressors only) 4

RESULTS OF THE PRELIMINARY RISK ANALYSIS The PRA of the cryogenic system for the whole LHC machine was performed 9, however this paper focuses on the detailed analysis concerning the nodes located in the tunnel; for the whole machine, we give only summary results. A typical cross-section of the LHC tunnel is shown in Figure 4. The accelerator will be composed of the LHC cryomagnets paralleled by the cryogenic distribution line. Both will be linked by jumper connections every 107 m. The nodes of LHC cryogenic system located in the tunnel, together with the amount of helium enclosed and vacuum insulation volume are listed in Table 2 and schematically represented in Figure 5. All potential failures at the cryogenic nodes located in the tunnel have been identified, which may happen in any phase of the collider operation. In this way, over five hundred (namely 540) of the failures have been defined. Subsequently, for each potential failure a YES/NO decision has been made to eliminate events that are not credible and 183 credible failures have been retained. Finally, some of the credible failures have been qualified as worst case scenarios on the criterion of mass of helium discharged and access to the tunnel. Twelve events of gravity level 3 have been identified. Table 3 lists these events, gives the amounts of helium that might be relieved to the tunnel together with approximate peak mass flow rates. R=1900 Warm recovery line (QRP) Jumper connection LHC cryomagnets Cold mass F D B C E He ring line (QRP) Cryogenic distribution line (QRL) Figure 4. LHC machine components located in the tunnel. 5

Insulation Vacuum sectorization: QRL vacuum jacket Jumper vacuum barriers Cryogenic distribution line vacuum barriers 428 m LHC cryomagnet vacuum vessel LHC cryomagnet vacuum barriers 214 m Cold-mass sectorization: Bus-bar plugs Safety relief valves Cooldown and fill valves A B A B A B A B A B A C D A B A B A B A B A B A B A LHC sector 214 m Figure 5. Vacuum and cold mass sub-sectorisation in LHC sector. QRL: Table 2. Maximum He masses and volumes in the tunnel (see also Figure 5) P [bar] T [K] Mass-flow [kg/s] Mass per sub-sector [kg] Residence time (1) [s] Volume per subsector [m3] He subsectorisation [m] Vacuum subsectorisation Header B 0.016 4 0.125 37 296 195 3300 428 Header C 3 4.6 0.141 3300 23400 26 3300 428 Header D (2) 3 10 0.114 917 (2) 8043 60 3300 428 Header F 19 75 0.234 195 833 17 3300 428 Cryomagnets: Cold mass Header E 1.3 19.5 1.9 75 0 0.234 475 195 DFB (3) 1.3 4.4 0 79 0.65 (3) 15 300 RF cavities 1.3 4.4 0 34 0.28 (4) 13 13 He ring line 20 300 0.15 321 2140 104 26400 = Warm recovery line 833 3.21 17 214 3300 1.05 300 0.05 9 180 58 3300 = (1) residence time is calculated as element length divided by the fluid velocity. (2) helium parameters in header D as after a limited quench (maximum 8 cells). (3) DFB: Electrical feedbox. The longest DFB is situated at Point 2 left side. (4) volume per module. [m] 214 214 6

Table 3. Gravity 3 failures at the nodes located in the tunnel. No. Node and failure description, remarks Probability Maximum amount of helium relieved to the tunnel [kg]/ approximate peak flow rate [kg/s] 1 LHC cryomagnets: He flow to cryostat D 475 / < 2 insulation vacuum 2 LHC cryomagnets: He flow to air D 475 / He leakage only 3 LHC cryomagnets He flow to beam vacuum D 475 / < 2 4 LHC cryomagnets energy release electrical D 475 kg / < 2 arc Not directly related to cryogenics 5 He flow to QRL insulation vacuum, D 3300 kg / <2 assumption of header C break Worst case scenario of the probability higher than E 6 He flow to air, assumption of jumper E 4250 / < 20 connection break Worst case scenario 7 He flow to air, He ring line break D 321 kg / < 7 8 He flow to air, warm He recovery line break D 9 kg / He leakage only 9 He flow to DFB insulation vacuum D 79 kg / < 2 10 DFB He flow to air D 79 kg / He leakage only 11 He flow to RF cavities insulation vacuum D 34 kg / < 2 12 RF cavities cooling He flow to air D 34 kg / He leakage only As it follows from Table 3, two worst case scenarios can be identified based on the criterion of mass of helium involved and peak flow rate to the tunnel: helium flow to QRL insulation vacuum (assumption of a full break of header C) and a break of a jumper connection. More generally, table 4 summarises the PRA of the LHC cryogenic system giving worst case scenarios following the failures of the modes located in the tunnel, caverns, shaft and surface buildings. Table 4: Worst case scenario failures for the LHC cryogenic system nodes located in the tunnel, caverns, access shafts and surface buildings. Location Failure Probability Max. amount of helium relieved [kg] / peak flow rate [kg/s] Tunnel He flow to QRL insulation vacuum D 3300 / < 2 (break of header C) Tunnel He flow to air (jumper connection E 4250 / < 20 break) Cavern & shaft He flow to QURA 1 insulation D 176 / < 2 vacuum, LP circuit break Surface building He flow to QSRB 2 insulation D 190 / < 2 vacuum Surface building Break of LN2 storage vessel. Nitrogen flow to environment D 40000 / may be of the order of hundreds (1) QURA: Underground lower cold box. The given values correspond to the low pressure circuit. (2) QSRB: Surface integrated cold box. The given values correspond to the subcooler. 7

CONCLUSIONS AND RECOMMENDATIONS Due to its specific design features (cold recovery header, absence of nitrogen in the tunnel, no pump driven forced flow in cooling loops) the LHC cryogenic system is inherently safe with a limited number of possible risks and failures, especially those resulting in helium relief to a confined space. Out of almost 1000 analysed failure modes there are only 29 events that may be followed by helium discharge to a confined space. Worst-case failure modes have been identified and potential amount of helium that might be vented into the machine tunnel, caverns, shafts and surface building as well as peak discharge flow rate have been estimated. More detailed studies are being conducted to assess the development over time of such events and the resulting propagation and diffusion of helium in confined spaces (tunnel, caverns, shafts buildings). ACKNOWLEDGEMENTS The authors would like to thank S. Claudet. L. Tavian, U. Wagner and M. Barranco, W. Erdt, G. Rau, V. Sergo, R. Trant and R. van Weelderen for their help during preparation of this study. REFERENCES 1. Ph. Lebrun, Superfluid helium cryogenics for the Large Hadron Collider project at CERN, Cryogenics 34, ICEC Suppl. (1994). 2. G. Horlitz, Refrigeration of large scale superconducting systems for high energy accelerators, Cryogenics 32, ICEC Suppl., 44:49 (1992). 3. M. Chorowski, W. Erdt, Ph. Lebrun, G. Riddone, L. Serio, L. Tavian, U. Wagner and R. van Weldeeren, A simplified cryogenic distribution scheme for the Large Hadron collider, in: Adv. Cryo, Eng. 43, Plenum Press, New York, (1998), pp. 395-402. 4. L. Bottura, P. Burla, R. Wolf, LHC main dipoles proposed baseline current ramping, LHC Project Report- 172, CERN, Geneva (1998). 5. B. L. Hendrix, Application of system safety engineering techniques for hazard prevention at the superconducting super collider, in: Supercollider 3, Plenum Press, New York (1991), pp 1005-1015. 6. H. Garin, AMDEC, MADE, AEEL, L essentiel de la méthode, AFNOR (1994). 7. S. W. Malasky, System Safety, Hayden Book Company, Inc., ISBN 0-87671-559-5 (1974). 8. B. G. Blyukher, L.E. Reznikov, Design phase safety and risk assessment for superconducting cryogenic system, ASME International, 74:80 (1997). 9. M. Chorowski, Ph. Lebrun, G. Riddone, Preliminary risk analysis of the LHC cryogenic system, LHC Project Note 177, CERN, Geneva (1999). 8