risk analysis of the iter cryogenic system

7/23/2019 Risk Analysis of the ITER Cryogenic System

http://slidepdf.com/reader/full/risk-analysis-of-the-iter-cryogenic-system 1/9

Risk analysis of the ITER cryogenic system

Maciej Chorowski, Jaroslaw Fydrych, Maciej Grabowski, and Luigi Serio

Citation: AIP Conference Proceedings1434, 1559 (2012); doi: 10.1063/1.4707086

View online: http://dx.doi.org/10.1063/1.4707086

View Table of Contents: http://scitation.aip.org/content/aip/proceeding/aipcp/1434?ver=pdfcov

Published by the AIP Publishing

Articles you may be interested in

Conceptual design of ACB-CP for ITER cryogenic system

AIP Conf. Proc. 1434, 1720 (2012); 10.1063/1.4707106

Thermal mechanical analysis on the ACB-CP valve box of ITER cryogenic system

AIP Conf. Proc. 1434, 1714 (2012); 10.1063/1.4707105

PROCESS FLOW AND FUNCTIONAL ANALYSIS OF THE ITER CRYOGENIC SYSTEM

AIP Conf. Proc. 1218, 676 (2010); 10.1063/1.3422417

Performance analysis of ITER tomographic systems

AIP Conf. Proc. 988, 485 (2008); 10.1063/1.2905119

Cryogenic detector systems for materials analysis

AIP Conf. Proc. 605, 353 (2002); 10.1063/1.1457662

This article is copyrighted as indicated in the article. Reuse of AIP content is subject to the terms at: http://scitation.aip.org/termsconditions. Downloaded to

125.18.133.100 On: Thu, 20 Aug 2015 09:24:39

http://scitation.aip.org/search?value1=Maciej+Chorowski&option1=author

http://scitation.aip.org/search?value1=Jaroslaw+Fydrych&option1=author

http://scitation.aip.org/search?value1=Maciej+Grabowski&option1=author

http://scitation.aip.org/search?value1=Luigi+Serio&option1=author

http://scitation.aip.org/content/aip/proceeding/aipcp?ver=pdfcov

http://dx.doi.org/10.1063/1.4707086

http://scitation.aip.org/content/aip/proceeding/aipcp/1434?ver=pdfcov

http://scitation.aip.org/content/aip?ver=pdfcov

http://scitation.aip.org/content/aip/proceeding/aipcp/10.1063/1.4707106?ver=pdfcov










http://scitation.aip.org/content/aip?ver=pdfcov

http://scitation.aip.org/content/aip/proceeding/aipcp/1434?ver=pdfcov

http://dx.doi.org/10.1063/1.4707086


http://scitation.aip.org/search?value1=Luigi+Serio&option1=author

http://scitation.aip.org/search?value1=Maciej+Grabowski&option1=author

http://scitation.aip.org/search?value1=Jaroslaw+Fydrych&option1=author

http://scitation.aip.org/search?value1=Maciej+Chorowski&option1=author




RISK ANALYSIS OF THE ITER CRYOGENIC

SYSTEM

M. Chorowski1, J. Fydrych

1, M. Grabowski

1, L. Serio

2

1Wroclaw University of Technology, Faculty of Mechanical and Power

Engineering, Wyb. Wyspianskiego 27, 50-370 Wroclaw, Poland

2ITER OrganizationRoute de Vinon-sur-Verdon, 13115 St. Paul-lez-Durance, France

ABSTRACT

The reliability of the ITER tokamak will strongly depend on the safe operation of the

cryogenic system. The objective of the performed risk analysis is to identify all the

possible risks to personnel, equipment and environment resulting from cryogenic system

failures that might accidentally occur within any phases of the machine operation, and that

could not be eliminated by design. The applied methodology of the presented risk analysis

is based on the Failure Mode and Effects Analysis. All the potential failure modes were

analyzed to identify their possible effects and then to classify them according to their

severity and probability of occurrence. The Pareto-Lorentz analysis has been used for

ranking all the identified failures and determining the most credible incidents and

scenarios. For the most credible scenarios numerical simulations of the helium outflows

from the system have been performed, including analysis of the helium flow impact on the

neighboring confinements. Conclusions concerning the system safe operation, remedial

actions and mitigations of the most credible incidents have been formulated.

KEYWORDS: Risk analysis, FMEA, ITER Cryogenic system, Cryogenic node

INTRODUCTION

ITER will be a tokamak- based machine, in which a mixture of hydrogen isotopes will

be heated up to a hot plasma phase and fused to produce helium, releasing a neutron and a

net thermal energy. The ITER superconducting magnet system will confine the plasma in a

toroidal vacuum vessel. To obtain the superconducting state of the magnets the coils, in a

large and thermally shielded cryostat, will be maintained at 4.5 K with supercritical

Advances in Cryogenic Engineering

AIP Conf. Proc. 1434, 1559-1566 (2012); doi: 10.1063/1.4707086© 2012 American Institute of Physics 978-0-7354-1020-6/$0.00

1559 This article is copyrighted as indicated in the article. Reuse of AIP content is subject to the terms at: http://scitation.aip.org/termsconditions. Downloaded to

125.18.133.100 On: Thu, 20 Aug 2015 09:24:39



helium. The ITER cryogenic system will be composed of three main sub-systems: the

cryoplant located in a dedicated building, cryogenic distribution in the tokamak building,

and transfer lines connecting the cryoplant with the tokamak machine [1]. Due to a very

complex structure, high helium content (24 tons, mostly in high density cold phases) and

location in highly dense area, the ITER cryogenic system will belong to the most

complicated ever built. The operation of the tokamak strongly depends on the reliability

and availability of the cryogenic system. The risk analysis of the cryogenic system has been performed to identify all the hazards to personnel, equipment and environment

resulting from cryogenic system failures that might accidentally occur, and that could not

be eliminated by design. The findings are taken into account in the architecture, design and

operating scenarios to minimize the probability of the machine failures and its operation

interruptions.

METHODOLOGY OF THE RISK ANALYSIS

The applied methodology of risk analysis of cryogenic systems has been developed on

the basis of the Failure Mode and Effects Analysis FMEA, already applied to the risk

analysis of the LHC cryogenics [2]. Each potential failure mode of the cryogenic system isanalyzed to determine its effects, and then classified according to its severity and the

probability of occurrence. The procedure of the FMEA analysis for the ITER cryogenic

system comprises the following stages:

1.

Identification of the cryogenic system nodes, their design and operation features,

2.

Identification of the locations of the nodes in the site facilities,

3. Analysis of the potential failures and the determination of credible incidents (risk

factors, frequency of occurrence, level of detectability, importance of defects),

4.

Identification of credible scenarios for chosen components and the analysis of their

potential causes and consequences,

5. Specification of the most credible incident and most credible scenario,

6.

Dynamics simulations of the most credible and severe helium leakages to the

vacuum insulation and to the environment (including oxygen deficiency hazard and

the influence of cold helium impact on mechanical structures),

7.

Proposal for the mitigation of the most credible incident consequences,

8. Formulation of remedial actions.

For the purpose of the risk analysis the ITER cryogenic system is treated as composed

of separated helium enclosures – so called cryogenic nodes. Each cryogenic node is

characterized in terms of helium quantity and thermodynamic parameters, the volume of a

corresponding insulation vacuum, instrumentation and special equipment. Additionally, the

volume of a potential node confinement in a tokamak building is taken into account.

FIGURE 1 depicts a general scheme of a generic cryogenic node located in a confinement.

Possible failure modes that can accidentally occur in all cryogenic nodes of the ITER

cryogenic system include a break of a cold vessel or process line, break of a heatexchanger, break of a vacuum vessel and electrical arc. Each failure mode can be caused

by several defects such as pipe or weld leakage, bellow rupture, electrical feedthrough

defect, electrical joint failure, etc. These defects can be triggered by a number of

independent causes, for example: material flaw, mechanical fatigue, accidental mechanical

impact, incorrectly assembled electrical joint. The following risk analysis is based on the

assumption that the occurrence of two independent defects at the same time is excluded.

The defects leading to failures can be characterized by their occurrences, whilst all possible

consequences of the failures can be characterized with respect to their severities.

1560


125.18.133.100 On: Thu, 20 Aug 2015 09:24:39



FIGURE 1. General scheme of a generic cryogenic node in a confinement

The recognized potential failures can be classified by their criticality CRT as a function of

the defect occurrence rate OCC and severities of the failure consequences. The following

formula has been proposed for the assessment of the failure criticality:

me p SEV SEV SEV OCC CRT ⋅⋅⋅=3

(1)

where SEV p, SEV e and SEV m are the severity rates to the personnel, environment and

machine respectively.

The ITER cryogenic system cooling fluid are not active or contaminated by design and

therefore the failures are not followed by any discharge hazard to the environment.

Therefore the criticality can be assessed from a simplified equation (2):

m p SEV SEV OCC CRT ⋅⋅=2

(2)

The failure occurrence rate is quantified with respect to the cumulative failure rateCFR described by the product of the quantity of elements that fail (e.g. number of valves,

length of welds) and the probability of the defect occurrence. The severity rate to the

personnel is quantified in respect to the oxygen deficiency hazard (ODH) following the

failure mode, whilst the severity rate to the machine depends on the location of the

cryogenic node in the ITER site and the technical complexity of the malfunctioning

cryogenic node.

The specification of the most credible incidents MCI is based on the Pareto-Lorentz

analysis that helps in ranking all the identified defects according to their criticality rate

values. The possible sequences of events that happen consecutively or simultaneously after

the specified MCIs have been numerically simulated and then fully analyzed to evaluate

the remedial actions and the mitigations of the consequences. For the purpose of this

analysis the ITER cryogenic system has been divided into 8 subsystems, namely:1 – central solenoid feeders (components feeding electrically and hydraulically the

corresponding magnet system), 2 – toroidal field magnet feeders, 3 – poloidal field magnet

and correction coil feeders, 4 – structure cooling feeders, 5 – cryopumps cooling boxes,

6 – transfer lines (including cold compressor box and thermal shield cooling boxes),

7 – cryoplant and 8 – main cryostat. Then each sub-system has been split into a number of

cryogenic nodes according to the locations of the vacuum barriers of the external vacuum

vessel. The paper presents the analysis performed for toroidal field magnet feeders (TF).

1561


125.18.133.100 On: Thu, 20 Aug 2015 09:24:39



FIGURE 2. Scheme of the connections among the cryogenic nodes in the toroidal field magnet feeders

subsystem

TABLE 1. Technical characteristic of the TF feeder

Total lenght of process pipe 190 m

Total length of cold welds 28 mTotal length of vacuum vessel welds 80 m

Vacuum barrier 3 pcs

Process valve 17 pcsVacuum valve 1 pcs

Safety valve 5 pcs

Eletrical feedthrough 4 pcsElectrical joint 2 pcs

Amount of the helium that can outflow through the node 633 kg

Total volume of the confinements 17390 m3

IDENTIFICATION OF CRYOGENIC NODES FOR TOROIDAL FIELD

MAGNET FEEDERS

The number of cryogenic nodes in the toroidal field (TF) magnet feeders subsystem

is 12 and their topology is presented in FIGURE 2. TABLE 1 shows the technical

parameters of TF feeders.

ANALYSIS OF THE POTENTIAL FAILURES OF TF FEEDERS

Potential failures have been first identified and then analyzed in respect to the

frequencies of the occurrence of the defects that can cause the failures as well as to the

severities of the failures to the personnel and the machine. TABLE 2 presents an example

of failure analysis for the chosen group of the cryogenic nodes of the TF magnet feeder

cryogenic subsystem.

The analyzed defects of the cryogenic nodes grouped in TF Feeders subsystem were

ranked according to their criticalities. An example of Pareto-Lorentz chart is shown in

FIGURE 3. The chart helps to recognize the significance of the most critical defects by the

distribution of their cumulative percentages. Additionally the analyzed defects of eachsubsystem were plotted on a criticality matrix to visualize the contribution of occurrence

and severities in the criticality of failures. The criticality matrix used for the risk analysis of

the ITER cryogenic system was plotted in the coordinates of the product of the severities

for personnel and machine (SEV p⋅ SEV m) and the square of occurrence (OCC 2). It was

assumed that the major criticality is for the CRT higher than 468, the minor criticality is for

CTR lower than 100 and the medium criticality is for CRT between 100 and 468.

FIGURE 4 presents the distributions of the numbers of failures on criticality matrixes in

case of the toroidal field magnet feeder subsystem.

T F

F e e d e r

[ T F 8 , 9

]

TF cryolines North

ACB-2 TF

T F

F e e d e r

[ T

F 1 2 , 1

3 ]

T F

F e e d e r

[ T

F 1 4 , 1

5 ]

T F

F e e d e r

[ T F 4 , 5

]

T F

F e e d e r

[ T

F 1 6 , 1

7 ]

TF cryolines South

T F

F e e d e r

[ T F 2 , 3

]

T F

F e e d e r

[ T

F 1 8 , 1

]

T F

F e e d e r

[ T

F 1 0 , 1

1 ]

T F

F e e d e r

[ T F 6 , 7

]

1562


125.18.133.100 On: Thu, 20 Aug 2015 09:24:39



TABLE 2. Failure analysis of the TF Feeders

Failure mode CFR OCC SEVm SEVp CRT

Cold weld ruture TF Feeders defect 1 0,01473 3 4 3 108

Cold pipe leakage TF Feeders defect 2 0,00100 2 4 3 48

Cold pipe rupture TF Feeders defect 3 0,00832 3 4 3 108

Process valve leakage TF Feeders defect 4 0,00149 2 4 3 48Process valve rupture TF Feeders defect 5 0,08942 4 4 3 192

Vacuum vessel weld rupture TF Feeders defect 6 0,04208 3 4 3 108

Vacuum jacket rupture TF Feeders defect 7 0,00877 3 4 3 108

Vacuum safety plate damage TF Feeders defect 8 0,02630 3 4 3 108

Electrical feedthrough defect TF Feeders defect 9 0,03200 3 4 3 108

Electrical arc Electrical joint failure TF Feeders defect 10 0,24000 4 4 3 192

B r e a k o f

v a c u u m

v e s s e l

B r e

a k o f c o l d

v e s s e l o r

p r o c e s s p i p e

DEFECT

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

0

20

40

60

80

100

120

140

160

180

200

T F F e e d e r s d e f e c t 5

T F F e e d e r s d e f e c t 1 0







A C B - 2 T F d e f e c t 5



3 4 2 C T N d e f e c t 1

3 4 2 C T N d e f e c t 3

3 4 2 C T N d e f e c t 5

3 4 2 C T S d e f e c t 1

3 4 2 C T S d e f e c t 3

3 4 2 C T S d e f e c t 5






A C B - 2 T F d e f e c t 1 0

A C B - 2 T F d e f e c t 1 2

3 4 2 C T N d e f e c t 2

3 4 2 C T N d e f e c t 4

3 4 2 C T N d e f e c t 6

3 4 2 C T S d e f e c t 2

3 4 2 C T S d e f e c t 4

3 4 2 C T S d e f e c t 6




3 4 2 C T N d e f e c t 7

3 4 2 C T S d e f e c t 7

A C B - 2 T F d e f e c t 1 1

C u m u l a t i v e p e r c e n t a g e

C R T

Defects

CRT

cumulative percentage

FIGURE 3. Analysis of Pareto-Lorentz for the toroidal field magnet feeder subsystem

SPECIFICATION OF THE MOST CREDIBLE INCIDENTS AND SCENARIOS

To specify the most credible incidents all the defects which criticality values are equal

to or higher than 100 were selected and compared to each other taking into account the

possibility of helium leakage, the amount of helium that can be discharged into

a confinement in the tokamak building, and the confinement volumes. The incidents with

lower criticality values but significantly high helium quantities were also taken into

account. Finally, 11 defects characterized by relatively high value of criticality factor, the

large quantity of discharged helium and relatively low volume of the related confinements

were selected as the most credible incidents (MCI).

1563


125.18.133.100 On: Thu, 20 Aug 2015 09:24:39



FIGURE 4. Criticality matrix for the toroidal field magnet feeder subsystem

Examples of most credible incidents (MCI) are: 1 – a process valve rupture in one of the

TF Feeders, 2 – an electrical joint failure in one of the TF Feeders, 3 – a cold weld rupture

in one of the PF Feeders and 4 – process pipe rupture in the ACB line for magnets.

Due to the fact that some of the selected failures could be followed by the same series

of events, the number of specified most critical scenarios (MCS) could have been reducedto 9. The examples of most critical scenarios (MCS) can be caused by: 1 – break of cold

process pipe in one of the TF Feeders and 2 – electrical arc in one of the TF Feeders.

Break of cold process pipe in one of the TF Feeders is characterized by the following

sequence of events:

1.

Process pipe or process valve rupture in one of TF Feeder,

2.

Leakage of cryogen into the vacuum vessel,

3. Loss of insulation vacuum,

4.

Cut-off of the helium supply and return in ACB-2 TF,

5.

Increase of heat transfer to the cryogen in the TF Feeder,

6. Increase of pressure in both the cold and vacuum vessels,

7. Opening of the safety valve (if pressure exceeds the safety valve opening pressure),

8.

Opening of the safety plate (if pressure exceeds the safety plate opening pressure),9. Cryogen outflow to the related confinement,

10. Decrease of the air temperature and ODH danger in the confinement,

11.

Potential pressurization of the confinement.

In case of the electrical arc in one of the TF Feeders the scenario begins with the

following two events:

1.

Electrical arc in an electrical joint of TF Feeder,

2.

Perforation or full cut of one or a few process pipes.

All the specified most credible scenarios result in the outflows of cold helium to the

confinements where the nodes are located. These outflows can cause pressurization of the

confinements as well as the drops of temperature and ODH.

INVESTIGATION INTO THE MOST POTENTIAL HELIUM LEAKAGES

The investigation into the dynamics of the most potential helium leakages aims into

the evaluation of the maximum potential pressurizations of the ITER site building

confinements. It bases on the numerical calculation of the helium thermodynamic

parameters in the inner vessel (so-called cold mass) and vacuum space, as well as in the

1564


125.18.133.100 On: Thu, 20 Aug 2015 09:24:39



confinement where an analyzed cryogenic node is located. The developed model enables

the simulations of the helium parameters from first principles, using a lumped parameter

approach for the helium located in the cold mass and vacuum space enclosures and the

adjacent cryogenic node confinement. The numerical model takes into consideration all

important technical characteristics of the analyzed cryogenic node, particularly the initial

temperatures and pressures, heat transfers areas, masses and volumes of the cold masses,

radiation shields and vacuum vessels, as well as the opening pressures, flow coefficientsand diameters of the pressure safety devices. Additionally, in case of an electrical arc

failure, both the total energy of an electrical arc and its time characteristics are taken into

account.

If the pressurization of the confinement exceeds the acceptable level, then the model

takes into consideration the outflows of the helium-air mixture generated in the node

confinement to an adjacent confinement through the existing passages.

The time evolutions of pressure, temperature, mass flow rates and oxygen

concentration in the vacuum space of the TF Feeder as well as in the related confinements

were chosen as the helium outflow numerical modeling result examples. FIGURE 5 shows

the evolution of helium pressure and temperature in the TF Feeder vacuum space. After the

failure of a cold process pipe, the pressure rapidly rises and reaches 1.1 bar in the first half

hour, then it rises up to 1.2 bar in the next 20 hours after the rupture.The evolution of the helium mass flow rate is presented in FIGURE 6. The flow rate

reaches the value of 1.25 kg/s in the very beginning of the flow and then it drops to

0.6 kg/s in 5 minutes. Then it declines in 40 minutes after the process pipe rupture.

FIGURES 7 and 8 present the time evolutions of the pressure, temperature and oxygen

concentration in the confinement related to the TF Feeder. The temperature in this

confinement decreases to 263 K in the first half hour and after it rises back to the initial

value. The pressure rises close to 1.1 bar within first 30 minutes and then it slowly grows

to 1.25 bar, exceeding a little bit above the acceptable level (1.2 bar). The oxygen

concentration drops close to 17%.

A total ITER cryodistribution system, consists of 66 cryogenic nodes (including 12

nodes of TF magnet feeders). The number of the analyzed individual defects the ITER

cryodistribution system is 275. Eighteen defects lead to helium relieve from the cryogenic

system to the tokamak building confinements. By grouping the most credible incidents that

lead to the same series of events, it was sufficient to specify 9 the most credible scenarios,

requiring numerical modeling.

CONCLUSIONS

An FMEA based methodology of the cryogenic risk analysis was applied to the ITER

cryogenic system. The performed risk analysis, together with the numerical investigation

of the helium outflows to the confinements of cryogenic nodes, allows identifying the

following most credible incidents:1)

Drop of the oxygen concentration below acceptable level in the related confinements of

the cryogenic nodes, that can cause the oxygen deficiency hazard to the personnel

present in the zone of the node operated in failure mode,

2) Significant temperature decrease in the confinement related to the cryogenic node

operated in failure mode that can cause danger to the personnel and to the facilities

located in the zone that get fragile at low temperatures,

3) Pressurization above 1.2 bar of the tight confinements of the tokamak building,

4) Significantly long shutdowns of the machine resulting from the necessary repair period.

1565


125.18.133.100 On: Thu, 20 Aug 2015 09:24:39



FIGURE 5. Evolution of the helium temperature

and pressure in the vacuum space of TF Feeder

FIGURE 6. Evolution of the helium mass

flow rate through the safety plate of TF Feeder

FIGURE 7. Evolution of the helium temperature

and pressure in the confinement related to TF Feeder

FIGURE 8. Evolution of the oxygen concentration

in the confinement related to of TF Feeder

The results of the simulations showed that if the confinements are considered open to

the adjacent confinements through specified passages, the pressure in any confinements

will not exceed the acceptable pressure value, and the oxygen concentration will drop

below acceptable levels. Therefore the actions that mitigate the consequences of the most

credible incidents are to implement a oxygen monitoring system and to allow sufficient

free helium flow between the adjacent confinements to make the maximum use of the

accessible volume in the tokamak building while maintaining not leak tight volumesegregation for fire confinement. The above actions are implemented in the tokamak

building design and layout.

ACKNOWLEDGEMENTS

This paper was prepared as an account of work by and for IO which Members are the

People’s Republic of China, the European Atomic Energy Community, the Republic of

India, Japan, the Republic of Korea, the Russia Federation, and the United States of

America. The views and opinions expressed herein do not necessarily reflect those of the

Members or any agency thereof. Dissemination of the information in this proceeding is

governed by the applicable terms of the ITER Joint Implementation Agreement.

REFERENCES

1. Serio L., “Challenges for Cryogenics at ITER” in Advances in Cryogenic Engineering, vol. 55A,

edited byedited by J. G. Weisend II, et al., Melville, NY, 2010, pp.651-652.

2. Chorowski M., Lebrun Ph., Riddone G. “Preliminary risk analysis of the LHC cryogenic system”in Advances in Cryogenic Engineering, vol. 45, edited by Quan-Sheng Shu, et al., NY, 2000,

pp. 1309-1316.


risk analysis of the iter cryogenic system

Documents