MICE Liquid Hydrogen Review Risk Management LH 2

MICE Liquid Hydrogen Review Risk Management • LH 2 project - safety philosophy • Organisation • Responsibilities • Applicable legislation & frameworks • International/National • Local • Role of SHE Group • Practical operation • • 1 Operational model Access controls Expert staff and training Security Andy Nichols/Steve Watson, STFC, 15 -1 -15

Hierarchy Director of Particle Physics Dept Dave Wark Other stakeholders Director of ISIS RAL SHE group, MICE management, Director of Technology Robert Mc. Greevy Working group MICE + ISIS Safety input Various consultants MICE LH 2 team Technical input SW, PW, MC BPG, contractors

Safety Philosophy and organisation • • Responsibilities: • A. Nichols (Group Leader in Matters of Safety) – delegated responsibility from Director PPD for all MICE Safety in construction and operation • Steve Watson (LH 2 Project Engineer) – responsible for delivering the hydrogen system and ensuring it is compliant with the correct safety frameworks. Also locally responsible for its safe operation Organisation & local oversight • • • 3 Within MICE, key technical decisions are taken by MICE Technical Board, now superseded by the MIPO (MICE International Project Office) The MICE Liquid Hydrogen Working Group, chaired by John Thomason, has ISIS-PPD-MICE membership and meets regularly to monitor and advise the hydrogen project and to provide input to Director-level Major technical reviews are held at points dictated by the above bodies

Safety Philosophy and organisation • From IEC 61508: • • The hydrogen system’s safety policy grew from the first external project review, held in 2005, described elsewhere today The presence of hydrogen gives a high profile, which helps rather than hinders – no chance of it slipping off the radar! Because of its importance and unusual considerations, the LH 2 safety case has been largely ring-fenced from other safety-related situations in MICE • But the critical interfaces are well understood and managed • • 4 ‘Safety must be considered from the beginning’ Safety and risk management is influenced by a top-level risk assessment, created by the LH 2 Project Engineer and is reviewed regularly As close as reasonably practicable, the system design, manufacture and operation complies with relevant safety frameworks Since 2005, regular safety reviews have been held, with the very close cooperation of our hosts, ISIS, SHE Group and relevant third parties The process has generally been to review, test, modify and review

Applicable Legislation & Frameworks • International/National standards: • • • These requirements are articulated locally by STFC Safety Codes (SC); these define our safety regime in the terms of the host lab (STFC, RAL): • • • DSEAR – Dangerous Substances & Explosive Atmospheres Regulations IEC 61508 – Functional Safety of Electrical/Electronic/Programmable Electronic Safety Related Systems PED – Pressurised Equipment Directive ATEX – Atmospheres Explosives SC 3 – safe use of cryogenic materials SC 6 – risk management SC 20 – controlling explosive and flammable gases and dusts SC 32 – fire and emergency management SC 33 - safety of pressure and vacuum systems But our top-level guide is the STFC Safety Policy http: //www. stfc. ac. uk/SHE/Resources/pdf/Healthand. Safety. Policy. pdf 5

LOPA studies • Layers of Protection Analysis – Determines a Safety Integrity Level rating (SIL) for the critical safety hazards identified in the HAZOP – SIL ratings used in assessment of compliance with IEC 61508 – Carried out by Functional Safety Consultancy in 2010 • Original report identified two marginal SIL 1, one SIL 1 and one SIL 2 rated scenarios • The SIL 2 rating was regarded as excessively conservative and reassessed to SIL 1 – This decision was ‘vetted’ by an external safety consultant and accepted by the working group – Result of downgrading was removal of requirement for dissimilar redundancy in mitigating systems

Applicable legislation & frameworks • 7 Role of SHE Group: • Maintenance and responsibility for STFC Safety policy and safety codes • Give advice on project constructional and operational safety • Participate in reviews and meetings • Conduct regular safety tours and feedback their findings

Practical Operation • 9 The liquid hydrogen absorber is a crucial part of the MICE Step IV experimental programme • The absorber will be filled for discrete periods of a few weeks to suit the programme • These periods will be clearly defined in advance, ie, the system will not be operated at short notice or on an experimental whim – it is likely to be a three or two shift system, but hydrogen will remain for 24/7 • This way we can plan expert staffing, oversight and operation • The MICE Run Co-ordinator, Steve Boyd is responsible for the experimental shifts • But the LH 2 expert team will be responsible for the LH 2 system themselves • Of course, some overlap will be required; the on-call system is already mature within MICE and was also exercised at the LH 2 system test

Access controls • 10 This is straightforward: • While hydrogen is present in the absorber, universal access to the experimental Hall is prevented by the PPS system, which has been separately reviewed, latest in December 2014 • It does however allow controlled access for experts and nominated shifters • Again, this regime has been proven in the system test and also with the TIARA RF test • Outside the experimental Hall, access to two DSEAR rated zones is prevented by gates or barriers and prohibition signs are provided

DSEAR • All relevant areas designated as ATEX Zone 2 – a place where an explosive atmosphere is not likely to occur during normal operation but, if it does, will persist for a short period only – The zone does not extend beyond the walls of the ventilation system (as is often assumed in industry) due to its negative pressure • Using this, all areas assessed are deemed to be ‘broadly acceptable’ using the DSEAR risk assessment method

Expert staff and training 12 • It is strictly understood that all matters of operation and maintenance rest with the expert team; it is: • Steve Watson – Project Engineer • Phil Warburton – Controls engineering • Mike Courthold – Cryogenics • Some limited overlap between the above and the experimental shift team will be inevitable though • A plan for awareness training of relevant shifters is under construction in conjunction with the Run Co-ordinator • This will also include the ISIS operational crew if required

Security • Online: • The operational software and user interface is password protected and can only be accessed by members of the expert team • Experimental shifters will not be able to interact with the control software • The control system is suitably backed up and the system will fail safe in the event of software failure • A UPS is provided for power security • Offline: • During running, universal access is prevented by the PPS system • The Hydrogen system has a dedicated control room that is combination locked 13