Risk analysis of the ITER cryogenic system

Maciej Chorowski, Jaroslaw Fydrych, Maciej Grabowski, and Luigi Serio

Citation: AIP Conference Proceedings 1434, 1559 (2012); doi: 10.1063/1.4707086
View online: http://dx.doi.org/10.1063/1.4707086
View Table of Contents: http://scitation.aip.org/content/aip/proceeding/aipcp/1434?ver=pdfcov
Published by the AIP Publishing
Articles you may be interested in
Conceptual design of ACB-CP for ITER cryogenic system
AIP Conf. Proc. 1434, 1720 (2012); 10.1063/1.4707106
Thermal mechanical analysis on the ACB-CP valve box of ITER cryogenic system
AIP Conf. Proc. 1434, 1714 (2012); 10.1063/1.4707105
PROCESS FLOW AND FUNCTIONAL ANALYSIS OF THE ITER CRYOGENIC SYSTEM
AIP Conf. Proc. 1218, 676 (2010); 10.1063/1.3422417
Performance analysis of ITER tomographic systems
AIP Conf. Proc. 988, 485 (2008); 10.1063/1.2905119
Cryogenic detector systems for materials analysis
AIP Conf. Proc. 605, 353 (2002); 10.1063/1.1457662

This article is copyrighted as indicated in the article. Reuse of AIP content is subject to the terms at: http://scitation.aip.org/termsconditions. Downloaded to IP:
125.18.133.100 On: Thu, 20 Aug 2015 09:24:39

RISK ANALYSIS OF THE ITER CRYOGENIC

SYSTEM

M. Chorowski1, J. Fydrych1, M. Grabowski1, L. Serio2

1

Wroclaw University of Technology, Faculty of Mechanical and Power

Engineering, Wyb. Wyspianskiego 27, 50-370 Wroclaw, Poland

ITER Organization
Route de Vinon-sur-Verdon, 13115 St. Paul-lez-Durance, France

ABSTRACT
The reliability of the ITER tokamak will strongly depend on the safe operation of the
cryogenic system. The objective of the performed risk analysis is to identify all the
possible risks to personnel, equipment and environment resulting from cryogenic system
failures that might accidentally occur within any phases of the machine operation, and that
could not be eliminated by design. The applied methodology of the presented risk analysis
is based on the Failure Mode and Effects Analysis. All the potential failure modes were
analyzed to identify their possible effects and then to classify them according to their
severity and probability of occurrence. The Pareto-Lorentz analysis has been used for
ranking all the identified failures and determining the most credible incidents and
scenarios. For the most credible scenarios numerical simulations of the helium outflows
from the system have been performed, including analysis of the helium flow impact on the
neighboring confinements. Conclusions concerning the system safe operation, remedial
actions and mitigations of the most credible incidents have been formulated.

KEYWORDS: Risk analysis, FMEA, ITER Cryogenic system, Cryogenic node

INTRODUCTION
ITER will be a tokamak- based machine, in which a mixture of hydrogen isotopes will
be heated up to a hot plasma phase and fused to produce helium, releasing a neutron and a
net thermal energy. The ITER superconducting magnet system will confine the plasma in a
toroidal vacuum vessel. To obtain the superconducting state of the magnets the coils, in a
large and thermally shielded cryostat, will be maintained at 4.5 K with supercritical
Advances in Cryogenic Engineering
AIP Conf. Proc. 1434, 1559-1566 (2012); doi: 10.1063/1.4707086
2012 American Institute of Physics 978-0-7354-1020-6/$0.00

This article is copyrighted as indicated in the article. Reuse of AIP content is subject to the terms at: http://scitation.aip.org/termsconditions. Downloaded to IP:
155920 Aug 2015 09:24:39
125.18.133.100 On: Thu,

helium. The ITER cryogenic system will be composed of three main sub-systems: the
cryoplant located in a dedicated building, cryogenic distribution in the tokamak building,
and transfer lines connecting the cryoplant with the tokamak machine [1]. Due to a very
complex structure, high helium content (24 tons, mostly in high density cold phases) and
location in highly dense area, the ITER cryogenic system will belong to the most
complicated ever built. The operation of the tokamak strongly depends on the reliability
and availability of the cryogenic system. The risk analysis of the cryogenic system has
been performed to identify all the hazards to personnel, equipment and environment
resulting from cryogenic system failures that might accidentally occur, and that could not
be eliminated by design. The findings are taken into account in the architecture, design and
operating scenarios to minimize the probability of the machine failures and its operation
interruptions.

METHODOLOGY OF THE RISK ANALYSIS

The applied methodology of risk analysis of cryogenic systems has been developed on
the basis of the Failure Mode and Effects Analysis FMEA, already applied to the risk
analysis of the LHC cryogenics [2]. Each potential failure mode of the cryogenic system is
analyzed to determine its effects, and then classified according to its severity and the
probability of occurrence. The procedure of the FMEA analysis for the ITER cryogenic
system comprises the following stages:
1. Identification of the cryogenic system nodes, their design and operation features,
2. Identification of the locations of the nodes in the site facilities,
3. Analysis of the potential failures and the determination of credible incidents (risk
factors, frequency of occurrence, level of detectability, importance of defects),
4. Identification of credible scenarios for chosen components and the analysis of their
potential causes and consequences,
5. Specification of the most credible incident and most credible scenario,
6. Dynamics simulations of the most credible and severe helium leakages to the
vacuum insulation and to the environment (including oxygen deficiency hazard and
the influence of cold helium impact on mechanical structures),
7. Proposal for the mitigation of the most credible incident consequences,
8. Formulation of remedial actions.
For the purpose of the risk analysis the ITER cryogenic system is treated as composed
of separated helium enclosures so called cryogenic nodes. Each cryogenic node is
characterized in terms of helium quantity and thermodynamic parameters, the volume of a
corresponding insulation vacuum, instrumentation and special equipment. Additionally, the
volume of a potential node confinement in a tokamak building is taken into account.
FIGURE 1 depicts a general scheme of a generic cryogenic node located in a confinement.
Possible failure modes that can accidentally occur in all cryogenic nodes of the ITER
cryogenic system include a break of a cold vessel or process line, break of a heat
exchanger, break of a vacuum vessel and electrical arc. Each failure mode can be caused
by several defects such as pipe or weld leakage, bellow rupture, electrical feedthrough
defect, electrical joint failure, etc. These defects can be triggered by a number of
independent causes, for example: material flaw, mechanical fatigue, accidental mechanical
impact, incorrectly assembled electrical joint. The following risk analysis is based on the
assumption that the occurrence of two independent defects at the same time is excluded.
The defects leading to failures can be characterized by their occurrences, whilst all possible
consequences of the failures can be characterized with respect to their severities.

This article is copyrighted as indicated in the article. Reuse of AIP content is subject to the terms at: http://scitation.aip.org/termsconditions. Downloaded to IP:
156020 Aug 2015 09:24:39
125.18.133.100 On: Thu,

FIGURE 1. General scheme of a generic cryogenic node in a confinement

The recognized potential failures can be classified by their criticality CRT as a function of
the defect occurrence rate OCC and severities of the failure consequences. The following
formula has been proposed for the assessment of the failure criticality:

CRT = OCC 3 SEV p SEVe SEVm

(1)
where SEVp, SEVe and SEVm are the severity rates to the personnel, environment and
machine respectively.
The ITER cryogenic system cooling fluid are not active or contaminated by design and
therefore the failures are not followed by any discharge hazard to the environment.
Therefore the criticality can be assessed from a simplified equation (2):
CRT = OCC 2 SEV p SEVm

(2)
The failure occurrence rate is quantified with respect to the cumulative failure rate
CFR described by the product of the quantity of elements that fail (e.g. number of valves,
length of welds) and the probability of the defect occurrence. The severity rate to the
personnel is quantified in respect to the oxygen deficiency hazard (ODH) following the
failure mode, whilst the severity rate to the machine depends on the location of the
cryogenic node in the ITER site and the technical complexity of the malfunctioning
cryogenic node.
The specification of the most credible incidents MCI is based on the Pareto-Lorentz
analysis that helps in ranking all the identified defects according to their criticality rate
values. The possible sequences of events that happen consecutively or simultaneously after
the specified MCIs have been numerically simulated and then fully analyzed to evaluate
the remedial actions and the mitigations of the consequences. For the purpose of this
analysis the ITER cryogenic system has been divided into 8 subsystems, namely:
1 central solenoid feeders (components feeding electrically and hydraulically the
corresponding magnet system), 2 toroidal field magnet feeders, 3 poloidal field magnet
and correction coil feeders, 4 structure cooling feeders, 5 cryopumps cooling boxes,
6 transfer lines (including cold compressor box and thermal shield cooling boxes),
7 cryoplant and 8 main cryostat. Then each sub-system has been split into a number of
cryogenic nodes according to the locations of the vacuum barriers of the external vacuum
vessel. The paper presents the analysis performed for toroidal field magnet feeders (TF).

This article is copyrighted as indicated in the article. Reuse of AIP content is subject to the terms at: http://scitation.aip.org/termsconditions. Downloaded to IP:
156120 Aug 2015 09:24:39
125.18.133.100 On: Thu,

ACB-2 TF

TF Feeder
[TF16,17]

TF Feeder
[TF18,1]

TF Feeder
[TF2,3]

TF Feeder
[TF6,7]

TF Feeder
[TF14,15]

TF Feeder
[TF12,13]

TF Feeder
[TF10,11]

TF Feeder
[TF8,9]

TF Feeder
[TF4,5]

TF cryolines North

TF cryolines South

FIGURE 2. Scheme of the connections among the cryogenic nodes in the toroidal field magnet feeders
subsystem
TABLE 1. Technical characteristic of the TF feeder
Total lenght of process pipe
Total length of cold welds
Total length of vacuum vessel welds
Vacuum barrier
Process valve
Vacuum valve
Safety valve
Eletrical feedthrough
Electrical joint
Amount of the helium that can outflow through the node
Total volume of the confinements

190 m
28 m
80 m
3 pcs
17 pcs
1 pcs
5 pcs
4 pcs
2 pcs
633 kg
17390 m3

IDENTIFICATION OF CRYOGENIC NODES FOR TOROIDAL FIELD

MAGNET FEEDERS
The number of cryogenic nodes in the toroidal field (TF) magnet feeders subsystem
is 12 and their topology is presented in FIGURE 2. TABLE 1 shows the technical
parameters of TF feeders.

ANALYSIS OF THE POTENTIAL FAILURES OF TF FEEDERS

Potential failures have been first identified and then analyzed in respect to the
frequencies of the occurrence of the defects that can cause the failures as well as to the
severities of the failures to the personnel and the machine. TABLE 2 presents an example
of failure analysis for the chosen group of the cryogenic nodes of the TF magnet feeder
cryogenic subsystem.
The analyzed defects of the cryogenic nodes grouped in TF Feeders subsystem were
ranked according to their criticalities. An example of Pareto-Lorentz chart is shown in
FIGURE 3. The chart helps to recognize the significance of the most critical defects by the
distribution of their cumulative percentages. Additionally the analyzed defects of each
subsystem were plotted on a criticality matrix to visualize the contribution of occurrence
and severities in the criticality of failures. The criticality matrix used for the risk analysis of
the ITER cryogenic system was plotted in the coordinates of the product of the severities
for personnel and machine (SEVpSEVm) and the square of occurrence (OCC2). It was
assumed that the major criticality is for the CRT higher than 468, the minor criticality is for
CTR lower than 100 and the medium criticality is for CRT between 100 and 468.
FIGURE 4 presents the distributions of the numbers of failures on criticality matrixes in
case of the toroidal field magnet feeder subsystem.

This article is copyrighted as indicated in the article. Reuse of AIP content is subject to the terms at: http://scitation.aip.org/termsconditions. Downloaded to IP:
156220 Aug 2015 09:24:39
125.18.133.100 On: Thu,

TABLE 2. Failure analysis of the TF Feeders

Cold weld ruture

Cold pipe leakage

DEFECT
TF Feeders defect 1
TF Feeders defect 2

CFR
OCC SEVm SEVp CRT
0,01473
3
4
3
108
0,00100
2
4
3
48

Cold pipe rupture

TF Feeders defect 3

0,00832

Process valve leakage

TF Feeders defect 4

0,00149

48

Process valve rupture

TF Feeders defect 5

0,08942

192

Vacuum vessel weld rupture

Vacuum jacket rupture

TF Feeders defect 6
TF Feeders defect 7

0,04208
0,00877

3
3

4
4

3
3

108
108

108

Vacuum safety plate damage

TF Feeders defect 8

0,02630

108

Electrical feedthrough defect

TF Feeders defect 9

0,03200

108

TF Feeders defect 10

0,24000

192

Electrical arc Electrical joint failure

200

100%

180

90%

160

80%

140

70%

120

60%
50%
CRT
cumulative percentage

80

40%

342CTS defect 7

ACB-2 TF defect 11

342CTN defect 7

ACB-2 TF defect 4

ACB-2 TF defect 2

342CTS defect 6

ACB-2 TF defect 1

342CTS defect 4

342CTS defect 2

342CTN defect 6

342CTN defect 4

342CTN defect 2

ACB-2 TF defect 12

ACB-2 TF defect 9

ACB-2 TF defect 10

ACB-2 TF defect 8

ACB-2 TF defect 3

TF Feeders defect 4

342CTS defect 5

TF Feeders defect 2

342CTS defect 3

342CTS defect 1

342CTN defect 5

342CTN defect 3

342CTN defect 1

ACB-2 TF defect 7

ACB-2 TF defect 6

ACB-2 TF defect 5

TF Feeders defect 9

0%

TF Feeders defect 8

TF Feeders defect 7

10%

TF Feeders defect 6

20%

20

TF Feeders defect 3

40

TF Feeders defect 1

30%

TF Feeders defect 5

60

TF Feeders defect 10

CRT

100

Cumulative percentage

Break of
vacuum
vessel

Break of cold
vessel or
process pipe

Failure mode

Defects

FIGURE 3. Analysis of Pareto-Lorentz for the toroidal field magnet feeder subsystem

SPECIFICATION OF THE MOST CREDIBLE INCIDENTS AND SCENARIOS

To specify the most credible incidents all the defects which criticality values are equal
to or higher than 100 were selected and compared to each other taking into account the
possibility of helium leakage, the amount of helium that can be discharged into
a confinement in the tokamak building, and the confinement volumes. The incidents with
lower criticality values but significantly high helium quantities were also taken into
account. Finally, 11 defects characterized by relatively high value of criticality factor, the
large quantity of discharged helium and relatively low volume of the related confinements
were selected as the most credible incidents (MCI).

This article is copyrighted as indicated in the article. Reuse of AIP content is subject to the terms at: http://scitation.aip.org/termsconditions. Downloaded to IP:
156320 Aug 2015 09:24:39
125.18.133.100 On: Thu,

FIGURE 4. Criticality matrix for the toroidal field magnet feeder subsystem

Examples of most credible incidents (MCI) are: 1 a process valve rupture in one of the
TF Feeders, 2 an electrical joint failure in one of the TF Feeders, 3 a cold weld rupture
in one of the PF Feeders and 4 process pipe rupture in the ACB line for magnets.
Due to the fact that some of the selected failures could be followed by the same series
of events, the number of specified most critical scenarios (MCS) could have been reduced
to 9. The examples of most critical scenarios (MCS) can be caused by: 1 break of cold
process pipe in one of the TF Feeders and 2 electrical arc in one of the TF Feeders.
Break of cold process pipe in one of the TF Feeders is characterized by the following
sequence of events:
1. Process pipe or process valve rupture in one of TF Feeder,
2. Leakage of cryogen into the vacuum vessel,
3. Loss of insulation vacuum,
4. Cut-off of the helium supply and return in ACB-2 TF,
5. Increase of heat transfer to the cryogen in the TF Feeder,
6. Increase of pressure in both the cold and vacuum vessels,
7. Opening of the safety valve (if pressure exceeds the safety valve opening pressure),
8. Opening of the safety plate (if pressure exceeds the safety plate opening pressure),
9. Cryogen outflow to the related confinement,
10. Decrease of the air temperature and ODH danger in the confinement,
11. Potential pressurization of the confinement.
In case of the electrical arc in one of the TF Feeders the scenario begins with the
following two events:
1. Electrical arc in an electrical joint of TF Feeder,
2. Perforation or full cut of one or a few process pipes.
All the specified most credible scenarios result in the outflows of cold helium to the
confinements where the nodes are located. These outflows can cause pressurization of the
confinements as well as the drops of temperature and ODH.

INVESTIGATION INTO THE MOST POTENTIAL HELIUM LEAKAGES

The investigation into the dynamics of the most potential helium leakages aims into
the evaluation of the maximum potential pressurizations of the ITER site building
confinements. It bases on the numerical calculation of the helium thermodynamic
parameters in the inner vessel (so-called cold mass) and vacuum space, as well as in the

This article is copyrighted as indicated in the article. Reuse of AIP content is subject to the terms at: http://scitation.aip.org/termsconditions. Downloaded to IP:
156420 Aug 2015 09:24:39
125.18.133.100 On: Thu,

confinement where an analyzed cryogenic node is located. The developed model enables
the simulations of the helium parameters from first principles, using a lumped parameter
approach for the helium located in the cold mass and vacuum space enclosures and the
adjacent cryogenic node confinement. The numerical model takes into consideration all
important technical characteristics of the analyzed cryogenic node, particularly the initial
temperatures and pressures, heat transfers areas, masses and volumes of the cold masses,
radiation shields and vacuum vessels, as well as the opening pressures, flow coefficients
and diameters of the pressure safety devices. Additionally, in case of an electrical arc
failure, both the total energy of an electrical arc and its time characteristics are taken into
account.
If the pressurization of the confinement exceeds the acceptable level, then the model
takes into consideration the outflows of the helium-air mixture generated in the node
confinement to an adjacent confinement through the existing passages.
The time evolutions of pressure, temperature, mass flow rates and oxygen
concentration in the vacuum space of the TF Feeder as well as in the related confinements
were chosen as the helium outflow numerical modeling result examples. FIGURE 5 shows
the evolution of helium pressure and temperature in the TF Feeder vacuum space. After the
failure of a cold process pipe, the pressure rapidly rises and reaches 1.1 bar in the first half
hour, then it rises up to 1.2 bar in the next 20 hours after the rupture.
The evolution of the helium mass flow rate is presented in FIGURE 6. The flow rate
reaches the value of 1.25 kg/s in the very beginning of the flow and then it drops to
0.6 kg/s in 5 minutes. Then it declines in 40 minutes after the process pipe rupture.
FIGURES 7 and 8 present the time evolutions of the pressure, temperature and oxygen
concentration in the confinement related to the TF Feeder. The temperature in this
confinement decreases to 263 K in the first half hour and after it rises back to the initial
value. The pressure rises close to 1.1 bar within first 30 minutes and then it slowly grows
to 1.25 bar, exceeding a little bit above the acceptable level (1.2 bar). The oxygen
concentration drops close to 17%.
A total ITER cryodistribution system, consists of 66 cryogenic nodes (including 12
nodes of TF magnet feeders). The number of the analyzed individual defects the ITER
cryodistribution system is 275. Eighteen defects lead to helium relieve from the cryogenic
system to the tokamak building confinements. By grouping the most credible incidents that
lead to the same series of events, it was sufficient to specify 9 the most credible scenarios,
requiring numerical modeling.

CONCLUSIONS
An FMEA based methodology of the cryogenic risk analysis was applied to the ITER
cryogenic system. The performed risk analysis, together with the numerical investigation
of the helium outflows to the confinements of cryogenic nodes, allows identifying the
following most credible incidents:
1) Drop of the oxygen concentration below acceptable level in the related confinements of
the cryogenic nodes, that can cause the oxygen deficiency hazard to the personnel
present in the zone of the node operated in failure mode,
2) Significant temperature decrease in the confinement related to the cryogenic node
operated in failure mode that can cause danger to the personnel and to the facilities
located in the zone that get fragile at low temperatures,
3) Pressurization above 1.2 bar of the tight confinements of the tokamak building,
4) Significantly long shutdowns of the machine resulting from the necessary repair period.

This article is copyrighted as indicated in the article. Reuse of AIP content is subject to the terms at: http://scitation.aip.org/termsconditions. Downloaded to IP:
156520 Aug 2015 09:24:39
125.18.133.100 On: Thu,

FIGURE 5. Evolution of the helium temperature

and pressure in the vacuum space of TF Feeder

FIGURE 6. Evolution of the helium mass

flow rate through the safety plate of TF Feeder

FIGURE 7. Evolution of the helium temperature

and pressure in the confinement related to TF Feeder

FIGURE 8. Evolution of the oxygen concentration

in the confinement related to of TF Feeder

The results of the simulations showed that if the confinements are considered open to
the adjacent confinements through specified passages, the pressure in any confinements
will not exceed the acceptable pressure value, and the oxygen concentration will drop
below acceptable levels. Therefore the actions that mitigate the consequences of the most
credible incidents are to implement a oxygen monitoring system and to allow sufficient
free helium flow between the adjacent confinements to make the maximum use of the
accessible volume in the tokamak building while maintaining not leak tight volume
segregation for fire confinement. The above actions are implemented in the tokamak
building design and layout.

ACKNOWLEDGEMENTS
This paper was prepared as an account of work by and for IO which Members are the
Peoples Republic of China, the European Atomic Energy Community, the Republic of
India, Japan, the Republic of Korea, the Russia Federation, and the United States of
America. The views and opinions expressed herein do not necessarily reflect those of the
Members or any agency thereof. Dissemination of the information in this proceeding is
governed by the applicable terms of the ITER Joint Implementation Agreement.

REFERENCES
1.
2.

Serio L., Challenges for Cryogenics at ITER in Advances in Cryogenic Engineering, vol. 55A,
edited byedited by J. G. Weisend II, et al., Melville, NY, 2010, pp.651-652.
Chorowski M., Lebrun Ph., Riddone G. Preliminary risk analysis of the LHC cryogenic system
in Advances in Cryogenic Engineering, vol. 45, edited by Quan-Sheng Shu, et al., NY, 2000,
pp. 1309-1316.

This article is copyrighted as indicated in the article. Reuse of AIP content is subject to the terms at: http://scitation.aip.org/termsconditions. Downloaded to IP:
156620 Aug 2015 09:24:39
125.18.133.100 On: Thu,