Helium Management of ESS Cryoplants with Common Safety Relief Header and Recovery System

The European Spallation Source (ESS) is a neutron-scattering facility being built with extensive international collaboration in Lund, Sweden. Three cryogenic plants with a vast cryogenic distribution system meet the cooling requirements of the superconducting RF cavities in the accelerator (ACCP), the cold hydrogen moderators in the target (TMCP), a cryomodule test stand and the sample environments for neutron instruments (TICP). The first of the three plants, the TICP has been successfully installed, commissioned and acceptance tested in 2018 by Air Liquide Advanced Technologies. Meanwhile the other two cryoplants (ACCP and TMCP) are under commissioning and testing by Linde Kryotechnik AG. The cryoplants share common helium buffer tanks, safety relief headers and helium recovery system due to historical, economical and architectural reasons. The helium recovery strategy and system configuration will be described in the paper. Resulting challenges, risks and safety relevant events that happened during, especially parallel, commissioning activities will be presented. The measures implemented to mitigate major risk and lessons learned are addressed as well.


Cryogenic system overview
The ESS cryogenic system is composed of three independent cryoplants, which meet the cooling requirements for different clients. System overview and design have been described in [1], [2] and [3]. These three cryoplants vary greatly in size and number of equipment which is supplied by different companies with different delivery, installation and commissioning schedules. Due to historical and architectural reasons, all cryoplant compressor systems are located in the compressor building, which is connected via an underground duct with the coldbox building containing all three coldboxes. The interconnecting piping between two buildings and piping header along the walls were designed for completion at once. Together these factors determine that three cryoplants share the same connections to the cooling water circuit, instrument air circuit, gas nitrogen supply, buffer lines, safety relief manifolds, pure helium storage tanks and a common helium recovery and purification system [4].

Helium gas management, recovery, purification and storage
A unique feature of the ESS project is its commitment to sustainability via energy savings and helium recovery. The cryogenic system will be operated with as low heat load and with as high efficiency as reasonably possible. Waste heat from the helium compressor system will provide heating to the Lund district heating system instead of depositing into cooling towers.
To keep aligned with this goal the ESS cryogenics system is designed to minimize the loss of helium during operation. Towards this aim, an integrated helium gas management system including recovery, purification and storage are shared by the ACCP, TICP, TMCP and the neutron instruments sample environment. Helium gas boiled off from the instrument stations will be collected as well as impure helium from other resources. The gas is subsequently compressed and purified either in the TICP coldbox internal purifier or in the standalone external purifier before being liquefied or stored in pure helium gas storage tank. Sufficient storage tanks to contain all the gas helium have been installed (19x70m 3 ). Additionally, liquid helium storage tanks are sufficient to provide a back-up supply for the instruments station in case TICP cannot be used for helium liquefaction. e.g. when operating for the cryomodule test stand or during maintenance.

Impure helium sources of the ESS helium recovery system
The TICP is also used to recover impure helium from all instrument suits and cryoplants, as well as from external customers. The main impure helium sources are as listed below:  Helium discharge from safety valves venting lines of Elliptical cryomodule test stand.  Helium discharge from safety valves venting lines of the Linac cryogenic distribution system.  Helium from neutron science instrumentation sample environment stations.  Boil off station for the mobile Dewars.  Flash gas from the TICP LHe filling station.  Neck cooling of the large TICP and ACCP liquid helium storage tanks.  Diverse connections from cryoplants adsorber recovery units and purge connections.
The main objective of connecting the safety relief discharge of Linac and Cryomodule test stand is not the recovery helium but to create a helium atmosphere downstream the potential leaky safety relief valves.

Helium recovery system components
The primary components of the helium recovery system typically include:  2 recovery compressors from Girondin Sauer, each with helium compression capacity of 60 m 3 /h, figure 2;  Gas analysers for ensuring purity levels; one helium analyser for measuring content of pure helium content in impure helium in % range, one helium analyser to measure content of N2, H2O and CnHm content in pure helium in ppm range, a pyrolyser analyser to measure oil content in pure helium in ppb range;  High pressure bundles with a geometrical storage volume of 12 m 3 and maximum operation pressure of 200 barg to store recovered impure helium, figure 3;  High pressure valve distribution, figure 4;  100m 3 gas bag, figure 5;  Safety valve sealed by oil installed for gas bag for emergency venting. Set point 30mbar, figure 6; The recovery equipment and external purifier are placed in one of the compressor halls of the ESS cryo compressor building. Vaporized helium is recaptured through recovery lines and stored in the atmospheric pressure helium gas bag. The recovery compressors switch on and off according to hysteresis shown as figure 7 and switch position periodically in order to have the same operating hours. The high pressure impure gas is fed to high pressure bundles and can be purified separately in the LN2 cooled external purifier. Alternatively it can be supplied to the TICP internal purifier located in cold box skid and purified for subsequent liquefaction.

Commissioning, operational issues and continuous adjustment
As mentioned above, three cryoplants share the common recovery header. There are two safety relief headers in the compressor halls for the compressor system, one oil free safety relief header and one oil contaminated safety relief header. In the cold box hall there are two independent safety relief headers one for the TICP and one for the ACCP and TMCP combined. Additionally, a nitrogen relief header is available for the TICP to vent gaseous nitrogen from the LN2 pre-cooling stage and for all cryoplants impure gas vent from adsorber regeneration processes.
While this setup had cost and time saving advantages during the installation phase, some issues came up due to unexpected parallel commissioning and operation activities as explained in more detail in [4]. It soon became clear that when commissioning phase coincides with operation phases of equipment in the same place two major risks for the workers on site arise -exposure to flowing media involving high pressure and/or high or low temperatures and oxygen deficiency hazard (ODH). A strict mechanical LOTO (lock out tag out) procedure has been established and implemented, which helped prevent potential risks, but still unexpected events did happen.

ODH alarm triggered incident
One ODH incident happened when the ACCP dryer regeneration was tested the first time. The ACCP dryer is regenerated by supplying gaseous nitrogen to the ACCP dryer from the LN2 tank located outside of the compressor building. LN2 is evaporated and heated up in ambient vaporisors adjcent to the tank, then flows through the dryer, is heated up to 220 ℃ by a built-in heater, and finally released to the oil contaminated safety valve discharge header which is routed to a safe location outside the building.
One ODH sensor triggered the alarms in the whole compressor building during the regeneration process. Later operators also noticed the plastic tube which connected the TICP gas bag oil safety valve to safety relief header (see figure 5) was blown off.
The nitrogen release to compressor hall from this opening triggered the ODH alarm. The root cause was not quite obvious, as the pipe length from the T-piece to the safety location outside is about 20 m, while the pipe length from the T-piece to the oil safety valve is about 30 m with the same diameter. In addition, the oil safety valve for gas bag has set pressure of 30 mbar. This means the gas nitrogen should always go to the outside through the easier way with less pressure drop. But everthing is understandable when it was discovered that the discharge port to the outside was blocked by a welding plug, see figure  8, which is used to provide inert gas during the welding process. A welder forgot to remove this plug.

Pressure safety incident
Another incident occurred during a wrongly performed manual depressurization of the ACCP dryer. The gas should be released through a DN25 valve to the recovery system, not to the safety relief header discharging outside of the compressor building. But due to valve misoperation, a shock wave of the gas flow from the dryer, pressurised at 16 bar to the relief header was enough to break off the clamp that fixes the plastic hose to the plexiglass oil vessel acting as safety valve, see figure 9. A big amount of gas was released into the compressor hall, mixing with oil from the safety valve and triggering the fire alarm and ODH alarm simultaneously.
The incident showed that it was a mistake to have connected this gas bag safety valve to the main safety header.

Other events due to control valve malfunction or misoperation during parallel commissioning and operation activities
It already happened twice that a valve of a subsystem to the recovery system was left open or leaky when pumping on a subsystem resulted in pumping the gasbag, figure 10.
Other cases to the contrary, there is a non-return valve located on the sub-atmospheric line in the gas management skid for the ACCP and connected to the helium recovery header, with low opening pressure. One time during commissioning an over pressure during start-up of a compressor resulted in a lot of gas flow over the non-return valve to the recovery header. The flow was so high, it fully filled the gas bag, figure 11.

Potential risk when cryomodule test stand on line in near future
The discharge helium from the cryomodule test stand will also be collected via the recovery line in the gasbag. The safety relief header from cryomodule test stand to gasbag is very long and some elements, particularly piping just upfront the gasbag and non-return valves, are creating a substantial pressure drop when seeing flow. Some calculation were performed and indicated a pressure drop of up to 387 mbar at a discharge mass flow of 100 g/s from the test stand safety relief valve to the gasbag safety valve outlet. In order to reduce the pressure drop, a check valve upstream the gas bag has been removed, leading to the unfavourable events as described in section 3.1.3. This check valve contributed otherwise additional 220 mbar to the 387 mbar pressure drop in the entire recovery system.
On the other side, the cryomodules have an extremely low design pressure of only 1.04 barg. The cavities and their vessels are protected with two burst disks which are protected against the small variations of pressure with one safety relief valve and one controll valve. The outlets of both valves are connected to the safety recovery line. This means the opening of the relief valve is linked to the pressure of the recovery line. With the assumption that pressure of the safety recovery line is 1.1 bara, the pressure margin between burst disk and safety valve would be very small. Measures shall be taken to reduce the back pressure of the cryomodule safety valves to increase the pressure margin in order to limit the bursting risk of the burst disks membrane.

Measures to mitigate potential operation and commissioning risk
Some necessary measures have been or will be taken to prevent future potential risk:  Disconnecting gas bag oil safety valve from the main safety relief header, as the plastic hose connection is not safe and cannot withstand a pressure shock.  Redesign an independent safety relief line only for the gas bag relief. The safety relief header will be needed when the cryomodule safety relief valves from the tunnel are connected to the gas bag header.
 Redesign and reroute part of helium recovery line from the gas bag connection port to the helium recovery header, enlarge pipe diameter to reduce pressure drop along the pipe, aim to reduce pressure drop from cryomodule test stand to gasbag.  Include check valves at various recovery line connections to prevent pumping on the gas bag

Summary
In summer of 2018, the recovery system has started to be fully operational and fulfilled its key performance parameters and even over performs in certain areas, particularly the external purifier performance [5]. Now the recovery system is constantly in use and the purifiers operate several times every month to meet the requirement to purify impure helium from the three cryoplants and external customers.
There is still more work required to do, particularly in the operations phase. The helium recovery grid will be extended to the science instrumentation halls with the building infrastructure completion. Some necessary adjustments need to be implemented for the safety relief headers. Related design work has started and will enable the recovery system and safety relief system more beneficial and reliable in the future.