Introduction to the LBDS system and its functionality

B.Goddard / J.Uythoven LBDS UPS review

Introduction to the LBDS systemand its functionality

The function of the LHC beam dumping system is to fast-extract the beam in a low-loss way from each ring of the collider and to transport it to an external absorber, positioned sufficiently far away to allow for appropriate beam dilution in order not to overheat the absorber material. Fast extraction will require a particle-free gap in the circulating beam, during which the field of the extraction kicker magnets can rise to its nominal value. Given the destructive power of the LHC beam, the dumping system must meet extremely high reliability criteria, which condition the overall and detailed design.

B.Goddard / J. Uythoven CERN TE/ABT

Input from:

W.Bartmann, L.Bruno, C.Bracco, E.Carlier, L.Ducimetière, D.Gerard, M.Gyr, J.M.Jimenez, N.Magnin, V.Mertens, A.Presland, L.Sarchiapone, R.Schmidt,

R.Veness, W.Weterings

and many others…

20 June 2012

B.Goddard / J.Uythoven LBDS UPS review20 June 2012

The challenge

Is not just to dispose of the LHC beam…

…but to dispose of it – quickly (within a few turns, i.e. 100-200 s)

– safely (with an extremely low probability of dangerous failure)

– robustly (insensitive to expected machine/system failures)

– cleanly (with low distributed/uncontrolled losses)

– efficiently (without inducing extra machine down time, i.e. quenches)

– repetitively (re-usable dump block and protection devices)


MKD(15x)MKD(15x)

MSD(3x5)

MSDA MSDC

MSD(3x5)

MSDA MSDC

TDETDE

MKB

MKBH(4x)

MKBV(6x)

MKB

MKBH(4x)

MKBV(6x)

MKBH(4x)

MKBV(6x)

Q5R

Q4R

Q4L

Q5L

TCDS

TCDQ

Beam 2

Beam 1

LHC beam dump principle (and acronyms)

Dump block

Dilution kickers

Extraction kicker

Extraction septum

Passive diluter

Passive diluter


TD62

TD68

UD62

UD68

UP62

UP68

UJ62

UJ68

UJ63

UJ67

RA67

UA67

RA63

UA63

~1500 m

Underground structures


TCDQ

[m]

Passive protection Passive protection

Extraction septaExtraction kickers

Dilution kickers Dump block + shielding

Entrance windowVacuum line

Plus beam position and loss monitors, and dedicated interlocking (not shown)

Layout of components


Extraction kickers (MKD)

• Redundancy (14 of the 15 kickers are needed to extract beam)

• Generators have two parallel discharge circuits, including two switches

• Fast High Current Thyristor (FHCT) solid-state switches

• Local capacitors remain charged and voltage constantly monitored.

• Erratic on one switch re-triggers other 14 switches within 700 ns (unsynchronised with gap)

• Redundant UPS system ensures correct dump in event of general power cut;

• All trigger and re-triggering lines are doubled.

• Check all systems operated correctly (redundant branches, triggering, current waveforms…)

Strip-wound Core

Conductor

Ceramic vacuumChamber (coated)


Beam dump block (TDE)

• 700 mm graphite core, with graded density of 1.1 g/cm3 and 1.7 g/cm3

• 12 mm wall, stainless-steel welded pressure vessel, at 1.2 bar of N2

• Surrounded by ~1000 tonnes of concrete/steel radiation shielding blocks 0.7 m 3.5 m 3.5 m

1.7 g/cm3 1.1 g/cm3 1.7 g/cm3

beam

600 mm1.2 bar N2

Entrancewindow

concreteshielding

graphite TDEdump block

600 mm1.2 bar N2

Entrancewindow

concreteshielding

graphite TDEdump block


System Safety

20 June 2012

• System safety is based on:

– Built in redundancy

– Continuous surveillance

– Post Operational Checks (IPOC/XPOC)

Redundancy

14 out of 15 MKD, 1 out of 2 MKD generator branches

Surveillance

Energy tracking, Retriggering

Redundancy

1 out of 4 MKBH, 1 out of 6 MKBV

Surveillance

Energy tracking

Surveillance

Energy tracking, Fast current change monitoring (MSD)

Redundancy

1 out of 2 trigger generation and distribution

Surveillance

Synchronization tracking

Surveillance

Reference energy taken from 4 Main Dipole circuits

TX/RX error detection Voting of inputs


Dump synchronisation

0

0.05

0.1

0.15

0.2

0.25

0.3

-10 -8 -6 -4 -2 0 2 4 6 8 10time [us]

MK

D k

ick

[mra

d]

0

dump trigger

3.0 sparticle-free

abort gap

Extraction kicker MKD deflection

Transient (3-89 s) losses will occur:• If the dump trigger is not synchronised with the abort gap• If the abort gap contains spurious particles• If the MKD kick is not in tolerance• If the local orbit is out of tolerance

LHC Beam


Risk from particles in the abort gap

• Asynchronous beam dump or over-populated abort gap quench or damage– Several failures possible (synchronisation, MKD erratic, abort gap repopulation)

• Precautionary measures include:– Abort gap watchdog during the injection process, to inhibit injection with wrong phase– Abort gap monitor and possibility of abort gap cleaning: in operation at full energy since

2012– TCDS (fixed) – 6 m long diluter protects extraction septum– TCDQ/TCS (mobile) – 7 m long diluter kept at about 7-8 from the beam, at all times


Functional Architecture of 1 MKD Generator

Two parallel switches, full

redundancy in each generator

4 triggers coming in from BIS

(and 2 going out)

Surveillance of voltage = kick

angle

See presentation A.Antoine


Power Cut

20 June 2012

• In this case the beam will clearly need to be dumped because most other equipment will stop working

• Beam dumping system kickers are on 2 parallel, redundant Uninterruptable Power Supplies (UPS)

• UPS required:– Trigger Synchronisation Unit needs power from UPS to start the trigger of the beam

dump

– All other power is stored in capacitors, ready to be ‘released’ at the moment of trigger

– Beams were correctly dumped:


Safety Study

20 June 2012

• Ph.D. thesis Roberto Filippini (CERN-THESIS-2006-054)

• FMECA analysis– More than 2100 failure modes at component levels

Components failure rates from standard literature (Military Handbook)

– Arranged into 21 System Failure modes

• Operational Scenarios with State Transition Diagram for each Mission = 1 LHC fill

• State Transition Diagram for Sequence of Missions and checks

Likelihood of any unacceptable failure

Obligatory !

Availbility

Can learn a lot from relative numbers !


Reliability Run

0 50 100 150 200 2500

1

2

3

4

5

6

7

D ays

Ene

rgy

TeVOperation only below 5.5 TeV, due to MKB break down

Operation ‘with beam’ at injection energy

Beam 1 Beam 2# Pulses 23’534 15’469

Time considered 10.5 months 9.1 months

Continuous running (p <13 h)

2.7 months 1.7 months

Data from 8/11/07 to 19/09/08

Beam 2

Beam 2

System pulses = 19 magnets


• 741’057 Magnet Pulses Analysed with IPOC and XPOC Systems– > 10 years of operation

• Some hardware problems discovered Contact erosion on generators. GTO stack surveillance. Replacement program and regular testing.

• No critical failures on the MKD system which would have resulted in a non-acceptable beam dump even if redundancy would not be there

• No ‘asynchronous’ beam dumps were recorded (erratics). No missings.

• However, unexpected MKB breakdown Common failure mode by vacuum

• Global confirmation of assumed component failure rates

Reliability Run: Internal and External Post Operational Checks (IPOC / XPOC)

MKD pulse


• Every beam dump (extraction) is automatically analysed

• Any out of tolerance kicker waveform, or more than usual beam losses, will block the next injection

• Redundancy of signal paths for triggering checked at every beam dump

• Kicker waveform failures can only be reset by the system experts– Not the Engineer In Charge in the control room

– Not the piquet / technician from the standby service

• This provides the ‘as good as new’ assumption used in the reliability calculations leading to SIL4 classification

Post Operational Checks


XPOC check of extraction kicker

15 MKD magnets, with 2 redundant current pick-ups each, based on

different technologiesOther XPOC checks


Safety critical aspects of the Dump System

• Signal from beam interlock system and triggering– No trigger = no beam dump

• Energy tracking– Potentially catastrophic (whole beam at “any” amplitude)

• Extraction kicker retriggering after single kicker erratic– No retriggering could put whole 7 TeV beam at ~10

• Mobile protection device setting– Wrong w.r.t. orbit exposes LHC arc / triplets / collimators.

• System self-tests and post-mortem– Undetected ‘dead’ MKD severely reduces reliability

• Aperture, optics and orbit– Dump with bad orbit could damage extraction elements MSD, TCDS or MKB

• Extraction – dilution kicker connection and sweep form– Insufficient dilution could damage TDE, BTVDD and TDE entrance window

• Abort gap ‘protection’– Beam in the abort gaps risks quench, or TCT/LHC damage if TCDQ position error

• Fault tolerance with 14/15 extraction kickers – The system is designed to operate safely with only 14 out of the 15 MKDs

Nearly all aspects need beam commissioning (validation or optimisation)


Summary and conclusion

• The LHC beam dump is a critical system for machine protection– Safety has been built into the design from the start– “Risk” inherent in using pulsed kicker magnet systems

• Conventional technological choices have been used

• Large redundancy, monitoring, failsafe components

• Areas for concern are known and are checked during operation

• Reliability analysis was useful tool for finding weaknesses– Only as good as the system analysis and fault statistics…

• Reliability run proven to be useful– Confirm reliability assumption and no critical failures– Some discoveries used for follow-up before first beam– Foreseen again, about 100 days, after Long Shutdown 1

• “No trigger = no dump”!– This equation is still generally true!– Efforts now being made to ameliorate effects of ‘beyond design’ failures

• Powering failure in combination with missing UPS still one of the main worries

Introduction to the LBDS system and its functionality

Documents

Transcript of Introduction to the LBDS system and its functionality