Reliability of the Quench Protection System for the LHC

s.c. Elements

F. Rodriguez-Mateos and Antonio Vergara(both TS now,

AT when the work was done)

SubWG on ReliabilityCERN

26 March 2004

References on the subject• “Reliability of the Quench Protection System for the LHC s.c. Elements”, PhD

thesis, Antonio Vergara Fernandez, Nov’03

• Accelerator Reliability Workshop, Grenoble, Feb’02: “Machine Protection and Interlock System for the LHC”, R. Schmidt

• European Particle Accelerator Conference EPAC, Jun’02: ”Reliability Analysis for the Quench Detection in the LHC”

• What do we hope to achieve for the LHC quench protection and beam availability?, F. Rodriguez-Mateos and A. Vergara, Chamonix 2003

• Reliability of the Quench Protection System for the LHC s.c. Elements, A. Vergara and F. Rodriguez-Mateos, Nuclear Instruments and methods, Section A, pre-print accepted, to be published

• CERN Machine Protection Working Group, Nov’01• External Review of the LHC Quench Protection System, Dec’01• CERN Electrical Enginnering Working Group, Jun’02• LHC Main Ring Committee (MARIC), Aug’02

Overview• Channels provoking a Power Abort in QPS:• Quench detectors: availability on demand (missing a quench is

dangerous!)

• False triggers (false quenches, spurious opening of breakers, accidental HDS discharge)

• Channels giving the QPS Power Permit:– Baseline:

• PP given only when 100% of the QPS system is available (including redundancies)

• PP from QPS is only considered by the PICs for the start-up, not during operation (only needed after a power abort)

• Estimations on expected global reliability:– Input data, boundary conditions

– Results: impact on designs (redundancy, powering, alternatives)

• Maintenance/monitoring strategies– Maintainability:

• Maximum repair period to reach desired reliability

QPS Reliability: Motivation• Why a reliability study?

– QPS is a fundamental system of the LHC directly related to:

• Commissioning Success.• Useful operational time.• Total lifetime and cost.

– Lack of experience and studies of reliability in this field.

• Where can the results be applied?– System Design.– Operational Strategy:

• Supervision.• Power permit and abort.• Inspection and repairs.

– Safety: hazard analysis.

QPS Dependability• Experience (mainly String-2, String-1 and also test benches) and

simulations have proven that QPS, when it is fully available, can assure the integrity of all the LHC superconducting elements.

• This dependability study includes:– Experimental and/or theoretical validation of the protection strategies.– Validation of the components under the expected radiation environment.– Reliability modelling using RESQP.

(REliability Software for Quench Protection Studies)

• Its calibration (not to forget!)– Optimisation of subsystem designs considering:

• Redundant Topologies.• Maintainability.• Space Constraints.• Machine Operation.• Cost.

– Sensitivity analysis– Outlook of the QPS maintenance strategy.– Estimation of the QPS impact on the overall LHC performance.

The study was applied to …

• Quench detectors

• Quench heater power supplies

• Energy extraction

• Designs: redundancies and voting schemes

• Preventive maintainability strategies

The results were applied to …

Redundant Quench Detectors: States

Logic

k-oo-n

Analog

n

4 Possible StatesFalse Quench

Missed Quench

Detector Available

Magnet Unprotected

Safe Failure. Downtime ( 5 h)

Main Failure. Downtime ( ??? h)

Dangerous Failure. Downtime (0 h)

AC-DC

DQQDL (MB, MQ): Maintainability (e.g. 2oo4)

•Maintenance: Inspection and Repair.Two possible checks foreseen:

• Coherency Check (CT): Flag showing ‘n’ channels coherency. PERMANENTLY AVAILABLE

k-oo-n

Flag

Flag=0 OK

Flag=1 WARNING Improves

false quench reliability if

repaired

• Quench Test (QT): Amplifier outputs after quench-test signal from CR.Quench Test

(required over the machine life)

Flag=0 Flag=1 => repair

Improves unprotected

magnet reliability

RESQP REliability Software for Quench Protection Studies

Markov Modeling

System Structure Function

FQ UM

Bath-Curve Poisson

Component Availability

Random Walk Renewal Theory

MQ Downtime

RESQPRESQP

- Reliability Data- Maintenance

- Expected Quench Rate- Maintenance

Failure ‘costs’

(weight function)

Machine StatusFault Trees

Failure Dependencies

Component Failure Screening

MIL-HDBK

Spec sheets

Manufact. data

DQQDL: Topology & Maintenance

Detected-Quench Reliability 99.1 % Monthly Quench Tests (id)

41 % Yearly Quench Tests (Test mode+repair)

(20 years)

0.6 – 1.2 2 Power Supplies

9 – 12 1 Power SupplyYearly False

Quenches

Monthly repair after wrong-coherency flag

Main Advantage: Maintainability

2016 units in LHC

QD 2k-oo-n

QD 1k-oo-n

Other Detector Families (1oo2 + double powering)

PGA

PGA

Calibration Switch DSP

PGA

PGA

Calibration Switch DSP

ADC

ADC

AC-DC

AC-DC

InstAmpl

InstAmpl

REF

C

SRAM

HTS

RES

InstAmpl

InstAmpl

REF

C

SRA

AC-DC

AC-DC Inner Triplet (DQQDT)Insertion Magnets (DQQDI)Corrector Magnets (DQQDG)

Current Leads (DQQDC)

QPS monthly tests are required…

Detected-Quench Reliability Detector Family

Quench Channels Yearly QT Monthly QT

False Quenches per Year

DQQDL 2016 0.412 0.991 9-12 DQQDI,T 180 0.801 0.991 4-7 DQQDG 418 0.932 0.997 6-9 DQQDC 1198 0.619 0.974 6-8 3812 0.1904 0.9536

Over 20 years

Energy Extraction

• Operation:– All facilities in a powering sub-sector open after a quench in the main

magnets.– High demand rate: 1530 demands/year/facility

• Failures:– Switch opening failure Solutions

– Accidental opening (e.g. of more than one branch in a 13kA facility) Spurious beam abort

• Maintenance:– Post-mortem data after quench very useful in this case– Scheduled tests

Fire arc quench heaters in MB/MQ

Open back-up device

13 kA 600 A

32 unitsin LHC

202 unitsin LHC

EE Reliability

SWITCH = 10-3

SWITCH = 10-4 No Fuse 3.7 % 0.03 %

FUSE = 1.210-5 h-1 3.5 % 0.03 %

FUSE = 1.210-6 h-1 0.98 % < 0.01 %

Monthly Tests

13 kA

600 A

Monthly Tests

Main Failure Probability over 20 years

15 demands/year/facility(4 quenches/week)

SWITCH = 10-3

SWITCH = 10-4 No Fuse 5.8 % 0.06 %

FUSE = 1.210-5 h-1 5.5 % 0.05 %

FUSE = 1.210-6 h-1 1.5 % 0.01 %

Third Switch < 0.01 % < 0.01 %

Sensitivity analysis is one of the powerfulfeatures of RESQP

(good relative precision)

Issues on EE reliability:• Post-Mortem analysis and monthly tests, together with

repairs are most necessary• For the 13kA facilities, decision was taken not to use

any backup device: if two of the breakers stay closed over the same branch, heaters are fired selectively

• For the 600A case, the use of a third switchgear (of equal type, only as a back-up) pays off even for “lower” quality devices.

• The advantages of these 600A breakers in front of the fuses are: cost and maintainability, as well as the fact that the latter are a better developed technology.

Conclusions on QPS ReliabilityProbability of protecting LHC S.C. elementsIN ALL quenches (20 years)

Conclusions: Maintenance Strategy

SummaryRepairs after a quench, before Power Permit, using PM

Repairs after monthly Quench Test (LHC QPS as good as new)

Room for possible collaborations(are they still needed?)

• UPC, Barcelona, Spain• Prof. Carrasco, Dep. d'Enginyeria Electrònica• http://www-eel.upc.es/~carrasco/carrasco.htm

• Politecnico di Milano, Italy• Prof. Zio, Dipartimento di Ingegneria Nucleare• Montecarlo, safety-oriented, nuclear applications