1. Reliability of the Quench Protection System for the LHC s.c. Elements F. Rodriguez-Mateos and Antonio Vergara (both TS now, AT when the work was done) SubWG on Reliability CERN 26 March 2004

2. References on the subject “Reliability of the Quench Protection System for the LHC s.c. Elements”, PhD thesis, Antonio Vergara Fernandez, Nov’03 Accelerator Reliability Workshop, Grenoble, Feb’02: “Machine Protection and Interlock System for the LHC”, R. Schmidt European Particle Accelerator Conference EPAC, Jun’02: ”Reliability Analysis for the Quench Detection in the LHC” What do we hope to achieve for the LHC quench protection and beam availability?, F. Rodriguez-Mateos and A. Vergara, Chamonix 2003 Reliability of the Quench Protection System for the LHC s.c. Elements, A. Vergara and F. Rodriguez-Mateos, Nuclear Instruments and methods, Section A, pre-print accepted, to be published CERN Machine Protection Working Group, Nov’01 External Review of the LHC Quench Protection System, Dec’01 CERN Electrical Enginnering Working Group, Jun’02 LHC Main Ring Committee (MARIC), Aug’02

3. Overview Channels provoking a Power Abort in QPS: Quench detectors: availability on demand (missing a quench is dangerous!) False triggers (false quenches, spurious opening of breakers, accidental HDS discharge) Channels giving the QPS Power Permit: –Baseline: PP given only when 100% of the QPS system is available (including redundancies) PP from QPS is only considered by the PICs for the start-up, not during operation (only needed after a power abort) Estimations on expected global reliability: –Input data, boundary conditions –Results: impact on designs (redundancy, powering, alternatives) Maintenance/monitoring strategies –Maintainability: Maximum repair period to reach desired reliability

4. QPS Reliability: Motivation Why a reliability study? –QPS is a fundamental system of the LHC directly related to: Commissioning Success. Useful operational time. Total lifetime and cost. –Lack of experience and studies of reliability in this field. Where can the results be applied? –System Design. –Operational Strategy: Supervision. Power permit and abort. Inspection and repairs. –Safety: hazard analysis.

5. QPS Dependability Experience (mainly String-2, String-1 and also test benches) and simulations have proven that QPS, when it is fully available, can assure the integrity of all the LHC superconducting elements. This dependability study includes: –Experimental and/or theoretical validation of the protection strategies. –Validation of the components under the expected radiation environment. –Reliability modelling using RESQP. (REliability Software for Quench Protection Studies) Its calibration (not to forget!) –Optimisation of subsystem designs considering: Redundant Topologies. Maintainability. Space Constraints. Machine Operation. Cost. –Sensitivity analysis –Outlook of the QPS maintenance strategy. –Estimation of the QPS impact on the overall LHC performance.

6. The study was applied to … Quench detectors Quench heater power supplies Energy extraction Designs: redundancies and voting schemes Preventive maintainability strategies The results were applied to …

7. Redundant Quench Detectors: States Logic k-oo-n Analog n 4 Possible States False Quench Missed Quench Detector Available Magnet Unprotected Safe Failure. Downtime (  5 h) Main Failure. Downtime (  ??? h) Dangerous Failure. Downtime (0 h) AC-DC

8. DQQDL (MB, MQ): Maintainability (e.g. 2oo4) Maintenance: Inspection and Repair. Two possible checks foreseen: Coherency Check (CT):Flag showing ‘n’ channels coherency. PERMANENTLY AVAILABLE k-oo-n Flag Flag=0 OK Flag=1 WARNING Improves false quench reliability if repaired Quench Test (QT):Amplifier outputs after quench-test signal from CR. Quench Test (required over the machine life) Flag=0 Flag=1 => repair Improves unprotected magnet reliability

9. RESQP REliability Software for Quench Protection Studies Markov Modeling System Structure Function FQ UM Bath-Curve Poisson Component Availability Random Walk Renewal Theory MQDowntime RESQP - Reliability Data - Maintenance - Expected Quench Rate - Maintenance Failure ‘costs’ (weight function) Machine Status Fault Trees Failure Dependencies Component Failure Screening MIL-HDBK Spec sheets Manufact. data

10. DQQDL: Topology & Maintenance Detected-Quench Reliability 99.1 % Monthly Quench Tests (id) 41 % Yearly Quench Tests (Test mode+repair) (20 years) 0.6 – 1.2  2 Power Supplies 9 – 12  1 Power Supply Yearly False Quenches Monthly repair after wrong-coherency flag Main Advantage : Maintainability 2016 units in LHC QD 2 k-oo-n QD 1 k-oo-n

11. Other Detector Families (1oo2 + double powering) PGA Calibration Switch DSP PGA Calibration Switch DSP ADC AC-DC Inst Ampl Inst Ampl REF CC SRAM HTS RES Inst Ampl Inst Ampl REF CC SRA AC-DC Inner Triplet (DQQDT) Insertion Magnets (DQQDI) Corrector Magnets (DQQDG) Current Leads (DQQDC)

12. QPS monthly tests are required… Over 20 years

13. Energy Extraction Operation: –All facilities in a powering sub-sector open after a quench in the main magnets. –High demand rate:  15  30 demands/year/facility Failures: –Switch opening failure  Solutions –Accidental opening (e.g. of more than one branch in a 13kA facility)  Spurious beam abort Maintenance: –Post-mortem data after quench  very useful in this case –Scheduled tests Fire arc quench heaters in MB/MQ Open back-up device 13 kA600 A 32 units in LHC 202 units in LHC

14. EE Reliability Monthly Tests 13 kA 600 A Monthly Tests Main Failure Probability over 20 years 15 demands/year/facility (4 quenches/week) Sensitivity analysis is one of the powerful features of RESQP (good relative precision)

15. Issues on EE reliability: Post-Mortem analysis and monthly tests, together with repairs are most necessary For the 13kA facilities, decision was taken not to use any backup device: if two of the breakers stay closed over the same branch, heaters are fired selectively For the 600A case, the use of a third switchgear (of equal type, only as a back-up) pays off even for “lower” quality devices. The advantages of these 600A breakers in front of the fuses are: cost and maintainability, as well as the fact that the latter are a better developed technology.

16. Conclusions on QPS Reliability Probability of protecting LHC S.C. elements IN ALL quenches (20 years)

17. Conclusions: Maintenance Strategy Summary Repairs after a quench, before Power Permit, using PM Repairs after monthly Quench Test (LHC QPS as good as new)

18. Room for possible collaborations (are they still needed?) UPC, Barcelona, Spain Prof. Carrasco, Dep. d'Enginyeria Electrònica http://www-eel.upc.es/~carrasco/carrasco.htm Politecnico di Milano, Italy Prof. Zio, Dipartimento di Ingegneria Nucleare Montecarlo, safety-oriented, nuclear applications