Reliability Analysis of the 11T Dipole Quench Protection System

Transcription

1 Reliability Analysis of the 11T Dipole Quench Protection System Daniel Sollich TE-MPE-MI 4 th October 2018 Many thanks to Andrea Apollonio, Miriam Blumenschein, Fernando Menendez Camara, David Carrillo, Zinur Charifoulline, Reiner Denz, Felix Rodriguez Mateos, Jelena Spasic, Jens Steckert, Jan Uythoven, Daniel Wollmann

2 Content Introduction Reliability Target Modelling Results Conclusion and Outlook 2

3 Introduction Two 11T dipole full assemblies will replace two main dipoles in the HL-LHC upgrade One 11T dipole full assembly contains two 11T dipoles and one collimator between them A new superconductor, niobium-tin (Nb 3 Sn), is used for the 11T Dipole (The MBs use NbTi) The 11T dipole full assembly will be protected by quench heaters 16 (quench heater discharge power supplies) 16 quench heater circuits with 2 quench heater strips per circuit Collimator 11T Dipole 11T magnet coils made of Nb 3 Sn 11T Dipole 3

4 Introduction In case of a quench, 14 oo 16 have to fire the quench heater strips correctly in order to ensure the protection of the 11T Dipole 1. Question: Is the firing of the quench heaters at a quench event reliable enough? Analysis of the DYPQ rack of the main quadrupoles identified the entry (relay) as the most critical part for not firing the heater strips 2. Question: Has an additional redundant trigger-line in the a big impact on the system s reliability? 4

5 Frequency Reliability Target 1. Question: Is the firing of the quench heaters at a quench event reliable enough? Definition of the reliability target with the LHC risk matrix The LHC risk matrix determines the acceptable frequency of a specified failure mode on accelerator level LHC risk matrix 1 / hour 1 / day 1 / week 1 / month 1 / year 1 / 10 years 1 / 100 years 1 / 1000 years Recovery year month week day hours minutes Critical failure mode of the QPS (top event): 11T Dipole is unprotected at a quench event ( 3 oo 16 do not discharge) End effect: 11T Dipole destroyed and adjacent magnets damaged Recovery time: Order of magnitude of years Frequency: Second green box from the top, since many other systems contribute to this severity class The probability that the top event occurs in 1000 years must not exceed 10 % 5

6 Coupling 11T Dipole Quench Protection System Version Single -Control A Voltage Taps Local Circuit oo16 -Control ing of Thyristors - Discharge Capacitor Bank Quench Heaters B Voltage Taps Local Circuit Fired quench heaters:

7 Coupling 11T Dipole Quench Protection System Version Double -Control A Voltage Taps Local Circuit -Control ing of Thyristors Discharge Capacitor Bank Quench Heaters B Voltage Taps Local Circuit -Control ing of Thyristors

8 Failure Model Failure behaviour Exponential failure distribution constant failure rate Failure rates are based on operational data specifications of the manufacturer reliability prediction (MIL-HDBK 217Plus) Maintenance behaviour Some boxes are monitored immediate failure detection and repair (no hidden failures) Some boxes are tested once per year periodic maintenance every 4800 h ( 1 LHC year 200 days per year, 24 hours per day) 8

9 Failure Model Attribute Box Voltage Taps Source Local Manufacturer + MIL-HDBK Circuit Coupling Control Heater Strips MIL-HDBK MIL-HDBK Failures [-] (1) Units [-] Time [LHC years] required data to calculate the input for the model MTBF [LHC years] Maintenance Immediate Immediate Immediate Periodic Periodic Periodic Immediate Periodic 9

10 Failure Model Quench Rate Quench rate based on operational experience of the main dipoles (MB) 4 beam induced quench events per year for 1232 MB 5 magnets are quenched per quench event (4 adjacent magnets will also be quenched) QR MB = 5 4 quenches/year 1232 MB quenches MB year QR 11T Full Assembly = 2 QR MB 0.03 quenches year Conservative assumptions for the 11T Full Assembly 0.3 quenches per year 3 quenches per year 30 quenches per year Sequencing A quench has to occur after the QPS failed times 10 times 100 times

11 Fault Tree unprotected magnet 3 oo 16 do not discharge Top event: unprotected magnet + quench (A)symmetric quench 3 rd - 16 th does not discharge 1 st does not discharge 2 nd does not discharge 11

12 Fault Tree Version: Single -Control Version: Double -Control 1 -Control 2 -Control 1 does not discharge 1 does not discharge 12

13 Definitions Unreliability Unreliability is the probability that a system or component fails during a defined period of time under given functional and environmental conditions Failure Non-fulfilment of a function Gain Factor Reduction of the system s unreliability between the single and double -Control version 13

14 Results Top event: 3 oo 16 do not discharge + quench Reliability target: Unreliability in t = 1000 years 10 % Versions: Single Double -Control QR of MBs Quench Rate (QR) per assembly 0.03 quenches year 0.3 quenches year 3 quenches year 30 quenches year Unreliability for t = 1000 years Single [%] Double [%] Gain factor - Reduction of unreliability [-] Results: The redundant trigger-line has a minor impact on the reliability of the system Quench rate has a huge impact on the unreliability Best estimates The results meet the reliability target for both versions The results do not meet the reliability target for very high quench rates 14

15 Conclusion and Outlook 1. Question: Is the firing of the quench heaters at a quench event reliable enough? Taking into account the best estimate for the quench rate, the calculated unreliability meets the specified reliability target However, the unreliability is not acceptable assuming 30 quenches per year for one 11T Dipole Full Assembly 2. Question: Has an additional redundant trigger-line in the a big impact on the system s reliability? The trigger-line in the (-control box) is very reliable The gain in reliability between the two configuration (single double -Control) is very limited Outlook: The quench rate needs to be determined more accurately The reliability requirements of the 11T QPS will be established following the RIRE procedure in order to identify other critical failure modes for the complete system (RIRE procedure see TE-MPE-TM #

16

17 Coupling Coupling Coupling A B 11T Dipole Quench Protection System Version Single -Control Voltage Taps Local Local Circuit Circuit Circuit Voltage Taps Local Local Circuit Circuit Circuit Control ing of Thyristors -Control ing of Thyristors -Control ing of Thyristors - Discharge Capacitor Bank - Discharge Capacitor Bank - Discharge Capacitor Bank Heater Strips Heater Strips Heater Strips

18 Results Single Control Double Control 1. Row: Control optimistic FR (times 1) 2. Row: Control pessimistic FR (times 10) 3. Row: Control very pessimistic FR (times 100) Top event: 3 oo 16 do not discharge + quench Reliability target: Unreliability in t = 1000 years 10 % Versions: Single Double -Control Quench Rate 1 Quench 30years LHC operation 1 Quench 3 years LHC operation Unreliability for t = 1000 years Single [%] Double [%] Gain factor - Reduction of unreliability [-] 1, ,04 1,0249 1, Results: Gain factor increases slightly with the FR of -Control Influence of an increasing FR of -Control on the unreliability Version Single Major influence Version Double Minor influence 3 Quenches 1 LHC operation year ,0244 1, Quenches 1 LHC operation year ,0197 1,

19 reliability [%] Results Single Control Double Control TOP EVENT: 1 oo 16 fails 2 oo 16 fail Conditions: Single Control Control optimistic FR (times 1) Quench is not considered x oo 16 trigger failures 1 oo 16 2 oo 16 3 oo 16 Results: 10 % probability that 1 oo 16 fails within 2 LHC operation years 10 % probability that 2 oo 16 fails within 30 LHC operation years 6.98 % probability that 3 oo 16 fails within 1000 LHC operation years time [years] 19

20 Failure Model Failure rates of the boxes Attribute Voltage Taps Failures [-] 5 10 Units [-] Time [LHC years] Source [ / MIL-HDBK / Manufacturer] 7 MTTF [LHC years] 860 Maintenance Immediate Voltage Taps (1 of 2): Failures: 5 10 Local - Excluding 100 weak VTaps failures (increased resistance in the wire) No risk for the magnet, as long the VTap is checked with the redundant VTap Units: VTs - 12 VTaps per MB and 20 VTaps per MQ MBH: 37 VTaps per MBH cryo assembly (19 uqds A, 18 uqds B) - Pessimistic assumption: All VTaps have to work in order to detect a quench n_vtaps of MBH cryo assembly FR VTap Box = FR VTap = FR 2 VTap 37 2 Circuit Coupling Control Quench Heaters 20

21 Failure Model Failure rates of the boxes Attribute Voltage Taps Failures [-] Units [-] /4 Time [LHC years] Source [ / MIL-HDBK / Manufacturer] 7 3 MTTF [LHC years] Maintenance Immediate Immediate (1 of 2): Functions - Convert the voltage signal of the voltage taps - Quench Detection System - ing of the PhotoMOS Comparable board in LHC: input channels: 1 failure of 1636 boards in 609 days of operation MBH: 1 with max. 16 input channels: FR new Board = FR old Board 4 Local Circuit Coupling Control Quench Heaters 21

22 Failure Model- Manufacturer: MTBF = 200,000 h (other alternatives show higher values) Failure rates of the boxes Attribute Voltage Taps Local Failures [-] Units [-] Time [LHC years] Source [ / MIL-HDBK / Manufacturer] Manufacturer + MIL-HDBK (2 Diodes) MTTF [LHC years] Maintenance Immediate Immediate Immediate Local (1 of 4): - New PS no operation data available Coupling of the power supplies for the trigger circuit: - 2 Diodes: Low Frequ, Schottky Prediction with MIL-HDBK Monitoring: - Each local PS is monitored before the coupling Failure of a single local PS is detectable Circuit Coupling Control MIL-HDBK: Classification - Category: Diode, relay, transistor, etc. - Type: Type of diode, type of relay, etc. - Quantity huge influence on FR Default values for other parameters - e.g. temperature, cycling rate, etc. minor influence on FR Quench Heaters 22

23 Failure Model Circuit (1 of 16): - 1 PhotoMOS (Solid State Relays) Prediction with MIL-HDBK - 1 Resistor to monitor the current while triggering the - unit Prediction with MIL-HDBK Failure rates of the boxes Attribute Voltage Taps Local Circuit Coupling Control Quench Heaters Failures [-] Units [-] Time [LHC years] Source [ / MIL-HDBK / Manufacturer] Manufacturer + MIL-HDBK (2 Diodes) MIL-HDBK MTTF [LHC years] Maintenance Immediate Immediate Immediate PM 23

24 Failure Model Coupling (1 of 16): - 2 Diodes: LowFreq, Gen Purpose Prediction with MIL-HDBK Failure rates of the boxes Attribute Voltage Taps Local Circuit Coupling Control Quench Heaters Failures [-] Units [-] Time [LHC years] Source [ / MIL-HDBK / Manufacturer] Manufacturer + MIL-HDBK (2 Diodes) MIL-HDBK MIL-HDBK MTTF [LHC years] Maintenance Immediate Immediate Immediate PM PM 24

25 Failure Model Control (1 of 16): Failures: 0 - No failures in 9 years operation (including 2 years for LS1) - Assumption: First failure will occur tomorrow Failure rates of the boxes Attribute Voltage Taps Local Circuit Coupling Control Failures [-] (1) Units [-] Time [LHC years] Source [ / MIL-HDBK / Manufacturer] Manufacturer + MIL-HDBK (2 Diodes) MIL-HDBK MIL-HDBK MTTF [LHC years] Maintenance Immediate Immediate Immediate PM PM PM Quench Heaters 25

26 Failure Model (1 of 16): Failures: 90 failures in total - 65 failures of the mains switch (excluding mains switch failures of the old type) Failure Accelerator Fault Tracker von Reiner ( ) operation days - Failures: 8 - F3 Failures: 3 Failure rates of the boxes Attribute Voltage Taps Local Circuit Coupling Control Failures [-] (1) 90 Units [-] Time [LHC years] Source [ / MIL-HDBK / Manufacturer] Manufacturer + MIL-HDBK (2 Diodes) MIL-HDBK MIL-HDBK MTTF [LHC years] Maintenance Immediate Immediate Immediate PM PM PM Immediate Quench Heaters 26

27 Failure Model Failure rates of the boxes Attribute Voltage Taps Local Circuit Coupling Control Failures [-] (1) Quench Heaters Units [-] Time [LHC years] Source [ / MIL-HDBK / Manufacturer] Quench Heater Circuit (1 of 16): - 1 QH circuit consists of 2 QH strips for the MB and the MBH Failures: 10 MB-QH failures during the period from October 2007 to May QH strips per circuit for MB Units: 1232MB 4 QH circuits = 4928 units Manufacturer + MIL-HDBK (2 Diodes) 2 QH strips per circuit for MBH This period includes - Commissioning and re-commissioning - Quench trainings - LHC operation at 3.5 TeV and at 6.5 TeV MBH: Pessimistic Assumption: FR MBH = FR MB 10 MIL-HDBK MIL-HDBK MTTF [LHC years] Maintenance Immediate Immediate Immediate PM PM PM Immediate PM 27