introduction to the lbds system and its functionality20 june 2012 b.goddard / j.uythoven lbds ups...

B.Goddard / J.Uythoven LBDS UPS review

Introduction to the LBDS system and its functionality

The function of the LHC beam dumping system is to fast-extract the beam in a low-loss way from each

ring of the collider and to transport it to an external absorber, positioned sufficiently far away to allow for appropriate beam dilution in order not to overheat the absorber material. Fast extraction will require a particle-free gap in the circulating beam, during which the field of the extraction kicker magnets can rise to its nominal value. Given the destructive power of the LHC beam, the dumping system must meet extremely high reliability criteria, which condition the overall and detailed design.

B.Goddard / J. Uythoven CERN TE/ABT

Input from:

W.Bartmann, L.Bruno, C.Bracco, E.Carlier, L.Ducimetière, D.Gerard, M.Gyr, J.M.Jimenez, N.Magnin, V.Mertens, A.Presland, L.Sarchiapone, R.Schmidt,

R.Veness, W.Weterings

and many others…

20 June 2012

B.Goddard / J.Uythoven LBDS UPS review 20 June 2012

The challenge

Is not just to dispose of the LHC beam…

…but to dispose of it

– quickly (within a few turns, i.e. 100-200 ms)

– safely (with an extremely low probability of dangerous failure)

– robustly (insensitive to expected machine/system failures)

– cleanly (with low distributed/uncontrolled losses)

– efficiently (without inducing extra machine down time, i.e. quenches)

– repetitively (re-usable dump block and protection devices)


MKD(15x)

MKD(15x)

MSD(3x5)

MSDA MSDC

MSD(3x5)

MSDA MSDC

TDETDE

MKB

MKBH

(4x)

MKBV

(6x)

MKB

MKBH

(4x)

MKBV

(6x)

MKBH

(4x)

MKBV

(6x)

Q5R

Q4R

Q4L

Q5L

TCDS

TCDQ

Beam 2

Beam 1

LHC beam dump principle (and acronyms)

Dump block

Dilution kickers

Extraction kicker

Extraction septum

Passive diluter

Passive diluter


TD62

TD68

UD62

UD68

UP62

UP68

UJ62

UJ68

UJ63

UJ67

RA67

UA67

RA63

UA63

Underground structures


TCDQ

[m]

Passive protection Passive protection

Extraction septa Extraction

kickers Dilution kickers Dump block + shielding

Entrance window Vacuum line

Plus beam position and loss monitors, and dedicated interlocking (not shown)

Layout of components


Extraction kickers (MKD)

• Redundancy (14 of the 15 kickers are needed to extract beam)

• Generators have two parallel discharge circuits, including two switches

• Fast High Current Thyristor (FHCT) solid-state switches

• Local capacitors remain charged and voltage constantly monitored.

• Erratic on one switch re-triggers other 14 switches within 700 ns (unsynchronised with gap)

• Redundant UPS system ensures correct dump in event of general power cut;

• All trigger and re-triggering lines are doubled.

• Check all systems operated correctly (redundant branches, triggering, current waveforms…)

Strip-wound

Core

Conductor

Ceramic vacuum

Chamber (coated)


Beam dump block (TDE)

• 700 mm graphite core, with graded density of 1.1 g/cm3 and 1.7 g/cm3

• 12 mm wall, stainless-steel welded pressure vessel, at 1.2 bar of N2

• Surrounded by ~1000 tonnes of concrete/steel radiation shielding blocks

0.7 m 3.5 m 3.5 m

1.7 g/cm 3 1.1 g/cm 3 1.7 g/cm 3

beam

600 mm1.2 bar N2

Entrancewindow

concreteshielding

graphite TDE

dump block

600 mm1.2 bar N2

Entrancewindow

concreteshielding

graphite TDE

dump block


System Safety

20 June 2012

• System safety is based on:

– Built in redundancy

– Continuous surveillance

– Post Operational Checks (IPOC/XPOC)

Redundancy

14 out of 15 MKD, 1 out of 2 MKD generator branches

Surveillance

Energy tracking, Retriggering

Redundancy

1 out of 4 MKBH, 1 out of 6 MKBV

Surveillance

Energy tracking

Surveillance

Energy tracking, Fast current change monitoring (MSD)

Redundancy

1 out of 2 trigger generation and distribution

Surveillance

Synchronization tracking

Surveillance

Reference energy taken from 4 Main Dipole circuits

TX/RX error detection Voting of

inputs


Dump synchronisation

0

0.05

0.1

0.15

0.2

0.25

0.3

-10 -8 -6 -4 -2 0 2 4 6 8 10

time [us]

MK

D k

ick

[m

rad

]

0

dump trigger

3.0 ms

particle-free

abort gap

Extraction kicker MKD deflection

Transient (3-89 ms) losses will occur: • If the dump trigger is not synchronised with the abort gap

• If the abort gap contains spurious particles

• If the MKD kick is not in tolerance

• If the local orbit is out of tolerance

LHC

Beam


Risk from particles in the abort gap

• Asynchronous beam dump or over-populated abort gap quench or damage

– Several failures possible (synchronisation, MKD erratic, abort gap repopulation)

• Precautionary measures include:

– Abort gap watchdog during the injection process, to inhibit injection with wrong phase

– Abort gap monitor and possibility of abort gap cleaning: in operation at full energy since 2012

– TCDS (fixed) – 6 m long diluter protects extraction septum

– TCDQ/TCS (mobile) – 7 m long diluter kept at about 7-8 s from the beam, at all times


Functional Architecture of 1 MKD

Generator

Two parallel

switches, full

redundancy in

each generator

4 triggers coming in

from BIS

(and 2 going out)

Surveillance of

voltage = kick

angle

See presentation

A.Antoine


Power Cut

20 June 2012

• In this case the beam will clearly need to be dumped because most

other equipment will stop working

• Beam dumping system kickers are on 2 parallel, redundant

Uninterruptable Power Supplies (UPS)

• UPS required:

– Trigger Synchronisation Unit needs power from UPS to start the trigger

of the beam dump

– All other power is stored in capacitors, ready to be ‘released’ at the moment of trigger

– Beams were correctly dumped:


Safety Study

20 June 2012

• Ph.D. thesis Roberto Filippini (CERN-THESIS-2006-054)

• FMECA analysis

– More than 2100 failure modes at component levels

Components failure rates from standard literature (Military Handbook)

– Arranged into 21 System Failure modes

• Operational Scenarios with State Transition Diagram for each Mission

= 1 LHC fill

• State Transition Diagram for Sequence of Missions and checks

Likelihood of any

unacceptable failure

Obligatory !

Availbility

Can learn a lot

from relative

numbers !


Reliability Run

0 50 100 150 200 2500

1

2

3

4

5

6

7

Days

Ene

rgy

TeV

Operation only below

5.5 TeV, due to MKB

break down

Operation ‘with

beam’ at injection

energy

Beam 1 Beam 2

# Pulses 23’534 15’469

Time considered 10.5 months 9.1 months

Continuous

running (p <13 h)

2.7 months 1.7 months

Data from 8/11/07 to 19/09/08

Beam 2

Beam 2

System pulses = 19 magnets


• 741’057 Magnet Pulses Analysed with IPOC and XPOC Systems

– > 10 years of operation

• Some hardware problems discovered Contact erosion on generators.

GTO stack surveillance. Replacement program and regular testing.

• No critical failures on the MKD system which would have resulted in a non-

acceptable beam dump even if redundancy would not be there

• No ‘asynchronous’ beam dumps were recorded (erratics). No missings.

• However, unexpected MKB breakdown Common failure mode by vacuum

• Global confirmation of assumed component failure rates

Reliability Run: Internal and External Post

Operational Checks (IPOC / XPOC)

MKD pulse


• Every beam dump (extraction) is automatically analysed

• Any out of tolerance kicker waveform, or more than usual beam

losses, will block the next injection

• Redundancy of signal paths for triggering checked at every beam

dump

• Kicker waveform failures can only be reset by the system experts

– Not the Engineer In Charge in the control room

– Not the piquet / technician from the standby service

• This provides the ‘as good as new’ assumption used in the

reliability calculations leading to SIL4 classification

Post Operational Checks


XPOC check of extraction kicker

15 MKD magnets, with 2 redundant

current pick-ups each, based on

different technologies Other XPOC checks


Safety critical aspects of the Dump System

• Signal from beam interlock system and triggering – No trigger = no beam dump

• Energy tracking – Potentially catastrophic (whole beam at “any” amplitude)

• Extraction kicker retriggering after single kicker erratic – No retriggering could put whole 7 TeV beam at ~10s

• Mobile protection device setting – Wrong w.r.t. orbit exposes LHC arc / triplets / collimators.

• System self-tests and post-mortem – Undetected ‘dead’ MKD severely reduces reliability

• Aperture, optics and orbit – Dump with bad orbit could damage extraction elements MSD, TCDS or MKB

• Extraction – dilution kicker connection and sweep form – Insufficient dilution could damage TDE, BTVDD and TDE entrance window

• Abort gap ‘protection’ – Beam in the abort gaps risks quench, or TCT/LHC damage if TCDQ position error

• Fault tolerance with 14/15 extraction kickers – The system is designed to operate safely with only 14 out of the 15 MKDs

Nearly all aspects need beam commissioning (validation or optimisation)


Summary and conclusion

• The LHC beam dump is a critical system for machine protection

– Safety has been built into the design from the start

– “Risk” inherent in using pulsed kicker magnet systems

• Conventional technological choices have been used

• Large redundancy, monitoring, failsafe components

• Areas for concern are known and are checked during operation

• Reliability analysis was useful tool for finding weaknesses

– Only as good as the system analysis and fault statistics…

• Reliability run proven to be useful

– Confirm reliability assumption and no critical failures

– Some discoveries used for follow-up before first beam

– Foreseen again, about 100 days, after Long Shutdown 1

• “No trigger = no dump”!

– This equation is still generally true!

– Efforts now being made to ameliorate effects of ‘beyond design’ failures

• Powering failure in combination with missing UPS still one of the main worries

introduction to the lbds system and its functionality20 june 2012 b.goddard / j.uythoven lbds ups...

Documents