IPAC2022, Bangkok, Thailand
JACoW Publishing
ISSN: 2673-5490
doi:10.18429/JACoW-IPAC2022-MOPOMS046

RELIABILITY ANALYSIS OF
THE HL-LHC ENERGY EXTRACTION SYSTEMS
M. Blaszkiewicz ∗ , A. Apollonio, T. Cartier-Michaud,
B. Panev, M. Pojer, D. Wollmann
CERN, Geneva, Switzerland
Abstract
The energy extraction systems for the protection of thenew HL-LHC superconducting magnet circuits are basedon vacuum breakers. This technology allows a significant
reduction of the switch opening time and increases the reliability of the overall system with reduced maintenance needs.
This paper presents the results of detailed reliability studies
performed for these new energy extraction systems. The
study quantifies the risk of a failure preventing the proper
protection of a magnet circuit and identifies the most criticalcomponents of the system. To do this, the model considers
factors such as failure probabilities at the block or component level, different maintenance strategies, and repair
procedures. Reliability simulations were performed using
AvailSim4, a novel Monte Carlo code for availability andreliability simulations. The results are compared against thesystem’s reliability requirements and provide insights into
the most critical components.

INTRODUCTION
The Energy Extraction (EE) systems are essential elements for the protection of LHC’s superconducting circuits in case of magnet quenches. Following the transition
from the superconducting to the normal-conducing state,
the energy stored in the magnet rapidly transforms into heat
which can cause damage in a magnet, as report [1] shows.
Quenches in magnets are unavoidable and, as such, are an
accepted failure mode. The EE systems are responsible forextracting a maximum of the energy stored in the superconducting circuits upon receiving a signal from the Quench
Detection System (QDS) [2] or the power converter [3] via
the Powering Interlock Controller (PIC) [4]. The EE systems
react in several milliseconds after receiving the triggering
signal and redirect the circuit current into resistor banks thatdissipate the remaining energy stored in the circuit.
The new EE design for HL-LHC is conceived to offer
an even more resilient, reliable and maintenance-free solution that will cover the increased reliability requirements ofthe HL-LHC. The key design change is the circuit breakertechnology: the new systems are to use vacuum interruptersinstead of mechanical DC breakers. The new interruptersoffer maintenance-free operation, while ensuring a better
reaction time than other solutions [5, 6]. Detailed studies
have been performed to validate the compliance of the newHL-LHC EE systems to the protection and reliability requirements derived in section “RELIABILITY TARGET”.
∗ Research supported by the HL-LHC project

Table 1: Number of protection systems considered in thisstudy to derive the reliability targetMagnets

Protection

NumberInner Triplet Quadrupole
2 kA orbit correctors
600 A and 200 A highorder correctors
D1, D2

CLIQ + QH
EE

6×46×4EE
QH

5×42×4Total

19 × 4 = 76

The EE systems for HL-LHC will exist in two versions:
2 kA and 600 A. Both are based on similar hardware.

METHODOLOGY
The reliability model of the EE system was prepared andsimulated in AvailSim4 framework [7], a tool developed at
CERN for availability and reliability simulations. It offers ageneric Monte Carlo approach to predict system reliability
and availability, while allowing for the incorporation of additional custom strategies and protection measures, specificfor accelerator technologies.
The Monte Carlo approach requires performing numerous iterations, each simulating the system behavior over its
expected lifetime. The occurrence of simulated events isbased on failure probability distributions defined for eachcomponent based on experience, manufacturer data or themilitary handbook MIL-HDBK-217 [8].
The reliability model is described by a list of components,
their failure dependencies and a list of failure modes withfailure and repair probability distributions. Complex failure behaviors, as well as advanced repair and maintenancestrategies can also be defined. High/low system loads canbe simulated by means of so-called phases. In addition, periodic inspections and repair of minimal replaceable units
allow to closely reproduce the adopted maintenance strategies in use for machine protection systems. More details
about the methodology used with AvailSim4, a descriptionof the tool and instructions of its usage are available in [7].

RELIABILITY TARGETThe study focused on the critical failure of a missed energy
extraction upon the occurrence of a quench. Due to the highdegree of redundancy implemented in the system design,
this can only occur due to a combination of independent
failures in different components of the system. In case of aMC6: Beam Instrumentation, Controls, Feedback and Operational Aspects
T22: Reliability, Operability

MOPOMS046
747

Content from this work may be used under the terms of the CC BY 4.0 licence (© 2022). Any distribution of this work must maintain attribution to the author(s), title of the work, publisher, and DOI

13th Int. Particle Acc. Conf.
ISBN: 978-3-95450-227-1

Content from this work may be used under the terms of the CC BY 4.0 licence (© 2022). Any distribution of this work must maintain attribution to the author(s), title of the work, publisher, and DOI

13th Int. Particle Acc. Conf.
ISBN: 978-3-95450-227-1

IPAC2022, Bangkok, Thailand
JACoW Publishing
ISSN: 2673-5490
doi:10.18429/JACoW-IPAC2022-MOPOMS046

Figure 1: Functional block diagram of the new HL-LHC EE system.
missed energy extraction during nominal powering of thecircuit, magnet damage will demand an intervention for themagnet replacement. The target reliability for the HL-LHC
EE systems is derived from the LHC risk matrix defined in[9]. The recovery time is quantified to be in the order of one
month to one year. According to the risk matrix in use, thisyields an acceptable failure frequency of 1 in 100 years.
An additional safety margin is taken by defining the target
as follows: after 100 years of operation, the failure probability should be below 10%, or conversely the expected
system reliability is 90% after 100 years. The reliability target 𝑅𝑀 scaled to the system lifetime 𝑏= 20 years is defined𝑙20as follows: 𝑅𝑀 = 𝑟 𝑏 = 0.9 100 = 0.97914, where 𝑟 is thereliability target over 100 years. The reliability thresholdfor an individual system must comply with the overall target
when combined for 76 relevant systems (all systems which
failure may lead to a critical failure) listed in Table 1.
The reliability target 𝑅𝑆 for a single EE system is defined
11𝑛as 𝑅𝑆 = 𝑅𝑀
= 0.97914 76 = 0.999723, where 𝑛 is thenumber of considered systems. This value can be interpreted
as the maximum acceptable unreliability of 2.77 × 10−4 overa system lifetime of 20 years. Within each year, the LHC will

MOPOMS046
748

be operating for approximately 250 days – the operational
period is assumed to be of 120,000 hours.

MODEL DESCRIPTION
The model is defined as a group of interconnected components organized in a hierarchy that describes the entiresystem. Each physical component is assigned a failure rate,
provided as Mean Time To Failure (MTTF).
The developed reliability model is based on technical reports and the system functional description reported in [10].
The functional dependencies are presented in Fig. 1. Eachsystem consists of two redundant switches connected in series to the powering circuit of the magnet. Each switch
is contained in a physical cassette, a unit which is to be
removed and replaced upon switch failure.
A signal coming from the Quench Detection System(QDS) is provided to a High-Level Control Chassis (HLCC).
The signal is active-high and provided in parallel to bothswitches. A single switch involves operation of a dedicated
FPGA, a Pulse Train Thyristor Firing (PTTF) units, Inductive Dynamic Drive (IDD – triggering the interrupter) andthe Counter Current (CC – responsible for extinguishing theMC6: Beam Instrumentation, Controls, Feedback and Operational Aspects
T22: Reliability, Operability

IPAC2022, Bangkok, Thailand
JACoW Publishing
ISSN: 2673-5490
doi:10.18429/JACoW-IPAC2022-MOPOMS046

arc). FPGAs have a dedicated hardware link to exchange
information about their status.
The power for the system is supplied by two Uninterruptible Power Supplies (UPSs) with separate current breakers. When one UPS stops providing energy, the other one
takes over within milliseconds — capacitors in PTTFs haveenough energy to operate in the meantime. In case of apower shortage, switches also open preventively.

Monitoring & Repairs
The model distinguishes between detectable and blindfailures. A third monitoring approach, blind with passive
monitoring applies to entire switches. Each interrupter hasa dedicated opening sensor and a missing opening of aninterrupter would be detected. This improves the reliability
significantly, as each extraction effectively acts as a test of
the system.
As mentioned above, a large part of the Energy Extraction
system, i.e. the switches, are physically contained in twocassettes, which are minimal replaceable units. This strategy
of repairs reduces the intervention time and also implies thatall blind failures in a cassette will be parasitically removed
once it is replaced.

Additional Considerations
A mechanical spring at the level of the vacuum breaker
used to keep the magnet powering circuit closed is a fail-safe
component (not included in the model), as damage leads toan energy extraction. However, simulations of critical spring
failures have also been studied (results in an internal report
and the appendix of [11]). The transfer switch and UPS
are excluded from the model, as they are considered failsafe components (due to being surveyed by the PIC system).
Failures of the QDS fall outside the scope of this study. Coiland inductors failures were neglected based on operationalexperience. Optical fiber connections are excluded with only
a qualitative reliability assessment provided by experts (alsofail-safe, as failures cause an extraction).

RELIABILITY RESULTS
Figure 2 shows the simulated probability of failures ofthe system. The probability to have at least one failure in
one EE system in 20 years is below 3.13 × 10−5 which isbelow the target of 2.77 × 10−4 . The results leave one orderof magnitude for a margin in all tested parameter configurations and were obtained using conservative values of input
parameters (pessimistic mean time to failure values).
The system demand rate is the number of quenches detected by the QDS. Quenches are a relatively rare phenomenon, in the order of a few events per year combined.
Only during the circuit commissioning and magnet training
phase each magnet can experience several quenches overa few weeks. To account for this variability, the results of
the reliability analysis are presented as with Mean Time
To Energy Extraction (MTTEE) ranging from 320 to 6,000hours.

Figure 2: Probability of a critical failure occurring in 20years of operation.
As shown in Fig. 2, the system reliability meets the target
with a margin of one order of magnitude, even for the caseof inspections every three years, and by more than two orders of magnitude with annual inspections. In both cases,
the probability of a failure increases with the MTTEE. Performed extractions often allow for detection of blind failures
while the other switch provides the required functionality.
If there are less extractions, blind failures accumulate. In
simulations with annual inspections and yearly (average)
extractions, we see a change in the trend due to failures detected with an inspection and not extractions. Due to thecomputational weight and impracticability of such a scenario, simulation campaigns did not cover extractions every
3 years with the 3-years inspection period. It is expected tosee a similar dip.

CONCLUSION
The conducted reliability analysis confirms that the HLLHC design for the EE system meets the identified reliability
target. High reliability is obtained primarily thanks to a fully
redundant, fail-safe design and the implemented diagnostics
capabilities, which allow for timely interventions in case of
detected failures.
Monitoring of the values sent in optical channels could further improve the system reliability. Such a monitoring would
provide information on functioning of a separate switch andallow for faster diagnostics in case of loss of redundancy.
Results show impact of regular inspections performed on thesystem. Differences between 1-year and 3-year inspection
periods highlight the importance of periodic system checks,
which are vital for proper functioning of the system.
Furthermore, an important element to understand the HLLHC EE systems reliability is its redundant design. Leveraging the fact that each activation of the system acts as ade facto test of the system, allowing for the replacementof a potentially faulty switch, is a major factor shaping thesystem’s overall reliability.

MC6: Beam Instrumentation, Controls, Feedback and Operational Aspects
T22: Reliability, Operability

MOPOMS046749

Content from this work may be used under the terms of the CC BY 4.0 licence (© 2022). Any distribution of this work must maintain attribution to the author(s), title of the work, publisher, and DOI

13th Int. Particle Acc. Conf.
ISBN: 978-3-95450-227-1

Content from this work may be used under the terms of the CC BY 4.0 licence (© 2022). Any distribution of this work must maintain attribution to the author(s), title of the work, publisher, and DOI

13th Int. Particle Acc. Conf.
ISBN: 978-3-95450-227-1

IPAC2022, Bangkok, Thailand
JACoW Publishing
ISSN: 2673-5490doi:10.18429/JACoW-IPAC2022-MOPOMS046

REFERENCES[1] M. Bajko et al., “Report of the Task Force on the Incident of
19th September 2008 at the LHC”, CERN Report, 31 Mar,2009. https://cds.cern.ch/record/1168025[2] R. Denz et al., “Quench Detection and Diagnostic Systems
for the Superconducting Circuits for the HL-LHC”, in Proc.
IPAC’19, Melbourne, Australia, May 2019, pp. 4183–4186.
doi:10.18429/JACoW-IPAC2019-THPTS036[3] H. Thiesen et al., “High Precision Current Control for theLHC Main Power Converters”, in Proc. IPAC’10, Kyoto,Japan, May 2010, paper WEPD070, pp. 3260–3262.
[4] I. Romera, P. Dahlen, R. Mompo, B. Puccio, and M. Zerlauth,“A Retrospective View to the Magnet Interlock Systems at
CERN”, in Proc. IPAC’14, Dresden, Germany, Jun. 2014, pp.
4001–4003. doi:10.18429/JACoW-IPAC2014-THPRI097[5] R. Renz, D. Gentsch, H. Fink, P. Slade, M. Schlaug, “Vacuum
Interrupters – Sealed For Life”, in 19th Conference on Electricity Distribution, Vienna, 21-24 May, 2007, CIRED2007
Session 1, Paper No 0156.

MOPOMS046
750[6] Siemens Industry, Inc. “TechTopics No. 02: Loss of vacuum”, https://new.siemens.com/us/en/products/
energy/techtopics/techtopics-02.html[7] AvailSim4.
https://gitlab.cern.ch/availsim4/availsim4[8] “MIL-217 (1991) Military Handbook: Reliability Predictionof Electronic Equipment”, MIL-HDBK-217F, 2 December
1991, US Department of Defense, Washington DC.
[9] T. Cartier-Michaud, A. Apollonio, G.B. Blarasin, B. Todd,
and J.A. Uythoven, “Data-Driven Risk Matrices for
CERN’s Accelerators”, in Proc. IPAC’21, Campinas,SP, Brazil, May 2021, pp. 2260–2263. doi:10.18429/
JACoW-IPAC2021-TUPAB325[10] M. Bartosik, P. Borkowski, and F. Wojcik, “Ultra-fast hybrid systems for protecting direct current circuits with highmagnetic energy”, in Bulletin of the Polish Academy ofSciences: Technical Sciences, vol. 69, no. 2, 2021. doi:
10.24425/bpasts.2021.136743[11] M. Blaszkiewicz “Methods to optimize rare-event Monte
Carlo reliability simulations for Large Hadron Collider Protection Systems”, https://cds.cern.ch/record/2808520

MC6: Beam Instrumentation, Controls, Feedback and Operational Aspects
T22: Reliability, Operability