04/19/23 Roberto Filippini AB-BT 1

Topics of the Presentation

• The operational scenario• Re-analyzing the model for the beam losses.• Updating the model.

– Beam loss and normal conclusion.

• The general model.– Some approximations for managing complexity.

• Trading-off safety performance (a case study).• Conclusions.

04/19/23 Roberto Filippini AB-BT 2

System DescriptionOperational Scenario

04/19/23 Roberto Filippini AB-BT 3

The Beam Loss ModelBasic Assumptions

The model.– The system includes the BLM, the BICs, the beam permit loop and the

LBDS. The BEM is included in the LBDS.

– The BIC6 is kept separated from the other BICs, for the function of sending a dump request to the LBDS.

– Failure rates are assumed constant.

Beam Losses– The likelihood of having beam losses at a certain portion is uniformly

distributed along the ring and involves only one BLM at a time.

– Beam losses average rate is assumed 1/48h (200days).

Analysis.– The probability of being available at the time of a beam loss (continuous

operation, no planned dump requests).

04/19/23 Roberto Filippini AB-BT 4

The Beam Loss ModelModeling the Beam Loss Event

Probability of the number of beam loss events respect to time t

tn

BL BLen

tntNP

!

)())((

20 40 60 80 100t

0.005

0.01

0.015

0.02

pBLt

20 40 60 80 100t

0.2

0.4

0.6

0.8

PBLt20

4060

80100

Missions1000

2000

3000

4000

timeh00.020.040.060.08

prob

2040

6080

100

Missions

tBLBL

BLetp )(

tBL

BLetP 1)(

Distribution of a single beam loss

Probability a beam loss occurred in[0,t]

Beam Loss Events

04/19/23 Roberto Filippini AB-BT 5

The Beam Loss ModelMarkov Chain

StatesX0 System available

X1 System available at the time of a beam loss

X2 System no more available for a beam loss

X3 Beam loss and system no available

Parameters

BL Beam loss rate Markov Chain

BLMxyBICxLoopBICLBDS 6

04/19/23 Roberto Filippini AB-BT 6

The Beam Loss ModelResults

Event/Failure Rate

Beam loss 1/48h

BLMxy 10-6/h

BICx 10-6/h

BIC-6 10-6/h

P.Loop 10-6/h

LBDS 10-6/h

P(X3): System not available at a Beam loss

P(X3): Mean System Unreliability after 100 missions of mean duration T = 48h

Model parameters setting

20 40 60 80 100missions

0.0020.0040.0060.0080.01

0.0120.014

1RtT1 T2 Tn

E{T i+1 – Ti }= 48h

E{N(t)} = 100, (t = 4800h)

50 100 150 200mission timeh0.00005

0.0001

0.00015

0.0002

1St1-R(t)

1-R(m)

04/19/23 Roberto Filippini AB-BT 7

The Beam Loss ModelComments

About the model:• The single mission terminates at a beam loss and restarts only if it has

been successfully terminated.• The overall process (one year) is a sequence of dump requests at the

time of the beam loss. It is a Markov renewal process.What is to update:1. The mission has a finite duration T due to the planned dump requests:2. The system configuration at a planned dump requests is in part

different form the configuration needed for a beam loss.

04/19/23 Roberto Filippini AB-BT 8

Updating ModelBeam Loss and Planned Dump Requests

StatesX0 System available

X1 System not available for a beam loss

X2 System not available for a planned dump request (DR)

X3 System no available for a planned DR and a beam loss

X4 System failed at a beam loss

X5 Safe beam dump at a beam loss

Parameters

01 BLMxy OR BICx failed

02 BIC1 failed

23 BLMxy OR BICx failed

13 LBDS OR Permit Loop OR BIC6 OR BIC1

03 LBDS OR Permit Loop OR BIC6

Markov Chain

04/19/23 Roberto Filippini AB-BT 9

Updating ModelResults at the End of a 10h Operation

20 40 60 80 100 120 140Missionaborts

0.010.020.030.040.050.06

Prob

Unavailable at a planned dump

request at any time: P(X2)+P(X3) Unavailable at a beam loss occurred in [0,10] : P(X4)

Mission aborts distribution due to a beam loss (1/48h) over 400 missions

Probability of unsafe dump at time t=10

At time t =10h the unavailability of the system BIC1-Permit Loop-BIC6-LBDS is added

2 4 6 8 10mission timeh1 106

2 106

3 106

4 106

1St1-R(t)

2 4 6 8 10mission timeh5106

0.000010.0000150.00002

0.0000250.00003

1St1-R(t)

2 4 6 8 10 12mission timeh0.00001

0.00002

0.00003

0.000040.00005

1St1-R(t)

04/19/23 Roberto Filippini AB-BT 10

Updating ModelComments

About the model:• More realistic reliability figures are

obtained.• Reliability over 1 year involves a more

complex renewal process.• System is as good as new at the start of a

mission.• Surveillance (BET, etc…) not yet included.The next step: to include surveillance:• Benefits: reduction of the system failure

rate. • Drawbacks: generation of dump requests. Approximations are necessary for

managing complexity.1. For the reliability of a single operation.2. For the reliability over one year.

Beam Loss Model: Unreliability over 400 missions (10h each)

Beam Loss and Planned dump requests Model: Unreliability over 400 missions (10h each)

100 200 300 400missionsh0.002

0.0040.0060.0080.01

0.0120.014

1Rm

100 200 300 400missions

0.00250.005

0.00750.01

0.01250.015

0.01751Rm

04/19/23 Roberto Filippini AB-BT 11

The Model Including SurveillanceAssumptions

Assumptions during a single mission• A1: The probabilities are evaluated at time t = T.• A2: All the cases leading to a dump requests are modeled and analyzed

separately.• A3: The system reliability R(T) is calculated with respect to the system

configuration at the time of a dump request.Assumptions over one year• A4: The system is as good as new after the check (no aging and wearing).• A5: We assume 400 LHC operation cycles per year (average).

The approximations 1,2,3 lead to a lower bound for the system reliability over one mission. The assumptions 4 can be relaxed.

04/19/23 Roberto Filippini AB-BT 12

The General ModelPutting All Together

)()()(

...)(

)()()(1)()()(

400

400...1400

onscontributiOther

52

5...21

request dumpPlanned

11

TRTRTR

TP

TRTPTPTRTPTR

nnn

kk

kkk

04/19/23 Roberto Filippini AB-BT 13

MKDA Case Study (EPAC Paper)

• Analysis of safety and average number of false dumps of the MKD (LBDS) over one year.

04/19/23 Roberto Filippini AB-BT 14

The MKD ModelRedundancy, Surveillance, Post mortem

Not-Homogeneous Markov Chain

StatesX0 System available

X1 BET failed, no more surveillance

X2 Dump request, safe mission aborts

X3 System failed unsafe

Parameters BET failure (failed silent)

Powering failure, surveillance fail safe modes (channels)

Power triggers, switches, magnets failure (above redundancy)

Every failure in the system

04/19/23 Roberto Filippini AB-BT 15

MKD AnalysisAssumptions

Modeling assumptions1. BEM, triggering and re-

triggering systems have not been included.

2. The data acquisition channels going to the BET are identical and fail always safe (dump request).

3. Constant failure rates.4. The length of an LHC

operation (the mission) is 10h.5. After the post mortem the

system is as good as new.

Components Failure rates/h

Capacitors 1x10-6 (1) 1x10-5(2)

Power triggers, switches 1x10-5

Power supplies 1x10-5

Magnets 1x10-6

Channels 1x10-6

BET 1x10-8

04/19/23 Roberto Filippini AB-BT 16

MKD AnalysisResults Over One Year (400 Missions)

2 4 6 8 10 12 14Mission aborts

0.05

0.1

0.15

0.2

0.25

Prob 12

Probability of MKD system failure

(a) Default case 4.2x10-6

(b) No post mortem 2.7x10-3

(c) No generator redundancy 3.4x10-3

(d) No surveillance 5.4x10-3

Distribution of mission aborts

(1) Capacitors failure rate 1x10-6 2 average

(2) Capacitors failure rate1x10-5 6 average

04/19/23 Roberto Filippini AB-BT 17

Conclusions

• The beam loss model was updated considering the conclusion due to a planned dump request

• The model is very compact although complex in the transition rates.

• To manage things at higher level needs approximations.

• The next steps:– To analyze the contribution of surveillance in terms of safety gain

and false dumps per year as shown for the MKD system.

– Sensitivity analysis and trade-off studies (safety against false dumps) of the most critical systems.