1. C. M. Piaszczyk, 1999 Particle Accelerator Conference D. FinnleyISIS data L Hardy, Lots of stuff…… P. Pierini, Lots of stuff…… Seung J. RheeProceedings of Design Engineering Technical Conference, 2003 P. K. SiggRELIABILITY OF HIGH BEAM POWER CYCLOTRON RF-SYSTEMS AT PSI W. Gudowski Why Accelerator-Driven Transmutation of Wastes Enables Future Nuclear Mechanical reliability Electronic reliability RELIABILITY Redundancy (40’s) Derating (40’s) Failure Mode and Effects Analysis (60’s) R. Seviour

2. Aim to provide a service to the national grid Beam trips significant neutron flux driver in a ADS reactor. Beam trips have two major consequences for the target: first, thermal shock and, second, the necessity to use on the secondary side of the heat exchanger cooling water at a temperature higher than the melting point of the coolant, in order to prevent coolant in the circuit from solidifying. Also prediction of beam trips needed for maintenance scheduling, spare parts procurement, Lots of workshops over last 10 years on reliability for ADS systems (nothing on FFAG) In Europe most prolific; P. Pierini (INFN), L. Hardy (ESRF) ADSR’s…

3. “….The problem of the few long beam trips per year that are expected can be solved with equipment redundancy.” Accelerator-driven Systems (ADS) and Fast Reactors (FR) in Advanced Nuclear Fuel Cycles NUCLEAR ENERGY AGENCY ORGANISATION FOR ECONOMIC CO-OPERATION AND DEVELOPMENT “The super-conducting linac design is derived from the experience gained at CERN, TJLab, and DESY, …. …strong proof that the expectations of improved reliability, and reduced capital and operational cost have to be considered as fully realistic.” “…trips caused by sparking and similar (non-failure) events can be reduced to a time scale <100 milliseconds, and would have practically zero impact….”

4. Reliability engineering: estimating, controlling and managing, ….the probability of failures in complex systems. Technical complexity of systems mean it is not enough to specify and allocate the reliability of components to predict the reliability of the system. What is…

5. Formal mathematical and statistical methods can be applied to measure and assess reliability characteristics of components, but the associated uncertainties are high, leading to reliability estimates with limited credibility (...) the role of mathematical and statistical methods in reliability engineering is limited, and appreciation of the uncertainty is important in order to minimize the chances of performing inappropriate analysis and of generating misleading results. (…) practical engineering must take precedence in determining the causes of problems and their solutions [PDT O’Connor]

6. However… There exist design principles to achieve a reliable system: Derating: Operate components below max rating Redundancy: Provide more components with a given function Fault Tolerance: Component failure do not imply system failure Mathematical and statistical methods for reliability assessment teach us that the reliability of a complex system depends not only by the component specifications, importantly, by the logical and functional connections (role of redundancies and spares) In other words, proper planning of redundancies allows building reliable systems out of moderately reliable components

7. Predictive Methodologies Top-Down / Deductive Need detailed info about components and connections Need “solid” database of components Most common: Reliability Block Diagram (RBD) Layout of RBD usually depends on system state! Fault Tree Analysis (FTA) Determine all component faults that lead to given system fault Methods for availability allocation and maintenability Integrated Logistic Support (ILS) Logistic Support Analysis (LSA) Bottom-Up / Inductive Failure Mode and Effects (Criticality) Analysis (FMEA/FMECA) Can be performed with expert judgment on relative criticality of components Can be performed also with less detail in design

8. - Availability : Fraction time system meets its specification. - Reliability : probability system performs intended function for a specified time interval - Mean Time Between Failure (MTBF): mean time system performs to spec, during a given time interval. - Mean Down Time (MDT): Mean time system is unavailable due to a failure. Repair time plus all delays associated with the repair (finding the spare part, etc). - Mean Time To Repair (MTTR): sum of corrective maintenance time divided by the total number of failures during a given time interval. May include waiting for radiation decay. Terminology

9. Identification of possible failure modes of each component Listing of all the envisaged faults Analysis of the effects of the component fault on the performance of system Identification of preventive and corrective actions Severity ranking of the faults Relative frequency of faults Failure Mode and Effects Analysis (FMEA) The purpose of the FMEA is to take actions to eliminate or reduce failures, starting with the highest-priority ones. Failures are prioritized according to how serious their consequences are, how frequently they occur and how easily they can be detected. Component data has only a limited role on system reliability, nature of connection is important!

10. Accelerator components two categories: “Industrial” components e.g. cooling, vacuum, cryogenics, electrical power supplies Data is available from other areas of application (e.g. fission/fusion, aerospace industry or available information from research organizations or companies) 10

11. Accelerator components two categories: “Special” components RF cavities, klystrons, optics components, etc. Reliability parameters are inferred on the basis of information available –from vendors –from previous studies (where applicable), –from existing facilities operational data analysis for most of them a sort of engineering/expert judgment is envisaged in order to reach an appropriate evaluation, suitable for the reliability analysis

12. FMEA in the design process

13. - P. Pierini Credibility of input data is one of the most serious issues when performing accelerator reliability and availability analysis, applying current methods and tools While it is possible to use reliability theory to model accelerator systems, there does not exist, up to now, a formal reliability database for accelerator components available, leading thus to large uncertainties in the results At each accelerator laboratory large datasets of information are regularly collected about the failures occurred … are not actually organized in a consistent database, and preliminary estimations on the manpower required for their organization and harmonization has, until now, slowed all the efforts directed in this sense… credible failure and repair rates, especially for one-of-a-kind large complex system such as an accelerator facility, are not readily available

14. Downtime of Accelerator Due to Power Supply Failure Failure Frequency and Downtime of Electromagnets Magnet failures (1997 to 2001), SLAC CATER system. FMEA Analysis

15. SINQ P SOURCE 870-keV Injector 72 MeV cyclotron Main Ring 590 MeV cyclotron 1.8 mA intensity protons 590 MeV 1.2 mA to target. beam power ~ 1 MW (has in past been considered for ADS)

16. SINQ Operating statistics of the year 1997 - 600 hours (unscheduled interruts > 4 hrs), - 11% of the planned beam time RF problems 220 hrs. 4% of the planned beam time. Water leaks at bending magnet coils 280 hrs, Failures of vacuum seals between 100 hrs. The rest problems or failures fixed in < four hours. < 1 min not included, sparking at beam splitters, injection and extraction septa, inside RF- cavities or on coupling elements fast recovery, and all other beam- or safety interlocks (typically 1600 per week).

17. Sparking in cavities (including windows): -Short duration, Automatic recovery. Number of sparks a window can handle safely is limited! - Failures of coupling windows: usually of long duration: V. bad if coinciding with cracking of ceramic (vacuum leak  forced filling of cyclotron with air. - Water leaks of coupling loops in vacuum. can take several weeks before the sparking rate of the cavities is down to the 'normal‘ value (conditioning !). RF system component failures: - systems with limited lifetime: ( < 3yrs); e.g.: power tubes, RF cavity windows - systems with 'unlimited' lifetime (> 3yrs): No scheduled replacement during expected lifetime of cyclotron; e.g.: power supplies, air/water cooling systems, control systems, tuning systems, RF power amplifiers, etc. RF System faliures

18. Ways to reduce contribution of RF-sparking to total beam-off time: a)Reduce the absolute number of sparks per unit time: - conditioning cavities: very time-consuming process, has to be repeated after each vacuum breaking. Back filling the cyclotron with nitrogen. b) Analyse sparking mechanisms in cavities and on coupling windows, try to reduce induced damage on ceramic windows c) Multipacting phenomena in cavities can be a serious problem: in SINQ, they can prevent RF turn-on for up to ½ hr after a spark; some cavities may even become impossible to turn on. Special measures used, coating critical areas inside a cavity. The RF System Improvement Program

19. Beam interruption distribution > 1 minute 2001 Large downtime: A few events only -Cooling: missing redundancy -Magnets: savings on spare parts, time consuming repairs -RF: use components until it fails According to PSI: no technological obstacles. More a financial problem: -Replace 25-year old power supplies (in progress) -Fully assembled spare parts for magnets (in progress) -Redundancy of cooling water plant (to be decided) -Better interchangeability of sub-equipment to decrease MTTR

20. What about short trips / reliability ? Short interruptions < 1 min. : 10000 trips per year (1% of the beam time) : 20 s to ramp and recover nominal intensity. Electrostatic elements: most of the beam trips. Critical as the power increases (1.5 -> 1.8 mA). Behaviour of electrostatic elements is far from understood. R&D is needed (sensitivity to RF-leakage, surface physics, beam halo,.) (Extensive R&D work is carried out to understand RF arcs caused by microparticle contaminants, e.g:Werner et al.) Werner et al. PAC 2001 proceedings

21. When the failure is there: reduce the Mean Down Time Improved fault diagnostics and event data logging Ready-to-operate units available (spare parts) Design for fast interchangeability of equipment Modular design at all levels This policy applied at PSI dramatically increased their reliability / availability. Mainly required ideas, manpower, willingness to improve and RE- design P. Sigg/PSI

22. FFAG ADSR – Unique RF system Low Q structures (~1), 200 KeV per cavity, 10 cm Iris Novel EM fields required 30-40 MHz sweep (Multiple Big RF structures) ~ GHz Harmonic Jumping (Iris ~ λ) Cavities would not be ideal. My suggestions: Travelling wave structure (Established) Induction cavity (Working in Japan) In both cases MP could probable be a major problem (given operating environment Aquadag will take care of this).

23. 1 for H+, 1 for H- 750Kev Cockcroft-Waldron 100 MeV Drift Tube Linac 800 MeV Cavity Linac Storage Ring LANSCE Marcus Eriksson MSc (thesis) work on reliability on LANSCE Weak point: INJECTORS H + Injector :70 % of all trips H - Injector : 26 % of all trips 90 % of H+ Injector trips were < 1 minute 40 % of H-Injector trips were < 1 minute H + General availability: 86 % H - General availability: 85 %

24. Availabilities achieved by ISIS over the past ten years is 89%, for individual cycles availabilities greater than 95% have never been achieved. ~80% of the downtime is due to the accelerator systems, ~20% to the target systems. ISIS 665Kev Cockcroft-Waldron 8 Mev RFQ

25. SILHI 75 mA proton beam for a 104 hours with only 1 failure, of 2.5 minutes. Microwave ION sources 208 MeV Indiana University Cyclotron. The injector includes a 6 microwave proton source and RFQ. The injector has been nearly continuously since June 03 with no failures.

26. Need to provide a service to the national grid Beam trips significant neutron flux driver in a ADS reactor. ● been said 5 trips a year max ? ● how long each trip ? ● what sort of variation in flux with impact on service ? (Hardy) ADS designers agree that 10-20 long beam interruptions/year is an upper limit. ‘Industrial’ accelerators should aim at limiting themselves to 2-3 long trips/year Trips < 100 ms could be accommodated thanks to fuel inertia as fuel temperature only drops after a few seconds. Efforts must be made to get rid of the short trips that remain a concern for the target Prediction of beam trips needed for maintenance scheduling, spare parts procurement, We should bear in mind the performances seen on current machines are only achieved by extensive and regular maintenance procedures. Conclusion…

27. Each design will require a separate reliability analysis, First step in assuring a reliability performance of analysis of existing data. But….. Need rough design to do this…. Then can compare to other proposed designs: (see Hardy) RFQ design for the low energy part of the Linac (< 5 MeV) and superconducting cavities for the high energy part (100 MeV – 1 GeV). Although, we should have…… Fewer components to fail, less equipment in hazardous environment, Could afford near complete redundancy. Conclusion…

28. Intentionally blank slide

29. 1Accelerator 1.1Ion Source 1.2LEBT 1.3RFQ 1.4MEBT 1.5 FFAG 1.6 HEBT 1.7 BDS to Target 2Cryogenics SC magnets ? 3Services 3.1Water System 3.2Compressed ai 3.3Electrical Power 4 Controls

30. for a typical week in Sept. '98 reveal that, out of about 1'100 beam trips, about 1'000 can be attributed to electrostatic devices at injection and extraction and to the two beam splitters. Sparking at the high voltage septa causes these interruptions, which typically last < 1 min.,