- Email: [email protected]
RAMI analysis for ITER radial X-ray camera system
Fusion Engineering and Design 112 (2016) 169–176
Contents lists available at ScienceDirect
Fusion Engineering and Design journal homepage: www.elsevier.com/locate/fusengdes
RAMI analysis for ITER radial X-ray camera system Shijun Qin a,∗ , Liqun Hu a , Kaiyun Chen a , Robin Barnsley b , Antoine Sirinelli b , Yuntao Song a , Kun Lu a , Damao Yao a , Yebin Chen a , Shi Li a , Hongrui Cao a , Hong Yu a , Xiuli Sheng a , RXC team a b
Institute of Plasma Physics, Chinese Academy of Sciences, Hefei 230031, China ITER Organization, Route Vinon sur Verdon, CS 90046, 13067, St. Paul lez Durance, Cedex, France
h i g h l i g h t s • • • •
The functional analysis of the ITER RXC system was performed. A failure modes, effects and criticality analysis of the ITER RXC system was performed. The reliability and availability of the ITER RXC system and its main functions were calculated. The ITER RAMI approach was applied to the ITER RXC system for technical risk control in the preliminary design phase.
a r t i c l e
i n f o
Article history: Received 24 May 2016 Received in revised form 22 July 2016 Accepted 15 August 2016 Keywords: RAMI Availability Risk control Nuclear fusion ITER RXC system
a b s t r a c t ITER is the first international experimental nuclear fusion device. In the project, the RAMI approach (reliability, availability, maintainability and inspectability) has been adopted for technical risk control to mitigate all the possible failure of components in preparation for operation and maintenance. RAMI analysis of the ITER Radial X-ray Camera diagnostic (RXC) system during preliminary design phase was required, which insures the system with a very high performance to measure the X-ray emission and research the MHD of plasma with high accuracy on the ITER machine. A functional breakdown was prepared in a bottom-up approach, resulting in in a bottom-up approach, resulting in the system being divided into 3 main functions, 6 intermediate functions and 28 basic functions which are described using the IDEFØ method. Reliability block diagrams (RBDs) were prepared to calculate the reliability and availability of each function under assumption of operating conditions and failure data. Initial and expected scenarios were analyzed to define risk-mitigation actions. The initial availability of RXC system was 92.93%, while after optimization the expected availability was 95.23% over 11,520 h (approx. 16 months) which corresponds to ITER typical operation cycle. A Failure Modes, Effects and Criticality Analysis (FMECA) was performed to the system initial risk. Criticality charts highlight the risks of the different failure modes with regard to the probability of their occurrence and impact on operations. There are 28 risks for the initial state, including 8 major risks. No major risk remains after taking into account all the actions. It was assessed that the RAMI analysis results meet the project requirement during preliminary design phase and the result will be qualified further when the system design is more mature. © 2016 Elsevier B.V. All rights reserved.
1. Introduction ITER is an international experimental nuclear fusion device, with extremely challenging technological and objectives requirements, that the technical risk control is very important. RAMI approach is devised by the ITER Organization (IO) to perform technical risk
∗ Corresponding author. E-mail address: [email protected] (S. Qin) http://dx.doi.org/10.1016/j.fusengdes.2016.08.019 0920-3796/© 2016 Elsevier B.V. All rights reserved.
assessment [1]. Extracted the first letter the each words (Reliability: continuity of correct operation, Availability: readiness for correct operation [2], Maintainability: ability to undergo repairs and modifications and Inspectability: ability to undergo visits and controls), the RAMI analysis method is one of the main stages of the technical risk control, it focus on the operational functions which required by the ITER machine operation, but not on physical components. And it uses dedicated software tools and an association of methods. The RAMI analysis begins at the design phase of a system because corrective actions are still possible at this stage [3], mainly in terms
170
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
Fig. 1. Simply flow chart of ITER RAMI analysis program.
of design changes or choices, tests before assembly, allowance for accessibility and inspectability in the system integration, definition of the maintenance frequency and the list of spare parts. The RAMI analysis is focused on the functions required to ITER operation and their failure criticality. It consists of five major steps [4]: (1) Functional analysis are performed, (2) Analyzing Failure Mode, Effects and Criticality Analysis (FMECA), (3) Calculating reliability block diagrams, (4) Risk mitigation actions are taken to ensure every system is compatibility with RAMI objectives, (5) All the RAMI analysis are integrated as the final RAMI analysis reports to be reviewed in the system final design review (Fig. 1). The main function of ITER Radial X-ray Camera diagnostic system was to measure the X-ray emission and research the MHD of plasma. The RXC system consists of in-port and ex-port camera modules that view the plasma through vertical slots in the diagnostic first wall and diagnostic shielding module of an equatorial port plug #12. At the same time during the camera design there are three main factors have been driven the design. (a) For neutron shielding, the camera fan is divided into 12 camera modules, individually shielded, and with an acceptance angle of a few degrees. (b) Due to the aspect ratio of the ports and port-plugs, it is not possible to view the full poloidal plasma cross-section from behind the port. Therefore the camera uses external views where possible, and in-port views where necessary. (c) To allow for future detector upgrades, the in-port detectors are installed in removable secondary vacuum enclosures in the port-plug. Besides, the detectors RXC system still includes I&C system which is used as data-acquisition and control, the signal amplify system, all kinds of cables, and the hard wares to keep vacuum and so on. 2. Functional analysis of ITER RXC system Functional breakdown and analysis is the first step of the RXC system RAMI analysis. It allows making an exhaustive understanding of the system from functional point of view. The functional breakdown is a top-down description of the system as a hierarchy of functions on multiple levels, from the main functions fulfilled by the system to the basic functions performed by the components. The methodology is inspired by the IDEF∅ (Integration Definition Function – language∅) approach, based on the SADT (Structured Analysis and Design Technique) methodology [1]. Table 1 shows the functional break down of the ITER RXC for the RAMI analysis. There are 3 main functions, 6 intermediate functions and 28 basic functions. The main functions are: “To provide services and features to support the main functions” (RXC.1), “To collect XRay flux and detect the signal” (RXC.2) and “To provide physics measurements from signal” (RXC.3). “To provide services and features to support the main functions” (RXC.1) is performed to ensure the integrity of the ITER Tokamak machine, RXC system and its integrity of vacuum and shielding. It involves no human intervention. It has 3 sub-functions: “To ensure proper vacuum” (RXC.1.1), “To provide the detector cooling” (RXC.1.2) and “To provide shielding” (RXC.1.3). At the same time, there are different basic functions under each intermediate function. “To collect X-Ray flux and detect the signal” (RXC.2) is to collect the signals exactly and then transfer them to the data acquisition
Table 1 Functional break down of the ITER RXC system for the RAMI analysis. RXC.0 To measure the X-ray emission and research the MHD of plasma RXC.1 To provide services and features to support the main functions RXC.1.1 To ensure proper vacuum RXC.1.1.1 To maintain the integrity of the primary vacuum boundary RXC.1.1.2 To maintain the integrity of the secondary vacuum boundary RXC.1.1.3 To isolate primary vacuum from secondary vacuum RXC.1.1.4 To provide vacuum pumping RXC.1.1.5 To provide the safety related confinement at primary vacuum boundary RXC.1.1.6 To provide safety related confinement at secondary vacuum boundary RXC.1.2 To provide the detector cooling RXC.1.2.1 To monitor temperature(gas, detector) RXC.1.2.2 To monitor flow rate RXC.1.2.3 To monitor the cooling gas pressure RXC.1.2.4 To provide cooling gas source RXC.1.3 To provide shielding RXC.1.3.1 To keep the internal detector far from the neutron/gama fluxes RXC.1.3.2 To keep the external detector far from the neutron/gama fluxes RXC.1.3.3 To keep pre-amplifier/mid-amplifier far from the neutron/gama fluxes RXC.1.3.4 To reduce shutdown dose rate RXC.2 To collect X-ray flux and detect the signal RXC.2.1 To collect X-ray flux RXC.2.1.1 Collecting X-ray flux in well-defined viewing angle RXC.2.1.2 To collect background inside RXC chamber near detectors RXC.2.1.3 To receive the X-ray directly RXC.2.1.4 To provide continuity check from detector to DAQ RXC.2.1.5 To transmit signal from detectors to preamplifier RXC.2.2 To amplify and acquire the signal RXC.2.2.1 To provide detector current amplification RXC.2.2.2 To generate electronics calibration signal RXC.2.2.3 DAQ and I&C RXC.2.2.3.1 To acquire raw data RXC.2.2.3.2 To calibrate the inner and outer detector RXC.2.2.3.3 To realize the gain change RXC.2.2.3.4 To control gas cooling and monitor temperature, gas pressure and flow RXC.3 To provide physics measurements from signal RXC.3.1 To provide chord-integrated SXR intensity RXC.3.2 To determine change in chord integrated SXR emission RXC.3.3 To provide supplementary diagnostic parameter with input from other diagnostics
equipments. Signals were amplified during the process. The function plays a very important role in the RXC function and it has 2 sub-functions: “To collect X-Ray flux” (RXC.2.1) and “To amplify and acquire the signal” (RXC.2.2). At the same time, there are different basic functions under each intermediate function. “To provide physics measurements from signal” (RXC.3) is to provide the medium in doing the physical analysis based on the data acquired from the cameras, including analyzing the chord integrated SXR emission, the chord-integrated SXR intensity and provide supplementary diagnostic parameter with input from other diagnostics. So it has 3 basic functions: “To provide chordintegrated SXR intensity” (RXC.3.1), “To determine change in chord integrated SXR emission” (RXC.3.2) and “To provide supplementary diagnostic parameter with input from other diagnostics” (RXC.3.3). Fig. 2 shows the top IDEFØ diagram of ITER RXC system. The input of RXC are the X-ray flux signal from normal and abnormal plasma operation, the variables of gas or cooling water temperature and pressure, all kind of hardware’s structure and the I&C operation process. The output are the structural integrity of vacuum boundary under all kinds of radiation and the well performance of detectors, the X-ray flux collected and amplified successfully, and the physical
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
171
Fig. 2. Top IDEFØ model of ITER RXC system (A0 level: To measure the X-ray emission and research the MHD of plasma).
characteristics of X-ray emission and MHD of plasma successfully researched. Fig. 3 shows the IDEFØ diagram of the function RXC.1.2. The input includes the cooling gas and cooling water with their operation conditions, also the hardware’s structure. Environmental, RXC and ITER operation condition and CODAC are the control. The instruments and equipment of the cooling system are the functional mechanism. The output of the IDEFØ diagram including the change of temperature in detector was recorded, the flow rate of cooling water and pressure of cooling gas was measured and monitored, and the certain temperature of cooling water was provided continually. Fig. 2 is a representation of the First Level Functions for the RXC system. In addition to identifying the Functions and Sub-Functions of a system (in this case the RXC system), the IDEFØ methodology also identifies the interactions between each of the Functions and/or Sub-Functions. Although only the main functions level is shown, lower levels down to the basic functions have been established and are available. One of the lower levels function RXC.1.2 was taken as an example and shown.
Table 2 ITER rating scale for severity S [1]. S value
Description
Meaning
1 2 3 4 5 6
Weak <1 h Moderate <1 d Serious <1 w Severe <2 m Critical <1 y Catastrophic >1 y
Unavailable less than 1 h Unavailable between 1 h and 1 day Unavailable between 1 day and 1 week Unavailable between 1 week and 2 months Unavailable between 2 months and 1 year Unavailable more than 1 year
Table 3 ITER rating scale for occurrence O [1]. O value
Description
Meaning
1 2
Very Low Low
3
Moderate
4
High
5
Very High
6
Frequent
risk < 5.7e − 8/h (MTBF > 2000 years) 5.7e − 8/h < risk < 5.7e − 7/h (200 years < MTBF < 2000 years) 5.7e − 7/h < risk < 5.7e − 6/h (20 years < MTBF < 200 years) 5.7e − 6/h < risk < 5.7e − 5/h (2 years < MTBF < 20 years) 5.7e − 5/h < risk < 5.7e-4/h (10 weeks < MTBF < 2 years) risk > 5.7e − 4/h (MTBF < 10 weeks)
3. FMECA (Failure mode, effects & criticality analysis) of the ITER RXC system FMECA is basing on the functional breakdown of the system, according to the importance with respect to the machine operation availability. It established a list of functional failure modes, their causes and effects. It is going to evaluate the severity of the effect and the occurrence of the cause of main failure modes, using a criticality chart (O, S) to discriminate the major, medium and minor risks. The FMECA uses the functional breakdown, the list of failure modes, rating scales for occurrence and severity and components failure rate as the input data, while the qualitative description of the technical risks, a prioritization of the actions to reduce risk and the updating of failure modes database are its output. In the RAMI approach, criticality C is used to evaluate the magnitude of each risk to the achievement of operational objectives. All the effects and causes are evaluated quantitatively using the sever-
ity and occurrence rating scales as in Table 2 and Table 3 [1], where S = Mean Down Time induced by the effect of failure (unavailable time for the operation) and O = Frequency of the cause of each failure mode. A criticality chart is used to distinguish several risk levels, and criticality C is obtained from the product of the severity S and the occurrence O, namely the following formula: Criticality C = S × O. Then the coordinate (S, O) of all couples are placed on the criticality chart. The chart is to be defined priorities, just as showed in Fig. 4. Where are 3 zones: Major technical risks (C > 13), the mitigation actions addressing them are required (red zone); Medium technical risks (13 > C > 7), the mitigation actions addressing them are recommended (yellow zone); Minor technical risks (C < 7), the mitigation actions addressing them are optional (green zone). The three zones are depending on the criticality thresholds defined by ITER Organization [1,4].
172
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
Fig. 3. IDEFØ diagram of RXC.1.2: To provide the detector cooling.
Fig. 4. Criticality chart of the ITER RXC system in initial (a) and expected (b). Criticality C is the product of severity S and occurrence O (C = S × O). The criticality is divided into 3 zones; major risk in red zone (C > 13), medium risk in yellow zone (13 > C > 7) and minor risk in green zone (7 > C). (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)
Fig. 4(a) shows the initial criticality matrix which respects to the first design phase. In that phase the design optimization, riskreducing actions implementation and spare parts have not been considered. There are 8 major risks and 28 failures in all. Fig. 4(b) shows the expected criticality matrix which displays the expected
results after implementation of the advocated risk-reducing actions and on-site spare parts. There is no risk in the red zone, and the criticality can be reduced by taking proper measures. In the initial criticality chart in Fig. 4(a), the maximum criticality C = 16, where S = 4 and O = 4, are mainly due to the amplifiers
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
chips failed by the neutron radiation, or the power voltage are unsteady leading the circuit could not sustain steady operation. But after neutron analysis was done and giving a suitable margin to the cable shielding design; strictly choosing the chips suppliers who have the anti-radiation performance; doing adequate testing before assembly; adding voltage regulator module; select power cable with small loss and a certain quantity of spare part on site. The severity can be reduced from S = 4 to 2 and the C could be dropped to 8 in the yellow zone. Besides the maximum criticality C = 16, there are still the other 7 major risks which C = 15. Most of the major risks are focusing on the Si linear detectors and their auxiliaries. The failure modes of Si linear detectors and their auxiliaries are that the background signal could not be provided exactly; the X-ray emission signal could not be received effectively; the continuity check function lost; the data could not be transmitted to the preamplifier. But after some mitigation actions and a certain quantity of spare part on site were considered, severity can be reduced from S = 5 to 4 and the C could be dropped to 12 in the yellow zone. For all the other failure modes the occurrence can be reduced with sufficient testing and the severity also can be reduced by preparing spares or the other actions. Fig. 4(b) shows that only 19 failure modes are medium risks in the yellow zone by the risk-reducing actions and compensating provisions advocated for reducing their criticality, with the associated costs and/or spares.
4. RBD (Reliability block diagram) analysis The RBD analysis was prepared to estimate the reliability and availability of each function under stipulated operating conditions. The evaluating reliability and availability of each main and intermediate function in the ITER RXC system has been performed using BlockSim9 software [5,6]. The functional breakdown structures that were prepared for the IDEFØ analysis form the logical basis from which the RBDs are derived, which were prepared in the former analysis in IDEFØ. The RBDs were drawn as a diagram consisting of nodes of system components for each function. The RBDs of the top functions are shown in Fig. 5. There are 3 sub-functions of the RXC system, where RXC1 stands for to provide services and features to support the main functions, RXC2 stands for to collect X-ray flux and detect the signal, RXC3 stands for to provide physics measurements from signal. The RXC1 module is contained another 3 sub-functions and the other more basic functions and components. So its RBD model was shown in Fig. 6. The contents RXC.1.1, RXC.1.2 and RXC.1.3 stand for were shown in Table 1. The RBD model to collect X-ray flux and detect the signal are more complicated than the first one to provide services and features to support the main functions, so the RBD model was shown in Fig. 7. Although only several functions level of RBD models are shown, for a detailed analysis, the top level system nodes represent subdiagrams, cascading to sub-system, unit, device and parts has been established and finished. The upper internal camera tube is in parallel with the lower internal camera tube, and the upper half of external camera channel (together with thermocouple, cables, detectors, etc.) is in parallel with the lower half of external camera channel. Because the RXC system is used to measure the X-ray emission profile of plasma, half of the internal camera channels (observe upper or lower plasma) and half of the external camera channels can achieve this goal. Of course, it will be better if the two internal camera tubes and the two external camera channels could operate simultaneously. So when building of RBD model and calculation, the two internal camera tubes are in parallel from the design point of view but also the RAMI point of view, the same consideration to the two external camera
173
channels. So the internal tube or external camera is replaced in whole when failure. The beryllium window break will not influence the ITER operation and RXC physical signal acquisition from the experience of JET. So beryllium window is not considered in the RXC availability calculation. ITER operations and the RXC system failure have the following relationship: (1) ITER operation has to be stopped when RXC failure modes of vacuum leakage or nuclear leakage, the causes were welds broken, E-feedthrough ceramic isolation damaged or valves leakage. ITER machine and the RXC system need to be stopped to check the primary vacuum boundary, and then repairing or replacing. All the procedures are following the ITER maintenance procedure. (2) ITER can continue to operate independently but RXC has to be stopped, when the beryllium windows, detectors cooling system, Si linear detectors and their auxiliaries fail. This is because at these cases, the second vacuum boundary of RXC detectors have been broken, and the X-ray signal could not be checked and collected exactly. But there are not impurities to the VV and the ITER machine primary vacuum boundary was still maintained, so ITER could operate independently. (3) ITER can continue independently to operate, also the RXC diagnostic system, but at the CODAC room the X-ray signal could not been read. Because the signal transfer or amplify system fails, just like the preamplifier could not amplify the signal; current signal could not be changed into voltage signal; mid-amplifier could not amplify the voltage signal; hardware initialization failed; raw data error and so on. In these cases, the failures only happened out of the primary vacuum boundary, also out of the second vacuum boundary of RXC system. The Ex-vessel failure did not influence the ITER and RXC operation. The Port Integration (PI) team is now designing multifunction feedthrough containing E-feedthrough, Cooling gas feedthrough and SVS port, so number of feedthrougs may be considered as 3 in all with the MTBF 666667 h and MTTR 1440 h: one for upper tube, one for lower tube and another for the external camera. During the calculation, the MTTR of components inside port plug is supposed to be: firstly 12 days for cooling down, then 1 week for ISS/PCSS (vacuum extensions removal), 3 days for work, and then 1 week for ISS/PCSS/Vacuum externals installation, at last 1 month for pumpdown or commissioning, so in all the time was 2 months (1440 h). For maintenance of other components, the MTTR was shorter. Duty cycle (ratio of the operating time of the component compared to the total operating time of the system considered) was set to be 20% for all components. It was done because the system is going to be used only during the plasma operation. Maintenance regarding to ex-vessel failure modes and components, which did not need to break vacuum boundary is foreseen when the plasma will be off. The other maintenances which need breaking of vacuum boundary will wait for the ITER in its main shutdown. undary is foreseen when the plasma will be off. The other maintenances which need breaking of vacuum boundary will wait for the ITER in its main shutdown. Component failure data was mainly taken from various sources such as manufacturers’ specifications, reliability databases, industry standards, previous experience compiled in other scientific devices, the other most important source is that because it is not get the precise data, so assumption data are made following the personal experience of the RAMI analysts and experts available at the time of the analysis. Sometime the available data may not be completely pertinent because the very specific experimental conditions the components will face on ITER can be not known very precisely, therefore an appropriate estimation has to be carried out based on the data sources take from such as EAST, KSTAR, JT-60 devices and so on. For the components of the same type (detectors, valves, pumps, pipelines, gauges etc.) pessimistic scenario was considered. It means that the worst parameters for components of the
174
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
Fig. 5. Reliability Block Diagram for RXC system top function (A0 level).
Fig. 6. Reliability Block Diagram of RXC1 to provide services and features to support the main functions.
Fig. 7. Reliability Block Diagram of RXC2 to collect X-ray flux and detect the signal.
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
175
Table 4 Initial and expected input data for reliability & availability calculations of ITER RXC system. Components considered
upper or lower internal camera tube(including thermocouple, cables, piping, Gauges, shielding block, slit, Single detector behind linear array, Si linear detectors, Light source) external camera chamber Multi-function feedthrough (including E-feedthrough, Cooling gas feedthrough and SVS port) SVS connector Valves thermometer Flowmeter Pressure gage Heat exchanger gas tank Circulating pump SVS and cooling gas line valves Shielding cabinet concrete block E-connector Preamplifiers Mid-amplifier Power supplier Signal source DAQ card or timing board I/O chassis Analogue input or digital input/output Software or communication
Initial
Expected
(1/h)
MTTR (h)
(1/h)
MTTR (h)
2.45E-4
1440
2.45E-4
1440
1.26E-4 1.50E-6
1440 1440
1.26E-4 1.50E-6
1440 1440
5.71E-6 3.20E-6 0.25E-5 4.30E-6 1.0E-6 3.0E-6 5.30E-7 2.0E-6 3.20E-6 4.65E-7 1.14E-7 1.44E-6 7.87E-6 7.87E-6 4.48E-7 2.28E-6 3.80E-6 5.65E-8 4.48E-7 5.70E-6
720 720 336 168 168 1440 1440 72 168 720 720 2160 173.5 173.5 15 27.5 27.5 27.5 51 72
5.71E-6 3.20E-6 0.25E-5 4.30E-6 1.0E-6 3.0E-6 5.30E-7 2.0E-6 3.20E-6 4.65E-7 1.14E-7 1.44E-6 5.70E-6 5.70E-6 4.48E-7 2.28E-6 3.80E-6 5.65E-8 4.48E-7 5.70E-6
720 720 168 48 48 8 8 8 8 720 720 720 48 48 8 8 8 8 8 8
Table 5 Inherent availability and reliability of main functions of the ITER RXC system. Functions
To measure the X-ray emission and research the MHD of plasma (RXC0) To provide services and features to support the main functions (RXC1) To ensure proper vacuum(RXC1.1) To provide the detector cooling (RXC1.2) To provide shielding (RXC1.3) To collect X-ray flux and detect the signal (RXC2) To collect X-ray flux (RXC2.1) To amplify and acquire the signal (RXC2.2) To collect X-Ray flux and detect the signal (RXC3)
same types were taken into consideration. The overview of input data for components used is given in Table 4. The inherent availability and reliability of main functions of the ITER RXC system are summarized in Table 5. The simulation end time is 11,520 h (approx. 16 months) because this time corresponds to typical operation cycle of ITER. And 264 h (11 days) for reliability, 11-days are consistent with the single ITER plasma operation cycle which followed by 3 days of routine maintenance. The numbers of simulations are fixed at 1000 which is large enough for their significant digits. It can be seen that the availability for the expected simulation is improved over the initial simulation, primarily due to the provision of spares reducing the estimates. The exponential or fixed reliability was usually used for the components failure distribution, and the exponential failure distribution was used for simulation. The availability for all function of the ITER RXC system is 92.93% without spares and 95.23% with spares over 16 months. 5. Conclusion The ITER RAMI approach was applied to the ITER Radial X-ray Camera diagnostic system for technical risk control in the preliminary design phase. The functional break-down was performed to understand the required functions of the ITER RXC system. The
Inherent availability (%)
Reliability (%)
Initial
Expected
Initial
Expected
92.93 98.91 99.39 99.62 99.99 94.09 93.90 99.88 99.96
95.23 99.19 99.39 99.92 99.99 96.02 96.13 99.98 99.99
97.71 99.38 99.84 99.70 99.98 98.72 99.27 99.40 99.84
98.14 99.40 99.84 99.70 99.98 98.76 99.31 99.41 99.84
RXC system requires a very high performance to measure the Xray emission and research the MHD of plasma with high accuracy. And at the same time all the signal could be transferred outside to the amplifiers and analysis centre in the neutron environment. Overall functional breakdown was done firstly, IDEFØ analysis was applied to create diagrams of the processes for each function in the system and define the relationships among the sub-functions. FMECA analysis was performed to evaluate severity and occurrence of the failure modes within the system and to prepare the criticality chart on this basis. Risks of RXC system are sorted and the mitigation actions for major risks of high initial criticality are provided. There are 28 risks for the initial state, including 8 major. No major risk remains after taking into account all the actions. RBD analysis was applied to failure modes, the failure rate and availability for the device block for each function in initial and expected conditions. The initial and expected availability of each main function and the total availability of RXC systems are calculated. The initial availability of RXC system was 92.93%, after optimizations were taken the expected availability was 95.23%. The numbers of spare parts are recommended and the components which may be used in the other ITER systems including diagnostic tenant systems are recommended for standardization. If most of the same or similar functional components could realize standardizing, it allows decreasing significantly time to repair of failure components in all
176
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
systems. This result in preliminary design phase must be qualified further when the system design is more mature. All the RAMI requirements including mitigation actions and spare part recommendations are expected to be integrated in the baseline and to be implemented during the design, the construction, test and conditioning, and following operation period. Acknowledgments The work was performed in the frame work of RAMI analysis for the ITER RXC system Procurement Arrangement and the National Science and Technology Major Project of the Ministry of Science and Technology of China (5.5.P1.CN.02/1A). Also has been supported by the National Natural Science Foundation of China (Grant No.Y65JQ21502) and National Magnetic Confinement Fusion Science Program (Grant Nos. 2014GB101001, 2015GB107001). The author also would like to express his thanks to all the members
of ITER RXC team in china and the ITER Organization colleagues. The views and opinions expressed herein do not necessarily reflect those of the ITER Organization. References [1] D. van Houtte, K. Okayama, F. Sagot, RAMI approach for ITER, Fusion Eng. Des. 85 (2010) 1220. [2] R. Buende, Fusion Eng. Des. 29 (1995) 262. [3] D. van Houtte, K. Okayama, F. Sagot, ITER RAMI analysis programme, ITER D (2012) 28WBXD. [4] Shijun QIN, Yuntao SONG, Damao YAO, et al., RAMI analysis program design and research for CFETR (Chinese fusion engineering testing reactor) tokamak machine [J], J. Fusion Energy 33 (5) (2014) 516. [5] S. Kitazawa, K. Okayama, Y. Neyatani, F. Sagot, D. van Houtte, RAMI analysis of ITER CIS, Fusion Eng. Des. [5]S.KitazawaK.OkayamaY.NeyataniF.SagotD.van HoutteRAMI analysis of ITER CISFusion Eng. Des.89 (2014) 88. [6] K. Okayama, D. van Houtte, F. Sagot, S. Maruyama, Fusion Eng. Des. 86 (2011) 598.
Contents lists available at ScienceDirect
Fusion Engineering and Design journal homepage: www.elsevier.com/locate/fusengdes
RAMI analysis for ITER radial X-ray camera system Shijun Qin a,∗ , Liqun Hu a , Kaiyun Chen a , Robin Barnsley b , Antoine Sirinelli b , Yuntao Song a , Kun Lu a , Damao Yao a , Yebin Chen a , Shi Li a , Hongrui Cao a , Hong Yu a , Xiuli Sheng a , RXC team a b
Institute of Plasma Physics, Chinese Academy of Sciences, Hefei 230031, China ITER Organization, Route Vinon sur Verdon, CS 90046, 13067, St. Paul lez Durance, Cedex, France
h i g h l i g h t s • • • •
The functional analysis of the ITER RXC system was performed. A failure modes, effects and criticality analysis of the ITER RXC system was performed. The reliability and availability of the ITER RXC system and its main functions were calculated. The ITER RAMI approach was applied to the ITER RXC system for technical risk control in the preliminary design phase.
a r t i c l e
i n f o
Article history: Received 24 May 2016 Received in revised form 22 July 2016 Accepted 15 August 2016 Keywords: RAMI Availability Risk control Nuclear fusion ITER RXC system
a b s t r a c t ITER is the first international experimental nuclear fusion device. In the project, the RAMI approach (reliability, availability, maintainability and inspectability) has been adopted for technical risk control to mitigate all the possible failure of components in preparation for operation and maintenance. RAMI analysis of the ITER Radial X-ray Camera diagnostic (RXC) system during preliminary design phase was required, which insures the system with a very high performance to measure the X-ray emission and research the MHD of plasma with high accuracy on the ITER machine. A functional breakdown was prepared in a bottom-up approach, resulting in in a bottom-up approach, resulting in the system being divided into 3 main functions, 6 intermediate functions and 28 basic functions which are described using the IDEFØ method. Reliability block diagrams (RBDs) were prepared to calculate the reliability and availability of each function under assumption of operating conditions and failure data. Initial and expected scenarios were analyzed to define risk-mitigation actions. The initial availability of RXC system was 92.93%, while after optimization the expected availability was 95.23% over 11,520 h (approx. 16 months) which corresponds to ITER typical operation cycle. A Failure Modes, Effects and Criticality Analysis (FMECA) was performed to the system initial risk. Criticality charts highlight the risks of the different failure modes with regard to the probability of their occurrence and impact on operations. There are 28 risks for the initial state, including 8 major risks. No major risk remains after taking into account all the actions. It was assessed that the RAMI analysis results meet the project requirement during preliminary design phase and the result will be qualified further when the system design is more mature. © 2016 Elsevier B.V. All rights reserved.
1. Introduction ITER is an international experimental nuclear fusion device, with extremely challenging technological and objectives requirements, that the technical risk control is very important. RAMI approach is devised by the ITER Organization (IO) to perform technical risk
∗ Corresponding author. E-mail address: [email protected] (S. Qin) http://dx.doi.org/10.1016/j.fusengdes.2016.08.019 0920-3796/© 2016 Elsevier B.V. All rights reserved.
assessment [1]. Extracted the first letter the each words (Reliability: continuity of correct operation, Availability: readiness for correct operation [2], Maintainability: ability to undergo repairs and modifications and Inspectability: ability to undergo visits and controls), the RAMI analysis method is one of the main stages of the technical risk control, it focus on the operational functions which required by the ITER machine operation, but not on physical components. And it uses dedicated software tools and an association of methods. The RAMI analysis begins at the design phase of a system because corrective actions are still possible at this stage [3], mainly in terms
170
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
Fig. 1. Simply flow chart of ITER RAMI analysis program.
of design changes or choices, tests before assembly, allowance for accessibility and inspectability in the system integration, definition of the maintenance frequency and the list of spare parts. The RAMI analysis is focused on the functions required to ITER operation and their failure criticality. It consists of five major steps [4]: (1) Functional analysis are performed, (2) Analyzing Failure Mode, Effects and Criticality Analysis (FMECA), (3) Calculating reliability block diagrams, (4) Risk mitigation actions are taken to ensure every system is compatibility with RAMI objectives, (5) All the RAMI analysis are integrated as the final RAMI analysis reports to be reviewed in the system final design review (Fig. 1). The main function of ITER Radial X-ray Camera diagnostic system was to measure the X-ray emission and research the MHD of plasma. The RXC system consists of in-port and ex-port camera modules that view the plasma through vertical slots in the diagnostic first wall and diagnostic shielding module of an equatorial port plug #12. At the same time during the camera design there are three main factors have been driven the design. (a) For neutron shielding, the camera fan is divided into 12 camera modules, individually shielded, and with an acceptance angle of a few degrees. (b) Due to the aspect ratio of the ports and port-plugs, it is not possible to view the full poloidal plasma cross-section from behind the port. Therefore the camera uses external views where possible, and in-port views where necessary. (c) To allow for future detector upgrades, the in-port detectors are installed in removable secondary vacuum enclosures in the port-plug. Besides, the detectors RXC system still includes I&C system which is used as data-acquisition and control, the signal amplify system, all kinds of cables, and the hard wares to keep vacuum and so on. 2. Functional analysis of ITER RXC system Functional breakdown and analysis is the first step of the RXC system RAMI analysis. It allows making an exhaustive understanding of the system from functional point of view. The functional breakdown is a top-down description of the system as a hierarchy of functions on multiple levels, from the main functions fulfilled by the system to the basic functions performed by the components. The methodology is inspired by the IDEF∅ (Integration Definition Function – language∅) approach, based on the SADT (Structured Analysis and Design Technique) methodology [1]. Table 1 shows the functional break down of the ITER RXC for the RAMI analysis. There are 3 main functions, 6 intermediate functions and 28 basic functions. The main functions are: “To provide services and features to support the main functions” (RXC.1), “To collect XRay flux and detect the signal” (RXC.2) and “To provide physics measurements from signal” (RXC.3). “To provide services and features to support the main functions” (RXC.1) is performed to ensure the integrity of the ITER Tokamak machine, RXC system and its integrity of vacuum and shielding. It involves no human intervention. It has 3 sub-functions: “To ensure proper vacuum” (RXC.1.1), “To provide the detector cooling” (RXC.1.2) and “To provide shielding” (RXC.1.3). At the same time, there are different basic functions under each intermediate function. “To collect X-Ray flux and detect the signal” (RXC.2) is to collect the signals exactly and then transfer them to the data acquisition
Table 1 Functional break down of the ITER RXC system for the RAMI analysis. RXC.0 To measure the X-ray emission and research the MHD of plasma RXC.1 To provide services and features to support the main functions RXC.1.1 To ensure proper vacuum RXC.1.1.1 To maintain the integrity of the primary vacuum boundary RXC.1.1.2 To maintain the integrity of the secondary vacuum boundary RXC.1.1.3 To isolate primary vacuum from secondary vacuum RXC.1.1.4 To provide vacuum pumping RXC.1.1.5 To provide the safety related confinement at primary vacuum boundary RXC.1.1.6 To provide safety related confinement at secondary vacuum boundary RXC.1.2 To provide the detector cooling RXC.1.2.1 To monitor temperature(gas, detector) RXC.1.2.2 To monitor flow rate RXC.1.2.3 To monitor the cooling gas pressure RXC.1.2.4 To provide cooling gas source RXC.1.3 To provide shielding RXC.1.3.1 To keep the internal detector far from the neutron/gama fluxes RXC.1.3.2 To keep the external detector far from the neutron/gama fluxes RXC.1.3.3 To keep pre-amplifier/mid-amplifier far from the neutron/gama fluxes RXC.1.3.4 To reduce shutdown dose rate RXC.2 To collect X-ray flux and detect the signal RXC.2.1 To collect X-ray flux RXC.2.1.1 Collecting X-ray flux in well-defined viewing angle RXC.2.1.2 To collect background inside RXC chamber near detectors RXC.2.1.3 To receive the X-ray directly RXC.2.1.4 To provide continuity check from detector to DAQ RXC.2.1.5 To transmit signal from detectors to preamplifier RXC.2.2 To amplify and acquire the signal RXC.2.2.1 To provide detector current amplification RXC.2.2.2 To generate electronics calibration signal RXC.2.2.3 DAQ and I&C RXC.2.2.3.1 To acquire raw data RXC.2.2.3.2 To calibrate the inner and outer detector RXC.2.2.3.3 To realize the gain change RXC.2.2.3.4 To control gas cooling and monitor temperature, gas pressure and flow RXC.3 To provide physics measurements from signal RXC.3.1 To provide chord-integrated SXR intensity RXC.3.2 To determine change in chord integrated SXR emission RXC.3.3 To provide supplementary diagnostic parameter with input from other diagnostics
equipments. Signals were amplified during the process. The function plays a very important role in the RXC function and it has 2 sub-functions: “To collect X-Ray flux” (RXC.2.1) and “To amplify and acquire the signal” (RXC.2.2). At the same time, there are different basic functions under each intermediate function. “To provide physics measurements from signal” (RXC.3) is to provide the medium in doing the physical analysis based on the data acquired from the cameras, including analyzing the chord integrated SXR emission, the chord-integrated SXR intensity and provide supplementary diagnostic parameter with input from other diagnostics. So it has 3 basic functions: “To provide chordintegrated SXR intensity” (RXC.3.1), “To determine change in chord integrated SXR emission” (RXC.3.2) and “To provide supplementary diagnostic parameter with input from other diagnostics” (RXC.3.3). Fig. 2 shows the top IDEFØ diagram of ITER RXC system. The input of RXC are the X-ray flux signal from normal and abnormal plasma operation, the variables of gas or cooling water temperature and pressure, all kind of hardware’s structure and the I&C operation process. The output are the structural integrity of vacuum boundary under all kinds of radiation and the well performance of detectors, the X-ray flux collected and amplified successfully, and the physical
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
171
Fig. 2. Top IDEFØ model of ITER RXC system (A0 level: To measure the X-ray emission and research the MHD of plasma).
characteristics of X-ray emission and MHD of plasma successfully researched. Fig. 3 shows the IDEFØ diagram of the function RXC.1.2. The input includes the cooling gas and cooling water with their operation conditions, also the hardware’s structure. Environmental, RXC and ITER operation condition and CODAC are the control. The instruments and equipment of the cooling system are the functional mechanism. The output of the IDEFØ diagram including the change of temperature in detector was recorded, the flow rate of cooling water and pressure of cooling gas was measured and monitored, and the certain temperature of cooling water was provided continually. Fig. 2 is a representation of the First Level Functions for the RXC system. In addition to identifying the Functions and Sub-Functions of a system (in this case the RXC system), the IDEFØ methodology also identifies the interactions between each of the Functions and/or Sub-Functions. Although only the main functions level is shown, lower levels down to the basic functions have been established and are available. One of the lower levels function RXC.1.2 was taken as an example and shown.
Table 2 ITER rating scale for severity S [1]. S value
Description
Meaning
1 2 3 4 5 6
Weak <1 h Moderate <1 d Serious <1 w Severe <2 m Critical <1 y Catastrophic >1 y
Unavailable less than 1 h Unavailable between 1 h and 1 day Unavailable between 1 day and 1 week Unavailable between 1 week and 2 months Unavailable between 2 months and 1 year Unavailable more than 1 year
Table 3 ITER rating scale for occurrence O [1]. O value
Description
Meaning
1 2
Very Low Low
3
Moderate
4
High
5
Very High
6
Frequent
risk < 5.7e − 8/h (MTBF > 2000 years) 5.7e − 8/h < risk < 5.7e − 7/h (200 years < MTBF < 2000 years) 5.7e − 7/h < risk < 5.7e − 6/h (20 years < MTBF < 200 years) 5.7e − 6/h < risk < 5.7e − 5/h (2 years < MTBF < 20 years) 5.7e − 5/h < risk < 5.7e-4/h (10 weeks < MTBF < 2 years) risk > 5.7e − 4/h (MTBF < 10 weeks)
3. FMECA (Failure mode, effects & criticality analysis) of the ITER RXC system FMECA is basing on the functional breakdown of the system, according to the importance with respect to the machine operation availability. It established a list of functional failure modes, their causes and effects. It is going to evaluate the severity of the effect and the occurrence of the cause of main failure modes, using a criticality chart (O, S) to discriminate the major, medium and minor risks. The FMECA uses the functional breakdown, the list of failure modes, rating scales for occurrence and severity and components failure rate as the input data, while the qualitative description of the technical risks, a prioritization of the actions to reduce risk and the updating of failure modes database are its output. In the RAMI approach, criticality C is used to evaluate the magnitude of each risk to the achievement of operational objectives. All the effects and causes are evaluated quantitatively using the sever-
ity and occurrence rating scales as in Table 2 and Table 3 [1], where S = Mean Down Time induced by the effect of failure (unavailable time for the operation) and O = Frequency of the cause of each failure mode. A criticality chart is used to distinguish several risk levels, and criticality C is obtained from the product of the severity S and the occurrence O, namely the following formula: Criticality C = S × O. Then the coordinate (S, O) of all couples are placed on the criticality chart. The chart is to be defined priorities, just as showed in Fig. 4. Where are 3 zones: Major technical risks (C > 13), the mitigation actions addressing them are required (red zone); Medium technical risks (13 > C > 7), the mitigation actions addressing them are recommended (yellow zone); Minor technical risks (C < 7), the mitigation actions addressing them are optional (green zone). The three zones are depending on the criticality thresholds defined by ITER Organization [1,4].
172
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
Fig. 3. IDEFØ diagram of RXC.1.2: To provide the detector cooling.
Fig. 4. Criticality chart of the ITER RXC system in initial (a) and expected (b). Criticality C is the product of severity S and occurrence O (C = S × O). The criticality is divided into 3 zones; major risk in red zone (C > 13), medium risk in yellow zone (13 > C > 7) and minor risk in green zone (7 > C). (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)
Fig. 4(a) shows the initial criticality matrix which respects to the first design phase. In that phase the design optimization, riskreducing actions implementation and spare parts have not been considered. There are 8 major risks and 28 failures in all. Fig. 4(b) shows the expected criticality matrix which displays the expected
results after implementation of the advocated risk-reducing actions and on-site spare parts. There is no risk in the red zone, and the criticality can be reduced by taking proper measures. In the initial criticality chart in Fig. 4(a), the maximum criticality C = 16, where S = 4 and O = 4, are mainly due to the amplifiers
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
chips failed by the neutron radiation, or the power voltage are unsteady leading the circuit could not sustain steady operation. But after neutron analysis was done and giving a suitable margin to the cable shielding design; strictly choosing the chips suppliers who have the anti-radiation performance; doing adequate testing before assembly; adding voltage regulator module; select power cable with small loss and a certain quantity of spare part on site. The severity can be reduced from S = 4 to 2 and the C could be dropped to 8 in the yellow zone. Besides the maximum criticality C = 16, there are still the other 7 major risks which C = 15. Most of the major risks are focusing on the Si linear detectors and their auxiliaries. The failure modes of Si linear detectors and their auxiliaries are that the background signal could not be provided exactly; the X-ray emission signal could not be received effectively; the continuity check function lost; the data could not be transmitted to the preamplifier. But after some mitigation actions and a certain quantity of spare part on site were considered, severity can be reduced from S = 5 to 4 and the C could be dropped to 12 in the yellow zone. For all the other failure modes the occurrence can be reduced with sufficient testing and the severity also can be reduced by preparing spares or the other actions. Fig. 4(b) shows that only 19 failure modes are medium risks in the yellow zone by the risk-reducing actions and compensating provisions advocated for reducing their criticality, with the associated costs and/or spares.
4. RBD (Reliability block diagram) analysis The RBD analysis was prepared to estimate the reliability and availability of each function under stipulated operating conditions. The evaluating reliability and availability of each main and intermediate function in the ITER RXC system has been performed using BlockSim9 software [5,6]. The functional breakdown structures that were prepared for the IDEFØ analysis form the logical basis from which the RBDs are derived, which were prepared in the former analysis in IDEFØ. The RBDs were drawn as a diagram consisting of nodes of system components for each function. The RBDs of the top functions are shown in Fig. 5. There are 3 sub-functions of the RXC system, where RXC1 stands for to provide services and features to support the main functions, RXC2 stands for to collect X-ray flux and detect the signal, RXC3 stands for to provide physics measurements from signal. The RXC1 module is contained another 3 sub-functions and the other more basic functions and components. So its RBD model was shown in Fig. 6. The contents RXC.1.1, RXC.1.2 and RXC.1.3 stand for were shown in Table 1. The RBD model to collect X-ray flux and detect the signal are more complicated than the first one to provide services and features to support the main functions, so the RBD model was shown in Fig. 7. Although only several functions level of RBD models are shown, for a detailed analysis, the top level system nodes represent subdiagrams, cascading to sub-system, unit, device and parts has been established and finished. The upper internal camera tube is in parallel with the lower internal camera tube, and the upper half of external camera channel (together with thermocouple, cables, detectors, etc.) is in parallel with the lower half of external camera channel. Because the RXC system is used to measure the X-ray emission profile of plasma, half of the internal camera channels (observe upper or lower plasma) and half of the external camera channels can achieve this goal. Of course, it will be better if the two internal camera tubes and the two external camera channels could operate simultaneously. So when building of RBD model and calculation, the two internal camera tubes are in parallel from the design point of view but also the RAMI point of view, the same consideration to the two external camera
173
channels. So the internal tube or external camera is replaced in whole when failure. The beryllium window break will not influence the ITER operation and RXC physical signal acquisition from the experience of JET. So beryllium window is not considered in the RXC availability calculation. ITER operations and the RXC system failure have the following relationship: (1) ITER operation has to be stopped when RXC failure modes of vacuum leakage or nuclear leakage, the causes were welds broken, E-feedthrough ceramic isolation damaged or valves leakage. ITER machine and the RXC system need to be stopped to check the primary vacuum boundary, and then repairing or replacing. All the procedures are following the ITER maintenance procedure. (2) ITER can continue to operate independently but RXC has to be stopped, when the beryllium windows, detectors cooling system, Si linear detectors and their auxiliaries fail. This is because at these cases, the second vacuum boundary of RXC detectors have been broken, and the X-ray signal could not be checked and collected exactly. But there are not impurities to the VV and the ITER machine primary vacuum boundary was still maintained, so ITER could operate independently. (3) ITER can continue independently to operate, also the RXC diagnostic system, but at the CODAC room the X-ray signal could not been read. Because the signal transfer or amplify system fails, just like the preamplifier could not amplify the signal; current signal could not be changed into voltage signal; mid-amplifier could not amplify the voltage signal; hardware initialization failed; raw data error and so on. In these cases, the failures only happened out of the primary vacuum boundary, also out of the second vacuum boundary of RXC system. The Ex-vessel failure did not influence the ITER and RXC operation. The Port Integration (PI) team is now designing multifunction feedthrough containing E-feedthrough, Cooling gas feedthrough and SVS port, so number of feedthrougs may be considered as 3 in all with the MTBF 666667 h and MTTR 1440 h: one for upper tube, one for lower tube and another for the external camera. During the calculation, the MTTR of components inside port plug is supposed to be: firstly 12 days for cooling down, then 1 week for ISS/PCSS (vacuum extensions removal), 3 days for work, and then 1 week for ISS/PCSS/Vacuum externals installation, at last 1 month for pumpdown or commissioning, so in all the time was 2 months (1440 h). For maintenance of other components, the MTTR was shorter. Duty cycle (ratio of the operating time of the component compared to the total operating time of the system considered) was set to be 20% for all components. It was done because the system is going to be used only during the plasma operation. Maintenance regarding to ex-vessel failure modes and components, which did not need to break vacuum boundary is foreseen when the plasma will be off. The other maintenances which need breaking of vacuum boundary will wait for the ITER in its main shutdown. undary is foreseen when the plasma will be off. The other maintenances which need breaking of vacuum boundary will wait for the ITER in its main shutdown. Component failure data was mainly taken from various sources such as manufacturers’ specifications, reliability databases, industry standards, previous experience compiled in other scientific devices, the other most important source is that because it is not get the precise data, so assumption data are made following the personal experience of the RAMI analysts and experts available at the time of the analysis. Sometime the available data may not be completely pertinent because the very specific experimental conditions the components will face on ITER can be not known very precisely, therefore an appropriate estimation has to be carried out based on the data sources take from such as EAST, KSTAR, JT-60 devices and so on. For the components of the same type (detectors, valves, pumps, pipelines, gauges etc.) pessimistic scenario was considered. It means that the worst parameters for components of the
174
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
Fig. 5. Reliability Block Diagram for RXC system top function (A0 level).
Fig. 6. Reliability Block Diagram of RXC1 to provide services and features to support the main functions.
Fig. 7. Reliability Block Diagram of RXC2 to collect X-ray flux and detect the signal.
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
175
Table 4 Initial and expected input data for reliability & availability calculations of ITER RXC system. Components considered
upper or lower internal camera tube(including thermocouple, cables, piping, Gauges, shielding block, slit, Single detector behind linear array, Si linear detectors, Light source) external camera chamber Multi-function feedthrough (including E-feedthrough, Cooling gas feedthrough and SVS port) SVS connector Valves thermometer Flowmeter Pressure gage Heat exchanger gas tank Circulating pump SVS and cooling gas line valves Shielding cabinet concrete block E-connector Preamplifiers Mid-amplifier Power supplier Signal source DAQ card or timing board I/O chassis Analogue input or digital input/output Software or communication
Initial
Expected
(1/h)
MTTR (h)
(1/h)
MTTR (h)
2.45E-4
1440
2.45E-4
1440
1.26E-4 1.50E-6
1440 1440
1.26E-4 1.50E-6
1440 1440
5.71E-6 3.20E-6 0.25E-5 4.30E-6 1.0E-6 3.0E-6 5.30E-7 2.0E-6 3.20E-6 4.65E-7 1.14E-7 1.44E-6 7.87E-6 7.87E-6 4.48E-7 2.28E-6 3.80E-6 5.65E-8 4.48E-7 5.70E-6
720 720 336 168 168 1440 1440 72 168 720 720 2160 173.5 173.5 15 27.5 27.5 27.5 51 72
5.71E-6 3.20E-6 0.25E-5 4.30E-6 1.0E-6 3.0E-6 5.30E-7 2.0E-6 3.20E-6 4.65E-7 1.14E-7 1.44E-6 5.70E-6 5.70E-6 4.48E-7 2.28E-6 3.80E-6 5.65E-8 4.48E-7 5.70E-6
720 720 168 48 48 8 8 8 8 720 720 720 48 48 8 8 8 8 8 8
Table 5 Inherent availability and reliability of main functions of the ITER RXC system. Functions
To measure the X-ray emission and research the MHD of plasma (RXC0) To provide services and features to support the main functions (RXC1) To ensure proper vacuum(RXC1.1) To provide the detector cooling (RXC1.2) To provide shielding (RXC1.3) To collect X-ray flux and detect the signal (RXC2) To collect X-ray flux (RXC2.1) To amplify and acquire the signal (RXC2.2) To collect X-Ray flux and detect the signal (RXC3)
same types were taken into consideration. The overview of input data for components used is given in Table 4. The inherent availability and reliability of main functions of the ITER RXC system are summarized in Table 5. The simulation end time is 11,520 h (approx. 16 months) because this time corresponds to typical operation cycle of ITER. And 264 h (11 days) for reliability, 11-days are consistent with the single ITER plasma operation cycle which followed by 3 days of routine maintenance. The numbers of simulations are fixed at 1000 which is large enough for their significant digits. It can be seen that the availability for the expected simulation is improved over the initial simulation, primarily due to the provision of spares reducing the estimates. The exponential or fixed reliability was usually used for the components failure distribution, and the exponential failure distribution was used for simulation. The availability for all function of the ITER RXC system is 92.93% without spares and 95.23% with spares over 16 months. 5. Conclusion The ITER RAMI approach was applied to the ITER Radial X-ray Camera diagnostic system for technical risk control in the preliminary design phase. The functional break-down was performed to understand the required functions of the ITER RXC system. The
Inherent availability (%)
Reliability (%)
Initial
Expected
Initial
Expected
92.93 98.91 99.39 99.62 99.99 94.09 93.90 99.88 99.96
95.23 99.19 99.39 99.92 99.99 96.02 96.13 99.98 99.99
97.71 99.38 99.84 99.70 99.98 98.72 99.27 99.40 99.84
98.14 99.40 99.84 99.70 99.98 98.76 99.31 99.41 99.84
RXC system requires a very high performance to measure the Xray emission and research the MHD of plasma with high accuracy. And at the same time all the signal could be transferred outside to the amplifiers and analysis centre in the neutron environment. Overall functional breakdown was done firstly, IDEFØ analysis was applied to create diagrams of the processes for each function in the system and define the relationships among the sub-functions. FMECA analysis was performed to evaluate severity and occurrence of the failure modes within the system and to prepare the criticality chart on this basis. Risks of RXC system are sorted and the mitigation actions for major risks of high initial criticality are provided. There are 28 risks for the initial state, including 8 major. No major risk remains after taking into account all the actions. RBD analysis was applied to failure modes, the failure rate and availability for the device block for each function in initial and expected conditions. The initial and expected availability of each main function and the total availability of RXC systems are calculated. The initial availability of RXC system was 92.93%, after optimizations were taken the expected availability was 95.23%. The numbers of spare parts are recommended and the components which may be used in the other ITER systems including diagnostic tenant systems are recommended for standardization. If most of the same or similar functional components could realize standardizing, it allows decreasing significantly time to repair of failure components in all
176
S. Qin et al. / Fusion Engineering and Design 112 (2016) 169–176
systems. This result in preliminary design phase must be qualified further when the system design is more mature. All the RAMI requirements including mitigation actions and spare part recommendations are expected to be integrated in the baseline and to be implemented during the design, the construction, test and conditioning, and following operation period. Acknowledgments The work was performed in the frame work of RAMI analysis for the ITER RXC system Procurement Arrangement and the National Science and Technology Major Project of the Ministry of Science and Technology of China (5.5.P1.CN.02/1A). Also has been supported by the National Natural Science Foundation of China (Grant No.Y65JQ21502) and National Magnetic Confinement Fusion Science Program (Grant Nos. 2014GB101001, 2015GB107001). The author also would like to express his thanks to all the members
of ITER RXC team in china and the ITER Organization colleagues. The views and opinions expressed herein do not necessarily reflect those of the ITER Organization. References [1] D. van Houtte, K. Okayama, F. Sagot, RAMI approach for ITER, Fusion Eng. Des. 85 (2010) 1220. [2] R. Buende, Fusion Eng. Des. 29 (1995) 262. [3] D. van Houtte, K. Okayama, F. Sagot, ITER RAMI analysis programme, ITER D (2012) 28WBXD. [4] Shijun QIN, Yuntao SONG, Damao YAO, et al., RAMI analysis program design and research for CFETR (Chinese fusion engineering testing reactor) tokamak machine [J], J. Fusion Energy 33 (5) (2014) 516. [5] S. Kitazawa, K. Okayama, Y. Neyatani, F. Sagot, D. van Houtte, RAMI analysis of ITER CIS, Fusion Eng. Des. [5]S.KitazawaK.OkayamaY.NeyataniF.SagotD.van HoutteRAMI analysis of ITER CISFusion Eng. Des.89 (2014) 88. [6] K. Okayama, D. van Houtte, F. Sagot, S. Maruyama, Fusion Eng. Des. 86 (2011) 598.