ANALYSIS. LHC Cryogenic System: Criticality analysis, determination of critical hardware components. Abstract

Transcription

1 CERN CH-1211 Geneva 23 Switzerland CERN Dep./Group TE/CRG OA CRYOGENIC LHC Cryo Document Number LHC CRYO OP A 11 EDMS Document No. xxxxxxxx ANALYSIS LHC Cryogenic System: Criticality analysis, determination of critical hardware components Abstract The Large Hadron Collider (LHC) superconducting systems require being cooled down below 2K. The cooling power is provided by helium refrigerators. Gas and liquid helium are both supplied through various valves boxes and cryogenic lines to the LHC, with a minimum of substitution solutions in case of failure of a subcomponent. The reached current overall availability is above 9%, but should be increased to maximise the operation time of the LHC. A criticality analysis is set up at CERN: the aim of this analysis is to highlight critical components in terms of failure occurrence and severity, and then, to adapt the current maintenance plan and the process layout, in order to avoid incidental and accidental events as well. In order to quantify occurrence and severity of failure events, a statistical study of operational data from 1 st January 211 to 1 st August 212 is led. This document gathers the statistical results, in terms of failure rates, occurrences and durations of losses of Cryo Maintain conditions and mean times between failures (MTBF). This allows drawing conclusions about the cryogenic process overall criticality. Applicability LHC Cryogenic System Issued Jimmy MARTIN Date 29/8/212 Checked Krzysztof BRODZINSKI Approved Krzysztof BRODZINSKI

2 Table of Contents 1. PURPOSE OF THE DOCUMENT METHODOLOGY OF STUDY FMECA analysis HAZOP technique Events analysis Reliability computations The chosen method CRITICALITY ANALYSIS AND CRITERIONS Definition of criticality Index of occurrence Index of severity Index of non-detection Other possible indexes STATISTICAL TOOLS Weibull s laws for reliability probabilities Failure rate function Mean Time Between Failures Computing Weibull s parameters from raw data Sampling Linear Regression method Kolmogorov-Smirnov s test STATISTICAL ANALYSIS Sampling raw data Weibull analysis Cold compressors Warm compressors Turbines CV valves Electric heaters PV valves for nitrogen

3 5.3 Global synthesis and index O attribution Severity analysis and index S attribution CRITICALITY RANKING SOURCES OF BIAS LIMITS OF THE ANALYSIS FOR FURTHER CONCLUSION REFERENCES

4 1. PURPOSE OF THE DOCUMENT The aim of this document is to present results of a statistical study based on operational data, from 1 st January 211 to 1 st August 212, and their consequences in terms of criticality of LHC cryogenic process hardware components. Firstly, the choice of the presented method will be justified, and then the treatment of failure events related to hardware components (i.e. cold compressors, CV valves, etc.) and the calculation of failure rate functions, MTBFs and causes distribution will be developed. Secondly, the criticality of each hardware component, its various causes of failure and the possible solutions in order to reduce the occurrence probability and severity of such events will be discussed. 2. METHODOLOGY OF STUDY In terms of criticality analysis, various methods have been applied for many years in industrial sector, such as (non-exhaustive list): FMECA; HAZOP; Events analysis; Reliability computations. 2.1 FMECA analysis FMECA is the acronym for Failure Mode and Effects, Criticality Analysis. This method focuses on each elementary part of the studied process. Firstly, the ranking of most critical elements is done, based on a criticality index (called RPN for Risk Priority Number ), which is the multiplication of three sub-indexes: Index of occurrence of a failure mode, applied on an elementary process part; Index of severity of the events; Index of non-detection of the events. This stage of the analysis is completed by using numerical data from the process (i.e. probabilities of failure by components). Then, the four following questions are formulated, in order to understand the specific processes which lead to failures, and then avoid them as well: What kind of failure mode could happen? What could be its effects on the process? What are the causes which lead to this failure mode? 4

5 How to detect the failure occurrence? However, managing with a sharp level of detail - needed in this analysis - can be hard for a complex process layout, such as the LHC cryogenic process. 2.2 HAZOP technique Given the nominal process parameters, the HAZOP technique tries to understand the consequences of certain variations of these parameters, i.e. what could happen if the liquid helium temperature - initially at 1.8 K suddenly increases and reaches a 5 K value. By ranking the consequences of such process parameters variations in order of severity, it is possible to focus on most critical events and then, to find what kind of component can be responsible for variations of process conditions. After highlighting these critical components, their failure modes can be explored by formulating the next questions: What are the causes which lead to this failure mode? How to detect the failure occurrence? For a complex process, such as the studied one, the analysis of parameters variations can be very difficult. Indeed, many combinations of variables are possible, and each of them can lead to a specific event. 2.3 Events analysis The events analysis is based on cumulated events description for a certain interval of time (i.e. data from Logbook OA ). By finding the origins of a given event with a tree of causes, it is possible to determine what components lead to the detected failure, and then apply actions in order to avoid the new occurrence of this event. This method is appropriate to post-incidental/accidental situations, when an event must be entirely analysed in order to avoid its repetition, but is unsuitable when finding critical elements of a process. Indeed, latent failure modes (for example due to the aging of components) are occulted by this method, whose input is past events. 2.4 Reliability computations This technique is based on a statistical treatment of numerical data, in order to rank components given their own criticality. Determination of criticality is possible by considering the computed values of failure rate functions (most relevant information is their trends). The classical used statistical tool is the Weibull analysis, described on chapter 4. In addition to the previous stage, the origins of failure modes must be explored, in order to avoid severe events occurrence. 5

6 2.5 The chosen method The chosen method is based on reliability computations (using the Weibull analysis) for hardware components which act directly on the process, such as warm and cold compressors, valves, turbines, etc. Given the obtained numerical results, a criticality ranking will be operated, using the next FMECA criterions: Index of occurrence of a failure mode; Index of severity of the events; Note the non-detection index will not be used here, because of a lack of data, which constitutes the input for its formulation. The Pareto analysis of causes will be operated in order to associate to critical process elements some origins of failure, and to help the future analysis that would be set up to avoid the occurrence of highlighted critical failure modes. So, we can define the chosen method as a mix between reliability computations and FMECA aspects (at a much large level of details). 3. CRITICALITY ANALYSIS AND CRITERIONS 3.1 Definition of criticality A component is an elementary part of a complex ensemble such as the LHC s cryogenic process. It ensures one or several technical functions, and so its failure can lead to severe situations, according to the importance of these functions in the overall process. The probability of occurrence of failures, also called failure function F(t) is a function of time. It is proven the age of a component has a direct effect on its probability to be on failure, and as a consequence, on its reliability, which is defined as below: R(t) = 1 F(t) Thus, it is relevant to quantify at any time, increase and then monitor the reliability of an elementary type of components, in order to maintain the overall process availability above an acceptability limit (low limit of global efficiency for LHC s cryogenic process = 9%). Reliability can be improved by calculating and decreasing failure rates of a statistical population of components. However, severity of failures must be taken into account when studying the availability of a process; the calculation of failure rate functions is not enough. Non-frequent events associated to severe consequences can highly reduce the overall process availability, even if the failure rate is low: for example, a cold compressor s stop generally leads to the process stop, i.e. loss of Cryo Maintain conditions. Conditions for starting up the process are reached along various durations; this has a direct incidence on the overall availability. So, it is much more efficient to associate to each type of component a criticality index. The criticality of a population of components is evaluated by calculating its intrinsic failure rate and by taking into account the consequences of a failure event on the overall process in which it is integrated, and the probability monitoring systems (and operators) have to detect such an 6

7 event. For example, a type of components which is defined by a high and growing failure rate and a high non-detection probability of severe failure events will be declared highly critical. The index C of criticality can be calculated as below: With: C O S D O: Index of occurrence of failure events (from to 1); S: Index of severity of these events (idem); D: Index of non-detection (idem). 3.2 Index of occurrence The computation of index O of occurrence is based on the statistical study of cumulated operation data, from 1 st January 211 to 1 st August 212 (extracted from the Logbook OA ). The input data is the date of failure during the studied period, associated to a process hardware component. The output result is the failure rate function λ(t), computed by correlating operation data related to a given hardware component to a statistical law (see chapter 5). Then, given the overall number of failures N cumulated during the studied period and the λ (t) function s trend of each type of components included in the present analysis, an index O of occurrence of failure is associated to them, as follows: The following code must be applied in order to associate to each type of component an occurrence index O: Green.25; Yellow.5; Orange.75; Red 1. For example, a population of a given hardware component which has been affected by 25 failures from 1 st January 211 to 1 st August 212 and whose failure rate function s trend is constant will be associated to an index O equal to.75, according to the previous table. These criterions of association can be discussed and re-evaluated if necessary. Their adjustment depends on the limit of acceptability of occurrence previously defined by the Cryogenics - Operation for Accelerators section. 7

8 Note that four levels of failure rate function s trend are specified. The trend is defined by the value of the β parameter of the statistical Weibull distribution (see chapter 5). Recall the following rules in order to associate a β-value to a trend: β < 1 λ s trend = β = 1 λ s trend = 1 < β 2 λ s trend = + 2 < β λ s trend = Index of severity In this criticality analysis, the severity of a failure is evaluated by two criterions: The loss of Cryo Maintain conditions induced by the event (also noted CM= ); The recovery time of these conditions. During a failure, if requested physical conditions such as fluid level, temperature, pressure or flow rate are lost, the Cryo Maintain (CM) indicator turns into zero. As a consequence, the LHC experiments are interrupted (the beams are dumped), while the CM conditions are not reached. Dates of loss of CM conditions and their associated duration before recovery are implemented in an Excel table by the Cryogenics Operation for Accelerators section, every week (see [8] and [9]). This serves as a statistical basis to the criticality analysis. Three levels of duration before recovering the CM conditions are considered: T < 8h; 8h T < 18h; 18h T. The index S of severity is defined when associating these three previous levels of duration with the overall number of CM losses during the statistical study period. Considering the range of occurrence of CM losses highlighted through the present statistical analysis, three levels of number N are also set up: N CM = < 2; 2 N CM = < 4; 4 N CM =. Note that the case of no loss of CM conditions during the statistical study period is considered as a (T < 8h; N CM = < 2) case. The following table gathers the different cases of association between durations and occurrence of loss of CM conditions: 8

9 Recall the next code of colour in order to associate to each failure case an index S of severity: Green.25; Yellow.5; Orange.75; Red 1. When events for a studied type of component have different duration before recovering CM conditions, intermediate S indexes must be calculated. Then, a mean value of S is considered as the overall severity index. For example, a given type of component led to 2 losses of CM conditions with a recovery time of 7 and 19 hours and 5 losses with recovery durations from 8 to 18 hours. Its mean severity index is calculated as below: S inter1 =.25 (T=7h < 8h; N CM = = 1 < 2); S inter2 =.75 (18h T=19h ; N CM = = 1 < 2); S inter3 = 1 (8h T < 18h; 4 N CM = = 5). S inter1 + S inter2 + S inter3 ) =.67 These criterions of association can be discussed and re-evaluated if necessary. Their adjustment depends on the definition of severity previously set up by the Cryogenics - Operation for Accelerators section. 3.4 Index of non-detection The notion of criticality generally includes the non-detection aspect of a failure. Indeed, the overall availability of a process may be highly reduced in some cases when rare and non-severe events are not quickly detected. As the requested input in order to compute this index is incomplete, D index will be occulted here. 3.5 Other possible indexes Other indexes are possible to define the criticality of process components, such as: Index of accessibility of the component to maintain in case of failure; 9

10 Index of existence of alternative solutions/spares compared to available time to react: Available delay before stop (CM=) T > 24h 5 < T < 24h 1 < T < 5h 1min < T < 1h min < T < 1min Immediate Stop spares alt. solution 8h < Avail. Spare + set up 3 < Avail. Spare + set up < 8h Built in with delay or spare < 3h Alt. solution ready to switch Sometimes, accessibility of a given component is limited, e.g. components inside vacuum vessels. Even if spares are available in order to maintain components, non-accessibility gives severity when they fail. Also, in certain circumstances, alternative solution or spares are available and can be set up with a high accessibility, but the available delay before losing CM conditions is too reduced: such events are declared severe. That s the two previous indexes could take into account. 4. STATISTICAL TOOLS 4.1 Weibull s laws for reliability probabilities A Weibull s law is a continuous law of probability, which is a good approximation of stochastic physical processes. For this reason, it is currently used in fields like maintenance, when components lifetime is studied. In lifetime computations, the reliability probability R(t) can generally be approximated by a Weibull s law, which is expressed as below: Where: t = time variable; β = shape parameter; γ = position parameter; η = scale parameter. 1

11 Recall that R(t) represents the reliability in time of a type of components, in a given environment. R(t) varies from to 1. Its opposite is the failure probability F(t), which is expressed by: 1 1 The γ position parameter is generally equal to zero. But in some specific cases, it may be useful to offset in time the Weibull s law with a γ value. In other cases, successive Weibull s laws must be considered in order to define the reliability probability of a type of components in time. For example, a bi-weibull s law is used when components have two different reliability probability trends in time. The first Weibull s law defines the first interval of lifetime of a population, from t = to t = T. Then, a combination of both distinct Weibull s laws characterises the second interval of lifetime, from t = T to t =. This is expressed by the following system:,, T T Where: α = scale parameter for 1 st law; θ = shape parameter for 1st law; β = shape parameter for 2 nd law; η = scale parameter for 2 nd law; γ = position parameter; t = time variable. From a given Weibull s law, it is possible to determine two current statistical indicators: The failure rate function ; The Mean Time Between Failures (MTBF). 4.2 Failure rate function The failure rate function of a population is given by: 11

12 The three parameters β, η, and γ are related to the Weibull s law of the studied population. The failure rate function represents a number of failures per unit of time (here, [t] = day), and has three different trends, depending on the β values (e.g. η = 3 and β = [.8, 1, 1.3]): λ(t) β < 1 1 < β β = 1 When a bi-weibull distribution describes the cumulated frequency of failures of a given population, two distinct expressions for λ(t) must be considered, as follows:, T, T It is interesting to note the second expression of λ(t) is simply the sum of two failure rate functions. R(t) for a bi-weibull distribution has a much more complex expression from t = T to t =, which is not just a sum of two R(t) sub functions, as previously seen on chapter 4.1. In case of a bi-weibull distribution, the shape of the overall failure rate function of a population (from t = to t = ) is more sophisticated than the previous one. For example, the following typical bathtub shape can be obtained (but others can be found, given the bi-weibull distribution s parameters): 12

13 λ(t) time t (day) Where the red scatter is related to the first failure rate expression, from t = to t = T, and the green to the second expression, from t = T to t =. 4.3 Mean Time Between Failures The Mean Time Between Failures (MTBF) of a population represents an estimator of its reliability, given its environment and its various solicitations. When the overall failure number N is up to 1, the MTBF can be approximated by: TBF is the calculated time between two consecutive failures. This approximation assumes the failure rate is constant along the statistical study interval. For a variable failure rate, this expression loses its validity. If the reliability of a population is given by a Weibull s law (whatever the trend of λ (t)), it is possible to compute the MTBF as below:. 1 1 Where: η and β are the Weibull distribution s parameters; is the Euler s Gamma function: 13

14 The values are given by current probability tables and software. Recall that it is possible to compute MTBF values by using the EXP (GAMMALN) function from Excel. In case of a bi-weibull distribution, a conservative way to compute the MTBF is to use the second law s parameters (if the second law is corresponding to an increasing step of the failure rate function). 4.4 Computing Weibull s parameters from raw data Sampling To be reliable, the sampling of past events must satisfy the two following points: Include at least 1 events; Be related to a coherent population of components, i.e. solicited by a common failure mode. If a combination of two dominant failure modes is found, the coherence of the population can also be reached Linear Regression method If we assume reliability probability is given by a Weibull s law, so: We can determine β, η and γ parameters as follows: Computation of cumulated frequency of failures F*(t): 1 Where: is the overall number of failures of the sample, and so, the number of survivors at time t = ; is the number of survivors at time t. Note the * superscript index which indicates the expression of F(t) is unbiased. The statistical bias related to the sampling is avoided by using the mean estimator of F(t), noted F*(t) (the use of a median estimator for F(t) is also possible, which is not-significantly different from the mean estimator in the present analysis). Computation of Ln(Ln(1/R*(t)): 14

15 First, assume a Weibull distribution of failures and γ = : By demonstrating the linear relation between and Ln(t) terms which are respectively y and x variables in the previous expression, it is possible to identify a distribution of failures of a given population as a Weibull s law. A linear regression applied on the scatter formed by Weibull distribution, as illustrated below: Ln(Ln(1/(1 F*(t)))) and Ln(t) values gives the parameters of the supposed y =.8757x R² = Ln(t) The R 2 correlation coefficient is approximately equal to 1; this demonstrates the linearity of the previous relation. Weibull s parameters can be deduced from computed a and b values: 15

16 If the scatter isn t linearly distributed (i.e. R 2 far from 1) but follows a convex or concave plot, the Weibull distribution hypothesis is not necessarily rejected: this can reveal parameter is not equal to zero. So, the next step of computation must be completed: Choice of an arbitrary point {y 2 ;t 2 } near the middle of the plot; Choice of two other points of the plot {y 1 ;t 1 } and {y 3 ;t 3 }, linearly equidistant to point 2; Computation of estimated gamma, as below: Application to new variable (t γ) of the previous linear regression method. If the R 2 correlation coefficient is close to 1, the hypothesis of a Weibull distribution is valid. Then, β and η can be computed by a linear regression. In this case, γ is simply the previous computed value. If R 2 correlation coefficient is far from 1 after this additional step of computation, so the Weibull distribution hypothesis must be definitely rejected. The case of two distinct linear plots reveals a bi-weibull distribution, which characterises multiple failure modes: y = 3.564x R² =.9649 ln(ln(1/(1 F*(t)))) y =.8555x R² = ln(t) The parameters of the first Weibull s law can be deduced from the purple scatter, with the previous linear regression method: the second failure mode s effects are negligible along the 16

17 first time interval. However, a significant error is introduced when computing the second Weibull s parameters directly by applying a linear regression to the green scatter. Along the second time interval, both failure modes are combined: the first one is only negligible when events are close to the present date. So, for the second scatter, the following method must be applied: Computation of instant failure rate, given by: Where: N(t) is the number of survivors at time t; N() is the number of survivors at time t =. Plotting of Ln(λ inst (t)) = f[ln(t)], as illustrated below: Ln(λinst (t)) y =.151x y = x R² = Ln(t) As presented on chapter 4.2, in case of a bi-weibull distribution, the failure rate function can be simply expressed as a sum of the first failure rate function and a second one, along the second time interval. So, to compute the second distribution s parameters, it is necessary to subtract λ 1 (t) to λ inst (t) along the second time interval, where λ 1 (t) is the previously defined expression of λ(t) along the first interval. Then, the next step consists in plotting Ln(λ inst (t) λ 1 (t)) = f[ln(t)]: 17

18 y = x R² = y = x R² =.9517 The cross scatter represents Ln(λ inst (t) λ 1 (t)) = f[ln(t)] along the second time interval, in other words, the logarithm of the second instant failure rate function less the first distribution s contribution λ 1 (t), as a function of Ln(t). The determination of second Weibull distribution by a linear regression is now possible. Recall the expression of a failure rate function, related to a given Weibull distribution (assuming γ = ): The previous expression is equivalent to: Then: Given the coefficients a and b from the linear regression of the cross scatter: 18

19 1 (When R 2 is close to 1) The same considerations as previously can be applied if R 2 is far from Kolmogorov-Smirnov s test In order to improve the fitting between the observed distribution of failures and a Weibull s law, a Kolmogorov-Smirnov s test can be applied to data. Given Weibull s parameters, a theoretical F theo (t) function can be computed: 1 1 Moreover, to determine Weibull s parameters by a regression method, F*(t) was previously computed, which is the real cumulated frequency of failures. The Kolmogorov-Smirnov s test consists in calculating the maximum absolute value of the difference between F theo (t) and F*(t), and then in comparing this value to a limit value given by a Kolmogorov-Smirnov s table. The limit value is a function of the number N() of the studied population and a chosen level of risk α. This level of risk represents the probability to accept the hypothesis H : F theo (t) = F*(t) whereas it is false (risk of first kind). Also, the level of confidence in this acceptation of H is given by 1 α. Mathematically, this is expressed by: Where: Recall the following example to determine the D limit value from a Kolmogorov-Smirnov s table. If the chosen level of risk α is equal to 5%, and the population size is N() = 18, so the table gives the D limit value, equal to.39: 19

20 If the computed is equal to.281, so we can accept the H hypothesis of a fitting between the observed distribution and a Weibull s law, with a level of confidence equal to 95%. 5. STATISTICAL ANALYSIS 5.1 Sampling raw data Operational data from 1 st January 211 to 1 st August 212 constitutes the input of the present statistical study. In terms of events, only those classified on type failure/stop and problem solved were extracted from Logbook OA. This represents an amount of approximately 5 events along this period. These categories are related to real failures. Eventually, it is possible to extend the analysis to some events on type pre problem, which are sometimes related to failures. The classification of events in coherent groups is necessary to manage with such amount of data. The Weibull analysis keeps its validity for populations of components solicited by at maximum two significant failure modes. So, forming too inclusive groups, which may be solicited by various modes of failures, is a risk for the reliability of the Weibull analysis results. These groups are related to the following hardware components we assume solicited by common failure modes: Cold compressors; Warm compressors; Turbines; CV valves for helium; Electric heaters; PV valves for N 2. Other categories were rejected because not enough data was available for a reliable statistical study from 1 st January 211 to 1 st August

21 5.2 Weibull analysis For complete numerical data about the Weibull analysis, see the table: Excel LHC CRYO Statistics [7] Cold compressors Along the studied period, 25 events are related to cold compressors. When plotting as a function of Ln(t), the following scatter is reached: ln(ln(1/(1 F*(t)))) ln(t) y = 2.683x R² =.9433 The R 2 correlation coefficient is equal to.9433, so the present distribution of failures can be assimilated to a Weibull distribution, whose parameters are: So: (Which means the failure rate function is increasing) The failure rate function s trend is given by the previous computed expression for λ(t): 21

22 λ(t) time (day) When comparing the theoretical probability of failure F theo (t) to the observed F*(t), and applying the Kolmogorov-Smirnov s test, the validity of the Weibull model is confirmed. Indeed, for N = 25 and α = 5% a Kolmogorov-Smirnov s table gives the following limit value: D limit =.264 The maximum value for is equal to.1979, so we can accept the Weibull distribution hypothesis, with a 95% level of confidence. See below the trends for theoretical and observed F(t) probabilities: F(t) theo real t (day) By confirming the validity of the model, it is now possible to compute MTBF for cold compressors, as presented on chapter 4.3. Given the β and η values: 22

23 A Pareto analysis of causes, i.e. failure modes gives the following results: CAUSE Quantity % COM Command UTI Utilities 2 8. UNK Unknown 2 8. MEC Mechanical. ENV Environment. Total Global Pareto histogram for CCs Command Utilities Unknown Mechanical Environment We can observe the main failure mode is related to command about 84% of the overall. In details, through the command category, the cold compressor s regulator and frequency converter are mainly responsible to the 84% of command failures, as presented below: CAUSE Quantity % CCR CC regulation VFREQ Frequency converter PLC QURC regulation INSTRU Instrumentation SIGN Links (profibus, etc.) Total

24 12 Pareto histogram for COM CC regulation Frequency converter QURC regulation Instrumentation Links (profibus, etc) For cold compressors, a unique failure mode is probably dominant and may affect both distinct command systems regulator and frequency converter, that could be why the observed failures distribution fits accurately to a Weibull s law. Also, we can distribute to each cold compressor a number of failures, as follows: VFREQ and CCR failure distribution Element Quantity % %Air Liquide %Linde CC CC CC CC Total % value (Probabilities for Air Liquide and Linde failures computed by using the total probabilities formula ) Note that cold compressors nearby the most soliciting fluid parameters (i.e. to the lowest condition of pressure and temperature) are mainly responsible for failure events: CC1 and then CC2 are mostly on failure. It could be interesting to try to correlate the physical fluid conditions to this failure mode, even if it is related to command systems. By this way, improvements could probably be reached in terms of reliability. Linde cold compressors are statistically the most related with failures, and a similar correlation than the previous one could be set up, in order to improve the overall process reliability. Note the particular concentration of events around Ln(t) = 5.4, which corresponds to August 211. Analysing this singular period in terms of failures causes could also be a source of progress. 24

25 VREQ and CCR failure distribution Linde/A.Liquide failure% CC1 CC2 CC3 CC4 %Air Liquide %Linde The following scatter represents the plotting of on the 11 events which are due to cold compressors regulators failures: as a function of Ln(t), applied ln(ln(1/(1 F*(t)))) ln(t) y = x R² =.8371 The low R 2 value, equal to.8371, is due to the singular concentration of events related to CCR failures around August 211 (i.e. Ln(t) ~ 5.3). But, we can admit the global trend is linear. So, the computation of Weibull parameters is possible: Given these parameters, we can compute and plot the failure rate function, as follows:

26 .12 Lambda (failure/day) time (day) Note the current failure rate function s expression and plot are very similar to the previous ones. Globally, the overall cold compressors trend of failure rate follows the cold compressors regulators one. The computed value of MTBF related to regulators is: This MTBF is higher than the previous one, given the new computed η value, also higher. The Kolmogorov-Smirnov s test allows accepting the Weibull distribution hypothesis: For N=11 and α = 5%: D limit =.3912 The maximum value for is equal to.1773, so we can accept the Weibull distribution hypothesis, with a 95% level of confidence. Note that, excepting the singularity of events around August 211, the theoretical and measured F probabilities fairly fit: 26

27 F(t).5.4 theo real t (day) Warm compressors Warm compressors were affected by 26 failure events along the studied period. The following plot represents the values as a function of Ln(t): ln(ln(1/(1 F*(t)))) ln(t) y =.8912x R² =

28 The R 2 correlation coefficient is equal to.9529, so the present distribution of failures can be assimilated to a Weibull distribution, whose parameters are: So:.8912 (Which means the failure rate function is decreasing) The failure rate function s trend is given by the previous computed expression for λ(t): Lambda (failure/day) y =.54x time (day) When comparing the theoretical probability of failure F theo (t) to the observed F*(t), and applying the Kolmogorov-Smirnov s test, the validity of the Weibull model is confirmed. Indeed, for N = 26 and α = 5% a Kolmogorov-Smirnov s table gives the following limit value: D limit =.2591 The maximum value for is equal to.1642, so we can accept the Weibull distribution hypothesis, with a 95% level of confidence. See below the trends for theoretical and observed F(t) probabilities: 28

29 F(t) theo real t (day) By confirming the validity of the model, it is now possible to compute MTBF for warm compressors, as presented on chapter 4.3. Given the β and η values: A Pareto analysis of causes, i.e. failure modes gives the following results: CAUSE Quantity % COM Command MEC Mechanical LEAK Leakage UTI Utilities UNK Unknown ENV Environment Total

30 Command Mechanical Leakage Utilities Unknown Environment The Pareto analysis reveals a multiplicity of failure modes. Events related to command systems are dominant. Also, mechanical and leakage types of failures are approximately equivalent. However, the Drenick s law says a combination of at least three failure modes leads to a random distribution of failures, which can be represented both by an increasing or decreasing failure rate function, whatever the β values for each mode. So, in that case, it is hard to draw conclusions about the overall failure rate s trend. The observation of January-February of 212 months events reveals a concentration of assimilated leakage failure. The discovery of such an amount of events is related to the previous Technical Stop period (winter 212), when maintenance inspections were applied to warm compressors stations. So, it is also difficult to evaluate the precise date of such failures. The leakage may be reached during the inspections days (e.g. when the reassembly of a flange is non-correctly operated), or during an anterior date (for more details, see [7]). So, the Weibull analysis of warm compressors can be operated by censoring events related to leakages. The following plot represents the linear regression method applied to the cumulated frequency of failures: 3

31 1.5 ln(ln(1/(1 F*(t)))) ln(t) y =.8155x R² =.954 The R 2 correlation coefficient is equal to.954, so the distribution of failures excluding leakage can also be assimilated to a Weibull distribution, whose parameters are: So:.8155 (Which means the failure rate function is decreasing) The refined failure rate function s trend is given by the previous computed expression for λ(t). The trend is in that case much more decreasing than the previous one: the reached current λ value is around.25 failures per day. 31

32 .55.5 Lambda (failure/day) y =.78x time (day) The application of a Kolmogorov-Smirnov s test gives the following results: For N = 21 and α = 5% a Kolmogorov-Smirnov s table gives the following limit value: D limit =.2872 The maximum value for is equal to.1273, so we can accept the Weibull distribution hypothesis, with a 95% level of confidence. Note we gain much more precision about the fitting between the theoretical and observed distributions by censoring leakage events: The current D value is lower than the previous one (which is equal to.1642) F(t) theo real t (day) Given the new β and η parameters, we can compute the warm compressors MTBF: 32

33 (Superior to the previous one) The new causes distribution is given by the next table: CAUSE Quantity % COM Command MEC Mechanical UTI Utilities UNK Unknown ENV Environment Total Command Mechanical Utilities Unknown Environment Two distinct failure modes can be distinguished in that case (i.e. command and mechanical ). The influence of utilities cause is reduced here, comparing to the previous analysis in which the leakage cause was approximately equivalent to both mechanical and command modes. So, we can confirm the overall failure rate s trend is decreasing. The specific study of command and mechanical systems related to warm compressors can t give in that case reliable results: These systems lead respectively to 8 and 6 failures, which are too low numbers in order to operate a Weibull analysis. Not to forget to consider leakage events to improve another statistical indicator of performance, i.e. loss of helium. This criterion is excluded to the present study, even if leakage data may also give a good description about warm compressors global state (state of seals, etc.), as mechanical statistics does. 33

34 5.2.3 Turbines A total of 25 failures can be imputed to turbines from 1 st January 211 to 1 st August 212. The representation of as a function of Ln(t) is given below: 2 ln(ln(1/(1 F*(t)))) 1 ln(t) y = 1.529x R² =.9292 The R 2 correlation coefficient is equal to.9292, so the present distribution of failures can be assimilated to a Weibull distribution, whose parameters are: So: ~ 1 (Which means the failure rate function is approximately constant) The failure rate function s trend is given by the previous computed expression for λ(t): 34

35 .3 Lambda (failure/day) y =.18x time (day) For a studied population number N = 25 and a level of risk α = 5%, a Kolmogorov-Smirnov s table gives the next limit value: D limit =.264 The maximum value for is equal to.1697, so we can accept the Weibull distribution hypothesis, with a 95% level of confidence. The following figure represents the plotting of both theoretical and observed F(t) probabilities: F(t) theo real t (day) Since the validity of the Weibull distribution hypothesis is confirmed, the turbines MTBF can be computed, given the β and η values: 35

36 The Pareto analysis of causes highlights the predominance of two distinct failure modes: command and mechanical sources. CAUSE Quantity % COM Command MEC Mechanical UNK Unknown 2 8. ENV Environment. UTI Utilities. Total Command Mechanical Unknown Environment Utilities The overall failure rate s trend is constant, but individual failure rates for command and mechanical modes are not necessarily both constant: one can be increasing and the other decreasing, giving a constant overall failure rate for turbines. The specific study for command systems related to turbines is possible, given the 15 events cumulated from 1 st January 211 to 1 st August 212. Unfortunately, not enough data is available to analyse failure mode associated to mechanical origins. When plotting scatter is reached: as a function of Ln(t), for command events, the following 36

37 1.5 ln(t) ln(ln(1/(1 F*(t)))) y = 1.262x R² =.8721 The correlation coefficient R 2 is here equal to.8721, due to a consequent number of events concentrated around X-coordinate Ln(t) = 6.2 (May 212). However, the overall trend is approximately linear, occulting this particular amount of events, probably due to a specific failure mode we need to understand. So, we can consider the observed distribution as a Weibull one, whose parameters are: So: (Which means the failure rate function is slowly increasing) When plotting λ(t) as a function of time t:

38 .3.25 Lambda (failure/day) y =.5x time (day) The λ s trend is slowly increasing and is probably responsible for the slow increasing trend of the λ(t) function, related to turbines. So, we can assume the failure rate of mechanical systems is decreasing. The Kolmogorov-Smirnov s test applied on the current distribution gives the following results: For N = 15 and α = 5% a Kolmogorov-Smirnov s table gives the following limit value: D limit =.3376 The maximum value for is equal to.1933, so we can accept the Weibull distribution hypothesis, with a 95% level of confidence. Note the difference between F theo (t) and F*(t) is higher when only focussing on data related to command failure mode. This is also probably due to the concentration of events around Ln(t) = 6.2 (t ~ 5 days), as seen on next graph: 38

39 F(t) theo real t (day) The Pareto analysis for causes gives the following histogram: CAUSE Quantity % FS Flow Switch 6 4. PLC TU regulation INSTRU Instrumentation 3 2. SETTING Settings Total Flow Switch TU regulation Instrumentation Settings Two distinct modes of failure are dominant: Failure related to a flow switch or PLC is intrinsically different.. Also, failures classified on type FS are not necessarily imputable to the flow switch itself: this could be either a hardware failure or a lack of water inside the water circuit the flow 39

40 switch monitors. This is a source of a bias on the statistics, and must be explored in order to censure non-appropriated events and then refine the Weibull model. Note the last events concentrated around t = 5 days are essentially due to FS failures (see table [7]). So, this could explain the observed difference between data and the theoretical distribution. Moreover, taking into account the previous remarks related to the statistical results accuracy, note that all PLC events are associated to Air Liquide 18kW refrigerators (which have their own regulation systems), which means the CERN s PLCs disposed on Linde refrigerators were not affected by failures during the studied period. Also, all FS events are related to Linde refrigerators, as seen below: PLC and FS failure distribution Element Quantity %Air Liquide %Linde PLC FS 6 1 Total 11 In terms of MTBF associated to command systems of turbines, taking into account the computed β and η values: CV valves Global study CV valves were most affected by failures: 43 events were cumulated from 1 st January 211 to 1 st August 212. When plotting trends are distinguishable: as a function of Ln(t), two scatters with linear 4

41 1.3.3 ln(t) y = 3.564x R² =.9649 ln(ln(1/(1 F*(t)))) y =.8555x R² = This reveals the existence of two Weibull distributions with specific failure modes, and will lead to the characteristic bathtub trend for the failure rate function λ(t). This study is applied on a large population of CVs, localized at different process levels (i.e. with different thermo-hydraulic conditions), so we can assume these failure modes are mainly independent of physical properties, such as temperature, pressure and flow rate of the conveyed fluid. Otherwise, it would have been impossible to correlate failures related to such a large population of CVs solicited by very different ranges of physical conditions with any Weibull distribution. This existence can be firstly confirmed by the very close to 1 R 2 correlation coefficients, respectively equal to.9819 and However, a Kolmogorov-Smirnov s test is also mandatory in order to accept the bi-weibull distribution hypothesis. Given the important difference of slopes between the two linear trends, we can consider during the first interval of time, only the first Weibull distribution is dominant, and apply the standard linear regression method to determine Weibull s parameters from the plotting of So, with R 2 =.9819: as a function of Ln(t) presented above And then: To determine parameters associated to the second Weibull distribution, it is necessary to apply the specific method, presented on chapter 4.4.2, i.e. plotting Ln(λ inst (t)) as a function of Ln(t), where λ inst (t) is expressed by: 41

42 Along the second distinguishable time interval, it is also necessary to substrate to λ inst (t) computed values of λ 1 (t) - previously determined - and then, to apply the logarithm to this difference, as seen below, where the purple scatter represents the corrected term Ln(λ inst (t) λ 1 (t)): Ln(t) y = 7.939x R² =.9386 Ln(λ(t)) y = 8.255x R² =.947 Given the linear regression results when applied to the purple scatter, we can compute the second Weibull distribution s parameters (with a R 2 correlation coefficient equal to.947): And then: , 356 days , 356 days The failure rate function s trend is given by the next graph: 42

43 .4.35 Lambda (failure/day) time (day) Note the current failure rate is equal to 3.5 failures every 1 days, which corresponds to 1 failure every 3 days. This value is approximately the observed current failure rate (see table [7]). The Kolmogorov-Smirnov s test gives the results below: For N = 43 and α = 5%: D limit =.22 The maximum value for is equal to.1764, so we can accept the Weibull distribution hypothesis, with a 95% level of confidence. The following graph represents the theoretical and observed R(t) probabilities trends: 43

44 1.2 1 R(t) theo1 theo2 real t (day) See below the plotting of the absolute difference as a function of time: D=Abs(F theo(t) F*(t)) Kolmogorov Smirnov's test t (day) Note the maximum values of D are reached from t = 45 to t = 55 days, said differently, from February 212 to current date. This is due to an important concentration of events which have happened after the winter Technical Stop. A recrudescence of failures is currently observed after a given Technical Stop, during start up stages. The Pareto analysis of causes gives the next results: 44

45 CAUSE N % Command Mechanical Unknown Utilities Environment Total Global Pareto histogram for CVs Command Mechanical Unknown Utilities Environment Two failure modes are dominant: command and mechanical causes both represent around 75% of the overall. Given the large available data for each of them, a much more detailed statistical analysis is possible Command failure mode The specific study of command failure mode gives the following scatter of a function of Ln(t): as ln(ln(1/(1 F*(t)))) ln(t) 45 y = x R² =.9254

46 The overall trend can be considered as linear, with a correlation coefficient R 2 equal to The same concentration of events around X-coordinate Ln(t) = 6 as previously seen for other populations of components is observed. This corresponds to spring 212 (i.e. from February to May 212), which follows the winter Technical Stop. Considering the R 2 value, the correlation between the observed distribution and a Weibull one is possible: Given these parameters, we can compute and plot the failure rate function as below: Lambda (failure/day) time (day) The validity to the Weibull distribution hypothesis characterized by the previous parameters is confirmed by the next Kolmogorov-Smirnov s test: For N = 21 and α = 5%: D limit =.2872 The maximum value for is equal to.16, so we can accept the Weibull distribution hypothesis, with a 95% level of confidence. The following graph represents the theoretical and observed F(t) probabilities trends: 46

47 F(t) theo real t (day) A much more detailed Pareto analysis for command failure mode gives the following distribution of secondary causes: CAUSE Quantity % PROFIBUS SIPART SETTING SAFETY COMPONENT UNKNOWN INSTRU Total PROFIBUS SIPART SETTING SAFETY UNKNOWN COMPONENT INSTRU Failures which are more frequent than others are mainly due to Profibus system (including cables and DP/AP converters) and then to Sipart device. Their occurrence goes increasing as 47

48 revealed by the β value superior to 1. The third most frequent failure mode is the Settings one. But in the worst case, it is a systematic problem which is independent to time (when no corrections are applied): there are no apparent reasons its own failure rate increases. The computation of MTBF for command systems related to CVs gives the next value: Mechanical failure mode When plotting as a function of Ln(t) for mechanical failure mode, the observed scatter is equivalent to a linear distribution, as seen below: ln(ln(1/(1 F*(t)))) y =.6494x R² = ln(t) Given the R 2 value equal to.968, we can correlate the failure distribution to a Weibull s law, whose parameters are: Given these parameters, we can compute and plot the failure rate function as below:

49 .8 Lambda (failure/day) y =.151x time (day) By applying the Kolmogorov-Smirnov s test to the observed distribution, we can validate the hypothesis of its fitting to a Weibull distribution with a 95% level of confidence, as presented below: For N = 11 and α = 5%, a Kolmogorov-Smirnov s table gives the following limit: D limit =.3912 The maximum value for is equal to.11, so we can accept the Weibull distribution hypothesis, with a 95% level of confidence. For mechanical failure mode, the fitting between theoretical and measured distributions is illustrated below: F(t) theo real t (day) The computed MTBF for mechanical failure mode is equal to: 49

50 This MTBF value is higher than the related value for command systems. Indeed, the failure rate for command is increasing whereas it is decreasing for mechanical. This means command systems are mainly responsible for the overall increasing failure rate s trend associated to CVs Electric heaters When only considering events linked with electric heaters on tunnels, 8 failures are available to a statistical study. Curiously, these events are concentrated on a time period which extends from February 212 to June 212 (censuring a singular event on February 211, which introduces bias in the statistics). Note not enough data related to electric heaters from phases separators is available to be studied too. Plotting of as a function of Ln(t) gives the following results: 1.5 ln(t) ln(ln(1/(1 F*(t)))) y = x R² = Note the low R 2 coefficient s value, equal to This can be explained by the low number of events available during the studied period. Perhaps two failure modes are combined what can leads to such a distribution of events, difficult to correlate with certain accuracy to a Weibull one. 5

51 However, taking into account that the precision on Weibull parameters will not be as good as requested, we can compute β, η and γ values: Then we can compute and plot the λ(t) function, as follows: Lambda (failure/day) time (day) The Kolmogorov-Smirnov s test allows accepting the Weibull distribution hypothesis: For N=8 and α = 5 %: D limit =.4543 The maximum value for is equal to.114 so we can accept the Weibull distribution hypothesis, with a 95% level of confidence. When plotting theoretical and measured F functions, we can note the difference between the prediction and the observed failure probability, at current date: 51

52 F(t) t (day) theo real Indeed, the current λ value is equal to 4 failures every 1 days, which is equivalent to 1 failure every 25 days. This is not the observed value which is around 1 failure every 35 days (see table [7]). The MTBF related to electric heaters can be computed, as follows: Even if the current failure rate value is high, the MTBF which comes from a computation including β but also η value is relatively high, in comparison with other components. In terms of causes, the command failure mode is dominant, as seen below: CAUSE Quantity % Command Hardware Power Unknown. Environment. Total

53 Command Hardware Power Unknown Environment Given the observed precision between the measured and theoretical distribution, we can assume the command mode is a combination of at least two failure sub modes PV valves for nitrogen PV valves conveying nitrogen, mainly those referenced PV49 are frequently associated to leak of nitrogen, which could be problematic in terms of availability of the stored fluid. Even if not enough data was cumulated from 1 st January 211 to 1 st August 212, it is interesting to note the particular observed accuracy when correlating the current distribution to a Weibull one. This 5-event distribution can be precisely correlated by a linear regression, as presented below: ln(ln(1/(1 F*(t)))) ln(t) y = x R² =

54 The R 2 coefficient equal to.9562 reveals the accuracy of the linear correlation; it is so possible to compute the Weibull s parameters: The computed expression and plot for λ(t) are presented below: Lambda (failure/day) y = 6E 38x The Kolmogorov-Smirnov s test gives the results below: For N = 5 and α = 5%: time (day) D limit =.5653 The maximum value for is equal to.69, so we can accept the Weibull distribution hypothesis, with a 95% level of confidence. Note the extremely low value for Max(D), in comparison with all the observed values for previous populations of components. The following graph represents the theoretical and observed F(t) probabilities trends: 54

55 F(t).4.3 theo real t (day) The leakage rate for PVs conveying nitrogen is considerably increasing, with a high β value equal to However, note the low value of the current failure rate, which is equal to 3 failures every 1 days (said differently: 1 event every 3 days). The MTBF related to PVs - nitrogen is equal to: This value is approximately equal to the MTBF of CVs - mechanical failure mode. 5.3 Global synthesis and index O attribution The table below sums up the previous results. We can associate to each next population of components an occurrence index, noted O, recalling the criterions presented in chapter 3.2: 55

56 Population type λ s trend N of events MTBF (day) Index O Cold compressors general β = Cold compressors regulator β = Warm compressors general β = Warm compressors without leakage β = Turbines general β = Turbines command β = CVs general CVs command β = CVs mechanical β = Electric heaters β = PVs for N 2 β =

57 INDEX OF OCCURENCE OF PROCESS HARDWARE COMPONENTS Cold Compressors regulator CV valves COM Electric Heatears Turbines command PV valves for N2 Warm Compressors (without leakage) CV valves MEC Severity analysis and index S attribution The following severity analysis is based on the previously mentioned criterions (see chapter 3.3). Its input is the statistics of losses of CM conditions, for 211 and 212 (see tables [8] and [9]). Its output is related to the previous populations. When exploring the statistics of losses of CM conditions, the following results can be drawn: 57

58 SEVERITY OF PROCESS HARDWARE COMPONENTS Cold Compressors regulator Warm Compressors (without leakage) Turbines command CV valves COM Electric Heatears CV valves MEC PV valves for N CRITICALITY RANKING The criticality index - previously defined in chapter 3.1 is obtained by multiplying the occurrence and severity indexes. This leads to the following results: 58