Safety Analysis of the Movable Absorber TCDQ in the LHC Beam Dumping System

The LHC Beam Dumping System nominally dumps the beam synchronously with the passage of the particle free beam abort gap at the beam dump extraction kickers. In the case of an asynchronous beam dump the TCDQ absorber protects the machine aperture. It is a single sided collimator, positioned close to the beam and it has to follow the beam position and beam size during the energy ramp. This report assesses the different failure scenarios of TCDQ positioning and their likelihood. The failure probability for the two TCDQ systems together is estimated to be 3.6 E-05 (mean value) for one year of LHC operation. This corresponds to a SIL4 safety level, which is considered sufficient. The three dominant failure modes are highlighted. The calculated failure probability refers to scenarios that are generated and developed inside the TCDQ system. Potential failure sources not included are the interaction with external systems: the transmission of the start signal to the PLC from a dedicated timing card and the manual optimisation of the TCDQ position by the operator. The sensitivity of the TCDQ system to these failures is also discussed and recommendations to address these vulnerabilities are made.