Design aspects related to the reliability of the LHC beam dump kicker systems

The two LHC beam dump kicker systems consist each of 14 pulse generator and magnet subsystems. Their task is to extract on request the beams in synchronisation with the gap in the beam. This operation must be fail-safe to avoid disastrous consequences due to loss of the beam inside the LHC. Only a failing operation of one of the 14 pulse generators is allowed. To preserve this tolerance premature beam dumps are forced immediately after early detection of internal faults. However, these faults should occur rarely in order not to be a source of undesirable downtime of the LHC. The report determines first the level of reliability required for the main components of the system. In particular faults which could cause spontaneously non-synchronised beam dumps are identified. Then, technical solutions are evaluated on failure behaviour. Those having a most likely failure mode which does not cause dump triggers are favoured. These solutions need redundancy and are more complex but have the advantage to be fault tolerant. The design goal can be achieved with a combination of high quality components, redundant signal paths, fault tolerant subsystems, continuous surveillance and check-list validation tests before the start of the injection of beam in the LHC.