CERN Rdiger Schmidt Introduction to Machine Protection and

CERN Rüdiger Schmidt Introduction to Machine Protection and Interlock Systems Rüdiger Schmidt, CERN Workshop on Beam Interlock Systems CERN 2 -3 February 2015 BIS workshop February 2015 page 1

Protection from Energy and Power CERN ● Risks come from Energy stored in a system (Joule), and Power when operating a system (Watt) • ● An uncontrolled release of the energy, or an uncontrolled power flow can lead to unwanted consequences • • ● “Very powerful accelerator” … the power flow needs to be controlled Damage of equipment and loss of time for operation For particle beams, activation of equipment This is true for all systems, in particular for complex systems such as accelerators • • For the RF system, power converters, magnet system … For particle beams Rüdiger Schmidt BIS workshop February 2015 page 2

CERN Proton collider LHC – 362 MJ stored in one beam Switzerland Lake Geneva LHC Accelerator (100 m down) LHCb CMS, TOTEM ALICE SPS Accelerator ATLAS LHC pp and ions 7 Te. V/c – up to now 4 Te. V/c 26. 8 km circumference Energy stored in. BIS one beam 3622015 MJ Rüdiger Schmidt workshop February page 3

CERN Proton collider LHC – 362 MJ stored in one beam Switzerland Lake Geneva LHC Accelerator (100 m down) If something goes wrong, the beam energy LHCb CMS, has to be safely deposited TOTEM ALICE SPS Accelerator ATLAS LHC pp and ions 7 Te. V/c – up to now 4 Te. V/c 26. 8 km Circumference Energy stored in. BIS one beam 3622015 MJ Rüdiger Schmidt workshop February page 4

ESS Lund / Sweden – 5 MW beam power CERN ~ 500 m 352. 21 MHz Source 704. 42 MHz 2. 4 m 4. 0 m 3. 6 m 32. 4 m 58. 5 m LEBT RFQ MEBT DTL Spokes 75 ke. V Low energy beam transport 78 Me. V 3 Me. V RFQ 352. 2 MHz Medium energy beam transport Drift tube linac with 4 tanks 113. 9 m Medium β 200 Me. V 227. 9 m High β 628 Me. V HEBT & Upgrade Target 2500 Me. V Super-conducting cavities High energy beam transport Power of 5000 k. W • Operating with protons • Operation with beam pulses at a frequency of 14 Hz • Pulse length of 2. 86 ms As an example for a high • Average power of 5 MW intensity linear accelerator • Peak power of 125 MW (similar to SNS and J-PARC) Rüdiger Schmidt BIS workshop February 2015 page 5

ESS Lund / Sweden – 5 MW beam power CERN ~ 500 m 352. 21 MHz 704. 42 MHz 2. 4 m 4. 0 m 3. 6 m 32. 4 m 58. 5 m LEBT RFQ MEBT DTL Spokes 113. 9 m 227. 9 m If something goes wrong, injection has to be stopped Source 75 ke. V Low energy beam transport 78 Me. V 3 Me. V RFQ 352. 2 MHz Medium energy beam transport Drift tube linac with 4 tanks Medium β 200 Me. V High β 628 Me. V HEBT & Upgrade Target 2500 Me. V Super-conducting cavities High energy beam transport Power of 5000 k. W • Operating with protons • Operation with beam pulses at a frequency of 14 Hz • Pulse length of 2. 86 ms As an example for a high • Average power of 5 MW intensity linear accelerator • Peak power of 125 MW (similar to SNS and J-PARC) Rüdiger Schmidt BIS workshop February 2015 page 6

Energy stored in beam and magnet system CERN LHC energy in magnets Energy stored in the beam [MJ] 10000, 00 1000, 00 LHC top energy 100, 00 LHC injection ESS (beam one SPS fixed 10, 00 ISR HERA TEVATRON SPS batch to LHC 1, 00 0, 10 LEP 2 RHIC proton SPS ppbar 0, 01 1 Rüdiger Schmidt 10 BIS workshop February 2015 100 Momentum [Ge. V/c] 10000 page 7

CERN What does it mean ……… Joule, k. J and MJ? The energy of pistol bullet: about 500 J The energy of 1 kg TNT: about 4 MJ The energy of 1 l gas: about 36 MJ To melt 1 kg of steel (copper is similar): about 800 KJ Rüdiger Schmidt BIS workshop February 2015 page 8

CERN Hazards and Risks Rüdiger Schmidt BIS workshop February 2015 page 9

Hazard and Risk for accelerators CERN ● Hazard: a situation that poses a level of threat to the accelerator. Hazards are dormant or potential, with only a theoretical risk of damage. Once a hazard becomes "active“: incident / accident. Consequences and possibility of an incident interact together to create RISK, can be quantified: RISK = Consequences ∙ Probability Related to accelerators ● Consequences of an uncontrolled beam loss ● Probability of an uncontrolled beam loss ● The higher the Risk, the more Protection is required Rüdiger Schmidt BIS workshop February 2015 page 10

LHC Layout Beam dump blocks Layout of. IR 5: CMS beam dump system in IR 6 CERN eight arcs (sectors) Signal to kicker magnet eight long straight section (about 700 m long) IR 4: RF + Beam instrumentation IR 6: Beam dumping system IR 3: Moment Beam Clearing (warm) IR 7: Betatron Beam Cleaning (warm) IR 8: LHC-B IR 2: ALICE Detection of beam losses with >3600 monitors around LHC IR 1: ATLAS Injection Rüdiger Schmidt BIS workshop February 2015 Injection Beams from SPS page 11 11

CERN LHC strategy for machine protection • Definition of aperture by collimators. Beam Cleaning System • Early detection of equipment failures generates dump request, possibly before beam is affected. Powering Interlocks Fast Magnet Current change Monitor • Active monitoring of the beams detects abnormal beam conditions and generates beam dump requests down to a single machine turn. Beam Loss Monitors Other Beam Monitors • Reliable operation of beam dumping system for dump requests or internal faults, safely extracting beams onto the external dump blocks. Beam Dumping System • Reliable transmission of beam dump requests to beam dumping system. Active signal required for operation, absence of signal is considered as beam dump request and injection inhibit. Beam Interlock System • Passive protection by beam absorbers and collimators for specific failure cases. Rüdiger Schmidt BIS workshop February 2015 Collimator and Beam Absorbers page 12

Machine Interlock Systems at LHC CERN ● Beam Interlock System • ● Powering Interlock System • ● Ensures that the beams are extracted into the beam dump blocks when one of the connected systems detects a failure Ensures communication between systems involved in the powering of the LHC superconducting magnets (magnet protection system, power converters, cryogenics, UPS, controls) Normal conducting Magnet Interlock System • • Ensures protection of normal conducting magnets in case of overheating Ensures communication between systems involved in the powering of the LHC normal conducting magnets (magnet protection system, power converters, UPS, controls) Separate machine interlocks strictly from interlock for personnel safety Rüdiger Schmidt BIS workshop February 2015 page 13

LHC Interlock Systems and inputs CERN Timing LHC LHC Devices SMP Software Interlocks Safe Beam Flag SEQ via GMT BCM Beam Loss Experimental Magnets CCC Transverse Operator Experiments Feedback Buttons Collimator Positions Beam Aperture Kickers Environmental parameters Collimation System BTV screens FBCM Lifetime MKI Beam Dumping System 12 8 PIC essential WIC + auxiliary circuits Magnets Power Converters ~1800 Rüdiger Schmidt FMCM Injection BIS RF System Power Converters AUG UPS JAS 2014 Mirrors BTV Beam Interlock System (distributed system over 27 km) 32 QPS (several 10000) Movable Devices Cryo OK BLM Monitors in arcs aperture (several limits (some 100) 1000) BPM in IR 6 Doors Access System Vacuum System EIS Vacuum Valves (~300) Timing System (PM) Access Safety Blocks page 14 RF /e. Stoppers

Beam Interlock System Function CERN BIS ~200 User Systems distributed over 27 kms Both-Beam LHC has 2 Beams Some User Systems give simultaneous permit Others give independent permit Beam-1 Beam-2 Following slides from Ben Todd Rüdiger Schmidt BIS workshop February 2015 page 15

Signals CERN Rüdiger Schmidt BIS workshop February 2015 page 16

Signals with redundancy CERN Rüdiger Schmidt BIS workshop February 2015 page 17

CERN Signals with redundancy and feedback to users Hardware MATRIX = 9500 Complex Programmable Logic Device (CPLD) Hardware Description Language (VHDL) NON-CRITICAL / Monitoring = DIFFERENT device Rüdiger Schmidt BIS workshop February 2015 page 18

Layout CERN In LHC, BIS forms a transparent layer from User System to Beam Dump Rüdiger Schmidt BIS workshop February 2015 page 19

Layout CERN Rüdiger Schmidt BIS workshop February 2015 page 20

Layout CERN Rüdiger Schmidt BIS workshop February 2015 page 21

Beam Permit Loops & BICs CERN 4 fibre-optic channels from Point 6 1 clockwise & 1 anticlockwise for each Beam Dump Beam-1 and Beam-2 Square wave generated at IP 6 -Signal can be cut by any Controller -Signal can be monitored by any Controller When any of the four signals is absent at IP 6, BEAM DUMP! Beam-1 / Beam-2 are Independent! Beam Interlock Controllers (BIC) 16 BICs per beam - Two at each Insertion Point Up to 20 User Systems per BIC 6 x Beam-1 8 x Both-Beam 6 x Beam-2 Rüdiger Schmidt BIS workshop February 2015 page 22

LHC Function CERN Rüdiger Schmidt BIS workshop February 2015 page 23

Typical Hardware CERN User Interface BIC (Front) Rüdiger Schmidt Partially located in Radiation environment BIC (Rear) BIS workshop February 2015 page 24

CERN Some essentials from the specification • Clear Interface between User Systems and Beam Interlock System • Fast and distributed = 100μs over 27 km • Fully Redundant System from User Permit to Actuator = Safe • Redundant Power Supplies, very robust cables and connectors, minimise connections = Available • Critical is Hardware Only • Critical physically separated from non-critical • NO remote update of critical • CAN remote update non-critical • Little requirements for radiation tolerance Rüdiger Schmidt BIS workshop February 2015 page 25

CERN Some essentials from the specification • Modular in-house design • 20 years lifespan (system design between 2003 and 2005) • Every Board tested during fabrication • Every Controller exhaustive critical test before installation • Installed system can be fully tested on demand • Option to mask / disable inputs in a controlled way • Pre operational checks • Full online consistency monitoring during operation • Post operational checks Rüdiger Schmidt BIS workshop February 2015 page 26

Have a good workshop CERN Beam Interlock Systems Rüdiger Schmidt BIS workshop February 2015 page 27

CERN Concluding slides Rüdiger Schmidt BIS workshop February 2015 page 28

For discussion CERN There are many ways to make a Beam Interlock System, no claim that the CERN BIS is the best, but it was demonstrated that it works ● Safety systems: keep it simple! All functionalities that are not strictly safety relevant – outside ● Time for development of a safety system with respect to a non-safety system: my experience is a factor between 3 to 7 ● ● ● Is the Linac 4 BIS architecture adequate for ESS? Should the separation between “users” of the interlock system by user boxes be retained? Is a VME based system (at least for the first years of operation) acceptable? What parts of the SW layer can possibly be re-used in ESS? What developments are required to use the system for, say, the next 10 years? What for the next 40 years? Rüdiger Schmidt BIS workshop February 2015 page 29

One option for continuation CERN provides ESS with one interlock crate, a few user boxes and a CIBT ● ESS, assisted by CERN, makes it operational for tests, e. g. at a source test stand, in an EPICS environment ● EMBEX develops a prototype for one “user” system, reading the magnet current, producing safety flags, and feeding them into a user box (…one of the most critical user systems – think about changing the name) ● • ● EMBEX gets experience with the user box, and therefore the BIS HW ZHAW continues with the analysis of the requirements versus CERN implementation for the BIS • • • Adequate Not adequate In principle adequate, but modifications are proposed The time scale of these activities is in the order of 6 -10 months ● Depending on the outcome, plan the next step ● • • ● If positive, start re-engineering of existing cards If required to re-engineer in mu. TCA, secure resources Contractual aspects to be discussed between ESS and different partners Rüdiger Schmidt BIS workshop February 2015 page 30

Participants outside CERN M. Adler@embex. de, Marc Adler (FPGA-Spezialist) ● d. eberhard@embex. de, Dietmar Eberhard (Senior Safety-Hardware Entwickler) ● Martin ML. Lange <m. lange@embex. de>; ● Tobias TLY. Layer <T. Layer@embex. de>; ● Hilbes Christian (hilc <hilc@zhaw. ch>; ● martin. rejzekzhaw. ch; ● Angel Monera Martinez <Angel. Monera. Martinez@esss. se>; ● Annika Nordt (annika. nordt@esss. se); ● Timo Korhonen <Timo. Korhonen@esss. se>; ● Rüdiger Schmidt BIS workshop February 2015 page 31

Participants CERN ● ● ● Stephane Gabourin <Stephane. Gabourin@cern. ch>; Christophe Martin <Christophe. Martin@cern. ch>; Arend Dinius <Arend. Dinius@cern. ch>; Benjamin Todd <benjamin. todd@cern. ch>; Markus Zerlauth <Markus. Zerlauth@cern. ch>; Jorg Wenninger <Jorg. Wenninger@cern. ch>; Andrea Apollonio <Andrea. Apollonio@cern. ch>; Carlos Garcia Argos <carlos. garcia. argos@cern. ch>; Jean-Christophe Garnier <Jean-Christophe. Garnier@cern. ch>; Maxime Simon Audrain <maxime. simon. audrain@cern. ch> Andrzej Siemko <Andrzej. Siemko@cern. ch>; Reiner Denz Reiner. Denz@cern. ch; ● Stefanie Sapountzi <stefanie. alexandra. sapountzi@cern. ch>; ● Rüdiger Schmidt BIS workshop February 2015 page 32