Machine Protection LHC Jrg Wenninger CERN Accelerators and

Machine Protection @ LHC Jörg Wenninger CERN Accelerators and Beams Department Operations group CERN-ITER meeting, Dec 2008

Introduction 15/12/2008 ITER-CERN WS - J. Wenninger 2

LHC history 1982 : First studies for the LHC project 1983 : Z 0/W discovered at SPS proton antiproton collider (Sppbar. S) 1989 : Start of LEP operation (Z boson-factory) 1994 : Approval of the LHC by the CERN Council 1996 : Final decision to start the LHC construction 1996 : LEP operation > 80 Ge. V (W boson -factory) 2000 : Last year of LEP operation above 100 Ge. V 2001 : Birth of the LHC Machine Protection WG 2002 : LEP equipment removed 2003 : Start of the LHC installation 2005 : Start of LHC hardware commissioning 2008 : LHC commissioning with beam 15/12/2008 ITER-CERN WS - J. Wenninger 3

7 years of construction to replace : CMS LEP: 1989 -2000 • • e+e- collider 4 experiments max. energy 104 Ge. V circumference 26. 7 km in the same tunnel by LHC : 2008 -2020+ LHCB • proton-proton & ion-ion collider in the LEP tunnel • 4+ experiments • energy 7 Te. V ATLAS ALICE 15/12/2008 ITER-CERN WS - J. Wenninger 4

Tunnel circumference 26. 7 km, tunnel diameter 3. 8 m Depth : ~ 70 -140 m – tunnel is inclined by ~ 1. 4% 5

Beam 2 4 Beam 1 5 LHC 6 7 3 2 SPS TI 2 Booster protons LINACS TI 8 8 1 CPS Ions LEIR Linac PSB CPS SPS LHC Top energy/Ge. V Circumference/m 0. 12 30 1. 4 157 26 628 = 4 PSB 450 6’ 911 = 11 x PS 7000 26’ 657 = 27/7 x SPS Note the energy gain/machine of 10 to 20 – and not more ! The gain is typical for the useful range of magnets !!! 15/12/2008 ITER-CERN WS - J. Wenninger 6

LHC Layout 8 arcs. q 8 long straight sections (insertions), ~ 700 m long. q beam 1 : clockwise q beam 2 : counter-clockwise q The beams exchange their positions (inside/outside) in 4 points to ensure that both rings have the same circumference ! IR 6: Beam dumping system IR 4: RF + Beam instrumentation IR 3: Momentum collimation (normal conducting magnets) The main dipole magnets define the geometry of the circle ! Beam dump blocks IR 5: CMS q IR 7: Betatron collimation (normal conducting magnets) IR 8: LHC-B IR 2: ALICE IR 1: ATLAS 15/12/2008 Injection ring 1 Injection ring 2 7

The Challenge : stored energy Increase with respect to existing accelerators : • A factor 2 in magnetic field • A factor 7 in beam energy • A factor 200 in stored beam energy 15/12/2008 8

Dipole 7 Te. V • 8. 33 T • 11850 A • 7 M J 9

Powering/circuit layout To limit the stored energy within one electrical circuit, the LHC is powered by sectors. q The main dipole circuits are split into 8 sectors to bring down the stored energy to ~1 GJ/sector. q Each main sector (~2. 9 km) includes 154 dipole magnets (powered by a single power converter) and ~50 quadrupoles. q 5 4 6 DC Power feed 3 DC Power LHC 27 km Circumference 7 This also facilitates the commissioning that can be done sector by sector ! Powering Sector 8 2 Sector 1 10

Quench protection - arcs 1. 2. 3. 4. 5. 6. The quench is detected based on voltage measurements over the coils (U_mag_A, U_mag_B). The energy is distributed over the entire magnet by force-quenching with quench heaters. The power converter is switched off. The current within the quenched magnet decays in < 200 ms, circuit current now flows through the ‚bypass‘ diode that can stand the current for 100 -200 s. The circuit current/energy is discharged into the dump resistors. The beam is dumped. >> 2 -6 happen ‚in parallel‘ 11

Beam 2 4 Beam 1 5 LHC 6 7 3 2 protons LINACS TI 8 SPS TI 2 Booster 8 1 CPS Ions LEIR Linac PSB CPS SPS LHC Top energy/Ge. V Stored E/MJ 0. 12 1. 4 ~0. 005 26 ~0. 2 450 3 7000 360 In RED : accelerators where machine protection due to beam is critical. 15/12/2008 ITER-CERN WS - J. Wenninger 12

The LBDS LHC Beam Dumping System 5) TDE The beam is absorbed in a graphite block The beam sweep at the front face of the TDE absorber at 450 Ge. V 4) MKB The 10 kicker magnets dilute the beam energy LBDS inventory Extraction 15 Kicker Magnets + 15 generators 10 Septum Magnets + 1 power converter Dilution 10 Kicker Magnets + 10 generators Absorption One dump block Electronics Beam energy measurement (BEM) Beam energy tracking (BET) Triggering and re-triggering Post mortem diagnostics (check of every beam dump) Beam line 975 m from extraction point to TDE 3) MSD The 15 septum magnets deflect the beam vertically 2) Q 4 The quadrupole enhances the horizontal deflection 1) MKD The 15 kicker magnets deflect the beam horizontally 15/12/2008 ITER-CERN WS - J. Wenninger 13

The dump block q This is the ONLY element in the LHC that can withstand the impact of the full beam ! q The block is made of graphite (low Z material) to beam absorber (graphite) spread out the hadronic showers over a large volume. q It is actually necessary to paint the beam over the surface to keep the peak energy densities at a tolerable level ! p Ap ro 8 x. m concrete shielding 14

MPS mission The central mission of beam related machine protection at the LHC is to ensure that the beam is ALWAYS safely extracted to the dump block since there is no other element that can withstand the impact of the full LHC beam. 15/12/2008 ITER-CERN WS - J. Wenninger 15

LHC cycle beam dump coast energy ramp coast 7 Te. V start of the ramp injection phase preparation and access L. Bottura 15/12/2008 450 Ge. V ITER-CERN WS - J. Wenninger 16

Machine protection organization The machine protection issues that we are discussing here concern only protection of the accelerator from beam related damage. Protection of the personnel and equipment protection against non-beam hazards are dealt elsewhere. 15/12/2008 ITER-CERN WS - J. Wenninger 17

‘MPWG’ : Machine Protection Working Group q Machine Protection @ CERN concerns many different hardware systems Ø Different CERN departments and groups responsible for the equipment q Up to 2000, no coordinated beam MP work, effort mostly concentrated on equipment ‘self-’protection. Ø q Quench protection for SC magnets … In 2001 the MPWG was launched by R. Schmidt (J. Wenninger sc. secretary ) to ensure a coordinate MP effort. Ø MPWG coordinates MP work, takes decisions (consensus) and, if needed, resolves ‘conflicts’. Ø Individual equipment groups remain responsible of their equipment etc. 15/12/2008 ITER-CERN WS - J. Wenninger 18

MPWG activities and evolution q Reviews and external audits, initiated or encouraged by MPWG, are used to obtain external advice Ø Ø q General review LHC Machine Protection System Audit of Beam Interlock System Audit of Beam Dumping System Audit of Beam Loss Monitoring System Sub-working groups were launched as appropriate. Ø Reliability studies sub-WG. Ø Commissioning sub-WG. q Following the LHC startup with beam in 2008, the MPWG has been transformed and exists now as Machine Protection Panel (‘MPP’) with a reduced number of members. Ø Follow up of MP issues at ‘running’ LHC. Ø Defines limits for safe operation. 15/12/2008 ITER-CERN WS - J. Wenninger 19

MPS requirements q Safety Assessment (‘reliability’) – IEC 61508 standard defining the different Safety Integrity Levels (SIL) ranking from SIL 1 to SIL 4 – Based on Risk Classes = Consequence x Frequency – Machine Protection System for the LHC should be SIL 3, taking definition of Protection Systems, with a probability of failure between 10 -8 and 10 -7 per hour (because of short mission times) • Catastrophy = beam should have been dumped and this did not take place; can possibly cause large damage q Availability – Definition: • Beam is dumped when it was not required • Operation can not take place because the protection system does not give the green light (is not ready) – Requirement: • Downtime comparable to other accelerator equipment; maximum tens of operations per year 15/12/2008 ITER-CERN WS - J. Wenninger 20

Dual approach q Prevent faults at the source. Equipment ‘design’ – reliability. Ø Fast internal failure detection. Ø q Detect the effect resulting from any fault, including beam instabilities, and react fast enough to prevent damage. Simulation of failures. Ø Knowledge of damage levels. Ø 15/12/2008 ITER-CERN WS - J. Wenninger 21

Failure studies 15/12/2008 ITER-CERN WS - J. Wenninger 22

Failure categories In the event a failure or unacceptable beam lifetime, the beam must be dumped immediately and safely into the beam dump block. Two main classes for failures (with more subtle sub-classes): Beam loss over a single turn during injection, beam dump or any other fast ‘kick’. Beam loss over multiple turns due to many types of failures. Fastest failures >= ~ 10 -ish turns 15/12/2008 Passive protection - Failure prevention (high reliability systems). - Intercept beam with collimators and absorber blocks. Active protection systems have no time to react ! Active Protection - Failure detection (by beam and/or equipment monitoring) with fast reaction time (< 1 ms). - Fire beam dumping system ITER-CERN WS - J. Wenninger 23

Failure categories 15/12/2008 ITER-CERN WS - J. Wenninger 24

Collimation system A multi-stage halo cleaning (collimation) system has been designed to protect the LHC magnets from beam induced quenches. q Halo particles are first scattered by the primary collimator (closest to the beam). The scattered particles (forming the secondary halo) are absorbed by the secondary collimators, or scattered to form the tertiary halo. q More than 100 collimators jaws are needed for the nominal LHC beam. q Primary and secondary collimators are made of Carbon to survive severe beam impacts ! the collimators have a key role for protection as they define the aperture : in (almost) all failure cases the beam will touch collimators first !! Experiment Protection devices Primary collimator Secondary collimators Tertiary collimators Absorbers Tertiary halo Primary halo particle Beam Triplet magnets hadronic showers Secondary halo + hadronic showers ITER-CERN WS - J. Wenninger 25

Collimator settings at 7 Te. V q For colliders like HERA, TEVATRON, RHIC, LEP collimators are/were used to reduce backgrounds in the experiments ! But the machines can/could actually operate without collimators ! q At the LHC collimators are essential for machine operation as soon as we have more than a few % of the nominal beam intensity ! The collimator opening corresponds roughly to the size of Spain ! 1 mm Opening ~3 -5 mm ITER-CERN WS - J. Wenninger 26

Collimator robustness q Around ~2001 when the MPWG started its work, the LHC collimation system consisted of Copper collimators : ü Excellent for beam stability (low resistivity) ü Good for collimation itself (density). A single mis-injection would have damaged the collimators !!! >> Failures were not considered in the design !!!! q A review of the collimation system requirements indicated that a major re- design was needed !! ü Collimation project & collimation WG were launched. Work in close collaboration with MPWG. ü Robust collimator design based on Carbon collimators – ‘phase 1’. The phase 1 collimator will not allow nominal beams due to beam instability issues (Carbon resistivity). >> Phase 2 collimator design in progress. 15/12/2008 ITER-CERN WS - J. Wenninger 27

Damage levels 15/12/2008 ITER-CERN WS - J. Wenninger 28

Beam induced damage test The effect of a high intensity beam impacting on equipment is not so easy to evaluate, in particular when you are looking for damage : heating, melting, vaporization … >> very little experimental data available ! >> organized a controlled beam experiment: § Special target (sandwich of Tin, Steel, Copper plates) installed in an SPS transfer line. § Impact of 450 Ge. V LHC beam (beam size σx/y ~ 1 mm) Beam 25 cm 15/12/2008 29

Damage potential of high energy beams Controlled experiment with 450 Ge. V beam to benchmark simulations: • Melting point of Copper is reached for an impact of 2. 5× 1012 p, damage at 5× 1012 p. • Stainless steel is not damaged with 7× 1012 • Results agree with simulation. p. A B Shot Intensity / p+ A 1. 2× 1012 B 2. 4× 1012 C 4. 8× 1012 D 7. 2× 1012 D C Effect of beam impact depends strongly on impact angles, beam size… Based on those results LHC has a limit for safe beam at 450 Ge. V of 1012 protons ~ 0. 3% of the total intensity ~ 0. 1 MJ Scaling the results (beam size reduction etc) yields a limit @ 7 Te. V of 1010 protons ~ 0. 003% of the total intensity ~ 0. 02 MJ 15/12/2008 ITER-CERN WS - J. Wenninger 30

When the MPS is not fast enough… • At the SPS the MPS was been ‘assembled’ in stages over the years, but not following a proper failure analysis. • As a consequence the MPS cannot cope with every situation! It is now also covered by the MPWG but would require new resources… • Here an example from …. 2008 ! The effect of an impact on the vacuum chamber of a 400 Ge. V beam of 3 x 1013 p (2 MJ). • Vacuum chamber to atmospheric pressure, Downtime ~ 3 days. 15/12/2008 ITER-CERN WS - J. Wenninger 31

Full LHC beam deflected into copper target Copper target 2808 bunches 2 m Energy density [Ge. V/cm 3] on target axis vaporisation melting Target length [cm] The beam will drill a hole along the target axis !! 15/12/2008 ITER-CERN WS - J. Wenninger 32

Beams and damage Beam type No. protons Safe @ 450 Ge. V Safe @ 7 Te. V Comment Probe bunch 2 x 109 YES !! ‘YES’ Nominal bunch 1 x 1011 YES NO Safe for collimators Nominal injection (288 bunches) 3 x 1013 NO NO Safe for collimators at 450 Ge. V(*) Full beam 4 x 1014 NO NO üAt injection commissioning can be done safely with one bunch. üAt 7 Te. V even the smallest bunch is just about safe. (*) : also tested with 450 Ge. V beams (same time as damage test). Note that a first test resulted in mechanical deformations that led to an improved design (that was retested with beam). 15/12/2008 ITER-CERN WS - J. Wenninger 33

Lessons from the 19 th September incident An severe incident occurred on 19 th September during the last powering tests of one LHC sector (sector 34): At 8. 7 k. A a resistive zone developed in the dipole bus bar between dipoles. q Most likely an electrical arc developed which punctured the helium enclosure. q Large amounts of Helium were released into the insulating vacuum. q Rapid pressure rise inside the LHC magnets – Large pressure wave travelled along the accelerator both ways. – Self actuating relief valves opened but could not handle all. – Large forces exerted on the vacuum barriers located every 2 cells. – These forces displaced several quadrupoles by up to ~50 cm. – Connections to the cryogenic line damaged in some places. – Beam ‘vacuum’ to atmospheric pressure q >> Repair of ~ 50 magnets. >> Indicates that the collateral damage due to beam impact can be much more severe that anticipated consolidation under way ! 15/12/2008 ITER-CERN WS - J. Wenninger 34

Failure studies 15/12/2008 ITER-CERN WS - J. Wenninger 35

Simulations q Many failures simulations were performed under the guidance of MPWG members. q They resulted in : ü Correct requirements for protection systems. ü Design changes and new developments. Typical example : Current decay curves of power converters are used to asses criticality of magnetic circuits. PHD - A. Gomez 15/12/2008 ITER-CERN WS - J. Wenninger 36

Simulation result examples q The evolution of the beam parameters, here beam orbit, is used to evaluate REACTION times for internal interlocks and for beam diagnostic systems (beam loss monitors). PHD - A. Gomez Orbit along the ring Orbit around collimators Collimator jaw 37

Simulation result example q Using a certain transverse beam distributions (usually nominal size with Gaussian shape) it is possible to reconstruct the beam lost at various locations versus time to evaluate REACTION times for internal interlocks and for beam diagnostic systems (beam loss monitors). PHD - A. Gomez 38

Failure studies outcome 15/12/2008 ITER-CERN WS - J. Wenninger 39

Beam loss monitors q Ionization – – chambers to detect beam losses: N 2 gas filling at 100 mbar over-pressure, voltage 1. 5 k. V Sensitive volume 1. 5 l q Requirements – – (backed by simulations) : Very fast reaction time ~ ½ turn (40 s) Very large dynamic range (> 106) q There are ~3600 chambers distributed over the ring to detect abnormal beam losses and if necessary trigger a beam abort ! 40

FMCMs q Led to the development (together with DESY/Hamburg) of so-called FMCMs (Fast Magnet Current change Monitor) that provide protection against fast magnet current changes after powering failures: Fast Magnet Current change Monitor VIPC 626 Simulations indicated absence of redundancy and very short reaction times for BLMs for failures of some normal-conducting circuits in the LHC. CPU + CTRP (or TG 8) q VME Crate ü Very fast detection (< 1 ms) of voltage changes on the circuit. Tolerances of ~ 104 on DI/I achievable. ü The hardware is based on a DESY design. RS 422 link Power Converter BIS interface Voltage Divider & Isolation Amplifier resistive magnet 41

FMCM Test Example Zoom around step time Transfer line dipole PC: >> Steep step programmed into the PC reference to simulate failure FMCM interlock trigger time: ü DI < 0. 1 A ü DI/I < 0. 01% - specification : 0. 1% 15/12/2008 ITER-CERN WS - J. Wenninger 42

Beam Interlock System 15/12/2008 ITER-CERN WS - J. Wenninger 43

Interlock System Overview Over 10’ 000 signals enter the interlock system of the LHC !! Timing LHC LHC Devices Safe Mach. Param. Software Interlocks Movable Devices SEQ CCC Operator Buttons Safe Beam Flag BCM Beam Loss Experimental Magnets Experiments Transverse Feedback Collimator Positions Beam Aperture Kickers Environmental parameters Collimation System BTV screens FBCM Lifetime Mirrors BTV Beam Dumping System Beam Interlock System Injection BIS PIC essential + auxiliary circuits WIC Magnets QPS Power (several Converters 15/12/2008 1000) ~1500 FMCM RF System Monitors aperture limits (some 100) Power Converters AUG UPS BLM Monitors in arcs (several 1000) BPM in IR 6 Doors Access System Vacuum System EIS Vacuum valves Timing System (Post Mortem) Access Safety Blocks RF Stoppers Cryo OK ITER-CERN WS - J. Wenninger 44

Beam Interlock System BIS Beam ‘Permit’ Dump Kicker User permit signals Hardware links and systems Actors and signal exchange for the beam interlock system: • ‘User systems’ : systems that survey equipment or beam parameters and that are able to detect failures and send a HW signal to the beam interlock system. • Each user system provides a HW status signal, the user permit signal. • The beam interlock system combines the user permits and produces the beam permit. • The beam permit is a HW signal that is provided to the dump kicker (also injection or extraction kickers) : absence of beam permit dump triggered ! 15/12/2008 ITER-CERN WS - J. Wenninger 45

Beam Interlock System q Unique Hw solution for connecting any user system (= interlock) via a copper cable. l Fiber optic variant for long links (>1. 2 km) q BIC (Beam Interlock Controller) boards embedded in VME chassis. q Beam Permit Loops with Frequency signals connect the BICs with the corresponding kicker system (extraction, injection, dump). q In operation at the SPS and the SPS/LHC transfer lines since 2006. Inputs are: § maskable (with safe beam) § unmaskable User Permit User System #1 #1 Beam User System #2 Permit #2 User Interfaces Loops copper cables (F. O. ) rear User System #14 front Beam Interlock Controller 46

Architecture of the LHC BEAM INTERLOCK SYSTEM Beam-1 / Beam-2 are Independent! - fast reaction time (~ s) - safe - limited no. of inputs - Some inputs maskable for safe beam intensity Up to 20 Users per BIC system: 6 x Beam-1 8 x Both-Beam 6 x Beam-2 Connected to injection IR 2/IR 8: -In case of an interlock (=NO beam permit), the beam is dumped & injection is inhibited. - It is not possible to inhibit injection ALONE. 47

BIS Reaction Times USER_PERMIT signal changes from TRUE to FALSE a failure has been detected… beam dump request User System process Signals send to LBDS Beam Interlock system process Beam Dumping System waiting for beam gap ~70μs max. > 10μs t 1 89μs max t 2 Kicker fired all bunches have been extracted ~ 89μs t 3 t 4 Achievable response time ranges between 100 s and 270 s (between the detection of a dump request and the completion of a beam dump) 15/12/2008 ITER-CERN WS - J. Wenninger 48

In action… 15/12/2008 ITER-CERN WS - J. Wenninger 49

First Emergency Dump First “Emergency Dump” on Thurs 11 th at 22: 45: 08 q On 11 th September 2008 during operation with circulating beam. q At 22: 45: 08, beam 2 was dumped by the LBDS triggered by the BIS. q The dump was caused by a water fault in the DC cables in the main quadrupole circuit in LHC sector 81. q This event allowed to address the performance of the interlock / machine protection systems at a very early state, as well as to understand the functionality of the post mortem (transient data) recording 15/12/2008 ITER-CERN WS - J. Wenninger 50

First Dump Beam Interlock Controller at IP 6 received dump request - 50 s later (anti clockwise signal) - 180 s later (clockwise signal) Beam Dump 561. 523 ms Beam Interlock Controller at IP 8 received dump request at 561. 437 ms Data from Beam Interlock System 51

Post-mortem System As indicated on the previous slide the Post-mortem data is very important. q The diagnostics of failures is essential to: ü Understand what happened. ü Assess the performance / correct functioning of the MPS. ü For critical systems like beam dumping system, the PM analysis is MANDATORY to ensure that the system is ‘as good as new’. q At the LHC all equipment systems provide post-mortem data: Ø Circular buffers that are frozen on fault/beam abort. Ø Accurate timestamps, down to s for fast systems. Ø Data relevant for understanding of failures. Ø Buffer depth and granularity dependent on system. Typical for beam diagnostics is turn by turn (sometimes bunch by bunch). >> ‘Expected’ data volume for LHC : 2 -5 GBytes 15/12/2008 ITER-CERN WS - J. Wenninger 52

Software interlocking q In very large accelerators it is not always possible to cover all failure mechanisms with a hardware system: needs something more flexible. Example : At the LHC the integrated bending field of horizontal steering magnets may bias the beam energy and cause problems during beam aborts. q Provide flexibility to quickly add new interlocks (provided they are not too time critical). q Need to survey the integrity of the settings even with a MCS system: Comparison of data and digital signatures between front end computers and DB. >> Software Interlock System to survey the control system components relevant for machine protection as additional protection layer, with possibility to abort beam if necessary. 15/12/2008 ITER-CERN WS - J. Wenninger 53

MPS settings control q A Critical Settings Management (MCS) system has been developed for the LHC (and for CERN in general) to be able to control MPS settings (for example Beam loss monitor thresholds…) through the central controls database without loss of security. q MCS provides: Ø Critical settings that can only be changed by authorized groups of persons. Ø Parameters are visible to everyone that has access to the control system. Ø Authentication and Authorization of the user. Ø Verification that values of critical parameters have not changed since the authorized person has updated them: § Data transfer errors. § ‘Hacking’. § Data corruption – radiation, data loss during reboots… 15/12/2008 ITER-CERN WS - J. Wenninger 54

Critical settings control Based on the concept of public & private key. q User logs in. q The critical data receives a digital signature. q Data and digital signature are: • Send to the front-end system which verifies the data validity. • Stored together in the DB - avoid direct DB access, reference for checks. 15/12/2008 ITER-CERN WS - J. Wenninger 55

Documentation q All presentations, minutes of meetings etc are accessible from the machine protection web site : http: //lhc-mpwg. web. cern. ch/lhc-mpwg/ which is however only accessible from INSIDE CERN. q MP commissioning documents for SPS and LHC are on 2 other sites: https: //sps-mp-operation. web. cern. ch/sps-mp-operation/ https: //lhc-mp-operation. web. cern. ch/lhc-mp-operation/ 15/12/2008 ITER-CERN WS - J. Wenninger 56