Introduction; Machine protection, experience and challenges: Review of existing solutions and challenges faced by future installations Purpose of machine protection, risks, challenges, issues and objectives Michael Jonker (CERN) Experience from MP in LHC, Markus Zerlauth (CERN) Experience from MP in Flash, lessons for XFEL, Martin Staack (DESY) Machine protection plans in ESS, Gregor Čuk (CosyLab) Machine protection challenges in ILC, Marc Ross (SLAC) Machine protection challenges in CLIC, Michael Jonker (CERN) Status of the ASTA Facility Machine Protection System at Fermilab, Arden Warner (Fermilab) Machine protection at the Jefferson Lab 1 MW CEBAF electron accelerator, Kelly Mahoney (TJNAF)

General comments This workshop was triggered by the work ongoing for CLIC machine protection There has never been a workshop on Machine Protection on accelerators Machine protection systems for 9 different accelerators were discussed LHC, Flash, XFEL, ESS, ILC, CLIC, ASTA, Jefferson Lab, FERMI There seems to be a considerable interest in this topic There are a number of common issues for all (or at least most) labs

What is Machine Protection? MPS versus MIS

The MPS consists of: 1) a single bunch damage mitigation system, 2) an average beam loss limiting system, 3) a series of abort kickers and low power dumps, 4) a restart ramp sequence, 5) a beam permit system, 6) a fault analysis recorder system, 7) a strategy for limiting the rate with which magnetic fields (and insert-able device positions) can change, 8) a sequencing system that provides for the appropriate level of protection depending on machine mode or state, and 9) a protection collimator system. MPS is NOT limited to the Machine Interlock System (the interlock system is the physical link between different hardware systems) MPS CERN 2012 06 06 Marc Ross, SLAC

Machine Protection System CONTROL SYSTEM (Configuration management) BPS (Beam Permit System) ≈ 1000 signals Response time: 5-10µs Binary OK/NOK MID (MPS Input Devices) MOD (MPS Output Devices) Binary OK/NOK BIS (Beam Interlock System) Post Mortem TIMING SYSTEM

Purpose of machine protection, risks, challenges, issues and objectives, Michael Jonker (CERN) Machine protection is NOT personnel protection (Do not mix it!) There are differences between MP systems for accelerators: with large stored energy in the beam (e.g. LHC more than 360 MJ), accelerators operating with large beam power (CLIC more than 150 MW, ESS with 5 MW) smaller accelerators However, there are also many similarities Machine Protection should prevent beam induce damage – what beam (particle type, intensity, beam size, energy) will damage what type of equipment (vacuum chamber, magnets, cavities, collimators)? This is not clear and is frequently left to “feeling”, and requires (a lot of) studies, relevant for many accelerators Managing risks during accelerator operation Machine protection should result in acceptable risks for operation There established methods, one method is inspired by IEC 61508 Several methods for risk reduction

Experience from MP in LHC, Markus Zerlauth (CERN) Not a single miss can be tolerated: protection of equipment Some experience with massive damage in LHC during the sector 34 event Design principles: protect machine, protect beam, provide evidence Energy of injected bunch is high, protection at injection is important MPS: individual systems coupled via the interlock system Machine Protection WG and Reliability WG was essential Independent powering and beam interlock systems, it is evolving and there are many changes during a year, it is a continuous challenge Controls: Software Interlock System, Sequencer and Logging + Post Mortem Systems Origin of all LHC beam dumps understood No quench from circulating beam with 130MJ energy stored in each beam Dependability observation are in the same order compared to calculations that were done several years ago

Experience from MP in Flash, lessons for XFEL, Martin Staack (DESY) BLMs for beam losses, and toroids for total current difference MPS is using a PLC (ms), stop beam from train to next train MPS reaction depends on operational mode XFEL PLC not possible, distributed system with about 2000 alarm signals 50 bunches in accelerator …cannot be stopped Actuator: laser and dump kicker, to minimise number of bunches that might impact on equipment (do no stop laser, but deflect laser beam to dump) Interlock system uses distributed Micro TCA system with fibre links and two Masters controllers, some masking of interlocks is possible Many photomultipliers, 35 toroids, measuring the beam current in an interleaved way

Experience from MP in Flash, lessons for XFEL, Martin Staack (DESY) Segmentation: checks different areas of the machine, then conclude if beam operation is possible in this segment Beam modes collects info, and configures MPS and the timing system is heavily used 15 experiments, MPS needs to know the branching of beams System will be tested at FLASH 2 next year before XFEL Radiation monitoring in the tunnel is part of system Hardware is in production operation in 2015

Machine protection plans in ESS, Gregor Čuk (CosyLab) ESS: 600m, 5MW, 14Hz, 2.86ms pulse length, availability of 95% Several protection systems: Target Safety Systems, Personnel Protection Systems, MPS Cosylab: Interlock system, controls, timing, MPS and databases MPS: two main services, beam permit, beam interlock Beam Permit System is integrated into timing system MPS: Beam Interlock System: 5-10mus, about 10000 binary device inputs (MID), few output devices (MOD) MID: BLMs, several other HW systems, signals from target are critical (possibly several signals) MOD: ions source, RFQ, chopper, chopper, beam dumps, target protection block Beam permit: based on software (what can stop the accelerator?) Next Pulse Inhibit (next pulse permit): 68ms

Machine protection plans in ESS, Gregor Čuk (CosyLab) Machine modes and commissioning phases require different configuration Input masking required, how? Post mortem: MPS stops circular buffers How to ensure that all systems are coherent? Single timeline: timing and synchronisation? How to ensure it? Questions MPS security: who can change settings? Restarting, how? MPS responsibility boundaries? Device integration guidelines…. how to ensure a coherent system? How to implement operational modes in the protection? Mitigation devices, what to use? Failure catalogue… hazards etc… to be established

Machine protection challenges in ILC, Marc Ross MPS: SLAC 2MW Impressive studies on damage, what is the consequence of such micro hole? Need of further material studies…. Every pulse is a new injection Single pilot bunch is injected All device must be ok for main beam injection Pilot with intensity of 1% of nominal beam (instruments with sufficient dynamic needed) MPS needs to be segmented, applied throughout the complex Shut-off points: in total 11 locations (spoiler, collimator, kicker)

Machine protection challenges in ILC, Marc Ross If the emittance grows sufficiently after a kick there might be no damage Restart sequence, with different steps increasing the beam intensity, or changing beam parameters Fast changing devices need specific attention (e.g. kickers and feedback systems) Some devices need to be fast Common mode failures need attention…. Basic MPS rules are proposed

Machine protection challenges in CLIC, Michael Jonker In total, power of 2*70MW + 2*14MW Energy density is critical (10e4 above damage limit) Safe by design: slow systems (see later presentation) Time constant for failures: slow failures, inter-cycle failures, last moment equipment failures, fast failures Many components, many failure modes…. ~700 Failure analysis and simulations are required to understand consequences of failures Post pulse analysis – many instruments are being involved RT protection possibly needed, intermediate dumps? Beam feedback system…? How to avoid failures of such system?

Machine protection at the Jefferson Lab 1MW CEBAF electron accelerator, Kelly Mahoney (TJNAF) Electron beam power up to 1MW accelerator, 100% duty factor, high availability + free electron laser and energy recovering linac Already with 1kW beam power damage is possible Burn through versus time graphs, diagnostics important SC cavities machine protection operating at the limit, field emission, many interlocks for avoiding or detecting quenches The quantity to be optimised is the integrated performance (integrated luminosity, number of protons on target, …) Top down approach (see talk in other session) Integrated system approach – high availability is required, purpose is not to shut off the accelerator (high availability) Identify precursors for beam loss and correct, MPS is backup Fast recovery, less than <9s (MTTR) Random HW system failures are small portion…. software more important (seems to be different from LHC….)

Status of the ASTA Facility Machine Protection System at Fermilab, Arden Warner (Fermilab) Length of the accelerator is 133.5 meters, total power about 50 kW MPS uses fast electronics based on FPGA MPS has MIDs (MPS Input Devices) and MODs (MPS Output Devices) Main MIDs: BLMs (scintillators) and toroid loss monitors Main MOD: Laser, but also RF can be stopped System reaction depends on operational mode For measuring the dark current in cavities: BLMs in the cold are of interest Instrumentation Secondary emission monitors (SEMs) or Aluminium cathode PMTs near dumps Cryogenic Loss monitors sensitive to dark current as close to the beam pipe as possible (5K ) Diamond loss monitors also close to the beam pipe (1.8K) Fast Kicker

The LHC machine need protection systems, but…. Machine Protection is not an objective in itself, it is to maximise operational availability by minimising down-time (quench, repairs) avoid expensive repair of equipment and irreparable damage Side effects from LHC Machine Protection System compromising operational efficiency must be minimised Downtime dominated by too complex Protection Systems Qualitative Downtime for repairs due to insufficient protection systems R.Schmidt - Villars 30/01/2001 Operations workshop

Comments The objective is not to protect by all means but to optimise the output of the accelerator Machine Interlock Systems have similar architectures, Segmentation of the MPS is desired Monitors for MPS (e.g. for beam loss) are very similar Machine protection is to prevent damage – but what is the damage level? Machine Protection Systems take into account operational modes – how? General awareness of dependability, but more can be done to help building reliable systems

Proposals Session chairs write a summary, combine the summary to one document Individual paper are encouraged PSIPAC – Protection Systems for Particle Accelerators Several colleagues asked when a future workshop on Machine Protection could be organised, is there enough interest?