Initial Experience with the Machine Protection System for LHC Initial Experience with the Machine Protection System for LHC Rüdiger Schmidt R.Assmann, B.Dehning, M.Ferro-Luzzi, B.Goddard, M.Lamont, A.Siemko, J.Uythoven, J.Wenninger, M.Zerlauth LHC cycle and machine protection Strategy for machine protection Commissioning Operational experience Conclusions IPAC May 2010 Kyoto v1.1

Energy stored in one LHC beam 6 cm A B D C Today

IPAC May 2010 Kyoto v1.1

LHC operational cycle and machine protectioin 3500 3000 2500 energy ramp 10 kJ  100 kJ circulating beam coast (100 kJ) circulating beam Energy [GeV/c] 2000 1500 1000 beam dump ~100 kJ 500 -4000 -2000 2000 4000 time from start of injection (s) Injection: 13 bunches from SPS per beam (21010) Nominal: 2808 bunches per beam (1.151011)

Injection: Without quenching magnets or causing damage No kick by injection kicker of circulating beam (correct synchronisation) Injection protection absorber in place in case of kicker failure 3500 3000 2500 energy ramp 10 kJ  100 kJ circulating beam coast (100 kJ) circulating beam Energy [GeV/c] 2000 1500 1000 beam dump ~100 kJ 500 -4000 -2000 2000 4000 time from start of injection (s) Injection: 13 bunches from SPS per beam (21010)

No accidental firing of a kicker magnet Circulating beam: In case of failure, detect failure and extract beam into dump block for some failures within a few turns No accidental firing of a kicker magnet 3500 3000 2500 energy ramp 10 kJ  100 kJ circulating beam coast (100 kJ) circulating beam Energy [GeV/c] 2000 1500 1000 beam dump ~100 kJ 500 -4000 -2000 2000 4000 time from start of injection (s) Injection: 13 bunches from SPS per beam (21010)

Extraction: Beams must ALWAYS be extracted into beam dump block Kicker rise must be synchronised with the 3 µs long beam abort gap Abort gap must be clean of particles 3500 3000 2500 energy ramp 10 kJ  100 kJ circulating beam coast (100 kJ) circulating beam Energy [GeV/c] 2000 1500 1000 beam dump ~100 kJ 500 -4000 -2000 2000 4000 time from start of injection (s) Injection: 13 bunches from SPS per beam (21010)

Strategy for machine protection Early detection of equipment failures triggering beam dump request. Powering Interlocks: failures in powering system (quench, PC trip,..) Fast Magnet Current change Monitor Monitoring of beams to detect abnormal beam conditions and triggering dump request, down to a single machine turn. Beam Loss Monitors and Beam Position Monitors Reliable transmission of dump requests to beam dumping system and stop injection + extraction from SPS Beam Interlock Systems Reliable operation of beam dumping system, safely extracting beams onto the external dump blocks. Beam Dumping System Definition of LHC aperture by collimators, to limit beam losses to (warm) collimator regions. Beam Cleaning System Passive protection by absorbers and collimators for specific failure cases. Beam Absorbers MOPEB045 WEPEB069 WEPEB073 TUPEB063 TUOAMH01

Architecture of the Beam and Powering Interlocks Safe Beam Parameter Distribution Beam Loss Monitors BCM Jaw Position Temperature SpecialBLMs Safe Machine Parameter Software Interlock System Operator Buttons CCC LHC Experiments Screens and Mirrors beam observation RF System Collimation System BPMs Beam Dumping System Beam Interlock System Safe Beam Flag Injection Interlock and SPS extraction Powering Interlocks superconducting magnets Powering Interlocks normal conducting magnets Fast Magnet Current Monitors Vacuum System Access System Beam loss monitors BLM Timing System (Post Mortem Trigger) Magnets Power Converters Monitors aperture limits (some 100) Monitors in arcs (several 1000) Quench protection system PS (20000 channels) Power Converters ~1600 AUG UPS Cryogenics some 10000 channels

Steps in commissioning of machine protection Before starting beam operation, check interlocks from all system (as far as possible) Start with low intensity beam (no risk of damage) Commissioning the beam dump system at different energies Commissioning the beam cleaning system (80 collimators) at different energies, and for different optics Specific tests with beam (Machine Protection tests) Analyse operation (for all beam dumps and for beam losses not leading to a beam dump) Early commissioning: masking of interlocks setup beam flag: when energy density is below critical value Exceed the stored energy of the setup beam flag (“safe beam”) – masking automatically removed Get confidence in machine protection to go to higher intensity

Commissioning of the beam dump system Beam dumps done at different energy, to demonstrate that bunches are correctly extracted via a 700 m long line into the dump block To reduce the energy density on the dump block, beam is “painted” by fast deflection of two families of kicker dilution magnets A 3 µs abort gap for the switch-on of the extraction kicker field allows loss free extraction under normal operating conditions. Some asynchronous beam dumps are expected. Collimators are installed to capture beam that is deflected with a small angle. Tests with de-bunched beam: particles in abort gap are correctly intercepted Beam dump of 10 bunches, beam spots on screen (measurement and expected centres) in front of beam dump block

Collimator setup red line: BLM thresholds ATLAS Alice Momentum cleaning RF CMS Beam dump Betatron cleaning LHCb Cleaning efficiency depends jaw centring on beam, accuracy of gap size and jaw parallelism with respect to beam. The collimators are aligned during the different operational phases (injection, top energy, etc.) Excellent performance, no beam induced quench. The efficiency is measured by driving the beam on a resonance.

Early detection of powering failures (FMCM OFF) With low intensity beam, the monitor was disabled and a trip of the power converter triggered A trip of normal conducting magnets close to the experiments is most critical (fastest beam loss) The beam position changed, and beam loss monitors close to collimators recorded the loss and triggered a beam dump Redundant protection is required, by measuring voltage drops in the circuit within less than one ms Position change of ~1.5 mm within 250 turns (25 ms) Beam position over 1000 turns at one BPM 11/15/2018

Early detection of powering failures (FMCM ON) The Fast Magnet Current change Monitor (FMCM) to detect fast powering failures was enabled The test was repeated The beam was dumped, before any effect on the beam position was visible No beam losses were detected The redundant protection works. This is an example that we try to use for all possible failures Very sensitive in case of problems with the electrical network (a number of beam dumps) no position change Beam position over 1000 turns at one BPM

Software Interlock System Provides additional protection for complex but less critical conditions (e.g. surveillance of magnet currents and closed orbit) Example: triggered on large orbit excursion (> 12 BPMs over 6 mm for beam 2 in the horizontal plane (too large RF frequency change) Threshhold MPP - 16th April 2010 16 16

“Post Mortem” after beam dump FMCM RD1 LR1 3500280 GeV Record all state changes from interlock systems Record transient data for every beam dump for all systems (beam loss, orbit, beam current, tune, hardware parameters (magnet current, collimator positions, …)

Early experience Many beam dumps at injection, in general for commissioning purpose “False” beam dumps: if a protection system dumps the beam because of an internal failure (e.g. noise spikes, problems in connectors, …) About 75 beam dumps after the start of the energy ramp All beam dumps are understood (thanks to the interlock systems and post mortem recording) Not a single quench with circulating beam Stored energy of 100 kJ with respect to 10 mJ for quenching a magnet Cleaning system did an excellent job Detection of failures worked very well Very few beam induced magnet quenches (“quenchinos”), only during injection at 450 GeV the threshold of a quench detector was exceeded, the quench heaters fired and quenched the magnet (without firing the magnet would have recovered) one event: main quadrupole current in one sector 350A instead of 760A other events: during special aperture studies

Conclusions For many Machine Protection sub-systems: Commissioning finished before LHC beam operation during hardware commissioning (all interlocks related to the magnet powering system) Commissioning of LHC with low intensity beams, slowly increasing the intensity, bringing up all machine protection systems The beam intensity where interlocks can be masked has been exceeded. LHC operates with all interlock enabled LHC can operate with the full machine protection system Operational experience and machine protection experiments demonstrated that the machine protection system works as expected, no surprises until today These are early days, a huge step in beam intensity is still required Next month(s): 1 MJoule, end of this year: >10 MJoule

Acknowledgements LHC Machine Protection reflects the complexity of the LHC accelerator. Many colleagues contributed to LHC Machine Protection. We like to thank them and are very grateful for their contributions.

Reserve slides

Beam dumps above injection energy (incl. 3.5TeV) Reason for beam dump Dumps False dumps Magnet Protection System 6 Cryogenics Feedback / Magnet Protection Experiments 4 Beam dynamics 5 Electrical Network 2 Beam Loss Monitor System Beam Position Monitors Beam Dumping System Internal Failure Operational error Dump at the end of the fill Machine Protection Tests 12 Interlock systems

Masking interlocks during initial operation There are several 10 thousand interlock channels Start-up of such a machine is not possible without masking interlock channels Example: commissioning of the cleaning system with all beam loss monitors active BE PREPARED TO MASK (disable) interlocks! but in a co-ordinated way Setup Beam Flag: interlock can be masked it is always easy to see what interlocks are masked when the beam becomes unsafe (stored energy above setup beam limit), the interlock become automatically enabled Masking of interlocks should be considered when designing the system

Principles for machine protection Protect the machine highest priority is to avoid equipment damage second priority is to avoid quenching of magnets: with superconducting magnets it requires few mJoule to quench: no beam losses in the cold part Protect the beam: trade-off between protection and operation complex protection systems reduces the availability of the machine minimise number of “false” beam dumps (beam dumps due to a failure in the protection systems) Provide the evidence if the protection systems stops operation (e.g. dumps the beam or inhibits injection), clear diagnostics provided by the “post mortem” system if something goes wrong (near miss or even damage), it should be possible to understand the reason why

Machine protection during operational cycle Injection injection of beam without quenching magnets or causing damage no kick by injection kicker of circulating beam (correct synchronisation) Circulating beam in case of failure, detect failure and extract the beam into the beam dump block, for some failures within a few turns no accidental firing of a kicker magnet The beam must ALWAYS be extracted into the beam dump block (end of fill or in case of a failure) reliable operation of beam dumping system kicker rise must be synchronised with the 3 µs long beam abort gap abort gap must be clean of particles collimators reduce beam loss in case of failure

Setup (Safe) Beam Flag - TRUE Initial beam commissioning and machine protection tests very difficult with all interlocks active Some interlocks can be MASKED when beams stored little energy density

Setup (Safe) Beam Flag - FALSE When stored beam energy exceeds a critical value for the stored beam energy density, all masks are removed If an interlock on a masked input is active => beam dump

Interlocks Systems: ensure time stamping Safe Beam Parameter Distribution Beam Loss Monitors BCM Jaw Position Temperature SpecialBLMs Safe LHC Parameter Software Interlock System Operator Buttons CCC LHC Experiments Screens and Mirrors beam observation RF System Collimation System BPMs Beam Dumping System Beam Interlock System Safe Beam Flag Injection Interlock Powering Interlocks superconducting magnets Powering Interlocks normal conducting magnets Fast Magnet Current Monitor Vacuum System Access System Beam loss monitors BLM Timing System (Post Mortem Trigger) The interlock systems allows to identify the origin of any beam dump, and for powering failures to identify the electrical circuit that tripped data from several 10000 channels (50k-100k) all data is time stamped with the same clock (beam interlocks ~ µs, powering interlocks ~ ms) Magnets Power Converters Monitors aperture limits (some 100) Monitors in arcs (several 1000) Quench protection system PS (20000 channels) Power Converters ~1600 AUG UPS Cryogenics some 10000 channels

Powering System and interlocks Hardware commissioning: Ramp all magnets with current functions as during beam operation and commission all interlocks 1700 high current powering circuits with about 10000 magnets Interlocks required for commissioning of the magnet powering system Monitors temperatures in superconducting magnet system, voltages, currents, many other parameters, …. Failures: quench, power converter failure, cryogenics problem, water cooling failure, UPS failure, failure in the protection systems firing of quench heaters, extraction of energy in the circuit, stop power converters, … AND trigger beam dump For some magnet circuits: beam dump, for other circuits: no beam dump can be configured for each circuit main dipole and quadrupole magnets: always dump beams in case of failure example: orbit correctors in the arc not (yet) included in the systems that dump the beam