R.Schmidt (CERN und TU Darmstadt) Seminarvortrag Universität Stuttgart, 16 Oktober 2012 CERN, the LHC collider and studies on its dependability

What is CERN ? What are the principles of accelerators ? What is the Large Hadron Collider (LHC) ? What risks at CERN … and for the LHC ?

CERN Mission: Research, technology, collaboration, education The motivation for CERN is basic research: Seeking and finding answers to questions about the Universe To perform this research needs innovation in technology (such as the WWW): Advancing the frontiers of technology Collaborating: Bringing nations together through science Education: Training the scientists of tomorrow

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 4 A global endeavour Founded in 1954 Funded by the 12 European States 20 Member States 8 Observer States and Organisations 35 Non-Member States …Japan, Russia, USA… 580 Institutes World Wide 2500 Staff Visiting Scientists …Australia, Canada, New Zealand… …most of the EU… European Centre for Nuclear Research Conseil Européen pour la Recherche Nucléaire

Understanding our universe many thousand scientists are fascinated about research at CERN The Universe is governed by forces and is made out of elementary particles Understand the forces governing nature: Gravitation, Electro- Magnetic forces, Forces in the nucleus (Strong Force holding the nucleus together, and Weak Force related to radioactivity) The basic constituents of matter are elementary particles (electrons, protons, neutrons, photons, …) Understand the Origin of Mass: finding the HIGGS particle Particle Physics: these questions are related to elementary particles physics. We need some clues! The LHC started to provide it…. CERN

CERN infrastructure: Accelerators and experiments ● CERN provides the world’s largest and most complex scientific instruments to study the elementary particles ● These instruments are particle accelerators and experiments ● Accelerators boost beams of elementary particles to high energies before they are made to collide with each other ● Experiments observe and record the results of these collisions CERN Our flag-ship project is the Large Hadron Collider…

CERN Machine Protection – A Future Safety System? CERN CERN Accelerator Complex Lake Geneva Geneva Airport CERN LAB 1 (Switzerland) CERN LAB 2 (France)

CERN Machine Protection – A Future Safety System? CERN CERN Accelerator Complex Lake Geneva Geneva Airport Proton Synchrotron (PS, 1959) Super Proton Synchrotron (SPS, 1976) Large Hadron Collider (LHC, 2008) 27km long 150m underground

CERN Machine Protection – A Future Safety System? CERN CERN Accelerator Complex CMS ALICE ATLAS LHC-b Four LHC experiments: huge detectors were constructed by thousands of scientists in international collaboration

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 10 A different kind of particle accelerator… Protons are accelerated by radio waves to an energy of 7 TeV while kept on a circle with strong magnetic fields from superconducting magnets operating at 8.3 T The protons make 7 Million turns, and are accelerated with one Million Volt per turn to the speed of light ( km/second)

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 11 The LHC: A 50 Years long Adventure ● 1984: Kick off meeting to discuss ideas for an accelerator to collide protons at very high energy ● 1996: Final decision for the LHC, the most complex scientific instrument ever constructed ● 10 September 2008: Start of commissioning with beam ● 19 September 2008: Serious accident and damage ● 19 November 2009: Restart of beam operation Since 2009: successful operation, providing billions of particle collisions for the LHC experiments …………..……. ● About 2030: The LHC physics programme to be finished ? Upgrade of LHC to higher energy?

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 12 Beam dumping system Acceleration CMS ATLAS LHC-B ALICE Injection Beam dump blocks The arcs: 1232 DIPOLE MAGNETS The LHC 27 km long 2 beams turns per second 8 arcs 8 straight sections

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 13 The LHC tunnel with dipole magnets Looking into the arc beam tubes

CERN Machine Protection – A Future Safety System? Installation of LHC dipoles in the tunnel

CERN Machine Protection – A Future Safety System? Detecting new particles: the ATLAS Experiment – A Toroidal LHC ApparatuSCERN 15

CERN Machine Protection – A Future Safety System? Risks

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 17 Risks for the LHC ● Not to complete the construction of the accelerator Happened to other projects, the most expensive was the Superconducting Super Collider in Texas / USA with a length of ~ 80 km Cost increase from 4.4 Billion US $ to 12 Billion US $, US congress stopped the project in 1993 after having invested more the 2 Billion US $ ● Not to be able to operate the accelerator ● Damage to the accelerator beyond repair due to an accident SSC

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 18 Risks for particle physics NO LHC = Future of Particle Physics compromised

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 19 Risk during LHC operation

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 20 Energy and risk ● Energy stored in any system can cause damage, when the energy is released accidentally ● For an accelerator, risks are coming from energy stored in the magnets system and in the beams Energy of a car with 1.4 tons driving at 50 km/h: Joule

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 21 Stored energy in the magnet circuits is 9 GJoule Kinetic Energy of Aircraft Carrier at 50 km/h ≈ 9 GJoule ….can melt 14 tons of copper Energy stored in the magnet system [11] Picture source: Shared as: public domain

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 22 Energy stored in one beam [11] 3  protons in each beam Kinetic Energy of 200 m Train at 155 km/h ≈ 360 MJoule Stored energy per beam is 360 MJoule Picture source: Shared as:

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 23 Energy stored in one beam [11] 360 Million Joule = 90 kg of explosives 360 Million Joule = 10 kg of Swiss Chocolate..think of you fuel tank

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 24 ● 250 journalists ● 30 television stations ● Millions of viewers ● “we attempted to do something for the first time, live, with absolutely no guarantee of success” ● The idea was to send a right and a left hand beam to the LHC and obtain at least one turn around the accelerator… Risk: performing an experiment that might not work, in the presence of Millions of spectators First beam on 10 September 2008CERN LHC start up with beam – 10 September 2008

CERN CERN, the LHC collider and studies its dependability LHC commissioning and operation

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 26 Tense moments

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 27 Everything green!

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 28 Success!

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 29 Unfortunately, nine days later...

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 30 The incident of 19 September 2008 ● high current superconducting cable joints – all soldered in situ in the tunnel and one of these connections was defective One joint ruptured, with 600 MJ stored in the magnets – 70% of this energy was dissipated in the tunnel, electric arcs, vaporizing material, and moving magnets around

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 31 The damage ●...and collateral damage

……the road to full repair would be long and difficultCERN

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 33 What has been done about it…. ● Analyse the accident, to exactly understand the causes ● Establish a plan for repair ● Improve the systems to prevent that this can happen again ● Invite international experts to review risks and proposed improvements The LHC had worked very well and 99% were still ok – pull yourself together, face the problems and work towards a solution First priority is to solve the problem, and not too look for the “culprit”….

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page : the LHC is back in action!

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 35 The experiments saw their first collisions

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 36 LHC operation…. ….a success ATLAS Collaboration, Observation of a new particle in the search for the Standard Model Higgs boson with the ATLAS detector at the LHC Phys.Lett.B (2012) CMS Collaboration, Observation of a new boson at a mass of 125 GeV with the CMS experiment at the LHC Phys.Lett.B (2012

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 37 …….but still some way to go ● The performance of LHC was substantially increased from 2009 to 2012 ● The energy stored in one beam is about 145 MJoule, the LHC operates at 4 TeV ● The objective operation with beams of 362 MJoule at 7 TeV To be done after a long shutdown 20113/14

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 38 Machine Protection

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 39 Risk of damage from beam Beams with the 360 MJ are running through the beam tube with the speed of light ● magnets keep the beams in the center of the beam tube ● In case of magnet failure, the beams hit the accelerator equipment in a very short time, 1/1000 of a second This must never happen: Managing risks is relying on the Machine Protection Systems

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page Controlled SPS experiment ● 8  protons clear damage ● beam size σ x/y = 1.1mm/0.6mm above damage limit for copper stainless steel no damage ● 2  protons below damage limit for copper 6 cm 25 cm Damage limit ~200 kJoule 0.1 % of the full LHC 7 TeV beams factor of ~10 below the energy in a bunch train injected into LHC V.Kain et al A B D C SPS experiment: Beam damage with 450 GeV proton beam

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 41 Beam dumping system Acceleration CMS ATLAS LHC-B ALICE Injection Beam dump blocks They must be detected The beams shall be extracted into the beam dump blocks This must happen within less than 1 ms Failures in such complex accelerator cannot be avoided

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 42 LHC beam dumping system

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 43 Strategy for machine protection ● Definition of aperture by collimators. Beam Cleaning System Beam Loss Monitors Other Beam Monitors Beam Interlock System Powering Interlocks Fast Magnet Current change Monitor Beam Dumping System Collimator and Beam Absorbers Early detection of equipment failures generates dump request, possibly before beam is affected. Active monitoring of the beams detects abnormal beam conditions and generates beam dump requests down to a single machine turn. Reliable transmission of beam dump requests to beam dumping system. Active signal required for operation, absence of signal is considered as beam dump request and injection inhibit. Reliable operation of beam dumping system for dump requests or internal faults, safely extract the beams onto the external dump blocks. Passive protection by beam absorbers and collimators for specific failure cases. In total, many 10 thousand interlock channels than can trigger a beam dump

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 44 LHC: first accelerator with the potential of damage beyond repair ● Dependability: new challenge for accelerator laboratories ● Requires different approach in engineering, operation and management ● Safety culture: has been developed over the last, say, 10 years Largely helped by the accident in 2008 ● Excellent experience: no damage, no near miss ● Continuous effort to safely operate that LHC ● Availability is acceptable, but we are working on further increasing availability ● Lessons to be learned for future accelerators to ensure safe operation with high availability (e.g. Accelerator Driven Spallation)

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 45 Accidental beam losses: Risks and protection ● Protection is required since there is some risk ● Risk = probability of an accident (in number of accidents per year)  consequences (in Euro, downtime, radiation dose to people) ● Probability of an accidental beam loss What are the failure modes the lead to beam loss into equipment? What is the probability for the most likely failures (there is an practical infinite number of mechanisms to lose the beam)? ● Consequences of an accidental beam loss Damage to equipment Downtime of the accelerator for repair (spare parts available?) Activation of material, might lead to downtime since access to equipment is delayed ● The higher the risk, the more protection becomes important

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 46 Design principles for protection systems ● Failsafe design detect internal faults possibility for remote testing, for example between two runs if the protection system does not work, better stop operation rather than damage equipment ● Critical equipment should be redundant (possibly diverse) ● Critical processes not by software (no operating system) no remote changes of most critical parameters ● Demonstrate safety / availability / reliability use established methods to analyse critical systems and to predict failure rate ● Managing interlocks disabling of interlocks is common practice (keep track !) LHC: masking of some interlocks possible for low intensity / low energy beams

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 47 IEC Safety Lifecycle ‘A model for structuring safety management activities throughout the life cycle of safety- related systems’ Handout​ Principles of System Safety Engineering and Management, Workshop, CERN 2011​, Redmill Consultancy, London ​ Sigrid Wagner

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 48 Safety case ● The MPS was designed considering a large number of possible failures of LHC equipment ● The knowledge of these failures and of the machine protection functions implemented to cover these failures is distributed over the different teams involved in the design and operation of the LHC ● A recent project (Sigrid Wagner and Andrea Apollonio) aims at bringing together this knowledge in a common failure catalogue. ● The objective is to create a “safety case” documentation ‘ to go to court with’ including, claim, argument, evidence ● Details can be discussed if of interest

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 49 Hazard and Risk Analysis and Protection requirements Proceeding in lifecycle from hazard chains to definition of protection functions Sigrid Wagner

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 50 Comment to LHC Machine Protection ● Some protection systems were considered early in the project (beam dumping system, magnet protection, beam loss monitors) ● Consideration for coherent approach on machine protection started in 2000 – done by the team working in interlocks that links all systems ● Lot of work since then (e.g PhD theses on machine protection) ● Stated to use “formal methods” since ~2004 (calculation of reliability, availability etc.) ● Together with design and construction of systems considerations for documentation, commissioning etc. ● Very important: diagnostics for protection (what stopped the beam?)

CERN Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 51 Some remarks ● Citation: “Prioritizing risk management too highly could keep an organisation from ever completing a project or even getting started” – particular true for research (Wikipedia, Risk Management) ● Do not address all possible risks at the same time…. ● Prioritise the risks ● Address the most urgent risk now ● Accept some risks – there will be problems for a complex one-off machine… sometime completely unforeseen ● Risk management at CERN is novel for such institutes: we learned during construction and operation, and continue learning ● Our approach is unconventional and less formal compared to other domains, others (institutes and industry) are interested in our new ideas

CERN Rüdiger Schmidtpage 52 Some PhD theses on dependability ● S.Wagner, LHC Machine Protection System: Method for Balancing Machine Safety and Beam Availability, CERN-THESIS , ETH Zurich, 2010 ● A.Vergara-Fernández, A Reliability of the Quench Protection System for the LHC Superconducting Elements, CERN-THESIS ● G.Guaglio, Reliability of the Beam Loss Monitors System for the Large Hadron Collider at CERN, CERN-THESIS , Clermont-Ferrand ● R. Filippini, Dependability analysis of a safety critical system : the LHC beam dumping system at CERN, CERN-THESIS , Pisa U., ● F.Perisse et al., Reliability determination of aluminium electrolytic capacitors by the mean of various methods, Published in: Microelectron. Reliab. 44 (2004) (short version of theses) ● M.Rampl, Study for a failsafe trigger generation system for the LHC beam dump kicker magnets, CERN-THESIS , 1999 ● B. Todd, A Beam Interlock System for CERN High Energy Accelerators, CERN-THESIS West London: Brunel U.

CERN Rüdiger Schmidtpage 53 Selection of other publications ● S. Wagner et al., A Failure Catalogue for the LHC, 2nd International Particle Accelerator Conference, San Sebastian, Spain, Sep 2011 ● R.Filippini et al., Reliability Assessment of the LHC Machine Protection System, LHC- Project-Report-812; CERN, 14 Jun 2005 ● E.Carlier et al., Reliability Analysis of the LHC Beam Dumping System, CERN-LHC- Project-Report-811, CERN, 14 Jun 2005 ● J.H.Dieperink et al. Design aspects related to the reliability of the LHC beam dump kicker system, PAC 1997, Vancouver ● C.Garion et al., Reliability oriented optimum design of the Large Hadron Collider magnet-to-magnet interconnections, CERN-LHC-Project-Report-631, CERN, 3 Apr 2003 ● C.Garion, B.Skoczen, Reliability oriented optimum design of the LHC interconnections - Part I: Mechanical compensation system LHC, PROJECT-NOTE-245 (2000) ● L.Scibile, P.Ninin, S.Grau, Functional Safety, A total quality approach, CERN-ST (2001) ● W.Hees, R.Trant, Evaluation of Electro Pneumatic Valve Positioners for LHC Cryogenics, LHC-PROJECT-NOTE-190 (1999)

CERN Rüdiger Schmidtpage 54 Comment on CERN Is CERN a playground for thousands of (particle) physicists all hoping to discover the secrets of the universe and getting the Nobel Prize?  Indeed, these are the visitor (incl. students and post docs) from many hundred universities around the globe Is CERN the laboratory for thousand engineers (incl. a few applied physicists) from many different fields to design, construct and operate the most complex scientific instruments ever conceived (particle accelerators and detectors)?  Indeed, the engineers are the CERN staff members, working together well students (e.g. about 140 PhD students), post docs and other external collaborators, mostly from the CERN member states

CERN Rüdiger Schmidtpage 55 …the end Thank you for your attention