Interlock and Protection Systems for SC Accelerators: Machine Protection System for the LHC l The Risks l The Challenge l The LHC Layout l The Systems for Protection l The Glue The impact of LHC Machine Protection has been recently discussed at the LHC Workshop in Chamonix January, and I will use some of the material that has been presented (contributions from O.Brüning, H.Burkhardt, E.Carlier, H.Mess, R.Lauckner, M.Lomperski, F.Rodriguez-Mateos) R.Schmidt - Villars 30/01/2001

p. 230/01/2001 R.Schmidt, Villars Energy in two LHC Beams: 700 MJ – Two systems, one for each beam Energy in dipole magnets (one sector): 1.3 GJ –Eight systems in the LHC Energy in quadrupole magnets (one sector): 40 MJ –Sixteen systems in the LHC Energy in 600 A circuits (i.e. chromaticity correction): kJ –Some 100 systems In total about 11 GJ 50 tons at 600 km/h = heating + melting of 950 kg copper 180 kg at km/h 3 * kg at 200 km/h The Risks: Energy in Magnets and Beams

p. 330/01/2001 R.Schmidt, Villars LHC magnets operate at 1.9 K - Little enthalpy - Temperature margin about 1.4 K Nominal beam intensity : 3 * Protons / beam Energy at 7 TeV to quench a dipole magnet corresponds to about 10 7 Protons Energy at 450 GeV to quench a dipole magnet corresponds to about 10 9 Protons Energy to quench a superconducting dipole magnet is small First beam tests with one bunch, very low intensity, below quench threshold Beam Monitors must work for such parameters

p. 430/01/2001 R.Schmidt, Villars The beam can leave in a very short time…. -Published in Chamonix Workshop - (O.Brüning) Power trip of power converter for D1 warm separation magnet –in collision the beam would start to suffer after 5 turns (2 mm orbit displacement) Wrong functioning of the damper for injection oscillations and instabilities –at injection energy the beam would start to suffer after 6 turns Power trip of power converter for one of the warm quadrupoles in the collimation section –in collision the beam would start to suffer after 18 turns Quench of one main dipole magnet –in collision the beam would start to suffer after 280 turns

The energy in the LHC magnet system corresponds to about tons of snow, sliding down by about about 600 m …….the bad news: an energy release can be easily triggered by some innocent (ski)-operator …… the good news: LHC operators are far away from the LHC tunnel

The LHC machine need protection systems, but…. Machine Protection is not an objective in itself, it is to l maximise operational availability by minimising down-time (quench, repairs) l avoid expensive repair of equipment and irreparable damage Side effects from LHC Machine Protection System compromising operational efficiency must be minimised Downtime dominated by too complex Protection Systems Downtime for repairs due to insufficient protection systems

p. 730/01/2001 R.Schmidt, Villars LHC Machine Protection is to... Prevent an uncontrolled release of stored energy, thus avoiding: l damage of equipment l unnecessary down-time - example: BEAM DUMP to avoid quenches and will include: l tools for consistent error and fault tracing ……. POST MORTEM Related topic: –access and interlock system to protect people is separate system, however, there are links between the access system and the machine protection

Sector Continuous Cryostat/Cryoline Superconducting bus-bars run through cryostatconnecting magnets. Current feeds at extreme ends. Other central insertion elements eg. Low Betas, separator dipoles, matching COLD (<2K) 2.9km WARM 500m 1 5 DC Power feed 3 Octant DC Power Main Arc FODO cells containing; main dipoles and quadrupoles, chromaticity sextupoles, octupoles, tuning and skew quadrupoles, spool pieces, orbit correctors End of Continuous Cryostat containing; dispersion suppressors, Some of the matching section, and the electrical feedbox LHC 27 km Circumference LHC is divided into 8 Sectors Slide from P.Proudlock

p. 930/01/2001 R.Schmidt, Villars LHC Machine Protection = Integration of systems The interlocks deal with the integration of systems into the LHC MACHINE PROTECTION SYSTEM,……, with the glue that links systems such as: l BEAM DUMP SYSTEM l BEAM LOSS MONITOR SYSTEM l QUENCH PROTECTION and POWERING SYSTEM l BEAM CLEANING SYSTEM (two long straight section for collimators) Access, RF, Vacuum, Collimators, Warm magnets, Experiments, …. and an architecture of the MACHINE INTERLOCK SYSTEM is required

p. 1030/01/2001 R.Schmidt, Villars They “lazy” approach …can we copy another system ? l FERMILAB - TEVATRON operates since more than 15 years l DESY - HERA operates since more than10 years l BNL - RHIC operates since less than 2 years (evolution of FERMILAB system) => No major accidents during operation LHC is specific: l energy much larger l many more components l powering of the machine in sectors very different from other machines l time constants involved together with energy require different solutions After visits to FERMILAB, BNL, and DESY (…+ K.H.Mess - associate from DESY here for one year) a systems is proposed with an different architecture, but with using some ideas from BNL and HERA

p. 1130/01/2001 R.Schmidt, Villars With respect to BEAM OPERATION: Energy stored in beams Fault detected => BEAM ABORT, beam is directed into BEAM DUMP BLOCK Two systems - one BEAM DUMP SYSTEM for each beam With respect to POWERING: Energy stored in magnets of one cryostat: Fault detected => POWER ABORT, and most of the magnetic energy is dumped into ENERGY EXTRACATION RESISTORS four large such systems for each sector - 2 for MB, 1 for QF, 1 for QD (in total 32) some hundred smaller (600 A) systems around the LHC Electrical circuits in one continuous cryostat independent from circuits in other cryostats String II - Commissioning of Power and Magnet Interlock System soon Separation of POWER ABORT and BEAM ABORT

p. 1230/01/2001 R.Schmidt, Villars Architecture of Power Permit in one LHC sector LHC-B T Q4D2 Q5 Arc Q4D2 T Atlas DFBX DFBM DFBM DFBA DFBA DFBM DFBX QP PPC PC QP 1 8 Slide from K.H.Mess

Architecture of BEAM PERMIT in the LHC

BEAM PERMIT CONTROLLER p. 14

p. 1530/01/2001 R.Schmidt, Villars With respect to POWERING CIRCUITS connecting magnets with LARGE amount of stored energy Quenches propagate to magnets in other circuits => All power in continuous cryostat will be switched off after detecting a quench CIRCUITS connecting magnets with SMALL amount of stored energy => In the (unlikely) case of a quench, only the corresponding circuit is de-excited With respect to BEAM OPERATION CIRCUITS that are very critical for operation with beam Fault always causes total beam loss => In case of a fault - always BEAM DUMP CIRCUITS that are less critical for operation with beam Fault might cause beam losses, depending on machine status: energy, beam intensity.. => In case of fault - BEAM DUMP IF ……other conditions are met / not met Classification of electrical circuits

BEAM PERMIT / ABORT for the entire LHC accelerator –Fast system - the beam can be dumped in a few turns –BEAM PERMIT CONTROLLERS (BPC) linked via optical fibres with 10 MHz signal (fast data transmission) –Absence of BEAM PERMIT triggers BEAM DUMP –16 BEAM PERMIT CONTROLLERS are required –Input from variety of systems, such as powering and protection, access, BLM, vacuum, and others POWER PERMIT / ABORT for each continuous cryostat –System is less fast, the power is extracted in several seconds –Impact beams after some 10 ms - therefore more time to react –About 48 POWER PERMIT CONTROLLERS (PPC) are required, one per cryostat (two for long arc cryostat) –Links in tunnel could be via current loop and non-critical communication between controllers via control system Some Parameters of the Protection Systems

p. 1730/01/2001 R.Schmidt, Villarsp. 17 Information links for Machine Protection System

p. 1830/01/2001 R.Schmidt, Villars Post Mortem Diagnostics MUST be a part of the system - Artist view of the requirement

p. 1930/01/2001 R.Schmidt, Villars Summary of architecture for the machine protection General Separation of BEAM PERMIT and POWER PERMIT Separation of POWER PERMITS for cryostats - one (two for arcs) PPC per cryostat Diagnostics after fault is integral part of the system Classification of Electrical Circuits Powering: Main circuits (CRYOSTAT POWER ABORT) and auxiliary circuits (CRYOSTAT POWER FAULT) Beam Operation: CRITICAL CIRCUITS and LESS CRITICAL CIRCUITS Inventory About 60 electronics crates Two fast links for BEAM ABORT with optical fibres (plus some reserve fibres) Several slower links for POWER ABORT, possibly using current loops Fail-safe links, and input signals to electronics

p. 2030/01/2001 R.Schmidt, Villars Outlook Require POWER PERMIT CONTROLLER for first sector (octant) test in 2004 –Functional Specification for Summer 2001 –Start development of hardware by this Summer Require full functionality of BEAM PERMIT CONTROLLER for 2006 –Functional Specification for End of 2001 –Possibly reduced functionality for 2004 (injection test) POST MORTEM Facilities to be defined –Some definitions BEFORE electronics development starts –Unique CLOCK required How to use beam loss monitor systems to request BEAM DUMP? –Studies continuing...

p. 2130/01/2001 R.Schmidt, Villars With respect to BEAM OPERATION Energy stored in beams to be safely deposited with BEAM DUMP SYSTEM BEAM ABORT - POWER ABORT With respect to POWERING Energy stored in magnets to be safely deposited with POWER DUMP SYSTEM Both systems are largely independent No signals from BEAM DUMP SYSTEM to POWER DUMP SYSTEM Signal from POWER DUMP SYSTEM to BEAM DUMP SYSTEM in case of power fault

p. 22

p. 23

p. 2430/01/2001 R.Schmidt, Villars Interfaces between BPC and PPC to other systems POWER PERMIT CONTROLLERS Interfaces for Interlocks Power Converters Quench Protection System Cryogenic System Access System Beam Permit System Interfaces for Services Control System Timing System Power Supply for electronics Post Mortem System BEAM PERMIT CONTROLLERS Interfaces for Interlocks POWER PERMIT CONTROLLERS Beam Loss Monitors and other BI Beam Dump System Collimators RF System Vacuum System Experiments Injection System Access System Interfaces for Services Control System Timing System Power Supply for electronics Machine Status (Energy, Current,..) Post Mortem System

p. 2530/01/2001 R.Schmidt, Villars ….and what concerns the interface between Machine Protection and LHC Experiments Next Milestone the Experiments will not be concerned, however, since time passes…. Risk analysis for the experiments –How could large fraction of the beam hit the experiments? –What would be the consequence? –How to avoid such accidents? BEAM ABORT signals from the experiments –One BEAM ABORT stops the LHC for at least 2 hours Hardware interfaces - what signals should be exchanged? Initially one representative for all 4 experiments could follow discussions on Machine Protection. For specific topics, other representatives from the experiments could attend. To be re-considered at a later date.

p. 26

BEAM PERMIT CONTROLLER p. 27

p. 2830/01/2001 R.Schmidt, Villars How fast does the beam has to be dumped? Quench in one MB magnet at top current –massive quench in a dipole magnet due to beam loss would lead to an orbit change of 2 mm in 20 ms (see EXCEL calculation), assuming beta = 100 m - beam dump in the order of 10 ms. Quench in other magnets –quadrupole quenches lead to betratron tune change –sextupole quenches lead to change of chromaticity - beam loss and instabilities Loss of RF - de-bunching of the beam –action in some hundred milliseconds Access door forced or emergency button pushed –less than one second Beam loss monitor indicates too large losses –assuming integration time of 5 ms, activation of the beam dump should be in the order of 1 ms Experiments dump the beam - to be discussed with the experiments Main Power converter failure –depends on the power converter, but a fast action before the current decays substantially would always make sure that the beam is lost in a controlled way Other systems (cryogenics, vacuum, …) - to be discussed

p. 2930/01/2001 R.Schmidt, Villars Example for Classification All main circuits are considered to be critical The final list of critical circuits will be established (much) later, and could be modified during LHC beam operation

–Enable: A system that allows to switch on (equipment interlock system) -power converters -beam injection enable -other systems and test modes - to be defined this is in general not time critical and includes many systems (eg. Cryogenics) –A system that stops beam - BEAM ABORT -beam dumps (as fast as technical possible - see Oliver) this is VERY time critical and must be fail safe, and includes less systems –A system that stops power - POWER ABORT -fire quench protection heaters (local action) -act on power converter (10ms - 1s) -open energy extraction switches (10ms - 1s) -discharge circuits (time constants between 1 and 104 seconds) this is time critical and must be fail-safe (failure could lead to heavy equipment damage) –A system recording the data for post-mortem analysis of any ABORT -Clear diagnostics (example - get info MB 112 in sector 5 quenched) Three-Fold Functionality p. 30