1. R.Schmidt and J.Wenninger - Lumi ‘061 Rüdiger Schmidt Jörg Wenninger CERN LUMI 06 in Valencia / Spain Friday 20 October 2006 Machine protection for PS2, SPS (LHC+)

2. R.Schmidt and J.Wenninger - Lumi ‘062 Machine protection for LHC+, SPS, PS2 Rüdiger Schmidt Jörg Wenninger CERN LUMI 06 in Valencia / Spain Tuesday 17 October 2006

3. R.Schmidt and J.Wenninger - Lumi ‘063 Main Challenge: Energy stored in the beams Factor 3 Based on graph by R.Assmann LHC injection (12 SPS batches) ISR SNS LEP2 SPS fixed target and CNGS HERA TEVATRON SPS ppbar SPS batch to LHC Factor ~200 RHIC proton LHC energy in magnets LHC top upgrade

4. R.Schmidt and J.Wenninger - Lumi ‘064 Protection of LHC – magnets and accelerator Protection has been part of the design of superconducting magnets since a long time –For the LHC, since the beginning of the 90 th Beam dumping system was part of the early design of LHC Beam Loss Monitor system: started after 2000 LEP type collimation system was foreseen Coherent approach to “Machine protection” started ~2000 –Studies of failures and consequences –Beam and Powering Interlock Systems –“New” cleaning system –Other systems for protection of LHC Future accelerators with higher beam energy (LHC+): machine protection to be considered at an early stage – this talk…

5. R.Schmidt and J.Wenninger - Lumi ‘065 Approach to Machine Protection Establish a list of failure scenarios that could lead to damage, and their expected frequency –As an example, power converter trips, magnet quenches, … Quantify the consequences – what could happen? –What could be damaged? –What is the cost for repair, and how long would it take? What can be done to exclude the failure? …should always have priority, if possible….. –As an example, a kicker that deflects the beam at 7 TeV by 6  to measure the aperture – is this really required? NO What protection systems are required to survive the failure? What is the dependability of the protection system(s)? –Dependability: reliability and availability - a failure of the protection systems could have catastrophic consequences

6. R.Schmidt and J.Wenninger - Lumi ‘066 SPS experiment: Beam damage at 450 GeV Controlled experiment 8  10 12 protons beam size σ x/y = 1.1mm/0.6mm above damage limit 2  10 12 protons below damage limit 25 cm ~0.1 % of the nominal LHC beam energy (0.6 MJoule) The energy of about three nominal 7 TeV bunches The energy density of less than one bunch 6 cm 8  10 12 6  10 12 4  10 12 2  10 12 V.Kain

7. R.Schmidt and J.Wenninger - Lumi ‘067 Full nominal LHC 7 TeV beam deflected into copper target Target length [cm] vaporisation melting N.Tahir (GSI) et al. Copper target 2 m Energy density [GeV/cm 3 ] on target axis 2808 bunches 90 µs long train 2808 nominal bunches would travel up to ~30 m into a copper target

8. R.Schmidt and J.Wenninger - Lumi ‘068 Nominal LHC: Protection and Beam Energy A small fraction of beam loss is sufficient for damage (~10 -4 ) Very efficient protection systems throughout the operational cycle are required A tiny fraction of beam loss is sufficient to quench a magnet (~10 -8 ) Very efficient beam cleaning is required –Sophisticated beam cleaning with about 50 collimators, each with two jaws, in total about 90 collimators and beam absorbers –Collimators are close to the beam (full gap as small as 2.2 mm, for 7 TeV with fully squeezed beams), particles will always touch collimators first ! This becomes even more critical after an upgrade

9. R.Schmidt and J.Wenninger - Lumi ‘069 Use of existing ideas and tools + novel approaches Large redundancy in protection systems (in particular for detecting failures) Machine protection systems are build using tools from reliability engineering (dependability has been quantified for main protection systems) Protection systems for powering operation and beam operation are separated (…with a link from powering interlocks to beam interlocks) Short time constant for reaction of the protection systems (order of a few turns, to detect failure, inform beam dump kicker, wait for abort gap, and extract bunch train) Relaxing interlocks by using Safe Beam Flag LHC machine protection

10. R.Schmidt and J.Wenninger - Lumi ‘0610 Single turn failures From SPS until beams are circulating in LHC…… …..extraction, transfer through a 3 km long line, and injection of a 4 MJoule beam into a 27 km long, very cold, very very expensive and narrow structure is thrilling… Kicker failures – at extraction from SPS and at injection into LHC Magnetic elements having wrong settings Object in beam pipe (e.g. vacuum valve, screen, …) Failures with circulating beam –Due to a kicker that fires accidentally (injection or extraction kicker, kicker for beam monitoring such as for aperture measurements, other new devices,…) Failures during extraction of beam towards beam dump block

11. R.Schmidt and J.Wenninger - Lumi ‘0611 Protection from single turn failures: Injection After a (kicker) failure, the beam goes where it goes according to the magnetic fields - no “active” protection possible Passive protection by beam absorbers – studied for LHC up to ~3 MJoule at 450 GeV, and ~1 MJoule at 7 TeV 1.20 m long carbon collimator block for LHC (R.Assmann) 1.Inject beam of limited intensity (~MJ) 2.Limit probability for failures to the minimum Safe pilot beam that is replaced by high intensity beam Monitoring of all parameters, and permitting kicker firing when everything is ok and pilot beam alive 3.Protect exposed equipment by beam absorbers

12. R.Schmidt and J.Wenninger - Lumi ‘0612 Protection for single turn failures: Extraction about 35 cm Extraction All beam should go OUT Limit complexity of the extraction system to the minimum Limit risks to LHC to the minimum by all means Limit risks for the extraction channel as far as possible If something goes wrong, extraction channel is mostly exposed, the LHC much less… Watch the orbit around LHC

13. R.Schmidt and J.Wenninger - Lumi ‘0613 Circulating beams: failures leading to beam losses after several turns or more Failures in the magnet and powering system Wrong operational parameter (tune, chromaticity, orbit, …) Beam instability Object moves into beam Transverse damper has wrong phase Vacuum problem RF trip Others The beam must be extracted before too many particles touch the aperture 1.Detection of the initial failure, or of the consequences of the failure on the beam 2.Extracting the beam into the beam dump block 3.Takes maximum three turns after detection of failure

14. R.Schmidt and J.Wenninger - Lumi ‘0614 Detection of failures: large diverse redundancy Hardware diagnostics Vacuum valve leaving the “OUT” position (…away from end switch) Other movable devices leaving the “OUT” position Powering failures detected by the power converter, requesting a beam dump (typical times in the order of 10 ms) Failures of cooling for normal conducting magnets Failure in the RF system Quench signal from Quench Protection System Failure in critical beam absorbers and collimators Fast Magnet Current change Monitors (development from DESY) Beam loss monitors at collimators and other aperture limitations Beam loss monitors in the arcs Fast Beam Position change Monitors – needs commissioning Fast Beam Current change (“lifetime”) Monitors – under study

15. 15 Particles that touch collimator after failure of normal conducting D1 magnets After about 13 turns 3·10 9 protons touch collimator, about 6 turns later 10 11 protons touch collimator V.Kain “Dump beam” level 10 11 protons at collimator Nominal LHC

16. R.Schmidt and J.Wenninger - Lumi ‘0616 LHC upgrade and very fast beam losses Beta function increase by a factor of 4 reduces time scale of fast beam losses by a factor of 2 (assuming same time constants as for D1 type magnets in nominal LHC) An increase of the number of protons by a factor of 2-3 reduces the time scale further There is a limit, it might not be possible to safely detect failure and dump the beam in time Needs to be considered during the design phase Avoid to put an element into LHC that deflects the beam by, say more than 3-6  within few turns => THERE IS NOT WAY TO PROTECT LHC

17. R.Schmidt and J.Wenninger - Lumi ‘0617 LHC upgrades… LHC upgrade that includes stronger focusing –Achieving the same luminosity with reduced beam current is preferred –There is a limit since high luminosity requires many protons –Larger aperture in the triplet is very beneficial –If time constant for beam loss decreases …there is a limit (chromaticity correction is not the only issue) LHC upgrade that includes more beam current –Single turn failures become more critical –Injection into LHC: if injected intensity increases substantially, injection protection to be re-considered –Absorbers and collimators still ok? –Extraction into beam dump if intensity is above ultimate: B.Goddards presentation

18. R.Schmidt and J.Wenninger - Lumi ‘0618 Increasingly important role of Beam Instrumentation To detect failures and trigger a beam dump 1.Beam Loss Monitor System (most critical system together with the Beam Dumping System and Beam Interlock System) The system has been developed with its dependability in mind 2.Fast Beam Current change Monitors used at HERA and under discussion for LHC Redundant to the BLM system - if the BLMs miss to detect beam losses To provide information for safe operation 1.Beam Current Monitors To monitor pilot bunch (only then injection of high intensity beam allowed) To provide the Safe Beam Flag (If TRUE, interlocks can be relaxed, turned out to be very useful during CNGS run) 2.Beam Position Monitors –To ensure that enough aperture is available (reliability of BPMs should be high to avoid single turn failures during beam dump)

19. R.Schmidt and J.Wenninger - Lumi ‘0619 Workshop brainstorming: possible risks for LHC I Very low margin of superconducting magnets with respect to energy stored in the beams –Collimation system already very demanding HERA: spikes in beam losses exceed average beam losses by orders of magnitude –For LHC 7 TeV, collimators are VERY close to the beam Different ideas should be pursued –Electron lens –Nonlinear collimation –Collimation using crystals Could we install additional absorbers in the cold part? –Few shorter (less than 15 m), stronger dipole magnets replacing LHC arc dipoles at a few locations would create some space for absorbers at intermediate temperature (downstream insertions 3 and 7) to capture debris

20. R.Schmidt and J.Wenninger - Lumi ‘0620 M.Lomperski, Chamonix XI

21. R.Schmidt and J.Wenninger - Lumi ‘0621 Workshop brainstorming: possible risks for LHC II Equipment in the tunnel (e.g. electronics) is radiation tolerant – should be ok Most equipment in the underground areas (e.g. powering equipment, a lot [ !!] of electronics) –Experiments worry about radiation level in their control rooms for upgrade –Equipment in the RRs, UAs, UJs, etc. is in general commercial-off-the- shelf (COTS) –Number of single event upsets increases with beam current / luminosity in some areas…. –Might have a impact on LHC availability What to do if…. ? –Might be required to move part of the equipment to the surface, or to develop radiation tolerant equipment –If this would be required for high current powering equipment - superconducting links might be an option

22. R.Schmidt and J.Wenninger - Lumi ‘0622 Safety culture for LHC Recording of all failures – in particular of “near misses” (events that could have had catastrophic consequences) –Failure in the hardware systems –Failure in procedures, software and operation –Unexpected beam dynamics Compare expectations with predictions from (reliability) models –This is a lot of detailed and time consuming work –This requires resources –This is a new field - little expertise in accelerator physics and technology If this would not be done in the air-traffic industry – no planes - we would have traveled between 15 hours and 15 days to Valencia Safety culture in accelerator – protection is not only the task of a few specialists

23. R.Schmidt and J.Wenninger - Lumi ‘0623 Machine protection for injectors LHC machine protection toolkit should be adequate to provide protection for all injectors and all upgrades Important issue for high power accelerators: reduce activation to minimum (beam losses < 1 W/m) –Some high intensity proton machines are limited by dose to equipment, and NOT by the beam current that can be accelerated –Collimators might be required for injectors (in particular, if they use superconducting magnets) –Other techniques to limit activation (new proposal for PS extraction) More performance might not bring much more integrated luminosity for LHC - to be quantified (.... Injector performance was not most relevant for LEP) Extend design principles for machine protection systems to other systems could lead to higher availability

24. R.Schmidt and J.Wenninger - Lumi ‘0624 SPS Machine Protection Beam Interlock System: currently an LHC type system is being installed in SPS Beam Loss Monitor system: the monitors do not detect all beam losses –More monitors and faster reaction time –LHC type BLM system should work for SPS Injection into the SPS might become an issue for some scenarios (for the moment this is not the case) –Again, LHC type systems should be able to cope with it (absorbers, interlocks, etc.) Moving internal beam dump block out into (short) tunnel, not too close to machine (new extraction kicker?)

25. R.Schmidt and J.Wenninger - Lumi ‘0625 Conclusions Upgrade scenarios should consider machine protection from the start –LHC: do not introduce faster beam loss mechanisms Experience from early LHC operation will be decisive: where are the limits… ? –Beam dynamics: Dynamic aperture, E-cloud, Beam-Beam, … –Beam cleaning and quenching –Activation of materials –Protection –Reliability of LHC systems –Injectors –Others Work that is being done in view of an LHC upgrade: Priority to projects that could also help to achieve nominal luminosity in case of problems

26. R.Schmidt and J.Wenninger - Lumi ‘0626 The End

27. 27 Most likely failures for fast losses: quenches Failures leading to the fastest multiturn losses: D1 magnet Quench of: - MQX - D2 - MB Powering Failure of D1 normal conducting D1 normalconducting very fast loss Squeezed optics with max beta of 4.8 km All 4 quadrupole magnets (inner triplet MQX) quench, approximately Gaussian current decay with time constant 0.2 s Powering failure for D1, exponential current decay, time constant 2.5 s Quench of one MB, approximately Gaussian current decay with time constant 0.2 s D2 quench fast loss time [seconds] orbit [mm] MB quench fast loss MQX: 2 quads quench fast loss V.Kain Diploma thesis 2001 / O.Brüning

28. 28 Beam dump failures (schematic drawing) Beam dump kicker Extraction channel to beam dump block Circulating beam Before beam dump request….

29. Beam dump failures (schematic drawing) Beam dump kicker Extraction channel to beam dump block Beam dump must be synchronised with beam abort gap Strength of kicker and septum magnets must match energy of the beam: Ultrareliable energy tracking Orbit excursions in IR6 < 4 mm to protect dump channel (interlock) Circulating bunches Extracted bunches Beam abort gap 3  s

30. 30 Beam dump failures (schematic drawing) Beam dump kicker Extraction channel to beam dump block Example for accidental prefiring of kicker: about 100 bunches are only partially deflected Circulating bunches

31. 31 Beam dump failures (schematic drawing) Beam dump kicker Extraction channel to beam dump block Set distance between closed orbit and TCDQ to protect aperture (10σ) Capture bunches by beam absorbers Eight bunches stay in the machine and oscillate around closed orbit Circulating bunches TCDQ protects magnets TCDS protects septum 300 m

32. 32 Beam dump failures orbit behind beam dump insertion Oscillation of bunches downstream of beam dump insertion – optimum orbit Bunches oscillate by up to about 10 σ If closed orbit is less than, say, 3 mm, enough aperture is available Closed orbit

33. 33 Beam dump failures orbit behind beam dump insertion If closed orbit is much more than, say, 3 mm, not enough aperture is available, in particular delicate in low beta insertions Closed orbit Oscillation of bunches downstream of beam dump insertion – closed bump

34. R.Schmidt and J.Wenninger - Lumi ‘0634 Reducing consequences of catastrophic failure Beam dump requests –After a failure the beam needs to be extracted fast –After a fill, beam needs to be extracted on the request of an operator What to do when the operator cannot dump the beam? If the beam is not extracted after a failure, severe damage to the LHC –Failure of the beam dumping system or the beam interlock system –Failure of the monitoring system(s) Passive system for the protection in case of such major failure (not obvious) –(Additional) insertion with (disposable) beam absorbers –Non-movable devices close to the beam (for 7 TeV at about 10  ) –When beam becomes unstable, it would damage cleaning collimators and the absorbers in the insertion –Keep the beam at 10  : either changing the optics, or changing the orbit –Long downtime expected, but not total loss of LHC Dump block that is inserted into the LHC when beam dump kickers did not fire (must be VERY fast)