1. machine protection in CLIC
MPWS /06/06
M.Jonker
machine protection in CLIC

2. Outline CLIC beam power and destructive capacity
Base line CLIC machine protection
Identification of failure scenarios
Introduction to failure simulation
Various issues
MPWS /06/06
M.Jonker

3. Beam Power and destructive capacity
Beam Power = BeamCharge × ParticleEnergy × CyclingRate
Drive Beam: 2 × 70 MWatt Main Beam: 2 × 14 MWatt
this makes a sustained disposal of this power a challenging task.
Energy Density = BeamCharge × BeamSize-1 × dE/dx (ionisation loss)
Destructive capacity: determined by BeamCharge × BeamSize-1 not Beam Power.
Safe Beam:: yield limit in copper (62 J g-1)
Drive beam Hz
1.4 MJ /pulse = 340 Kcal
Single cycle heats 100 litre water 3.4 OC melt 2.3 kg CU
Main beam, TeV
289kJ / pulse = 70 Kcal
Single pulse: 0.7 OC 100 litre of water, or melt 450 g CU
@ 2.8 GeV ?  14 cal  0.14 OC in 1 glass of wine
This will not harm?
Do not ignore the ENERGY DENSITY
Particle Energy [GeV]
Pulse Charge [μC]
Beam Size [mm2]
Energy Density
in copper [J g-1]
Incident Beam
Shower Core
Drive Beam Train (1 of 24)
2.4 25 1 40
Main Beam
@ Damping Ring
2.8
0.20
0.34
@ β collimation
0.18
120
Energy density in shower core is less significant than energy density of the incident beam.
Main beam already unsafe in the damping ring even with low beam power.
Particle energy is not the primary worry, however, no doubt at 1.5 TeV you ‘drill’ deeper holes. 
Historically, electron machines have been less impressive than hadron machines, in part because hadron machine have a larger activation potential.
CLIC challenge: Drive beam of unprecedented power (70 MW/beam)
Note Hz = 1.4 MJ for a single pulse = 340 Kcal = 3.4 OC in 100 litre of water. Not so much? It will become steaming hot after 0.5 seconds.
Charge densities: (orders above damage thresholds)
2 orders (drive beam)
4 orders (main beam)
main beam already destructive at 2.8 GeV (such beam exists in light sources, but are they ever extracted?)
Challenging task: fixed masks to protect extraction channels against RT errors.
Main Beam : × ‘safe beam’
Drive Beam : × ‘safe beam’
MPWS /06/06
M.Jonker

4. Machine Protection Timeline
- 2 ms
Next Cycle permit
- 0.1 ms
Beam in flight
- 20 ms:
Last delivered pulse
Slow errors and drifts:
Post cycle analysis
In flight errors:
Masks and RT protection
No modification in the basic concept:
Post pulse analysis to protect against slow machine drifts.
Interlock for equipment faults at inter-pulse time down to 2 ms (next pulse permit decision).
Safe by design for last moment equipment errors
Fixed masks for “In Flight” error (or RT where possible in the injector complex).
Inter cycle equipment errors:
Interlock system
Last moment equipment errors:
Safe by design (equipment inertia)
MPWS /06/06
M.Jonker

5. Failure types and Protection strategies
Slow Failures
Time scale larger than the machine cycle period (10 ~ 20 ms) .
Temperature drifts
Alignment drifts
Beam feedback saturations.
N.B.: Normally, the beam feedback system should keep drifts under control. Any deviation of the expected behaviour is potentially dangerous.
Inter-Cycle Failures
Time scale comparable to machine cycle period (10 ~ 20 ms).
Power supply failures
Positioning system failures
Vacuum system failures
Last moment Equipment Failures
As above but to late for the Interlock system to react (< 2 ms)
Fast Failures
Time scale of beam flight time through the accelerator complex (in flight < 0.2 ms).
RF breakdown: (transversal kicks...)
Kicker misfiring: (damage to septum magnet).
RF klystron trip. (disrupt beam, large losses)
N.B. the drive beam linac: 1.5 drive beam train in the pipeline: i.e. two orders above damage level.
Next Cycle Permit
Systematically revoked after every cycle
Re-established if predefined beam and equipment quality checks have passed:
≈10 ~ 20 ms to analyse the previous cycle and to decide if OK for next cycle.
Equipment Interlock
4 Beam-permit chains: DB e-, DB e+, MB e- MB e+
Network for diagnostics and control
Beam permits
Local Abort
Local Interlocks
Local MP Supervisor
Master MP Supervisor
Post Cycle Analysis
Combination of hardware and embedded software.
False PASS decisions rate must not lead to intolerable risks.
False VETO decisions rate should have a low impact on the system availability.
Certification protocol: Strict test procedures must be defined to certify the reliability of the post cycle analysis. These test procedures must revalidate the system every time a quality check implementation has been modified.
All beam observation systems will be scrutinized for abnormalities
Beam Loss Monitoring system: workhorse of next cycle permit and line of last defence for detecting any failure.
Static Protection
In flight failures:
Difficult to detect beam failures and dump the misbehaving beam.
Impossible for the head of the beam (causality, speed of light).
Passive protection: masks and spoilers.
Make passive protection robust enough to provide full protection for the whole pulse.
Many of the systems are already designed along this principle.
Locations (mostly associated with kickers)
Extraction channels damping ring
Extraction from combiner rings
Drive Beam turn around
Protective masks. (Picture of an LHC Collimator)
Covering the 2 ms blind period prior to the each cycle:
Remain within tolerance (for safe beam passage) for 2 MS after a power converter fault (Magnet circuits inertia τ=L/R)
Preliminary studies: acceptable tolerances ~10%
Þ need magnet circuits with a τ=L/R > 20 ms.
Same principle for all active equipment (vacuum, positioning systems, RF-HV, kicker-HV etc.)
Safe by construction
Addressed by Patrice Nouvel
Addressed by David Nisbet
Next Cycle Permit
Safe by construction
Post Cycle Analysis
Addressed by Javier Resta
4 Beam-Permit-Chains (2 drive beams and 2 main beams).
permits (in both directions) for different beam types (pilot, tests, nominal).
contains local nodes with user permit inputs
the local node also provides local beam and equipment abort signals.
Decision time: 2 ms before next pulse
Equipment Interlock
Static Protection
MPWS /06/06
M.Jonker

6. Failure types and Protection strategies
Slow Failures
Time scale larger than the machine cycle period (10~ms) .
Temperature drifts
Alignment drifts
Beam feedback saturations.
N.B.: Normally, the beam feedback system should keep drifts under control. Any deviation of the expected behaviour is potentially dangerous.
Inter-Cycle Failures
Time scale comparable to machine cycle period (10~ms).
Power supply failures
Positioning system failures
Vacuum system failures
Fast Failures
Time scale of beam flight time through the accelerator complex (in flight).
RF breakdown: (transversal kicks...)
Kicker misfiring: (damage to septum magnet).
RF klystron trip. (disrupt beam, large losses)
N.B. the drive beam linac: 1.5 drive beam train in the pipeline: i.e. two orders above damage level.
Next Cycle Permit
Systematically revoked after every cycle
Re-established if predefined beam and equipment quality checks have passed:
≈ 10 ~ 20 ms to analyse the previous cycle and to decide if OK for next cycle.
Post Cycle Analysis
Implemented in a combination of hardware and embedded software.
False PASS decisions rate must not lead to intolerable risks.
False VETO decisions rate should have a low impact on the system availability.
Certification protocol: Strict test procedures must be defined to certify the reliability of the post cycle analysis. These test procedures must revalidate the system every time a quality check implementation has been modified.
All beam observation systems will be scrutinized for abnormalities
Beam Loss Monitoring system: workhorse of next cycle permit and line of last defence for detecting any failure.
Static Protection
BEAM Interlock
Covering the 2 ms blind period prior to the each cycle:
Remain within tolerance (for safe beam passage) for 2 MS after a power converter fault (Magnet circuits inertia τ=L/R)
Preliminary studies: acceptable tolerances ~10%
Þ need magnet circuits with a τ=L/R > 20 ms.
Same principle for all active equipment (vacuum, positioning systems, RF-HV, kicker- HV etc.)
Safe by construction
In flight failures:
Difficult to detect beam failures and dump the misbehaving beam.
Impossible for the head of the beam (causality, speed of light).
Passive protection: masks and spoilers.
Make passive protection robust enough to provide full protection for the whole pulse.
Many of the systems are already designed along this principle.
Locations (mostly associated with kickers)
Extraction channels damping ring
Extraction from combiner rings
Drive Beam turn around
Beam Interlock System
controls 4 parallel Beam-Permit-Chains (2 drive beams and 2 main beams).
Each chain carries the beam permits (in both directions) for different beam types (pilot, tests, nominal).
A Beam-Permit-Chain contains n local nodes with user permit inputs that can inhibit the beam permit chain .
In case the beam permit chain is interrupted, the local node also provides local beam and equipment abort signals.
Decision time:
2 ms before next pulse
After this time, the machine must be:
4 Beam-permit chains: DB e-, DB e+, MB e- MB e+
Network for diagnostics and control
Beam permits
Local Abort
Local Interlocks
Local MP Supervisor
Master MP Supervisor 
Protective masks. (Picture of an LHC Collimator)
MPWS /06/06
M.Jonker

7. Potential problems Drive beam Linac. Turn around kicker.
CLIC overall layout – 3 TeV
Drive beam Linac.
1.5 drive beam train equivalent in the pipeline…
Turn around kicker.
One drive train equivalent
Kicker failure
Need protection of decelerator structures
Betatron collimators
Disposable equipment
One hit you are out
Combiner rings.
One drive train equivalent
Kicker failures
Decelerators and main linac
RF breakdown
RF Structures
Use this figure to indicate beam and beam powers and brillance
Damping rings.
above safe level
Kicker failures.
Septum protection.
Transport line protection
MPWS /06/06
M.Jonker

8. CLIC Machine Protection
Main Beam
2 injectors e+ e-
1 Linac, 2.2 GeV, 234 m, 2 GHz
2 Pre-damping rings 365 M NB: Synchrotron power from damping rings: Mev turn-1 x 204 nC /1.2 ms turn-1 = 656 KW, (13 KJ pulse-1).
2 Damping rings 365 M (same as PDR)
2 Bunch compressors (4 GHz RF)
1 Booster linac, 6.6 GeV, 561m
2 Transport lines (24.2 km)
2 Turn around loops
2 Bunch compressors (245 m, 12 GHz RF)
2 Main linacs (24.2 km 12 GHz RF from Pets)
2 Beam delivery (2.75 km diagnostics, collimation, final focus)
2 Post collision lines (beam dumps)
Drive Beam
2 Drive beam linac (2x326 klystrons, 139 us)
2 Delay loops (2 RF kickers)
2 Combiner rings m (2 RF kickers)
2 Combiner rings 434 m (2 RF kickers)
2 Transport line with 24 extraction kickers
2x24 Decelerator sectors, each n PETS structures and dump.
MPWS /06/06
M.Jonker

9. Failure Inventory Many failure cases to be evaluated:
Components Classes
Main Beam Production
Injectors
PreDamping Rings
Damping Rings
Booster Linac
Transfer to tunnel
Long transfer
Turnaround
Bunch Compressor
Spin Rotator
Drive Beam Production
Linac
Delay Loop
Combiner Ring 1
Combiner Ring 2
Transfer to Tunnel
Long Transfer
Two Beam Accelerator /Drive Beam
Turnaround loop
Decelerator
Beam Disposal
Two Beam Accelerator /Main Beam
Accelerator
Interaction Region
Diagnostics Section
Collimation Section
Experiment
Post Collision Line
Equipment Failure Classes
RF System
Cavity Break down
Synchro System/Timing error
Powering System HV trip
Kicker Systems
Spurious kick
Timing synchronization error
HV generator Error
RF Deflectors
Synchro System Timing error
Magnet Powering System
Power Interlock /Fault
Magnet System
Winding Short
Alignment System
Stabilization System
Control out of range
Beam Feedback system
Control out of Range
Beam Instrumentation System
Beam Dump
Dump Not ready
Collimators, spoilers…
Vacuum System
Bad Vacuum
Fast Vacuum Fault
Environment and infrastructure
For every combination (~ 700 failure mode +including multiple failures), evaluate: multiplicity, frequency and damage => risk equivalent
MPWS /06/06
M.Jonker

10. Failure catalogue Will be addressed in more detail by Andrea Apollonio
a model: LHC failure catalogue under development by Sigrid Wagner, Andrea Apollonio TE-MPE-PE.
Problem: Collect LHC failure scenarios related to beam induced damage
Result: Heading - ‘pull down menu’ - list of component failure modes - list of prevention/protection systems
Ongoing/next: iteration process - filling of catalogue in collaboration with experts - documentation
Will be addressed in more detail by Andrea Apollonio
Failure catalogue also useful for availability analysis (addressed by Marc Ross: Avail-sim)
MPWS /06/06
M.Jonker

11. Failure analysis
Consequences of individual failures do not have to be studied in detail:
Common underlying mechanism
Fault  effect on beam  transport  damage
Perturb beam and look for impacts on most sensitive and restrictive elements
Collimators in main linac
RF structures
Extraction septa
Once we know which beam perturbations cause harm, look for possible equipment failures that can causes these beam perturbations
RF breakdown
Kicker misfiring
Power supply failure
Vacuum failure
Magnet failure
Falling magnet
UFO
MPWS /06/06
M.Jonker

12. Analytical estimates First guess, approximation with linear optic
Kicks in the vertical plane
Betatron collimators half aperture = 100 μm, 1500 GeV, βy = 483 m
Acceleration structures at the end of the linac half aperture = 2 mm, 1500 GeV, βy = 67 m
Acceleration structures at the start of the linac half aperture = 2 mm, 9 GeV, βy= 67 m
Kicks in the horizontal plane
Betatron collimators half aperture = 120 μm, 1500 GeV, βx= 270 m
Energy collimators half aperture = 3.51 mm, 1500 GeV, βx= 1406 m
Acceleration structures at the end of the linac half aperture = 2 mm, 1500 GeV, βx= 67 m
Acceleration structures at the start of the linac half aperture = 2 mm, 9 GeV, βx= 7 m
Energy [GeV]
Beta [m]
Max Kick
h-App eq
Max Vtrans 9
1.8 / 7
22 μrad
155 μm
200 KeV
1500
18 / 67
0.56 μrad
37 μm
830 KeV
Energy [GeV]
Beta [m]
Max Kick
h-App eq
Max Vtrans 9 7
35 μrad
250 μm
320 KeV
1500 67
0.9 μrad
60 μm
1340 KeV
Energy [GeV]
Beta [m]
Max Kick
h-App eq
Max Vtrans 9
1.8 / 7
1.2 mrad
8.3 mm
10 MeV
1500
18 / 67
30 μrad
2 mm
44 MeV
Energy [GeV]
Beta [m]
Max Kick
h-App eq
Max Vtrans 9 7
460 μrad
3.2 mm
4 MeV
1500 67
11 μrad
0.77 mm
17 MeV
Energy [GeV]
Beta [m]
Max Kick
h-App eq
Max Vtrans 9
2 / 7
290 μrad
2 mm
2.6 MeV
Energy [GeV]
Beta [m]
Max Kick
h-App eq
Max Vtrans 9 7
1.2 mrad
8.3 mm
10 MeV
1500 67
30 μrad
2 mm
44 MeV
Energy [GeV]
Beta [m]
Max Kick
h-App eq
Max Vtrans 9 7
290 μrad
2 mm
2.6 MeV
MPWS /06/06
M.Jonker

13. Failure simulation Why detailed simulation
A beam deflection that is large enough to send the beam into the collimators may also blow up the emittance of the beam (non linear effect).
Optimistic:
Reduction of beam charge density
Less destructive beams
Pessimistic:
Beam fragments may hit the collimators already for smaller kicks
Reduction of effective aperture
Simulate multiple error conditions
Simulate failures in non standard conditions
Will be addressed in more detail by Andrea Latina & Carlos Maidana
MPWS /06/06
M.Jonker

14. POST PULSE analysis A lot of redundancy?
The primary role of the Post Pulse analysis:
detect in time the onsets of beam instabilities (temperature drifts, ground motions, TGV Lausanne-Geneva, etc) that develop over a medium length timescale and which may cause radiation damage to the machine.
Any not understood excursion from standard values will inhibit the next pulse permit and require the system to go through a fast commissioning cycle (intensity ramp up).
The system will learn by experience.
Based on information from
BLM
BPM,
Transverse profile monitors
BCT
Dump profile measurements
Post collision diagnostics
Ground motion sensors
Beam Feedback performance
(And everything else)
But all within 20 ms
A lot of redundancy?
Good news: better reliability
Bad news: more options for false alarms
Can learn from LHC experience (presentation Verena Kain)
MPWS /06/06
M.Jonker

15. RT protection: Only a few opportunities for a shortcut:
Damping ring (dump after one turn, or spoil the emittance)
Important protection against synchrotron radiation causing quenches of superconducting wigglers.
Turn around loop at entry of main linac (1000 M)
Dump in case of, position errors, phase errors, energy errors… Important also to reduce radiation
Special tricks with Drive Beam turn around ...
Drive Beam Linac failures: cut the source ...
1.5 Train equivalent in the pipe-line! ... do we need intermediate dumps?
Beam Quality Monitor
MPWS /06/06
M.Jonker

16. Equipment Interlock with Beam Feedback
We can restrict the maximum cycle to cycle changes on individual correctors.
A failing beam based feedback system may apply a lot of small changes with a damaging effect.
What freedom can we give a beam feedback system?
Do we need certification and formal testing of the feedback sofware (like we will need with the equipment interlock and post cycle analysis)
Can we define and independent limit on a vector sum of all the feedback corrections?
Any experience out there?
MPWS /06/06
M.Jonker

17. Purging a pipeline If a real-time problem is detected in
a decelerator section
Option: the extraction in the decelerator and dump the train at the end of the line
the drive beam transport line
Note: Stopping the source will not solve the problem: long delay to reach the source (a huge pipeline).
However we can clean the pipeline by switching the trains prematurely into decelerator lines.
Not likely to be a realistic fault scenario
MPWS /06/06
M.Jonker

18. Other issues Radiation background in main tunnel
Impact on electronics
Need better tracking of loss locations for “operational” losses (addressed in presentation of Helmut Burkhardt)
RT protection of the Drive Beam Linac
Kicker upstream channel protection
Masks may be in the limits (presentation of Alessandro Bertarelli)
Tune up dumps for commissioning.
Commissioning of MP system.
Certification validation of software components in MP system
Bootstrap of next cycle permit after an interlock (fast intensity ramp) (addressed in my presentation on Friday)
MPWS /06/06
M.Jonker

19. Conclusions Time for a break ? i.e. lunch
We will learn about it more in following presentations
MPWS /06/06
M.Jonker