1. Initial Experience with the Machine Protection System for LHC
Initial Experience with the Machine Protection System for LHC Rüdiger Schmidt R.Assmann, B.Dehning, M.Ferro-Luzzi, B.Goddard, M.Lamont, A.Siemko, J.Uythoven, J.Wenninger, M.Zerlauth
LHC cycle and machine protection
Strategy for machine protection
Commissioning
Operational experience
Conclusions
IPAC May 2010 Kyoto
v1.1

3. Energy stored in one LHC beam
6 cm
A B D C
Today

4. IPAC May 2010 Kyoto
v1.1

5. LHC operational cycle and machine protectioin
3500
3000
2500
energy ramp 10 kJ  100 kJ circulating beam
coast
(100 kJ) circulating beam
Energy [GeV/c]
2000
1500
1000
beam dump ~100 kJ
500
-4000
-2000
2000
4000
time from start of injection (s)
Injection: 13 bunches from SPS per beam (21010)
Nominal: 2808 bunches per beam (1.151011)

6. Injection: Without quenching magnets or causing damage
No kick by injection kicker of circulating beam (correct synchronisation)
Injection protection absorber in place in case of kicker failure
3500
3000
2500
energy ramp 10 kJ  100 kJ circulating beam
coast
(100 kJ) circulating beam
Energy [GeV/c]
2000
1500
1000
beam dump ~100 kJ
500
-4000
-2000
2000
4000
time from start of injection (s)
Injection: 13 bunches from SPS per beam (21010)

7. No accidental firing of a kicker magnet
Circulating beam: In case of failure, detect failure and extract beam into dump block for some failures within a few turns
No accidental firing of a kicker magnet
3500
3000
2500
energy ramp 10 kJ  100 kJ circulating beam
coast
(100 kJ) circulating beam
Energy [GeV/c]
2000
1500
1000
beam dump ~100 kJ
500
-4000
-2000
2000
4000
time from start of injection (s)
Injection: 13 bunches from SPS per beam (21010)

8. Extraction: Beams must ALWAYS be extracted into beam dump block
Kicker rise must be synchronised with the 3 µs long beam abort gap
Abort gap must be clean of particles
3500
3000
2500
energy ramp 10 kJ  100 kJ circulating beam
coast
(100 kJ) circulating beam
Energy [GeV/c]
2000
1500
1000
beam dump ~100 kJ
500
-4000
-2000
2000
4000
time from start of injection (s)
Injection: 13 bunches from SPS per beam (21010)

9. Strategy for machine protection
Early detection of equipment failures triggering beam dump request.
Powering Interlocks: failures in powering system (quench, PC trip,..)
Fast Magnet Current change Monitor
Monitoring of beams to detect abnormal beam conditions and triggering dump request, down to a single machine turn.
Beam Loss Monitors and Beam Position Monitors
Reliable transmission of dump requests to beam dumping system and stop injection + extraction from SPS
Beam Interlock Systems
Reliable operation of beam dumping system, safely extracting beams onto the external dump blocks.
Beam Dumping System
Definition of LHC aperture by collimators, to limit beam losses to (warm) collimator regions.
Beam Cleaning System
Passive protection by absorbers and collimators for specific failure cases.
Beam Absorbers
MOPEB045
WEPEB069
WEPEB073
TUPEB063
TUOAMH01

10. Architecture of the Beam and Powering Interlocks
Safe Beam Parameter Distribution
Beam Loss
Monitors
BCM
Jaw Position
Temperature
SpecialBLMs
Safe
Machine
Parameter
Software
Interlock
System
Operator Buttons
CCC
LHC
Experiments
Screens and Mirrors
beam observation RF
System
Collimation
System
BPMs
Beam
Dumping System
Beam Interlock System
Safe
Beam
Flag
Injection Interlock
and SPS extraction
Powering
Interlocks
superconducting magnets
Powering
Interlocks
normal conducting magnets
Fast Magnet Current Monitors
Vacuum
System
Access
System
Beam loss monitors
BLM
Timing System
(Post Mortem Trigger)
Magnets
Power Converters
Monitors
aperture limits
(some 100)
Monitors in arcs
(several 1000)
Quench protection system PS
(20000 channels)
Power
Converters
~1600
AUG
UPS
Cryogenics
some channels

11. Steps in commissioning of machine protection
Before starting beam operation, check interlocks from all system (as far as possible)
Start with low intensity beam (no risk of damage)
Commissioning the beam dump system at different energies
Commissioning the beam cleaning system (80 collimators) at different energies, and for different optics
Specific tests with beam (Machine Protection tests)
Analyse operation (for all beam dumps and for beam losses not leading to a beam dump)
Early commissioning: masking of interlocks
setup beam flag: when energy density is below critical value
Exceed the stored energy of the setup beam flag (“safe beam”) – masking automatically removed
Get confidence in machine protection to go to higher intensity

12. Commissioning of the beam dump system
Beam dumps done at different energy, to demonstrate that bunches are correctly extracted via a 700 m long line into the dump block
To reduce the energy density on the dump block, beam is “painted” by fast deflection of two families of kicker dilution magnets
A 3 µs abort gap for the switch-on of the extraction kicker field allows loss free extraction under normal operating conditions.
Some asynchronous beam dumps are expected. Collimators are installed to capture beam that is deflected with a small angle. Tests with de-bunched beam: particles in abort gap are correctly intercepted
Beam dump of 10 bunches, beam spots on screen (measurement and expected centres) in front of beam dump block

13. Collimator setup
red line: BLM thresholds
ATLAS
Alice
Momentum cleaning RF
CMS
Beam dump
Betatron cleaning
LHCb
Cleaning efficiency depends jaw centring on beam, accuracy of gap size and jaw parallelism with respect to beam. The collimators are aligned during the different operational phases (injection, top energy, etc.)
Excellent performance, no beam induced quench. The efficiency is measured by driving the beam on a resonance.

14. Early detection of powering failures (FMCM OFF)
With low intensity beam, the monitor was disabled and a trip of the power converter triggered
A trip of normal conducting magnets close to the experiments is most critical (fastest beam loss)
The beam position changed, and beam loss monitors close to collimators recorded the loss and triggered a beam dump
Redundant protection is required, by measuring voltage drops in the circuit within less than one ms
Position change of ~1.5 mm within 250 turns (25 ms)
Beam position over 1000 turns at one BPM
11/15/2018

15. Early detection of powering failures (FMCM ON)
The Fast Magnet Current change Monitor (FMCM) to detect fast powering failures was enabled
The test was repeated
The beam was dumped, before any effect on the beam position was visible
No beam losses were detected
The redundant protection works. This is an example that we try to use for all possible failures
Very sensitive in case of problems with the electrical network (a number of beam dumps)
no position change
Beam position over 1000 turns at one BPM

16. Software Interlock System
Provides additional protection for complex but less critical conditions (e.g. surveillance of magnet currents and closed orbit)
Example: triggered on large orbit excursion (> 12 BPMs over 6 mm for beam 2 in the horizontal plane (too large RF frequency change)
Threshhold
MPP - 16th April 2010 16 16

17. “Post Mortem” after beam dump
FMCM RD1 LR1
GeV
Record all state changes from interlock systems
Record transient data for every beam dump for all systems (beam loss, orbit, beam current, tune, hardware parameters (magnet current, collimator positions, …)

18. Early experience
Many beam dumps at injection, in general for commissioning purpose
“False” beam dumps: if a protection system dumps the beam because of an internal failure (e.g. noise spikes, problems in connectors, …)
About 75 beam dumps after the start of the energy ramp
All beam dumps are understood (thanks to the interlock systems and post mortem recording)
Not a single quench with circulating beam
Stored energy of 100 kJ with respect to 10 mJ for quenching a magnet
Cleaning system did an excellent job
Detection of failures worked very well
Very few beam induced magnet quenches (“quenchinos”), only during injection at 450 GeV
the threshold of a quench detector was exceeded, the quench heaters fired and quenched the magnet (without firing the magnet would have recovered)
one event: main quadrupole current in one sector 350A instead of 760A
other events: during special aperture studies

19. Conclusions
For many Machine Protection sub-systems: Commissioning finished before LHC beam operation during hardware commissioning (all interlocks related to the magnet powering system)
Commissioning of LHC with low intensity beams, slowly increasing the intensity, bringing up all machine protection systems
The beam intensity where interlocks can be masked has been exceeded. LHC operates with all interlock enabled
LHC can operate with the full machine protection system
Operational experience and machine protection experiments demonstrated that the machine protection system works as expected, no surprises until today
These are early days, a huge step in beam intensity is still required
Next month(s): 1 MJoule, end of this year: >10 MJoule

20. Acknowledgements
LHC Machine Protection reflects the complexity of the LHC accelerator.
Many colleagues contributed to LHC Machine Protection. We like to thank them and are very grateful for their contributions.

21. Reserve slides

22. Beam dumps above injection energy (incl. 3.5TeV)
Reason for beam dump
Dumps
False dumps
Magnet Protection System 6
Cryogenics
Feedback / Magnet Protection
Experiments 4
Beam dynamics 5
Electrical Network 2
Beam Loss Monitor System
Beam Position Monitors
Beam Dumping System Internal Failure
Operational error
Dump at the end of the fill
Machine Protection Tests 12
Interlock systems

23. Masking interlocks during initial operation
There are several 10 thousand interlock channels
Start-up of such a machine is not possible without masking interlock channels
Example: commissioning of the cleaning system with all beam loss monitors active
BE PREPARED TO MASK (disable) interlocks!
but in a co-ordinated way
Setup Beam Flag: interlock can be masked
it is always easy to see what interlocks are masked
when the beam becomes unsafe (stored energy above setup beam limit), the interlock become automatically enabled
Masking of interlocks should be considered when designing the system

24. Principles for machine protection
Protect the machine
highest priority is to avoid equipment damage
second priority is to avoid quenching of magnets: with superconducting magnets it requires few mJoule to quench: no beam losses in the cold part
Protect the beam: trade-off between protection and operation
complex protection systems reduces the availability of the machine
minimise number of “false” beam dumps (beam dumps due to a failure in the protection systems)
Provide the evidence
if the protection systems stops operation (e.g. dumps the beam or inhibits injection), clear diagnostics provided by the “post mortem” system
if something goes wrong (near miss or even damage), it should be possible to understand the reason why

25. Machine protection during operational cycle
Injection
injection of beam without quenching magnets or causing damage
no kick by injection kicker of circulating beam (correct synchronisation)
Circulating beam
in case of failure, detect failure and extract the beam into the beam dump block, for some failures within a few turns
no accidental firing of a kicker magnet
The beam must ALWAYS be extracted into the beam dump block (end of fill or in case of a failure)
reliable operation of beam dumping system
kicker rise must be synchronised with the 3 µs long beam abort gap
abort gap must be clean of particles
collimators reduce beam loss in case of failure

26. Setup (Safe) Beam Flag - TRUE
Initial beam commissioning and machine protection tests very difficult with all interlocks active
Some interlocks can be MASKED when beams stored little energy density

27. Setup (Safe) Beam Flag - FALSE
When stored beam energy exceeds a critical value for the stored beam energy density, all masks are removed
If an interlock on a masked input is active => beam dump

28. Interlocks Systems: ensure time stamping
Safe Beam Parameter Distribution
Beam Loss
Monitors
BCM
Jaw Position
Temperature
SpecialBLMs
Safe
LHC
Parameter
Software
Interlock
System
Operator Buttons
CCC
LHC
Experiments
Screens and Mirrors
beam observation RF
System
Collimation
System
BPMs
Beam
Dumping System
Beam Interlock System
Safe
Beam
Flag
Injection Interlock
Powering
Interlocks
superconducting magnets
Powering
Interlocks
normal conducting magnets
Fast Magnet Current Monitor
Vacuum
System
Access
System
Beam loss monitors
BLM
Timing System
(Post Mortem Trigger)
The interlock systems allows to identify the origin of any beam dump, and for powering failures to identify the electrical circuit that tripped
data from several channels (50k-100k)
all data is time stamped with the same clock (beam interlocks ~ µs, powering interlocks ~ ms)
Magnets
Power Converters
Monitors
aperture limits
(some 100)
Monitors in arcs
(several 1000)
Quench protection system PS
(20000 channels)
Power
Converters
~1600
AUG
UPS
Cryogenics
some channels

29. Powering System and interlocks
Hardware commissioning: Ramp all magnets with current functions as during beam operation and commission all interlocks
1700 high current powering circuits with about magnets
Interlocks required for commissioning of the magnet powering system
Monitors temperatures in superconducting magnet system, voltages, currents, many other parameters, ….
Failures: quench, power converter failure, cryogenics problem, water cooling failure, UPS failure, failure in the protection systems
firing of quench heaters, extraction of energy in the circuit, stop power converters, … AND trigger beam dump
For some magnet circuits: beam dump, for other circuits: no beam dump
can be configured for each circuit
main dipole and quadrupole magnets: always dump beams in case of failure
example: orbit correctors in the arc not (yet) included in the systems that dump the beam