1. What systems request a beam dump? And when do we need them?
J. Wenninger AB/OP/SPS
Systems connected to the Beam Interlock System
Safe beam limit
Interlock matrix of required systems
Discussion
With input from : R. Assmann, B. Dehning, B. Goddard, V. Kain, R. Schmidt, J. Uythoven
January 2006
What systems request a beam dump / J.Wenninger

2. Components of the Machine Protection System
Interlock System Clients
Interlock System & Safe Parameters
Access
Vacuum
Powering Interlock System:
Quench detection
PC interlocks
Fast Magnet Current Monitors
Beam loss monitors:
At collimators & aperture limits
In the arcs
Beam position change monitors
Fast beam current decay monitors
Transverse feedback RF
Experiments
Collimators & absorbers
Injection protection devices
Beam Dumping System
BPM for BDS
TCDQ & TCS protection devices
LHC Beam Interlock System
LHC Injection Interlock System
SPS Transfer Line Interlock System
Safe LHC Parameters:
Safe Beam Flag
Beam Presence Flag
Safe LHC mode
Safe Energy
Safe Squeezing Factor
SW related to machine protection
Software Interlock System
..and its inputs!!!!
Post-mortem System
Critical settings management
Sequencer
January 2006
What systems request a beam dump / J.Wenninger

3. Parameters relevant for machine protection
Contribute to
Beam energy
Beam intensity
Emittance
Minimum b* Collimation & failures
Beam intensity from SPS Stored injection
Stored energy & density
Energy density
January 2006
What systems request a beam dump / J.Wenninger

4. What systems request a beam dump / J.Wenninger
Stored energy
Beam
Stored energy in MJ
450 GeV
7 TeV
single pilot ×109
0.006
beam of
0.07
1.1
bunches of 4×1010
0.12
1.9
156 bunches of 4×1010
0.45
7.0
936 bunches of 4×1010
2.70
42.0
2808 bunches of 4×1010
8.09
125.9
2808 bunches of 1.15×1010
23.27
362.0
~ stored energy of SPS, HERA, TEVATRON
Stored energy alone is not the whole story, the beam size has also its importance !
The failure mechanism plays also an important role for damages:
Impact angle and time-constant
January 2006
What systems request a beam dump / J.Wenninger

5. Damage test results A B D C TT40 damage test presented by
V. Kain at Chamonix 2005:
Melting point of Copper reached for  2.5×1012 p [beam impact  to target surface].
Results agree with estimates based on FLUKA simulations.
Shot
Intensity / p+ A
1.2×1012 B
2.4×1012 C
4.8×1012 D
7.2×1012
A B D C
Based on those results we have adopted for the LHC a limit for safe 450 GeV of:
1012 protons with nominal emittance
January 2006
What systems request a beam dump / J.Wenninger

6. Scaling damage limits Energy density scales  1/s
Peak energy deposition Edep in Cu vs beam sigma, for 450 GeV and 7 TeV protons
Energy density scales  1/s
Energy dependence  E1.7
(including emittance reduc.)
Safe beam intensity vs energy, assuming 1012 p+ is safe intensity at 450 GeV
Damage 7 TeV =
(1/100) × Damage 0.45 TeV
Limits for NOMINAL e*:
GeV
TeV  pilot edge !
Pilot

7. Damage potential of a pilot bunch @ 7 TeV
The pilot bunch with nominal e* is close to the damage limit (~ factor 2-4).
A pilot bunch with e* = 1 mm is ~ at the damage limit !
 with nominal e* a pilot should be safe at 7 TeV.
However
the safety margin for some failure scenarios is marginal,
there are uncertainties in scaling the simulation,
the damage levels of materials other than Cu are not (yet) well known,
therefore some protection must be available from the start – in particular because operation with low intensity should only occur for a short time (?).
It is important to note that the damage limit also depends on the failure mode and on the beam impact angle which makes the picture even more complicated.
January 2006
What systems request a beam dump / J.Wenninger

8. Stages for Machine Protection
Stage I II
III IV
Hardware commissioning
Machine checkout
Beam commissioning
43 bunch operation ?
75ns ops
25ns ops I
Install Phase II and MKB
25ns ops II
No beam
Beam
Comm. before first beam
First pilot
1012 protons
43 bunches
156 bunches
936 bunches
0.45 / 7 TeV
SAFE at 450 GeV
‘Just’ SAFE at 7 TeV
January 2006
What systems request a beam dump / J.Wenninger

9. What systems request a beam dump / J.Wenninger
Required or not?
Simplified states for inputs to the Beam Interlock System for a given machine commissioning stage:
Phase 0: not required for operation
Phase 1 : expected to work – but operation is possible without it !
Phase 2 : required – no operation without !
To be noted:
Such a coarse classification does not capture the subtleties or possible staging of the interlock logic behind a given input to the BIS.
‘Precision’ of threshold, width of tolerance windows, reaction times…
For system that are not required from the very beginning, it is recommended to to follow the sequence Phase 0  Phase 1  Phase 2 to profit from a ‘learning’ period (and not Phase 0  Phase 2).
January 2006
What systems request a beam dump / J.Wenninger

10. Injection See V. Kain’s presentation ! System
Commissioning before beam possible ?
First pilot beam
10^12
43 bunches ^12
156 bunches ^12<N<1.4 10^13
936 bunches >5 10^13
Powering interlock system
YES
Beam interlock system
Safe distribution of energy
Safe beam flag
PARTIAL
Beam presence flag
Safe distribution of mode
Safe distr. of squeezing factor
Beam interlocks SPS to LHC
Injection protection NO
Access system
Vacuum system
Magnet current change monitor
BLMs, collimators & apertures
BLM in the arcs
Collimators and beam absorbers
Beam position change monitors
Fast beam current decay monitors
Transverse feedback RF
Experiments
Beam Dumping System
TCDQ / TCS
BPM for BDS

11. Commissioning before beam possible ?
7 TeV
System
Commissioning before beam possible ?
Pilot beam
10^12
43 bunches ^12
156 bunches ^12<N<1.4 10^13
936 bunches >5 10^13
Powering interlock system
YES
Beam interlock system
Safe distribution of energy
Safe beam flag
PARTIAL
Safe distribution of mode
Safe distr. of squeezing factor
Access system
Vacuum system
Magnet current change monitor
BLMs, collimators & apertures
BLM in the arcs
Collimators and beam absorbers NO
Beam position change monitors
Fast beam current decay monitors
Transverse feedback RF
Experiments
Beam Dumping System
TCDQ / TCS
BPM for BDS

12. What systems request a beam dump / J.Wenninger
Comments on the table
State transitions of the MPS appear during commissioning when:
we ramp a pilot bunch to 7 TeV large fraction of inputs required
we ramp 43 bunches to 7 TeV majority of inputs required
we inject 156 bunches majority of inputs required
If we are stuck at 7 TeV because some input systems are not ready, we cannot change the program to high intensity injection ‘studies’.
Although the majority of interlock systems must be operational for 43 bunch operation at 7 TeV, the required safety level or complexity is by far not the same as for 2808 bunches !!
The collimation system is a good example, where only a subset of collimators is required during initial stages, see R. Assmann’s talk.
This table is clearly not cast in stone ! We expect some evolution until the LHC starts up.
January 2006
What systems request a beam dump / J.Wenninger

13. Critical software Injection January 2006
System
Commissioning before beam possible ?
First pilot beam
10^12
43 bunches ^12
156 bunches ^12<N<1.4 10^13
936 bunches >5 10^13
Post-mortem
PARTIAL
Software Interlock System
Critical settings management
YES
Sequencer
January 2006
What systems request a beam dump / J.Wenninger

14. Critical software
7 TeV
System
Commissioning before beam possible ?
First pilot beam
10^12
43 bunches ^12
156 bunches ^12<N<1.4 10^13
936 bunches >5 10^13
Post-mortem
PARTIAL
Software Interlock Control
Critical settings management
YES
Sequencer
For SW components it is clear that constraints & requirements are not the same for a pilot bunch and for 43 bunches or even for 2808 bunches !!
Initially the SW component ‘core’ must be available (Phase 1  Phase 2), with a functionality that is a adapted to a given commissioning stage.
The Software Interlock System ‘box’ hides a large system, with a core to transmit interlocks and a long list of ‘clients’: this a an interlock system of its own ! A first version of this system is expected to be operational at the SPS for the 2006 machine startup (CNGS commissioning).
January 2006
What systems request a beam dump / J.Wenninger

15. Talon d’Achille of the Interlock Systems
A lot of effort is going into building a BIS with very high safety standard SIL3-4.
But many interlocks depend on reference & tolerance settings. Some of those settings must be adjustable during operation. Changes of such settings MUST be protected by adequate access control. An uncontrolled modification can be equivalent to MASKING the corresponding interlock – Exit our SIL3-4 systems !
Front-end frameworks like FESA are presently totally open, and settings may be changed from any WEB CERN !!! The separation of technical and general purpose network has improved the situation somewhat – but not sufficiently.
The development of systems like MCS (Management of Critical Settings) to provide (reasonably) safe & controlled access to critical interlock settings is essential !
We need awareness for those issues in the AB department, and in particular in the CO & OP groups !
January 2006
What systems request a beam dump / J.Wenninger

16. Discussion : first pilot @ 450 GeV
From a pure DAMAGE protection point of view we do not need the BIS and its clients for the first injections.
We only need an interlock in the SPS on the beam intensity.
But we do not want to ‘strap’ interlocks to get going, and then to reconnect and re-test them !
Some very central systems will be tested and ready to go:
The Beam Interlock System
Key beam interlock clients:
Vacuum
Access
Powering interlock system
Dump system
Critical BLMs
Experiments(*)
Un-maskable input signals to the BIS
Does not mean that those systems are 100% operational – e.g. Dump System
(*) The experiments request un-maskable inputs, they must therefore be ready during the machine checkout with all other un-maskable inputs !
January 2006
What systems request a beam dump / J.Wenninger

17. Discussion : pilot @ 7 TeV
The pilot bunch being at the edge of the damage limit at 7 TeV, the BIS must provide sufficient protection even for a pilot, thus requiring a significant number of inputs. In particular:
Minimal collimation (primary & absorber) with rough positions must be in place (see R. Assmann).
Beam loss monitors around the collimators.
Orbit control must be available for the TCDQ, since an asynchronous beam dump is possibly the worst event for a pilot (note the probability to hit the pilot is of course not very high…).
There is no point findings an absolute minimum set of inputs, since we expect to increase intensities anyhow asap…
January 2006
What systems request a beam dump / J.Wenninger

18. What systems request a beam dump / J.Wenninger
43 x 43
With 43 bunches we reach a stored intensity comparable to what is accelerated routinely in the SPS since many years – but which also requires significant interlocking.
At the LHC we aim to reach such stored energy levels in a short time !
The SPS experience shows that one can provoke damage with such beams and at the LHC the price to pay (delay & €) is larger:
‘Natural’ stage where the MP system must be in an advanced stage of commissioning – proportionally more advanced than beam operation.
Systems that may not be required at this stage (still to be studied):
RF and damper interlocks.
Fast beam current decay and fast position change monitors.
January 2006
What systems request a beam dump / J.Wenninger

19. What systems request a beam dump / J.Wenninger
Ions…
The ions will profit from a MP system that is already commissioned with protons, at least up to a certain intensity.
We still have to analyze the safe-unsafe transition with ions (coming soon on MPWG agenda).
We have to analyze what sub-systems of the MP system must be at least partly re-commissioned.
 More detailled studies on ions are foreseen by the MPWG in 2006.
January 2006
What systems request a beam dump / J.Wenninger

20. Conclusions : numbers & milestones
First injection of a pilot bunch – no protection is required except a limitation of the intensity extracted from the SPS. But the BIS and all non-maskable inputs to the BIS will be ready and (pre-)commissioned.
A beam of 1012 p constitutes the SAFE limit (damage) at INJECTION.
Damage 7 TeV = (1/100)× Damage 450 GeV.
A pilot bunch is close to the damage 7 TeV. We presently assume that the pilot is possibly SAFE, but we require some protection (‘minimal’ collimation and BLMs) as soon as the pilot is ramped to 7 TeV.
The majority of the MPS must be operational:
for 43 7 TeV
for GeV
We must start to address the issue of how to manage critical interlock settings!
January 2006
What systems request a beam dump / J.Wenninger