1. Concept & architecture of the machine protection systems for FCC
Rüdiger Schmidt, CERN
FCC week 2015

2. Protection from Energy and Power
Risks come from Energy stored in a system (Joule)
The energy stored in particle beams reached already an impressive level, and will further increase with FCC
The energy stored in the magnet system is even more impressive, and discussed in other talks
An uncontrolled release of the energy can lead to unwanted consequences
Damage of equipment and loss of time for operation
Activation of equipment
This is true in particular for complex systems such as accelerators the FCC magnet system and particle beams

3. Energy stored in the FCC beams
𝐸 𝑏𝑒𝑎𝑚 = 𝑁 𝑝 ⋅ 𝐸 𝑝 = 𝝈⋅𝑬⋅𝑪 𝑐 4⋅𝜋⋅𝑳 𝚫𝑻 ⋅𝑭
Luminosity [cm-2s-1]: 𝑳 Bunch distance [ns]: 𝚫𝑻 Circumference [m]: 𝑪 Energy [TeV]: 𝑬 Beam size at IP (round beams) [m]: 𝝈 Speed of light: 𝑐 Filling factor: F (typically about 0.9)
Energy stored in the beam: 𝐸 𝑏𝑒𝑎𝑚 increases with the particle energy, with the circumference, with the luminosity and the number of bunches
=> for FCC at 50 TeV/c this yields 8000 MJ per beam

4. Proton energy deposition for different energies
40 TeV
7 TeV
450 GeV
50 MeV
26 GeV
1 GeV
100 MeV
200 MeV
F.Burkart + V.Chetvertkova

5. FCC-hh challenges Stored beam energy
Stored energy 8 GJ per beam
20 times higher than LHC, equivalent to A380 (560 t) at nominal speed (850 km/h)
FCC beams can melt 20 tons of copper
Collimation, control of beam losses and radiation effects (shielding) important
Injection, beam transfer and beam dump very critical
Damage of a beam with an energy of 2 MJ
Machine protection issues to be addressed early on!

6. Proton beams are very dangerous, but do not forget e+e- beams ……..
FCC Protection
Proton beams are very dangerous, but do not forget e+e- beams ……..

7. Energy versus momentum

8. Energy versus momentum

9. Energy versus momentum

10. FCC Beam Protection
LHC made a large step in protection, profiting from the experience in previous accelerators
Scaling of a factor of 200 from previous machines was not obvious … presently with very good results
For FCC, for some areas, scaling is possible
Other areas, different solutions are required
No only energy to be considered, also energy density (MJ/mm2) that matters for beam induced damage
Assuming the same beta, the beam size scales with 1/E
With the same beta and number of particles, the energy density deposited in a target for FCC increases by about a factor of more than 50/7 (e.g. for a beam size of 1 mm, a factor of 20 to 30)
e+e- beam in the MJ region are unheard of……

11. FCC Machine Protection
What can go wrong?
What are the consequences?
Mitigation
Controls and operation

12. Hazard and Risk for accelerators
Hazard: a situation that poses a level of threat to the accelerator. Hazards are dormant or potential, with only a theoretical risk of damage. Once a hazard becomes "active“: incident / accident.
Consequences and Probability of an accident interact together to create RISK, can be quantified:
RISK = Consequences ∙ Probability
Related to accelerators
Consequences of uncontrolled beam loss (in $$$, downtime, radiation dose to people, reputation)
Probability of such event
The higher the RISK, the more Protection needs to be considered 12

13. Approach to designing a protection system
Identify hazards: what failures can have a direct impact on beam parameters and cause loss of particles (….hitting the aperture)
Classify the failures in different categories
Estimate the risk for each failure (or for categories of failures)
Work out the worst case failures
Identify how to prevent the failures or mitigate the consequences
Design systems for machine protection
……then back to square 1
….starting in the early design phase, continuous effort, not only once….

14. Hazards related to particle beams
Accidental beam losses due to failures: understand hazards, e.g. mechanisms for accidental beam losses
Hazards become accidents due to a failure, machine protection systems mitigate the consequences
Understand mechanisms for damage of components by direct beam loss
Regular beam losses during operation
To be considered since this leads to activation of equipment and possibly quenches of superconducting magnets
Radiation induced effects in electronics (Single Event Effects)
Understand effects from electromagnetic fields and synchrotron radiation that potentially lead to damage of equipment
Understand interaction of particle beams with the environment
Heating, activation, …

15. Injection -> Injection protection
Operational phases
Hazards and Machine Protection can be considered for three operational phases
Injection -> Injection protection
Stored beam -> Detect failures and trigger a beam dump
Extraction -> Beam dump protection
A number of talks in the different sessions,
e.g. W.Bartmann , A.Lechner, A.Bertarelli, R.Assmann, M.Fiascaris, N.Tahir

16. Classification of failures
Type of the failure
Hardware failure (power converter trip, magnet quench, AC distribution failure such as thunderstorm, object in vacuum chamber, vacuum leak, RF trip, kicker magnet misfires, .…)
Controls failure (wrong data, wrong magnet current function, trigger problem, timing system, feedback failure, ..)
Operational failure (chromaticity / tune / orbit wrong values, …)
Beam instability (due to too high beam current / bunch current / e-clouds)
Failures in the injector, transfer lines and FCC to be considered
Parameters for the failure
Probability for the failure
Damage potential
Time constant for beam loss
Risk = Probability * Consequences

17. Time constant for failures
Very fast beam loss (few ms)
e.g. multi turn beam losses in FCC
due to a large number of possible failures, mostly in the magnet powering system, with a typical time constant of some ms to many seconds
Fast beam loss (some 10 ms to seconds)
Slow beam loss (many seconds)
Detect and trigger beam dump
Single-passage beam loss in the accelerator complex (ns - s)
transfer lines between LHC and FCC
failures of kicker magnets (injection, extraction, special kicker magnets, for example for diagnostics) 17

18. Strategy for protection and related systems
Avoid that a specific failure can happen
Detect failure at hardware level and stop beam operation
Detect initial consequences of a failure with beam instrumentation ….before it is too late…
Stop beam operation
extract beam into beam dump block
inhibit injection
stop beam by beam absorber / collimator
Elements in the protection systems
equipment monitoring and beam monitoring
extraction protection
Injection protection
collimators and beam absorbers
beam interlock systems linking different systems

19. Strategy for machine protection
Beam Cleaning System
Definition of aperture by collimators.
Interlocks for powering system (incl. several subsystems)
Early detection of equipment failures generates dump request, possibly before beam is affected.
Active monitoring of the beams detects abnormal beam conditions and generates beam dump requests down to a s.
Beam Loss Monitors
Other Beam Monitors
Reliable operation of beam dumping system for dump requests or internal faults, safely extracting beams onto the external dump blocks.
Extraction System
Reliable transmission of beam dump requests to beam dumping system. Active signal required for operation, absence of signal is considered as beam dump request and injection inhibit.
Beam Interlock System
Passive protection by beam absorbers and collimators for specific failure cases.
Collimator and Beam Absorbers

20. Machine Interlock Systems Concepts
Beam Interlock System
Ensures that the beam dumping systems gets a trigger, and the beams are extracted into the beam dump blocks when one of the connected systems detects a failure
Interlocks for powering system (incl. several subsystems)
Includes systems involved in the powering of the FCC superconducting magnets (magnet protection system, power converters, cryogenics, UPS, controls)
Normal conducting Magnet Interlock System
Ensures protection of normal conducting magnets in case of overheating
Detects very fast decay of magnet current (as done in LHC)

21. FCC Interlock Systems and inputs (derived from LHC)
Screens, mirrors etc
Software
Interlocks
Operator Buttons
Experiments
Beam Lifetime
beam presence
Collimation
System
Injection
Beam
Dumping System
Beam Interlock System 32
Injection
Powering and Circuit Protection System
100000 RF
System
Beam Loss Monitors
16000
Personnel Safety System
Vacuum
System
Timing System
Beam interlock system collecting the beam dump requests from many systems
Scaling from LHC, the number of interlock channels will exceed by far
After a failure is detected, it will take up to 1 ms until all bunches are extracted

22. What more ?

23. Gaussian beam, energy in beam tails

24. FCC: Gaussian beam collimated at 4 
99.9% of protons
collimator
collimator
Example: a collimator is positioned at 4 , and we assume a dipole magnet failure.

25. FCC: Gaussian beam collimated at 4 
99.9% of protons
collimator
collimator
Example: a collimator is positioned at 4 , and we assume a dipole magnet failure. The beam starts to move, we assume by 1.5 . All particles beyond 2.5  are lost corresponding to ~330 MJ (5  = 17 MJ, 6  = 0.3 MJ)

26. Gaussian beam, 1.5  are cut
Normally, the collimator has a position larger than 7 
Failures that result in a beam displacement within less than, say, ms by, say, up to 1.5  are only acceptable, if there is some space free of particles between beam tails and collimators
Could be ensured by an eLense
Monitoring is required
Similar requirements for HL-LHC, but less critical
Failures that result in a beam displacement within less than, say, ms by larger than 1.5  are not acceptable (watch our for trips of normal conducting magnets, high beta function, ….)

27. Conclusions FCC will profit from LHC experience in machine protection
Machine Protection ≠ Interlock System
Machine Protection: Methods and technologies to identify, mitigate, monitor, and manage the technical risks associated with the operation of accelerators with high power beams or sub-systems with large stored energy, if failure modes can result in substantial damage to accelerator systems or significance interruption of operations.
Machine Protection includes an ensemble of hardware systems + software + commissioning and operational procedures + ….
Successful implementation of machine protection requires a safety culture at the lab

28. The END

29. SPS Beam with 1.5 MJ impacting on a copper target, first 10 cm.
A cut through the target is shown
The END
F.Burkart, V.Raginel

30. Beam dumping block
Beam size at exit window with sigma of about 4 mm (window of carbon should survive, to be confirmed)
Corresponds to beta function of 400 km (why not?)
1m beta waist after 1000 m gives 1000 km
Beam can be stopped in gas, water, …. some material that is not too dense

31. Evaluation of risk

32. Safety / Protection Integrity Level
RISK = Consequences ∙ Probability
IEC is an international standard of rules applied in industry, Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems (E/E/PE, or E/E/PES))
Ideas from Safety Integrity Level (SIL) concept of the IEC were applied => PIL
If a hazard becomes active…..
M.Kwiatkowski, Methods for the application of programmable logic devices in electronic protection systems for high energy particle accelerators, CERN-THESIS