2. Machine Protection – ISSC 2010B. ToddAugust 2010 Thanks to : TE/MPE/MI, CERN Machine Protection Panel, et al 0v3 A Future Safety System?

3. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? CERN Founded in 1954 Funded by the European Union 20 Member States 8 Observer States and Organisations 35 Non-Member States …Japan, Russia, USA… 580 Institutes World Wide 2500 Staff 8000 Visiting Scientists …Australia, Canada, New Zealand… …most of the EU… European Centre for Nuclear Research Conseil Européen pour la Recherche Nucléaire Pure Science – Particle Physics 1.Pushing the boundaries of research, physics beyond the standard model. 2.Advancing frontiers of technology. 3.Forming collaborations through science 4.Educating the scientists and engineers of tomorrow

4. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? 4 We use the world’s largest and most complex scientific instruments to study the basic constituents of matter. These instruments are particle accelerators and detectors. Accelerators boost beams of particles to high energies before they are made to collide with each other or with stationary targets. Detectors observe and record the results of these collisions. Our flag-ship project is the Large Hadron Collider…

5. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? CERN CERN Accelerator Complex Lake Geneva Geneva Airport CERN LAB 1 (Switzerland) CERN LAB 2 (France)

6. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? CERN CERN Accelerator Complex Lake Geneva Geneva Airport CERN LAB 1 (Switzerland) CERN LAB 2 (France) Proton Synchrotron (PS) Super Proton Synchrotron (SPS) Large Hadron Collider (LHC)

7. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? The Large Hadron Collider

9. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? CERN, the LHC and Machine Protection CERN 9 of 23 CERN Accelerator Complex Large Hadron Collider (LHC) Beam-1 Transfer Line (TI2) Beam-2 Transfer Line (TI8) Beam Dumping Systems ~ 9 km ~ 5.5 miles Super Proton Synchrotron (SPS) 150m underground, 100us for one turn, 1e12 protons / injection

10. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? CERN CERN Accelerator Complex CMS ALICE ATLAS LHC-b

11. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? ATLAS – A Toroidal LHC ApparatuS 11

12. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? ATLAS – A Toroidal LHC ApparatuS 12

13. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? ATLAS 13

14. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Why the LHC? 14 [11] material costs of the LHC and experiments ≈$4 billion The Higgs Boson Gravity is such a weak force – can it be explained? high intensity = more ‘events’ high energy = more massive particles possible LHC Beam Intensity = 3 x 10 14 p LHC Energy = 7 TeV Dark Matter / Energy 96% of mass in the universe is unaccounted for Do Weakly Interacting Massive Particles (WIMPs) account for this? Beyond the Standard Model String Theory / Super Symmetry / Super String Theory / A Theory of Everything? We need some clues! collide two beams…

15. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? ~10 9 proton-proton collisions per second Massive amounts of data generated – all must be processed new particles are rare – only a few events per day Collisions 15 [3]

16. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Stored energy in the magnet circuits is 9 GJ Technological Challenges 16 …To see the rarest events… LHC needs high luminosity of 10 34 [cm -2 s -1 ] 3 x 10 14 p per beam … to get 7 TeV operation… LHC needs 8.3 Tesla dipole fields with circumference of 27 kms (16.5 miles) … to get 8.3 Tesla … LHC needs super-conducting magnets <2°K (-271°C) with an operational current of ≈13kA cooled in super fluid helium maintained in a vacuum 1 ppm Collisions generate PetaBytes of data Per year two orders of magnitude higher than others World’s largest machine [11] A magnet will QUENCH with milliJoule deposited energy Stored energy per beam is 360 MJ 10x less pressure than on moon surface

17. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Stored energy in the magnet circuits is 9 GJ Technological Challenges 17 [11] Stored energy per beam is 360 MJ Kinetic Energy of 200m Train at 155 km/h ≈ 360 MJ

18. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Stored energy in the magnet circuits is 9 GJ Technological Challenges 18 [11] Stored energy per beam is 360 MJ Kinetic Energy of 200m Train at 155 km/h ≈ 360 MJ Kinetic Energy of Aircraft Carrier at 50 km/h ≈ 9 GJ

19. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Protection Function 19 10-20x energy per magnet of TEVATRON magnet quenched = hours downtime many magnets quenched = days downtime (few spares) 100x energy of TEVATRON Emergency DischargeMagnet Energy Powering Protection: Beam DumpBeam Energy Beam Protection: magnet damaged = $1 million, months downtime many magnets damaged = many millions, many months downtime 0.000005% of beam lost into a magnet = quench 0.005% beam lost into magnet = damage Failure in protection – complete loss of LHC is possible

20. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Protection Function 20 100x energy of TEVATRON Beam DumpBeam Energy Beam Protection: 0.000005% of beam lost into a magnet = quench 0.005% beam lost into magnet = damage Failure in protection – complete loss of LHC is possible 8m long absorber Graphite = 800°C Concrete Shielding Beam is ‘painted’ diameter 35cm

21. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Protection Function 21 100x energy of TEVATRON Beam DumpBeam Energy Beam Protection: 0.000005% of beam lost into a magnet = quench 0.005% beam lost into magnet = damage Failure in protection – complete loss of LHC is possible To protect against fastest failure modes ≈ 400 µs over 27km

22. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? LHC Equipment and Control System 22 [11] Vacuum Pressure Vacuum Pump Speed Control Fulfill operational requirements Plant Systems: Vacuum Example: maintain correct pressure

23. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? LHC Equipment and Control System 23 [11] Vacuum Pressure Vacuum Pump Speed Control Vacuum Pressure Vacuum Valve Actuator Ensure plant stays within limits Plant Protection: Fulfill operational requirements Plant Systems: Vacuum Example: maintain correct pressure bad pressure = close valves

24. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? LHC Equipment and Control System 24 [11] Vacuum Pump Speed Control Vacuum Pressure Vacuum Valve Actuator Sensors, Actuators and Process may be combined No rules regarding combination Must meet functional requirement Ensure plant stays within limits Fulfill operational requirements Plant Systems:

25. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? LHC Equipment and Control System 25 [11] Access doors Beam absorbers personnel safe but machine at risk People in perimeter – stop machine Personnel Safety System: cannot be merged with plants Must meet legal requirement

26. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? LHC Equipment and Control System 26 [11] Prevent damage to machine Prevent undue stress to components Machine Protection System: No rules regarding implementation Must meet functional requirement

27. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? LHC Equipment and Control System 27 [11] powering protection closely coupled to powering plant Prevent damage to machine Prevent undue stress to components Machine Protection System: No rules regarding implementation Must meet functional requirement

28. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? LHC Equipment and Control System 28 [11] Personnel Safety System: Plant Systems: Machine Protection System: danger exists – extract energy danger will exist – extract energy

29. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? LHC Equipment and Control System 29 [11] Personnel Safety System: Plant Systems: Machine Protection System: danger exists – extract energy danger will exist – extract energy Beam protection inputs from Safety system Plant systems Dedicated sensors

30. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Developing the Machine Protection System 30 Why am I here? … machine protection ≠ safety But… cost of protection system failure is enormous LHC is (just) the first machine with these energy risks High Energy Physics community has to learn to deal with the challenges System-safety ideas, concepts and approaches have to be absorbed by CERN LHC is its own prototype: systems involved protection are unique certain technologies used have never been tried on this scale before I can argue that the MPS is fit for purpose My mission: rigorous development of machine protection as if it were a safety system But: can our argument-based approach be accepted by system-safety?

31. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Developing the Machine Protection System 31 CERN’s machine protection system development process… could this ever be considered as a safety-system? prior knowledge assumptions simulations failure cases solutions for every failure case testing Implementation verification It took more than ten years to address all of the issues for the LHC… And we’re still learning…

32. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? The Machine Protection System Today 32 Powering ProtectionBeam Protection

33. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? The Machine Protection System Today 33

34. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? 199420052007200820092010201120122013 Decommissioning of the LEP machine LEP CERN approves LHC project 2002 The Story So Far

35. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? 199420052008200920102011201220132002 preparation, installation, alignment and interconnection of magnets Install magnets LEP CERN approves LHC project 2007

36. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? 1994200520072008200920102011201220132002 first circulating beam established in LHC Install magnets LEP CERN approves LHC project September 10 th first circulating beam

37. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? 1994200520072008200920102011201220132002 Install magnets LEP Interconnection failure – damaged magnets and helium leak CERN approves LHC project September 10 th first circulating beam September 18 th first lesson learned

38. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Magnet Protection 38 Magnet Interconnect

39. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Ideal 13 kA Connection Scheme Superconducting Cable Tin – Silver Foils Longditudinal View – filled with Solder Cross Section View Superconducting Cable Copper Stabiliser

40. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Observed Interconnections

41. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Magnet Protection 41

42. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Incident location Dipole Bus bar

43. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Install magnets LEP Upgrade 1994200520072002 September 10 th first circulating beam CERN approves LHC project November 20 th second startup 3.5 TeV 7.0 TeV Repair November 30 th 1.18 TeV November 23 rd 450 GeV 201020112012201320082009 The Story So Far September 18 th first lesson learned

44. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Install magnets LEP Upgrade 1994200520072002 September 10 th first circulating beam CERN approves LHC project November 20 th second startup 3.5 TeV 7.0 TeV Repair November 30 th 1.18 TeV November 23 rd 450 GeV 201020112012201320082009 September 18 th first lesson learned

45. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? The Future – Linear Accelerators 45 CLIC – Compacy LInear Collider LHC results = electron / positron collider required for detailed study CERN is designing CLIC machine protection Various Institutes designing ILC machine protection Only one of these likely to be built – depends on what LHC discovers ILC – International Linear Collider logical next step for physics specification to be finished circa 2015 > $10 Billion machines 30-50 km long beam energy densities 1000x higher than previous e - e + machines beam energy 10000x above component damage limit

46. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? Large Hadron Collider (LHC) Compact Linear Collider (CLIC)

47. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? The Future – ITER 47 [11] ITER – International Thermonuclear Experimental Reactor first steps of 50-year plan prove / disprove fusion feasibility for commercialisation > $10 Billion machine > 100 GJ of stored magnetic energy 500MW of fusion for 1000 seconds vs state-of-the-art: 16MW of fusion for 1 second (Joint European Torus) Tritium – Deuterium Fusion many synergies with LHC challenges CERN is consulting on the design of the ITER Machine Protection…

48. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? The Future – ITER 48 [11] ITER – International Thermonuclear Experimental Reactor first steps of 50-year plan prove / disprove fusion feasibility for commercialisation > $10 Billion machine > 100 GJ of stored magnetic energy 500MW of fusion for 1000 seconds vs current record: 16MW of fusion for 1 second (Joint European Torus) Tritium – Deuterium Fusion many synergies with LHC challenges CERN is consulting on the design of the ITER Machine Protection…

49. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? The Future – ITER 49 [11] Safety– prevent Tritium release Protection– protect the reactor Plant– protect the sub-systems ITER – International Thermonuclear Experimental Reactor

50. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? The Future – ITER 50 [11] Safety– prevent Tritium release Protection– protect the reactor Plant– protect the sub-systems ITER – International Thermonuclear Experimental Reactor

51. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? The Future – ITER 51 [11] Safety– prevent Tritium release Protection– protect the reactor Plant– protect the sub-systems ITER – International Thermonuclear Experimental Reactor

52. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? The Future – ITER 52 [11] Safety– prevent Tritium release Protection– protect the reactor Plant– protect the sub-systems ITER – International Thermonuclear Experimental Reactor Machine protection can veto plant protection Shutdown in sequence Sacrifice one to save another Initial study:

53. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? The Future – ITER 53 [11] Safety– prevent Tritium release Protection– protect the reactor Plant– protect the sub-systems ITER – International Thermonuclear Experimental Reactor Machine protection can veto plant protection Shutdown in sequence Sacrifice one to save another Initial study: Or delay plant protection?

54. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? An Outlook 54 LHC is its own prototype, a unique machine, ≈30 years in the making key protection systems involved are one-of-a-kind LHC is the first machine with such massive built-in destruction potential cost of failure is extreme we have used an argument based approach to address the issues we’ve had positive and negative experiences Could stake-holders demand some “compliance” from us to insure their investment? My mission: rigorous development of machine protection as if it were a safety system. Keep the deep-thinking approach, incorporate system-safety techniques Future machines: bigger, more powerful, more challenging protection already crucial, even in first design drafts Ultimate goal: certification. Wishful thinking? High Energy Physics community has to learn to deal with the challenges “Machine Protection – A Future Safety System?” – an open question to your community

55. CERN benjamin.todd@cern.ch Machine Protection – A Future Safety System? benjamin.todd@cern.ch 55 Machine Protection – A Future Safety System? CERN Fin Thank you for your attention