1. SL Seminar 11 July 20021 Machine Protection and Interlock Systems for the LHC SL-Seminar Rüdiger Schmidt on behalf of the MPWG The LHC challenges Powering Operation and Protection Beam Operation and Protection SL Seminar 11 July 2002

2. Outline u LHC parameters and layout u LHC stored energy and associated risks u LHC protection systems u Protection and interlocks for powering u Protection and interlocks for beam operation u Beam Dump u Beam Cleaning u Beam Loss Monitors u Beam Interlock System u Conclusions

3. u LHC parameters and layout u LHC stored energy and associated risks u LHC protection systems u Protection and interlocks for powering u Protection and interlocks for beam operation u Beam Dump u Beam Cleaning u Beam Loss Monitors u Beam Interlock System u Conclusions

4. 4 Momentum at collision 7 TeV/c Momentum at injection 450 GeV/c Dipole field at 7 TeV 8.33 Tesla Circumference26658m Number of electrical circuits~1700 Luminosity 10 34 cm -2 s -1 Number of bunches 2808 Particles per bunch 1.1  10 11 DC beam current 0.56 A Stored energy per beam 350 MJ Normalised emittance3.75 µm Beam size at IP / 7 TeV15.9µm Beam size in arcs (rms)300µm High beam energy in LHC tunnel Superconducting NbTi magnets at 1.9 K Stored energy in magnets very large High luminosity at 7 TeV very high energy stored in the beam beam power concentrated in small area LHC Parameters and Challenges for Protection

5. 5 Energy in the magnet system: 11 GJ u In case of failure, extract energy with a time constant of up to about 100 s Energy in two LHC Beams: 700 MJ  Dump the beams in case of failure within 89  s after dump kicker fires Drop 35 tons from 28 km Energy in Magnets and Beams Drop it from 2 km One beam, nominal intensity corresponds to an energy that melts 500 kg of copper

6. 6 Challenges: Energy stored in the magnets Energy stored in the LHC magnets, powered in ~1700 electrical circuits - all need protection HERA: all dipole magnets store about 700 MJ LHC: to limit energy - powering in eight sectors Energy in dipole magnets (one sector): 1.3 GJ u eight systems in the LHC - 8 dipole circuits Energy in main quadrupole magnets (one sector): 40 MJ u sixteen systems in the LHC for main quadrupoles Energy in special quadrupole magnets (6 kA): u about 100 circuits Energy in 600 A circuits (i.e. chromaticity correction): 10 - some 100 kJ u several 100 systems

7. 7 Challenges: Energy stored in the beam courtesy R.Assmann Momentum [GeV/c] Energy stored in the beam [MJ] Energy density: even larger factor between LHC and other machines x 200 x 10000

8. The risks u Damaging equipment in case of uncontrolled release of energy stored in the magnets u Dipole magnet replacement would take about 30 days u Damaging equipment in case of uncontrolled beam losses u No realistic estimation of possible damage Magnets could quench due to beam losses, or due to other failures u Quench recovery at 7 TeV could take several hours Beam losses due to a large variety of failures (sc magnets, resistive magnets, …) u Recovery from 7 TeV could take hours

9. 9 Failures of machine equipment must be anticipated Risk comes from large stored energy plus possible failures u 7000 magnets (most of them superconducting), powered in ~1700 electrical circuits …. ~1700 power converters u Superconducting magnets operate at 1.9 K with a small margin in temperature, at the edge of their performance u The protection of the sc elements (magnets, busbars and current leads) requires several 1000 detectors u The protection from beam losses includes more than 1000 channels (beam loss monitors and other equipment) Realistic failure scenarios => Protection systems u A quench in a superconducting magnet could lead to beam losses u A failure of a power converter could lead to beam losses u Failures in many other systems could lead to beam losses

10. 10 LHC Machine Protection is to….. No uncontrolled release of stored energy Priority I: prevent damage of equipment Priority II: prevent unnecessary down-time - for example: DUMP the beam in case of beam losses that could lead to a magnet quench The Machine Protection Systems include A) Systems to protect the LHC superconducting elements in case of a quench, or others failures in the powering system B) Systems to protect the LHC equipment in case beam losses become unacceptable u …together with tools for consistent error and fault diagnostics ……. POST MORTEM

11. 11 Beam Interlock System Powering Interlock System Beam loss Monitor System Beam Cleaning System Beam Dump System Quench Protection System Warm Magnet Protection LHC protection systems and main interfaces Acces system Cryogenics System Power converter System Emergency Stop (AUG) Magnet System warm+cold Vacuum System Injection System Experiments RF System BI All systems interface to control system

12. 12 LHC Machine Protection = Integration of systems This presentation focuses with the integration of systems into the LHC MACHINE PROTECTION SYSTEM,… with the interlocks as glue linking systems Input from u Superconducting Magnet tests, String 2 u Accelerator Physics - Collimation - input for BEAM LOSS SCENARIOS And experience from other accelerators u SPS, LEP, HERA, RHIC and FERMILAB

13. 13 u Some Systems for Machine Protection were already in the baseline: Quench Protection (LHC-ICP), Beam Dump (SL-BT), Beam Losses (SL-BI), Beam Cleaning (J.B.Jeanneret, SL-BI) … u Machine Protection WG started in March 2001, R.Schmidt and J.Wenninger (chairman, scientific secretary) - reports to LCC u Interlock System: Architecture of Interlock Systems, LHC Project Report 521, (F.Bordry et al.), System done in SL-CO, B.Puccio u Autumn 2001 Beam Cleaning Study Group (BCSG, chairman R.Assmann): “Study beam dynamics and operational issues for the LHC collimation system. Identify open questions, assign priorities, and show the overall feasibility of the LHC cleaning system.“ Reports to LCC and works in close collaboration with MPWG This presentation is on behalf of the MPWG - and many other colleagues that contributed to the work (in particular in the Beam Cleaning Study Group) How did it start….

14. 14 ….. where should it go - be ready in time Fabrication of equipment Installation of completed components Very thorough commissioning of the hardware systems starting in 2005, sector by sector, as key for successful fast start up with beam, throughout 2005 and 2006 From now to 2006 In 2006 - one beam injected and transported across two sectors (hopefully - requires operation of SPS ) Start-up with two beams in spring 2007

15. 15 Layout of the LHC ring: 8 arcs, and 8 long straight sections Betatron Cleaning WARM Momentum Cleaning WARM Beam dump system RF + Beam instrumentation One sector = 1/8

16. u LHC parameters and layout u LHC stored energy and associated risks u Protection and interlocks for powering u Protection and interlocks for beam operation u Beam Dump u Beam Cleaning u Beam Loss Monitors u Beam Interlock System u Conclusions

17. Sector Continuous Cryostat / Cryoline Superconducting bus-bars run through cryostat connecting magnets. Current feeds at extreme ends. Other central insertion elements eg. Low Betas, separator dipoles, matching COLD (<2K) 2.9km WARM 500m 1 5 DC Power feed 3 Octant DC Power Main Arc FODO cells main dipoles, quadrupoles, chromaticity sextupoles, octupoles tuning and orbit correctors, skew quadrupoles, spool pieces End of Continuous Cryostat dispersion suppressors, Some of the matching section, and the electrical feedbox. 2 4 6 8 7 LHC 27 km Circumference LHC Powering in 8 Sectors Slide from P.Proudlock Powering Sector

18. 18 Separation of Protection systems With respect to operation with BEAM: Energy stored in beams u Two systems - one BEAM DUMP SYSTEM for each beam With respect to operation of the POWERING system: Energy stored in magnets of one cryostat u Electrical circuits in one continuous cryostat independent from circuits in other cryostats

19. POWERING ABORT BEAM ABORT Dump Trigger Back to EDF POWERING u Detect quenches or other failures u Energy stored in magnets to be safely deposited with POWER DUMP SYSTEM (Energy extraction) Extraction Resistors 2min Magnets Cryogenics 500ms Magnet Energy EDF Beam Dump 89  s Collimation system 0.1-10h Magnets / Cryogenics 10h LHC Experiments 10h SPS + RF Beam Energy BEAM OPERATION u Detect dangerous failures or beam losses u Energy stored in beams to be safely deposited with BEAM DUMP SYSTEM

20. 20 Example: Protection main dipoles When conditions are OK - green light for powering In case of a failure (quench), uncontrolled release of energy is prevented: Fire quench heaters (quenched magnets) Current by-passes magnet via power diode Extract energy by switching a resistor into circuit - eight tons of steel heated to 300 °C Switch off dipole power converter, and possibly others Release helium by safety relief valve 13 kA switches from Protvino Russia K.Dahlerup-Petersen (LHC-ICP)

21. 21 Example for architecture in one LHC sector - powering subsectors

22. 22 Results from the String u String 2: commissioning of Powering, Magnet Protection and Powering Interlocks successfully in 2001 and 2002 l String 2 gave us confidence as we observed a smooth commissioning of the powering protection systems l Complexity of powering systems for String 2 are similar to one of the LHC Powering Subsectors => scaling to the LHC is reasonable R.Saban and the String Team

23. u LHC parameters and layout u LHC stored energy and associated risks u Protection and interlocks for powering u Protection and interlocks for beam operation u Beam Dump u Beam Cleaning u Beam Loss Monitors u Beam Interlock System u Conclusions

24. Machine protection when operating with beam u Early commissioning: First injection of beam into the LHC u Regular injection into the LHC u At 450 GeV u During the energy ramp u At 7 TeV - before squeezing u At 7 TeV - after squeezing Operation with beam is discussed in the LHC Commissioning Committee (LCC) - chaired by S.Myers, scientific secretary O.Brüning

25. Beam intensities Energy of LEP beam Intensity range ~ 1:60000 !!

26. 26 Machine protection: Beam energy For 7 TeV: u fast beam losses between 10 6 and 10 7 protons could quench a dipole magnet u fast beam losses with less intensity than one “nominal bunch” could already damage superconducting coils u slow regular losses could quench the magnets Quench limits: J.B.Jeanneret, D.Leroy, L.Oberli and T.Trenkler, LHC Project Report 44, 1996 Requirements and Design Criteria for the LHC Collimation System, R.W.Assmann et al., EPAC 2002 and Project Note 277

27. 27 Machine Protection Systems must be operational Beam Dump System u The beam dump block is the only element that can stand the full 7 TeV beam without damage Beam cleaning system (collimators) u Capture particles with collimators in the warm insertions, with an efficiency of > 99.9%, to minimise losses in superconducting magnets u For equipment failure, collimators are the first to capture beam losses u Collimator position adjustment is critical Beam Loss Monitor System u Measures beam losses and, possibly triggers a beam dump Beam Interlock System u “Green Light” for beam operation, if changes to red => BEAM DUMP Post Mortem recording must be operational u Working Group on Post Mortem, chaired by J.Wenninger

28. Beam “lifetime” for optimum operation u During “healthy” operation with nominal luminosity the lifetime is determined by the collision of two protons (beam lifetime in the order of 20 hours) u A large fraction of the protons is “lost” in the high luminosity collision points - and into ATLAS and CMS (corresponds to 10 kW per experiment) u At the end of the fill or in case of failure - the residual beam will be dumped, and its energy will end in the beam dump blocks

29. 29 Lifetime of the beam with nominal intensity at 7 TeV Beam lifetime Beam power into equipment (1 beam) Comments 100 h1 kWHealthy operation 10 h10 kWOperation acceptable, collimation must absorb large fraction of beam energy (approx. = cryogenic cooling power at 1.9 K) 1 h100 kWOperation only possibly for short time, collimators must be very efficient 1 min6 MWEquipment or operation failure - operation not possible - beam must be dumped Acceptable lifetimes worked out by Beam Cleaning Study Group - see reports

30. 30 Lifetime of the beam at 7 TeV Beam lifetime Comments 1 sFailure of equipment - beam must be dumped fast 15 turnsFailure of D1 normal conducting dipole magnet - monitor beam losses, beam to be dumped as fast as possible 1 turnFailure at injection, failure of beam dump kicker, or injection kicker misfiring with stored beam, potential damage of equipment, protection relies on collimators Comments: The parameters at injection energy of 450 GeV are much more relaxed Specification for the BLMs, J.B.Jeanneret+H.Burkhardt in the BI- Specification Committee Very fast losses due to failures of the dump systems, LHC Project Note 293, R.Assmann, B.Goddard, E.Vossenberg, E.Weisse - not discussed here

31. 31 Though the LHC cycle: First injection into the LHC Early commissioning: first injection into the LHC with low intensity beam would neither quench magnets nor damage equipment (pilot bunch with about 5 · 10 9 protons) u Establish circulating beam u Commission beam monitoring and other systems u Commissioning of beam dump system u Possibly first energy ramp with pilot bunch Protection against beam losses is not required …but it needs to be certain that beam intensity is low, at top energy collimators should be in “coarse” position

32. 32 Regular injection - consider the first turn There are about 7000 magnets powered in ~1700 electrical circuits, >100 collimator jaws, more than 100 vacuum valves, roman pots…. u Low beam intensity (pilot bunch, 10 9 - several 10 10 ) - no problem u Beam intensity is above about 10 10 - quenches of sc magnets u Beam intensity is much higher, up to 2·10 13 - equipment could be damaged see J.B.Jeanneret et al. Experience from SPS - injected beam hits UA2, could happen for LHC (studies by W.Herr): NOT TOLERABLE FOR LHC Example: magnet has wrong setting (Power Converter fault, or Power Converter has wrong input) The beam is deflected during the first turn The beam touches / traverses the vacuum chamber The beam hits equipment (magnet, collimator, experiment,...)

33. If beam is already circulating, injected beam will survive LHC ring with several 1000 objects that could prevent the beam from circulating (magnets, mechanical objects, …) In principle, one proton for checking would be sufficient - in practice 10 10 - 10 11 are more practical Any relevant failure would prevent the beam from circulating

34. 34 How to avoid damage at injection No beam is circulating u In case of equipment failure condition - no injection u Injection of intense beam NOT ALLOWED (interlock) Step 1: Injection of weak beam <10 11 protons - ALLOWED Step 2A: If beam circulates - request injection of intense beam Step 2B: JUST BEFORE INJECTION check if circulating beam is OK Step 3: Injection of beam with higher intensity, ONLY, if beam is still present u If there is no circulating beam => no injection => go back to step 1 u If there is circulating beam - inject beam => go to step 2 u If there is a bunch present at the longitudinal position of the fresh beam to come in, it will be deflected into the TDI - go to step 2

35. 35 Replacing pilot beam by batch from SPS Injection failures have been worked out by the Injection WG and the BT-Group - led to proposal for TDI

36. 36 Beam Dump System u The beam dump system has many active components - kicker magnets, septum magnets, dilutor - all need to ramp with beam energy u The beam dump is an active system - it requires a trigger to dump the beam u Quality and reliability of the beam dump system can not be better than the quality and reliability of the trigger The beam is dumped, either due to an operator request, or by the beam interlock system after a failure has been detected From SL-BT, E.Carlier

37. 37 Beam dump must be synchronised with particle free gap Strength of kicker and septum magnets must match energy of the beam « Particle free gap » must be free of particles Requirement for clean beam dump

38. 38 Beam dump must be synchronised with particle free gap Strength of kicker and septum magnets must match energy of the beam « Particle free gap » must be free of particles Requirement for clean beam dump The entire beam would be deflected with an angle that does not correspond to the nominal angle Beam Energy Tracking using special hardware BEAM ENERGY METER I) Cleaning of particle free gap (active and passive) II) Monitoring of beam intensity - if too large- dump beams About 100 bunches would be deflected with an angle between 0 and the nominal kick I) Rigorous synchronsation II) Additional collimators 1) Depending on the beam intensity in the gap, particles would be sprayed 1) TCDQ - suggested by SL-BT, and LHC Project Note 297

39. 39 Energy tracking required locally in insertion 6 for the beam dump system: u Extraction kicker u Septum magnets u Dilution kickers u The field of the septa magnets needs to track the beam energy within about +-0.5 % u The dump kickers need to track the beam energy u It is required to apply trims to the extraction trajectory M.Gyr, J.B.Jeanneret u Distribution of energy information to Beam Loss Monitors around the ring (how…?) Beam Energy Meter and beam dump system

40. 40 Current for the magnet with standard power converter / standard control electronics with a current versus time function loaded into the controller During the energy ramp the deflection angle is constant. The non-linearity between current of the power converter and magnetic field is taken into account in the definition of the ramp function (as for all other magnets) This is not sufficient for such critical system, therefore… Reliable monitoring for safe operation is required Safe tracking that allows trimming of the functions in the beam dump system in a limited range

41. Beam Energy Meter DCCT Beam Energy Meter DCCT Dump beam Other users Make energy Beam Energy Meter Septum magnet beam 1 Septum magnet beam 2 Dipole magnets Sector 5-6 Energy not consistent Energy consistent Prototyping components for Energy Meter has been made by J.Pett et al. Dipole magnets Sector 6-7

42. 42 Beam Cleaning System Collimators close to the beam are required during all phases of operation Sophisticated beam cleaning system with many collimators has been designed (J.B.Jeanneret, and EPAC 2002 presentation by BCSG - R.Assmann) - limit aperture to about 6-10  Together with the Beam Loss Monitors produce a fast and reliable signal to dump the beam if beam losses become unacceptable

43. 43 +- 3  1.3 mm Beam +/- 3 sigma 56.0 mm Beam in vacuum chamber at 7 TeV

44. Example for failure at 450 GeV Assume that the current in one orbit corrector magnet is off by 10% of maximum current (Imax = 60 A) 12.0 mm 16.0 mm Beam+/- 3 sigma Beam+/- 3 sigma and orbit corrector 10 % / 100 % of Imax 56.0 mm Ralphs EURO

45. Beam+/- 3 sigma 56.0 mm 1 mm +/- 8 sigma = 4.0 mm Example: Setting of collimators at 7 TeV - with luminosity optics Beam must always touch collimators first ! Collimators might remain at injection position during the energy ramp Ralphs EURO Collimators at 7 TeV, squeezed

46. 46 Particles that touch collimator after failure of normal conducting D1 magnets After about 13 turns 3·10 9 protons touch collimator, about 6 turns later 10 11 protons touch collimator V.Kain “Dump beam” level 10 11 protons at collimator

47. 47 Beam Loss Monitors Primary strategy for protection: Beam loss monitors at collimators continuously measure beam losses u Beam loss monitors indicate increased losses => MUST BE FAST After a failure: u Beam loss monitors break Beam Permit Loop u Beam dump sees “No Beam Permit” => dump beams In case of equipment failure, enough time is available to dump the beam before damage of equipment - including all magnets and power converters - but issues such a General Power Cut etc. are still being addressed Failure scenarios with circulating beam studied by O.Brüning, and V.Kain Beam Loss Monitor System: Specifications by BI-Spec-Committee (JBJ+HB), and realisation of the system by B.Dehning et al. in SL-BI

48. 48 Redundant strategy for protection in case of equipment failure u Beam loss monitors around the LHC machine (a subset of all BLMs is critical for protection - to be defined) u Detection of fault states from equipment (e.g. power converter) Example: Power converter failure of D1 separation dipole induces orbit distortion  Signal from Powering Interlock System to Beam Interlock System to DUMP BEAM OR  Signal from Beam Loss Monitors to Beam Interlock System to DUMP BEAM u What to include to generate Beam Abort - to be worked out later (some flexibility required, the system must be tuned to optimise operational efficiency)

49. Architecture of the BEAM INTERLOCK SYSTEM

50. p. 50 BEAM INTERLOCK CONTROLLER

51. 51 General Layout of the 2 Machine Interlock Systems Control Room B.Puccio

52. 52 Quantifying reliability for the LHC u Reliability can be quantified - with accepted mathematical tools. Such tools are challenging since mathematics involved can be rather advanced u Reliability of different systems can be compared u To estimate the reliability of the entire accelerator, the reliability of all subsystems need to be estimated u Strictly required for systems related to safety of personnel (INB, legal obligation) u Should be extended to equipment protection systems u … and for other systems in order to optimise the efficiency of LHC operation u Examples of past studies: quench protection system, interconnects between magnets, SPS access system, …

53. u LHC parameters and layout u LHC stored energy and associated risks u Protection and interlocks for powering u Protection and interlocks for beam operation u Beam Dump u Beam Cleaning u Beam Loss Monitors u Beam Interlock System u Conclusions

54. Conclusions u The LHC is a global project with the world-wide high- energy physics community devoted to its progress and results u As a project, it is much more complex and diversified than the SPS or LEP or any other large accelerator project constructed to date I consider the complexity of the LHC with its magnets systems at 1.9 K and the machine protection issues to be the main challenges for the LHC From the summary of the LHC Machine Advisory Committee in March 2002, chaired by Prof. M. Tigner

55. 55 Conclusions u If the protection systems will not be fully operational for Hardware commissioning in 2005 and Beam commissioning in 2007 - there is no way to startup the machine u Very good progress for the protection against uncontrolled release of magnet energy, due to the excellent collaboration of people and the experiments at the String - a sound baseline has been established u For the protection against beam losses still substantial work ahead of us - in particular for fast losses - to avoid any damage of collimators or other machine equipment (work ongoing in BCSG and MPWG, LCC is the coordinating body) u For several important sub-systems principles and the architecture has been established - but the technical work is hampered by lack of personal and responsibilities need to be defined Renovation of SPS interlocks - possibly with the same brainware and hardware (J.Wenninger & R.Giachino + B.Puccio & myself)

56. 56 Acknowledgement u This presentation is based of the work of many people u Particular thanks to my colleagues in the MPWG, and its scientific secretary J.Wenninger u Particular thanks also to my colleagues in the Beam Cleaning Studies team, to its chairman R.Assmann, and to the “father of LHC collimation” J.B.Jeanneret u References under: http://www.cern.ch/lhc-collimation/ http://www.cern.ch/lhc-mpwg/ Future related presentation could be on Beam Cleaning, Beam Loss Monitoring, Beam Dump System, Quench Protection System and Post Mortem System