Overview of Machine Protection for the LHC

1. Overview of Machine Protection for the LHC J. Wenninger CERN AB Department / Operations Group With input from many colleagues of the MPWG Experiments-Machine WS / June 07

2. Machine protection at the LHC – ‘organization’ • Machine protection activities of the LHC and the SPS are coordinated by the LHC Machine Protection Working Group (MPWG), co-chaired by R. Schmidt & J. Wenninger. • The MPWG WEB site (only from inside CERN !) • http://lhc-mpwg.web.cern.ch/lhc-mpwg/ • New : • The MPWG has asked each LHC experiment to provide a contact person to interface on machine protection issues between machine and experiments. This person should be nominated soon (if it is not already done). Experiments-Machine WS / June 07

3. Stored Energy • A factor 2 in magnetic field • A factor 7 in beam energy • A factor 200 in stored energy 360 MJ Experiments-Machine WS / June 07

4. Damage Potential of High Energy Beams • Controlled experiment with 450 GeV beam shot into a target (over 5 ms) to benchmark simulations: • Melting point of Copper is reached for an impact of  2.5×1012 p, damage at  5×1012 p. A B D C The MPWG has adopted for the LHC a limit for safe beams (nom. emittance) of 1012 protons at 450 GeV 1010 protons at 7 TeV (scaled from 450 GeV) - under discussion!! Note : tests as described above do not correspond to the most typical impact of beam, there is a safety margin on the 450 GeV ‘safe beam’ (for typical accelerator equipment). Experiments-Machine WS / June 07

5. Magnets & quenches Applied Field [T] The LHC is ~1000 times more critical than TEVATRON, HERA, RHIC Bccritical field Bc quench with fast loss of ~106-7 protons 8.3 T / 7 TeV QUENCH Tccritical temperature quench with fast loss of ~1010 protons Tc 0.54 T / 450 GeV 1.9 K 9 K Temperature [K] 5 Experiments-Machine WS / June 07

6. Lifetime & losses • For a beam with a given lifetime, the number of protons lost per second at nominal intensity: • t = 100 hours ~ 109 p/s • t = 25 hours ~ 4x109 p/s • t = 1 hour ~ 1011 p/s • While ‘normal’ lifetimes will be in the range of 10-100 hours (in collisions most of the protons are actually lost in the experiments !!), one has to anticipate short periods of low lifetimes down to 0.2 hours. • The protons that are lost must be intercepted with very high efficiency before they can quench a superconducting magnet : collimation! • Unlike HERA, TEVATRON, RHIC.. the LHC cannot be operated without collimators (except at injection with low intensity). • At the LHC the collimators must define the aperture (primary + secondary) which has an important impact for MP : for most multi-turn failures the beam will hit collimators first ! Quench level ~ 106-7 p Experiments-Machine WS / June 07

7. Machine Aperture ATLAS • Vertical axis : • Machine aperture in units of beam sigma (s), includingalignmenterrors and othertolerances. • Horizontal axis : • Longitudinal position on leftside of ATLAS (seenfrom the ring center). 450 GeV Arc • Injection : • Aperture limit is the LHC ARCs (~ 7-8 s). • The triplet magnets in front of ATLAS/CMS are slightly behind the ARC (~ 8-9 s). •  Collimators @ ~5-6 s ! 7 TeV, b* 0.5 m • Collisions, squeeze to b* 0.5 m : • Aperture limit is defined by the triplet magnets in front of ATLAS/CMS (~ 8 s).. •  Collimators @ ~6 s ! Triplet Experiments-Machine WS / June 07

8. Effects of FAST losses Nominal intensity : 3 ×1014 protons Nominal bunch : 1011 protons ‘Pilot’ (minimal) bunch : 5×109 protons • 450 GeV • 5 ×109 protons : pilot bunch, no quench • 1 ×1010 protons : quench limit – to be confirmed ! • 1 ×1012 protons : safe beam limit, below damage level for Cu • 5 ×1012 protons :  damage level for Cu for • 3 ×1013 protons : one nominal injection from SPS (272 bunches) , no damage to graphite collimators • 7 TeV • 106-7 protons : quench limit • 1010 protons :  damage level for Cu • 1012 protons :  damage level for collimators Validated To be confirmed Even the LHC collimators must be protected from massive beam impact ! Experiments-Machine WS / June 07

9. Time constants for beam losses time Very slow beam losses (lifetime 0.2 hours or more) Cleaning system to limit beam losses around the ring min … hours Very fast beam losses (some turns to some milliseconds) Fast beam losses (5 ms – several seconds) Slow beam losses (several seconds – 0.2 hours) At all times collimators limit the aperture – particles lost on collimators Hardware surveillance and beam monitoring, failure detection and beam extraction onto the beam dump block. ms … sec accidental beam losses Ultra fast beam losses • Single turn failures at injection • Single turn failures at extraction • Single turn failures with stored beams Hardware surveillance and passive protection with beam absorbers s Experiments-Machine WS / June 07

10. Passive Protection • Passive protection against single turn failure relies on protection devices. • Injection failures (kickers…): • - TDI absorber. • - Transfer line/injection collimators. • Dump failures (asynchronous beam dump): • - TCDQ absorber downstream of the dump septa, and . For the case of beam2 this device is also essential to protect CMS and the IR5 triplet magnets. • - Collimators (for a limited range of swept beam amplitudes). •  Discussed in the presentation by V. Kain. Experiments-Machine WS / June 07

11. LHC Layout IR3, IR6 and IR7 are devoted to protection and collimation ! Beam dump blocks IR5:CMS experiment IR4: Radio frequency acceleration IR6: Beam dumping system IR3: Momentum Collimation (normal conducting magnets) IR7: Collimation (normal conducting magnets) IR8: LHC-B experiment IR2: ALICE experiment IR1: ATLAS experiment Injection Injection Experiments-Machine WS / June 07

12. Beam Interlock System The Beam Interlock System (BIS) is responsible for collecting interlocks signals generated by the different surveillance systems and for transmitting this information to the beam dump kicker ! Details will be discussed in the presentation by B. Todd Beam ‘Permit’ BIS Dump kicker User permit signals Hardware links /systems, fully redundant • Actors and signal exchange for the beam interlock system: • ‘User systems’ : systems that survey equipment or beam parameters. Each user system provides a HW status signal, the user permit signal to the BIS. • The beam interlock system combines the user permits and produces the beam permit. • The beam permit is a HW signal that is provided to the dump kicker (also injection or extraction kickers) : absence of beam permit  dump triggered ! Experiments-Machine WS / June 07

13. LHC BIS ‘Users’ • List of BIS ‘Users’ that are part of the machine protection system: • Approximately 3600 Beam Loss Monitors (BLMs) installed next to each quadrupole and collimator with a sampling period and reaction time of less than 1 turns (100 ms). • Beam Position Monitors to protect against fast beam position changes with a reaction time of few turns. • The Powering Interlock System (‘includes’ quench protection). • Fast powering failure detection systems (for critical circuits). • Collimator position and temperature surveillance. • RF system. • Vacuum valves. • Position surveillance of absorbers. • LHC Experiments. • Etc… • Each ‘User’ is able to dump the beam if it detects a failure ! Experiments-Machine WS / June 07

14. Beam Interlock Systems • Three distinct interlock systems play a role for protection at the LHC: • The LHC BIS acts primarily on the LHC circulating beam (dump kicker). • The LHC Injection Interlock Systems (IR2 & IR8) acts on the injected beam (injection kicker). • - Surveillance of injection elements in the LHC ring. • The SPS Extraction Interlock Systems (SPS LSS4 +TI8, SPS LSS6 + TI2) acts on the SPS beam (extraction kicker). • - Surveillance of the transfer lines and the extraction elements of the SPS. LHC BIS The 4 systems share the same HW! SPS BIS LHC Injection Interlock Systems Beam permit Beam permit Injection permit SPS Extraction Interlock Systems Dump Kicker Extraction permit SPS Dump Kicker Injection Kickers SPS Extraction Kickers Experiments-Machine WS / June 07

15. Safe Beam Flags & Masks • The User Inputs to the interlock systems are split up into 2 groups : • Un-maskableinputs that are ALWAYS active. • Maskableinputs that may be de-activated provided the beam is SAFE. • Safe masking is achieved using the SAFE BEAM FLAG (SBF) that is distributed to the BIS and that can be: TRUE The stored beam energy is < damage threshold. Masking of USER_PERMITs is taken in account. If a masked USER_PERMIT = FALSE ignored  BEAM_PERMIT = TRUE. FALSE The stored beam energy is > damage threshold. Masking of USER_PERMITs is no longer taken in account. If one USER_PERMIT = FALSE  BEAM_PERMIT = FALSE. • LHC : the SBF will be derived from the energy and the beam intensity. • SPS : the SBF depends only on intensity (SBF = FALSE if > 1012 protons) and is only used for the Extraction Interlock System. Experiments-Machine WS / June 07

16. Injection - Probing with Beam For the LHC ring, rather than implementing a highly complex surveillance of all equipment to ensure there will be not dramatic failure during the injection process, we verify the correctness of machine settings directly with beam : 1 – If no beam is circulating in a ring, only injection of a safe beam is allowed: By definition the safe beam is below damage threshold. Even if the entire injection is lost due to a wrong setting, there will be no equipment damage. 2 – Injection of an ‘unsafe’ beam is only allowed if beam is circulating in the ring: Since a beam is circulating, the injection of the high(er) intensity will not lead to a loss over a single turn. The lifetime of the high(er) intensity beam may be poor, but this leaves time for beam loss monitors …to react. Experiments-Machine WS / June 07

17. Beam Presence Flag • To ensure safe injection, we introduced an additional signal called the Beam Presence Flag / BPF(one per beam). • The BPF is a signal that can be : TRUEBeam is present, intensity > ~1-2 × 109 protons FALSENo measurable beam, intensity < ~1-2 ×109 protons • The following logic is enforced for injection at the level of the SPS extraction interlock system: BPF = FALSE Only a SAFE beam can be injected from the SPS. BPF = TRUE Any beam may be injected The highest intensity that may be injected into an empty ring corresponds to the SPS SBF limit of 1012 protons. Experiments-Machine WS / June 07

18. Software Interlock System • Two Software Interlock Systems (SIS)will provide additional protection – on top of the HW interlock systems – for complex but also less critical conditions: • - For example a surveillance of magnet currents at injection and during collisions to avoid certain failures (local bumps) that would drive the beam into an experiment (or the nearby triplet). • The reaction time of those systems will be at the level of a few seconds. • The systems rely entirely on the machine technical network, databases, etc – clearly not as safe as HW systems ! • The Injection SIS will complement the Injection Interlock Systems: • - Active from the beginning. • - Stops injection through the Injection Interlock Systems. • - Receives the experiments injection inhibits, either through our middleware (preferred) or through DIP. • The (ring) SIS will complement the BIS system: • - Dumps the beam through the BIS. • - Not clear if it will be active from the beginning – reliability to be checked. Initially it may be only sending alarms. Experiments-Machine WS / June 07

19. SPS SIS • The new SIS that protects the SPS ring and all its transfer lines (including the ones to LHC) since this run is identical to the future SIS systems of the LHC. • Experience so far: • System core performs reliably with ~1500 surveyed systems/parameters (tested up to 10’000). • Clients systems that are based on the new AB front-end system SW architecture (FESA) proved to be extremely reliable. • All problems that were encountered were related to data loss from front-end computers that are still running old ‘legacy’ SW. Experiments-Machine WS / June 07

20. Post-mortem Data • All machine user systems connected to the LHC BIS must provide Post-Mortem informationfor diagnostics, even systems that have NOT triggered the dump. • - Each experiment must be able to send similar information, at least for the beam dumps it initiates itself ! • The granularity (in time) of the PM data ranges from bunch-to-bunch and turn-by-turn to ~1Hz sampling depending on the system. Maximum depth in time ~20-60 seconds. • The PM data will be essential to ensure that the MP system performance is adequate (dumps due to failures and MP tests with beam). • - For example: abnormal losses on the tertiary collimators/triplet in IR5/CMS indicate beam in the abort gap and incorrect positioning of the TCDQ ! • To resume beam operation after a beam dump, the PM data must be analysed and ‘understood’: • - Exact criteria must still be defined. Experiments-Machine WS / June 07

21. LHC MP ‘Transitions’ • Injection: • I < 1012 p, ~ 12 nominal bunches : • - Safe beam • - Maskable inputs can be masked ! • - No injection protection is ‘required’. • Circulating beam: • 450 GeV, I < 1012 p : • - Safe beam • - Maskable inputs can be masked ! • - Absorbers and collimators at relaxed settings/not required. • Ramp – more or less any beam : • - Beam becomes progressively ‘un-safer’. • - Maskable inputs are re-activated automatically during the ramp. • - Minimum collimation required. Experiments-Machine WS / June 07

22. LHC MP Commissioning • The commissioning of the MP system will follow closely the general beam commissioning and its ‘phase’ transitions: • 450 GeV all systems • Ramp, 7 TeV all systems • Single bunches to trains (48/72 bunches) injection protection • Crossing angles and b* insertion protection, collimators •  The machine must remain protected in all phases. • Interlocks should be activated well before they become (too) critical/essential to gain experience and identify problems. • - As soon as beam are considered unsafe all inputs must be active, but interlock thresholds and settings can be still adjusted. Experiments-Machine WS / June 07