1. LHC’s Modular Machine ITER – Machine ProtectionB. ToddJuly 2010 Thanks to : TE/MPE/MI, CERN Machine Protection Panel, et al 1v0 Protection System

2. CERN benjamin.todd@cern.ch ITER – Machine Protection Background 2 Following CERN’s last visit to ITER… more reflection on CERN’s Machine Protection System Try to describe the implementation of CERN’s MPS using ITER terminology [11] TEVATRON = p+p- accelerator / collider in Fermilab, USA. LHC’s most comparable predecessor / competitor LHC is a game-changer Massive increase in energy, >> damage limits, no such equivalent leap in the formal way we should do machine protection. We’re making this leap as we go along. New technologies, new scales = new unknowns very difficult to appreciate. N.B. This is a work in progress.

3. CERN benjamin.todd@cern.ch ITER – Machine Protection Protection Function 3 10-20x energy per magnet of TEVATRON magnet quenched = hours downtime many magnets quenched = days downtime (few spares) 100x energy of TEVATRON Emergency DischargeMagnet Energy Powering Protection: Beam DumpBeam Energy Beam Protection: magnet damaged = $1 million, months downtime many magnets damaged = many millions, many months downtime 0.000005% of beam lost into a magnet = quench 0.005% beam lost into magnet = damage Failure in protection – complete loss of LHC is possible

4. CERN benjamin.todd@cern.ch ITER – Machine Protection The basic guidelines… (1 of 2) 4 1. How similar is LHC to previous machines? How were other machines protected? What were the lessons learned? 2. How different is LHC from previous machines? Where could assumptions fail? 3.In what ways can we sense LHC beam energy going where it shouldn’t? We must protect against excessive energy impact… Simulations / analysis / dedicated tests etc. 4.In what ways can we predict that LHC beam energy will go where it shouldn’t? We must protect against un-necessary energy impact… Simulations / analysis / dedicated tests etc. …if significant energy loss is about to occur… …remove the energy safely before it does… [11] Beam == Magnet powering

5. CERN benjamin.todd@cern.ch ITER – Machine Protection The basic guidelines… (2 of 2) 5 6. No bypassing of the system Formalise this Masking, disabling, transparency 7.Simple interlocks = fast, dependable, hardware < complexity < software at all levels 8. Complex interlocks = slower, less dependable, software 9. Machine protection weak links. Identify, mitigate or accept. 10. Machine Protection acknowledged by the organisation. drives hardware and beam commissioning to nominal. Pressure from above and below channeled through the Machine Protection Working Group (Panel) Even more significant since 19.09.08… Organisation accepts that 10% of LHC missions lost = FALSE TRIGGERING [11]

6. CERN benjamin.todd@cern.ch ITER – Machine Protection Control System Principles 6 very clear boundaries: 1. Personnel and environmental protection = safety system this context: machine protection /= safety 2. Protect against damage = machine protection system Split into two sub-systems guarding against: * energy in the magnet powering 3. Operate = plant systems All built as a modular system – small, well defined, self contained sub-systems [11] Giving the following general modular approach * energy in the beam

7. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 7 [11] Vacuum Pressure Vacuum Pump Speed Control Fulfill operational requirements Plant Systems: Vacuum Example: maintain correct pressure

8. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 8 [11] Vacuum Pressure Vacuum Pump Speed Control Vacuum Pressure Vacuum Valve Actuator Ensure plant stays within limits Plant Protection: Fulfill operational requirements Plant Systems: Vacuum Example: maintain correct pressure bad pressure = close valves

9. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 9 [11] Vacuum Pump Speed Control Vacuum Pressure Vacuum Valve Actuator Sensors, Actuators and Process may be combined No rules regarding combination Must meet functional requirement Ensure plant stays within limits Fulfill operational requirements Plant Systems:

10. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 10 [11] Access doors Beam absorbers personnel safe but machine at risk People in perimeter – stop machine Personnel Safety System: cannot be merged with plants Must meet legal requirement

11. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 11 [11] Prevent damage to machine Prevent undue stress to components Machine Protection System: No rules regarding implementation Must meet functional requirement

12. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 12 [11] powering protection closely coupled to powering plant Prevent damage to machine Prevent undue stress to components Machine Protection System: No rules regarding implementation Must meet functional requirement

13. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 13 [11] Personnel Safety System: Plant Systems: Machine Protection System: danger exists – extract energy danger will exist – extract energy

14. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 14 [11] Personnel Safety System: Plant Systems: Machine Protection System: danger exists – extract energy danger will exist – extract energy Beam protection inputs from Safety system Plant systems Dedicated sensors

15. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 15 [11] Personnel Safety System: Plant Systems: Machine Protection System: danger exists – extract energy danger will exist – extract energy Beam protection inputs from Safety system Plant systems Dedicated sensors milliseconds before risk exists seconds before risk exists < 1ms to shut machine down

16. CERN benjamin.todd@cern.ch ITER – Machine Protection This means… 16 [11] No feedbacks between MPS and Plant Problem to Plant/Sensor to Interlock to Extraction BOOLEAN information expand beam protection…

17. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 17 [11] Beam Related Machine Protection: Ignore Powering Protection complexity Quench Protection -> Cryogenics -> Converters -> Power Interlocks -> Discharge Circuits = powering protection

18. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 18 [11]

19. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 19 [11]

20. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 20 [11] The safety system is independent! = The Access System

21. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 21 [11] doors / patrol keys… also triggers the beam protection

22. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 22 [11]

23. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 23 [11]

24. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 24 [11] powering protection trigger = remove beam energy before fields decay

25. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 25 [11]

26. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 26 [11] …by triggering the beam dump system through the beam interlock system…

27. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 27 [11] beam dump can self trigger

28. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 28 [11]

29. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 29 [11] plant action which can put beam at risk = interlock

30. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 30 [11]

31. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 31 [11]

32. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 32 [11] Can cause significant orbit shift Can get into beam path

33. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 33 [11] Dedicated machine protection sensors look for danger & trigger beam abort

34. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 34 [11]

35. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 35 [11] All designed to see dangerous situations

36. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 36 [11] Failure in a plant system leads to or can lead to danger = interlock Dedicated sensors for upcoming danger

37. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 37 [11] But… Protection /= Safety so we have operational inputs to Machine Protection System

38. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 38 [11] But… Protection /= Safety so we have operational inputs to Machine Protection System

39. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 39 [11] BIS + Beam Dump = Boolean = Go / No Go Connected systems = Go / No Go No complex decision making by the BIS…

40. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 40 [11] Set-up beam flag allows for sub-set of inputs to be masked…

41. CERN benjamin.todd@cern.ch ITER – Machine Protection LHC Equipment and Control System 41 [11] Set-up beam flag allows for sub-set of inputs to be masked… Powering Interlocks & Beam Loss Monitors have UNMASKABLE and MASKABLE inputs = run with a predefined subset in operation.

42. CERN benjamin.todd@cern.ch ITER – Machine Protection Post-Mortem 42 [11] beam dump not planned = analyse. PM request Through timing system

43. CERN benjamin.todd@cern.ch ITER – Machine Protection Post-Mortem 43 [11] PM system = reasons for dump = 5-10 minutes Engineer in charge = accept or not Automated systems inhibit further operation if serious problems…. See Markus next

44. CERN benjamin.todd@cern.ch ITER – Machine Protection How does this compare to ITER? 44 [11] Safety– prevent Tritium release Protection– protect the reactor Plant– protect the sub-systems The ITER Case:

45. CERN benjamin.todd@cern.ch ITER – Machine Protection The Future – ITER 45 [11] Safety– prevent Tritium release Protection– protect the reactor Plant– protect the sub-systems The ITER Case:

46. CERN benjamin.todd@cern.ch ITER – Machine Protection The Future – ITER 46 [11] Safety– prevent Tritium release Protection– protect the reactor Plant– protect the sub-systems The ITER Case:

47. CERN benjamin.todd@cern.ch ITER – Machine Protection The Future – ITER 47 [11] Safety– prevent Tritium release Protection– protect the reactor Plant– protect the sub-systems The ITER Case: Machine protection can veto plant protection Shutdown in sequence Sacrifice one to save another Initial study:

48. CERN benjamin.todd@cern.ch ITER – Machine Protection The Future – ITER 48 [11] Safety– prevent Tritium release Protection– protect the reactor Plant– protect the sub-systems The ITER Case: Machine protection can veto plant protection Shutdown in sequence Sacrifice one to save another Initial study: Or delay plant protection?

49. CERN benjamin.todd@cern.ch ITER – Machine Protection Summary 49 [11] Machine protection system is a simple Go / No Go Plants and sensors all derive Go / No Go simple requirements for each sub-system requirements defined by studies, simulations, understanding interactions of systems Machine protection appreciated by the organisation 10% loss of availability driving commissioning All people working in machine protection = solid overview of accelerator basic principles Thinking process – “what effect does my system have on the LHC?” Have to be sure MPS worked, is working, and will work = PM system An open forum for coordination – Machine Protection Panel ITER looks similar! But not the same…

50. CERN benjamin.todd@cern.ch ITER – Machine Protection A note: 50 [11] There are also two significant aspects which I have not talked about here. 1. Injection Protection Have assumed the disturbance of a circulating high-energy beam Must inject high-energy beam = different protection approach. 2.Protection Mode & Configuration Another system controls protection mode (set-up beam) Addresses conflicting configurations in transfer lines i.e. LHC beam protection /= CNGS beam protection Next time?