1. Overview of Machine Protection for the LHC
J. Wenninger
CERN
AB Department / Operations Group
With input from many colleagues of the MPWG
Experiments-Machine WS / June 07

2. Machine protection at the LHC – ‘organization’
Machine protection activities of the LHC and the SPS are coordinated by the LHC Machine Protection Working Group (MPWG), co-chaired by R. Schmidt & J. Wenninger.
The MPWG WEB site (only from inside CERN !)
New :
The MPWG has asked each LHC experiment to provide a contact person to interface on machine protection issues between machine and experiments. This person should be nominated soon (if it is not already done).
Experiments-Machine WS / June 07

3. Experiments-Machine WS / June 07
Stored Energy
A factor 2 in magnetic field
A factor 7 in beam energy
A factor 200 in stored energy
360 MJ
Experiments-Machine WS / June 07

4. Damage Potential of High Energy Beams
Shot
Intensity / p+ A
1.2×1012 B
2.4×1012 C
4.8×1012 D
7.2×1012
Controlled experiment with 450 GeV beam shot into a target (over 5 ms) to benchmark simulations:
Melting point of Copper is reached for an impact of  2.5×1012 p, damage at  5×1012 p.
A B D C
The MPWG has adopted for the LHC a limit for safe beams (nom. emittance) of
1012 protons at 450 GeV
1010 protons at 7 TeV (scaled from 450 GeV) - under discussion!!
Note : tests as described above do not correspond to the most typical impact of beam, there is a safety margin on the 450 GeV ‘safe beam’ (for typical accelerator equipment).
Experiments-Machine WS / June 07

5. Magnets & quenches Applied Field [T] Temperature [K] Bc QUENCH Tc
The LHC is ~1000 times more critical than TEVATRON, HERA, RHIC
Bc critical field Bc
quench with fast loss of ~106-7 protons
8.3 T / 7 TeV
QUENCH
Tc critical
temperature
quench with fast loss
of ~1010 protons Tc
0.54 T / 450 GeV
1.9 K
Temperature [K]
9 K 5
Experiments-Machine WS / June 07

6. Experiments-Machine WS / June 07
Lifetime & losses
For a beam with a given lifetime, the number of protons lost per second at nominal intensity:
t = 100 hours ~ p/s
t = 25 hours ~ 4x109 p/s
t = 1 hour ~ p/s
While ‘normal’ lifetimes will be in the range of hours (in collisions most of the protons are actually lost in the experiments !!), one has to anticipate short periods of low lifetimes down to 0.2 hours.
The protons that are lost must be intercepted with very high efficiency before they can quench a superconducting magnet : collimation!
Unlike HERA, TEVATRON, RHIC.. the LHC cannot be operated without collimators (except at injection with low intensity).
At the LHC the collimators must define the aperture (primary + secondary) which has an important impact for MP : for most multi-turn failures the beam will hit collimators first !
Quench level ~ p
Experiments-Machine WS / June 07

7. Machine Aperture 450 GeV 7 TeV, b* 0.5 m Arc Triplet ATLAS Injection :
Vertical axis :
Machine aperture in units of beam sigma (s), including alignment errors and other tolerances.
Horizontal axis :
Longitudinal position on left side of ATLAS (seen from the ring center).
450 GeV
Arc
Injection :
Aperture limit is the LHC ARCs (~ 7-8 s).
The triplet magnets in front of ATLAS/CMS are slightly behind the ARC (~ 8-9 s).
 ~5-6 s !
7 TeV, b* 0.5 m
Collisions, squeeze to b* 0.5 m :
Aperture limit is defined by the triplet magnets in front of ATLAS/CMS (~ 8 s)..
 ~6 s !
Triplet
Experiments-Machine WS / June 07

8. Experiments-Machine WS / June 07
Effects of FAST losses
Nominal intensity : ×1014 protons
Nominal bunch : protons
‘Pilot’ (minimal) bunch : 5×109 protons
450 GeV
5 ×109 protons : pilot bunch, no quench
1 ×1010 protons : quench limit – to be confirmed !
1 ×1012 protons : safe beam limit, below damage level for Cu
5 ×1012 protons :  damage level for Cu for
3 ×1013 protons : one nominal injection from SPS (272 bunches) , no damage to graphite collimators
7 TeV
protons : quench limit
1010 protons :  damage level for Cu
1012 protons :  damage level for collimators
Validated
To be
confirmed
Even the LHC collimators must be protected from massive beam impact !
Experiments-Machine WS / June 07

9. Time constants for beam losses
Very slow beam losses (lifetime 0.2 hours or more)
Cleaning system to limit beam losses around the ring
min … hours
Very fast beam losses (some turns to some milliseconds)
Fast beam losses (5 ms – several seconds)
Slow beam losses (several seconds – 0.2 hours)
At all times collimators limit the aperture – particles lost on collimators
Hardware surveillance and beam monitoring, failure detection and beam extraction onto the beam dump block.
ms … sec
accidental beam losses
Ultra fast beam losses
Single turn failures at injection
Single turn failures at extraction
Single turn failures with stored beams
Hardware surveillance and passive protection with beam absorbers s
Experiments-Machine WS / June 07

10. Experiments-Machine WS / June 07
Passive Protection
Passive protection against single turn failure relies on protection devices.
Injection failures (kickers…):
- TDI absorber.
- Transfer line/injection collimators.
Dump failures (asynchronous beam dump):
- TCDQ absorber downstream of the dump septa, and . For the case of beam2 this device is also essential to protect CMS and the IR5 triplet magnets.
- Collimators (for a limited range of swept beam amplitudes).
 Discussed in the presentation by V. Kain.
Experiments-Machine WS / June 07

11. IR3, IR6 and IR7 are devoted to protection and collimation !
LHC Layout
IR3, IR6 and IR7 are devoted to protection and collimation !
Beam dump blocks
IR5:CMS
experiment
IR4: Radio frequency acceleration
IR6: Beam dumping system
IR3: Momentum Collimation (normal conducting magnets)
IR7: Collimation (normal conducting magnets)
IR8: LHC-B
experiment
IR2: ALICE
experiment
IR1: ATLAS
experiment
Injection
Injection
Experiments-Machine WS / June 07

12. Beam Interlock System BIS Beam ‘Permit’
The Beam Interlock System (BIS) is responsible for collecting interlocks signals generated by the different surveillance systems and for transmitting this information to the beam dump kicker !
 Details will be discussed in the presentation by B. Todd
BIS
Dump kicker
Beam ‘Permit’
User permit
signals
Hardware links /systems, fully redundant
Actors and signal exchange for the beam interlock system:
‘User systems’ : systems that survey equipment or beam parameters. Each user system provides a HW status signal, the user permit signal to the BIS.
The beam interlock system combines the user permits and produces the beam permit.
The beam permit is a HW signal that is provided to the dump kicker (also injection or extraction kickers) : absence of beam permit  dump triggered !
Experiments-Machine WS / June 07

13. Experiments-Machine WS / June 07
LHC BIS ‘Users’
List of BIS ‘Users’ that are part of the machine protection system:
Approximately 3600 Beam Loss Monitors (BLMs) installed next to each quadrupole and collimator with a sampling period and reaction time of less than 1 turns (100 ms).
Beam Position Monitors to protect against fast beam position changes with a reaction time of few turns.
The Powering Interlock System (‘includes’ quench protection).
Fast powering failure detection systems (for critical circuits).
Collimator position and temperature surveillance.
RF system.
Vacuum valves.
Position surveillance of absorbers.
LHC Experiments.
Etc…
Each ‘User’ is able to dump the beam if it detects a failure !
Experiments-Machine WS / June 07

14. Beam Interlock Systems
Three distinct interlock systems play a role for protection at the LHC:
The LHC BIS acts primarily on the LHC circulating beam (dump kicker).
The LHC Injection Interlock Systems (IR2 & IR8) acts on the injected beam (injection kicker).
- Surveillance of injection elements in the LHC ring.
The SPS Extraction Interlock Systems (SPS LSS4 +TI8, SPS LSS6 + TI2) acts on the SPS beam (extraction kicker).
- Surveillance of the transfer lines and the extraction elements of the SPS.
LHC BIS
LHC Injection Interlock Systems
SPS Extraction Interlock Systems
Dump Kicker
Injection Kickers
SPS Extraction Kickers
Beam
permit
Injection
Extraction
The 4 systems share the same HW!
SPS BIS
SPS Dump Kicker
Beam
permit
Experiments-Machine WS / June 07

15. Experiments-Machine WS / June 07
Safe Beam Flags & Masks
The User Inputs to the interlock systems are split up into 2 groups :
Un-maskable inputs that are ALWAYS active.
Maskable inputs that may be de-activated provided the beam is SAFE.
Safe masking is achieved using the SAFE BEAM FLAG (SBF) that is distributed to the BIS and that can be:
TRUE
The stored beam energy is < damage threshold.
Masking of USER_PERMITs is taken in account.
If a masked USER_PERMIT = FALSE  ignored  BEAM_PERMIT = TRUE.
FALSE
The stored beam energy is > damage threshold.
Masking of USER_PERMITs is no longer taken in account.
If one USER_PERMIT = FALSE  BEAM_PERMIT = FALSE.
LHC : the SBF will be derived from the energy and the beam intensity.
SPS : the SBF depends only on intensity (SBF = FALSE if > 1012 protons) and is only used for the Extraction Interlock System.
Experiments-Machine WS / June 07

16. Injection - Probing with Beam
For the LHC ring, rather than implementing a highly complex surveillance of all equipment to ensure there will be not dramatic failure during the injection process, we verify the correctness of machine settings directly with beam :
1 – If no beam is circulating in a ring, only injection of a safe beam is allowed:
By definition the safe beam is below damage threshold.
Even if the entire injection is lost due to a wrong setting, there will be no equipment damage.
2 – Injection of an ‘unsafe’ beam is only allowed if beam is circulating in the ring:
Since a beam is circulating, the injection of the high(er) intensity will not lead to a loss over a single turn.
The lifetime of the high(er) intensity beam may be poor, but this leaves time for beam loss monitors …to react.
Experiments-Machine WS / June 07

17. Experiments-Machine WS / June 07
Beam Presence Flag
To ensure safe injection, we introduced an additional signal called the
Beam Presence Flag / BPF (one per beam).
The BPF is a signal that can be :
TRUE Beam is present, intensity > ~1-2 × 109 protons
FALSE No measurable beam, intensity < ~1-2 ×109 protons
The following logic is enforced for injection at the level of the SPS extraction interlock system:
BPF = FALSE Only a SAFE beam can be injected from the SPS.
BPF = TRUE Any beam may be injected
The highest intensity that may be injected into an empty ring corresponds to the SPS SBF limit of 1012 protons.
Experiments-Machine WS / June 07

18. Software Interlock System
Two Software Interlock Systems (SIS) will provide additional protection – on top of the HW interlock systems – for complex but also less critical conditions:
- For example a surveillance of magnet currents at injection and during collisions to avoid certain failures (local bumps) that would drive the beam into an experiment (or the nearby triplet).
The reaction time of those systems will be at the level of a few seconds.
The systems rely entirely on the machine technical network, databases, etc – clearly not as safe as HW systems !
The Injection SIS will complement the Injection Interlock Systems:
- Active from the beginning.
- Stops injection through the Injection Interlock Systems.
- Receives the experiments injection inhibits, either through our middleware (preferred) or through DIP.
The (ring) SIS will complement the BIS system:
- Dumps the beam through the BIS.
- Not clear if it will be active from the beginning – reliability to be checked. Initially it may be only sending alarms.
Experiments-Machine WS / June 07

19. Experiments-Machine WS / June 07
SPS SIS
The new SIS that protects the SPS ring and all its transfer lines (including the ones to LHC) since this run is identical to the future SIS systems of the LHC.
Experience so far:
System core performs reliably with ~1500 surveyed systems/parameters (tested up to 10’000).
Clients systems that are based on the new AB front-end system SW architecture (FESA) proved to be extremely reliable.
All problems that were encountered were related to data loss from front-end computers that are still running old ‘legacy’ SW.
Experiments-Machine WS / June 07

20. Experiments-Machine WS / June 07
Post-mortem Data
All machine user systems connected to the LHC BIS must provide Post-Mortem information for diagnostics, even systems that have NOT triggered the dump.
- Each experiment must be able to send similar information, at least for the beam dumps it initiates itself !
The granularity (in time) of the PM data ranges from bunch-to-bunch and turn- by-turn to ~1Hz sampling depending on the system. Maximum depth in time ~ seconds.
The PM data will be essential to ensure that the MP system performance is adequate (dumps due to failures and MP tests with beam).
- For example: abnormal losses on the tertiary collimators/triplet in IR5/CMS indicate beam in the abort gap and incorrect positioning of the TCDQ !
To resume beam operation after a beam dump, the PM data must be analysed and ‘understood’:
- Exact criteria must still be defined.
Experiments-Machine WS / June 07

21. Experiments-Machine WS / June 07
LHC MP ‘Transitions’
Injection:
I < 1012 p, ~ 12 nominal bunches :
- Safe beam
- Maskable inputs can be masked !
- No injection protection is ‘required’.
Circulating beam:
450 GeV, I < 1012 p :
- Absorbers and collimators at relaxed settings/not required.
Ramp – more or less any beam :
- Beam becomes progressively ‘un-safer’.
- Maskable inputs are re-activated automatically during the ramp.
- Minimum collimation required.
Experiments-Machine WS / June 07

22. LHC MP Commissioning
The commissioning of the MP system will follow closely the general beam commissioning and its ‘phase’ transitions:
450 GeV all systems
Ramp, 7 TeV all systems
Single bunches to trains (48/72 bunches) injection protection
Crossing angles and b* insertion protection, collimators
 The machine must remain protected in all phases.
Interlocks should be activated well before they become (too) critical/essential to gain experience and identify problems.
- As soon as beam are considered unsafe all inputs must be active, but interlock thresholds and settings can be still adjusted.
Experiments-Machine WS / June 07