What systems request a beam dump? And when do we need them? J. Wenninger AB/OP/SPS Systems connected to the Beam Interlock System Safe beam limit Interlock matrix of required systems Discussion With input from : R. Assmann, B. Dehning, B. Goddard, V. Kain, R. Schmidt, J. Uythoven January 2006 What systems request a beam dump / J.Wenninger

Components of the Machine Protection System Interlock System Clients Interlock System & Safe Parameters Access Vacuum Powering Interlock System: Quench detection PC interlocks Fast Magnet Current Monitors Beam loss monitors: At collimators & aperture limits In the arcs Beam position change monitors Fast beam current decay monitors Transverse feedback RF Experiments Collimators & absorbers Injection protection devices Beam Dumping System BPM for BDS TCDQ & TCS protection devices LHC Beam Interlock System LHC Injection Interlock System SPS Transfer Line Interlock System Safe LHC Parameters: Safe Beam Flag Beam Presence Flag Safe LHC mode Safe Energy Safe Squeezing Factor SW related to machine protection Software Interlock System ..and its inputs!!!! Post-mortem System Critical settings management Sequencer January 2006 What systems request a beam dump / J.Wenninger

Parameters relevant for machine protection Contribute to Beam energy Beam intensity Emittance Minimum b* Collimation & failures Beam intensity from SPS Stored energy @ injection Stored energy & density Energy density January 2006 What systems request a beam dump / J.Wenninger

What systems request a beam dump / J.Wenninger Stored energy Beam Stored energy in MJ 450 GeV 7 TeV single pilot 5×109 0.006 beam of 1012 0.07 1.1 43 bunches of 4×1010 0.12 1.9 156 bunches of 4×1010 0.45 7.0 936 bunches of 4×1010 2.70 42.0 2808 bunches of 4×1010 8.09 125.9 2808 bunches of 1.15×1010 23.27 362.0 ~ stored energy of SPS, HERA, TEVATRON Stored energy alone is not the whole story, the beam size has also its importance ! The failure mechanism plays also an important role for damages: Impact angle and time-constant January 2006 What systems request a beam dump / J.Wenninger

Damage test results A B D C TT40 damage test presented by V. Kain at Chamonix 2005: Melting point of Copper reached for  2.5×1012 p [beam impact  to target surface]. Results agree with estimates based on FLUKA simulations. Shot Intensity / p+ A 1.2×1012 B 2.4×1012 C 4.8×1012 D 7.2×1012 A B D C Based on those results we have adopted for the LHC a limit for safe beams @ 450 GeV of: 1012 protons with nominal emittance January 2006 What systems request a beam dump / J.Wenninger

Scaling damage limits Energy density scales  1/s Peak energy deposition Edep in Cu vs beam sigma, for 450 GeV and 7 TeV protons Energy density scales  1/s Energy dependence  E1.7 (including emittance reduc.) Safe beam intensity vs energy, assuming 1012 p+ is safe intensity at 450 GeV Damage limit @ 7 TeV = (1/100) × Damage limit @ 0.45 TeV Limits for NOMINAL e*: 1012 p @ 450 GeV 1010 p @ 7 TeV  pilot is @ edge ! Pilot

Damage potential of a pilot bunch @ 7 TeV The pilot bunch with nominal e* is close to the damage limit (~ factor 2-4). A pilot bunch with e* = 1 mm is ~ at the damage limit !  with nominal e* a pilot should be safe at 7 TeV. However the safety margin for some failure scenarios is marginal, there are uncertainties in scaling the simulation, the damage levels of materials other than Cu are not (yet) well known, therefore some protection must be available from the start – in particular because operation with low intensity should only occur for a short time (?). It is important to note that the damage limit also depends on the failure mode and on the beam impact angle which makes the picture even more complicated. January 2006 What systems request a beam dump / J.Wenninger

Stages for Machine Protection Stage I II III IV Hardware commissioning Machine checkout Beam commissioning 43 bunch operation ? 75ns ops 25ns ops I Install Phase II and MKB 25ns ops II No beam Beam Comm. before first beam First pilot 1012 protons 43 bunches 156 bunches 936 bunches 0.45 / 7 TeV SAFE at 450 GeV ‘Just’ SAFE at 7 TeV January 2006 What systems request a beam dump / J.Wenninger

What systems request a beam dump / J.Wenninger Required or not? Simplified states for inputs to the Beam Interlock System for a given machine commissioning stage: Phase 0: not required for operation Phase 1 : expected to work – but operation is possible without it ! Phase 2 : required – no operation without ! To be noted: Such a coarse classification does not capture the subtleties or possible staging of the interlock logic behind a given input to the BIS. ‘Precision’ of threshold, width of tolerance windows, reaction times… For system that are not required from the very beginning, it is recommended to to follow the sequence Phase 0  Phase 1  Phase 2 to profit from a ‘learning’ period (and not Phase 0  Phase 2). January 2006 What systems request a beam dump / J.Wenninger

Injection See V. Kain’s presentation ! System Commissioning before beam possible ? First pilot beam 10^12 43 bunches 1.7 10^12 156 bunches 6 10^12<N<1.4 10^13 936 bunches >5 10^13 Powering interlock system YES Beam interlock system Safe distribution of energy Safe beam flag PARTIAL Beam presence flag Safe distribution of mode Safe distr. of squeezing factor Beam interlocks SPS to LHC Injection protection NO Access system Vacuum system Magnet current change monitor BLMs, collimators & apertures BLM in the arcs Collimators and beam absorbers Beam position change monitors Fast beam current decay monitors Transverse feedback RF Experiments Beam Dumping System TCDQ / TCS BPM for BDS

Commissioning before beam possible ? 7 TeV System Commissioning before beam possible ? Pilot beam 10^12 43 bunches 1.7 10^12 156 bunches 6 10^12<N<1.4 10^13 936 bunches >5 10^13 Powering interlock system YES Beam interlock system Safe distribution of energy Safe beam flag PARTIAL Safe distribution of mode Safe distr. of squeezing factor Access system Vacuum system Magnet current change monitor BLMs, collimators & apertures BLM in the arcs Collimators and beam absorbers NO Beam position change monitors Fast beam current decay monitors Transverse feedback RF Experiments Beam Dumping System TCDQ / TCS BPM for BDS

What systems request a beam dump / J.Wenninger Comments on the table State transitions of the MPS appear during commissioning when: we ramp a pilot bunch to 7 TeV large fraction of inputs required we ramp 43 bunches to 7 TeV majority of inputs required we inject 156 bunches majority of inputs required If we are stuck at 7 TeV because some input systems are not ready, we cannot change the program to high intensity injection ‘studies’. Although the majority of interlock systems must be operational for 43 bunch operation at 7 TeV, the required safety level or complexity is by far not the same as for 2808 bunches !! The collimation system is a good example, where only a subset of collimators is required during initial stages, see R. Assmann’s talk. This table is clearly not cast in stone ! We expect some evolution until the LHC starts up. January 2006 What systems request a beam dump / J.Wenninger

Critical software Injection January 2006 System Commissioning before beam possible ? First pilot beam 10^12 43 bunches 1.7 10^12 156 bunches 6 10^12<N<1.4 10^13 936 bunches >5 10^13 Post-mortem PARTIAL Software Interlock System Critical settings management YES Sequencer January 2006 What systems request a beam dump / J.Wenninger

Critical software 7 TeV System Commissioning before beam possible ? First pilot beam 10^12 43 bunches 1.7 10^12 156 bunches 6 10^12<N<1.4 10^13 936 bunches >5 10^13 Post-mortem PARTIAL Software Interlock Control Critical settings management YES Sequencer For SW components it is clear that constraints & requirements are not the same for a pilot bunch and for 43 bunches or even for 2808 bunches !! Initially the SW component ‘core’ must be available (Phase 1  Phase 2), with a functionality that is a adapted to a given commissioning stage. The Software Interlock System ‘box’ hides a large system, with a core to transmit interlocks and a long list of ‘clients’: this a an interlock system of its own ! A first version of this system is expected to be operational at the SPS for the 2006 machine startup (CNGS commissioning). January 2006 What systems request a beam dump / J.Wenninger

Talon d’Achille of the Interlock Systems A lot of effort is going into building a BIS with very high safety standard SIL3-4. But many interlocks depend on reference & tolerance settings. Some of those settings must be adjustable during operation. Changes of such settings MUST be protected by adequate access control. An uncontrolled modification can be equivalent to MASKING the corresponding interlock – Exit our SIL3-4 systems ! Front-end frameworks like FESA are presently totally open, and settings may be changed from any WEB browser @ CERN !!! The separation of technical and general purpose network has improved the situation somewhat – but not sufficiently. The development of systems like MCS (Management of Critical Settings) to provide (reasonably) safe & controlled access to critical interlock settings is essential ! We need awareness for those issues in the AB department, and in particular in the CO & OP groups ! January 2006 What systems request a beam dump / J.Wenninger

Discussion : first pilot @ 450 GeV From a pure DAMAGE protection point of view we do not need the BIS and its clients for the first injections. We only need an interlock in the SPS on the beam intensity. But we do not want to ‘strap’ interlocks to get going, and then to reconnect and re-test them ! Some very central systems will be tested and ready to go: The Beam Interlock System Key beam interlock clients: Vacuum Access Powering interlock system Dump system Critical BLMs Experiments(*) Un-maskable input signals to the BIS Does not mean that those systems are 100% operational – e.g. Dump System (*) The experiments request un-maskable inputs, they must therefore be ready during the machine checkout with all other un-maskable inputs ! January 2006 What systems request a beam dump / J.Wenninger

Discussion : pilot @ 7 TeV The pilot bunch being at the edge of the damage limit at 7 TeV, the BIS must provide sufficient protection even for a pilot, thus requiring a significant number of inputs. In particular: Minimal collimation (primary & absorber) with rough positions must be in place (see R. Assmann). Beam loss monitors around the collimators. Orbit control must be available for the TCDQ, since an asynchronous beam dump is possibly the worst event for a pilot (note the probability to hit the pilot is of course not very high…). There is no point findings an absolute minimum set of inputs, since we expect to increase intensities anyhow asap… January 2006 What systems request a beam dump / J.Wenninger

What systems request a beam dump / J.Wenninger 43 x 43 With 43 bunches we reach a stored intensity comparable to what is accelerated routinely in the SPS since many years – but which also requires significant interlocking. At the LHC we aim to reach such stored energy levels in a short time ! The SPS experience shows that one can provoke damage with such beams and at the LHC the price to pay (delay & €) is larger: ‘Natural’ stage where the MP system must be in an advanced stage of commissioning – proportionally more advanced than beam operation. Systems that may not be required at this stage (still to be studied): RF and damper interlocks. Fast beam current decay and fast position change monitors. January 2006 What systems request a beam dump / J.Wenninger

What systems request a beam dump / J.Wenninger Ions… The ions will profit from a MP system that is already commissioned with protons, at least up to a certain intensity. We still have to analyze the safe-unsafe transition with ions (coming soon on MPWG agenda). We have to analyze what sub-systems of the MP system must be at least partly re-commissioned.  More detailled studies on ions are foreseen by the MPWG in 2006. January 2006 What systems request a beam dump / J.Wenninger

Conclusions : numbers & milestones First injection of a pilot bunch – no protection is required except a limitation of the intensity extracted from the SPS. But the BIS and all non-maskable inputs to the BIS will be ready and (pre-)commissioned. A beam of 1012 p constitutes the SAFE limit (damage) at INJECTION. Damage limit @ 7 TeV = (1/100)× Damage limit @ 450 GeV. A pilot bunch is close to the damage limit @ 7 TeV. We presently assume that the pilot is possibly SAFE, but we require some protection (‘minimal’ collimation and BLMs) as soon as the pilot is ramped to 7 TeV. The majority of the MPS must be operational: for 43 bunches @ 7 TeV for 156 bunches @ 450 GeV We must start to address the issue of how to manage critical interlock settings! January 2006 What systems request a beam dump / J.Wenninger