Concept & architecture of the machine protection systems for FCC Rüdiger Schmidt, CERN FCC week 2015

Protection from Energy and Power Risks come from Energy stored in a system (Joule) The energy stored in particle beams reached already an impressive level, and will further increase with FCC The energy stored in the magnet system is even more impressive, and discussed in other talks An uncontrolled release of the energy can lead to unwanted consequences Damage of equipment and loss of time for operation Activation of equipment This is true in particular for complex systems such as accelerators the FCC magnet system and particle beams

Energy stored in the FCC beams 𝐸 𝑏𝑒𝑎𝑚 = 𝑁 𝑝 ⋅ 𝐸 𝑝 = 𝝈⋅𝑬⋅𝑪 𝑐 4⋅𝜋⋅𝑳 𝚫𝑻 ⋅𝑭 Luminosity [cm-2s-1]: 𝑳 Bunch distance [ns]: 𝚫𝑻 Circumference [m]: 𝑪 Energy [TeV]: 𝑬 Beam size at IP (round beams) [m]: 𝝈 Speed of light: 𝑐 Filling factor: F (typically about 0.9) Energy stored in the beam: 𝐸 𝑏𝑒𝑎𝑚 increases with the particle energy, with the circumference, with the luminosity and the number of bunches => for FCC at 50 TeV/c this yields 8000 MJ per beam

Proton energy deposition for different energies 40 TeV 7 TeV 450 GeV 50 MeV 26 GeV 1 GeV 100 MeV 200 MeV F.Burkart + V.Chetvertkova

FCC-hh challenges Stored beam energy Stored energy 8 GJ per beam 20 times higher than LHC, equivalent to A380 (560 t) at nominal speed (850 km/h) FCC beams can melt 20 tons of copper Collimation, control of beam losses and radiation effects (shielding) important Injection, beam transfer and beam dump very critical Damage of a beam with an energy of 2 MJ Machine protection issues to be addressed early on!

Proton beams are very dangerous, but do not forget e+e- beams …….. FCC Protection Proton beams are very dangerous, but do not forget e+e- beams ……..

Energy versus momentum

Energy versus momentum

Energy versus momentum

FCC Beam Protection LHC made a large step in protection, profiting from the experience in previous accelerators Scaling of a factor of 200 from previous machines was not obvious … presently with very good results For FCC, for some areas, scaling is possible Other areas, different solutions are required No only energy to be considered, also energy density (MJ/mm2) that matters for beam induced damage Assuming the same beta, the beam size scales with 1/E With the same beta and number of particles, the energy density deposited in a target for FCC increases by about a factor of more than 50/7 (e.g. for a beam size of 1 mm, a factor of 20 to 30) e+e- beam in the MJ region are unheard of……

FCC Machine Protection What can go wrong? What are the consequences? Mitigation Controls and operation

Hazard and Risk for accelerators Hazard: a situation that poses a level of threat to the accelerator. Hazards are dormant or potential, with only a theoretical risk of damage. Once a hazard becomes "active“: incident / accident. Consequences and Probability of an accident interact together to create RISK, can be quantified: RISK = Consequences ∙ Probability Related to accelerators Consequences of uncontrolled beam loss (in $$$, downtime, radiation dose to people, reputation) Probability of such event The higher the RISK, the more Protection needs to be considered 12

Approach to designing a protection system Identify hazards: what failures can have a direct impact on beam parameters and cause loss of particles (….hitting the aperture) Classify the failures in different categories Estimate the risk for each failure (or for categories of failures) Work out the worst case failures Identify how to prevent the failures or mitigate the consequences Design systems for machine protection ……then back to square 1 ….starting in the early design phase, continuous effort, not only once….

Hazards related to particle beams Accidental beam losses due to failures: understand hazards, e.g. mechanisms for accidental beam losses Hazards become accidents due to a failure, machine protection systems mitigate the consequences Understand mechanisms for damage of components by direct beam loss Regular beam losses during operation To be considered since this leads to activation of equipment and possibly quenches of superconducting magnets Radiation induced effects in electronics (Single Event Effects) Understand effects from electromagnetic fields and synchrotron radiation that potentially lead to damage of equipment Understand interaction of particle beams with the environment Heating, activation, …

Injection -> Injection protection Operational phases Hazards and Machine Protection can be considered for three operational phases Injection -> Injection protection Stored beam -> Detect failures and trigger a beam dump Extraction -> Beam dump protection A number of talks in the different sessions, e.g. W.Bartmann , A.Lechner, A.Bertarelli, R.Assmann, M.Fiascaris, N.Tahir

Classification of failures Type of the failure Hardware failure (power converter trip, magnet quench, AC distribution failure such as thunderstorm, object in vacuum chamber, vacuum leak, RF trip, kicker magnet misfires, .…) Controls failure (wrong data, wrong magnet current function, trigger problem, timing system, feedback failure, ..) Operational failure (chromaticity / tune / orbit wrong values, …) Beam instability (due to too high beam current / bunch current / e-clouds) Failures in the injector, transfer lines and FCC to be considered Parameters for the failure Probability for the failure Damage potential Time constant for beam loss Risk = Probability * Consequences

Time constant for failures Very fast beam loss (few ms) e.g. multi turn beam losses in FCC due to a large number of possible failures, mostly in the magnet powering system, with a typical time constant of some ms to many seconds Fast beam loss (some 10 ms to seconds) Slow beam loss (many seconds) Detect and trigger beam dump Single-passage beam loss in the accelerator complex (ns - s) transfer lines between LHC and FCC failures of kicker magnets (injection, extraction, special kicker magnets, for example for diagnostics) 17

Strategy for protection and related systems Avoid that a specific failure can happen Detect failure at hardware level and stop beam operation Detect initial consequences of a failure with beam instrumentation ….before it is too late… Stop beam operation extract beam into beam dump block inhibit injection stop beam by beam absorber / collimator Elements in the protection systems equipment monitoring and beam monitoring extraction protection Injection protection collimators and beam absorbers beam interlock systems linking different systems

Strategy for machine protection Beam Cleaning System Definition of aperture by collimators. Interlocks for powering system (incl. several subsystems) Early detection of equipment failures generates dump request, possibly before beam is affected. Active monitoring of the beams detects abnormal beam conditions and generates beam dump requests down to a s. Beam Loss Monitors Other Beam Monitors Reliable operation of beam dumping system for dump requests or internal faults, safely extracting beams onto the external dump blocks. Extraction System Reliable transmission of beam dump requests to beam dumping system. Active signal required for operation, absence of signal is considered as beam dump request and injection inhibit. Beam Interlock System Passive protection by beam absorbers and collimators for specific failure cases. Collimator and Beam Absorbers

Machine Interlock Systems Concepts Beam Interlock System Ensures that the beam dumping systems gets a trigger, and the beams are extracted into the beam dump blocks when one of the connected systems detects a failure Interlocks for powering system (incl. several subsystems) Includes systems involved in the powering of the FCC superconducting magnets (magnet protection system, power converters, cryogenics, UPS, controls) Normal conducting Magnet Interlock System Ensures protection of normal conducting magnets in case of overheating Detects very fast decay of magnet current (as done in LHC)

FCC Interlock Systems and inputs (derived from LHC) Screens, mirrors etc Software Interlocks Operator Buttons Experiments Beam Lifetime beam presence Collimation System Injection Beam Dumping System Beam Interlock System 32 Injection Powering and Circuit Protection System 100000 RF System Beam Loss Monitors 16000 Personnel Safety System Vacuum System Timing System Beam interlock system collecting the beam dump requests from many systems Scaling from LHC, the number of interlock channels will exceed 100000 by far After a failure is detected, it will take up to 1 ms until all bunches are extracted

What more ?

Gaussian beam, energy in beam tails

FCC: Gaussian beam collimated at 4  99.9% of protons collimator collimator Example: a collimator is positioned at 4 , and we assume a dipole magnet failure.

FCC: Gaussian beam collimated at 4  99.9% of protons collimator collimator Example: a collimator is positioned at 4 , and we assume a dipole magnet failure. The beam starts to move, we assume by 1.5 . All particles beyond 2.5  are lost corresponding to ~330 MJ (5  = 17 MJ, 6  = 0.3 MJ)

Gaussian beam, 1.5  are cut Normally, the collimator has a position larger than 7  Failures that result in a beam displacement within less than, say, 2 ms by, say, up to 1.5  are only acceptable, if there is some space free of particles between beam tails and collimators Could be ensured by an eLense Monitoring is required Similar requirements for HL-LHC, but less critical Failures that result in a beam displacement within less than, say, 2 ms by larger than 1.5  are not acceptable (watch our for trips of normal conducting magnets, high beta function, ….)

Conclusions FCC will profit from LHC experience in machine protection Machine Protection ≠ Interlock System Machine Protection: Methods and technologies to identify, mitigate, monitor, and manage the technical risks associated with the operation of accelerators with high power beams or sub-systems with large stored energy, if failure modes can result in substantial damage to accelerator systems or significance interruption of operations. Machine Protection includes an ensemble of hardware systems + software + commissioning and operational procedures + …. Successful implementation of machine protection requires a safety culture at the lab

The END

SPS Beam with 1.5 MJ impacting on a copper target, first 10 cm. A cut through the target is shown The END F.Burkart, V.Raginel

Beam dumping block Beam size at exit window with sigma of about 4 mm (window of carbon should survive, to be confirmed) Corresponds to beta function of 400 km (why not?) 1m beta waist after 1000 m gives 1000 km Beam can be stopped in gas, water, …. some material that is not too dense

Evaluation of risk

Safety / Protection Integrity Level RISK = Consequences ∙ Probability IEC 61508 is an international standard of rules applied in industry, Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems (E/E/PE, or E/E/PES)) Ideas from Safety Integrity Level (SIL) concept of the IEC 61508 were applied => PIL If a hazard becomes active….. M.Kwiatkowski, Methods for the application of programmable logic devices in electronic protection systems for high energy particle accelerators, CERN-THESIS-2014-048