1. Introduction; Machine protection, experience and challenges: Review of existing solutions and challenges faced by future installations
Purpose of machine protection, risks, challenges, issues and objectives Michael Jonker (CERN)
Experience from MP in LHC, Markus Zerlauth (CERN)
Experience from MP in Flash, lessons for XFEL, Martin Staack (DESY)
Machine protection plans in ESS, Gregor Čuk (CosyLab)
Machine protection challenges in ILC, Marc Ross (SLAC)
Machine protection challenges in CLIC, Michael Jonker (CERN)
Status of the ASTA Facility Machine Protection System at Fermilab, Arden Warner (Fermilab)
Machine protection at the Jefferson Lab 1 MW CEBAF electron accelerator, Kelly Mahoney (TJNAF)

2. General comments
This workshop was triggered by the work ongoing for CLIC machine protection
There has never been a workshop on Machine Protection on accelerators
Machine protection systems for 9 different accelerators were discussed
LHC, Flash, XFEL, ESS, ILC, CLIC, ASTA, Jefferson Lab, FERMI
There seems to be a considerable interest in this topic
There are a number of common issues for all (or at least most) labs

3. What is Machine Protection? MPS versus MIS

4. The MPS consists of:
1) a single bunch damage mitigation system,
2) an average beam loss limiting system,
3) a series of abort kickers and low power dumps,
4) a restart ramp sequence,
5) a beam permit system,
6) a fault analysis recorder system,
7) a strategy for limiting the rate with which magnetic fields (and insert-able device positions) can change,
8) a sequencing system that provides for the appropriate level of protection depending on machine mode or state, and
9) a protection collimator system.
MPS is NOT limited to the Machine Interlock System (the interlock system is the physical link between different hardware systems)
MPS CERN
Marc Ross, SLAC

5. Machine Protection System
CONTROL SYSTEM
(Configuration management)
BPS (Beam Permit System)
≈ 1000 signals
Response time: 5-10µs
Binary
OK/NOK
MID
(MPS Input Devices)
MOD
(MPS Output Devices)
Binary
OK/NOK
BIS
(Beam Interlock System)
Post Mortem
TIMING SYSTEM

6. Purpose of machine protection, risks, challenges, issues and objectives, Michael Jonker (CERN)
Machine protection is NOT personnel protection (Do not mix it!)
There are differences between MP systems for accelerators:
with large stored energy in the beam (e.g. LHC more than 360 MJ),
accelerators operating with large beam power (CLIC more than 150 MW, ESS with 5 MW)
smaller accelerators
However, there are also many similarities
Machine Protection should prevent beam induce damage – what beam (particle type, intensity, beam size, energy) will damage what type of equipment (vacuum chamber, magnets, cavities, collimators)?
This is not clear and is frequently left to “feeling”, and requires (a lot of) studies, relevant for many accelerators
Managing risks during accelerator operation
Machine protection should result in acceptable risks for operation
There established methods, one method is inspired by IEC 61508
Several methods for risk reduction

7. Experience from MP in LHC, Markus Zerlauth (CERN)
Not a single miss can be tolerated: protection of equipment
Some experience with massive damage in LHC during the sector 34 event
Design principles: protect machine, protect beam, provide evidence
Energy of injected bunch is high, protection at injection is important
MPS: individual systems coupled via the interlock system
Machine Protection WG and Reliability WG was essential
Independent powering and beam interlock systems, it is evolving and there are many changes during a year, it is a continuous challenge
Controls: Software Interlock System, Sequencer and Logging + Post Mortem Systems
Origin of all LHC beam dumps understood
No quench from circulating beam with 130MJ energy stored in each beam
Dependability observation are in the same order compared to calculations that were done several years ago

8. Experience from MP in Flash, lessons for XFEL, Martin Staack (DESY)
BLMs for beam losses, and toroids for total current difference
MPS is using a PLC (ms), stop beam from train to next train
MPS reaction depends on operational mode
XFEL
PLC not possible, distributed system with about 2000 alarm signals
50 bunches in accelerator …cannot be stopped
Actuator: laser and dump kicker, to minimise number of bunches that might impact on equipment (do no stop laser, but deflect laser beam to dump)
Interlock system uses distributed Micro TCA system with fibre links and two Masters controllers, some masking of interlocks is possible
Many photomultipliers, 35 toroids, measuring the beam current in an interleaved way

9. Experience from MP in Flash, lessons for XFEL, Martin Staack (DESY)
Segmentation: checks different areas of the machine, then conclude if beam operation is possible in this segment
Beam modes collects info, and configures MPS and the timing system is heavily used
15 experiments, MPS needs to know the branching of beams
System will be tested at FLASH 2 next year before XFEL
Radiation monitoring in the tunnel is part of system
Hardware is in production operation in 2015

10. Machine protection plans in ESS, Gregor Čuk (CosyLab)
ESS: 600m, 5MW, 14Hz, 2.86ms pulse length, availability of 95%
Several protection systems: Target Safety Systems, Personnel Protection Systems, MPS
Cosylab: Interlock system, controls, timing, MPS and databases
MPS: two main services, beam permit, beam interlock
Beam Permit System is integrated into timing system
MPS: Beam Interlock System: 5-10mus, about binary device inputs (MID), few output devices (MOD)
MID: BLMs, several other HW systems, signals from target are critical (possibly several signals)
MOD: ions source, RFQ, chopper, chopper, beam dumps, target protection block
Beam permit: based on software (what can stop the accelerator?)
Next Pulse Inhibit (next pulse permit): 68ms

11. Machine protection plans in ESS, Gregor Čuk (CosyLab)
Machine modes and commissioning phases require different configuration
Input masking required, how?
Post mortem: MPS stops circular buffers
How to ensure that all systems are coherent?
Single timeline: timing and synchronisation? How to ensure it?
Questions
MPS security: who can change settings? Restarting, how?
MPS responsibility boundaries?
Device integration guidelines…. how to ensure a coherent system?
How to implement operational modes in the protection?
Mitigation devices, what to use?
Failure catalogue… hazards etc… to be established

12. Machine protection challenges in ILC, Marc Ross
MPS: SLAC 2MW
Impressive studies on damage, what is the consequence of such micro hole? Need of further material studies….
Every pulse is a new injection
Single pilot bunch is injected
All device must be ok for main beam injection
Pilot with intensity of 1% of nominal beam (instruments with sufficient dynamic needed)
MPS needs to be segmented, applied throughout the complex
Shut-off points: in total 11 locations (spoiler, collimator, kicker)

13. Machine protection challenges in ILC, Marc Ross
If the emittance grows sufficiently after a kick there might be no damage
Restart sequence, with different steps increasing the beam intensity, or changing beam parameters
Fast changing devices need specific attention (e.g. kickers and feedback systems)
Some devices need to be fast
Common mode failures need attention….
Basic MPS rules are proposed

14. Machine protection challenges in CLIC, Michael Jonker
In total, power of 2*70MW + 2*14MW
Energy density is critical (10e4 above damage limit)
Safe by design: slow systems (see later presentation)
Time constant for failures: slow failures, inter-cycle failures, last moment equipment failures, fast failures
Many components, many failure modes…. ~700
Failure analysis and simulations are required to understand consequences of failures
Post pulse analysis – many instruments are being involved
RT protection possibly needed, intermediate dumps?
Beam feedback system…? How to avoid failures of such system?

15. Machine protection at the Jefferson Lab 1MW CEBAF electron accelerator, Kelly Mahoney (TJNAF)
Electron beam power up to 1MW accelerator, 100% duty factor, high availability + free electron laser and energy recovering linac
Already with 1kW beam power damage is possible
Burn through versus time graphs, diagnostics important
SC cavities machine protection operating at the limit, field emission, many interlocks for avoiding or detecting quenches
The quantity to be optimised is the integrated performance (integrated luminosity, number of protons on target, …)
Top down approach (see talk in other session)
Integrated system approach – high availability is required, purpose is not to shut off the accelerator (high availability)
Identify precursors for beam loss and correct, MPS is backup
Fast recovery, less than <9s (MTTR)
Random HW system failures are small portion…. software more important (seems to be different from LHC….)

16. Status of the ASTA Facility Machine Protection System at Fermilab, Arden Warner (Fermilab)
Length of the accelerator is meters, total power about 50 kW
MPS uses fast electronics based on FPGA
MPS has MIDs (MPS Input Devices) and MODs (MPS Output Devices)
Main MIDs: BLMs (scintillators) and toroid loss monitors
Main MOD: Laser, but also RF can be stopped
System reaction depends on operational mode
For measuring the dark current in cavities: BLMs in the cold are of interest
Instrumentation
Secondary emission monitors (SEMs) or Aluminium cathode PMTs near dumps
Cryogenic Loss monitors sensitive to dark current as close to the beam pipe as possible (5K )
Diamond loss monitors also close to the beam pipe (1.8K)
Fast Kicker

17. The LHC machine need protection systems, but….
Machine Protection is not an objective in itself, it is to
maximise operational availability by minimising down-time (quench, repairs)
avoid expensive repair of equipment and irreparable damage
Side effects from LHC Machine Protection System
compromising operational efficiency must be minimised
Downtime dominated by too complex Protection Systems
Qualitative
Downtime for repairs due to insufficient protection systems
R.Schmidt - Villars 30/01/2001
Operations workshop

18. Comments
The objective is not to protect by all means but to optimise the output of the accelerator
Machine Interlock Systems have similar architectures,
Segmentation of the MPS is desired
Monitors for MPS (e.g. for beam loss) are very similar
Machine protection is to prevent damage – but what is the damage level?
Machine Protection Systems take into account operational modes – how?
General awareness of dependability, but more can be done to help building reliable systems

19. Proposals
Session chairs write a summary, combine the summary to one document
Individual paper are encouraged
PSIPAC – Protection Systems for Particle Accelerators
Several colleagues asked when a future workshop on Machine Protection could be organised, is there enough interest?