1. Overview on LHC Machine Failure Scenarios
Jörg Wenninger
AB-OP-SPS
Co-chair LHC Machine Protection Working Group
Introduction to LHC machine protection
Machine aperture
Injection and dump failures
Circulating beam failures
Summary
14/12/2007
VELO WS - J. Wenninger

2. LHC Machine Protection system
The LHC machine protection system includes all systems required to safely operate the magnets and the beams. The system is subdivided into:
Powering interlock system that protects against uncontrolled release against the energy stored in the magnets (> 10 GJ). This system is required to power the magnets. It is commissioned together with the magnets (already started).
This system is based on PLCs with typical reaction times of ~4 ms, less for a few critical circuits.
Beam interlock system that protects the LHC equipment against uncontrolled release of the energy stored in the beams (0.35 GJ).
The BIS is a VME based system with reactions times of ~ms.
Maximum time between dump request and last proton out ~270 ms.
The MPS has more than 10’000 interlocks, and in many cases sub-systems overlap in their protection. In particular the powering interlock system, which includes the magnet quench protection system, provides in many cases redundancy for ‘pure’ beam interlocks.
14/12/2007
VELO WS - J. Wenninger

3. Collimation system Beam
A multi-stage halo cleaning (collimation) system has been designed to protect the LHC magnets from beam induced quenches.
Halo particles are first scattered by the primary collimator (closest to the beam). The scattered particles (forming the secondary halo) are absorbed by the secondary collimators, or scattered to form the tertiary halo.
More than 100 collimators jaws are needed for the nominal LHC beam.
Primary and secondary collimators are made of Carbon to survive severe beam impacts !
 the collimators have an key role for protection as they define the aperture.
 contrary to TEVATRON and HERA the LHC cannot be operated without collimators as soon as ~few permill of the nominal beam intensity is stored !
Primary
collimator
Secondary
collimators
Absorbers
Protection
devices
Tertiary
Triplet
magnets
Experiment
Beam
halo particle
Secondary halo
Tertiary halo
+ hadronic showers
hadronic showers
14/12/2007
VELO WS - J. Wenninger

4. IR3, IR6 and IR7 are devoted to protection and collimation !
LHC Layout
IR3, IR6 and IR7 are devoted to protection and collimation !
Beam dump blocks
IR5:CMS
experiment
IR4: Radio frequency acceleration
IR6: Beam dumping system
IR3: Momentum Collimation (normal conducting magnets)
IR7: Collimation (normal conducting magnets)
IR8: LHC-B
experiment
IR2: ALICE
experiment
IR1: ATLAS
experiment
Injection
Injection
14/12/2007
VELO WS - J. Wenninger
Experiments-Machine WS / June 07 4

5. Active protection systems have no time to react !
Failure categories
In the event a failure or unacceptable beam lifetime, the beam must be dumped immediately and safely into the beam dump block.
Two main classes for failures (with more subtle sub-classes):
Passive protection
- Failure prevention (high reliability systems).
Intercept beam with collimators and absorber blocks.
Active protection systems have no time to react !
Beam loss over a single turn
during injection, beam dump or any other fast ‘kick’.
Active Protection
- Failure detection (by beam and/or equipment monitoring) with fast reaction time (< 1 ms).
- Fire beam dumping system
Beam loss over multiple turns
due to many types of failures.
Fastest failures >= ~ 10-ish turns
14/12/2007
VELO WS - J. Wenninger

6. ‘Properties’ of global failures
Almost all perturbations due to failures (typically magnet powering, an injection or dump failure) affect the entire machine.
To first order the amplitude of the perturbation at any place in the ring, is proportional to the (unperturbed) beam size and to a phase factor, i.e. :
Ampl. ~ s cos(phase) ~ b cos(phase) b is the betatron function
>>> For failures the parameter that defines if an element is likely to be hit is not the physical distance to the beam, but the distance in units of beam size.
>>> Since at the LHC the collimators must ALWAYS define the aperture to avoid quenches of the SC magnets, one of the collimators is always the first elements that is hit by the beam. This is confirmed by all simulations performed so far.
14/12/2007
VELO WS - J. Wenninger

7. Issues around ‘orbit bumps’
Local orbit bumps are tools that are regularly used in rings for :
Crossing angles.
Separation of the beam at the IP
for injection & ramp.
Local aperture checks.
Etc…
A local bump may produce a large local excursions, and at injection one can reach basically any element of the machine (because the magnets are designed for 7 TeV):
Contrary to global failures, for a bump the amplitude does not scale with s !!
Even the fastest bumps take however seconds to minutes to bring the beam to the aperture, which leaves time for Loss Monitors to react and dump the beam.
Bumps are a worry for machine protection, because they commonly used and at the same time they are potentially dangerous, in particular in conjunction with an injection or dump failure.
>>> We have prepared strategies to detect undesired bumps (at least during normal physics operation) by analysis of orbit and corrector magnet data. To be tuned and validated in operation. s x
Corrector magnet
14/12/2007
VELO WS - J. Wenninger

8. Comments on ‘stable beams’
A common misconceptions is to believe that during the ‘Stable beams’ phase which corresponds to experiments data taking, the beam is … stable !!!
During the ~12 hours of colliding beams, one observes :
Thermal effects on warm magnets that affect beam parameters.
Orbit drifts (~ 1s equivalent over 12 hours at LHC) due to ground motion and tides.
Beam parameters drifts (tune…) due to the intensity decay.
Etc…
The changes are either corrected manually or by automated feedback (orbit drift).
The distinction between a ‘dangerous’ and a beneficial change one is usually only given by… the amplitude !!
>> Operational errors can happen during stable beams (by operators or feedbacks), but they are never worse than a failure due to power cuts !
14/12/2007
VELO WS - J. Wenninger

9. Machine Aperture
14/12/2007
VELO WS - J. Wenninger

10. IR8 physical aperture
14/12/2007
VELO WS - J. Wenninger

11. Beam aperture
The standard LHC beam aperture model not only takes into account the physical aperture, it also includes mechanical tolerances, alignment errors, orbit tolerances, magnetic errors etc.
>> The net aperture after subtraction of all clearances is normalized by the beam size and expressed in ‘n1’ units, n1 being the primary collimator setting (in beam s) required to ensure that the aperture is beyond the beam halo of the secondary collimators.
Example : for a SC magnet where n1=10, it is possible to set the primary collimators to 10s before risking a quench of the magnet due to halo particles (assuming an properly setup collimation system !!).
14/12/2007
VELO WS - J. Wenninger

12. IR8 normalized aperture at injection
ARCs are the aperture limit (n1 ~7s).
The triplet magnets are slightly behind the ARC.
The primary collimator opening must be set ~5-6 s to protect the ‘cold’ arc aperture.
VELO is well protected … by the triplets !
30 mm
Triplets
IP8
Arcs
14/12/2007
VELO WS - J. Wenninger

13. Beam sizes
During the energy ramp, the beam size shrinks but the optics is not changed, and n1 scales with E.
During the betatron squeeze, the beam size decreases at the IP and increases in the triplet magnets, reducing the aperture near the IR.
>> This is due to the fact that phase space is conserved, a smaller size means more divergence and therefore a larger size in the next quadrupole (triplets).
14/12/2007
VELO WS - J. Wenninger

14. IR8 normalized aperture at 7 TeV
5 mm,
perfectly centered
At 5 mm from the beam, VELO remains behind the triplet aperture.
For b* = 2 m, the triplets define the apertures in IR8. Tertiary collimators are necessary to protect the triplet magnets (quench from halo and failures).
For global perturbations of the beam parameters (s, orbit), VELO is always in the shadow of machine elements (Arc magnets, triplets):
>> VELO is not directly affected by most global failures!
14/12/2007
VELO WS - J. Wenninger

15. Injection Failures
14/12/2007
VELO WS - J. Wenninger

16. Overview injection/extraction
Same principle for injection and extraction:
“kicker” magnets: fast rise time, much less than one turn, large (~ mrad) angles
Septa magnets: two apertures with different magnetic fields
Injection:
Beam 1: IR2
Beam 2: IR8
Extraction:
Both beams in IR 6
Injection and extraction lead to single turn failures !!
14/12/2007
VELO WS - J. Wenninger

17. Injection layout
Beam is coming in from the TI2 (IR2) and TI8 (IR8) transfer lines (both ~ 3km).
Injection in 2 steps:
Septum magnet (MSI) provides a horizontal deflection to bring the injected beam parallel to the circulating beam.
The kicker magnet (MKI) provides a vertical deflection to bring the injection beam on the orbit of the circulating beam.
The TDI absorber protects the downstream elements against damage from MKI failures (no kick, over voltage…). A mask (TCDD) helps to absorb the showers.
The injection and crossing angle schemes are ‘mixed’ (injection area overlaps with crossing angle) : crossing scheme changes associated to changes of the LHCb spectrometer polarity are very tricky from point of view of protection.
14/12/2007
VELO WS - J. Wenninger

18. Injection protection
Because the extraction process from SPS/injection into the LHC occurs over less than 10 ms, all elements must be in place and at their correct settings.
The transfers lines (up to MKI) are very heavily interlocked (magnet settings) and protected by collimators in the lines and in the LHC (TDI, TCLI downstream from IR2/IR8) :
>> Aim is to protect the LHC arc magnets against beam impact and beam halo.
>> Target : no beam beyond ~ 7s from nominal orbit.
TED
TDI
MKE
MKI
TCDIMOM
TCDIH/V
SPS
TT40/60
TI 8/2
LHC
Transfer line collimators
setting: 4.5 s
14/12/2007
VELO WS - J. Wenninger

19. Injection into an empty ring
Injection can be risky when a ring is empty, since one must be sure that all magnet settings are sufficiently good to avoid immediate loss.
That is why the LHC injection principle, implemented by hardware signals, is based on the following principle :
If some beam is present in a ring, the conditions for injection of high intensity are sufficiently good to avoid immediate loss of the beam over the first turns. Even if the lifetime is very poor, the beam will stay for some turns and the protection systems have time to detect losses and trigger the dump if necessary.
Injection logic:
- If beam is present (> ~ 2x109 p), any beam intensity may be injected.
- If no beam is detected, the maximum intensity that can be injected is
> ~1010 p for regular operation.
> 1011 p in dedicated periods of machine studies (as required).
This scheme is presently under discussion, but it is not possible to go further down in intensity for the first injection.
14/12/2007
VELO WS - J. Wenninger

20. Injection failures
30 mm
A special case of failures at injection into an EMPTY ring are (large) setting errors of separation dipoles (D1/D2) or orbit correctors close an IR:
Beam may be deflected right into the detectors.
A more likely scenario is a random setting that leads to beam impact in the triplets.
Such case can be ‘build’ for all IPs.
Cures:
Limit intensity injected into an empty ring (see previous slide).
Current surveillance of the critical magnets (by Software Interlock System).
V plane
30 mm
H plane
14/12/2007
VELO WS - J. Wenninger

21. Extraction (dump) Failures
14/12/2007
VELO WS - J. Wenninger

22. Beam Dumping System Septum magnet deflecting the extracted beam MSD
H-V kicker for painting the beam
Q5L
Beam Dump Block
Q4L
15 kicker magnets
MKD
about 700 m
Q4R
about 500 m
Q5R
Beam 2
14/12/2007
VELO WS - J. Wenninger

23. Requirements for a ‘clean’ dump
The extraction kicker rise time
must coincide with the 3 ms long
particle free abort gap.
The abort gap must be free of
particles (dedicated detector).
The kicker setting must match the beam energy (‘Energy Tracking’). Energy tracking errors are among the worst failures for the LHC, the system is therefore highly redundant.
Abort gap
14/12/2007
VELO WS - J. Wenninger

24. Dump sweep: asynchronous dump
When the kicker rise does not coincide with the abort gap (‘asynchronous dump’) the bunched are swept out over all amplitudes. As protection against DAMAGE against such events (expected ~ 1 / year):
Moveable graphite absorber TCDQ (7 m), plus normal collimator (TCS) downstream from the kicker.
Tertiary collimators protect the triplets (mainly IR5) against beam leaking out of absorbers + coll.
>>> IR8 is rather well protected, since beam 1 must pass the collimation section in IR7 before reaching IR8 – should be confirmed by simulations (ongoing).
14/12/2007
VELO WS - J. Wenninger

25. Circulating Beam Failures
14/12/2007
VELO WS - J. Wenninger

26. ‘Global’ failures
Since a few years a number of more or less sophisticated simulations have been performed on machine failures, including particle tracking and shower simulations with GEANT/FLUKA.
The most critical failures have been identified and for some cases, additional protection devices were added:
Fastest failures imply the normal conducting D1 separation dipoles in IR1 and IR5 that lead to beam loss on collimators after ~ turns.
Special devices to detect fast powering failures have been developed with DESY and successfully tested in the SPS-LHC transfer lines. Such devices have been attached to the most critical magnet circuits.
All simulations so far indicate that the beams
first hit one of the collimators,
then impact on elements downstream of/close to the collimators,
and a small fraction of the beam leaks out to the Arcs & IRs, in which case it impacts frequently near the triplet magnets (depends on b* !).
 LHC Beam Loss Monitor System is expected to catch such failures if the interlocks on the powering are not fast enough.
14/12/2007
VELO WS - J. Wenninger

27. Bump at IR8
When VELO is in data taking position at 5 mm from the beam, the beam can be pushed to the inner edge of VELO by a specially designed orbit bump even at 7 TeV !
Such a bump takes ~ minutes to develop and pushes some magnets to their limit.
This case is very very unlikely to happen (deliberate !), but it shows what bumps can do!
At injection a similar bump can reach much larger amplitudes but will hit the magnet apertures and not VELO (assuming it is at 30 mm).
14/12/2007
VELO WS - J. Wenninger

28. Summary Beam failures may affect VELO in the following way :
During injection large settings errors of dipoles/correctors can lead to direct beam impact in the vicinity of or into VELO. Such failures will be mitigated by:
Surveillance of magnet currents (by software interlocking).
Limit on the intensity that may be injected into an empty ring (hardware signals).
With circulating beam VELO is protected from direct impact due to global failures by collimators and by the triplets, but could be affected by showers from triplets.
Local bumps can reach VELO in its data taking position, but are basically very unlikely at 7 TeV. Local bumps at injection would drive the beam into the triplet magnets or into the corrector magnets. Bump ‘failures’ will be mitigated by surveillance of corrector currents and orbit.
>> The most likely impact of failures on VELO is from showers created by beam impact on the triplet magnets (or the tertiary collimators).
Question : in case of direct impact of 1010 p near VELO at injection, would the BCMs detect the failures and react? Sensitivity/threshold?
14/12/2007
VELO WS - J. Wenninger