1. Protection against accidental beam loss at the LHC
J. Wenninger
CERN
AB Department / Operations Group
(Short) introduction to Machine Protection at the LHC
Protection issues for CMS

2. Machine protection at the LHC – ‘organization’
Machine protection activities of the LHC and the SPS are coordinated by the LHC Machine Protection Working Group (MPWG), co-chaired by R. Schmidt & J. Wenninger.
The MPWG WEB site (only from inside CERN !)
New :
The MPWG has asked each LHC experiment to provide a contact person to interface on machine protection issues between machine and experiments. This person should be nominated soon (if it is not already done).
A one day workshop on machine protection issues for the LHC experiments will be organized in June.

3. Stored Energy A factor 2 in magnetic field A factor 7 in beam energy
A factor 200 in stored energy
360 MJ

4. Damage Potential of High Energy Beams
Shot
Intensity / p+ A
1.2×1012 B
2.4×1012 C
4.8×1012 D
7.2×1012
Controlled experiment with 450 GeV beam shot into a target (over 5 ms) to benchmark simulations:
Melting point of Copper is reached for an impact of  2.5×1012 p, damage at  5×1012 p.
Stainless steel is not damaged with 7×1012 p.
Results agree with simulation.
Effect of beam impact depends strongly on impact angles, beam size…
A B D C
Based on those results the MPWG has adopted for the LHC a limit for safe beams with nominal 450 GeV of
1012 protons ~ 0.3% of the total intensity
Scaling the results yields a 7 TeV of
1010 protons ~ 0.003% of the total intensity – still under discussion !!

5. Effects of FAST losses 450 GeV 7 TeV
Nominal intensity : ×1014 protons
Nominal bunch : protons
‘Pilot’ (minimal) bunch : 5×109 protons
450 GeV
5 ×109 protons : pilot bunch, no quench
1 ×1010 protons : quench limit – to be confirmed !
2 ×1012 protons : safe beam limit, below damage level for Cu
5 ×1012 protons :  damage level for Cu
3 ×1013 protons : one nominal injection from SPS (272 bunches) , no damage to graphite collimators
7 TeV
protons : quench limit
1010 protons :  damage level for Cu
1012 protons :  damage level for collimators
Validated
To be
confirmed
Even the LHC collimators must be protected from massive beam impact !

6. ‘Unscheduled’ beam loss due to failures
Two main classes for failures (with more subtle sub-classes):
Passive protection
Avoid such failures (high reliability systems)
Rely on collimators and beam absorbers
Beam loss over a single turn
during injection, beam dump or any other fast ‘kick’.
Active Protection
Failure detection (from beam monitors and / or equipment monitoring)
Fire Beam Dump
Beam loss over multiple turns
due to many types of failures
In case of any failure or unacceptable beam lifetime, the beam must be dumped immediately and safely into the beam dump block

7. accidental beam losses
Time constants for beam losses
time
Very slow beam losses (lifetime 0.2 hours or more)
Cleaning system to limit beam losses around the ring
min … hours
Very fast beam losses (some turns to some milliseconds)
Fast beam losses (5 ms – several seconds)
Slow beam losses (several seconds – 0.2 hours)
At all times collimators limit the aperture – particles lost on collimators
Hardware surveillance and beam monitoring, failure detection and beam extraction onto the beam dump block
ms … sec
accidental beam losses
Ultra fast beam losses
Single turn failures at injection
Single turn failures at extraction
Single turn failures with stored beams
Hardware surveillance and passive protection with beam absorbers s

8. Machine Protection at the LHC
Machine Protection is split into 2 main components
Powering Interlock System: Protection during powering
Protects the magnets and power converters against uncontrolled release of the energy stored in the magnets.
Must be available as soon as the magnets are powered.
Receives signals from the Quench Protection and Power Converter Systems.
Reaction times ~ milliseconds.
Provides direct inputs (interlocks) to the Beam Interlock System.
Beam Interlock System (BIS): Protection during beam operation
Protects the machine (and the experiments) against uncontrolled release of the energy stored in the beams.
Receives inputs from many different systems, including the Powering Interlock System.
Reaction times ~ microseconds.

9. Hardware links /systems, fully redundant
Beam Interlock System
Beam ‘Permit’
BIS
Dump kicker
User permit
signals
Hardware links /systems, fully redundant
Actors and signal exchange for the beam interlock system:
‘User systems’ : systems that survey equipment or beam parameters and that are able to detect failures and send a HW signal to the beam interlock system.
Each user system provides a HW status signal, the user permit signal.
The beam interlock system combines the user permits and produces the beam permit.
The beam permit is a HW signal that is provided to the dump kicker (also injection or extraction kickers) : absence of beam permit  dump triggered !

10. Architecture of the BEAM INTERLOCK SYSTEM
- fast reaction time (~ ms)
- safe
- limited no. of inputs
- Some inputs maskable for safe beam intensity
Beam-1 / Beam-2 are Independent!
Up to 20 Users per BIC system:
6 x Beam-1
8 x Both-Beam
6 x Beam-2
Connected to injection IR2/IR8:
In case of an interlock (=NO beam permit), the beam is dumped & injection is inhibited.
It is not possible to inhibit injection ALONE.

11. Achievable response time ranges between 100 s and 270 s
BIS reaction times t1
> 10μs
USER_PERMIT signal changes
from TRUE to FALSE
a failure has been detected…
beam dump request
User
System
process
Signals
send
to LBDS t2
Beam
Interlock
system
process
~70μs max.
Kicker fired
Beam Dumping
System waiting
for beam gap t4
all bunches have been extracted
~ 89μs
89μs max t3
Achievable response time ranges between 100 s and 270 s
(between the detection of a dump request and the completion of a beam dump)

12. Schematic layout of beam dump system in IR6
Septum magnet deflecting the extracted beam
H-V kicker for painting the beam
Q5L
Beam Dump Block
Q4L
15 kicker magnets
about 700 m
Q4R
about 500 m
Q5R
Beam 2

13. BIS ‘Users’
List of BIS ‘Users’ that are part of the machine protection system:
Approximately 3600 Beam Loss Monitors (BLMs) installed next to each quadrupole and collimator with a sampling period and reaction time of less than 1 turns (100 ms).
Beam Position Monitors to protect against fast beam position changes with a reaction time of few turns.
The Powering Interlock.
Fast powering failure detection systems for (for critical circuits).
Collimator position and temperature surveillance.
RF system.
Position surveillance of absorbers.
LHC Experiments.
Etc…
Each ‘User’ is able to dump the beam if it detects a failure !

14. Passive Protection Collimators : Absorbers: Distance to beam :
The primary aim of the collimation (beam cleaning) system is to intercept large amplitude particles before they are lost in the cold mass and quench the SC magnets. The lower the beam lifetime, the tighter the tolerances for the collimation system.
A second aim is the protection of the machine aperture against beam loss due to failures. For that purpose the collimators must always define the machine aperture, i.e. they must be the elements that are closest to the beam.
Absorbers:
Absorbers are used to protect equipment against damage due to injection (transfer line & injection kicker) and dump failures (dump kicker).
Absorbers are installed in IR2 and IR8 for injection protection.
Absorbers are installed in IR6 for dump failure protection.
Distance to beam :
Primary coll. < secondary coll. < tertiary coll., absorbers < Equipment

15. Beam collimation (cleaning)
The very high stored energy, combined with a very low thresholds for quench requires a complex two-stage cleaning system:
Large amplitude protons are scattered by the primary collimator (closest to the beam).
The scattered particles impact on the secondary collimators that should absorb them.
The efficiency of the collimation must be larger than 99.9% to be able to run under reasonable conditions, i.e. with lifetimes that can drop down to less than 1 hours from time to time… This requires settings tolerance of < 0.1 mm.
60 collimators/beam!

16. IR3, IR6 and IR7 are devoted to protection and collimation !
LHC Layout
IR3, IR6 and IR7 are devoted to protection and collimation !
Beam dump blocks
IR5:CMS
experiment
IR4: Radio frequency acceleration
IR6: Beam dumping system
IR3: Momentum Collimation (normal conducting magnets)
IR7: Collimation (normal conducting magnets)
IR8: LHC-B
experiment
IR2: ALICE
experiment
IR1: ATLAS
experiment
Injection
Injection

17. Collisions, squeeze to b* 0.5 m :
Machine Aperture
ATLAS
Vertical axis :
Machine aperture in units of beam sigma (s), including alignment errors and other tolerances.
Horizontal axis :
Longitudinal position on left side of ATLAS (seen from the ring center).
450 GeV
Arc
Injection :
Aperture limit is the LHC ARCs (~ 7-8 s).
The triplet magnets in front of ATLAS/CMS are slightly behind the ARC (~ 8-9 s).
 ~5-6 s !
7 TeV, b* 0.5 m
Collisions, squeeze to b* 0.5 m :
Aperture limit is given by the triplet magnets in front of ATLAS/CMS (~ 8 s)..
 ~6 s !
Triplet
The aperture of the CMS vacuum chamber is large (in s !), impacts from lost protons near CMS due to failures will occur most likely in the triplet magnets or nearby collimators !

18. Multi-turn failures
In case of failures that ‘build’ up over a number of turns, the experiments will profit from the protection of the machine systems (in particular BLMs) :
In the majority of the cases, the losses will appear next to the aperture limiting collimators and absorbers. Dedicated BLMs monitor the beam losses at those location.
If it comes to the worst, beam losses will appear at the triplet magnets, which should sooner or later trigger the nearby BLMs.
The CMS should be protected by the machine protection systems.
Question to be investigated:
Are the thresholds of the machine detection systems adequate for CMS?
Since for the machine we try to prevent quenches that can be triggered with very little beam (energy depositions of ~10 mJ/cm3), the answer is probably yes – but need to check some time !

19. Injection - Probing with Beam
For the LHC ring, rather than implementing a highly complex surveillance of all equipment to ensure there will be not dramatic failure during the injection process, we verify the correctness of machine settings directly with beam :
1 – If no beam is circulating in a ring, only injection of a safe beam is allowed:
By definition the safe beam is below damage threshold.
Even if the entire injection is lost due to a wrong setting, there will be no equipment damage.
2 – Injection of an ‘unsafe’ beam is only allowed if beam is circulating in the ring:
Since a beam is circulating, the injection of the high(er) intensity will not lead to a loss over a single turn.
The lifetime of the high(er) intensity beam may be poor, but this leaves time for beam loss monitors …to react.
 This scheme is implemented directly in the BIS hardware !

20. Injection – ‘Normal’ sequence
The ‘normal’ injection into a ring is expected to be:
Inject a single bunch into the empty machine.
Check parameters etc… and ensure that it circulates with reasonable lifetime. The intensity of the bunch will be in the range of 5x109 (pilot). But one cannot exclude that with experience with inject more intense nominal bunches of 1011 protons.
Inject an intermediate beam of ~ 12 bunches.
Once the low intensity circulates, inject this higher intensity to fine tune parameters, adjust/check collimators and protection devices etc.
Once the machine is in good shape, switch to nominal injections.
For every injection with intensity above 1012 protons, some beam must be circulating – see rule from previous slide !
It is clear that the details may change with experience etc…

21. Injection – safe beam definition
The injection sequence described in the previous slide & the BIS ensure that one cannot loose a high intensity injection into a magnet etc…
For the LHC machine:
A beam is safe at injection if the intensity < 1012 protons
(Possible) consequences for CMS:
Even tough most injections will start with lower intensity (≤ 1011 p) and a surveillance of machine settings etc will be put in place, it is a priori possible that some day a beam of 1012 protons is shot directly into CMS during the injection process.
Questions:
Does the impact of 1012 protons over an area of 1 mm2 lead to damage when the detector is OFF ? When the detector is ON ?
If YES, what is the maximum intensity that can be tolerated ?

22. Dumping the beam : abort gap
The LHC bunch structure contains a 3 ms long particle free beam abort gap to allow the LHC dump kickers to raise their field to the correct strength for extraction.
Kicker field/voltage
Beam abort gap

23. Present estimate for erratic (unsynchronized) dump kicker tiggers:
Clean beam dump
Strength of kicker and septum magnets must match the beam energy:
Safe energy measurement based on the current of the magnets !
Dump kicker must be synchronized to the abort gap:
Accurate and reliable synchronization.
Abort gap must be free of particles.
Present estimate for erratic (unsynchronized) dump kicker tiggers:
~ 1 /year

24. Dump sweep protection
Large graphite absorbers (TCDS and TCDQ) protect downstream elements (including the dump septa themselves) against badly ‘kicked’ particles.
Kicker (MKD)
Extraction septa (MSD)
H-plane
The TCDQ absorber downstream of the dump kickers will be positioned to protect machine elements from the dump sweep. The TCDQ will be positioned at to shadow the apertures  distance of 8-10s during most operational phases.

25. Dump sweep issues for CMS
For a correctly places TCDQ absorber, all beam in the abort gap or any bunch that is swept by an asynchronous dump trigger will be intercepted.
In the early days of LHC (i.e. when the positions are yet well defined) or in case a small gap opens up in the protection, it is possible that 1-2 bunches escape the TCDQ and hit the triplet magnets or the tertiary collimators in front of them.
Questions:
Does the particle shower do to the impact of 1 or 2 bunches of protons into the triplet/tertiary collimators lead to damage when the detector is ON ?
Note that this issue is also critical for the triplet itself – so the machine has strong interest to avoid such failures !