1. Machine Protection Issues for LHCb
Jörg Wenninger
AB-OP-SPS
Co-chair LHC Machine Protection Working Group
Introduction
Circulating beam failures
Injection and dump failures
Summary
Sept 2008
LHCb - J. Wenninger

2. The Machine Protection challenge
A factor 2 in magnetic field
A factor 7 in beam energy
A factor 200 in stored energy
Sept 2008
LHCb - J. Wenninger

3. Machine Protection Organization
Since 2001 the Machine Protection Working Group (MPWG) deals with all machine protection related issues of the LHC and the SPS. All MP sub-system experts are members of the MPWG.
>> For any question or worry about machine protection please ask for advice from the MPWG !!
The MPWG will now be reorganized into a new ‘body’ responsible for the operational aspects of MP at the LHC.
Sept 2008
LHCb - J. Wenninger

4. Machine Protection @ LHC
Protection of the machine will play a prime role in operation of the LHC:
360 MJ stored energy versus ~10 mJ/cm3 to quench a magnet
~200 kJ beam may damage accelerator components (magnets)
We already quenched a dipole with a direct impact of 3.5109 p at 450 GeV…
To ensure that the LHC can be operate safely :
Detailed studies of failure scenarios were used to assess if the machine is adequately protected. This effort is still ongoing…
The LHC is equipped with an unprecedented number of active and passive protection elements.
LHC machine protection was tailored for the machine, but always keeping in mind that it must also protect the experiments !
Sept 2008
LHCb - J. Wenninger

5. LHC Machine Protection Systems
The LHC machine protection system is subdivided into:
Interlock System
‘Type’
Reaction
time
Protects…
Comments
Powering Interlock System
(PIC)
PLC
~ 4 ms
Magnets
Already required without beam.
Interfaces to BIS.
Beam Interlock Systems (BIS)
VME
~ ms
Entire LHC
Interfaces to beam dump and injection systems.
270 ms from dump request to last proton out !
LHCb interlocks enter here !
Software Interlock System
(SIS)
Software
(JAVA)
~ second
‘Across-system’ interlocks.
Complex interlocks.
‘Auxiliary’ interlock system.
Sept 2008
LHCb - J. Wenninger

6. MP Commissioning Status
Following the various LHC schedule changes, the dedicated ~1-2 month FULL machine checkout period has vanished :
Replaced by ‘piece-wise’ checkout in parallel with Hardware Commissioning.
>> Complicates integration tests of sub-systems.
>> Complicates commissioning of some machine protection sub-systems.
Commissioning of the MP system is progressing rapidly.
>>All MP inputs required for low intensity operation will be ready for Sept. 10th.
Parts of the MP system can only be commissioned with beam: collimators, absorbers, beam instruments for MP…
>> Beam related MP commissioning will follow the overall LHC commissioning.
Sept 2008
LHCb - J. Wenninger

7. Active protection systems have no time to react !
Failure categories
In the event a failure or unacceptable beam lifetime, the beam must be dumped immediately and safely into the beam dump block.
Two main classes for failures:
Passive protection
- Failure prevention (high reliability systems).
Intercept beam with collimators and absorber blocks.
Active protection systems have no time to react !
Beam loss over a single turn
during injection, beam dump or any other fast ‘kick’.
Active Protection
- Failure detection (by beam and/or equipment monitoring) with fast reaction time (< 1 ms).
- Fire beam dumping system
Beam loss over multiple turns
due to many types of failures.
Fastest failures >= ~ 10 turns
Sept 2008
LHCb - J. Wenninger

8. Circulating Beam Failures - Multiple Turns
Sept 2008
LHCb - J. Wenninger

9. Timescales for Failures
Time to ‘impact’
Operational
‘mistakes’
10000 turns
= 0.89 s
1000 turns
100 turns
Quenches
Normal conducting magnet
powering failures
10 turns
1 turn
= 89 ms
Kicker magnets (injection, dump)
Sept 2008
LHCb - J. Wenninger

10. Main active protection devices
Type
Time scale
Comment
PC interlocking
10’s of milliseconds
All PCs, except low current orbit correctors.
Quench protection
10’s of milliseconds
Time scale depend on B field and quench type.
FMCM*
0.1-1 millisecond
Fast detection of powering failures.
Installed on the most critical magnet circuits.
Beam loss monitor (BLM)
40 ms
~ 4000 monitors installed on every quadrupole and every collimator.
Independent interlock levels on loss rates averaged from 40 ms to 5 seconds.
Beam position monitor (BPM)
89 ms
Fast interlock on position changes.
8 monitors.
(*) Fast Magnet Current change Monitor
Sept 2008
LHCb - J. Wenninger

11. Collimation system – passive protection
The LHC is equipped with a multi-stage halo cleaning (collimation) system to protect the magnets from beam induced quenches.
Halo particles are first scattered by the primary collimator (closest to the beam). The scattered particles (the secondary halo) are absorbed by secondary collimators, or scattered to form the tertiary halo.
 the collimators have an key role for protection as they define the aperture.
 the ‘distance to beam’ (retraction) hierarchy must always be respected.
 contrary to TEVATRON and HERA the LHC cannot be operated without collimators as soon as ~few permill of the nominal beam intensity is stored !
Primary
collimator
Secondary
collimators
Absorbers
Protection
devices
Tertiary
Triplet
magnets
Experiment
Beam
halo particle
Secondary halo
Tertiary halo
+ hadronic showers
hadronic showers
Sept 2008
LHCb - J. Wenninger

12. Timescales Time 10000 turns = 0.89 s 1000 turns 100 turns 10 turns
Operational
‘mistakes’
1000 turns
100 turns
Quench
protection
Quenches
Powering
interlocks
10 turns
NC magnet
powering failures
FMCM
1 turn
= 89 ms
Kicker
magnets
BPMs
BLMs
Absorbers
Sept 2008
LHCb - J. Wenninger

13. ‘Global’ failures
Almost all perturbations due to failures (typically magnet powering, an injection or dump failure) affect the entire machine.
To first order the amplitude of the perturbation at any place in the ring is proportional to the beam size s and to a phase factor, i.e. :
Amplitude ~ s cos(phase)
>>> The parameter that defines if an element is likely to be hit is not the physical distance to the beam, but the distance in units of beam size.
>>> Since at the LHC the collimators must ALWAYS define the aperture, one of the collimators is always the first elements that is hit by the beam:
 Dump triggered by BLMs at or downstream of collimator(s).
Sept 2008
LHCb - J. Wenninger

14. IR8 physical aperture
Sept 2008
LHCb - J. Wenninger

15. Beam aperture
The standard LHC beam aperture model includes mechanical tolerances, alignment errors, orbit tolerances, magnetic errors etc.
>> The net aperture after subtraction of all clearances is normalized by the beam size and expressed in ‘n1’ units, n1 being the primary collimator setting (in beam s) required to ensure that the aperture is beyond the beam halo of the secondary collimators.
Example : for a SC magnet where n1=10, it is possible to set the primary collimators to 10s before risking a quench of the magnet due to halo particles (assuming an properly setup collimation system !!).
Sept 2008
LHCb - J. Wenninger

16. IR8 normalized aperture at injection
ARCs are the aperture limit (n1 ~7s).
The triplet magnets are slightly behind the ARC.
The primary collimator opening must be set ~5-6 s to protect the ‘cold’ arc aperture.
When it is retracted VELO is well protected … by the triplets !
30 mm
Triplets
IP8
Arcs
Sept 2008
LHCb - J. Wenninger

17. Beam sizes
During the energy ramp, the beam size shrinks but the optics is not changed, and n1 scales with E.
During the betatron squeeze, the beam size decreases at the IP and increases in the triplet magnets, reducing the aperture near the IR.
>> This is due to the fact that phase space is conserved, a smaller size means more divergence and therefore a larger size in the next quadrupole (triplets).
Sept 2008
LHCb - J. Wenninger

18. IR8 normalized aperture at 7 TeV
5 mm,
perfectly centered
At 5 mm from the beam, VELO remains behind the triplet aperture.
For b* = 2 m, the triplets define the apertures in IR8. Tertiary collimators are necessary to protect the triplet magnets (quench from halo and failures).
For global perturbations of the beam parameters, VELO is in the shadow of machine elements (Arc magnets, triplets).
Sept 2008
LHCb - J. Wenninger

19. Measured Apertures IR7 IR8
So far the measurements show that mechanical apertures of the 2 tested sectors (23 & 78) are as designed.
IR8
IR7
Sept 2008
LHCb - J. Wenninger

20. ‘Orbit bumps’ x s Local orbit bumps are commonly used in rings for :
Crossing angles.
Separation of the beam at the IP.
Spectrometer bumps !
Etc…
Issues with bumps:
Large local excursions : ‘break’ global protection mechanisms.
Mostly an issue at injection: the vacuum chamber can be reached ~ everywhere.
Protection/mitigation:
Even the fastest bumps take few seconds (to minutes) to bring the beam to the aperture, which leaves time for loss monitors to react and dump the beam.
>> Fast loss detection system is also recommended for all exps.
At injection energy, current limits will be set for the orbit correctors to limit the range of bumps. The experiments vacuum chambers / VELO must be out of range of bumps. s x
Corrector magnet
Sept 2008
LHCb - J. Wenninger

21. Comments on ‘stable beams’
A common misconceptions is to believe that during the ‘Stable beams’ phase which corresponds to experiments data taking, the beam is … stable !!!
During the ~12 hours of colliding beams, one observes :
Thermal effects on warm magnets that affect beam parameters.
Orbit drifts (~ 1s equivalent over 12 hours at LHC) due to ground motion and tides.
Beam parameters drifts due to the intensity decay.
Etc…
Changes are either corrected manually or by automated feedback (orbit drift).
The distinction between a ‘dangerous’ and a beneficial change one is usually only given by… the amplitude:
>> Operational errors can happen during stable beams, but they very slow compared to the most severe failures.
Sept 2008
LHCb - J. Wenninger

22. Kicker Failures
Sept 2008
LHCb - J. Wenninger

23. Overview injection/extraction
Same principle for injection and extraction:
“kicker” magnets: fast rise time, much less than one turn, large (~ mrad) angles
Septa magnets: two apertures with different magnetic fields
Injection:
Beam 1: IR2
Beam 2: IR8
Extraction:
Both beams in IR 6
Injection and extraction lead to single turn failures !!
Sept 2008
LHCb - J. Wenninger

24. Injection into an empty ring
Injection can be risky when a ring is empty, since one must be sure that all magnet settings are adequate to avoid immediate loss.
The LHC injection schema, implemented by hardware signals, is based on the following principle:
>> Injection logic:
- If beam is present (> ~ 2x109 p), any beam intensity may be injected.
- If no beam is detected, the maximum intensity that can be injected is
> p for regular operation – present setting.
> p in dedicated periods of machine studies (as required).
This scheme is already implemented and tested.
Injection of high intensity is only allowed if some beam is already present in a ring: this ensures that conditions for injection of high intensity are sufficiently good to avoid immediate loss of the beam over the first turns.
Sept 2008
LHCb - J. Wenninger

25. Injection layout
Beam is coming in from the TI2 (IR2) and TI8 (IR8) transfer lines (both ~ 3km).
Injection in 2 steps:
Septum magnet (MSI) provides a horizontal deflection to bring the injected beam parallel to the circulating beam.
The injection kicker magnet (MKI) provides a vertical deflection to bring the injection beam on the orbit of the circulating beam.
TDI and TCDD absorbers protect against damage from MKI failures.
MKI
MSI
TDI
TCDD
Transfer Line TI8
Sept 2008
LHCb - J. Wenninger

26. Injection kicker failures
TDI absorber opening ~ beam sigma – interlocks injection.
TDI protects against kicker misfiring (for example erratic discharges  kick the circulating beam), up to nominal intensity.
TDI is critical for multi-bunch injection/operation.
>> MKI misfiring could lead to high rates from showers in LHCb, but not to direct impact.
TDI absorber
nominal
beam axis
MKI
4 m
+- (7-8) s
Ramp and collisions:
TDI is opened during the ramp.
MKI interlocking only allows operation at GeV.
>> MKI is locked off above 452 GeV (+ will be switched off).
Sept 2008
LHCb - J. Wenninger

27. Beam Dumping System Septum magnet deflecting the extracted beam MSD
H-V kicker for painting the beam
Q5L
Beam Dump Block
Q4L
15 kicker magnets
MKD
about 700 m
Q4R
about 500 m
Q5R
Beam 2
Sept 2008
LHCb - J. Wenninger

28. Requirements for a ‘clean’ dump
The extraction kicker rise time
must coincide with the 3 ms long
particle free abort gap.
The abort gap must be free of
particles: measurement & cleaning
(if needed)
The kicker setting must match the beam energy (‘Energy Tracking’). Energy tracking errors are among the worst failures for the LHC, the system is therefore highly redundant.
Abort gap
Sept 2008
LHCb - J. Wenninger

29. Dump sweep: asynchronous dump
When the kicker rise does not coincide with the abort gap (‘asynchronous dump’) the bunched are swept out over all amplitudes. Protection against DAMAGE due to such events (expected ~ 1 / year):
Moveable graphite absorber TCDQ (7 m), plus normal collimator (TCS) downstream from the kicker.
Tertiary collimators protect the triplets (mainly IR5) against beam leaking out of absorbers + coll.
>>> IR8 is rather well protected, since beam 1 must pass the collimation section in IR7 before reaching IR8.
Sept 2008
LHCb - J. Wenninger

30. Summary : failures that may affect LHCb / I
During injection large settings errors of dipoles/correctors can lead to direct beam impact in the vicinity of or into LHCb. Protection/mitigation :
Surveillance of magnet currents.
Limit on the intensity that may be injected into an empty ring.
During injection showers from beams hitting the TDI (or also the transfer line dumps) can reach LHCb – has already happened.
With circulating beam LHCb/VELO is protected from direct impact due to global failures by collimators and by the triplets, but could be affected by showers from triplets.
Local orbit bumps could bring the beam very close to LHCb/VELO at injection (most likely impact on triplets).
Bumps will be limited in amplitude by surveillance of corrector currents.
Sept 2008
LHCb - J. Wenninger

31. Summary : failures that may affect LHCb / II
Early collisions & data taking at 450 GeV come with a number of solvable MP issues for the experiments.
Bumps must be limited in amplitude by surveillance of corrector currents.
For collisions at 450 GeV a special locking procedure for the injection kicker will have to be put in place. The TDI must remain in place (background??).
For LHCb the risk/possibility of moving VELO towards the beam for collisions at 450 GeV must be evaluated.
There is an issue for the interlocking of movable devices since it does NOT allow moving detectors towards the beam at 450 GeV.
Sept 2008
LHCb - J. Wenninger

32. Settings errors
30 mm
A special case of failures at injection are (large) setting errors of separation dipoles (D1/D2) or orbit correctors close an IR:
Beam may be deflected directly into the detectors.
Detailed study for LHCb by R. Appleby (TS/LEA) – will be published soon.
Cures/mitigation :
Limit intensity injected into an empty ring (see previous slides).
Current surveillance of the critical magnets (by Software Interlock System) – in place.
V plane
30 mm
H plane
Sept 2008
LHCb - J. Wenninger

33. Injection kicker setup
Injection kicker OFF, TDI closed : beam hits upper edge of TDI.
Injection kicker ON, TDI closed : beam should be ~ on nominal beam axis. 1
TDI absorber
Min. gap = 3 mm
nominal
beam axis
MKI
Max. offset = +-3 mm 2
4 m
Sept 2008
LHCb - J. Wenninger

34. Showers into LHCb TDI absorber MKI 4 m
Weekend , sector 78 test:
After a period of few hours without beam, when the first beam came back, it was displaced vertically and hit near the TDI gap:
>> showers/beam leaked into LHCb – beam cut by LHCb.
Problem was ‘cured’ by moving the gap from +3 mm to -3 mm…
Due to control system issues we were not yet able to set the jaws with an angle to close the gap.
TDI absorber
Min. gap = 3 mm
nominal
beam axis
MKI
Max. offset = +-3 mm
4 m
Sept 2008
LHCb - J. Wenninger