1IPAC May 2010

Initial Experience with the Machine Protection System for LHC

Rüdiger Schmidt R.Assmann, B.Dehning, M.Ferro-Luzzi, B.Goddard, M.Lamont, A.Siemko,

J.Uythoven, J.Wenninger, M.Zerlauth

• LHC cycle and machine protectionLHC cycle and machine protection

• Strategy for machine protectionStrategy for machine protection

• Commissioning Commissioning

• Operational experienceOperational experience

• ConclusionsConclusionsIPAC May 2010 Kyotov1.

1

2IPAC May 2010

3IPAC May 2010

0.0010

0.0100

0.1000

1.0000

10.0000

100.0000

1000.0000

100 1000 10000Momentum [GeV/c]

En

erg

y st

ore

d in

th

e b

eam

[M

J]

LHC injectionnominal

TEVATRON

LHC one nominal bunch at injection

SPSCNGS

SPSmaterial tests

SPSppbar collider

LHC one nominal bunch

at 3.5 TeV

LHC Injection at 450 GeV/c

LHC Physics at 3.5 TeV/c

setup beam flag

LHC 7 TeV/cenergy nominal

beam

Energy stored in one LHC beam

6 cm

A B D C

Today

4IPAC May 2010 IPAC May 2010 Kyotov1.1

5IPAC May 2010

LHC operational cycle and machine protectioin

0

1000

1500

2000

2500

3000

3500

-4000 2000 4000

time from start of injection (s)

Ene

rgy

[GeV

/c]

500

-2000

Injection: 13 bunches from SPS per beam (21010)

energy ramp 10 kJ 100 kJ

circulating beam

coast (100 kJ)

circulating beam

beam dump ~100 kJ

Nominal: 2808 bunches per beam (1.151011)

6IPAC May 2010

0

1000

1500

2000

2500

3000

3500

-4000 2000 4000

time from start of injection (s)

Ene

rgy

[GeV

/c]

500

-2000

Injection: 13 bunches from SPS per beam (21010)

energy ramp 10 kJ 100 kJ

circulating beam

coast (100 kJ)

circulating beam

beam dump ~100 kJ

Injection: Without quenching magnets or causing damage No kick by injection kicker of circulating beam (correct synchronisation)Injection protection absorber in place in case of kicker failure

7IPAC May 2010

0

1000

1500

2000

2500

3000

3500

-4000 2000 4000

time from start of injection (s)

Ene

rgy

[GeV

/c]

500

-2000

Injection: 13 bunches from SPS per beam (21010)

energy ramp 10 kJ 100 kJ

circulating beam

coast (100 kJ)

circulating beam

beam dump ~100 kJ

Circulating beam: In case of failure, detect failure and extract beam into dump block for some failures within a few turns

No accidental firing of a kicker magnet

8IPAC May 2010

0

1000

1500

2000

2500

3000

3500

-4000 2000 4000

time from start of injection (s)

Ene

rgy

[GeV

/c]

500

-2000

Injection: 13 bunches from SPS per beam (21010)

energy ramp 10 kJ 100 kJ

circulating beam

coast (100 kJ)

circulating beam

beam dump ~100 kJ

Extraction: Beams must ALWAYS be extracted into beam dump block Kicker rise must be synchronised with the 3 µs long beam abort gapAbort gap must be clean of particles

9IPAC May 2010

Strategy for machine protection

Early detection of equipment failures triggering beam dump request.– Powering Interlocks: failures in powering system (quench, PC trip,..) – Fast Magnet Current change Monitor

Monitoring of beams to detect abnormal beam conditions and triggering dump request, down to a single machine turn. – Beam Loss Monitors and Beam Position Monitors

Reliable transmission of dump requests to beam dumping system and stop injection + extraction from SPS– Beam Interlock Systems

Reliable operation of beam dumping system, safely extracting beams onto the external dump blocks. – Beam Dumping System

Definition of LHC aperture by collimators, to limit beam losses to (warm) collimator regions.– Beam Cleaning System

Passive protection by absorbers and collimators for specific failure cases.– Beam Absorbers

MOPEB045

WEPEB069

WEPEB073

TUPEB063

TUOAMH01

10IPAC May 2010

Architecture of the Beam and Powering Interlocks

Beam Interlock SystemBeam

Dumping System

Injection Interlockand SPS extraction

PoweringInterlocks

superconducting magnets

PoweringInterlocks

normal conducting magnets

Quench protection system PS

(20000 channels)

Power Converters

~1600

AUG

UPS

Power Converters

Magnets

Fast Magnet Current

Monitors

Cryogenicssome 10000

channels

RFSystem

LHCExperiments

Beam LossMonitors

BCM

CollimationSystem

Jaw PositionTemperature

Screens and Mirrorsbeam

observation

Access System

VacuumSystem

Beam loss monitors

BLM

SpecialBLMs

Monitorsaperture

limits(some 100)

Monitors in arcs

(several 1000)

Timing System (Post Mortem

Trigger)

Operator Buttons

CCC

SafeMachine

Parameter

SoftwareInterlockSystem

Safe Beam Parameter

Distribution

SafeBeamFlag

BPMs

11IPAC May 2010

Steps in commissioning of machine protection

• Before starting beam operation, check interlocks from all system (as far as possible)

• Start with low intensity beam (no risk of damage)

• Commissioning the beam dump system at different energies

• Commissioning the beam cleaning system (80 collimators) at different energies, and for different optics

• Specific tests with beam (Machine Protection tests)

• Analyse operation (for all beam dumps and for beam losses not leading to a beam dump)

• Early commissioning: masking of interlocks– setup beam flag: when energy density is below critical value

• Exceed the stored energy of the setup beam flag (“safe beam”) – masking automatically removed

• Get confidence in machine protection to go to higher intensity

12IPAC May 2010

Commissioning of the beam dump system

• Beam dumps done at different energy, to demonstrate that bunches are correctly extracted via a 700 m long line into the dump block

• To reduce the energy density on the dump block, beam is “painted” by fast deflection of two families of kicker dilution magnets

• A 3 µs abort gap for the switch-on of the extraction kicker field allows loss free extraction under normal operating conditions.

• Some asynchronous beam dumps are expected. Collimators are installed to capture beam that is deflected with a small angle. Tests with de-bunched beam: particles in abort gap are correctly intercepted

Beam dump of 10 bunches, beam spots on screen (measurement and expected centres) in front of beam dump block

13IPAC May 2010

Collimator setup

•

• Cleaning efficiency depends jaw centring on beam, accuracy of gap size and jaw parallelism with respect to beam. The collimators are aligned during the different operational phases (injection, top energy, etc.)

• Excellent performance, no beam induced quench. The efficiency is measured by driving the beam on a resonance.

Betatron cleaningMomentum cleaningAlice CMSATLAS LHCbBeam dumpRF

red line: BLM thresholds

14IPAC May 2010

04/21/23

Early detection of powering failures (FMCM OFF)

• With low intensity beam, the monitor was disabled and a trip of the power converter triggered

• A trip of normal conducting magnets close to the experiments is most critical (fastest beam loss)

• The beam position changed, and beam loss monitors close to collimators recorded the loss and triggered a beam dump

• Redundant protection is required, by measuring voltage drops in the circuit within less than one ms

Position change of ~1.5 mm within 250 turns (25 ms)

Beam position over 1000 turns at one BPM

15IPAC May 2010

Early detection of powering failures (FMCM ON)

• The Fast Magnet Current change Monitor (FMCM) to detect fast powering failures was enabled

• The test was repeated

• The beam was dumped, before any effect on the beam position was visible

• No beam losses were detected

• The redundant protection works. This is an example that we try to use for all possible failures

• Very sensitive in case of problems with the electrical network (a number of beam dumps)

no position change

Beam position over 1000 turns at one BPM

16IPAC May 2010

Software Interlock System

Provides additional protection for complex but less critical conditions (e.g. surveillance of magnet currents and closed orbit)

• Example: triggered on large orbit excursion (> 12 BPMs over 6 mm for beam 2 in the horizontal plane (too large RF frequency change)

MPP - 16th April 2010 16

Threshhold

17IPAC May 2010

“Post Mortem” after beam dump

• Record all state changes from interlock systems • Record transient data for every beam dump for all

systems (beam loss, orbit, beam current, tune, hardware parameters (magnet current, collimator positions, …)

3500280 GeVFMCM RD1 LR1

18IPAC May 2010

Early experience

• Many beam dumps at injection, in general for commissioning purpose

• “False” beam dumps: if a protection system dumps the beam because of an internal failure (e.g. noise spikes, problems in connectors, …)

• About 75 beam dumps after the start of the energy ramp

• All beam dumps are understood (thanks to the interlock systems and post mortem recording)

• Not a single quench with circulating beam– Stored energy of 100 kJ with respect to 10 mJ for quenching a magnet – Cleaning system did an excellent job– Detection of failures worked very well

• Very few beam induced magnet quenches (“quenchinos”), only during injection at 450 GeV – the threshold of a quench detector was exceeded, the quench heaters fired

and quenched the magnet (without firing the magnet would have recovered)– one event: main quadrupole current in one sector 350A instead of 760A – other events: during special aperture studies

19IPAC May 2010

Conclusions

• For many Machine Protection sub-systems: Commissioning finished before LHC beam operation during hardware commissioning (all interlocks related to the magnet powering system)

• Commissioning of LHC with low intensity beams, slowly increasing the intensity, bringing up all machine protection systems

• The beam intensity where interlocks can be masked has been exceeded. LHC operates with all interlock enabled

• LHC can operate with the full machine protection system

• Operational experience and machine protection experiments demonstrated that the machine protection system works as expected, no surprises until today

• These are early days, a huge step in beam intensity is still required

• Next month(s): 1 MJoule, end of this year: >10 MJoule

20IPAC May 2010

Acknowledgements

LHC Machine Protection reflects the complexity of the LHC accelerator.

Many colleagues contributed to LHC Machine Protection. We like to thank them and are very grateful for their contributions.

21IPAC May 2010

Reserve slides

22IPAC May 2010

Beam dumps above injection energy (incl. 3.5TeV)

Reason for beam dump Dumps False dumps

Magnet Protection System 6 6

Cryogenics 6

Feedback / Magnet Protection 6

Experiments 4

Beam dynamics 5

Electrical Network 2

Beam Loss Monitor System 2 2

Beam Position Monitors 5

Beam Dumping System Internal Failure 6

Operational error 2

Dump at the end of the fill 2

Machine Protection Tests 12

Interlock systems 0 0

23IPAC May 2010

Masking interlocks during initial operation

• There are several 10 thousand interlock channels

• Start-up of such a machine is not possible without masking interlock channels– Example: commissioning of the cleaning system with all beam loss monitors

active

• BE PREPARED TO MASK (disable) interlocks!– but in a co-ordinated way

• Setup Beam Flag: interlock can be masked – it is always easy to see what interlocks are masked– when the beam becomes unsafe (stored energy above setup beam limit), the

interlock become automatically enabled

• Masking of interlocks should be considered when designing the system

24IPAC May 2010

Principles for machine protection

• Protect the machine– highest priority is to avoid equipment damage– second priority is to avoid quenching of magnets: with superconducting

magnets it requires few mJoule to quench: no beam losses in the cold part

• Protect the beam: trade-off between protection and operation– complex protection systems reduces the availability of the machine– minimise number of “false” beam dumps (beam dumps due to a failure in the

protection systems)

• Provide the evidence– if the protection systems stops operation (e.g. dumps the beam or inhibits

injection), clear diagnostics provided by the “post mortem” system– if something goes wrong (near miss or even damage), it should be possible to

understand the reason why

25IPAC May 2010

Machine protection during operational cycle

• Injection– injection of beam without quenching magnets or causing damage – no kick by injection kicker of circulating beam (correct synchronisation)

• Circulating beam– in case of failure, detect failure and extract the beam into the beam dump

block, for some failures within a few turns– no accidental firing of a kicker magnet

• The beam must ALWAYS be extracted into the beam dump block (end of fill or in case of a failure)– reliable operation of beam dumping system– kicker rise must be synchronised with the 3 µs long beam abort gap– abort gap must be clean of particles– collimators reduce beam loss in case of failure

26IPAC May 2010

Setup (Safe) Beam Flag - TRUE

• Initial beam commissioning and machine protection tests very difficult with all interlocks active

• Some interlocks can be MASKED when beams stored little energy density

27IPAC May 2010

Setup (Safe) Beam Flag - FALSE

• When stored beam energy exceeds a critical value for the stored beam energy density, all masks are removed

• If an interlock on a masked input is active => beam dump

28IPAC May 2010

Interlocks Systems: ensure time stamping

Beam Interlock SystemBeam

Dumping System

Injection InterlockPowering

Interlockssuperconducting

magnets

PoweringInterlocks

normal conducting magnets

Quench protection system PS

(20000 channels)

Power Converters

~1600

AUG

UPS

Power Converters

Magnets

Fast Magnet Current Monitor

Cryogenicssome 10000

channels

RFSystem

LHCExperiments

Beam LossMonitors

BCM

CollimationSystem

Jaw PositionTemperature

Screens and Mirrorsbeam

observation

Access System

VacuumSystem

Beam loss monitors

BLM

SpecialBLMs

Monitorsaperture

limits(some 100)

Monitors in arcs

(several 1000)

Timing System (Post Mortem

Trigger)

Operator Buttons

CCC

SafeLHC

Parameter

SoftwareInterlockSystem

Safe Beam Parameter

Distribution

SafeBeamFlag

BPMs

The interlock systems allows to identify the origin of any beam dump, and for powering failures to identify the electrical circuit that tripped

• data from several 10000 channels (50k-100k)• all data is time stamped with the same clock (beam interlocks ~

µs, powering interlocks ~ ms)

29IPAC May 2010

Powering System and interlocks

• Hardware commissioning: Ramp all magnets with current functions as during beam operation and commission all interlocks– 1700 high current powering circuits with about 10000 magnets

• Interlocks required for commissioning of the magnet powering system

• Monitors temperatures in superconducting magnet system, voltages, currents, many other parameters, ….

• Failures: quench, power converter failure, cryogenics problem, water cooling failure, UPS failure, failure in the protection systems– firing of quench heaters, extraction of energy in the circuit, stop power

converters, … AND trigger beam dump

• For some magnet circuits: beam dump, for other circuits: no beam dump– can be configured for each circuit– main dipole and quadrupole magnets: always dump beams in case of failure– example: orbit correctors in the arc not (yet) included in the systems that

dump the beam