interlock and protection systems for sc accelerators: machine protection system for the lhc

Interlock and Protection Systems for SC Accelerators:Machine Protection System for the LHC

The Risks The Challenge The LHC Layout The Systems for Protection The Glue

The impact of LHC Machine Protection has been recently discussed at the LHC Workshop in Chamonix 15-19 January, and I will use some of the material that has been presented

(contributions from O.Brüning, H.Burkhardt, E.Carlier, H.Mess, R.Lauckner, M.Lomperski, F.Rodriguez-Mateos)

R.Schmidt - Villars 30/01/2001

p. 230/01/2001 R.Schmidt, Villars

Energy in two LHC Beams: 700 MJ

– Two systems, one for each beam

Energy in dipole magnets (one sector): 1.3 GJ– Eight systems in the LHC

Energy in quadrupole magnets (one sector): 40 MJ – Sixteen systems in the LHC

Energy in 600 A circuits (i.e. chromaticity correction): 10-100 kJ– Some 100 systems

In total about 11 GJ

50 tons at 600 km/h = heating + melting of 950 kg copper

180 kg at 40-120 km/h

3 * 10000 kg at 200 km/h

The Risks: Energy in Magnets and Beams


LHC magnets operate at 1.9 K - Little enthalpy - Temperature margin about 1.4 K

Nominal beam intensity : 3 * 1014 Protons / beam

Energy at 7 TeV to quench a dipole magnet corresponds to about 10 7 Protons

Energy at 450 GeV to quench a dipole magnet corresponds to about 10 9 Protons

Energy to quench a superconducting dipole magnet is small

First beam tests with one bunch, very low intensity, below quench threshold

Beam Monitors must work for such parameters


The beam can leave in a very short time….

Beam energy

Magnet energy

SPS + RF

EDF via PC

LHC Experiments (10 hours)Collimation System (10 hours)Magnets / Cryogenics (10 hours)LHC BEAM DUMPS (2 Systems) 89 micro.seconds

Back to PC (20 min)Magnets / Cryogenics(some 100 ms for quench)LHC POWER DUMPSsome 100 systems(2 min)

Time constants: 23 micro.sec 20 minutes Time constants: 10 hours 89 micro.sec

Time constants: 20 minutes

BEAM DUMPTRIGGER

- Published in Chamonix 20001 Workshop - (O.Brüning)

Power trip of power converter for D1 warm separation magnet– in collision the beam would start to suffer after 5 turns (2 mm orbit displacement)

Wrong functioning of the damper for injection oscillations and instabilities– at injection energy the beam would start to suffer after 6 turns

Power trip of power converter for one of the warm quadrupoles in the collimation section– in collision the beam would start to suffer after 18 turns

Quench of one main dipole magnet– in collision the beam would start to suffer after 280 turns

The energy in the LHC magnet system corresponds to about 20000 tons of snow, sliding down by about about 600 m

…….the bad news: an energy release can be easily triggered by some innocent (ski)-operator

…… the good news: LHC operators are far away from the LHC tunnel

The LHC machine need protection systems, but….

Machine Protection is not an objective in itself, it is to

maximise operational availability by minimising down-time (quench, repairs) avoid expensive repair of equipment and irreparable damage

Side effects from LHC Machine Protection System compromising

operational efficiency must be minimised

operational availability versus equipment safety

0

10

20

30

40

50

60

70

80

90

100

0 1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 9 0 1 00

machine safety

op

eratio

nal availab

ilit

y [

%]

Downtime dominated by too complex Protection Systems

Downtime for repairs due to insufficient protection systems


LHC Machine Protection is to...

Prevent an uncontrolled release of stored energy, thus avoiding: damage of equipment unnecessary down-time - example: BEAM DUMP to avoid quenches

and will include: tools for consistent error and fault tracing ……. POST MORTEM

Related topic:– access and interlock system to protect people is separate system, however, there are links between the access system and

the machine protection

Sector

Continuous Cryostat/Cryoline Superconducting bus-bars runthrough cryostat connecting magnets.Current feeds at extreme ends.

Other central insertion elementseg. Low Betas, separator dipoles, matching

COLD (<2K) 2.9km

WARM500m

1

5

DC Power feed

3

Oct

ant

DC Power

Main Arc FODO cellscontaining; main dipoles andquadrupoles, chromaticity sextupoles, octupoles, tuning and skew quadrupoles, spool pieces,orbit correctors

End of Continuous Cryostatcontaining; dispersion suppressors,Some of the matching section, and the electrical feedbox.

2

4 6

8

7LHC27 km Circumference

LHC is divided into 8 Sectors

Slide from P.Proudlock


LHC Machine Protection = Integration of systems

The interlocks deal with the integration of systems into the LHC MACHINE PROTECTION SYSTEM,……, with the glue that links systems such as:

BEAM DUMP SYSTEM BEAM LOSS MONITOR SYSTEM QUENCH PROTECTION and POWERING SYSTEM BEAM CLEANING SYSTEM (two long straight section for collimators) Access, RF, Vacuum, Collimators, Warm magnets, Experiments, ….

and an architecture of the MACHINE INTERLOCK SYSTEM is required


They “lazy” approach …can we copy another system ?

FERMILAB - TEVATRON operates since more than 15 years DESY - HERA operates since more than10 years BNL - RHIC operates since less than 2 years (evolution of FERMILAB system)

=> No major accidents during operation

LHC is specific: energy much larger many more components powering of the machine in sectors very different from other machines time constants involved together with energy require different solutions

After visits to FERMILAB, BNL, and DESY (…+ K.H.Mess - associate from DESY here for one year) a systems is proposed with an different architecture, but with using some ideas from BNL and HERA


With respect to BEAM OPERATION: Energy stored in beams

Fault detected => BEAM ABORT, beam is directed into BEAM DUMP BLOCK

Two systems - one BEAM DUMP SYSTEM for each beam

With respect to POWERING: Energy stored in magnets of one cryostat:

Fault detected => POWER ABORT, and most of the magnetic energy is dumped into ENERGY EXTRACATION RESISTORS

four large such systems for each sector - 2 for MB, 1 for QF, 1 for QD (in total 32) some hundred smaller (600 A) systems around the LHC

Electrical circuits in one continuous cryostat independent from circuits in other cryostats

String II - Commissioning of Power and Magnet Interlock System soon

Separation of POWER ABORT and BEAM ABORT


Architecture of Power Permit in one LHC sector

LHC-B T Q4D2 Q5 Arc Q4D2 T Atlas

DFBX DFBM DFBM DFBA DFBA DFBM DFBX

QP

PPC

PC

QP

18

Slide from K.H.Mess

Architecture of BEAM PERMIT in the LHC

Pt.1

Pt.2

Pt.3

Pt.4

Pt.5

Pt.6

Pt.7

Pt.8ATLAS

CMS

LHC-BALICE

Momentumcleaning

RFBeam Dump

Betatroncleaning

BEAM 1clockwise

BEAM 2counter-clockwise

InjectionBEAM II from SPS

InjectionBEAM I from SPS

BEAM DUMPCONTROLLERS

Beam Permit Loopsoptical fibre at 10 MHz

BPC

BPC

BPC

BPC

BPC

BPC

BPCBPCBPC BPC

BPCBPCBPCBPC BPC

BPC

BPC

BPC

BPC

BPC

BPC

BPC

BEAM PERMIT CONTROLLER

p. 14

Timing system

power in from UPS

BEAM PERMITCONTROLLER

ALL CIRCUITS OK

Link to Control system

BEAM PERMIT LOOPS

CRITICAL CIRCUITS OK

PPC arc cryostat

PPC triplet cryostat

PPC Q3 cryostat

PPC Q4 cryostat

PPC Q6 cryostat

PPC Q4D2 cryostat

Signals fromCRYOSTATPOWER PERMIT CONTROLLERS

Signals fromsubsystems to give BEAM PERMISSIONand ABORT

Machine Status

Other systemsBeam LossAccessExperimentsVacuumRFBEAM DUMPInjectionWarm magnets


With respect to POWERING

CIRCUITS connecting magnets with LARGE amount of stored energyQuenches propagate to magnets in other circuits

=> All power in continuous cryostat will be switched off after detecting a quench

CIRCUITS connecting magnets with SMALL amount of stored energy=> In the (unlikely) case of a quench, only the corresponding circuit is de-excited

With respect to BEAM OPERATION

CIRCUITS that are very critical for operation with beam Fault always causes total beam loss

=> In case of a fault - always BEAM DUMP

CIRCUITS that are less critical for operation with beamFault might cause beam losses, depending on machine status: energy, beam intensity..

=> In case of fault - BEAM DUMP IF ……other conditions are met / not met

Classification of electrical circuits

BEAM PERMIT / ABORT for the entire LHC accelerator– Fast system - the beam can be dumped in a few turns

– BEAM PERMIT CONTROLLERS (BPC) linked via optical fibres with 10 MHz signal (fast data

transmission)– Absence of BEAM PERMIT triggers BEAM DUMP– 16 BEAM PERMIT CONTROLLERS are required– Input from variety of systems, such as powering and protection, access, BLM, vacuum, and others

POWER PERMIT / ABORT for each continuous cryostat– System is less fast, the power is extracted in several seconds– Impact beams after some 10 ms - therefore more time to react

– About 48 POWER PERMIT CONTROLLERS (PPC) are required, one per cryostat (two for long arc cryostat)

– Links in tunnel could be via current loop and non-critical communication between controllers via control system

Some Parameters of the Protection Systems

p. 1730/01/2001 R.Schmidt, Villars p. 17

sector

alcove

IP

Quench loop (current loop)

Power converter

Power status link possibly via WORLD FIP

HEATER ACTIVATION Link

BEAM PERMIT LOOPS (one for each beam)

IP

Orbit corrector link (possibly via WORLD FIP)

BPC

Quenchdetector

PMC

Heater powersupply

severalPPC

Inputs fromother systems

Power converter

Heater powersupply

Quenchdetector

BPC PMCseveralPPC PMC

alcove

PMC BPC PMCseveralPPC

Inputs fromother systems

BPC PMCseveralPPC

Post Mortem Link

a c c e l e r a t o r t u n n e l

Information links for Machine Protection System


Beam loss due to trip of power converter for orbit corrector

0

5 00

1 000

1 5 00

2 000

2 5 00

3 000

3 5 00

4 000

0.00 20.00 40.00 60.00 80.00 100.00

time [ms]

beam position

helium temperature

corrector current

beam current

radiation monitors

quench signal

beam abort

Post Mortem Diagnostics MUST be a part of the system- Artist view of the requirement


Summary of architecture for the machine protection

General Separation of BEAM PERMIT and POWER PERMIT Separation of POWER PERMITS for cryostats - one (two for arcs) PPC per cryostat Diagnostics after fault is integral part of the system

Classification of Electrical Circuits Powering: Main circuits (CRYOSTAT POWER ABORT) and auxiliary circuits (CRYOSTAT POWER

FAULT) Beam Operation: CRITICAL CIRCUITS and LESS CRITICAL CIRCUITS

Inventory About 60 electronics crates Two fast links for BEAM ABORT with optical fibres (plus some reserve fibres) Several slower links for POWER ABORT, possibly using current loops Fail-safe links, and input signals to electronics


Outlook

Require POWER PERMIT CONTROLLER for first sector (octant) test in 2004– Functional Specification for Summer 2001– Start development of hardware by this Summer

Require full functionality of BEAM PERMIT CONTROLLER for 2006– Functional Specification for End of 2001– Possibly reduced functionality for 2004 (injection test)

POST MORTEM Facilities to be defined– Some definitions BEFORE electronics development starts– Unique CLOCK required

How to use beam loss monitor systems to request BEAM DUMP?– Studies continuing...


With respect to BEAM OPERATION

Energy stored in beams to be safely deposited with BEAM DUMP SYSTEM

BEAM ABORT - POWER ABORT

Beam energy

Magnet energy

SPS + RF

EDF via PC

LHC Experiments (10 hours)Collimation System (10 hours)Magnets / Cryogenics (10 hours)LHC BEAM DUMPS (2 Systems) 89 micro.seconds

Back to PC (20 min)Magnets / Cryogenics(some 100 ms for quench)LHC POWER DUMPSsome 100 systems(2 min)

Time constants: 23 micro.sec 20 minutes Time constants: 10 hours 89 micro.sec

Time constants: 20 minutes

BEAM DUMPTRIGGER

With respect to POWERING

Energy stored in magnets to be safely deposited with POWER DUMP SYSTEM

Both systems are largely independent

No signals from BEAM DUMP SYSTEM to POWER DUMP SYSTEM Signal from POWER DUMP SYSTEM to BEAM DUMP SYSTEM in case of power fault

Beam energy

SPS + RF

EDF via PCLHC Experiments (10 hours)

Collimation System (10 hours)

Magnets/Cryogenics (10 hours)

LHC BEAM DUMPS (2 Systems) 89 micro.seconds

Back to PC (20 min)

Magnets / Cryogenics(some 100 ms for quench)

LHC POWER DUMPSsome 100 systems(2 min)

Time constants: 10 hours 89 micro.sec

BEAM DUMPTRIGGER

Magnet energy

p. 22

Timing system

power from UPS


Main circuitQuench detectors

Cryostat POWER ABORT

Correctorpower converter

DischargeSwitch

Main MBpower converter

DISCHARGESWITCH MB

Quench detectorlocal

selected HEATERfire Trigger

DischargeSwitch OpenFault

HEATER ACTIVATION LINK

CircuitStatusCircuit Status

power from UPS

CryoOK

Post Mortem trigger

Up to 40 ofsuch circuits


AccessOK

PC Fault

AccessOK

PC PERMIT

PC FaultCircuitStatusCircuit Status

Correctorpower converter Circuit Status

Quench Loop


PC Fault

AccessOK

Discharge Request


CircuitStatus

Circuit Status

Quench Loop

MQF MQD

MQF MQD



DISCHARGESWITCH MB

DischargeSwitch Trigger



CircuitStatus

Circuit Status

Quench Loop

Quench detectors


Quench LoopQuench detectors

Circuit Status

Circuit Status

Interface toBEAM PERMITCONTROLLER

POWER PERMITControllerodd point




POWER PERMITController even point

PC FAST ABORT

PC FAST ABORT

PC PERMIT

ProtectionOK

Timing system


CryoOK

Post Mortem trigger

AccessOK

ProtectionOK


Heater Power supplies


ALL CIRCUITSOK



ALL CIRCUITSOK


Sector left part Sector right part

PC SLOW ABORT

PC Fault

AccessOK

PC PERMIT

PC FAST ABORT

PC SLOW ABORT

PC SLOW ABORT

MQMpower converter

PC Fault

AccessOK

PC FAST ABORT

PC PERMIT

PC SLOW ABORT


DischargeSwitch




PC Fault

AccessOK

PC PERMIT





PC FAST ABORT

PC SLOW ABORT

PC Fault

AccessOK

PC PERMIT

PC FAST ABORT

PC SLOW ABORT

MQMpower converter

PC Fault

AccessOK

PC FAST ABORT

PC PERMIT

PC SLOW ABORT

Tunnel

p. 23

Timing system

power from UPS





DischargeSwitch


DISCHARGESWITCH MB






CryoOK

Post Mortem trigger



AccessOK

PC Fault

AccessOK

PC PERMIT



Quench Loop


PC Fault

AccessOK

Discharge Request


CircuitStatus

Circuit Status

Quench Loop

MQF MQD

MQF MQD

Quench detectors






PC FAST ABORT

PC FAST ABORT

PC PERMIT

ProtectionOK



ALL CIRCUITSOK


Sector left part

PC SLOW ABORT

PC Fault

AccessOK

PC PERMIT

PC FAST ABORT

PC SLOW ABORT

PC SLOW ABORT

MQMpower converter

PC Fault

AccessOK

PC FAST ABORT

PC PERMIT

PC SLOW ABORT


Interfaces between BPC and PPC to other systems

POWER PERMIT CONTROLLERS

Interfaces for Interlocks Power Converters Quench Protection System Cryogenic System Access System Beam Permit System

Interfaces for Services Control System Timing System Power Supply for electronics Post Mortem System

BEAM PERMIT CONTROLLERS

Interfaces for Interlocks POWER PERMIT CONTROLLERS Beam Loss Monitors and other BI Beam Dump System Collimators RF System Vacuum System Experiments Injection System Access System

Interfaces for Services Control System Timing System Power Supply for electronics Machine Status (Energy, Current, ..) Post Mortem System


….and what concerns the interface between Machine Protection and LHC Experiments

Next Milestone - 2004 - the Experiments will not be concerned, however, since time passes….

Risk analysis for the experiments– How could large fraction of the beam hit the experiments? – What would be the consequence?– How to avoid such accidents?

BEAM ABORT signals from the experiments– One BEAM ABORT stops the LHC for at least 2 hours

Hardware interfaces - what signals should be exchanged?

Initially one representative for all 4 experiments could follow discussions on Machine Protection. For specific topics, other representatives from the experiments could attend. To be re-considered at a later date.

Timing system

power from UPS





DischargeSwitch


DISCHARGESWITCH MB






CryoOK

Post Mortem trigger



AccessOK

PC Fault

AccessOK

PC PERMIT



Quench Loop


PC Fault

AccessOK

Discharge Request


CircuitStatus

Circuit Status

Quench Loop

MQF MQD

MQF MQD

Quench detectors






PC FAST ABORT

PC FAST ABORT

PC PERMIT

ProtectionOK

CableWaterOK(to be discussed)



ALL CIRCUITSOK


Sector left part

PC SLOW ABORT

PC Fault

AccessOK

PC PERMIT

PC FAST ABORT

PC SLOW ABORT

PC SLOW ABORT

MQMpower converter

PC Fault

AccessOK

PC FAST ABORT

PC PERMIT

PC SLOW ABORT

p. 26

BEAM PERMIT CONTROLLERChannel Name Conditional Bit pattern Nr

0 RF system YES 0 0 0 0 0 01 Beam Loss monitors I YES 0 0 0 0 1 12 Beam Loss monitors II YES 0 0 0 1 0 23 Beam excursion (?) YES 0 0 0 1 1 34 arc cryostat - ALL CIRCUITS OK YES 0 0 1 0 0 45 triplet cryostat - ALL CIRCUITS OK YES 0 0 1 0 1 56 Q3 cryostat - ALL CIRCUITS OK YES 0 0 1 1 0 67 Q4 cryostat - ALL CIRCUITS OK YES 0 0 1 1 1 78 Q5 cryostat - ALL CIRCUITS OK YES 0 1 0 0 0 89 Q6 cryostat - ALL CIRCUITS OK YES 0 1 0 0 1 9

10 Q4D2 cryostat - ALL CIRCUITS OK YES 0 1 0 1 0 1011 spare YES 0 1 0 1 1 1112 spare YES 0 1 1 0 0 1213 spare YES 0 1 1 0 1 1314 spare YES 0 1 1 1 0 1415 spare YES 0 1 1 1 1 1516 Experiments NO 1 0 0 0 0 1617 Warm magnets NO 1 0 0 0 1 1718 Access system NO 1 0 0 1 0 1819 Extraction system NO 1 0 0 1 1 1920 arc cryostat - CRITICAL CIRCUITS OK NO 1 0 1 0 0 2021 triplet cryostat - CRITICAL CIRCUITS OK NO 1 0 1 0 1 2122 Q3 cryostat - CRITICAL CIRCUITS OK NO 1 0 1 1 0 2223 Q4 cryostat - CRITICAL CIRCUITS OK NO 1 0 1 1 1 2324 Q5 cryostat - CRITICAL CIRCUITS OK NO 1 1 0 0 0 2425 Q6 cryostat - CRITICAL CIRCUITS OK NO 1 1 0 0 1 2526 Q4D2 cryostat - CRITICAL CIRCUITS OK NO 1 1 0 1 0 2627 Collimators NO 1 1 0 1 1 2728 Beam Loss monitors at collimators NO 1 1 1 0 0 2829 Vacuum valves beam I NO 1 1 1 0 1 2930 Vacuum valves beam II NO 1 1 1 1 0 3031 spare NO 1 1 1 1 1 31 p. 27


How fast does the beam has to be dumped?

Quench in one MB magnet at top current– massive quench in a dipole magnet due to beam loss would lead to an orbit change of 2 mm in 20 ms (see EXCEL

calculation), assuming beta = 100 m - beam dump in the order of 10 ms. Quench in other magnets

– quadrupole quenches lead to betratron tune change

– sextupole quenches lead to change of chromaticity - beam loss and instabilities Loss of RF - de-bunching of the beam

– action in some hundred milliseconds Access door forced or emergency button pushed

– less than one second Beam loss monitor indicates too large losses

– assuming integration time of 5 ms, activation of the beam dump should be in the order of 1 ms Experiments dump the beam - to be discussed with the experiments Main Power converter failure

– depends on the power converter, but a fast action before the current decays substantially would always make sure that the beam is lost in a controlled way

Other systems (cryogenics, vacuum, …) - to be discussed


Example for Classification

All main circuits are considered to be critical The final list of critical circuits will be established (much) later, and could be

modified during LHC beam operation

Classification of some electrical circuits in continuous arc cryostat

PRELIMINARY !

Name Description Main circuit Critical circuitCryostat POWER ABORT

Unconditional BEAM ABORT

MB Main dipoles YES YESMQ Main quadrupole YES YES

MQM Matching quadrupoles YES YESMS Chromaticity sextupoles NO YES

MQTL Tuning quadrupoles, long depends dependsMQT Tuning quadrupoles, short NO dependsMCS "Spool piece" sextupoles NO NOMCD "Spool piece" decapoles NO NOMCO "Spool piece" octupoles NO NOMO Octupoles NO NO

MCB Orbit corrector dipoles NO NO

– Enable: A system that allows to switch on (equipment interlock system)- power converters- beam injection enable- other systems and test modes - to be defined

this is in general not time critical and includes many systems (eg. Cryogenics)

– A system that stops beam - BEAM ABORT- beam dumps (as fast as technical possible - see Oliver)

this is VERY time critical and must be fail safe, and includes less systems

– A system that stops power - POWER ABORT- fire quench protection heaters (local action) - act on power converter (10ms - 1s)- open energy extraction switches (10ms - 1s)- discharge circuits (time constants between 1 and 104 seconds)

this is time critical and must be fail-safe (failure could lead to heavy equipment damage)

– A system recording the data for post-mortem analysis of any ABORT- Clear diagnostics (example - get info MB 112 in sector 5 quenched)

Three-Fold Functionality

p. 30

interlock and protection systems for sc accelerators: machine protection system for the lhc

Documents