CERN: Machine Protection Systems

Machine Protection –
A Future Safety System?
B. Todd ISSC 2010 August 2010

Thanks to : TE/MPE/MI, A. Schauf, ISSC, J. Joyce, L, Fabre, et al.

long– 60 minutes – 1v5

CERN
CERN
Founded in 1954 20 Member States
Funded by the European Union …most of the EU…
8 Observer States and Organisations
580 Institutes World Wide …Japan, Russia, USA…
2500 Staff
35 Non-Member States
8000 Visiting Scientists …Australia, Canada, New Zealand…

Conseil Européen pour la Recherche Nucléaire
European Centre for Nuclear Research

Pure Science – Particle Physics

1. Pushing the boundaries of research, physics beyond the standard model.
2. Advancing frontiers of technology.
3. Forming collaborations through science
4. Educating the scientists and engineers of tomorrow

benjamin.todd@cern.ch Machine Protection – A Future Safety System?

CERN

We use the world’s largest and most complex scientific instruments to
study the basic constituents of matter.

These instruments are particle accelerators and detectors.
Accelerators boost beams of particles to high energies before they are
made to collide with each other or with stationary targets.
Detectors observe and record the results of these collisions.

Our flag-ship project is the Large Hadron Collider…

benjamin.todd@cern.ch
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 4

CERN
CERN Accelerator Complex CERN
Lake Geneva

Geneva
Airport

CERN LAB 2 (France)

CERN LAB 1 (Switzerland)


CERN
Lake Geneva
Large Hadron Collider
(LHC)

Geneva
Airport

CERN LAB 2 (France)

Super Proton Synchrotron
(SPS)

Proton Synchrotron
27km long (PS)
150m underground CERN LAB 1 (Switzerland)


CERN
Lake Geneva
(LHC)

Geneva
Airport

CERN LAB 2 (France)

(SPS)

Proton Synchrotron
(PS)


CERN Accelerator Complex
Lake Geneva
(LHC)

Geneva
Airport

CERN LAB 2 (France)

(SPS)

Proton Synchrotron
(PS)

CERN
Lake Geneva
(LHC)

Geneva
Airport

CERN LAB 2 (France)

(SPS)

Proton Synchrotron
Injector complex (PS)
1e12 protons per injection CERN LAB 1 (Switzerland)
2808 injections per beam…

CERN
CERN Accelerator Complex
Lake Geneva
(LHC)

Geneva
Airport

CERN LAB 2 (France)

(SPS)

Proton Synchrotron
(PS)


CERN
Beam Dumping Systems
(LHC)

~ 9 km
~ 5.5 miles Beam-2 Transfer Line
(TI8)
(SPS)

Beam-1 Transfer Line (TI2)
100us for one turn,
benjamin.todd@cern.ch Machine Protection
CERN, the LHC and Machine Protection – A Future Safety System? 12 of 23

CERN

CMS

LHC-b

ALICE

ATLAS


CERN
ATLAS – A Toroidal LHC ApparatuS


CERN


CERN
Why the LHC?
material costs of the LHC and experiments ≈$4 billion

The Higgs Boson
Gravity is such a weak force – can it be explained?

Dark Matter / Energy
96% of mass in the universe is unaccounted for
Do Weakly Interacting Massive Particles (WIMPs) account for this?

Beyond the Standard Model
String Theory / Super Symmetry / Super String Theory / A Theory of Everything?

We need some clues!

collide two beams…
high intensity = more ‘events’ LHC Beam Intensity = 3 x 1014 p
high energy = more massive particles possible LHC Energy = 7 TeV

[11]

CERN
Collisions
~109 proton-proton collisions per second

Massive amounts of data generated – all must be processed
new particles are rare – only a few events per day [3]

CERN
Technological Challenges
…To see the rarest events…
LHC needs high luminosity of 1034 [cm-2s-1]
Collisions generate
3 x 1014 p per beam
particle fluence near machine PetaBytes of data
demands radiation-tolerant electronics Per year
… to get 7 TeV operation…
LHC needs 8.3 Tesla dipole fields with circumference of 27 kms (16.5 miles)
World’s largest
… to get 8.3 Tesla …
machine
LHC needs super-conducting magnets <2 K (-271 C)
with an operational current of ≈13kA
cooled in super fluid helium 1 ppm
maintained in a vacuum
10x less pressure than
on moon surface
Stored energy per beam is 360 MJ
Stored energy in the magnet circuits is 9 GJ
A magnet will QUENCH
two orders of magnitude with milliJoule
higher than others deposited energy
[11]

CERN

Kinetic Energy of 200m Train at 155 km/h ≈ 360 MJ

Picture source: http://en.wikipedia.org/wiki/File:Alstom_AGV_Cerhenice_img_0365.jpg
[11]
Shared as: http://creativecommons.org/licenses/by-sa/3.0/deed.en


CERN

Kinetic Energy of 200m Train at 155 km/h ≈ 360 MJ
Kinetic Energy of Aircraft Carrier at 50 km/h ≈ 9 GJ

Picture source: http://militarytimes.com/blogs/scoopdeck/2010/07/07/the-airstrike-that-never-happened/
[11]
Shared as: public domain


CERN
Machine protection – a fundamental requirement to realise LHC

I would argue:

LHC stored energies are game-changing
far above prior machines
machine protection mindset had to rapidly evolve to address the new risks

keeping pace, but only now are we starting to formalise how we tackle challenges like LHC

We’re defining what we’ve done after the fact.
Similar in a way: electronic systems in passenger vehicles?

LHC’s most comparable predecessor / competitor :

The TEVATRON = p+p- accelerator / collider in Fermilab, USA.

[11]

CERN
Protection Functions

Beam Protection: Beam Energy Beam Dump

100x energy of TEVATRON
0.000005% of beam lost into a magnet = quench
0.005% beam lost into magnet = damage

Failure in protection – complete loss of LHC is possible

Powering Protection: Magnet Energy Emergency Discharge

10-20x energy per magnet of TEVATRON
magnet quenched = hours downtime
many magnets quenched = days downtime
magnet damaged = $1 million, months downtime
many magnets damaged = many millions, many months downtime (few spares)


CERN




Concrete
Beam is ‘painted’
Shielding
diameter 35cm

8m long absorber Graphite
= 800 C


CERN




unacceptable beam dump
danger exists completed

DETECT COMMUNICATE SYNCHRONISE ABORT

>80 us <150 us <90 us 90 us

Plant / Sensor Beam Interlock System Beam Dump

To protect against fastest failure modes ≈ 400 µs over 27km

CERN
LHC is (just) the first machine with these energy risks
High Energy Physics community is learning to deal with the challenges

I think:
• System-safety ideas, concepts and approaches should be absorbed by CERN

LHC is its own prototype:
• systems involved protection are unique
• certain technologies used have never been tried on this scale before

My mission:
• rigorous development of machine protection as if it were a safety system
• Could our argument-based approach be accepted by system-safety?

I can argue that the MPS is fit for purpose


CERN

It took more than ten years to address all of the issues for the LHC…

• prior knowledge

• assumptions

• simulations

• failure cases

• solutions for every failure case

• testing

• Implementation

• verification

And we’re still learning…


CERN
LHC Equipment and Control System

Vacuum Example:
• maintain correct pressure

Plant Systems:
Fulfill operational requirements Sensors Plant
Actuators
Vacuum Vacuum Pump
Pressure Speed Control [11]

CERN

Vacuum Example:
• maintain correct pressure
• bad pressure = close valves

Vacuum Vacuum Valve
Pressure Actuator
Plant Protection: Plant
Ensure plant stays within limits Protection

Plant Systems:
Fulfill operational requirements Sensors Plant
Actuators
Vacuum Vacuum Pump
Pressure Speed Control [11]

CERN

Vacuum Vacuum Valve
Pressure Actuator
Plant Systems: Plant
Ensure plant stays within limits Protection
Fulfill operational requirements Sensors Actuators

Plant

• Sensors, Actuators and Process may be combined
• No rules regarding combination Vacuum Pump
• Must meet functional requirement Speed Control [11]

CERN
Personnel Safety System: Access Beam
doors absorbers
People in perimeter – stop machine
personnel safe
• cannot be merged with plants Safety
but machine at risk
• Must meet legal requirement

Plant
Protection
Sensors Actuators

Plant

[11]

CERN

Safety

Beam
Machine Protection System: Protection
Prevent damage to machine
Prevent undue stress to components Powering
Protection

•No rules regarding implementation
• Must meet functional requirement

Plant
Protection
Sensors Actuators

Plant

[11]

CERN

Safety

Beam
Prevent damage to machine
Prevent undue stress to components Powering
Protection

•No rules regarding implementation
• Must meet functional requirement Powering powering protection closely
coupled to powering plant

Plant
Protection
Sensors Actuators

Plant

[11]

CERN
Personnel Safety System:

Sensors Safety
Actuators

Beam

danger exists – extract energy
danger will exist – extract energy Powering
Protection

Powering

Protection
Sensors Actuators

Plant

[11]

CERN
Personnel Safety System:

Sensors Safety
Actuators

Beam

danger exists – extract energy
danger will exist – extract energy Powering
Protection
Beam protection inputs from
• Safety system Powering
• Plant systems
• Dedicated sensors
Protection
Sensors Actuators

Plant

[11]

CERN
The Machine Protection System Today
Control System

Discharge Circuits
Quench Protection System Radio Frequency System
Power Converters Power Essential Controllers
Interlock
Cryogenics Controllers Auxiliary Controllers
General Emergency Stop Warm Magnets
Uninterruptible Supplies Beam Television
Control Room
Powering Protection Collimation System Beam Protection
Experiments
Beam
Vacuum System Interlock Beam Interlock System Beam
System Dumping
Access System Access System System
Beam Position Monitor
Beam Lifetime Monitor Timing
Post Mortem
Fast Magnet Current Changes System

Beam Loss Monitors (Aperture)

I am responsible for BIS and SMP Beam Loss Monitors (Arc)
Software Interlock System
Design and implementation
Injection Systems

Safe Machine Parameters


CERN
The Machine Protection System Today
Control System

Discharge Circuits
Quench Protection System Radio Frequency System
Power Converters Power Essential Controllers
Interlock
Cryogenics Controllers Auxiliary Controllers
General Emergency Stop Warm Magnets
Uninterruptible Supplies Beam Television
Control Room
Collimation System
Experiments
Beam
Vacuum System Interlock Beam Interlock System Beam
System Dumping
Original Access System Access System System
Specification Beam Position Monitor
(2000)
Beam Lifetime Monitor Timing
Post Mortem
Fast Magnet Current Changes System
Current
Specification Beam Loss Monitors (Aperture)
Beam Loss Monitors (Arc)
Software Interlock System
Injection Systems

Safe Machine Parameters


CERN
The Story So Far

1994 2002 2005 2007 2008 2009 2010 2011 2012 2013

Install
LEP
magnets

CERN approves September 10th
LHC project first circulating beam
September 18th
first lesson learned

An un-considered failure mode of solder connection

2008-9 LHC closed – repair
2012 LHC closed – upgrade

Machine Protection demonstrated to be a real risk


CERN
The Story So Far

1994 2002 2005 2007 2008 2009 2010 2011 2012 2013

Install
LEP
magnets

CERN approves September 10th
September 18th
first lesson learned

not all circuits had been commissioned to 5 TeV - Final Main Dipole Circuit Commissioning
• Electrical Fault at 5.2 TeV in dipole bus bar, between quadrupole and dipole
Post-Analysis: R = 220 nΩ, nominal = 0.35nΩ
• Electrical Arc developed and punctured helium enclosure
Post-Analysis: 400 MJ dissipated in cold-mass and arcing
• Helium Release into the insulating vacuum
Post-Analysis: Pressure wave caused most damage


CERN
Magnet Protection

Magnet Interconnect


CERN
Ideal 13 kA Connection Scheme

Superconducting Cable

Tin – Silver Foils

Cross Section View

Longditudinal View – filled with Solder

Copper Superconducting
Stabiliser Cable


CERN
Observed Interconnections


CERN
Magnet Protection


CERN
Incident location

Dipole Bus bar


CERN
Pressure wave

PT
QV QV SV QV SV QV QV

Q D D D Q D D D Q D D D Q D D D Q

Cold-mass
Vacuum vessel 1. Pressure Wave propagates inside insulation Vacuum enclosure
Line E
Cold support post
Warm Jack 2. Rapid Pressure Rise
Compensator/Bellows
Vacuum barrier Self actuating relief valves could not handle pressure
Design: 2Kg He/s Incident: ~20 kg He/s

3. Forces on the vacuum barriers (every second cell)
Design: 1.5 bar Incident: ~8 bar
• Several Quadrupoles Displaced by ~50 cm
• Cryogenic line connections damaged
• Vacuum to atmospheric pressure

CERN
Collateral Damage
Quadrupole-dipole interconnection

Quadrupole support
Main Damage Area: 700m

• 39 dipoles and 14 quadrupoles effected
• moved to surface:
• 37 replaced and 16 repaired


CERN
LHC repair and consolidation
14 quadrupole 39 dipole magnets 204 electrical Over 4km of vacuum
magnets replaced replaced interconnections repaired beam tube cleaned

New longitudinal restraining Almost 900 new helium 6500 new detectors and 250km cables
system for 50 quadrupoles pressure release ports for new Quench Protection System to
protect from busbar quenches
Future Damage Limitation


CERN
The Story So Far

1994 2002 2005 2007 2008 2009 2010 2011 2012 2013

Install
LEP 3.5 TeV
magnets

CERN approves September 10th Repair
September 18th
first lesson learned November 30th
1.18 TeV

November 23rd
450 GeV

November 20th
second startup


CERN

1994 2002 2005 2007 2008 2009 2010 2011 2012 2013

Install
LEP 3.5 TeV
magnets

CERN approves September 10th Repair
September 18th
1.18 TeV

November 23rd
450 GeV

November 20th
second startup


CERN
The Story So Far

1994 2002 2005 2007 2008 2009 2010 2011 2012 2013

Install
LEP 3.5 TeV 7.0 TeV
magnets

CERN approves September 10th Repair Upgrade
September 18th
1.18 TeV

November 23rd
450 GeV

November 20th
second startup


CERN
Dump Statistics January-August 2010
increase of beam energy as machine protection is commissioned ≈770 triggers to date
Within this: one mission abort due to
Beam Interlock System fail-safe
Beam Loss
Others Detected
17% 23%

Control Room
16%
Beam Position
Incorrect
12%
Software
Interlock
8% Beam Dump
Self Trigger
Powering
14%
System Fault
10%


CERN
The Future – Linear Accelerators

CLIC – Compact LInear Collider
ILC – International Linear Collider

LHC results = electron / positron collider required for detailed study

CERN is designing CLIC machine protection
Various Institutes designing ILC machine protection

Only one of these likely to be built – depends on what LHC discovers

• logical next step for physics
• specification to be finished circa 2015
• > $10 Billion machines
• 30-50 km long
• beam energy densities 1000x higher than previous e-e+ machines
• beam energy 10000x above component damage limit


CERN

(LHC)

Compact Linear Collider
(CLIC)


CERN
The Future – ITER
ITER – International Thermonuclear Experimental Reactor

many synergies with LHC challenges
CERN is consulting on the design of the ITER Machine Protection…

• first steps of 50-year plan
• prove / disprove fusion feasibility for commercialisation
• > $10 Billion machine
• > 100 GJ of stored magnetic energy
• 500MW of fusion for 1000 seconds vs state-of-the-art:
16MW of fusion for 1 second (Joint European Torus)

Tritium – Deuterium Fusion
Deuterium Tritium Neutron Helium

+ → + + Energy

[11]

CERN
The Future – ITER

many synergies with LHC challenges
CERN is consulting on the design of the ITER Machine Protection…

• first steps of 50-year plan
• prove / disprove fusion feasibility for commercialisation
• > $10 Billion machine
• > 100 GJ of stored magnetic energy
• 500MW of fusion for 1000 seconds vs state-of-the-art:
16MW of fusion for 1 second (Joint European Torus)

Tritium – Deuterium Fusion
Deuterium Tritium Neutron Helium

+ → + + Energy

[11]

CERN
The Future – ITER

Safety– prevent Tritium release
Protection– protect the reactor
Plant– protect the sub-systems

Safety

Protection

Plant
Protection
Sensors Actuators

Plant

[11]

CERN
The Future – ITER


Safety

Protection

Plant
Protection
Sensors Actuators

Plant

[11]

CERN
The Future – ITER


Safety

Protection Initial study:
Machine protection
can veto plant protection
Plant
Protection • Shutdown in sequence
Sensors Actuators • Sacrifice one to save another
Plant

[11]

CERN
The Future – ITER


Safety

Protection Initial study:
Machine protection
can veto plant protection
Plant
Protection ΔT • Shutdown in sequence
Sensors Actuators • Sacrifice one to save another
Plant

Or delay plant protection?

[11]

CERN
My Mission
LHC is its own prototype, a unique machine, ≈30 years in the making
• key protection systems involved are one-of-a-kind
• Installations are very large
• Shut down a 27km machine in less than 0.5 milliseconds
• Electronically harsh machine environment (B, E, radiation fields)
• stored energies are far higher than in previous machines
• LHC is the first machine with such massive built-in destruction potential
• cost of failure is extreme
• we have used an argument based approach to address machine protection

Future machines will be bigger, more powerful, more challenging
• protection already critical factor, even in first design drafts

High Energy Physics community is already dealing with the challenges
But technology is ahead of safety: this is formalising what we’ve already done.

My mission:
• rigorous development of machine protection as if it were a safety system.
• Keep the deep-thinking approach, incorporate system-safety techniques
• certification. Wishful thinking?

stake-holders could demand some “compliance” from us to insure their investment.

CERN

“Machine Protection – A Future Safety System?”

an open question to your community

Thank you for your attention


CERN: Machine Protection Systems

More Related Content

What's hot

Similar to CERN: Machine Protection Systems

Recently uploaded

CERN: Machine Protection Systems