The document discusses machine protection systems at CERN, specifically for the Large Hadron Collider (LHC). It notes that the LHC poses unprecedented technological challenges due to its immense stored energies, far higher than prior particle accelerators. CERN had to develop rigorous machine protection approaches to address risks like magnet quenches or beam losses that could damage the accelerator. The LHC's machine protection system draws inputs from various systems like personnel safety, plant systems, and dedicated sensors to rapidly detect and respond to potential dangers in order to protect the expensive machine. After over ten years of work, CERN has established comprehensive protection functions but continues improving its approaches for operating the high-risk LHC safely.
Handwritten Text Recognition for manuscripts and early printed texts
CERN: Machine Protection Systems
1.
2. Machine Protection –
A Future Safety System?
B. Todd ISSC 2010 August 2010
Thanks to : TE/MPE/MI, A. Schauf, ISSC, J. Joyce, L, Fabre, et al.
long– 60 minutes – 1v5
3. CERN
CERN
Founded in 1954 20 Member States
Funded by the European Union …most of the EU…
8 Observer States and Organisations
580 Institutes World Wide …Japan, Russia, USA…
2500 Staff
35 Non-Member States
8000 Visiting Scientists …Australia, Canada, New Zealand…
Conseil Européen pour la Recherche Nucléaire
European Centre for Nuclear Research
Pure Science – Particle Physics
1. Pushing the boundaries of research, physics beyond the standard model.
2. Advancing frontiers of technology.
3. Forming collaborations through science
4. Educating the scientists and engineers of tomorrow
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
4. CERN
We use the world’s largest and most complex scientific instruments to
study the basic constituents of matter.
These instruments are particle accelerators and detectors.
Accelerators boost beams of particles to high energies before they are
made to collide with each other or with stationary targets.
Detectors observe and record the results of these collisions.
Our flag-ship project is the Large Hadron Collider…
benjamin.todd@cern.ch
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 4
6. CERN
CERN Accelerator Complex CERN
Lake Geneva
Large Hadron Collider
(LHC)
Geneva
Airport
CERN LAB 2 (France)
Super Proton Synchrotron
(SPS)
Proton Synchrotron
27km long (PS)
150m underground CERN LAB 1 (Switzerland)
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
7. CERN
CERN Accelerator Complex CERN
Lake Geneva
Large Hadron Collider
(LHC)
Geneva
Airport
CERN LAB 2 (France)
Super Proton Synchrotron
(SPS)
Proton Synchrotron
(PS)
CERN LAB 1 (Switzerland)
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
8. CERN Accelerator Complex
Lake Geneva
Large Hadron Collider
(LHC)
Geneva
Airport
CERN LAB 2 (France)
Super Proton Synchrotron
(SPS)
Proton Synchrotron
(PS)
CERN LAB 1 (Switzerland)
9. CERN
CERN Accelerator Complex CERN
Lake Geneva
Large Hadron Collider
(LHC)
Geneva
Airport
CERN LAB 2 (France)
Super Proton Synchrotron
(SPS)
Proton Synchrotron
Injector complex (PS)
1e12 protons per injection CERN LAB 1 (Switzerland)
2808 injections per beam…
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
10. CERN
CERN Accelerator Complex
Lake Geneva
Large Hadron Collider
(LHC)
Geneva
Airport
CERN LAB 2 (France)
Super Proton Synchrotron
(SPS)
Proton Synchrotron
(PS)
CERN LAB 1 (Switzerland)
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
11. CERN
CERN Accelerator Complex CERN
Lake Geneva
Large Hadron Collider
(LHC)
Geneva
Airport
CERN LAB 2 (France)
Super Proton Synchrotron
(SPS)
Proton Synchrotron
(PS)
CERN LAB 1 (Switzerland)
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
12. CERN
CERN Accelerator Complex CERN
Beam Dumping Systems
Large Hadron Collider
(LHC)
~ 9 km
~ 5.5 miles Beam-2 Transfer Line
(TI8)
Super Proton Synchrotron
(SPS)
Beam-1 Transfer Line (TI2)
100us for one turn,
benjamin.todd@cern.ch Machine Protection
CERN, the LHC and Machine Protection – A Future Safety System? 12 of 23
13. CERN
CERN Accelerator Complex CERN
CMS
LHC-b
ALICE
ATLAS
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
14. CERN
ATLAS – A Toroidal LHC ApparatuS
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 14
15. CERN
ATLAS – A Toroidal LHC ApparatuS
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 15
17. CERN
Why the LHC?
material costs of the LHC and experiments ≈$4 billion
The Higgs Boson
Gravity is such a weak force – can it be explained?
Dark Matter / Energy
96% of mass in the universe is unaccounted for
Do Weakly Interacting Massive Particles (WIMPs) account for this?
Beyond the Standard Model
String Theory / Super Symmetry / Super String Theory / A Theory of Everything?
We need some clues!
collide two beams…
high intensity = more ‘events’ LHC Beam Intensity = 3 x 1014 p
high energy = more massive particles possible LHC Energy = 7 TeV
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 17
18. CERN
Collisions
~109 proton-proton collisions per second
Massive amounts of data generated – all must be processed
new particles are rare – only a few events per day [3]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 18
19. CERN
Technological Challenges
…To see the rarest events…
LHC needs high luminosity of 1034 [cm-2s-1]
Collisions generate
3 x 1014 p per beam
particle fluence near machine PetaBytes of data
demands radiation-tolerant electronics Per year
… to get 7 TeV operation…
LHC needs 8.3 Tesla dipole fields with circumference of 27 kms (16.5 miles)
World’s largest
… to get 8.3 Tesla …
machine
LHC needs super-conducting magnets <2 K (-271 C)
with an operational current of ≈13kA
cooled in super fluid helium 1 ppm
maintained in a vacuum
10x less pressure than
on moon surface
Stored energy per beam is 360 MJ
Stored energy in the magnet circuits is 9 GJ
A magnet will QUENCH
two orders of magnitude with milliJoule
higher than others deposited energy
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 19
20. CERN
Technological Challenges
Kinetic Energy of 200m Train at 155 km/h ≈ 360 MJ
Stored energy per beam is 360 MJ
Stored energy in the magnet circuits is 9 GJ
Picture source: http://en.wikipedia.org/wiki/File:Alstom_AGV_Cerhenice_img_0365.jpg
[11]
Shared as: http://creativecommons.org/licenses/by-sa/3.0/deed.en
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 20
21. CERN
Technological Challenges
Kinetic Energy of 200m Train at 155 km/h ≈ 360 MJ
Stored energy per beam is 360 MJ
Stored energy in the magnet circuits is 9 GJ
Kinetic Energy of Aircraft Carrier at 50 km/h ≈ 9 GJ
Picture source: http://militarytimes.com/blogs/scoopdeck/2010/07/07/the-airstrike-that-never-happened/
[11]
Shared as: public domain
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 21
22. CERN
Technological Challenges
Machine protection – a fundamental requirement to realise LHC
I would argue:
LHC stored energies are game-changing
far above prior machines
machine protection mindset had to rapidly evolve to address the new risks
keeping pace, but only now are we starting to formalise how we tackle challenges like LHC
We’re defining what we’ve done after the fact.
Similar in a way: electronic systems in passenger vehicles?
LHC’s most comparable predecessor / competitor :
The TEVATRON = p+p- accelerator / collider in Fermilab, USA.
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 22
23. CERN
Protection Functions
Beam Protection: Beam Energy Beam Dump
100x energy of TEVATRON
0.000005% of beam lost into a magnet = quench
0.005% beam lost into magnet = damage
Failure in protection – complete loss of LHC is possible
Powering Protection: Magnet Energy Emergency Discharge
10-20x energy per magnet of TEVATRON
magnet quenched = hours downtime
many magnets quenched = days downtime
magnet damaged = $1 million, months downtime
many magnets damaged = many millions, many months downtime (few spares)
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 23
24. CERN
Protection Functions
Beam Protection: Beam Energy Beam Dump
100x energy of TEVATRON
0.000005% of beam lost into a magnet = quench
0.005% beam lost into magnet = damage
Failure in protection – complete loss of LHC is possible
Concrete
Beam is ‘painted’
Shielding
diameter 35cm
8m long absorber Graphite
= 800 C
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 24
25. CERN
Protection Functions
Beam Protection: Beam Energy Beam Dump
100x energy of TEVATRON
0.000005% of beam lost into a magnet = quench
0.005% beam lost into magnet = damage
Failure in protection – complete loss of LHC is possible
unacceptable beam dump
danger exists completed
DETECT COMMUNICATE SYNCHRONISE ABORT
>80 us <150 us <90 us 90 us
Plant / Sensor Beam Interlock System Beam Dump
To protect against fastest failure modes ≈ 400 µs over 27km
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 25
26. CERN
Protection Functions
LHC is (just) the first machine with these energy risks
High Energy Physics community is learning to deal with the challenges
I think:
• System-safety ideas, concepts and approaches should be absorbed by CERN
LHC is its own prototype:
• systems involved protection are unique
• certain technologies used have never been tried on this scale before
My mission:
• rigorous development of machine protection as if it were a safety system
• Could our argument-based approach be accepted by system-safety?
I can argue that the MPS is fit for purpose
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 26
27. CERN
Protection Functions
It took more than ten years to address all of the issues for the LHC…
• prior knowledge
• assumptions
• simulations
• failure cases
• solutions for every failure case
• testing
• Implementation
• verification
And we’re still learning…
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 27
28. CERN
LHC Equipment and Control System
Vacuum Example:
• maintain correct pressure
Plant Systems:
Fulfill operational requirements Sensors Plant
Actuators
Vacuum Vacuum Pump
Pressure Speed Control [11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 28
29. CERN
LHC Equipment and Control System
Vacuum Example:
• maintain correct pressure
• bad pressure = close valves
Vacuum Vacuum Valve
Pressure Actuator
Plant Protection: Plant
Ensure plant stays within limits Protection
Plant Systems:
Fulfill operational requirements Sensors Plant
Actuators
Vacuum Vacuum Pump
Pressure Speed Control [11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 29
30. CERN
LHC Equipment and Control System
Vacuum Vacuum Valve
Pressure Actuator
Plant Systems: Plant
Ensure plant stays within limits Protection
Fulfill operational requirements Sensors Actuators
Plant
• Sensors, Actuators and Process may be combined
• No rules regarding combination Vacuum Pump
• Must meet functional requirement Speed Control [11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 30
31. CERN
LHC Equipment and Control System
Personnel Safety System: Access Beam
doors absorbers
People in perimeter – stop machine
personnel safe
• cannot be merged with plants Safety
but machine at risk
• Must meet legal requirement
Plant
Protection
Sensors Actuators
Plant
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 31
32. CERN
LHC Equipment and Control System
Safety
Beam
Machine Protection System: Protection
Prevent damage to machine
Prevent undue stress to components Powering
Protection
•No rules regarding implementation
• Must meet functional requirement
Plant
Protection
Sensors Actuators
Plant
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 32
33. CERN
LHC Equipment and Control System
Safety
Beam
Machine Protection System: Protection
Prevent damage to machine
Prevent undue stress to components Powering
Protection
•No rules regarding implementation
• Must meet functional requirement Powering powering protection closely
coupled to powering plant
Plant
Protection
Sensors Actuators
Plant
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 33
34. CERN
LHC Equipment and Control System
Personnel Safety System:
Sensors Safety
Actuators
Beam
Machine Protection System: Protection
danger exists – extract energy
danger will exist – extract energy Powering
Protection
Powering
Plant Systems: Plant
Protection
Sensors Actuators
Plant
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 34
35. CERN
LHC Equipment and Control System
Personnel Safety System:
Sensors Safety
Actuators
Beam
Machine Protection System: Protection
danger exists – extract energy
danger will exist – extract energy Powering
Protection
Beam protection inputs from
• Safety system Powering
• Plant systems
• Dedicated sensors
Plant Systems: Plant
Protection
Sensors Actuators
Plant
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 35
36. CERN
The Machine Protection System Today
Control System
Discharge Circuits
Quench Protection System Radio Frequency System
Power Converters Power Essential Controllers
Interlock
Cryogenics Controllers Auxiliary Controllers
General Emergency Stop Warm Magnets
Uninterruptible Supplies Beam Television
Control Room
Powering Protection Collimation System Beam Protection
Experiments
Beam
Vacuum System Interlock Beam Interlock System Beam
System Dumping
Access System Access System System
Beam Position Monitor
Beam Lifetime Monitor Timing
Post Mortem
Fast Magnet Current Changes System
Beam Loss Monitors (Aperture)
I am responsible for BIS and SMP Beam Loss Monitors (Arc)
Software Interlock System
Design and implementation
Injection Systems
Safe Machine Parameters
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 36
37. CERN
The Machine Protection System Today
Control System
Discharge Circuits
Quench Protection System Radio Frequency System
Power Converters Power Essential Controllers
Interlock
Cryogenics Controllers Auxiliary Controllers
General Emergency Stop Warm Magnets
Uninterruptible Supplies Beam Television
Control Room
Collimation System
Experiments
Beam
Vacuum System Interlock Beam Interlock System Beam
System Dumping
Original Access System Access System System
Specification Beam Position Monitor
(2000)
Beam Lifetime Monitor Timing
Post Mortem
Fast Magnet Current Changes System
Current
Specification Beam Loss Monitors (Aperture)
Beam Loss Monitors (Arc)
Software Interlock System
Injection Systems
Safe Machine Parameters
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 37
38. CERN
The Story So Far
1994 2002 2005 2007 2008 2009 2010 2011 2012 2013
Install
LEP
magnets
CERN approves September 10th
LHC project first circulating beam
September 18th
first lesson learned
An un-considered failure mode of solder connection
2008-9 LHC closed – repair
2012 LHC closed – upgrade
Machine Protection demonstrated to be a real risk
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
39. CERN
The Story So Far
1994 2002 2005 2007 2008 2009 2010 2011 2012 2013
Install
LEP
magnets
CERN approves September 10th
LHC project first circulating beam
September 18th
first lesson learned
not all circuits had been commissioned to 5 TeV - Final Main Dipole Circuit Commissioning
• Electrical Fault at 5.2 TeV in dipole bus bar, between quadrupole and dipole
Post-Analysis: R = 220 nΩ, nominal = 0.35nΩ
• Electrical Arc developed and punctured helium enclosure
Post-Analysis: 400 MJ dissipated in cold-mass and arcing
• Helium Release into the insulating vacuum
Post-Analysis: Pressure wave caused most damage
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
44. CERN
Incident location
Dipole Bus bar
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
45. CERN
Pressure wave
PT
QV QV SV QV SV QV QV
Q D D D Q D D D Q D D D Q D D D Q
Cold-mass
Vacuum vessel 1. Pressure Wave propagates inside insulation Vacuum enclosure
Line E
Cold support post
Warm Jack 2. Rapid Pressure Rise
Compensator/Bellows
Vacuum barrier Self actuating relief valves could not handle pressure
Design: 2Kg He/s Incident: ~20 kg He/s
3. Forces on the vacuum barriers (every second cell)
Design: 1.5 bar Incident: ~8 bar
• Several Quadrupoles Displaced by ~50 cm
• Cryogenic line connections damaged
• Vacuum to atmospheric pressure
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
46. CERN
Collateral Damage
Quadrupole-dipole interconnection
Quadrupole support
Main Damage Area: 700m
• 39 dipoles and 14 quadrupoles effected
• moved to surface:
• 37 replaced and 16 repaired
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
47. CERN
LHC repair and consolidation
14 quadrupole 39 dipole magnets 204 electrical Over 4km of vacuum
magnets replaced replaced interconnections repaired beam tube cleaned
New longitudinal restraining Almost 900 new helium 6500 new detectors and 250km cables
system for 50 quadrupoles pressure release ports for new Quench Protection System to
protect from busbar quenches
Future Damage Limitation
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
48. CERN
The Story So Far
1994 2002 2005 2007 2008 2009 2010 2011 2012 2013
Install
LEP 3.5 TeV
magnets
CERN approves September 10th Repair
LHC project first circulating beam
September 18th
first lesson learned November 30th
1.18 TeV
November 23rd
450 GeV
November 20th
second startup
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
49. CERN
1994 2002 2005 2007 2008 2009 2010 2011 2012 2013
Install
LEP 3.5 TeV
magnets
CERN approves September 10th Repair
LHC project first circulating beam
September 18th
first lesson learned November 30th
1.18 TeV
November 23rd
450 GeV
November 20th
second startup
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
50. CERN
The Story So Far
1994 2002 2005 2007 2008 2009 2010 2011 2012 2013
Install
LEP 3.5 TeV 7.0 TeV
magnets
CERN approves September 10th Repair Upgrade
LHC project first circulating beam
September 18th
first lesson learned November 30th
1.18 TeV
November 23rd
450 GeV
November 20th
second startup
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
51. CERN
Dump Statistics January-August 2010
increase of beam energy as machine protection is commissioned ≈770 triggers to date
Within this: one mission abort due to
Beam Interlock System fail-safe
Beam Loss
Others Detected
17% 23%
Control Room
16%
Beam Position
Incorrect
12%
Software
Interlock
8% Beam Dump
Self Trigger
Powering
14%
System Fault
10%
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 51
52. CERN
The Future – Linear Accelerators
CLIC – Compact LInear Collider
ILC – International Linear Collider
LHC results = electron / positron collider required for detailed study
CERN is designing CLIC machine protection
Various Institutes designing ILC machine protection
Only one of these likely to be built – depends on what LHC discovers
• logical next step for physics
• specification to be finished circa 2015
• > $10 Billion machines
• 30-50 km long
• beam energy densities 1000x higher than previous e-e+ machines
• beam energy 10000x above component damage limit
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 52
53. CERN
Large Hadron Collider
(LHC)
Compact Linear Collider
(CLIC)
benjamin.todd@cern.ch Machine Protection – A Future Safety System?
54. CERN
The Future – ITER
ITER – International Thermonuclear Experimental Reactor
many synergies with LHC challenges
CERN is consulting on the design of the ITER Machine Protection…
• first steps of 50-year plan
• prove / disprove fusion feasibility for commercialisation
• > $10 Billion machine
• > 100 GJ of stored magnetic energy
• 500MW of fusion for 1000 seconds vs state-of-the-art:
16MW of fusion for 1 second (Joint European Torus)
Tritium – Deuterium Fusion
Deuterium Tritium Neutron Helium
+ → + + Energy
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 54
55. CERN
The Future – ITER
ITER – International Thermonuclear Experimental Reactor
many synergies with LHC challenges
CERN is consulting on the design of the ITER Machine Protection…
• first steps of 50-year plan
• prove / disprove fusion feasibility for commercialisation
• > $10 Billion machine
• > 100 GJ of stored magnetic energy
• 500MW of fusion for 1000 seconds vs state-of-the-art:
16MW of fusion for 1 second (Joint European Torus)
Tritium – Deuterium Fusion
Deuterium Tritium Neutron Helium
+ → + + Energy
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 55
56. CERN
The Future – ITER
ITER – International Thermonuclear Experimental Reactor
Safety– prevent Tritium release
Protection– protect the reactor
Plant– protect the sub-systems
Safety
Protection
Plant
Protection
Sensors Actuators
Plant
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 56
57. CERN
The Future – ITER
ITER – International Thermonuclear Experimental Reactor
Safety– prevent Tritium release
Protection– protect the reactor
Plant– protect the sub-systems
Safety
Protection
Plant
Protection
Sensors Actuators
Plant
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 57
58. CERN
The Future – ITER
ITER – International Thermonuclear Experimental Reactor
Safety– prevent Tritium release
Protection– protect the reactor
Plant– protect the sub-systems
Safety
Protection
Plant
Protection
Sensors Actuators
Plant
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 58
59. CERN
The Future – ITER
ITER – International Thermonuclear Experimental Reactor
Safety– prevent Tritium release
Protection– protect the reactor
Plant– protect the sub-systems
Safety
Protection Initial study:
Machine protection
can veto plant protection
Plant
Protection • Shutdown in sequence
Sensors Actuators • Sacrifice one to save another
Plant
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 59
60. CERN
The Future – ITER
ITER – International Thermonuclear Experimental Reactor
Safety– prevent Tritium release
Protection– protect the reactor
Plant– protect the sub-systems
Safety
Protection Initial study:
Machine protection
can veto plant protection
Plant
Protection ΔT • Shutdown in sequence
Sensors Actuators • Sacrifice one to save another
Plant
Or delay plant protection?
[11]
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 60
61. CERN
My Mission
LHC is its own prototype, a unique machine, ≈30 years in the making
• key protection systems involved are one-of-a-kind
• Installations are very large
• Shut down a 27km machine in less than 0.5 milliseconds
• Electronically harsh machine environment (B, E, radiation fields)
• stored energies are far higher than in previous machines
• LHC is the first machine with such massive built-in destruction potential
• cost of failure is extreme
• we have used an argument based approach to address machine protection
Future machines will be bigger, more powerful, more challenging
• protection already critical factor, even in first design drafts
High Energy Physics community is already dealing with the challenges
But technology is ahead of safety: this is formalising what we’ve already done.
My mission:
• rigorous development of machine protection as if it were a safety system.
• Keep the deep-thinking approach, incorporate system-safety techniques
• certification. Wishful thinking?
stake-holders could demand some “compliance” from us to insure their investment.
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 61
62. CERN
“Machine Protection – A Future Safety System?”
an open question to your community
Thank you for your attention
benjamin.todd@cern.ch Machine Protection – A Future Safety System? 62