MPWS2012 2012/06/06
M.Jonker
Outline
•
•
•
•
•
CLIC beam power and destructive capacity
Base line CLIC machine protection
Identification of failure scenarios
Introduction to failure simulation
Various issues
MPWS2012 2012/06/06
M.Jonker
2
Beam Power and destructive capacity
Beam Power = BeamCharge × ParticleEnergy × CyclingRate
Drive Beam: 2 × 70 MWatt
Main Beam: 2 × 14 MWatt
this makes a sustained disposal of this power a challenging task.
Energy Density = BeamCharge × BeamSize-1 × dE/dx (ionisation loss)
Destructive capacity: determined by BeamCharge × BeamSize-1 not Beam Power.
Particle
Pulse
Beam Size
Energy Density
MainEnergy
beam, 14
MWatt[mm@] 1.5 TeVin copper [J g ]
Charge
Energy density in shower core is less significant
[GeV]
[μC]
289kJ beam
/ pulse70
= 70
Kcal@ 50 Hz
than energy density of the incident beam.
Drive
MW
Incident Beam
Shower Core
Single MJ
pulse:
0.7 O=
C 100
CU beam already unsafe in the damping ring
Drive Beam Train
1.4
/pulse
340litre
Kcalof water, or melt 450 gMain
2
2.4
(1 of 24)
25
3.4 103
OC in
cal12510-60.14 1.8
105
1
-1
40
even with low beam power.

heats 100 litre water
3.4
C Particle energy is not the primary worry, however,
@ Single
2.82.8
GeVcycle
?
14
1 glass
ofOwine
0.20
0.34
@ Damping Ring
This will not
harm?
melt402.3
kg CU
Main Beam
no doubt at 1.5 TeV you ‘drill’ deeper holes.
1.5 103
0.18
10-6
6.7 105
120
Main Beam
@ β collimation
Do not ignore the ENERGY DENSITY
Safe Beam:: yield limit in copper (62 J g-1)
10000 × ‘safe beam’
Drive Beam :
100 × ‘safe beam’
Main Beam :
MPWS2012 2012/06/06
M.Jonker
3
Machine Protection Timeline
Performance, equipment settings, …
- 0.1 ms
Beam in flight
- 2 ms
Next Cycle permit
- 20 ms:
Last delivered pulse
Slow errors and drifts:
Post cycle analysis
In flight errors:
Masks and RT
protection
120
100
80
Inter cycle equipment errors:
Interlock system
Last moment equipment errors:
Safe by design (equipment inertia)
60
10
1
0.1
0.01
0.001
0.0001
1E-05
Time before next beam collision [s]
MPWS2012 2012/06/06
M.Jonker
4
Failure types and Protection strategies
Slow Failures
Time scale larger than the machine cycle period (10 ~ 20 ms) .
– Temperature drifts
– Alignment drifts
– Beam feedback saturations.
N.B.: Normally, the beam feedback system should keep drifts under control. Any
deviation of the expected behaviour is potentially dangerous.
Next Cycle Permit
–
–
Systematically revoked after every cycle
Re-established if predefined beam and
equipment quality checks have passed:
≈10 ~ 20 ms to analyse the previous cycle
and to decide if OK for next cycle.
Inter-Cycle Failures
Time scale comparable to machine cycle period (10 ~ 20 ms).
– Power supply failures
– Positioning system failures
– Vacuum system failures
Post
Cycle
Analysis
Equipment
Interlock
Safe
Static
by
construction
Protection
Combination of hardware and embedded
software.
In
flight
failures:
 Remain
within tolerance
(for safe beam passage) for 2 MS after a power converter
Local
faultFalse
(MagnetPASS
circuits inertia
τ=L/R)
Last moment Equipment Failures
decisions
Abortmust
not
to
–– Difficult
to detect
beam
failures andrate
dump
the misbehaving
beam.
Local
Local lead
 PreliminaryMP
studies:
acceptable tolerances ~10%
Supervisor
MP Supervisor
–
Impossible
for
the
head
of
the
beam
(causality,
speed
of
light)
.
As above but to late for the Interlock system to react (< 2 ms)
intolerable risks.
Local
 need magnet circuits with a τ=L/R > 20 ms.Interlocks
Passive
protection:
masks
and
spoilers.
–Same principle
False
VETO
decisions
rate
should
have
a etc.)
low
for all active equipment (vacuum, positioning
systems,
RF-HV,
kicker-HV
Fast Failures
impact
the system
availability.
Make
passiveonprotection
robust
enough to provide
Time scale of beam flight time through the accelerator complex (in flight < 0.2 ms).
Local
– protection
Certification
protocol:
Strict test procedures
full
for the
whole pulse.
Abort
Local
Local
– RF breakdown: (transversal kicks...)
MP
Supervisor
Supervisor
must
be
defined
to
certify
theMPreliability
Many of the systems are already Local
designed
along this of
– Kicker misfiring: (damage to septum magnet).
the post cycle analysis. Interlocks
These test procedures
principle.
– RF klystron trip. (disrupt beam, large losses)
must revalidate the system
Local every time a
N.B. the drive beam linac: 1.5 drive beam train in the pipeline: i.e. two orders above
Abortkickers)Local
Local
Locations
(mostly
associated
with
quality
check implementation
has
been
MP Supervisor
MP
Supervisor
damage level.
Local
• Extraction
channels
modified.
Interlocks
Addressed by Patrice Nouvel
ring observation systems will be
Addressed by David Nisbet
– damping
All beam
• Extraction
from for abnormalities
scrutinized
Master MP Supervisor
Next Cycle Permit
Safe by construction
combiner
rings
– Beam Loss Monitoring system: workhorse
• Drive
Beam cycle permit and line of last defence
of next
Network for diagnostics and control
turn
foraround
detecting
4 Beam-Permit-Chains
(2 any
drive failure.
beams and 2 main beams).
Post Cycle Analysis
–
Covering the 2 ms blind period prior to the each cycle:
Beam
permits
Beam
permits
Beam
permits
Beam
permits
Static Protection
Beam
permits
Equipment Interlock
permits
Addressed by Javier Resta
Beam
permits
Local
Interlocks
Beam
Local Abort
Beam
permits
Local
Interlocks
Beam
permits
Beam
permits
Local Abort
Beam
permits
Beam
permits
Local
Interlocks
4 Beam-permit chains: DB e-, DB e+, MB e- MB e+
Local Abort
• permits (in both directions) for different beam types (pilot, tests, nominal).
• contains local nodes with user permit inputs
Protective masks. (Picture of an LHC Collimator)
• the local node also provides local beam and equipment abort signals.
Decision time: 2 ms before next pulse
MPWS2012 2012/06/06
M.Jonker
5
Potential problems
CLIC overall layout – 3 TeV
Drive beam Linac.
Turn
around
kicker.
1.5Betatron
drive beamcollimators
train equivalent in
One drive train equivalent
theDisposable
pipeline… equipment
Combiner
Kicker failurerings.
One
hit
you are
out
One
drive
train
equivalent
Need
protection
of decelerator
Kicker
failures
structures
Decelerators and main linac
RF breakdown
RF Structures
Damping rings.
0.5 104 above safe level
Kicker failures.
• Septum protection.
• Transport line protection
MPWS2012 2012/06/06
M.Jonker
7
Failure Inventory
• Many failure cases to be evaluated:
Equipment Failure Classes
Components Classes
•
–
–
–
–
–
–
–
–
–
•
•
Linac
Delay Loop
Combiner Ring 1
Combiner Ring 2
Transfer to Tunnel
Long Transfer
Turnaround
Bunch Compressor
•
•
•
•
Turnaround loop
Decelerator
Beam Disposal
•
•
•
Two Beam Accelerator /Main Beam
–
•
•
Two Beam Accelerator /Drive Beam
–
–
–
•
Injectors
PreDamping Rings
Damping Rings
Booster Linac
Transfer to tunnel
Long transfer
Turnaround
Bunch Compressor
Spin Rotator
Drive Beam Production
–
–
–
–
–
–
–
–
•
•
Main Beam Production
Accelerator
Interaction Region
–
–
–
–
Diagnostics Section
Collimation Section
Experiment
Post Collision Line
•
•
•
RF System
–
Cavity Break down
–
Synchro System/Timing error
–
Powering System HV trip
Kicker Systems
–
Spurious kick
–
Timing synchronization error
–
HV generator Error
RF Deflectors
–
Cavity Break down
–
Synchro System Timing error
–
Powering System HV trip
Magnet Powering System
–
Power Interlock /Fault
Magnet System
–
Winding Short
Alignment System
Stabilization System
–
Control out of range
Beam Feedback system
–
Control out of Range
Beam Instrumentation System
Beam Dump
–
Dump Not ready
Collimators, spoilers…
Vacuum System
–
Bad Vacuum
–
Fast Vacuum Fault
Environment and infrastructure
For every combination (~ 700 failure mode +including multiple failures), evaluate:
multiplicity, frequency and damage => risk equivalent
MPWS2012 2012/06/06
9
M.J
onk
er
Failure catalogue
a model: LHC failure catalogue under development by Sigrid Wagner, Andrea Apollonio TE-MPE-PE.
Problem: Collect LHC failure scenarios related to
beam induced damage
Result: Heading - ‘pull down menu’ - list of component
failure modes - list of prevention/protection systems
Ongoing/next: iteration process - filling of catalogue
in collaboration with experts - documentation
MPWS2012 2012/06/06
10
M.J
onk
er
Failure analysis
•
Consequences of individual failures do not have to be studied in detail:
‒ Common underlying mechanism
‒ Fault  effect on beam  transport  damage
•
Perturb beam and look for impacts on most sensitive and restrictive elements
‒ Collimators in main linac
‒ RF structures
‒ Extraction septa
•
Once we know which beam perturbations cause harm, look for possible
equipment failures that can causes these beam perturbations
‒ RF breakdown
‒ Kicker misfiring
‒ Power supply failure
‒ Vacuum failure
‒ Magnet failure
‒ Falling magnet
‒ UFO
MPWS2012 2012/06/06
11
M.J
onk
er
Analytical estimates
• First guess, approximation with linear optic
Kicks in the vertical plane
Kicks in the horizontal plane
• Betatron collimators
• Betatron collimators
half aperture = 100 μm, 1500 GeV, βy = 483 m
Energy [GeV]
9
1500
Beta [m]
1.8 / 7
18 / 67
Max Kick
22 μrad
0.56 μrad
h-App eq
155 μm
37 μm
half aperture = 120 μm, 1500 GeV, βx= 270 m
Max Vtrans
200 KeV
830 KeV
Energy [GeV]
9
1500
• Acceleration structures at the end of the linac
Beta [m]
1.8 / 7
18 / 67
Max Kick
1.2 mrad
30 μrad
h-App eq
8.3 mm
2 mm
Max Kick
35 μrad
0.9 μrad
h-App eq
250 μm
60 μm
Max Vtrans
320 KeV
1340 KeV
• Energy collimators
half aperture = 2 mm, 1500 GeV, βy = 67 m
Energy [GeV]
9
1500
Beta [m]
7
67
half aperture = 3.51 mm, 1500 GeV, βx= 1406 m
Max Vtrans
10 MeV
44 MeV
Energy [GeV]
9
1500
• Acceleration structures at the start of the linac
Beta [m]
7
67
Max Kick
460 μrad
11 μrad
h-App eq
3.2 mm
0.77 mm
Max Vtrans
4 MeV
17 MeV
• Acceleration structures at the end of the linac
half aperture = 2 mm, 9 GeV, βy= 67 m
half aperture = 2 mm, 1500 GeV, βx= 67 m
Energy [GeV]
Beta [m]
Max Kick
h-App eq
Max Vtrans
9
2/ 7
290 μrad
2 mm
2.6 MeV
Energy [GeV]
9
1500
Beta [m]
7
67
Max Kick
1.2 mrad
30 μrad
h-App eq
8.3 mm
2 mm
Max Vtrans
10 MeV
44 MeV
• Acceleration structures at the start of the linac
half aperture = 2 mm, 9 GeV, βx= 7 m
Energy [GeV]
9
MPWS2012 2012/06/06
12
Beta [m]
7
Max Kick
290 μrad
h-App eq
2 mm
Max Vtrans
2.6 MeV
M.J
onk
er
Failure simulation
Why detailed simulation
• A beam deflection that is large enough to send the beam
into the collimators may also blow up the emittance of
the beam (non linear effect).
• Optimistic:
‒ Reduction of beam charge density
‒ Less destructive beams
• Pessimistic:
‒ Beam fragments may hit the collimators already for smaller kicks
‒ Reduction of effective aperture
• Simulate multiple error conditions
• Simulate failures in non standard conditions
MPWS2012 2012/06/06
13
M.J
onk
er
POST PULSE analysis
The primary role of the Post Pulse analysis:
•
detect in time the onsets of beam instabilities (temperature drifts, ground motions,
TGV Lausanne-Geneva, etc) that develop over a medium length timescale and which
may cause radiation damage to the machine.
Any not understood excursion from standard values will inhibit the next pulse permit and
require the system to go through a fast commissioning cycle (intensity ramp up).
The system will learn by experience.
Based on information from
•
•
•
•
•
•
•
•
•
BLM
BPM,
Transverse profile monitors
BCT
Dump profile measurements
Post collision diagnostics
Ground motion sensors
Beam Feedback performance
(And everything else)
But all within 20 ms
MPWS2012 2012/06/06
M.Jonker
14
RT protection:
Only a few opportunities for a shortcut:
• Damping ring (dump after one turn, or spoil the emittance)
‒ Important protection against synchrotron radiation causing quenches of
superconducting wigglers.
• Turn around loop at entry of main linac (1000 M)
‒ Dump in case of, position errors, phase errors, energy errors…
Important also to reduce radiation
Beam Quality
Monitor
• Special tricks with Drive Beam turn around ...
• Drive Beam Linac failures: cut the source ...
‒ 1.5 Train equivalent in the pipe-line! ... do we need intermediate dumps?
MPWS2012 2012/06/06
M.Jonker
15
Equipment Interlock with Beam Feedback
We can restrict the maximum cycle to cycle changes on
individual correctors.
• A failing beam based feedback system may apply a lot of
small changes with a damaging effect.
• What freedom can we give a beam feedback system?
‒ Do we need certification and formal testing of the feedback
sofware (like we will need with the equipment interlock and
post cycle analysis)
‒ Can we define and independent limit on a vector sum of all the
feedback corrections?
• Any experience out there?
MPWS2012 2012/06/06
M.Jonker
16
Other issues
• Radiation background in main tunnel
‒ Impact on electronics
‒ Need better tracking of loss locations for “operational” losses (addressed in
presentation of Helmut Burkhardt)
• RT protection of the Drive Beam Linac
• Kicker upstream channel protection
‒ Masks may be in the limits (presentation of Alessandro Bertarelli)
•
•
•
•
Tune up dumps for commissioning.
Commissioning of MP system.
Certification validation of software components in MP system
Bootstrap of next cycle permit after an interlock (fast intensity
ramp) (addressed in my presentation on Friday)
MPWS2012 2012/06/06
M.Jonker
18
Conclusions
Time for a break ?
i.e. lunch
We will learn about it more in following
presentations
MPWS2012 2012/06/06
M.Jonker
19