R.Schmidt (CERN und TU Darmstadt) Seminarvortrag Universität Stuttgart, 16 Oktober 2012

1. CERN, the LHC collider and studies on its dependability R.Schmidt (CERN und TU Darmstadt) Seminarvortrag Universität Stuttgart, 16 Oktober 2012

2. What is CERN ? What are the principles of accelerators ? What is the Large Hadron Collider (LHC) ? What risks at CERN … and for the LHC ?

3. CERN Mission: Research, technology, collaboration, education • The motivation for CERN is basic research: Seeking and finding answers to questions about the Universe • To perform this research needs innovation in technology (such as the WWW): Advancing the frontiers of technology • Collaborating: Bringing nations together through science • Education: Training the scientists of tomorrow

4. A global endeavour 20 Member States Foundedin1954 Fundedbythe12 European States …most of the EU… 8 Observer States and Organisations …Japan, Russia, USA… 580 Institutes World Wide 2500 Staff 10000 Visiting Scientists 35 Non-Member States …Australia, Canada, New Zealand… ConseilEuropéenpour la RechercheNucléaire EuropeanCentrefor NuclearResearch

5. Understanding our universemany thousand scientists are fascinated about research at CERN CERN • The Universe is governed byforcesand is made out ofelementary particles • Understand the forcesgoverning nature: Gravitation, Electro-Magnetic forces, Forces in the nucleus (Strong Force holding the nucleus together, and Weak Force related to radioactivity) • The basic constituents of matter are elementary particles (electrons, protons, neutrons, photons, …) • Understand the Origin of Mass:finding the HIGGS particle Particle Physics: these questions are related to elementary particles physics. We need some clues! The LHC started to provide it….

6. CERN infrastructure: Accelerators and experiments CERN • CERN provides the world’s largest and most complex scientific instruments to study the elementary particles • These instruments are particle accelerators and experiments • Accelerators boost beams of elementary particles to high energies before they are made to collide with each other • Experimentsobserve and record the results of these collisions Our flag-ship project is theLargeHadronCollider…

7. CERN CERN Accelerator Complex Lake Geneva Geneva Airport CERN LAB 2 (France) CERN LAB 1 (Switzerland)

8. CERN CERN Accelerator Complex Large Hadron Collider (LHC, 2008) 27km long 150m underground Lake Geneva Geneva Airport Super Proton Synchrotron (SPS, 1976) Proton Synchrotron (PS, 1959)

9. CERN CERN Accelerator Complex Four LHC experiments: huge detectors were constructed by thousands of scientists in international collaboration CMS LHC-b ALICE ATLAS

10. Protons are accelerated by radio waves to an energy of 7 TeV while kept on a circle with strong magnetic fields from superconducting magnets operating at 8.3 T A different kind of particle accelerator… The protons make 7 Million turns, and are accelerated with one Million Volt per turn to the speed of light (300000 km/second)

11. The LHC: A 50 Years long Adventure • 1984: Kick off meeting to discuss ideas for an accelerator to collide protons at very high energy • 1996: Final decision for the LHC, the most complex scientific instrument ever constructed • 10 September 2008: Start of commissioning with beam • 19 September 2008: Serious accident and damage • 19 November 2009: Restart of beam operation Since 2009: successful operation, providing billions of particle collisions for the LHC experiments …………..……. • About 2030: The LHC physics programme to be finished ? Upgrade of LHC to higher energy?

12. The LHC Beam dump blocks CMS The arcs: 1232 DIPOLE MAGNETS Beam dumping system Acceleration • 27 km long • 2 beams • 11000 turns per second • 8 arcs • 8 straight sections LHC-B ALICE ATLAS Injection Injection

13. The LHC tunnel with dipole magnets beam tubes Looking into the arc

14. Installation of LHC dipoles in the tunnel

15. Detecting new particles: the ATLAS Experiment – A Toroidal LHC ApparatuS CERN 15

16. Risks

17. Risks for the LHC • Not to complete the construction of the accelerator • Happened to other projects, the most expensive was the Superconducting Super Collider in Texas / USA with a length of ~80 km • Cost increase from 4.4 Billion US$ to 12 Billion US$, US congress stopped the project in 1993 after having invested more the 2 Billion US$ • Not to be able to operate the accelerator • Damage to the accelerator beyond repair due to an accident SSC

18. Risks for particle physics NO LHC = Future of Particle Physics compromised

19. Risk duringLHC operation

20. Energy and risk • Energy stored in any system can cause damage, when the energy is released accidentally • For an accelerator, risks are coming from energy stored in the magnets system and in the beams Energy of a car with 1.4 tons driving at 50 km/h: 135000 Joule

21. Energy stored in the magnet system Stored energy in the magnet circuits is 9 GJoule Kinetic Energy of Aircraft Carrier at 50 km/h ≈ 9 GJoule ….can melt 14 tons of copper [11] Picture source: http://militarytimes.com/blogs/scoopdeck/2010/07/07/the-airstrike-that-never-happened/ Shared as: public domain

22. Energy stored in one beam 31014protons in each beam Kinetic Energyof 200 mTrain at 155 km/h ≈ 360 MJoule Stored energyper beam is360 MJoule Picture source: http://en.wikipedia.org/wiki/File:Alstom_AGV_Cerhenice_img_0365.jpg Shared as: http://creativecommons.org/licenses/by-sa/3.0/deed.en [11]

23. Energy stored in one beam 360 Million Joule = 10 kg of Swiss Chocolate 360 Million Joule = 90 kg of explosives ..think of you fuel tank [11]

24. 250 journalists 30 television stations Millions of viewers “we attempted to do something for the first time, live, with absolutely no guarantee of success” The idea was to send a right and a left hand beam to the LHC and obtain at least one turn around the accelerator… Risk: performing an experiment that might not work, in the presence of Millions of spectators First beam on 10 September 2008 LHC start up with beam – 10 September 2008 CERN

25. LHC commissioning and operation

26. Tense moments

27. Everything green!

28. Success!

29. Unfortunately, nine days later...

30. The incident of 19 September 2008 10000 high current superconducting cable joints – all soldered in situ in the tunnel and one of these connections was defective One joint ruptured, with 600 MJ stored in the magnets – 70% of this energy was dissipated in the tunnel, electric arcs, vaporizing material, and moving magnets around

31. The damage ...and collateral damage

32. ……the road to full repair would be long and difficult CERN

33. What has been done about it…. Analysethe accident, to exactly understand the causes Establish a plan for repair Improve the systems to prevent that this can happen again Invite internationalexperts to review risks and proposed improvements The LHC had worked very well and 99% were still ok – pull yourself together, face the problems and work towards a solution First priority is to solve the problem, and not too look for the “culprit”….

34. 2009: the LHC is back in action!

35. The experiments saw their first collisions

36. LHC operation…. ….a success ATLAS Collaboration, Observation of a new particle in the search for the Standard Model Higgs boson with the ATLAS detector at the LHC Phys.Lett.B(2012) CMS Collaboration, Observation of a new boson at a mass of 125 GeV with the CMS experiment at the LHC Phys.Lett.B(2012

37. …….but still some way to go The performance of LHC was substantially increased from 2009 to 2012 The energy stored in one beam is about 145 MJoule, the LHC operates at 4 TeV The objective operation with beams of 362 MJoule at 7 TeV To be done after a long shutdown 20113/14

38. Machine Protection

39. Risk of damage from beam Beams with the 360 MJ are running through the beam tube with the speed of light 10000 magnets keep the beams in the center of the beam tube In case of magnet failure, the beams hit the accelerator equipment in a very short time, 1/1000 of a second This must never happen: Managing risks is relying on the Machine Protection Systems

40. Controlled SPS experiment 81012 protons clear damage beam size σx/y = 1.1mm/0.6mm above damage limit for copper stainless steel no damage 21012 protons below damage limit for copper SPS experiment: Beam damage with 450 GeV proton beam 25 cm 6 cm • Damage limit ~200 kJoule • 0.1 % of the full LHC 7 TeV beams • factor of ~10 below the energy in a bunch train injected into LHC A B D C V.Kain et al 40

41. Beam dump blocks CMS Failures in such complex accelerator cannot be avoided Beam dumping system Acceleration They must be detected The beams shall be extracted into the beam dump blocks This must happen within less than 1 ms LHC-B ALICE ATLAS Injection Injection

42. LHC beam dumping system

43. Strategy for machine protection Beam Cleaning System • Definition of aperture by collimators. Powering Interlocks Fast Magnet Current change Monitor • Early detection of equipment failures generates dump request, possibly before beam is affected. • Active monitoring of the beams detects abnormal beam conditions and generates beam dump requests down to a single machine turn. Beam Loss Monitors Other Beam Monitors In total, many 10 thousand interlock channels than can trigger a beam dump • Reliable operation of beam dumping system for dump requests or internal faults, safely extract the beams onto the external dump blocks. Beam Dumping System • Reliable transmission of beam dump requests to beam dumping system. Active signal required for operation, absence of signal is considered as beam dump request and injection inhibit. Beam Interlock System • Passive protection by beam absorbers and collimators for specific failure cases. Collimator and Beam Absorbers

44. LHC: first accelerator with the potential of damage beyond repair • Dependability: new challenge for accelerator laboratories • Requires different approach in engineering, operation and management • Safety culture: has been developed over the last, say, 10 years • Largely helped by the accident in 2008 • Excellent experience: no damage, no near miss • Continuous effort to safely operate that LHC • Availability is acceptable, but we are working on further increasing availability • Lessons to be learned for future accelerators to ensure safe operation with high availability (e.g. Accelerator Driven Spallation)

45. Accidental beam losses: Risks and protection • Protection is required since there is some risk • Risk = probability of an accident (in number of accidents per year)consequences(in Euro, downtime, radiation dose to people) • Probability of an accidental beam loss • What are the failure modes the lead to beam loss into equipment? • What is the probability for the most likely failures (there is an practical infinite number of mechanisms to lose the beam)? • Consequences of an accidental beam loss • Damage to equipment • Downtime of the accelerator for repair (spare parts available?) • Activation of material, might lead to downtime since access to equipment is delayed • The higher the risk, the more protection becomes important

46. Design principles for protection systems • Failsafe design • detect internal faults • possibility for remote testing, for example between two runs • if the protection system does not work, better stop operation rather than damage equipment • Critical equipment should be redundant (possibly diverse) • Critical processes not by software (no operating system) • no remote changes of most critical parameters • Demonstrate safety / availability / reliability • use established methods to analyse critical systems and to predict failure rate • Managing interlocks • disabling of interlocks is common practice (keep track !) • LHC: masking of some interlocks possible for low intensity / low energy beams

47. ‘A model for structuring safety management activities throughout the life cycle of safety- related systems’ IEC 61508 Safety Lifecycle Handout​ Principles of System Safety Engineering and Management, Workshop, CERN 2011​, Redmill Consultancy, London​ Sigrid Wagner

48. Safety case • The MPS was designed considering a large number of possible failures of LHC equipment • The knowledge of these failures and of the machine protection functions implemented to cover these failures is distributed over the different teams involved in the design and operation of the LHC • A recent project (Sigrid Wagner and Andrea Apollonio) aims at bringing together this knowledge in a common failure catalogue. • The objective is to create a “safety case” • documentation ‘ to go to court with’ • including, claim, argument, evidence • Details can be discussed if of interest

49. Hazard and Risk Analysis and Protection requirements Proceeding in lifecycle from hazard chains to definition of protection functions Sigrid Wagner

50. Comment to LHC Machine Protection • Some protection systems were considered early in the project (beam dumping system, magnet protection, beam loss monitors) • Consideration for coherent approach on machine protection started in 2000 – done by the team working in interlocks that links all systems • Lot of work since then (e.g. 10-20 PhD theses on machine protection) • Stated to use “formal methods” since ~2004 (calculation of reliability, availability etc.) • Together with design and construction of systems considerations for documentation, commissioning etc. • Very important: diagnostics for protection (what stopped the beam?)