Machine Protection Strategies for High Power Accelerators

1. PAC2003 Machine Protection Strategies for High Power Accelerators Coles Sibley SNS Controls Group May 15, 2003 2000-0xxxx/vlb

2. “Machine Protection is not an objective in itself; it is a means to maximize operational availability by minimizing time for interventions and to avoid expensive repair of equipment and irreparable damage” (LHC MPS document) Protecting the machine Protecting the beam(time) Providing the evidence Target protection Assisting operations Conclusions **** Machine Protection is not a personnel safety system Machine Protection Systems

3. Objectives - Protecting the Machine • Prevent damage to beam line equipment due to equipment failure or operator error. • Minimize radiation induced damage and minimize losses to allow hands on maintenance (ALARA). • Provide Maximum Allowable Interpulse Difference (MAID) systems for pulse-to-pulse permits. • Prepulse Beam Permit - Critical devices give permit just before beam, magnetics, kickers, dumps, vacuum etc. • Availability – MPS shut off the beam, reduced availability • MPS input bypassing or software masking depends on each Lab’s policy, Policy depends on risks.

4. Protect the Machine • Spallation Neutron Sources (SNS, ISIS, LANSCE, TTF) • High average power 1.4 MW, 1.4 ma average at 1 GeV • High peak current (50 Amps, 645 nsec), proton density on target • Loss limited, (10-4 losses) ALARA - Hands on maintenance • Linear Colliders (NLC) • Single Pulse Induced Failure • 10 MW average beam power – Distributed losses cause radiation and thermal damage • Beam collimation and MPS, problem for all future linear colliders • Large Superconducting Rings (LHC) • High current density, small beams • 10 GJ stored Energy in magnets, 350 MJ per proton beam • 10-8 Losses can impact operations

5. Machine Einj Eext Turns Typ Ppp Loss (%) ISIS 70 800 300 1.6e13 10 PSR (1) 800 800 2300 3.1e13 0.3 KEK-PSB 40 500 50 2.0e12 10 FNAL-B 400 8000 15 2.0e12 30 AGS-B 200 1900 200 1.5e13 28 IPNS 50 450 140 3.0e12 17 CERN-PSB(2) (Septum inj) 50 1400 15 per ring 1.0e13 50 SNS (1) 1000 1000 1060 1.5e14 0.01 Beam Loss Comparison Accumulator and Rapid Cycling Synchrotrons * * J. Alonso, “Beam Loss Working Group Report” ,LBNL

6. MPS Systems – Protecting the Machine • Average Machine Protect (almost all accelerators) • Machine interlocks • Quench protection • Fast Protect Systems (usec’s, almost all accelerators) • Fast Protect, Latched • Fast Protect, Auto Reset • Beam Accounting • Beam Current Accounting, (power limits, beam loss, etc) • Beam Loss Accounting, (10-4 SNS, 10-7 LHC)

7. MPS Systems continued • Maximum Allowable Interpulse (Or Intra) Difference (MAID) • Verifies previous pulse parameters within tolerance (position, loss, AP parameters) • Verifies prepulse systems are OK • (Required for systems where beam cannot be aborted and single pulse will damage machine) • Post Mortem Analysis (Provide the Evidence) • Pinpoints cause of fault, initiates corrective actions • Beam Scheduling or Sequencing (Assist operations) • Limits beam power according to machine mode • Schedules appropriate beam for recovery from faults

8. Beam Diagnostics used to Protect the Machine Typical Fast Protect Systems • Fail safe design, detects internal faults, cable connection status, power supply faults, etc. • Remote self test and calibration capability • Controlled access of threshold parameters. • Heartbeat from timing system • Machine / beam mode aware • Circular buffers, waveforms on demand • Pulse to pulse (turn by turn) and deterministic • Loss Monitors • Dynamic range, over 140 db, ALARA, quench control • Beam loss limits, peak and average • Beam Position Monitors • Nanometers to centimeters • Single bunch to CW • P-P position verification • Beam Current Monitors • Absolute - regulatory power limits • Integrated – average power limits • Differential – beam loss limits • Single Pulse – errant beams • New Technologies • Laser wires, beam in gap measurements / clearing

9. Beam in Gap measurement with Laser (Saeed Assadi) Expect to exceed 10^4 dynamic range, 3.8 ua between pulses Raw pickup signal Raw BCM Photodiode laser intercepting chopped part of very low current beam 60 ua, 600 uv signal (20 dB amp), need 3.2 ua laser intercepting unchopped part of 32mA beam, 278 mv signal

10. MPS - System Integration [1] (NLC) • MPS Systems • Average • Beam abort • MAID • Fast beam abort • Global Timing • Abort Systems • Global Controls • Networks • IOC’s • Algorithms Control System becomes “Pulsed”, ~1400 IOC’s

11. SNS Hardware Machine Protection Systems Run Permit (Software) Post Mortem, Recovery MAID (Full Power Ops) MPS PLC (Average MPS) Fast Permit

12. SNS Accelerator Timing Sequence RTDL – Real Time Data Link

13. Maximum Allowable Interpulse Difference (MAID) • Inputs guarantee trajectory and energy of upcoming pulse (or stored beam) is within MAID. (As measured by previous pulse) • Prepulse systems are within tolerance. • Faults require system to drop back to pilot beams, verify system response with low intensity beam, ramp to full power. • Timescale depends on accelerator • Ring interpulse implies turn by turn (100’s usec) • Accelerator interpulse implies beam rep rate • Output from MAID is a beam permit signal for next pulse or retaining beam permit for future turns.

14. MAID at SNS 1.4 MW operations • Pulse to Pulse monitoring of: (MAID) • Linac RF parameters pulse average (phase and amplitude) • Injection painting • Phase space on target (BPM, etc.) • Integrated Beam Loss • Interleaved Pilot beams • Pulse stealing (every 60 sec) Verify painting, optics • Prepulse monitoring • Prepulse verification of magnetics, kicker status, etc. • Intrapulse monitoring, fast protect • Linac RF parameters (phase and amplitude) • Injection kickers • Beam loss • Integrated current

15. Protect The Beam (Maximize Availability) • SNS is a neutron production facility for users (95 % Availability) • Users schedule beam far in advance, experimental samples last days? • LHC, Objective <= 1 faulty ABORT / 2 weeks, implies MTBF of 200 years/channel for 8000-10000 channels that can request abort. • Pwr converter failure, no quench 1.5 hours • Pwr converter and hysterisis, no quench 2.5 hours • Beam dump due to excess beam loss 1.5 hours • Beam loss causes dipole quench 5 hours • Sector warm up, equipment repair 4 weeks • Beam Interlock Controller • 15 conditional inputs, can be masked through control system depending on machine status. • 16 non maskable inputs, vacuum valves, extraction OK, etc.

16. Protect the Beam (reduce Downtime) • Reliability vs availability (Protect Machine without affecting Availability of Beam) • Redundant Systems • Voting schemes • Tolerant of non-critical system faults (allow reboots) • MAID windows reasonable for machine (low power, ignore windows) • Automatic recovery and startup Reliability, Availability and Machine Protection Issues Yanglai Cho, Tesla Collaboration Meeting, Daresbury Laboratory September 23-25, 2002

17. Provide the Evidence - Post Mortem Data • Post Mortem, reduce data, sort data, find what’s relevant. • Slow Data • Vacuum levels, water temperatures, line voltage, pressures, temperatures, power supply readback’s, etc. • Diagnostics (waveforms on request, circular buffers) • BLM’s, fast, integrated, BPM’s, BCM’s, halo monitors • Pulsed Systems • Feed forward • Phase, amplitude, FW,RV,RF power • Ramped waveforms, injection painting, extraction kickers • Consider bandwidths required to correlate data • Slow drifts leading to loss vs. inter pulse recoverable fault

18. Post Mortem Data Correlator (Beam Loss) • Uses time stamps to ensure data collected is from same pulse • Limits data search to small sections of machine, hierarchical. • Limits amount of data archived by storing waveforms in circular buffers, for N previous pulses • Provides evidence of equipment running outside of limits required for stable operation. • Allows a subset of data to be made available to AP applications for instability analysis

19. Post Mortem, Operator Interface • Filters by • Event • Time stamp • System, sub system • Peak Loss • Data excursions (time correlated data sets) • Displays • Waterfall • XY plots • Strip charts • Phase space parameters X,X’, Y,Y’, Z,Z’ etc. • Difference displays • Difference from model, yesterdays beam, etc Linac Beam Loss Time Position

20. RHIC Post Mortem Analysis Example Post Mortem Viewer • Selects data source • Machine section • Abort event • Data plots • Sort by xxx • Analysis of the root cause (first fault), and whether the dump was "clean" or "dirty" (excessive) losses during the dump.

21. Loss Monitor PM Data • Post Mortem viewer finds excessive losses • The graphs show losses around the time of the MPS trip (labeled as time 0). • Losses occurred before T0 => Losses in these areas tripped MPS.

22. Summary – Protect Beam, Provide the Evidence • Quench Protection, beam inhibit / dump for super conducting accelerators / rings, minimize false trips • Tolerate reboots – Systems not involved in pulse-to-pulse feedback, MAID. • Provide power limit protection for targets / beam dumps • Provide (schedule) diagnostic pulse(s) for commissioning or pilot beam for recovery from faults • Provides evidence from cascaded faults as to source of problem (post mortem analysis) • Fault recovery automatic, fault detection easy for operations

23. SNS Target Beam Parameters

24. Beam on Target Monitoring • Accelerator Physics fault studies determine redundancy requirements • Accelerator Physics models, commissioning results define acceptable pulse-to-pulse parameters • Prepulse system verification active. • Monitor parameters with pilot beam • Set MAID windows, redundant PS monitor windows • MAID active • Ramp to full pulse width, rep rate.

25. Assist Improving The Operation (SNS) • Minimize # of screens required to locate and reset faults. • Transition latched faults to auto reset as systems mature and faults are understood. • Recover from fault, log data, and bring machine back on line in diagnostics mode (commissioning) • Recover to full power using power ramp up (2007) SNS needs high level screens and Alarm handlers for commissioning. Partner labs provide engineering screens!

26. Conclusions • Machine Protection is more than an interlock chain. • Tight integration with the timing system, control system, RF systems, Beam Abort systems, and diagnostics is essential. • Control System Performance essential, QoS etc. • Post mortem systems integrated during commissioning will reduce troubleshooting time later. • Automatic recovery from faults will increase availability • Think of MPS as a diagnostic for the accelerator, not just a means of turning off the beam.

27. References: The Beam Inhibit System for TTFI, Draft to be submitted to DIPAC 2003 , D. Nölle, P. Göttlicher, R. Neumann, D. Pugachov, K. Wittenburg, M. Wendt, M. Werner, M. Staack, DESY, Hamburg, GermanyM. Desmors, A. Hamdi, M. Jablonka, M. Loung, CEA, DAPNIA, Saclay, FranceH. Schlarb, SLAC, Stanford, USA, e-mail: dirk.noelle@desy.de Beam Intensity Monitoring and Machine Protection By Toroidal Transformers on the Tesla Test Facility, J Fusellier, CEA, DSM/DAPNIA/SEA, CE-Saclay, F-91191 Gif-sur-Yvette The Next Linear Collider Machine Protection System, M. Ross, SLAC PAC1999, New York Surveille Protection of a 150 kW Proton Beam Dump, L. Rezzonico, Paul Scherrer Institut, PSI, Switzerland, BIW00 High Stability Operation of the ISIS Pulsed Spallation Neutron Source at 200 uA, C. Planner, Rutherford Appleton Laboratory, Chilton, Didcot, Oxon, U.K., EPAC96 Overall Design Concepts for the APS Storage Ring Machine Protection System, A. Lumpkin, Argonne National Lab, Argonne IL

28. ` RHIC Beam Permit and Quench Detection Communication SystemC. Conkling Jr, Brookhaven National Lab Machine Protection Schemes for the SLC, M. Ross, Stanfor Linear Accelerator Center, Stanford CA, PAC 1991 Machine Protection System Algorithm Compiler and SimulatorG White, SLAC PAC1993 NLC – Machine Protection System: Global Requirements, J. Frisch NLC Global Controls Architecture, R. Humphrey 5/25/99 Machine Protection for NLC, J. Frisch, Feb 24, 1999 Zeroth Order Design Report for the Next Linear Collider (Ch. 16) Interlock and Protection Systems for Superconducting Accelerators: Machine Protection System for the LHCR. Schmidt, CERN Geneva Switzerland (pge 170) A High Stability Intensity Monitoring System for the ISIS Extracted Proton Beam, M Clarke-Gayther, RAL, Didcot U.K.