Behind the scenes at the LHC: A look at some of the main aspects of the LHC’s operation and improving performance.
The combination of high intensity and high energy that characterizes the nominal beam in the LHC leads to a stored energy of 362 MJ in each ring. This is more than two orders of magnitude larger than in any previous accelerator – a large step that is highlighted in the comparisons shown in figure 1. An uncontrolled beam loss at the LHC could cause major damage to accelerator equipment. Indeed, recent simulations that couple energy-deposition and hydro-dynamic simulation codes show that the nominal LHC beam can drill a hole through the full length of a copper block that is 20 m long.
Safe operation of the LHC relies on a complex system of equipment protection – the machine protection system (MPS). Early detection of failures within the equipment and active monitoring of the beam parameters with fast and reliable beam instrumentation is required throughout the entire cycle, from injection to collisions. Once a failure is detected the information is transmitted to the beam-interlock system that triggers the LHC beam-dumping system. It is essential that the beams are always properly extracted from the accelerator via a 700-m-long transfer line into large graphite dump blocks, because these are the only elements of the LHC that can withstand the impact of the full beam. Figure 2 shows the simulated impact of a 7 TeV beam on the dump block.
A variety of systems
There are several general requirements for the MPS. Its top priority is to protect the accelerator equipment from beam damage, while its second priority is to prevent the superconducting magnets from quenching. At the same time, it should also protect the beam – that is, the protection systems should dump the beam only when necessary so that the LHC’s availability is not compromised. Last, the MPS must provide evidence from beam aborts. When there are failures, the so-called post-mortem system provides complete and coherent diagnostics data. These are needed to reconstruct the sequence of events accurately, to understand the root cause of the failure and to assess whether the protection systems functioned correctly.
Protection of the LHC relies on a variety of systems with strong interdependency – these include the collimators and beam-loss monitors (BLMs) and the beam controls, as well as the beam injection, extraction and dumping systems. The strategy for machine protection, which involves all of these, rests on several basic principles:
• Definition of the machine aperture by the collimator jaws, with BLMs close to the collimators and the superconducting magnets. In general, particles lost from the beam will hit collimators first and not delicate equipment such as superconducting magnets or the LHC experiments.
• Early detection of failures within the equipment that controls the beams, to generate a beam-dump request before the beam is affected.
• Active monitoring with fast and reliable beam instrumentation, to detect abnormal beam conditions and rapidly generate a beam-dump request. This can happen within as little as half a turn of the beam round the machine (40 μs).
• Reliable transmission of a beam-dump request to the beam-dumping system by a distributed interlock system. Fail-safe logic is used for all interlocks, therefore an active signal is required for operation. The absence of the signal is considered as a beam-dump request or injection inhibit.
• Reliable operation of the beam-dumping system on receipt of a dump request or internal-fault detection, to extract the beams safely onto the external dump blocks.
• Passive protection by beam absorbers and collimators for specific failure cases.
• Redundancy in the protection system so that failures can be detected by more than one system. Particularly high standards for safety and reliability are applied in the design of the core protection systems.
Many types of failure are possible with a system as large and complex as the LHC. From the point of view of machine protection, the timescale is one of the most important characteristics of a failure because it determines how the MPS responds.
The fastest and most dangerous failures occur on the timescale of a single turn or less. These events may occur, for example, because of failures during beam injection or beam extraction. The probability for such failures is minimized by designing the systems for high reliability and by interlocking the kicker magnets as soon as they are not needed. However, despite all of these design precautions, failures such as incorrect firing of the kicker magnets at injection or extraction cannot be excluded. In these cases, active protection based on the detection of a fault and an appropriate reaction is not possible because the failure occurs on a timescale that is smaller than the minimum time that it would take to detect it and dump the beam. Protection from these specific failures therefore relies on passive protection with beam absorbers and collimators that must be correctly positioned close to the beam to capture the particles that are deflected accidentally.
Since the injection process is one of the most delicate procedures, a great deal of care has been taken to ensure that only a beam with low intensity – which is highly unlikely to damage equipment – can be injected into an LHC ring where no beam is already circulating. High-intensity beam can be injected only into a ring where a minimum amount of beam is present. This is a guarantee that conditions are acceptable for injection.
The LHC is equipped with around 4000 BLMs distributed along its circumference to protect all elements against excessive beam loss
The majority of equipment failures, however, lead to beam “instabilities” – i.e. fast movements of the orbit or growth in beam size – that must be detected on a timescale of 1 ms or more. Protection against such events relies on fast monitoring of the beam’s position and of beam loss. The LHC is equipped with around 4000 BLMs distributed along its circumference to protect all elements against excessive beam loss. Equipment monitoring – e.g. quench detectors and monitors for failures of magnet powering – provides redundancy for the most critical failure scenarios.
Last, on the longest timescale there will be unavoidable beam losses around the LHC machine during all of the phases of normal operation. Most of these losses will be captured in the collimation sections, where the beam losses and heat load at collimators are monitored. If the losses or the heat load become unacceptably high, the beam is dumped.
Operational experience
Figure 3 shows the evolution of the peak energy stored in each LHC beam between 2010 and 2012. The 2010 run was the main commissioning and learning year for the LHC and the associated MPSs. Experience had to be gained with all of the MPS sub-systems and thresholds for failure detection – e.g. beam-loss thresholds – had to be adjusted based on operational experience. In the summer of 2010, the LHC was operated at a stored energy of around 1–2 MJ – similar to the level of CERN’s Super Proton Synchrotron and Fermilab’s Tevatron – to gain experience with beams that could already create significant damage. A core team of MPS experts monitored the subsequent intensity ramps closely, with bunch spacings of 150 ns, 75 ns and 50 ns. Checklists were completed for each intensity level to document the subsystem status and to record observations. Approval to proceed to the next intensity stage was given only when all of the issues had been resolved. As experience was gained, the increments in intensity became larger and faster to execute. By mid-2012, a maximum stored energy of 140 MJ had been reached at 4 TeV per beam.
One worry with so many superconducting magnets in the LHC concerned quenches induced by uncontrolled beam losses. However, the rate was difficult to estimate before the machine began operation because it depended on a number of factors, including the performance of the large and complex collimation system. Fortunately, not a single magnet quench was observed during normal operation with circulating beams of 3.5 TeV and 4 TeV. This is a result of the excellent performance of the MPS, the collimation system and the outstanding stability and reproducibility of the machine.
Nevertheless, there were other – unexpected – effects. In the summer of 2010, during the intensity ramp-up to stored energies of 1 MJ, fast beam-loss events with timescales of 1 ms or less were observed for the first time in the LHC’s arcs. When it became rapidly evident that dust particles were interacting with the beam they were nicknamed unidentified falling objects (UFOs). The rate of these UFOs increased steadily with beam intensity. Each year, the beams were dumped about 20 times when the losses induced by the interaction of the beams with the dust particles exceeded the loss thresholds. For the LHC injection kickers – where an important number of UFOs were observed – the dust particles could clearly be identified on the surface of the ceramic vacuum chamber. Kickers with better surface cleanliness will replace the existing kickers during the present long shutdown. Nevertheless, UFOs remain a potential threat to the operational efficiency of the LHC at 7 TeV per beam.
All of the beam-dump events were meticulously analysed and validated by the operation crews and experts
The LHC’s MPS performed remarkably well from 2010 to 2013, thanks to the thoroughness and commitment of the operation crews and the MPS experts. Around 1500 beam dumps were executed correctly above the injection energy. All of the beam-dump events were meticulously analysed and validated by the operation crews and experts. This information has been stored in a knowledge database to assess possible long-term improvements of the machine protection and equipment systems. As experience grew, an increasing number of failures were captured before their effects on the particle beams became visible – i.e. before the beam position changed or beam losses were observed.
During the whole period, no evidence of a major loophole or uncovered risk in the protection architecture was identified, although sometimes unexpected failure modes were identified and mitigated. However, approximately 14% of the 1500 beam dumps were initiated by the failure of an element of the MPS – a “false” dump. So, despite the high dependability of the MPS during these first operational years, it will be essential to remain vigilant in the future as more emphasis is placed on increasing the LHC’s availability for physics.
