The combination of high intensity and high energy that characterizes the nominal beam in the LHC leads to a stored energy of 362 MJ in each ring. This is more than two orders of magnitude larger than in any previous accelerator – a large step that is highlighted in the comparisons shown in figure 1. An uncontrolled beam loss at the LHC could cause major damage to accelerator equipment. Indeed, recent simulations that couple energy-deposition and hydro-dynamic simulation codes show that the nominal LHC beam can drill a hole through the full length of a copper block that is 20 m long.

Safe operation of the LHC relies on a complex system of equipment protection – the machine protection system (MPS). Early detection of failures within the equipment and active monitoring of the beam parameters with fast and reliable beam instrumentation is required throughout the entire cycle, from injection to collisions. Once a failure is detected the information is transmitted to the beam-interlock system that triggers the LHC beam-dumping system. It is essential that the beams are always properly extracted from the accelerator via a 700-m-long transfer line into large graphite dump blocks, because these are the only elements of the LHC that can withstand the impact of the full beam. Figure 2 shows the simulated impact of a 7 TeV beam on the dump block.

A variety of systems

There are several general requirements for the MPS. Its top priority is to protect the accelerator equipment from beam damage, while its second priority is to prevent the superconducting magnets from quenching. At the same time, it should also protect the beam – that is, the protection systems should dump the beam only when necessary so that the LHC’s availability is not compromised. Last, the MPS must provide evidence from beam aborts. When there are failures, the so-called post-mortem system provides complete and coherent diagnostics data. These are needed to reconstruct the sequence of events accurately, to understand the root cause of the failure and to assess whether the protection systems functioned correctly.

Protection of the LHC relies on a variety of systems with strong interdependency – these include the collimators and beam-loss monitors (BLMs) and the beam controls, as well as the beam injection, extraction and dumping systems. The strategy for machine protection, which involves all of these, rests on several basic principles:

• Definition of the machine aperture by the collimator jaws, with BLMs close to the collimators and the superconducting magnets. In general, particles lost from the beam will hit collimators first and not delicate equipment such as superconducting magnets or the LHC experiments.

• Early detection of failures within the equipment that controls the beams, to generate a beam-dump request before the beam is affected.

• Active monitoring with fast and reliable beam instrumentation, to detect abnormal beam conditions and rapidly generate a beam-dump request. This can happen within as little as half a turn of the beam round the machine (40 μs).

• Reliable transmission of a beam-dump request to the beam-dumping system by a distributed interlock system. Fail-safe logic is used for all interlocks, therefore an active signal is required for operation. The absence of the signal is considered as a beam-dump request or injection inhibit.

• Reliable operation of the beam-dumping system on receipt of a dump request or internal-fault detection, to extract the beams safely onto the external dump blocks.

• Passive protection by beam absorbers and collimators for specific failure cases.

• Redundancy in the protection system so that failures can be detected by more than one system. Particularly high standards for safety and reliability are applied in the design of the core protection systems.

Many types of failure are possible with a system as large and complex as the LHC. From the point of view of machine protection, the timescale is one of the most important characteristics of a failure because it determines how the MPS responds.

The fastest and most dangerous failures occur on the timescale of a single turn or less. These events may occur, for example, because of failures during beam injection or beam extraction. The probability for such failures is minimized by designing the systems for high reliability and by interlocking the kicker magnets as soon as they are not needed. However, despite all of these design precautions, failures such as incorrect firing of the kicker magnets at injection or extraction cannot be excluded. In these cases, active protection based on the detection of a fault and an appropriate reaction is not possible because the failure occurs on a timescale that is smaller than the minimum time that it would take to detect it and dump the beam. Protection from these specific failures therefore relies on passive protection with beam absorbers and collimators that must be correctly positioned close to the beam to capture the particles that are deflected accidentally.

Since the injection process is one of the most delicate procedures, a great deal of care has been taken to ensure that only a beam with low intensity – which is highly unlikely to damage equipment – can be injected into an LHC ring where no beam is already circulating. High-intensity beam can be injected only into a ring where a minimum amount of beam is present. This is a guarantee that conditions are acceptable for injection.

The LHC is equipped with around 4000 BLMs distributed along its circumference to protect all elements against excessive beam loss

The majority of equipment failures, however, lead to beam “instabilities” – i.e. fast movements of the orbit or growth in beam size – that must be detected on a timescale of 1 ms or more. Protection against such events relies on fast monitoring of the beam’s position and of beam loss. The LHC is equipped with around 4000 BLMs distributed along its circumference to protect all elements against excessive beam loss. Equipment monitoring – e.g. quench detectors and monitors for failures of magnet powering – provides redundancy for the most critical failure scenarios.

Last, on the longest timescale there will be unavoidable beam losses around the LHC machine during all of the phases of normal operation. Most of these losses will be captured in the collimation sections, where the beam losses and heat load at collimators are monitored. If the losses or the heat load become unacceptably high, the beam is dumped.

Operational experience

Figure 3 shows the evolution of the peak energy stored in each LHC beam between 2010 and 2012. The 2010 run was the main commissioning and learning year for the LHC and the associated MPSs. Experience had to be gained with all of the MPS sub-systems and thresholds for failure detection – e.g. beam-loss thresholds – had to be adjusted based on operational experience. In the summer of 2010, the LHC was operated at a stored energy of around 1–2 MJ – similar to the level of CERN’s Super Proton Synchrotron and Fermilab’s Tevatron – to gain experience with beams that could already create significant damage. A core team of MPS experts monitored the subsequent intensity ramps closely, with bunch spacings of 150 ns, 75 ns and 50 ns. Checklists were completed for each intensity level to document the subsystem status and to record observations. Approval to proceed to the next intensity stage was given only when all of the issues had been resolved. As experience was gained, the increments in intensity became larger and faster to execute. By mid-2012, a maximum stored energy of 140 MJ had been reached at 4 TeV per beam.

One worry with so many superconducting magnets in the LHC concerned quenches induced by uncontrolled beam losses. However, the rate was difficult to estimate before the machine began operation because it depended on a number of factors, including the performance of the large and complex collimation system. Fortunately, not a single magnet quench was observed during normal operation with circulating beams of 3.5 TeV and 4 TeV. This is a result of the excellent performance of the MPS, the collimation system and the outstanding stability and reproducibility of the machine.

Nevertheless, there were other – unexpected – effects. In the summer of 2010, during the intensity ramp-up to stored energies of 1 MJ, fast beam-loss events with timescales of 1 ms or less were observed for the first time in the LHC’s arcs. When it became rapidly evident that dust particles were interacting with the beam they were nicknamed unidentified falling objects (UFOs). The rate of these UFOs increased steadily with beam intensity. Each year, the beams were dumped about 20 times when the losses induced by the interaction of the beams with the dust particles exceeded the loss thresholds. For the LHC injection kickers – where an important number of UFOs were observed – the dust particles could clearly be identified on the surface of the ceramic vacuum chamber. Kickers with better surface cleanliness will replace the existing kickers during the present long shutdown. Nevertheless, UFOs remain a potential threat to the operational efficiency of the LHC at 7 TeV per beam.

All of the beam-dump events were meticulously analysed and validated by the operation crews and experts

The LHC’s MPS performed remarkably well from 2010 to 2013, thanks to the thoroughness and commitment of the operation crews and the MPS experts. Around 1500 beam dumps were executed correctly above the injection energy. All of the beam-dump events were meticulously analysed and validated by the operation crews and experts. This information has been stored in a knowledge database to assess possible long-term improvements of the machine protection and equipment systems. As experience grew, an increasing number of failures were captured before their effects on the particle beams became visible – i.e. before the beam position changed or beam losses were observed.

During the whole period, no evidence of a major loophole or uncovered risk in the protection architecture was identified, although sometimes unexpected failure modes were identified and mitigated. However, approximately 14% of the 1500 beam dumps were initiated by the failure of an element of the MPS – a “false” dump. So, despite the high dependability of the MPS during these first operational years, it will be essential to remain vigilant in the future as more emphasis is placed on increasing the LHC’s availability for physics.

Ideally, a storage ring like the LHC would never lose particles: the beam lifetime would be infinite. However, a number of processes will always lead to losses from the beam. The manipulations needed to prepare the beams for collision – such as injection, the energy ramp and “squeeze” – all entail unavoidable beam losses, as do the all-important collisions for physics. These losses generally become greater as the beam current and the luminosity are increased. In addition, the LHC’s superconducting environment demands an efficient beam-loss cleaning to avoid quenches from uncontrolled losses – the nominal stored beam energy of 362 MJ is more than a billion times larger than the typical quench limits.

The tight control of beam losses is the main purpose of the collimation system. Movable collimators define aperture restrictions for the circulating beam and should intercept particles on large-amplitude trajectories that could otherwise be lost in the magnets. Therefore, the collimators represent the LHC’s defence against unavoidable beam losses. Their primary role is to clean away the beam halo while maintaining losses at sensitive locations below safe limits. The current system is designed to ensure that peak losses below a few 0.01% of the energy lost from the beam is deposited in the cold magnets. As the closest elements to the circulating beams, the collimators provide passive machine protection against irregular fast losses and failures. They also control the distribution of losses around the ring by ensuring that the largest activation occurs at optimized locations. Collimators are also used to minimize background in the experiments.

The LHC collimation system provides multi-stage cleaning where primary, secondary and tertiary collimators and absorbers are used to reduce the population of halo particles to tolerable levels (figure 1). Robust carbon-based and non-robust but high-absorption metallic materials are used for different purposes. Collimators are installed around the LHC in seven out of the eight insertion regions (between the arcs), at optimal longitudinal positions and for various transverse rotation angles. The collimator jaws are set at different distances from the circulating beams, respecting the optimum setting hierarchy required to ensure that the system provides the required cleaning and protection functionalities.

The design was optimized using state-of-the-art numerical-simulation programs

The detailed system design was the outcome of a multi-parameter optimization that took into account nuclear-physics processes in the jaws, robustness against the worst anticipated beam accidents, collimation-cleaning efficiency, radiation impact and machine impedance. The result is the largest and most advanced cleaning system ever built for a particle accelerator. It consists of 84 two-sided movable collimators of various designs and materials. Including injection protection collimators, there are a total of 396 degrees-of-freedom, because each collimator jaw has two stepping motors. By contrast, the collimation system of the Tevatron at Fermilab had less than 30 degrees-of-freedom for collimator positions.

The design was optimized using state-of-the-art numerical-simulation programs. These were based on a detailed model of all of the magnetic elements for particle tracking and the vacuum pipe apertures, with a longitudinal resolution of 0.1 m along the 27-km-long rings. They also involved routines for proton-halo generation and transport, as well as aperture checks and proton–matter interactions. These simulations require high statistics to achieve accurate estimates of collimation cleaning. A typical simulation run involves tracking some 20–60 million primary halo protons for 200 LHC turns – equivalent to monitoring a single proton travelling a distance of 0.03 light-years. Several runs are needed to study the system in different conditions. Additional complex energy- deposition and thermo-mechanical finite-element computations are then used to establish heat loads in magnets, radiation doses and collimator structural behaviour for various loss scenarios. Such a highly demanding simulation process was possible only as a result of computing power developed over recent years.

The backbone of the collimation system is located at two warm insertion regions (IRs): the momentum cleaning at IR3 and betatron cleaning at IR7, which comprise 9 and 19 movable collimators per beam, respectively. Robust primary and secondary collimators made of a carbon-fibre composite define the momentum and betatron cuts for the beam halo. In 2012, in IR7 they were at ±4.3–6.3σ (with σ being the nominal standard deviation of the beam profile in the transverse plane) from the circulating 140 MJ beams, which passed through collimator apertures as small as 2.1 mm at a rate of around 11,000 times per second.

Additional tungsten absorbers protect the superconducting magnets downstream of the warm insertions. While these are more efficient in catching hadronic and electromagnetic showers, they are also more fragile against beam losses, so they are retracted further from the beam orbit. Further local protection is provided for the experiments in IR1, IR2, IR5 and IR8: tungsten collimators shield the inner triplet magnets that otherwise would be exposed to beam losses because they are the magnets with the tightest aperture restrictions in the LHC in collision conditions. Injection and dump protection elements are installed in IR2, IR8 and IR6. The collimation system must provide continuous cleaning and protection during all stages of beam operation: injection, ramp, squeeze and physics.

An LHC collimator consists of two jaws that define a slit for the beam, effectively constraining the beam halo from both sides (figure 2). These jaws are enclosed in a vacuum tank that can be rotated in the transverse plane to intercept the halo, whether it is horizontal, vertical or skew. Precise sensors monitor the jaw positions and collimator gaps. Temperature sensors are also mounted on the jaws. All of these critical parameters are connected to the beam-interlock system and trigger a beam dump if potentially dangerous conditions are detected.

At the LHC’s top energy, a beam size of less than 200 μm requires that the collimators act as high-precision devices. The correct system functionality relies on establishing the collimator hierarchy with position accuracies to within a fraction of the beam size. Collimation movements around the ring must also be synchronized to within better than 20 ms to achieve good relative positioning of devices during transient phases of the operational cycle. A unique feature of the control system is that the stepping motors can be driven according to arbitrary functions of time, synchronously with other accelerator systems such as power converters and radio-frequency cavities during ramp and squeeze.

These requirements place unprecedented constraints on the mechanical design, which is optimized to ensure good flatness along the 1-m-long jaw, even under extreme conditions. Extensive measurements were performed during prototyping and production, both for quality assurance and to obtain all of the required position calibrations. The collimator design has the critical feature that it is possible to measure a gap outside the beam vacuum that is directly related to the collimation gap seen by the beam. Some non-conformities in jaw flatness could not be avoided and were addressed by installing the affected jaws at locations of larger β functions (therefore larger beam size), in a way that is not critical for the overall performance.

Set-up and performance

The first step in collimation set-up is to adjust the collimators to the stored beam position. There are unavoidable uncertainties in the beam orbit and collimator alignment in the tunnel, so a beam-based alignment procedure has been established to set the jaws precisely around the beam orbit. The primary collimators are used to create reference cuts in phase space. Then all other jaws are moved symmetrically round the beam until they touch the reference beam halo. The results of this halo-based set-up provide information on the beam positions and sizes at each collimator. The theoretical target settings for the various collimators are determined from simulations to protect the available machine aperture. The beam-based alignment results are then used to generate appropriate setting functions for the collimator positions throughout the operational cycle. For each LHC fill, the system requires some 450 setting functions versus time, 1200 discrete set points and about 10,000 critical threshold settings versus time. Another 600 functions are used as redundant gap thresholds for different beam energies and optics configurations.

This complex system worked well during the first LHC operation with a minimum number of false errors and failures, showing that the choice of hardware and controls are fully appropriate for the challenging accelerator environment at the LHC. Collimator alignment and the handling of complex settings have always been major concerns for the operation of the large and distributed LHC collimation system. The experience accumulated in the first run indicates that these critical aspects have been addressed successfully.

The result of the cleaning mechanism from the LHC collimation process is always visible in the control room. Unavoidable beam losses occur continuously at the primary collimators and can be observed online by the operations team as the largest loss spikes on the fixed display showing the beam losses around the ring. The local leakage to cold magnets is in most cases below 0.00001 of the peak losses, with a few isolated loss locations around IR7 where the cleaning reaches levels up to a few 0.0001 (figure 3). So far, this excellent performance has ensured a quench-free operation, even in cases of extreme beam losses from circulating beams. Moreover, this was achieved throughout the year with only one collimator alignment in IR3 and IR7, thanks to the remarkable stability of the machine and of the collimator settings.

However, collimators in the interaction regions required regular setting up for each new machine configuration that was requested for the experiments. Eighteen of these collimators are being upgraded in the current long shutdown to reduce the time spent on alignment: the new tertiary collimator design has integrated beam-position monitors to enable a fast alignment without dedicated beam-based alignment fills. This upgrade will also eventually contribute to improving the peak luminosity performance by reducing further the colliding beam sizes, thanks to better control of the beam orbit next to the inner triplet.

The LHC collimation system performance is validated after set-up with provoked beam losses, which are artificially induced by deliberately driving transverse beam instabilities. Beam-loss monitors then record data at 3600 locations around the ring. As these losses occur under controlled conditions they can be compared in detail with simulations. As predicted, performance is limited by a few isolated loss locations, namely the IR7 dispersion-suppressor magnets, which catch particles that have lost energy in single diffractive scattering at the primary collimator. This limitation of the system will be addressed in future upgrades, in particular in the High Luminosity LHC era.

The first three-year operational run has shown that the LHC’s precise and complex collimation system works at the expected high performance, reaching unprecedented levels of cleaning efficiency. The system has shown excellent stability: the machine was regularly operated with stored beam energies of more than 140 MJ, with no loss-induced quenches of superconducting magnets. This excellent performance was among the major contributors to the rapid commissioning of high-intensity beams at the LHC as well as to the squeezing of 4 TeV beams to 60 cm at collision points – a crucial aspect of the successful operation in 2012 that led to the discovery of a Higgs boson.

•The success of the collimation system during the first years of LHC operation was the result of the efforts of the many motivated people involved in this project from different CERN departments and from external collaborators. All of these people, and Ralph Assmann who led the project until 2012, are gratefully acknowledged.

The total electromagnetic energy stored in the LHC superconducting magnets is about 10,000 MJ, which is more than an order of magnitude greater than in the nominal stored beams. Any uncontrolled release of this energy presents a danger to the machine. One way in which this can occur is through a magnet quench, so the LHC employs a sophisticated system to detect quenches and protect against their harmful effects.

The magnets of the LHC are superconducting if the temperature, the applied magnetic induction and the current density are below a critical set of interdependent values – the critical surface (figure 1). A quench occurs if the limits of the critical surface are exceeded locally and the affected section of magnet coil changes from a superconducting to a normal conducting state. The resulting drastic increase in electrical resistivity causes Joule heating, further increasing the temperature and spreading the normal conducting zone through the magnet.

An uncontrolled quench poses a number of threats to a superconducting magnet and its surroundings. High temperatures can destroy the insulation material or even result in a meltdown of superconducting cable: the energy stored in one dipole magnet can melt up to 14 kg of cable. The excessive voltages can cause electric discharges that could further destroy the magnet. In addition, high Lorentz forces and temperature gradients can cause large variations in stress and irreversible degradation of the superconducting material, resulting in a permanent reduction of its current-carrying capability.

The LHC main superconducting dipole magnets achieve magnetic fields of more than 8 T. There are 1232 main bending dipole magnets, each 15 m long, that produce the required curvature for proton beams with energies up to 7 TeV. Both the main dipole and the quadrupole magnets in each of the eight sectors of the LHC are powered in series. Each main dipole circuit includes 154 magnets, while the quadrupole circuits consist of 47 or 51 magnets, depending on the sector. All superconducting components, including bus- bars and current leads as well as the magnet coils, are vulnerable to quenching under adverse conditions.

The LHC employs sophisticated magnet protection, the so-called quench-protection system (QPS), both to safeguard the magnetic circuits and to maximize beam availability. The effectiveness of the magnet-protection system is dependent on the timely detection of a quench, followed by a beam dump and rapid disconnection of the power converter and current extraction from the affected magnetic circuit. The current decay rate is determined by the inductance, L, and resistance, R, of the resulting isolated circuit, with a discharge time constant of τ = L/R. For the purposes of magnet protection, reducing the current discharge time can be viewed as equivalent to the extraction and dissipation of stored magnetic energy. This is achieved by increasing the resistance of both the magnet and its associated circuit.

Additional resistance in the magnet is created by using quench heaters to heat up large fractions of the coil and spread the quench over the entire magnet. This dissipates the stored magnetic energy over a larger volume and results in lower hot-spot temperatures. The resistance in the circuit is increased by switching-in a dump resistor, which extracts energy from the circuit (figure 2). As soon as one magnet quenches, the dump resistor is used to extract the current from the chain. The size of the resistor is chosen such that the current does not decrease so quickly as to induce large eddy-current losses, which would cause further magnets in the chain to quench.

Detection and mitigation

A quench in the LHC is detected by monitoring the resistive voltage across the magnet, which rises as the quench appears and propagates. However, the total measured voltage also includes the inductive-voltage component, which is driven by the magnet current ramping up or down. Reliably extracting the resistive-voltage signal from the total voltage-measurement is done using detection systems with inductive-voltage compensation. In the case of fast-ramping corrector magnets with large inductive voltages, it is more difficult to detect a resistive voltage because of the low signal-to-noise ratio; higher threshold voltages have to be used and a quench is therefore detected later. Following the detection and validation of a quench, the beam is aborted and the power converter is switched off. The time between the start of a quench and quench validation (i.e. activating the beam and powering interlocks) must be independent of the selected method of protection.

Creating a parallel path to the magnet via a diode allows the circuit current to by-pass the quenching magnet (figure 2). As soon as the increasing voltage over the quenched coil reaches the threshold voltage of the diode, the current starts to transfer into the diode. The magnet is by-passed by its diode and discharges independently. The diode must withstand the radiation environment, carry the current of the magnet chain for a sufficient time and provide sufficiently high turn-on voltage, to hold during the ramp up of the current. The LHC’s main magnets use cold diodes, which are mounted within the cryostat. These have a significantly larger threshold voltage than diodes that operate at room temperature – but the threshold can be reached sooner if quench heaters are fired.

The sequence of events following quench detection and validation can be summarized as follows:

• 1. The beam is dumped and the power converter turned off.

• 2. The quench-heaters are triggered and the dump-resistor is switched-in.

• 3. The current transfers into the dump resistor and starts to decrease.

• 4. Once the quench heaters take effect, the voltage over the quenched magnet rises and switches on the cold diode.

• 5. The magnet starts now to be by-passed in the chain and discharges over the internal resistance.

• 6. The cold diode heats up and the forward voltage decreases.

• 7. The current decrease induces eddy-current losses in the magnet windings yielding enhanced quench propagation. • 8. The current of the quenched magnet transfers fully into the cold diode.

• 9. The magnet chain is completely switched off a few hundred seconds after the quench detection.

QPS in practice

The QPS must perform with high reliability and high LHC beam availability. Satisfying these contradictory requirements requires careful design to optimize the sensitivity of the system. While failure to detect and control a quench can clearly have a significant impact on the integrity of the accelerator, QPS settings that are too tight may increase the number of false triggers significantly. As well as causing additional downtime of the machine, false triggers – which can result from electromagnetic perturbations, such as network glitches and thunderstorms – can contribute to the deterioration of the magnets and quench heaters by subjecting them to unnecessary spurious quenches and fast de-excitation.

One of the important challenges for the QPS is coping with the conditions experienced during a fast power abort (FPA) following quench validation. Switching off the power converter and activating the energy extraction to the dump resistors causes electromagnetic transients and high voltages. The sensitivity of the QPS to spurious triggers from electromagnetic transients caused a number of multiple-magnet quench events in 2010 (figure 3). Following simulation studies of transient behaviour, a series of modifications were implemented to reduce the transient signals from a FPA. A delay was introduced between switching off the power converter and switching-in the dump resistors, with “snubber” capacitors installed in parallel to the switches to reduce electrical arcing and related transient voltage waves in the circuit (these are not shown in figure 2). These improvements resulted in a radically reduced number of spurious quenches in 2011 – only one such quench was recorded, in a single magnet, and this was probably due to an energetic neutron, a so-called “single-event upset” (SEU). The reduction in falsely triggered quenches between 2010 and 2011 was the most significant improvement in the QPS performance and impacted directly on the decision to increase the beam energy to 4 TeV in 2012.

To date, there have been no beam-induced quenches with circulating beams above injection current

To date, there have been no beam-induced quenches with circulating beams above injection current. This operational experience shows that the beam-loss monitor thresholds are low enough to cause a beam dump before beam losses cause a quench. However, the QPS had to act on several occasions in the event of real quenches in the bus-bars and current leads, demonstrating real protection in operation. The robustness of the system was evident on 18 August 2011 when the LHC experienced a total loss of power at a critical moment for the magnet circuits. At the time, the machine was ramping up and close to maximum magnet current with high beam intensity: no magnet tripped and no quenches occurred.

A persistent issue for the vast and complex electronics systems used in the QPS is exposure to radiation. In 2012 some of the radiation-to-electronics problems were partly mitigated by the development of electronics more tolerant to radiation. The number of trips per inverse femtobarn owing to SEUs was reduced by about 60% from 2011 to 2012 thanks to additional shielding and firmware upgrades. The downtime from trips is also being addressed by automating the power cycling to reset electronics after a SEU. While most of the radiation-induced faults are transparent to LHC operation, the number of beam dumps caused by false triggers remains an issue. Future LHC operation will require improvements in radiation-tolerant electronics, coupled with a programme of replacement where necessary.

Future operation

During the LHC run in 2010 and 2011 with a beam energy of 3.5 TeV, the normal operational parameters of the dipole magnets were well below the critical surface required for superconductivity. The main dipoles operated at about 6 kA and 4.2 T, while the critical current at this field is about 35 kA, resulting in a safe temperature margin of 4.9 K. However, this value will become 1.4 K for future LHC operation at 7 TeV per beam. The QPS must therefore be prepared for operation with tighter margins. Moreover, at higher beam energy quench events will be considerably larger, involving up to 10 times more magnetic energy. This will result in longer recuperation times for the cryogenic system. There is also a higher likelihood of beam-induced quench events and quenches induced by conditions such as faster ramp rates and FPAs.

The successful implementation of magnet protection depends on a high-performance control and data acquisition system, automated software analysis tools and highly trained personnel for technical interventions. These have all contributed to the very good performance during 2010–2013. The operational experience gained during this first long run will allow the QPS to meet the challenges of the next run.

The LHC is one of the coldest places on Earth, with superconducting magnets – the key defining feature – that operate at 1.9 K. While there might be colder places in other laboratories, none compares to the LHC’s scale and complexity. The cryogenic system that provides the cooling for the superconducting magnets, with their total cold mass of 36,000 tonnes, is the largest and most advanced of its kind. It has been running continuously at some level since January 2007, providing stalwart service and achieving an availability equivalent to more than 99% per cryogenic plant.

The task of keeping the 27-km-long collider at 1.9 K is performed by helium that is cooled to its superfluid state in a huge refrigeration system. While the niobium-titanium alloy in the magnet coils would be superconducting if normal liquid helium were used as the coolant, the performance of the magnets is greatly enhanced by lowering their operating temperature and by taking advantage of the unique properties of superfluid helium. At atmospheric pressure, helium gas liquefies at around 4.2 K but on further cooling it undergoes a second phase change at about 2.17 K and becomes a superfluid. Among many remarkable properties, superfluid helium has a high thermal conductivity, which makes it the coolant of choice for the refrigeration and stabilization of large superconducting systems.

The LHC consists of eight 3.3-km-long sectors with sites for access shafts to services on the surface at the ends of each sector. Five of these sites are used to locate the eight separate cryogenic plants, each dedicated to serving one sector (figure 1). An individual cryoplant consists of a pair of refrigeration units: one, the 4.5 K refrigerator, provides a cooling-capacity equivalent to 18 kW at 4.5 K; while the other, the 1.8 K refrigeration unit, provides a further cooling capacity of 2.4 kW at 1.8 K. Therefore, each of the eight cryoplants must distribute and recover kilowatts of refrigeration across a distance of 3.3 km, to be achieved with a temperature change of less than 0.1 K.

Four of the 4.5 K refrigerators were recovered from the second phase of the Large Electron–Positron collider

Four of the 4.5 K refrigerators were recovered from the second phase of the Large Electron–Positron collider (LEP2), where they were used to cool its superconducting radiofrequency cavities. These “recycled” units have been upgraded to operate on the LHC sectors that have a lower demand for refrigeration. The four high-load sectors are instead cooled by new 4.5 K refrigerators. The refrigeration capacity needed to cool the 4500 tonnes of material in each sector of the LHC is enormous and can be produced only by using liquid nitrogen. Consequently, each 4.5 K refrigerator is equipped with a 600-kW liquid-nitrogen pre-cooler. This is used to cool a flow of helium down to 80 K while the corresponding sector is cooled before being filled with helium – a procedure that takes just under a month. Using only helium in the tunnel considerably reduces the risk of oxygen deficiency in the case of an accidental release.

The 4.5 K refrigeration system works by first compressing the helium gas and then allowing it to expand. During expansion it cools by losing energy through mechanical turbo-expanders that run at up to 140,000 rpm on helium-gas bearings. Each of the refrigerators consists of a helium-compressor station equipped with systems to remove oil and water, as well as a vacuum-insulated cold box (60 tonnes) where the helium is cooled, purified and liquefied. The compressor station supplies compressed helium gas at 20 bar and room temperature. The cold box houses the heat exchangers and turbo-expanders that provide the cooling capacities necessary to liquefy the helium at 4.5 K. The liquid helium then passes to the 1.8 K refrigeration unit, where the cold-compressor train decreases its saturation pressure and consequently its saturation temperature down to 1.8 K. Each cryoplant is equipped with a fully automatic process-control system that manages about 1000 inlets and outlets per plant. The system takes a total electrical input power of 32 MW and reaches an equivalent cooling capacity of 144 kW at 4.5 K – enough to provide almost 40,000 litres of liquid helium per hour.

In the LHC tunnel, a cryogenic distribution line runs alongside the machine. It consists of eight continuous cryostats, each about 3.2 km long and housing four (or five) headers to supply and recover helium, with temperatures ranging from 4 K to 75 K. A total of 310 service modules, of 44 different types feed the machine. These contain sub-cooling heat exchangers, all of the cryogenic control valves for the local cooling loops and 1–2 cold pressure-relief valves that protect the magnet cold masses, as well as monitoring and control instrumentation. Overall, the LHC cryogenic system contains about 60,000 inlets and outlets, which are managed by 120 industrial-process logic controllers that implement more than 4000 PID control loops.

Operational aspects

The structure of the group involved with the operation of the LHC’s cryogenics has evolved naturally since the installation phase, so maintaining experience and expertise. Each cryogenically independent sector of the LHC and its pair of refrigerators is managed by its own dedicated team for process control and operational procedures. In addition, there are three support teams for mechanics, electricity-instrumentation controls and metrology instrumentation. A further team handles scheduling, maintenance and logistics, including cryogen distribution. Continuous monitoring and technical support is provided by personnel who are on shift “24/7” in the CERN Control Centre and on standby duties. This constant supervision is necessary because any loss of availability for the cryogenic system impacts directly on the availability of the accelerator. Furthermore, the response to cryogenic failures must be rapid to mitigate the consequences of loss of cooling.

In developing a strategy for operating the LHC it was necessary to define the overall availability criteria. Rather than using every temperature sensor or liquid-helium level as a separate interlock to the magnet powering and therefore the beam permit, it made more sense to organize the information according to the modularity of the magnet-powering system. As a result, each magnet-powering subsector is attributed a pair of cryogenic signals: “cryo-maintain” (CM) and “cryo-start” (CS). The CM signal corresponds to any condition that requires a slow discharge of the magnets concerned, while the CS signal has more stringent conditions to enable powering to take place with sufficient margins for a smooth transition to the CM threshold. A global CM signal is defined as the combination of all of the required conditions for the eight sectors. This determines the overall availability of the LHC cryogenics.

During the first LHC beams in 2009, the system immediately delivered availability of 90% despite there being no means of dealing quickly with identified faults. These were corrected whenever possible during the routine technical stops of the accelerator and the end-of-year stops. The main issues resolved during this phase were the elimination of two air leaks in sub-atmospheric circuits, the consolidation of all of the 1200 cooling valves for current leads and the 1200 electronic cards for temperature sensors that were particularly affected by energetic neutron impacts, so-called single-event upsets (SEUs).

Since early operation for physics began in November 2009, the availability has been above 90% for more than 260 days per year. A substantial improvement occurred in 2012–2013 because of progress in the operation of the cryogenic system. The operation team undertook appropriate training that included the evaluation and optimization of operation settings. There were major improvements in handling utilities-induced failures. In particular, in the case of electrical-network glitches, fine-tuning the tolerance thresholds for the helium compressors and cooling-water stations represented half of the gain. A reduction in the time taken to recover nominal cryogenic conditions after failures also led to improved availability. The progress made during the past three years led to a reduction in the number of short stops, i.e. less than eight hours, from 140 to 81 per year. By 2012, the efforts of the operation and support teams had resulted in a global availability of 94.8%, corresponding to an equivalent availability of more than 99.3% for each of the eight cryogenically independent sectors.

In addition, the requirement to undertake an energy-saving programme contributed significantly to the improved availability and efficiency of the cryogenic system – and resulted in a direct saving of SwFr3 million a year. Efforts to improve efficiency have also focused on the consumption of helium. The overall LHC inventory comes to 136 tonnes of helium, with an additional 15 tonnes held as strategic storage to cope with urgent situations during operation. For 2010 and 2011, the overall losses remained high because of increased losses from the newly commissioned storage tanks during the first end-of-year technical stop. However, the operational losses were substantially reduced in 2011. Then, in 2012, the combination of a massive campaign to localize all detectable leaks – combined with the reduced operational losses – led to a dramatic improvement in the overall figure, nearly halving the losses.

Towards the next run

Thanks to the early consolidation work already performed while ramping up the LHC luminosity, no significant changes are being implemented to the cryogenic system during the first long shutdown (LS1) of the LHC. However, because it has been operating continuously since 2007, a full preventive-maintenance plan is taking place. A major overhaul of helium compressors and motors is being undertaken at the manufacturers’ premises. The acquisition of important spares for critical rotating machinery is already completed. Specific electronic units will be upgraded or relocated to cope with future radiation levels. In addition, identified leaks in the system must be repaired. The consolidation of the magnet interconnections – including the interface with the current leads – together with relocation of electronics to limit SEUs, will require a complete re-commissioning effort before cool-down for the next run.

The scheduled consolidation work – together with lessons learnt from the operational experience so far – will be key factors for the cryogenic system to maintain its high level of performance under future conditions at the LHC. The successful systematic approach to operations will continue when the LHC restarts at close to nominal beam energy and intensity. With greater heat loads corresponding to increased beam parameters and magnet currents, expectations are high that the cryogenic system will meet the challenge.