Machine Protection of the Large Hadron Collider :
Protection System Lifecycle
B. Todd, M. Kwiatkowski, B. Puccio, R. Schmidt, S. Wagner, M. Zerlauth
1v1
CERN
CERN – The European Organisation for Nuclear Research:
use the world’s largest and most complex scientific instruments to study the basic
constituents of matter.
These instruments are particle accelerators and detectors.
Accelerators boost beams of particles to high energies before they are made to
collide with each other or with stationary targets.
Detectors observe and record the results of these collisions.
Our flag-ship project is the Large Hadron Collider…
benjamin.todd@cern.ch
CERN
CERN Accelerator Complex
CERN
Lake Geneva
Geneva
Airport
CERN LAB 2 (France)
CERN LAB 1 (Switzerland)
benjamin.todd@cern.ch
CERN Accelerator Complex
CERN
CERN
Lake Geneva
Large Hadron Collider
(LHC)
Geneva
Airport
CERN LAB 2 (France)
Super Proton Synchrotron
(SPS)
27km long
150m underground
benjamin.todd@cern.ch
Proton Synchrotron
(PS)
CERN LAB 1 (Switzerland)
CERN Accelerator Complex
CERN
CERN
Beam Dumping Systems
Large Hadron Collider
(LHC)
Beam-2 Transfer Line
(TI8)
Super Proton Synchrotron
(SPS)
Beam-1 Transfer Line (TI2)
100us for one turn,
benjamin.todd@cern.ch
CERN, the LHC and Machine Protection
6 of 23
CERN
CERN Accelerator Complex
CMS
LHC-b
ALICE
ATLAS
benjamin.todd@cern.ch
CERN
Technological Challenges
CERN
…To see the rarest events…
LHC needs high luminosity of 1034 [cm-2s-1]
3 x 1014 p per beam
… to get 7 TeV operation…
LHC needs 8.3 Tesla dipole fields with circumference of 27 kms (16.5 miles)
… to get 8.3 Tesla …
LHC needs super-conducting magnets <2°K (-271°C)
with an operational current of ≈13kA
cooled in super fluid helium
maintained in a vacuum
two orders of magnitude
higher than others
Stored energy per beam is 360 MJ
A magnet will QUENCH
with milliJoule
deposited energy
Stored energy in the magnet circuits is 9 GJ
[11]
benjamin.todd@cern.ch
benjamin.todd@cern.ch
CERN
Technological Challenges
Kinetic Energy of 200m Train at 155 km/h ≈ 360 MJ
Stored energy per beam is 360 MJ
Stored energy in the magnet circuits is 9 GJ
Picture source: http://en.wikipedia.org/wiki/File:Alstom_AGV_Cerhenice_img_0365.jpg
Shared as: http://creativecommons.org/licenses/by-sa/3.0/deed.en
[11]
benjamin.todd@cern.ch
CERN
Technological Challenges
Kinetic Energy of 200m Train at 155 km/h ≈ 360 MJ
Stored energy per beam is 360 MJ
Stored energy in the magnet circuits is 9 GJ
Kinetic Energy of Aircraft Carrier at 50 km/h ≈ 9 GJ
Picture source: http://militarytimes.com/blogs/scoopdeck/2010/07/07/the-airstrike-that-never-happened/
Shared as: public domain
[11]
benjamin.todd@cern.ch
Protection System Lifecycle
CERN
Good understanding of Machine,
Equipment and Operations
Machine
Hazard Chain Identification and Analysis
Risk Classification
Risk Reduction Determination
Protection (Sub-) System
Protection Function Specification
Protection (Sub-)System Specification
Individual System
Tests &
Commissioning
Plan:
Machine Checkout
& Beam
Commissioning
Sub-System
PhD Thesis
Operation
Individual System Tests & Commissioning
Machine Checkout & Beam Commissioning
Operation
benjamin.todd@cern.ch
Protection System Lifecycle
CERN
Good understanding of Machine,
Equipment and Operations
Machine
Hazard Chain Identification and Analysis
Risk Classification
Risk Reduction Determination
Protection (Sub-) System
Protection Function Specification
Protection (Sub-)System Specification
Individual System
Tests &
Commissioning
Plan:
Machine Checkout
& Beam
Commissioning
Sub-System
PhD Thesis
Operation
Individual System Tests & Commissioning
Machine Checkout & Beam Commissioning
Operation
benjamin.todd@cern.ch
Already started!
Protection System Lifecycle
CERN
systems involved in protection are unique
certain technologies used have never been tried on this scale before
high cost of failure
development and analysis of machine protection as if it were a safety system
Design System
Protection System Lifecycle
Assess Existing
worked example
Dipole Magnet Protection – 9GJ mentioned earlier
benjamin.todd@cern.ch
Protection System Lifecycle
CERN
Cryogenics
Power
Converter
Equipment Under Control
benjamin.todd@cern.ch
benjamin.todd@cern.ch
Magnet
Cryogenics
Power Converter
CERN
Failure
Event(s)
and/or
Condition(s)
Non-Nominal
Energy Loss
Event(s)
and/or
Condition(s)
Damage
Cryogenics
Power
Converter
Equipment Under Control
benjamin.todd@cern.ch
154 in series
Magnet
Cryogenics
Power Converter
=
Hazard
Chain
CERN
prevent
Failure
Event(s)
and/or
Condition(s)
protect
Non-Nominal
Energy Loss
Event(s)
and/or
Condition(s)
Quench
Magnet
Damage
Damage
Magnet
Cryogenics
Power
Converter
Equipment Under Control
benjamin.todd@cern.ch
154 in series
Non-nominal
energy loss
Magnet
Cryogenics
Power Converter
=
Hazard
Chain
CERN
Failure  Hazard Chain  Failure Catalogue
?!?
HC0
HC1
HCp
Hazard Chain: from Quench to Damage…
• Resistive zone appears in a magnet
• I2R losses begin
• Zone heats up
(heat propagates to neighbouring magnets)
• Damage to magnets
Cryogenics
Power
Converter
benjamin.todd@cern.ch
154 in series
Non-nominal
energy loss
CERN
Failure  Hazard Chain  Failure Catalogue
prior experience
HC0
deep thinking
HC
1
?!?
simulations
HCp
prototyping
PF0
PF1
PFq
Hazard Chain: from Quench to Damage…
• Resistive zone appears in a magnet
• I2R losses begin
• Zone heats up
(heat propagates to neighbouring magnets)
• Damage to magnets
Cryogenics
Power
Converter
154 in series
What Protection Functions and Protection Systems are in place?
benjamin.todd@cern.ch
Non-nominal
energy loss
….
CERN
Failure  Hazard Chain  Failure Catalogue
prior experience
HC0
deep thinking
HC
1
?!?
simulations
HCp
prototyping
PF0
PF1
PFq
Cryogenics
Power
Converter
when quench occurs…
benjamin.todd@cern.ch
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
….
CERN
Failure  Hazard Chain  Failure Catalogue
prior experience
HC0
deep thinking
HC
1
?!?
simulations
HCp
prototyping
PF0
PF1
PFq
Power Abort
Detection
Quench
Protection
Cryogenics
Power
Converter
when quench occurs…
benjamin.todd@cern.ch
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
….
CERN
Failure  Hazard Chain  Failure Catalogue
prior experience
HC0
deep thinking
HC
1
?!?
simulations
HCp
prototyping
Quench
Protection
PF0
PF1
PFq
Quench Heater
Cryogenics
Power
Converter
when quench occurs…
benjamin.todd@cern.ch
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
….
CERN
Failure  Hazard Chain  Failure Catalogue
prior experience
HC0
deep thinking
HC
1
?!?
simulations
HCp
prototyping
Extraction
Switch
PF0
PF1
PFq
Quench
Protection
Cryogenics
Resistor
Power
Converter
when quench occurs…
benjamin.todd@cern.ch
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
….
CERN
Failure  Hazard Chain  Failure Catalogue
prior experience
HC0
deep thinking
HC
1
?!?
simulations
HCp
prototyping
Quench Loop
PF0
PF1
PFq
Powering
Interlocks
Quench
Protection
Cryogenics
Power
Converter
when quench occurs…
benjamin.todd@cern.ch
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
….
CERN
Failure  Hazard Chain  Failure Catalogue
prior experience
HC0
deep thinking
HC
1
?!?
simulations
HCp
prototyping
PF0
PF1
PFq
Powering
Interlocks
Quench
Protection
Cryogenics
Power
Converter
when quench occurs…
benjamin.todd@cern.ch
Escape Diode
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
….
CERN
Failure  Hazard Chain  Failure Catalogue
prior experience
HC0
deep thinking
HC
1
?!?
simulations
HCp
prototyping
PF0
PF1
PFq
Powering
Interlocks
Quench
Protection
Cryogenics
Power
Converter
when quench occurs…
benjamin.todd@cern.ch
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
….
CERN
?!?
HC0
HC1
PF0
PF1
HCp
PFq
classify probability and consequence using risk matrix
Colour boundaries, probabilities, consequences intentionally vague = talking points
Magnets Damaged
one
few
some
Probability
High
Medium
Low
Negligible
risk, if function didn’t exist, according to system experts…
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
benjamin.todd@cern.ch
many
….
CERN
?!?
HC0
HC1
PF0
PF1
HCp
PFq
classify probability and consequence using risk matrix
Colour boundaries, probabilities, consequences intentionally vague = talking points
Magnets Damaged
one
few
some
Probability
High
Medium
Low
Negligible
risk, if function didn’t exist, according to system experts…
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
benjamin.todd@cern.ch
many
….
CERN
Risk Matrix  Risk Catalogue
?!?
HC0
HC1
PF0
PF1
HCp
PFq
Magnets Damaged
one
few
some
2
Probability
High
Medium
Low
1
1
Negligible
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
benjamin.todd@cern.ch
many
….
CERN
?!?
HC0
HC1
PF0
PF1
HCp
PFq
determine risk reduction level using matrix
original
desired
reduction
3
2
1
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
benjamin.todd@cern.ch
….
CERN
RRL Matrix  RRL Catalogue
?!?
HC0
HC1
PF0
PF1
HCp
PFq
….
determine risk reduction level using matrix
original
desired
reduction
3
2
1
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
benjamin.todd@cern.ch
= reliability requirements
CERN
RRL Matrix  RRL Catalogue
?!?
HC0
HC1
PF0
PF1
HCp
PFq
….
determine risk reduction level using matrix
original
desired
reduction
3
2
1
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
benjamin.todd@cern.ch
= reliability requirements
CERN
RRL Matrix  RRL Catalogue
?!?
HC0
HC1
PF0
PF1
HCp
PFq
Magnets Damaged
one
few
some
2
Probability
High
Medium
Low
1
1
Negligible
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
benjamin.todd@cern.ch
many
….
CERN
RRL Matrix  RRL Catalogue
?!?
HC0
HC1
PF0
PF1
HCp
PFq
Magnets Damaged
one
one
few
Low
Negligible
many
many
2
MediumMedium
Low
some
High
Probability
Probability
High
Magnets
few Damagedsome
1
1
1
1
Negligible
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
benjamin.todd@cern.ch
2
….
CERN
expected  assess  actual?
?!?
HC0
HC1
?!?
HCp
PFq
Assess existing system implementation: coverage, quality …
Powering
Interlocks
Quench
Protection
Cryogenics
Power
Converter
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
benjamin.todd@cern.ch
PF0
PF1
….
CERN
expected  assess  actual?
?!?
HC0
HC1
?!?
HCp
PFq
Assess existing system implementation: coverage, quality …
Powering
Interlocks
Quench
Protection
Cryogenics
Power
Converter
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
benjamin.todd@cern.ch
PF0
PF1
….
CERN
expected  assess  actual?
?!?
HC0
HC1
PF0
PF1
?!?
HCp
….
PFq
Assess existing system implementation: coverage, quality …
Powering
Interlocks
Quench
Protection
1. Detect Quench
2. Open Loop
Cryogenics
3. Detect Loop
4. Switch Off Converter
Power
Converter
combined!
• Turn off Power Converter = purple = 3
• Propagate Quench = orange = 2
• Extract Energy = purple = 3
• Link Related Circuits = green = 1
benjamin.todd@cern.ch
CERN
?!?
HC0
HC1
PF0
PF1
?!?
HCp
PFq
Beam
Interlocks
Powering
Interlocks
Emergency
Stop
Uninterruptable
Power
Supplies
Quench
Protection
Cryogenics
Power
Converter
simplified example!
benjamin.todd@cern.ch
….
CERN
?!?
HC0
HC1
?!?
HCp
PFq
Today: done using a deep-thinking argumentative approach
Information is there, not organised
benjamin.todd@cern.ch
PF0
PF1
….
CERN
?!?
HC0
HC1
?!?
HCp
PFq
Today: done using a deep-thinking argumentative approach
Information is there, not organised
If we work outside to inside = protection assessment
benjamin.todd@cern.ch
PF0
PF1
….
CERN
Protection Functions  System Specifications
?!?
HC0
HC1
?!?
HCp
PF0
PF1
PFq
Today: done using a deep-thinking argumentative approach
Information is there, not organised
If we work outside to inside = protection assessment
If we work left to right = protection as a safety system
build protection cases
The future: combine approaches?
powerful tools for our organisation …LHC is a prototype machine…
benjamin.todd@cern.ch
….
CERN
Fin
Thank you for your attention
benjamin.todd@cern.ch