\documentclass{JAC2003}

%%
%%  Use \documentclass[boxit]{JAC2000}
%%  To draw a frame with the correct margins on the output.
%%
%%  Use \documentclass[acus]{JAC2000}
%%  For US letter paper layout
%%

\usepackage{graphicx}
\usepackage{amsmath}


%%
%%   VARIABLE HEIGHT FOR THE TITLE BOX (default 35mm)
%%

\setlength{\titleblockheight}{35mm}

\begin{document}
\title{How to safely reach higher energies and intensities}

\author{J. Wenninger, CERN, Geneva}

\maketitle

\abstract{The LHC Machine Protection System has been commissioned in
November and December 2009 for low intensity and low energy beam
operation. During this period interlocks were activated step by step
and masking of channels was used regularly to improve the
commissioning efficiency. As intensity and energy are increased this
flexibility will be lost as the machine has to be protected at all
times. It is therefore essential that all protection functionality
must be commissioned at low intensity. Intensity and energy must be
increased progressively, and every new step in energy or optics must
be performed at low intensity. The steps that must be performed at
the various stages will be outlined. The issues related to masking
of interlock channels will be discussed. }

\maketitle                 % Produces the title block including the abstract

\section{Introduction}

During the second half of 2009, and in particular in November and
December 2009, a large majority of interlocks were tested and
activated. Despite the presence of close to 20'000 interlocks
capable of stopping the beams, the LHC could be operated without
significant problems due to the Machine Protection System
(MPS)~\cite{LHC-MPS}. No magnet was quenched with circulating beam
thanks to an excellent collimation setup, with cleaning efficiencies
well above 99\%. The frequently predicted "with so many interlocks
it will never work" scenario did not occur thanks to the excellent
preparation, see Fig.~\ref{fig:lhc-mps} for an overview of all
systems feeding into the LHC Beam Interlock System (BIS).

It must however be noted that the beams were modest compared to
design: the maximum stored energy was 30~kJ see Fig.~\ref{fig:sbf},
a factor 10’000 to go, and no beam made it above the Setup Beam Flag
(SBF) limit~\cite{VK}.

The 2010 plans for the LHC imply World record stored energies,
approximately 10 times larger than TEVATRON, to be reached on the
time scale of a few months !

\section{MPS in 2009}

MPS tests without beam were almost entirely completed (some test
were not required for low intensities). Following the stop in
January and February 2010, some tests must be repeated (equipment
changes or upgrades, in particular for the LBDS). Concerning MPS
tests with beam,  approximately 2/3 of individual system beam tests
were completed. Global setup and tests were performed for injection
energy. Collimators and absorbers were set up (for injection only a
partial setup was made). Global setup and tests must be repeated at
all energies and $\beta^*$ values. A major item missing in 2009 was
the abort gap cleaning; it was tested, but was not made operational
(for beam~1 the undulator was not commissioned) and not interlocked.
This will become critical at high(er) intensity and smaller
$\beta^*$ (aperture limited by triplet, quenches of Q4 in case of
excessive gap population).

\begin{figure}[bt]
\begin{center}
{\scalebox{0.34}{\includegraphics*{JW_1_05.f1.eps}}} \vspace{-2mm}
\caption{Setup Beam Flag limit as a function of beam energy. The
green area indicates the region that was explored in 2009. The
dashed region indicates the stored energy area for operation with
156 bunches at half-nominal bunch intensity.} \label{fig:sbf}
\end{center}
\end{figure}

\begin{figure*}[tb]
\begin{center}
\includegraphics*[width=160mm]{JW_1_05.f2.eps}
\caption{Schema of the LHC Machine Protection System with all its
clients.} \label{fig:lhc-mps}
\end{center}
\end{figure*}

A few issues have been uncovered during the 2009 operation of the
LHC MPS.
\begin{itemize}
  \item Safe Machine Parameters (SMP) System: reliability issues on the ‘Safe Energy’
were observed before startup with beam. This resulted in the
transmitted beam energy being set to 7.86~TeV. It must be noted that
this value is the SAFE state. This issues affects the machine
availability (false dumps), but not the machine safety. The Setup
Beam Flag (SBF) and Beam Presence Flag (BPF) had reliability issues
related to the data transmission from the LHC BCTs. Solutions will
be in place in 2010 to address the safety issues: the energy value
and transmission will be surveyed with the Software Interlock System
(SIS~\cite{SIS}), the SBF will be forced FALSE if needed. The SMP
system specification and design will be reviewed in 2010.
  \item BLM signal ‘cross-talk’ and saturation was observed mostly in the injection region (TDI and TCDI
  collimators). BLMs on the injection dumps (TDI) were saturated for short time scales already with a single pilot
  bunch. Losses on the TCDI transfer line collimators induce large signals on LHC ring
  BLMs due to the close distance between the collimators and the
  BLMs that are protecting the LHC super-conducting magnets.
  Shielding of the BLMs from the TCDI may be a longer term solution,
  but simulations are required to evaluate if sufficient shielding
  can be installed in the crowded injection region. Due to the
  TCDI-ring BLM shower cross-talk, scrapping in the SPS was
  mandatory already for very small intensities.
  Injection of a pilot bunch on the IP8 TDI (required for
  over-injection) triggered a dump on a BLM installed on the D1
  magnet to protect the triplet (Q3). Possible solutions to the
  problem will be evaluated. Despite those issues the performance of
  the BLM system proved to be remarkable and the diagnostics (1 Hz
  data stream) proved to be excellent,
  Remarkable
\end{itemize}


\section{Moving towards unsafe beams}

MPS operation at 3.5, 5 or 7~TeV is essentially equivalent (splices
are not considered). There are differences due to the emittance, the
minimum $\beta^*$, the collimator settings and the quench level.
Collimators and absorbers must be set up at every energy.  The
quench level decreases with energy, see Fig.~\ref{fig:qlevel}, which
makes collimator more and more critical as the energy is increased.

\begin{figure}[bt]
\begin{center}
{\scalebox{0.35}{\includegraphics*{JW_1_05.f3.eps}}} \vspace{-2mm}
\caption{Estimated magnet enthalpy as a function of the energy for 3
different models (Courtesy M. Sapinski).} \label{fig:qlevel}
\end{center}
\end{figure}


A certain number is conditions must be fulfilled to operate with
unsafe beam:
\begin{itemize}
  \item All MPS system test steps must be completed (with and without beam).
  \item Collimators and absorbers must be in place, in particular
  during the stable beams periods.
  \item Global protection tests must be completed. This includes
  triggering powering failures to ensure that the beam is dumped in
  due time, inducing low lifetimes to very the quality of the
  collimator positioning.
  \item Injection protection will
only be required when unsafe beams are injected directly.
\item Beam diagnostics must be working reliably, in particular the
for BPMs and BLMs.
\item The Post-mortem diagnostics must be adequate~\cite{LHCPM}. More and more
online analysis must be developed with experience.
\item The optics must be known and reproducible.
\item The orbit must be reproducible at the level of at least one
rms beam size.
\item The operational cycle must be established.
\end{itemize}

The systems that are part of the MPS monitor equipment and beam
parameters and aim to safely extract the stored energy in case of
failure. The safety levels of those systems are either unknown or
estimated from reliability analysis. ‘Dry’ operation is used to
verify some reliability estimates (see for example the LBDS and BIS
reliability runs). A critical point for such safety level estimates
concerns common cause and correlated failures leaving the machine
unprotected in some situations. For certain failure cases,
protection redundancy based on a diversity of systems reduces the
likelihood and impact of correlated failures, but redundancy does
not exist for all cases. Careful performance monitoring of the MPS
during operation may reveal issues before they are the cause of
incidents. Confidence in the safety is mostly obtained by running
the system and monitoring it carefully: this unfortunately takes
time!

The control system also plays a role in operating with unsafe beams.
Errors due to operational mistakes or controls issues may trigger
dangerous situations that could have dramatic consequences in case
of a coincidence with another failures (failure coincidence).

The beam is a another complex variable in the MP game. Both beam
shape and position must be well controlled. Tail populations and
distributions are an issue at the LHC: the tails of a high intensity
LHC beam constitute an unsafe beam. The available reaction time to
certain failures depends strongly on tail properties, which can vary
significantly depending on the operating conditions (beam-beam…).

\subsection{MD periods}

During standard physics operation sequences and settings can be
frozen to ensure best possible protection, even if so far only orbit
correctors settings are surveyed.

Machine Development (MD) phases interleaved with standard operation
are a potential threat since the experiments may involve interlock
masking. Settings changes introduced during MDs can potentially
break the collimator-absorber hierarchy. To provide more safety, one
MD participant must be responsible to restore machine conditions.
Separation of settings for MD and for regular operation is a simple
means to avoid undesired settings changes. The scope of
"end-of-fill" MDs (at the end of a stable beams period) will be
severely limited because the beams will most likely be unsafe.
Squeeze, crossing angle, etc experiments can only be performed if
they have been tested previously at low intensity.

\subsection{Interlock masking}

Interlock and signal masking at the LHC is strongly dependent on the
system.
\begin{itemize}
  \item BIS inputs: for maskable channels the possibility to mask is conditioned by the SBF.
The SBF reliability depends on the LHC BCTs, and more experience is
needed to decide if the safety is sufficient. For regular physics
fills the SBF will be forced to FALSE (at the start ramp). Beyond a
certain intensity one might consider forcing permanently the SBF to
FALSE. An expert would in that case unforce the SBF for MDs.
  \item SIS inputs: masking of tests is conditioned by RBAC and limited to EICs and SIS experts.
  \item BLMs: disabling a BLM is only possible by following an approved procedure. There are strict rules for disabling a loss
  monitor to avoid creating local 'holes' in the protection by
  disabling to many monitors of a region.
  \item PIC (electrical circuits/magnets): masking of circuits is only possible by the PIC expert. This is evidently also limited
  to uncritical circuits since the LHC cannot operate without the
  main elements (RB, RQ, IPQ, IPD IT). Depending on the circuit it may be more efficient to repair than to perform
  a low intensity ramp to check ramp ing a circuit may be more efficient that rechecking ramp
  and squeeze. Faulty orbit correctors could become an (efficiency)
  issue.
MCBX…
\end{itemize}

\begin{table*}[tb]
\begin{center}
\begin{tabular} {|l|c|c|c|c|c|c|l|} \hline
 Phase  & $k_b^{inj}$ & $k_b$ & $N_b$ & $E_{stored}$ & Step & $\cal{L}$  & Comment \\
  & & & ($10^{10}$ p) & (kJ) & & (Hz cm$^-2$) & \\ \hline \hline
 1    & 1 & 4 & 0.5 & 11.2 & & 4.2 $\times 10^{27}$ & pilot collisions \\
 2    & 1 & 4 & 2 & 44.8 & 4 & 6.8 $\times 10^{28}$ & $\approx$3 times above SBF limits \\
 3    & 1 & 4 & 5 & 112 & 2.5 & 4.2 $\times 10^{29}$ &  \\
 4    & 1 & 8 & 5 & 224 & 2 & 8.4 $\times 10^{29}$ &  \\
 5    & 4 & 16 & 5 & 448 & 2 & 1.7 $\times 10^{30}$ & Injection of 4 bunches \\
 6    & 4 & 32 & 5 & 896 & 2 & 3.4 $\times 10^{30}$ &  \\
 7    & 4 & 43 & 5 & 1204 & 1.3 & 4.6 $\times 10^{30}$ &  Standard 43$\times$43 \\
 8    & 6/12 & 48 & 5 & 1344 & 1.1 & 5.1 $\times 10^{30}$ &  50 ns trains of 6 or 13 bunches \\
   \hline
\end{tabular}
\caption{A possible scenario for the intensity increase in 2010 up
to about 1~MJ. $k_b$ is the total number of bunches, $k_b^{inj}$ the
number of injected bunches. The injected intensity remains below the
SBF limit at injection up to phase~7. Train operation is started
with short trains of 6 or 12 bunches.} \label{tab:scenario10}
\end{center}
\end{table*}

\subsection{Post-mortem}

The Post-mortem (PM) system holds all the essential information to
diagnose beam dumps (programmed or emergency). A careful analysis of
the data must be performed to validate the performance of the MPS,
and to detect anomalies that could lead to severe incidents before
it may be too late.

A PM analysis team must check all the beam dumps, and develop
automated tools to perform as much diagnostics as possible online.
In 2010 the EICs will have to acknowledge every beam dump, and SIS
will inhibit injection as long as the last beam dump is not
acknowledged. A database of beam dumps must be established for later
analysis, and operation must be stopped if an abnormal event is
detected.

\section{Startup 2010}

Initial operation will be performed with 'safe' beams (intensity
below SBF limit). At 3.5~Tev 4~pilot bunches beam are just are just
at the SBF limit (3E10 p) and the risk is very limited. The first
commissioning steps:
\begin{enumerate}
  \item Establish stable beams at 3.5 TeV with $\beta^*$ of 11~m.
  \item Establish stable beams at 3.5 TeV with $\beta^*$ of 2-3~m.
\end{enumerate}
The commissioning of the $\beta^*$ squeeze should be done in
parallel to operating for physics with $\beta^*$ 11~m. There will be
no intensity increase in this period. ‘Quiet beams’ periods will be
banned in 2010.

\subsection{Increasing intensity}

Decisions to increase the beam intensity will be based on the
performance of the MPS and on operational stability. For the MPS,
the decision will involve beam losses (all machine phases), analysis
of the Post-mortem system. Green light for an intensity increase
will be given by MPP for machine protection performance and MP3 for
magnet performance (quenches…). The intensity steps should not be
larger than a factor f~=~2-4, with f a decreasing function of
intensity. The ratio luminosity to stored energy should be maximized
through the bunch charge: increase bunch intensity first, then
increase number of bunches. A long(er) stable running period should
be planned for a stored energy of 1~MJ which corresponds to present
state of the art. This is also the stored energy where by experience
vacuum chambers and magnet coils are damaged by uncontrolled beam
loss. A possible progression of stored energy and luminosity is
indicated in Table~\ref{tab:scenario10} up to a stored energy of
1~MJ. The progression above 1~MJ is difficult to predict, as it
depends on many factors, some of them not necessarily related to MP
(cleaning efficiency, beam-beam etc).

MPS setup and global MP tests must be repeated when when $\beta^*$
is changed, when crossing angles are switched on and when the
operating energy is changed. To gain efficiency the number of MP
setups should minimized. It is recommended to select 1-2 $\beta^*$
values and then stick to them (as much as possible). At any given
time there will be a well defined operation envelope:

\begin{itemize}
  \item Total intensity
  \item Maximum injected intensity
  \item Minimum $\beta^*$
  \item Crossing scheme
\end{itemize}


\section{conclusion}

 In 2010 the LHC will hopefully operate (highly) unsafe beam: it may be possible to reach
sufficient stored energy to shutdown the LHC for some months in case
of severe incident. The MPS commissioning must be finished, and some
parts must be repeated (for example global tests). A careful
commissioning planning will avoid repetition of MP testing. The
operational cycle must be established to switch to unsafe beam, and
intensity increases must be gradual. Careful analysis of losses and
post-mortem data will be used to validate machine safety. Finally
great care must be used during MD periods not to jeopardize safety
of regular operation.
\section{ACKNOWLEDGEMENTS}

The author would like to thank many colleagues of the Machine
Protection Panel for help and discussions.

\begin{thebibliography}{10}

\bibitem{LHC-MPS} R. Schmidt et al., {\it Protection of the CERN Large Hadron Collider}, New Journal of Physics 8 (2006) 290.

\bibitem{VK} V. Kain et al., {\it Material Damage Test with 450 GeV LHC-Type Beam}, Proc. of PAC05, Knoxville,
Tn.

\bibitem{SIS} J. Wozniak et al., {\it Software Interlock System}, Proc. of ICALEPCS07, Knoxville, Tn.

\bibitem{LHCPM} J. Wenninger et al, {\it LHC Post-mortem System}, LHC Project Note 303 (2001).

\end{thebibliography}

\end{document}                        % End of document
