R.Schmidt (CERN und TU Darmstadt) Seminarvortrag Universität Stuttgart, 16 Oktober 2012

R.Schmidt (CERN und TU Darmstadt)Seminarvortrag Universität Stuttgart, 16 Oktober 2012

CERN, the LHC collider and studies on its dependability

What is CERN ?

What are the principles of accelerators ?

What is the Large Hadron Collider (LHC) ?

What risks at CERN … and for the LHC ?

CERN Mission: Research, technology, collaboration, education

• The motivation for CERN is basic research: Seeking and finding answers to questions about the Universe

• To perform this research needs innovation in technology (such as the WWW): Advancing the frontiers of technology

• Collaborating: Bringing nations together through science

• Education: Training the scientists of tomorrow

CERN

Rüdiger Schmidt CERN, the LHC collider and studies its dependability page 4

A global endeavour

Founded in 1954Funded by the

12 European States

20 Member States

8 Observer States and Organisations

35 Non-Member States

…Japan, Russia, USA…

580 Institutes World Wide2500 Staff

10000 Visiting Scientists…Australia, Canada, New

Zealand…

…most of the EU…

European Centre for Nuclear ResearchConseil Européen pour la Recherche Nucléaire

Understanding our universemany thousand scientists are fascinated

about research at CERN• The Universe is governed by forces and is made out of

elementary particles• Understand the forces governing nature: Gravitation, Electro-

Magnetic forces, Forces in the nucleus (Strong Force holding the nucleus together, and Weak Force related to radioactivity)

• The basic constituents of matter are elementary particles (electrons, protons, neutrons, photons, …)

• Understand the Origin of Mass: finding the HIGGS particle

Particle Physics: these questions are related to elementary particles physics. We need some clues! The LHC started to provide it….

CERN

CERN infrastructure: Accelerators and experiments

● CERN provides the world’s largest and most complex scientific instruments to study the elementary particles

● These instruments are particle accelerators and experiments

● Accelerators boost beams of elementary particles to high energies before they are made to collide with each other

● Experiments observe and record the results of these collisions

CERN

Our flag-ship project is the Large Hadron Collider…

CERN

[email protected] Machine Protection – A Future Safety System?

CERNCERN Accelerator ComplexLake Geneva

GenevaAirport

CERN LAB 1 (Switzerland)

CERN LAB 2 (France)

CERN


CERNCERN Accelerator ComplexLake Geneva

GenevaAirport

Proton Synchrotron(PS, 1959)

Super Proton Synchrotron(SPS, 1976)

Large Hadron Collider(LHC, 2008)

27km long150m underground

CERN


CERNCERN Accelerator Complex

CMS

ALICE

ATLAS

LHC-b

Four LHC experiments: huge detectors were constructed by thousands of scientists in international collaboration

CERN


A different kind of particle accelerator…Protons are accelerated by radio waves to an energy of 7 TeV while

kept on a circle with strong magnetic fields from superconducting magnets operating at 8.3 T

The protons make 7 Million turns, and are accelerated with one Million Volt per turn to the speed of light (300000 km/second)

CERN


The LHC: A 50 Years long Adventure

● 1984: Kick off meeting to discuss ideas for an accelerator to collide protons at very high energy

● 1996: Final decision for the LHC, the most complex scientific instrument ever constructed

● 10 September 2008: Start of commissioning with beam● 19 September 2008: Serious accident and damage● 19 November 2009: Restart of beam operation

Since 2009: successful operation, providing billions of particle collisions for the LHC experiments

…………..…….● About 2030: The LHC physics programme to be finished ?

Upgrade of LHC to higher energy?

CERN


Beam dumping system

Acceleration

CMS

ATLAS

LHC-BALICE

InjectionInjection

Beam dump blocks

The arcs:1232 DIPOLE

MAGNETS

The LHC

• 27 km long• 2 beams• 11000 turns per

second• 8 arcs• 8 straight

sections

CERN


The LHC tunnel with dipole magnets

Looking into the arc

beam tubes

CERN


Installation of LHC dipoles in the tunnel

CERN


Detecting new particles: the ATLAS Experiment – A Toroidal LHC ApparatuS

CERN

15

CERN


Risks

CERN


Risks for the LHC

● Not to complete the construction of the accelerator• Happened to other projects, the most

expensive was the Superconducting Super Collider in Texas / USA with a length of ~80 km

• Cost increase from 4.4 Billion US$ to 12 Billion US$, US congress stopped the project in 1993 after having invested more the 2 Billion US$

● Not to be able to operate the accelerator● Damage to the accelerator beyond repair

due to an accident SSC

CERN


Risks for particle physics

NO LHC=

Future of Particle Physics compromised

CERN


Risk during LHC operation

CERN


Energy and risk

● Energy stored in any system can cause damage, when the energy is released accidentally

● For an accelerator, risks are coming from energy stored in the magnets system and in the beams

Energy of a car with 1.4 tons driving at 50 km/h: 135000 Joule

CERN


Stored energy in the magnet circuits is 9 GJoule Kinetic Energy of Aircraft Carrier at 50 km/h ≈ 9 GJoule

….can melt 14 tons of copper

Energy stored in the magnet system

Picture source: http://militarytimes.com/blogs/scoopdeck/2010/07/07/the-airstrike-that-never-happened/Shared as: public domain

http://militarytimes.com/blogs/scoopdeck/2010/07/07/the-airstrike-that-never-happened/

CERN


Energy stored in one beam

[11]

31014 protons in each beamKinetic Energy of 200 m Train at 155 km/h ≈ 360 MJoule

Stored energy per beam is 360 MJoulePicture source: http://en.wikipedia.org/wiki/File:Alstom_AGV_Cerhenice_img_0365.jpg

Shared as: http://creativecommons.org/licenses/by-sa/3.0/deed.en

http://en.wikipedia.org/wiki/File:Alstom_AGV_Cerhenice_img_0365.jpg

http://creativecommons.org/licenses/by-sa/3.0/deed.en

CERN


Energy stored in one beam

[11]

360 Million Joule = 90 kg of explosives

360 Million Joule = 10 kg of Swiss Chocolate

..think of you fuel tank

CERN


● 250 journalists● 30 television stations● Millions of viewers● “we attempted to do something for the first time, live, with

absolutely no guarantee of success”● The idea was to send a right and a left hand beam to the LHC and

obtain at least one turn around the accelerator…

Risk: performing an experiment that might not work, in the presence of Millions of spectators

First beam on 10 September 2008CERN LHC start up with beam – 10 September 2008

CERN

[email protected] CERN, the LHC collider and studies its dependability

LHC commissioning and operation

CERN


Tense moments

CERN


Everything green!

CERN


Success!

CERN


Unfortunately, nine days later...

CERN


The incident of 19 September 2008● 10000 high current superconducting cable joints – all soldered in situ

in the tunnel and one of these connections was defective

One joint ruptured, with 600 MJ stored in the magnets – 70% of this energy was dissipated in the tunnel, electric arcs, vaporizing material, and moving magnets around

CERN


The damage

● ...and collateral damage

……the road to full repair would be long and difficult

CERN

CERN


What has been done about it….

● Analyse the accident, to exactly understand the causes

● Establish a plan for repair

● Improve the systems to prevent that this can happen again

● Invite international experts to review risks and proposed improvements

The LHC had worked very well and 99% were still ok – pull yourself together, face the problems and work towards a solution

First priority is to solve the problem, and not too look for the “culprit”….

CERN


2009: the LHC is back in action!

CERN


The experiments saw their first collisions

CERN


LHC operation…. ….a success

ATLAS Collaboration, Observation of a new particle in the search for the Standard Model Higgs boson with the ATLAS detector at the LHCPhys.Lett.B (2012) CMS Collaboration, Observation of a new boson at a mass of 125 GeV with the CMS experiment at the LHC Phys.Lett.B (2012

CERN


…….but still some way to go

●The performance of LHC was substantially increased from 2009 to 2012

●The energy stored in one beam is about 145 MJoule, the LHC operates at 4 TeV

●The objective operation with beams of 362 MJoule at 7 TeV

To be done after a long shutdown 20113/14

CERN


Machine Protection

CERN


Risk of damage from beam

Beams with the 360 MJ are running through the beam tube with the speed of light

● 10000 magnets keep the beams in the center of the beam tube

● In case of magnet failure, the beams hit the accelerator equipment in a very short time, 1/1000 of a second

This must never happen: Managing risks is relying on the Machine Protection Systems

CERN


Controlled SPS experiment● 81012 protons clear damage● beam size σx/y = 1.1mm/0.6mmabove damage limit for copper stainless steel no damage● 21012 protons below damage limit for copper

6 cm25 cm

• Damage limit ~200 kJoule• 0.1 % of the full LHC 7 TeV beams• factor of ~10 below the energy in a

bunch train injected into LHC

V.Kain et al

A B D C

SPS experiment: Beam damage with 450 GeV proton beam

CERN


Beam dumping system

Acceleration

CMS

ATLAS

LHC-BALICE

InjectionInjection

Beam dump blocks

They must be detected The beams shall be

extracted into the beam dump blocks

This must happen within less than 1 ms

Failures in such complex accelerator cannot be avoided

CERN


LHC beam dumping system

CERN


Strategy for machine protection● Definition of aperture by collimators. Beam Cleaning System

Beam Loss MonitorsOther Beam Monitors

Beam Interlock System

Powering Interlocks Fast Magnet Current

change Monitor

Beam Dumping System

Collimator and Beam Absorbers

• Early detection of equipment failures generates dump request, possibly before beam is affected.

• Active monitoring of the beams detects abnormal beam conditions and generates beam dump requests down to a single machine turn.

• Reliable transmission of beam dump requests to beam dumping system. Active signal required for operation, absence of signal is considered as beam dump request and injection inhibit.

• Reliable operation of beam dumping system for dump requests or internal faults, safely extract the beams onto the external dump blocks.

• Passive protection by beam absorbers and collimators for specific failure cases.

In total, many 10 thousand interlock channels than can trigger a beam dump

CERN


LHC: first accelerator with the potential of damage beyond repair

● Dependability: new challenge for accelerator laboratories● Requires different approach in engineering, operation and

management ● Safety culture: has been developed over the last, say, 10 years

• Largely helped by the accident in 2008● Excellent experience: no damage, no near miss● Continuous effort to safely operate that LHC● Availability is acceptable, but we are working on further

increasing availability● Lessons to be learned for future accelerators to ensure safe

operation with high availability (e.g. Accelerator Driven Spallation)

CERN


Accidental beam losses: Risks and protection

● Protection is required since there is some risk● Risk = probability of an accident (in number of accidents per year)

consequences (in Euro, downtime, radiation dose to people)● Probability of an accidental beam loss

• What are the failure modes the lead to beam loss into equipment?• What is the probability for the most likely failures (there is an practical

infinite number of mechanisms to lose the beam)?● Consequences of an accidental beam loss

• Damage to equipment• Downtime of the accelerator for repair (spare parts available?)• Activation of material, might lead to downtime since access to

equipment is delayed● The higher the risk, the more protection becomes important

CERN


Design principles for protection systems● Failsafe design

• detect internal faults• possibility for remote testing, for example between two runs• if the protection system does not work, better stop operation rather than

damage equipment● Critical equipment should be redundant (possibly diverse)● Critical processes not by software (no operating system)

• no remote changes of most critical parameters● Demonstrate safety / availability / reliability

• use established methods to analyse critical systems and to predict failure rate

● Managing interlocks• disabling of interlocks is common practice (keep track !)• LHC: masking of some interlocks possible for low intensity / low energy

beams

CERN


IEC 61508 Safety Lifecycle

‘A model for structuring safety management activities throughout the life cycle of safety- related systems’

Handout Principles of System Safety Engineering and Management,

Workshop, CERN 2011 , Redmill Consultancy, London

Sigrid Wagner

CERN


Safety case

● The MPS was designed considering a large number of possible failures of LHC equipment

● The knowledge of these failures and of the machine protection functions implemented to cover these failures is distributed over the different teams involved in the design and operation of the LHC

● A recent project (Sigrid Wagner and Andrea Apollonio) aims at bringing together this knowledge in a common failure catalogue.

● The objective is to create a “safety case”• documentation ‘ to go to court with’• including, claim, argument, evidence

● Details can be discussed if of interest

CERN


Hazard and Risk Analysis and Protection requirements

Proceeding in lifecycle from hazard chains to definition of protection functions

Sigrid Wagner

CERN


Comment to LHC Machine Protection

● Some protection systems were considered early in the project (beam dumping system, magnet protection, beam loss monitors)

● Consideration for coherent approach on machine protection started in 2000 – done by the team working in interlocks that links all systems

● Lot of work since then (e.g. 10-20 PhD theses on machine protection)

● Stated to use “formal methods” since ~2004 (calculation of reliability, availability etc.)

● Together with design and construction of systems considerations for documentation, commissioning etc.

● Very important: diagnostics for protection (what stopped the beam?)

CERN


Some remarks● Citation: “Prioritizing risk management too highly could keep an

organisation from ever completing a project or even getting started” – particular true for research (Wikipedia, Risk Management)

● Do not address all possible risks at the same time….● Prioritise the risks● Address the most urgent risk now● Accept some risks – there will be problems for a complex one-off

machine… sometime completely unforeseen ● Risk management at CERN is novel for such institutes: we learned

during construction and operation, and continue learning● Our approach is unconventional and less formal compared to

other domains, others (institutes and industry) are interested in our new ideas

CERN

Rüdiger Schmidt page 52

Some PhD theses on dependability● S.Wagner, LHC Machine Protection System: Method for Balancing Machine Safety and

Beam Availability, CERN-THESIS-2010-215 , ETH Zurich, 2010 ● A.Vergara-Fernández, A Reliability of the Quench Protection System for the LHC

Superconducting Elements, CERN-THESIS-2004-019● G.Guaglio, Reliability of the Beam Loss Monitors System for the Large Hadron Collider at

CERN, CERN-THESIS-2006-012, Clermont-Ferrand ● R. Filippini, Dependability analysis of a safety critical system : the LHC beam dumping

system at CERN, CERN-THESIS-2006-054, Pisa U.,● F.Perisse et al., Reliability determination of aluminium electrolytic capacitors by the

mean of various methods, 2004 - Published in: Microelectron. Reliab. 44 (2004) 1757-1762 (short version of theses)

● M.Rampl, Study for a failsafe trigger generation system for the LHC beam dump kicker magnets, CERN-THESIS-99-056, 1999

● B. Todd, A Beam Interlock System for CERN High Energy Accelerators, CERN-THESIS-2007-019 - West London: Brunel U.

CERN


Selection of other publications● S. Wagner et al., A Failure Catalogue for the LHC, 2nd International Particle Accelerator

Conference, San Sebastian, Spain, Sep 2011● R.Filippini et al., Reliability Assessment of the LHC Machine Protection System, LHC-

Project-Report-812; CERN, 14 Jun 2005● E.Carlier et al., Reliability Analysis of the LHC Beam Dumping System, CERN-LHC-Project-

Report-811, CERN, 14 Jun 2005● J.H.Dieperink et al. Design aspects related to the reliability of the LHC beam dump

kicker system, PAC 1997, Vancouver ● C.Garion et al., Reliability oriented optimum design of the Large Hadron Collider

magnet-to-magnet interconnections, CERN-LHC-Project-Report-631, CERN, 3 Apr 2003 ● C.Garion, B.Skoczen, Reliability oriented optimum design of the LHC interconnections -

Part I: Mechanical compensation system LHC, PROJECT-NOTE-245 (2000) ● L.Scibile, P.Ninin, S.Grau, Functional Safety, A total quality approach, CERN-ST-2001-055

(2001)● W.Hees, R.Trant, Evaluation of Electro Pneumatic Valve Positioners for LHC Cryogenics,

LHC-PROJECT-NOTE-190 (1999)

CERN


Comment on CERN

Is CERN a playground for thousands of (particle) physicists all hoping to discover the secrets of the universe and getting the Nobel Prize? Indeed, these are the visitor (incl. students and post docs) from

many hundred universities around the globe

Is CERN the laboratory for thousand engineers (incl. a few applied physicists) from many different fields to design, construct and operate the most complex scientific instruments ever conceived (particle accelerators and detectors)? Indeed, the engineers are the CERN staff members, working

together well students (e.g. about 140 PhD students), post docs and other external collaborators, mostly from the CERN member states

CERN


…the end

Thank you for your attention

R.Schmidt (CERN und TU Darmstadt) Seminarvortrag Universität Stuttgart, 16 Oktober 2012

Documents

Transcript of R.Schmidt (CERN und TU Darmstadt) Seminarvortrag Universität Stuttgart, 16 Oktober 2012