# Machine Protection Strategies for High Power Accelerators\*

C. Sibley, SNS - ORNL, Oak Ridge, TN 37830, USA

Abstract

The Machine Protection System Requirements for a number of accelerators
have been reviewed. The specific requirements vary depending on the type
of machine, beam power, pulse length, etc. Some system concepts are
common to a number of accelerators and these systems will be discussed.
The Machine Protection System (MPS) must protect beam apertures and
insertable devices from damage, minimize radiation produced by the beam
(ALARA) for hands on maintenance, and shut down the beam when
beam-on-target parameters drift outside specifications. MPS systems
should be used as an Accelerator diagnostic. MPS can trigger data
acquisition when a fault occurs, and start post mortem applications
automatically. Tight integration with timing and other systems allows
automatic recovery from beam faults.

\* SNS is managed by UT-Battelle, LLC, under contract DE-AC05-00OR22725
for the U.S. Department of Energy

## Introduction

Machine protection systems have evolved from simple interlock systems to
complex systems combining slow interlocks, fast interlocks to inhibit
beam or trigger abort sequences, and sequences for automatically
returning the accelerator to normal operation. MPS has to be fully
integrated with global timing systems, adjacent MPS systems, beam
diagnostics systems, RF systems, Control Systems, and others.
Additionally, most new systems involve post mortem analysis to help sift
through Gigabytes of data and pinpoint the cause of a failure or cause
of drifting beam optics. High availability requirements, over 95% for
SNS, dictate automation of recovery processes after an MPS fault.

In this paper we will discuss the role of MPS in:

1.  Protecting the Machine

2.  Protecting the Beam

3.  Providing the Evidence

4.  High Power Target protection; and

5.  Assisting operations

## Protect The Machine

New accelerator facilities will have unprecedented beam power and beam
power densities. The challenges presented depend on accelerator type,
particle type, peak currents, maximum beam energy, etc. Spallation
sources run loss-limited with high peak and average current on target.
Linear colliders have very high current densities where a single errant
pulse can cause considerable damage. Large hadron colliders have large
stored energies in both beam and superconducting systems, both of which
can damage beamline components and superconducting magnets. X-ray
machines can damage the vacuum system by slight misalignments in
wigglers, etc.

SNS will run in a loss-limited mode. Uncontrolled beam loss
specifications are less than 1 W/m, or 10^-4^. Collimation systems are
designed to intercept beam in the linac where high losses are expected,
or for halo cleaning. The total uncontrolled beam loss \[2\] in the SNS
accumulator ring is compared with several other high current rings in
Table 1. Some rings show large losses, but the injection rates are slow
so the losses are allowable. At PSR the 0.3 % becomes significant due to
the high-energy injection and 20 Hz operation. The beam loss goal for
the SNS ring is very low at 0.01% but this is required for hands-on
maintenance and availability reasons.

Table 1. Comparison of several rings, energies, peak currents, and beam
loss.

(1) Accumulator rings, others are Rapid Cycling Synchrotrons

(2) Septum injection. Others are foil.

+---------------------+--------+--------+---------+----------+--------+
| Machine             | Einj   | Eext   | \#      | Typ      | Loss   |
|                     |        |        |         |          |        |
|                     |        |        | Turns   | Ppp      | (%)    |
+---------------------+--------+--------+---------+----------+--------+
| ISIS                | 70     | 800    | 300     | 1.6e13   | 10     |
+---------------------+--------+--------+---------+----------+--------+
| PSR (1)             | 800    | 800    | 2300    | 3.1e13   | 0.3    |
+---------------------+--------+--------+---------+----------+--------+
| KEK-PSB             | 40     | 500    | 50      | 2.0e12   | 10     |
+---------------------+--------+--------+---------+----------+--------+
| FNAL-B              | 400    | 8000   | 15      | 2.0e12   | 30     |
+---------------------+--------+--------+---------+----------+--------+
| AGS-B               | 200    | 1900   | 200     | 1.5e13   | 28     |
+---------------------+--------+--------+---------+----------+--------+
| IPNS                | 50     | 450    | 140     | 3.0e12   | 17     |
+---------------------+--------+--------+---------+----------+--------+
| CERN-PSB (2)        | 50     | 1400   | 15per   | 1.0e13   | 50     |
|                     |        |        |         |          |        |
|                     |        |        | ring    |          |        |
+---------------------+--------+--------+---------+----------+--------+
| SNS (1)             | 1000   | 1000   | 1060    | 1.5e14   | 0.01   |
+---------------------+--------+--------+---------+----------+--------+

Neutron sources such as SNS, ISIS, and LANSCE use H^-^ sources to
produce high-accumulated beam currents to strike a target in a short
amount of time. SNS for instance accelerates 1060 turns at peak currents
up to 38 ma. The H^-^ ions are stripped as they are injected into the
accumulator ring, building up to 50 Amps peak. Extraction kickers are
fired in the beam gap to steer the proton beam down the extraction line
to a liquid mercury target to produce neutrons through spallation.

Linear colliders require very small beam size and high peak current to
meet luminosity requirements. A single errant pulse will cause component
damage if extracted from the damping ring. Recovery from faults requires
the system to drop back in state and use pilot pulses. The systems have
to measure pilot beams with sufficient accuracy, stability, and
resolution for feedback systems to work properly. Pulse-to-pulse
monitoring of beam parameters requires control system latencies much
less than the beam repetition rate. Collimator design is critical to
intercept the high power pulsed beam \[3\]. Use of the control system to
monitor the properties of the beam pulse-to-pulse implies the control
system is a "pulsed" control system.

Hadron colliders have very high stored energy in the beam and the
superconducting magnets, 13 GJ per sector for the LHC \[4\]. Beam losses
can cause damage due to radiation and thermal effects. The stored energy
in the beam is high enough to damage any component in the ring if the
beam is not cleanly aborted. Beam abort systems must dump the beam
before the beam trajectory changes and inhibit beam until the quench
completes and the magnetic field is restored. Recovery from beam dumps
can take a couple of hours. Recovery from magnet system quenches can
take several times longer. Light sources also have high currents and
small beams. Besides damage from the beam, upwards of 10 kW in the x-ray
beam can damage the vacuum chambers. Beam diagnostics are thus required
to monitor the e+/- beam position and X-ray beam. At the APS for
instance, beam position monitors average 32 turns of beam position data
on a turn-by-turn basis and will abort the beam in 300 usec by disabling
ring RF if measurements indicate beam position errors.

### Fast Machine Protection Inputs

Beam Diagnostics are the main input to fast MPS systems. Beam loss
monitors detect beam loss that can cause radiation and thermal damage to
equipment in the beam line tunnels. Component damage depends on the beam
energy, beam current, and current density.

![](media/image1.wmf)

Figure 2. Time to reach the thermal stress limit in copper verses beam
energy.

For SNS, damage will occur faster at lower energies \[5\]. Figure 2
shows the time to reach the thermal stress limit for copper assuming
σ~x~ = σ~y~ = 0.2 cm, I = 36 ma, J = 62 J/gm (energy density). The time
to reach the thermal stress limit at the bragg peak is quicker, however
the peak energy deposition depth is dependant on beam energy and quickly
goes beyond the thickness of the copper walls.

For low energy beams, differential current measurements are desired for
fast beam loss detection \[6\]. A system using toroidal transformers was
designed for the Tesla Test facility to provide a fast beam shutoff when
the average loss exceeds 0.8 μa over the nominal 64 μa nominal machine
current.

CW accelerators such as CEBAF \[7\] use beam current monitors for beam
loss detection and beam current limits. The current monitoring system
provides three functions:

1.  Fault if beam loss exceeds loss limit.

2.  Fault if current exceeds limit for an experimental hall.

3.  Fault if current exceeds beam off threshold for multi end station
    operation.

The 2^nd^ generation machine protection Beam Current Monitor /
Accounting system was designed specifically for machine protection.

At higher beam energies, beam loss monitors are preferred. There are
many publications available \[8\] on the topic of beam loss monitors.
MPS systems typically receive faults from peak loss (within a pulse),
integrated loss for a pulse, or integrated loss over many injection
cycles or turns. Machines such as SNS, ISIS and TTF run loss-limited and
need to keep losses below 10^-4^ for hands on maintenance.
Superconducting accelerators such as the LHC will be affected by beam
loss at a fraction of 10^-8^ of the beam \[9\]. Systems like the LHC use
loss monitors for protection of the beam as well as protection of the
machine. A beam dump due to a quench takes much longer to recover from
than a beam abort due to increased losses.

Beam Position Monitors (BPM) are crucial for MPS systems in storage
rings and linear colliders. Storage rings average beam position over a
number of turns to determine if the closed orbit is exceeding some
threshold. Beam abort is initiated to protect ring components from
damage, or vacuum systems from damage due to mis-steered X-ray beams. In
new collider designs, a pilot beam is used to verify beam optics for
full power beam. The beam position monitors must have sufficient
sensitivity to monitor these low intensity beams to accurately predict
if the high power beam will be accelerated without damaging beam line
components.

Machine operation and commissioning can continue without beam
diagnostics however MPS function could be compromised. Systems that will
be used for MPS should be designed with those goals from the beginning.
Beam diagnostics for machine protection should be designed with some or
all of the following system requirements, dependant on machine:

-   Fail Safe Design, detects internal faults, cable connection status,
    power supply faults, etc.

-   Remote self test and calibration capability, interpulse test
    functions (Force a fault between pulses)

-   Controlled access to threshold settings

-   Heartbeat from timing system

-   Machine / beam mode aware

-   Circular buffers, waveforms on demand

-   Pulse-to-pulse or turn-by-turn (Deterministic)

As stated before, SNS will accumulate 1060 turns in the ring before
extraction. There is a 250 nsec gap in the beam to allow the kicker
system to ramp to full power. Any beam in the gap will be uncontrolled
loss in the ring and extraction line. The goal is to keep the gap clean
to less than 1x10^-4^ of the injected current. With up to 50 amps
circulating, this is a measurement range of greater than 1x10^6^.
Several methods are being investigated. A beam-in-gap kicker will kick
beam onto a collimator monitored by a fast loss monitor. A new technique
used to monitor low currents for beam-in-gap measurements is the laser
profile monitor, Figure 3 \[10\]. Electrons are measured on a collector
after being deflected by a small dipole magnet.

![](media/image2.wmf)

Figure 3. Beam-in-Gap measurement made by a fast laser pulse. The
measurement above show about 60 ua of beam measured in the beam tail.
Improvements in the amplifier design should bring the resolution below
the 10^-4^ level.

### Types of Machine Protection

A survey of several accelerators of different types show the following
types of Machine Protection Systems (not all accelerators have all the
systems) are implemented or are being designed. The names vary depending
on the facility. Larger accelerators have several MPS systems, one per
machine section. These need to be integrated with each other and other
systems at a high level.

1.  Average Machine Protection

2.  Fast Protect

3.  Beam Accounting

4.  Maximum Allowable Intrapulse Difference (MAID) (and prepulse)

#### Average Machine Protection

The Average Machine Protection uses slow inputs from vacuum systems,
power supply systems, etc for slow interlock inputs. Faults due to these
inputs will cause damage due to mis-steering, defocusing, or
intercepting the beam and the beam is inhibited until the fault is
cleared. Systems will either mask these types of inputs from beam lines
not in use using a Machine Mode indication, or the various beam lines
are a subsystem in themselves, and are summed in a master MPS system.
Some facilities allow masking of these under special circumstances, such
as machine commissioning, BPM studies, beam-based alignment, etc. Other
facilities hard code these inputs into PLC logic, FPGA logic or software
and require repairs before the machine can be brought on line.

#### Fast Protect Systems

Fast Protect systems fall into three categories, turning off the beam as
soon as possible, prohibiting beam from being injected to the next part
of the accelerator or aborting the beam from a storage / accumulator
ring. For long pulse accelerators, the mechanism is turning off the
source. Electron storage rings may turn off the ring RF, allowing the
beam to coast inward to collimators in the ring as the beam loses energy
due to synchrotron radiation. Large hadron accelerators use fast, high
reliable kicker systems to kick the beam out of the ring to a beam dump
designed to handle the high power in the beam. Linear colliders must
prevent an errant pulse from being launched into the accelerator, as an
errant beam will cause damage and there is no way to prevent damage once
the pulse is injected, because the monitoring signal can not catch up to
the beam and abort systems.

SNS has two fast protect systems, Fast Protect Latched (FPL) and Fast
Protect Auto Reset (FPAR). The hardware is the same; the FPGA logic is
slightly different. Both have a maximum shutdown time of 20 usec,
although it is faster closer to the source due to fewer IC propagation
delays and shorter cable distances. There are two bypass mechanisms for
the MPS hardware: software masks initiated by an operator (if enabled
using hardware jumpers) and beam/machine mode masking through the timing
system. Beam/machine modes are broadcast on the Real Time Data Link
(RTDL) and will automatically bypass certain MPS inputs for diagnostic
pulses to allow intrusive diagnostics to operate without operator
intervention. The mode masks are downloaded during initialization, and
verified periodically during operation. The beam/machine mode is encoded
three ways in a 24-bit frame. There is an 8 bit CRC check of each frame.
In addition, there is a 24-bit CRC frame for all RTDL frames broadcast
in a cycle. The MPS hardware also uses the CYCLE_START event and the
RTDL_VALID events for heartbeats indicating the timing system is healthy
and stale modes are not used. The probability of detecting an erroneous
mode broadcast on the RTDL using the two CRC checks, and encoding the
data in three ways is better than 99.999994% \[11\].

Fast protect systems for linear colliders prevent errant beams from
being launched into the accelerator. Once a pulse is launched, there is
little to be done to protect the machine, except to design collimation
systems to handle the beam. This is very difficult to impossible so some
engineering is under way to design "sacrificial" collimator systems.

Beam Loss monitors at HERA often have the last chance to recognize a
doomed beam and abort it safely before uncontrolled and possibly
damaging losses occur.

#### Beam Accounting

Beam Current Accounting and Beam Loss Accounting are required for
monitoring integrated losses and warning operations when loss limits are
approached. Some systems will shut down the machine as the limits are
reached. Beam loss and accounting are used to stop beam-induced
radiation damage before it occurs. Some machines like CEBAF at JLAB have
beam loss accounting to limit power to the various experimental halls.
These limits are set by power limit requirements for the experimental
devices (spectrometers) and the beam dumps in each experimental hall.

Beam Loss monitors and beam current monitors are used in these systems.
Beam loss monitors can pinpoint the beam loss better than current
monitors, but calibration for absolute losses is harder due to the
particle types, equipment shielding the detector, etc. Beam current
monitors can be calibrated to a high degree of accuracy \[CEBAF, TTF\],
but they can also be "fooled" by opposite charged particles or beam
spray after beam loss.

#### 

#### Maximum Allowable Interpulse Difference (MAID)

MAID was originally designed to monitor orbit stability using BPM's and
abort the beam if the orbit starts drifting outside allowable limits. In
this case it is a turn-by-turn difference rather than an interpulse
difference. It was planned for the Tevatron \[12\] but not really used.
Complexes such as PEPII are using the MAID principle.

MAID requires previous pulsed data to be verified from the accelerator
physics point of view\-- that is the data fits within an ellipse defined
by the beam envelope in the accelerator. This applies to beam position
monitors, beam loss monitors and device control monitors \[13\]. Just
prior to injection all systems that can change the beam trajectory or
beam energy are verified to be operational. This prepulse system gives a
final beam permit signal to allow beam. Beam is also monitored in
damping rings or injection systems that will abort errant beams before
being injected.

For accelerators depending on MAID, any intermittent faults require the
injected beam to be brought to a low power state in the injection
sequence. In order for full beam to proceed, an automated sequence to
bring the beam back on line should be initiated. These procedures
require integration of a number of systems, MPS between injectors,
damping rings and accelerators, timing system sequences, control system
feedback loops, feed forward algorithms, and timing systems. The
complexity speaks for itself.

## Protect the Beam (Availability)

Protecting the beam is a goal for all accelerators desiring high beam
availability. SNS goals are \>95% availability at full power for
production beam. Beam down time is increased unnecessarily when MPS
provides false trips, or input devices provide nuisance trips. The MTBF
decreases as the number of MPS inputs increases. For instance, the MTBF
for inputs to the LHC have to exceed 200 years to meet the goal of less
than 1 trip per 2 weeks.

Experience at LANSCE and the PSR have determined that losses of 1 W/m
will allow hands-on accelerator maintenance (\~100mR/hr at 1 foot), with
transverse losses primarily at quadrupoles where the beta-max occurs
\[14\]. Meeting the ALARA limits for hands-on maintenance will increase
machine availability by reducing the time to repair.

Software masking of inputs allows components in the down slope of a
bathtub curve to be identified during the commissioning process and
masked out to increase beam time. If the component or device is not
deemed critical for steering and focusing, it can be masked during
operation until a suitable time for repair occurs.

## Provide the Evidence

MPS Faults should post Abort or Fault events locally or globally through
the timing system. Control system devices, beam diagnostics, and pulse
systems use these triggers to freeze circular buffers and provide
waveforms of the interrupted pulse. Post mortem analysis will identify
first faults using timestamps from MPS input faults.

Using a correlator tool, such as the XAL Correlator package developed by
the AP group at SNS, faults can easily be captured and sorted by time
(figure 4). Using the hierarchy provided, these faults can trigger
capture of waveforms and slow data buffers depending on the location and
type of the machine fault. This will help reduce data sorting from
Gigabytes to Megabytes.

![](media/image3.png){width="3.2583333333333333in"
height="2.0909722222222222in"}

Figure 4. Typical Post Mortem displays for quick identification of MPS
faults and root analysis. (RHIC Example)

The application will bring up the data post processed by:

  ----------------------- ----------------------- ------------------------
  Event                   User Pulse              Sub System

  Time Stamp              MPS Fault               Peak Loss

  Timing Event            System                  Data Excursion
  ----------------------- ----------------------- ------------------------

Standard displays built into XAL include waterfall, XY correlator, 2d
and 3d, Strip charts, phase space parameters, and difference from model,
yesterdays beam, etc.

## High Power Target Protection

At SNS, the target requirements for errant pulses is less than 2 full
power pulses for beam power within the nominal spot size (50% beam power
outside of 200 mm x 70 mm) and for peak single pulse current density \<
3.2x10^16^ protons/m^2^.

Accelerator Physics fault studies have determined which quadrupoles
could cause target parameters to be exceeded. In the majority of cases,
large beam losses are predicted when the target parameters are exceeded
\[15\]. Standard monitoring of RTBT beam line elements (On-Off), and
loss monitor inputs provide a first level of defense. Redundant inputs
are chosen from the AP studies where beam loss monitors and power supply
status cannot monitor losses. These magnets are chosen for redundant
input using current window monitoring for the power supply.

Accelerator physics models and commissioning results using wire
scanners, harps, beam loss monitors, and beam position monitors define
acceptable pulse-to-pulse windows for MAID. Control system performance
needs to be verified for latency and Quality of Service (QoS). A single
control system network should be sufficient but a second high QoS
network can be added in the future if required.

## Operations

The operator interface for MPS should make faults easy to locate, reset,
and startup reset routines. During initial commissioning, faults are
located manually or (preferably) using post mortem tools. As
commissioning proceeds into operations, the fault discovery process is
automated and operators note the number and type of fault in the
logbooks.

Three types of interface screens are being implemented at SNS. A system
overview screen shows the status of all MPS Machine Mode chains. An
interlock view shows the MPS system where the chain is broken. Clicking
down this screen path shown each MPS input and MPS chassis status from
an MPS engineers point of view.

A machine-oriented view allows operations to link the fault to a
location on the beam line. This allows device specific screens to pop up
device status, cause of device fault, device reset functions, and MPS
reset functions. Input masking is available at this level as well as the
setting of chatter fault (N faults in M pulses) limits. A system status
view is also offered showing MPS inputs by system and subsystem.

Each of these displays is highlighted in a fault condition. The
operations group will eventually develop high-level screens to their
taste. Other EPICS tools like the Alarm Handler also show MPS faults in
a hierarchical manner.

## Conclusions

Machine Protection is not just a system to shut off beam like an
interlock chain. MPS needs to be tightly integrated with local MPS,
global timing systems, global controls, beam diagnostics, and fast abort
systems. Startup sequences can be very complex to automate bringing the
beam online after an MPS fault Control systems used to provide
pulse-to-pulse beam permit signals become a pulsed control system.
Network infrastructures need to be provided to allow this functionality.
Post mortem systems triggered by MPS will help operations recover from
faults. Automatic recovery will further increase the availability of the
machine. MPS should become a machine diagnostic tool, integrated with
other systems to maximize availability and pinpoint failures for
operations.

## References

\[1\] SNS Parameter List, SNS 100000000-PL0001 R08

\[2\] J. Alonso, "Beam Loss Working Group Report", LBNL, Berkeley CA
94720

\[3\] M. Ross, "Single Pulse Damage In Copper", SLAC, Stanford, CA94309,
USA

\[4\] K. H. Meß1, "Architecture of the Machine Protection System",
Chamonix XI, CERN, Geneva, Switzerland

\[5\] How Long a SNS Beam Pulse would Damage a Copper Accelerating
Structure? R. E. Shafer, rev. 4/20/01.

\[6\] Jean Fusellier, "Beam Intensity Monitoring and Machine Protection
By Toroidal Transformers On The TESLA Test Facility", EPAC96, CE-Saclay,
F-91191 Gif-sur-Yvette

\[7\] R. Uric, "CEBAF Beam Loss Accounting", Proceedings if the 1995
Particle Accelerator Conference, pp.2652-4

\[8\] <http://www.JACoW.org/>

\[9\] F.Bordry, "Machine Protection for the LHC: Architecture of the
Beam and Powering Interlock Systems", LHC Project Report 521, CERN, CH -
1211 Geneva 23, Switzerland

\[10\] Saeed Assadi, "Beam in Gap Measurements at the SNS Front-End",
TPAG041 ,These proceedings

\[11\]E. Bjorklund "A Proposal to Remove the Run-Permit Mode from the
SNS Event Link", SNS-NOTE-CNTRL-71

\[12\] M. Ross, private communication

\[13\] C.Adolphsen, "The Next Linear Collider Machine Protection
System," Proceedings if the 1999 Particle Accelerator Conference , 1999
IEEE, p. 253.

\[14\] R. Hardekopf, "Beam Loss and Activation at LANSCE and SNS",
Proceedings of the 7^th^ Mini-Workshop on High-Brightness Beams, Sept.
1999

\[15\] Stuart Henderson,"Exploration of Beam Fault Scenarios for the
Spallation Neutron Source Target", PAC2003, These proceedings, TPPE012