Machine Protection System

The task of the machine protection system, MPS, is to protect the machine components from being damaged by the beam when equipment failure or human error causes the beam to strike the vacuum envelope. The MPS design must take into account the types of failures that may occur and the damage they could produce.

2.9.5.1 Overview

The ILC Machine Protection System (MPS) is a collection of devices intended to keep the beam from damaging machine components. The nominal average beam power is 20 MW, consisting of 14,000 bunches of 2×10¹⁰ particles per second, and typical beam sizes near 10 × 1 µm. Both the damage caused by a single bunch and the residual radiation or heating

DRAFT

caused by small (fractional) losses of many bunches are important for MPS. The MPS consists of 1) a single bunch damage mitigation system, 2) an average beam loss limiting system, 3) a series of abort kickers and dumps, 4) a restart ramp sequence, 5) a fault analysis recorder system, 6) a strategy for limiting the rate with which magnetic fields (and insertable device positions) can change, 7) a sequencing system that provides for the appropriate level of protection depending on machine mode or state, and 8) a protection collimator system. The systems listed must be tightly integrated in order to minimize time lost to aberrant beams and associated faults.

2.9.5.2 Single Pulse Damage

Single pulse damage is mitigated by systems that check the preparedness of the machine before the high power beam passes. Single pulse damage control is only necessary in the

‘damped-beam’ section of the ILC. Three basic subsystems are involved: 1) a beam permit system that surveys all appropriate devices before damping ring beam extraction begins and provides a permit if each device is in the proper state 2) an abort system that stops the remaining bunches of a train if a bunch does not arrive at its intended destination 3) spoilers upstream of devices (typically collimators) to expand the beam size enough that several incident bunches do not cause damage. In addition, some exceptional devices (damping ring RF and extraction kickers for example) have fast monitoring systems and redundancy.

Spoilers or sacrificial collimators are placed before the bunch compressors, in the undulator chicane, at the beginning of the BDS system and in the collimator section of the BDS.

Locations with dispersion downstream of an accelerator section have spoilers to intercept off-energy beam caused by klystron faults or phase errors before the beam can hit a downstream collimator or beam pipe. The spoilers are designed to survive the number of incident bunches that hit before the abort system can stop the beam. If this design becomes problematic, the use of a pilot bunch is being kept as an option. A pilot bunch is one percent of nominal current and is spaced 10 µs ahead of the start of the nominal train. If it does not arrive at its intended destination, the beam abort system is triggered to prevent full intensity bunches from hitting the spoiler.

Studies [102] have shown that for many failure scenarios such as quadrupole errors or klystron phase errors, the beam is so defocused by the time it hits the linac aperture that it does not cause damage. For this reason, no spoilers or extra beam abort kickers are included in the linac.

The beam abort system uses BPMs and current detectors to monitor the beam trajectory and detect losses. On a bunch by bunch basis, the system checks for major steering errors or loss of beam. When a problem is detected it inhibits extraction from the damping ring and fires all abort kickers upstream of the problem. The abort kickers cleanly extract the beam into dumps, protecting downstream beamlines.

In the few milliseconds before the start of the pulse train, the beam permit system checks the readiness of the modulators and kicker pulsers, and the settings of many magnets before allowing extraction of beam from the damping rings.

2.9.5.3 Average Beam Loss Limiting System

Average beam loss is limited, throughout the ILC, by using a combination of radiation, thermal, beam intensity and other special sensors. This system functions in a manner similar to other machines, such as SLC, LHC, SNS and Tevatron. If exposure limits are exceeded

DRAFT

at some point during the passage of the train, damping ring extraction or source production (e⁺/e⁻) are stopped. For stability, it is important to keep as much of the machine as possible operating at a nominal power level. This is done by segmenting it into operational MPS regions. There are 11 of these regions, as noted in Table 2.9-3. Beam rate or train length can be limited in a downstream region while higher rate and train lengths are maintained in upstream regions.

TABLE 2.9-3

Beam shut off points. Each of these segmentation points is capable of handling the full beam power, i.e.

both a kicker and dump are required. These systems also serve as fast abort locations for single bunch damage mitigation.

Region name Begin End

1 e⁻ injector Source (gun) e⁻ Damping ring injection (before) 2 e⁻ damping ring Ring injection e⁻ Ring extraction (after)

3 e⁻ RTML Ring extraction e⁻ Linac injection (before) 4 e⁻ linac Linac injection Undulator (before)

5 Undulator Undulator BD; e⁺ target

6 e⁻ BDS BD start e⁻ Main dump

7 e⁺ target e⁺ target e⁺ damping ring injection 8 e⁺ damping ring Ring injection e⁺ ring extraction

9 e⁺ RTML Ring extraction e⁺ linac injection 10 e⁺ linac Linac injection e⁺ BDS

11 e⁺ BDS e⁺ BDS e⁺ main dump

2.9.5.4 Abort Kickers and Dumps

Abort systems are needed to protect machine components from single bunch damage. It is expected that a single bunch impact on a vacuum chamber will leave a small hole, roughly the diameter of the beam. Each abort system uses a fast kicker to divert the beam onto a dump. The kicker rise time must be fast enough to produce a guaranteed displacement of more than the beampipe radius in an inter-bunch interval.

There are three abort systems in each RTML, one at the undulator entrance, and one at the entrance to each BDS.

There will be many meters of fast kickers needed at each dump and megawatts of peak power from pulsers. R&D is need to optimize the system and and ensure its reliability.

2.9.5.5 Restart Ramp Sequence

Actual running experience is needed to exactly define the restart ramp sequence. For that reason the sequencer must be flexible and programmable. Depending on the beam dynamics of the long trains, it may be advisable to program short trains into a restart sequence. There may also be single bunch, intensity dependent effects that require an intensity ramp. In order to avoid relaxation oscillator performance of the average beam loss MPS, the system must be able to determine in advance if the beam loss expected at the next stage in the ramp

DRAFT

sequence is acceptable. Given the number of stages and regions, the sequence controller must distribute its intentions so that all subsidiary controls can respond appropriately and data acquisition systems are properly aligned.

The sequence may need to generate a ‘benign’ bunch sequence with the nominal intensity but large emittance. The initial stages of the sequence can be used to produce ‘diagnostic’

pulses to be used during commissioning, setup and testing.

2.9.5.6 Fault Analysis Recorder System

A post mortem analysis capability is required that captures the state of the system at each trip. This must have enough information to allow the circumstances that led to the fault to be uncovered. Data to be recorded on each fault include: bunch by bunch trajectories, loss monitor data, machine component states (magnets, temperature, RF, insertable device states), control system states (timing system, network status) and global system status (se-quencer states, PPS, electrical, water and related sensors). The fault analysis system must automatically sort this information to find what is relevant.

2.9.5.7 Rapidly Changing Fields

In addition to the above, there are critical devices whose fields (or positions) can change quickly, perhaps during the pulse, or (more likely) between pulses. These devices need 1) special controls protocols, 2) redundancy or 3) external stabilization and verification systems.

1. Depending on the state of the machine, there are programmed (perhaps at a very low level) ramp rate limits that keep critical components from changing too quickly. For example, a dipole magnet is not allowed to change its kick by more than a small fraction of the aperture (few percent) between beam pulses during full power operation. This may have an impact on the speed of beam based feedbacks. Some devices, such as collimators are effectively frozen in position at the highest beam power level. There may be several different modes, basically defined by beam power, that indicate different ramp rate limits.

2. There are a few critical, high power, high speed devices (damping ring kicker and RF, linac front end RF, bunch compressor RF and dump magnets) which need some level of redundancy or extra monitoring in order to reduce the consequence of failure. In the case of the extraction kicker, this is done by having a sequence of independent power supplies and stripline magnets that have minimal common mode failure mechanisms.

3. There are several serious common mode failures in the timing and phase distribution system that need specially engineered controls. This is necessary so that, for example, the bunch compressor or linac common phase cannot change drastically compared to some previously defined reference, even if commanded to do so by the controls, unless the system is in the benign beam-tune-up mode.

2.9.5.8 Sequencing System Depending on Machine State

The ILC is divided into segments delineated by beam stoppers and dump lines. There may be several of these in the injector system, two beam dumps in each RTML, and 2 (or 3) in the beam delivery and undulator system. In addition, the ring extraction system effectively operates as a beam stopper assuming the beam can remain stored in the ring for an indefinite

DRAFT

period. This part of the MPS assumes that the beam power in each of these segments can be different and reconfigures the protection systems noted above accordingly.

2.9.5.9 Protection Collimators

The entire ILC requires protection collimators and spoilers that effectively shadow critical components. These devices must be engineered to withstand innumerable single pulse im-pacts. The number and locations of these protection collimators are documented in the descriptions of each accelerator region.

2.9.6 Operability

To ensure high average luminosity it is important that the ILC have many features built in to make its operation mostly automatic and efficient. These features include:

• Accurate, reliable, robust diagnostics

• Monitoring, recording, and flagging of out-of-tolerance readings of all parameters that can affect the beam. Some of these must be checked milliseconds before each pulse train so beam can be aborted if there is a problem.

• Beam-based feedback loops to keep the beam stable through disturbances like temper-ature changes and ground motion

• Automated procedures to perform beam based alignment, steering, dispersion correc-tion, etc.

• Automatic recovery from MPS trips starting with a low intensity high emittance beam and gradually increasing to nominal beam parameters

2.9.6.1 Feedback systems

The transport of the beam through the ILC requires a large number of feedback systems to be active to steer the beam to the interaction point. These feedback systems include measurements from various beam position monitors, from laserwires scanning the beam profile and other diagnostics. The feedback loops must be carefully designed to be orthogonal and to maintain corrections that are within the device ranges. The feedback systems must avoid trying to compensate for large deviations of the beam due to component failure. It is hence necessary to use flexible setups for the control loops such as provided by MATLAB tools and analysis techniques.

DRAFT