Redundancy of the LHC machine protection systems in case of magnet failures

The Large Hadron Collider (LHC) built at CERN, the European Laboratory for Particle Physics will accelerate high intensity proton beams up to an energy of 7 TeV per proton. The energy stored in the LHC magnets reaches about 10 GJ and each of the proton beams stores about 360 MJ at nominal collision energy. Accidental release of this energy in an uncontrolled way would lead to serious damage of the accelerator equipment. The LHC Machine Protection Systems are designed to protect the accelerator against such uncontrolled release of the stored energy. They provide constant monitoring of critical equipment, constant monitoring of the beam position and losses, a very reliable Beam Dump System and fast, very reliable interlock systems to transmit protection critical signals. While protecting the accelerator in case of failure, the Machine Protection Systems must also ensure maximum operational availability of the LHC beams. Magnet failures produce the fastest effects on the beam and are most critical with respect to machine protection. Quenches (loss of magnet superconductivity) and failures of the power converters (powering failures) have been considered. These failures produce a current decay in the magnet and the corresponding decay in the magnetic field. The current decay after a quench has been modeled by a Gaussian curve based on previous studies. The current decay generated by powering failures has been considered exponent ial. In order to evaluate the effects of magnet failures on the beam, particle tracking with variable magnetic fields has been done using the MADX program. Dipole failures produce a closed orbit distortion that can be easily determined analytically. Losses produced by dipole failures are generally localized. Quadrupole failures lead to beta beating and tune shift, which in the transverse plane translate into either defocusing or displacement of the beam. The crossing of non-linear resonances induced by the tune shift can generate losses of up to 10% of the beam intensity, and beam losses induced by quadrupole failures may be distributed over many locations. The transverse distribution of the primary losses at the collimators can be described by a function of exponential nature, allowing a fast characterization of the impact from the parameters of the function. Dipole and quadrupole failures lead to primary impacts that are not significantly different in shape or size, and in both cases faster failures produce broader impacts. The average impact parameter for the cases studied ranges from less than 5 um to about 1 mm. The amount of losses reaching the superconducting elements from particles scattered after a primary impact is greater for impacts at collimators outside or at the end of the cleaning insertions. It may reach up to 10% of the beam intensity at 450 GeV and 1% at 7 TeV and in most cases, it decreases with incr easing impact parameter of the primary impact. With circulating beam at LHC, powering failures of the D1 dipoles at IR1 and IR5 produce the fastest losses both at 450 GeV and 7 TeV, reaching the damage level in less than 3 ms in both cases. Other failures of normal conducting magnets could produce damage after about 10 ms and quenches in the main superconducting dipoles may lead to damage about 15 ms after the current decay starts. Redundancy is ensured when, for a given failure, at least two independent protection systems react on time. The Beam Loss Monitors are able to request a beam dump in time for every failure case considered. In combination with the Quench Protection System, the Powering Interlock Controller and the Fast Magnet Current change Monitors most failure cases are redundantly protected. Only quenches of some superconducting dipoles are not redundantly protected with these systems, but redundancy can be ensured by additional systems, such as a Fast Beam Current Monitor.