Possible Causes and Consequences of Serious Failures of the LHC Machine Protection Systems

The LHC machine protection systems, including the beam dumping system, are designed to ensure that failures leading to serious damage to the LHC during its lifetime are extremely unlikely. These kind of failures, for instance requiring a combination of equipment failure and surveillance failure, have to date been considered as being 'beyond the design case'. However, their consequences need to be evaluated to determine the required safety levels of the protection systems. A second objective is to understand if measures can and should be taken to further reduce the probability of such failures, or to minimise their impact. This paper considers various serious failure modes of the different machine protection systems. The probable consequences and possible ameliorating measures of the worst-case scenarios are discussed. The particular case of having a stored beam with an unavailable beam dumping system is mentioned, together with possible actions to be taken in such an event.