Outline

1

Can we sufficiently protect Can we sufficiently protect the SPS and its extraction lines the SPS and its extraction lines

against damage against damage in a multi-cycling and high intensity in a multi-cycling and high intensity

beam context?beam context?

2

The purpose

The current solutions

The proposals

Wrapping up

OutlineOutline

14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days 3

Why a Beam Interlock system?Why a Beam Interlock system?

Equipment #N

Interlock

EquipmentsEquipmentsEquipment #3

Equipment #2

Equipment #1

KickerSystem

Transmits the result as:

- Dump Request

- Injection Permit

- Extraction Enable

Collects status or

default signals

Performs a summation of all signals

As one of the systems involved in the machine protection,

the Interlock system has to:


which mission?which mission?

For the SPS Ring● Dump the Beam if unsafe situation● Stop Injection

For the Extraction Lines● Enable extraction if everything OK● Request a beam dump if not enabled

Equipment #N

InterlockEquipments

Operators

EquipmentsEquipment #3Equipment #2

Equipment #1

KickerSystem

Post-MortemAlarm system

Timing

Transmits the output signal

and also:● Transmit an Alarm● Alert Cycle Beam Manager● Inform Operator● Allow Post-Mortem Analysis


Hw or Sw Interlock ?Hw or Sw Interlock ?

Equipment #N

InterlockEquipments

Operators


Equipment #1

KickerSystem


Timing

Hardware Interlock:● for critical elements● for fast response

Software Interlock:● as a second line of defense● for lower R-T constraints● for non standard elements (magnets in MD,…)

Performs a summation of all signals


Which sources ?Which sources ?

Equipment #N

InterlockEquipments

Operators


Equipment #1

KickerSystem


Timing

Interlock signal categories:● State Interlocks

Power Converter ON/OFF Vacuum valves IN/OUT etc…

● Setting Interlocks Magnet current out of tolerance window Beam loss > defined threshold Beam position > specified limit etc….

Collects


Features?Features?

Main characteristics: should be Reliable should be Available should be Real-Time should be “Flexible” should be helpful for operators

What about high intensity beam operation?

And what about fast multi-cycling changes?

Equipment #N

InterlockEquipments

Operators


Equipment #1

KickerSystem


Timing

8

The purpose

The existing solutions

The proposals

Wrapping up

22ndnd part part


Present Hw Interlock: Clients & Layout Present Hw Interlock: Clients & Layout

BA1crate 3

BA1crate 1

BA1crate 2

SSIS

EmergencyBeamDump

PCR reset

Beam Dump Kicker

Trigger

InjectionInhibit

Injection Kicker

Standby

Extraction Kicker

CPShardwired

ExtractionInhibit

Disable

Vacuum

Main P.S.& Sextupoles

MPS fast chain

BD Internal fault

BD no trigger

Energy Tracking

Totem

Collimator tests

Beam Tracking

Beam Position

Beam losses 1

Beam losses 2

Beam losses 6

R.F.

Beam losses ring+ BCT

BA6crate 4

Sum BA6

SSIS

Septum Fault

TT60 P.S.

…

Kdsba1 watchdog


Present Hw Interlock: is it suitable for the future?Present Hw Interlock: is it suitable for the future?

Could be used for short term but has to be replaced anyway

Simple and robust system● Basic AND logic of all signals anyone could cause a beam dump● Every signal could be set in remote mode (therefore maskable by the operator) ● Inhibits the injection when a circulating beam has been dumped● Installed in only one place (next to the beam dump itself) therefore every client needs its own cable to BA1 …

Machine timing independent● Any timing/cycle dependence is handled by the clients

Managed for the time being by AB/BT and installed in the 80s Cannot be extended anymore

we are running out of spare parts…


Extraction

Present Software Interlock systemPresent Software Interlock system

Written in the 90s, the SPS Software Interlock System is composed of 4 parts (SSIS hardware, Kernel, Accelerator Equipment Monitor, and User interface)

and interacts with several other systems

PS Operation

Stop Ejection

Alarm system

DumpRequest

EmergencyBeam Dump(Hw Interlock)

Injection

A.E.M.

User Interface

SSIS Kernel

SSIShardware

Equipment #NEquipmentsEquipmentsEquipment #3

Equipment #2Equipment #1

SPS EquipmentSPS Equipment

SPS Equipment

SPS Mode

PCR operators

Console switches

By-pass switch


Present Software Interlock ChannelsPresent Software Interlock Channels

The watched equipments, sub-systems or elements are : ● Main Power Supplies error● STOPPER MOVING● DUMP INTLK DISABLED● RADIATION BB4/5 or TI8/TT41● Operator request● Switching AUXPS / ROCS reload● MD PODH in 4 should be off● GEF'S EXT.N RELOAD● W.Extr. (or N.Extr.) Bumper in bad state● HIGH ENERGY STORAGE● HIGH INTENSITY ON NORTH TARGET● EDF CRITICAL PERIOD● WOBBLE FAULT NORTH● Injection Interlock Disabled● E A UNSAFE● SETTING UP SEM OFFSET TABLE● SPS VACUUM INTLK. CHAIN BROKEN● HIGH INTENSITY/HALO ON WEST TARGET● W ZS in bad state● MBBT 6202 OUT OF TOLERANCE● QBM in 6 ON - should be off● Beam loss ring● N ZS in bad state● TED TT40 ● TED TI8● TBSE TT41● TBSE 80243 in bad state or position fault● WOBSU N/alarm system communication problems● EXTRACTION INHIBIT CHANNEL DISABLED● BI-BTV RING or BI-BTV TRANSFER could be IN● Extr. Sextupole OFF

● ZS GIRDERS in beam● SCHOTTKY PU in beam● TIDV water fault.● TED First Turn in beam● TED TT60 or TED TT20 in bad state● ACCESS CHAIN broken● BHZ 377 in bad state● COLLIMATORS 1 in bad position or COLLIMATORS STEP 4 in beam● COLLIMAT & SCRAP 5 in bad position● SCRAPER 5 ENABLED● TT10 MAGNETS in bad state● West MST/MSE or North MST/MSE in bad state● TT60 MAGNET or TT20 MAGNET in bad state● P0 Line TAX closed or P0 Line BEND error● EAST BUMPERS in bad state● COLDEX LSS4● MDVW in 5 in bad state● STOPPER TT20 or STOPPER north IN with TED OUT● East EXT. GIRDER LSS4 in beam● MBSG 410 OUT OF TOLERANCE● TT40 MAGNETS or TT41 MAGNETS or TI8 MAGNETS IN BAD STATE● EAST MSE IN BAD STATE● TT40 TOO LOW (or TOO HIGH) INTENSITY● VACUUM PLATES IN 5 IN BEAM● MDHW / QSE in 5 in bad state● MKE MAGNETS LSS4 OVER-TEMP● 1 or 2 TBSE in with TED TT40 out


Present Sw Interlock system: Present Sw Interlock system: Does it fit the purpose?Does it fit the purpose?

Does not fulfil fast cycle changes andmust be upgraded (or remade) for the future

Features● Reliable system

● Connected to the Hardware Interlock but could be by-passed by an operator

● Operators can disable any individual interlock channel as well

● Does not provide any safeguards against forgotten masks! (except message on Alarm screen)

● Quite slow response time with polling rate fixed to 20 sec

● Uses “old” SL-Equip procedure for Equipment access

● Difficult to analyse after a fault and access to logged data

Machine timing independent● Does not react to cycle changes● The operators modify the settings via the SPS Mode

14

The purpose


The proposals

Wrapping up

3rd part3rd part


target

LSS6 Fast

Extraction

LSS2 Slow

Extraction

LSS4 Fast

Extraction

one for the SPS Ring and one for the 3 Extraction Lines.

Two types of Hw Interlock must be considered:

In both cases, the LHC Beam Interlock platform (i.e. BIC) will be used.


Process duration time= ~20 µs max (from User signal to Beam Dump trigger)

fixed frequency via 2 optical fibres: if one loop open Beam Dump

● Reliable with full redundant system (from User request to B-D activation)

● Flexible (Masking possible)

but secure (Safe Beam Flag condition)

● Software for live monitoring

and for post-mortem analysis

BIC

DumpBA1

BA2

BA3 BA4

BA5

BA6

BIC

BIC BIC

BIC

BIC

Inj.

6 distributed controllers (BIC)+

2 Beam Permit loops(for redundancy)

~30 input signals are foreseen

Global estimated cost : ~250kCHF

Proposal for SPS Ring Interlock Proposal for SPS Ring Interlock

The layout would be identical to LHC Beam Interlock System:

LHC

As the LHC Interlock:


““Flexible” with SBFFlexible” with SBF

The SAFE BEAM FLAG is a distributed information to allow some flexibility while maintaining safety.

In general, Beam operation is permitted when all User Systems are OK. But masking should be possible if the beam is “safe” and cannot result in

damaging equipment => concept of MASKABLE / NOT MASKABLE partition with the SBF condition.

The NOT MASKABLE signal will be NEVER ignored. The partition (MASKABLE / NOT MASKABLE) is permanently defined by hardware and is remotely

readable from the Supervision.

For the SPS: the SBF could be derived from the beam intensity. It will be generated and distributed by a dedicated (and reliable) system.

IF SBF = TRUE● if a masked signal is present: it will be ignored and the beam operation will continue.

IF TRUE → FALSE● Masking is no longer taken into account● if a masked signal is present: the beam will be dumped.


Proposal for Extraction lines InterlockProposal for Extraction lines Interlock

(final) layout of LSS4 as an example:

some “slave” BICs assigned to interlock zones

( TT40, CNGS line, TI8…)

Interlock logic still independent of cycle changes

One “master” BIC:• Receives all summary signals and generates the Extraction Enable signal

• Provokes a Beam Dump trigger if Extraction is not enabled or “disappears” (slow extractions, kicker misfiring)

• For efficient operation: a beam dependent logic could be applied in case of failure in either TT41 (CNGS beam) or in TI8 (LHC beam)

Master/slave architecture using the same hardware units (BIC):

SPS

TT40

TT41

LSS4

Extraction Elements

LHC Inj.

TI8 / TT41

Switch

Ti 8 upstream

Ti 8

downstream

BICBIC

BICBICBICBIC BICBIC BICBIC BICBIC

LHCBeam Permit

LH

C

Extraction Enable

SBF

Beam Type?


Already used in LSS4Already used in LSS4

ROCS

BPM

VAC

MKE

etc… Patchingmodules

Coremodules

CPU + CTRPModules

VME crate with LynxOS

UTC

via SPS Timing

Control Network

Application

ExtractionEnable

BLM

User Interfaces

Successful participation in TT40 & TI8 tests performed in Autumn 2004!

User Interface

Opticalmodule to Extraction

Kicker

Simplified layout of the installed material:

20

The purpose


The proposals

Summing up

4th part4th part


To sum up: To sum up: (1/3)(1/3)

Yes, if we:- continue to deploy the Extraction Interlock in the 3 Extraction lines. - install a new Hardware Interlock for the Ring. Because:

● It fulfils SPS requirements● Full redundant system designed for LHC (:= 200*SPS stored energy)

● Masking allowed with Safe Beam Flag condition● Already existing Hw solution with its Monitoring software

but:

● Missing Budget● Lack of Manpower● Required time for: Production, tests, Installation, SBF

implementation, and finally Commissioning

Difficult to do it before next start-up

Can we sufficiently protect… …in a high intensity beam context?

We propose an intermediate solution for 2006 (and not beyond): by setting up the new system for the SPS ring (in // with the existing one) and by connecting the clients step by step.


Yes! as the new Hardware Interlock is still independent of the cycle changes:

● Interlock process should stay simple (and then reliable)● The Cycle/Beam changes are managed by the Clients

Yes, if Software Interlock is able to process the cycle changes: via an upgrade of the existing SSIS ?

But, it will require extensive testing to make sure

the changes will not affect the software stability! Wasted time?

Can we sufficiently protect… in a multi-cycling mode context?


or via a new study? Invest in a new software interlocks forthe LHC era one single coherent system thatwill take care of the SPS ring and transfer lines too. Need time & resources: a 2 man-year activity?

We propose minimal changes (only if absolutely necessary) to present SSIS for the start-up of 2006.

In parallel, we’ll be working on a new LHC era software interlock system, which should phase out SSIS. First deliverable around mid 2006.



On the Equipments side, the interlock parameters must be reconsidered and carefully selected :

● Decide on a connection to Hw Interlock or to Sw Interlock● Set the correct values for Setting Interlocks● Define the right multi-cycling settings● Perform the corresponding tests● Could be useful to implement a kind of “Interlock Reference Manager”?

To store all the interlock references in a defined place To get an history of reference values changes To permit (or not) the modification of defined thresholds:

Modify a threshold (in a wrong way) is equivalent to masking!

Interlock and Kicker systems are designed to be highly reliable. But the machine protection relies as well on the Interlock sources (i.e. the Equipments)

We have to profit from both Hw & Sw Interlock systems replacement by a review of all involved elements:Jorg, Rossano, Rüdiger and myself are ready to participate to this task…

Support and willingness are welcome!


Thank you for your Thank you for your attentionattention

Acknowledgements to Etienne Carlier, Katarina Sigerud, Claude Despas & Benjamin Todd

And a special thanks to Jorg Wenninger, Rossano Giachino & Rüdiger Schmidt


AnnexesAnnexes


target

LSS6 Fast

Extraction

LSS2 Slow

Extraction

LSS4 Fast

Extraction

are using the same LHC Beam Interlock solution (i.e. BIC)

● Circulating beam is less difficult to protect (thanks to beam losses for ex.)

● “Static” process in latch mode:

● Same architecture as LHC

is proposed with distributed

controllers around the ring

linked by beam permit

loops.

“long” period

● Fast Extraction is more tricky:

one shot process!

● Dynamic process (transparent mode):

● Master/slave architecture is proposed for each Extraction Line. A first version has participated in TT40/TI8 tests in Autumn 2004.

some mS

the SPS the SPS RingRing interlock & the (3) interlock & the (3) Extraction LinesExtraction Lines interlock systems interlock systems


Site Interlock signal New? Comment

BA1 BL Ring Sextant 1 (y)

BA1 BLD LSS1 + TT10 Fast beam losses LSS1 / injection

BA1 Ring Vacuum Existing and unique SPS signal has to be segmented in: TT10,Ring, TT40, TT41,…

BA1 Main Power Supplies (MPS)

BA1 MPS Fast Chain Fast transients on 18 kV

BA1 TT10 PC surveillance Y Possible future PC surveillance for TT10

BA1 Beam Dump Internal Fault

BA1 Beam Dump Energy Tracking

BA1 Beam Dump no trigger

BA1 Beam Dump beam tracking

BA1 Software interlock system Input signal from software interlock system

BA1 Beam Position > 30 mm Existing beam position interlock


BA2 BLD LSS2 + TT20 Fast beam losses LSS2 / extraction

BA2 Extraction Interlock System LSS2 Y SCIC beam dump request


BA3 RF

BA3 Software interlock system Input signal from software interlock system

BA3 BCT (ramp losses) Y

BA3 BCT (beam structure) Y Quality interlock from FBCT

BA3 Beam Position Y New beam position interlock




BA4 Extraction kicker mode Y Interlock set when the kicker is in LOCAL mode.





BA6 Extraction kicker mode Y Interlock set when the kicker is in LOCAL mode.

Expected input signals to the SPS beam interlock system:


Supervision for BIC-TT40 Supervision for BIC-TT40 (Top Screen)(Top Screen)


Power Converter SurveillancePower Converter Surveillance

• The currents are checked within a defined window against a reference VALUE (with a certain tolerance).

• Reference value and tolerance : • Depend on cycle/beam type.• Are loaded independently of the usual functions.

Courtesy of Jorg Wenninger

For the fast extractions, a fast power converter surveillance is now provided:

The slow extractions will also profit from it !

In the SPS there is presently no hardware surveillance of PC currents.


Timing interface for Interlock?Timing interface for Interlock?

With Multi-cycling and fast cycle changes: Obviously, Sw Interlock has to deal with cycle changes. In return, Interlock must inform the CBCM in order to stop the corresponding beam production. On the other hand, the Hw Interlock process should remain independent of timing. Cycle changes must be handled by the clients (power converter, instrumentation, kickers,…) for their interlock signal activation.

Nevertheless, what to do for the TT41/TI8 selection? Danger to have a beam through a wrong extraction channel => The extraction interlock system should apply the correct conditions. But how to know the beam type?

via the Machine Timing? or via a Energy Meter? or both for redundancy?

TT41

Extraction Elements

Ti 8 upstream

BICBIC

BICBICBICBIC BICBIC BICBIC BICBIC

Beam Type

What is the source to set the TT41/TI8 Switch’s position?


Redundancy

BeamPermitLoops

USER_PERMITSignal

m

Tr

2

Switch Rcv

Tr Switch Rcv

OpticalInterfaceModule

BICIBICIBICIBICIBICIBICIBICIUserInterface

1

3

4

16

COREModule

(for Beam 1)

Loop A (Beam 1)

Loop B (Beam 1)

Loop A (Beam 1)

Loop B (Beam 1)

16

MatrixB

MatrixA

2Patching and Interface

Modulesfor Beam 1

Redundant link

for each User Interface

Two Matrixes in //

Two Loops

Beam

Interlock

Controller


Safe Beam Flag for LHC Safe Beam Flag for LHC

For the LHC, SBF will be generated in IR4 by a dedicated system. Derived from LHC energy and from beam intensity:

● Energy value coming from the ultra reliable energy tracking system● Intensity of beam 1 and beam 2 measured by the BCTs

Threshold value should normally be fixedMust be possible to set it to different value after receiving authorisation (to be defined) and new value must be logged.

If ( Ibeam1 · Energy ) < Threshold1 then SFB1 = PRESENT else SFB1 = NOT PRESENTIf ( Ibeam2 · Energy ) < Threshold2 then SFB2 = PRESENT else SFB2 = NOT PRESENT


Interface with LBDSInterface with LBDS (example with Beam1) (example with Beam1)

BIC-R6BIC-L6BIC-L5 BIC-R5 BIC-L7 BIC-R7

Dumping SystemBeam 1

other BICs: L4, R4, L3, R3, L2, R2, L1, R1, R8, L8

10 MHzstop

10 MHz

USER_PERMITsignals

USER_PERMITsignals

USER_PERMITsignals

USER_PERMITsignals

USER_PERMITsignals

USER_PERMITsignals

Loop B1

Loop A1

USER_PERMITsignals

stop

Same interface for Beam2…

Outline

Documents

Transcript of Outline