Beam Plans for Accelerator Systems: The Machine Protection System

1. Beam Plans for Accelerator Systems: The Machine Protection System Jan Uythoven On behalf of the MPWG and the MPS Commissioning WG Special thanks to R.Schmidt, J.Wenninger, A.Macpherson

2. Machine Protection System • Has to guarantee the Safe operation of the LHC under all circumstances • Hard work during all the different LHC ‘phases’: • Design phase: done • Construction phase of the individual equipment: almost done • Individual System Testing (equipment): ongoing • Global System Testing, MPS aspects • Talk Alick Macpherson, session 2 Hardware Commissioning • Starting • Tests with beam • Operation with beam This Session eLTC, 5 March 2008

3. View of the LHC - MPS Little beam dependence Core Systems LHC Devices Movable Detectors Beam Loss Monitors BCM Experimental Magnets Environmental parameters Collimator Positions LHC Devices Safe Beam Parameter Distribution LHC Devices SpecialBLMs Safe LHC Parameter Software Interlocks Sequencer Operator Buttons CCC LHC Experiments Transverse Feedback Beam Aperture Kickers Collimation System Protection elements Beam Dumping System Beam Interlock System Safe Beam Flag Injection Interlock Powering Interlocks sc magnets Powering Interlocks nc magnets Magnet Current Monitor Beam loss monitors BLM Beam LifetimeFBCM Access System Vacuum System Screens / Mirrors BTV RF System Timing System (Post Mortem Trigger) Monitors aperture limits (some 100) Monitors in arcs (several 1000) Magnets Power Converters QPS (several 1000) Power Converters ~1500 AUG UPS Cryo OK Doors EIS Vacuum valves Access Safety Blocks RF Stoppers eLTC, 5 March 2008

4. Tests with Beam • Some systems require ‘Machine Protection Tests’ with beam: • Injection System and its Protection Elements • Collimation System • Beam Dump System and its Protection Elements • Beam Loss Monitors • FMCM • Generally not to test the hardware (done without beam) but to • Check if the settings are ok • Check if the assumptions – underlying the concepts used in the ‘protection theory’ – is correct • Check interdependency within systems • Treated by talks of the individual systems in this session • Listed as tests in the procedures developed in the MPS Comm. WG eLTC, 5 March 2008

5. Daily Operation with BeamThe Ideal World • The MPS hardware is working under nominal configuration: • Beam dump request is only given when it is required • No ‘false’ hardware interlocks via BIS • No ‘false’ software interlocks via SIS • Systems are brought into operation according to MPS commissioning plans • Depends on beam intensity and beam energy = commissioning phase • Machine model is nominal, fitting to the corresponding phase : • Optics functions within tolerance (orbit, tunes etc.) properly corrected and within tolerances, beam intensity and energy within the pre-defined limits • Try to stick to ‘stable optics’ – avoid verification of MPS for new conditions • Operational procedures related to Machine Protection ok: • Beam quality checks ok • Post Mortem following beam dump fully understood • Post Operational Checks (injection, beam dump) always ok Be sure not to work outside the agreed upon conditions: • A system is required to restrict the operation within the well defined window: • Clear procedures / limits known at all times: central place to keep this info! • Software interlock on energy / intensity / optics? (e.g. limit operation at 2 TeV) eLTC, 5 March 2008

6. Daily Operation with BeamThe Real World Interlocks Safe • Hardware malfunctioning or not available • Automatic Post Operational Checks stop operation • Produce interlock which needs resetting • No interlocks, but one does not fully understand what happened • Post Mortem • Machine is not in nominal conditions • Different tunes, optical functions etc. Beam Dump, or no ‘green light’ to inject: operation Stopped Safe, but degradation of the machine up-time: action desired Next Slide Unsafe No Interlocks Not Safe to continue:Procedures – discipline of the operators, need clear limits and/or restrictionsCheck of MPS functionality under the different conditions / change interlock settings Previous Slide Next Slide eLTC, 5 March 2008

7. Beam Dump, or no ‘green light’ to inject: operation Stopped Safe, but degradation of the machine up-time: action desired Is this sufficient (I, E) Y Mask Y Follow-up N Possible to mask? Can it be fixed within an acceptable delay Y Fix it N N RBAC MCS, … Possible to adjust the interlock level or the settings to continue Acceptable? Adjust Y Y Follow-up N N RBAC MCS, … Acceptable? Useful? which? Continue with Different beam conditions ? (I , E, Optics) Adjust (SIS) Y Y Follow-up N N RBAC MCS, … Acceptable? Y Disable the interlock Adjust Y N Follow-up N Stop the LHC,Restart after Repair eLTC, 5 March 2008

8. Protection andBookkeeping RBAC MCS, … • When Settings or Interlock Levels ’can be changed’, protection against ‘anybody’ doing this and errors in transmission. Talk V.Kain on Friday: • Role Based Access Control (RBAC) • Management of Critical Settings (MCS) • Coherent list of equipment where this is required • Coherent list of people for the specific equipment • Need to do the bookkeeping of all changes Change of Settings, Interlocks Disabled Change of Settings, Interlocks Disabled TOOL eLTC, 5 March 2008

9. Maskable InterlocksSafe Machine Parameters • Selected set of BIS interlocks or maskable: • First step if unexpected interlock – during the beam commissioning phase: can the interlock be masked? • Agreed upon procedures, decided upon before the beam commissioning started • Foreseen especially for the commissioning phase • Should be rather straight forward – done by EIC • However: bookkeeping • Software Interlock System: • Do we need to have maskable interlocks for the SIS (disabled with safe beam)? • Also ‘ RBAC like system’ on SIS? • SIS talk by J.Wozniak on Friday If we don’t trust our definition of ‘safe beam’ – Sector test session: provoke quench – then we should NOT use any maskable interlocks… eLTC, 5 March 2008

10. Is this sufficient (I, E) Beam Dump, or no ‘green light’ to inject Automatic protection, but degradation of the machine up-time: actions desired Y Mask Y Follow-up N Possible to mask? Can it be fixed within an acceptable delay Y Fix it N N RBAC MCS, … Possible to adjust the interlock level or the settings to continue Acceptable? Adjust Y Y Follow-up N N RBAC MCS, … Acceptable? Useful? which? Continue with Different beam conditions ? (I , E, Optics) Adjust (SIS) Y Y Follow-up N N RBAC MCS, … Acceptable? Y Disable the interlock Adjust Y N Follow-up N Stop the LHC,Restart after Repair eLTC, 5 March 2008

11. Is this sufficient (I, E) Beam Dump, or no ‘green light’ to inject Automatic protection, but degradation of the machine up-time: actions desired EIC can decide by him/her-self Mask Y Follow-up Y Possible to mask? Advice from equipment specialist Can it be fixed within an acceptable delay Y Fix it Decision increasingly complicated to take Advise / Discussion / Green light required N RBAC MCS, … Possible to adjust the interlock level or the settings to continue Acceptable? Adjust Advice from ‘LHC Protection Panel’ Y Follow-up N RBAC MCS, … Acceptable? Useful? which? Continue with Different beam conditions ? (I , E, Optics) Adjust Y Follow-up RBAC MCS, … + …. N RBAC MCS, … Acceptable? Disable the interlock Adjust Y Follow-up Stop the LHC,Restart after Repair eLTC, 5 March 2008

12. Responsibilities Engineer In Charge Equipment Experts Machine Coordinator Commissioner in Charge LHC Protection Panel Concerning Machine Protection System Magnet Performance Panel In place for ‘magnet protection’, Already used during Hardw. Comm. A.Siemko, MPP meeting 21/09/2006 J. Uythoven, ‘Chamonix’ 2006 eLTC, 5 March 2008

13. LHC Protection Panel • Group of experts who have an overview of • The nominal MPS • MPS  MPSi • The actual state of the MPS • The bookkeeping • Can’t foresee all permutations, can’t write procedures in case of failures beforehand, need experience with the actual systems and flexibility to adjust • See ‘Chamonix’ 2006 • New: LPP members  MPS Comm WGThis group of experts exists! JET is operating since many years with a Machine Protection System Panel eLTC, 5 March 2008

14. Examples Can take 10’s of hours out of physics: so cannot be decided on by individuals but needs support/weight of LPP BG • BIS problem • STOP • Asynchronous beam dump • Analysis by BT group of XPOC data • If the result of the BT analysis is not clear: • Fix / replace doubtful equipment • Series of runs of LBDS without beam • Series of test dumps with low intensity beam • Check interface to other equipment: RF, timing, … • BLM crate not working • Repair • If not possible, can change ‘Master Table’ (RBAC etc.) to continue with: • Safe beam? • Pilot at 450 GeV? • No beam • dIbeam/dt interlock available in a later stage, so been running with limited beam power without this interlock • If this system has a hardware problem: gives an interlock and stops operation • Do we need to stop until it is fixed? • Can we continue, but with limited beam power? • Can we just continue? • BLM signals behind collimators giving higher values than normal • When do we stop operation (only at interlock level?) • How much time do we take to re-optimise collimator settings • What do we do if we can’t get back in the old situation • Suddenly no losses measured on BLM collimators any more…! No interlocks or RBAC, but here LPP should be of help as well! eLTC, 5 March 2008

15. Conclusions • The aim is to have a fully operational MPS, functioning under nominal conditions, all the time. • In all circumstances the state of the MPS should be known • Inventory of ‘hardware’ which is not standard • Settings • Interlock Levels • Masking • Disabling • In all circumstances the operational limits and conditions of the machine should be clear • For the standard conditions, depending on the commissioning phase • If one is allowed to only run under special conditions: • An LHC Protection Panel should be used to advise the EIC when significant changes to MPS systems and their settings need to be made to continue or optimise operation • This is at least the case when RBAC is required to make the change • Once agreed upon to make a change to MPS (settings): procedures for doing this • Clear definitions of applying RBAC and MCS – coherent approach • Who can make hardware changes? Obvious? • Do we need a kind of RBAC on the Software Interlock System? • Maskable interlocks with Safe Beam on SIS? Tool(s) required for keeping track of MPS conditions Tool(s) required for keeping track of allowed machine conditions eLTC, 5 March 2008