# Presentation: 045457

## Interlocking strategy

**Interlocking strategy**

- J. Wenninger R.Giachino
- AB Department / OP Group

- Interlock system,
- 		concepts & architecture.
- Injection protection,
- 		safe beams and beam presence.

**Acknowledgements : B. Puccio, B. Todd, R. Schmidt **

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## What is an interlock system

- As part of the machine protection system, the role of the interlock system is to:
- collect interlock signals from users/clients
- apply an adequate logic to the signals
- transmit result to the relevant system for ‘action’
**USER = EQUIPMENT SYSTEM**

***    ******Transmits *****the result as:**
**     ****- Dump Request**
**     ****- Injection Permit**
**     ****- Extraction Permit**
**     ****- Beam stop (injectors)**

***Collects s*****tatus ****or **
**fault signals**
**from ****users/clients**

***Applies***
**adequate logic**
** ****to all signals**

**Hardware **
**or **
**software**
**link**

**Hardware **
**or **
**software**
**link**

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Interlock systems at the LHC

- The powering interlock system
**Protects the magnets, interacts with power converters, quench protection and energy extraction systems.**
**Provides inputs to the LHC beam interlock system.**
_**Not part of this talk**_
- The LHC beam interlock system
**Interacts with all LHC equipment systems involved in the protection of the machine.**
**Interfaces to the beam dumping system and SPS extraction interlock system.**
- The LHC injection / SPS extraction interlock system
**Protects the transfer lines from SPS to the LHC.**
**Protects the LHC against bad injection.**
- The software interlock system
**Provides additional protection through high level, potentially complex ‘algorithms’**
**Used as a diagnostic tool **
_**Not part of this talk, **_**work is just starting on this issue.**

**Hardware**
**links**

**Software**
**links**

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Objectives of the LHC beam interlock system 

- One of the central systems required to operate the LHC safely with beam.
- Two roles :
- 1) Permit injection when all connected user systems are ready for beam.
- 2) With circulating beam, transmit any beam dump request from connected user systems to beam dumping system.

- Additional objectives :
- Protect the beam
**Faulty trigger signals must be avoided.**
- Provide the ‘evidence’
**For multiple alarms: identify the initial failure.**
**Give time sequence of beam dump requests.**
- Assist the operation of the machine
**System Status and diagnostics for failures presented clearly to operation crews.**

**Post-mortem info**

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## LHC beam permit

- The signal produced by the beam interlock system is called BEAM_PERMIT.
- The BEAM_PERMIT can be:
**TRUE***** *****(beam operation is permitted)**
**Injection of beam is allowed.**
**If beam is circulating, then the beam operation continues.**
**FALSE ****(beam operation is NOT permitted)**
**Beam injection and SPS extraction are blocked. **
**If the BEAM_PERMIT changes from TRUE***** *****to FALSE, the beam will be extracted by the beam dumping system.**
- One BEAM_PERMIT for each beam: BEAM1_PERMIT, BEAM2_PERMIT
- Signals are carried by the beam interlock loops for BEAM1 and BEAM2.
- Distributed over hardware links to:
- Beam Dumping System
- LHC injection kickers
- SPS Extraction systems
*User Systems*

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## User permit signals

- The signal collected from the *User Systems* **(Equipment Systems)** is called the USER_PERMIT.
- The USER_PERMIT signal can be:
**TRUE**
**The User System is ready for beam and beam operation is possible.**
**FALSE**
**The User System is not ready for beam or has detected a failure.**
- Beam operation at the LHC is permitted when all USER_PERMITs = TRUE.
- The USER_PERMITs are gathered via hardware links.
- The USER_PERMITs are processed inside the Beam Interlock Controller.

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## BEAM_PERMITs are

**BEAM_PERMITs are**
**carried by the interlock loops**

**USER_PERMITs are **
**collected by the BICs**

**User 1**

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Safe masking

- In certain circumstances it can be important / very useful to _mask out_ (i.e. ingnore) user signals that are not critical.
- When ?
**for machine commissioning (reduce number of interlock channels...)**
**for special operation phases / measurements**
**but in any case **_**only for SAFE beam intensity, SAFE = below damage threshold.**_
- The central issue of masking interlocks is to ensure that :
**Masks can only be set when the beam is SAFE.**
**Masks are ****AUTOMATICALLY**** ****removed (i.e. the corresponding signal is re-activated) when the beams becomes unsafe: **
****** ****More beam is injected or the energy is increased****.**
- 	For the LHC our concept is to provide an
- 	*automatic mechanism to **	**ensure safe masking*.

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Safe beam flag for masking

- The SBF is distributed to the interlock systems and all concerned users.
- It is derived from the LHC energy and from the beam intensity:
**Energy from Beam Energy Tracking System (**_**E. Carlier**_**).**
**Intensity of beam 1 and beam 2 measured by BCTs (D. Belohrad).**
**Intensity of the beam from the SPS before an injection !**

- Safe masking is achieved using a so-called SAFE BEAM FLAG (SBF).
- The SAFE BEAM FLAG can be:
- TRUE
_**The stored beam energy is < damage threshold.**_
**Masking of USER_PERMITs is taken in account.**
**If a masked USER_PERMIT = FALSE ******** ****ignored ******** BEAM_PERMIT = TRUE.**
- FALSE
_**The stored beam energy is > damage threshold.**_
**Masking of USER_PERMITs is no longer taken in account. **
**If one USER_PERMIT = FALSE ******** BEAM_PERMIT = FALSE.**

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Partition : maskable / non-maskable

| family | (main) User Systems |
| --- | --- |
| Non-maskable | Powering Interlocks (for essential electrical circuits) |
|  | Warm Magnet Interlocks |
|  | Vacuum system  |
|  | Access Safety system |
|  | Beam Energy Tracking System |
|  | Beam Dumping system |
|  | Critical Beam Loss Monitors |
|  | LHC experiments (several signals / exper.) |
|  | Software interlock |
|  | LHC Control Room (manual dump switch) |
| Maskable  | Beam Loss Monitors (less critical) |
|  | Powering Interlocks (for less critical circuits) |
|  | R.F. |
|  | Collimators |
|  | Transverse Feedback |
|  | Beam Aperture Kicker |
|  | Beam Position Interlocks |
|  | Fast Magnet Current Decay Monitor |
|  | Fast Beam Current Decay Monitor |

**! Preliminary !**
**Not complete**

**Fundamental elements,**
**must be OK for beam to circulate**

**Highly critical elements**

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Basic functionality

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## From SPS to LHC

- Protection of the LHC starts in the SPS !

**Extraction**
**kicker**

**Extraction**
**kicker**

**Injection**
**kicker**
**(ring1)**

**Injection**
**kicker**
**(ring2)**

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## LHC injection interlock system

- The role of the injection interlock system is to survey LHC elements that are relevant for the injection process (kickers, absorbers, injection collimators... ), but not necessarily for the circulating beam.
- This system produces a signal called INJECTION_PERMIT (one per beam).
- The INJECTION_PERMIT can be
**TRUE***** ***
***	*****Beam injection of beam is permitted.**
**	****All user systems involved in injection are ready.**
**FALSE**
**	****Beam injection and SPS extraction are NOT permitted.**
- The INJECTION_PERMITs are available locally in IR2 (Ring 1) and IR8 (Ring 2) and distributed over hardware links to the corresponding :
- LHC injection kicker
- SPS Extraction system

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## SPS extraction interlock system

- The SPS extraction interlock system surveys all critical components of the transfer line from SPS to LHC and of the SPS extraction channel, from power converters and magnets to absorbers.
- This system produced a signal called EXTRACTION_PERMIT (one per extraction / LHC ring).
- The EXTRACTION_PERMIT can be:
**TRUE**
**Extraction of beam from the SPS is permitted.**
**All user systems involved in extraction to the LHC are ready.**
**FALSE**
**Extraction of beam from the SPS is NOT permitted. **
**The beam remains in the SPS ring / is dumped in the SPS.**
- The EXTRACTION_PERMIT is distributed over hardware link to the SPS extraction kicker.

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Four systems – one hardware solution

- The LHC beam interlock system,
- the LHC injection interlock system,
- the SPS extraction interlock system
- and the SPS beam interlock system
- will be (re)build with the same hardware components
- The existing SPS beam interlock system will be progressively replaced by the new system in the coming years.

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Extraction / Injection interlocking

- Injection is a potentially one of the most dangerous processes
-  failures may happen in a single passage, no chance to react...
- To ensure safe beam transmission through the lines and into the LHC for a fast extraction, *all equipment settings must be verified *_*IN ADVANCE*_* !*
- For the transfer lines, all relevant elements settings are surveyed as close as possible to the extraction time to minimize / eliminate the risk of damage by the extraction interlock system
- The beam is only extracted from the SPS if all settings are correct.
-  How do we ensure on the LHC side that everything is correct ?
- There are 1600 power converters to survey !
- Unrealistic to prepare all settings of the LHC in advance for high intensity.

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Probing with beam

- For the LHC ring we use the concept to verify the settings directly with beam :
- 1 - Injection of a safe beam never leads to equipment damage.
- A safe beam is below damage threshold.
- Beam interlock system must give BEAM_PERMIT, and settings surveillance is done by SW interlock system.
- 2 - If a safe beam is circulating in the LHC – lifetime > few minutes.
- Injection of high(er) intensity will not lead to a loss over a single turn.
- The lifetime of the high(er) intensity beam may be poor, but this leaves time for beam loss monitors ...to react.
-  We implement a scheme where we only permit injection
- of _a safe beam into an empty ring_.

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Beam Presence Flag

- To ensure safe injection, we introduce a signal called the
- 		Beam Presence Flag (one per beam).
- The BEAM_PRESENCE flag is a signal that can be :
**TRUE **
**Beam is present, intensity > ~1-2 ****×**** 10****9 ****protons**
**FALSE**
**No measurable beam, intensity < ~1-2 ****×****10****9**** protons**
- We enforce the following logic for injection (implemented in the extraction interlock system) :
**BEAM_PRESENCE = FALSE**
**Only a SAFE beam can be injected from the SPS.**
**BEAM_PRESENCE = TRUE**
**Any beam may be injected**

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## In practice

- Closed orbit

- Injection Kicker

- Injected beam from SPS

- Injection absorber
- TDI ~7σ

- Circulating safe beam

- Since the low intensity safe beam may not fit into the desired bunch pattern :
- The injected beam is placed into same longitudinal position than the circulating safe (low intensity) beam.
- The circulating safe beam is dumped onto the injection absorber (TCDI).

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Summary

- The interlock systems collect the user interlock signal and provide green light for beam operation when conditions for safe operation are met.
- To provide more flexibility for operation, some interlock signals will be maskable provided the beam is safe.
- Two important signals are needed for safe LHC operation
- A safe bean flag that indicates if the beam intensity is < damage threshold (SPS & LHC)
- A beam presence flag that indicates if beam is present in a given LHC ring.
- Safe injection is enforced by ensuring that only safe beams may ever be injected into an empty LHC ring.
- The Interlock systems for the LHC ring and for injection/extraction are coupled and are based on the same HW components.

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Extraction interlock architecture

- Architecture for SPS  Ring2 extraction system :
- 	The system is segmented to allow operation of the line / extraction system 	independently of the LHC

**SPS******** Ring2 is more complex than **
**SPS******** Ring1 due to ‘interference’ of the CERN Neutrino to Gran Sasso (CNGS) beam**

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Safe beam flag evolution

- Estimated damage level for fast losses** **
**at 450GeV ******** ~ 2 ****·**** 10****12**** ****protons**
**at 7 TeV    ******** ~ 1 ****·**** 10****10**** ****protons**

**1 ****·**** 10****12**

**1 ****·**** 10****9**

**2 ****·**** 10****12**

**1 ****·**** 10****11**

**1 ****·**** 10****10**

**1**** ****·**** 10****8**

** ****0.45**

**2**

**3**

**4**

**5**

**6**

**7   TeV**

**1 ****·**** 10****13**

**1 ****·**** 10****14**

**1 ****·**** 10****15**

**SBF = ****"****True****"**

**SBF = ****"****False****"**

**Energy**

**I ****beam**

- In this intensity range,
- a safe beam becomes unsafe
- during acceleration

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Response time

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Interlock system hierarchy

**Interlock system hierarchy**

**LHC beam interlock system**

**Ring1 beam intlk syst.**

**Ring2 beam intlk syst.**

**Ring1 injection intlk syst.**

**SPS  Ring1 extraction intlk syst.**

**Ring1 beam dump**

**Ring1 injection kicker**

**SPS Ring1 extraction kicker**

**SPS  beam interlock system**

**BEAM1_PERMIT**

**INJECTION1_PERMIT**

**EXTRACTION1_PERMIT**

**To inject a beam from the SPS into LHC Ring 1 :**
**BEAM1_PERMIT = TRUE**
**AND**
**INJECTION1_PERMIT = TRUE**
**AND**
**EXTRACTION1_PERMIT = TRUE**

- Same structure,
- Ring1  Ring2

**SPS Ring **
**beam dump**

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005

## Masking of user permits

- Masking must only be possible when the SAFE BEAM FLAG = TRUE and a full beam loss cannot result in damage to equipment.
- The *User Systems* are classified in two families:
- _MASKABLE signals_
**Signal can be temporarily ignored if the beam is SAFE. **
**Mask set by the operator ******** ****USER_PERMIT is not taken into account .**
- _UN-MASKABLE signals_
**The USER_PERMIT will NEVER**** be ****ignored to produce the BEAM_PERMIT.**
- The partition MASKABLE / NOT MASKABLE cannot be modified by software, but is remotely readable from the supervision program.

- LARP / Interlocking strategy / J. Wenninger R.Giachino

- 21.06.2005