1 beam plans for accelerator systems: the machine protection system jan uythoven on behalf of the...

1

Beam Plans for Accelerator Systems: The Machine Protection System

Jan UythovenOn behalf of the MPWG and the

MPS Commissioning WG

Special thanks to R.Schmidt, J.Wenninger, A.Macpherson

Jan Uythoven, AB /BT eLTC, 5 March 2008 2

Machine Protection System

Has to guarantee the Safe operation of the LHC under all circumstances

Hard work during all the different LHC ‘phases’: Design phase: done Construction phase of the individual equipment: almost done Individual System Testing (equipment): ongoing Global System Testing, MPS aspects

Talk Alick Macpherson, session 2 Hardware Commissioning Starting

Tests with beam Operation with beam

This Session


Beam Interlock SystemBeam

Dumping System

Injection InterlockPowering

Interlockssc magnets

PoweringInterlocks

nc magnets

QPS(several 1000)

Power Converters

~1500

AUG

UPS

Power Converters

Magnets

Magnet Current Monitor

CryoOK

RFSystem

Movable Detectors

LHCExperiments

Beam LossMonitors

BCM

Experimental Magnets

CollimationSystem

CollimatorPositions

Environmentalparameters

Transverse Feedback

Beam ApertureKickers

BeamLifetimeFBCM

Screens / Mirrors

BTV

Access System

Doors EIS

VacuumSystem

Vacuumvalves

AccessSafetyBlocks

RF Stoppers

Beam loss monitors

BLM

SpecialBLMs

Monitorsaperture

limits(some 100)

Monitors in arcs

(several 1000)

Timing System (Post Mortem

Trigger)

Operator Buttons

CCC

SafeLHC

Parameter

SoftwareInterlocks

LHCDevices

Sequencer

LHCDevices

LHCDevices

Safe Beam Parameter

Distribution

SafeBeamFlag

Little beam dependence

View of the LHC - MPSCore Systems

Protection elements


Tests with Beam

Some systems require ‘Machine Protection Tests’ with beam: Injection System and its Protection Elements Collimation System Beam Dump System and its Protection Elements Beam Loss Monitors FMCM

Generally not to test the hardware (done without beam) but to Check if the settings are ok Check if the assumptions – underlying the concepts used in

the ‘protection theory’ – is correct Check interdependency within systems

Treated by talks of the individual systems in this session Listed as tests in the procedures developed in the MPS Comm. WG


The MPS hardware is working under nominal configuration: Beam dump request is only given when it is required No ‘false’ hardware interlocks via BIS No ‘false’ software interlocks via SIS Systems are brought into operation according to MPS commissioning plans

Depends on beam intensity and beam energy = commissioning phase Machine model is nominal, fitting to the corresponding phase :

Optics functions within tolerance (orbit, tunes etc.) properly corrected and within tolerances, beam intensity and energy within the pre-defined limits

Try to stick to ‘stable optics’ – avoid verification of MPS for new conditions Operational procedures related to Machine Protection ok:

Beam quality checks ok Post Mortem following beam dump fully understood Post Operational Checks (injection, beam dump) always ok

Daily Operation with BeamThe Ideal World

A system is required to restrict the operation within the well defined window:

• Clear procedures / limits known at all times: central place to keep this info!

• Software interlock on energy / intensity / optics? (e.g. limit operation at 2 TeV)

Be sure not to work outside the agreed upon conditions:


Daily Operation with BeamThe Real World

Beam Dump, or no ‘green light’ to inject: operation Stopped

Safe, but degradation of the machine up-time: action desired

Not Safe to continue:Procedures – discipline of the operators, need clear limits and/or restrictionsCheck of MPS functionality under the different conditions / change interlock settings

Hardware malfunctioning or not available

Automatic Post Operational Checks stop operation

Produce interlock which needs resetting

No interlocks, but one does not fully understand what happened

Post Mortem Machine is not in nominal conditions

Different tunes, optical functions etc.

Previous Slide

Next Slide

Interlocks

No InterlocksUnsafe

Safe

Next Slide


Beam Dump, or no ‘green light’ to inject: operation StoppedSafe, but degradation of the machine up-time: action desired

Can it be fixed within an acceptable delay

Y

Fix it

N

Possible toadjust the interlock level

or the settings to continue

Y

Acceptable?

Y

Adjust

Continue withDifferent beam conditions ?

(I , E, Optics)

Y

Acceptable?Useful?which?

Y

Adjust(SIS)

Disable the interlockY

Acceptable?

N

N

Y

Adjust

Follow-up

Follow-up

Follow-up

Stop the LHC,Restart after Repair

RBACMCS, …

RBACMCS, …

RBACMCS, …

N

Possible to mask?

Is this sufficient(I, E) Mask

Follow-upN

N

N

Y

Y

N

N


Protection andBookkeeping

When Settings or Interlock Levels ’can be changed’, protection against ‘anybody’ doing this and errors in transmission. Talk V.Kain on Friday: Role Based Access Control

(RBAC) Management of Critical

Settings (MCS) Coherent list of equipment

where this is required Coherent list of people for the

specific equipment Need to do the bookkeeping of all

changes

RBACMCS, …

Change of Settings,Interlocks Disabled

Change of Settings,Interlocks DisabledTOOL


Maskable InterlocksSafe Machine Parameters

Selected set of BIS interlocks or maskable: First step if unexpected interlock – during the beam commissioning

phase: can the interlock be masked? Agreed upon procedures, decided upon before the beam

commissioning started Foreseen especially for the commissioning phase Should be rather straight forward – done by EIC However: bookkeeping

Software Interlock System: Do we need to have maskable interlocks for the SIS (disabled with

safe beam)? Also ‘ RBAC like system’ on SIS? SIS talk by J.Wozniak on Friday

If we don’t trust our definition of ‘safe beam’ – Sector

test session: provoke quench – then we should NOT

use any maskable interlocks…


Beam Dump, or no ‘green light’ to inject

Automatic protection, but degradation of the machine up-time: actions desired


Y

Fix it

N



Y

Acceptable?

Y

Adjust


(I , E, Optics)

Y


Y

Adjust(SIS)

Disable the interlockY

Acceptable?

N

N

Y

Adjust

Follow-up

Follow-up

Follow-up


RBACMCS, …

RBACMCS, …

RBACMCS, …

N

Possible to mask?

Is this sufficient(I, E) Mask

Follow-upN

N

N

Y

Y

N

N


Beam Dump, or no ‘green light’ to inject

Automatic protection, but degradation of the machine up-time: actions desired

Y

Fix it

N



Y

Y

Adjust


(I , E, Optics)

Y

Adjust

Disable the interlockY Adjust

Follow-up

Follow-up

Follow-up


RBACMCS, …

RBACMCS, …

RBACMCS, …

Possible to mask?

Mask

Follow-up

N

N

Y


Acceptable?


Acceptable?

Is this sufficient(I, E)

Decision increasingly complicated to take

Advise / Discussion / Green light required

EIC can decide by

him/her-self

Advice from equipment specialist

Advice from ‘LHC

Protection Panel’

RBACMCS, …

+ ….


Responsibilities

Engineer In Charge

Machine Coordinator Commissioner in Charge

Equipment Experts

Magnet Performance PanelIn place for ‘magnet protection’,

Already used during Hardw. Comm.

LHC Protection PanelConcerning MachineProtection System

A.Siemko, MPP meeting 21/09/2006

J. Uythoven, ‘Chamonix’ 2006


Group of experts who have an overview of The nominal MPS

MPS MPSi

The actual state of the MPS The bookkeeping

Can’t foresee all permutations, can’t write procedures in case of failures beforehand, need experience with the actual systems and flexibility to adjust

See ‘Chamonix’ 2006 New: LPP members MPS Comm WG

This group of experts exists!

LHC Protection Panel

JET is operating since many years with a Machine Protection System Panel


Examples BIS problem

STOP Asynchronous beam dump

Analysis by BT group of XPOC data If the result of the BT analysis is not clear:

Fix / replace doubtful equipment Series of runs of LBDS without beam Series of test dumps with low intensity beam Check interface to other equipment: RF, timing, …

BLM crate not working Repair If not possible, can change ‘Master Table’ (RBAC etc.) to continue with:

Safe beam? Pilot at 450 GeV? No beam

dIbeam/dt interlock available in a later stage, so been running with limited beam power without this interlock

If this system has a hardware problem: gives an interlock and stops operation Do we need to stop until it is fixed? Can we continue, but with limited beam power? Can we just continue?

BLM signals behind collimators giving higher values than normal When do we stop operation (only at interlock level?) How much time do we take to re-optimise collimator settings What do we do if we can’t get back in the old situation

Suddenly no losses measured on BLM collimators any more…!

Can take 10’s of hours out of physics: so cannot be decided on by individuals but needs support/weight of LPP BG

No interlocks or RBAC, but here LPP should be of help as well!


The aim is to have a fully operational MPS, functioning under nominal conditions, all the time.

In all circumstances the state of the MPS should be known Inventory of ‘hardware’ which is not standard

Settings Interlock Levels Masking Disabling

In all circumstances the operational limits and conditions of the machine should be clear

For the standard conditions, depending on the commissioning phase

If one is allowed to only run under special conditions:

An LHC Protection Panel should be used to advise the EIC when significant changes to MPS systems and their settings need to be made to continue or optimise operation

This is at least the case when RBAC is required to make the change Once agreed upon to make a change to MPS (settings): procedures for doing this

Clear definitions of applying RBAC and MCS – coherent approach Who can make hardware changes? Obvious?

Do we need a kind of RBAC on the Software Interlock System? Maskable interlocks with Safe Beam on SIS?

Conclusions

Tool(s) required for keeping track of MPS conditions

Tool(s) required for keeping track of allowed machine conditions

1 beam plans for accelerator systems: the machine protection system jan uythoven on behalf of the...

Documents