Primary Ion Beams in the North Area:Design of the Safety Interlock

Information for SPS-OP 14/2/2014

D.Manglunki presenting the work of

T. Hakulinen, F. Havart, S.Hutchins, P. Ninin, P.Odier, S.Reignier, F. Valentini, D. Vaxelaire,

& colleagues.

Motivation• Until recently, primary ion beams could be sent towards the North Area only during periods where no

protons could be present in the SPS (ex: Pb ions at 13 & 80 GeV/u in December 2010, during PS proton injection septum fault).

• For the forthcoming Ar, Xe, and Pb runs, it is foreseen to intermix both proton and ion cycles in the same super-cycle.

• Although highly unprobable, it it not impossible in these conditions to extract a high intensity primary proton beam to the North Area, exposing personnel to a radiation hazard:

– Wrongly programmed injection of protons on an ion cycle– Accidental firing of the extraction elements during a high intensity proton cycle– Installation of a slow extraction proton cycle (SFTPRO) during primary ion operations

• The principle of an interlock based on BCTs, preventing the extraction of a beam more intense than 2x1011 charges, has been proposed by the SPS OP team leader, and approved by the Beams Department Safety Officer in March 2009.

Technical Solution• Two BCTs installed in BA5,

measure the beam intensity and give veto signal if I>2x1011 charges.

• The interlock acts on the power supplies of extraction magnets MST and MSE in BA2, forcing them to quasi-zero current if the interlock gives a veto signal.

• The interlock function is activated by an “Ion-mode” key in the CCC

• Diversely redundant design at the level of measurement, control, transmission & action

Implementation• Respect norms IEC 61511 (process industry) and IEC 61513 (nuclear installations).• Two interlock chains: PLC and wired interlock

(response time < 200 ms).– PLC chain based on SIEMENS S7 300 CPU and remote I/O with fiber optic cabling.– Wired chain based on HIMA Planar 4 modular wired logic.

• See technical spec EDMS 1146023.

BCTs• Pure hardware solution for maximum reliability

and availability• 2 new DCCTs, designed and made at CERN,

installed in June 2012 in SPS point 5• Identical and independent systems• Permanent monitoring of the circulating beam

intensity (IB)• Comparator on the analogue signal

– threshold @ 2x1011 charges• Self-check system to assess the DCCTs

performance• 2 status sent to the interlock system indicating

– whether IB is > or < 2x1011 charges– whether the DCCTs are available or under

test• Real-time software for remote monitoring

Self-check principleContinuous check:Performed in the DIAGNOSTIC UNIT Assessment of important DCCT parameters:• Current consumption• Demodulation signal amplitude• etc.Quick Check:Performed automatically once per cycle before injection in the CHECK & COMPARATOR UNIT• Verification of the DCCT and comparator

responses to a sequence of 6 calibrated current pulses injected into the monitor

• Results stored until the next Quick Check• Validity period fixed to 60s

CONTINUOUSSTATUS

DCCT CHECK

COMPARATOR CHECK

VALIDITY CHECK

SELF CHECKSTATUS

START CHECK QUICKSTATUS

QUICK CHECK

CONTINUOUS CHECK

AN

D

AN

DA

ND

SELF CHECK

One should tune the right balance between check severity and system availability

Each DCCT delivers 2 status and their complements to the 2 different inputs of the Interlock System (PLC and wired) Galvanic insulation by opto-couplers

Status delivered to the Interlock System

• LOW_IB_STATUSTRUE IF Ib < 2x1011 charges AND Self-Check result is OK AND NOT_IN_CHECK_STATUS is TRUE

• NOT_IN_CHECK_STATUSTRUE when the DCCT and the comparator are available, i.e not in quick check process

MSE-MST power supplies• Acting on the REF-in of the converter to prevent extraction,

forcing it to Imin • Feedback to check I=Imin• Check if system actually prevented an accident, in which case

DSO action is required• Actuator card between the Mugef and the Converter control

crate -> direct control on the current reference

• The reference simply passes through the card (REF-OUT=REF-IN) as the NO_EXTRACT_VETO signal from the Interlock is high, allowing extraction.

REF-IN (Mugef)

NO_EXTRACT_VETO (PLC)

REF-OUT (Control crate)

I0

REF – IN < I0

Carte Ions/Protons Interlocks

INTL-FAULT

NO_EXTRACT_VETO (Wired)AND

REF Imin REF Imin

Idcct I>

NO_REF_FAULT

Reset with Key

-+

Ierreur

Status

DCCT2

Normal behaviour: extraction of low intensity beam

REF-OUT (Control crate)

I0

REF – IN < I0

Carte Ions/Protons Interlocks

INTL-FAULT

AND/OR

REF Imin REF Imin

NO_REF_FAULT

Reset with Key

NO_EXTRACT_VETO (PLC)

NO_EXTRACT_VETO (Wired)

REF-IN (Mugef)

Idcct I>-

+Ierreur

Status

DCCT2- +

• The BCTs detect an intensity I>2x1011 charges:• One of the NO_EXTRACT_VETO signal from the interlocks (PLC and Wired) is low• The reference is forced to Imin=(720A for MSE ; Imin=225A for MST), minimum current reference given

by the CCC, inhibiting the pulse converter.

Normal behaviour: high intensity beam, no extraction

Abnormal behaviour• First Case: The signals NO_EXTRACT_VETO are low. The current

reference REF-OUT is forced to Imin.– In the second step, a reference REF-IN (above I0) is still received.– This abnormal case should be analysed: A signal INTL-FAULT is generated

and the converter is stopped.• Second Case: The converter of a pulse cycle is allowed, the REF-IN

is greater than I0. – In the second step, the signals NO_EXTRACT_VETO become low: This

abnormal case should be analysed. The associated actions are:– The reference REF-OUT is forced to Imin.– A signal INTL-FAULT is generated and the converter is stopped.

• If either of these cases occurs, a fault in the converter will be activated, which can only be reset with a key. This key will be available to authorized persons competent to reset this fault (DSO), after an analysis of the fault event.

REF-OUT (Control crate)

I0

REF – IN > I0

Carte Ions/Protons Interlocks

INTL-FAULT

AND/OR

REF Imin REF Imin

NO_REF_FAULT

Reset with Key

NO_EXTRACT_VETO (PLC)

NO_EXTRACT_VETO (Wired)

REF-IN (Mugef)

Idcct I>-

+Ierreur

Status

DCCT2- +

FAULT

Abnormal behaviour• First Case: The signals NO_EXTRACT_VETO are low. The current reference REF-OUT is forced to Imin.

• In the second step, a reference REF-IN (above I0) is still received.• This abnormal case should be analysed: A signal INTL-FAULT is generated and the converter is stopped.

• Second Case: The converter of a pulse cycle is allowed, the REF-IN is greater than I0. • In the second step, the signals NO_EXTRACT_VETO become low: This abnormal case should be analysed. The associated actions are:• The reference REF-OUT is forced to Imin.• A signal INTL-FAULT is generated and the converter is stopped.

• If either of these cases occurs, a fault in the converter will be activated, which can only be reset with a key. This key will be available to authorized persons competent to reset this fault (DSO), after an analysis of the fault event.

Status as of today (February 2014)• 2 BCTs installed in BA5 and tested with beam• Design of power supply safety system done;

implementation being done TE/EPC• Interlock design done and internally tested.• Interface to BCTs tested.• NOW: approbation of the Technical Spec.• Final version of the BCT/Comparator electronics• MST/MSE power supply interlocking electronics• Installation of one Fast BCT (additional beam monitoring)• Global BCT/Comparator system commissioning without beam• Interface to MSE/MST final testing.• Inter-site cabling:

– BA5, CCC, CCR done. BA2 planned for March.– All Fiber-optics cabling finished

• Integration tests with all components will be connected early 2014.– Finalization of installation and test documentation.

• DSO-tests to be scheduled before SPS start-up.

Thanks for your attention!

Typical SPS Super-cycle

North Area Ion cyclewith slow extraction

HiRadMatproton cycle

LHC proton cycle

Geographical Layout

Interlock Schematic

System monitoring interface using TIM

Development Model

SIF 1: Avoid high intensity proton beam extraction to north area in ION mode

(ION_PROTON_MODE = 0 Λ LOW_IB_STATUS_A = 1 Λ LOW_IB_STATUS_B = 1 ΛIN_CHECK_STATUS_A = 0 Λ In_CHECK_STATUS_B = 0 Λ Watch_Check_A = 1 Λ Watch_Check_B = 1 ΛNO_REF_FAULT = 1) ION_PROTON_MODE = 1∨ PLC OUTPUT NO_EXTRACT_VETO_A = 1 PLC OUTPUT NO_EXTRACT_VETO_B = 1

TRIGGERING EVENT- SAFETY VETO REMOVAL FROM MST/MSETimeout_Check_A = 1 Λ Watch_Check_A = 1

OUTPUT Watch_Check_A = 0

TRIGGERING EVENT- DCCT 1 CHECK WATCHDOG INVALIDATION:

Timeout_Check_A = 1 Λ Watch_Check_A = 1

OUTPUT Watch_Check_B= 0

TRIGGERING EVENT- DCCT 2 CHECK WATCHDOG INVALIDATION:

SIF 2: Send and maintain veto to BIS in case of MSE/MST malfunction

NO_REF_FAULT = 0 Λ ION_PROTON_MODE = 0

PLC OUTPUT NO_SAFETY_FAULT = 0

TRIGGERING EVENT- SPS SAFETY BEAM DUMP REQUEST:

21

In red: Minimum system required to fulfil the initial specification

In green:Monitoring, remote diagnostic tools + acquisition + logging

General layout

Time diagram

Range 3

Extraction Permitted NO Extraction

4 Cases

NO Extraction NO Extraction

Will be NOT_IN_CHECK_STATUS in the final version

Acquisition, monitoring and logging• Acquisition via a RT program running in the FEC (Front End Computer)• 1 FEC per DCCT

ADC• 16 signals per system (Beam intensity on 4 ranges, system 1 and 2, status, etc.)• Sampling rate: 100 S/s• Start 900ms before injection• Stop ~20ms after ejection• Reading after ejection

Input Register• 17 status per DCCT (result of every elementary check, etc.)• Reading after ejection

• Data publication via a FESA class once per cycle after ejection

•Logging Timber system To be decided:

o Which signal (Beam intensity, LOW_IB_STATUS, NOT_IN_CHECK_STATUS?)o What time resolution?

Test with beam (SPS.LHC4; 12.10.2012)

ADC

bin

Time [ms]

Will be NOT_IN_CHECK_STATUS in the final version

Real signals seen via the FESA Navigator

BCT Planning• March 2009 Specification draft• April 2010 ECR 1075945 v1• Jan 2011 Cable pulling for provisional location (BB5)• May 2011 Writing the technical specification (v1)• June 2012 ECR 1075945 v2• Sept 2011-May 2012 Manufacturing of mechanics• March - June 2012 Building the electronic prototypes • June 2012 Installation of 2 monitors in point 5• Since August 2012 Test of DCCT & Soft RT programme• Jan-Feb 2013 Tests with the Interlock system

• LS1 -Cable pulling for final location (BA5)

-Approbation of the technical specification-Make final version of the electronic-Installation of one Fast BCT (additional beam monitoring)-Global System Commissioning without beam

• After LS1 -Global System Commissioning with Beam -Operation with Ions Beam in North Hall

Required for the next stepNow

• Actuator card between the Mugef and the Converter control crate -> direct control on the current reference• However, setting the current reference to Imin does not guarantee that in the case of a malfunction of the

electronic control of this converter, the current in the circuit is actually Imin

• Supplementary DCCT measures the converter output current – compared to the input reference current “REF-IN”, giving us an error signal “Ierror”. – If difference too large, comparator drives a relay into fault (open) position and cause action on the beam

(signal NO_REF_FAULT).• DCCT status managed by “Ion/Proton actuator card”:

– DCCT dry status contact connected in series with relay contact -> any problem with the DCCT will also cause appropriate action on the beam (signal NO_REF_FAULT).

REF-OUT

Mugef

Convertercontrol crate

REF-INCrate Ions/protons

InterlocksNO_EXTRACT_VETO (PLC)

RESET with KEY

INTL-FAULT

NO_EXTRACT_VETO (Wired)

Idcct

NO_REF_FAULT

DCCT2CrateStatus