Outline

1. Can we sufficiently protect the SPS and its extraction lines against damage in a multi-cycling and high intensity beam context?

2. Outline • The purpose • The current solutions • The proposals • Wrapping up

3. Equipment #N Interlock Equipments Kicker System Equipments Equipment #3 Equipment #2 Equipment #1 Why a Beam Interlock system? As one of the systems involved in the machine protection, the Interlock system has to: Collects status or default signals Performs a summation of all signals Transmits the result as: - Dump Request - Injection Permit - Extraction Enable 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

4. which mission? Operators Post-Mortem Alarm system Equipment #N Interlock Equipments Timing Kicker System Equipments Equipment #3 Equipment #2 Equipment #1 Transmits the output signal For the SPS Ring • Dump the Beam if unsafe situation • Stop Injection For the Extraction Lines • Enable extraction if everything OK • Request a beam dump if not enabled and also: • Transmit an Alarm • Alert Cycle Beam Manager • Inform Operator • Allow Post-Mortem Analysis 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

5. Operators Post-Mortem Alarm system Equipment #N Interlock Equipments Timing Kicker System Equipments Equipment #3 Equipment #2 Equipment #1 Hw or Sw Interlock ? Performs a summation of all signals Hardware Interlock: • for critical elements • for fast response Software Interlock: • as a second line of defense • for lower R-T constraints • for non standard elements (magnets in MD,…) 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

6. Operators Post-Mortem Alarm system Equipment #N Interlock Equipments Timing Kicker System Equipments Equipment #3 Equipment #2 Equipment #1 Which sources ? Collects Interlock signal categories: • State Interlocks • Power Converter ON/OFF • Vacuum valves IN/OUT • etc… • Setting Interlocks • Magnet current out of tolerance window • Beam loss > defined threshold • Beam position > specified limit • etc…. 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

7. Operators Post-Mortem Alarm system Equipment #N Interlock Equipments Timing Kicker System Equipments Equipment #3 Equipment #2 Equipment #1 Features? What about high intensity beam operation? Main characteristics: • should be Reliable • should be Available • should be Real-Time • should be “Flexible” • should be helpful for operators And what about fast multi-cycling changes? 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

8. 2nd part • The purpose • The existing solutions • The proposals • Wrapping up

9. SSIS CPS SSIS Extraction Kicker Injection Kicker PCR reset Present Hw Interlock: Clients & Layout Vacuum Main P.S. & Sextupoles hardwired BA1 crate 3 MPS fast chain Injection Inhibit Emergency Beam Dump Standby Beam Position BA1 crate 2 Beam losses 1 Beam losses 2 Beam losses 6 Trigger Beam Dump Kicker R.F. Beam losses ring + BCT BD Internal fault BA1 crate 1 BD no trigger Energy Tracking Totem Extraction Inhibit Disable Collimator tests Beam Tracking Septum Fault Kdsba1 watchdog TT60 P.S. Sum BA6 BA6 crate 4 … 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

10. Could be used for short term but has to be replaced anyway Present Hw Interlock: is it suitable for the future? • Simple and robust system • Basic AND logic of all signals  anyone could cause a beam dump • Every signal could be set in remote mode (therefore maskable by the operator) • Inhibits the injection when a circulating beam has been dumped • Installed in only one place (next to the beam dump itself) therefore every client needs its own cable to BA1 … • Machine timing independent • Any timing/cycle dependence is handled by the clients • Managed for the time being by AB/BT and installed in the 80s • Cannot be extended anymore • we are running out of spare parts…  14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

11. Equipment #N Equipments Equipments Equipment #3 Equipment #2 Equipment #1 SPS Equipment Injection SPS Equipment Alarm system SSIS hardware SPS Equipment SSIS Kernel A.E.M. Emergency Beam Dump (Hw Interlock) Dump Request User Interface Stop Ejection SPS Mode PS Operation Console switches By-pass switch PCR operators Present Software Interlock system Written in the 90s, the SPS Software Interlock Systemis composed of 4 parts(SSIS hardware, Kernel, Accelerator Equipment Monitor, and User interface) and interacts with several other systems Extraction 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

12. Present Software Interlock Channels The watched equipments, sub-systems or elements are : • Main Power Supplies error • STOPPER MOVING • DUMP INTLK DISABLED • RADIATION BB4/5 or TI8/TT41 • Operator request • Switching AUXPS / ROCS reload • MD PODH in 4 should be off • GEF'S EXT.N RELOAD • W.Extr. (or N.Extr.) Bumper in bad state • HIGH ENERGY STORAGE • HIGH INTENSITY ON NORTH TARGET • EDF CRITICAL PERIOD • WOBBLE FAULT NORTH • Injection Interlock Disabled • E A UNSAFE • SETTING UP SEM OFFSET TABLE • SPS VACUUM INTLK. CHAIN BROKEN • HIGH INTENSITY/HALO ON WEST TARGET • W ZS in bad state • MBBT 6202 OUT OF TOLERANCE • QBM in 6 ON - should be off • Beam loss ring • N ZS in bad state • TED TT40 • TED TI8 • TBSE TT41 • TBSE 80243 in bad state or position fault • WOBSU N/alarm system communication problems • EXTRACTION INHIBIT CHANNEL DISABLED • BI-BTV RING or BI-BTV TRANSFER could be IN • Extr. Sextupole OFF • ZS GIRDERS in beam • SCHOTTKY PU in beam • TIDV water fault. • TED First Turn in beam • TED TT60 or TED TT20 in bad state • ACCESS CHAIN broken • BHZ 377 in bad state • COLLIMATORS 1 in bad position or COLLIMATORS STEP 4 in beam • COLLIMAT & SCRAP 5 in bad position • SCRAPER 5 ENABLED • TT10 MAGNETS in bad state • West MST/MSE or North MST/MSE in bad state • TT60 MAGNET or TT20 MAGNET in bad state • P0 Line TAX closed or P0 Line BEND error • EAST BUMPERS in bad state • COLDEX LSS4 • MDVW in 5 in bad state • STOPPER TT20 or STOPPER north IN with TED OUT • East EXT. GIRDER LSS4 in beam • MBSG 410 OUT OF TOLERANCE • TT40 MAGNETS or TT41 MAGNETS or TI8 MAGNETS IN BAD STATE • EAST MSE IN BAD STATE • TT40 TOO LOW (or TOO HIGH) INTENSITY • VACUUM PLATES IN 5 IN BEAM • MDHW / QSE in 5 in bad state • MKE MAGNETS LSS4 OVER-TEMP • 1 or 2 TBSE in with TED TT40 out 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

13. Does not fulfil fast cycle changes and must be upgraded (or remade) for the future Present Sw Interlock system: Does it fit the purpose? • Features • Reliable system • Connected to the Hardware Interlock but could be by-passed by an operator • Operators can disable any individual interlock channel as well • Does not provide any safeguards against forgotten masks! (except message on Alarm screen) • Quite slow response time with polling rate fixed to 20 sec • Uses “old” SL-Equip procedure for Equipment access • Difficult to analyse after a fault and access to logged data • Machine timing independent • Does not react to cycle changes • The operators modify the settings via the SPS Mode 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

14. 3rd part • The purpose • The existing solutions • The proposals • Wrapping up

15. LSS4 Fast Extraction target LSS2 Slow Extraction LSS6 Fast Extraction Two types of Hw Interlock must be considered: one for the SPS Ring and one for the 3 Extraction Lines. In both cases, the LHC Beam Interlock platform (i.e. BIC) will be used. 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

16. LHC BA3 BA4 6 distributed controllers (BIC) + 2 BeamPermit loops (for redundancy) BA2 BA5 Dump BA1 BA6 Inj. BIC BIC BIC BIC BIC BIC Proposal for SPS Ring Interlock The layout would be identical to LHC Beam Interlock System: • fixed frequency via2 optical fibres: if one loop open  Beam Dump As the LHC Interlock: • Reliable with full redundant system (from User request to B-D activation) • Process duration time= ~20 µs max (from User signal to Beam Dump trigger) • Software for live monitoring and for post-mortem analysis • ~30 input signals are foreseen • Flexible (Masking possible) but secure (Safe Beam Flag condition) • Global estimated cost : ~250kCHF 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

17. “Flexible” with SBF • The SAFE BEAM FLAG is a distributed information to allow some flexibility while maintaining safety. • In general, Beam operation is permitted when all User Systems are OK. But masking should be possible if the beam is “safe” and cannot result in damaging equipment => concept of MASKABLE / NOT MASKABLE partition with the SBF condition. • IF SBF = TRUE • if a masked signal is present: it will be ignored and the beam operation will continue. • IF TRUE → FALSE • Masking is no longer taken into account • if a masked signal is present: the beam will be dumped. • The NOT MASKABLE signal will be NEVER ignored. • The partition (MASKABLE / NOT MASKABLE) is permanently defined by hardware and is remotely readable from the Supervision. • For the SPS: the SBF could be derived from the beam intensity. It will be generated and distributed by a dedicated (and reliable) system. 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

18. Extraction Enable Beam Type? LHC Beam Permit LHC Inj. LSS4 SBF Extraction Elements TT40 BIC BIC BIC BIC BIC BIC BIC BIC BIC BIC BIC BIC TT41 Ti 8 downstream TI8 / TT41 Switch Ti 8 upstream S P S L H C Proposal for Extraction lines Interlock (final) layout of LSS4 as an example: Master/slave architecture using the same hardware units (BIC): • some “slave” BICs assigned to interlock zones ( TT40, CNGS line, TI8…) • Interlock logic still independent of cycle changes • One “master” BIC: • Receives all summary signals • and generates the Extraction Enable signal • Provokes a Beam Dump trigger • if Extraction is not enabled or “disappears” (slow extractions, kicker misfiring) • For efficient operation: a beam dependent logic could be appliedin case of failure in either TT41 (CNGS beam) or in TI8 (LHC beam) 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

19. Simplified layout of the installed material: Already used in LSS4 Application Successful participation in TT40 & TI8 tests performed in Autumn 2004! Extraction Enable Control Network ROCS VME crate with LynxOS User Interface BPM BLM VAC CPU + CTRP Modules UTC via SPS Timing MKE etc… Optical module Patching modules Core modules User Interfaces to Extraction Kicker 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

20. 4th part • The purpose • The existing solutions • The proposals • Summing up

21. To sum up: (1/3) Can we sufficiently protect… …in a high intensity beam context? Yes, if we: - continue to deploy the Extraction Interlock in the 3 Extraction lines. - install a new Hardware Interlock for the Ring. Because: • It fulfils SPS requirements • Full redundant system designed for LHC (:= 200*SPS stored energy) • Masking allowed with Safe Beam Flag condition • Already existing Hw solution with its Monitoring software but: • Missing Budget • Lack of Manpower • Required time for: Production, tests, Installation, SBF implementation, and finally Commissioning  Difficult to do it before next start-up We propose an intermediate solution for 2006 (and not beyond): by setting up the new system for the SPS ring(in // with the existing one) and by connecting the clients step by step. 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

22. To sum up: (2/3) Can we sufficiently protect… in a multi-cycling mode context? • Yes! as the new Hardware Interlock is still independent of the cycle changes: • Interlock process should stay simple (and then reliable) • The Cycle/Beam changes are managed by the Clients • Yes, if Software Interlock is able to process the cycle changes: • via an upgrade of the existing SSIS ? But,it will require extensive testing to make sure the changes will not affect the software stability! Wasted time? • or via a new study? • Invest in a new software interlocks for the LHC era  one single coherent system that will take care of the SPS ring and transfer lines too. • Need time & resources: a 2 man-year activity? We propose minimal changes (only if absolutely necessary) to present SSIS for the start-up of 2006. In parallel, we’ll be working on a new LHC era software interlock system, which should phase out SSIS. First deliverable around mid 2006. 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

23. To sum up: (3/3) Interlock and Kicker systems are designed to be highly reliable. But the machine protection relies as well on the Interlock sources (i.e. the Equipments) On the Equipments side, the interlock parameters must be reconsidered and carefully selected : • Decide on a connection to Hw Interlock or to Sw Interlock • Set the correct values for Setting Interlocks • Define the right multi-cycling settings • Perform the corresponding tests • Could be useful to implement a kind of “Interlock Reference Manager”? • To store all the interlock references in a defined place • To get an history of reference values changes • To permit (or not) the modification of defined thresholds: Modify a threshold (in a wrong way) is equivalent to masking! We have to profit from both Hw & Sw Interlock systems replacementby a review of all involved elements: Jorg, Rossano, Rüdiger and myself are ready to participate to this task… Support and willingness are welcome! 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

24. Thank you for your attention Acknowledgements to Etienne Carlier, Katarina Sigerud, Claude Despas & Benjamin Todd And a special thanks to Jorg Wenninger, Rossano Giachino & Rüdiger Schmidt 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

25. Annexes 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

26. ●Circulating beam is less difficult to protect (thanks to beam losses for ex.) ● “Static” process in latch mode: ● Same architecture as LHC is proposed with distributed controllers around the ring linked by beam permit loops. LSS4 Fast Extraction target LSS2 Slow Extraction ●Fast Extraction is more tricky:  one shot process! ●Dynamic process (transparent mode): ● Master/slave architecture is proposed for each Extraction Line. A first version has participated in TT40/TI8 tests in Autumn 2004. “long” period LSS6 Fast Extraction some mS the SPS Ring interlock & the (3) Extraction Lines interlock systems are using the same LHC Beam Interlock solution (i.e. BIC) 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

27. Expected input signals to the SPS beam interlock system: 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

28. Supervision for BIC-TT40 (Top Screen) 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

29. Power Converter Surveillance • For the fast extractions, a fast power converter surveillance is now provided: • The currents are checked within a defined window against a reference VALUE (with a certain tolerance). • Reference value and tolerance : • Depend on cycle/beam type. • Are loaded independently of the usual functions. • The slow extractions will also profit from it ! • In the SPS there is presently no hardware surveillance of PC currents. Courtesy of Jorg Wenninger 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

30. Beam Type Extraction Elements BIC BIC BIC BIC BIC BIC BIC BIC BIC BIC BIC BIC TT41 Ti 8 upstream Timing interface for Interlock? With Multi-cycling and fast cycle changes: • Obviously, Sw Interlock has to deal with cycle changes. • In return, Interlock must inform the CBCM in order to stop the corresponding beam production. • On the other hand, the Hw Interlock process should remain independent of timing. Cycle changes must be handled by the clients (power converter, instrumentation, kickers,…) for their interlock signal activation. Nevertheless, what to do for the TT41/TI8 selection? • Danger to have a beam through a wrong extraction channel => The extraction interlock system should apply the correct conditions. • But how to know the beam type? • via the Machine Timing? • or via a Energy Meter? • or both for redundancy? What is the source to set the TT41/TI8 Switch’s position? 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

31. Redundancy Two Loops Beam Interlock Controller Two Matrixes in // Redundant link for each User Interface 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

32. If ( Ibeam1 · Energy ) < Threshold1 then SFB1 = PRESENT else SFB1 = NOT PRESENT If ( Ibeam2 · Energy ) < Threshold2 then SFB2 = PRESENT else SFB2 = NOT PRESENT Safe Beam Flag for LHC • For the LHC, SBF will be generated in IR4 by a dedicated system. Derived from LHC energy and from beam intensity: • Energy value coming from the ultra reliable energy tracking system • Intensity of beam 1 and beam 2 measured by the BCTs • Threshold value should normally be fixed Must be possible to set it to different value after receiving authorisation (to be defined) and new value must be logged. 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days

33. Interface with LBDS(example with Beam1) Dumping System Beam 1 BIC-R6 BIC-L7 BIC-L6 BIC-L5 BIC-R5 BIC-R7 10 MHz stop 10 MHz stop USER_PERMIT signals USER_PERMIT signals USER_PERMIT signals USER_PERMIT signals USER_PERMIT signals USER_PERMIT signals other BICs: L4, R4, L3, R3, L2, R2, L1, R1, R8, L8 Loop B1 Loop A1 • Same interface for Beam2… USER_PERMIT signals 14 Jan. 2005 - B.Puccio Session 3 / PS & SPS Days