1. Primary Ion Beams in the North Area: Design of the Safety Interlock Information for SPS-OP 14/2/2014 D.Manglunki presenting the work of T. Hakulinen, F. Havart, S.Hutchins, P. Ninin, P.Odier, S.Reignier, F. Valentini, D. Vaxelaire, & colleagues.

2. Motivation Until recently, primary ion beams could be sent towards the North Area only during periods where no protons could be present in the SPS (ex: Pb ions at 13 & 80 GeV/u in December 2010, during PS proton injection septum fault). For the forthcoming Ar, Xe, and Pb runs, it is foreseen to intermix both proton and ion cycles in the same super-cycle. Although highly unprobable, it it not impossible in these conditions to extract a high intensity primary proton beam to the North Area, exposing personnel to a radiation hazard: – Wrongly programmed injection of protons on an ion cycle – Accidental firing of the extraction elements during a high intensity proton cycle – Installation of a slow extraction proton cycle (SFTPRO) during primary ion operations The principle of an interlock based on BCTs, preventing the extraction of a beam more intense than 2x10 11 charges, has been proposed by the SPS OP team leader, and approved by the Beams Department Safety Officer in March 2009.

3. Technical Solution Two BCTs installed in BA5, measure the beam intensity and give veto signal if I>2x10 11 charges. The interlock acts on the power supplies of extraction magnets MST and MSE in BA2, forcing them to quasi- zero current if the interlock gives a veto signal. The interlock function is activated by an “Ion-mode” key in the CCC Diversely redundant design at the level of measurement, control, transmission & action

4. Implementation Respect norms IEC 61511 (process industry) and IEC 61513 (nuclear installations). Two interlock chains: PLC and wired interlock (response time < 200 ms). – PLC chain based on SIEMENS S7 300 CPU and remote I/O with fiber optic cabling. – Wired chain based on HIMA Planar 4 modular wired logic. See technical spec EDMS 1146023.

5. BCTs Pure hardware solution for maximum reliability and availability 2 new DCCTs, designed and made at CERN, installed in June 2012 in SPS point 5 Identical and independent systems Permanent monitoring of the circulating beam intensity (I B ) Comparator on the analogue signal – threshold @ 2x10 11 charges Self-check system to assess the DCCTs performance 2 status sent to the interlock system indicating – whether I B is > or < 2x10 11 charges – whether the DCCTs are available or under test Real-time software for remote monitoring

6. Self-check principle Continuous check: Performed in the DIAGNOSTIC UNIT Assessment of important DCCT parameters: Current consumption Demodulation signal amplitude etc. Quick Check: Performed automatically once per cycle before injection in the CHECK & COMPARATOR UNIT Verification of the DCCT and comparator responses to a sequence of 6 calibrated current pulses injected into the monitor Results stored until the next Quick Check Validity period fixed to 60s One should tune the right balance between check severity and system availability

7. Each DCCT delivers 2 status and their complements to the 2 different inputs of the Interlock System (PLC and wired) Galvanic insulation by opto-couplers Status delivered to the Interlock System LOW_IB_STATUS TRUE IF Ib < 2x10 11 charges AND Self-Check result is OK AND NOT_IN_CHECK_STATUS is TRUE NOT_IN_CHECK_STATUS TRUE when the DCCT and the comparator are available, i.e not in quick check process

8. MSE-MST power supplies Acting on the REF-in of the converter to prevent extraction, forcing it to Imin Feedback to check I=Imin Check if system actually prevented an accident, in which case DSO action is required Actuator card between the Mugef and the Converter control crate -> direct control on the current reference

9. The reference simply passes through the card (REF-OUT=REF-IN) as the NO_EXTRACT_VETO signal from the Interlock is high, allowing extraction. REF-IN (Mugef) NO_EXTRACT_VETO (PLC) REF-OUT (Control crate) I0I0 REF – IN < I 0 Carte Ions/Protons Interlocks INTL-FAULT NO_EXTRACT_VETO (Wired) AND REF I min Idcct I> NO_REF_FAULT Reset with Key - + I erreur Status DCCT2 Normal behaviour: extraction of low intensity beam

10. REF-OUT (Control crate) I0I0 REF – IN < I 0 Carte Ions/Protons Interlocks INTL-FAULT AND/OR REF I min NO_REF_FAULT Reset with Key NO_EXTRACT_VETO (PLC) NO_EXTRACT_VETO (Wired) REF-IN (Mugef) Idcct I> - + I erreur Status DCCT2 - + The BCTs detect an intensity I>2x10 11 charges: One of the NO_EXTRACT_VETO signal from the interlocks (PLC and Wired) is low The reference is forced to I min =(720A for MSE ; I min =225A for MST), minimum current reference given by the CCC, inhibiting the pulse converter. Normal behaviour: high intensity beam, no extraction

11. Abnormal behaviour First Case: The signals NO_EXTRACT_VETO are low. The current reference REF-OUT is forced to I min. – In the second step, a reference REF-IN (above I 0 ) is still received. – This abnormal case should be analysed: A signal INTL-FAULT is generated and the converter is stopped. Second Case: The converter of a pulse cycle is allowed, the REF-IN is greater than I 0. – In the second step, the signals NO_EXTRACT_VETO become low: This abnormal case should be analysed. The associated actions are: – The reference REF-OUT is forced to I min. – A signal INTL-FAULT is generated and the converter is stopped. If either of these cases occurs, a fault in the converter will be activated, which can only be reset with a key. This key will be available to authorized persons competent to reset this fault (DSO), after an analysis of the fault event.

12. REF-OUT (Control crate) I0I0 REF – IN > I 0 Carte Ions/Protons Interlocks INTL-FAULT AND/OR REF I min NO_REF_FAULT Reset with Key NO_EXTRACT_VETO (PLC) NO_EXTRACT_VETO (Wired) REF-IN (Mugef) Idcct I> - + I erreur Status DCCT2 - + FAULT Abnormal behaviour First Case: The signals NO_EXTRACT_VETO are low. The current reference REF-OUT is forced to I min. In the second step, a reference REF-IN (above I 0 ) is still received. This abnormal case should be analysed: A signal INTL-FAULT is generated and the converter is stopped. Second Case: The converter of a pulse cycle is allowed, the REF-IN is greater than I 0. In the second step, the signals NO_EXTRACT_VETO become low: This abnormal case should be analysed. The associated actions are: The reference REF-OUT is forced to I min. A signal INTL-FAULT is generated and the converter is stopped. If either of these cases occurs, a fault in the converter will be activated, which can only be reset with a key. This key will be available to authorized persons competent to reset this fault (DSO), after an analysis of the fault event.

13. Status as of today (February 2014) 2 BCTs installed in BA5 and tested with beam Design of power supply safety system done; implementation being done TE/EPC Interlock design done and internally tested. Interface to BCTs tested. NOW: approbation of the Technical Spec. Final version of the BCT/Comparator electronics MST/MSE power supply interlocking electronics Installation of one Fast BCT (additional beam monitoring) Global BCT/Comparator system commissioning without beam Interface to MSE/MST final testing. Inter-site cabling: – BA5, CCC, CCR done. BA2 planned for March. – All Fiber-optics cabling finished Integration tests with all components will be connected early 2014. – Finalization of installation and test documentation. DSO-tests to be scheduled before SPS start-up.

14. Thanks for your attention!

15. Typical SPS Super-cycle North Area Ion cycle with slow extraction HiRadMat proton cycle LHC proton cycle

16. Geographical Layout

17. Interlock Schematic System monitoring interface using TIM

18. Development Model

19. SIF 1: Avoid high intensity proton beam extraction to north area in ION mode (ION_PROTON_MODE = 0 Λ LOW_IB_STATUS_A = 1 Λ LOW_IB_STATUS_B = 1 Λ IN_CHECK_STATUS_A = 0 Λ In_CHECK_STATUS_B = 0 Λ Watch_Check_A = 1 Λ Watch_Check_B = 1 Λ NO_REF_FAULT = 1) ∨ ION_PROTON_MODE = 1 PLC OUTPUT  NO_EXTRACT_VETO_A = 1 PLC OUTPUT  NO_EXTRACT_VETO_B = 1 TRIGGERING EVENT- SAFETY VETO REMOVAL FROM MST/MSE Timeout_Check_A = 1 Λ Watch_Check_A = 1 OUTPUT  Watch_Check_A = 0 TRIGGERING EVENT- DCCT 1 CHECK WATCHDOG INVALIDATION: Timeout_Check_A = 1 Λ Watch_Check_A = 1 OUTPUT  Watch_Check_B= 0 TRIGGERING EVENT- DCCT 2 CHECK WATCHDOG INVALIDATION:

20. SIF 2: Send and maintain veto to BIS in case of MSE/MST malfunction NO_REF_FAULT = 0 Λ ION_PROTON_MODE = 0 PLC OUTPUT  NO_SAFETY_FAULT = 0 TRIGGERING EVENT- SPS SAFETY BEAM DUMP REQUEST:

21. 21 In red: Minimum system required to fulfil the initial specification In green: Monitoring, remote diagnostic tools + acquisition + logging General layout

22. Time diagram Range 3 Extraction Permitted NO Extraction 4 Cases NO Extraction Will be NOT_IN_CHECK_STATUS in the final version

23. Acquisition, monitoring and logging Acquisition via a RT program running in the FEC (Front End Computer) 1 FEC per DCCT  ADC 16 signals per system (Beam intensity on 4 ranges, system 1 and 2, status, etc.) Sampling rate: 100 S/s Start 900ms before injection Stop ~20ms after ejection Reading after ejection  Input Register 17 status per DCCT (result of every elementary check, etc.) Reading after ejection Data publication via a FESA class once per cycle after ejection Logging  Timber system  To be decided: o Which signal (Beam intensity, LOW_IB_STATUS, NOT_IN_CHECK_STATUS?) o What time resolution?

24. Test with beam (SPS.LHC4; 12.10.2012) ADC bin Time [ms] Will be NOT_IN_CHECK_STATUS in the final version Real signals seen via the FESA Navigator

25. BCT Planning March 2009 Specification draft April 2010ECR 1075945 v1 Jan 2011 Cable pulling for provisional location (BB5) May 2011Writing the technical specification (v1) June 2012ECR 1075945 v2 Sept 2011-May 2012Manufacturing of mechanics March - June 2012 Building the electronic prototypes June 2012 Installation of 2 monitors in point 5 Since August 2012 Test of DCCT & Soft RT programme Jan-Feb 2013Tests with the Interlock system LS1-Cable pulling for final location (BA5) -Approbation of the technical specification -Make final version of the electronic -Installation of one Fast BCT (additional beam monitoring) -Global System Commissioning without beam After LS1 -Global System Commissioning with Beam -Operation with Ions Beam in North Hall Required for the next step Now

26. Actuator card between the Mugef and the Converter control crate -> direct control on the current reference However, setting the current reference to I min does not guarantee that in the case of a malfunction of the electronic control of this converter, the current in the circuit is actually I min Supplementary DCCT measures the converter output current – compared to the input reference current “REF-IN”, giving us an error signal “I error ”. – If difference too large, comparator drives a relay into fault (open) position and cause action on the beam (signal NO_REF_FAULT). DCCT status managed by “Ion/Proton actuator card”: – DCCT dry status contact connected in series with relay contact -> any problem with the DCCT will also cause appropriate action on the beam (signal NO_REF_FAULT). REF-OUT Mugef Converter control crate REF-IN Crate Ions/protons Interlocks NO_EXTRACT_VETO (PLC) RESET with KEY INTL-FAULT NO_EXTRACT_VETO (Wired) I dcct NO_REF_FAULT DCCT2 Crate Status