1. The LHC Beam Interlock System
J. Wenninger AB-OP-SPS
for the LHC Machine Protection WG
A description of the LHC Interlock System
Technical drawings : courtesy of B. Puccio (AB-CO)
J. Wenninger / LEADE

2. Stored Energy
The amount of energy stored in the LHC is unprecedented :
10 GJ are stored in the magnets at 7 TeV
Need a sophisticated powering interlock system.
350 MJ are stored in each beam at 7 TeV
Need a performant beam interlocking scheme in the LHC.
2 MJ are stored in the beams that are extracted from the SPS
Need interlocking and passive protection systems for the transfer lines and the first turn in the LHC.
The existing SPS ring interlock system will be (gradually) replaced by the same system that is used for the LHC.
J. Wenninger / LEADE

3. Stored Beam Energy…
… in the LHC exceeds by 2 orders of magnitude that of existing machines.
Already at the SPS we manage to damage vacuum chambers !
J. Wenninger / LEADE

4. Machine protection
The LHC will be protected against accidental ‘release’ of the beam energy by :
Absorbers and collimators (! collimators not ‘optimized’ for protection !)
Define the aperture.
Protect against ‘single-turn’ failures due to injection and kicker errors.
Protection systems
Equipment surveillance : powering, quench protection, vacuum, RF …
Beam surveillance : beam loss, beam position…
In case of a critical failure the beams must be dumped. The beam interlock system is the ‘glue’ that links together the protection systems (clients), the beam dumping system and the injectors (mainly SPS).
J. Wenninger / LEADE

5. The LHC Beam Dumping System
The beam dumping system itself has already a tight internal intelock system since any malfunction can have very severe consequences for the LHC machine.
Septum magnets
(V deflection)
Beam 1
H-V kickers to paint the beam
Q5L
Beam Dump Block
Q4L
~ 700 m
15 kicker magnets
(H deflection)
Q4R
~ 500m
IR6
Q5R
Beam 2
J. Wenninger / LEADE

6. Dump Block
The dump block is the only element of the LHC able to absorb the full 7 TeV beam !
beam absorber (graphite)
7 m
concrete shielding
J. Wenninger / LEADE

7. Beam Interlock System : Aims and Objectives
Two roles:
1) Allow injection when all client systems are ready for beam.
2) Transmit any beam dump request from clients systems to the Beam Dumping system.
Additional objectives:
Protect the beam
Faulty trigger signals should be avoided.
Provide post-mortem information
For multiple alarms: identify the initial failure.
Give time sequence of Beam Dump requests
J. Wenninger / LEADE

8. Principle of the Beam Interlock System
BEAM1_PERMIT
BEAM_PERMIT STATUS SIGNALS
BEAM2_PERMIT
to User Systems
SPS Extraction System
for beam 1
for beam 2
Beam Dumping System
USER_PERMIT SIGNALS
UNMASKABLE INPUTS
MASKABLE INPUTS
Mask
Settings
Safe Beam
Flag
PM event Trigger
Timing
System
LHC
protection
systems
User System #2
User System #9
User System #16
User System #1
User System #8
User System #10
LHC Injection System
J. Wenninger / LEADE

9. LHC Layout
J. Wenninger / LEADE
next

10. Distributed Architecture
J. Wenninger / LEADE

11. Individual Permit Signals
Every User System must provide a USER_PERMIT signal.
Beam operation is only allowed when ALL un-masked or unmaskable User Systems deliver their USER_PERMIT.
USER_PERMIT :
TRUE
User System is ready for beam and beam operation is possible.
FALSE
User System is not ready for beam or has detected a failure.
The USER_PERMITs are gathered via hardware links.
J. Wenninger / LEADE

12. LHC Systems connected to the Beam Interlock System
The (main) User Systems are:
Beam Loss Monitors
Powering Interlock system
Warm Magnets Interlock system
Vacuum system
Access Safety system
Beam Energy Meter
Beam Dumping system
LHC Control Room
LHC Experiments
R.F. system
Collimators
Transverse Damper
Beam Aperture Kicker
Beam Excursion Monitors
Fast Beam Current Decay Monitors
J. Wenninger / LEADE

13. Beam Permit Status Signal
The BEAM_PERMIT can be:
TRUE (beam operation is permitted)
Injection of beam is allowed.
Beam operation continues.
FALSE (beam operation is NOT permitted)
Beam injection and SPS extraction are blocked.
If beam is circulating and the BEAM_PERMIT changes from TRUE to FALSE, then the beam will be extracted to the dump.
There is one BEAM_PERMIT for each beam.
Distribution via hardware links to:
Beam Dumping System
LHC injection kickers
SPS Extraction systems
Beam interlock user systems.
J. Wenninger / LEADE

14. Masking User Signals
Depending on intensity, energy and other parameters, it is possible to mask (disable) some User Signals without risk of damage to LHC components. Such a possibility is useful during commissioning phases, problems during certain OP phases…
Masking must only be possible if the beam is “safe” : a beam loss must not result in damage.
To allow for some flexibility while maintaining safety, the User Systems are classified in two families:
MASKABLE signals
The USER_PERMIT can be temporary ignored if the beam is “safe”.
Mask set by the operator  USER_PERMIT is not taken into account .
NOT MASKABLE signals
The USER_PERMIT is NEVER ignored to produce the BEAM_PERMIT.
J. Wenninger / LEADE

15. Safe ‘Masking’
The central issue of masking interlocks is to ensure that :
Masks can only be set when the beam is ‘safe’.
Masks are AUTOMATICALLY removed (i.e. the corresponding interlock is re-enabled) when the beams becomes unsafe:
More beam is injected.
The energy is increased.
The idea to provide an automatic mechanism to ensure safe masking was proposed for the new SPS interlock system and discussed at the last Chamonix in January 2004 (presentation by … myself !).
This lead to the concept of ‘Safe Beam Parameters’ (SLPs) :
Critical parameters that are measured with high reliability : essentially energy and intensity.
SLPs are distributed over hardware links to the clients (includes the interlock system).
J. Wenninger / LEADE

16. Safe Beam Flags
The Safe Beam Flag is derived from the LHC energy and beam intensity (for each beam) :
Energy value coming from ‘Beam Energy Meter’s in IR6.
Intensity of beam 1 and beam 2 measured by BCTs.
If Func(Ibeam1, Energy) < Threshold1 then SFB1 = TRUE else SFB1 = FALSE
If Func(Ibeam2, Energy) < Threshold2 then SFB2 = TRUE else SFB2 = FALSE
SAFE BEAM FLAG can be:
TRUE (for example, if a low intensity beam is circulating at 450 GeV)
Masking of USER_PERMITs is taken in account.
If one of the masked signals is indicating FALSE  ignored  beam operation continues.
FALSE (for example, if the beam is accelerated and becomes unsafe due to increasing stored energy)
The mask is not longer taken in account.
If one USER_PERMIT = FALSE  BEAM_PERMIT changes to FALSE  beam will be dumped.
J. Wenninger / LEADE

17. Maskable / Not Maskable Partition
family
(main) User Systems
Not maskable
Critical Beam Loss Monitors
Powering Interlock Controllers
(for essential electrical circuits)
Warm Magnet Interlock Controllers
Vacuum system
Access Safety system
Beam Energy Meter
Beam Dumping system
LHC Control Room
Maskable
Beam Loss Monitors (less critical)
(for less critical circuits, namely the auxiliary circuits)
LHC Experiments
R.F.
Collimators
Transverse Feedback
Beam Aperture Kicker
Beam Excursion Monitors
Fast Beam Current Decay Monitors
Please note that this partition is not finalized !
J. Wenninger / LEADE

18. Time between a Request to a Beam Dump
USER_PERMIT signal changes
from TRUE to FALSE
a failure has been detected…
beam dump request
User
System
process
Signals
send
to LBDS t2
Beam
Interlock
system
process
~70μs max.
Kicker fired
Beam Dumping
System waiting
for beam gap t4
all bunches have been extracted
~ 89μs
89μs max
time t3
Achievable response time ranges between 100 s and 270 s
(between the detection of a beam dump request and the completion of a beam dump)
J. Wenninger / LEADE

19. Beam Interlock Controller
a BIC is composed of:
1) User Interface
2) Patching and Interface modules
3) Core modules
4) Optical Interface modules
It consists of 2 sets of modules
(one per beam) therefore:
2 x Patching and Interface modules,
2 x Core modules and
2 x Optical Interface modules.
J. Wenninger / LEADE
Return to Architecture slide

20. Beam Permit Loops IRn From/to previous To/from next BIC in IRn-1
BIC-Ln
BIC-Rn
USER_PERMIT
signals
loop B
loop A
Two “Beam Permit Loops”: loop A and loop B PER BEAM.
The signals (10 MHz) are generated in one of the BICs and send to the next BIC.
When the conditions for beam operation are fulfilled, the signals are transmitted to the following BIC. If NOT  signals are interrupted.
J. Wenninger / LEADE
back

21. Beam Interlock User Interface
From
User System to
Beam Interlock Crate
Receives the USER_PERMIT from a given LHC system.
Transmits the USER_PERMIT to the BIC crate.
Some User Systems will always provide the USER_PERMIT for both beams.
If failure  both beams will be dumped.
Some User Systems will dump either Beam 1 or Beam 2.
The BEAM_PERMIT status for each beam is provided to the User System.
J. Wenninger / LEADE

22. LHC Experiments
Each LHC experiment can provide one user input signal to the beam interlock system :
Different detector signals should be merged into a unique signal to the beam interlock system.
We have to define what is considered to be an ‘experiment’ : should TOTEM / CMS have 2 independent signals ?...
The experiment user signal can be used to :
Inhibit injection if the detector is not ready for beam.
Request a beam dump if radiation levels, rates… are so high that the detector may be damaged.
Note that this signal must not be used to stop beams when backgrounds are high…
A user interface module will be provided to each experiment.
J. Wenninger / LEADE

23. Conclusion / 1
The LHC Beam Interlock System is a distributed system. The Beam Interlock Controllers are spread around the ring and are linked by Beam Permit Loops. The Beam Permit Loops are connected to the Beam Dumping System, to the LHC injection kickers and to the SPS fast extraction system.
The expected response time ranges from 100 to 300 ms (time until the last proton has left the ring).
All Beam Interlock System components are already used sucessfully for the extraction from SPS to LHC ring 2.
Each experiment will be able to provide an interlock signal to inhibit injection and dump the beam in case of emergency. If more than one detector is involved in the protection of an experiment, the signals should be merged into a single one.
A standard user signal interface will be provided for the connection to the Beam Interlock System.
J. Wenninger / LEADE

24. Conclusion / 2
Details concerning the signals and the interlocking will be addressed in the near future by the LHC Machine Protection WG :
TOTEM / CMS splitting.
Maskable or unmaskable experiments signals ?
Interlocking of movable devices : TOTEM roman pots, LHCb VELO…
Any other issue…
J. Wenninger / LEADE