1. 1 Beam Plans for Accelerator Systems: The Machine Protection System Jan Uythoven On behalf of the MPWG and the MPS Commissioning WG Special thanks to R.Schmidt, J.Wenninger, A.Macpherson

2. Jan Uythoven, AB /BT eLTC, 5 March 2008 2 Machine Protection System Has to guarantee the Safe operation of the LHC under all circumstances Hard work during all the different LHC ‘phases’: Design phase: done Construction phase of the individual equipment: almost done Individual System Testing (equipment): ongoing Global System Testing, MPS aspects Talk Alick Macpherson, session 2 Hardware Commissioning Starting Tests with beam Operation with beam This Session

3. Jan Uythoven, AB /BT eLTC, 5 March 2008 3 Beam Interlock System Beam Dumping System Injection Interlock Powering Interlocks sc magnets Powering Interlocks nc magnets QPS (several 1000) Power Converters ~1500 AUG UPS Power Converters Magnets Magnet Current Monitor Cryo OK RF System Movable Detectors LHC Experiments Beam Loss Monitors BCM Experimental Magnets Collimation System Collimator Positions Environmental parameters Transverse Feedback Beam Aperture Kickers Beam Lifetime FBCM Screens / Mirrors BTV Access System DoorsEIS Vacuum System Vacuum valves Access Safety Blocks RF Stoppers Beam loss monitors BLM Special BLMs Monitors aperture limits (some 100) Monitors in arcs (several 1000) Timing System (Post Mortem Trigger) Operator Buttons CCC Safe LHC Parameter Software Interlocks LHC Devices Sequencer LHC Devices LHC Devices Safe Beam Parameter Distribution Safe Beam Flag Little beam dependence View of the LHC - MPS Core Systems Protection elements

4. Jan Uythoven, AB /BT eLTC, 5 March 2008 4 Tests with Beam Some systems require ‘Machine Protection Tests’ with beam: Injection System and its Protection Elements Collimation System Beam Dump System and its Protection Elements Beam Loss Monitors FMCM Generally not to test the hardware (done without beam) but to Check if the settings are ok Check if the assumptions – underlying the concepts used in the ‘protection theory’ – is correct Check interdependency within systems Treated by talks of the individual systems in this session Listed as tests in the procedures developed in the MPS Comm. WG

5. Jan Uythoven, AB /BT eLTC, 5 March 2008 5 The MPS hardware is working under nominal configuration: Beam dump request is only given when it is required No ‘false’ hardware interlocks via BIS No ‘false’ software interlocks via SIS Systems are brought into operation according to MPS commissioning plans Depends on beam intensity and beam energy = commissioning phase Machine model is nominal, fitting to the corresponding phase : Optics functions within tolerance (orbit, tunes etc.) properly corrected and within tolerances, beam intensity and energy within the pre-defined limits Try to stick to ‘stable optics’ – avoid verification of MPS for new conditions Operational procedures related to Machine Protection ok: Beam quality checks ok Post Mortem following beam dump fully understood Post Operational Checks (injection, beam dump) always ok Daily Operation with Beam The Ideal World A system is required to restrict the operation within the well defined window: Clear procedures / limits known at all times: central place to keep this info! Software interlock on energy / intensity / optics? (e.g. limit operation at 2 TeV) Be sure not to work outside the agreed upon conditions:

6. Jan Uythoven, AB /BT eLTC, 5 March 2008 6 Daily Operation with Beam The Real World Beam Dump, or no ‘green light’ to inject: operation Stopped Safe, but degradation of the machine up-time: action desired Not Safe to continue: Procedures – discipline of the operators, need clear limits and/or restrictions Check of MPS functionality under the different conditions / change interlock settings Hardware malfunctioning or not available Automatic Post Operational Checks stop operation Produce interlock which needs resetting No interlocks, but one does not fully understand what happened Post Mortem Machine is not in nominal conditions Different tunes, optical functions etc. Previous Slide Next Slide Interlocks No Interlocks Unsafe Safe Next Slide

7. Jan Uythoven, AB /BT eLTC, 5 March 2008 7 Beam Dump, or no ‘green light’ to inject: operation Stopped Safe, but degradation of the machine up-time: action desired Can it be fixed within an acceptable delay Y Fix it N Possible to adjust the interlock level or the settings to continue Y Acceptable? Y Adjust Continue with Different beam conditions ? (I, E, Optics) Y Acceptable? Useful? which? Y Adjust (SIS) Disable the interlock Y Acceptable? N N Y Adjust Follow-up Stop the LHC, Restart after Repair RBAC MCS, … RBAC MCS, … RBAC MCS, … N Possible to mask? Is this sufficient (I, E) Mask Follow-up N N N Y Y N N

8. Jan Uythoven, AB /BT eLTC, 5 March 2008 8 Protection and Bookkeeping When Settings or Interlock Levels ’can be changed’, protection against ‘anybody’ doing this and errors in transmission. Talk V.Kain on Friday: Role Based Access Control (RBAC) Management of Critical Settings (MCS) Coherent list of equipment where this is required Coherent list of people for the specific equipment Need to do the bookkeeping of all changes RBAC MCS, … Change of Settings, Interlocks Disabled Change of Settings, Interlocks Disabled TOOL

9. Jan Uythoven, AB /BT eLTC, 5 March 2008 9 Maskable Interlocks Safe Machine Parameters Selected set of BIS interlocks or maskable: First step if unexpected interlock – during the beam commissioning phase: can the interlock be masked? Agreed upon procedures, decided upon before the beam commissioning started Foreseen especially for the commissioning phase Should be rather straight forward – done by EIC However: bookkeeping Software Interlock System: Do we need to have maskable interlocks for the SIS (disabled with safe beam)? Also ‘ RBAC like system’ on SIS? SIS talk by J.Wozniak on Friday If we don’t trust our definition of ‘safe beam’ – Sector test session: provoke quench – then we should NOT use any maskable interlocks…

10. Jan Uythoven, AB /BT eLTC, 5 March 2008 10 Beam Dump, or no ‘green light’ to inject Automatic protection, but degradation of the machine up-time: actions desired Can it be fixed within an acceptable delay Y Fix it N Possible to adjust the interlock level or the settings to continue Y Acceptable? Y Adjust Continue with Different beam conditions ? (I, E, Optics) Y Acceptable? Useful? which? Y Adjust (SIS) Disable the interlock Y Acceptable? N N Y Adjust Follow-up Stop the LHC, Restart after Repair RBAC MCS, … RBAC MCS, … RBAC MCS, … N Possible to mask? Is this sufficient (I, E) Mask Follow-up N N N Y Y N N

11. Jan Uythoven, AB /BT eLTC, 5 March 2008 11 Beam Dump, or no ‘green light’ to inject Automatic protection, but degradation of the machine up-time: actions desired Y Fix it N Possible to adjust the interlock level or the settings to continue Y Y Adjust Continue with Different beam conditions ? (I, E, Optics) Y Adjust Disable the interlock Y Adjust Follow-up Stop the LHC, Restart after Repair RBAC MCS, … RBAC MCS, … RBAC MCS, … Possible to mask? Mask Follow-up N N Y Can it be fixed within an acceptable delay Acceptable? Useful? which? Acceptable? Is this sufficient (I, E) Decision increasingly complicated to take Advise / Discussion / Green light required EIC can decide by him/her-self Advice from equipment specialist Advice from ‘LHC Protection Panel’ RBAC MCS, … + ….

12. Jan Uythoven, AB /BT eLTC, 5 March 2008 12 Responsibilities Engineer In Charge Machine Coordinator Commissioner in Charge Equipment Experts Magnet Performance Panel In place for ‘magnet protection’, Already used during Hardw. Comm. LHC Protection Panel Concerning Machine Protection System A.Siemko, MPP meeting 21/09/2006 J. Uythoven, ‘Chamonix’ 2006

13. Jan Uythoven, AB /BT eLTC, 5 March 2008 13 Group of experts who have an overview of The nominal MPS MPS  MPS i The actual state of the MPS The bookkeeping Can’t foresee all permutations, can’t write procedures in case of failures beforehand, need experience with the actual systems and flexibility to adjust See ‘Chamonix’ 2006 New: LPP members  MPS Comm WG This group of experts exists! LHC Protection Panel JET is operating since many years with a Machine Protection System Panel

14. Jan Uythoven, AB /BT eLTC, 5 March 2008 14 Examples BIS problem STOP Asynchronous beam dump Analysis by BT group of XPOC data If the result of the BT analysis is not clear: Fix / replace doubtful equipment Series of runs of LBDS without beam Series of test dumps with low intensity beam Check interface to other equipment: RF, timing, … BLM crate not working Repair If not possible, can change ‘Master Table’ (RBAC etc.) to continue with: Safe beam? Pilot at 450 GeV? No beam dIbeam/dt interlock available in a later stage, so been running with limited beam power without this interlock If this system has a hardware problem: gives an interlock and stops operation Do we need to stop until it is fixed? Can we continue, but with limited beam power? Can we just continue? BLM signals behind collimators giving higher values than normal When do we stop operation (only at interlock level?) How much time do we take to re-optimise collimator settings What do we do if we can’t get back in the old situation Suddenly no losses measured on BLM collimators any more…! Can take 10’s of hours out of physics: so cannot be decided on by individuals but needs support/weight of LPP BG No interlocks or RBAC, but here LPP should be of help as well!

15. Jan Uythoven, AB /BT eLTC, 5 March 2008 15 The aim is to have a fully operational MPS, functioning under nominal conditions, all the time. In all circumstances the state of the MPS should be known Inventory of ‘hardware’ which is not standard Settings Interlock Levels Masking Disabling In all circumstances the operational limits and conditions of the machine should be clear For the standard conditions, depending on the commissioning phase If one is allowed to only run under special conditions: An LHC Protection Panel should be used to advise the EIC when significant changes to MPS systems and their settings need to be made to continue or optimise operation This is at least the case when RBAC is required to make the change Once agreed upon to make a change to MPS (settings): procedures for doing this Clear definitions of applying RBAC and MCS – coherent approach Who can make hardware changes? Obvious? Do we need a kind of RBAC on the Software Interlock System? Maskable interlocks with Safe Beam on SIS? Conclusions Tool(s) required for keeping track of MPS conditions Tool(s) required for keeping track of allowed machine conditions