Integration into MP - Considerations - R. Assmann, AB Collimator Control System Mini-Review December 18th, 2006 Many thanks to the COCOST and machine protection colleagues for comments and useful input, in particular to V. Kain, S. Redaelli, R. Schmidt and J. Wenninger. RWA, 18/12/2006

Why is it so important? Many damaging events in existing accelerators found collimators or other movable elements a posteriori at wrong positions. Collimators at wrong positions go unnoticed (or can even provide better efficiency) until protection function is needed: first case of irregular event. At the LHC consequences of such an event can be catastrophic. LHC collimators designed from the first minute with high redundancy and safety in mind (in spite of limited time available for optimization). We had an event in the SPS: Somebody moved the LHC prototype collimator in with FESA tools. The collimator switch generated an interlock that stopped the beam and we were called in… This talk: Summarize the MP features of collimators. Sketch the possible implementation of MP functions into a safe collimator controls system. RWA, 18/12/2006

Interlocks from Switches Switches are indicating extreme jaw positions. In switch  Maximum in-position of a jaw (5 mm beyond ideal beam axis). Generates interlock as this is not an allowed operational mode with LHC beam. Anti-collision switch  Minimum collimation-gap (≤ 0.5 mm). Generates an interlock as this is not an allowed operational mode with LHC beam. Out switch  Collimator jaw is fully out (half-gap of 28mm): Possibility 1: No interlock. Jaw must be out (injection protection after end of injection, absorption of physics-debris before collisions, collimator not used, …). Possibility 2: Generates an interlock. Jaw must not be out (injection protection during injection, primary and secondary collimators, TCDQ, …). Requires machine mode dependent “required switch status” for decision. Depends on state of commissioning (not all collimators used in the first day). “Required switch status” stored and retrieved from management of critical settings (MCS). Logic is machine-mode dependent. Risk: Loss of passive MP. Damage to collimators and/or accelerator. RWA, 18/12/2006

Interlocks from Jaw Temperature Measured jaw temperature depends on many factors: Heating from beam loss HOM heating (distance from the beam) Speed and input temperature of cooling water Threshold for jaw temperature (warning and dump) must be determined from operational experience and are influenced from various factors: Increase in out-gassing rate due to jaw heating (factor 10 increase with DT=50ºC for CFC material). Risk of closing vacuum valves. Risk of reduced lifetime and background. Heating and deformation in the collimator (no need to worry about damage to CFC). Risk of loosing cleaning efficiency. Heating (typically asymmetric) of downstream accelerator components (e.g. flanges) due to showers escaping from the collimators jaws. Risk of vacuum leaks and accelerator damage. Warning and damage thresholds can depend on machine mode. They are stored and retrieved from the MCS. RWA, 18/12/2006

Status-Related Interlocks Stepping motors must always be in good status (diagnostics flag OK, power supply up, communication OK, …). If good status is lost  generation of interlock. Jaw position switches must provide a signal, otherwise generation of interlock. At least 1 out of the 2 temperature sensors (redundancy) in a jaw must provide a signal, otherwise generation of interlock. A sufficient number of position sensors (redundant system) must provide signals, otherwise generation of interlock. Can be reviewed later (for example keep running during reboot)… RWA, 18/12/2006

Low Level Calibrations The low level systems require calibration, for example the position sensors. The calibration constants are stored at the low level (and a copy through FESA in the MCS). At the start of each fill the low level calibration data is verified against the MCS system. Interlock if found inconsistent. In case of a low level reboot: Load FESA image with critical settings. A re-calibration is a protected process with the following proposed procedure: In case of collimation problems the first line collimation contact is called in. The first line decides whether a re-calibration is required. If required then the low level expert is called in, performing the calibration (without beam) in a protected procedure. The calibration results are reviewed on the spot by the first line contact and the low level expert. If the new calibration data is successfully validated then it is stored into the low level and the MCS database. RWA, 18/12/2006

Beam-Based Calibration It is not convenient that the operator drives the collimators through absolute positions. Instead, LHC collimation will be mainly set up with normalized settings through collimator families (primary, secondary, tertiary, … collimators): For example all primary collimators to ± 6 s gap centered around the beam. All secondary collimators to ± 7.5 s gap centered around the beam. … Top level will allow changes in family settings in addition to control of single collimators (like in SPS). The relevant normalized settings require knowledge of beam-based collimator calibration data: Calibration is (hopefully) done infrequently for each used collimator. Collimator data: Beam center and angle in collimator. Beta function during calibration. Overall: Emittance during calibration. The beam-based calibration data is stored in the MCS and replaced by a collimation expert after a new calibration and a check of calibration data. RWA, 18/12/2006

Driving Jaws: Step Change position Requested Position time 6 mm Notification of completed movement and continuous check of position Actual Position 3 s Continuous check of position until start of movement “Blackout” for jaw position control: Jaws can run too short or too far. Difficult to detect during movement: no reference is defined during movement. Tolerance: If we want to detect differences of 0.2 s then we have 20 ms to react.  Need for function-driven movements to assure correct settings at all times! RWA, 18/12/2006

Driving Jaws: Function Driven time jaw position Upper dump threshold (MCS) Upper warning threshold (derived MCS) Requested Position Actual Position Lower warning threshold (derived MCS) Lower dump threshold (MCS)  Interlock if the actual position crosses upper or lower dump threshold! Calculate or load new absolute setting functions Download setting functions to low level (MDS and PRS) Activate correct MCS collimator functions (e.g. squeeze) Download MCS functions to low level (PRS) Send synchronized trigger to execute new function and start position control with new MCS functions.  A series of functions (setting + MCS) can be downloaded at the start of the fill and executed one after the other by subsequent trigger events. RWA, 18/12/2006

Interlocks from Jaw Position & Collimation Gap A fully redundant position readout and survey is implemented: 8 position sensors for 4 settings. Use redundancy for improved safety and efficiency. On top independent measurement of the collimation gap. Function-driven movements avoid blackout windows. Interlocks generated for the following events: “Jaw support point measured too far in.” “Jaw support point measured too far out.” “Measured gap too small.” “Measured gap too large.” Tightest tolerance is at the 0.2 s level (~20 ms or ~40 mm for nominal 7 TeV settings). A warning will be generated before the interlock: Possibility to stop all collimator movement in safe status and re-trim before dump threshold is reached. Challenge: Up to 500 DOF means up to 500 setting functions! RWA, 18/12/2006

MCS Jaw and Gap Functions The collimation control must rely heavily on MCS for storage of dump thresholds (used for deriving warn thresholds). All MCS functions will be stored in absolute settings: No protection from relative bands, as any function could be downloaded and executed. Upper and lower bands can be asymmetric to the setting and their values depend on the collimator settings (more tight for small gaps). Changes in collimation settings (for example secondary collimators to 7.3 s instead of 6.7 s) can require update of the absolute MCS functions. For every regular collimation action (e.g. injection, ramp, squeeze) the setting and MCS functions can be pre-generated and downloaded at the start of the fill. Important empirical adjustments during the fill will require update on settings and MCS functions (in particular during collimation MD’s with exploration of collimation settings). Initially we will have larger bands to allow for set up and commissioning while maintaining the machine safety. RWA, 18/12/2006

Missing Trigger Events: Checks with Beam Energy or other Signals Important beam information is distributed in the timing signal (for example beam energy). This can be used to protect against events like “missing trigger”: Imagine the collimation controls system misses the timing event that starts the ramp. Collimators will stay happily where they should be according to their old setting and MCS function. Meanwhile the energy is ramped. Can be unsafe! Solution: A function of beam energy versus time is sent together with the setting function versus time. The beam energy from the timing signal is checked with the beam energy function. If the trigger signal is missed then the old beam energy function is still active and the interlock will be generated once a different beam energy is reported via timing signal. Can be done for other parameters the same way (for example b*). RWA, 18/12/2006

Summary Interlocks per Collimator In switch activated. Anti-collision switch activated. Out switch activated. Out switch not activated. Can depend on mode. Jaw temperature limit reached. No temperature measurement in jaw. Switch not responding. Motor, power supply or communication down. Too many position sensors not working. Inconsistent low-level calibration table. Jaw support point measured too far in. Jaw support point measured too far out. Measured gap too small. Measured gap too large. Active function has inconsistent beam energy. Sum entry from collima-tors to the BIC: Crucial role of post- mortem information to diagnose the origin of the interlock. RWA, 18/12/2006

Conclusion The SPS and TT40 beam tests have proven that the responsible colleagues have selected powerful and precise hardware for the LHC. Step like collimator controls (unsafe) is proven: we are ready for performing collimator calibrations and simple collimation set up. The safe LHC collimation control system will rely on synchronized and function-driven movements, extending the system tested in the SPS. Many ways to detect dangerous events: At present 14 interlocks are possible through many channels in a given collimator. The MCS will be crucial in handling and saving critical information. Close connection is required. Still need to optimize HW storage against MCS storage. My talk focused on the possibilities and functional requirements as discussed over the last 2 years. We are now ready to work out a preliminary technical specification until April. A review of MP functionality in LHC collimation in April! RWA, 18/12/2006