Machine Interlocks in the Injectors MPE-TMB. Puccio & al.25 th Aug v0

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 Injectors chain / CERN Accelerators Complex 2 LINAC 4 LINAC 2 LHC Injectors chain (protons) ions chain HiRadMat

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 What are the “Machine Interlocks”? 3 Beam Interlock System (VME based) for protecting Normal Conducting Magnets for protecting the Equipments for Beam Operation BIS Fast Magnet Current change Monitor FMCM Powering Interlock Controllers (PLC based) + PIC Warm magnet Interlock Controllers (PLC based) WIC + Safe Machine Parameters System (VME based) SMP or Super Conducting Magnets

Warm Magnets Interlock (WIC system) Warm Magnets Interlock (WIC system) 1v0 4 Pierre Dahlen

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 WIC system Overview 5  based on Safety PLC  collect input signals from: - thermo-switches, - flow meters, - red buttons, …  give Power Permit for the corresponding converter Magnet 1 Power Converter Magnet 2 PC Status Thermoswitches Water Flow Red button… Several thermo- 60°C Power Permit PVSS Operator Console Ethernet PLC + I/Os Beam Permit BIS interface  WIC solution = PLC crate + remote I/O crates Profibus-Safe link remote I/Os Configuration DB

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 WIC systems currently in Operation 6 WIC  LHC (2007)  TT60 (in 2005) TT66 & Ti2 ( 4 c.  TT40 & Ti8 (2004) 2 c. WIC  TT41 1 c. WIC  LEIR (2005) 1 c. 17 Controllers & ~ 310 I/O modules 6 machines/zones ~ 1000 magnets are protected (2009) 1 c. WIC 8 controllers  LINAC3 WIC

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 WIC system: the main features 7  Based of Safety PLC (Siemens S7-300 F series)  (on purpose) Very simple process for PLC software  Sensors/Magnets/Converters partition described in Configuration DB  Reliable solution  Remote test facility  Generic solution to be deployed on any type/size of machine  Dedicated PVSS application to allow supervision of:  Magnets & Power Converters Status  Interlock process (history buffer)  Communication state (Ethernet & Profibus) Strong support from EN/ICE Developed & maintained by EN/ICE BE/CO

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 PVSS application: few screen-shots… 8 SPS Transfer Lines LINAC 3 + LEIR Courtesy of F. Bernard (EN/ICE)

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 PVSS application: monitoring views… 9 Magnets status P.C. status Courtesy of F. Bernard (EN/ICE)

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 PVSS application: History Buffer 10 Courtesy of F. Bernard (EN/ICE)

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 WIC system: future deployments 11 Machine Number of Installation date Protected Magnets PLC crate Remote I/O crates Booster during 2011 & Xmas shutdown’11/12 + during LS1 Linac4 & Transfer line Isolde /2014 Elena ring4811 ~2015 (1st beam in 2016) should match corresponding schedules (not part of Injectors chain)

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 planned deployments LHC chain status after planned deployments 12 TT41 (CNGS) Linac4 TT40 & Ti8 lines TT60 & Ti2 lines TT66 (HiRadMat) currently in operation WIC system LINAC4 PSB Linac3LEIR PSSPSLHCLinac4PSB => +70% Qty of both Controllers & protected Magnets 6 more machines/zones

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 other WIC deployments…? 13 Machine Protected Magnets PLC crate Remote I/O crates PS main ~ PS Auxiliary ~ 5021 SPS ring +auxiliaries ~ 900 ~9~9 ~ 15 According to preliminary study (project not fully decided on) + closed collaboration EN/ICE group

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 ● Using a fieldbus can reduce significantly the cost of the project => A study is going to be launched to find the most appropriate solution (maintainability, radiation tolerance,...) Note: this solution could be also used for PS deployment modified version for SPS? 14 ● Current solution uses copper cables for linking the sensors to the safety PLC ● Due to sextant length (~1.1.km), estimated cables cost could reach 500kCHF...

Beam Interlock System 1v0 15 BenjaminTodd & Christophe Martin

B.P.“MI for Injectors” MPE-TM meeting of 25 August Beam Interlock System Function 16 BIS Dumping system or Extraction Kicker or Beam Stopper or Beam source…. Target system Beam ‘Permit’ Signals Σ(User Permit = “TRUE” ) => Beam Operation is allowed IF one User Permit = “FALSE” => Beam Operation is stopped  BIS only protects equipments => not involved in personal safety. Note: LHC Access system is connected to the BIS but as LBDS redundant trigger channel

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 Design Basis 17 Safe: (Safety Integrity Level 3 was used as a guideline). Must react with a probability of unsafe failure of less than per hour and, Beam abort less than 1% of LHC missions due to internal failure (2 to 4 failures per year). Reliable: (whole design studied using Military and Failure Modes Handbooks) Results from the LHC analysis are: P (false beam dump) per hour = 9.1 x P (missed beam dump) per hour = 3.3 x Fail Safe: Must go to fail safe state whatever the failure Available: Redundant Power Supply (for LHC BIS) & UPS for Controller crate Redundant Power Supply for Remote User Interface

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 Simplified layout 18 User Interfaces User Permits #1 #14 #2 (installed in User’s rack) Beam Interlock Controller (VME chassis) copper cables User System #1 User System #2 User System #14 front rear FESA class copper cables or fiber optics links  Remote User Interfaces safely transmit Permit signals from connected systems to Controller  Controller acts as a concentrator, collecting User Systems Permits (14 HW + 1SW) generating local Beam Permit JAVA Application Configuration DB 0 Software Interlock input Technical Network Optical outputs (local ) Beam Permit Cupper links

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 Main features (1/3) 19 Critical process in Hardware: ♦ functionality into 2 redundant matrices ♦ VHDL code written by different engineers following same specification. Critical / Non-Critical separation: ♦ Critical functionality always separated from non-critical. ♦ Monitoring elements fully independent of the two redundant safety channels. Manager board FPGA chip (Monitoring part) CPLD chip (Matrix A) CPLD chip (Matrix B) Used CPLD: 288 macro-cells & 6’400 equivalent gates Used FPGA: 30’000 macro-cells & 1 million gates + all the built in RAM,etc. FPGA: Field Programmable Gate Array CPLD: Complex Programmable Logic Device

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 Main features (2/3) “Flexible” : Half of User Permit signals could be remotely masked Masking conditioned by external signal (Setup_Beam Flag) 20 Maintainable: with 100% Online Test Coverage Can be easily tested from end-to-end in a safe manner => recovered “good as new” Fast: ~20μS reaction time from User Permit change detection to the corresponding Local Beam Permit change.

B.P.“MI for Injectors” MPE-TM meeting of 25 August Main features (3 /3)  Modular and Scalable  Ring architecture or Tree architecture possible  Daisy chain possible (BIC output connected to input of another BIC) Tree Architecture Ring Architecture ● Generic solution  Protect as much as small installation as large machine  Based on BE/CO standard solutions (HW & SW) VME chassis FESA Class JAVA GUIs Logging, Post-Mortem, Databases,….

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 Daisy chained example 22 LHC ring Beam-2 Permit Injection Beam-2 Permit Extraction Beam-2 Permit

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 Master Controller variant (different type of Matrix) 23 Master BIC (AND + OR function) Standard BIC (ring architecture) & “slave” BIC” (tree architecture) (AND function) & & 1 … 1 … & … OR

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 BIS Application: Extraction cycles view Courtesy of J.Wenninger

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 BIS Application: Timing Diagram Courtesy of J.Wenninger

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 Monitoring & analysis time

B.P.“MI for Injectors” MPE-TM meeting of 25 August Operational Tests configuration verification and integrity check fault diagnosis and monitoring Pre-Operation checks (launched by Beam Sequencer) During Operation (DiaMon application) response analysis Post-Operation checks (included in PM ) In order to ensure that its safety is not compromised, the verification of the BIS is carried out in three stages

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 What about the cost? User Interface redundant P.S. F.O. variant of the User Interface Optical daughter cards Manager boardTest & Mon. board Crate + Power Supply + CPU + Timing card receiver backplane board VME system: ~15 kCHF (-30% for new Linux version) User Interface units : ~1,2 kCHF each Set of boards composing a pair of Controllers: ~ 8 kCHF  Total cost with 2 opposed examples : 3Mev Test Stand => less than 50 kCH (1 Crate, 2xBIC, 10xCIBU, short cables & no fibres) LHC ring => probably more than 1.1 MCH (17 Crates with redundant P.S, 34xBIC, ~150xCIBU, >40km cupper cables & hundreds km of f.o.)

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 BIS currently in Operation Controllers 6 machines/zones ~ 380 connected systems  TT60/Ti2/TT66 [7 c.] BIS  TT40/Ti8/TT41 [7 c.] BIS [2 c.]  LHC Inj.2 region  SPS ring  (since 2005) [6 c.] BIS [2 c.]  LHC Inj.1 region  LHC ring  ( (since 2007) [34 controllers] BIS

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 BIS: Future deployments 30 Machine Number of Installation date User Interface Controller 3 MeV Test Stand71Autumn ‘11 Linac4 & Transfer line Booster ring & ejection (more than likely) + support from Ben & from SW Engineer Linac4 LTB PS Booster Linac2 LT

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 Engineering Specifications 31

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 BIS Linac4 & PSB layout 32 Not yet defined Ejection Kicker EJECTION Master BIC EJECTION Master BIC Destination Telegrams AQN magnet currents PSB RF Source RF Master BIC Source RF Master BIC Low E. part systems L4 syst. Choppers Master BIC Choppers Master BIC TL systems PSB syst PSB systems Destination Telegrams Disable Timing signal

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 Truth table example: “Choppers” BIC 33 “Choppers” BIC FESA class Sw Interlock PSB FESA cl as s L4 & TL FESA cl as s / 5 Timing Receiver card(s) BIS User Interfaces (1 per Destination) PS FESA cla ss Vacuum valves (L4 & TL) Beam-Stopper OUT Vacuum valves (LBS) Vacuum valves (LBE) / 3 InName State 1SIS Destination LBE Destination LBS Destination PSB Destination PS Destination L4DUMP L4 and L4 T-Lines OK PSB OK XX 11X 9PS OK XXX 1X 10 L4T+LT+LTB Vacuum V. 1111X 11 LBS.VVS10 X 1 XXX 12 LBE.VVS10 1XXXX 13 L4T Beamstopper Out 111 1X Outp ut Linac4 Transfer OK Permit for beam transfer to 5 destinations: Linac4 dump, LBE, LBS, PSB and PS

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 planned deployments LHC chain status after planned deployments 34 TT41 (CNGS) Linac4 TT40 & Ti8 lines TT60 & Ti2 lines TT66 (HiRadMat) currently in operation Beam Interlock System LINAC4 PSB Linac3LEIR PSSPSLHCLinac4PSB

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 summing-up on BIS solution 35  Maintainable, Fast…  Modular & Scalable o Can be daisy chained o Latched or Dynamic Mode o CIBU solution => interface with any type of electronics  Maximize Beam Operation efficiency o A Timing card can be used as a “User_System” (like the LHC inject & dump case) o An Operator switch can be used as a “User_System”  Maintain operational flexibility o Software Interlock Inputs o External Condition signals used as User_Permits +

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 Let’s open the Pandora box… 36  Regarding the Injectors requirements, is BIS oversized (performance wise) … ? is it too costly...?  Well, in fact there is currently no another Hw choice:  Design, build, test and install a new Interlock system will cost a lot of resources…  Deploy a “light” version of the BIS will lead to a flawed solution. Saved money won’t balance the drawback of a hybrid solution.  Adapt WIC system to BIS requirements will imply new resources as well. The cost ratio “Safety PLC based system” / “VME based system” is probably at ~60/70%

B.P.“MI for Injectors” MPE-TM meeting of 25 August 2011 Wrap-up 37  is the BIS solution oversized for the Injectors?…  Next deployments: Linac4 (2013), Booster (2017)  No decision yet for PS, Linac3 and LEIR My personal point of view: Having a generic solution is the most effective answer for MI section, Machines Operation and for CERN  The WIC solution is appropriate for the Injectors  Next deployments: Booster (2012), Linac4 (2013),  Decision not fully taken for PS (2017?) and for SPS (201x?)  Study launched for using safe & reliable Fieldbus for a large installations  Limited staffing (rely on EN/ICE collaboration)

B.P.“MI for Injectors” MPE-TM meeting of 25 August CERN Fin Thank you for your attention