Primary Ion Beams in the North Area: Design of the Safety Interlock Information for SPS-OP 14/2/2014...
-
Upload
sarah-delilah-hill -
Category
Documents
-
view
216 -
download
0
Transcript of Primary Ion Beams in the North Area: Design of the Safety Interlock Information for SPS-OP 14/2/2014...
Primary Ion Beams in the North Area:Design of the Safety Interlock
Information for SPS-OP 14/2/2014
D.Manglunki presenting the work of
T. Hakulinen, F. Havart, S.Hutchins, P. Ninin, P.Odier, S.Reignier, F. Valentini, D. Vaxelaire,
& colleagues.
Motivation• Until recently, primary ion beams could be sent towards the North Area only during periods where
no protons could be present in the SPS (ex: Pb ions at 13 & 80 GeV/u in December 2010, during PS proton injection septum fault).
• For the forthcoming Ar, Xe, and Pb runs, it is foreseen to intermix both proton and ion cycles in the same super-cycle.
• Although highly unprobable, it it not impossible in these conditions to extract a high intensity primary proton beam to the North Area, exposing personnel to a radiation hazard:
– Wrongly programmed injection of protons on an ion cycle– Accidental firing of the extraction elements during a high intensity proton cycle– Installation of a slow extraction proton cycle (SFTPRO) during primary ion operations
• The principle of an interlock based on BCTs, preventing the extraction of a beam more intense than 2x1011 charges, has been proposed by the SPS OP team leader, and approved by the Beams Department Safety Officer in March 2009.
Technical Solution• Two BCTs installed in BA5,
measure the beam intensity and give veto signal if I>2x1011 charges.
• The interlock acts on the power supplies of extraction magnets MST and MSE in BA2, forcing them to quasi-zero current if the interlock gives a veto signal.
• The interlock function is activated by an “Ion-mode” key in the CCC
• Diversely redundant design at the level of measurement, control, transmission & action
Implementation• Respect norms IEC 61511 (process industry) and IEC 61513 (nuclear installations).• Two interlock chains: PLC and wired interlock
(response time < 200 ms).– PLC chain based on SIEMENS S7 300 CPU and remote I/O with fiber optic cabling.– Wired chain based on HIMA Planar 4 modular wired logic.
• See technical spec EDMS 1146023.
BCTs• Pure hardware solution for maximum
reliability and availability• 2 new DCCTs, designed and made at CERN,
installed in June 2012 in SPS point 5• Identical and independent systems• Permanent monitoring of the circulating
beam intensity (IB)• Comparator on the analogue signal
– threshold @ 2x1011 charges• Self-check system to assess the DCCTs
performance• 2 status sent to the interlock system
indicating– whether IB is > or < 2x1011 charges– whether the DCCTs are available or
under test• Real-time software for remote monitoring
Self-check principleContinuous check:Performed in the DIAGNOSTIC UNIT Assessment of important DCCT parameters:• Current consumption• Demodulation signal amplitude• etc.Quick Check:Performed automatically once per cycle before injection in the CHECK & COMPARATOR UNIT• Verification of the DCCT and comparator
responses to a sequence of 6 calibrated current pulses injected into the monitor
• Results stored until the next Quick Check• Validity period fixed to 60s
CONTINUOUSSTATUS
DCCT CHECK
COMPARATOR CHECK
VALIDITY CHECK
SELF CHECKSTATUS
START CHECK QUICKSTATUS
QUICK CHECK
CONTINUOUS CHECK
AN
D
AN
DA
ND
SELF CHECK
One should tune the right balance between check severity and system availability
Each DCCT delivers 2 status and their complements to the 2 different inputs of the Interlock System (PLC and wired) Galvanic insulation by opto-couplers
Status delivered to the Interlock System
• LOW_IB_STATUSTRUE IF Ib < 2x1011 charges AND Self-Check result is OK AND NOT_IN_CHECK_STATUS is TRUE
• NOT_IN_CHECK_STATUSTRUE when the DCCT and the comparator are available, i.e not in quick check process
MSE-MST power supplies• Acting on the REF-in of the converter to prevent extraction,
forcing it to Imin • Feedback to check I=Imin• Check if system actually prevented an accident, in which case
DSO action is required• Actuator card between the Mugef and the Converter control
crate -> direct control on the current reference
• The reference simply passes through the card (REF-OUT=REF-IN) as the NO_EXTRACT_VETO signal from the Interlock is high, allowing extraction.
REF-IN (Mugef)
NO_EXTRACT_VETO (PLC)
REF-OUT (Control crate)
I0
REF – IN < I0
Carte Ions/Protons Interlocks
INTL-FAULT
NO_EXTRACT_VETO (Wired)AND
REF Imin REF Imin
Idcct I>
NO_REF_FAULT
Reset with Key
-+
Ierreur
Status
DCCT2
Normal behaviour: extraction of low intensity beam
REF-OUT (Control crate)
I0
REF – IN < I0
Carte Ions/Protons Interlocks
INTL-FAULT
AND/OR
REF Imin REF Imin
NO_REF_FAULT
Reset with Key
NO_EXTRACT_VETO (PLC)
NO_EXTRACT_VETO (Wired)
REF-IN (Mugef)
Idcct I>
-+
Ierreur
Status
DCCT2- +
• The BCTs detect an intensity I>2x1011 charges:• One of the NO_EXTRACT_VETO signal from the interlocks (PLC and Wired) is low• The reference is forced to Imin=(720A for MSE ; Imin=225A for MST), minimum current reference
given by the CCC, inhibiting the pulse converter.
Normal behaviour: high intensity beam, no extraction
Abnormal behaviour• First Case: The signals NO_EXTRACT_VETO are low. The current
reference REF-OUT is forced to Imin.– In the second step, a reference REF-IN (above I0) is still received.– This abnormal case should be analysed: A signal INTL-FAULT is
generated and the converter is stopped.• Second Case: The converter of a pulse cycle is allowed, the REF-
IN is greater than I0. – In the second step, the signals NO_EXTRACT_VETO become low: This
abnormal case should be analysed. The associated actions are:– The reference REF-OUT is forced to Imin.– A signal INTL-FAULT is generated and the converter is stopped.
• If either of these cases occurs, a fault in the converter will be activated, which can only be reset with a key. This key will be available to authorized persons competent to reset this fault (DSO), after an analysis of the fault event.
REF-OUT (Control crate)
I0
REF – IN > I0
Carte Ions/Protons Interlocks
INTL-FAULT
AND/OR
REF Imin REF Imin
NO_REF_FAULT
Reset with Key
NO_EXTRACT_VETO (PLC)
NO_EXTRACT_VETO (Wired)
REF-IN (Mugef)
Idcct I>-
+Ierreur
Status
DCCT2- +
FAULT
Abnormal behaviour• First Case: The signals NO_EXTRACT_VETO are low. The current reference REF-OUT is forced to I min.
• In the second step, a reference REF-IN (above I0) is still received.• This abnormal case should be analysed: A signal INTL-FAULT is generated and the converter is stopped.
• Second Case: The converter of a pulse cycle is allowed, the REF-IN is greater than I 0. • In the second step, the signals NO_EXTRACT_VETO become low: This abnormal case should be analysed. The associated actions are:• The reference REF-OUT is forced to Imin.• A signal INTL-FAULT is generated and the converter is stopped.
• If either of these cases occurs, a fault in the converter will be activated, which can only be reset with a key. This key will be available to authorized persons competent to reset this fault (DSO), after an analysis of the fault event.
Status as of today (February 2014)• 2 BCTs installed in BA5 and tested with beam• Design of power supply safety system done;
implementation being done TE/EPC• Interlock design done and internally tested.• Interface to BCTs tested.• NOW: approbation of the Technical Spec.• Final version of the BCT/Comparator electronics• MST/MSE power supply interlocking electronics• Installation of one Fast BCT (additional beam monitoring)• Global BCT/Comparator system commissioning without beam• Interface to MSE/MST final testing.• Inter-site cabling:
– BA5, CCC, CCR done. BA2 planned for March.– All Fiber-optics cabling finished
• Integration tests with all components will be connected early 2014.– Finalization of installation and test documentation.
• DSO-tests to be scheduled before SPS start-up.
Thanks for your attention!
Typical SPS Super-cycle
North Area Ion cyclewith slow extraction
HiRadMatproton cycle
LHC proton cycle
Geographical Layout
Interlock Schematic
System monitoring interface using TIM
Development Model
SIF 1: Avoid high intensity proton beam extraction to north area in ION mode
(ION_PROTON_MODE = 0 Λ LOW_IB_STATUS_A = 1 Λ LOW_IB_STATUS_B = 1 ΛIN_CHECK_STATUS_A = 0 Λ In_CHECK_STATUS_B = 0 Λ Watch_Check_A = 1 Λ Watch_Check_B = 1 ΛNO_REF_FAULT = 1) ION_PROTON_MODE = 1∨
PLC OUTPUT NO_EXTRACT_VETO_A = 1 PLC OUTPUT NO_EXTRACT_VETO_B = 1
TRIGGERING EVENT- SAFETY VETO REMOVAL FROM MST/MSETimeout_Check_A = 1 Λ Watch_Check_A = 1
OUTPUT Watch_Check_A = 0
TRIGGERING EVENT- DCCT 1 CHECK WATCHDOG INVALIDATION:
Timeout_Check_A = 1 Λ Watch_Check_A = 1
OUTPUT Watch_Check_B= 0
TRIGGERING EVENT- DCCT 2 CHECK WATCHDOG INVALIDATION:
SIF 2: Send and maintain veto to BIS in case of MSE/MST malfunction
NO_REF_FAULT = 0 Λ ION_PROTON_MODE = 0
PLC OUTPUT NO_SAFETY_FAULT = 0
TRIGGERING EVENT- SPS SAFETY BEAM DUMP REQUEST:
21
In red: Minimum system required to fulfil the initial specification
In green:Monitoring, remote diagnostic tools + acquisition + logging
General layout
Time diagram
Range 3
Extraction Permitted NO Extraction
4 Cases
NO Extraction NO Extraction
Will be NOT_IN_CHECK_STATUS in the final version
Acquisition, monitoring and logging• Acquisition via a RT program running in the FEC (Front End Computer)• 1 FEC per DCCT
ADC• 16 signals per system (Beam intensity on 4 ranges, system 1 and 2, status, etc.)• Sampling rate: 100 S/s• Start 900ms before injection• Stop ~20ms after ejection• Reading after ejection
Input Register• 17 status per DCCT (result of every elementary check, etc.)• Reading after ejection
• Data publication via a FESA class once per cycle after ejection
•Logging Timber system To be decided:
o Which signal (Beam intensity, LOW_IB_STATUS, NOT_IN_CHECK_STATUS?)o What time resolution?
Test with beam (SPS.LHC4; 12.10.2012)
ADC
bin
Time [ms]
Will be NOT_IN_CHECK_STATUS in the final version
Real signals seen via the FESA Navigator
BCT Planning• March 2009 Specification draft• April 2010 ECR 1075945 v1• Jan 2011 Cable pulling for provisional location (BB5)• May 2011 Writing the technical specification (v1)• June 2012 ECR 1075945 v2• Sept 2011-May 2012 Manufacturing of mechanics• March - June 2012 Building the electronic prototypes • June 2012 Installation of 2 monitors in point 5• Since August 2012 Test of DCCT & Soft RT programme• Jan-Feb 2013 Tests with the Interlock system
• LS1 -Cable pulling for final location (BA5)
-Approbation of the technical specification-Make final version of the electronic-Installation of one Fast BCT (additional beam monitoring)-Global System Commissioning without beam
• After LS1 -Global System Commissioning with Beam -Operation with Ions Beam in North Hall
Required for the next stepNow
• Actuator card between the Mugef and the Converter control crate -> direct control on the current reference• However, setting the current reference to Imin does not guarantee that in the case of a malfunction of the
electronic control of this converter, the current in the circuit is actually Imin
• Supplementary DCCT measures the converter output current – compared to the input reference current “REF-IN”, giving us an error signal “Ierror”. – If difference too large, comparator drives a relay into fault (open) position and cause action on the beam
(signal NO_REF_FAULT).• DCCT status managed by “Ion/Proton actuator card”:
– DCCT dry status contact connected in series with relay contact -> any problem with the DCCT will also cause appropriate action on the beam (signal NO_REF_FAULT).
REF-OUT
Mugef
Convertercontrol crate
REF-INCrate Ions/protons
InterlocksNO_EXTRACT_VETO (PLC)
RESET with KEY
INTL-FAULT
NO_EXTRACT_VETO (Wired)
Idcct
NO_REF_FAULT
DCCT2CrateStatus