9 Accelerator Operations
575
• Beam instrumentation to measure and check that beam parameters are in the
correct range.
• A beam dumping system, in general including a fast kicker magnet and absorber
block.
• Collimators and beam absorbers to provide passive protection against beam loss.
• A beam interlock system that links the different protection systems. Its role is
to ensure that the appropriate action is taken in case of problems (the beam is
extracted from a synchrotron, injection is stopped etc.). The interlock system
might include complex logic.
There are several principles that should be considered in the design of protection
systems, although it might not be possible to follow all these principles in all
cases.
• If the protection system does not work or is compromised, it should prevent
continued operation. The design should be fail-safe. In case of a failure in the
protection system, protection functionalities should not be compromised. As an
example, if the cable that triggers the extraction kicker of the beam dumping
system is disconnected, operation must be stopped and the beam dumped.
• Detection of internal faults: the protection system must monitor its status. In case
of an internal fault, the fault should be reported. If the fault is critical, operation
must be stopped.
• Remote testing of correction system behaviour should be possible. For example
between two runs unit testing should allow verification of the correct status of
the system.
• Critical systems should have built in redundancy of critical functionality (possibly diverse redundancy, with the same or similar functions executed by different
systems).
• Critical processes for protection should not rely on complex software running
under an operating system and requiring the availability of a computer network.
• It should not be possible to remotely change the most critical parameters of a
given system. If parameters need to be changed, the changes must be controlled,
logged and password protection should ensure that only authorised personnel can
make the change.
• Safety, availability and reliability of the systems should be demonstrated. This is
possible by using established methods to analyse critical systems and to predict
failure rates.
• One should attempt to gain experience of operating the protection systems in
good time before they become critical, to gain experience and to build up
confidence. This could be done before beam operation, or during early beam
operation when the beam intensity is deliberately kept relatively low.
575
• Beam instrumentation to measure and check that beam parameters are in the
correct range.
• A beam dumping system, in general including a fast kicker magnet and absorber
block.
• Collimators and beam absorbers to provide passive protection against beam loss.
• A beam interlock system that links the different protection systems. Its role is
to ensure that the appropriate action is taken in case of problems (the beam is
extracted from a synchrotron, injection is stopped etc.). The interlock system
might include complex logic.
There are several principles that should be considered in the design of protection
systems, although it might not be possible to follow all these principles in all
cases.
• If the protection system does not work or is compromised, it should prevent
continued operation. The design should be fail-safe. In case of a failure in the
protection system, protection functionalities should not be compromised. As an
example, if the cable that triggers the extraction kicker of the beam dumping
system is disconnected, operation must be stopped and the beam dumped.
• Detection of internal faults: the protection system must monitor its status. In case
of an internal fault, the fault should be reported. If the fault is critical, operation
must be stopped.
• Remote testing of correction system behaviour should be possible. For example
between two runs unit testing should allow verification of the correct status of
the system.
• Critical systems should have built in redundancy of critical functionality (possibly diverse redundancy, with the same or similar functions executed by different
systems).
• Critical processes for protection should not rely on complex software running
under an operating system and requiring the availability of a computer network.
• It should not be possible to remotely change the most critical parameters of a
given system. If parameters need to be changed, the changes must be controlled,
logged and password protection should ensure that only authorised personnel can
make the change.
• Safety, availability and reliability of the systems should be demonstrated. This is
possible by using established methods to analyse critical systems and to predict
failure rates.
• One should attempt to gain experience of operating the protection systems in
good time before they become critical, to gain experience and to build up
confidence. This could be done before beam operation, or during early beam
operation when the beam intensity is deliberately kept relatively low.