The CERN Beam Interlock System: Principle and Operational Experience

A complex Machine Protection System has been designed to protect the LHC machine from an accidental release of the beam energy, with about 20 subsystems providing status information to the Beam Interlock System that is the backbone of machine protection. Only if the subsystems are in the correct state for beam operation, the Beam Interlock System receives a status flag and beam can be injected into LHC (Large Hadron Collider). The Beam Interlock System also relays commands from the connected subsystems in case of failure for triggering the LHC Beam Dumping System. To maintain the required level of safety of the Beam Interlock System, the performance of the key components is verified before every fill of the machine and validated after every emergency beam dump before beam operation is allowed to continue. This includes all critical paths, starting from the inputs from connected systems triggering a beam dump request, followed by the correct interruption and propagation sequence of the two redundant beam permit loops until the final extraction of the beam via the LHC beam dumping system. In this paper we report about the experience with the Beam Interlock System that has been deployed for some years in the Super Proton Synchrotron (SPS), in its transfer lines and recently in LHC.