Optics interlock system for the CERN LHC: Implementation and operational experience

In 2016 the luminosity reach of the Large Hadron Collider (LHC) was increased by reducing the β-function in the main collision points below the design value to β 1⁄4 40 cm. This was possible thanks to a specially matched betatron phase advance between the extraction kickers and some sensitive machine elements that would otherwise risk to be damaged by miskicked beam in case of an asynchronous beam dump. This method imposed the demand to guarantee the phase advance always stays within an acceptable tolerance, including operational actions like tune adjustments. Therefore, a new interlock system on the quadrupole magnet currents was put in place to safeguard the stability of the phase advance. This paper describes the technical implementation of this power-converter interlock (PcInterlock) and the strategies used to derive appropriated tolerances to allow sufficient protection without risking false beam dump triggers. The experience with the new PcInterlock settings in 2016-18 are discussed.


I. INTRODUCTION
The Large Hadron Collider (LHC) is a 27 km long synchrotron that collides two counterrotating beams (socalled B1 and B2) in four interaction points (IPs), which host the particle physics experiments ATLAS, ALICE, CMS, and LHCb. Figure 1 shows a schematic layout of the LHC, highlighting particularly those elements that are relevant for this paper.
With the aim for highest performance, various options for the 2016 operational configuration of the LHC were considered [1,2]. The main change in the final configuration with respect to the previous year was a reduced β-function of β Ã ¼ 40 cm at the collision points of the two general-purpose experiments ATLAS (IP1) and CMS (IP5) that require high luminosity [3]. This value is 15 cm below design [4] and was made possible by using a new scheme of collimator settings and optics proposed in Ref. [5], which is summarized below.
The collimators are ordered in hierarchy such that they protect the aperture everywhere in the ring [6][7][8].
Collimator gaps are set such that all magnets have a larger normalized aperture 1 than all collimation stages [5]. The smaller the β-function in the IP, the so-called β Ã , the larger it becomes inside the adjacent triplet of low-beta quadrupoles. Therefore, the minimum machine aperture is located inside the triplets around the ATLAS and CMS experiments. These aperture bottlenecks are locally protected by tertiary collimators (TCTs 2 ) set to an even smaller normalized aperture than that available in the triplet for a given β Ã . Accommodating lower values of β Ã while maintaining the protection of the aperture therefore imposes tighter collimator gaps expressed in units of beam size. Eventually the reach in β Ã is limited by the retractions required between the collimators and the aperture.
In the unlikely event of an asynchronous beam dump [the dump kicker (MKD 3 ) misfires while beam passes] there is a risk to damage the triplet quadrupoles or TCTs in front of ATLAS and CMS. In such an event, the first part of the beam, passing the kickers while their field is rising, is only partially kicked and is not extracted into the dump channel. Instead most of these miskicked particles are absorbed by the collimator between the MKD and the next quadrupole, the so-called TCDQ, 4 and the secondary collimator TCSP. 5 However, a certain amount of particles is expected to escape. The escaped particles continue to travel along the beam-line with potentially high oscillation amplitudes and could still damage the TCTs [5,9]. The TCTs are made out of tungsten alloy and thus feature a high stopping power but are fragile and not made to intercept primary beam losses.
One way to avoid such damage is to retract the TCT jaws further to gain more space for the beam to pass through and be extracted to the beam dump in the next turn.
Alternatively, damage can be avoided by constraining the phase advance between the MKD and the TCT [5]. This principle is illustrated in Fig. 2. The picture shows TCTs at two different phases from the dump kicker: TCT 1 (blue) has a fractional phase difference of about 0°from the MKD, while TCT 2 (red) sits at about 90°. In order to reduce the amount of particles on TCT 2 , its jaws have to be retracted further compared to TCT 1 . Thus by rematching the phase advance between the MKD and TCT to be close to 0°, tighter TCT settings are feasible which allows smaller β Ã -values. A new machine optics was constructed, respecting the mentioned phase-advance constraints, which allowed reaching β Ã ¼ 40 cm [5,10].
Using this new scheme, it has to be ensured that the phase advance is stable enough to always fulfil the requirements in the event of an asynchronous beam dump. The phase advance around the circumference (and thus in a given section of the LHC) is defined by the strengths of the quadrupoles. Matching the quadrupole strength to obtain the desired phase advances for the nominal machine configuration, as described in Fig. 2, is intrinsically a safe procedure, since the quadrupole currents involved follow predefined functions throughout the LHC cycle. Nevertheless, adjustments during operation (e.g., tune trims) can change the phase advance and could potentially move out the configuration from the safe regime. To prevent such-potentially risky-situations, a new interlocking layer was put in place to constrain the changes in the phase advance during operation (see Sec. II).
For the protection during an asynchronous beam dump the phase advances between the MKD and TCTs in IP1 and IP5 are the most critical, particularly during minimum-β Ã operation, i.e., after the β Ã -squeeze, when the β-function in those interaction points is reduced from the large injection (β Ã ¼ 11m) to the small physics (as small as β Ã ¼ 0.25m in 2018) values. Here the β-functions in the triplets and TCTs are the largest (and with it the beam size), such that the amount of particles potentially impacting on the TCTs is maximized.

II. BASIC PRINCIPLE OF THE POWER-CONVERTER INTERLOCK SYSTEM
This type of interlock system was introduced for the LHC in 2012 [11]. The power-converter (PC) interlock monitors the PC currents to protect against operational-and feedback-failures. Its primary use-case, up to now, was the interlock of orbit corrector currents in order to track bump shape amplitudes and variations. To cover the use-case described in this report, it was extended in 2016 to apply an interlock on the optics (phase advance), which is controlled by monitoring the quadrupole currents. The operational principle of this system is the following: (i) A reference current-function is defined for each magnetic circuit (power-converter) to interlock, representing the nominal current evolution for each phase of the LHC cycle, established at the time of commissioning of the nominal cycle. (ii) Additionally each circuit is assigned a tolerancefunction (always positive), specifying how much the current of the given circuit is allowed to vary around the reference. (iii) The PcInterlock system acquires the current 6 of each circuit and checks that the measurement lies within the reference AE tolerance (both corresponding to the actual point in time of the ongoing cycle). In case the measured current is outside the tolerance band, the respective circuit is considered as interlocking. (iv) Interlock signals are generated based on different strategies, potentially combining interlock signals of several power converters. The beam is dumped as soon as the dump strategy conditions are met. Figure 3 shows an example of the current evolution of one power-converter during the betatron squeeze as monitored by the PcInterlock system. The reference function is shown in red with a shaded red tolerance band. If the measured current (shown in blue) would go out of the tolerance band, the circuit would interlock.
As mentioned before, originally the PcInterlock was built to observe all orbit corrector currents with the main purpose to avoid undesired closed orbit bumps that could bring the beam too close to the aperture. For this case the interlock condition is that at least two circuits for one beam and one plane have to be interlocking to trigger a dump, because only in this configuration an unwanted closed orbit bump could build up.
The quadrupole current interlock condition follows a different strategy, since the phase advance between two particular points could be changed by only one arbitrary quadrupole changing its current anywhere on the circumference. Therefore a beam dump is triggered as soon as a single individual quadrupole power-converter interlocks. Each interlock output of the PcInterlock (be it orbit correctors or quadrupoles) can have one of the following three states: (i) Ok → no interlock, all currents are within limits (or the PCs are not in an operational state).
(ii) Warning → trigger warning, when one or more PC currents reach 70% of the interlock limit. (iii) Interlock → trigger interlock (beam dump). For the quadrupoles, this is the case if at least one PC current is at or above 100% of the interlock limit.

III. SOFTWARE IMPLEMENTATION AND TIMING CONSIDERATIONS
The PcInterlock software is implemented in Java and follows a classical client/server architecture. The server interacts with the different parts of the control system and is responsible for gathering the necessary data and triggering an interlock. The client is a graphical user interface that runs on a computer in the CERN Control Center. It is used to control the behavior and to monitor the status of the server. Figure 4 shows a graphical representation of the data flow. At a frequency of 2 Hz, the PcInterlock server receives the measured PC currents and compares them with the defined reference currents (and tolerances, see below and Sec. IV) stored in the LHC control system, the so-called LHC software architecture (LSA). The result of this comparison is then published to the LHC software interlock system (SIS) that will issue a beam dump request if the conditions are met.
Unlike other cycling accelerators, the LHC cycle is not divided into equally sized time-frames linked to a supercycle. Instead, it has a predefined set of so-called Users (like INJECTION, RAMP, SQUEEZE, or COLLISIONS). The settings that are needed for the devices to operate correctly are stored in so-called beam processes (BP). A beam process is a collection of functions that each defines the change of state of a device in the LHC, e.g., its current or position, over the common time period of the BP (for simplicity, only functional BPs are considered). Depending FIG. 3. Principle of the PcInterlock. The reference (red dashed) and measured (blue) PC current is shown over the duration of a beam process. The red shade shows the allowed variation tolerance. Once the blue line exceeds the red band, this circuit is considered as interlocking.
on the task, the BP can have a different duration. The BPs are then mapped to users in order to achieve certain goals (e.g., collisions). The order in which the users, and with them the attributed BPs, are linked defines the LHC cycle. For continuity, it is evident that the endpoint of a BP must match the starting point of the following.
The previously mentioned reference function of the PCs are stored as additional functions in the operational BPs. The PcInterlock reads this reference function and needs to compare it to the momentarily measured current value. Therefore, it is imperative to know the actual point in time since the beginning of such a function to extract the exact reference point to compare with.
The start of a BP, and thus the played functions, is signalled by a so-called timing event that is sent by the LHC central timing system. When the PcInterlock receives this event it will query the actual user and the associated beam process. In the BP it will find the reference current functions for each PC. By subtracting the time at which the timing event was received from the actual time, the PcInterlock can determine at which point of the function it has to look for the actual reference current of a PC. With this information, PcInterlock can compare the current of each PC with the reference function at a precise point in time in order to determine the interlocking status. The accuracy of the synchronisation between data and reference is around one second.
The sampling frequency is defined by the regular PC publication rate of 2 Hz. This is adequate for two reasons: there is no precise timing requirement for the phase interlock due to the fact that asynchronous dump events are extremely rare and the field change is slow due to large impedance. Therefore, also the Java server could be designed without hard real-time constraints.
The current in the quadrupoles naturally changes during the energy ramp and the squeeze. The currents, and so the tolerances, increase during the energy ramp to compensate for the increasing beam rigidity at constant strength (apart from necessary tune corrections). During the squeeze the energy is constant and therefore the tolerances are programmed to be constant as well. For very tight tolerance settings and fast ramp rates, it could happen that the measured current exceeds the tolerances caused by a timing delay with respect to the reference function, as sketched in Fig. 5. In this situation the PcInterlock would trigger and cause an unjustified protection dump. This scenario is avoided by keeping wider, constant tolerance bands during the squeeze and only close the limits at the end just before the final optics configuration is reached. Since the protection is aimed at rare but critical asynchronous beam dumps, increased tolerances can be accepted during short time intervals. Moreover, during the ramp the phase interlock is not yet required by machine protection, due to the large β Ã (as explained in Sec. I and Ref. [5]).

A. Configuration management
To keep the interlock system simple, the interlocking is always applied to the PC currents, since those are the observable quantities. However, to configure the system it is more convenient to work with magnet strengths k (k-level). Therefore, the tolerances are configured on k-level and stored in LSA, from which the PcInterlock takes its settings. Internal mechanisms in LSA (makerules) are used to convert the strength values to currents. LSA is the natural place to perform this transformation, because all required information is already available in the associated settings database: e.g., the magnet transfer-functions that describe the relation between the magnet current and the magnetic field, as well as the beam momentum at a given time. For easier configuration, the computation is based on the following simplifications: (i) Magnet families are defined for which the same tolerances are applied in terms  Table I.
(ii) All phase-advance changes are taken as absolute values, in order to assume the worst cases scenario (phase advance shifts adding up in the same direction) and avoid signconvention problems.

B. Computation procedure
Deviations from the nominal quadrupole strengths sum up to a total phase error in the machine. The effect on the phase advance of an individual current error in the powerconverter is however different for each quadrupole (and thus between the quadrupole families 7 ) and depends on the β-function at the quadrupole and thus on its position in the machine. Therefore, individual reference function and tolerances have to be defined for each family.
For the failure case described here, it is enough to consider the four distinct beam-line segments of the LHC circumference as illustrated in Fig. 1: for each beam, the range from the dump kicker (IP6) to the interaction points IP1 and IP5, respectively. The PcInterlock has to ensure the stability of the phase advance in these four segments.
The generation of the individual tolerances is based on MADX [12][13][14] simulations of the closed-orbit phase and the maximum allowed phase advance change. Individual computations of the phase advance per PC per segment are performed. All PCs are assigned an individual tolerance according to their family and are interlocked individually.

Total phase-advance tolerance
The total budget for the allowed phase-advance deviation over any of the segments shown in Fig. 1, Δμ budget , is based on machine protection considerations and computed in [5]. In 2016, Δμ budget ð2016Þ ¼ 26°ð1Þ was tolerable, while in 2017, with Achromatic Telescopic Squeeze (ATS) optics (see [15] and Sec. VI B), only Δμ budget ð2017Þ ¼ 4°ð2Þ was acceptable. The phase advance was measured and corrected with the ATS optics in 2017, revealing a phase shift of 3°into the direction of increased protection. Using this measurement as a reference, the allowed total phase budget could be relaxed to Δμ budget meas ð2017Þ ¼ 7°: 2. Magnet family tolerances The calculation described here was revised since Ref. [16], where the family responses and the total phase budget are obtained by calculating the linear sums of all families. This describes a situation in which all magnets of all families show a fully correlated error. This is a too pessimistic assumption and not a realistic failure scenario. Most quadrupoles (all except the trim quadrupoles) follow individual, pre-defined functions throughout the accelerator cycle, defined in beam processes, and are never modified by other means (e.g., trim knobs). These functions are carefully evaluated with low intensity beam during the commissioning and kept unchanged for the following operational period.
It can thus be assumed that the phase errors between families are uncorrelated. Therefore, the total phaseadvance budget from above is distributed over the magnet families with the condition that the quadratic sum of the phase-advance budgets, Δμ budget f , per family f ∈ F (F is the set of all defined families), does not exceed Δμ budget :   8 The tolerance generation tool will be introduced below in Sec. IV C. strength, k, by a fixed value (Δk m ¼ 10 −5 m −2 ) and observing the change in phase advance, Δμ s , individually within each beamline segment s ∈ S (S is the set of segments to consider for the tolerance generation): The full set of four segments (two per beam) is defined and schematically illustrated in Fig. 1. (2) The phase errors introduced by magnets belonging to a given family may be assumed to be independent when their currents are changed individually by functions defined in a given beam process only. This is the case for the main, matching section, normal conducting and low-beta triplet quadrupoles. The resulting response for an entire family f is defined as the square root of quadratic sum of its member's absolute phase responses: For the tune trim quadrupoles, the most likely error scenario is a misuse of the tune trim knob, which drives the currents in all trim quadrupoles at the same time. Therefore, for this family the phase errors of individual quadrupoles are correlated and the family response is calculated via the a linear sum: (3) The strength tolerance per family and segment is obtained from the phase advance budget Δμ budget f as: Note that Δμ budget f is an input parameter. It is obtained by the distribution of the total allowed phase budget Δμ budget noted in Sec. IV B 1 over all families according to Eq. (4). The individual Δμ budget f are optimized by the expert, considering necessary margins to protect from unjustified beam dumps based on the results of the analysis presented in Sec. V, while respecting the total allowed Δμ budget . (4) The final family tolerance, k tol f , which will be applied to each magnet in f, is defined by the segment in which the minimum tolerance (maximum phase response) was observed: The generated strength tolerances k tol f have to be converted into current tolerances, I tol , within LSA as explained previously.

Special case: Low beta quadrupoles
Special attention has to be given to the triplet circuits. These circuits consist of three magnets and three powerconverters, using a nested powering scheme as sketched in Fig. 6. All other quadrupoles have a one-to-one relation to their power-converter. The currents through the three triplet quadrupoles (Q1, Q2, Q3) are given by: ð10aÞ The standard rule for the driving current would simply invert these equations and distribute the current to the power-converters as follows: This strategy does not work for the tolerance generation, because, e.g., the tolerance for I RTQX1 would become zero if the calculated tolerances for I Q1 and I Q3 would be equal. Therefore, the following strategy was chosen to calculate the triplet current tolerances:

C. Automation
In order to automate the calculation of the 1435 k tol values (per optic) needed to operate the LHC safely, a new PcInterlock tolerance-generation-tool has been designed. This dedicated software tool drastically reduces the risk of human error and guarantees that the calculation algorithm behaves as expected due to unit testing.
The current implementation is developed in Java as it is the preferred language for interacting with the LHC control system. The LHC model simulations are handled using JMAD [13,14], an integration of MADX [12] into the Java environment. The user can interact with the tool via a command line interface that provides the possibility to specify the following parameters: (i) Δμ budget f with f ∈ F: max budget per family (ii) Δμ budget : max budget allowed (iii) S: the LHC segments to consider (iv) optic to be used in the calculations (v) JMAD, i.e., LHC, model The tolerance-generation-tool output consists of the k tol f value for each magnet family, with the option to save the corresponding k tol of each magnet of the given family in LSA. This operation has to be done for every new optic, generally at the beginning of the LHC yearly run. LSA is the junction point between the offline tool and the interlocking system: the offline PcInterlock tolerance-generation-tool calculates the power converters tolerances, k tol , and the online PcInterlock will use them for interlock evaluation (Fig. 3).

V. QUADRUPOLE CURRENT DISTRIBUTION IN PHYSICS
The previous chapter focused solely on the machine protection aspects. But it must be taken into account that if tolerances would be set too tight, the machine availability could be compromised. In this case, the risk of false dumps, due to, e.g., fluctuations of the magnet currents, would be increased. To avoid such situations, this chapter describes a detailed analysis on the data of quadrupole currents for the years 2015 to 2017, where the physics operation periods (so-called stable beams) of all fills with equivalent optics configuration are taken into account. The quadrupoles responsible for online adjustments of the tune, the socalled tune trim quadrupoles, frequently change their current during all periods of the LHC cycle to keep the tune at its reference value. Those are treated separately from the other circuits, which follow preprogrammed current functions.

A. Main, matching, normal conducting and low-beta quadrupoles
Normally, the current of the main and normal conducting (warm) quadrupoles is only changed during the energy ramp, while the current of the triplets and matching quadrupoles also changes during the β Ã -squeeze. 9 As was already mentioned, the currents of these magnet families are set by preprogrammed functions, describing the settings during the different periods of the LHC cycle. For a given machine configuration, those magnets therefore always carry the same current at a certain moment in the cycle. Especially during physics conditions the machine settings, and thus the magnet currents, are constant.
For the following analysis, the measured currents, I meas , of all power-converters in these families were extracted from the logging database (LDB) in 1 min intervals, repeating the previous data point if no data was available for the given period. Only data during physics operation periods (stable beams) was taken into account. The analysis of this data confirms that the absolute current value of those magnets is always the same within the measurement accuracy of for the main, matching and warm quadrupoles and for the triplets. For most of the triplet magnets an accuracy similar to the other families is found, however one powerconverter in IP5 (RQTX2.L5) shows a higher fluctuation rate, 10 which therefore defines a higher tolerance for all triplet magnets. In order to avoid undesired dumps due to current fluctuation, we decided to include a margin of a factor 3 on the tolerance band for those magnet families. The lower tolerance limit imposed by current stability is therefore (rounded):

B. Tune trim quadrupoles
The tune trim quadrupoles [power-converter names are RQTF (focusing) and RQTD (defocusing)] are used to adjust the tune during the cycle. Whenever the tune needs correction, the strength of those quadrupoles is changed. Their absolute current at a certain stage of the cycle 9 For operation at β Ã ¼ 40 cm with the nominal optics in 2016 some of the main quadrupole circuits around IP1 and IP5 had to be changed during the squeeze to support the matching quadrupoles in order to reach the target β Ã . With the ATS optics used since 2017, this adjustment of the main quadrupoles during the squeeze was not necessary anymore. 10 Data from 2016 and 2017 has been analyzed. In both years the fluctuation rate for this PC was increased. depends on the corrections made up to that point and might thus be different from one fill to the next. Figure 7 shows a snapshot of the RQTF and RQTD circuit currents at the moment when stable beams were declared as a function of the fill number over the years 2015-2017. The operational reference current, I ref , of each PC was used as normalization value. This reference current is the calculated current the PC should operate on. It is set during the commissioning of the given optics in the beginning of each run and it is used as the reference for the PcInterlock. The eight LHC sectors are shown in color code, but due to their similarity they lie on top of each other.
A clear variation of the current is visible from fill to fill, where the current differences between the measured and the reference value reach up to ΔI ≈ AE3A, which corresponds to a tune change of about ΔQ ≈ 0.002. This number only includes fill to fill variations of the start current in physics. Normally, the tune feedback is switched off during this period, however, occasionally tune corrections are performed, leading to current variations in the RQTs, which have to be taken into account to define the lower tolerance limit. The histograms displayed in Fig. 8 summarize the current distributions of all RQT circuits over the stable beams periods in 2015 (top), 2016 (middle), and 2017 (bottom). Data points of each circuit (RQTFs and RQTDs) were taken every minute during physics operation, normalized to the corresponding reference current and filled in the histograms. In this way, the widths of the distributions provide an estimate of the total current spread observed in physics, including the current variations between fills and over time in one fill.
The bulk of the 2015 distribution is slightly smaller than for 2016. Nevertheless, in 2015 more frequent larger trims up to ΔI ≈ AE3 A were applied, while in 2016 all data points are within a boundary of ΔI < AE2 A. In 2017 the variation between the families is bigger, as can also be seen from Fig. 7, such that trims up to ΔI < AE4 A occurred. The most extreme outliers of these distributions define the absolute lower limit for the tolerance band width: This width covers the variations of the initial currents, thus the trim history through the cycle, and the tune corrections in collisions. Nonetheless, a tolerance of this width is considered very tight and could cause undesired dumps when, e.g., tune corrections on top of a large initial current offset are necessary. The current variations of the RQTs are dominated by desired changes (and not by FIG. 7. Fill to fill differences in the current of the RQTF (top) and RQTD (bottom) circuits at the start of stable beams. Left: Beam 1, right: Beam 2, the different sectors are shown in color code, but due to their similarity for each family they lie on top of each other. statistical measurement fluctuations), which are observed to be of similar amount over three years of operation. Therefore, it should be sufficient to include a margin of a factor 2 with respect to Eq. (17). This limits the RQT tolerance band to This corresponds to ΔQ ≈ 0.0056 in tune units with respect to the reference function.

A. Operational settings in 2016
With the beginning of the 2016 proton operation the minimum β Ã was reduced to 40 cm in IP1 and IP5. In order to provide sufficient protection for the TCTs around these experiments, the last optics point at β Ã ¼ 40 cm was rematched to have more phase margin [5,10]. The phase advance difference between the MKD and the TCTs in IP1 and IP5 could be optimized to be around 4°. With this adjustment the maximum phase shift allowed was [5] Δμ budget ¼ 26°: To obtain the PcInterlock settings for the quadrupoles, this amount was distributed over the magnet families as noted in Table II. The corresponding strength and current tolerances and the lower tolerance limits defined by the observed current fluctuations during physics operation, as discussed in Sec. V, are listed. According to Eq. (4) only Δμ budget ¼ 6.3°out of the allowed 26°were used. Nevertheless, from Table II it becomes clear that the tolerance settings for all families were still relaxed in 2016 compared to the required minimum defined by the current fluctuations and tune trims. From a machine protection point of view, the phase interlock is not yet necessary for β Ã ¼ 40 cm [5]. The interlock was therefore not active during the first month of its operation, but potential interlock triggers were registered to gain experience with its functionality and tolerance settings.

B. Operational settings in 2017 (ATS Optics)
For the machine restart in 2017, the LHC was commissioned with the new achromatic telescopic squeeze (ATS) optics configuration [15]. Compared to the nominal optics configuration, the ATS enables the operation with smaller β Ã while keeping the chromatic properties of the lattice under control. Its main new feature is the use of the matching quadrupoles of the neighboring straight sections to support the ones in the minimum-β IPs.
Physics operation started at β Ã ¼ 40 cm, similarly to 2016, but with a new optics configuration, preparing for the ATS, but not yet using the support of the matching quadrupoles from the neighboring interaction regions. In September β Ã was lowered to 30 cm, introducing a short Achromatic Telescopic Squeeze segment [15]. The phase advances between the MKD and the TCTs are negatively affected by this optics change. With the ATS optics the initial phase difference is already about 26°, implying that the phase is only allowed to drift by Δμ budget ¼ 4°before the protection of the TCTs and triplets is compromised (see Sec. IV B 1).
Tables III and IV show the tolerance settings used in 2017 for the two optics configurations. The tolerances were tighter than in 2016, but still comfortably relaxed with respect to the fluctuation minimum in order to gain experience with the active interlock.
Knowing that the current of all families, except the trim quadrupoles, will never be changed by any knob, beam process or operator in physics operation, their limits are set to be around I tol ¼ 0.5 A still leaving some margin with respect to the observed fluctuation limits. If their currents change for any reason the beams need to be dumped for protection. The trim quadrupoles are assigned the largest fraction of the available total phase budget, because they have the largest uncertainty on their currents. The total phase budget of these settings calculates to Δμ budget ¼ 5.2°, which slightly exceeds the value given in Eq. (2). This was allowed because a phase advance measurement and correction revealed a phase shift in the good direction with which the safe phase budget was considered to be Δμ budget meas ¼ 7°, as described in Sec. IV B 1.
C. Operational settings in 2018 (ATS optics and β Ã -leveling) In 2016 and 2017 the optics interlock worked reliably and did not cause any unjustified beam dump. With this experience the settings could be optimized for 2018 and the tolerances for the tune trim quadrupoles were further TABLE II. PcInterlock tolerances, k tol f and I tol , on quadrupole strength and currents operationally used in 2016 with β Ã ¼ 40 cm and Δμ budget ¼ 6.3°. The limits obtained from current fluctuation measurement, I tol meas , and the applied phase margin per family, Δμ budget f , are given. Note that even though all magnets of one family have by definition the same tolerances on their strength k, they do not all have the same k-to-I transfer functions. Therefore, I tol can be different for magnets of the same family, which is the case for the triplets, matching and warm quadrupoles. The I tol values of those magnet families are given as ranges between the minimum and maximum used current. For comparison also the range of operational reference current, I Ref , for the magnets within the family is listed.  tightened (see Table IV). That reduced the total phase budget to Δμ budget ¼ 3.4°, no longer relying on the relaxed budget of the measured phase advance, but comfortably respecting the calculated limit given in Eq. (2). While the nominal β Ã ¼ 30 cm optics configuration is the same as in 2017, with the restart in 2018 β Ã -leveling has been commissioned and operationally used for the first time. For this leveling method, β Ã is reduced subsequently when the luminosity has decayed with colliding beams. In the 2018 set-up two β Ã -leveling steps from 30 cm via 27 cm to 25 cm were implemented.

Quadrupole families
Since the procedure is the same as during the squeeze, the precautions described in Sec. III have to be applied for tight tolerance settings. Just after starting a leveling step, the tolerances of the matching quadrupole family have to be opened to account for timing delays between the measured and programmed currents. Just before all quadrupoles reach their final (low β Ã ) current value, the tolerances need to be closed again. With the currently still rather relaxed tolerances, the margins are large enough to cover this issue. If tighter settings are used in the future, this procedure should be programmed into the beam process to be automatically applied for each levelling step.
The tolerance settings used at β Ã < 30 cm apply the same phase budgets as given in Table IV, however the calculated tolerances are about 10-20% tighter at β Ã ¼ 25 cm.

VII. CONCLUSION AND OUTLOOK
The PcInterlock was successfully extended to provide interlocks on all LHC quadrupoles. The implementation is completed and the software is running since spring 2016. To test its functionality and to avoid undesired dumps due to wrongly calculated settings, the Software Interlock System (SIS) channel was masked (deactivated) until 9 August 2016 such that triggered interlocks are registered but not sent to the beam dump system. Since this date, the software is operationally active and connected to the beam dump system. In 2016 the tolerance settings were very relaxed and no interlocks occurred during physics. Only during machine development (MD) sessions several interlocks were correctly triggered.
With the ATS optics in 2017, the tolerance settings were tightened to comply with the reduced phase margin in this machine configuration. A total phase budget of Δμ budget ¼ 5.2°was used in 2017 and reduced to Δμ budget ¼ 3.4°in 2018, still providing comfortable tolerance settings when compared to the observed current variations. In whole LHC Run 2 (2015-2018) the PcInterlock triggered in total (orbit correctors and quadrupoles) 12 beam dumps at various stages in the cycle. Five were caused by communication or data subscription timeout and six by not updated settings during MDs or commissioning. In one case it caught a current oscillation of a quadrupole PC that exceeded the tolerance during physics operation.
Until now, margins can be chosen comfortably, while still being in agreement with the total allowed phase budget. If in the future tighter tolerances would be required, the general I tol ¼ 0.5 A could be further closed to exploit the current fluctuation limit. The triplets are assigned a larger phase budget as the other families with a preprogrammed current cycle, because their effect on the phase advance is large due to the high β-function at their positions. The used values are still a factor 2 above their fluctuation limit and could thus be optimized.