Until Now…
Operations and Safety Envelope assume worst case beam energy simultaneously to all Halls
Envelope controlled by limiting beam current - not power
Ops envelope now ~20 % below capability of dump cooling
Excursion beyond setpoint trips off machine in microseconds