Outcome of BI.DIS Fast Interlocks Peer Review Etienne Carlier TCM 29-11-2016

Review Objectives Validation of required functionalities Performance evaluation of the solution under test in 867 Decision on the strategy for final deployment https://indico.cern.ch/event/580138/

Two separate trigger signals Avoid overshoot on IGBT during switching Control unbalanced signal on IGBT during switching Improve energy recovery mechanism  Fine synchronization (ON & OFF) between triggers required

Fast Interlocking Functionalities Detection Internal failures in the pulse generator Internal failures in the triggering chain Protection (failures dependent) Re-triggering Triggers Inhibition Interlocking Slow (State) Fast (BIS + DCPS) Monitoring PM analysis Statistics

Parameters to be analysed and cross-checked Trig1 Trig2

Detection Short-circuit between IGBTs and Magnet (I2, I3) No current in Magnet (I3, due to missing shot, PFN not charged…) Pulse length not correct (I2, I3) Voltage balance on each switch (V1, V2, V3) No output current from assembly (I2) Faulty shot: missing or erratic shot (I2, I3) Freewheel diode: No current (Ishunt) Recovery diode: No current (I1) PFN voltage not in range before pulsing Triggering chain supervision: Faulty switch ON / Faulty switch OFF IGBT driver status

Protection Re-trigger in case of Inhibition in case of Missing trigger (according to trigger sequence) Erratic trigger Incorrect voltage balancing between IGBT during turn-on or turn-off Inhibition in case of Missing trigger (according to trigger sequence) Turn-off trigger before zero crossing Substraction |Vce1-Vce2| should be close to zero during switching. Some admissible unbalancing (Normal, Admissible, Warning, Fault).

Typical state machine for surveillance of 1 parameter

Configurability Different set of settings Different type of settings For each PFN (PFN lengths) For each switch (IGBT pairing) For interlock thresholds (PPM operation) Different type of settings Operational / Configuration Dynamic / Static Hardware dependent / independent IGBT cassette change Not 1 to 1 compatible Set of settings to be adapted in FIS (…and in KiTS)

Functional Requirements Functional specification available for BI.DIS fast interlocking logic https://edms.cern.ch/document/1537992/0.3 Engineering specification in preparation Configuration strategy to be clarified... Some programmable thresholds inside the system to be dynamically managed Necessity to detect faulty reverse current in diode to be further investigated.  Failure of the freewheel diode detected by the interlock checking the presence of current in the magnet Correlation between signals, interlocks, failure modes and actions to be clarified. A summary table has to be produced for a clear overview of the system.

Implementation for 867 test bench Configuration settings to be defined and categorised. Configuration of variable interlock thresholds for PPM operation to be reassessed. Interlocking vs. surveillance functionalities to be clearly differenced. To be added in summary table. Voltage balancing interlock seems to be the more complex and critical part of the system. Complexity of actual implementation to be reviewed Sensors range to be individually adjusted through attenuators. Strategy for long term management of attenuator to be defined. Homogenisation at sensor level seems not possible. To be summarised in an adequate document (sensors, ratio, attenuation). Required reaction time for each interlock up to BIS to be estimated and included in summary table. 

Outcome of ongoing test in 867 Each interlock individually tested. No major problem encountered w.r.t. requirements. Required functionalities well defined. Test protocol to be provided for validation of each interlocking functionalities System boot-strapping and revalidation after TS and LS. Can it be automated? Protocol shall not rely on internal modification of embedded software. Can-it be done through modification of some thresholds? Strategy to re-set operational thresholds afterwards to be defined. Implementation of PFN voltage surveillance (measured vs. demanded) under progress (new requirements). Is-it the right place to do it or can-it be done by an external BETS?

Status FASEC option for BI.DIS No missing functionalities identified in the FIDS w.r.t. requirements and current FIS implementation. Interface for DCPS HV inhibition needs clarification (signal type, levels...) Control of IGBT turn OFF in the FIDS. Only possible at zero crossing. Is-this possible for test in 867 available. Test of both systems (FIS & FIDS)  in // in 867 seems feasible. Test of FIDS on 865 BI.DIS test bench to be added in the project planning. 865 BI.DIS FIS test bench to be extended for use and validation of FIDS. Missing functionalities to be identified and added….

Control Integration Cross-communication strategy for availability of all information at low-level to be addressed Avoid to rely on FESA for operation of a system with interlocking functionalities. Settings / thresholds management strategy to be clarified. Interlocking logic should not be PPM dependant… Software layers homogenisation up to hardware abstraction layer. Try to reduce software development effort at the upper layers.

Summary Working prototype under test and successfully validated in 867 BI.DIS test stand Functional requirements captured and well documented More complex than anticipated Gain of snubber circuit not obvious at the interlock (and triggerings) level Dynamic configuration of the interlocking logic to be carefully analysed Full RAMS analysis to be performed??? Protection vs. complexity Deployment in FIDS to be validated Enhance 865 test bench as required Uniform approach for Fast Interlocking System