0v1

CIBM – Controls Interlocks Beam Manager CIBM – Matrix CPLD CIBM – Controls Interlocks Beam Manager CIBM Beam-1 x6 CIBM Beam-2 x8 x6 CERN, the LHC and Machine Protection

CIBM – Matrix CPLD CIBM – Controls Interlocks Beam Manager Critical Function Perform local ‘AND’ to make a LOCAL_BEAM_PERMIT from all USER_PERMITs Filter each USER_PERMIT to remove glitches Apply DISABLE jumpers to switch off unused channels Allow MASKABLE inputs to be ignored if SAFE_BEAM_FLAG is TRUE Everything duplicated Critical is in a different device to Non-Critical CERN, the LHC and Machine Protection

Block Diagram CERN, the LHC and Machine Protection

Block Diagram Hardware MATRIX = 9500XL Complex Programmable Logic Device (CPLD) Hardware Description Language (VHDL) S3 1000 FPGA Coolrunner 2 CPLD XC95144XL CPLD XC95144XL CPLD CERN, the LHC and Machine Protection

Block Diagram LOOP_OUT = LOOP_IN when LOCAL_PERMIT is TRUE LOCAL_PERMIT_A 14 LOOP_A_OUT USER_PERMIT_A LOOP_A_IN 14 LOOP_B_OUT USER_PERMIT_B LOOP_B_IN LOCAL_PERMIT_B LOOP_OUT = LOOP_IN when LOCAL_PERMIT is TRUE If LOOP_OUT is CORRECT FREQUENCY then BEAM_PERMIT = TRUE CERN, the LHC and Machine Protection

Block Diagram Focus of this talk CERN, the LHC and Machine Protection

Orange = Critical Signals Green = Non-Critical Signals IO Signals Orange = Critical Signals Green = Non-Critical Signals CERN, the LHC and Machine Protection

The Fail-Safe Principle Electrical Characteristics - See section 18 Too detailed to present everything now - basic premise is always as follows: Fast, Dependable Transmission CERN, the LHC and Machine Protection

The Fail-Safe Principle Electrical Characteristics - See section 18 Too detailed to present everything now - basic premise is always as follows: CERN, the LHC and Machine Protection

The Fail-Safe Principle Electrical Characteristics - See section 18 Too detailed to present everything now - basic premise is always as follows: CERN, the LHC and Machine Protection

The Fail-Safe Principle Electrical Characteristics - See section 18 Too detailed to present everything now - basic premise is always as follows: CERN, the LHC and Machine Protection

The Fail-Safe Principle At Destination: if (*FLAG = 0 AND FLAG_FAULT = 0) then FLAG = TRUE MAX3440 = fail-safe transceiver, narrow window for USER_PERMIT = TRUE CERN, the LHC and Machine Protection

The Fail-Safe Principle We always use two links. Using two separate hardware paths A B We can safely test this by setting ‘A’ TRUE and ‘B’ FALSE and vice-versa CERN, the LHC and Machine Protection

Inside the Matrix CPLD A very simple code…. A CPLD 288 macrocell is equivalent to 288 registers, with 288 look-up tables ALL INPUTS corrected for polarity before used internally Whole of Thursday dedicated to explaining this code in detail CERN, the LHC and Machine Protection

Inside the Matrix CPLD CERN, the LHC and Machine Protection

DISABLE CERN, the LHC and Machine Protection

Inside the Matrix CPLD CERN, the LHC and Machine Protection

Only half of the inputs can be masked CERN, the LHC and Machine Protection

Inside the Matrix CPLD CERN, the LHC and Machine Protection

Probably the most critical code in the matrix. FILTER Probably the most critical code in the matrix. Perpetual filtering is possible if there is noise = counters monitored, logged and alarmed CERN, the LHC and Machine Protection

Inside the Matrix CPLD CERN, the LHC and Machine Protection

MATRIX Generally: if INPUT (14->1) = TRUE AND SOFTWARE = TRUE then LOCAL_BEAM_PERMIT = TRUE LATCH_INIT must be pulsed after the device is powered LATCH_ENABLE is TRUE in LHC - So after every TRUE -> FALSE trigger, LATCH_REARM must be pulsed CERN, the LHC and Machine Protection

Inside the Matrix CPLD CERN, the LHC and Machine Protection

If LOCAL_BEAM_PERMIT = TRUE then OUT = IN SWITCH If LOCAL_BEAM_PERMIT = TRUE then OUT = IN CERN, the LHC and Machine Protection

Monitoring The FPGA in the CIBM contains extensive monitoring: 8000 record history buffer, accurate to 1us Integrity analysis for Beam Permit Loops Glitch Counters More in demonstration day Thursday CERN, the LHC and Machine Protection

CRITICAL Matrix Verification 1/2 Complete, exhaustive VHDL simulation Two different engineers wrote code (A vs B) Three different engineers tested it Code coverage 100% on critical signals BEAM_PERMIT_INFO – One Impossible combination – Not critical CERN, the LHC and Machine Protection

CRITICAL Matrix Verification 2/2 Complete, exhaustive Hardware test-bench - 100% of critical signals 4 hours to test everything at ~100k combinations per second Rear View Front View Top-Down verification of the Matrix function CERN, the LHC and Machine Protection

CRITICAL Matrix Verification 2/2 Complete, exhaustive Hardware test-bench - 100% of critical signals 4 hours to test everything at ~100k combinations per second Rear View Front View After installation – we test critical paths online using ‘A’ ‘B’ test mode end to end … CERN, the LHC and Machine Protection

FIN CERN, the LHC and Machine Protection