BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 1/15 Reliability of Beam Loss Monitors System for the Large Hadron Collider

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 2/15 LHC Superconductive Magnets In LHC there are: 514 main quadrupoles (MQ), 1232 main dipoles (MD). Favorite loss location: quadrupole and transitions. We will monitor only the MQ (and some other critical locations). If losses exceed a threshold, a dump signal is generated. RF Cleaning section Proton injection Dump Cleaning section Proton injection

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 3/15 SIL approach Safety Integrity Levels (IEC 61508): our guideline for LHC protection systems. Events definition Event gravity Event frequency Suggested system failure rate Expected (LHC) system failure rate Faced risk Magnet Destruction False Dump Substitution downtime Recovering downtime Dangerous losses/y False dump/y Suggested/Tolerable failure rates Unavailability of protection system Failure rate frequency Destruct magnets/y False dumps/y

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 4/15 Events Definition Prevent superconductive magnet destruction (MaDe) due to an high loss (~30 downtime days for substitution). Avoid false dumps (FaDu) ( ~3 downtime hours to recover previous beam status). System fault events

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 5/15 Frequency TABLE 1). Frequency table used for LHC risk definition. CategoryDescriptionIndicative frequency level (per year) FrequentEvents which are very likely to occur > 1 ProbableEvents that are likely to occur OccasionalEvents which are possible and expected to occur – RemoteEvents which are possible but not expected to occur – ImprobableEvents which are unlikely to occur – Negligible / Not credibleEvents which are extremely unlikely to occur < 10 -4

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 6/15 Gravity TABLE 1). Gravity table used for LHC risk definition. CategoryInjury to personnelDamage to equipment CriteriaN. fatalities (indicative) CHF LossDowntime CatastrophicEvents capable of resulting in multiple fatalities 11> 5*10 7 > 6 months MajorEvents capable of resulting in a fatality 0.1 (or 1 over 10 accidents) 10 6 – 5* days to 6 months SevereEvents which may lead to serious, but not fatal, injury 0.01 (or 1 over 100 accidents) 10 5 – to 20 days Minor Events which may lead to minor injuries (or 1 over 1000 accidents) 0 – 10 5 < 3 days

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 7/15 SIL levels Event LikelihoodConsequence Catas- trophic MajorSevereMinor FrequentSIL 4SIL 3 SIL 2 ProbableSIL 3 SIL 2 OccasionalSIL 3 SIL 2SIL 1 RemoteSIL 3SIL 2 SIL 1 ImprobableSIL 3SIL 2SIL 1 Negligible / Not CredibleSIL 2SIL 1 SILProbability of a dangerous failure per hour < Pr < < Pr < < Pr < < Pr < For high demand / continuous mode of operation systems

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 8/15 LHC Systems MaDe Loss Duration <10ms >10s middle FaDu Resistive magnets Lifetime RF Beam position Access Timing Experiments Collimation Vacuum Dump Beam Energy Interlocks Cryogenics Quench protection Beam Loss 4 first line systems: average 2.5E-8/h ~20 dump generator systems: average 5E-8/h Power converter

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 9/15 BLMS Current to frequency converter Multi- plexer LASER Diode Demulti- plexer Threshold comparator BIC (Dump) Beam Permit Beam Energy VME Bus Analogue ElectronicsDigital Electronics Below Quad. in ARC Ionization chamber At surface (SR, SX) Switch I in (t) Reference current Treshold comparator One-shot  T I ref Integrator f out 7 TeV 450 GeV

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 10/15 Availability improvements Test (continuously, 20 hours and yearly) of detector and analog electronic, to face integral dose degradation; voting for digital part, to avoid single event effects. Actions against the weakest elements (lasers, CRC, decisions table,…):redundancy.

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 11/15 Failure Rates Element Failure rate  [ /h] Inspection interval [h] Notes SingleNot redundantRedundant IC+cable+terminations Experience SPS Integrator2.0 Continuous (40  s) Dose and fluence tested Switch8.7 FPGA TX* Laser510 2 Optical connectors20 Optical fibre20 Photodiode3.2 FPGA RX*70 Reference:MIL-HDBK-217F IC calculated with 60% confidence level of no fails over 140 IC in 30 years in SPS

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 12/15 Component failure rate predictions. Assembly failure mode. System dependability. References: MIL-217 (electronic), Telcordia (telecommunication), IEC (electronic), NSWC (mechanical) Failure Mode Effect and Criticality Analysis Reliability Block Diagram Fault Tree Software possibilities Front end electronic Monitor Surface electronic Dump electronic Laser line 1 Laser line 2 Dump line 1 Dump line 2 Dump line 3 2 System failure FPGA TX FPGA RX Com- biner 2oo3 IC Beam interlock DUMP

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 13/ IC JFET1JFET2 OPA1OPA2 LASER1LASER2 Relative importance Software outputs Time profiles Importance diagram Unreliability 40  s80  s 20 h40 h Unavailability, failure rate,…

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 14/15 Results FaDu ( no Power Supply ): /h * 4000 h/y * 3200 = 3/y Foreseen event frequency: “Focused” dangerous losses per years: pessimistic! Number of channels Beam hours: 200 d*20 h/d We are beyond the Functional limits, but tolerable for Malfunction approach: good confidence that in 20 year we will lose (less than) the 16 spares magnets and BLMS generate around 3 false dump per year. SIL suggested rate: /h SIL suggested rate: /h /h * 4000 h/y * 100 = 0.2/yMaDe (single channel):

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 15/15 Conclusions 1.Probable multi-detection per loss (further simulations on going): MaDe OK. 2.FaDu improving with better electronic components (and better power distribution). 3.The systematic reliability approach guide the BLMS design (redundancies, testing, sensitivity evaluations).

BIW May 2004 LHCSILSystemsBLMSSoftwareResults Reliability of BLMS for the LHC. G.Guaglio, B Dehning, C. Santoni 16/15 Questions? Don’t shoot the messenger.