B. Todd et al. 25 th August 2009 Observations Since v1

Observations Since of 15 Beam Interlock System Locations Designed to protect CERN high energy accelerators = SPS / LHC / INJ / EXT

Observations Since of 15 Beam Interlock System Locations Designed to protect CERN high energy accelerators = SPS / LHC / INJ / EXT In LHC = 17 x 2 Beam Interlock Controllers 188 individual connections

Observations Since of 15 Machine Protection System

Observations Since of 15 Operational Figures so far… LHC system used throughout CERN for > 2 years -Feedback into production and upgrades already TRACOPOWER Pessimistic figure 217F Both failures due to Non-conforming installation Monitor weakness Identified in 2007 = New PCB design 2008 Not enough data yet… One double blind failure during commissioning – next presentation – many revised specifications to ensure conforming installations for this year – 2005 onwards = system running in SPS and EXT onwards = LHC system running in LHC and INJ

Observations Since of 15 The Effect of Programmable Logic Non-critical = DIFFERENT device and circuits ≈90000 components in BIS Critical = small & simple as possible FMECA = GOOD for discrete NO GOOD for FIRMWARE!  More systems than ever are using FPGA… We must prepare…

Observations Since of 15 Online Testing and Checking 1.BIS Pre Operational Testing a) Static Checks Hardware ID numbers Enabled / Disabled Channels Power Supply Redundancy Software Servers b) Dynamic Checks 100% Coverage Internal Test Mode External Test with Users History Buffer Time alignment Safe Beam Flag Reception Post-Mortem Trigger Check Hardware Statuses All OK? Check Hardware Configuration Check Time Alignment Stand Alone Tests Global Tests Rearm System Yes No Intervention Next Slide

Observations Since of 15 Online Testing and Checking 2. Diagnosis and Monitoring Hardware ID numbers Enabled / Disabled Channels Power Supply Redundancy Software Servers Glitch Counters Frequency Measurements 3. Post Operational Checks who started the dump – which user? Or was the BIC responsible? Internal Fault? Redundancy compromised? Time delays respected? Beam Dump Online Monitoring Diagnosis Non-critical failures = schedule maintenance Critical failures = BIS hardware forces False dump No Yes Post Operational Check Post-Mortem Validation All OK? 4. Post Mortem Checks the whole MPS works correctly No Intervention Back to pre-op checks Previous Slide Yes

Observations Since of 15 Testing with ‘A’ and ‘B’

Observations Since of 15 Testing with ‘A’ and ‘B’

Observations Since of 15 Testing with ‘A’ and ‘B’ User System to User Interface TEST in the same way

Observations Since of 15 Beam Interlock System Concerns Optical – CIBO / CIBOA / CIBOB / CIBL Availability of the ELED technology DC – 10MHz not in keeping with commercial technology Design Basis – CIBF User Systems installed >1200m from controller require fibre device (CIBF) not much experience with this Radiation Effects Newer simulations show much higher radiation than expected in certain areas Very difficult to mitigate, ongoing work Xilinx CPLDs Our inside man at Xilinx gave us a warning regarding Discontinuation… Requires a deep re-design VHDL More systems than ever use this… We have to be sure we’re on the right lines with the safety

Observations Since of 15 FIN