B. Todd on behalf of TE/MPE/MI 25 th May 2009 Beam Interlock System Changes Following 2006 Audit 1v0

Review of Reviews June of Audit Recommendations -Actions 1. Beam Interlock System -Reminder 3. Conclusions -Summary Table -Future Plans Contents

Review of Reviews June of Audit Recommendations -Actions 1. Beam Interlock System -Reminder 3. Conclusions -Summary Table -Future Plans

Review of Reviews June of 29 LHC Function BIS Both-Beam Beam-1 Beam-2 ~200 connections to User Systems distributed over 28kms LHC has 2 Beams Some User Systems give simultaneous permit Others give independent permit

Review of Reviews June of 29 Signals

Review of Reviews June of Audit Recommendations -Actions 1. Beam Interlock System -Reminder 3. Conclusions -Summary Table -Future Plans Audit 2006

Review of Reviews June of Audit Scope Normal points in normal font Major points in bold font Done / Being Done = implemented changes Not Done = haven’t implemented changes yet Not Done = not going to implemented these changes Audit format: 6 auditers 1 day of presentations + 4 days ‘open-house’ Auditors raised 40 points, of which 22 = Major

Review of Reviews June of 29 Documentation 1.A consistent set of up-to-date and finalised documents should be provided. 2. Following PhD completion: all information relevant for the project to be retrieved 3.A full listing of all pending design aspects should be provided. EDMS – all being progressively updated Electronics Designs: Documentation and Test Results: All information is available as above and on the network drive: G:\Departments\AB\Projects\beaminterlocks\BTodd\INTERLOCK_PROJECTS The two pending designs have been documented on EDMS Fibre Extended User Interface : Frequency Generator : Done / Being Done Done

Review of Reviews June of 29 Electronics and PCB Layout 4.Beam Permit Loop Frequencies should be more separated than 8 and 8.125MHz. 5.Power filters to 230V mains should be added in order to protect against power spikes. 6.Oscillation of USER_PERMIT … might create a continuous BEAM_PERMIT signal with a frequency above 300 kHz. This should be investigated. Permit Loop A is now MHz Permit Loop B is now MHz Derived by integer division from a custom oscillator Controller = AB systematically added filters for VME where needed User Interface = filtered by Schaffner FN , SCEM RS485 Slew Rate Limited to 250kHz… Glitch count values = DIAgnosis and MONitoring software Done

Review of Reviews June of 29 Electronics and PCB Layout 8.Since 5×20mm fuses do not have the capability to cut AC high short circuit currents, it must be ensured that the maximum short circuit current of the AC network is below the short circuit capability of the CIBU. 9. The use of the current 10µF 10V 1206 X5R capacitors in the CIBO should be checked Choice of Components 7.In the optical transceiver electronics (CIBO), the two time constants and the Schmitt trigger threshold should be well understood and — if necessary — adapted in order to obtain the desired functionality. PSPICE simulations Complete dedicated hardware testbench = optimum performance for Optical Transceiver 250V 400mA Slow-Blow, CERN , Schurter ~1500A current before arcing, mains = 16A? Changed to 1uF Done

Review of Reviews June of 29 Choice of Components 10.Some PI filters use ceramic capacitors and SMD inductors. Verify that no high-frequency over-shoots arrive at startup. Check the power supply decoupling of the opto-transmitter and the receiver. 11. The redundant power supplies are decoupled from each other by the usage of Schottky diodes. Verify these diodes are covered in the FMEC analysis. 12.The bidirectional transil suppressor with reference “SMBJ15CA” from Fairchild was used for the QPS electronics and on LHC power converters but found to be of bad quality. Complete dedicated hardware testbench 5V filtering is acceptable 0V in older VME chassis is poor = Optical Transceiver Variant B as a contingency (CIBOB) These are included used SM6T33CA from ST Microelectronics Done

Review of Reviews June of 29 The Optical Link 13.During the live presentation, the BIS encountered a severe denial-of-service due to spurious signals on the optical fiber link, identify and mitigate the cause. 14.The availability of the “old-fashioned” ELED seems to present a potential problem. Investigate alternatives. 15.For the hardwired SPS and LHC interlock signals used by the operators in the CCC, the CIBU – BIC cable exceeds the RS422 maximum distance. Mitigate this. 0V in older VME chassis is poor = Optical Transceiver Variant B as a contingency (CIBOB) History Buffer is more robust Frequency Detectors are more precise 2006 letter from Laser Components = at least 5 more years of ELED = 2011 Optical Transceiver Variant A uses a laser as a contingency (CIBOA) 17 th Controller is in the CERN Control Centre Done

Review of Reviews June of 29 Testing & Commissioning 16.Electrical tests of all PCBs should be conducted 17. Currently power soak tests are conducted for about one hour. The test duration should be justified and potentially adjusted. 18.A Walkie-Talkie-type / RF susceptibility test should be conducted after installation. Every board has a dedicated hardware tester After manufacturing = Test After goods reception at CERN = Test These were increased to 8-12 hours Longest we could manage for reception in time for commissioning Not done Done In parallel with #33 = this year

Review of Reviews June of 29 Electromagnetic Compatibility 19.The conductivity of the unit’s enclosure and the earth connection of the rack should be tested after installation. 20.It has to be made sure that all cables use 360 degree shielding on BURNDY connectors. 21.Failure modes and corresponding mitigations for a local oscillator failure on the Xilinx CPLD should be checked. Done/Being Done Done Ring oscillator not good for CPLD Oscillator frequency is monitored and alarmed through DIAgnosis and MONitoring software Done Samples are <0.2 Ohms – full test this year

Review of Reviews June of 29 VHDL Coding 22. Review the VHDL Code when the final version of the CIBM is ready 23. Document the code, and store it in a repository such as CVS. Mechanics 24. Take measures to fix the 220V cables into the power supplies using locks or screws Only concerned with critical function Almost 100% code coverage in simulation 100% coverage hardware tester Designed by two engineers Tested by an independent third engineer External review planned for this year Code is completely documented: SVF is being implemented for all MI projects decided against changes risk of accidental release in racks very small. Already redundant Very expensive to implement the changes Done / Being Done Not Done

Review of Reviews June of 29 Mechanics 25. Labelling or keying should be added to VME slots to avoid problems during maintenance. Cabling 26. Use the latest version of the cabling guide written by Yves Thurel. Radiation and Magnetic Fields 27. The radiation tolerance of the User Interface should be determined. Completely labelled Keys = BIS v2? Done

Review of Reviews June of 29 Radiation and Magnetic Fields 28. The magnetic field tolerance of the User Interface should be determined. 29. A similar audit to this should be conducted for the Beam Dump electronics 30. The Fast Inhibit Board should be considered as part of the Beam Interlock System Failure Modes, Effects and Criticality Analysis. Interface to the LBDS Delegated to Machine Protection Working Group External review planned for this year Not done

Review of Reviews June of 29 Interfaces to User Systems 31.The major User Systems should be audited. 32.User Systems must be made aware of the impact of their designs on the safety of LHC, for example, bad cabling can result in blind failures. 33.The interconnection between User Systems and the Beam Interlock System should be tested using a Walkie/Talking or RF-type test. Delegated to Machine Protection Working Group Following the incident in UJ33… working on it for 2009 startup Done / Being Done Not done Done / Being Done In parallel with #18 = this year

Review of Reviews June of 29 Interfaces to Software Systems 34. Alternative solutions of the SOFTWARE_PERMIT signal should be investigated. 35. Procedures for testing the full USER_PERMIT to BEAM_PERMIT chain should be made. 36.Implications of the swapping of Maskable and Unmaskable channels should be investigated. The Safe Beam Flag Protected by Role Based Access Control (RBAC) BIS In Operation is a project in its own right Implementation for later this year Once Safe Beam Flag = FALSE ‘MASKs’ are set FALSE by software It IS possible to swap cables, but only in USER SYSTEM Not at BIC: CIBU ID# must match before rearming is allowed MI have no control over User System installations Done Done / Being Done Done

Review of Reviews June of 29 The Safe Beam Flag 37.Safe solutions for the implementation of the Safe LHC Parameters Receiver Board should be investigated. 38.The distribution of the Safe Beam Flag should be consistent with points 36 and The history buffer should be designed to reduce the possibility of overflows and loss of data. Dedicated timing receiver called CISV Cannot be re-programmed at distance (once released) Safe Machine Parameters System is very safe on paper. System be reviewed when appropriately mature (many delays due to LHC) Done Done / Being Done Not done Review will be planned following BIS External Review this year.

Review of Reviews June of 29 Miscellaneous 40. Beam Permit in INJ and EXT should be displayed with persistence on operator screens. Delegated to software expertsDone \ Being Done

Review of Reviews June of Audit Recommendations -Actions 1. Beam Interlock System -Reminder 3. Conclusions -Summary Table -Future Plans Conclusions

Review of Reviews June of 29 Summary Table 40 points, of which 22 = Major

Review of Reviews June of 29 Summary Table 40 points, of which 22 = Major 34 are Done

Review of Reviews June of 29 Summary Table 40 points, of which 22 = Major 34 are done1 will not be done

Review of Reviews June of 29 Summary Table 40 points, of which 22 = Major 34 are Done1 will not be done3 before startup 2009

Review of Reviews June of 29 Summary Table 40 points, of which 22 = Major 34 are Done1 will not be done3 before startup as new series of reviews

Review of Reviews June of 29 Conclusions All of the comments from the reviewers were considered. Most have been take into consideration One was rejected ! interconnection BIS to LBDS = an external review of BIS is planned to include this ! Dedicated system safety company to come to CERN for a week Either June-July or October-November 2009 Safe Machine Parameters is then to be subject to a review One or Two months after BIS External review

Review of Reviews June of 29 FIN

Review of Reviews June of 29 Beam Interlock Systems Designed to protect CERN high energy accelerators = SPS / LHC / INJ / EXT