1. Overview of the Beam Interlock System
BIS Overview Linac4 BCC meeting / 21 Oct.2010 / B.Puccio (TE/MPE)

2. Beam Interlock System BIS “Target” system
BIS Overview Linac4 BCC meeting / 21 Oct.2010 / B.Puccio (TE/MPE)

3. Σ (User_Permit = « TRUE » )  Beam_Permit = « TRUE »
Principle
User
System #n
User
#n-1
User
Beam_Permit
User
System #3
“Target”
system
AND
User
System #2
User_Permit#3
User
System #1
User_Permit#2
Beam Source
or Extraction kicker
or Dump Kicker,…
etc…
BIS Overview Linac4 BCC meeting / 21 Oct.2010 / B.Puccio (TE/MPE)
User_Permit#1
Σ (User_Permit = « TRUE » )  Beam_Permit = « TRUE »

4. Central part of LHC protection
BIS Overview Linac4 BCC meeting / 21 Oct.2010 / B.Puccio (TE/MPE)

5. Beam Interlock Controller
BIS Layout
BIS = set of Beam Interlock Controllers with 14+1 inputs each
BICs can be daisy chained
Two types of layout: ring or tree architecture (see next slide)
BIC boards embedded in VME chassis
Dedicated FESA class for monitoring and for remote testing
Supervision (JAVA application) for Operators
Technical
Network
JAVA
Application
Dedicated User Interfaces (named CIBU) for connecting User System Permit signals via copper cable
Always installed in the User System rack
Input signal = current loop
User
Permit #1
#14 #2
copper cables
User System #1
User System #2
Beam
Permit
Loops
(F.O.)
rear
front view
Beam Interlock Controller
User System #14
User Interfaces

6. ring architecture or tree architecture
Two types of layout
ring architecture or tree architecture
are identical except the “Master” BIC
All
BIC

7. Example of Master BIC: SPS Extraction (1/2)
Extraction_Permit for the Extraction kickers is generated by a “Master” BIC:
Simple ‘AND’ function replaced by combination of ‘OR of AND’ function
All inputs are NOT maskable
TED position is taken into account to ignore downstream inputs for necessary operational flexibility
Basic Principle:
Extraction_Permit = (TT60 BIC = OK) AND (TED = “IN position” ) OR
(TT60 BIC = OK) AND (Ti2 BICs = OK )
In taking into account the LHC injection region and the different conditions to inject a high intensity beam, we introduce another complication...
Courtesy Verena Kain (BE/OP)

8. Example of Master BIC: SPS Extraction (2/2)
Various operating modes:
M1:
Beam to upstream TED
(setting up of the SPS extractions)
M2:
Beam onto downstream TED
(setting up of the transfer line)
M3:
Probe beam into LHC
(setting up of the LHC injections…)
M4:
Low intensity beam into LHC
(filling the LHC)
M5:
High intensity beam into LHC
Corresponding Truth Table for Master BIC:
Input Names
Input Type M1 M2 M3 M4 M5
Software Interlock Sw 1
TT60 User_Permits
Slave BIC 2
TED Upstream ‘IN position’
User System 3
Ti2 Upstream User_Permits X 4
Ti2 Downstream User_Permits 5
TED Downstream ‘IN position’ 6
LHC b1 Injection User_Permits 7
SPS Probe Beam Flag
Safe Param. 8
LHC Beam Presence Flag 9
SPS Setup Beam Flag 10
LHC Setup Beam Flag
Extraction Beam_Permit

9. Critical versus Non-Critical:
System Performance
Safe & Reliable: Safety Integrity Level 3 was used as a guideline
Whole design studied using Military and Failure Modes Handbooks
Results from the LHC analysis are:
P (false beam dump) per hour = 9.1 x 10-4
P (missed beam dump) per hour = 3.3 x 10-9
Critical process in Hardware:
♦ functionality into 2 redundant matrices
♦ VHDL code written by different engineers following same specification.
Critical versus Non-Critical:
♦ Critical functionality always separated from non-critical.
♦ Monitoring elements fully independent of the two redundant safety channels.
100% Online Test Coverage:
Can be easily tested from end-to end in a safe manner
=> recovered “good as new”
Critical process in Hardware: functionality into 2 redundant matrices
VHDL code written by different engineers following same specification.
Critical versus Non-Critical:
Critical functionality always separated from non-critical.
Monitoring elements fully independent of the two redundant safety channels.

10. Masking “Flexible” system: thanks to Input Masking
FALSE
Setup Beam Flag
Within a fixed partition, half of User Permit signals could be remotely masked
FALSE
Masking automatically removed when this flag changes to FALSE
Masking depends on an external condition:
the Setup Beam Flag
this SBF is generated by an independent system
(like LHC Safe Machine Parameters system)
and is distributed by the Timing system
YES
FALSE

11. BIS monitoring: History Buffer
time 11

12. BIS & Timing... BIS process is independent of Timing
 Beam_Permit changes when one of User_Permits changes
Nevertheless (thanks to Timing system) the BIS is synchronized to UTC time
Timing
Receiver board
1PPS tick
Machine Timing
Event pulse
Beam Interlock Controller
In addition, an External hardware signal can create a record in the History Buffer
- like for the SPS Extraction lines with the Extraction Event occurrence
Record created at the external pulse occurrence
Useful for checking time relationship Interlock’s change Vs. Machine event 12

13. BIS Output: Beam Permit signals
♦ For Beam_Permit _A: Nominal Frequency 9.375MHz => Period = 107ns
Duty cycle 50%
♦ For Beam_Permit _B: Nominal Frequency 8.375MHz => Period = 119ns
♦ Beam_Permit is TRUE is corresponding frequency is detected
♦ absence or erroneous frequency means that Beam_Permit is FALSE.
BIS Overview Linac4 BCC meeting / 21 Oct.2010 / B.Puccio (TE/MPE)
Initially designed for LHC, the principle of Permit Loops is simple; a single generated frequency is relayed around
the machine, BIC to BIC, over optical fibres. Each BIC is capable of interrupting the
repetition of the generated signal. Once the signal has performed a full lap of the
machine it is detected, a frequency present means Beam Permit is TRUE, absence or
erroneous frequency means that the Beam Permit is FALSE for that loop.
Both Beam_Permits transmitted via Fibres
Conversion Electrical/light and Light/electrical performed by a dedicated board

14. BIS User Interface (named CIBU)
Unique HW solution for connecting any User System to the BIS
Front view
rear view
to Beam
Interlock
Controller
User System
CIBU
( could be PLC based, or VME based, or any type of electronics…)
BIS Overview Linac4 BCC meeting / 21 Oct.2010 / B.Puccio (TE/MPE)
Note that between the values of 1 and 9 milliamps, the value of USER_PERMIT is either TRUE or FALSE, depending on the age of the installed equipment. A newer optocoupler will react to lower levels of current, whereas an ageing device will have a higher threshold of current.
User _
Permit A+ A-
User_Permit state transmitted in
RS485 format
Current loop signal
User_Permit = “TRUE” if input current > ~10mA

15. BIS User Interface details
BIS Overview Linac4 BCC meeting / 21 Oct.2010 / B.Puccio (TE/MPE)
Fast response time (2.6 µS max)
Large Input Voltage Range ( 4V up to 25V)
Input TVS Diodes (33Volts) to protect overvoltage
Input current limitation stage
Hysteresis, clean signal edges
RS485 output, good EMC, long distance (up to 1200m)
More details in EDMS #636589

16. BIS User Interface input
(CIBU )
Shielded &
Twisted Pair cable
User Side +
25Vmax
User_Permit_B
<5 meters
User_Permit_A
BIS Overview Linac4 BCC meeting / 21 Oct.2010 / B.Puccio (TE/MPE) 0V
Mandatory circuit:
All ground / earth / 0V connected
Spare wires grounded
Shield 360o at both ends & NO pig-tails
Cable should be Twisted pair (like NE8 type) or LEMO 00 from VME front-panel
More than 5 meters = FORBIDEN
 Same circuit
for “B” channel

17. Summing up
Initially designed for LHC => Highly reliable, Fast and Maintainable
Modular and expandable
Deployed in SPS ring and Transfer lines SPS-CNGS-LHC
Tree architecture suitable for Linac4 requirements
Slave BICs : “AND” function of 14+1 inputs
with fixed Unmaskable/ Maskable partition
Master BIC : “AND” & “OR” functions of 14+1 inputs
(like local Beam_Permits, User_Permits, Beam Conditions Flags…)
In both cases, an input for Software Interlock allows more flexibility.
BIS Overview Linac4 BCC meeting / 21 Oct.2010 / B.Puccio (TE/MPE)
Redundant Beam_Permits = Fixed Freq. signals available of optical cables
Unique Hw solution to interface any type of electronics
User_Permits = simple current loops ( with I >10mA )
Redundant signals are required
Interconnecting recommendations have to be followed

18. Thank you !
BIS Overview LINAC4 WP presentation meeting 17 Feb.09 / B.Puccio (TE/MPE)

19. Backup slides
BIS Overview LINAC4 WP presentation meeting 17 Feb.09 / B.Puccio (TE/MPE)

20. Electrical Architecture (LHC case)
in USER rack
in INTERLOCK rack
Cable
User System
2U Chassis
VME Chassis
Courtesy BenjaminTodd

21. Kickers only pulse if they have the PERMIT
...and if energy is correct (BETS = beam energy tracking system) and for the injection kicker: if the abort gap keeper (AGK) gives green light → see Jan’s talk
LHC injection kicker needs: injection permit (produced by the Injection BICs)
SPS extraction kicker needs: extraction permit (produced by the Extraction master BIC)
Injection permit = LHC beam permit + injection BICs OK
Extraction permit = injection permit + transfer line BICs OK + extraction BICs OK +
+ combination of flags
Courtesy Verena Kain (BE/OP)

22. User Interface: remote test & monitoring
Test and Monitoring of USER_PERMIT Channel (signals in green)

23. Reaction Time

24. User system’s side Controller’s side
BIS Hardware
~2200 boards produced
(~85% in operation)
User Interface
Optical daughter cards
Redundant
P.S.
Manager
Test & Monitoring
F.O. variant of
the User Interface
Back Panel
User system’s side
Controller’s side