1. 0v1

2. CIBM – Controls Interlocks Beam Manager
CIBM – Matrix CPLD
CIBM – Controls Interlocks Beam Manager
CIBM Beam-1 x6
CIBM Beam-2 x8 x6
CERN, the LHC and Machine Protection

3. CIBM – Matrix CPLD CIBM – Controls Interlocks Beam Manager
Critical Function
Perform local ‘AND’ to make a LOCAL_BEAM_PERMIT from all USER_PERMITs
Filter each USER_PERMIT to remove glitches
Apply DISABLE jumpers to switch off unused channels
Allow MASKABLE inputs to be ignored if SAFE_BEAM_FLAG is TRUE
Everything duplicated
Critical is in a different device to Non-Critical
CERN, the LHC and Machine Protection

4. Block Diagram
CERN, the LHC and Machine Protection

5. Block Diagram
Hardware MATRIX = 9500XL Complex Programmable Logic Device (CPLD)
Hardware Description Language (VHDL)
S3 1000
FPGA
Coolrunner 2
CPLD
XC95144XL
CPLD
XC95144XL
CPLD
CERN, the LHC and Machine Protection

6. Block Diagram LOOP_OUT = LOOP_IN when LOCAL_PERMIT is TRUE
LOCAL_PERMIT_A 14
LOOP_A_OUT
USER_PERMIT_A
LOOP_A_IN 14
LOOP_B_OUT
USER_PERMIT_B
LOOP_B_IN
LOCAL_PERMIT_B
LOOP_OUT = LOOP_IN when LOCAL_PERMIT is TRUE
If LOOP_OUT is CORRECT FREQUENCY then BEAM_PERMIT = TRUE
CERN, the LHC and Machine Protection

7. Block Diagram
Focus of this talk
CERN, the LHC and Machine Protection

8. Orange = Critical Signals Green = Non-Critical Signals
IO Signals
Orange = Critical Signals Green = Non-Critical Signals
CERN, the LHC and Machine Protection

9. The Fail-Safe Principle
Electrical Characteristics - See section 18
Too detailed to present everything now - basic premise is always as follows:
Fast, Dependable Transmission
CERN, the LHC and Machine Protection

10. The Fail-Safe Principle
Electrical Characteristics - See section 18
Too detailed to present everything now - basic premise is always as follows:
CERN, the LHC and Machine Protection

11. The Fail-Safe Principle
Electrical Characteristics - See section 18
Too detailed to present everything now - basic premise is always as follows:
CERN, the LHC and Machine Protection

12. The Fail-Safe Principle
Electrical Characteristics - See section 18
Too detailed to present everything now - basic premise is always as follows:
CERN, the LHC and Machine Protection

13. The Fail-Safe Principle
At Destination: if (*FLAG = 0 AND FLAG_FAULT = 0) then FLAG = TRUE
MAX3440 = fail-safe transceiver, narrow window for USER_PERMIT = TRUE
CERN, the LHC and Machine Protection

14. The Fail-Safe Principle
We always use two links. Using two separate hardware paths A B
We can safely test this by setting ‘A’ TRUE and ‘B’ FALSE and vice-versa
CERN, the LHC and Machine Protection

15. Inside the Matrix CPLD A very simple code….
A CPLD 288 macrocell is equivalent to 288 registers, with 288 look-up tables
ALL INPUTS corrected for polarity before used internally
Whole of Thursday dedicated to explaining this code in detail
CERN, the LHC and Machine Protection

16. Inside the Matrix CPLD
CERN, the LHC and Machine Protection

17. DISABLE
CERN, the LHC and Machine Protection

18. Inside the Matrix CPLD
CERN, the LHC and Machine Protection

19. Only half of the inputs can be masked
CERN, the LHC and Machine Protection

20. Inside the Matrix CPLD
CERN, the LHC and Machine Protection

21. Probably the most critical code in the matrix.
FILTER
Probably the most critical code in the matrix.
Perpetual filtering is possible if there is noise = counters monitored, logged and alarmed
CERN, the LHC and Machine Protection

22. Inside the Matrix CPLD
CERN, the LHC and Machine Protection

23. MATRIX Generally: if INPUT (14->1) = TRUE AND SOFTWARE = TRUE
then LOCAL_BEAM_PERMIT = TRUE
LATCH_INIT must be pulsed after the device is powered
LATCH_ENABLE is TRUE in LHC
- So after every TRUE -> FALSE trigger, LATCH_REARM must be pulsed
CERN, the LHC and Machine Protection

24. Inside the Matrix CPLD
CERN, the LHC and Machine Protection

25. If LOCAL_BEAM_PERMIT = TRUE then OUT = IN
SWITCH
If LOCAL_BEAM_PERMIT = TRUE then OUT = IN
CERN, the LHC and Machine Protection

26. Monitoring The FPGA in the CIBM contains extensive monitoring:
8000 record history buffer, accurate to 1us
Integrity analysis for Beam Permit Loops
Glitch Counters
More in demonstration day Thursday
CERN, the LHC and Machine Protection

27. CRITICAL Matrix Verification 1/2
Complete, exhaustive VHDL simulation
Two different engineers wrote code (A vs B)
Three different engineers tested it
Code coverage 100% on critical signals
BEAM_PERMIT_INFO – One Impossible combination – Not critical
CERN, the LHC and Machine Protection

28. CRITICAL Matrix Verification 2/2
Complete, exhaustive Hardware test-bench - 100% of critical signals
4 hours to test everything at ~100k combinations per second
Rear View
Front View
Top-Down verification of the Matrix function
CERN, the LHC and Machine Protection

29. CRITICAL Matrix Verification 2/2
Complete, exhaustive Hardware test-bench - 100% of critical signals
4 hours to test everything at ~100k combinations per second
Rear View
Front View
After installation – we test critical paths online using ‘A’ ‘B’ test mode end to end …
CERN, the LHC and Machine Protection

30. FIN
CERN, the LHC and Machine Protection