1. CLIC Interlock System study: from Principle to Prototyping Patrice Nouvel TE-MPE-EP TE-MPE Technical Meeting : 22/03/2012

2. Topics CLIC Machine ProtectionInterlock System ConceptsRequirements Focus on dependability requirements Specifications Functionality Technology choice Architecture Proofs of concept Functional at CTF3 Hardware Feasibility Study Wrap-up Patrice Nouvel – March 20122

3. CLIC Machine Protection Patrice Nouvel – March 2012-3- Passive protection (e.g. collimators) Real time protection, partial dump (at first Linac, on rings) Fast failures (beam in-flight): RF cavity breakdown, kicker failure, etc Equipments based Interlock System “Safe by design” principle (2 ms) Inter-cycle failures: Equipment failures Post-Pulse Analysis System Slow beam failures (drift) - Failures classification and their related protection system - Related Document=> CLIC CDR chap 5.16: “CLIC Machine Protection”CLIC CDR chap 5.16

4. CLIC Interlock System Concepts The CLIC Interlock System is based on two concepts: – Equipments based Interlock System (EIS) : Looks for any equipment failures Inhibits the next pulse => Beam Permit – Post-Pulse Analysis System (PPAS): Performs beam quality analysis Inhibits the next pulse => Next Cycle Permit Patrice Nouvel – March 20124 Example: power converter Example: Beam Loss Monitor

5. Topics CLIC Machine ProtectionInterlock System ConceptsRequirements Focus on dependability requirements Specifications Functionality Technology choice Architecture Proofs of concept Functional at CTF3 Hardware Feasibility Study Wrap-up Patrice Nouvel – March 20125

6. Requirements cf. concepts Functional requirements Response time: EIS: 2 ms PPAS: 6 ms Dependability attributes (reliability and availability) Two main performance requirements: Patrice Nouvel – March 20126 Related Document=> EDMS 1148133 : “CLIC Interlock Systems Requirements Analysis”EDMS 1148133

7. Dependability requirements - method -

8. Hazard Chain:

9. Dependability requirements - method - Interlock System: Active system => can act on the failure frequency

10. Dependability requirements - method - Related Document => EDMS 1167156: “CLIC Interlock Systems Dependability requirements”EDMS 1167156 Requirement/ratedefinitionValue (conservative case) Machine AvailabilityDead time range allowed to Interlock system[0.30%;0.10%] Machine SafetyProbability of catastrophic event1 / 10 000 years Machine Availability impact on Interlock System Probability of VETO Decision when PASS decision is expected ≤ 2.8 x 10 -9 (per cycle) = 2 (per year) Machine Safety impact on Interlock System Probability of PASS Decision when VETO decision is expected ≤ 6 x 10 -9 (per cycle) = 0.01 (per year) Interlock System Availability1- (Outage time/expected operation time)≥ 99.29% Interlock System Reliability Amount of not covered beam per operational times ≤ 438/720.10 6 beams.year -1

11. Topics CLIC Machine ProtectionInterlock System ConceptsRequirements Focus on dependability requirements Specifications Functional analysis Technology choice Architecture Proofs of concept Functional at CTF3 Hardware Feasibility Study Wrap-up Patrice Nouvel – March 201211

12. Functional Analysis Patrice Nouvel – March 201212 Ready to be processed Threshold comparison Concentrator + correlation Communication with Control System Switches “[…]decompose the system functions to lower-level functions that should be satisfied by elements of the system design (e.g. subsystems, components or parts)” Aim (from IEEE 1220):

13. Technology Choice Boards: FPGA-based Tradeoff reliability vs. response time MPE Group experience Other options (such as DSP) are not excluded Hardware Platform: follow choice by BE-CO (µTCA/ATCA?) Hardware: critical part Follow choice by BE-CO (such as FESA class) Middleware Software: non-critical part (testing and monitoring purpose) Patrice Nouvel – March 201213

14. Architecture: Interface with CO system Patrice Nouvel – March 201214 CLIC CDR chap 5.13 Control Acquisition and Control Module X 22 000

15. Architecture: Interface with CO system Patrice Nouvel – March 201215 CLIC CDR chap 5.13 Control Application Tier Control Center Middle Tier Servers in Surface building Equipment Tier Dedicated Front-End Computer (FEC) Machine Protection surrounded in red CLIC CDR chap 5.13 Control CM CLIC Modules Acquisition and Control Module

16. Architecture Patrice Nouvel – March 201216 1 60......

17. Architecture: EIS Patrice Nouvel – March 201217 EIS Architecture: Daisy chain – Response time required: 2 ms Strategy: Beam Permit Loops – Master Module: frequency generator – Other nodes: switches To be investigated: – Multiple frequencies Target systems: RF sources (to be confirmed)

18. Architecture: PPAS Patrice Nouvel – March 201218 PPAS Architecture: Tree topology – Response time required: 6 ms Strategy: Concentrate and Transmit

19. Topics CLIC Machine ProtectionInterlock System ConceptsRequirements Focus on dependability requirements Specifications Functionality Technology choice Architecture Proofs of concept Functional at CTF3 Hardware Feasibility Study Wrap-up Patrice Nouvel – March 201219

20. Proofs of concept Patrice Nouvel – March 201220 EIS: direct inheritor from LHC BIS => Function well known PPAS: no direct inheritor (multiple concepts: SMP, PM, SIS, Linac4 WD) => need Functional Proof of Concept Functional (un)validate specifications through requirements Use BE-CO technology choices (e.g. White Rabbit Switches) Hardware demonstration

21. PPAS function at CTF3 CTF3 (CLIC Test Facility 3 rd version): – practical example – CLIC Test Bench Adapted function (very tunable machine) “Automatic Procedure to restart the beam with safety considerations” Patrice Nouvel – March 201221 Related Document=> EDMS 1182876EDMS 1182876

22. Hardware demonstration Patrice Nouvel – March 201222 Step by step approach First objective: 3 node EIS (hereunder) and 3 layer PPAS (same hardware)

23. Wrap-up Concepts Requirements Specifications: but need to be validated What is defined PPAS at CTF3: in progress (JAVA developing) HW demonstration: on going (budget validation) Proofs of concept status Dependability study (architecture) What is foreseen Patrice Nouvel – March 201223

24. Thanks for your attention Questions and remarks are very welcome

25. Spare slides Patrice Nouvel – March 201225

26. CLIC Layout Patrice Nouvel – March 201226

27. CLIC Module Patrice Nouvel – March 201227 CLIC CDR chap 5.13 Control

28. CTF3 Layout Patrice Nouvel – March 201228

29. Dependability concept definition Patrice Nouvel – March 201229

30. CLIC Failure characterization CLIC - Drive Beam beam Energy Density in copper (J/g) normalized beam hazard (%) Probability of beam not lost (%) without MP risk (%) tolerable risk (%) Safe Beam Pilot 30 bunches 601E-30991E-300.02 1 train (24*121 bunches) 1.80E+041.92990.0190.02 N trainsN * 1.8*10^4---- Binomial law B(N, 99%) ---0.02 nominal beam 24 trains 4.30E+0545.99B(24,99%)=79%9.450.02 Patrice Nouvel – March 201230 CLIC - Main Beam beam Energy Density in copper (J/g) normalized beam hazard (%) Probability of beam not lost (%) without MP risk (%) tolerable risk (%) Safe Beam Pilot (1 bunch) 601E-30991E-320.02 beam at the start of main linac 3.21E+0534.3990.340.02 beam at the end of main linac 9.35E+051009910.02

31. Project methodology IEEE 1220-2005: Standard for Application and Management of the Systems Engineering Process (ISO-IEC 26702) IEEE 1233: IEEE Guide for Developing System Requirements Specifications EIA standard 632: Processes for Engineering a System ISO-IEC 15288: Systems and software engineering — System life cycle processes Patrice Nouvel – March 201231

32. CLIC operational scenario Patrice Nouvel – March 201232 Safe Pilot Beam and PPAS: CLIC CDR chap 5.16 Machine Protection