1v0

1. 1v0

2. Contents 1. Beam Interlock System • Reminder 2. Audit 2006 • Recommendations • Actions 3. Conclusions • Summary Table • Future Plans Review of Reviews June 2009

3. 1. Beam Interlock System • Reminder 2. Audit 2006 • Recommendations • Actions 3. Conclusions • Summary Table • Future Plans Review of Reviews June 2009

4. LHC Function BIS ~200 connections to User Systems distributed over 28kms Both-Beam LHC has 2 Beams Some User Systems give simultaneous permit Others give independent permit Beam-1 Beam-2 Review of Reviews June 2009

5. Signals Review of Reviews June 2009

6. Audit 2006 1. Beam Interlock System • Reminder 2. Audit 2006 • Recommendations • Actions 3. Conclusions • Summary Table • Future Plans Review of Reviews June 2009

7. 2006 Audit Scope Audit format: 6 auditers 1 day of presentations + 4 days ‘open-house’ Auditors raised 40 points, of which 22 = Major Done / Being Done = implemented changes Not Done = not going to implemented these changes Not Done = haven’t implemented changes yet Normal points in normal font Major points in bold font Review of Reviews June 2009

8. Documentation 1. A consistent set of up-to-date and finalised documents should be provided. Done / Being Done EDMS – all being progressively updated Electronics Designs: https://edms.cern.ch/nav/AB-001259 Documentation and Test Results:https://edms.cern.ch/nav/AB-001913 2. Following PhD completion: all information relevant for the project to be retrieved Done All information is available as above and on the network drive: G:\Departments\AB\Projects\beaminterlocks\BTodd\INTERLOCK_PROJECTS 3. A full listing of all pending design aspects should be provided. Done The two pending designs have been documented on EDMS Fibre Extended User Interface : https://edms.cern.ch/nav/AB-001163 Frequency Generator : https://edms.cern.ch/nav/AB-001261 Review of Reviews June 2009

9. Electronics and PCB Layout 4. Beam Permit Loop Frequencies should be more separated than 8 and 8.125MHz. Done Permit Loop A is now 9.375 MHz Permit Loop B is now 8.375 MHz Derived by integer division from a custom oscillator 5. Power filters to 230V mains should be added in order to protect against power spikes. Done Controller = AB systematically added filters for VME where needed User Interface = filtered by Schaffner FN-261-4-06, SCEM 08.21.10.260.3 http://www.schaffner.com/components/en/_pdf/Datasheet%20FN9260%20e%2012.pdf 6. Oscillation of USER_PERMIT … might create a continuous BEAM_PERMIT signal with a frequency above 300 kHz. This should be investigated. Done RS485 Slew Rate Limited to 250kHz… Glitch count values = DIAgnosisand MONitoringsoftware Review of Reviews June 2009

10. Electronics and PCB Layout 7. In the optical transceiver electronics (CIBO), the two time constants and the Schmitt trigger threshold should be well understood and — if necessary — adapted in order to obtain the desired functionality. Done PSPICE simulations Complete dedicated hardware testbench = optimum performance for Optical Transceiver Choice of Components 8. Since 5×20mm fuses do not have the capability to cut AC high short circuit currents, it must be ensured that the maximum short circuit current of the AC network is below the short circuit capability of the CIBU. 250V 400mA Slow-Blow, CERN 06.73.51.332.9, Schurter 0034.3113 http://www.schurter.ch/pdf/english/typ_fst_5x20.pdf ~1500A current before arcing, mains = 16A? Done 9. The use of the current 10µF 10V 1206 X5R capacitors in the CIBO should be checked Changed to 1uF Done Review of Reviews June 2009

11. Choice of Components 10. Some PI filters use ceramic capacitors and SMD inductors. Verify that no high-frequency over-shoots arrive at startup. Check the power supply decoupling of the opto-transmitter and the receiver. Complete dedicated hardware testbench 5V filtering is acceptable 0V in older VME chassis is poor = Optical Transceiver Variant B as a contingency (CIBOB) Done 11. The redundant power supplies are decoupled from each other by the usage of Schottky diodes. Verify these diodes are covered in the FMEC analysis. Done These are included 12. The bidirectional transil suppressor with reference “SMBJ15CA” from Fairchild was used for the QPS electronics and on LHC power converters but found to be of bad quality. Done used SM6T33CA from ST Microelectronics Review of Reviews June 2009

12. The Optical Link 13. During the live presentation, the BIS encountered a severe denial-of-service due to spurious signals on the optical fiber link, identify and mitigate the cause. Done 0V in older VME chassis is poor = Optical Transceiver Variant B as a contingency (CIBOB) History Buffer is more robust Frequency Detectors are more precise 14. The availability of the “old-fashioned” ELED seems to present a potential problem. Investigate alternatives. Done 2006 letter from Laser Components = at least 5 more years of ELED = 2011 Optical Transceiver Variant A uses a laser as a contingency (CIBOA) 15. For the hardwired SPS and LHC interlock signals used by the operators in the CCC, the CIBU – BIC cable exceeds the RS422 maximum distance. Mitigate this. Done 17th Controller is in the CERN Control Centre Review of Reviews June 2009

13. Testing & Commissioning 16. Electrical tests of all PCBs should be conducted Done Every board has a dedicated hardware tester After manufacturing = Test After goods reception at CERN = Test 17. Currently power soak tests are conducted for about one hour. The test duration should be justified and potentially adjusted. Done These were increased to 8-12 hours Longest we could manage for reception in time for commissioning 18. A Walkie-Talkie-type / RF susceptibility test should be conducted after installation. Not done In parallel with #33 = this year Review of Reviews June 2009

14. Electromagnetic Compatibility 19. The conductivity of the unit’s enclosure and the earth connection of the rack should be tested after installation. Done/Being Done Samples are <0.2 Ohms – full test this year 20. It has to be made sure that all cables use 360 degree shielding on BURNDY connectors. Done 21. Failure modes and corresponding mitigations for a local oscillator failure on the Xilinx CPLD should be checked. Done Ring oscillator not good for CPLD Oscillator frequency is monitored and alarmed through DIAgnosisand MONitoringsoftware Review of Reviews June 2009

15. VHDL Coding 22. Review the VHDL Code when the final version of the CIBM is ready Only concerned with critical function Almost 100% code coverage in simulation 100% coverage hardware tester Designed by two engineers Tested by an independent third engineer External review planned for this year Done / Being Done 23. Document the code, and store it in a repository such as CVS. Code is completely documented: https://edms.cern.ch/document/884688/1v1 SVF is being implemented for all MI projects Done / Being Done Mechanics 24. Take measures to fix the 220V cables into the power supplies using locks or screws Not Done decided against changes risk of accidental release in racks very small. Already redundant Very expensive to implement the changes Review of Reviews June 2009

16. Mechanics 25. Labelling or keying should be added to VME slots to avoid problems during maintenance. Done Completely labelled Keys = BIS v2? Cabling 26. Use the latest version of the cabling guide written by Yves Thurel. Done Radiation and Magnetic Fields 27. The radiation tolerance of the User Interface should be determined. Done https://edms.cern.ch/document/993416/1v0 Review of Reviews June 2009

17. Radiation and Magnetic Fields 28. The magnetic field tolerance of the User Interface should be determined. Not done Interface to the LBDS 29. A similar audit to this should be conducted for the Beam Dump electronics Delegated to Machine Protection Working Group 30. The Fast Inhibit Board should be considered as part of the Beam Interlock System Failure Modes, Effects and Criticality Analysis. Not done External review planned for this year Review of Reviews June 2009

18. Interfaces to User Systems 31. The major User Systems should be audited. Done / Being Done Delegated to Machine Protection Working Group 32. User Systems must be made aware of the impact of their designs on the safety of LHC, for example, bad cabling can result in blind failures. Done / Being Done Following the incident in UJ33… working on it for 2009 startup 33. The interconnection between User Systems and the Beam Interlock System should be tested using a Walkie/Talking or RF-type test. Not done In parallel with #18 = this year Review of Reviews June 2009

19. Interfaces to Software Systems 34. Alternative solutions of the SOFTWARE_PERMIT signal should be investigated. Done Protected by Role Based Access Control (RBAC) 35. Procedures for testing the full USER_PERMIT to BEAM_PERMIT chain should be made. BIS In Operation is a project in its own right Implementation for later this year Done / Being Done The Safe Beam Flag 36. Implications of the swapping of Maskable and Unmaskable channels should be investigated. Done Once Safe Beam Flag = FALSE ‘MASKs’ are set FALSE by software It IS possible to swap cables, but only in USER SYSTEM Not at BIC: CIBU ID# must match before rearming is allowed MI have no control over User System installations Review of Reviews June 2009

20. The Safe Beam Flag 37. Safe solutions for the implementation of the Safe LHC Parameters Receiver Board should be investigated. Done / Being Done Dedicated timing receiver called CISV Cannot be re-programmed at distance (once released) 38. The distribution of the Safe Beam Flag should be consistent with points 36 and 37. Review will be planned following BIS External Review this year. Not done Safe Machine Parameters System is very safe on paper. System be reviewed when appropriately mature (many delays due to LHC) 39. The history buffer should be designed to reduce the possibility of overflows and loss of data. Done Review of Reviews June 2009

21. Miscellaneous 40. Beam Permit in INJ and EXT should be displayed with persistence on operator screens. Done \ Being Done Delegated to software experts Review of Reviews June 2009

22. Conclusions 1. Beam Interlock System • Reminder 2. Audit 2006 • Recommendations • Actions 3. Conclusions • Summary Table • Future Plans Review of Reviews June 2009

23. Summary Table 40 points, of which 22 = Major Review of Reviews June 2009

24. Summary Table 40 points, of which 22 = Major 34 are Done Review of Reviews June 2009

25. Summary Table 40 points, of which 22 = Major 34 are done 1 will not be done Review of Reviews June 2009

26. Summary Table 40 points, of which 22 = Major 34 are Done 1 will not be done 3 before startup 2009 Review of Reviews June 2009

27. Summary Table 40 points, of which 22 = Major 34 are Done 1 will not be done 3 before startup 2009 2 as new series of reviews Review of Reviews June 2009

28. Conclusions All of the comments from the reviewers were considered. Most have been take into consideration One was rejected ! interconnection BIS to LBDS = an external review of BISis planned to include this ! Dedicated system safety company to come to CERN for a week Either June-July or October-November 2009 Safe Machine Parameters is then to be subject to a review One or Two months after BIS External review Review of Reviews June 2009

29. FIN Review of Reviews June 2009

30. Beam Interlock Systems Designed to protect CERN high energy accelerators = SPS / LHC / INJ / EXT Review of Reviews June 2009