Scheme proposal for the Linac4 watchdog

1. Scheme proposal for the Linac4 watchdog G Bellodi, B Mikulec, J-L Sanchez Alvarez Linac4 BCC meeting

2. Introduction Watchdog = Machine protection element whose function is to cut the beam if losses exceed predefined thresholds, depending on which user is being executed. • At Linac2 Software Interlock System (SIS) solution • 1 FESA class providing the persistent configuration registry for some parameters (thresholds, counter, status, tolerance ranges for the BCTs or the power supplies) • + • 2 hardware connections to the Interlock crate of LINAC 2. • The interlock crate disables (by HW) the timings for pulsing the source of LINAC 2 in case of raised interlock condition. • A keep-alive pulse isgenerated by SIS at every cycle to ensure that the SIS and FESA are up and running (SW action that the FESA class turns into timing pulse to the interlock chassis) • PPM counter linked to PSB timing Linac4 BCC meeting

3. Linac2 SIS flowchart Linac4 BCC meeting

4. @ Linac4 The Linac4 Watchdog acts via the Beam Interlock System – EDMS1016233 Foreseen to be a maskable User Input of the BICs and can thus be disabled by the operators for particular operating scenarios B Mikulec, B.Puccio Linac4 BCC meeting

5. L4 watchdog architecture • Four parallel implementations (BIS design compatibility) are proposed: • Low-energy WD • Linac4 and LT line WD • LT-LTB-BI lines and LBE/LBS WD • PSB injection WD a) Losses in the chopper cannot be covered (thresholds would have to depend on the chopping pattern used) all BCTs upstream of LT.BHZ20  Linac4 frontend b) Readout: all BCTs downstream of LT.BHZ20  BOR frontend L4DUMP LBE PSB LBS Linac4 BCC meeting

6. 1) Low energy Compares : L4L.BCT.1183 & L4L.BCT.3113 for all beam destinations Input to Master BIC ‘Source-RF’ 2) Linac4 and LT line Compares : L4L.BCT.4013 & L4Z.BCT.0117 (if dest=L4DUMP) L4L.BCT.4013 & LT.BCT30 (if dest = LBE,LBS,PSB) Input to BIC ‘Linac4 and Linac4 Transfer OK’ Linac4 BCC meeting

7. 3) LT/LTB and LBE/LBS/BI line watchdog Compares: L4T.BCT.1617 & BI.BCT10 if dest=PSB L4T.BCT.1617 & LBE.BCT65 if dest=LBE L4T.BCT.1617 & LBS.BCT64 if dest=LBS (slit?) Input to BIC ‘Linac4 and Linac4 Transfer OK’ 4) PSB injection Compares: BI(1:4).BCT20 & intermediate bandwidth transformer in section 8L1 (4, ring by ring) Compares the sum of the 4 BI transformers with the sum of the 4 ring transformers (value taken after 100 turns) user per user . Input to BIC ‘PSB OK(1)’ Linac4 BCC meeting

8. L4 WD Specifications/functionality • Function: cut the beam if excessive losses are measured • on a user-by-user basis • after a certain number (set by the operators) of ‘bad’ pulses have been recorded • FESA class receives information from the PSB telegram about which timing user (and destination) is being executed. • For each user, a Bad-Pulse-Counter is initialized to a maximum value and incremented/decremented if at every subsequent pulse according to whether this is good/bad. • When the Bad-Pulse-Counter=0 the watchdog triggers the interlock to cut the beam. A manual reset is needed (on a user-per-user basis) to restart operation. • On the basis of recent studies on beam induced damage scenarios (C Maglioni, BCC#25), the baseline assumed is that the watchdog should be able to react within 1 second(i.e. cutting the next pulse at 1Hz repetition rate after the detection of substantial losses in the machine) Rules out purely SW-based solution a` la Linac2. Linac4 BCC meeting

9. Hybrid technology • registry of: • user and destination • thresholds information • BadPulseCounter update • BCT readings comparison Linac4 BCC meeting

10. Watchdog flow-chart WD card provides an electrical interface to the CIBU modules Hardware and software are in the same front-end (unlike Linac2)  to reduce potential failure Linac4 BCC meeting

11. Time action During the WD timing window, beam intensities are acquired from the TRIC cards and compared to WD thresholds- BadPulseCounter is updated If counter ≠0 for the user to be executed, the FESA class activates in the WD card a “watchdog timing window” that enables beam permit over ~2ms Beam permit is disabled outside the WD timing window • BIC effectively re-armed at every pulse Linac4 BCC meeting

12. Extra remarks A minimum intensity threshold should be implemented to avoid taking into account pulses with no beam (or triggering on noise). Current integration should be carried out as close as possible to the detector to avoid signal deterioration. Redundancy needs to be built in the system and solutions sought to ensure fail-safe operation in case of failure scenarios and communication breakdowns . Duplicated inputs to the CIBU user interface per watchdog. Keep-alive pulse coming from the SIS software should be generated at every cycle to ensure that FESA SW is up and running. If SW is not alive, no WD timing window is issued. Operator needs to manually reset the watchdog (on a user-per-user basis) to restart operation. WD architecture here presented matches currently proposed solution for the Linac4 BIS. Any changes to the latter will probably require modifications to the WD scheme shown... Linac4 BCC meeting