1. B. Todd et al. 25 th August 2009 Observations Since 2005 0v1

2. benjamin.todd@cern.ch Observations Since 2005 2 of 15 Beam Interlock System Locations Designed to protect CERN high energy accelerators = SPS / LHC / INJ / EXT

3. benjamin.todd@cern.ch Observations Since 2005 3 of 15 Beam Interlock System Locations Designed to protect CERN high energy accelerators = SPS / LHC / INJ / EXT In LHC = 17 x 2 Beam Interlock Controllers 188 individual connections

4. benjamin.todd@cern.ch Observations Since 2005 4 of 15 Machine Protection System

5. benjamin.todd@cern.ch Observations Since 2005 5 of 15 Operational Figures so far… LHC system used throughout CERN for > 2 years -Feedback into production and upgrades already TRACOPOWER Pessimistic figure 217F Both failures due to Non-conforming installation Monitor weakness Identified in 2007 = New PCB design 2008 Not enough data yet… One double blind failure during commissioning – next presentation – many revised specifications to ensure conforming installations for this year – 2005 onwards = system running in SPS and EXT 2007-8 onwards = LHC system running in LHC and INJ

6. benjamin.todd@cern.ch Observations Since 2005 6 of 15 The Effect of Programmable Logic Non-critical = DIFFERENT device and circuits ≈90000 components in BIS Critical = small & simple as possible FMECA = GOOD for discrete NO GOOD for FIRMWARE!  More systems than ever are using FPGA… We must prepare…

7. benjamin.todd@cern.ch Observations Since 2005 7 of 15 Online Testing and Checking 1.BIS Pre Operational Testing a) Static Checks Hardware ID numbers Enabled / Disabled Channels Power Supply Redundancy Software Servers b) Dynamic Checks 100% Coverage Internal Test Mode External Test with Users History Buffer Time alignment Safe Beam Flag Reception Post-Mortem Trigger Check Hardware Statuses All OK? Check Hardware Configuration Check Time Alignment Stand Alone Tests Global Tests Rearm System Yes No Intervention Next Slide

8. benjamin.todd@cern.ch Observations Since 2005 8 of 15 Online Testing and Checking 2. Diagnosis and Monitoring Hardware ID numbers Enabled / Disabled Channels Power Supply Redundancy Software Servers Glitch Counters Frequency Measurements 3. Post Operational Checks who started the dump – which user? Or was the BIC responsible? Internal Fault? Redundancy compromised? Time delays respected? Beam Dump Online Monitoring Diagnosis Non-critical failures = schedule maintenance Critical failures = BIS hardware forces False dump No Yes Post Operational Check Post-Mortem Validation All OK? 4. Post Mortem Checks the whole MPS works correctly No Intervention Back to pre-op checks Previous Slide Yes

9. benjamin.todd@cern.ch Observations Since 2005 9 of 15 Testing with ‘A’ and ‘B’

10. benjamin.todd@cern.ch Observations Since 2005 10 of 15 Testing with ‘A’ and ‘B’

11. benjamin.todd@cern.ch Observations Since 2005 11 of 15 Testing with ‘A’ and ‘B’ User System to User Interface TEST in the same way

12. benjamin.todd@cern.ch Observations Since 2005 12 of 15 Beam Interlock System Concerns Optical – CIBO / CIBOA / CIBOB / CIBL Availability of the ELED technology DC – 10MHz not in keeping with commercial technology Design Basis – CIBF User Systems installed >1200m from controller require fibre device (CIBF) not much experience with this Radiation Effects Newer simulations show much higher radiation than expected in certain areas Very difficult to mitigate, ongoing work Xilinx CPLDs Our inside man at Xilinx gave us a warning regarding Discontinuation… Requires a deep re-design VHDL More systems than ever use this… We have to be sure we’re on the right lines with the safety

13. benjamin.todd@cern.ch Observations Since 2005 13 of 15 FIN