Beam Loss Monitor System Overview & Reliability

26
08.11.2010 BLM Audit, B.Dehning 1 Beam Loss Monitor System Overview & Reliability Specification System Overview Loss Locations & Detectors Acquisition System & Beam Permit System Tests Fault Tree Software Layout Content

description

Beam Loss Monitor System Overview & Reliability. Content. Specification System Overview Loss Locations & Detectors Acquisition System & Beam Permit System Tests Fault Tree Software Layout. Beam Loss Monitor Specification. 5. USE OF THE BLM’S FOR MACHINE PROTECTION - PowerPoint PPT Presentation

Transcript of Beam Loss Monitor System Overview & Reliability

Page 1: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 108.11.2010

Beam Loss Monitor System Overview & Reliability

Specification

System Overview

Loss Locations & Detectors

Acquisition System & Beam Permit

System Tests

Fault Tree

Software Layout

Content

Page 2: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 208.11.2010

Beam Loss Monitor Specification

5. USE OF THE BLM’S FOR MACHINE PROTECTION

The strategy for machine protection impacts on the BLM design in two ways, its time response and the reliability.

Protection of the machine from beam losses has two aspects:

• protection against beam losses that could lead to damage of equipment,

• protection against beam losses that could lead to a quench of a magnet.

Since a repair of superconducting magnets would take several weeks, the protection against damage has highest priority and damages should be strictly avoided (SIL 3, 1E-8 to 1E-7 1/h).

In case of a quench, the quench protection system would prevent equipment damage. However, the beam would be lost and re-establishing operation would take several hours. Therefore the number of quenches should be minimized

Page 3: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 308.11.2010

Loss Levels and Required Accuracy

Relative loss levels

450 GeV 7 TeV

Damage to components

320/5 1000/25

Quench level 1 1

Beam dump threshold for quench prevention

0.3 0.3/0.4

Warning 0.1 0.1/0.25

Absolute precision (calibration)

< factor 2 initial < factor 5)

Relative precision for quench prevention

< 25%

Functional specification:https://edms.cern.ch/file/328146/2.0/LHC-BLM-ES-0001-20-00.pdf

Page 4: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 408.11.2010

Quench and Damage Levels

Detection of shower particles outside the cryostat or near the collimators to determine the coil temperature increase due to particle losses

DynamicArc: 108

1E-02 1E-01 1E+00 1E+01 1E+02 1E+03 1E+04 1E+05 1E+061E+04

1E+05

1E+06

1E+07

1E+08

1E+09

1E+10

1E+11

1E+12

1E+13

1E+14

1E+15

1E+16

1E+17

1E+18

duration of loss [ms]

qu

ench

leve

ls [

pro

ton

/s]

Quench level and observation range

450 GeV

7 TeV

Damage levels

Time resolution1/2 turn

Page 5: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 508.11.2010

BLM Aims

1. Monitor the 27 km of accelerator to detect dangerous losses. 2. Trigger beam extraction requests to avoid damages of the

superconductive magnets and of other equipments.

The BLMS must be :• 1. SAFE: in case of dangerous loss, it has to inhibit the beam

permit. If it fails, there will be ~30 days of downtime.

• 2. FUNCTIONAL: in case of NO dangerous loss, it has NOT to inhibit the beam. If it fails, it generates a false alarm and 3 h will be lost to recover the previous situation. Such an event will decrease the LHC efficiency.

Page 6: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 608.11.2010

Location of Detectors

1. Distinguish between beams2. Observe losses due to magnet misalignments3. Observe losses due to orbit changes and emittance growth

Impact of protons in the centre of the quad. magnet

Every dangerous loss could be seen just by one detector.

Every dangerous loss could be seen just by one detector.

Page 7: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 7

BLM Signal Chain

08.11.2010

Acquisition Cards (700)

around the LHC ring

Beam Loss Monitors (4000)

Tunnel

Surface

Optical fibres

Page 8: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 808.11.2010

Ionisation Chamber and Secondary Emission Monitor

Stainless steal cylinder Parallel electrodes distance 0.5

cm Diameter 8.9 cm Voltage 1.5 kV Low pass filter at the HV input

IC: Al electrodes Length 60 cm Ion collection time 85 us

N2 gas filling at 1.1 bar

Sensitive volume 1.5 l

SEM: Ti electrodes Components UHV

compatible Steel vacuum fired Detector contains 170 cm2

of NEG St707 to keep the vacuum < 10-4 mbar during 20 years

Signal Ratio: IC/SEM = 60000

Page 9: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 908.11.2010

Ewald EffingerChannel 8

Front End Electronics (FEE)

Front End Electronics (CFC)

Transformation of the current signal in a digital data.

Multiplexing of 8 channels with redundant optical transmission.

Electronics in an harsh environment (radiations).

Transformation of the current signal in a digital data.

Multiplexing of 8 channels with redundant optical transmission.

Electronics in an harsh environment (radiations).

Multi-plexing

and doubling

Optical TX

Digitalization

Optical TX

Page 10: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 1008.11.2010

Back End Electronics (Threshold Comparator)

VM

E B

ackp

lane

Optical RX

Demulti-plexing

Status monitor

FE

E 2

Beam Energy

SU

RFA

CEF

EE

1

Unmaskable beam permits

Maskable beam permits

Back End Electronics (BEE)

Optical RX

Demulti-plexing Signal

selec-tion

Thres-holds comp-arison

Channel selection

and beam

permits gener-ation.

Optical receivers in a mezzanine board.

Data treatment in a Digital Acquisition Board. Energy input for the selection of the threshold levels.

Beam permits connected to the backplane.

Optical receivers in a mezzanine board.

Data treatment in a Digital Acquisition Board. Energy input for the selection of the threshold levels.

Beam permits connected to the backplane.

Christos Zamantzas

Page 11: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 1108.11.2010

Combine & Survey (Combiner)

Reception of the

beam permits and

forwarding them

to the LHC Beam

Interlock System.

Reception and

distribution of the

energy signal to

the BEE cards.

Surveillance:

several testing

process for the

BLMS.

Combiner card

FP

GA

Energy from external system CISRV

Maskable beam permit

Logic switch

Beam Permit from previous Combiner

From last DAB

Unmaskable beam permit

tests, settings, …

From last DAB

Energy Link to BEEs

To next Combiner

Current loops to next Combiner or to LBIS

Logic switch

Logic switch

HT Driver To-from HT (only last Combiner)

Com

para

tors

Voltages and Currents signals from VME power supplies.

Beam Permit Status form LBIS

Mas

kabl

eU

n m

a s

k a

b l

e

VM

E b

ackp

lane

VM

E b

us

Jonathan Emery

Page 12: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 1208.11.2010

VME Crate and Rack

Up to 16 BEE cards and a Combiner card are located in a VME crate.

The beam permit lines of the BEE cards in a crate are daisy chained up to the Combiner

card.

• The energy signal is provided in parallel to each combiner card.

• The energy signal is provided in parallel to each combiner card.

• 25 VME Crates in 8 racks per LHC octant. In each rack there will be a LHC Beam Interlock System user interface.

• The beam permit lines of the Combiner cards in a rack are daisy chained up to the LBIS user interface.

• 25 VME Crates in 8 racks per LHC octant. In each rack there will be a LHC Beam Interlock System user interface.

• The beam permit lines of the Combiner cards in a rack are daisy chained up to the LBIS user interface.

VME crate (up to 16 BEE)

Com

bine

ri

Jonathan Emery

BeamPermit

VME crate (up to 16 BEE)

VME crate (up to 16 BEE)

Com

bine

r

LBIS

Com

bine

r

BeamPermit

BeamPermit

Beam Energy

Page 13: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 1308.11.2010

FEE Dependability

12

Integrator

Comparator

JFET

Iin from IC

Vres

Ires

C

R

A

B

Q

Q

Monostable

Vref

10 pA V

V

V

Ires

-+

ADC 12 LVDS to

CMOS

To

FPG

A

DAC

Δt

Irradiation tests on the analogue

components to investigate hazard

rate variation. Definition of the 10pA test to check

the analogue channel.

Irradiation tests on the analogue

components to investigate hazard

rate variation. Definition of the 10pA test to check

the analogue channel.

• Irradiation tests of the optical

transmitter LASERs.

• Doubling of the optical lines and

two-out-of-three (2oo3) redundancy

in the FPGA.

• Definition of the HT test to check all

the channel functionalities.

• Irradiation tests of the optical

transmitter LASERs.

• Doubling of the optical lines and

two-out-of-three (2oo3) redundancy

in the FPGA.

• Definition of the HT test to check all

the channel functionalities.

Transmission FPGA

Status

Opt

ical

fib

res

to s

urfa

ce

Test logic

HT test request

Channel 8

Mul

tiple

xer

16 b

its f

ram

es

8

20

CR

C g

ener

ator

Mul

tiple

xer

CR

C g

ener

ator

To 10 pA source

Counters

Counters

Counters 2oo3 vote 12

Channel 1

From mono-stable

16

8

20

12

16

2oo3 vote

From ADC

TX

TX

Ewald Effinger

Page 14: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 1408.11.2010

BEE Dependability

Optical cables from FEE A

DAB

Mezzanine

Photo-diode

Trans-ceiver

Photo-diode

Trans-ceiver

Memory: thresholds table

FPGA

Energy from Combiner

CLCK

Q

From current source or previous BEE

To next BEEor Combiner

MASKABLE BEAM PERMITS

CLCK

Q

From current source or previous BEE

To next BEE or Combiner

UNMASKABLE BEAM PERMITS

VME bus

Photo-diode

Trans-ceiver

Photo-diode

Trans-ceiver

Optical cables from FEE B

Energy trans-ceiver

Inactive

Maskable

Unm

askable

Channel Assignment Table

Thresholds values

Definition of the

tests to check the

integrity of the data.

Definition of the

thresholds windows

to minimize the

evaluation error

(see next slide).

Definition of the

tests to check the

integrity of the data.

Definition of the

thresholds windows

to minimize the

evaluation error

(see next slide).

Christos Zamantzas

Page 15: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 1508.11.2010

Combiner card

FP

GA

Energy LINK from external system

Maskable beam permit

Logic switch

Beam Permit from previous Combiner

From last DAB

Unmaskable beam permit

tests, settings, …

From last DAB

Energy Link to BEEs

To next Combiner

Beam Permit to next Combiner or to LBIS

Logic switch

Logic switch

HT Driver To-from HT (only last Combiner)

Com

para

tors

Voltages and Currents signals from VME power supplies.

Beam Permit Status form LBIS

Mas

kabl

eU

n m

a s

k a

b l

e

VM

E b

ackp

lane

8

VM

E b

us

Combiner Dependability

Definition of

the tests to

check whole

signal chain.

Definition of

the criticalities

of the energy

signal.

Definition of

the tests to

check whole

signal chain.

Definition of

the criticalities

of the energy

signal.

Jonathan Emery

Page 16: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 1608.11.2010

Radioactive source test

Functional tests before installation

Barcode check

HV modulation test

Double optical line comparison

Offset to check connectivity (10 pA test)

System component identity check

Beam inhibit lines tests

Detector

Tunnel electronics

Surface electronic

sCombiner

Inspection frequency:

Reception Installation and yearly maintenance Before (each) fill Parallel with beam

Current source test

Threshold table data base comparison

Functional Tests Overview PhD thesis G. Guaglio

Page 17: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 1708.11.2010

AND Gate

EVENT1 EVENT2

AND Gate

EVENT1 EVENT2

Fault Tree Analysis

The probability to have an Failure Mode A, Pr{A}, is calculated per each Failure Modes of the FMECA, given the hazard rate, the repair rate and the inspection period .

The probability to have an Failure Mode A, Pr{A}, is calculated per each Failure Modes of the FMECA, given the hazard rate, the repair rate and the inspection period .

OR Gate

EVENT1 EVENT2

OR Gate

EVENT1 EVENT2

DamageRisk

BlindFEE

BlindBEE

False Alarmby

transmission

Opticalline 1

Opticalline 2

02_FAQ=0.0336 w=0.00275

False Alarm

Channel _FAQ=0.00513 w=0.000427

Channel FalseAlarm

DigFEE _FAQ=0.000125 w=1.04e-5

Digital FEEFalse Alarm

TunnnelPS_FAQ=0.0191 w=0.00158

False alarmgenerated bytunnel Power

Supply

BEE _FAQ=9.35e -5 w=7.79e-6

Back EndElectronic

False Alarm

Crate _FAQ=7.12e-6 w=5.99e-7

Crateselectronics

False Alarms

VMEunit _FAQ=0.00946 w=0.000784

VME unitFalse Alarms

OL_equiv_FA

642 redudantOptical link ,

w

r=5.30677e-007 tau=12

Q=3.18e-6 w=5.31e -7

Memory .01

MechanicalFailure (325)

r =9. 2713e- 011 n=325 m =1

Q=3.62e-7 w=3.01e-8

Memory .02

ElectricalFailure (325)

r =3. 0858e- 011 n=325 m =1

Q=1.2e-7 w=1e-8

HTcon _FA_CQ=4.82e-5 w=4.02e-6

HT connectorsFalse Alarms,

Continuous check

Page 11

IC_FA_CQ=0.000368 w=3.07e-5

IonizationChamber False

Alarm,Continuous check

Page 12

Channel _FA_10pA

Q=0.00472 w=0.000392

CFC FalseAlarm , 10pA

check

Page 13

PSarc_FA_CQ=2.5e-5 w=2.08e-6

Arc PowerSupplies False

Alarm,Continuous check

Page 16

PSSS_FA_CQ=0.0191 w=0.00158

Straight SectionPS False Alarm,

Continuous check

Page 17

PSVME_FA_CQ=9.75e-9 w=1.95e-8

PS VME FalseAlarm,

Continuous check

Page 20

VMEfans_FA_CQ=0.00946 w=0.000784

VME fantray FalseAlarm,

Continuous check

Page 21

BEE _FA_CQ=8.58e-5 w=7.15e-6

Back Endelectronic False

Alarm,Continuous check

Page 18

BEE _FA_LQ=7.71e-6 w=6.43e-7

Back Endelectronic False

Alarm, Loggingcheck

Crate _FA_CQ=5.47e-6 w=4.62e-7

Crates electronicsFalse Alarms,

Continuous check

Page 19

CombFPGA_FA_L

Q=1.65e -6 w=1.37e-7

Combiner FPGAFalse Alarm,

Loggin check

Memory_FA_LQ=4.82e-7 w=4.02e-8

No thresholds(325)

FPGARXen _FA_L

Q=7.14e-6 w=5.95e-7

No energyupdating from

combiner

TransceiverEn_FA_L

Q=9.55e -8 w=7.96e-9

Wrong energysignal fromtransceiver

DigFEE _FA_CQ=0.000108 w=8.97e-6

Digital FEE FalseAlarm,

Continuous check

Page 14

DigFEE_FA_10pA

Q=1.74e-5 w=1.45e-6

Digital FEEFalse Alarm ,10pA check

Page 15

FPGARX.0.3_1

Wrong energyfrom Combiner

(325)

r=1.83e-009 n=325 m=1

Q=7.14e-6 w=5.95e-7

Transceiver .0.6_1

Data Bit Error(325)

r=2.448e-011 n=325 m=1

Q=9.55e -8 w=7.96e-9

Combiner FPGA.02_1

Internal error

r=5.49e-009 n=25 m=1

Q=1.65e -6 w=1.37e-7

CombBPin_FA_L

Q=1.65e -6 w=1.37e-7

Wrongcombinerbackplane

OL_equiv_FA:r= r(OL_FA)* n

tau=missiontime

To run with lifetime= mission time (12

h)

02_FAQ=0.0336 w=0.00275

False Alarm

Channel _FAQ=0.00513 w=0.000427

Channel FalseAlarm

DigFEE _FAQ=0.000125 w=1.04e-5

Digital FEEFalse Alarm

TunnnelPS_FAQ=0.0191 w=0.00158

False alarmgenerated bytunnel Power

Supply

BEE _FAQ=9.35e -5 w=7.79e-6

Back EndElectronic

False Alarm

Crate _FAQ=7.12e-6 w=5.99e-7

Crateselectronics

False Alarms

VMEunit _FAQ=0.00946 w=0.000784

VME unitFalse Alarms

OL_equiv_FA

642 redudantOptical link ,

w

r=5.30677e-007 tau=12

Q=3.18e-6 w=5.31e -7

Memory .01

MechanicalFailure (325)

r =9. 2713e- 011 n=325 m =1

Q=3.62e-7 w=3.01e-8

Memory .02

ElectricalFailure (325)

r =3. 0858e- 011 n=325 m =1

Q=1.2e-7 w=1e-8

HTcon _FA_CQ=4.82e-5 w=4.02e-6

HT connectorsFalse Alarms,

Continuous check

Page 11

IC_FA_CQ=0.000368 w=3.07e-5

IonizationChamber False

Alarm,Continuous check

Page 12

Channel _FA_10pA

Q=0.00472 w=0.000392

CFC FalseAlarm , 10pA

check

Page 13

PSarc_FA_CQ=2.5e-5 w=2.08e-6

Arc PowerSupplies False

Alarm,Continuous check

Page 16

PSSS_FA_CQ=0.0191 w=0.00158

Straight SectionPS False Alarm,

Continuous check

Page 17

PSVME_FA_CQ=9.75e-9 w=1.95e-8

PS VME FalseAlarm,

Continuous check

Page 20

VMEfans_FA_CQ=0.00946 w=0.000784

VME fantray FalseAlarm,

Continuous check

Page 21

BEE _FA_CQ=8.58e-5 w=7.15e-6

Back Endelectronic False

Alarm,Continuous check

Page 18

BEE _FA_LQ=7.71e-6 w=6.43e-7

Back Endelectronic False

Alarm, Loggingcheck

Crate _FA_CQ=5.47e-6 w=4.62e-7

Crates electronicsFalse Alarms,

Continuous check

Page 19

CombFPGA_FA_L

Q=1.65e -6 w=1.37e-7

Combiner FPGAFalse Alarm,

Loggin check

Memory_FA_LQ=4.82e-7 w=4.02e-8

No thresholds(325)

FPGARXen _FA_L

Q=7.14e-6 w=5.95e-7

No energyupdating from

combiner

TransceiverEn_FA_L

Q=9.55e -8 w=7.96e-9

Wrong energysignal fromtransceiver

DigFEE _FA_CQ=0.000108 w=8.97e-6

Digital FEE FalseAlarm,

Continuous check

Page 14

DigFEE_FA_10pA

Q=1.74e-5 w=1.45e-6

Digital FEEFalse Alarm ,10pA check

Page 15

FPGARX.0.3_1

Wrong energyfrom Combiner

(325)

r=1.83e-009 n=325 m=1

Q=7.14e-6 w=5.95e-7

Transceiver .0.6_1

Data Bit Error(325)

r=2.448e-011 n=325 m=1

Q=9.55e -8 w=7.96e-9

Combiner FPGA.02_1

Internal error

r=5.49e-009 n=25 m=1

Q=1.65e -6 w=1.37e-7

CombBPin_FA_L

Q=1.65e -6 w=1.37e-7

Wrongcombinerbackplane

OL_equiv_FA:r= r(OL_FA)* n

tau=missiontime

To run with lifetime= mission time (12

h)

02_FAQ=0.0336 w=0.00275

False Alarm

Channel _FAQ=0.00513 w=0.000427

Channel FalseAlarm

DigFEE _FAQ=0.000125 w=1.04e-5

Digital FEEFalse Alarm

TunnnelPS_FAQ=0.0191 w=0.00158

False alarmgenerated bytunnel Power

Supply

BEE _FAQ=9.35e -5 w=7.79e-6

Back EndElectronic

False Alarm

Crate _FAQ=7.12e-6 w=5.99e-7

Crateselectronics

False Alarms

VMEunit _FAQ=0.00946 w=0.000784

VME unitFalse Alarms

OL_equiv_FA

642 redudantOptical link ,

02_FAQ=0.0336 w=0.00275

False Alarm

Channel _FAQ=0.00513 w=0.000427

Channel FalseAlarm

DigFEE _FAQ=0.000125 w=1.04e-5

Digital FEEFalse Alarm

TunnnelPS_FAQ=0.0191 w=0.00158

False alarmgenerated bytunnel Power

Supply

BEE _FAQ=9.35e -5 w=7.79e-6

Back EndElectronic

False Alarm

Crate _FAQ=7.12e-6 w=5.99e-7

Crateselectronics

False Alarms

VMEunit _FAQ=0.00946 w=0.000784

VME unitFalse Alarms

OL_equiv_FA

642 redudantOptical link ,

w

r=5.30677e-007 tau=12

Q=3.18e-6 w=5.31e -7

Memory .01

MechanicalFailure (325)

r =9. 2713e- 011 n=325 m =1

Q=3.62e-7 w=3.01e-8

Memory .02

ElectricalFailure (325)

r =3. 0858e- 011 n=325 m =1

Q=1.2e-7 w=1e-8

HTcon _FA_CQ=4.82e-5 w=4.02e-6

HT connectorsFalse Alarms,

Continuous check

Page 11

IC_FA_CQ=0.000368 w=3.07e-5

IonizationChamber False

w

r=5.30677e-007 tau=12

Q=3.18e-6 w=5.31e -7

Memory .01

MechanicalFailure (325)

r =9. 2713e- 011 n=325 m =1

Q=3.62e-7 w=3.01e-8

Memory .02

ElectricalFailure (325)

r =3. 0858e- 011 n=325 m =1

Q=1.2e-7 w=1e-8

HTcon _FA_CQ=4.82e-5 w=4.02e-6

HT connectorsFalse Alarms,

Continuous check

Page 11

IC_FA_CQ=0.000368 w=3.07e-5

IonizationChamber False

Alarm,Continuous check

Page 12

Channel _FA_10pA

Q=0.00472 w=0.000392

CFC FalseAlarm , 10pA

check

Page 13

PSarc_FA_CQ=2.5e-5 w=2.08e-6

Arc PowerSupplies False

Alarm,Continuous check

Page 16

PSSS_FA_CQ=0.0191 w=0.00158

Straight SectionPS False Alarm,

Continuous check

Page 17

PSVME_FA_CQ=9.75e-9 w=1.95e-8

PS VME FalseAlarm,

Continuous check

Page 20

VMEfans_FA_CQ=0.00946 w=0.000784

VME fantray FalseAlarm,

Continuous check

Page 21

BEE _FA_CQ=8

Alarm,Continuous check

Page 12

Channel _FA_10pA

Q=0.00472 w=0.000392

CFC FalseAlarm , 10pA

check

Page 13

PSarc_FA_CQ=2.5e-5 w=2.08e-6

Arc PowerSupplies False

Alarm,Continuous check

Page 16

PSSS_FA_CQ=0.0191 w=0.00158

Straight SectionPS False Alarm,

Continuous check

Page 17

PSVME_FA_CQ=9.75e-9 w=1.95e-8

PS VME FalseAlarm,

Continuous check

Page 20

VMEfans_FA_CQ=0.00946 w=0.000784

VME fantray FalseAlarm,

Continuous check

Page 21

BEE _FA_CQ=8.58e-5 w=7.15e-6

Back Endelectronic False

Alarm,Continuous check

Page 18

BEE _FA_LQ=7.71e-6 w=6.43e-7

Back Endelectronic False

Alarm, Loggingcheck

Crate _FA_CQ=5.47e-6 w=4.62e-7

Crates electronicsFalse Alarms,

Continuous check

Page 19

CombFPGA_FA_L

Q=1.65e -6 w=1.37e-7

Combiner FPGAFalse Alarm,

Loggin check

Memory_FA_LQ=4.82e-7 w=4.02e-8

No thresholds(325)

FPGARXen _FA_L

Q=7.14e-6 w=5.95e-7

No energy

.58e-5 w=7.15e-6

Back Endelectronic False

Alarm,Continuous check

Page 18

BEE _FA_LQ=7.71e-6 w=6.43e-7

Back Endelectronic False

Alarm, Loggingcheck

Crate _FA_CQ=5.47e-6 w=4.62e-7

Crates electronicsFalse Alarms,

Continuous check

Page 19

CombFPGA_FA_L

Q=1.65e -6 w=1.37e-7

Combiner FPGAFalse Alarm,

Loggin check

Memory_FA_LQ=4.82e-7 w=4.02e-8

No thresholds(325)

FPGARXen _FA_L

Q=7.14e-6 w=5.95e-7

No energyupdating from

combiner

TransceiverEn_FA_L

Q=9.55e -8 w=7.96e-9

Wrong energysignal fromtransceiver

DigFEE _FA_CQ=0.000108 w=8.97e-6

Digital FEE FalseAlarm,

Continuous check

Page 14

DigFEE_FA_10pA

Q=1.74e-5 w=1.45e-6

Digital FEEFalse Alarm ,10pA check

Page 15

FPGARX.0.3_1

Wrong energyfrom Combiner

(325)

r=1.83e-009 n=325 m=1

Q=7.14e-6 w=5.95e-7

Transceiver .0.6_1

Data Bit Error(325)

r=2.448e-011 n=325 m

updating fromcombiner

TransceiverEn_FA_L

Q=9.55e -8 w=7.96e-9

Wrong energysignal fromtransceiver

DigFEE _FA_CQ=0.000108 w=8.97e-6

Digital FEE FalseAlarm,

Continuous check

Page 14

DigFEE_FA_10pA

Q=1.74e-5 w=1.45e-6

Digital FEEFalse Alarm ,10pA check

Page 15

FPGARX.0.3_1

Wrong energyfrom Combiner

(325)

r=1.83e-009 n=325 m=1

Q=7.14e-6 w=5.95e-7

Transceiver .0.6_1

Data Bit Error(325)

r=2.448e-011 n=325 m=1

Q=9.55e -8 w=7.96e-9

Combiner FPGA.02_1

Internal error

r=5.49e-009 n=25 m=1

Q=1.65e -6 w=1.37e-7

CombBPin_FA_L

Q=1.65e -6 w=1.37e-7

Wrongcombinerbackplane

OL_equiv_FA:r= r(OL_FA)* n

tau=missiontime

To run with lifetime= mission time (12

h)

Almost 160 Failure Modes have been defined for the BLMS using the FMD-97 standard.

Three Ends Effects:1. Damage Risk: probability not to be ready in case of dangerous loss. 2. False Alarm: probability to generate a false alarm.3. Warning: probability to generate a maintenance request

following a failure of a redundant component.

Three Ends Effects:1. Damage Risk: probability not to be ready in case of dangerous loss. 2. False Alarm: probability to generate a false alarm.3. Warning: probability to generate a maintenance request

following a failure of a redundant component.

Page 18: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 1808.11.2010

Fault Trees Results

The probabilities to fail (unavailability) for the BLMS have been calculated.

Per each End Effects, the major contributors to such probabilities have been pointed out too.

Consequencesper year

Weakest components Notes

DamageRisk

5·10-4

(100 dangerouslosses)

Detector (88%)

Analogue electronics (11%)

Detector likely overestimated (60% CL of no failure after1.5 106 h).

FalseAlarm

13 ± 4Tunnel power supplies

(57%)VME fans (28%)

Tunnel power supplies likely underestimated (see sensitivity example).

Warning 35 ± 6Optical line

(98%)VME PS ( 1%)

LASER hazard rate likely overestimated by MIL.

Page 19: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning08.11.2010

System settings& data flow

Beam permit

signal flow

Page 20: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 2008.11.2010

Reliability and Time Resolution

Type Area of use Criticality

Time resolution

Ion chamber + SEM

Collimation sections

yes 1 turn

Ion chamber + SEM

Critical aperture limits or critical positions

yes 1 turn(89 us)

Ion chamber All along the rings (ARC, …)

no 2.5 ms (7.4.4)

Definition (specs): By criticality, we mean that the system must be 100% operational to allow beam injection and that the beam is dumped if it fails.

In case of a non working monitor this monitor has to be repaired before the next injection

Page 21: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 2108.11.2010

Ionisation chamber currents (1 litre)

Collimation All others

450 GeV, quench levels (min) 100 s 3.3 mA 12.5 nA

7 TeV, quench levels (min) 100 s 100 uA 2 nA

Required 25 % rel. accuracy, error small against 25% => 5 %

100 pA

450 GeV, dynamic range min. 10 10 pA

100 33 nA 2.5 pA

7 TeV, dynamic range min. 10 s 160 pA

100s 1.1 nA 80 pA

Page 22: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 2208.11.2010

Gain Variation of SPS Chambers

30 years of operation Measurements done with

installed electronic Relative accuracy

/Ds s < 0.01 (for ring BLMs) /Ds s < 0.05 (for Extr., inj.

BLMs) Gain variation only observed

in high radiation areas Consequences for LHC:

No gain variation expected in the straight section and ARC of LHC

Variation of gain in collimation possible for ionisation chambers

SPS BLMs

02468

101214161820

36 42 48 54 60 66M

ore

current [pA]

Fre

qu

en

cy

dis

trib

uti

on

0

20

40

60

80

100

120

140

160

Extr., inj. BLMs

Ring BLMs

Test with Cs137

Total received dose: ring 0.1 to 1 kGy/yearextr 0.1 to 10 MGy/year

Page 23: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 2308.11.2010

BLMS Predictions

Rates collected mainly from the suppliers, then from historical data, and

finally from the MIL-HDBK 217F.

True rate.Constant.

r(t)

tLifetime

Earlyfailures

Randomfailures

Wearoutfailures

Hazard rates are assumed to be constant. After a short initial period, this assumption overestimates the

failure rates.

Hazard rates are assumed to be constant. After a short initial period, this assumption overestimates the

failure rates.

The Prediction is the estimation of the hazard rate of the components. The Prediction is the estimation of the hazard rate of the components.

Page 24: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 2408.11.2010

Predictions Uncertainties

The Dependability Analysis will be performed on the central values.

The effect of the uncertainties on the dependability results will be

estimated by the Sensitivity Analysis.

The Dependability Analysis will be performed on the central values.

The effect of the uncertainties on the dependability results will be

estimated by the Sensitivity Analysis.

SupplierSupplierl of the power supply in the arc:2·10-9/h.

l of the power supply in the arc:2·10-9/h.

l of similar power supply in the tunnel:2·10-6/h.

l of similar power supply in the tunnel:2·10-6/h.

Uncertainty is given by the unknown supplier test procedures.

Uncertainty is given by the unknown supplier test procedures.

HistoricalHistorical216 detectors had no failure over 20 years (of 4800 hours).

216 detectors had no failure over 20 years (of 4800 hours).

Assumption: is constant. < 4·10-8/h (60% of CL) 1·10-8/h < < 8·10-8/h (95%)

Assumption: is constant. < 4·10-8/h (60% of CL) 1·10-8/h < < 8·10-8/h (95%)

Uncertainty is given by the lack of failures.

Uncertainty is given by the lack of failures.

Military handbookMilitary handbook

has been evaluated by tests of electronics 20 years ago.

has been evaluated by tests of electronics 20 years ago.

New electronics evaluation (IEC standard) lower .

New electronics evaluation (IEC standard) lower .

MIL to be comparable with other LHC studies and to be conservative.

MIL to be comparable with other LHC studies and to be conservative.

Page 25: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 2508.11.2010

Failure Rate and Checks

Systems parallel + survey + functional check:

1. in case of system failure dump beam (failsafe)

2. verification of functionality: simulate measurement and

comparison with expected result => as good as new

0.00000001

0.0000001

0.000001

0.00001

0.0001

0.001

0.01

0 50 100 150 200 250 300

time [a.u.]

failu

re r

ate

[a

. u.]

constant f. r.

systems parallel

systems parallel + surv.

systems parallel + surv. + check

Page 26: Beam Loss Monitor System Overview & Reliability

BLM Audit, B.Dehning 2608.11.2010

BEE Thresholds Levels

An error less

than 25% in the

approximation

of the threshold

lines is reached

with 11 times

windows and 32

energy steps.

Arc average counts to beam inhibition

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

1.E+00

1.E+01

1.E+02

1.E+03

1.E-02 1.E-01 1.E+00 1.E+01 1.E+02 1.E+03 1.E+04 1.E+05loss duration [ms]

Ave

rage

cou

nts

450 GeV max 7 Tev minAppriximated 450 GeV Approximated 7 TeV

11

1 23 4 5

67

89

10