6 th MPEPE Beam Impact Meeting V Vatansever

6 th MPE-PE Beam Impact Meeting – V. Vatansever Connection between LHC BIS and LBDS re-triggering system: dependability studies 10/3/2020 Volkan Vatansever 2

Outline Overview and considerations of the connection between LHC BIS and LBDS retriggering system • Short summary: Dependability studies on the Trigger Delay Unit • Dependability studies on the Link between the BIS and the Trigger Delay Unit • 10/3/2020 Volkan Vatansever 3

Retriggering Lines The New Connection beam dump request TSU TFO MKD 1 … BIS Link to delay requested: MKD 15 Delay 200 µs Delay 250 µs • In case of TSDS failure • additional connection of the beam dump signal from the BIS to the LBDS Asynchronous beam dump re-triggering line. after 250 µs 10/3/2020 Volkan Vatansever 4

Open BIS loop to avoid false ABDs Trigger Delay Unit Link to Delay Retriggering Lines Layout of the New Connection Trigger Delay Unit BIS Trigger Delay Unit Link to Delay Open BIS loop to avoid false ABDs Trigger Delay Unit ABD: Asynchronous Beam Dump 10/3/2020 Volkan Vatansever 5

Technical considerations and goals • • Modify as little as possible the BIS Obtain SIL level Not more than 1 false asynchronous beam dump in 10 years Not more than 2 false synchronous beam dumps per year Reliability analysis of Trigger Delay Unit and the Link 10/3/2020 Volkan Vatansever 6

Main failure modes of the TDU 1. False asynchronous beam dump • 2. System not available on demand • 3. TDU causes an asynchronous beam dump although the LBDS is working TDU cannot forward the trigger Silent failures, failures w/o effect on output • • Loss of redundancy Loss of additional functions 10/3/2020 Volkan Vatansever 7

TDU: Asynchronous Beam Dumps 1 Probability for ABDs over Time 0. 9 0. 8 MTTF: 275 years 0. 7 Probability 0. 6 0. 5 Failure Probability Four TDUs Failure Probability One TDU 0. 4 0. 3 10% Failure Probability: 29 years 0. 2 0. 1 0 0 50 100 150 10/3/2020 200 250 Time [Years] 300 350 400 Volkan Vatansever 450 500 8

Link to TDU: design Beam Permit Trigger for TDU A Masking the BIS LBDS local mode Beam Permit 10/3/2020 Trigger for TDU B Volkan Vatansever 9

LBDS local mode 10/3/2020 Volkan Vatansever 10

Link to TDU: failure modes and effects Gates • Failure mode: “stuck in TRUE/FALSE” • Effect: Downtime (No user permit from the CIBU or no trigger from the TDU) 10/3/2020 Volkan Vatansever 11

Link to TDU: failure modes and effects MOSFET driver • Spurious triggers, causes asynchronous and synchronous beam dumps • No output: downtime 10/3/2020 Volkan Vatansever 12

Link to TDU: failure modes and effects Optocoupler • Failures cause downtime or synchronous beam dumps 10/3/2020 Volkan Vatansever 13

Link to TDU: failure modes and effects CPLD • Failures cause beam dumps • Software reliability not included yet 10/3/2020 Volkan Vatansever 14

Component failure rates Component Total failure rate [FIT] Schmitt-Trigger Buffer 2 / 79 Inductors 3 MOSFET Driver 4 / 54 Optocoupler 8 / 270 Hex Schmitt-Trigger Inverter 3 / 26 Gates 12 / 74 Connectors 36 Fuses 40 Capacitors 56 Diodes 151 Resistors 170 CPLD 6 / 70 10/3/2020 Source Manufacturer / MIL-217 Manufacturer / MIL-217 MIL-217 Manufacturer / MIL-217 Volkan Vatansever 15

Main failure modes of the Link 1. False Asynchronous Beam Dumps • 2. False Synchronous Beam Dumps • 3. Link causes an Asynchronous Beam Dump although the LBDS is working Link will spuriously open the BIS Loop Downtime, silent failures, failures w/o effect on output 10/3/2020 Volkan Vatansever 16

ABDs Link and TDU 1 Probability for ABDs over Time 0. 9 0. 8 Failure Probability Four TDU Failure Probability One TDUs Failure Probability One Link Failure Probability Two Links Total Pobability for ABDs MTTF: 249 years 0. 7 Probability 0. 6 0. 5 0. 4 0. 3 10% Failure Probability: 26 years 0. 2 0. 1 0 0 50 100 150 10/3/2020 200 250 Time [Years] 300 350 400 Volkan Vatansever 450 500 17

SBDs Link (preliminary) 1 Probability for SBDs over Time 0. 9 0. 8 MTTF: 101 years 0. 7 Failure Probability One Link Probability 0. 6 Failure Probability Two Links 0. 5 0. 4 0. 3 10% Failure Probability: 10 years 0. 2 0. 1 0 0 50 100 150 10/3/2020 200 250 Time [Years] 300 350 400 Volkan Vatansever 450 500 18

Downtime caused by the Link (preliminary) 1 Probability for LHC Downtime due to detectable failures over Time 0. 9 0. 8 MTTF: 311 years 0. 7 Probability 0. 6 10% Failure Probability: 33 years 0. 5 0. 4 Failure Probability One Link 0. 3 0. 2 Failure Probability Two Links 0. 1 0 0 50 100 150 10/3/2020 200 250 Time [Years] 300 350 400 Volkan Vatansever 450 500 19

Summary system reliability Some components in the reliability analysis of the Link are still missing • Failure modes and effects will be rechecked • Implementation and powering to be investigated • • Looks like goals will be achieved! • • 4% probability for ABDs in 10 years for the whole system expected 10% probability for SBDs in 10 year for the whole system expected (preliminary) 10/3/2020 Volkan Vatansever 20

Thank you! 10/3/2020 Volkan Vatansever 21

Different solutions investigated: • • One path for LBDS local mode + fewer components, less failures - single point of failure: logic gate Connection to the CIBU + spurious triggers wont cause an asynchronous beam dump - more connectors, more synchronous beam dumps? Combining the signals to trigger both retriggering lines at the same time after a dump request + shortens time to dump - new failure modes, single points of failures possible, post analysis difficult, silent failures possible 10/3/2020 Volkan Vatansever 24

Trigger Delay Unit (TDU) 10/3/2020 Volkan Vatansever 27

Reliability block diagrams TDU failure modes Asynchronous beam dump Trigger Delay Unit System not available on demand Trigger Delay Unit 10/3/2020 Volkan Vatansever 28

LBDS in Local Mode Asynchronous beam dump IC 10 & MOSFET Driver Local Mode 10/3/2020 Volkan Vatansever 29

Open Diode BYV 27 -200 10/3/2020 Volkan Vatansever 30

TDU not available on demand • • 21 components contribute Effect: TDU cannot forward trigger Short resistor 10/3/2020 Volkan Vatansever 31

Other failures TDU • 337 FIT w/o effect on output • • • Redundant components Detectable failures (changes in delay time) Other failures with no effect on trigger delay 10/3/2020 Volkan Vatansever 32

1 Failure Probabilities TDU 0. 9 0. 8 Failure Probability 0. 7 0. 6 MTTF = 390 years MTTF =27000 years 0. 5 ABD (TDU) 0. 4 No Output (TDU) 0. 3 10% failure probability after 41 years 0. 2 10% failure probability after 2870 years 0. 1 0 0 100 200 300 10/3/2020 400 Years 500 600 700 Volkan Vatansever 800 33

Other failures Backup power Redundant power supply Parameter change in threshhold 10/3/2020 Volkan Vatansever 34

Reliability block diagrams Link failure modes Asynchronous beam dump Link System not available on demand Link 10/3/2020 Volkan Vatansever 35

Link to TDU: status of analysis reliability analysis is in early state • different designs regarded • • • Analogic / digital Redundant paths in the link Combining the output signals to trigger both retriggering lines at the same time Backlink opening the BIS to prevent spurious triggers causing an ABD 10/3/2020 Volkan Vatansever 36