• M. Kwiatkowski, A. Castañeda, B. Todd
  CERN, Geneva

Mission critical systems at the European Organisation for Nuclear Research (CERN) make extensive use of Programmable Logic Devices (PLDs) such as Field Programmable Gate Arrays (FPGAs) to implement their safety critical functions. The dependability of these safety critical functions is difficult to determine using traditional techniques. A robust approach is needed if PLD technology is to be accepted in mission critical systems. This paper discusses techniques which are being developed and employed by CERN to give confidence in the use of PLDs in mission critical systems, the Safe Machine Parameter system development is used as an example.

• B. Puccio, A. Castañeda, M. Kwiatkowski, I. Romera, B. Todd
  CERN, Geneva

A complex Machine Protection System has been designed to protect the LHC machine from an accidental release of the beam energy, with about 20 subsystems providing status information to the Beam Interlock System (BIS). Only if the subsystems are in the correct state for beam operation, the BIS receives a status flag and beam can be injected into LHC. The BIS also relays commands from the connected subsystems in case of failure for emergency extraction of beam to the LHC Beam Dump Block. To maintain the required level of safety of the BIS, the performance of the key components is verified before every fill of the machine and validated after every emergency beam dump before beam operation is allowed to continue. This includes all critical paths, starting from the inputs from connected system triggering a beam dump request, followed by the correct interruption and propagation sequence of the two redundant beam permit loops until the final extraction of the beam via the LHC beam dumping system. In this paper we report about the experience with the BIS that has been deployed for some years in the SPS (as LHC injector), in the transfer lines between SPS and LHC and recently in LHC.