12th Int. Beam Instrum. Conf.
ISBN: 9 7 8 - 3 - 9 5 4 5 0 - 2 3 6 - 3

IBIC2023, Saskatoon, Canada
JACoW Publishing
ISSN: 2 6 7 3 - 5 3 5 0d o i : 1 0 . 1 8 4 2 9 / J A C o W - I B I C 2 0 2 3 - T U P 0 4 1

R. Keane†, K. Harkay, N. Sereno, Argonne National Laboratory, Lemont, IL, USA
A. Caracappa, C. Danneil, K. Ha, J. Mead, D. Padrazo
Brookhaven National Laboratory, Upton, NY, USA
Abstract
The Advanced Photon Source upgrade (APS-U) replaces
the APS storage ring with a new Multi-Bend Acromat(MBA) storage ring utilizing on-axis swap-out injection
requiring up to 20 nC charge per injected electron bunch,more than a three-fold increase from the original ring.
Enforcement of radiation safety limits for the new storage
ring will be accomplished by a new beam charge monitor
interlock that acquires the accumulated beam charge in theBooster-to-Storage ring (BTS) transfer line and disables
injection when the charge limit over a pre-set time period
is exceeded. The new interlock is based on the existing
APS Beam Shut-Off Current Monitor (BESOCM) that has
been in operation in the APS injector for many years andincorporates significant improvements over the existing
system. New features include use of direct digitization andFPGA processing, extensive remote monitoring capabilities, expanded self-test and fail-safe functions, and theability to adjust settings and monitor status remotely via
EPICS. The new device integrates a test pulse (self-check)feature that verifies the integrity of the integrating beam
current transformer (ICT) and cable system used to detect
the beam signal. This paper describes the new BTS
interlock (BESOCM) design and presents results of benchtest and in-machine evaluation of the prototype andproduction units.

INTRODUCTION
The existing APS BESOCM system limits the amount ofaccelerated charge in the APS Linac over a 1 minuteaccumulation period in order to enforce radiation safety
requirements. If the limit is exceeded, the BESOCM
disables the beam by inhibiting several necessary systems.
The BESOCM continually tests itself by creating a single
test pulse of ~2.5 nC after every beam trigger and sending
the pulse through a test winding in the current transformer
in the beam line, and has some addition fail-safes thatmonitor the trigger and integration gate [1,2].
The new BTS BESOCM will function similarly to thelegacy system, but with far more adjustments and self-test
functions, and will include robust remote monitoring
capabilities.

beam for a variety of abnormal conditions. The system uses
dual redundant chains denoted A and B, and relies on fault
tolerant hardware such as relay contacts and PLCs. The
BTS BESOCM electronics chassis contains two redundantsets of electronics that interface to the ACIS system viasafety rated relays.

APS Radiation Safety and FPGA Development
APS radiation safety requirements are stated in APS
safety assessment documents and specify the risks andconsequences of off-normal beam loss events [3]. Since theBTS BESOCM is a layer of protection added as part of theMBA upgrade, the FPGA firmware development process
followed a graded approach based on the low specified
risk, i.e., identical hardware was used in both chains A &B with separate firmware developers for each chain. Eachdeveloper worked independently to implement the FPGA
functions as defined in the BESOCM engineering
specification document. Independent code reviews werealso performed on each FPGA code design.

BTS BESOCM SYSTEM DESIGN
Figure 1 shows a block diagram of the BESOCM
system. The electron beam bunch charge is sensed by an
Integrating Current Transformer (ICT) in the BTS beamline. The ICT has two independent identical test windingsthat allow beam to be simulated by passing a test pulse
through the winding. One test winding is always in use
during BESOCM operation, to provide the self-test pulse
to the ICT. The second winding is used only during
validation or testing. The ICT connects to the BESOCM
electronics chassis, located outside the beam tunnel, via
three coax cables.

APS ACIS System
The APS Access Control and Interlock System (ACIS)
includes both personnel protection and radiation safety
interlocks that act to disable accelerated and/or stored___________________________________________

Figure 1: BESOCM system block diagram.

* Work supported by the U.S. Department of Energy, Office of Science,
under Contract No. DE-AC02-06CH11357† keane@anl.gov

TUP04106 Beam Charges and Current Monitors

281

Content from this work may be used under the terms of the CC-BY-4.0 licence (© 2023). Any distribution of this work must maintain attribution to the author(s), title of the work, publisher, and DOI

APS UPGRADE RADIATION SAFETY BEAM CURRENT INTERLOCK*Content from this work may be used under the terms of the CC-BY-4.0 licence (© 2023). Any distribution of this work must maintain attribution to the author(s), title of the work, publisher, and DOI

12th Int. Beam Instrum. Conf.
ISBN: 9 7 8 - 3 - 9 5 4 5 0 - 2 3 6 - 3IBIC2023, Saskatoon, CanadaJACoW Publishing
ISSN: 2 6 7 3 - 5 3 5 0d o i : 1 0 . 1 8 4 2 9 / J A C o W - I B I C 2 0 2 3 - T U P 0 4 1

The BESOCM performs the following measurements oneach electron bunch, and will trip ACIS if any are outsidepreset limits:
Accumulated beam charge
Single beam bunch charge
Beam timing

Correct beam timing is determined by comparing thearrival time of a detected bunch to the expected window
based on the timing of the external trigger.
For each of three test pulses, the following checks areperformed, and if the result is outside preset limits, a fault
is generated:
Pulse charge (integration)
Pulse amplitude (peak)
FWHM
Baseline

In addition to beam and test pulse generated faults, theBESOCM has several system fail-safes faults (see Table 1).
Table 1: Fault Conditions
Fault #12
34
5
6
7
8
9101112131415
16Condition
Beam Pulse HighBeam Accumulator HighBeam Baseline Integrity
Test Pulse 1 FailTest Pulse 2 Fail
Test Pulse 3 FailCRC BadCharge Outside Window
Power Bad
ADC Saturation
Keylock in Program
Force Trip
ACIS Reset Hold-off
No Clockreserved
No Trigger200 Msps, 16-bit ADC for the BESOCM design(LTC2107). The ICT is available from the manufacturewith an optional test winding. We requested a custom ICT
design with two test windings to allow for validations to be
performed without impacting the self-test function.
As in our existing BESOCM system, a single ICT is usedfor both chains; each chain independently analyses the selftest pulses to provide redundancy. In response to ourrequest, the ICT manufacturer (Bergoz) performed failure
testing of ICTs by creating various failure conditions andrecording the effects on the ICT response. The results
demonstrate that the BESOCM self-test pulse function willdetect ICT failures such as windings shorted or open,
internal component failures, etc. This testing provided
additional justification for using a single common ICT for
both chains [4].

BESOCM CHASSIS DESIGNThe BESOCM chassis (see Figs. 2 and 3) contains several
circuit boards:FPGA Processing Boards (A & B)
Test Pulse Generator Board
ICT Buffer and Fan-out Board
ACIS Interface (Relay) Board
Power Supply Distribution Board

A brief description of each board is given below.

Figure 2: BESOCM chassis, front view.

Any fault will trip the ACIS relay to the unsafe state andlatch until reset. The reset can only be accomplishedmanually, either by pressing the front panel reset button or
via a remote reset signal input on the ACIS DB9 connector(see Fig. 1). The BESOCM front panel provides an LEDindicator for each of the faults listed in Table 1. An EPICS
PV is also available for each fault for remote monitoring.

Integrating Current Transformer (ICT)The ICT is located in the BTS beam line (see Fig. 1). Itoutputs a gaussian-like pulse in response to a beam bunchpassing through it; the area under this pulse is proportional
to the bunch charge. The ICT is designed to output a pulseof at least ~20 ns width, even for very short beam pulses,
resulting in a signal bandwidth below a few tens of MHz.
Therefore, direct digitization of the ICT signal isachievable with reasonable sample rates. We used aFigure 3: BESOCM chassis components block diagram.
The components inside the border are duplicated for eachof the two chains.

FPGA Processing Board
The FPGA processing board includes the Artix 7 FPGA,
the ADC that digitizes the ICT signal, ACIS latch circuit,

TUP041282

06 Beam Charges and Current Monitors

IBIC2023, Saskatoon, Canada
JACoW Publishing
ISSN: 2 6 7 3 - 5 3 5 0
d o i : 1 0 . 1 8 4 2 9 / J A C o W - I B I C 2 0 2 3 - T U P 0 4 1

watchdog ICs that monitor timing signals and power, andconnectors to mount the PicoZed SOM modules. The board
provides I/O connections for the PicoZed LAN, USB-serialand MRF event receiver external connectors on the frontpanel.

Test Pulse Generator Board
The test pulse generator board schematic is shown inFig. 4. The circuit generates up to four different test pulsesthat are sent to the test winding of the ICT via a coax cableto simulate beam pulses of varying charge. The pulse is
selected using a fast analog switch controlled by the FPGA.
The charge level of each pulse is set by a fast MOSFET
along with an attenuation network and DC block. For eachpulse, the FPGA provides two timing signals that control
the delay and width of the pulse. The pulse widthadjustment allows control over the resulting pulse charge.
The MOSFET produces a small but significant transientpulse; the adjustable delay allows the test pulse to bepositioned such that it combines with the switch transient,effectively eliminating it as an issue [5].

test pulses along with test parameter measurement resultson the waveforms. Plots of the accumulator and beamhistory for the previous hour are displayed, along with live
and latched fault status. Power supply voltage and current,
and board temperatures are also displayed. Separatescreens for the beam pulse, and each test pulse, with moredetailed analysis are available, along with a post-mortem
screen that saves BESOCM data at the time of the last fault(see Fig. 5).

Figure 5: Engineering Summary screen; tabs provide
access to other screens with more detailed information.

Changing System Settings
Figure 4: Test pulse generator circuit.
The BESOCM is configured to use three test pulses insequence that cover the operating range of the ADC.

ACIS Interface Board
The ACIS interface board has two safety-rated relays
that provide the interface to the ACIS system chains A & B
via a DB9 connector on the BESOCM rear panel. Thisboard also includes a reset relay with an externally driven
coil that resets the fault latches in the same manner as thefront panel reset switch, allowing operators to reset faults
remotely from the control room.

SYSTEM SETTINGS AND MONITORINGEPICS IOCThe PicoZed SOM daughter boards run Ubuntu Linux.
Each board implements an embedded EPICS IOC thatprovides process variable (PVs) for all settings andreadbacks, including waveforms.

CSS GUI Screens
Extensive Control System Studio (CSS) engineering
screens were developed by the BNL team. The screensallow monitoring of the BESOCM in real time and include
digitized waveforms of the beam ICT output and the three

The BESOCM stores the system settings in a flash
EEPROM on the FPGA main board, along with a CRC
hash. Upon power up, the settings and CRC are transferred
to FPGA memory. During operation the BESOCM
continuously re-calculates the CRC on every 1 Hz trigger
to ensure the integrity of the settings data.
The EPICS IOC provides PVs for all the settableparameters, such as accumulation time, beam limits, test
pulse limits and timing, beam charge calibration, etc. As
all these settings are critical to the BESOCM function,
strict control over any changes to the settings is required.
Therefore, we implemented a hardware enable using a key
switch on the front panel that enables or disables writing tothe EEPROM. When the BESOCM is in its normal
operating mode, the key switch is in the “run” position
which prevents any data transfer into the EEPROM. Whenthe key switch is set to “program” writing to the EEPROM
is enabled and an ACIS trip state is always asserted. This
prevents beam from being transferred through the BTSline. APS administrative controls require the BESOCM to
be re-validated after any switch to “program”.
The CSS Settings screen is shown in Fig. 6. The screen
is divided into three sets of equivalent PVs. The top set isthe editor; the middle set displays the contents of thesettings file; the bottom set displays the FPGA values. Thebuttons on the right control the transfer of settings fromthe editor to the FPGA via the settings file and flash
EEPROM. Changes can only occur when the front panel
keylock is set to “program”. The editor section allows
TUP04106 Beam Charges and Current Monitors

283

Content from this work may be used under the terms of the CC-BY-4.0 licence (© 2023). Any distribution of this work must maintain attribution to the author(s), title of the work, publisher, and DOI

12th Int. Beam Instrum. Conf.
ISBN: 9 7 8 - 3 - 9 5 4 5 0 - 2 3 6 - 3

Content from this work may be used under the terms of the CC-BY-4.0 licence (© 2023). Any distribution of this work must maintain attribution to the author(s), title of the work, publisher, and DOI

12th Int. Beam Instrum. Conf.
ISBN: 9 7 8 - 3 - 9 5 4 5 0 - 2 3 6 - 3

IBIC2023, Saskatoon, Canada
JACoW Publishing
ISSN: 2 6 7 3 - 5 3 5 0d o i : 1 0 . 1 8 4 2 9 / J A C o W - I B I C 2 0 2 3 - T U P 0 4 1

settings to be written to and read from the settings file. Thesettings file is used to temporarily store the settings; innormal operation only the FPGA values are relevant. Any
discrepancy in the value of a setting between the three
sections is highlighted in red (not shown). The red boxeson the right indicate the key switch is in “run” mode.

VALIDATIONAPS requires annual re-validation of safety systems. We
are currently developing a new validation procedure for theBTS BESOCM that will test and validate each of the beamand self-test fault functions. The extensive EPICS PVs willaid in automating the new validation procedure.

CONCLUSION
In preliminary testing and evaluation, the BTS
BESOCM has operated reliably and is a significant
advancement over the existing BESOCM system. We arepreparing to install it in the upgraded BTS line and expect
it to be fully operational when the upgraded BTS line iscommissioned.

ACKNOWLEDGMENTS
The authors would like to acknowledge Glenn Decker,
Ken Belcher, Joe Lenner, Bob Hettel, Dan Paskvan andAndrew Johnson for their help and support.

REFERENCES

Figure 6: The Settings screen.

EVALUATION AND TESTING
Three production units have been delivered to APS fromBNL. Each unit has been tested and evaluated in the labwith simulated beam without issues. One unit was installedin the BTS during the final APS run and performed asexpected. Once the upgraded BTS beam line is operational,
we plan to do extensive statistical analysis with real beam
to determine the best settings for the various fault limits
with different beam charge, timing, etc., with the goal ofensuring maximum fail-safe function and minimal
interruption to operations from spurious trips.

[1] X. Wang et al., “High Beam Current Shut-off Systems in theAPS Linac and Low Energy Transfer Line,” in Proc BIW’94,Vancouver, Canada, vol. 333. pp. 274-285, 1995.
doi.org/10.1063/1.48051[2] A. Pietryla et al., “Design of the Beam Shut-off Current
Monitor Upgrade for the Advanced Photon Source,” in Proc.
BIW’00, Cambridge, USA, vol. 546, pp. 527-534, 2000.
doi.org/10.1063/1.1342626[3] K.C. Harkay et al., “Radiation Safety Considerations For The
APS Upgrade Injector”, in Proc. IPAC'21, Campinas, Brazil,May 2021, pp. 445-448. doi:10.18429/JACoWIPAC2021-MOPAB123[4] N. Sereno et al., “Justification for use of a single ICT for the
APS-U BTS BESOCM,” ANL/APS, Lemont, IL, Technical
Report DIAG-TN-2021-033, 2021.
[5] A. Caracappa et al., “Method to Remove Test Pulse Switch
Transients and Long-Term Bench Testing for the BTS
BESOCM Electronics,” ANL/APS, Lemont, IL, Technical
Report DIAG-TN-2022-045, 2022.

TUP041284

06 Beam Charges and Current Monitors