Design of FPGA-based radiation tolerant quench detectors for LHC

The Large Hadron Collider (LHC) comprises many superconducting circuits. Most elements of these circuits require active protection. The functionality of the quench detectors was initially implemented as microcontroller based equipment. After the initial stage of the LHC operation with beams the introduction of a new type of quench detector began. This article presents briefly the main ideas and architectures applied to the design and the validation of FPGA-based quench detectors.


Introduction
A circular particle accelerator requires a dipole magnetic field to maintain the particle beam on circular trajectory. Several other kinds of magnets are required for shaping and guiding the beam. In the case of the LHC most of them are superconducting magnets [1] supplied with DC current by means of power converters. The need for a system of active magnet protection originates from the nature of the superconducting cables used to build the magnets. The cables are not cryostable [2] and therefore a random and local temperature change can lead to sudden transition to a normal conduction state. This transition is named quench. Most of the high-current superconducting magnets used in LHC are not self-protected and would be damaged or destroyed if not protected during a quench. The LHC protection system comprises many subsystems. One of the sub-systems is the magnet quench protection system (QPS) [3]. This system consists of the quench detection system (QDS) and actuators which are activated once a quench is detected.
A superconducting magnet as an element of an electric circuit has zero resistance and a relatively large inductance. When a constant current flows through the magnet, the total voltage across it is zero. When the magnet loses its superconducting state (quench) the resistance becomes non-zero hence a voltage develops over the resistive part. This voltage is used to detect the quench. However, during normal operation any current change in the magnet generates an inductive voltage which might be well above the resistive voltage detection threshold. Therefore the inductive voltage must be compensated in order to prevent the QDS from triggering.
-1 -Thus one of the main tasks of the QDS is the compensation of inductive voltages generated during normal operation (ramping up or down the current). The compensation method is simple in the case of a differential magnet circuit where two very similar inductances are connected in series in one circuit. However, in some LHC corrector magnet circuits there are no reference voltages available, hence the compensation of the inductive voltage by simple subtraction cannot be implemented. In this case Kirchhoff's voltage law for the circuit must be solved. To satisfy timing requirements, the solution must be performed numerically (on line) by means of using digital logic.
Since the beginning of LHC operation, the QDS has consisted of several kinds of detection devices. For various superconducting circuits, the detectors have utilized different technologies to perform the detection function. The base-layer, still in operation, is based on classic analogue technology using a measurement bridge and comparators. For supervision an 8-bit microcontroller with integrated analogue to digital converters (ADC) was used. Other devices, used in zones with no or little radiation were based on standalone ADC and digital signal processors [3].
A quench detector is an electronic device with the following functions: • Monitoring of the voltage of superconducting elements, • Extraction of the resistive part of the voltage, • Generation of trigger signals in case the resistive voltage exceeds the threshold.
The triggers are transmitted to other protection devices via current loops to initiate magnet protection measures and a safe shutdown of the magnet system. Already during initial commissioning of the LHC the necessity for changes to the system appeared. Higher levels of radiation than initially anticipated and new elements to protect lead to several upgrade campaigns. After implementing a new layer of QDS for the main dipole and quadrupole circuits [4], the QDS of the individually powered quadrupoles and 600 A correctors was upgraded in a radiation tolerant way.
Most of the quench detectors are located in the LHC tunnel with presence of radiation which may adversely influence the reliability of the system. Therefore the choice of technology, architecture and design rules is very important for the safety of the whole machine. Special attention was paid to mitigation of soft errors known as Single Event Effects (SEE).
This article presents the architectures of three quench detectors which were developed as an upgrade and were introduced to operation during the First Long Shutdown (LS1) [5] and afterwards. These are: • DQQDS: symmetric quench detector for main dipole and quadrupole magnets, • nDQQDI: quench detector for individually powered quadrupole and dipole circuits, • nDQQDG: quench detector for 600 A corrector circuits.

Radiation effects on CMOS devices in the LHC
Currently almost all state of the art digital logic is implemented in Complementary Metal Oxide Semiconductor (CMOS) technology. Considering radiation influence on electronics implemented in CMOS technology one should take into account two groups of phenomena. First is the long term accumulation of charges in the insulating layers of a CMOS integrated circuit referred to as Total -2 -Ionising Dose (TID). Charges arising inside the thin gate oxide layers are especially important. They influence the parameters of individual transistors leading to degradation of the circuit performance. The second group of radiation effects in electronics are fast and random events caused by the interaction of a single particle with a circuit element referred to as Single Event Effects (SEE). A particle traversing the active region of a semiconductor device creates charges which can disturb the correct functionality of a circuit. Depending on the process technology and the design of the device the consequences of single effects can range from data corruption (soft errors) to destruction of the device itself (hard errors). In the case of soft errors the disturbance is temporary or it exists to the next change of the circuit state.
The TID effects are caused by pure ionising radiation expressed as absorbed dose [Gy]. The important factor to consider radiation levels in the LHC is the dose accumulated per one year [Gy · y −1 ]. In general the electronics located in the LHC tunnel is exposed to annual doses up to 1 · 10 3 Gy · y −1 [6]. However quench protection devices discussed in this article are located in places where the annual dose does not exceed 10 Gy · y −1 . The SEE phenomena are caused by a flux of particles expressed by High Energy Hadrons (HEH) annual fluence [cm −2 · y −1 ]. The level of HEH annual fluence is approximately 10 8 cm −2 · y −1 in the middle of the LHC sector and rises up to 10 10 cm −2 · y −1 at the end of the sector. These radiation levels in the LHC tunnel are not constant and they increase with the luminosity of the LHC. In 2016 the annual integrated luminosity has reached 40 fb −1 [6][7][8]. For the future high luminosity upgrade of LHC about 300 fb −1 should be accumulated per year [9,10].
Radiation tests were carried out to validate the electronic components used to design the devices described in this article. Devices that have passed the radiation tests should not suffer from destructive effects if exposed to the radiation environment foreseen. As an example, the main dipole protection electronics should operate correctly at radiation levels expected below a mid-cell LHC dipole position which is exposed to an annual HEH fluence of 10 10 cm −2 · y −1 [4,11].
TID effects are mainly related to the total accumulated energy deposited in the electronics by radiation. They are less dependent on the accumulation rate. This means that TID effects become relevant only at higher doses while SEE phenomena are flux related and can be observed as soon the device is exposed to radiation. In fact SEE are observed also in aeroplanes and at sea level where annual HEH fluence is on the level of 10 4 cm −2 · y −1 . Soft errors caused by SEE can lead to incorrect function of the electronics if not properly treated by system design. In the case of the LHC, one particle incident on an electronic device can terminate the operation of the whole accelerator (a beam dump or a fast power abort) which results in several hours of down-time. Therefore the electronic equipment located in the LHC tunnel must be designed in a special manner to achieve an immunity to soft error failures. The degree of the immunity of the electronics to SEE is usually expressed as a number of Failures In Time (FIT) which stands for 1 error per 10 9 hours. However, in the field of accelerator technology the number of beam dumps caused by SEE per unit of integrated luminosity is used instead.

Technology consideration
Field-Programmable Gate Arrays (FPGAs) are configurable integrated circuits. They consist of three major elements: configurable logic blocks, routing matrix, and programmable switches. Depending on the technology used to maintain the configuration information inside the switches -3 -one can distinguish three major kinds of FPGA circuits: SRAM-based, flash-based and antifusebased. SRAM-based FPGAs are currently the most advanced and developed family which is used for the most designs today. However, in the field of critical and fault-tolerant applications the SRAMbased approach suffers from a high sensitivity to SEE. Each single impinging particle can cause persistent effects in logic blocks, interconnections, and configuration switches. The configuration has to be reloaded to recover the design functionality after a SEE. There are radiation tolerant or even radiation hardened SRAM-based FPGAs available [12] but cost wise of these devices are not competitive with other technologies. The antifuse-approach is safe in the domain of interconnections and switches. The configuration is stored in the form of a permanent change of an insulation layer which is fully tolerant to radiation. However, due to their one-time only programmability, antifuse devices are very impractical during development. The inability to deploy firmware-updates makes these devices unsuited for an environment like LHC. On the other hand the flash-based approach exhibits similar immunity to SEE [13][14][15] while the configuration can be modified almost without any limitation. For both approaches (flash, antifuse) a particle striking on a node inside logic blocks can induce a transient effect in a form of a narrow pulse. The pulse can be widened when it travels through logic resources. The mitigation of this kind of SEE can be achieved by spatial redundancy [16]. Between flash-based circuits there are also devices available which are validated by the manufacturer as radiation tolerant (RT) solutions [17]. However in the case of our projects the necessity of an economical tradeoff directed our attention to standard families of flash-based FPGAs.
Finally the ProASIC3E family of Microsemi Corporation was chosen as a platform for our projects. This family of FPGA devices is already well known at CERN, carefully tested and widely used [18]. The ProASIC3E devices are fabricated in 130nm flash-based CMOS technology with 7 metal layers. Devices of this family are programmable by means of using In-System Programming (ISP) available directly on the chip and they retain the programmed design when powered off [19]. As a mitigation technique for SEE a method known as Triple Modular Redundancy (TMR) was applied. This means that during synthesis each flipflop in the design is substituted by a structure consisting of three flipflops followed by a voting logic. This is performed automatically during synthesis by the technology mapper. The activation of the triplication process is done by means of using a dedicated synthesis attribute [20]. While all registers are triplicated automatically by the synthesis tool, the TMR approach was applied manually in each place where Static Random Access Memory (SRAM) blocks inside the FPGA fabric were used. For example, averaging filters are designed by means of using three independent memory blocks and each write and read operation is performed three times simultaneously. The value of a word coming from the triplicated memory is determined by a voting logic implemented in a hardware description language (HDL). TMR is also applied to external flash memories which hold Look-Up Tables (LUT) dedicated to store settings necessary for quench detector operation. Actually there are three independent flashes installed on the detector board and three Serial Peripheral Interface (SPI) interfaces implemented inside the FPGA work simultaneously. Each value taken from a flash is validated by a voting logic to avoid soft errors in critical information.

General architecture of the quench detectors
The simplified, common architecture of each of the three devices presented in this publication is shown in figure 1. The design comprises several stages: an analogue signal conditioning stage, an -4 -ADC, a FPGA circuit for digital processing and generation of triggers, and actuators like relays or semiconductor switches. Depending on the device, the number of processing chains is different. The digital signal processing chain comprises functional blocks like filters, correctors, decimators and others which are separated from each other by two-to-one multiplexers. The multiplexer structure allows the use or omission of the output of a functional block. Addresses for multiplexers are stored in configuration registers and can be modified by sending commands through a command interface based on Inter-Integrated Circuit (I 2 C) communication protocol. Some functional blocks feature parameters which can be changed via the command interface during run-time. The crucial parameters of the quench detection logic block are quench thresholds and discrimination time. All register settings are accessible via the I 2 C interface. During the operation samples of the magnet signals are transmitted via I 2 C to the controls system which logs the data at 5-10 Hz. High-speed data is recorded in a circular buffer. In case of a detection trigger of the algorithm or a command, the buffer recording is stopped. This data is read out after the event via the controls system thus designated post mortem data (PM). The PM data is used as a basis for the analysis of an event.
At the end of the processing pipeline, data is delivered to a quench detection logic block where it is compared to the threshold. If the trigger condition is fulfilled, the trigger signal is filtered by a time discriminator. Only trigger signals persisting longer than the selected discrimination time will pass. In the next stage the trigger signal is latched and can be cancelled only during reset state.

Symmetric quench detector -DQQDS detector
The device compares voltages across four electrically adjacent magnets in the main circuits of the LHC. The basic magnet layout is shown in figure 2. The LHC consists of eight sectors. The main superconducting circuit of each sector consists of 154 dipole magnets connected in series together with two energy extraction switches. The numbering of magnets shown in figure 2 represents physical sequence of the magnets in the LHC tunnel. The magnets with even numbers form a -5 -

JINST 12 T04005
forward branch of the circuit while the magnets with odd numbers form backward branch. The circuit is supplied by a current generated by a power converter. Figure 2. One of the eight main superconducting circuits of the LHC. A cell for a symmetric quench detector was marked. The red lines represents quench heaters which are fired in case of quench detection. The symbols B1 and B2 denote coils for clockwise and counterclockwise particle beams respectively.
One DQQDS detector monitors one magnet cell. One cell consists of three electrically adjacent dipole magnets. For example a cell number n consists of magnets with numbers k + 1, k + 3, k + 5. The fourth magnet is located in the next cell and it is only used as reference. The cell number n + 1 consists of magnets with numbers k + 7, k + 9, k + 11. Hence, an overlap of one magnet exists between two DQQDS detectors. The detector logic compares magnet voltages by calculating twelve differences shown in figure 3. If one of these differences exceeds the threshold, a trigger signal for the quench heaters of the magnet with the higher voltage will be generated. Magnets which received a trigger are taken out of the comparison. When a quench is detected, the trigger signal will stay latched until the card receives a hard reset. This avoids the re-charging of the quench-heaters before completion of the event analysis. When two magnets of a cell are already in quench condition, the quench detector will also trigger the remaining quench heaters due to loss of reference. The functional blocks implemented in the FPGA are shown in figure 4. Serial data with a resolution of 16 bits generated by the four ADCs is acquired by four channels of the SPI interface. Since a mismatch between magnet and heater signals will lead to erroneous heater firings, a "mapper" unit was introduced. This functional block allows the interchange of the voltage channels to correct -6 -non-conformities in cabling. Digital conditioning of data is performed by four independent signal processing channels. Details of the signal processing chain are presented in figure 5. Input data is acquired with a sampling rate of 6410 sps. The signal processing chain consists of five subsequent multiplexers and four functional blocks as shown in figure 5. The first multiplexer controls if measurement data or pre-set data is routed to the signal chain. Pre-set data is only used for test purposes. For safety reasons, the activation of this signal during operation will cause a fast power abort. The second multiplexer controls the optional inversion of the data words from the ADC. This option was put in place due to the inverting nature of the analogue input stage. The third multiplexer activates nonlinear digital filtering for spike rejection as a pre-processing step. It is implemented as a 7-point median filter. This stage is followed by a fourth multiplexer which activates a low pass digital filter, implemented as a moving average filter with a length of 128 samples whose first notch is at 50 Hz. The last multiplexer activates the digital correction of offset and gain errors caused by the analogue part. -7 -After processing, the data is delivered to a quench detection logic block where voltage differences (listed in figure 3) are calculated and compared to a threshold value. Once a threshold is exceeded, a time-discriminating filter is activated. Only trigger conditions which remain valid for a time exceeding the discrimination time are propagated. This signal is then latched and can be cleared only by a hard reset.
An additional functional block implementing an adaptive filter will increase the system's threshold during the operational state of fast power abort where, for a short time, differences in the magnet voltage might exceed the standard thresholds.

Quench detector for individually powered quadrupoles -nDQQDI detector
This quench detector measures the voltages U 1 and U 2 of two coils of a superconducting quadrupole magnet as it is presented in figure 6. During operation the inductive voltage measured might well exceed the quench detection threshold. Hence a compensation method has to be applied. Since the inductive voltage of the two identical coils in series is equal, the difference between the voltages is zero. Under the assumption that a quench develops only in one coil, the difference is equal to the resistive voltage U res of the quenching coil. In order to protect the quadrupole as well in the case of a simultaneous quench in both coils, a second, higher threshold is applied to the sum U sym of the coil voltages. A block diagram of the FPGA design is presented in figure 7. Serial data generated by two ADCs with a resolution of 16 bits is acquired by two channels of an SPI interface. A mapper stage allows to interchange the signals to correct non-conformities in the cabling. Digital conditioning of data is performed by two independent signal processing channels. A more detailed view of the signal processing chain is shown in figure 8.
Settings for the detector are transmitted through an I 2 C interface and stored in a flash memory outside the FPGA. The flash memory is connected to the FPGA via an SPI interface. Test signals can be generated by a wave generator block which is connected to an external digital to analogue converter (DAC) by means of using a dedicated SPI interface. These signals fed back into the analogue input stages of the detector allow a self-test of large parts of the design.
Input data is acquired with a sampling rate of 9615 sps. The signal processing chain consists of three subsequent multiplexers and three functional blocks as shown in figure 8. The first multiplexer controls the insertion of a rate limiter into the chain. This functional block limits the change of the -8 - signal to 1V sample-to-sample which will damp large radiation-induced spikes from the ADC. A moving average filter of up to 64 samples length with the first notch at 150 Hz can be enabled in the second stage. The third stage contains a digital gain and offset correction unit to compensate offsets and gain errors caused by the analogue input chain. After processing, data is delivered to a quench detection logic block where voltage differences defined in figure 6 are calculated and compared to the threshold values. A time discriminator rejects triggers with a duration shorter than the discrimination time. The generated trigger signal is latched and can be cancelled only during reset state.

Quench detector for 600 A circuits -nDQQDG detector
In this type of circuits, limited instrumentation does not allow the application of compensation schemes similar to the ones used by the quench detectors described above. To compensate for the inductive voltage, an algorithm has been implemented which calculates the expected inductive voltage based on the circuit current and the known inductance of the magnet circuit. With the measurement of the total circuit voltage and the current, the device solves the differential equation for the circuit shown in figure 9. With I dcct and U diff as inputs, the device has to calculate the derivative of the current, and due to the presence of the parallel protection resistor R par , also the derivative of the circuit voltage. Magnet inductance, and parallel resistor values are constants which have to be set for each circuit. The functionality implemented in the FPGA is presented in figure 10. Serial data is generated by two ADCs with a resolution of 24 bits. The first channel carries the circuit voltage U diff while the second channel is connected to a Hall-effect current sensor measuring the circuit current. Digital conditioning of input data is performed by two independent signal processing channels. Details of the signal processing chain are presented in figure 11. After differentiation of the data, one more digital conditioning stage is used in both channels. Details of the signal processing chain for derivatives are presented in figure 12. Finally, data coming from all four processing chains is directed to the calculation block shown in figure 13.
Input data is acquired with a sampling rate of 4000 sps. The signal processing chain for input data consists of five subsequent multiplexers and six functional blocks as shown in figure 11. In the first functional block, the scaler, data from the ADC interface as a 24 bit vector in two's complement notation is converted to a fixed point format by means of using factors appropriate for both kinds of data. For further processing, the format of the current signal is set to Q10. 13. For the voltage signal the format is Q4.17. After the scaler, the data can be optionally inverted. The second stage comprises of a decimator which can lower the data rate by factor 8. It substitutes each eight samples by one sample with their mean value. The third multiplexer controls the insertion of a median filter into the chain. In the chain for the voltage U diff a median filter with 11-points depth is used. In the chain for the current I DCCT a median filter with 9-points depth is used. The fourth multiplexer activates a low pass digital filter. It is implemented as a moving average filter with length configured in steps of 2 n up to n = 8 for the voltage channel and up to n = 9 for the current channel. The last multiplexer activates the unit for digital correction of offset and gain errors caused by the analogue part. The signal processing chain for the derivatives of voltage and current consists of two subsequent multiplexers and two functional blocks shown in figure 12. The first multiplexer controls insertion of a median filter into the chain. For both chains 7-point median filters are used. The second multiplexer enables a moving average filter. Its length can be changed in steps of 2 n up to n = 10 for the current derivative channel and up to n = 8 for the voltage derivative channel.
The last stage of resistive voltage extraction performs additions and multiplications using values of magnet inductance L and protection resistance R PAR . This stage is shown in figure 13. The values of these parameters together with threshold values for the quench logic block are stored in external flash memories. Inductances and threshold values are organized as LUT addressed by the value of current I DCCT . In this way the dependence of magnet inductance and thresholds on current is taken into account.
Finally, the calculated value (according to the formula presented in figure 9) of the resistive voltage is delivered to a quench detection logic block where it is compared to a threshold value. Again, a time discriminator rejects triggers shorter than the discrimination time. The generated trigger signal is latched and can be cancelled only during reset state.

Verification and Testing
The presented projects were carefully verified by simulation. Smaller simulation tasks concerning single module or groups of several modules were carried out by means of using the simulator ModelSim (Mentor Graphics ). A test-bench for the whole design was also prepared for each of the three cases. For this purpose the simulator Incisive (Cadence ) was used. One example of the architecture of this kind of test-benches is presented in figure 14.
The test-bench is built in several layers. The innermost is the unit under test (UUT) which requires several common signals like clock, reset, address and many specific signals for SPI and I 2 C interfaces. The UUT is created in Very High Speed Integrated Circuits Hardware Description Language (VHDL) as a synthesizable unit. Therefore the top test unit is also prepared in VHDL to deliver common signals. However, generators for specific signals are prepared in Verilog because of the availability of some useful modules. The transmission over the I 2 C interface was simulated by means of using a synthesizable I 2 C-master module equipped with two text files containing commands and data for sending to (or from) the UUT. In order to deliver input signals to the UUT a behavioural model of the ADC was developed. The ADC model takes an analogue signal as input and produces digital serial output on an SPI-master interface. An analogue signal is generated -12 - by a module prepared in the HDL known as Verilog-AMS (Analogue Mixed Signal). In order to accelerate simulation the analogue signal generator was substituted with a simple text file containing raw samples of the signal. The next layer of the test-bench is a control script prepared in the tool command language TCL. Purposes of the script are: creation of a waveform database, probing signals, forcing values of signals, and launching the simulation. An especially useful feature of the control script is the ability of signal injection to any node in the UUT during simulation. This functionality is used to simulate radiation induced errors.
Synthesis and implementation processes produce a programming file and a structural HDL model together with a timing back-annotation file. This means that the complete information about performance of the design is contained in structured back-annotated model. Simulations can be performed at different levels: behavioral (pre-synthesis), structural (post-synthesis), and back-annotated (post-route). The test-bench described above was initially used for behavioural simulation. It was used again for verification of the final model. The structural model was used in place of the synthesisable UUT module in figure 14. It was elaborated together with the precompiled simulation library for the ProAsic3 [21]. In the same process the design was annotated with timing information coming from the routing process. The simulation was carried out for delivering the most detailed timing information available by means of using digital simulation tools. The results had been used for further optimizations of the design. The next step for validation of the detector design was the hardware testing. Figure 15 presents the test setup dedicated to perform automatic hardware tests. The setup is build based on a standard personal computer (PC) and two devices of National Instruments. The test is controlled by an application prepared by means of using LabView software. Four magnet voltages are generated by -13 - the analogue outputs of the NI USB-6535 device. Commands and data were transmitted to and from the detector under test via its I 2 C interface. A NI USB-8451 device was used as a converter between the PC's Universal Serial Bus (USB) and the detector's I 2 C interface. The trigger generated by the detector was monitored by a current loop connected to one of the digital inputs of the NI USB-6535 device. The LabView based test software incorporates a script interpreter allowing the generation of various test vectors. It also incorporates a model of the quench detection logic which allowed fully automatic testing of the device using random input data. The setup was used to conduct automated tests to check correctness of functionality, to measure delays and to receive data from detector for different settings. The setup was also used to conduct endurance tests.
The above description concerns the DQQDS board but similar verification test-benches and test setups were prepared also for nDQQDI and nDQQDG boards.

Conclusion
The presented designs have been developed over several years. Immunity to soft errors was the main issue addressed during the design and the verification. The choice of technology, design methods, design rules and architectures were made in order to achieve several goals: an increase in the system dependability, an enhancement of its diagnostic capabilities and increased flexibility in modification of device settings. The FPGA technology and the HDL design method were chosen in order to have deep insight into operation of individual logic elements during design and verification. Standard flash-based CMOS technology was chosen as the best compromise between total system cost and a tolerance to SEE inside configuration switches and routing connections. The Triple Modular Redundancy (TMR) technique was chosen to achieve a mitigation of transient SEE in the logic. The architecture comprising many steps of digital filtering was chosen to reduce number of radiation induced spurious triggers as well as noise from various sources coupling into the signal channels. All relevant components used in the detector boards were tested in a radiation environment representative for the LHC tunnel and validated for use in the LHC tunnel. The three designs were successfully implemented, verified and tested.
-14 - The installation of DQQDS detectors in the LHC tunnel began already before LHC first run, but tests and verifications were also carried out during LS1 where a major firmware upgrade was conducted. The installation of nDQQDI detectors took place during LS1. Both designs successfully passed commissioning. Finally the nDQQDG detector was installed and commissioned in the year end technical stop 2015/2016. It operated well with the absence of radiation induced trips up to the end of 2016. During this time the LHC reached and exceeded its design luminosity.
During LHC operation in 2012, 56 dumps out of 585 total dumps were recognized as caused by SEE occurrences in electronic systems (about 10% of the total). The systems which were mostly impacted by the SEE were the QPS (32 dumps, about 50 % of the SEE total). The failure rate normalized to the luminosity delivered by the LHC in the 2012 was 3 dumps/fb −1 for all LHC subsystems and 1.4 dumps/fb −1 for the QPS [6,7]. To enhance the immunity to the SEE many efforts were undertaken during LS1. As a result the failure rate of the QPS in 2015 achieved the value 0.5 dumps/fb −1 . In 2016 up to the time of completion this text there was no any beam dump related to the SEE in the QPS instrumentation. The three designs presented in the article have significantly contributed to the enhanced immunity of the LHC QPS system to the SEE.