J. Kissel

As per request of the review committee responsible for Engineering Change Request E1400102, or Integration Issue 720, I've used the IFO down time to shake suspensions with quite vigor, on resonance, to prove the OSEM AC band-limited RMS sensor watchdog (the only portion of the SUS user that will remain after the ECR is complete) will sufficiently protect the suspension from danger.

It will. Removing all *other* components of the SUS User Watchdog, as requested, should be fine.

I attach 4 sets of time series of the excitations for three different suspension types (an HSTS [PR2], an HLTS [PR3], and a QUAD [ETMX]), driving in Longitudinal or Vertical (those degrees of freedom with the largest number of actuators), from the top mass (which have the strongest actuators). 
Upper Left -- the requested drive (the TEST_OUT in red) and the the sent drive (the MASTER_OUT, which is after the watchdog). 
Bottom Left -- the response to the drive, in [um] as measured by the OSEMs. (Top = Brown, Middle = Magenta, Bottom = Cyan)
Upper Right -- the watchdog state during the time series. (Top = Green, Yellow = Middle, Black = Bottom, Pink = USER DACKILL)

For green (top mass WD), a FIRSTTRIG bit value of 2 indicates that the Sensor OSEM AC WD caused the watchdog to trip. For all* studies, top mass OSEM AC watchdog trips, stopping the excitation as expected. (*For the 1st, 5th and 6th page, with PR2 drive in L, the FIRSTTRIG doesn't report a trip, but the excitation is turned off by guardian [nice!], because the lower stage watchdogs have tripped -- on the AC Band-Limited Sensor Signal.)

Also under debate is to remove the lower stage sensor band-limited OSEM AC triggering, but I've convinced myself through the few PR2 and ETMX trips that they're still worth it. HOWEVER, we should most certainly simplify the watchdog MEDM screen system to have one screen with a "RESET ALL" button, like the SEI subsystem has.

I did find an undesirable mode of the Guardian though -- if the SUS trips, and resonances are rung up such that the WD continues to trip, one cannot untrip the watchdog long enough for Guardian to get damping loops up and running again to cool off the system. This means you have to wait for the system to cool down itself or temporarily raise the WD threshold, neither of which are desirable for these high-Q suspensions.

Details
-------
Measurement templates live in
/ligo/svncommon/SusSVN/sus/trunk/Common/Data/20140325_WDTests/

I used AWGGUI to create the drive -- a 10000 [ct] (or 100000 [ct] where needed) sine wave, driven at the first resonant frequency for the SUS type, as determined by T1200404.