Introduction. PSS Description

Transcription

1 Introduction The Personnel Safety System is an active programmable safety instrumented system primarily designed to mitigate the risk of personnel injury due to exposure to prompt ionizing radiation during accelerator operations. Other hazards, such as uncovered electromagnet conductors, gun high voltage, and high power radio frequency (RF) are also addressed by components of the PSS. Safety functions performed by the Personnel Safety Systems in the CEBAF and FEL accelerators are considered credited controls under the JLab Final Safety Assessment Document (FSAD). Credited Controls are a set of mitigations that are in and of themselves sufficient to allow safe operation of an accelerator facility. Description of CEBAF The Continuous Electron Beam Accelerator Facility is a basic research laboratory operated for the U.S. Department of Energy by Jefferson Science Associates, LLC; The purpose of CEBAF is to explore the quark nature of the nucleus by probing materials with a very high intensity electron beam. CEBAF is unique in that the electron beam is delivered in a very high average power continuous wave (CW) beam; most other accelerators around the world use a pulsed beam with high peak but lower average power. The electron beam current, which may be up to 200 µa, is accelerated by two opposing linear accelerators (linacs) connected in a race track fashion by two 180 degree arcs. After 5 1/2 passes through the two linacs the total beam energy is up to 12 GeV. Each linac uses 200 superconducting radio frequency (RF) cavities to transfer energy from an RF power source to the beam. Each of the RF power sources are synchronized such that the beam is always receiving the maximum energy gain from each RF cavity. Liquid helium is used to cool the niobium superconducting cavities to 2 Kelvin (-456 F).

2 The arcs use large dipole electromagnets to bend the beam between the linacs or to an experimental end station. Each of the three endstations contains target, detector, and data acquisition systems. After interaction with the target the beam is dissipated in a high power beam dump. CEBAF has three experimental endstations, each designed to perform a different type of experiment. The beam can be split in the Beam Switchyard (BSY) for use by all three endstations simultaneously. Several of the large magnets in the endstations are superconducting, using liquid nitrogen and helium as the cryogens. Both the accelerator tunnel and endstations are located under ground in concrete enclosures. The tunnel is segmented by a series of gates and shield walls such that beam may be operated in part of the accelerator, or to any endstations, while an adjacent area may be safely open for access. Each of the nine partitioned areas has a separate and redundant PSS.

3 Each linac uses 160 niobium superconducting radio frequency (RF) cavities to transfer energy from an RF power source to the beam. Each of the RF power sources are synchronized such that the beam is always receiving the maximum energy gain from each RF cavity. The arcs use a series of large dipole electromagnets to recirculate the beam between the linacs or to an experimental end station.

4 Description of the Free Electron Laser (FEL) Located inside the CEBAF footprint, the JLab FEL is a separate facility that capitalizes on JLab SRF technology to implement a low energy high current accelerator used to create a tunable laser beam. The same hazards exist in the FEL as in CEBAF and the hazard controls, including the PSS, are similar in the two facilities. One significant operational difference between the two facilities is Injector Accelerator IR Beam Line Entry Way UV Beam Line GTS Test Area Emergency Exit that instead of adding energy to get maximum acceleration in each pass, the FEL adds energy to the first pass then extracts that energy on the second pass. This energy recovery process allows the FEL to operate at high peak powers with relatively low RF power. It also greatly reduces the power requirements of the beam dump. The final beam is at the same power as the injected beam.

5 Hazards present during accelerator operations The specific hazards which can be present in the beam enclosure while CEBAF beam is running are: Short lived beam related radiation dose rates in excess of 10 s of Mrem/hr Continuous beam related dose rates in excess of 10 s of krem/hr RF cavity field emission dose rates in excess of 20 rem/hr Accelerating system electromagnetic radiation in excess of 30 mw/cm 2 Exposed magnet electrical leads with over 800V and/or 600 amps Oxygen levels < 19.5 % caused by unplanned release of large amounts of cryogens in a beam enclosure. A complete hazard analysis is included in the Facility Safety Assessment Document. First line measures to prevent personnel exposure to the above hazards are to prevent access to the beam enclosure: security controlled access to the facility site passive shielding design locked tunnel and service building doors during beam operations administrative procedures for the proper operation of hazardous devices employee training on the hazards present during beam operations Therefore, the first line measures are intended to minimize challenges to an access control and interlock system. The Personnel Safety System (PSS) is an active protection system designed to ensure personnel safety if one or more of the above measures fail.

6 Description of the Personnel Safety System The Personnel Safety System is composed of sensors, interlocks, and warning devices designed to protect personnel from exposure to prompt radiation, electrocution, and oxygen deficiency hazards which could be present during accelerator operations. Prompt radiation is produced when an electron beam is intercepted by a substance which may be anything from a gas molecule in the vacuum system to the beam pipe. The radiation is prompt in the sense that as soon as the beam is turned off the primary radiation hazard goes away. For this reason, the primary method of mitigation used by the PSS is to shut off the electron beam. Activation is minimal and no dangerous quantities of activated material are created during accelerator operations. In addition to the beam operations, an additional source of prompt ionizing radiation, called field emission, is produced when the superconducting RF cavities are operated at high field gradients. PSS Design Basis Assumptions: Unless otherwise noted, hazards are located within a limited access beam enclosure. The enclosure provides sufficient shielding to limit radiation exposure to personnel outside of the shielding from credible beam loss Proper staffing is maintained to perform the administrative procedures such as personnel sweeps and controlled accesses. Therefore the main task of the PSS is to help to establish and maintain exclusion areas. PSS Hazard Mitigation The PSS automatically protects against the following hazards: Entry into an exclusion area Excessive radiation dose rate in an occupied area

7 Beam transport from an exclusion area to an occupied area Beam burn-through of beam stopping devices Operation of radiation producing devices while an area is occupied Exposure to high power RF EMI Electrical shock from powered arc dipoles Beam current in excess of the CEBAF safety envelope In addition, the PSS provides semi-automated or administrative assistance in the following areas: Tunnel sweep (search and secure) sequence Tunnel controlled access PSS emergency crash Public address announcements Audio/visual status and warning indicators. Automated door locks ODH alarms ODH event logging The PSS does not protect against: Radiation from activated components Electrical shock hazards other than from the operation of the large arc dipole magnets Radiation doses less than those permissible for trained Jefferson Lab radiation workers Beam-related damage to non-pss machine hardware

8 Damage to beam dumps Beam loss Malicious intent to defeat or circumvent the PSS Explosive gas hazards Exposure to cryogenic hazards All of these areas are addressed by CEBAF radiological and EH&S policy and procedures and, therefore, do not require an active protection system like the Personnel Safety System

9 PSS Safety Functions Function ID Safety Function Required SIL SF1 Prevent beam transport from exclusion to occupied areas 3 SF2 Shut off interlocked devices when physical barriers between personnel and hazards are unsecured. 2 SF3 Shut off interlocked devices upon activation of an ESTOP 2 SF4 Shut off interlocked devices in support of administrative access to a secure beam enclosure. 2 SF5 Support search and secure operations prior to facility operations. 2 SF6 Inhibit operation of radiation generating devices when a high radiation dose rate associated with the device is detected in an occupied area 1

10 Function ID Safety Function Required SIL SF7 Deter unauthorized entry to exclusion areas 1 SF8 Provide visual indications of unsecured safe, secure safe, and unsafe radiological enclosure status. 1 SF9 Provide audible warnings of pending unsafe status of a beam enclosure 1 SF10 Activate audible and visual alarms when the indicated oxygen level in monitored areas drops below 19.5% by volume. 1 Multiple Protection Functions In addition to physical redundancy, the PSS also incorporates functional redundancy. For example, a trip in one area may take multiple paths to shut off the injector. A trip in Hall C will not only send a signal directly to the Injector, it will also shut drop the state of the BSY, which has a completely separate connection to the Injector. In the above example, both Hall C and the BSY will also act independently to activate critical devices, preventing beam transport in to the Hall.

11 PSS Operations Control Room Staffing Beam operations require at least two cognizant personnel responsible for ensuring the PSS is maintaining and to react to emergency conditions that may require shutdown (ESTOP) of the accelerator or emergency. As the first line for safety on site, the Crew Chief is responsible for ensuring appropriate response and notifications if personnel are exposed to PIR. Operation of the PSS involves using PSS equipment to ensure that there are no personnel present in the tunnel exclusion area when beam operations are planned, and that all hazardous devices are in a "safe" state when access to the tunnel is permitted. During tunnel access operations, the PSS is an administrative aid. For example, personnel carry out the tunnel sweep using an administrative procedure, but the PSS ensures that a predetermined pattern is followed during the sweep. Safety System Operators (SSO) It is important that all personnel involved with the design, operation, management, and maintenance of the safety systems have a basic understanding of the functions performed by the PSS and how the PSS is implemented. Personnel overseeing PSS operations are trained and qualified as Safety System Operators (SSOs.) SSOs are responsible for oversight of the Sweep and Controlled Access procedures as well as the transition of the PSS from access to exclusion operational modes. The on-duty SSO will monitor all controlled accesses, including personnel both entering and exiting the accelerator tunnel and/or halls. If a controlled access condition exists during shift turnover, the on-duty SSO will inform the on-coming SSO of the identity of everyone in a controlled access area and their approximate location. The on-duty SSO's responsibility for access only ends when everyone is out of all controlled access areas or the responsibility is transferred to the on-coming SSO at shift turnover. SSO training includes review of training material, on-the-job training under the supervision of an assigned mentor, and successful completion of a written test. The candidate is then assigned the qualification of SSO on the recommendation of the mentor, the Group Leader for operations, and the Group Leader for Safety Systems. SSO qualification is tracked in the JLab training database

12 as course number SAF141. The qualification is good for two years, at which time SSOs must complete another written test for requalification. SSO training emphasizes both procedures and the theory behind PSS operation so that they may recognize an unsafe or ambiguous PSS states. All Operations Crew Chiefs are qualified SSOs. In addition to the training of new operators, SSG personnel train all operators when there are changes to the PSS or there is a subject area that requires additional emphasis. The results of SSO tests are tracked and analyzed for trends. Duties and Responsibilities of the SSO The Safety System Operator plays a crucial part in ensuring that person- nel remain safe during accelerator operations. The SSO has to be familiar enough with the safety system to be able to do the following: Follow procedures for operating the safety system outlined in the PSS procedure documents. Configure and operate the various accelerator modes without dropping the machine out of those modes. Recognize abnormal or unsafe PSS status. Be able to diagnose the cause of a safety system fault or drop. Ensure that personnel entering the tunnel are doing so safely. Ensure that the tunnel is properly swept and that the sweepers are out of the tunnel before hazardous equipment is allowed to operate. Understand the various PSS modes and how they affect the safety of personnel in and around hazardous areas and equipment. Keep records of personnel entering the enclosure, exiting the enclosure, and changes in the state of the PSS. Ensure that the Operations crew is kept informed of the status of the PSS operations. Make announcements for change of status of the beam enclosure. Report suspected malfunctions or inconsistencies in the PSS to the on-duty crew chief.

13 The Accelerator Operations Directives (AOD) contains more information on the duties and qualifications of the SSO. Additional resources can be found at SSO Training Sweep Procedures Controlled Access Procedures State Change Procedures PSS Certification Each PSS segment is recertified twice a year and no more than 8 months may pass between certifications. During certification each input is exercised and the outputs are observed for proper response. PSS systems A and System B are verified independently. Certification of the PSS is directed by an approved CEBAF Operation's Crew Chief and is conducted according to a written test procedure for each PSS segment. There is also a series of functional tests to ensure that specific combinations of conditions or functions are properly implemented. Functional tests include each PSS segment s interface to the electron gun, combinations of conditions which can and cannot result in Beam Permit to the Gun, Controlled Access, Detector Hut Access, Beam Current Monitor performance, and Beam Stopper control. Any part of the PSS that is disconnected, repaired, or replaced is recertified. The recertification includes any logic associated with the device and any other devices connected to, or dependent upon, the device in question. More detail about PSS certification is contained it the Certification Procedure for each segment as well as the PSS Configuration Control Document (DRAFT).

14 PSS Implementation Overview Design Philosophy of the PSS The PSS is composed of over 2500 elements. There are, however, a few basic design principles which are used throughout the system. Many of these principles are taken from experience at other accelerators or best industry practice. A summary of the PSS design and operations philosophy is given below. All PSS systems are designed to be fail-safe All inputs which can drop the system to a lower access state are sensed independently by parallel systems. All PSS outputs (permits) which can energize a hazardous device receive independent parallel outputs from the PSS. All PSS sensors and controls are maintained as two independent systems as close as possible to the device which is sensed or energized. The PSS does not share any wiring with any other system up to the device which is sensed or energized. The on/off status of any hazardous device which can be energized by the PSS is also sensed by the PSS; if the device is sensed as being energized when the tunnel access allows occupation of the beam enclosure the PSS will drop the tunnel to it's safest state. Any segmented PSS area has control over all devices which could present a hazard to the area. Any devices which do not serve an interlock function are not implemented redundantly. The PSS is never used as the routine means for energizing equipment but only grants permission to operate the equipment. The only access points to the tunnel are through designated double door access areas. All other doors are for emergency exit only. The PSS uses programmable logic controllers (PLCs) as the primary logic devices to sense and control PSS devices. Relays may be used in areas where a PLC does not provide sufficient isolation from external equipment or other PLCs. PLCs are programmed by two individual programmers. The two programmers work independently and do not share any common algorithms. All equipment not under the direct control of the Safety Systems Group is electrically isolated from PSS equipment. PSS equipment and wiring is located in dedicated PSS racks, conduit, or cable tray. Alternately, isolated equipment or wiring external to the

15 PSS may be located with other systems if the PSS function is monitored. Accelerator operations are suspended in an area before any work on a PSS device in the area starts. Operations in the area do not recommence until rectification of the PSS is complete. Accelerator operations are suspended in any area where a PSS device is suspected of being defective. Operations may not resume until either the defective device is replaced and re-certified or it is determined the device is operable. Any PSS device which is electrically disconnected is re-certified before operations in the area may recommence. Re-certification tests of PSS devices extend from the device itself to any function affected by the device. Any modification to the interlock logic of a currently running PLC program requires a complete re-certification of the area monitored (exceptions noted in the Configuration Control Procedure). After any modification to PLC logic, the revised logic is compared to the previous version to ensure that only the intended change took place. The PLC program is NEVER used to temporarily bypass an active PSS element. Bypassing of active PSS interlock devices is strictly forbidden. If a PSS device is not required for operations the PSS is reconfigured with equivalent protection measures to replace the unused device. Only personnel approved by the Safety Systems group are authorized to work on PSS devices or wiring. CEBAF Tunnel Segmentation The original design of the PSS used a redundant set of PLCs to operate the Personnel Safety System over the entire site. As construction and precommissioning of the machine continued it was determined that one set of PLCs would not have the necessary performance to cover the entire area. As a result the PSS was divided into logical sectors following a geographical division of the tunnel enclosure. Each sector can operate independently to mitigate PSS hazards within its own area. The tunnel is physically segmented into 9 operational areas. They are the Injector, North Linac, South Linac, Beam Switchyard, Hall A, Hall B, and Hall C. Each area has a redundant safety system which is independent from other segments. Each segment s set of PLCs monitor the PSS devices within the area and is responsible for personnel safety within its area. This includes control of any critical device which protects the area.

16 For example, the Hall C PLC system has control over the Hall C beam stoppers and magnet string although they are not physically located within Hall C. Placement of the gates was chosen by the CEBAF Radiological Control Group to ensure that personnel outside an exclusion area would not INJECTOR NORTH LINAC HALL A HALL B BSY SOUTH LINAC HALL C receive radiation in excess of CEBAF limits in a worst case beam loss scenario (ref. 29). A detailed description of the PSS segmentation is given in the "Segmented Personnel Safety System Requirements" document. Each segment reports its current access state back to the Injector segment. Based on the access state of each area the injector logic determines if the electron gun can be energized. The minimum criteria for permitting the electron gun to be turned on is that: All segments that beam will be transported through are in Beam Permit mode. There is a designated medium or high power beam dump within at least one area to dissipate beam. Critical Devices are in place to protect personnel in areas adjacent to beam operations. The North Linac and Beam Switchyard each have two Beam Permit Modes. The first mode is to enable beam to be operated to a beam dump within the segment. The second mode is to enable beam to be transported to the next segment. In the first case, all critical devices must be in place to allow beam operation into a beam dump within a segment. This is to ensure that people down stream of the beam operations are safe. The second case, beam transport mode, the segment indicates that it is ready to pass beam down stream

17 to the next segment. The determination of readiness to allow operation of the gun is made by the injector PLCs by comparing the Beam Permit status of each segment. In all cases the beam must be shut off before switching from one mode of operation to another. In addition to reporting access state back to the injector some segments send and receive access state information to/from other segments. The inter-segment communication is as follows: Hall A BSY Hall B Injector Hall C Hall D N. Linac S. Linac Sectoring of the PSS system also has several other benefits. Maintenance and certification may be performed on each sector with minimal impact on adjacent sectors. The machine can be operated in sectors which, in turn, allow operation of equipment in one part of the machine while

18 another may be safely occupied. Although future beam operations exclusively in the North Linac will become a small part of the overall operation of the machine, the ability to test high power RF amplifiers and magnet power supplies in an isolated segment will be used throughout the life of the machine. The requirement for entry into one or more endstations while another is open for access is an important part of the long term operation of CEBAF. Safety Interlock System The safety interlock system is the part of the PSS designed to ensure that personnel are not exposed to prompt radiation exceeding the JLab administrative limits. This is accomplished by maintaining exclusion areas for accelerator operations. Exclusion areas are designed to maximize the amount of shielding and distance between personnel and beam operations. If an exclusion area is violated, such as if a tunnel entrance door is opened, the interlock system will immediately shut off the beam and any other device which could present a prompt ionizing radiation hazard. This system is composed of two independent parallel systems. If either one of the systems senses an unsafe condition it can turn off the electron gun or any other hazardous device the PSS has control over. This redundancy is to ensure that an undetected failure of one system will not compromise the ability of the PSS to maintain safety. In the safety interlock system the PLCs monitor the status of interlocked devices and permit or deny operation of hazardous devices. Devices which are interlocked include access points to exclusion areas, hazardous equipment such as electron guns, RF and magnets power supplies, and emergency shutdown devices such as crash switches. There are two independent parallel safety interlock systems, labeled A and B. Both System A and System B use PLCs to implement the PSS logic. Each is programmed by a separate programmer using a general logic specification. Figure 3 shows a block diagram of how the Safety interlock system interfaces to a controlled device. EXAMPLE OF REDUNDANT SAFETY INTERLOCK

19

20 Access States The logic for the safety system is state oriented, i.e. the outputs of the PLCs are determined by a few well defined states which are dependent on the status of the inputs. There are 7 states which the logic resolves to: Restricted Access Lockdown, Restricted Access, Sweep, Sweep Complete, Controlled Access, Power Permit, and Beam Permit. Restricted, Sweep and Controlled Access states allow for safe occupation of the tunnel enclosure. Power and Beam Permit require that the tunnel enclosure be an exclusion area. Sweep Complete is an internal mode of the PSS and is not an access state, as is Restricted Access Lockdown. Controlled Access, Power Permit and Beam Permit modes all require that the tunnel sweep is complete. Key Switch Key Switch Key Switch Key Switch Restricted Access Access/Crash/ Of f -Saf e Fault Sweep Mode Access/Crash/ Of f -Saf e Fault Controlled Access Access/Crash Fault Power Permit Non-Access Fault Access/Crash Fault Beam Permit Figure 4. PSS Access States

21 Each state is normally reached by the operator turning the access control key to the position corresponding to the desired access state. If all conditions are OK the PSS will go to the desired state. If any fault exists the PSS will not go to an unsafe state. For example, if the operator switches the access control key from Controlled Access to Power Permit when an exchange key is out the PSS state will not go to Power Permit but will remain in Controlled Access. Restricted Access The lowest (safest) state is "Restricted Access". All permissives are in the "OFF" state. The Run/Safe Boxes are not armed. Access to the tunnel enclosure is Restricted administratively to those with current ODH and radiation worker training by the site perimeter fence and locked doors at each tunnel entrance and service building. These door locks are for administrative control only and are not the same lock used to bar entry into the tunnel during beam operations. Any access control fault will drop the access state to Restricted Access. Sweep Mode The next state is "Sweep Mode". In this state all doors must be closed, except for specified entrance doors, and all high voltage devices must be off. Each tunnel segment has only one access entrance point and only one entrance door may be open at a time. If both entrance doors are open at the same time the sweep will drop and will have to be restarted. Entrance to the tunnel is controlled by a member of the operations crew, designated as the Safety System Operator, by manual control of the magnetic door locks. After a sweep is started no door may be opened until the sweep is complete. The sweepers carry with them a Sweep key taken from the safety system console. This is the same key that is used to control the accelerator access state, thus the state cannot be changed while the sweepers are in the tunnel. During the sweep the sweep team inspects the tunnel to ensure the area is unoccupied, stopping at "Run/Safe" boxes along the way. At each Run/Safe box the sweeper arms the box by inserting and turning the Sweep key, removing the key, and then moving to the next box in the sweep sequence. The sweep pattern is stored in the PLCs. If a sweeper attempts to arm a Run/Safe box out of sequence the box will not arm.

22 The last box in the sweep sequence is always the box at the entrance point. This forces the sweepers to do a complete circuit. After the last box is armed the sweepers have 30 seconds to exit the tunnel. After that if the entrance doors are opened the tunnel will drop to Restricted Access. When the last box is armed there is an internal mode of the safety system which is called "Sweep Complete." This mode is used as a summary of the status of the tunnel sweep.

23 Controlled Access Mode The next higher mode is Controlled Access. In this mode all high voltage devices must be off or the access state will drop to Restricted Access. Tunnel access is controlled by the safety system operator just as in the Sweep Mode. The safety system operator also ensures that each person entering the tunnel has proper training and dosimetry, and that each removes an exchange key from the access key bank. As long as any exchange key is out the PSS cannot be changed to Power or Beam Permit. The inner tunnel access door may only be opened after the master access key is removed and inserted in the key bank. As in Sweep Mode only one tunnel door may be open at a time. No controlled or critical device may be energized in the Controlled Access mode. Power Permit Mode Power Permit mode is designed to allow PSS shutdown of the beam while maintaining operation of devices such as the RF HPAs and large dipole magnets. In Power Permit mode all controlled devices may be energized. The RF HPAs are arranged in banks of five. If one system faults, Power Permit will be removed from the four adjacent systems. This limitation is due to the number of outputs available from the PSS. Critical devices may only be energized if both the segment containing the device and the segment the device is designed to protect are in Power Permit. Beam Permit Modes In Beam Permit mode all critical, controlled and safety interlock systems must be in the not-faulted state. Any fault will drop the PSS out of Beam Permit. HPA, CARM, and BCM faults will drop the PSS to Power Permit. All other faults will drop the system to Restricted Access. Each tunnel segment has a Beam Permit state although only the Injector Beam Permit output controls the permissive to the electron gun. Beam Permit in other segments is interpreted as all devices within the segment are not faulted - i.e. the segment is ready for beam. Injector Beam Permit is determined by the combination of Beam Permits from other tunnel segments. There are presently three segment combinations which resolve to Injector Beam Permit. Figures 5-7 show, in the shaded areas, exclusion areas for each beam operations mode.

24 If any segment drops from Beam Permit the Injector will immediately drop to Power Permit to shut off the electron gun. Once a segment drops to Power Permit, Beam Permit can only be restored by correcting the fault and resetting the sector control key to Power Permit and back to Beam Permit. In all cases the Injector must be the last segment reset. Safety Interlock Devices Devices monitored by the PSS are categorized as critical devices, controlled devices, and safety interlock devices. Both PLC system A and system B monitor critical, controlled and safety interlock devices and either system can independently bring these devices to a safe state. PLC System The PLC system is composed of 15 PLCs. Each of the 7 segments (North Linac and Injector have separate PLCs) have independent System A and System B PLCs. There is one additional PLC located in the MCC which is used to transmit non-interlock control console information to the endstations. Use of PLCs Historically personnel safety systems, also termed radiation protection systems (RPS), Personnel Protection Systems (PPS) and accelerator safety interlock systems (ASIS), were implemented using solenoid activated relays. In the 1960's industry developed a specialized computer which emulated a network of relay logic but retained the reliability and programmability of solid state devices. These devices, termed programmable logic controllers or PLCs, rapidly replaced relay systems in critical applications on factory floors. It was not until the late 1970's, when solid state reliability analysis allowed analysis of PLCs that they were first used in safety applications. The British were among the first to use PLCs in applications such as chemical processing control systems. CEBAF was the first large accelerator to use PLCs as part of the safety interlock system. The use of PLCs has allowed the CEBAF Personnel Safety System to support staged operation of the accelerator during commissioning while minimizing the need for rewiring. CEBAF has conducted several reviews of the use of PLCs for safety systems including a Failure Modes and Effects Analysis of the specific PLCs

25 used. PLC Hardware The PLCs used at CEBAF are the AEG (now Square-D) Modicon 684 family with 800 series I/O. Only discrete (i.e. not analog) modules are used in the PSS. Each PLC location is designated as a master drop. At each master drop there is at a minimum a CPU, two output modules and 3 input modules. In areas where the PLC system must cover large distances remote drops are used. Remote drops contain only I/O and are connected back to the CPU via a dedicated ruggedized coaxial network. Logically, the remote drops are transparent to the PLC operation. Master Drop w/ Local I/O TYPICAL PLC SYSTEM NETWORK (1 OF 2) Master Drop w/ Local I/O Remote I/O Drop Peer-to-Peer Network Program Computer Display Computer

26 Fiber Optic Master Drop w/ Local I/O Fiber Optic Peer-to-Peer Network Fiber Optic Fiber Optic Master Drop w/ Local I/O Master Drop w/ Local I/O Master Drop w/ Local I/O Master Drop w/ Local I/O Remote I/O Drop Hardwired Feedback REDUNDANT PLC DIAGRAM System A Peer-to-Peer Network (1 million bits/sec) Remote I/O Network (1.5 million bits/sec) Program Computer

27 An example of the use of remote drops is in the North Linac. The CPU is located in the MCC equipment room. Local drops are located in the North Access, North Linac, East Arc and South Access service buildings. The South Linac, Injector, and MCC PLCs also use remote drops. PLC System* Master Drop Location Remote Drop Locations North Linac MCC equipment room North Access Service Building North Linac Service Building

28 East Arc Service Building 2 South Access Service Building Injector Injector Service Building Counting House 2nd floor South Linac South Access Service Building South Linac West Arc Service Building 2 Beam Switch Yard BSY service Building 4 None Hall A Counting House 2nd floor None Hall B Counting House 2nd floor None Hall C Counting House 2nd floor None MCC (one PLC only) MCC equipment room Counting House 2nd floor * 2 PLCs (system A and system B) at each location unless otherwise noted. Table 1. PLC and Remote I/O Locations PLC Program Each PLC solves a logic program written as a ladder logic diagram. The program is defined as a series of logical combinations of inputs, written as normally open or closed relay contacts, which energize an output (relay coil). Internal inputs (ones that do not come from an input module) are also used in the logic program. An example may be an internal signal which is the summary of all doors to an enclosure. This summary

29 signal is then used in the logic chain for the Beam Permit output. Each PSS segment has a general logic specification. The specification gives a functional and logical description of the PLC logic for the area. The specification is careful to avoid detailed algorithms or suggested implementations. This allows each programmer the greatest degree of freedom in the actual implementation of the logic. Each PLC input and output is assigned an I/O location. The PSS documentation has an I/O allocation sheet for each PLC. In these sheets are the I/O locations for each PSS signal as well as data register and first fault register allocations. The I/O allocation data is stored in the PLC as a database. Each point includes a description of the function. Each PLC logic program contains two sets of digital registers. At each PLC scan the status of all inputs and outputs are saved to a data register. If the access state output has dropped to a lower state all inputs are copied to a first fault register. The data registers are updated continuously. The first fault registers are used to latch the status of the PLC at the time a fault occurs. This is then used to diagnose what caused the access state of the system to drop. The I/O status is copied to registers so that at no time is the actual real-world inputs or outputs addressed by the display computer. This is an added measure to make sure that an input or output could not be accidentally changed through the network. The PLC program is self documenting in that it is printed as an actual ladder diagram. Because the I/O is stored as a database the ladder logic diagram can include descriptions and cross references of each I/O point. PSS Computer Three computers are used in the monitoring of the PSS. Two PCs are used in the monitoring and programming of the PLC system. Each of the PCs has two token ring communication ports, one for the system A group of PLCs and one for system B. The first PC is for the programming, diagnostic, and performance monitoring of the PLC logic system is used by safety system personnel only. The second PC operates as the safety system operator s display. The PLC status registers are read by this PC and displayed as red or green icons on the operational screens. First faults are also displayed on these screens. Other, special purpose, screens have been developed to aid

30 operators in switching between machine modes and in performing accesses. The software used to read and display PSS status is an industry standard package which has been in use worldwide for several years. The package includes security, alarming and event logging. The display computer is used to monitor the status of each PLC system. It is a read-only device and serves as an administrative aid in operating the PSS. No interlock function is performed by the either PSS computer and the PSS can be operated without the displays. Critical Devices A Critical Device is something used to ensure that the electron beam does not enter an occupied area. In such an area CEBAF uses three critical devices to achieve this purpose. Each of the critical devices can independently stop beam from entering an occupied area. Each is redundantly sensed and activated by the PSS Systems A and B. At least two different types of technologies must be used in implementing critical devices in order to reduce the chance of a common mode failure. The primary means of preventing beam from entering an occupied area is passive. Large bending magnets which are normally used to bend the beam between sectors are shut off by the PSS. A secondary means of preventing beam from entering an occupied area is the use of beam stoppers. The beam stoppers used at CEBAF are copper slugs which can be removed from the beam line by a pneumatic cylinder only if the down stream area is in an exclusion mode. Because of the high average beam power at CEBAF there is no practical device which could stop the beam indefinitely. In such areas (for example at a beam stopper) there is an additional system that will terminate the beam at the injector if excessive beam current is detected at the critical device.

31 Injector North Linac Hall A Hall B Hall C Beam Stopping Devices Beam Switchy ard South Linac = Magnet Control = Beam Stopper = Electron Gun CEBAF Electron Gun: The electron gun is the primary means of removing a prompt ionizing radiation hazard if a fault occurs during operation of the accelerator. High voltage is removed by opening contacts in the high voltage power supply which control the HV On/Off and the AC power to each gun s high voltage transformer. The PLC system can shut off the high voltage to the guns in less than 500 msec. The PSS also has a fast beam shutoff interface to the beam modulation electronics. The fast shutdown method is used by the fast electronics system to shut off beam in less than 1 ms. Beam Stoppers: Beam Stoppers are 70 kg copper slugs attached to a pneumatic piston in a beam line vacuum chamber. Currently there are two stoppers installed in the Hall C transport line. Each stopper is monitored and energized by both PSS system A and system B. Several fail-safe features are built into the beam stoppers. Power, in the form of a permissive from each of the PSS systems A and B, is required to remove the stopper out of the beam line. Loss of power or power applied simultaneously to the IN and OUT cylinders will result in the stopper going to the "IN" position. Each stopper has a built in burn through monitor. The monitor is a pressurized chamber within the slug. Chamber pressure is sensed by redundant sensors. Loss of pressure is assumed to be a beam burn through and a fault. Pneumatic Piston

32 >15 Χ 0 Copper Slug >6 Χ 0 Copper Slug Beam Direction Nitrogen filled pressure chamber CEBAF Beam Stopper Each stopper also has redundant IN and OUT position sensors. The status of the stopper position is monitored by the PLCs. For a stopper position to be valid the status indicators must agree. For example, for the PSS to accept that a stopper is in the OUT position the switches must indicate that the stopper is OUT and NOT IN. Any fault of the stopper will drop the segment out of Beam Permit. Normal IN/OUT control of the beam stoppers is done through the accelerator control system. From this screen the operator can issue a request to extract the stoppers. If both the system A and system B permissive is active power will then be applied to the stopper pneumatic control and the stopper extracted. Note however, that each time the stoppers are inserted or extracted the beam will be shut off. This is due to the fact that while the stopper is in transit the position sensing switches read that the stopper is NOT IN and NOT OUT which is a fault. Beam Diffusers Injector Apertures

33 Fast Gun Interface System Beam Current Monitors Redundant beam current monitors are installed in the injector and directly upstream of each beam stopper. The injector BCMs are designed to trip if the measured current exceeds 190 µa which reflects the current CEBAF operating power envelope. The beam stopper BCMs are designed to trip if the beam current exceeds 1 µa when the stoppers are IN. Due to the very high average power of the CEBAF electron beam the beam stoppers cannot stop the beam for more than 7 ms for the worst case. This time frame is too short for the PLC system to react to shut off the beam. The BCM System is designed to detect beam hitting a beam stopper and shut off the beam before burn through can occur. It is implemented redundantly, just like the PLC system. The components of the systems are located in the Injector, East Arc, and Beam Switchyard. Each is composed of a BCM detector and logic circuitry. Each system also has a fault output to the local PLC. If the PLC detects a BCM fault it will drop the area and the Injector out of Beam Permit. The BSY system also receives an input from the BSY PLCs which tells the BCM system the status of the Beam Stoppers. If the Beam Stoppers are OUT then the BCM fault function is bypassed. This is to allow normal operation at high current when the stopper protection is not needed, e.g. the stopper is out. The permissive outputs of the BSY are transmitted to the Injector over fiber optic links. A 625 khz fiber optic permissive signal is routed from the injector chassis to the electron gun control electrode driver. Loss of the 625 khz permission signal will shut off the electron beam in less than 200 µs once a fault is detected. Arc Magnet Strings All Box dipole supplies are interfaced to the PSS. Normally they can be energized when the segment containing the magnet string is in Power Permit (see 4.3.3). Magnet strings which could transport beam to an occupied area down stream of the string are operated as critical devices. The East arc and the experimental transport arc strings are critical devices. The East arc string may only be turned on if: The North Linac is configured for recirculated beam

34 Both the North Linac and South Linac are in Power or Beam Permit The experimental hall string may only be turned on if: The BSY is configured for beam to the hall Both the hall and the BSY are in Power or Beam Permit Controlled Devices Controlled devices are accelerator systems which are not part of the Personnel Safety System but present a hazard to people in the tunnel when operating. They receive redundant permissive signals from the PSS and their on/off status is redundantly monitored by the PSS. There are presently two types of controlled devices interfaced to the personnel safety system. They are the RF High Power Amplifiers and the large dipole magnet or "Box" power supplies. Each of these external systems is interfaced to the PSS through an isolation chassis so that equipment failure of the controlled device will not affect the ability of the PSS to operate safely. Each of these systems gets a redundant "Permit" signal from the PSS and the RF and magnet systems send back a redundant "Off/Safe" indication. In addition the RF HPAs send back an "Interlock Ready Signal". The "Ready" signal indicates that neither a HPA door is open nor the waveguide from the HPA to the superconducting cavities is loose or missing. Both of these conditions could lead to exposure of personnel working in the HPA cabinet. RF High Power Amplifier Three hazards are presented by operation of the HPA. One, the waveguide used to transport the RF from the HPA to the tunnel is rather large. This requires an unusually large (24 ) penetration to the tunnel. In the event of beam loss under the penetration personnel in and around an open HPA could be exposed to an uncontrolled low radiation dose. The second hazard presented by the HPA is high (>5mW/cm 2 ) RF emission in the area if a waveguide is disconnected. RF emission may be due to either a high power klystron output or RF stimulated in a cavity by the beam. The third hazard is x-ray field emission of an RF cavity. Field emission is stimulated when charged particles from the cavity surface are accelerated into the opposite cavity wall, thus creating a particle shower. In the worst case the emission can be coherent and the x-rays produced on the order of several

35 kilorem/hr. The RF High Power Amplifiers are interfaced to the PSS through an interface isolation chassis. Signals from the PSS to the HPAs are "Power Permit". Signals from the HPA to the PSS are "Ready" and "Off/Safe". The ready signal is an indication that all high power amplifier doors are closed and the waveguide is holding > 1psig pressure. The Off/Safe signal indicates the status of the HPA Cathode Power Supply (CPS) contactor solenoid and three phase AC power. Power Permit will be passed from the PSS to the CPS only if the HPA "ready" is good (no fault) and the status of the PSS is Power Permit. The HPA groups are: IN02-IN04, NL02-NL06, NL07-NL11, NL12- NL16, NL17-NL21, NL22-NL26, SL02-SL06, SL07-SL11, SL12-SL16, SL17-SL21, SL22-SL26. If the HPA ready signal faults on any one zone then Power Permit will be removed for all HPAs within the group. A ready fault will drop the injector to Power Permit. Magnet Box Supplies Each high power magnet box supply is interfaced to the PSS. There are two hazards mitigated by the PSS. One, magnet leads in the tunnel are exposed and are not easily covered. The magnet power is up to 600V at 600 A. The second hazard is beam transport to occupied areas. This case is addressed under "Critical Devices". Signals to the power supplies from the PSS are "Power Permit". Signals from the power supplies to the PSS are "Off/Safe". Note that the arc magnets cross between segments. The North Linac must be in Power Permit mode and configured for recirculated beam and the South linac must be in Power Permit mode for the east and west arc magnet power supplies to receive Power Permit. Special note about OFF/Safe The action of going from Power Permit to Controlled access will remove Power Permit from the RF and Magnet power supplies. If the OFF/Safe status indicates "ON/Unsafe" in Controlled Access or Sweep modes the PSS will drop to Restricted Access. A 0.5 second timer is included in the PLC logic that allows the power supply high voltage to discharge before the OFF/Safe status would drop the PSS system to Restricted Access. If the OFF/Safe status is still "ON" 0.5 seconds after switching from Power Permit to Controlled Access, the system will drop.

36 Access Control Devices Access control is accomplished through a combination of interlocks and administrative procedures. All interlocks are designed to be fail-safe by ensuring that power is provided to/from the device only if it is in the "safe" state. If power is not present the device is assumed to be in the "unsafe" state and the PSS will act accordingly. All entrances and exits to the tunnel are monitored by the PSS systems A and B. This includes hatches and elevator shafts. If any door is open other than a designated access point during sweep or controlled access the tunnel access state will drop to restricted access. If any entrance or exit is opened when the tunnel is in Power or Beam Permit the tunnel access state will drop to Restricted Access. Access Points There are currently 9 designated access points to the accelerator tunnel and endstation(s). They are located in the North Access Service Building, the Injector Service Building, the South Access Service Building, the Beam Switchyard Service Building, the endstation labyrinth area (A, B, C), The Tagger Truck Ramp, and the Hall D Counting House. The access area is used to enter the tunnel either to perform a sweep or to enter under controlled access. For both of these modes it is up to the safety system operator to ensure that only authorized personnel enter and exit the tunnel and make sure that all personnel have exited the tunnel before switching to Power or Beam Permit. Injector Access North Access Hall A Hall B Hall C BSY Access South Access

37 Tunnel Access Points Each access room has a door at each end, a controlled access exchange key bank, and entrance/exit video, and telephone systems. In addition to redundant position sensors each door has a magnetic lock. The door lock, exchange key, intercom, and video are all monitored at the safety system console in the control room. The door locks are automatically activated when either PSS system A or System B is in Power or Beam Permit. They may also be manually controlled form the control console in all other modes. Beside each door is an emergency exit maglock cutoff switch. The switch is there to allow emergency egress in case of fire or other emergency. The switch ties directly to the maglock power and is not sensed by the PSS. Non Access Doors All non-access doors are mechanically locked in addition to having redundant PSS interlocks. There are currently 9 exit doors, 14 emergency exits, 9 hatches, 5 roll-up doors, and 2 elevators that are interlocked. In addition there are 9 tunnel gates/doors which separate PSS tunnel segments. All of these gates are locked and redundantly interlocked by both segments sharing the gate. The locks are automatically activated when the access state of either segment bordered by the gate is in Sweep mode or higher. All of the Beam Switchyard gates/doors are two-way emergency exits, i.e. one must be able to egress from either side of the gate in an emergency. For that reason, each side of the gate is equipped with an emergency exit magnetic lock cutoff switch.

38 Detector Hut Access Experimental Hall detector enclosures (detector huts) are treated as a semi-autonomous area. Once the Run/Safe box in the hut has been reset the area inside the hut will remain armed as long as the hut door remains closed. A 5 minute timer built into the PLC logic allows personnel time to completely close the detector hut door before the position of the door is sensed. The timer starts as soon as the box inside the hut is reset. During a Controlled Access, if someone enters the hut enclosure the run/safe box inside will drop. All other run/safe boxes in the endstation will remain armed. The detector hut box must be reset and the detector hut door closed before the endstation access state can be set to Power or Beam Permit. Crash Switches Crash switches are designed as an emergency measure to immediately cut off all hazardous devices in an area. Local crash switches will crash the PSS segment the switch is located in. Each experimental endstation has a crash switch located on the endstation control room console. Each Run/Safe box in the tunnel enclosure also houses a crash switch. The TOP STOP crash switch located on the PSS operations console will crash all segments, regardless of the present beam operating mode. In all cases a segment will crash to Restricted Access. Run/Safe Boxes The Run/Safe Boxes are designed to handle several functions. First they are installed throughout the tunnel to provide emergency "Crash" switches. Secondly they provide a station to confirm the sweep sequence. Third they provide a visual safe/unsafe status of the tunnel enclosure. The crash switch is a large detent latched red button. Contacts on the crash switch are monitored independently by system A and system B. If pushed, the tunnel segment will immediately drop to Restricted Access. The Sweep key has two positions - one is "Set Interlock" and two is "Reset". Each key position is independently sensed by system A and system B. If the access state is Sweep Mode the PLC will latch the status of the run/safe box once the key is set to the reset position. This status is

39 held until the sweep is broken. Each Run/Safe box also contains a status panel with three lamps which are labeled "Safe", "Operational", and "Unsafe". The status of the lamps is controlled by the System A PLC. The "Safe" lamp is lit when system A is in Restricted, Sweep, and Controlled Access modes. The "Operational" lamp is lit when System A recognizes the Run/Safe box has been armed. The "Unsafe" lamp will light when System A OR System B is in Power or Beam Permit modes. Controlled Access Exchange Key Each designated access point has an exchange key bank for Controlled Access. The exchange key system consists of a master key and 10 slave keys. The position of the master key is redundantly sensed by the PSS. If the key is out the PSS will inhibit the access state from going to Power or Beam Permit. Each secondary key is mechanically locked into the keybank and may only be released when the master key is inserted and turned. The master

40 key is captured in a separate key box and can only be released by the safety system operator and only when the segment to be accessed is in Controlled Access mode. Once the master key is released the personnel accessing the tunnel will insert it in the slave keybank and each take a secondary key. Warning Lights and Klaxons When a tunnel segment enters Power Permit mode tunnel lights are turned OFF by the PSS System A. In the endstations, where it is not practical to dim the lights, a radiation warning klaxon goes off for 30 seconds. During this time Beam Permit to the gun is inhibited by both PLC systems. In both areas all Run/Safe box status indicators go to unsafe. Above the outer door of each access room is a 24 character status display. The display shows the current access state of the tunnel area associated with the access room. Above each exit stair door and tunnel gate is a rotating magenta beacon. The beacon is on whenever the area on the opposite side of the gate

41 or door is in Sweep mode or higher. Controlled Area Radiation Monitors (CARMs) Radiation monitors are distributed in occupied areas throughout the accelerator site. They are designed to measure and log long term trends of neutron and gamma radiation in occupied areas. They are generally placed in areas likely to be between a radiation source and workers. The CARM is not a critical or controlled device but does contain a redundant set of alarm relay contacts. These contacts are monitored by the PSS in each segment. If the radiation dose rate exceeds a preset limit the contacts open and the PSS will drop out of Beam Permit. Both the neutron and gamma sensors may be located up to 75' from the CARM electronics to optimize their sensitivity. CARM placement and trip point settings are under the direct control of the CEBAF Radiation Control Group. Control Room Console The Control Room Console contains all interfaces required to operate the PSS. Located on the console are the PSS display monitor, the access state key panel, the access control panel, video monitors, the intercom master hand set, and an emergency 911 telephone. There is also a PSS diagnostic computer which is used by safety group personnel only.

42