The Detector Safety System for LHC Experiments

1
The Detector Safety Systemfor LHC Experiments

• Stefan Lüders ? CERN EP/SFT IT/CO
• CHEP03 ? UC San Diego ? March 27th, 2003

2
Outline

• Experimental Safety
• The DSS
• Experimental Needs
• Functional Requirements
• Design and Architecture of the Prototype
• Planning and Conclusions

3
3 Levels of Experiment Safety
The DSS complements CSS and DCS The DSS is a
system to safeguard the experiment. As such, it
acts to prevent damage to the experimental
equipment when a serious fault situation is
detected (e.g. temperature too high, water
leak,bad sub-detector status), inside or
outside of the detector

• Sensors monitor the state of the equipment
• temperature (equipment, ambient air, water),
• humidity,
• water-flow,
• sniffers,
• status signals of the sub-detectors
• There are dedicated sensors for the different
  safety and control systems, but they are not
  duplicated.

• The LHC experiments and their sites, e.g.
• (sub-)detectors,
• gas systems,
• magnets,
• power distribution,
• racks and crates
• will be the equipment to be acted upon directly
• by the control and safety systems.
• Technical Services provide power, water, gas
  (general services) and distribute them to the
  different locations (experiment services).

The DSS is embedded in an Experiments DCS. Alarm
conditions are exchanged with the CSS (hardwired).
The safety for personnel is ensured by the CERN
Safety System (CSS). It is required by law and
conforms to relevantInternational, European, and
National standards. It has its own sensors and
reacts globally, i.e. on whole buildings or
caverns.
The Detector Control System (DCS) is
responsiblefor the overall monitoring and
control of the detector. It might take corrective
action to maintain normal operation. All DCS
sub-systems are interconnected.
In 2001, the experiments have realized, thatsome
safety aspects are not covered by the CSS and
DCS. The DSS was born.
Back-End / Supervisory Layer
CSS
DSS
Front-End / Hardware Layer
4
Scope and GoalAn Optimization Challenge

• The DSS should
• protect experimental equipment
• improve the experiments efficiency by
• preventing situations leading to level-3-alarms
• (these might lead to 2-3 weeks downtime)
• decreasing downtime due to failures
• not cost too much
• DSS can be considered as an insurance policy.

5
Constraints for the DSS

• The DSS is a common solution proposed forall
  four LHC experiments (ALICE, ATLAS, CMS and LHCb)

• Easy integration
• into the control system of the experiment
• of sub-detector safety systems
• of external information(from the LHC machine,
  gas system, CSS, )

• Adaptability
• to the different needs of four experiments
• to the evolving experiment environments

6
LHC Experimental Needs

• 200 to 800 analog and digital inputs to be
  monitored

• several digital 100 outputs

• sensors and actuators located in the cavernsand
  in several buildingson the surface

Geographicallydistributed system
7
The DSS Functional Requirements

• The DSS functional requirements have been
  evaluated by the four LHC experiments in a joint
  working group.
• The DSS must be a standalone system, and be
• highly reliable
• highly available
• as simple and robust as possible
• re-configurable by the experiments safety
  experts
• self-checking for consistency

8
The Prototyping Phase

• A DSS prototype
• is currently being developed by the DSS Team(2.5
  FTE) to meet the defined requirements
• will be a proof-of-concept
• The DSS Advisory Board, consisting of
  representatives from all four LHC experiments,
  safety experts, and the DSS Team are overseeing
  the prototyping phase.
• A review in June 2003 will verify that the design
  meets the requirements. This will allow for
  series production.

9
DSS Front-End Architecture

• After discussions in the DSS Advisory Board, the
  Front-End will
• be based on industrial solutions, e.g.
• PLC technology for safety applications
• standard communication protocols (PROFIBUS,
  Ethernet, OPC)
• have its own sensors and actuators
• check and filter the input sensors
• be on safe power (CERN safe power plus own UPS)
• will always react immediately and automatically
  on fault conditions indicated by the sensors

10
The PLC Cycle

• The PLC Cycle
• The PLC continuously monitors the sensors
• e.g. temperatures, water flow,sub-detector status

• Input values are compared to defined thresholds.

• Several conditions can be logically combined.
  Their fulfillment will produce an alarm.

• Alarms will trigger defined actions.
• Actions are taken on a coarse level (e.g.cutting
  power to a complete sub-detector).

End-of-Cycle
11
DSS Back-End Architecture

• The DSS User Interface (Back-End) will
• be based on the SCADA system PVSS andCERNs
  JCOP Framework
• monitor and configure the Front-End
• allow a configuration of the relations between
  sensor values, alarms, and the actions performed
  in these cases (the Alarm/Action Matrix)
• define user access levels
• provide the user with comprehensible displays
• log alarm states, warnings, and related
  information

12
DSS Architecture

• Redundancy
• up to the level of I/O interfaces
• backup in case a power supply, CPU, Profibus
  failure
• modules have high MTBF (low failure rates).
• optical link between CPU modules
• step-by-step comparison inside the processing
  of the PLC cycles

• OPC server
• gateway to the Back-End (Windows XP)
• data distribution via Siemens OPC software
• redundant in the Front-End communication

• Back End PVSS user interface for
• display
• logging
• modification of the Alarm/Action Matrix

13
Status

• Hardware development
• The PLC hardware has been installed in the DSS
  lab at CERN and is currently being commissioned.
• Survey of useful sensors (ambient air cooling
  water temperature, humidity, etc.) has started.

• Software development
• A first implementation of the Front-End software
  has been made.
• The DSS database prototype has been defined. It
  is based on Oracle.
• PVSS Back-End interface implementation is in
  progress.

The prototype DSS system will be readyfor the
review in June 2003.
14
Planning Overview
Prototype
Series
15
Conclusion

• The design of the Detector Safety System, arrived
  at in consultation with the DSS Advisory Board,
  will consist of
• a Front-End
• Siemens S7-400 redundant PLC hardware
• PC based OPC server acting as a gateway
• a Back-End
• A PC based system with the PVSS user
  interface,using CERNs JCOP Framework
• Oracle Database connection for data and
  configuration logging
• The prototype will be ready for the review in
  June 2003
• For more details see http//cern.ch/proj-lhcdss/