Charge 2. Equipment Protection 3. Definition and Documentation a. Are all the equipment protections functions (in particular responses to abnormal conditions such as trips, alarms and interlocks) comprehensive, clearly identified, documented, implemented, and traceable to the PLC code? 3. Definition and Documentation a. Are all automated functions (Alarms, Trips, Interlocks/Persmissives, Cause and Effects, Control Loops, and Automated Sequences) sufficeintly documented for Coding, Testing, Commissioning, Operation, and Troubleshooting? 6. Commissioning a. Has JLAB developed a plan to perform commissioning? c. Does JLAB’s plan for commissioning and testing of the coldboxes appropriately address commissioning and checkout of the PLC controls prior to testing the coldboxes? LCLS-II Software Review, November 14, 2018

Equipment Protection Requirements The equipment protection relies upon accuracy of the following: PLC Equipment protection logic. FMEA and Software Specification checks. Bench testing of software. History of working in similar installation (JLAB). Appropriate wiring for Inputs and Outputs. Pre-commissioning checks. Correct transducer calibration and switch set-points. Transducer and Switch calibration documentation trail. Checked during Pre-commissioning checks. LCLS-II Software Review, November 14, 2018

FMEA – Identification of Control functions The FMEA identified actions by the control system that would be required to deal with failure modes or upset conditions As an example, the below shows the Gas Management FMEA identifying a need for a low temperature alarm on the Cold Box LP Return header (TP21015). LCLS-II Software Review, November 14, 2018

Software Specification – Specification of Function The software specification incorporates elements identified in the FMEA LCLS-II Software Review, November 14, 2018

The PLC Code actively implements these alarms, trips, or interlocks. PLC Code - Realization The PLC Code actively implements these alarms, trips, or interlocks. LCLS-II Software Review, November 14, 2018

Equipment Protection in PLC Code (Trips) Main Compressors Oil, Temperature, Motor, Pressures Guard Vacuum Pumps Oil, Maintaining vacuum when operating Recovery Compressors Oil, Temperature, Motor, Pressures Turbines Bearings, Process and bearing temperature/pressure, Instability, Speed, Brake conditions Heat Exchangers Temperature Gradients 2K Cold Box Backflow, Surge/Choke/Stall, Cold Compressor Correct Operation. LCLS-II Software Review, November 14, 2018

Heat Exchanger Trips The 4K Cold Box control philosophy calls for monitoring differential temperatures across heat exchangers and tripping the cold box if the operating envelopes are violated. LCLS-II Software Review, November 14, 2018

Trips identification The standard for PLC codes that handle trips is to log what those trips are. This is typically done via an integer that can be archived and shows the trip/running history of a machine. The HMI/EDMs will also show a text box listing why the piece of equipment tripped off, if relevant. (Note: E-STOP is a hard-wired trip that the PLC only needs to recognize as having happened). LCLS-II Software Review, November 14, 2018

2 Stage PID loop equipment/plant protection Sometimes PID loops are used to accomplish limited equipment/plant protection tasks. This is a level of protection that exists prior to equipment trips. For example, In the recovery system, the valve from Dirty Line to recovery, PV71010, has a primary loop that controls recovery suction pressure PT71010, while a secondary PID loop will force the valve closed if the dirty line pressure PT11032 drops too low. The recovery bypass valve (PV71020) would open up according to it’s own PID loop setpoint. This prevents the Helium gas storage tank pressures from being brought too low by the system without having anything more complicated than PID loops. LCLS-II Software Review, November 14, 2018

Equipment Protection: Interlocks Generally, anything that functions as a trip also functions as a permissive or interlock. This prevents things like trying to start a recovery compressor with no oil in it. There are conditions that are not directly interlocked but are still protected against. For example, trying to start a compressor with the outlet valve closed will result in a High Discharge pressure trip. c. There are some interlocks that are independent of trips, for example Recovery compressor oil temperature must be > 295K prior to start, but is not monitored as a trip during operation. LCLS-II Software Review, November 14, 2018

Emergency Stops (Non-Software) Stop switches are located on all rotating equipment. External power disconnect switches are located on all enclosures fed by greater than 150 Volts. LCLS-II Software Review, November 14, 2018

Personnel safety during commissioning Lockout Tagout procedures identify hazards and how to mitigate them prior to working on equipment.

Pre-Commissioning Testing The goal of the Pre-commissioning checkout is to verify that field wiring is correct down to the device level, ensuring the correctness of the installation and wiring. Verification that the wiring is correct from the field all the way to the PLC and HMI. Verify correct wiring/operation of outputs from the PLC such as valves, heater commands, and equipment start/stop commands. Check calibration and settings for transducers, temperatures, and switches during pre-commissioning. This should be done physically and adds a layer of confidence in addition to calibration sheets. LCLS-II Software Review, November 14, 2018

Running Hours for equipment protection at JLAB The 6 Compressors and the Gas Management software that form the basis for the LCLS-II code exist in JLAB CHL2 and have had a combined ~220,000 Running hours. They have been tested against power-outages and the kind of physical failures they are expected to handle such as running low on oil or having cooling tower water cease. The 2K Box Surge and Trip logic comes from JLAB’s two 2K cold boxes and has been tested against real world conditions for decades. LCLS-II Software Review, November 14, 2018

Vendor Cooperation 4K Cold Box protection logic is being defined by Air Liquide, and the PLC Code is being checked by them in addition to JLAB. 2K Cold Box Cold Compressor individual protection is done at the level of the ALAT Control Enclosure. Compressor motor trip points defined by motor manufacturer and managed in commercial motor protection unit. LCLS-II Software Review, November 14, 2018

Charges 2. Equipment Protection Are all the equipment protections functions (in particular responses to abnormal conditions such as trips, alarms and interlocks) comprehensive, clearly identified, documented, implemented and traceable to PLC Code? Yes. The document trail goes from FMEA/Software spec to PLC Code. 3. Definition and Documentation Are all automated functions (Alarms, Trips, Interlocks/Persmissives, Cause and Effects, Control Loops, and Automated Sequences) sufficiently documented for Coding, Testing, Commissioning, Operation, and Troubleshooting? Yes. Documentation features these items and they are consistent with standard cryogenic plant automated functions. 6. Commissioning a. Has JLAB developed a plan to perform commissioning? Yes. c. Does JLAB’s plan for commissioning and testing of the coldboxes appropriately address commissioning and checkout of the PLC controls prior to testing the coldboxes? Pre-commissioning and bench testing activities should be sufficient to give confidence in the cold box equipment protection. LCLS-II Software Review, November 14, 2018