1. André Augustinus 15 March 2003 DCS Workshop Safety Interlocks

2. André Augustinus 15 March 2003DCS Workshop 2 Safety, introduction  What is Safety: Safety of people (prevent injuries or worse) Safety, integrity of equipment (protect capital investment)  CERN Safety System Covers Level3 alarms (Fire, Gas etc.)  DCS ensures integrity through: Alarm reporting (for operator intervention) and automation Detailed control on detector level and control of infrastructure and services (with high granularity) Interlocks on detector level

3. André Augustinus 15 March 2003DCS Workshop 3 Safety, introduction  Concentrate today on interlocks What classes of interlocks Inventory of needs Open questions  Few words on the role of DSS

4. André Augustinus 15 March 2003DCS Workshop 4 Interlocks  Primary task is to protect equipment and the sub- detector from serious damage  In order to be able discuss efficiently the subject, and to define requirements more precisely, we should try to define a common understanding of interlocks: what is an interlock  Define different classes of interlocks Described in ‘interlocks document’ (and TDR) Please comment!

5. André Augustinus 15 March 2003DCS Workshop 5 Interlock classes  Consider ‘interlocks’ in its widest sense Distinguish four classes of interlocks:  “Hardwired”: Internal interlocks Cross-system interlocks Actions  “Software”: Actions Low level High level Complexity

6. André Augustinus 15 March 2003DCS Workshop 6 “Hardwired” internal interlocks  Provide intrinsic protection of each type of equipment, lowest level of interlocks Built into equipment or electronics  Examples: Switch-off of HV channel at over-current (‘Trip’) Hardwired protection on the Front End Electronics E.g. ‘programmed’ in a FPGA E.g. switch-off a voltage regulator at over-current

7. André Augustinus 15 March 2003DCS Workshop 7 “Hardwired” internal interlocks Interaction with DCS  Some of these interlocks might have no interaction at all with the DCS But the result of an interlock being activated will be seen  Some of these interlocks might be read The DCS will be informed if an interlock is activated or not  Some of these interlocks might need to be configured (setting a limit, such as maximum current: ‘trip limit’)

8. André Augustinus 15 March 2003DCS Workshop 8 “Hardwired” internal interlocks Provide an inventory of this class of interlocks, especially if an interaction with DCS is required (read status, set limits)

9. André Augustinus 15 March 2003DCS Workshop 9 “Hardwired” cross-system interlocks  This is what is usually understood as interlock  Consist of a hardwired connection between two sub- systems  Usually a contact that is kept closed by the source action is triggered when contact is opened  Typical example is to interlock HV if gas mixture is wrong (risk of sparks) or interlock LV if cooling is failing (risk of burning electronics) Power Supply Gas or Cooling

10. André Augustinus 15 March 2003DCS Workshop 10 “Hardwired” cross-system interlocks Interlock source  Only few are ‘real’ hardwired = activated directly by a dedicated sensor Example: thermo-switch  Most are generated by a PLC or similar system Relay in gas or cooling control system User defines conditions to activate interlock Temperature too high, gas mixture wrong  Other sources might be magnet control system, LHC accelerator, neighbour sub-detector etc.

11. André Augustinus 15 March 2003DCS Workshop 11 “Hardwired” cross-system interlocks Interlock receiver  Usually (HV and LV) power supplies Action is a emergency off of the power supply (usually a crude action) Commercial power supplies have an input for interlock Custom built equipment will have to implement such an input Provision should be made to distribute a single interlock signal to a set of power supplies (e.g. daisy chain)

12. André Augustinus 15 March 2003DCS Workshop 12 “Hardwired” cross-system interlocks Provide an inventory of these interlocks and define: On what conditions does the source have to activate the interlock? Are these conditions ‘fixed’ or likely to change often? Does the receiving end have an input for an interlock? Can we standardise on a closed contact for these interlocks? (thus, opening the chain will trigger the interlock)

13. André Augustinus 15 March 2003DCS Workshop 13 “Hardwired” actions  Can be seen as a “gentle interlock”  A hardwired signal will trigger a predefined action E.g. a ‘fast’ ramp down of the HV  Signal can be generated by the same source as mentioned before or even a simple push-button  However, this functionality does note come for free! Is normally not foreseen in equipment, need a specific implementation Provide your requirements for such actions

14. André Augustinus 15 March 2003DCS Workshop 14 “Software” actions  Normal level of protection  Programmed in the DCS (e.g. in Finite State Machine), can have any level of complexity  Examples: Make sure systems can only be switched on if other systems are OK (and switch systems off if problem in other systems) Make sure systems are switched on or off in a given order Provide first ideas on your requirements for such actions

15. André Augustinus 15 March 2003DCS Workshop 15 Your input is requested  Assess the potential hazards in your sub-detector  Decide what kind of interlock is suitable Is a software action sufficient, or is a hardwired interlock required (ask yourself what happens if the software action is not performed)  Make an inventory of all interlocks What is the source and what are the conditions to activate the interlock Make sure the ‘receiving end’ can receive interlocks, and what signal does it need (opening a contact, stop supplying a given level)

16. André Augustinus 15 March 2003DCS Workshop 16 Food for thought  What happens to your equipment and detector in case of power cut Might happen more often than activation of an interlock  What happens in case of a partial power cut E.g. no power in counting room, but still power in cavern  Are you sensitive to external systems or influences E.g. neighbouring sub-detector, magnet, LHC, earthquake  Can we standardise on ‘closed contacts’ for our interlocks

17. André Augustinus 15 March 2003DCS Workshop 17 The role of DSS  DSS is a ‘safe and reliable’ part of DCS and can be used to transmit crucial signals  Currently thought to be used to monitor the experiments environment (temperatures, water leak, power status)  Not necessarily involved in sub-detector interlocks To be seen on a case by case basis

18. André Augustinus 15 March 2003DCS Workshop 18 Conclusions  Defined different classes of interlocks Let us know your remarks  We need your input, your requirements concerning interlocks Especially the ‘hardwired’ ones Check if your equipment can accept interlocks  Think about the open issues pointed out before