1. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 Configuration Control of PPS FAC Review November 2008 E. Michael Saleski Controls Dept Safety Systems QC Manager

2. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 Configuration Control Elements Prevention of Unintended Change Physical Security of System Labeling Training Control of Intended Change Work Planning (adequate review of design) Work Authorization (RSWCF) Verification of Work (RSWCF) Periodic Confirmation of System Integrity Routine testing and inspections

3. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 SLAC Configuration Control Policies Guidelines for Operations Guideline 14 “Configuration Control of Radiation Safety Systems” Guideline 24 “Safety Review of Major Modifications” Guidelines 27 “Testing of PPS Systems” Radiation Safety Systems Technical Basis Document

4. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 CD Safety Systems Section Configuration Control Documentation Change Control Plan Document Management Plan Document Change Control Procedure Document Change Order Design Review Plan Software Configuration Management Engineering Change Order Procedure Engineering Change Order Drawing Management Procedure

5. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 Physical Security PPS Equipment is situated in locked racks Field devices are labeled as ‘PPS;’ checked regularly by OPS New PLC-relevant issues: Program Storage Security Version Management Network Access Security ADSO and the RSWCF are the gate-keepers for work on the system

6. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 PLC Physical Security Software Security: Safety-critical program ‘smart card’ cannot be written on while in the PLC Communication with the ‘supervisor’ PLC is through TCP/IP Communication between the ‘supervisor’ PLC and the safety-critical PLCs is through DeviceNet serial data communication fully contained in a locked rack. Operational Security: Hardwire Enable from MCC required Only specific IP addresses are allowed to issue PPS commands

7. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 PPS PLC Architecture Safety-Critical Doors, EO, EE, Search Status, Keybank Modulators, Stoppers Non Safety-Critical Access States Door/Keybank release Status reporting

8. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 Safety Lifecycle Describes the development, review, configuration management and testing process for the PPS from inception, to design, construction, commissioning, and through to operations and system modifications.

9. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 Implementation, Operations, and Maintenance Lifecycle

10. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 Development and Review Lifecycle

11. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 Software Portion of Dev&Rev Lifecycle Hardware is design and reviewed per current SLAC practice Software has a more rigorous version- control scheme Includes documented bench testing of software

12. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 Software Configuration Management Procedure PPS Software is stored in a dedicated PPS repository Released software always has “N.0.0” version tag Documented software bench testing is performed prior to deployment

13. E. M. Saleski FAC 2008Saleski@SLAC.Stanford.edu 11/11/08 Software Configuration Management Support Software versions are checked during annual certification Written procedures exist for extracting PPS code from CVS and for uploading it to PLCs A documented training program tracks personnel PLC qualifications in the Section