1. The Detector Safety System for LHC Experiments Stefan Lüders ― CERN EP/SFT & IT/CO CHEP03 ― UC San Diego ― March 27 th, 2003

2. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP032/15 Outline Experimental Safety The DSS Experimental Needs Functional Requirements Design and Architecture of the Prototype Planning and Conclusions

3. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP033/15 Sensors monitor the state of the equipment: temperature (equipment, ambient air, water), humidity, water-flow, sniffers, status signals of the sub-detectors There are dedicated sensors for the different safety and control systems, but they are not duplicated. The LHC experiments and their sites, e.g. (sub-)detectors, gas systems, magnets, power distribution, racks and crates will be the equipment to be acted upon directly by the control and safety systems. Technical Services provide power, water, gas (general services) and distribute them to the different locations (experiment services). The safety for personnel is ensured by the CERN Safety System (CSS). It is required by law and conforms to relevant International, European, and National standards. It has its own sensors and reacts globally, i.e. on whole buildings or caverns. The DSS complements CSS and DCS: “The DSS is a system to safeguard the experiment. As such, it acts to prevent damage to the experimental equipment when a serious fault situation is detected (e.g. temperature too high, water leak, bad sub-detector status…), inside or outside of the detector…” Experiment DCS General services: power, water Experiment services: power, water, gas Experiment: sub-detectors, racks, crates Sensors 3 Levels of Experiment Safety DCS sub-system C DCS sub-system B DCS sub-system A CSSDSS Water Leak Front-End / Hardware Layer Back-End / Supervisory Layer Trip Smoke, Gas Leak monitor control Level 3 (fatal) Level 2 (error) Level 1 (normal) The Detector Control System (DCS) is responsible for the overall monitoring and control of the detector. It might take corrective action to maintain normal operation. All DCS sub-systems are interconnected. In 2001, the experiments have realized, that some safety aspects are not covered by the CSS and DCS. The DSS was born. The DSS is embedded in an Experiment’s DCS. Alarm conditions are exchanged with the CSS (hardwired).

4. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP034/15 Scope and Goal: An Optimization Challenge The DSS should… protect experimental equipment improve the experiment’s efficiency by… preventing situations leading to level-3-alarms (these might lead to 2-3 weeks downtime) decreasing downtime due to failures not cost too much DSS can be considered as an “insurance policy”.

5. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP035/15 The DSS is a common solution proposed for all four LHC experiments (ALICE, ATLAS, CMS and LHCb) Constraints for the DSS Easy integration… into the control system of the experiment of sub-detector safety systems of external information (from the LHC machine, gas system, CSS, …) Adaptability… to the different needs of four experiments to the evolving experiment environments

6. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP036/15 Surface buildings Counting rooms Detector LHC Experimental Needs 200 to 800 analog and digital inputs to be monitored Geographically distributed system several digital 100 outputs sensors and actuators located in the caverns and in several buildings on the surface

7. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP037/15 The DSS functional requirements have been evaluated by the four LHC experiments in a joint working group. The DSS must be a standalone system, and be… highly reliable highly available as simple and robust as possible re-configurable by the experiments’ safety experts self-checking for consistency The DSS Functional Requirements

8. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP038/15 The Prototyping Phase A DSS prototype is currently being developed by the DSS Team (2.5 FTE) to meet the defined requirements will be a “proof-of-concept” The DSS Advisory Board, consisting of representatives from all four LHC experiments, safety experts, and the DSS Team are overseeing the prototyping phase. A review in June 2003 will verify that the design meets the requirements. This will allow for series production.

9. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP039/15 After discussions in the DSS Advisory Board, the Front-End will… be based on industrial solutions, e.g. PLC technology for safety applications standard communication protocols (PROFIBUS, Ethernet, OPC) have its own sensors and actuators check and filter the input sensors be on safe power (CERN safe power plus own UPS) will always react immediately and automatically on fault conditions indicated by the sensors DSS Front-End Architecture

10. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP0310/15 Input: Sensors PLC cycle The PLC Cycle The PLC Cycle: The PLC continuously monitors the sensors e.g. temperatures, water flow, sub-detector status Output: Action (e.g. cutting off power ) T>T thres Input values are compared to defined thresholds. Several conditions can be logically combined. Their fulfillment will produce an alarm. Alarms will trigger defined actions. Actions are taken on a coarse level (e.g. cutting power to a complete sub-detector). AND Alarm End-of-Cycle

11. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP0311/15 The DSS User Interface (Back-End) will… be based on the SCADA system “PVSS” and CERN’s JCOP Framework monitor and configure the Front-End allow a configuration of the relations between sensor values, alarms, and the actions performed in these cases (the “Alarm/Action Matrix”) define user access levels provide the user with comprehensible displays log alarm states, warnings, and related information DSS Back-End Architecture

12. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP0312/15 Redundancy: up to the level of I/O interfaces backup in case a power supply, CPU, Profibus failure modules have high MTBF (low failure rates). optical link between CPU modules step-by-step comparison inside the processing of the PLC cycles Front-End (continued): External crates based on S7-300 modules capable of handling the number of channels (inputs and outputs) as required located close to the sensors (<200m) I/O interfaces hot-swappable inputs and outputs use “positive safety” External crate: ET 200M redundant PS Profibus adapter I/O interfaces Back End: PVSS user interface for display logging modification of the Alarm/Action Matrix Front-End: uses a Siemens S7-400 station programmed through the Siemens STEP7 development environment implementation and processing of the Alarm/Action Matrix monitors itself Main crate: redundant PS CPU 414-4H Ethernet adapter (CP 443-1) OPC server: gateway to the Back-End (Windows XP) data distribution via Siemens OPC software redundant in the Front-End communication DSS Architecture Profibus DSS COM OPC Server PVSS CERN LAN

13. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP0313/15 Status Hardware development The PLC hardware has been installed in the DSS lab at CERN and is currently being commissioned. Survey of useful sensors (ambient air & cooling water temperature, humidity, etc.) has started. The prototype DSS system will be ready for the review in June 2003. Software development A first implementation of the Front-End software has been made. The DSS database prototype has been defined. It is based on Oracle. PVSS Back-End interface implementation is in progress.

14. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP0314/15 Planning Overview TaskStatusTarget Date Front-End softwareOperationalApril 2003 Integration, commissioning, and test of the complete prototype In progressApril 2003 Back-End softwareIn progressMay 2003 System ReviewJune 2003 Final tests of the (revised) prototypeSummer 2003 Installation / commissioning for CMSSummer 2003 First operational DSS for CMSSeptember 2003 Installation / commissioning for LHCbAutumn/Fall 2003 First operational DSS for LHCbNovember 2003 First operational DSS for ALICEJanuary 2004 First operational DSS for ATLASDecember 2004

15. March 27 th, 2003“The Detector Safety System for LHC Experiments” @ CHEP0315/15 Conclusion The design of the Detector Safety System, arrived at in consultation with the DSS Advisory Board, will consist of… a Front-End: Siemens S7-400 redundant PLC hardware PC based OPC server acting as a gateway a Back-End: A PC based system with the PVSS user interface, using CERN’s JCOP Framework Oracle Database connection for data and configuration logging The prototype will be ready for the review in June 2003 For more details see : http://cern.ch/proj-lhcdss/ http://cern.ch/proj-lhcdss/