1. PLC Workshop at ITER, 4-5 th of December 2014 A. Nordt, ESS, Lund/Sweden

2. How to define an appropriate integrity level for a protection function and how to implement it and how to make sure its fulfilled?  Good question(s) but quite hard to answer Define a context first please: Focus here on accelerators or Accelerator Driven Facilities (ADF)Focus here on accelerators or Accelerator Driven Facilities (ADF) Focus on: “Machine Protection (System(s))”Focus on: “Machine Protection (System(s))” Separate from safety systems like access safety systemSeparate from safety systems like access safety system INTRODUCTION

3. Some accelerators operate at very high energies or at very high power & an uncontrolled release of such beam can lead to serious damage of equipment, and long downtimeSome accelerators operate at very high energies or at very high power & an uncontrolled release of such beam can lead to serious damage of equipment, and long downtime Typical mitigation: have specific sensors (like beam loss monitors) connected to a beam interlock system (BIS), being able to trigger a beam stop via actuator systems (beam dump system, choppers, beam source)Typical mitigation: have specific sensors (like beam loss monitors) connected to a beam interlock system (BIS), being able to trigger a beam stop via actuator systems (beam dump system, choppers, beam source) Usually this is what we call a machine protection system (MPS)Usually this is what we call a machine protection system (MPS) MACHINE PROTECTION SYSTEM(s) BeamTarget Monitor Beam Interlock System X Beam Source Beam Source

4. Tendency to use the IEC61508 standard as guideline for designing systems relevant for machine protection, especially for the BIS and actuators (CERN, ITER, ESS, JLAB, PSI, etc.)Tendency to use the IEC61508 standard as guideline for designing systems relevant for machine protection, especially for the BIS and actuators (CERN, ITER, ESS, JLAB, PSI, etc.) Why IEC61508?Why IEC61508? Systematic approach (provides structure)Systematic approach (provides structure) Lifecycle modelLifecycle model Estimation of probability of dangerous/random hardware failures to happenEstimation of probability of dangerous/random hardware failures to happen Following this standard helps to gain confidence in systems involved in removing beam from the machine before an uncontrolled release can happen (leading to equipment damage)Following this standard helps to gain confidence in systems involved in removing beam from the machine before an uncontrolled release can happen (leading to equipment damage) IEC61508

5. Machine protection for ADF is concerned about the uncontrolled release of beam power or beam energy (hazard)Machine protection for ADF is concerned about the uncontrolled release of beam power or beam energy (hazard) Following the standard requires to perform a hazard and risk analysis, evaluating all foreseeable events leading to “bad beam parameters” and thus leading possibly to (beam-induced) damage of equipmentFollowing the standard requires to perform a hazard and risk analysis, evaluating all foreseeable events leading to “bad beam parameters” and thus leading possibly to (beam-induced) damage of equipment How to perform such risk analysis?How to perform such risk analysis? APPLYING IEC61508 IN THEORY

6. EXAMPLE FOR RISK IDENTIFICATION Scope Identify risks/hazards of machine protection related systems and related Integrity Level Identify mitigation methods for at least all identified (catastrophic) events Probability Frequent: At least once a year Probable: Once between 1 and 10y Rare: Once between 10 and 100y Exceptional: Not in 100y Severity Production Losses/year Property Losses ≤1 year ≤1 year ≤50 MEUR ≤50 MEUR <2 month <8 MEUR <1 week <1 MEUR <1 day <150 KEUR InsignificantModerateMajorCatastrophic Consequence Ranking 6 5 4 3 2 5 43 2 1 1 1 2 3 3 4

7. DEFINITION OF PROTECTION FUNCTIONS Beam Interlock System (FPGA or PLC based technology) Protection Function ♯ i

8. DEFINITION OF INTEGRITY LEVELS The Integrity Level sets requirements for random failure rates for hardware, diagnostic coverage and fault tolerance for the entire protection function and on techniques and measures to minimize the propensity for systematic failures. The higher the SIL, the more stringent the requirements. Integrity Level for high demand / continuous mode of operation PFH: Probability of Failure per Hour Integrity Level (IL) PFH of Protection Function PFH of BIS

9. Sometimes this can be very/extremely difficult Sometimes this can be very/extremely difficult Reasons are: Lack of manpower,Lack of manpower, Lack of money,Lack of money, Lack of awareness,Lack of awareness, Lack of willingness,Lack of willingness, Suffering from tunnel vision: “this always worked at xx and therefore it should work for yy just the same way”, or: ”My system never fails and even if it would be, then such failure is not relevant for your machine protection”Suffering from tunnel vision: “this always worked at xx and therefore it should work for yy just the same way”, or: ”My system never fails and even if it would be, then such failure is not relevant for your machine protection” Lack of support from upper managementLack of support from upper management Lack of being a “REAL” safety system (prioritization)Lack of being a “REAL” safety system (prioritization) APPLYING IEC61508 IN PRACTICE

10. Must haves (in my opinion): Different layers of protectionDifferent layers of protection (don’t just account all to 1 function). (don’t just account all to 1 function). Upper management must be aware of machine protection (especially in research facilities where very complex and unique machines are being operated and where major accidents may be the end of a project).Upper management must be aware of machine protection (especially in research facilities where very complex and unique machines are being operated and where major accidents may be the end of a project). Management must support and assure the efforts required to implement and maintain a proper level of machine protection facility-wide (MP is not just building a BIS).Management must support and assure the efforts required to implement and maintain a proper level of machine protection facility-wide (MP is not just building a BIS). APPLYING IEC61508 IN PRACTICE

11. Must haves (cont.): Set up working group: constant communication is a key parameter to be successful.Set up working group: constant communication is a key parameter to be successful. Set up “machine protection committee” or ”machine protection panel” empowered to take major decisions (involve representatives from whole facility)Set up “machine protection committee” or ”machine protection panel” empowered to take major decisions (involve representatives from whole facility) Work hard to put a safety/protection culture in placeWork hard to put a safety/protection culture in place APPLYING IEC61508 IN PRACTICE

12. There is no clear and single way to define an integrity level for a protection functionThere is no clear and single way to define an integrity level for a protection function IEC61508 is a useful guideline but does hardly cover software, is a bit poor in providing guidelines for verification, etc.IEC61508 is a useful guideline but does hardly cover software, is a bit poor in providing guidelines for verification, etc. Principle of integrity level is a tool and should be used only in the proper contextPrinciple of integrity level is a tool and should be used only in the proper context Its not enough to just hand over a requirement on an integrity level to the systems owner (make sure they understand it)Its not enough to just hand over a requirement on an integrity level to the systems owner (make sure they understand it) Key ingredients needed to define an appropriate integrity level for a protection function are: communication, flexibility and awarenessKey ingredients needed to define an appropriate integrity level for a protection function are: communication, flexibility and awareness Very important: safety/protection cultureVery important: safety/protection culture SUMMARY AND CONCLUSIONS