access system m. gruwé (ab/op) thanks to ts/ase group extended ltc meeting march 3 rd 2008

Access system

M. Gruwé (AB/OP)

Thanks to TS/ASE group

Extended LTC meeting

March 3rd 2008

March 3rd 2008 M. Gruwé 2

Layout

• Present experience:– With installation configuration

– With operation configuration

• Near future:– Cool-down and power commissioning

– Move whole LHC to operation configuration

• Beam in LHC• Some issues


Present experience: installation configuration

• Installation configuration: – Situation for many years– Still current situation for most access points– LASS in “MYFARE” mode:

• Identifier is the CERN access card. • No biometry

• Plus:– Easy to access

• Minus:– People open doors without thinking

• Use of emergency handles rather than appropriate opening push button• Opening of end of zone doors

– Access points are often manually blocked open (which might in the end deteriorate the access system equipment)

• In addition: some access points/doors/trapdoors have not been installed yet (for easiness of installation of experiments/machine)


Present experience:operation configuration (I)

• Operation configuration:– LASS in “INSIDE” mode

• Identifier is the CERN dosimeter• Biometry is active

• Experience through tests:– Functional tests of the various points– DSO tests in view of the injection tests in TI8 and TI2– Closure of point 2 for TI2 tests– Global access system tests early January

• Type of experience:– On site:

• How to access (biometric scan, restricted access mode,…)• Patrolling the LHC

– In CCC:• Giving access from the CCC (in restricted access mode)• Conducting patrols from CCC


Global access system tests:tests in access mode

• Initial state:– Whole LHC fully searched. Still in access mode (potentially some

people in).

– All EIS-beam should be safe, so that it is impossible to circulate or even inject beam in LHC.

• Tests: – One EIS-beam becomes unsafe

• Result: the system goes to access off

– Two EIS-beam become unsafe: • Result: the system goes to access off and BIW (Beam Imminent Warning)

sirens start


Global access system tests:tests in beam mode

• Initial state:– LHC fully searched and closed (leaving some people in, on purpose, for

the tests)– LHC access off (BIW sirens)– Change to beam mode– EIS-beam un-safe (power converters on, TEDs out, etc…)

• Tests: – From inside LHC: force one door or one AUG:– As a consequence:

• Beam mode is off• Radiation veto is on• All EIS-beam to safe position• Signal sent to dump system• Signal sent to BIC is false


Present experience: operation configuration (II)

• Functionalities of the access system– LHC Access Safety System behaved as it should– But:

• Some non-conformities – Most have been fixed; some still under investigation – All to be fixed before beam operation

• Human interface to LHC Access Control System works fine but should be improved (slow response, could be more human friendly, occasional restart of the application)

• The system tested was not in its full nominal configuration:– Some doors not included in the system:

» to allow access to experimental areas during the tests» some trapdoors not installed yet» some ventilation doors not properly included

– SSA (System Safety Atlas) not ready and therefore not included in tests– The new LASS console was not installed yet– Other systems not fully operational (dump system, BIC, etc…)

– More and longer term tests have to be done


Present experience: operation configuration (III)

• Behavior of users:– During functional tests and DSO tests before TI8/TI2 injection:

• Despite of sign posts and warnings: people present on site, doors forced, lack of discipline

– During global tests (one full week dedicated to access system tests):• No other work foreseen on site during that week• “Plombage” installed on all emergency handles: makes people think and

hesitate before going through• As a consequence: door forced in one occasion only

– Need more training/practice of users


Present experience: operation configuration (IV)

• Operation’s experience:– Participation of OP in most of these tests (thanks to all participants)

– Some experience gained • In using the access system software:

– Changing access mode– Conducting a patrol– Giving access in restricted access mode

• In going through access points with dosimeter and biometry• In patrolling the zones

– Not enough time/experience to grant proper training of • Operators• Patrollers


Layout







Near future: HWC using access system

• For cool-down and power commissioning:– Currently being implemented:

• Use of the access system in operation configuration

– Purpose:• Safety during cool-down and hardware commissioning

– Details:• See my talk in HWC review (February 28th 2008)

– Summary:…


Near future: HWC using access system: how?

• Access points are being configured to “operational configuration” (were in “installation configuration” up to now): – Biometry is active!!– To enter, one

• Needs to have performed the biometric scan in building 55• Needs

– Either a personal dosimeter (with the biometry attached). To be obtained in building 55.

– Or a personal token (with the biometry attached). To be obtained in building 55.

• Needs to have appropriate access rights: to be asked via EDH– LHC-HC access– (Or LHC-CR access, but ONLY for cryo operators!)


Near future: HWC using access system: when?

• When cooling down a sector from 300K to 80K:– Access points are in “General access mode” but with restricted access

list: LHC-CR– No CCC intervention to give access

• When sector is below 80K:– Access points are in “General access mode” but with restricted access

list: LHC-HC– No CCC intervention to give access

• When ready for power commissioning:– Access points are in “Restricted access mode”, with restricted access

list: LHC-HC– Person in CCC necessary for giving access


Near future: HWC using access system: gains

• Gains:– Safety:

• Always possible to know who is IN (names of the people)• When starting a test: one may call each person who is IN to ask where

he/she is, what he/she is doing, and to warn about forthcoming test– Some experience will be gained for

• People accessing the tunnel (biometry, discipline, etc…)• Operators and EICs (using the access system consoles and software)• Test of reliability of access system


Near future: HWC using access system: but…

• Counterparts:– Requires time:

• Will take some time to give access via console (EIC or operator)• Whenever a door is forced: a patrol is required

– Constraints on users:• Stronger constraints for people intervening on site. • Access constraints for some experiments

• Limitations– Access system does not replace logging of information and discipline:

• Once in the tunnel, where does the person go? What will the person do?– Powering of magnets is NOT interlocked:

• Access system makes sure no beam can be injected while people are still in. • But access system is NOT foreseen to stop powering when people are in.• Still need discipline and appropriate procedures


Near future: HWC using access system: status

• Sector 8-1: – Access points UJ14 and UA87 in General mode, LHC-HC list, biometry

active– Other doors closed and “plombage” put on emergency handles

• Sector 5-6:– Access point PM56, UJ63, UP63 in General mode, LHC-HC list,

biometry active– Other doors closed and “plombage” put on emergency handles

• Sector 7-8:– Access point UJ83 in General mode, LHC-CR list, biometry active– Other doors closed and “plombage” put on emergency handles

• Sector 6-7:– Next on the list. Will be done on March 10th.


Near future: whole machineWhy?

• LASS in “INSIDE” mode everywhere (End of March?)• Use “general access mode” or “restricted access mode”• Purpose:

– Put the access system under stress– Longer term test of the access system– If changes required on access system: it takes time to implement and test!!– Users (=person intervening on site):

• Get used to the nominal access system• Loose the bad habit of using the emergency handles to open a door (should use the

proper opening button instead) and entering where not allowed

– OP (=operators in CCC): • Get some practice with the access system (console, software, logging, alarms,…)• Get some practice on giving access in restricted access mode• Get some practice in conducting a patrol from CCC• Part of the OP acceptance tests

– Train patrol teams – + Safety during cool down and hardware commissioning


Near future: whole machineConstraints

• Constraints:– Geographical:

• Zones are closed: end of zone doors are not supposed to be opened

– Identifier:• Identifier becomes the personal dosimeter (not the access card). Personal

dosimeter now contains the biometric information of the person.• However: as dosimeter is costly, and as LHC has not seen beam yet, no

fundamental reason for using a dosimeter;• For people (mainly contractors) who still work on the installation: personal

token containing the biometric information of the person

– Experiments:• Could also have personal tokens with biometric information


Layout







(Much) before beam in LHC (I)

• Access system should pass:– OP acceptance tests

• Partly through experience gained during power commissioning (restricted access mode, patrols, etc…)

• Other tests still to be defined (many people trying to access at the same time, in various access points, etc…)

• Reliability tests (“Long term” tests) through use and practice of the system

– DSO tests– Details being defined– Exact duration and organization not clear yet

• But:– Full DSO tests including extensive tests of interfaces with dump system, BIC,

etc..– Campaign of tests for (probably) about 2 months– All potential straps on EIS-beam or EIS-machine should be removed before– Access to different LHC points will be blocked

» For many hours » On various days» During several weeks


While beam in LHC

• Machine completely closed – For the whole test duration

– Irrespective of sector test scenario chosen

• Reason:– LASS does not allow “beam mode” in any part of the LHC if ALL zones

have not been closed and patrolled!


Before beam in LHC (II)

• Consequence:– Closure and thus patrol of the whole machine (LHC tunnel, service

areas and experiments) should be done.

– Time foreseen: Three days• Depending on number of patrol teams and patrol members per team• And depending on problems encountered, such as:

– People still working in the zones being patrolled, – People forcing doors of zones already patrolled, etc… (discipline

required).


Machine: - LHC 1: 3 people, 2 hours- LHC 1.8: 2 people, 1 hourATLAS: ?

Machine: - 2x3 people- 4 hoursALICE: - ½ hour- 5 people

Machine: -2 people-1 hour

Machine: - 2 people- 3 hoursCMS: 1 hour

Machine: - 2x3 people (min. 5 people)- 5 hours

Machine: - 2x3 people- 4 hoursLHCb: - ½ hour

Machine: -2 people-2 hours

Machine: - 2x3 people (min. 5 people)- 5 hours

1

5

2

3

4

8

7

6

500 m

1.9 km+ CMS

2.2 km+ATLAS

500 m

5.4 km + TI2+ ALICE

5.4 km+ cavern

5.4 km+ dumps+ cavern

5.4 km + TI8+ LHCb

Patrolling the LHC


After beam in LHC

• Radiation veto will be automatically set for every access point– Requires RP technician to remove it.

• After removal of radiation veto:– Most areas should then be “supervised” areas (personal dosimeter

required)– Some areas might be classified as “simple controlled” areas (fencing,

signaling and personal dosimeter required).

• Access to LHC:– From then on: will require personal dosimeter.– Simple personal tokens with biometry scan will not work anymore: any

person who requires access should have a personal dosimeter– Impact on continuation of power commissioning– Impact on continuation of experiments installation


Layout

• Present experience– With installation configuration






Issues (I)

• Training to be done: – For users: how to access in restricted access mode (including

biometry)?• A video (very well done) has been prepared by TS/ASE:• Will be made widely available (web, or general Level 4 safety training)• Currently:

– Install https://edms.cern.ch/file/886468/1/codec-mpeg2.zip– Watch https://edms.cern.ch/file/886468/1/restreint.mpg

– For operators: how to use the access system software?• Training foreseen between March 12th and March 14th • Done by TS/ASE • Lecture and hands-on sessions

– For patrollers: how to patrol a sector on LHC:• Being worked on with DSO• Will be organized soon• Needed before next power commissioning

https://edms.cern.ch/file/886468/1/codec-mpeg2.zip

https://mmm.cern.ch/exchweb/bin/redir.asp?URL=https://edms.cern.ch/file/886468/1/restreint.mpg


Issues (II)

• Documentation to be made available:– Geographical:

• Matching between equipment and (access system) sectors and zones• Routes to access a given equipment (which access point, which sectors)

– Proper operation instructions to be prepared and made available• How to react to access system alarm (door being forced, etc…)

– User manual of access system for operators• Training notes provided by TS/ASE

• Strapping of some EIS:– For test purposes, equipment groups occasionally require strapping of

some EIS…

– Any such change of the access system should go through formal procedure:


Official procedure for strapping EIS

1. Request:1. A request for configuration change or EIS strapping is raised by users such as RF, TED,...

and shall be sent to the person responsible for the operations of the LHC access system : T. Riesco or JF Juget TS/ASE

2. The request is entered in a standard EDMS validation process2. Evaluation:

1. The impact of the modification on the operational system is evaluated by the access system's operations team.

2. If approved by the access team, the new configuration of the system is documented in an excel file summarizing the status of all EIS in the whole LHC complex.

3. Validation1. The requestor and the AB DSO will receive this information and shall validate it in EDMS

before it is implemented.4. Implementation and verification:

1. When validated the operation team makes the modification on the field and reports it in EDMS

2. The correct functioning of the system after the strap has been implemented is verified and reported in EDMS.

Notes:– To remove straps the same procedure is applied. – No changes can be made without a formal approval from the AB DSO.


Issues (III)

• DSO tests (duration and organization)– Will take time

– Will block access to various points (frequency, duration,…)

– Requires access system of whole machine in operation configuration

– No EIS strapped

– Access system configuration should not be changed afterwards!

• “After beam” situation:– RP situation to be clarified

• Supervised areas?• Simple controlled areas?• Buffer zones?

– Impact on experiments / contractors / power commissioning

access system m. gruwé (ab/op) thanks to ts/ase group extended ltc meeting march 3 rd 2008

Documents

access pointslass

testslhc access

access pointsdoorstrapdoors

access systemm

lhc access control system

access modeinitial state

cern access card

applicationthe system