The LHC safety-alarm system needs, for reliability reasons, two different media to transmit the alarms to the CERN Safety Control Room. This is a requirement of the French regulatory authority (Direction de Sûreté des Installations Nucléaires de Base). This paper examines the safety systems currently in use at CERN, with particular emphasis on the methods used for transmission of alarm information across the site. The general requirements for transmission of alarms are described. Several options for transmission of LHC safety-alarm information are compared: fieldbuses, telecommunications networks with analogue voice or ISDN lines, the time-division multiplex system, and packet switching 'mesh' networks. The reliability of each of these solutions is estimated, and different topologies for physical links described and compared. It is shown that options are available which give an accepted level of reliability, obviating the need for hard-wired connections

Ninin, P

Parker, R

CERN Document Server

EUROPEAN LABORATORY FOR PARTICLE PHYSICSLABORATOIRE EUROPEEN POUR LA PHYSIQUE DES PARTICULESPresented at the 2nd ST WorkshopChamonix, France, February 2 - 5, 1999CERN-ST-99-024February, 1999OPTIONS FOR LHC SAFETY-ALARM TRANSMISSIONP. Ninin, R. ParkerAbstractThe LHC safety-alarm system needs, for reliability reasons, two different media to transmitthe alarms to the CERN Safety Control Room. This is a requirement of the French regulatoryauthority (Direction de Sûreté des Installations Nucléaires de Base).This paper examines the safety systems currently in use at CERN, with particular emphasison the methods used for transmission of alarm information across the site. The generalrequirements for transmission of alarms are described. Several options for transmission ofLHC safety-alarm information are compared: fieldbuses, telecommunications networks withanalogue voice or ISDN lines, the time-division multiplex system, and packet switching‘mesh’ networks. The reliability of each of these solutions is estimated, and differenttopologies for physical links described and compared. It is shown that options are availablewhich give an accepted level of reliability, obviating the need for hard-wired connections.21 INTRODUCTION‘Level-3’ alarms at CERN are alarms raised in situations endangering people andrequiring immediate action by the fire brigade. Level-3 alarms concern the whole of CERN,that is the Meyrin, Prévessin and LEP sites. Their main users are the firemen in the SCR(Safety Control Room).The level-3 alarm system comprises the following detectionequipment on the spot:• fire detection equipment,• flammable-gas detection equipment,• emergency stops,• miscellaneous.The first three categories cover more than 90% of the level-3 alarms.Signals are transmitted via the communication systems.  The data-processing system isthe main one which provides the SCR with the details (type of alarm, location, description,etc.). This system is backed up by a hard-wired system permitting lower-grade operation inthe event of the failure of the main system.Data-handling systems such as the Central Alarm Server (CAS) and the Technical DataServer (TDS), associated with the existing communication networks, make it possible tomanage the alarms. The alarms are displayed on workstations or on wall-mounted panels.For organizational and geographical grouping, CERN has been divided into 34 areas. Alocal panel in each area shows the alarms that may occur. 2 GENERAL DESCRIPTIONIn LEP and increasingly on the Meyrin site all level-3 alarms are transmitted to the SCRand to the Technical Control Room (TCR) via a computer network and are displayed as a textmessage on a terminal. At present the CAS handles only 3640 alarms of the 16854, theremaining alarms not yet being computerized.The redundancy required by the ‘Installations Nucléaires de Base’ (INB) rules isachieved by means of a hard-wired network [1]. All devices generating an alarm of level 3 areconnected to the SCR. In LEP and progressively on the Meyrin site these hard-wired signalsare transmitted via a local panel (one for each defined area) which displays the location of thealarm source. The hard-wired signal causes an LED to blink on the local synoptic panelindicating the building from which the alarm comes and the type of alarm.Apart from alarms from the emergency telephones, an incoming alarm causes an LEDto blink faster. When the detector that caused the alarm is reset to zero the correspondingLED remains bright; should the alarm(s) vanish then the LEDs will go off. Transient alarmsare also handled but will only be cleared after the reset of the detector and the disappearanceof the alarm. A ‘General Alarm’ summary signal from the local synoptic panel is alwaystransmitted to the SCR; this signal indicates the area concerned. Only a reset of the localpanel will turn off this ‘General Alarm’ in the SCR.After the double safety-alarm transmission system had been put into service for LEP thesame approach was adopted for the modernization of the other CERN areas.  The SPS areas3have been almost completely renovated as well as the Meyrin site where the oldest fire andflammable-gas detection systems have been replaced by modern ones [1].3 LHC AL3S RECOMMENDATIONSThe recommendations for the LHC safety-alarm system are structured in GeneralRecommendations, Technical Recommendations, Recommendations for Further Work,Standards and References. The Technical Recommendations state the following:♦ ‘Two completely independent, diversely redundant, dedicated alarm transmissionsystems shall be installed. Hereinafter, these two systems are named Safety-Alarm-Transmission system (SAT) and Safety-and-Technical-Data system (STD).’♦ ‘SAT and STD shall be designed and installed so as to exclude for the entire lengthof all transmission paths, as far as possible, any common-cause failure. Amongstothers, this shall apply in particular to separate routing and to separate powersupplies, including the stand-by sources.’♦ ‘Alarm systems, and both the SAT and STD throughout the entire lengths of theirtransmission paths, shall be permanently and automatically supervised for correctfunctioning. Any malfunction or unavailability shall be signalled to the technicalmonitoring centre, as well as to other users as required.’2]These recommendations are self explanatory and imply the evaluation of several optionsfor the alarm transmissions.4 OPTIONS4.1 FieldbusThe fieldbuses provide a valuable solution for the transmission requirement of the SATsystem. CERN has recommended the use of three fieldbuses: FIP, CAN, PROFIBUS.However in this context of safety alarms, where communication must be provided over a longdistance, PROFIBUS (PROcess FIeld BUS) seems the most appropriate candidate. This buscan be deployed over a distance of up to 50 km, using optical fibres. The use of a specificoptical coupling device may provide a redundant transmission of the signal on two differentoptical fibres. This bus is a low-cost option for the SAT. Up to 126 Programmable LogicControllers (PLC) could be connected in this way. PROFIBUS exists in three differentflavours: DP, FMS and PA. PROFIBUS-DP (Decentralized Peripheral) would provide adeterministic solution: a master PLC polls all the slave stations at a defined frequency. All thestations are supervised and unavailability is automatically reported. The dimensioning of thenetwork shall be done according to distance, the number of PLCs, and the expected data-acquisition frequency. Considering the LHC's low radiation level [4], we could consider twohalf-loops circulating in the drains. Locally on each safety zone the PLCs could exchangedata on copper cables, and the long-distance data exchange could be done using the opticalfibres. Redundancy of master and slaves could be foreseen as well even on a single network,but they would use different physical addresses.PROFIBUS-FMS, an asynchronous messaging system, is not suitable in this case,because a client application will never be informed that a packet has been lost.PROFIBUS-PA implements the same protocol as PROFIBUS-DP but it only usescopper cable with the electrical supply carried by the bus. It is mainly used by the chemical4industry where remote sensors need to be fed by the bus itself. PROFIBUS-PA is also slowerthan DP [5].4.2 The telephone networkThe CERN internal telephone service is provided by a distributed Private AutomaticBranch Exchange (PABX). Various switching nodes of this PABX are located on the Meyrinand Prévessin sites, and on most of the LEP sites. The nodes are interconnected by high-speedtime-division multiplex (see below) links operated by CERN. These links pass over a fibre-optic network (principally surface links) and a coaxial-cable network in the SPS and LEPtunnels.The telephone service is extremely reliable. One estimate of the availability of a similartelephone network including distributed links is 99.73%. Clearly, therefore, the telephonenetwork is a possible solution for the transmission of level-3 alarms. Indeed, many alarmsystems world-wide are implemented in this way.A particular problem which would have to be resolved if this solution were to beadopted concerns the emergency telephones. It is currently planned to modify the cabling ofthe emergency telephone voice connection so as to route it to the nearest switching node,rather than bringing the connection to the node in LEP Point 1 as at present. Clearly thereforethe associated alarm signal cannot be transmitted along the same path and to the same node.There are several possible solutions to this problem; these are beyond the scope of this paper.4.3 The time division multiplex systemThe time-division multiplex (TDM) network mentioned above could in itself be used totransmit alarm signals, without involving the telephone switches.Equipment is available on the market to collect alarms, and transmit the alarminformation over point-to-point TDM links to a central location. Generally packet-dataprotocols such as TCP/IP and X.25 are used for this transmission.TDM networks are used by public (telephone) network operators for long-distance linksto interconnect their switches; consequently the equipment is designed for very highreliability. Moreover a new system of TDM known as Synchronous Digital Hierarchy (SDH)is being introduced. SDH networks are often implemented in a self-healing ring topology: thenetwork automatically reconfigures to survive any single malfunction.4.4 Meshed network.Another interesting alternative to design the LHC safety systems, and more particularlythe STD, would be the deployment of a meshed network on the LHC area. Meshed networks[6] are widely used in public data-communication networks and in some local area networks.Their main characteristic is to provide alternative transmission paths between the nodes.Successful operation of a such a data-communication network is critically dependent on theprovision of an adequate routing algorithm. Route selection within an irregular mesh is acomplex process. It depends both on the loading of the network and the number of switchingnodes traversed. The routing algorithm tries to ensure a systematic progression of each packetfrom its source to the destination. Certainly the routing algorithm must be capable of re-routing the traffic in the event of the failure of some part of the network. The ATM5(Asynchronous Transfer Mode) network can be configured as a mesh; it uses the PNNI(Private Network Network Interface) routing mechanism. ATM and its routing principle arecurrently being tested at CERN around the SPS [7] and are considered as a possible candidatefor the LHC real-time network, ensuring a permanent bandwidth and a deterministic datatransmission for all real-time applications. This concept of meshed ATM network could beextended to the service network ensuring a higher data availability. The mesh could bedeployed as a star to the TCR on the surface and as a ring in the LHC tunnel. The particularinterest of such a meshed network complementing a specific SAT is to resolve the cablingcommon-mode problem. Even in the event of cable damage (with or without a common modewith the SAT) the STD data will always be re-routed successfully to the destination.5 CONCLUSIONSA variety of solutions exist which would allow transmission of level-3 alarminformation with very high reliability. An STD based on a meshed network completed by anSAT using either circuit switching technology or a fieldbus could be considered as thestarting point of a detailed study.However, whatever system is chosen, this detailed study will have to be carried out toidentify and eliminate any possible common points of failure with the data network, such aspower supply, physical routing of links, and co-location of equipment. The IEC 61508International Standard provides an extremely valuable framework to carry out this analysis.Furthermore, specification and discussion should start as early as possible with the people incharge of the LHC networks.AcknoledgementsWe would like to thank particularly Louis Guerrero and Jacky Brahy who gave usextremely valuable information on meshed networks and profibus, respectively.References[1] P. Ciriani, L. Henny, P. Ninin, Safety alarms at CERN, First ST workshop, Chamonix1998.[2] H. Laeger et al., Recommendations for the LHC safety alarm system, WG-AL35,November 1998.[3] G. Baribaud et al., Recommendation for the use of field-buses at CERN, November1997.[4] K. Potter et al., Estimates of dose to components in the arcs of the LHC due to beam-loss and beam-gas interactions, LHC Project Note 18 (1995).[5] J-P. Merisse, Dossier bus de terrain, Mesure magazine, Septembre 1998.[6] D.W. Davies and D.L.A. Barber, Computer networks and their protocols, WileyPublication.[7] L. Guerrero, Projet ATM SPS, SL internal document, September 1998.

Options for LHC safety-alarm transmission

Abstract

Similar works

Full text

Available Versions

CERN Document Server