Bulfone, D

Giacuzzo, F

Grulja, S

Lonza, M

Vascotto, Alessandro

CERN Document Server

THE UPGRADED ELETTRA ACCESS CONTROL SYSTEMA. Vascotto, D. Bulfone, F. Giacuzzo, S. Grulja, M. Lonza, G. Tromba, Sincrotrone Trieste, ItalyA. Mazzoli, M. Salvador, FASI TECH srl, Pordenone, ItalyAbstractThe access control system of the ELETTRAaccelerators must guarantee that access to the machinetunnels is allowed when safety conditions for personnelare fulfilled.The system is based on Programmable LogicControllers (PLCs) providing redundant logic in a fail-safe configuration.At present, the supervisor consoles of the system arebased on UNIX PCs running the Santa Cruz Operation(SCO) operating system and X-11 applications. Theseare being replaced by Microsoft Windows NT PCs,equipped with a SCADA (Supervisory Control And DataAcquisition) package, which is used for the developmentof the new application programs.1 THE ACCESS SYSTEM LOGICThe ELETTRA access control system [1] is made ofProgrammable Logic Controllers (PLCs) supervised bySanta Cruz Operation (SCO) UNIX PCs located in thelinac and storage ring control rooms. The system maincharacteristics are fail-safe logic, redundancy andultimate operator authorization. The fail-safe logicguarantees that if a fault occurs to the safety dedicatedequipment the machines are stopped in a safe status; theredundancy assures that permission to enter a controlledarea is given only if at least two independent safetyconditions are fulfilled. The operator intervention iseventually requested to provide the final assent during anaccess procedure or to verify that nobody is present insidethe accelerator tunnels (patrol inspection) before starting-up the machines after a shutdown.The access control system considers the ELETTRAfacility as divided into three logical areas (fig. 1): thelinac, the Transfer Line (TL) and the Storage Ring (SR).There are one entrance door to the linac (A1) and twoentrance doors to the ring (A2 and A3). The T1 and T2doors delimit the TL. Three emergency exits are locatedalong the linac tunnel (E1, E2 and E3) and two aroundthe SR (E4 and E5); the SR entrance doors themselves(A2, A3) can be used as emergency exits.The linac and the SR, which are physically separatedby the TL, can be operated independently from eachother.The access control system gets data from the TL andSR beamstoppers, linac gun, linac and SR radiofrequency (RF), door proximity switches, entranceequipment (badge reader controllers, key panels),emergency and patrol buttons, beamlines. According tothe status of these inputs the PLCs permit or interdict theoperation of the accelerators and subsequently control theaccess to the machine tunnels.Access to the linac tunnel is allowed if its gun and theRF accelerating sections are switched off. Access to theSR tunnel is permitted if the beam has been dumped and,in case the linac is on, the beamstoppers placed along theunderground section of the TL are closed. Access to theTL (through T1 or T2) is allowed only if both the linacand SR are switched off.The beam dump in the SR is performed through adouble action: a short interruption of the RF cavitiesdriving signal and the closure of the SR beamstopper.Figure 1: Logical areasThe access procedure for entering the acceleratorsduring a stand-by period consists of four successive steps:- the entering person presents his badge to theautomatic badge reader; if the accelerator is switched offand the badge identifier was pre-loaded in the list ofauthorized personnel, the system gives the first assent toopen the door;- one of the keys on the panel close to the door isautomatically unlocked and the person takes it out;- the control room operator, after recognizing theperson through a TV camera, gives the third assent andunlocks the door;T1T2LinacStorage RINGUndergroundGround levelTransfer lineA1A2A3E1 E2E3E4E5International Conference on Accelerator and Large Experimental Physics Control Systems421International Conference  Accel rator and L rge Experim ntal Physics Control Systems, 1999, Trieste, Italy- the person enters, closes the door and deposits thekey into an internal panel.Exit operations require similar steps, but with anopposite sequence: the person takes the key out from theinternal panel, opens the door by pressing a button,deposits the key in the external panel and presents thebadge.During the shutdown periods free access is permittedand all the doors are unlocked.2 THE UPGRADE PROJECTOBJECTIVESThe upgrade involves only the supervisor consoleswhile the low level PLCs are not modified.The main objectives of the upgrade project are:- the use of a new hardware/software platform for thesupervisors, Y2K compliant, with improved graphicinterface and management tools;- the use of a RAD (Rapid Application Development)environment, to facilitate the development of theapplication software and Graphic User Interface(GUI);- the use of Local Area Network (LAN) PC cards ableto run both the Sinec H1 and the ‘standard’ TCP/IPprotocols, in view of future upgrades of the PLCs;- to improve the diagnostics for the operators.3 HARDWARE ARCHITECTUREThe new hardware architecture is shown in fig. 2.Figure 2: Hardware ArchitectureThere are three Siemens Simatic S5 PLCs connected totwo supervisors through a dedicated Ethernet networkrunning the SINEC H1 Siemens proprietary protocol.The badge readers (from Schlage Electronics) areconnected in a redundant way to both the PLCs and,through a serial line, to the supervisors.The supervisors are Hewlett-Packard KAYAK XAsPCs. The SR control room PC, configured as a server, isequipped with a SINEC H1 Applicom PCI 2000ETHcard. The other PC, which is installed in the linac controlroom, is connected to the server PC by means of the mainplant Ethernet network running the TCP/IP protocol.4 SOFTWARE ARCHITECTUREThe access control system has a two level softwarearchitecture:- the lower level is in charge of automated tasks,performed by the PLCs.These tasks are the acquisition of signals andinterlock signals from sensors, micro-switches, etc.;transmission of commands to the actuators; automaticinterlock command transmission.- the upper level is in charge of the supervision of thevarious areas and of the access management. The twoPCs connected in a Client/Server configuration viathe main plant Ethernet network carry out these tasks.The main guidelines followed in the choice of the PCsoftware are:- adoption of an Open Architecture, carried outthrough both 'de facto' and officially approvedstandards;- availability of a modular environment for thedevelopment of applications and easy maintenance.The Microsoft (MS) Windows NT has been eventuallyselected as the basic operating system and the CUBE [2]Supervisory Control And Data Acquisition (SCADA),from Orsi, as the modular development environment.The CUBE system (fig. 3):- is developed upon MS Windows NT and based on theMS DNA (Distributed interNet Application)architecture;- is equipped with a native Client/Server architecture;- is highly scalable;- supports commercial standards, such as OLE, DDE,ODBC, OPC, IEC 1131-3;- provides a large MS Windows NT driver library,which can be expanded to custom interfaces by theuse of dedicated development tools;- allows to install an hot back-up server;- is characterised by a process data server made of theReal Time Data Base (RTDB), Alarm Data Base(ADB) and Process Data Base (PDB);- has a powerful environment for the development ofapplication modules (data processing and controllogic, Application Programming Interface (API) to422integrate external applications, real-timecommunication drivers);- provides special modules for designing and runningsynoptic interfaces (Graphic Monitoring System(GMS) module in Development (GSMD) andRuntime (GSMR) versions);- features robust debugging tools.Figure 3: Server PC software architecture4.1 Requested FeaturesThe main features requested by the access controlapplication are:- synoptic functionality;- Data Base operation (list of authorized personnel, listof people present inside the tunnel);- control logic made of 'finite state machines' gatheringdata from the PLCs, the badge reader controllers andthe Man-Machine Interface (MMI);- logging of events.4.2 Specific ProblemsAs far as the Data Base management is concerned, itwas necessary to consider the following needs:- the lists have to be readable and changeable byqualified personnel through permission passwords;- any change in the lists has to be transferred to thebadge reader controllers, which hold a local copy ofthem;- the control logic can interrogate the lists to checkaccess permission conditions.The following issues had to be considered for thecommunication with the badge reader controllers:- the controllers use an ASCII half-duplex protocol forthe transmission of the badge read data to the PCs;- the controllers use an XMODEM-CHECK protocolfor the reception of data from the PC's.For the reasons above, the standard CUBE driver couldnot be adopted, and an application external to theSCADA had to be developed. This application, whilewaiting for events from the serial lines, has to interfacewith the control logic and analyze possible changes inthe Data Base to automatically update the badge readercontroller lists in case of changes.4.3 Adopted SolutionsAs the Data Base is small and seldom accessed, theCUBE Track Data Base oriented module was notadopted. A dedicated solution based on the IBM DB2Universal Data Base was chosen.Two applications (fig. 3), called Account Manger andAttendance Manager, were written to read and edit theData Base lists. These were developed using the VisualBuilder available with the IBM Visual C++ 4.0. Bothapplications can be launched from the main synoptic.The main control logic tasks for the access to themachine through the A1, A2 and A3 doors weredeveloped taking advantage of the CUBE Data Engine(DE) environment. Each task is dedicated to one of thedoors and uses the RTDB to interface with the PLCs, theMMI, the badge reader controllers, the Data Base and tolog alarms.The specific applications for the dialogue with thebadge reader controllers are based on the IBM VisualAge C++. They are interfaced with the RTDB throughsome Orsi DLL.5 CONCLUSIONSA specific project has been defined at the beginning of1999 for the upgrade of the ELETTRA access controlsystem. The use of an off-the-shelf SCADA product hasminimized project times providing an effectiveenvironment for the development of the applicationsoftware. Changes in the underlying low level softwarerunning on the PLCs were negligible.The upgraded ELETTRA access control system hasbeen successfully tested during the last two weeks ofSeptember and will be definitively installed during theshut-down period of November.REFERENCES[1] G. Tromba, “The Project and Construction of theShielding at the ELETTRA 1.5-2 GeV SynchrotronRadiation Facility – Radiation Measurements Duringthe First Period of the Commissioning”, Proceedingsof the Specialists’ Meeting on Shielding Aspects ofAccelerators, Targets and Irradiation Facilities,Arlington, Texas, April 1994.[2] ORSI Automazione S.p.A, “CUBE Overview”,document code MT249/01E, July 1999, Genova,Italy.Cube Enabling Layer (COM/DCOM)Microsoft Windows NT 4.0 Work StationCube FoundationIBMDB2 UDBServerTASKAccountMANAGERTASKAttendanceMANAGERCubeUserExtensions(IBMVisualAgeC++)CubeRTDB(RealTimeDataBase)Cube ApplicationModulesTASK : BADGE READER A1TASK : BADGE READER A2TASK : BADGE READER A3Cube DECubeADB(AlarmDataServer)CubeADD(AlarmClient)CubeGMSRCustom ApplicationModules423

The Upgraded ELETTRA Access Control System

Abstract

Similar works

Full text

Available Versions

CERN Document Server