CERN Safety Alarm System Supervisory Board

Approval of the minutes of the first and second meeting

H. Laeger will check the actual number of Level 3 alarms for LEP L3 to be able to compare them with the future ATLAS requirements.

D. Schinzel proposed to write eventually a common dictionary to avoid confusion when using the same terminology but meaning different things.

P.Ninin presented the CSAM project outline. Today’s presentation topics were:

• IEC 61508 basics (S. Grau – ST/MO)
• CSAM safety requirements (F. Balda – ST/AA, A.Chouvelon – TIS/GS, S. Grau – ST/MO))
• Contract Strategy (P.Ninin ST/MO)

CSAM safety requirements: strategy definition

Risk Analysis: This will be done by the contractor. They have to proof the system functionality following the given risk analysis scheme. The commercial strategy and the acceptance tests and the system commissioning will be used to ensure the required functionality in reality. The market survey showed that presently 10 companies would be able to build the CSAM system. The boundaries of the project are set by an extensive URD, the analysis with the fire brigade and a prototype, which was realised in the CSAM laboratory.

W. Weingarten: Does this procedure and the risk analysis prevent us in future from the accidents as we had them in the past (fire in BA3, Uranium fire)? The CSAM project will not minimise the number of accidents, but reduce the actions and the consequences to a minimum after an accident. The definition of the necessary tools, the requirements of the fire brigade and the necessary changes of the actual system are covered by the URD.

The user requirements cannot be presented here in all details. They may be found in the CSAM URD. We should be careful to not overdo the system. But the budget (4.5 MCHF in total, divided in 3.0 MCHF financed by the technical sector over four years and 1.5 MCHF financed by LHC over 3 years) is known and is taken into account.

• Functional safety
• Upgrade of existing systems
• Operation
• INB compliance

One contract will be established. This contract containing 3 working packages:

• The detailed system specification
• System realisation and implementation
• System operation

The necessary papers are actually at the ST specification committee. A first (ST approved) verion is foreseen until end of August 2000, the call for tender is scheduled for September 2000. All the documents are available on the CSAM web page (URL: http://st.web.cern.ch/st/mo/CSAM/csam.htm)

Questions from W.Weingarten:

• Will all fault states, maintenance and normal functioning of the system be visible to the system operators? Yes, as described in the CSAM URD.
• Is a remote disabling of safety equipment possible? Technically yes, but this will only be realised if it is required. All requirements are listed in the CSAM URD.
• Are tests of system components possible without stopping the safety alarm transmission? Yes, the details are listed in the CSAM URD.

P. Ninin asked if the board members agree on the presented project strategy. D.Schinzel, K. Potter and H.Schonbacher prefer to consult the documents first and do not want to judge only after todays presentation. The URL of the CSAM project will be distributed again to the board members with the necessary information and where to find the papers. The board members also want to have a clearer information about all CSAM activities without reading the mentioned documents in details. Today the risk analysis and the contract strategy were very clear. The project philosophy has been understood, but some more details about the real actions are required. This should be clarified in the next meeting at 24.08.2000. An executive summary of the CSAM Technical Specification (max. 5 slides …) should be presented to the CERN Safety Alarm System Supervisory Board.

• based on fiber cables
• two optical rings (ring is capable to connect from two sides in case of breakdown)
• but: common nodes exist and may have influence on the safety system in case of breakdown of electrical power supply or fire (common racks or common buildings)
• the requirements for 24h/day and 365d/year operation are covered
• The AL3 requirement, the dedicated diverse redundancy, is not covered by the actual CIWG conclusion. If this is really needed, CSAM has to use a own dedicated network. But still this network would have to use the same technical infrastructure like tunnel, electricity supply, racks etc.
• P. Ninin mentioned that the AL3 requirements have been known from the beginning of the CIWG. Now it has to be decided if the proposed solution of this working group may be accepted by the CERN Safety Alarm System Supervisory Board or if a dedicated network has to be installed. A written report from the CSAM team about the network requirements and a written report of the CIWG with the constraints are necessary to be able to take this decision. These reports have to be made available to the board members before the next meeting.

The common understanding from the board members are that we have to be sure

• that the network is available 24h/day and 365d/year
• that the redundant paths are not in the same rack
• that configuration or maintenance issues will never block the redundant paths at the same time
• etc.