Access system M. Gruwé (AB/OP) Thanks to TS/ASE group Extended LTC meeting March 3 rd 2008

M. Gruwé2 Layout Present experience: –With installation configuration –With operation configuration Near future: –Cool-down and power commissioning –Move whole LHC to operation configuration Beam in LHC Some issues

March 3 rd 2008M. Gruwé3 Present experience: installation configuration Installation configuration: –Situation for many years –Still current situation for most access points –LASS in “MYFARE” mode: Identifier is the CERN access card. No biometry Plus: –Easy to access Minus: –People open doors without thinking Use of emergency handles rather than appropriate opening push button Opening of end of zone doors –Access points are often manually blocked open (which might in the end deteriorate the access system equipment) In addition: some access points/doors/trapdoors have not been installed yet (for easiness of installation of experiments/machine)

March 3 rd 2008M. Gruwé4 Present experience: operation configuration (I) Operation configuration: –LASS in “INSIDE” mode Identifier is the CERN dosimeter Biometry is active Experience through tests: –Functional tests of the various points –DSO tests in view of the injection tests in TI8 and TI2 –Closure of point 2 for TI2 tests –Global access system tests early January Type of experience: –On site: How to access (biometric scan, restricted access mode,…) Patrolling the LHC –In CCC: Giving access from the CCC (in restricted access mode) Conducting patrols from CCC

March 3 rd 2008M. Gruwé5 Global access system tests: tests in access mode Initial state: –Whole LHC fully searched. Still in access mode (potentially some people in). –All EIS-beam should be safe, so that it is impossible to circulate or even inject beam in LHC. Tests: –One EIS-beam becomes unsafe Result: the system goes to access off –Two EIS-beam become unsafe: Result: the system goes to access off and BIW (Beam Imminent Warning) sirens start

March 3 rd 2008M. Gruwé6 Global access system tests: tests in beam mode Initial state: –LHC fully searched and closed (leaving some people in, on purpose, for the tests) –LHC access off (BIW sirens) –Change to beam mode –EIS-beam un-safe (power converters on, TEDs out, etc…) Tests: –From inside LHC: force one door or one AUG: –As a consequence: Beam mode is off Radiation veto is on All EIS-beam to safe position Signal sent to dump system Signal sent to BIC is false

March 3 rd 2008M. Gruwé7 Present experience: operation configuration (II) Functionalities of the access system –LHC Access Safety System behaved as it should –But: Some non-conformities –Most have been fixed; some still under investigation –All to be fixed before beam operation Human interface to LHC Access Control System works fine but should be improved (slow response, could be more human friendly, occasional restart of the application) The system tested was not in its full nominal configuration: –Some doors not included in the system: »to allow access to experimental areas during the tests »some trapdoors not installed yet »some ventilation doors not properly included –SSA (System Safety Atlas) not ready and therefore not included in tests –The new LASS console was not installed yet –Other systems not fully operational (dump system, BIC, etc…) –More and longer term tests have to be done

March 3 rd 2008M. Gruwé8 Present experience: operation configuration (III) Behavior of users: –During functional tests and DSO tests before TI8/TI2 injection: Despite of sign posts and warnings: people present on site, doors forced, lack of discipline –During global tests (one full week dedicated to access system tests): No other work foreseen on site during that week “Plombage” installed on all emergency handles: makes people think and hesitate before going through As a consequence: door forced in one occasion only –Need more training/practice of users

March 3 rd 2008M. Gruwé9 Present experience: operation configuration (IV) Operation’s experience: –Participation of OP in most of these tests (thanks to all participants) –Some experience gained In using the access system software: –Changing access mode –Conducting a patrol –Giving access in restricted access mode In going through access points with dosimeter and biometry In patrolling the zones –Not enough time/experience to grant proper training of Operators Patrollers

March 3 rd 2008M. Gruwé10 Layout Present experience: –With installation configuration –With operation configuration Near future: –Cool-down and power commissioning –Move whole LHC to operation configuration Beam in LHC Some issues

March 3 rd 2008M. Gruwé11 Near future: HWC using access system For cool-down and power commissioning: –Currently being implemented: Use of the access system in operation configuration –Purpose: Safety during cool-down and hardware commissioning –Details: See my talk in HWC review (February 28 th 2008) –Summary: …

March 3 rd 2008M. Gruwé12 Near future: HWC using access system: how? Access points are being configured to “operational configuration” (were in “installation configuration” up to now): –Biometry is active!! –To enter, one Needs to have performed the biometric scan in building 55 Needs –Either a personal dosimeter (with the biometry attached). To be obtained in building 55. –Or a personal token (with the biometry attached). To be obtained in building 55. Needs to have appropriate access rights: to be asked via EDH –LHC-HC access –(Or LHC-CR access, but ONLY for cryo operators!)

March 3 rd 2008M. Gruwé13 Near future: HWC using access system: when? When cooling down a sector from 300K to 80K: –Access points are in “General access mode” but with restricted access list: LHC-CR –No CCC intervention to give access When sector is below 80K: –Access points are in “General access mode” but with restricted access list: LHC-HC –No CCC intervention to give access When ready for power commissioning: –Access points are in “Restricted access mode”, with restricted access list: LHC-HC –Person in CCC necessary for giving access

March 3 rd 2008M. Gruwé14 Near future: HWC using access system: gains Gains: –Safety: Always possible to know who is IN (names of the people) When starting a test: one may call each person who is IN to ask where he/she is, what he/she is doing, and to warn about forthcoming test –Some experience will be gained for People accessing the tunnel (biometry, discipline, etc…) Operators and EICs (using the access system consoles and software) Test of reliability of access system

March 3 rd 2008M. Gruwé15 Near future: HWC using access system: but… Counterparts: –Requires time: Will take some time to give access via console (EIC or operator) Whenever a door is forced: a patrol is required –Constraints on users: Stronger constraints for people intervening on site. Access constraints for some experiments Limitations –Access system does not replace logging of information and discipline: Once in the tunnel, where does the person go? What will the person do? –Powering of magnets is NOT interlocked: Access system makes sure no beam can be injected while people are still in. But access system is NOT foreseen to stop powering when people are in. Still need discipline and appropriate procedures

March 3 rd 2008M. Gruwé16 Near future: HWC using access system: status Sector 8-1: –Access points UJ14 and UA87 in General mode, LHC-HC list, biometry active –Other doors closed and “plombage” put on emergency handles Sector 5-6: –Access point PM56, UJ63, UP63 in General mode, LHC-HC list, biometry active –Other doors closed and “plombage” put on emergency handles Sector 7-8: –Access point UJ83 in General mode, LHC-CR list, biometry active –Other doors closed and “plombage” put on emergency handles Sector 6-7: –Next on the list. Will be done on March 10 th.

March 3 rd 2008M. Gruwé17 Near future: whole machine Why? LASS in “INSIDE” mode everywhere (End of March?) Use “general access mode” or “restricted access mode” Purpose: –Put the access system under stress –Longer term test of the access system –If changes required on access system: it takes time to implement and test!! –Users (=person intervening on site): Get used to the nominal access system Loose the bad habit of using the emergency handles to open a door (should use the proper opening button instead) and entering where not allowed –OP (=operators in CCC): Get some practice with the access system (console, software, logging, alarms,…) Get some practice on giving access in restricted access mode Get some practice in conducting a patrol from CCC Part of the OP acceptance tests –Train patrol teams –+ Safety during cool down and hardware commissioning

March 3 rd 2008M. Gruwé18 Near future: whole machine Constraints Constraints: –Geographical: Zones are closed: end of zone doors are not supposed to be opened –Identifier: Identifier becomes the personal dosimeter (not the access card). Personal dosimeter now contains the biometric information of the person. However: as dosimeter is costly, and as LHC has not seen beam yet, no fundamental reason for using a dosimeter; For people (mainly contractors) who still work on the installation: personal token containing the biometric information of the person –Experiments: Could also have personal tokens with biometric information

March 3 rd 2008M. Gruwé19 Layout Present experience: –With installation configuration –With operation configuration Near future: –Cool-down and power commissioning –Move whole LHC to operation configuration Beam in LHC Some issues

March 3 rd 2008M. Gruwé20 (Much) before beam in LHC (I) Access system should pass: –OP acceptance tests Partly through experience gained during power commissioning (restricted access mode, patrols, etc…) Other tests still to be defined (many people trying to access at the same time, in various access points, etc…) Reliability tests (“Long term” tests) through use and practice of the system –DSO tests –Details being defined –Exact duration and organization not clear yet But: –Full DSO tests including extensive tests of interfaces with dump system, BIC, etc.. –Campaign of tests for (probably) about 2 months –All potential straps on EIS-beam or EIS-machine should be removed before –Access to different LHC points will be blocked »For many hours »On various days »During several weeks

March 3 rd 2008M. Gruwé21 While beam in LHC Machine completely closed –For the whole test duration –Irrespective of sector test scenario chosen Reason: –LASS does not allow “beam mode” in any part of the LHC if ALL zones have not been closed and patrolled!

March 3 rd 2008M. Gruwé22 Before beam in LHC (II) Consequence: –Closure and thus patrol of the whole machine (LHC tunnel, service areas and experiments) should be done. –Time foreseen: Three days Depending on number of patrol teams and patrol members per team And depending on problems encountered, such as: –People still working in the zones being patrolled, –People forcing doors of zones already patrolled, etc… (discipline required).

March 3 rd 2008M. Gruwé23 Machine: - LHC 1: 3 people, 2 hours - LHC 1.8: 2 people, 1 hour ATLAS: ? Machine: - 2x3 people - 4 hours ALICE: - ½ hour - 5 people Machine: -2 people -1 hour Machine: - 2 people - 3 hours CMS: 1 hour Machine: - 2x3 people (min. 5 people) - 5 hours Machine: - 2x3 people - 4 hours LHCb: - ½ hour Machine: -2 people -2 hours Machine: - 2x3 people (min. 5 people) - 5 hours m 1.9 km + CMS 2.2 km +ATLAS 500 m 5.4 km + TI2 + ALICE 5.4 km + cavern 5.4 km + dumps + cavern 5.4 km + TI8 + LHCb Patrolling the LHC

March 3 rd 2008M. Gruwé24 After beam in LHC Radiation veto will be automatically set for every access point –Requires RP technician to remove it. After removal of radiation veto: –Most areas should then be “supervised” areas (personal dosimeter required) –Some areas might be classified as “simple controlled” areas (fencing, signaling and personal dosimeter required). Access to LHC: –From then on: will require personal dosimeter. –Simple personal tokens with biometry scan will not work anymore: any person who requires access should have a personal dosimeter –Impact on continuation of power commissioning –Impact on continuation of experiments installation

March 3 rd 2008M. Gruwé25 Layout Present experience –With installation configuration –With operation configuration Near future: –Cool-down and power commissioning –Move whole LHC to operation configuration Beam in LHC Some issues

March 3 rd 2008M. Gruwé26 Issues (I) Training to be done: –For users: how to access in restricted access mode (including biometry)? A video (very well done) has been prepared by TS/ASE: Will be made widely available (web, or general Level 4 safety training) Currently: –Install –Watch –For operators: how to use the access system software? Training foreseen between March 12 th and March 14 th Done by TS/ASE Lecture and hands-on sessions –For patrollers: how to patrol a sector on LHC: Being worked on with DSO Will be organized soon Needed before next power commissioning

March 3 rd 2008M. Gruwé27 Issues (II) Documentation to be made available: –Geographical: Matching between equipment and (access system) sectors and zones Routes to access a given equipment (which access point, which sectors) –Proper operation instructions to be prepared and made available How to react to access system alarm (door being forced, etc…) –User manual of access system for operators Training notes provided by TS/ASE Strapping of some EIS: –For test purposes, equipment groups occasionally require strapping of some EIS… –Any such change of the access system should go through formal procedure:

March 3 rd 2008M. Gruwé28 Official procedure for strapping EIS 1.Request: 1.A request for configuration change or EIS strapping is raised by users such as RF, TED,... and shall be sent to the person responsible for the operations of the LHC access system : T. Riesco or JF Juget TS/ASE 2.The request is entered in a standard EDMS validation process 2.Evaluation: 1.The impact of the modification on the operational system is evaluated by the access system's operations team. 2.If approved by the access team, the new configuration of the system is documented in an excel file summarizing the status of all EIS in the whole LHC complex. 3.Validation 1.The requestor and the AB DSO will receive this information and shall validate it in EDMS before it is implemented. 4.Implementation and verification: 1.When validated the operation team makes the modification on the field and reports it in EDMS 2.The correct functioning of the system after the strap has been implemented is verified and reported in EDMS. Notes: –To remove straps the same procedure is applied. –No changes can be made without a formal approval from the AB DSO.

March 3 rd 2008M. Gruwé29 Issues (III) DSO tests (duration and organization) –Will take time –Will block access to various points (frequency, duration,…) –Requires access system of whole machine in operation configuration –No EIS strapped –Access system configuration should not be changed afterwards! “After beam” situation: –RP situation to be clarified Supervised areas? Simple controlled areas? Buffer zones? –Impact on experiments / contractors / power commissioning