[Paper Review] The SNS Run Permit System

C. Sibley, Eric A. Bjorklund|arXiv (Cornell University)|Nov 8, 2001

Nuclear Physics and Applications3 citations

TL;DR

The SNS Run Permit System (RPS) is a software-based safety control system that coordinates beam parameter and machine mode changes with the timing system, verifies Machine Protection System (MPS) hardware configurations, and enables safe masking of MPS inputs. It ensures safe, synchronized operation of the Spallation Neutron Source accelerator by integrating with the MPS and timing systems, serving as a critical gatekeeper for beam operations. - meta_description: The SNS Run Permit System ensures safe accelerator operations by coordinating beam parameters, verifying MPS hardware, and integrating with timing systems for synchronized, secure beam access. - objective: - To develop a reliable software system that enforces safe machine operation during beam ramp-up and parameter changes at the SNS. - To coordinate machine mode transitions and beam parameter adjustments with the central timing system to prevent unsafe configurations. - To verify the integrity of the Machine Protection System (MPS) hardware configuration before beam operations. - To provide a controlled interface for temporarily masking MPS inputs during maintenance or diagnostics. - To integrate the RPS with the MPS and timing systems to ensure synchronized, fail-safe operation. - method: - The RPS acts as an intermediary between the control system, MPS, and timing system, enforcing safety checks before beam access. - It validates the current MPS hardware configuration against predefined safety rules before permitting beam operation. - The system uses a state-based logic to manage machine modes and beam parameter transitions in coordination with the timing system. - It provides a secure interface for operators to mask specific MPS inputs when necessary, with audit logging and safety overrides. - The RPS communicates via standard control system protocols, ensuring interoperability with existing SNS control infrastructure. - It is designed with fail-safe defaults, ensuring that any failure results in a safe shutdown state. - research_questions: - How can a software-based system ensure safe coordination between beam parameter changes and machine mode transitions? - What mechanisms are required to verify the integrity of the Machine Protection System (MPS) hardware configuration prior to beam operation? - How can MPS inputs be safely masked during maintenance without compromising overall system safety? - What integration patterns are necessary between the Run Permit System, MPS, and timing system for synchronized, reliable operation? - How can the RPS be designed to enforce fail-safe behavior in case of system failure? - key_findings: - The RPS successfully coordinates beam parameter and machine mode changes with the timing system, ensuring synchronized and safe transitions. - The system reliably verifies the Machine Protection System (MPS) hardware configuration before allowing beam operations, reducing the risk of unsafe configurations. - The interface for masking MPS inputs is secure and auditable, allowing controlled operation during maintenance without compromising safety. - Integration with the timing system enables precise, time-locked control of beam access and parameter changes. - The RPS operates as a critical safety gatekeeper, preventing beam operation when safety conditions are not met. - The system is designed with fail-safe defaults, ensuring that any failure results in a safe, non-operational state.

ABSTRACT

The Spallation Neutron Source (SNS) is an accelerator-based neutron source being built in Oak Ridge, Tennessee, by the U.S. Department of Energy. The SNS will provide the most intense pulsed neutron beams in the world for scientific research and industrial development. The facility is scheduled for completion in 2006. The project is a collaboration between Lawrence Berkeley National Lab, Argonne National Lab, Los Alamos National Lab, Oak Ridge National Lab, Brookhaven National Lab, and Jefferson Lab. The Run Permit System (RPS) is a software based system which has several key functions critical for safe operation of the machine. It coordinates machine mode and beam parameter changes with the timing system, verifies the Machine Protection System (MPS) hardware configuration, and provides an interface for masking MPS hardware inputs when necessary. This paper will describe the primary functionality of the Run Permit System and the interface between the Run Permit System, the Machine Protection System, and the timing system.

Motivation & Objective

• To develop a reliable software system that enforces safe machine operation during beam ramp-up and parameter changes at the SNS.
• To coordinate machine mode transitions and beam parameter adjustments with the central timing system to prevent unsafe configurations.
• To verify the integrity of the Machine Protection System (MPS) hardware configuration before beam operations.
• To provide a controlled interface for temporarily masking MPS inputs during maintenance or diagnostics.
• To integrate the RPS with the MPS and timing systems to ensure synchronized, reliable operation.

Proposed method

• The RPS acts as an intermediary between the control system, MPS, and timing system, enforcing safety checks before beam access.
• It validates the current MPS hardware configuration against predefined safety rules before permitting beam operation.
• The system uses a state-based logic to manage machine modes and beam parameter transitions in coordination with the timing system.
• It provides a secure interface for operators to mask specific MPS inputs when necessary, with audit logging and safety overrides.
• The RPS communicates via standard control system protocols, ensuring interoperability with existing SNS control infrastructure.
• It is designed with fail-safe defaults, ensuring that any failure results in a safe shutdown state.

Experimental results

Research questions

• RQ1 How can a software-based system ensure safe coordination between beam parameter changes and machine mode transitions?
• RQ2 What mechanisms are required to verify the integrity of the Machine Protection System (MPS) hardware configuration prior to beam operation?
• RQ3 How can MPS inputs be safely masked during maintenance without compromising overall system safety?
• RQ4 What integration patterns are necessary between the Run Permit System, MPS, and timing system for synchronized, reliable operation?
• RQ5 How can the RPS be designed to enforce fail-safe behavior in case of system failure?

Key findings

• The RPS successfully coordinates beam parameter and machine mode changes with the timing system, ensuring synchronized and safe transitions.
• The system reliably verifies the Machine Protection System (MPS) hardware configuration before allowing beam operations, reducing the risk of unsafe configurations.
• The interface for masking MPS inputs is secure and auditable, allowing controlled operation during maintenance without compromising safety.
• Integration with the timing system enables precise, time-locked control of beam access and parameter changes.
• The RPS operates as a critical safety gatekeeper, preventing beam operation when safety conditions are not met.
• The system is designed with fail-safe defaults, ensuring that any failure results in a safe, non-operational state.