Pegasus Safety Interlock System

Author:	Gerard Andonian <gerard@physics.ucla.edu>
Affiliation:	Particle Beam Phsyics Lab, UCLA

The Pegasus Safety Interlock System is a collection of modular safety systems that incorporates electronic, computer and mechanical lockouts and readouts to maintain the personal safety of trained and qualified users during the operation of the electron linac in the Pegasus Radiation Studies Laboratory.

Introduction

The purpose of the Pegasus Safety Interlock System is to ensure the safety of lab personnel and the proper operation of the accelerator in the Pegasus Radiation Laboratory. Only trained operators shall operate the accelerator. The Pegasus Safety Interlock is controlled by a Central Control Box. The Central Box is integral to the operation of the linac. If, for some reason, the Central Box is turned off, linac operation is not possible.

The Pegasus Interlock Safety System has 5 discrete states, enumerated below.

OFF : All Faults are cleared. High Voltage is off. RF Trigger is off.
START : An intermediate state where all required inputs must be entered within a 120-second countdown. High Voltage is off. RF Trigger is off.
ON : High Voltage Relay is on. RF Trigger is on.
INTERRUPT : High Voltage Relay is on. RF Trigger is off. Control Room Key must be turned to set system in ON mode.
FAULT : A system fault has occurred. High Voltage is off. RF Trigger is off. All Faults must be cleared and System Reset button must be pressed to set system in OFF mode.

Operation and Procedure

Start Up Procedure

There shall be only one Chief Operator during each run. It is the sole responsibility of the Chief Operator to maintain possession of the Pegasus System Key at all times. The Pegasus system Key is located on a neckstrap in the Control Room. The Chief Operator should perform the following actions in succession to turn the system on.

Search, sweep and clear the bunker of all personnel.
Turn Bunker Key Switch On.
Turn off Bunker Lights (if necessary).
Close bunker door.
Turn Control Room Key Switch On.

Once the Control Room Key Switch is turned on, the Chief Operator is able to operate the Control system of the lab.

The duties of the Chief Operator also include, but are not limited to,

clearing the pathways of any potential safety hazards (i.e. power cords, cables, boxes and other obstructions, etc.),
keeping a record of all personnel present during each run,
recording all the proceedings in the Log Book,
reporting any accidents to the appropriate authorities.

Specifications and Layout

Parts List

Programmable Logic Controller - Micro 3 - (Idec): The main component of the Interlock System is a Programmable Logic Controller (PLC). The PLC was programmed using the software WindLDR v4.10 (c) distributed by the manufacturer, Idec Izumi Corporation. The hardcopy instruction manual for the PLC is located in Knudsen 4-108. The Logic Ladder currently used by the PLC is summarized in the following section (see Logic Ladder).
Neutron Detector Unit - Model # 6000-130 Serial #1101 - (Health Physics Instruments): Neutron Detector should be calibrated in regular intervals. Controlled by Controller Unit Model 6025 by Health Physics Instruments. Setting is NC. Instruction Manual is located in the Pegasus Radiation Laboratory, Knudsen B-105. The Detector Unit is located in south end of Control Room, adjacent to Bunker Wall.
Gamma Detector Unit - Model #6030 Serial #1101 - (Health Physics Instruments): Controlled by Controller Unit Model 6025 by Health Physics Instruments. Setting is NC. Instruction Manual is located in the Pegasus Radiation Laboratory, Knudsen B-105. Located in south end of Control Room, adjacent to Bunker Wall.
Bunker Lamp: Constant (2-color) indicator lamp. Uses 110 V AC. Pins 1 and 2 control Red Light. Pins 3 and 4 control Green Light. Uses 60W -100W light bulbs. Located on Bunker ceiling.
Warning Siren: Pin 1 is +VDC, Pin 4 is -VDC (ground). Located on East Wall of Bunker, near entrance.
Emergency Stop Box: Pins 1 and 4 are connected to the Bunker Key Switch. Pins 2 and 3 are connected to the E-Stop Push Button Switch. Located on the East Wall of the Bunker.
Bunker Door Switch: Setting is NC. Pin 1 is + VDC, Pin 4 is -VDC (ground). Located on East Wall of Control Room at Bunker Door.

Pictures of Various Interlock Components

Pin Connections of Various Components

The Safety Interlock System consists of a Central Interlock Box (which contains the PLC and various hardwired relays). The detailed wiring traces inside the central unit, as well as the wiring to the modulator and computer are listed below.

Logic Ladder

The following is a summary of the Logic Ladder used by the PLC.

System is OFF (default).

Pilot Light OFF is set.
System is in OFF mode.

Bunker Key is turned (NO Momentary Key Switch).

Bunker Lamp turns on (constant light turns from green to red).
Pilot Light START is set; Warning Siren is set; Timer Control is set (120 second countdown).
System is in START mode.

Bunker Door is closed (NC Limit Switch).

High Voltage Relay is turned on.
High Voltage Door must be closed.
Pilot Light INTERRUPT is set.
System is in INTERRUPT mode.

Control Room Key is turned (NO Momentary Key Switch).

RF Trigger Relay is on.
Pilot Light ON is set.
Timer Control is reset.
System is in ON mode.

Trigger Reset (NO Momentary Push Button).

If system is ON, Trigger Reset will reset the RF Trigger Relay.
Pilot Light INTERRUPT is set.
System is in INTERRUPT mode.

System Reset (NO Momentary Push Button).

System in OFF mode. All FAULTS must be clear.

The following are FAULTS - elctronic or mechanical trips that reset the system.

Emergency Stop (NC Maintained Push Button). Two locations- Central Interlock Box in Control Room and East Wall of Bunker.
Neutron Detector Unit Trip (NC circuit).
Gamma Detector Unit Trip (NC circuit).
Timer Control Expiration (120 second countdown).
High Voltage Door Open (only if System is in ON mode).
Bunker Door Open (only if System is in ON mode).
System is in FAULT mode.

Troubleshooting

More information coming soon.

Future Improvements and Modifications

Equipment Safety Interlocks

Vacuum Readout Interlock

The vacuum interlock is supposed to protect the accelerating structure; i.e. when the vacuum level goes beyond a preset threshold, the system shall go into interrupt mode.

There are two possible options regarding the vacuum readout. First, a digital readout of the vacuum levels is sent to the computer. Then the computer sends a relay signal to the Central Interlock Box indicating an INTERRUPT. The major concern with this method is the time delay with relaying the signal from the computer.

Temperature Readout Interlock
Flowmeter Readout Interlock