SuperKEKB personnel protection system

The Super-KEKB[1] personnel protection system (PPS) takes care of not only Super-KEKB accelerator, but also Photon Factory - Advanced Ring (PF-AR), Positron Damping Ring (PDR)[2] and their beam transport lines (BT)[3]. The logic of the PPS has been changed to adapt the new accelerator operation scheme. The Experimental Physics and Industrial Control System (EPICS) was introduced into the PPS. Many tools developed under EPICS environment are used.


Introduction
The injector linac supplies beam to PF, PF-AR, Super-KEKB.PDR is built in the middle of the injector linac to reduce the positron beam emittance for the Super-KEKB.The PPS of these accelerators are integrated into the one PPS.The safety of each ring and BT line is ensured by communicating with the injector linac safety system.Risk analysis, assessment and risk reduction are considered according to ISO121001 risk assessment.

Identification of the safety objective for SuperKEKB PPS and Risk Analysis
The safety objective for PPS is to protect that person in the accelerator tunnel from radiation exposure.Exposure must correspond to both that coming from the beam and the accelerating cavity.A possible case that the beam is injected during tunnel access are Case1: Enter the tunnel without Personal Key (PK) and the operator does not recognize.Case 2: Due to a malfunction of the safety magnet and beam shutter, the beam shutter is displayed as closed, but in reality, it is open and the safety magnet is displayed as off, but it is actually energized.Case 3: Due to Programable Logic Controller (PLC) failure or cable disconnection, the safety magnet is permitted to be turned on or the beam shutter is pulled out while person is entering the area.PPS must prevent these three events.

Identification of the safety objective for SuperKEKB PPS and Risk Analysis
The protection level required for the system must be the highest, and avoided missing interlock due to an assumed equipment failure.The interlock system used in PPS is structured under the policy that the system is constructed by hard wires.PLC is regarded as having the same level of reliability as hard wire.PLCs are installed in each local control room, and the interlock signals are gathered as ON/ OFF state to the central PLC through the optical fiber.Interlock logic is build as fail-safe logic, so that a single fault leaves the system in a beam-inhibiting state.The absence of beams in the tunnel is secured by at least two independent interlocks.They offer redundant protection so that a component failure leaves the person in a safe state.

Access control system
The access control to the tunnel is carried out based on the following three levels.They are "Free", "Limit" and "Keep out"."Free" is a state in which a person can enter the radiation control area without contacting the operator in the central control room (CCR).This state is occurred during a long shutdown period."Limit" indicates a state temporarily allowing entry during accelerator operation period.In this case, the entrant needs the shift leader's permission, and the entry area is strictly managed by the PK, the surveillance camera, the card reader and infrared sensor."Keep out" is a state that the beam can be injected or accumulated so that tunnel access is prohibited.At the boundary of each accelerator, "the boundary zone" is provided as much as possible to reduce the radiation from the adjacent accelerator.Entry to the tunnel is granted by sending a two-step authorization at the LIMIT level.
Step 1 is authorization to take the PK, and 2 nd step is authorization to open the door using PK.The safety of the entrant is guaranteed by possession of PK.There are 8 entrance in KEKB ring tunnel.Entrant basically stay in the area they enter.If PK of cavity installed area is taken, an interlock is applied so that the acceleration cavity cannot be operated.The whole tunnel is constantly monitored in CCR by the surveillance cameras and recorded.

KEKB ring and beam transport line
To permit the access to SuperKEKB/BT line and ring tunnel, two independent interlocks are required.One is to turn OFF the safety magnet at the end of the injector linac, upstream of the KEKB BT line.Another is to insert the beam shutter into the beam chamber.
For the access to Super-KEKB main ring, in addition these interlocks, two independent beam stoppers are inserted in the vacuum chambers to ensure no stored beam in the ring.

PDR and injector linac
To prohibit the injection beam to the PDR, a beam shutter and safety magnets are installed in the injection BT line.No stored beam in PDR must be secured not only for PDR access, but also for access to the injector linac, because the accumulated beam in PDR returns to the injector linac.To ensure no stored beam in PDR, two independent interlocks are prepared.Since only one beam stopper is installed in PDR, it is necessary to have another interlock.The PPS requires to turn off the accelerating cavity once under the condition of the beam shutter closed and turned off the safety magnets in injection line.For the access to the injector Linac, another safety magnet is installed in the PDR extraction line.

Beam dump
For Super-KEKB, six beam dumps are provided.A beam dump installed at the end of the injector is used for injector beam tuning.To tune injection beam with BT line, the BT end beam dumps are used.Beam dumps for the accumulated beam in the Super-KEKB ring are installed in each ring.In addition, a beam dump is installed just before the damping ring, it is used to tune the positron beam to PDR.

Logic of PPS
Each accelerator, excluding PF, requests the beam in the same procedure.First, the access level is set to "Limit", and the tunnel patrol is required.After the patrol, the access level can move into "Keep out", and beam key is turned on.At this stage, the open permission of the ring stopper is given.From the downstream accelerator to the upper stream injector, "Beam ON mode" request is sent and the injector Linac supposes to accept it.At this stage, the PPS gives a permission to turn on the safety magnet and open the beam shutter.Finally the beam request signal is sent to the injector linac.

Figure 1. PPS network conceptual diagram
Two injection modes are prepared for SuperKEKB.One is "Ring Injection Mode" and the other is "Injection Beam Tuning Mode".Beam is injected in the Super-KEKB ring. in "Ring Injection Mode".On the other hand, beam guided to BT end beam dump in "Injection Beam Tuning Mode".The SuperKEKB ring is divided into two area, Fuji and Tsukuba area.Only the Fuji area is off-limits in " Injection Beam Tuning Mode".This makes it possible to work on the Belle II detector while tuning the injection beam.The safety of entrants is ensured by the safety magnets and beam shutters installed at the end of each BT line.When the safety magnet is OFF and the beam shutter is inserted, the "Injection Beam Tuning Mode" is established.

Components of PPS
The hardware components of PPS include operation indicator lights, emergency buttons, buzzers, and signal towers.The colors used in signal towers have their meanings.The red light indicates high voltage, high magnetic fields, the yellow light indicates caution of radiation.The green light indicates high pressure gas production.A large number of emergency buttons are installed in the tunnel with an alarm buzzer.When an emergency button is pressed, the beam is dumped or beam injection is prohibited and turned off all accelerating cavities and magnets.In case of the emergency button near the entrance or gate door, the door will be unlocked.During beam operation, the buzzer in the tunnel keeps on.All doors are equipped with limit switches, and the beam is sequenced to dump when the door opens.
All inputs that directly affect the interlock are made from the operation console in CCR.The console consists of buttons and keys.They are connected to IO module of the PLCs.They cannot be controlled from outside of the control room.The PLC modules have been updated every ten years to keep the The PLCs are connected to two networks.Figure 1 shows the network conceptual diagram.One of the networks is connected to the sequencer CPU, and used to download the ladder program.This network is an isolated and cannot be accessed from outside.The other is a FA-M3V dedicated network called FL-Net, which defines a common memory between CPU nodes and shares information.FL-Net is used only as a monitoring purpose and does not contribute to interlock.The FL-net cluster is divided into three clusters and shares information in each cluster.The file server and computing server are separated.As a file server, the network attached storage (NAS) has been chosen.The replica of the main file server is also installed.The server is chosen as computing server.Outside of tunnel, radiation monitors are installed near injector linac, BT line, and PDR.Two radiation monitors are installed in each experimental hall.Beam injection is stopped when the radiation dose accumulated in one hour exceeds a specified value.

EPICS based system
EPICS [4] is introduced to PPS.The information obtained through the network is defined as EPICS Record on the Input-Output Controller (IOC).Yokogawa's Embedded Machine Controller (e-RT3) [5] with Linux is used.

User interface and logging system
The open/close state of the door, the PK return state, the state of the safety magnets and the beam shutter are gathered in the IOC through network and sent to the CCR through the EPICS framework.Their status are displayed using the BOY [6] of Control System Studio (CSS).The collected information is logged in the CSS archiver.The CSS Archiver has good affinity with EPICS.The information is logged when the value changes.Compared with polling records, it can save the logging data size as well as network bandwidth.The logging data is stored using PostgreSQL, it can be easily displayed by Web browser.

System operation
The SuperKEKB PPS renewal work and operation of accelerator must be compatible.And an access control to radiation controlled areas must be continued without interruption.Modularization of the system is important as a method to meet these demands.

Rejuvenation from KEKB PPS
The PPS of SuperKEKB also takes care of many accelerators.Since they are closely related with each other, the PPS cannot be modified or updated during the operation period.The period for the system upgrade suffers great restrictions by the accelerator operation schedule.Furthermore, due to the construction of PF-AR/BT and PDR and Super-KEKB, PPS must be updated to fit the corresponding accelerator operation.Table 1 shows the history of accelerator construction.During these periods, the operation scheam changes dramatically.It is extremely difficult to remodel a largescale PPS that manages multiple accelerators in the short period.The solution of the system modification to meet such demands is as follows.
8.1.1.Modularization of local/central PLC system.Modularization of systems is carried out.Since the PLCs of each local control room and CCR are exchanging only logic signals through the optical fiber.
The PLC system can mix a plurality of vendor models.
8.1.2.Separate interlock and its monitoring.The monitoring system is separated from interlock system.To rejuvenate the system within the short period, the main interlock must be constructed first, then move to monitoring system construction.The reliability of the interlock system must be very high and have to be constructed as the level of hard wire.But the reliability of the monitoring system is a little more acceptable and can be constructed with various convenient technologies such as networks and server computer.
8.1.3.Pilot system for logic debugging.The debugging of the PLC program with the actual accelerator is incompatible with the construction and operation.The programing and its verification has been done with simulation system.All input and output are simulated with the PLC internal relay.Input operations and status monitor for debug has been done through EPICS frame work.

Summary
Because of high reliability requirements, PPS of SuperKEKB was built with hardwire including PLC.
The PPS was constructed under the fail-safe logic.SuperKEKB PPS is requested to upgrade the system to fit the accelerator operation in a short period.The modularization of the system is the key of system rejuvenation.

Table 1 .
History of Accelerator Construction