3.1 Safety Interlock System

The safety interlock system is a crucial system that processes the interlock logic. The operation of the safety interlock system comprised the following three operation states: released state, searching state and the interlocked state. Fig. 2 shows the workflow chart of the safety interlock system. Table 1 lists the definitions and actions of the different operation states.

Fig. 2.Full-screen View

Workflow chart of the safety interlock system

When the facility was turned on, the safety interlock system entered into the released state. The HLS-II included three safety interlock areas: the linac, ring center and the ring hall. In the released state, the interlock system of these three areas were released. All the interlock signals were reset and the search lamps were turned off.

The search state was aimed at establishing the interlock. When the search state was initiated, the operator would inform all the individuals to leave the interlock areas using audible and visual alarms. Then the interlock areas in the linac, ring center and the ring hall were searched consecutively by the operator. If all the search buttons were pressed and the security doors were locked, the operator provided the beam permit command to transfer the operation state into interlocked state.

For the HLS-II, after the beam was injected and the beam current of the storage ring reached 360 mA, two types of operation modes, such as the top-off mode and decay mode, could be considered. The top-off mode is a high performance operation mode, in which the beam is injected every few minutes [18]. Thus, the linac and ring center were maintained in the interlocked state in the top-off mode. In the decay mode, the beam was injected every few hours, and the interlock of the linac and ring hall could be released, while the ring center was maintained in the interlocked state.

During the interlocked state, if the interlock system was released by the operator or triggered by the interlock signals, such as the emergency buttons were pressed or the radiation monitoring system detected an excessive radiation dose, the safety interlock system would cut off the timing signals of the electronic gun as well as the microwave system and transit into the released state.

3.2 Access Control System

The design of the access control system in HLS-II is based on the principle of classified protection. The interlock areas could be classified into three types, such as the high radiation area, radiation area, and the safety area, according to the radiation dose rates. If the radiation dose rate was higher than 10μSv/h, the interlock area was defined as the high radiation area. If the radiation dose rate ranged between 1μSv/h and 10μSv/h, the interlock area was defined as the radiation area. It was defined as the safety area, if the dose rate was less than 1μSv/h. Table 2 lists the safety classifications of the interlock areas in different PSS states. In the high radiation area, the access of the security doors was prohibited, and no personnel was allowed to open the doors under any condition. In the radiation area, only the staff were provided with the restricted access authority. In the safety area, staff, users, and all other personnel could open the security doors with their respective access cards.

In HLS-II, the security doors could be opened using the respective access cards. When the access card was swiped, the card information was transmitted to the PLC. Then the PLC determined the access permission according to the access authority of each card and safety classification of the interlock areas. The card number and authentication information were transmitted to the IOC and archived in the EPICS database as an event for recording and tracking. Meanwhile, the OPIs could display the access state synchronously.

In the access control system, the personnel count function was realized in the EPICS IOC using the state notation language (SNL). SNL is a domain specific programming language, which can provide a simple yet powerful tool for sequential operations in a real-time control system [19]. The number of personnel in each of the interlock areas was counted by the SNL program and the count results were recorded into the EPICS records.

4.1 PLC Programs

As shown in Fig. 3, the PLC programs include two types of blocks, such as the data block and function block. The data block is used as the storage block for the PLC programs. The input and output data are stored respectively in the data blocks "DI Data" and "DO Data". The function block is used to process the safety interlock and access control signals and communicate with the EPICS IOC.

Fig. 3.Full-screen View

Structure of the PLC programs

In the PLC programs, the input signals from the IO devices and the input data from the data block "DI Data" were retrieved using the receive function. Two types of flags, such as the lock flag and bypass flag, were defined for each signal in the preprocess function to process different types of input signals. The lock flag was designed to latch onto the transient signal, such as the signal of the search button. The bypass flag was used to ignore the related signals in the scenario of system test or maintenance.

The execution of the interlock logic and the PSS state transition among the released state, searching state and the interlocked state were managed by the safety interlock function. The access control function was used to process the access algorithms and control the security doors. The send function was used to output the interlock signals to the IO devices and record the output data to the data block "DO Data".

The communication function was used to define the communication cycle and the size of the communication frame, establish the communication links, and exchange data with the EPICS IOC. The role of the PLC could be determined by its state parameters. Only the MASTER PLC was used to transmit the data to the EPICS IOC.

4.2 EPICS Driver of Redundant PLC

The development of the EPICS driver for the Siemens redundant PLC is based on the EPICS driver "S7plc" [20, 21]. The driver was intended to connect to the PLC via the TCP/IP protocol. The EPICS IOC was set up as the TCP client, and the PLCs were set up as the TCP server. Fig. 4 demonstrates the structure of the EPICS driver.

Fig. 4.Full-screen View

Structure of the EPICS driver

The EPICS driver includes four types of threads, such as the manager thread, link thread, data receive thread, and the data send thread. After the IOC driver was initialized, the two link threads attempted to establish the TCP circuits with the redundant PLC pair periodically. Once successful, only the MASTER PLC transmitted data to the IOC. This behavior was used to distinguish the role of the redundant PLCs in the manager thread. The data receive thread and the data send thread were used to exchange data.

During the communication, the SLAVE PLC did not transmit data to the IOC. To check whether the SLAVE PLC was operational or not, the IOC transmitted the "ping" command periodically to the SLAVE PLC. If the MASTER PLC failed, the IOC would not receive any data. Once the SLAVE PLC switched to the new MASTER PLC, it transmitted data to the IOC. After the IOC received the data again from the new MASTER PLC, it could determine that the roles of the redundant PLCs were switched and the data was exchanged with the new MASTER PLC.

5.1 OPI Design

The OPIs of the proposed HLS-II PSS comprise the OPI of the linac area and that of the storage ring area, as shown in Fig. 5(a) and Fig. 5(b), respectively. The linac area includes the linac tunnel and transport line tunnel. The storage ring area includes the ring center and ring hall.

Fig. 5.Full-screen View

(Color online) OPI of the linac(up) and OPI of the storage ring(down)

The OPI could be divided into the following four parts: 1) the distribution and state of the security doors, emergency buttons, search buttons and the alarm devices; 2) personnel count and the radiation dose monitoring state in the interlock areas; 3) interlock logic diagram; and 4) the operation commands and related states. The line color in the interlock logic diagram is variable depending on the logic value. It is gray when the logic value is 0 and green when the logic value is 1.

5.2 Offline Tests

The development of the novel HLS-II PSS is complete. To ensure that that this system could function as per the design, we set up an offline test platform, as shown in Fig. 6. In the platform, the redundant PLCs and the industrial switch were installed in the cabinet. According to the location of the IO devices at HLS-II, all the buttons, lamps, and the card readers were mounted on three boards with the names "LINAC", "RING HALL", and "RING CENTER". The information screen was used to display the state of the security door and the personnel count results. In Fig.6, the OPI and part of the 14 IO stations are also shown. The IOC is not shown in the picture.

Fig. 6.Full-screen View

(Color online) Photo of the test platform of the novel HLS-II PSS (In the information screen, the search button in blue that is adjacent to the door is also called the registration button)

The offline platform was continuously tested according to the real operation situations for one month. The test results demonstrated that all the devices could function in a proper and stable manner, interlock actions could be executed effectively, and the top-off mode and decay mode could be supported successfully. Moreover, it was observed that the offline platform could function properly during the redundant PLCs switchover.