Experimental Physics and
Industrial Control System

"Chestnut, Ronald P." <[email protected]> · Tue, 7 Oct 2008 10:44:30 -0700

I'd like to chime in on this important point ....

At SLAC any system which protects people (or provides the fail-safe for machine operations) -- known as PPS and BCS here (Personnel Protection Systems and Beam Containment Systems) -- must be truly fail-safe. We have special teams trained to think in a fairly paranoid fashion who have just received permission to use special Safety-rated PLCs, after other labs proved the technology and we could convince even more paranoid (and rightly so!) committees that these new PLCs were redundant and unimpeachable.

So using any non-safety-rated system to protect people at a site (and even more so for the general public!) is a really bad idea, and most probably violates several laws.

I would strongly suggest that you raise alarms to your employers about the extreme concerns a seat-of-the-pants solution raises. I can put you in touch with our safety people if that is helpful.

EPICS is a really fine toolkit, which solves a huge array of control system problems well. It is NOT to be thought of as a crucial safety system toolkit, as all other general controls solutions are also NOT to be though of as such.

Please do take some action.

Ron Chestnut
Deputy Head of Controls/SLAC
Off.: 650 926 2450
Cell: 650 520 6186

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of J. Lewis Muir
Sent: Tuesday, October 07, 2008 10:20 AM
To: David Dudley
Cc: [email protected]
Subject: Re: Process 'bo' on write?

On 10/7/08 1:00 PM, David Dudley wrote:
> Unfortunately, all my sites are not connected together over the 
> network, some are handled using 1200 baud radios.
> 
> This is one of our remote facilities, where we handle Hydrofluoric 
> acid (probably misspelled that one), Gaseous and Liquid Chlorine, and 
> Liquid Ammonium Sulfate.  The alarm is to notify residents in the area 
> in case of a chemical mishap or leak.  I'm lucky to have a PLC and a 
> IOC available at this site, and I don't think there's enough space on 
> the IOC's ram disk for me to run the alarm handler as well.
> 
> The site's pretty much dictated to me, and I'm using the IOC to 
> communicate with all the gas detectors, make decisions about what's 
> dangerous, and set off alarms.

Hi, David.

Just a heads-up: my understanding is that EPICS has not been designed to be used in a role that provides human safety.  See this tech-talk post from Andrew:

  http://www.aps.anl.gov/epics/tech-talk/2008/msg00797.php

If you're using EPICS to provide some extra software alarms or something in addition to existing human safety alarms, that's one thing.  But if you're actually using EPICS to determine whether an alarm horn or strobe should go off when some environment condition could be dangerous for a human to warn them of a danger, I don't think EPICS was designed for that.

But this is just my understanding; I could be wrong.

Lewis

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System