Industrial Control Systems for the Technical Infrastructure at CERN
P. Ninin, E. Cennini, P. Sollander, D. Blanc, F. Bonthond
Pierre.Ninin@cern.ch
European Organisation for Nuclear Research - CERN,
1211 - Geneva - 23, Switzerland
Abstract

2.1 Introduction

Industrial control systems have been used forseveral years for the control of CERN's technicalinfrastructure, particularly for fire and gas detection, access
control and cooling water systems.
Until recently, industrial equipment has been connectedto the control network at the lowest level via CERN
specific front ends. Since 1993 they have been integratedusing industrial supervision systems drivers. Today theintegration is performed using TCP/IP based protocols andthe distributed Technical Data Server (TDS) supervisionsystem. This paper summarises the evolution of thedifferent techniques, the control system architecturesand our integration philosophy. The safety system of theChorus and Nomad experiments, the West Zone and the PS
cooling water systems are based on Siemens
Programmable Logic Controllers (PLC) the Siemens
proprietary fieldbus Sinec L2 and Ethernet protocol Sinec
H1, in combination with the driver from the supervisorysystem FactoryLink for data integration into the control
room layer. The Access Control and Machine Interlock
Safety systems of the SPS accelerator have been
implemented using PLCs connected to Sinec L2 fieldbuses
and the H1 protocol over a specific Ethernet network. Thissystem is entirely supervised by a FactoryLink software
application. The re-engineering of the control of the SPS
air conditioning, gas and fire detection uses a new Siemens
technology for TCP/IP communication and the newconcept of industrial control system integration of the TDS.
The PLCs communicate via TCP/IP on a public Ethernet
segment with a TDS Equipment Controller (EC). This
process converts and integrates PLC specific data to theTDS, using an asynchronous data exchange protocol
based on TCP/IP.

CERN's Technical Control Room (TCR), is responsible
for the overall surveillance and control of the technicalinfrastructure. The TCR is an alarm-driven control room inthe sense that the arrival of an alarm alerts the operator andmakes him take appropriate actions. The operator acts
upon the alarms primarily by consulting and interactingwith mimic diagrams. These human-computer interfaces,alarms and mimic diagrams have been structuredsystematically and they have been standardised to a large
extent, in spite of the large diversity of installations being
supervised [1]. Any new installation must be integrated
harmoniously into this environment. Since 93, Siemens
PLCs are being increasingly used and in conjunction theindustrial supervisor FactoryLink has been integrated in
the existing control system for the supervision of four
different systems.

1 Introduction
Ten years ago, industrial control devices (PLC) or standalone control systems) were integrated at the lowest level(Equipment Access layer) of the CERN control systemusing simple protocols such as RS-232. The integration
was usually difficult we were still in the era of the "closeand proprietary" control system. Today such industrial
control devices are designed for integration inheterogeneous control systems and many options
are offered to the control engineers. This paper will
illustrate three different options of industrial controls andtheir integration in the CERN control room environment.
2 Industrial control integration in the TCR

2.2 Systems
2.2.1 Safety applications
We are currently monitoring the refurbished safetysystems at CERN using the above-mentioned system. Thesystems include fire and gas detection, emergency stop
equipment and other safety related data. The systemcomprises around 2500 data points controlled by 15
different PLCs around the site
2.2.2 Cooling water west zone
The cooling water circuits servicing the CERN 'West
Zone' are controlled by two PLCs, programmed anddelivered by an external firm. The field bus used for theprevious safety system was extended to include thesetwo PLCs. The communication functions for the PLCs
were provided by CERN to ensure compatibility. The TCR
monitors approximately 300 data points from this system.
2.2.3 Cooling circuits of the PS accelerator
The Proton Synchrotron (PS) had its cooling water
control systems entirely rebuilt in the period 1994-95. The
project was given to an external firm who was asked
to deliver a SINEC H1 connection to an HP machinerunning FactoryLink. The machine comprises 15 coolingstations controlled by PLCs connected to a concentrator by
two separate field buses using the SINEC L2 protocol; thePLC is itself connected to FactoryLink running on the HP
machine using the SINEC H1 protocol over Ethernet. Dueto the large number of equipment parameters controlled
and the relative stability of the system, an event driven dataacquisition system was implemented. The TCR monitors
approximately 1000 points from this system.

add-on data acquisition module to FactoryLink in order
to be able to use the UMMI.

2.2.4 Cooling circuits for the computer centre

3 SPS access control and machine interlock

In 1995, the CERN computer centre cooling circuits wereprovided with new control facilities. Connecting thecomputer centre PLC to the existing SINEC L2 network
for the PS cooling made the integration of this system
possible. The TCR monitors 120 points from this system.
2.3 System architecture
SYSTEM ARCHITECTURE
X-Terminal

X-Terminal

SL/CO Ethernet

HP - UX
FactoryLink

HP - UX
UMMI server

HP - UX
CAS

Sinec H1

Cooling
Central PLC

Sinec L2

Sinec L2

3.2.1 The access and search interlock - A&S.

17 PLCs

FireLocal
Fire PLC
Local
Fire PLC
Local PLC

Cooling
Local PLC
Cooling
Local PLC
Cooling
Local PLC

West Zone
PLC 1West Zone
PLC 2

Figure 1. TCR integration architecture
2.4 Main system characteristics-The safety of personnel entering the accelerator,
comprising radiation and electrocution risks, is provided by
the Access Control System that conforms to the followingrules:⇒ All equipment related to beam circulation
can only operate when nobody is inside the machine,⇒ Personnel are only allowed to enter the machine whendangerous beam circulation equipment is not
in operation and radiation is at a safe level.
Considering the above rules and the related consequences,the design of the access control system consists of
two complementary functional blocks: the Access andSearch Interlock and the Machine Interlock System.
3.2 Systems

Safety. etc.
Central PLC

11 PLCs3.1 Introduction and definitions.

4000 points monitored
32 Siemens S5 - 115-U PLCs
HP Server running FactoryLink and in housealarm and HCI interface

2.5 Control room layer integration
The Central Alarm Server (CAS) [1] is the common
alarm server for all alarms handled by the TCR. It receives
the alarms from the equipment, and dispatches them to theusers. Hence a special CAS interface module wasdeveloped and added to the FactoryLink applicationin order to transmit alarms a standard way.
All mimic diagrams used in the TCR have beendeveloped using a high-level graphics environment calledthe Uniform Man Machine Interface (UMMI) [2]. Again,
for reasons of standardisation, we chose to develop an

The purpose of the SPS Access and Search Interlock
System is to control the different access equipment (doors,separating grids, shielding doors, etc.), of the various
buildings and sectors of the tunnels, called "Important
Safety Components for the access - ISC-access"3.2.2 The machine interlock system - MIS.
The purpose of the Machine Interlock System isto control the machine equipment (power supplies, magnets,dumps, beam stoppers, targets, vacuum chambers, etc.),
responsible for beam circulation. All this equipment iscalled "mportant Safety Components for the machine ISC-machine".
3.3 Architecture.
The complete Access Control System of the SPS isbased on the tight integration at the "Safety Desk" level ofthe A&S and the MIS systems.
The A&S and MIS have the same logical structure,
based on local PLCs (managing local interlocks) which
communicate to a central controller (managing centralinterlocks) through dedicated Sinec L2 branches.
The central controllers exchange summary data with amaster PLC located within the "Safety Desk" of the SPSLEP control room (PCR) using the SINEC H1 protocol.
The master controller manages the integration of the A&S
and MIS through the "resultant master interlock chains".
The flow of information, through Sinec H1 and L2, canbe summarised as follows :- the central controllers receive "commands" from the
FactoryLink supervisor and dispatch them to the localcontrollers;- the central controllers receive "statuses" from localcontrollers and dispatch them to the HP and process them,in order to provide the master controllers with theirrespective resultant interlocks chains
Each system has its own hardware redundancy for dataexchange between local, central and master controllers.
The global system is also equipped with a dedicated"Service Network" based on RS-232 lines for contingency
reasons, connecting the master controller to the local sites.
This network is used to distribute the "Access" database.

communicates to the TDS with a dedicated EC.
SYSTEM ARCHITECTURE
X-Terminal

X-Terminal

SL/CO Ethernet

MIS

Display(PC) A&S
ACCESS CONTROL SYSTEMMACHINE INTERLOCK SYSTEM

3.4 Main system characteristics.
- 130 access elements (doors, grids, turnstiles, keys, searchboxes, .etc.),- 600 keys (access and safety keys),- 15 film badge readers (Bar Code reader),- 50 machines (magnets, RF systems, dumps, ...),- 26 Siemens S5-115-U Programmable Logic Controllers- 1 Sinec H1 network,- 6 Sinec L2 networks (up to 5km),- HP-UX FactoryLink (V. 4.3.1) application software.
3.5 Control room layer integration
System operators supervise the access system onworkstations connected to an HP server running Factorylink. This server is connected via the Sinec H1 network
to the master PLC controller.
Figure 2.- SPS Access Control and Machine Interlock.
4 SPS fire detection and ventilation systems
4.1 Introduction
The refurbishing of the SPS fire detection andventilation systems uses a new Siemens technology
allowing PLCs to communicate directly over TCP/IP, andthe new concept of industrial control integration and data
distribution proposed by the TDS [6].

Intercom

Intercom

PCR

SAFETYDESKTESTKEYS(NORMAL)

CCTV

Hardwired
Lines

HardwiredLines

Sinec H1

A&S Central
HW Interf.

HP-UX
Factory Link

A&S
Central PLC

MISCentral PLC

Sinec L2Sinec L2

MIS Central
HW Interf.

CCR
HardwiredLines

L2 Repeat.

CentralComms
PCs
HardwiredLines

L2 Repeat.

# 15 RS-232 toLocal Comms PCs

A&S Local
HW Interf.

A&S
Local PLCMISLocal PLC

MIS Local
HW Interf.
RS-232network

Keys, Grids, Doors,
Search Boxes, ...

Sites
(BAs)

Local
Comms
PC

Internal
MonitorCntrl (PC)
Display

Magnets, RF Systems,Dumps, ...

External
MonitorCntrl (PC)
Film
Badge

Intercom

The aim of the system is to detect fires in the SPS
accelerator and to automatically activate the tunnel
ventilation system according to a predefined plan. The
supervision of these security systems is performed fromthe CERN Technical Control Room (TCR), Safety Control
Room (SCR) and locally from the SPS surface buildings.

CCTV

The TDS integrates equipment data coming from 3
different sources: Siemens PLCs monitoring the SPS
ventilation and fire detection systems and the industrial
Landis and Staefa Visonik control system of the SPS airconditioning.
The ventilation and fire detection PLC data
concentrators communicate via TCP/IP on a public
Ethernet segment to an Equipment Controller (EC). This
process converts and integrates PLC specific data frames
to the TDS, using an asynchronous data exchange protocol
based on TCP/IP.
The Landis & Staefa Visonik control system

CCTV

Master PLC

4.2 Systems

4.3 Architecture

TESTKEYS(TEST)

Display

Figure 2.- SPS Access Control and Machine Interlock
The TDS interfaces with the EC trough TCP/IP sockets
in an oriented connection mode (stream mode). The
exchanged messages are defined in the. Generic TDS
Equipment Access Protocol (GTEAP)[5].
The delivery of each EC is under the responsibility ofthe company providing the local control system.
Equipment data has to be defined in an Oracle reference
database (TdrefDB) along with the TDS topology to hostthis new interface.
The EC may run on any platform selected by thecompany as long as it matches the specification for
integrating a new device on the control network [6] andthat it communicates through TCP/IP. The TDS
communicates with ECs on PCs running OS2, PowerPCs
running Lynx OS and HPs running HPUX. These systems
are supervised by the CERN/SL network management
system.

4.4 Control room layer integration
The TDS provides equipment data storage in a real time
database, alarm delivery to the central alarm server, datalogging, automatic sending of command to the equipment,
and data delivery to mimic diagrams [7].
Data send by the ventilation and fire detection systems
will automatically trigger commands to the L&G Visonik
system to alter the ventilation of the tunnels.
4.5 Main system characteristics- Siemens S5-95-U PLCs to collect data from fire detection
units and air conditioning systems- Siemens Profibus,- Siemens S5-115-U acting as data concentrator, andconnected to the SPS Ethernet network via a specific
TCP/IP card.
- HP servers running the TDS/RTworks processes
5 Conclusion
Industrial control components may be used today at
every level of the standard model. The robustness of theindustrial programmable logic controllers and of the fieldbuses makes them very efficient devices for controlling
local processes particularly in "industrial areas" (dust,electromagnetic noise). Today the PLCs may be connected
to TCP/IP networks easing integration with the control
room layer. However when integrating several local
control system in a global monitoring system, a clear
strategy must be defined. At CERN, for the monitoring of

the technical infrastructure, we have built a Technical Data
Server whose distributed architecture allows theintegration of any local control systems via a defined
protocol based on TCP/IP.
References:[1] "Integrating Industrial Control Systems into theControl
EnvironmentoftheTechnical
Infrastructure of CERN", P. Sollander, D. Blanc, A.
Swift, ICALEPCS'95, Chicago, USA, October 30 November 3, 1995
[2] "Utilisation d'un logiciel commercial graphique pourle controle des installations techniques du CERN",
CERN-ST-MC-TCR/92, October 92[3] "Data Communication Infrastructure Available at
CERN for Interconnection of Industrial ControlSystems", Robin Lauckner, Patrick Lienard, RaymondRauch, CERN-SL 97-14 CO, March 1997.
[4] "SPS Access Control Renewal: Functional
Specifications", TECNOST - April 1997
[5] "Technical Data Server V1.0 ICD", P. Ninin & all,
ST/MC/96-12PN, December 1196
[6] "Integration of Industrial Equipment and Distributed
Control Systems into the Control Infrastructure at
CERN", October 1997, R.J. Lauckner, R. Rausch,
ICALEPCS'97,
thisConference,Beijing,3-7
November 1997
[7] "Technical Data Server: a Modern Vision of Large
Scale Supervision" P. Ninin, ICALEPCS'97, thisConference, Beijing, 3-7 November 1997