12th Int. Beam Instrum. Conf.
ISBN: 9 7 8 - 3 - 9 5 4 5 0 - 2 3 6 - 3

IBIC2023, Saskatoon, Canada
JACoW Publishing
ISSN: 2 6 7 3 - 5 3 5 0d o i : 1 0 . 1 8 4 2 9 / J A C o W - I B I C 2 0 2 3 - M O P 0 1 1

H.A. Watkins†, W. Barkley, C. Hatch, D. Martinez, D. Rai, E. Simakov
Los Alamos National Laboratory, Los Alamos, NM, USA
Abstract
The Accelerator Operations and Technology division isupgrading the control system for a 33-ton shield door thatwill be used when the Cathodes and RF Interactions inExtremes (CARIE) accelerator begins operations. The
door was installed in the 1990’s but safety standards suchas ISO 13849-1 have since emerged which provide safety
requirements and guidance on the principles for the design
and integration of safety-related parts of a control system.
Applying this standard, a safety controller, safety relays
and a light curtain barrier have been added to eliminate
injury and exposure of personnel to potential hazards
during door operations.

the door mechanism and piston were successful and thedoor is operational from a mechanical perspective. The
shield door and existing hydraulic system (see Fig 1).

PistonOVERVIEW OF CARIE
Los Alamos National Lab (LANL) is starting
construction of a new C-band (5.712 GHz) accelerator test
facility for cathode, accelerator, and material sciencestudies. The new facility is called Cathode and RFInteractions in Extremes (CARIE). This accelerator willreside in a radiation protection vault on the Los Alamos
Neutron Science Center (LANSCE) mesa. This location
will house a cryo-cooled copper RF photoinjector with ahigh quantum efficiency (QE) cathode and a high gradientaccelerator section with beam power up to 20 kW [1].

SHIELD VAULTCARIE will reside in a 12 by 25-foot interior vault thatuses 4-foot-thick magnetite blocks to shield the exterior
control and operations areas. The vault was originallydesigned for use with the Advanced Free Electron Laser(AFEL) project which is no longer in operation. A 33-ton
moveable shield door separates the vault from the control
room. When closed during CARIE operation, the door
protects personnel from neutron and bremsstrahlung
radiation, activated air, and ozone. The door is constructedof 12 magnetite concrete blocks welded together on theiredges and welded to a reinforced concrete base. The door
is mounted on four sets of Hilman rollers and guided bytracks on the floor, the door is opened and closed by ahydraulic piston [2]. The shield vault door will need toopen and close multiple times a day to support
experimentation within the vault. The original control
system was decommissioned and removed in the early
2000’s. However, the shield blocks, hydraulic piston androll track system remain intact (see Fig. 1). Attempts to test____________________________________________* This work was supported by the U.S. Department of Energy throughthe Los Alamos National Laboratory. Los Alamos National Laboratory is
operated by Triad National Security, LLC, for the National Nuclear
Security Administration of U.S. Department of Energy (Contract No.
89233218CNA000001).
LA-UR-23-29961†hwatkins@lanl.gov

Figure 1: Shield door opening and hydraulic system.

FUNCTIONAL REQUIREMENTS
The purpose of the control system for the shield door isto allow scientists and engineers to easily access theinterior vault when CARIE is not in operation and for thedoor to remain closed when operations commence. The
control system requirements are very simple. Open andclose buttons mounted exterior to the vault easily meet thefunctional requirements for operation. Investigation of themounting points and legacy relay system indicate this ismost likely what existed during its operation during the1990’s until decommissioning in early 2000’s.

SAFETY REQUIREMENTS
The legacy requirements of safety for the shield door
design focused on the radiation shielding that the door
provided to the users when the original AFEL was inoperation. However, safety of the control system e.g. door
operations were not considered or evident in the initialdesign. ISO 13849-1 is the safety standard that now
governs safety requirements for the operation of control
systems. This safety standard provides safety requirements
and guidance on the principles for the design andintegration of safety-related parts of a control system. This
standard defines the performance level (PL), which is thediscrete level used to specify the ability of safety-relatedparts of control systems to perform a safety function under
foreseeable conditions.

WHAT IS SAFETY? WHAT IS RISK?
Control system engineers must incorporate safety intodesigns to provide the protective measures needed to insure
MOP01101 Overview and Commissioning

59

Content from this work may be used under the terms of the CC-BY-4.0 licence (© 2023). Any distribution of this work must maintain attribution to the author(s), title of the work, publisher, and DOI

SAFETY CONSIDERATIONS FOR SHIELD DOOR CONTROL SYSTEMS*Content from this work may be used under the terms of the CC-BY-4.0 licence (© 2023). Any distribution of this work must maintain attribution to the author(s), title of the work, publisher, and DOI

12th Int. Beam Instrum. Conf.
ISBN: 9 7 8 - 3 - 9 5 4 5 0 - 2 3 6 - 3

IBIC2023, Saskatoon, Canada
JACoW Publishing
ISSN: 2 6 7 3 - 5 3 5 0d o i : 1 0 . 1 8 4 2 9 / J A C o W - I B I C 2 0 2 3 - M O P 0 1 1safe operations. Control system safety can be defined as“freedom of the operator from unacceptable risk.” This
infers that there is minimal level of risk involved evenwhen a system is considered safe. Risk is then defined as“a combination of the probability of the occurrence of harmand the severity of that harm” [3].
Risk = Severity of harm × Probability of theoccurrence of harm

(1)

RISK ASSESSMENT
Every time we rely upon a control system to reduce risk,
we also need to consider the probability that the safetycontrol system itself will fail. If a safety control systemfails, it does not provide the risk reduction measure. Thisis the domain of functional safety and incorporates the PL
as its basis to have the control system reliability exceed theneeds of the risk reduction measure [4].
Control system engineers should begin with a risk
assessment using the flow chart (see Fig. 2) to determine
limits, hazards, risk, and the protective measures needed tomitigate exposure to the hazards. This risk assessment wascompleted for the shield door project and resulted in adesign to minimize operator exposure to identified hazards.
START

DETERMINE THE
LIMITS OF THE
MACHINE
PROTECTIVE MEASURES
IMPLEMENTED BY
DESIGNERSIDENTIFY HAZARDS

Risk Analysis

Inherently Safe
Design MeasuresESTIMATE RISKEngineering Controls
Safeguarding
Measures

EVALUATE RISK

Administrative Controls
 Warning signs
 Warning signals

NORisk Assessment

RISK ADEQUATELYREDUCED?

engineering limit is added at the door closure to disengage
the pump and stop motion. Identifying these limits thenallow for moving to the hazard identification step of theflowchart.

INDENTIFY HAZARDS
Mechanical hazards fall into six different categories.
Crushing

ShearingCuttingEntanglement

Drawing-in or trappingStabbing or puncture

The shield doors specific mechanical hazard wasidentified as crushing. The hydraulic piston when in
operation can crush the human body and cause serious
injury if the hydraulic pump remains engaged and anengineering limit has not been reached.

ESTIMATE RISK
Since a hazard has been identified the next step is toestimate the risk of the crushing hazard of the shield door.
The risk estimation chart allows an engineer to determine
the degree of risk as a performance level requirement (PLr)given the severity of injury, frequency of exposure to thehazard and the possibility of avoiding the hazard. Figure 3
shows the flow chart with the dashed line estimating risk
for the shield door.
S = Severity of Injury
S1: Slight
S2: Serious 
F = Frequency or exposure to hazard
F1: Seldom to less often 
F2: Frequent to continuous
P = Possibility of avoiding hazard
P1: Possible under specific conditions P2: Scarcely possible

YES
COMPLETE

Figure 2: Risk assessment flow chart.

DETERMINE LIMITS
Assessing the operating limits of the machine in questionis the first step of the flow chart. The shield door project
determined that the limits of the shield door were based on
the track structure and the stroke of the hydraulic cylinder.
The door being fully opened occurs when the hydrauliccylinder is fully retracted. A leaf style limit switch isplaced 1-inch inside of the fully retracted system to allow
for an engineering limit. The other limit is full extensionof the hydraulic cylinder where the pump is placing 300 psiof fluid pressure through the lines to close the door. The
system can reach full closure and the hydraulic cylinder isstill able to provide additional stroke of 1-inch. AnotherMOP011
60Figure 3: Risk estimation flow chart.

01 Overview and Commissioning

12th Int. Beam Instrum. Conf.
ISBN: 9 7 8 - 3 - 9 5 4 5 0 - 2 3 6 - 3

The determination of the required performance level was
PLr = PLc. This allows the designer to evaluate the risk
and the components needed to mitigate that risk. In thecase of the shield door, components that will be selected tomitigate the crushing hazard must meet a minimum ratingof PLc to ensure that the component reliability meets orexceeds the risk estimation requirement.

EVALUATE RISK
Now that the hazard and PLr have been identified, it is
now possible to implement measures to reduce theexposure to the hazard in the form of protective measures.
In the case of the shield door, it is not possible to make itinherently safe which should always be a designer’s firstevaluation method. The area where the shield door closes
allows personnel access when the door is open sosafeguarding measures or engineering controls must be
implemented to reduce the likelihood of door movement
during personnel entry but also provide full operations ofthe door.

PROTECTIVE MEASURESLight Barrier
The protective measures chosen to reduce exposure tothe crushing hazard of the door during operation was a lightbarrier system. The light barrier system uses a light arrayfrom a transmitter to beam light to a receiver section.
When light becomes disrupted the safety programmable
logic controller (PLC) senses the disruption and trips thesafety relay. The PLC also has test equipment built-in tomonitor the health of the light barrier and safety relay toensure the equipment has not malfunctioned. This system
can be mounted at the opening of the shield door to protect
personnel trying to enter the vault when the door is inmotion.
Input

LogicOutput

Light Barrier

Safety PLC

Safety Relay

monitoring

Test
Equipment

Output
TestEquipment

Figure 4: Safety diagram for light barrier.
Figure 4 shows the system as designed where the lightbarrier interfaces to a safety PLC with a safety relay. The
PLC input is then programmed to latch open the output
relay when the light barrier is triggered. The safety relayis then added in series to the control relays to disable
motion of the door when latched. Latched systems also
require a reset input, not pictured, to recover the system tonormal operation if a safety event occurs. The test
capability built into the safety PLC provides real timefunctional testing of the light barrier and safety outputs toensure these systems will function correctly when needed.

This improves the performance level rating of the system
to PLc.

Status Indicators
Following the risk assessment flow chart and its iterative
process it was determined the light barrier works to provide
safety when very close to the door threshold howeveradditional risk mitigation would be an administrativecontrol to indicate to users further away that the door wasin motion. Administrative controls were added to indicate
to users the state of the door. Table 1 indicates the lights
and sounds used as administrative controls for this project.
Table 1: Indications for Administrative Controls
Light IndicatorStateGreen

Door OpenOrangeDoor Closed

Red

Safety Stop

Blink Red

Door In-Motion

Siren

Door In-Motion

Emergency Exit
The important part of iterating through the risk
assessment flow chart process is additional hazards may beidentified. An additional hazard of trapping was identified
during the assessment. The shield door could trap
personnel inside if closed, no other exits exist to the vault.
Risk estimation shows this is a PLa requirement due toslight risk of injury, seldom frequency and only possible
under very specific circumstances. This simplifies thesafety diagram where a simple exit override switch can beused interior to the vault and override the close commandwith an open command.

Emergency Stop
A similar emergency stop button was also provided forsituations where operators external to the vault wish to stop
all motion or lock out motion. This button did not meet thecriteria for a safety requirement and is considered a design
feature instead of a safety measure. However, it does
provide a single control that allows all motion to be halted
and overrides any motion commands of the control system.

PERFORMANCE LEVEL PARAMETER
Before the control system engineer dives into component
selection, it’s important to understand a manufacture’s
specification of performance level (PL). The PL must bedetermined for each safety component of the control
system and/or the combination of components that
performs a safety function. The following principal
aspects are used to establish PL according to ISO 13849-1:
1) Category (Structure) – establishes the required safetyfunction in case of a fault.
2) Diagnostic Coverage – is a measure of the effectivenessof the diagnostics to detect dangerous failures.
MOP01101 Overview and Commissioning

61

Content from this work may be used under the terms of the CC-BY-4.0 licence (© 2023). Any distribution of this work must maintain attribution to the author(s), title of the work, publisher, and DOIIBIC2023, Saskatoon, Canada
JACoW Publishing
ISSN: 2 6 7 3 - 5 3 5 0d o i : 1 0 . 1 8 4 2 9 / J A C o W - I B I C 2 0 2 3 - M O P 0 1 1

Content from this work may be used under the terms of the CC-BY-4.0 licence (© 2023). Any distribution of this work must maintain attribution to the author(s), title of the work, publisher, and DOI

12th Int. Beam Instrum. Conf.
ISBN: 9 7 8 - 3 - 9 5 4 5 0 - 2 3 6 - 3

IBIC2023, Saskatoon, Canada
JACoW Publishing
ISSN: 2 6 7 3 - 5 3 5 0
d o i : 1 0 . 1 8 4 2 9 / J A C o W - I B I C 2 0 2 3 - M O P 0 1 13) Mean Time to Dangerous Failure (MTTFd) – is theexpectation of the safety component to provide failure
free functionality.
4) Common Cause Failure – relates to the failure ofdifferent components resulting from a single event. [3]Safety component manufactures will provide the PL
ratings of their equipment, but it is the responsibility of thecontrol engineer to implement the correct risk mitigationand testing to ensure those PL ratings meet or exceed thePLr requirements of the system. The PL ratings rangealphabetically from a through e and will be called out on avendor’s datasheet as PLa – Ple. PLa would be theminimum level of safety performance and PLe would meetthe highest level of safety performance.

COMPONENT SELECTION
Once safety measures have been designed the correctcomponents must be selected to meet both the functionalsafety requirements and the performance level
requirements for reliability. Several manufacturers makesafety related equipment. The manufacturers Keyence,IDEC, Phoenix Contact and Schneider were all evaluatedfor safety related components for this project. Keyence
was chosen as the supplier for all safety related
components however the other three manufacturers wereused for components for the operator control design which
resides adjacent to the safety system. Keyence provided
the clearest guidance on safety. The manufacturer calls out
specifically the PLx ratings of their components, provided
on-site engineering support for demonstration anddiscussed their safety technology in depth.
The Keyence GLR96H was chosen for the light barrier.
This barrier has 96 beams and has a protection height of
1.9 m. The beam pitch is 20 mm which is capable ofdetecting hands, arms or legs. It uses 870 nm infrared
LEDs for the light source and supports a detection distanceof 15 m. Only 3.5 m distance is required for the door when
fully opened. The PL safety rating for this device is PLe(see Fig. 5) which exceeds the PLc requirement determined
during risk evaluation [5].

The Keyence GC-1000R is a safety PLC which also
includes built in safety relay outputs. This controller
provides the hardware control and safety logic
programming necessary to implement the light curtain
barrier, latch reset and the emergency stop switch.
Included in this safety PLC is the capability to provide test
equipment monitoring of the connected devices. Thisbrings the PL safety rating of the controller to a PLe rating
which exceeds the original PLc requirement needed tomitigate the crushing risk and the PLa requirement of thetrapping risk discovered during risk assessment.

CONCLUSION
Safety considerations for control systems require a risk
assessment to ensure that existing or new designs address
risk exposure to operators. In the case of the shield door
for the CARIE vault two hazards were identified.
Engineered safety controls and administrative controls
were implemented to reduce the risk of hazard exposure toa minimal level for operators. Los Alamos National Lab
has instituted a new focus on disciplined operations. Thisfocus reminds employees to use the safe conduct of
research principals to cultivate a questioning attitude about
safety and reminds all employees to maintain a healthy
respect for what can go wrong. These principles don’t justapply to the personnel operating devices such as the shield
door but also to the control system engineers who areproviding remote control capabilities for these devices.

REFERENCES[1] E.I. Simakov et al., “Update on the Status of C-Band
Research and Facilities at LANL”, in Proc. 5th North
American Particle Accel. Conf. (NAPAC’22), Albuquerque,
New Mexico, USA, August 2022 pp. 855-858.
doi:10.18429/JACoW-NAPAC2022-THY[2] K. Meier, “Engineering Considerations of the Advanced
Free Electron Laser Facility”, presented at the 13th
International Free-Electron Laser Conference, Santa Fe,NM, Aug 1991, paper, unpublished.
[3] Safety Support Guide Book, Keyence, Itasca, IL, USA, 2020.
[4] M. Tacchini, Functional Safety of Machinery, How to Apply
ISO13849-1 and IEC 62061, Poncarale, Brescia, Italy:Wiley, 2023.
[5] GL-RH Data Sheet, Keyence, Itasca, IL, USA Dec 2022.

Figure 5: Manufacturer’s datasheet.

MOP0116201 Overview and Commissioning