What requires four feet of concrete surrounded by two feet of steel to safeguard against things escaping, not entering? Answer: the Michigan State University Cyclotrons.
MSU''s cyclotrons are at the National Superconducting Cyclotron Laboratory (NSCL) located on its East Lansing, MI campus. Over the past 40 years, the NSCL has constructed four cyclotrons (K50, K100, K500, and K1200) and is currently building a coupled cyclotron in the facility using their K500 and K1200 cyclotrons. The K is used to rate the energy of the cyclotron''s beam. The K100, K500, and K 1200 cyclotrons use superconducting magnet technology
So what do cyclotrons do? Why are they important to us, and why must people be protected from them? A cyclotron guides the nuclei of atoms magnetically and accelerates them electrically using radio frequency into a beam that can be directed at a target. At the target, they smash into other nuclei to reveal their secrets to physicists around the world.
When nuclei smash into other nuclei, the resulting pieces of atoms and newly formed isotopes reveal the basic building blocks of matter, giving us a greater understanding of our physical world and allowing us to create isotopes of matter to be used for many different types of applications. The NSCL facility can even produce beams of radioactive isotopes.
At the same time, these collisions can produce high amounts of radiation in the form of neutrons and photons. The amount can be lethal and personnel must be protected against it. Senior Physicist Reginald Ronningen says that the Cyclotron requires a very complex system to keep personnel safe while working with it.
"Our accelerator system is set in a concrete bunker, which we call the vault, and there is a concrete door to the bunker," remarks Ronningen. "Inside the vault, the beam of nuclei is accelerated within the cyclotron and sent down along an evacuated tube. Superconducting magnets are positioned around the tube and move the beam so it can be bent into one of various other tubes and then finally sent to an experimental end-station, also located in a vault.
"The vaults enclosing the cyclotron and experimental areas exclude personnel and greatly reduce the level of radiation outside the vaults," Ronningen continues. "We are keeping personnel out because the accelerators produce radiation that could be harmful or deadly depending on the situation. Once people are outside the vault, it is closed. Then only under certain conditions can the accelerator be started. We also have a system of radiation detectors. When radiation levels get too high in occupiable areas, we can send signals to the safety processor to turn the accelerator''s power off so that it doesn''t create a hazardous environment."
He adds that safety interlocks are used throughout the cyclotron''s area. If an operator enters the main area of the cyclotron vault, he unlatches a series of gates that have safety interlocks. These gate locks act as an input for the safety system. Within the vault there are also pushbuttons with safety contacts and associated timers that start when the buttons are pushed. The area has to be closed within a specific sequence for the lockdown to progress. If only one gate is unlocked or one button is not pushed, the cyclotron won''t start. Once the operator and any other personnel leave that area, they lock different areas that proceed away from the cyclotron. When all areas within the vault are secure, the operator closes the shielding door (that also has safety switches) behind him. When the cyclotron area is clear of all personnel, all gates are locked, and the door is closed, it can start.
The problem is to coordinate all of these buttons, gates, and other safety devices such as radiation detectors together without having multiple PLCs and miles of wiring. The safety system must also have the ability to check switch contracts by sending signals to them to make sure they are functioning properly.
Relays
There are several ways to create a safety system. The easiest and least expensive is with a hard-wired relay system, for a system that isn''t very complex. "The initial cost is low, but it has a high cost of ownership if changes need to be frequently made," Ronningen says.
Many manufacturers such as Pilz Automation Safety L.P. (Farmington Hills, MI) make relays that are connected to a PLC in a fieldbus system to control safety devices. However, the technical demands on these types of safety systems are enormous because they must demonstrate fail-safe capability in accordance with established ANSI and OSHA safety standards to obtain the proper approval from the certifying body. Also relays are subject to error functions such as bouncing, contamination, burning, or contact welding, which compromise their capabilities to maintain a safe system.
Another disadvantage of using relays for a safety system is that they may require a PLC and extensive wiring when many relays are used. When more safety devices are added into the system, wiring can become extremely complicated.
The standard PLC itself can be another problem. The failure mode is not predictable. The best choice during PLC failure would be to shut the equipment down. However, in the worst case, it could open all the circuits on the safety devices, allowing the equipment to continue to run -- which is not acceptable.
Pilz makes safety relays such as their PNOZ line that are considered safe, meaning that if they fail, they are guaranteed to fail in a predefined safe condition. These safety relays meet the highest category 4 standards for safety related equipment. A PLC is also used with the Pilz safety relays to form a fieldbus system.
A safety relay (also called a safety interface module) consists of several components, including positively guided relays that are designed in a circuit to provide a redundant output. Also, a checking circuit will detect not only internal relay faults, but faults in the safeguard wiring as well. Pilz'' relays use a redundant three-channel system that detects shorts, or open or closed contacts. They also have a feedback control loop for monitoring external relays and contacts that make these relays safe.
Programmable Safety Systems
The next step with a complicated safety application is to use a programmable safety system (PSS) that uses a "PLC" designed for safety applications and having built-in redundancy and input/output modules. These systems are more costly than a relay system, but are vastly simpler systems that offer expandability and flexibility as well as a guarantee that if the PLC fails, it will shut safety devices off rather than start them.
A PSS takes over safety functions (up to Category 4 in accordance with EN 954-1) and standard functions in a control system and can even monitor all the safety devices for an entire facility with hundreds of safety devices.
The SafetyBUS p® safe bus system
Ronningen says they found the perfect system to accomplish their needs with the Pilz SafetyBUS p programmable safety system (PSS). Without this type of system he says, "It would have been a nightmare. We''d have to use several different processors to develop a safety system and they wouldn''t have the same ability as the expandable Pilz product."
Ronningen adds that they are using the Pilz 3100 SafetyBUS p PSS system with local DI, DO and DOT modules and DI-808, and DI-16 remote digital input and output modules (these are used to connect the safety devices).
Instead of having hundreds or thousands of feet of wiring to connect many relays, the SafetyBUS p is a bus system that uses just one cable to hook together all the remote input/output modules. These modules then connect directly to the safety devices (or the safety device can also hook directly to the PSS). SafetyBUS p can also be interfaced to standard fieldbus systems such as DeviceNet or ControlNet for communication with the system control, diagnostics, and data routing. Remote modules can be placed up to 11,343 ft. (3500 m) away. These stand-alone I/O modules (8 inputs/8 outputs or 16 inputs) can be used to query transducers (emergency on/off switches, protective doors or two-hand switches) or to control actuators, e.g. contacts. It is designed for Category 4 in accordance with EN 954-1 or AK6 in accordance with DIN 19250, therefore guaranteeing implementation in safety applications without restrictions. The Pilz SafetyBUS p PSS is the only system used in Europe today.
"The Pilz system works out very nicely for us because we can distribute all the safety devices with it," says Ronningen. "Outside of each vault used for experiments we plan to have a DI-16 and a DI-808 for the vault security devices and then those will be connected via the SafetyBUS p back to the main PSS processor."
To make sure the safety system is completely functional, according to Ronningen, they do quarterly tests, where simulations are done for testing the system. "We do tests and inspections of devices. This is mandated by state regulations."
Ronningen remarks that they chose Pilz because "we hadn''t seen anything else out on the market that compared to it. It was a joint decision between our electrical engineering department (the experts who really know the processors) and our safety group.
"After all, the market in this field does not have a great variety to offer. I have to point out that the costs are very competitive. If you have to use two or three standard processors, you are paying for the hardware and the time to integrate them.
"With some of our applications we have 100 or more inputs to the SafetyBUS p system. The nice thing about it is that we can always add more. Who knows what our capabilities will be five years from now? Our lab is even looking very different from what it did just last summer.
"We use the Pilz system as a stand-alone entity for safety only (the SafetyBUS p can also be used to control other aspects of an application because it is a PLC, such as all the controls on a sheet metal stamping press). When the Pilz system is satisfied to the safety of all the devices connected to it, we have outputs that are sensed by the standard PLC that runs another system. Then we ensure that the information sent is the same as that received from the safety relays, and if there is any disagreement, we start shutting down power supplies directly. We monitor the process; we don''t control it with the safety system. We do override and shut-down if things go wrong, though."
Ronningen adds, "We are a national facility for basic nuclear science research, but we have some researchers from industry and NASA. Currently, some of their research is to study the effects of cosmic rays on electronics for satellites. It is important to see how electronics react when they are bombarded by ions. Our facility has also helped calibrate detectors on board research satellites, such as the Advanced Composition Explorer."
The NSCL has also constructed a medical K100 cyclotron for use in treating cancer at the Gershenson Radiation Oncology Center at Harper Hospital in Detroit. The Harper facility is now the most active neutron therapy center in the world.