Project ORION – Laser Safety By Design Paper for presentation to ILSC 2007 T H Bett, S J Melton and G White AWE PLC. Abstract Project ORION currently underway at AWE is building the largest laser system in the UK. This is a MOPA configuration Nd doped glass laser system for high energy density physics research. The laser comprises 10 beams of 30cm aperture delivering 5kJ in 1ns at 351nm to target and 2 beams of 60cm aperture utilising CPA to deliver 1PW each at 1054nm in 0.5ps pulses. The Facility comprises several designated compartments in a building around 100m long and 60m wide. The major hazards are generated through firing the laser to target. A comprehensive set of engineering controls are designed to mitigate the risks from the laser target interaction, principally, high energy x-rays, activated material from energetic particles and EMP, and, from the high voltage capacitor banks that power the flash lamps. No personnel are allowed in designated areas during a shot firing and a comprehensive set of key and access controls driven from a logic controller are employed with management controls. There is also a significant laser beam hazard during set-up operations e.g. target alignment and laser oscillator/pre-amplifier tuning. Currently PPE is envisaged as a major protection in controlled laser areas manned only by suitably qualified and experienced staff but use of further engineering controls remain under investigation. 1 Introduction Project ORION is the development of a new facility for high energy density physics (plasma physics) research at AWE in the UK. In a newly constructed 4-storey building some 100m long by 60m wide an ultra high intensity laser system will be focussed on millimetre sized miniature targets to create instantaneous experimental conditions of high temperature and pressure, and the behaviour of the target materials will be monitored using sophisticated diagnostic instruments. The experimental conditions achieved as a result of firing a high intensity laser shot provide for the creation of hot dense matter and give scientists the opportunity to study extreme states of matter which exist nowhere else on Earth. ORION will be the successor to AWE’s existing HELEN laser, which has been in service for over 20 years. Construction of the ORION building is under way and is scheduled for completion at the end of calendar year 2007 with installation of laser equipment & pre-commissioning “setting to work” planned for the period from 2008 to 2009. End to end commissioning of the laser and the demonstration of two beams on target is scheduled for completion by the end of calendar year 2010. Design of the laser systems is progressing well, design of the core safety systems is complete and consideration is being given to further safety enhancements, which are described later in this paper. AWE operates in a highly regulated environment to ensure the health, safety and environmental integrity of its staff and the public at large. The ORION Facility is therefore subject to scrutiny from the following regulatory bodies:  External Regulation – including The Health & Safety Executive, The Environment Agency, The Nuclear Installations Inspectorate  Internal Regulation – including AWE Nuclear Safety Committee (which includes independent external members), AWE Assurance Department (where Assurance covers health, safety, environmental, quality & security aspects) and AWE Design Authority Approvals This paper introduces the ORION project, describes the hazards present in using the laser system and discusses the operational safety systems embodied in the ORION Facility to mitigate those hazards. 2 Safety is a primary goal The primary goals of project ORION are: 1) To complete the work safely and deliver a safe system into ongoing operations 2) To meet the operational performance requirements Safety is the number one priority throughout the project life cycle, right from the Concept stage to eventual De-commissioning, which is currently envisaged in over 25 years time. To emphasise this commitment to safety the project has adopted the AWE Target Zero campaign which aims for an Incident & Injury Free workplace. Safety briefings, safety observations and behavioural safety culture development are central to all project activities, together with comprehensive safety performance reporting and dissemination. The project development phase extends over some 7 years from the concept phase through feasibility, design, construction, installation & commissioning and a staged safety review process is used to manage the transition from one project stage to another. At each stage gate a comprehensive safety report, which describes the hazards associated with the next stage of development and how they are to be controlled, must be presented to an independent review board drawn from outside the project and their approval gained before work can proceed. At the end of system commissioning the final safety report becomes the operational safety case for the Facility, which itself is scrutinised on a regular basis by the same independent review board throughout the operational life of the Facility. The project Concept and Feasibility Stage Gates have been completed and the Design phase is on track for completion in 2007. The ORION Building Pre-construction Safety Report, including the main laser safety systems has been approved by the AWE Nuclear Safety Committee. 3 Laser System Design ORION is an Nd glass laser comprising 10 Long-pulse (ns) Beam Lines of 300mm aperture each delivering 500J per beam at a wavelength of 351nm in a 1ns pulse, and 2 Short-pulse (sub-ps) Beam Lines of 600mm aperture each delivering up to 500J at a wavelength of 1053nm in 0.5ps pulse. The very short time in which this energy is deposited into the target corresponds to powers in the petawatt range and the very precise focussing employed will produce intensities of around 10^21 W/cm^2. Broadly speaking, the main stages in the process of taking a laser “shot” involve:  Creating the source pulses of light and distributing into the beam lines,  Providing a pulse of electrical energy to feed the laser amplifiers,  Amplifying the beam, and  Delivering and focusing the beam onto the target To enable realisation of this process, which is delivered by the ORION Shot-cycle, the laser system is constructed around an integrated hollow “box” concrete structure joined by steel reinforced concrete pillars and stabilised by piles sunk up to 30 metres into the ground, and decoupled from the surrounding walls. The “box” structure effectively forming a huge optical “table” on which the ORION laser is mounted. The general layout is as shown in the cutaway diagram at Fig.1 (See Section 10, Figures). The ORION Laser comprises five main areas: 1. Optical Pulse Generation – located on the lower surface of the “box” (i.e. Level Zero) directly below the Laser Hall. This includes the “front-end” lasers and other optical equipment used to create the optical pulses that feed into the long-pulse and short-pulse beam lines for amplification in the Laser Hall above. 2. Pulse Power System – also on Level Zero directly below the Laser Hall. The Pulse Power System includes the High Voltage Capacitor Bank Modules (CBM) that are rapidly discharged to provide the electrical power input for the amplification of the laser beams. 3. Laser Hall – located on the upper surface of the “box” (i.e. Level 1) and extending through to Level 2. The Laser Hall contains the 10 long-pulse beam lines and 2 short-pulse beam lines in which the laser pulses are amplified for delivery to the target. 4. Compressor Hall – also on Level 1 and extending through Level 2. The Compressor hall contains two Compressor Chambers (large vacuum vessels) where the sub picosecond short-pulses are recompressed, having been previously stretched prior to amplification. 5. Target Hall – extending over all four levels of the building in order to allow sufficient space for the laser beam lines and target diagnostic systems to be grouped around the Target Chamber. The Target Chamber is a 4.2m diameter aluminium sphere in which the target is positioned at its centre. The target chamber also includes final optics for focussing the beams and viewing systems for alignment of the beams onto the target. Not shown in the diagram but important in controlling the Shot-cycle and reviewing the diagnostic data obtained from experiments are the Laser Control Room and Operations Rooms on Level 2, adjacent to the main personnel access points to the Laser Hall and Target Hall. 4 Multiple Hazards Within the areas described above, the main hazards associated with operation of the Facility can be grouped as follows: a) Laser light Potentially, the most severe consequences (e.g. eye damage from laser strike) could arise from exposure to the main beams of the Target Laser System. However there are several other Class 4 lasers with differing wavelengths (including 351nm, 527nm, 532nm, 694.3nm, 1053nm & 1550nm) used throughout the system for alignment and diagnostic purposes, in addition to those at the front end of the main beam lines used to create the initial optical pulses, all of which present significant hazards. b) Pulse Power hazards The use of High Voltage (HV) pulse power systems (typically operating at 22kV) presents a potentially lethal hazard both from direct contact with the power distribution and from stored charge in the Capacitor Bank Modules. At shot-time the CBMs typically discharge some 12MJ into 400 individual flash-lamp circuits throughout the Laser Hall. The Capacitor Bank Modules also present a particular hazard arising from a potential, albeit unlikely, failure of the capacitors themselves. Arcing across a capacitor could lead to flashover and generate a pressure wave, possibly with flying fragments. Locally strong, low frequency, magnetic fields are also generated when the capacitor banks are discharged. Similar fields are also generated from the operation of Faraday Rotators in the main laser beam lines. These magnetic fields are of a strength to be potentially harmful to personnel but they decay rapidly with distance from the source. c) Laser – Target Interaction hazards The interaction of the main laser beams with the target can, depending on the shot configuration, generate a transient and very short-lived burst of ionising radiation, typically in the form of X-rays and sometimes neutrons depending on the target material being used. Any person in the Target Hall at shot time would therefore receive a radiation dose, which could be significant if they were very close to the Target Chamber. A much lower transient dose could potentially propagate through service penetrations into the Laser hall or Compressor Hall. In addition, depending on the type of shot, activation of components inside the target chamber can also occur as a result of interaction with high energy protons and neutrons, together with a potential atmospheric discharge through the chamber venting system. Another consequence of the laser-target interaction is the generation of a transient, very short-lived Electro Magnetic Pulse (EMP). The EMP could be of a strength that would be harmful to personnel and equipment in the vicinity. d) Other more general hazards There are also significant general hazards associated with the design and operation of the ORION Facility that are typically found in other sophisticated research facilities, including fire, lightning strike, solvent use and general industrial working hazards. The ORION Facility also has an area for the preparation of small toxic components used in targets and diagnostics, which presents a particular health hazard. Control measures for these hazards are well known and will not be discussed in any further detail in this paper, which concentrates on the laser light and related hazards directly arising from the use of the laser system. 5 Hazard Mitigation The hazard control measures adopted for the ORION project are derived from the sequential consideration of a hierarchical list of options represented by the mnemonic ERICPD: Eliminate – the first consideration is can the hazard be removed by designing it out of the system? If this option is not reasonably practicable, attention is given to the next option; Reduce – by designing a safer alternative that reduces the hazard to a safe level. If this option is not reasonably practicable, attention is given to the next option; Isolate - the hazard from the people. If this option is not reasonably practicable, attention is given to the next option; Control - the extent of exposure or amount of contact with the hazard. If this option is not reasonably practicable, attention is given to the next option; Personal Protective Equipment – to protect the vulnerable part(s) of the individual’s body from coming into contact with the hazard. If this option is not reasonably practicable, attention is given to the final option; Discipline – the implementation of specific operational procedures to manage the hazard & monitoring for compliance with them by management supervision. Many of the hazards described for the ORION Facility exist because they are either a fundamental physical characteristic of the technology and processes required to produce the high energy density conditions for which the Facility is being created or they are a consequence of the laser-target interaction. As such, measures to Eliminate or Reduce the risk are not reasonably practicable and attention has focussed on Isolation measures which we are implementing through a Contain and Exclude approach, the specific measures for which are described later in this paper. Engineered safety solutions have been built in to the ORION design wherever possible and these are underpinned by management controls implemented by the Facility safety organisation. 5.1 ORION Safety Organisation The ORION safety organisation is managed independently of the shot operations by the Facility Manager (FM) to ensure that appropriate focus is given to the assurance of health, safety and environmental aspects associated with operating the ORION Facility. To achieve safe working practices within the ORION Facility the FM will appoint Area Managers for each area in the Facility where experimental/research work may be conducted. Each area will have a Work Area Safety Statement (WASS), which defines the normal operations that may be carried out by competent persons in these areas. One of the key Area Managers is the Shot Director, who is responsible for the safe execution of laser shots without damage to the system or risks to personnel. Area risk assessments will also be completed, which define all known hazards within each area and list the control measures that are in place to reduce the potential risks from the hazards to As Low As Reasonably Practicable (ALARP). Competent persons in the ORION Facility are appointed by the FM, and are recorded in a Competent Persons Database which lists all those staff who are authorised to carry out Work Area tasks which are either hazardous or could result in damage to equipment in a given Area. Collectively these arrangements & documents will form the Safe System of Work (SSoW) for each area and, in totality, for the Facility. The ORION Facility will, therefore, only be operated by Suitably Qualified Experienced Persons (SQEP). At AWE, SQEP status is achieved by virtue of qualifications, training, experience and continuing professional development, all of which contributes to the creation of competence. For the ORION Facility, SQEP Records are maintained in a database which is linked to the various Access Control Systems (ACS) throughout the Facility, including those at building entry and to particular areas within the building. Work involving competent SQEP staff, which is part of normal ORION activities encompassed within the Work Area Safety Statements and covered by a Safe System of Work, will have on going authorisation from the FM; this includes agreed shot campaigns under the control of the Shot Director. Potential work outside the norm (e.g. maintenance by 3rd parties) will require approval by the Facility Work Control Centre (WCC). The WCC is responsible to the FM for de-confliction of all other tasks carried out in the Facility and to control the work on a daily basis by means of a permit to work (PTW) or work authorisation form (WAF). 6 Control Measures for Laser Light Hazards Laser light is present in the following areas of the ORION Facility:  Optical Pulse Generation Laboratories  Laser Hall  Compressor Hall  Target Hall In general, the design philosophy has been to contain the beams and exclude personnel from these areas at shot time when the main laser is fired, indeed the main laser can be regarded as a Class 1 system at shot-time. However, access to the Laser Hall, Compressor Hall & Target Hall is necessary in the pre-shot phase of operations when the alignment lasers are operating and despite the extensive measures to enclose the beams it has been impossible to totally remove the need for manual intervention for set-up & adjustment in some areas of the system. Personal Protective Equipment (PPE) in the form of laser goggles therefore becomes an important protection measure for staff working in these areas. Such areas feature interlocked access control where only SQEP staff are permitted entry by means of a swipe-pass and when they have confirmed they are wearing the appropriate PPE. Beam blocks and side shields prevent stray beams leaving optical benches. Interlocked shutters prevent beam propagation into adjacent areas and where multiple wavelengths are present these lasers are interlocked to prevent simultaneous operation so that the appropriate laser goggles with the correct level of eye protection can be worn. Consideration is also being given to techniques to ensure that the correct eye-ware is actually being worn, such as fitting RF ID tags to the sides of the goggles. If the data received by the RF tag reader does not correlate with the laser in use then access to an area will be denied by the ACS door entry system. 6.1 Optical Pulse Generators The Optical Pulse Generators (OPG) are contained in two laser laboratories (OPG1 & OPG2) both accessed through a common air-lock lobby, the inner and outer doors of which are interlocked with the laser sources to prevent any potential beam propagation through the lobby and into the access corridor outside. The OPGs themselves are constructed on open optical breadboards for ease of alignment and adjustment and are designed with integral side screens to prevent the beams from leaving the table. Laser goggles must be worn by all persons entering the OPG laboratories. Only SQEP staff may enter the area and this is administered by means of a ACS door entry system linked to the SQEP database, as described above. 6.2 Laser Hall, Compressor Hall & Target Hall The Laser Hall, Compressor Hall & Target Hall is an exclusion area at shot time and the main beams are contained in beam tubes. To ensure the areas are vacated a PA announcement will be broadcast, warnings given both visually and audibly and a physical search (described in more detail in 8.2) must be completed before the system can be energised. Interlocked doors prevent the laser from firing if re-entry to an area is attempted while the system is in the Shot-cycle and similarly if an Emergency Stop button is pressed. This is achieved by the interlocks and ES inhibiting the pulsed power system and preventing laser amplification. The opening of any interlocked door in an attempt to gain access to the Laser Hall, Compressor Hall, Target Hall or the Pulse Power Rooms themselves, or the operation of any ES button causes the HV to be disconnected, the charge in the CBMs to be dumped and shorts applied to the capacitors, which together with closure of beam shutters completely inhibits any amplification or delivery of laser light to the target. The Alignment Lasers are enclosed wherever possible and remote controlled camera viewing & optical adjustment is widely used throughout the system wherever practicable. Alignment is further automated by the ability to call up previously used system configurations from the database within the Laser Central Control System. Recalled configurations can either be used “as-is” or edited accordingly, minimising the amount of manual intervention required. However, despite all these design measures, there remains a remote possibility that the alignment beams might propagate outside the desired areas under certain set-up or maintenance conditions and the precaution of wearing PPE is therefore applied at all times. Again, only SQEP staff may enter each area through an air-lock and this is administered by means of a ACS door entry system linked to the SQEP database, and RF tagged goggles as described above will be used if found practical. A turnstile will be used to control personnel access to the Target Hall and prevents tailgating. 7 Control Measures for Non-light Hazards 7.1 Pulse Power Hazard Control To protect personnel from the High Voltage hazard, all areas associated with the Pulse Power System are also declared an exclusion zone and staff must vacate the areas before energising the HV system and during charging & discharging of the Capacitor Bank Modules. The HV system can only be energised by correct sequential operation of a mechanical trapped key system (described in more detail later). Re-entry is protected by interlocked access control and Emergency Stops are also provided. Protection of personnel against the Magnetic Field hazard is also provided by the exclusion zone which is maintained throughout the Shot-cycle. Similarly, protection against the potential Capacitor Flashover hazard is afforded by the total exclusion zone throughout the Shot-cycle and containment of any explosion is afforded by the blast proof walls & doors of the Pulse Power Room in which the CBMs are located. 7.2 Laser/Target Interaction Hazard Controls a) Ionising Radiation Personnel protection from Ionising Radiation is achieved through total exclusion from the Target Hall at shot time, supported by the search and Interlocked access control measures as previously described. The Ionising Radiation hazard is contained in the Target Hall by the design of bulk shielding in the walls of the Target Hall. The shield walls are constructed from 1.5 metre thick Concrete (reinforced Ordinary Portland Cement) which ensures that the potential dose outside the Target Hall is limited to a maximum of 0.5mSv per year which is consistent with Independent Regulatory limits. A labyrinth entrance, also with 1.5 metre walls, provides concrete shielding for the doors. The penetrations for beam lines, services and diagnostic data are all designed to maintain shield effectiveness; mechanical and electrical penetrations use stepped routes to avoid lines of sight and for beam penetrations additional shield blocks are placed in front of the wall. b) Component Activation Any components activated as a result of the laser-target interaction will be placed in sealed containers and securely stored until the activity has decayed to levels where they can be cleaned or disposed of in a conventional manner. A Best Practical Means (BPM) study has been conducted to describe how the impact on the environment has been appropriately addressed and this confirms that the gaseous discharges to the atmosphere are minor and well below allowable limits, and have been incorporated into the AWE site discharge authorisation. c) EMP Personnel protection from the EMP hazard is again afforded by the implementation of total exclusion from the Target Hall at shot time, supported by the search and Interlocked access control measures as previously described. The EMP hazard is contained by the provision of an earthed RF shield on the inside of the Target Hall which is secured to the walls, ceiling and floor. The floor shield is made from solid sheet steel and the walls and ceiling are clad with shielded modular panels clamped together. Each shield panel consists of two sheets of galvanised steel laminated to a core of high density particle board. Penetrations, e.g. doors, have specifically designed & connected panels to maintain EMP shielding effectiveness. Electrical penetrations will use filter connectors to protect equipment outside the Target hall from conducted EMP. Equipment inside the Target Hall will either use technology not susceptible to EMP or will be located (e.g. enclosed) such that it is protected from the effects. Equipment not required to be operating at shot time can be protected by switching off for the duration of the Shot-cycle. 8 Core Safety Systems The core ORION Safety Systems have been designed following an assessment, in accordance with the method developed for the nuclear industry, of the Safety Integrity Level (SIL) required to protect against the risks presented by the operation of the shot process. Where the unmitigated risks could result in serious irreversible injuries to one or more persons, or death, or temporary major harmful influence on the environment, as would be the case for the ORION laser, the safety protection systems must have a SIL2 rating and this has been used as the design requirement for the core ORION Safety Systems. As previously indicated, a mechanical trapped key system will be utilised to prevent HV connection & capacitor charging until the exclusion zones have been established and confirmed by searching. Personnel keys permitting access to high hazard areas will be trapped in a key exchange and can only be released via a sequence designed to ensure that the CBMs cannot be charged while staff are in any of the high hazard areas. In addition Programmable Logic Controller (PLC) supervised Door Interlocks and ES cause disconnection of HV and dump stored charge should anyone attempt re-entry or have cause for concern during the Shot-cycle. 8.1 Mechanical Trapped Keys A simplified diagram of the ORION trapped key system is shown in Fig. 2 (see Section 10, Figures). When the Facility is conducting Shot Operations, every person entering a high hazard area, both pre and post shot, must take a Personal Access Key from a Local Key Exchange, and keep the key with them at all times until they leave the area, when they must replace it in the Local Key Exchange. Removal of any of the Personal keys traps the Area Key, which prevents HV connection & capacitor charging and maintains that person’s safety. Permanently affixed to the Personal key is the actual key that will open the relevant door and permit physical entry to the High Hazard Area. A card Access Control System (ACS) operated turnstile provides a physical barrier before the Local Key Exchanges at the Laser Hall & Target Hall to ensure that only SQEP staff can access the key exchange and this also reduces the risk of “tailgating” to ALARP. The turnstile is connected to a database that allows individuals to be identified and granted or refused entry depending on their SQEP status and also provides a level of personnel accountancy. Until all the Personal Access Keys are returned to the Local Key Exchange the Area Key cannot be removed and returned to the Laser Control Room. All the Area Keys must be replaced in the Master Key Exchange in the Control Room and the Laser Reset before the Search Keys can be removed and the Area Searches conducted. The Search Keys must be replaced before the Master Enable Key can be removed from the Master Key Exchange and placed in the Laser Enabling Key Exchange. The three Pulse Power Enabling Keys can then be removed and taken to the local key exchanges outside the now secured Pulse Power Area, i.e. Dump Enable, Shorts Enable and HV Enable. When inserted in the local Dump Key Exchange, the Dump Enable Key allows the flow of compressed air to lift the Dump Switches from the Capacitor Bank Modules (CBMs). Similarly, when inserted in the Shorts Key Exchange, the Shorts Enable Key allows the flow of compressed air to lift the CBM Shorting Switches (crowbar switches). Insertion of the HV Enable Key in the HV Key Exchange allows operation of the Pulse Power Isolation Switches thus connecting the 22kV supply to the CBMs. The system is now initialised and ready for the Shot-cycle to be started by the Shot Director from the Laser Control Room. 8.2 Search & Lock-up As indicated above, before the shot can be taken, the Area Searches must be completed and each High Hazard Area secured. A Search is also conducted of an area in the event of a wavelength change in any of the lasers used in the pre-shot setting up phase that would necessitate staff leaving the area for a change in laser eye-ware. The Search requires use of interlocked Search Keys which are released when all the Area Keys are returned. Removal of a Search Key traps the Master Key and prevents CBM charging. Each Search Team consists of at least two persons, one of whom remains at the entrance to the Area to prevent any staff from attempting re-entry while the search is proceeding and the other to physically conduct the search. The searcher must use the Search Key to gain entry to the area and then follow a set search pattern in a pre-defined time-frame. The progress of the searcher around the Area is monitored by a PLC logic solver “counting” the actuation of strategically located Search Push-buttons and timing the intervals between actuation. When the search is complete the Search Key is returned to the Master Key Exchange in the Control Room and all the door interlocks are enabled, together with the Emergency Stops throughout high-hazard areas. Actuation of either an interlock or an ES button causes the interlock logic controller to break the HV connection and release the compressed air switches operating the charge dumps and capacitor shorting switches, thus aborting the Shot-cycle. 8.3 Post Shot Unlocking Unless aborted, the automated Shot-cycle continues by charging the CBMs and firing the laser by discharging the CBMs into the amplifier flashlamps in the beamlines. The system transitions into the post-shot mode and the high hazard areas can be unlocked and opened for access by reversing the mechanical trapped key sequence previously described. Note that it is impossible to fire the laser again until the Laser Reset has been operated and a new search completed. 8.4 Electrical Interlock System The electrical interlock system outlined above is implemented by three separate Logic Solvers (LS). The LS are realised using high reliability SIL2 Programmable Logic Controllers (PLCs) which operate independently from the Laser Central Control System that is separately used to setup, align, command the shot-cycle and gather the experimental data. Thus the safety systems are totally independent of the control software and none of the control software is deemed a “safety system”, which greatly simplifies the safety certification process. A simplified diagram of the electrical interlock system and the boundaries of the three logic solvers is shown in Fig. 3 (see Section 10, Figures). a) Logic Solver 1, Emergency Stop & Interlocks This logic solver monitors the ES contacts and the interlock contacts on the doors, area viewing windows, beam shutters and other access points to the high hazard areas. On opening of any of these contacts the logic solver sends disable signals to the HV Isolation Switches and the compressed air switches that operate the Charge Dumps & CBM Shorts, thus preventing the shot-firing process. Disables are also sent to the alignment & other systems to make them safe. Additional hardwired ES connections are also employed in a daisy-chain configuration as an ALARP measure. The interlock contacts are also used to confirm that the door or other access point has been closed, and the LS prevents enabling of the HV Isolation Switches, Charge Dumps and CBM Shorts unless this confirmation is obtained. b) Logic Solver 2, Area Search Logic Solver 2 monitors the sequence in which the Search Buttons are pressed in each of the high hazard areas, and the time taken to complete the sequence. If the search is completed properly, LS2 sends Enable Signals to the HV Isolation Switches and the compressed air switches that operate the Charge Dumps and CBM Shorts, thus allowing the Shot-cycle to continue. Until the search is properly completed (i.e. in the correct sequence & time), the HV Isolation Switches and the compressed air switches that operate the Charge Dumps and CBM Shorts remain Disabled and a laser shot cannot be taken. c) Logic Solver 3, Alarms & Annunciators This Logic Solver monitors for operation of the Laser Reset and the removal of the Search keys, and activates the appropriate warning alarms and status annunciators throughout the Facility and at the entry points to the high hazard areas. Audio and visual warnings are provided and status panels at the entry points to the high hazard areas advise whether access is permitted, permitted only to search teams or prohibited to all staff. Displays are also activated to remind staff of the appropriate PPE to be worn to ensure that laser eyeware is consistent with the wavelength of the alignment lasers operating in the area at that time. RF tagged goggles or an interactive panel will be used for staff to confirm the eyeware they are wearing before they are granted entry by the access control system. 9 Conclusions Safety by Design is demonstrably the project pre-requisite and a holistic view of all the hazards associated with the operation of the ORION laser system has been taken. By this approach the hazards and risks associated with operating the ORION Facility have been managed to ALARP using the ERICPD hierarchy of control measures, which has ensured the prioritised consideration of the following mitigation methods: 1) Can the hazard be Eliminated by designing it out of the system? 2) If not can the impact be Reduced to a safe level? 3) If not, can the hazard be Isolated from the people using the system? 4) If not can Control measures be put in place to limit the extent of exposure or amount of contact with the hazard? 5) If not, can Personal Protective Equipment be used to protect the vulnerable part(s) of the individual’s body from coming into contact with the hazard? 6) Lastly, by the implementation of Disciplined operational procedures to manage the hazard & monitor for compliance by management supervision. Where the hazard from the ORION laser cannot reasonably be eliminated or reduced by engineered methods, isolation has been achieved by containment measures and staff exclusion. Robust mechanically trapped key systems underpinned by electrical interlocks & emergency stop buttons control the firing of the laser and maintain personnel safety from the hazards associated with the main laser at all times. PPE (e.g. laser goggles to Standard EN207)) remains an important measure to protect staff against the hazards arising from equipment other than the main target laser but its use has been adopted only after other measures have been assessed not to be reasonably practicable. A particular issue arising from the use of multiple wavelengths has been addressed by interlocking certain alignment lasers with each other thus allowing the matching of the operating wavelengths with the correct PPE. These measures are supported by management controls implemented by the Facility safety organisation, which ensures that appropriate risk assessments are in place and the Facility is only be operated by Suitably Qualified Experienced Persons (SQEP). The project Staged Safety Report process, supported by rigorous review of the ORION design by specialists external to the project, and in many cases external to AWE, has ensured that ORION is progressing safely on its journey to the hottest, densest place on Earth. © British Crown Copyright 2007/MoD Published with the permission of the controller of Her Majesty’s Stationery Office. 10 Figures Fig. 1: ORION Laser System Layout of the facility showing: 1. Optical Pulse Generation 2. Pulse Power System 3. Laser Hall 4. Compressor Hall 5. Target Hall Fig. 2: ORION Trapped Key System Diagram illustrating the hierarchy and flow of keys: Local Key Exchanges, Personal Key, Area Keys, Master Key Exchange, Search Keys, Master Enable Key, Laser Enabling Key Exchange, Dump Enable, Shorts Enable, HV Enables leading to 22kV Cap Bank Modules. Fig. 3: ORION Electrical Interlocks Block diagram depicting the three SIL2 Logic Solvers: - Logic Solver 1 (Emergency Stop & Interlocks): Interfaces with Emergency Stops (ES Buttons), Access Interlock Contacts (Open/Closed), Laser Reset, and Pulse Power Isolation Switches (DP/SC/HV). - Logic Solver 2 (Area Search): Monitors Area Search Buttons, sends Enable/Disable signals to Logic Solver 1 and Pulse Power Isolation Switches. - Logic Solver 3 (Alarms & Annunciators): Interfaces with Search Key Microswitches, Search Keys, and Entry Status Panel (Area Open, Lasers Operating, Search Access Only, Entry Prohibited).