Rebuilding the Safety Net: Detector Safety System v2 Gets Ready for LS3

A years-long collaboration between BE-ICS and the four big LHC experiments modernises the system that watches over ALICE, ATLAS, CMS and LHCb

BE-ICS Detector Safety System team (BE-ICS)

For more than two decades, the Detectors Safety System (DSS) has quietly stood guard over ALICE, ATLAS, CMS and LHCb, watching for fire, gas leaks, cooling failures and other hazards, and triggering protective actions on its own, independently of every other control system, whenever something goes wrong. It is one of those systems nobody notices when it works – and everybody depends on. Today, as CERN enters Long Shutdown 3 (LS3), the DSS is undergoing its most significant overhaul since it was first deployed: DSSv2.

Why an upgrade was needed

The original DSS software grew, feature by feature, into one of the largest and most customised CERN applications running on WinCC OA, the industrial control software used across CERN’s accelerator and experiment controls. Two decades of successive additions had made it powerful, but also hard to maintain, hard to debug, and a single point of failure for the safety of four major experiments. On the hardware side, the clock was also ticking: Siemens, the manufacturer of the programmable logic controllers (PLCs) at the heart of DSS, announced it will discontinue the S7-400 series – the model used since the system’s inception – by 2027.

Standardisation meets innovation

Rather than starting from a blank page, the DSS team, part of the BE-ICS group, chose to build on DSSv1’s proven concepts and code, re-engineering the parts that had become hardest to maintain – in close dialogue with ALICE, ATLAS, CMS and LHCb, and with engineering support from EP-DT, CERN’s cross-experiment detector technologies group. Requirements were collected over several years through the DSS Advisory Board, refined together with the experiments’ safety experts, and tracked openly so that every stakeholder could follow progress and weigh in.

The result leans heavily on the JCOP framework – developed and maintained by BE-ICS, that ALICE, ATLAS, CMS and LHCb already use to build their own detector control systems – replacing custom, homegrown pieces with standard, well-supported components wherever possible. The communication between the PLCs and the control software now relies on the Time Stamp Push Protocol (TSPP), a mechanism already proven over 20 years of use in CERN’s accelerator sector, in which the PLC pushes only the data that changes, rather than being constantly polled. This single change alone removed close to ten thousand lines of custom code and, with it, a subtle timing issue that could occasionally leave the control room with an incomplete picture of the PLC’s state. The custom alarm screen has been replaced by JCOP’s Next Generation Alarm Screen, and data archiving now relies on standard mechanisms – local configuration moved to SQLite, while process data uses the Oracle-based archiving.

On the hardware side, the ageing PLCs are being replaced with Siemens’ S7-410H model, chosen for its compatibility with the existing logic and its guaranteed availability throughout the system’s lifetime, while the servers are moving from Windows to Linux, in line with the infrastructure already used by the experiments. The system’s capacity has also grown substantially: DSSv1 had a limit on the number of sensors, alarms and actions it could handle, which meant CMS, for example, had to run two separate DSS applications side by side. DSSv2’s larger capacity now lets CMS merge both into a single system. Every change has been validated in a laboratory managed by the BE-ICS controls group, using real PLC hardware, a Siemens signal simulation unit, and an automated test suite built specifically to exercise the new, larger safety matrix.

What’s next

LS3 offers a rare opportunity: with the accelerator and detectors already paused for major consolidation work, the DSS team can retire two decades of legacy hardware and code without ever compromising safety coverage. The first production version of the new backend was released at the end of July 2026, and deployment has already begun in ATLAS, with LHCb following in September. CMS and ALICE will receive their upgraded systems through 2027, each on a timeline agreed together with their own shutdown planning. DSSv2 will already be watching over each experiment’s installation as it is progressively upgraded during LS3, and will keep doing so, simpler and more standard than before, once the LHC restarts and on through the High-Luminosity LHC era.

“DSSv2 is the result of a genuine partnership between BE-ICS and the experiments. Every requirement, every design choice, was shaped together with the people who rely on this system to keep their detectors safe.” – Alexandros Foivos Kostopoulos, DSS project leader

This kind of modernisation rarely happens in isolation. It relies on the same close, ongoing collaboration between BE-ICS and the experiments that has always underpinned the accelerator and detector controls at CERN. It is a reminder of how much of that shared infrastructure – from the JCOP framework to WinCC OA itself, validated, packaged and supported for all of CERN by BE-ICS’s WinCC OA Service – exists precisely to make projects like DSSv2 possible.