S Dwyer, S Cooper, J Kissel, TJ Shaffer

We've been thinking about how to better protect our suspensions and optics during earthquakes, and one thing that would help to keep them from banging around would be to keep top mass damping on whenever we can.  Brian Lantz is working on changes to the ISI watchdogs (see 39241), and Jeff K has proposed some changes to the sus watchdogs for this and other reasons (38948). What I am suggesting here is a relatively simple change to the suspension guardian to allow the suspensions to stay damped if a lower stage trips but not the top masses.

Currently, the suspension guardian reacts to any watchdog trip on the suspension by turning off all damping, so if any of the lower stages trips the top mass damping will be turned off.  Also, if M0 trips the reaction chain will become undamped, and the other way around. I am proposing a simple change to the guardian, shown by the graph image that is attached. 

Currently, if any watchdog trips the suspension guardian is redirected to the TRIPPED state, where a function called reset_safe turns off all the outputs to the suspension, including alignment offsets and damping, then a different function turned off the master switch.  This was probably done out of convenience, so that when the watchdog is reset by an operator, the guardian can follow the same set of steps to bring it back to its nominal state no matter which watchdog had tripped.  It is unnecessary in most cases to turn everything off like this: we could have the guardian respond to each watchdog trip differently, and turn on the controls again differently in each case. 

What I would like to do instead is have the tripped state do nothing (thanks TJ for catching the masterswitch), and rely on the watchdogs to do their job by turning off any stages which need to be turned off.  In the old graph, the tripped state was a protected state (redirect=False, red outline) which means it will not move on to another state until it returns true (which it will not do unless the watchdogs are reset).  I want the operator to be able to request that the suspension turn everything off (or the manager), which they would be able to do in the new graph by requesting reset or safe.  To make sure that the guardian will not move through its entire graph with a watchdog tripped, I've made RESET  a protected state which will not exit until the watchdog is untripped. 

With the graph, if an earthquake hits and trips some suspension watchdogs, the top mass damping will be left on unless the top mass trips.  When an operator resets the watchdogs, the suspension will turn off all outputs, and then re-damp, realign, ect.  This means that we will be better off if an EQ hits when no one is here.  The operators can do nothing until the EQ passes if only lower stages trip, if the top masses trip the operators should try to un-trip them as soon as possible.  (Jeff's changes to the SUS watchdogs will hopefully make it easier to untrip the suspensions.)