PLC based Interlock Workshop CIS Team February 2016 ITER Central Interlock System Fast Interlock Controller

CERN ITER PLC based interlock workshop February 2016 Requirements 2 Some central interlock functions require a response time which cannot be implemented by the chosen PLC architecture. Central interlock functions requiring faster than 300 ms response time mainly involve heating (EC H&CD, IC H&CD, NB H&CD), fuelling (DMS) and PCS. Requirements for fast architecture: No SIL certification is required, but the studies and developments shall be supported with a formal analysis, as described per IEC and the Interlock Control System Quality Specific Plan [ITER_D_BGSZW9]  Cope with availability (99.9%) and reliability (99,6% over two 8-h shifts) by implementing some redundant solution  Integrity level up to 3IL-3 (PFH < )  Fail-safe solution (deterministic state in case of internal error)  Response time between 100µs and 300ms  Integrate commercial off-the-shelf solutions Hardwired and Ethernet communications The Fast Interlock system will be integrated in the ICS and will communicate via hardwired links with other slow or fast interlock controllers, as well as with the Plasma Control System (PCS).

CERN ITER PLC based interlock workshop February 2016 Fast interlock functions 3

CERN ITER PLC based interlock workshop February 2016 PIS Controllers 4 Siemens S7-400-FH NI Compact RIO IntegrityPerformanceAvailabilityTechnical SolutionConfiguration Up to 3IL-3> 100msStandardSiemens S7-400-FStandard PIS Up to 3IL-3> 100msHigh AvailabilitySiemens S7-400-FHFully Fault-Tolerance Up to 3IL-3< 100msStandardNI Compact RioDouble Decker Single CPU Fully Fault-Tolerance CPU + 2 CP Red CPU + CP Double Decker If the mitigation of the event requires an active coordination of the actions.

CERN ITER PLC based interlock workshop February 2016 Fast PIS Hardware Architecture 5 Generic fast PIS controller solution: 2oo3 Double-Decker System The 2oo3 Double Decker architecture showed the best overall performance in terms of availability and reliability. The voter is implemented in the FPGA; hence it does not require en external voter unit and thus enables capabilities that can provide a higher level of safety. The two chassis allow for a diagnostic strategy that will increase the SFF. Also, this solution can be adapted as a F-CIS module solution. Compact Rio Modules for Fast Interlock Controllers

CERN ITER PLC based interlock workshop February 2016 Fast PIS – Features 6 Conf.PFHSIL consump. (IEC 61508) SFF3ILResponse Time (min / MAX) A1.324 E-813.2% of SIL %3*41 / 89 µs B1.322 E-813.2% of SIL %3*143 / 643 µs C1.597 E-816% of SIL %3*5 / 20 µs Note: the requirement for SIL-3 according to IEC is SFF>90%, There is no SIL-3 COTS with a response time below 1 ms Generic fast PIS controller solution: -Hardware configuration according to IEC Reliability and integrity figures available -PFH calculation tool available for integrity -Software preconfigured and tested Configuration A: 3 Analog Inputs – 2 Digital Outputs 24V Configuration B: 3 Digital Inputs 24V – 2 Digital Outputs 24V Configuration C: 3 Digital Inputs TTL – 2 Digital Outputs TTL Additional configuration can be defined and tested if requested -Integration with the central system -Critical signal: FPGA to FPGA, using Manchester coding via fiber optic -Non critical communication with CIS and CODAC via a PC HOST – OPC UA

CERN ITER PLC based interlock workshop February 2016 Fast PIS – Hardware Architecture 7

CERN ITER PLC based interlock workshop February 2016 Prototypes 8

CERN ITER PLC based interlock workshop February 2016 PLC PIS – Software Architecture 9

CERN ITER PLC based interlock workshop February 2016 Fast PIS – Software Architecture 10

CERN ITER PLC based interlock workshop February 2016 Fast PIS – FPGA core application 11

CERN ITER PLC based interlock workshop February 2016 Fast PIS – Labview Code 12 odac/dev/units/m-cis-pisfc

CERN ITER PLC based interlock workshop February 2016 Fast PIS – PC Host 13 The interlock critical data of the F-PIS or F-CIS module will be transmitted via hardwire links. The interlock non-critical data (diagnostics) and the communication with both interlock desk and engineering workstation would be done using ethernet CIN-P connected to an attached Fast Controller Server. The server will be also used to send all the field data to CODAC (e.g. via PON) The time synchronization for the fast controller will used the TCN FMEDA Analysis for the 2oo3SD Double Decker Diagnostic and Improvement of the Safe Failure Fraction Figures (SFF) (N62LS6) Reference Documentation:

CERN ITER PLC based interlock workshop February 2016 Fast-PIS Development Cycle 14 Several development tools are involved into the development of fast CIS runtime Application: LabVIEW for FPGA is used to develop and compile the FPGA code The OPC UA driver and the DMA FIFO for the data exchange between the FPGA and Win CC OA are configured under Linux environment with the necessary tools. Win CC OA is used to implement the archiving and monitoring of the CIS Fast controller from CIS Desk

CERN ITER PLC based interlock workshop February 2016 Fast ICS architecture 15

ITER – Interlocks Fast CIS – Fast PIS Supervisor Module WinCC OA Server Engineering Server CNP CIN-P1 Host PC CIN-P2 CIS PPM-1 CIS PPM-2 F-PIC-1 F-PIC-2 PON TCN MXIe SPI MC

CERN ITER PLC based interlock workshop February 2016 CCPS architecture 17 HOST Red Hat linux CODAC compliant Connected to CODAC and to CIS

CERN ITER PLC based interlock workshop February 2016 Fast interlock for SC circuits 18

CERN ITER PLC based interlock workshop February 2016 Conclusions and Outlook 19  The project launched in January 2013 has so far produced a PIS controller design over the base of the National Instrument’s cRIO with the required capabilities: Availability (99.9%) and reliability (99,6%) Integrity level up to 3IL-3 (PFH < 10-7) Fail-safe solution (deterministic state in case of internal error) Response time of 100µs  First real applications: Fast interlock for the superconducting coil power supplies (FAT of the Correction Coils Master Controller in December 2015 and for the poloidal field coils, central solenoid and toroidal field coils power converters during 2016) CIS v1

CERN ITER PLC based interlock workshop February Thank