Combining safety and conventional interfaces for interlock PLCs Ignacio Prieto Diaz Riccardo Pedica PLC Based Interlock systems Workshop 1-2 February 2016 CERN The ITER procurement strategy mixes systems delivered in-fund and in-kind. This complicates considerably the integration of the whole interlock system. The interlocks design and integration strategy is based on guidelines and template codes developed by the central team for ease the work of the plant system developers and mitigating future integration risks. This talk presents the tools developed by the ITER central team for ensuring the integrability of a robust ITER machine protection system Riccardo pedica

the way to new energy…

Energy Hydrogen Neutron Helium

4

RF CN European Union KO JP IN US * The ITER Domestic Agencies are responsible for implementing the procurement activities under each Member’s responsibility

ITER

ITER Interlock Control System Central I&C System Plant System I&C CODAC Plant Control System Central Interlock System Plant Interlock System Central Safety Systems Plant Safety System

The CIS Tomorrow #19 #100 #8

ICS – Complex architecture

Interlock PLC Software Architecture PROGRAMMING STRUCTURE Safety program Conventional program SCADA INTERFACES Epics WinCC OA COMMUNICATION PROTOCOL SIEMENS S7 SIEMENS TSPP Fail Safe communication HARDWARE INTERFACES Digital I/O Analog AI HEALTH MONITORING SYSTEM Critical HLM Conventional HLM PROTECTION FUNCTION Local protection function Central protection function

Integration YOU ARE HERE

Integration tool PIS configuration and integration DESIGN DEVELOP TEST INTEGRATION Integration tool PIS configuration and integration PLC software template Control logic diagram tool Mini-CIS

Guidelines for PIS Configuration and Integration It guides the plant system developer to the configuration of the Plant Interlock Slow Controller giving rules for Hardware naming convention Block naming and numbering convention Variables Naming convention Implementation of Safety program Core application Standard Program Implementation of the Safety program Version control Development process

PLC Software template It provides the basic structure of a Plant System PLC Code General Structure of the program Communication interfaces TSPP S7 Failsafe Command execution 3 Steps Overrides verification Hardware interfaces Health monitoring system Critical Non critical Runtime group organization F_ PROG Standard Safety

CLD – Control Logic Diagram tool Common platform for I&C Design Management Developed by the Central Safety System, extended to ITER I&C Database Functions Controllers Variables Logic Drawing Tool Report utility V&V

CLD – Control Logic Diagram tool Plant Breakdown Structure Central Functions Sub functions EVENT / CENTRAL / ACTION Central Interlock System Supervisor Module (SCADA server) Controllers Logic Drawing tool Variables Plant Interlock Systems Local Functions / Sub functions Sensors and Actuators Reports Interface Data Sheets Controller Data sheet Custom reports

mini-CIS The mini-CIS is an industrial computer, where the hardware and the software components are designed to perform the main functionality of the CIS and permit the FAT/SAT of Interlock Plant System. Subsequent to the use of the mini-CIS, the integration of the corresponding PIS into the real CIS should be immediate and free from errors. WinAC RTX NI PCIe FPGA card WinCC OA

And more… Interfaces data sheet The functional interface data between the PLC and other plant Systems are documented and managed through the IDS (Interface Data Sheet) There are five categories of functional interfaces in the plant interlock controllers Critical automatic data CIS supervision on PIS Critical manual data Archiving interface Maintenance interface. Automatic generated Electrical diagram SEE Electrical expert. An electrical tool used by ITER exchanges information with PLC programming software in order to automatically generate and update Input/Output card layouts

Conclusions The ITER Interlock System will most likely be the first machine protection system built with most of its components provided in-kind from up to 36 different countries A strong effort is being put in place to ensure that all actors around the globe design, build and configure the parts of the puzzle to be properly integrated with the central system While a detailed design of the Central Interlock System has been already performed, a strategy has been put in place to continuously monitor the progressive growth the overall interlock system.

Thank you... @ITERinterlocks

STANDARD vs SAFETY Which parts of the user program need to be fail-safe (Safety)? Hardware F I/O Interface Critical Health Monitoring System Threshold Values Voting Events Actions Resets Overrides (Masking/Forcing/Disabling) Safety Related Communications (PLC-PLC Communication) Which parts of the user program need to be standard (non-safety)? Conventional Health Monitoring (System diagnosis) Interface with CODAC (States/Commands/Events) Interface with Supervisory Module (States/Commands/Events) Interface with other PLCs on standard channels (i.e. S7/Modbus/TCP IP etc) Calculations of formulas (if any)