Dibyendu Roy Advait Ghate Yogesh Gaikwad Manojkumar Annigeri Central Interlock System: A Practical Approach for ITER Magnet Protection Dibyendu Roy Advait Ghate Yogesh Gaikwad Manojkumar Annigeri April 2015

Contents ITER I&C System ITER Magnet : Powering System Main Components Central Interlock System (CIS) Introduction Overview CIS Prototype : System Architecture System Layout System Specifications Discharge Loop Interface Box (DLIB) Central Interlock Functions Protection Actions To be continued….

Content CIS Prototype : Performance Tests Start Test (STRT) Effect in Response Time of Complex communication (ERTC) New Hardware Test (NHW) Complexity of Functions in Safety Matrix (CFST) Difference of Performance in remote I/Os (DPIO) Hot Standby Redundancy Loss Test Communication Time Out Test Network Time Protocol (NTP) Time Stamp Push Protocol (TSPP) Functionality Test Conclusion

ITER I&C System 2/26/2018

ITER Magnet Powering System

ITER Magnet Powering System Powering 18 toroidal field magnets. Generate the field to confine charged particles in the plasma 1 TF Circuit Powering 6 poloidal field magnets. Provide the position equilibrium of plasma current 6 PF Circuits Powering 6 central solenoid magnets Provide the inductive flux to ramp up plasma current and contribute to plasma shaping 5 CS Circuits Powering 18 correction coil magnets. Allow correction of error field harmonics 9 CC Circuits 2/26/2018

Central Interlock System (CIS)

CIS : Overview Main server room is backed up by mirror server room not to interrupt the operation. CIN Network :The Central Interlock Network (CIN) provides communication between all modules, user interface boxes inside the CIS, and between PIS and CIS The network technologies used for the implementation of CIN are based on conventional TCP/IP protocol and switched Ethernet interconnect standards. CIN has been divided into two main sub networks: CIN-A and CIN-P. 2/26/2018

ITER Magnet Main Components QDS FDU PC PMS SNU

CIS Prototype : Introduction Why CIS Prototype ? To validate the technical solutions to be implemented Access the methodology for the implementation Define strategies for: Timestamp Display information to the operator Define the interface with CODAC The Central Interlock system (CIS Prototype) is composed of the following modules: The Coil Protection Module The Supervisor Module 2/26/2018

CIS Prototype : System Architecture Coil Protection Module Supervisory Module CODAC Gateway Station CIS Desk Engineering Workstation Simulator Bypass Loop Discharge Loop TF FDU1 TF FDU2 TF PMS TF PC TF QDS PF1 FDU PF1 PMS PF1 PC Dummy Loop CIN-P1 CIN-P2 Profibus CIN-A Archiving Database Profinet User IN/User OUT User IN/ User OUT 2/26/2018

CIS Prototype : System Architecture The CIS Prototype platform includes CIS desk which implements the HMI. Critical interlock logging system. The CODAC gateway to validate the non-critical interface with CODAC and time synchronization of the CIS. Engineering workstation for performing configuration and maintain activities. Simulator to provide different interfaces to test the CIS Prototype functions. Simulator HMI which provides the interface to manage the simulation and supply feedback. Two discharge loops, one includes five DLIBs and other just one and one bypass loop with two BLIBs to protect the ITER magnet. The platform also includes six dummy loops with interface boxes for validating the current loop synchronization. 2/26/2018

CIS Prototype System Layout 2/26/2018

CIS Prototype : System Specifications The Central Interlock System Prototype (CIS Prototype) is composed of: The Coil Protection Module : Siemens hot standby PLC (417-5H) hardware along with IO cards The Simulator module : Siemens hot Standby PLC (414-4H) hardware along with IO cards CODAC gateway : Interface PLC (S7-414-4H) hardware On monitoring and supervisory front, Supervisory Module, CODAC Gateway and Engineering Station servers are used to design the functional programming. Supervisory Station Mini-CODAC station Engineering Server

CIS Prototype : Discharge Loop Interface Box For each one of the 21 circuits, a hardwired current loop (“Discharge Loop”) is used to allow client systems to trigger and/or receive Fast Discharge Requests, through a specially engineered device (“Discharge Loop Interface Box”) used to interface the loop. Each system is connected with the current loops via DLIB. DLIB’s input connector enables to open three current loops based on 1oo2 or 2oo3 voting.

Discharge Loop 2oo3 Diagram 2oo3 Voting logic for opening the loop, evaluation of the USER_STAT ports

CIS Prototype: Central Interlock Functions CIRCUIT_QUENCH (TF/PF/CS/CC) FDU Activation Non-safe FDU, PMS, SNU or BUSBAR failure (FDU_OK,PMS_OK,SNU_OK, PC_OK) Co-ordinated Fast Discharge Loss of cryogenic conditions (CRYO_START / CRYO_MAINTAIN) Safe Quench Detection System failure (QDS_OK) Power converter isolation 2/26/2018

CIRCUIT_QUENCH (TF/PF/CS/CC) As a result of a resistive transition detection, the QDS interrupts the discharge loop of the quenching circuit. The Power Converter, the PMS, the FDU and the SNU read the status of the 3 loops, perform 2oo3 voting and, depending on the result, perform the required action to safely fast discharge the Circuit. Fast Discharge DMS Trigger Inhibit Next Plasma Removal of Power Permit CIRCUIT_QUENCH Circuit PC Fast Discharge PMS Activation FDU Activation SNU Activation 2/26/2018

FDU Activation This function is performed by the Hardwired Loops called Discharge Loops the triggered FDU will interrupt the discharge loop, so that all other FDUs in the same loop can automatically activate. Fast Discharge DMS Trigger Inhibit Next Plasma Removal of Power Permit FDU Activation Circuit PC Fast Discharge PMS Activation SNU Activation 2/26/2018

Non-safe FDU, PMS, SNU or BUSBAR failure (FDU_OK,PMS_OK,SNU_OK, PC_OK) If due to internal or external failures a FDU becomes unavailable the associated circuit needs to discharged, since its protection may be compromised in case of a quench. If the affected circuit is the TF, the CIS will request an accelerated discharge to the TF power converter and inform PCS. For the other circuits the CIS will request a controlled discharge of the circuit to the PCS. For TF Accelerated Discharge Removal of Power Permit For all other circuits Controlled Discharge Removal of Power Permit 2/26/2018

Co-ordinated Fast Discharge TF Fast Discharge PF Fast Discharge CS Fast Discharge CC Fast Discharge

Protection Actions on Magnets Faults prevent CODAC to start new plasma discharge This function allows finishing the on-going plasma and interrupts the operation when it gets completed. Inhibit Next Plasma Power permit signals indicate that all the conditions for powering are met. It inhibit the next plasma cycle until power permit recovered. Converter Powering Permit Fastest mechanism to extract energy from the superconducting circuits Action is triggered by the interruption of discharge loop by QDS or FDU resulting into the activation of all FDU Fast Discharge for TF/PF/CS Circuits 2/26/2018

Protection Actions on Magnets Fast discharge units(FDU’s) are not required. CC Converters ramp down the coil current to zero. Fast Discharge for CC Circuits It is a controlled current ramp down driven by the power converter of the TF circuit without activation of the FDUs. Only available for TF circuits. Accelerated Discharge Current ramp down is driven by PCS through different power converter. Without activation of FDU’s Controlled Discharge 2/26/2018

CIS Prototype : Performance Tests Performance tests to ensure the safe and reliable working of System. Followings test has been conducted for CIS in two different parts: 1) With Slow Interlock Prototype: Start Test (STRT) Effect in Response Time of Complex communication (ERTC) New Hardware Test (NHW) Complexity of Functions in Safety Matrix (CFST) Difference of Performance in remote I/Os (DPIO) 2) With Actual CIS Prototype System Architecture: Hot Standby Redundancy Loss Test Communication Time Out Test Network Time Protocol (NTP) Time Stamp Push Protocol (TSPP) Functionality Test 2/26/2018

1. Start Test (STRT) This initial test campaign is defined to verify correct configuration and behaviour of the test platform.   STRT-001 STRT-002 STRT-003 STRT-004 STRT-005 STRT-006 STRT-007 Cyclic Interruption 300 100 Priority 16 11 PIS11 cyclic interruption PIS11 priority CIS 1 communication load 20% 30% PIS 21 – solo mode X Test Result : The communication times are driven by the slower partner in the architecture, CIS 1 in STRT test. 2/26/2018

2. Effect in Response Time of Complex Communication (ERTC) The ERTC test has been defined to obtain an image of the platform with an increasing number of partners and to evaluate how the number of communications can affect the performance of the different PLC included in the system. ERTC-000 ERTC-001 ERTC-007 ERTC-002 ERTC-003 ERTC-004 ERTC-005 ERTC-006 Contracts 3 4 5 Comm. Instances CIS1 8 10 12 14 20 30 FSEND/FRCV PIS12b 2 FSEND/FRCV CIS2 Test Result : It has been proven that the more important parameter in the performance of central functions is the number of partners connected to the central PLC. 2/26/2018

3.New Hardware Test (NHW) To compare the performance of this new CPU with the old version, s7 414-4H, already in the platform the test ERTC-003 and STRT-008 were repeated with different configurations NHW-001: CIS1 central with CPU417-5H, ERTC-003 scenario NWH-002: CIS2 central with CPU417-5H, ERTC-003 scenario STRT-008: Central functions are performed both hardwire and communicated. NWH-003: CIS2 central with CPU417-5H, STRT-008 scenario Test Result : The efficient processor has improved the response of redundant configuration in terms of program execution , communication and response time. 2/26/2018

4.Complexity of Functions in Safety Matrix (CFST) These tests are focused on the performance evaluation of the PLC with an increasing complexity of the program and the safety matrix. .   Event Actions E+A Intersections LLRT-005 2 3 5 CFST-001 12 13 25 93 CFST-002 32 33 65 263 CFST-003 62 63 125 443 CFST-004 92 185 623 Test Result : As the complexity of the program increases the scan cycle is also going to be increase 2/26/2018

5.Difference of Performance in Remote IOs (DPIO) These tests are intended to understand the influence of an increasing number of Remote I/Os. ET200M DI Cards AI Cards DO Cards DI ch AI ch DO ch Event Actions Intersections DPIO-001 2 DPIO-002 1 24 20 10 12 DPIO-003 6 DPIO-004 4 22 DPIO-005 8 48 40 38 42 44 DPIO-006 3 96 80 56 62 66 DPIO-007 16 144 18 120 74 82 88 Test Result : The addition of each remote I-O card has an effect in the CPU load. For the racks used in this test the contribution of a 2DO, 1AI and 4 DO increases the cycle time in 3 to 4 ms 2/26/2018

6. Hot Standby Redundancy Loss Test Loss of redundancy : The performance of Supervisory module at the time of redundancy loss in CPM PLC/Station due to CPU Stop CP cable fault Profibus fault Fibre optic fault Test Result : Communication between the systems remains alive except the fault affected area/device. 2/26/2018

7. Communication Timeout Test 17 communication blocks and 14 communication channels used for sending and receiving the signals. Tests are carried out on different configurations of the communication blocks and communication channels along with the different timeouts (4000msec, 2500msec, 2250msec, 1900msec up to 60000msec) Test Results: The maximum communication time out of the system is 2600msec with the scan cycle of 20msec. 2/26/2018

8. Network Time Protocol (NTP) Supervisory Module (Linux Machine) is used as Server for the said protocol whereas all other systems including PLCs are acting as a client for the same. 2/26/2018

9. Time Stamp Push Protocol (TSPP) For critical communication in between PLC and WinCC OA, TSPP has been used. The exact time for the events will be time stamped and stored into buffer. As soon as the buffer becomes empty the signals will be passed on to SCADA without any kind of delay and with the time when it was logged into buffer. 2/26/2018

10. Functionality Test Functionality / technical validation is completed as per the requirement. Two programming methods have been implemented to analyze the performance of the system. Safety Matrix CFC Programming Test Result : If we use all the cause and events in Safety Matrix we cannot control the scan cycle below 20 ms whereas plain CFC programming improve the scan cycle which is always 20ms as expected by ITER 2/26/2018

Conclusion CIS Prototype validates functional and system requirements of ITER Central Interlock System. Magnet protection being the critical one, CPM module is configured in CIS Prototype to validate the Interlock system architecture to protect ITER magnets. Implementation of full-fledged CIS based on CIS Prototype is already underway in South Korea. 2/26/2018

Reference: Central Interlock System Strategy for ITER Magnet Protection: Machine Protection Functions (K7G8GN) CIS_Coil_Protection_Module_v0_Engineerin_7M77LQ_v1_0 Central_Interlock_System_-_Preliminary_D_CW5PKC_v3_3 CIS_V.0_Technical_description__GLJUSM_v1_1 CIS_V.0__NTP_Configuration_PB5ZZD_v1_1 Performance_Analysis_of_the_CIS_Slow_Arc_P4WYVA_v1_0 2/26/2018

Thank You 2/26/2018