System Architecture of MPSVac and MPSID Critical Design Review for MPSVac and MPSID Manuel Zaera-Sanz ICS/Protection Systems Group www.europeanspallationsource.se 19-05-04

Manuel Zaera-Sanz. ICS/Protection Systems Group Table of contents Introduction Signal definition for MPSVac and MPSID Design Architecture of MPSVac and MPSID Networking Infrastructure of MPSVac and MPSID Conclusions and Further work Manuel Zaera-Sanz. ICS/Protection Systems Group

1. Introduction: BIS Architecture Manuel Zaera-Sanz. ICS/Protection Systems Group

Introduction: Scope of MPSVac Protect the equipment in the proton beam accelerator against beam damage preventing the wrong machine configuration. MPSVac will not allow beam if valves are closed upstream of beam destination Manuel Zaera-Sanz. ICS/Protection Systems Group

Introduction: Scope of MPSID Protect the equipment in the proton beam accelerator against beam damage preventing the wrong machine configuration. MPSID will not allow inserting a device upstream beam destination if the beam power is too high, or will request to stop beam if already inserted Manuel Zaera-Sanz. ICS/Protection Systems Group

2. Signal definition for MPSVac Manuel Zaera-Sanz. ICS/Protection Systems Group

Signal definition for MPSVac: Architecture Manuel Zaera-Sanz. ICS/Protection Systems Group

Signal definition for MPSID Manuel Zaera-Sanz. ICS/Protection Systems Group

Signal definition for MPSID: Architecture Manuel Zaera-Sanz. ICS/Protection Systems Group

Manuel Zaera-Sanz. ICS/Protection Systems Group 3. Design Architecture: PLC Hardware and communications for MPSVac and MPSID Two S7-1516 CPUs: Standard and Failsafe PROFIBUS between PLC CPUs (Master/Slave) as iDevices HMI TP 1200 (only monitoring) Redundant powering SITOP PSU8200 (10 A) and redundancy module SITOP PSE202U Selectivity module SITOP PSE200U Opt./Elect. Switches SCALANCE XC206-2SFP PROFINET in Failsafe PLC CPU I/O modules in ET200SP format: FDI,FDQ,FRQ,DI,DQ Anybus CompactCom as gateway with FBIS Technical network: Ethernet Copper category 6A (SFTP) Patch Panel Optical glass fibre cables (OS2, 10um) Manuel Zaera-Sanz. ICS/Protection Systems Group

Design Architecture: HW Signals exchange for MPSVac End Switches in each Vacuum Sector Gate Valve (Valve Open or Closed) dedicated to MPSVac: Number of switches: 2 per vacuum sector gate valve Parameters: sensor evaluation 1oo2, non-equivalent, short circuit test enabled, sensor supply internal (VS) Detection of short circuit within the channel pair, with other channels or other sensor supplies Detection of short circuit with M to DIn Detection of short circuit with M to VS or defective Discrepancy error detection Proton Beam Vacuum Interlock (PBVI) Beam Permit (PBVI VBP): DPDT relay governed by PBVI PLC Same parameterization of the FDI PLC module Same detection of faults achievable Manuel Zaera-Sanz. ICS/Protection Systems Group

Design Architecture: HW Signals exchange for MPSID End Switches in each Insertable Device dedicated to MPSID (ID IN or OUT): Number of switches per ID type: FCs(2), AS(1), WS(1), Slits(1), Grids(1), LBMs(1),GB(2) Same Parameterization as for end-switches for vacuum sector gate valves Same fault detection Discrepancy error detection Insertable Device Motion Control (IDMC) Beam Permit (IDMC BP): DPDT relay instead of a switch governed by MC PLC Same parameterization Same detection of faults achievable Cooling: same principle as above for IDMC BP Movement Permit: FDQ governing FRQ (coupling relay) commanding a Power relay(MC) Manuel Zaera-Sanz. ICS/Protection Systems Group

Design Architecture: HW Signals exchange for MPSVac and MPSID to FBIS Hardwired current loops for “Beam Permit” and “MPSVac/MPSID Ready”: Courtesy from Stephane Gabourin Manuel Zaera-Sanz. ICS/Protection Systems Group

Design Architecture: HW Signals exchange for MPSVac and MPSID to FBIS PROFINET signals exchange to FBIS (data link) for MPSVac and MPSID: “Beam Permit” “MPSVac/MPSID Ready” Configured Beam Mode of MPSVac/MPSID Configured Beam Destination of MPSVac/MPSID Position of IDs (OUT or not OUT) only in the case of MPSID “Alive”: bit toggling acting as a clock signal to FBIS Anybus CompactCom M40: MPSs PLC “see” FBIS as a PROFINET I/O device (32 bytes I /32 bytes O) Manuel Zaera-Sanz. ICS/Protection Systems Group

Design Architecture: HW Signals exchange for MPSVac and MPSID to FBIS Requested vs. Configured Beam Mode and Beam Destination: FBIS Equally configured? MPSVac MPSVac Configured (BM,BD) Requested (BM,BD) Beam Allowed / Beam Not Allowed MPSID MPSID Configured (BM,BD) Manuel Zaera-Sanz. ICS/Protection Systems Group

Design Architecture: SW Signals exchange for MPSVac and MPSID with EPICS and Timing MPS PLC system(MPSVac or MPSID) - Requested Beam Mode - Requested Beam Destination - Commands from Operator like “ARM” EVENT Rcv. Gateway PLC CPU FBIS IOC - Monitoring data (periodically each 500ms) and archiving in EPICS (on change). May require PLC circular buffers. - Content of PLC circular buffers archiving a “snapshot” of the MPS system (interlocks event freezes data buffer) EPICS coms MPS IOC Safety Critical PLC CPU PROFIBUS RS485 NTP server High availability cluster ICS/Infrastructure Critical SW Manuel Zaera-Sanz. ICS/Protection Systems Group

Design Architecture: MPSVac and MPSID Software Architecture Start-up process: ”Strict versioning with One single source of information for PLC + EPICS” CCDB VERSION X - Configuration data of PLC: SW=Configuration Table, HW description - Configuration data of EPICS including ALL CRCs(Configuration data of PLC) SQL script Configuration data of PLC Configuration data of EPICS PLC EPICS Version X Crosscheck (CRCs) CRC(PLC SW=Configuration Table and HW) CRCs(Configuration data of PLCs) Manuel Zaera-Sanz. ICS/Protection Systems Group

Design Architecture: MPSVac Software Architecture Software principle: ”Once the code is fully verified and validated, keep the code and make it configurable by configuration tables” “Beam Permit”: Courtesy from Enric Bargallo Manuel Zaera-Sanz. ICS/Protection Systems Group

Design Architecture: MPSVac Software Architecture State Machine for MPSVac: Manuel Zaera-Sanz. ICS/Protection Systems Group

Design Architecture: MPSID Software Architecture Software principle: ”Once the code is fully verified and validated, keep the code and make it configurable by configuration tables” “Beam Permit”: Courtesy from Enric Bargalló

Design Architecture: MPSID Software Architecture: “MOVEMENT PERMIT” Courtesy from Enric Bargalló

Design Architecture: MPSID Software Architecture: “MOVEMENT PERMIT” Courtesy from Enric Bargalló

Design Architecture: MPSID Software Architecture State Machine for MPSID: Manuel Zaera-Sanz. ICS/Protection Systems Group

4. Networking Infrastructure of MPSVac and MPSID

5. Conclusions and Further work Failsafe Real-Time architecture of MPSVac and MPSID has been presented Signals exchange and interfaces defined according to use cases and criticality Solutions for MPSVac and MPSID integrated with FBIS (SW and HW) Fixed core critical software configurable through “Configuration Tables” Critical software designed following a formal approach: State and Output Equations Strict Versioning with a single source of information for PLC and EPICS Simulations and work in the MPS Lab. indicate scan cycles on the order of 100ms Further work: Programming, Verification and Validation of the MPSVac and MPSID for NCL Extend to the rest of the LINAC according to Installation & Commissioning plans Manuel Zaera-Sanz. ICS/Protection Systems Group

THANK YOU !!! Courtesy from Dirk Nordt