NSTX Centerstack Upgrade: initial discussions of the Machine Protection System (MPS) Robert Woolley 4 November 2009

Plan for this MPS discussion What is the Machine Protection System (MPS) Why is the MPS needed for the NSTX CSU What are the essential MPS features What are other important MPS features What design options apply to the MPS What needs to happen to provide the MPS

Background: Coil Power Supplies Now Implement Machine Protection Computer commands to power supplies can: 1.Adjust firing angles, modifying their output voltages 2.Suppress bridge & fire bypass, so output voltages→0 Note that coil currents are only indirectly controlled, by adjusting loop voltages applied to coil circuits. – Current feedback control is achieved via computer software Machine protection is now implemented via (2). – Existing “level 1 fault” relay circuit commands (2), thus driving coil power supply voltages to zero. – Once commanded, the “level 1 fault” condition remains in effect until its relay circuit is manually reset. New Machine Protection System will also use (2).

Why is Machine Protection important? Coil currents are a hazard for NSTX equipment – Can cause excessive forces and thus stresses Especially for selected combinations of currents – Can cause excessive temperatures Especially if pulse timing is inconsistent with cooling Or if steady continuous currents are employed There can also be different time-dependent current limitations for different equipment in the same electrical circuit “Intelligence” needed to recognize developing emergencies and command a “level 1 fault” – Analogous to circuit breakers for single currents – Different: realtime varying estimates of quantities

MPS Purpose The Machine Protection System (MPS) purpose is to avoid NSTX misoperations likely to cause significant equipment damage. – Proposed: the MPS mission should NOT include limiting secondary damage after a major fault – MPS Purpose does not include employee safety. – MPS Purpose does not include public safety. – MPS Purpose does not include radiological issues. – Purpose is entirely to reduce risks to the NSTX program’s budget, schedule, and continuation. – In deciding on MPS technical scope, it is proper to weigh MPS cost against MPS risk reduction.

Misoperations Can Have Many Causes Feedback Control Servo System Response Equipment not entirely operational – E.G., faulty maintenance Wrong computer control file choices or edits Improper timing or operating mode setup Miscommunications between people Administrative controls failure Human Judgment Mistakes

MPS focus: coil current misoperations Power supplies will drive currents in the TF coil circuit, in 12 PF coil circuits, and in the OH coil circuit. They also will initiate and control the plasma current, shape and position. Lorenz forces from some current combinations can cause excessive stress in coils or structure. Extended pulses without sufficient cooling time can cause excessive coil temperature. MPS will abort shot via power supply trips if needed to avoid stress or temperature damage. Thus, MPS must automatically recognize coil current hazards.

Why is an MPS needed now ? Before the CS upgrade, machine protection was provided by power supply trips baseds on maximum allowable currents in each coil circuit. For any combination of currents within these maximum current limits, forces and stresses in the as-designed structural system were OK. With the CS upgrade’s higher operating current levels it is not possible to avoid overstressing equipment using power supply trips on individual currents. Power supply trips must be implemented based on multivariate functions of all currents.

MPS Force/Stress Algorithms Each Lorenz force is mathematically a weighted sum of products between pairs of currents (i.e., a generalized quadratic) Force combinations follow the same pattern but with different weighting coefficients With linear elasticity, coil stress components also follow the same pattern, varying as generalized quadratic functions of currents. Quadratic functions of current signals are easy to implement in a real-time processor Numerical values of coefficients can be easily extracted from a series of ANSYS runs.

Essential MPS Real-Time Functions Real-time functions are natural for an analog computer, but digital computer can operate in fast loop (>100/sec OK for NSTX currents) MPS must continually monitor currents, also coolant variables, e.g., temperature,& flow. MPS must continually calculate forces or stresses that must be limited. MPS must continually update its thermal heating/cooling models. MPS must immediately command coil power supplies to trip whenever any of its calculated quantities exceeds its allowable threshold.

Essential MPS Functions (2) Real-time repetitive loop calculations of the MPS must reliably continue without possibility of halting. In particular, it must be impossible to command the MPS to stop operating during active NSTX operations. It must be impossible to change the MPS’ real- time operating algorithms, including its trip threshold values, without formal approval of the NSTX project.

Important Other MPS Functions Each input quantitiy monitored by the MPS should be provided from two redundant sources as redundant signals, and they should be cross-checked within the MPS. After tripping coil power supplies, the MPS should provide troubleshooting information as to why it commanded the trip to occur. The MPS should also incorporate some self- check features and trip the coil power supplies if an internal MPS failure is detected.

Issue: What Levels of Redundancy Should the MPS Have? OPTIONS: Option 1: Implement the MPS as software only operating within the controls computer. Option 2: Implement the MPS as a separate stand-alone hardware box in addition to software within the controls computer. Option 3: Implement the MPS as two redundant separate stand-alone hardware boxes in addition to software within the controls computer.

Issue: What Levels of Redundancy Should the MPS Have? (My Opinion) MPS should be physically separate from NSTX control computer – Avoids single failure mode – Avoids configuration control issues Doubly redundant MPS is not necessary – Although 2 CPCs were used on TFTR All current sensors should be duplicated. – Avoids single failure mode if sensor used for both control and protection

What must happen to implement MPS Project selects MPS redundancy option. Complete design analyses of NSTX systems. Select and agree on real-time protection algorithms which enforce assumptions in NSTX design analyses. Implement electronic instrumentation and associated real-time software. Note: There is no reason to delay choosing the MPS redundancy configuration, but the other steps are paced by design progress.