1. Alternative technologies for interlocking: HIMA Planar4
T. Hakulinen, F. Havart, P. Ninin, T. Ladzinski
PLC workshop, CERN

2. Interlock technologies at CERN
PLC
Personnel safety systems (LASS, PASS, SPS, …)
Machine protection
Relay-based
Personnel safety systems (LASS and PASS redundant chains)
FPGA or ASIC
FPGA being tested in personnel protection
Logic cards
Personnel protection (North Area primary ion interlock)

3. Planar4 by HIMA HIMA Paul Hildebrandt GmbH + Co KG
German family-owned enterprise
Only deals in safety systems (PLCs and wired logic)
Planar4 is a product line of hard-wired logic cards, which can be used to build arbitrary safety logic
All cards are designed safety-related with active monitoring of all critical functions
Most Planar4 cards are certified for use in SIL 4 systems according to IEC 61508
Used extensively in critical process safety applications (oil rigs, chemical plants, etc.) as well as people transport systems
Logic implemented on the rack-level, defective cards can be easily exchanged

4. Planar4 modules
Basic logic modules: AND, OR, NOT/block (4-8 gates per module)
I/O: line monitored connections (circuit break, short circuit)
Timing/delay modules (SIL3 instead of SIL4 due to a bit of firmware on chip)
Communications / monitoring via Profibus, Modbus, or OPC
Installation in standard 19 inch sub-racks
Note about the block modules: it’s a module, which provides both direct and inverted outputs of the input signal in such a manner that the two are guaranteed to always be different -> we only use the inverted input for a NOT function

5. Safety-related design
All Planar4 cards implement safety-related logic, i.e., minimized failure probabilities and known failsafe states
Example: AND gate
A simple comparison of a relay-based and HIMA AND-gates. Point is that safety-related design has a cost in complexity, speed, and obviously price.
HIMA Planar4 AND-gate. The internal design is based on dynamic signaling driven by a signal generator. A simultaneous failure of up to three separate components leads to the output being de-energized.
A simple relay-based AND gate

6. Programming Planar4 The programming interface is “vintage”:
Wrapping or soldering on the sub-rack backplane
Pro: robust and guaranteed against accidental modifications
Con: even small modifications hard: often have to unsolder other stuff to access the pins
Planar4 rack in the development phase when the connections were not yet soldered but attached with clips
Here there are three sets of three opto-couplers each (blue/green/black) on the right hand side (three different brands per output channel to minimize common-mode failures and to increase safety level [optos not SIL certified])

7. Programming Planar4 (2) Performance: Optimization:
Individual HIMA modules can have internal processing delays of up to tens of milliseconds (downside of that safety-related design)
Consequently, reaction time of the full logic chain can be hundreds of milliseconds
Optimization:
Implement critical logic paths using OR-gates (simple diode bridge, minimum delay)
Using De Morgan’s theorem: AND-gate = OR-gate with inputs and outputs inverted
Drawback: logic may become somewhat “unnatural” and harder to understand
If you need more complexity…
Remember: only basic gates available
More complicated logic elements (latches, flip-flops, complementary ambivalent I/O) must be constructed from the basic elements

8. Application: SPS North Area primary ion interlock
Problem:
Need to mix high-intensity proton (for LHC etc.) and low intensity primary ion cycles (for NA61 experiment) within the same SPS super-cycle to optimize SPS usage
Primary ions are extracted towards the North Area with the usual secondary beam line elements removed
Accidentally extracting a high-intensity proton beam towards the North Area would create a serious radiation hazard
Solution:
A special safety interlock to measure beam intensity and interlock extraction towards the North Area if intensity too high
Two separate safety chains: PLC (Siemens S7) and wired (HIMA logic cards) for redundancy and diversity as required by host state nuclear authorities
Pilot implementation of the wired chain with logic cards instead of relays

9. Primary ion interlock: where
SPS ring is 7km in circumference
Interlock sensors at point 5
Interlock actuators at the opposite side at point 2
Interlock logic in-between at the CERN Control Center
Cabling in the SPS tunnel (copper for HIMA, Fiber optic for PLC)

10. Primary ion interlock: equipment
Sensors: Two Beam Current Transformers (BCT) at SPS point 5
Interlock rack (PLC and wired) at CERN Control Center
Actuators: Two power converter racks and extraction magnets at point 2

11. Primary Ion interlock: HIMA sub-rack
One HIMA Planar4 sub-rack to contain all modules:
Fuse Delay Block AND OR Input Block Profibus
Point to note: the leds in the modules indicate the states of each gate – this is the same info that can be read via the Profibus interface

12. Primary Ion interlock: logic
From a simple logic in principle…
…to a much more complicated logic in practice.
Here can point out the complexity arising from the OR-based logic (for speed), ambivalent inputs from BCTs (for safety), triple-optocoupler-driven outputs to power converters (triple for safety as optos are mot SIL certified, optos drive a higher voltage/current with high switching frequency, where relays would quickly die), and implementation of the reset latches with basic gates. Also: speed is only needed in the main EIS (left side schema), hence OR-based logic. Right side schema is only error reset -> left with non-optimized AND-gates.

13. Primary ion interlock: supervision
Supervision via the Profibus communications module
Every gate of every card can be monitored
Data acquisition by a PLC, which in turn connected to CERN Technical Network
Data/event logging and a simple graphical interface via TIM

14. Return of experience
In use now since beginning of 2015 during two primary ion runs
No malfunctions detected
HIMA Planar4 pros:
Certified for use in high safety level systems (SIL 3/4)
Maintenance of the finished system is quite straightforward
Very easy to supervise and monitor
Fairly well scalable
Cons:
Rigid implementation, hard to change
Relatively slow reaction times
Large implementations become costly
For info: our implementation cost a bit over 16kCHF. A full sub-rack of modules would go for 10-20kCHF depending on the modules (OR-modules are cheapest, delay, block, AND more expensive) -> scale from there to a full vertical rack or more

15. Thank You