1. Combining safety and conventional interfaces for interlock PLCs
Ignacio Prieto Diaz
Riccardo Pedica
PLC Based Interlock systems Workshop
1-2 February 2016 CERN
The ITER procurement strategy mixes systems delivered in-fund and in-kind.
This complicates considerably the integration of the whole interlock system.
The interlocks design and integration strategy is based on guidelines and template codes developed by the central team for ease the work of the plant system developers and mitigating future integration risks.
This talk presents
the tools developed by the ITER central team for ensuring the integrability of a robust ITER machine protection system
Riccardo pedica

2. the way to new energy…

3. Energy
Hydrogen
Neutron
Helium

4. 4

5. RF CN European Union KO JP IN US *
The ITER Domestic Agencies are responsible for implementing the procurement activities under each Member’s responsibility

6. ITER

7. ITER Interlock Control System
Central I&C System
Plant System I&C
CODAC
Plant Control System
Central Interlock System
Plant Interlock System
Central Safety Systems
Plant Safety System

8. The CIS
Tomorrow
#19
#100 #8

9. ICS – Complex architecture

10. Interlock PLC Software Architecture
PROGRAMMING STRUCTURE
Safety program
Conventional program
SCADA INTERFACES
Epics
WinCC OA
COMMUNICATION PROTOCOL
SIEMENS S7
SIEMENS TSPP
Fail Safe communication
HARDWARE INTERFACES
Digital I/O
Analog AI
HEALTH MONITORING SYSTEM
Critical HLM
Conventional HLM
PROTECTION FUNCTION
Local protection function
Central protection function

11. Integration
YOU ARE HERE

12. Integration tool PIS configuration and integration
DESIGN
DEVELOP
TEST
INTEGRATION
Integration tool
PIS configuration and integration
PLC software template
Control logic diagram tool
Mini-CIS

13. Guidelines for PIS Configuration and Integration
It guides the plant system developer to the configuration of the Plant Interlock Slow Controller giving rules for
Hardware naming convention
Block naming and numbering convention
Variables Naming convention
Implementation of
Safety program
Core application
Standard Program
Implementation of the Safety program
Version control
Development process

14. PLC Software template
It provides the basic structure of a Plant System PLC Code
General Structure of the program
Communication interfaces
TSPP S7
Failsafe
Command execution
3 Steps Overrides verification
Hardware interfaces
Health monitoring system
Critical
Non critical
Runtime group organization
F_ PROG
Standard
Safety

15. CLD – Control Logic Diagram tool
Common platform for I&C Design Management
Developed by the Central Safety System, extended to ITER I&C
Database
Functions
Controllers
Variables
Logic Drawing Tool
Report utility
V&V

16. CLD – Control Logic Diagram tool
Plant Breakdown Structure
Central Functions
Sub functions
EVENT / CENTRAL / ACTION
Central Interlock System
Supervisor Module (SCADA server)
Controllers
Logic Drawing tool
Variables
Plant Interlock Systems
Local Functions / Sub functions
Sensors and Actuators
Reports
Interface Data Sheets
Controller Data sheet
Custom reports

17. mini-CIS
The mini-CIS is an industrial computer, where the hardware and the software components are designed to perform the main functionality of the CIS and permit the FAT/SAT of Interlock Plant System.
Subsequent to the use of the mini-CIS, the integration of the corresponding PIS into the real CIS should be immediate and free from errors.
WinAC RTX
NI PCIe FPGA card
WinCC OA

18. And more… Interfaces data sheet
The functional interface data between the PLC and other plant Systems are documented and managed through the IDS (Interface Data Sheet)
There are five categories of functional interfaces in the plant interlock controllers
Critical automatic data
CIS supervision on PIS
Critical manual data
Archiving interface
Maintenance interface.
Automatic generated Electrical diagram
SEE Electrical expert.
An electrical tool used by ITER exchanges information with PLC programming software in order to automatically generate and update Input/Output card layouts

19. Conclusions
The ITER Interlock System will most likely be the first machine protection system built with most of its components provided in-kind from up to 36 different countries
A strong effort is being put in place to ensure that all actors around the globe design, build and configure the parts of the puzzle to be properly integrated with the central system
While a detailed design of the Central Interlock System has been already performed, a strategy has been put in place to continuously monitor the progressive growth the overall interlock system.

20. Thank you...
@ITERinterlocks

21. STANDARD vs SAFETY
Which parts of the user program need to be fail-safe (Safety)?
Hardware F I/O Interface
Critical Health Monitoring System
Threshold Values
Voting
Events
Actions
Resets
Overrides (Masking/Forcing/Disabling)
Safety Related Communications (PLC-PLC Communication)
Which parts of the user program need to be standard (non-safety)?
Conventional Health Monitoring (System diagnosis)
Interface with CODAC (States/Commands/Events)
Interface with Supervisory Module (States/Commands/Events)
Interface with other PLCs on standard channels (i.e. S7/Modbus/TCP IP etc)
Calculations of formulas (if any)