1. Dibyendu Roy Advait Ghate Yogesh Gaikwad Manojkumar Annigeri
Central Interlock System: A Practical Approach for ITER Magnet Protection
Dibyendu Roy
Advait Ghate
Yogesh Gaikwad
Manojkumar Annigeri
April 2015

2. Contents ITER I&C System ITER Magnet : Powering System Main Components
Central Interlock System (CIS)
Introduction
Overview
CIS Prototype :
System Architecture
System Layout
System Specifications
Discharge Loop Interface Box (DLIB)
Central Interlock Functions
Protection Actions
To be continued….

3. Content CIS Prototype : Performance Tests Start Test (STRT)
Effect in Response Time of Complex communication (ERTC)
New Hardware Test (NHW)
Complexity of Functions in Safety Matrix (CFST)
Difference of Performance in remote I/Os (DPIO)
Hot Standby Redundancy Loss Test
Communication Time Out Test
Network Time Protocol (NTP)
Time Stamp Push Protocol (TSPP)
Functionality Test
Conclusion

4. ITER I&C System
2/26/2018

5. ITER Magnet Powering System

6. ITER Magnet Powering System
Powering 18 toroidal field magnets.
Generate the field to confine charged particles in the plasma
1 TF Circuit
Powering 6 poloidal field magnets.
Provide the position equilibrium of plasma current
6 PF Circuits
Powering 6 central solenoid magnets
Provide the inductive flux to ramp up plasma current and contribute to plasma shaping
5 CS Circuits
Powering 18 correction coil magnets.
Allow correction of error field harmonics
9 CC Circuits
2/26/2018

7. Central Interlock System (CIS)

8. CIS : Overview
Main server room is backed up by mirror server room not to interrupt the operation.
CIN Network :The Central Interlock Network (CIN) provides communication between all modules, user interface boxes inside the CIS, and between PIS and CIS
The network technologies used for the implementation of CIN are based on conventional TCP/IP protocol and switched Ethernet interconnect standards.
CIN has been divided into two main sub networks: CIN-A and CIN-P.
2/26/2018

9. ITER Magnet Main Components
QDS
FDU PC
PMS
SNU

10. CIS Prototype : Introduction
Why CIS Prototype ?
To validate the technical
solutions to be implemented
Access the methodology for
the implementation
Define strategies for:
Timestamp
Display information to the operator
Define the interface with CODAC
The Central Interlock system (CIS Prototype) is composed of the following modules:
The Coil Protection Module
The Supervisor Module
2/26/2018

11. CIS Prototype : System Architecture
Coil Protection
Module
Supervisory Module
CODAC Gateway Station
CIS Desk
Engineering
Workstation
Simulator
Bypass Loop
Discharge Loop
TF FDU1
TF FDU2
TF PMS
TF PC
TF QDS
PF1 FDU
PF1 PMS
PF1 PC
Dummy Loop
CIN-P1
CIN-P2
Profibus
CIN-A
Archiving Database
Profinet
User IN/User OUT
User IN/
User OUT
2/26/2018

12. CIS Prototype : System Architecture
The CIS Prototype platform includes
CIS desk which implements the HMI.
Critical interlock logging system.
The CODAC gateway to validate the non-critical interface with CODAC and time synchronization of the CIS.
Engineering workstation for performing configuration and maintain activities.
Simulator to provide different interfaces to test the CIS Prototype functions. Simulator HMI which provides the interface to manage the simulation and supply feedback.
Two discharge loops, one includes five DLIBs and other just one and one bypass loop with two BLIBs to protect the ITER magnet. The platform also includes six dummy loops with interface boxes for validating the current loop synchronization.
2/26/2018

13. CIS Prototype System Layout
2/26/2018

14. CIS Prototype : System Specifications
The Central Interlock System Prototype (CIS Prototype) is composed of:
The Coil Protection Module : Siemens hot standby PLC (417-5H) hardware along with IO cards
The Simulator module : Siemens hot Standby PLC (414-4H) hardware along with IO cards
CODAC gateway : Interface PLC (S H) hardware
On monitoring and supervisory front, Supervisory Module, CODAC Gateway and Engineering Station servers are used to design the functional programming.
Supervisory Station
Mini-CODAC station
Engineering Server

15. CIS Prototype : Discharge Loop Interface Box
For each one of the 21 circuits, a hardwired current loop (“Discharge Loop”) is used to allow client systems to trigger and/or receive Fast Discharge Requests, through a specially engineered device (“Discharge Loop Interface Box”) used to interface the loop. Each system is connected with the current loops via DLIB. DLIB’s input connector enables to open three current loops based on 1oo2 or 2oo3 voting.

16. Discharge Loop 2oo3 Diagram
2oo3 Voting logic for opening the loop, evaluation of the USER_STAT ports

17. CIS Prototype: Central Interlock Functions
CIRCUIT_QUENCH (TF/PF/CS/CC)
FDU Activation
Non-safe FDU, PMS, SNU or BUSBAR failure (FDU_OK,PMS_OK,SNU_OK, PC_OK)
Co-ordinated Fast Discharge
Loss of cryogenic conditions (CRYO_START / CRYO_MAINTAIN)
Safe Quench Detection System failure (QDS_OK)
Power converter isolation
2/26/2018

18. CIRCUIT_QUENCH (TF/PF/CS/CC)
As a result of a resistive transition detection, the QDS interrupts the discharge loop of the quenching circuit.
The Power Converter, the PMS, the FDU and the SNU read the status of the 3 loops, perform 2oo3 voting and, depending on the result, perform the required action to safely fast discharge the Circuit.
Fast Discharge
DMS Trigger
Inhibit Next Plasma
Removal of Power Permit
CIRCUIT_QUENCH
Circuit PC Fast Discharge
PMS Activation
FDU Activation
SNU Activation
2/26/2018

19. FDU Activation
This function is performed by the Hardwired Loops called Discharge Loops
the triggered FDU will interrupt the discharge loop, so that all other FDUs in the same loop can automatically activate.
Fast Discharge
DMS Trigger
Inhibit Next Plasma
Removal of Power Permit
FDU Activation
Circuit PC Fast Discharge
PMS Activation
SNU Activation
2/26/2018

20. Non-safe FDU, PMS, SNU or BUSBAR failure (FDU_OK,PMS_OK,SNU_OK, PC_OK)
If due to internal or external failures a FDU becomes unavailable the associated circuit needs to discharged, since its protection may be compromised in case of a quench. If the affected circuit is the TF, the CIS will request an accelerated discharge to the TF power converter and inform PCS. For the other circuits the CIS will request a controlled discharge of the circuit to the PCS.
For TF
Accelerated Discharge
Removal of Power Permit
For all other circuits
Controlled Discharge
Removal of Power Permit
2/26/2018

21. Co-ordinated Fast Discharge
TF Fast Discharge
PF Fast Discharge
CS Fast Discharge
CC Fast Discharge

22. Protection Actions on Magnets
Faults prevent CODAC to start new plasma discharge
This function allows finishing the on-going plasma and interrupts the operation when it gets completed.
Inhibit Next Plasma
Power permit signals indicate that all the conditions for powering are met.
It inhibit the next plasma cycle until power permit recovered.
Converter Powering Permit
Fastest mechanism to extract energy from the superconducting circuits
Action is triggered by the interruption of discharge loop by QDS or FDU resulting into the activation of all FDU
Fast Discharge for TF/PF/CS Circuits
2/26/2018

23. Protection Actions on Magnets
Fast discharge units(FDU’s) are not required.
CC Converters ramp down the coil current to zero.
Fast Discharge for CC Circuits
It is a controlled current ramp down driven by the power converter of the TF circuit without activation of the FDUs.
Only available for TF circuits.
Accelerated Discharge
Current ramp down is driven by PCS through different power converter.
Without activation of FDU’s
Controlled Discharge
2/26/2018

24. CIS Prototype : Performance Tests
Performance tests to ensure the safe and reliable working of System.
Followings test has been conducted for CIS in two different parts:
1) With Slow Interlock Prototype:
Start Test (STRT)
Effect in Response Time of Complex communication (ERTC)
New Hardware Test (NHW)
Complexity of Functions in Safety Matrix (CFST)
Difference of Performance in remote I/Os (DPIO)
2) With Actual CIS Prototype System Architecture:
Hot Standby Redundancy Loss Test
Communication Time Out Test
Network Time Protocol (NTP)
Time Stamp Push Protocol (TSPP)
Functionality Test
2/26/2018

25. 1. Start Test (STRT)
This initial test campaign is defined to verify correct configuration and behaviour of the test platform.
STRT-001
STRT-002
STRT-003
STRT-004
STRT-005
STRT-006
STRT-007
Cyclic Interruption
300
100
Priority 16 11
PIS11 cyclic interruption
PIS11 priority
CIS 1 communication load
20%
30%
PIS 21 – solo mode X
Test Result : The communication times are driven by the slower partner in the architecture, CIS 1 in STRT test.
2/26/2018

26. 2. Effect in Response Time of Complex Communication (ERTC)
The ERTC test has been defined to obtain an image of the platform with an increasing number of partners and to evaluate how the number of communications can affect the performance of the different PLC included in the system.
ERTC-000
ERTC-001
ERTC-007
ERTC-002
ERTC-003
ERTC-004
ERTC-005
ERTC-006
Contracts 3 4 5
Comm. Instances CIS1 8 10 12 14 20 30
FSEND/FRCV PIS12b 2
FSEND/FRCV CIS2
Test Result : It has been proven that the more important parameter in the performance of central functions is the number of partners connected to the central PLC.
2/26/2018

27. 3.New Hardware Test (NHW)
To compare the performance of this new CPU with the old version, s H, already in the platform the test ERTC-003 and STRT-008 were repeated with different configurations
NHW-001: CIS1 central with CPU417-5H, ERTC-003 scenario
NWH-002: CIS2 central with CPU417-5H, ERTC-003 scenario
STRT-008: Central functions are performed both hardwire and communicated.
NWH-003: CIS2 central with CPU417-5H, STRT-008 scenario
Test Result : The efficient processor has improved the response of redundant configuration in terms of program execution , communication and response time.
2/26/2018

28. 4.Complexity of Functions in Safety Matrix (CFST)
These tests are focused on the performance evaluation of the PLC with an increasing complexity of the program and the safety matrix. .
Event
Actions
E+A
Intersections
LLRT-005 2 3 5
CFST-001 12 13 25 93
CFST-002 32 33 65
263
CFST-003 62 63
125
443
CFST-004 92
185
623
Test Result : As the complexity of the program increases the scan cycle is also going to be increase
2/26/2018

29. 5.Difference of Performance in Remote IOs (DPIO)
These tests are intended to understand the influence of an increasing number of Remote I/Os.
ET200M
DI Cards
AI Cards
DO Cards
DI ch
AI ch
DO ch
Event
Actions
Intersections
DPIO-001 2
DPIO-002 1 24 20 10 12
DPIO-003 6
DPIO-004 4 22
DPIO-005 8 48 40 38 42 44
DPIO-006 3 96 80 56 62 66
DPIO-007 16
144 18
120 74 82 88
Test Result : The addition of each remote I-O card has an effect in the CPU load. For the racks used in this test the contribution of a 2DO, 1AI and 4 DO increases the cycle time in 3 to 4 ms
2/26/2018

30. 6. Hot Standby Redundancy Loss Test
Loss of redundancy : The performance of Supervisory module at the time of redundancy loss in CPM PLC/Station due to
CPU Stop
CP cable fault
Profibus fault
Fibre optic fault
Test Result : Communication between the systems remains alive except the fault affected area/device.
2/26/2018

31. 7. Communication Timeout Test
17 communication blocks and 14 communication channels used for sending and receiving the signals.
Tests are carried out on different configurations of the communication blocks and communication channels along with the different timeouts (4000msec, 2500msec, 2250msec, 1900msec up to 60000msec)
Test Results: The maximum communication time out of the system is 2600msec with the scan cycle of 20msec.
2/26/2018

32. 8. Network Time Protocol (NTP)
Supervisory Module (Linux Machine) is used as Server for the said protocol whereas all other systems including PLCs are acting as a client for the same.
2/26/2018

33. 9. Time Stamp Push Protocol (TSPP)
For critical communication in between PLC and WinCC OA, TSPP has been used.
The exact time for the events will be time stamped and stored into buffer.
As soon as the buffer becomes empty the signals will be passed on to SCADA without any kind of delay and with the time when it was logged into buffer.
2/26/2018

34. 10. Functionality Test
Functionality / technical validation is completed as per the requirement.
Two programming methods have been implemented to analyze the performance of the system.
Safety Matrix
CFC Programming
Test Result :
If we use all the cause and events in Safety Matrix we cannot control the scan cycle below 20 ms whereas plain CFC programming improve the scan cycle which is always 20ms as expected by ITER
2/26/2018

35. Conclusion
CIS Prototype validates functional and system requirements of ITER Central Interlock System.
Magnet protection being the critical one, CPM module is configured in CIS Prototype to validate the Interlock system architecture to protect ITER magnets.
Implementation of full-fledged CIS based on CIS Prototype is already underway in South Korea.
2/26/2018

36. Reference:
Central Interlock System Strategy for ITER Magnet Protection: Machine Protection Functions (K7G8GN)
CIS_Coil_Protection_Module_v0_Engineerin_7M77LQ_v1_0
Central_Interlock_System_-_Preliminary_D_CW5PKC_v3_3
CIS_V.0_Technical_description__GLJUSM_v1_1
CIS_V.0__NTP_Configuration_PB5ZZD_v1_1
Performance_Analysis_of_the_CIS_Slow_Arc_P4WYVA_v1_0
2/26/2018

37. Thank You
2/26/2018