1. Status of ITER collaboration for Machine Protection I. Romera On behalf of the colleagues who contribute to the project Thanks to: Sigrid, Markus, Rüdiger, Manuel, Jonathan et all…

2. Outline  Introduction  Magnet Powering Layout  Current activities ongoing  Next milestones

3. Facts Q ≥ 10 (500 MW) 840m 3 of plasma 150M °C 23000 Tons 12.8 Billion Euros 34 nations ITER Tokamak

4. CERN-ITER agreement  Agreement nº 7 of 2007 cooperation between ITER and CERN  4 tasks:  Consultancy for the set up of a MPWG  Definition of overall architecture of Machine Protection and Central Interlock System  Specifications for the fault scenario simulations  Definition of tools for diagnostics

5. Outline  Introduction  Magnet Powering Layout  Current activities ongoing  Next steps

6. Magnet Powering Layout Toroidal Field coils  Plasma confinement  18 coils / 1 circuit  Stored energy = 41 GJ  Nominal current = 68 kA

7. Magnet Powering Layout Poloidal Field coils  Keep plasma away from walls  6 coils / 6 circuits  Stored energy = 4 GJ  Nominal current = 48 kA

8. Magnet Powering Layout Central Solenoid coils  Induce plasma current by changing current in the CS  6 coils / 5 circuits  Stored energy = 6 GJ  Nominal current = 45 kA

9. Magnet Powering Layout Corrector coils  Compensation of errors in confining magnetic field  18 coils / 9 circuits  Stored energy = 2 GJ  Nominal current = 10 kA

10. Magnet powering layout

11. Outline  Introduction  Magnet Powering Layout  Current activities ongoing  Next steps

12.  Functional specification of necessary logic in CIS for magnet powering protection  3 levels of protection:  Circuit level  Family level  Global level  Defining dependability level for each IPF  Includes fault tree representations of IPF Activities ongoing – IPF

13.  Circuit level IPF CF-QFCPA Quench in any circuit has to result in: Opening of all FDUs: o Case of the Toroidal Field Circuit at least 7oo9 o No action (no FDUs) in the case of Corrector Coils Fast Power Abort of the corresponding Power Converter Fast Discharge Request detected by PC, CIS and FDUs Inhibit Start of Powering/next plasma discharge Inform PCS to start Plasma ramp down/disruption mitigation A FDU spurious opening in any circuit (no action in case of Corrector Coil circuits) result in the same procedure as above. A CIS Fast Discharge Request has to result in the same actions as in the case of Quench. A Power Converter Fast Discharge Request has to result in the same actions as in the case of Quench Required SIL level SIL 3 equivalent. Direct hardwired loop, daisy chaining all involved user systems (quench loop)

14. Activities ongoing – IPF  Family level IPF CF-QFCPA Quench in any circuit of a family has to result in: Opening of all FDUs for the family of circuits considering: o No action (no FDUs) in the case of Corrector Coils Fast Power Abort of the Power Converters for all circuits of the corresponding family Fast Discharge Request detected by PC, CIS and FDUs Inhibit Start of Powering/next plasma discharge Inform PCS to start Plasma ramp down/disruption mitigation A FDU spurious opening in any family of circuits (no action in case of Corrector Coil circuits) result in the same procedure as above. A CIS Fast Discharge Request has to result in the same actions as in the case of Quench. A Power Converter Fast Discharge Request has to result in the same actions as in the case of Quench Required SIL level SIL 2 equivalent. ‘Configurable’ function implemented in Safety PLC and probably additional redundant HW module.

15. Activities ongoing – IPF  Global level IPF GF-CR2A less critical failure in the Cryogenics system due to a for instance an unbalanced coil cool down distribution implies: Inhibit Start for all the circuits of all families Slow Abort of the Power Converters for all circuits of all families Inform PCS to start Plasma ramp down/disruption mitigation Required SIL level SIL 2 equivalent. Hardware signal exchange with safety PLC I/O

16.  Functional specification of signal exchange between clients  Dependability requirements for different signals types  Transmission type and architecture  Electrical properties of interfaces and connections (interface box, safety PLC I/O) Activities ongoing – Hardware interfaces

18.  Fast discharges in magnet coils limited to ~50 during ITER life (real+false)  To ensure investment protection, CIS design must not only account for high level of safety, but also for high availability (to limit mechanical stress)  Studies confirmed 2oo3 architecture as the best candidate to meet dependability requirements Activities ongoing – Dependability studies Courtesy of S.Wagner Quench Loop Interface (voting fault-free) Interface with loop components (voting fault-free)

19. Activities ongoing – Dependability studies Interface with voting component Courtesy of S.Wagner Interface with redundant voting component  Series of quantitative studies performed on architecture of  Quench Loop  Interface with fault-free voting  Interface with voting component prone to failures (with and without redundancy)  Interface with voting logic

20. Activities ongoing – Dependability studies Courtesy of S.Wagner Interface with voting logic A. Apollonio  Series of quantitative studies performed on architecture of  Quench Loop  Interface with fault-free voting  Interface with voting component prone to failures (with and without redundancy)  Interface with voting logic

21. Activities ongoing – Dependability studies Courtesy of S.Wagner Availability Safety  2oo3 is the best compromise for availability and safety, but… it is only efficient if does not stop at the level of the CIS, but … Quench Loop

22. Activities ongoing – Dependability studies Courtesy of S.Wagner Interface A_B1_B2_C1_C2_C3_B0CO_ Mission completed B7 7.95E-017.40E-018.50E-016.89E-018.42E-018.54E-017.40E-018.24E-01 Emergency success B5A 1.28E-011.25E-011.32E-011.20E-011.33E-011.32E-011.24E-011.32E-01 False successB5B 7.62E-021.36E-011.68E-021.91E-012.48E-021.28E-027.68E-024.44E-02 Emergency missed B6A 4.62E-047.96E-069.16E-045.69E-061.25E-051.37E-034.09E-042.31E-05 False missedB6B 5.87E-02 Availability Safety … continued to the client system.

23.  Several proposals based on PLC S7- 400 series:  Redundant configuration: S7-400H + 2oo3  Redundant + Safety configuration: S7-400FH + 2oo3  Performance analysis on periphery based on:  Response times  MTBF figures from SIEMENS catalogue  Results shown:  F modules ~3 times slower than standard  F modules ~3 to 5 times more likely to fail than standard Activities ongoing – Interlock prototype Courtesy of M. Zaera-Sanz

24.  Provides unique interface to the Quench Loop with required dependability  Remote test facility  Simplified test and commissioning  Unique version common to all clients  Based on CIBU design Activities ongoing – Interface box Courtesy of J. Burdalo-Gil

25. Next milestones  First version of PLC program, implementing local and global IPFs  Performance measurements for realistic configuration  Functional verification of prototype  Remote diagnostics for user interfaces  Experimental setup being built in China with current leads QD

26. Next milestones

27. Thanks for your attention

28. Parameters of electrical circuits

29. Fault tree representations