Machine Interlocks in the Injectors MPE-TMB. Puccio & al.25 th Aug. 2011 1v0

Machine Interlocks in the InjectorsMPE-TMB. Puccio & al. 25th Aug. 2011

1v0

B.P. “MI for Injectors” MPE-TM meeting of 25 August 2011

Injectors chain / CERN Accelerators Complex

2

LINAC 4LINAC 2

LHC Injectors chain (protons)

ions chain

HiRadMat


What are the “Machine Interlocks”?

3

Beam Interlock System(VME based)

for protecting Normal Conducting Magnets

for protecting the Equipments

for Beam Operation

BIS

Fast Magnet Current change Monitor

FMCM

Powering Interlock Controllers

(PLC based)

+

PIC

Warm magnet

Interlock

Controllers

(PLC based)

WIC+

Safe Machine Parameters

System

(VME based)

SMP

or Super Conducting Magnets

Warm Magnets Interlock (WIC system)

1v0 4

Pierre Dahlen


WIC system Overview

5

based on Safety PLC collect input signals from:

- thermo-switches,

- flow meters,

- red buttons, …

give Power Permit for the corresponding converter

Magnet 1

Power Converter

Magnet 2

PC Status

Thermoswitches Water FlowRed button…

Several thermo-switches @ 60°C

Power Permit

PVSS Operator ConsoleEthernet

PLC + I/OsBeam Permit

BIS interface

WIC solution = PLC crate + remote I/O crates

Profibus-Safe link

remote I/Os

Configuration DB


WIC systems currently in Operation

6

WIC

WIC

LHC (2007)

TT60 (in 2005)

TT66 & Ti2(

4 c.

TT40 & Ti8 (2004)

2 c.

WIC TT41

1 c.

WIC LEIR (2005)

1 c.

17 Controllers & ~ 310 I/O modules

6 machines/zones

~ 1000 magnets are protected

(2009)

1 c.

WIC

8 controllers

LINAC3 WIC


WIC system: the main features

7

Based of Safety PLC (Siemens S7-300 F series)

(on purpose) Very simple process for PLC software

Sensors/Magnets/Converters partition described in Configuration DB

Reliable solution

Remote test facility

Generic solution to be deployed on any type/size of machine

Dedicated PVSS application to allow supervision of:

Magnets & Power Converters Status

Interlock process (history buffer)

Communication state (Ethernet & Profibus)

Strong support from EN/ICE

Developed & maintained by EN/ICE

BE/CO


PVSS application: few screen-shots…

8

SPS Transfer Lines

LINAC 3 + LEIR

Courtesy of F. Bernard

(EN/ICE)


PVSS application: monitoring views…

9

Magnets status

P.C. status


(EN/ICE)


PVSS application: History Buffer

10


(EN/ICE)


WIC system: future deployments

11

Machine

Number of

Installation date

Protected Magnets

PLCcrate

Remote I/O crates

Booster 172 4 53during 2011

& Xmas shutdown’11/12

+ during LS1Linac4 &Transfer line 98 2 6 2013

Isolde 50 1 1 2013/2014

Elena ring 48 1 1 ~2015 (1st beam in 2016)

should match corresponding

schedules

(not part of Injectors chain)


planneddeployments

LHC chain status after planned deployments

12

TT41 (CNGS)

Linac4TT40 & Ti8 lines

TT60 & Ti2 lines

TT66 (HiRadMat)

currently in operation

WIC system

LINAC4

PSB

Linac3 LEIR

PS SPS LHCLinac4 PSB

=> +70% Qty of both Controllers & protected Magnets

6 more machines/zones


other WIC deployments…?

13

MachineProtected Magnets

PLCcrate

Remote I/O crates

PS main ~100 1 11

PS Auxiliary ~50 2 1

SPS ring +auxiliaries ~900 ~9 ~15

According to preliminary study

(project not fully decided on)

Staffing: Pierre + “X” + FSU member+ closed collaboration EN/ICE group


● Using a fieldbus can reduce significantly the cost of the project

=> A study is going to be launched to find the most appropriate solution (maintainability, radiation tolerance,...)

Note: this solution could be also used for PS deployment

modified version for SPS?

14

● Current solution uses copper cables for linking the sensors to the safety PLC

● Due to sextant length (~1.1.km), estimated cables cost could reach 500kCHF...

Beam Interlock System

1v0 15

BenjaminTodd & Christophe Martin

B.P. “MI for Injectors” MPE-TM meeting of 25 August 2011 16

Beam Interlock System Function

16

BIS

User ‘Permit’ Signals

Dumping system orExtraction Kicker or

Beam Stopper orBeam source….

Targetsystem

Beam ‘Permit’ Signals

Σ(User Permit = “TRUE” ) => Beam Operation is allowed

IF one User Permit = “FALSE” => Beam Operation is stopped

BIS only protects equipments => not involved in personal safety. Note: LHC Access system is connected to the BIS but as LBDS redundant trigger channel


Design Basis

17

Safe: (Safety Integrity Level 3 was used as a guideline).

Must react with a probability of unsafe failure of less than 10-7 per hour and,Beam abort less than 1% of LHC missions due to internal failure (2 to 4 failures per year).

Reliable: (whole design studied using Military and Failure Modes Handbooks)

Results from the LHC analysis are: P (false beam dump) per hour = 9.1 x 10-4

P (missed beam dump) per hour = 3.3 x 10-9

Fail Safe: Must go to fail safe state whatever the failure

Available:

• Redundant Power Supply (for LHC BIS) & UPS for Controller crate

• Redundant Power Supply for Remote User Interface


Simplified layout

18

User Interfaces

UserPermits

#1

#14

#2

(installed in User’s rack)

Beam Interlock Controller

(VME chassis)

copper cables

User System #1

User System #2

User System #14

frontrear

FESA class

copper cablesor

fiber optics links

Remote User Interfaces safely transmit Permit signals

from connected systems to Controller

Controller acts as a concentrator,

• collecting User Systems Permits (14 HW + 1SW)

• generating local Beam Permit

JAVA Application

Configuration DB0

Software Interlock

inputTechnical Network

Optical

outputs

(local )

Beam Permit

Cupper links


Main features (1/3)

19

Critical process in Hardware: ♦ functionality into 2 redundant matrices♦ VHDL code written by different engineers following same specification.

Critical / Non-Critical separation: ♦ Critical functionality always separated from non-critical.

♦ Monitoring elements fully independent of the two redundant safety channels.

Manager board

FPGA chip(Monitoring part)

CPLD chip(Matrix A)

CPLD chip(Matrix B)

Used CPLD: 288 macro-cells & 6’400 equivalent gates

Used FPGA: 30’000 macro-cells & 1 million gates + all the built in RAM ,etc.

FPGA: Field Programmable Gate ArrayCPLD: Complex Programmable Logic Device


Main features (2/3)

“Flexible” :• Half of User Permit signals could be remotely masked • Masking conditioned by external signal (Setup_Beam Flag)

20

Maintainable: with 100% Online Test Coverage Can be easily tested from end-to-end in a safe manner => recovered “good as new”

Fast: ~20μS reaction time from User Permit change detection

to the corresponding Local Beam Permit change.


Main features (3 /3)

Modular and Scalable Ring architecture or Tree architecture possible Daisy chain possible (BIC output connected to input of another BIC)

Tree Architecture

Ring Architecture

● Generic solution Protect as much as small installation as large machine Based on BE/CO standard solutions (HW & SW)

• VME chassis• FESA Class• JAVA GUIs• Logging, Post-Mortem, Databases,….


Daisy chained example

22

LHC ring Beam-2 Permit

Injection Beam-2 Permit

Extraction Beam-2 Permit


Master Controller variant (different type of Matrix)

23

Master BIC

(AND + OR function)

Standard BIC (ring architecture)

& “slave” BIC” (tree architecture)

(AND function)

&

12

14

&1…14

1…14

&

… OR


BIS Application: Extraction cycles view

Courtesy of

J.Wenninger


BIS Application: Timing Diagram

Courtesy of

J.Wenninger


Monitoring & analysis

tim

e


Operational Tests

configuration verification and integrity check

fault diagnosis

and

monitoring

Pre-Operation checks (launched by Beam Sequencer)

During Operation (DiaMon application)

response analysis

Post-Operation checks (included in PM )

In order to ensure that its safety is not compromised, the verification of the BIS is carried out in three stages


What about the cost?

User Interface

redundant P.S.

F.O. variant of the User Interface

Optical daughter

cards

Manager board Test & Mon. board

Crate + Power Supply + CPU + Timing card receiver

backplane board

VME system: ~15 kCHF

(-30% for new Linux version)

User Interface units :

~1,2 kCHF each

Set of boards composing a pair of Controllers:

~ 8 kCHF

Total cost with 2 opposed examples:

• 3Mev Test Stand => less than 50 kCH (1 Crate, 2xBIC, 10xCIBU, short cables & no fibres)

• LHC ring => probably more than 1.1 MCH (17 Crates with redundant P.S, 34xBIC, ~150xCIBU, >40km cupper cables & hundreds km of f.o.)


BIS currently in Operation

29

58 Controllers

6 machines/zones

~ 380 connected systems

TT60/Ti2/TT66[7 c.]

BIS

TT40/Ti8/TT41[7 c.]

BIS

BIS

[2 c.]

LHC Inj.2 region

SPS ring (since

2005)[6 c.]

BISBIS

[2 c.]

LHC Inj.1 region

LHC ring ( (since

2007) [34 controllers]

BIS


BIS: Future deployments

30

Machine

Number of

Installation date

User Interface

Controller

3 MeV Test Stand 7 1 Autumn ‘11

Linac4 &Transfer line 23 3 2013

Booster ring& ejection 24 2

2017 (more than likely)

+ support from Ben &

from SW Engineer

Linac4

LTB

PS Booster

Linac2

LT

Staffing: Christophe +

FSU members


Engineering Specifications

31


BIS Linac4 & PSB layout

32

Not yet

defined

PS BIC

Ejection Kicker

EJECTIONMaster

BIC DestinationTelegrams

AQN magnet currents

PSB RF

RF c

ontr

ol

Source RFMaster

BIC

Low E. part systems

L4 syst.

ChoppersMaster

BIC

L4 & LTBIC

PSB (2)BIC

PSB (1)BIC

TL systems

PSB syst

PSB systemsDestinationTelegrams

Chop

per

Pre-

chop

per

Disable Timing signal


Truth table example: “Choppers” BIC

33

“Choppers” BIC

FESA class

Sw Interlock

PSB

FESA class L4 & TL

FESA class

/ 5

Timing Receiver card(s)

BIS User Interfaces

(1 per Destination)

PS

FESA class

Vacuum valves (L4 & TL)

Beam-Stopper OUT

Vacuum valves (LBS) Vacuum valves (LBE)

/ 3

In Name State1 SIS 1 1 1 1 12 Destination LBE 1 0 0 0 03 Destination LBS 0 1 0 0 04 Destination PSB 0 0 1 0 05 Destination PS 0 0 0 1 06 Destination L4DUMP 0 0 0 0 17 L4 and L4 T-Lines OK 1 1 1 1 18 PSB OK X X 1 1 X9 PS OK X X X 1 X

10 L4T+LT+LTB Vacuum V. 1 1 1 1 X11 LBS.VVS10 X 1 X X X12 LBE.VVS10 1 X X X X13 L4T Beamstopper Out 1 1 1 1 X

Output

Linac4 Transfer OK 1 1 1 1 1

Permit for beam transfer to 5 destinations:

Linac4 dump, LBE, LBS, PSB and PS


planneddeployments

LHC chain status after planned deployments

34

TT41 (CNGS)

Linac4TT40 & Ti8 lines

TT60 & Ti2 lines

TT66 (HiRadMat)

currently in operation

Beam Interlock System

LINAC4

PSB

Linac3 LEIR

PS SPS LHCLinac4 PSB


summing-up on BIS solution

35

Maintainable, Fast…

Modular & Scalableo Can be daisy chainedo Latched or Dynamic Modeo CIBU solution => interface with any type of electronics

Maximize Beam Operation efficiencyo A Timing card can be used as a “User_System” (like the LHC inject & dump case)o An Operator switch can be used as a “User_System”

Maintain operational flexibilityo Software Interlock Inputso External Condition signals used as User_Permits

+


Let’s open the Pandora box…

36

Regarding the Injectors requirements, is BIS oversized (performance wise) … ?

is it too costly...?

Well, in fact there is currently no another Hw choice:

Design, build, test and install a new Interlock system will cost a lot of resources… Deploy a “light” version of the BIS will lead to a flawed solution. Saved money won’t balance the drawback of a hybrid solution.

Adapt WIC system to BIS requirements will imply new resources as well. The cost ratio “Safety PLC based system” / “VME based system” is probably at ~60/70%


Wrap-up

37

is the BIS solution oversized for the Injectors?…

Next deployments: Linac4 (2013) , Booster (2017)

No decision yet for PS, Linac3 and LEIR

My personal point of view:

Having a generic solution is the most effective answer for MI section, Machines Operation and for CERN

The WIC solution is appropriate for the Injectors

Next deployments: Booster (2012), Linac4 (2013),

Decision not fully taken for PS (2017?) and for SPS (201x?)

Study launched for using safe & reliable Fieldbus for a large installations

Limited staffing (rely on EN/ICE collaboration)

B.P. “MI for Injectors” MPE-TM meeting of 25 August [email protected] 38

CERN

Fin

Thank you for your attention

mailto:[email protected]

Documents

Machine Interlocks in the Injectors MPE-TMB. Puccio & al.25 th Aug. 2011 1v0