Machine Protection System (MPS) Sheng Peng

Transcription

1 Machine Protection System (MPS) Sheng Peng

2 Development Life Cycle Physics Requirement Document is the starting point System Requirement Specification Design Document Gate reviews Implementation and Test Requirement tracing verification and validation Goal Fully meet the requirement Within budget and on time Efficient solution, no over-engineering General Policy How to reduce project risk and cost Using COTS (Commercial Off-The-Shelf) Using Industrial standard Using Proven technology Sharing design cross multiple subsystems within FRIB»Timing»MPS»Fast feedback Accelerator and Experiment share the solution S. Peng, July 13th, 2011, Controls Review, Slide 2

3 Scope MPS consists of two parts: Fast Protection System (FPS):» Fast system (response time within ~10µs)» Monitor critical signal which requires stopping beam as soon as possible» Interface to timing master (HW&SW) Indicate both MPS/Timing are healthy Get timing info such as timestamp/clock/machine mode/beam mode Report MPS status (ok to operate, or turn off beam)» Machine/beam mode and timestamp awareness Run Permit System (RPS):» Slow System (~> 100ms)» To establish permission to run» Keep monitoring during running and withdraw permission if things go wrong» Machine/beam mode and timestamp aware Personal Protection System is NOT in the scope It provides an OK signal to FPS Non-beam related equipment protection is not in the scope S. Peng, July 13th, 2011, Controls Review, Slide 3

4 Scope MPS/FPS Sensors/detectors and Cables to MPS nodes Mitigation device and Cables from MPS master/nodes S. Peng, July 13th, 2011, Controls Review, Slide 4

5 Physics Requirement (FPS) The maximum MPS response time for Linac segment 2 is 35 µs. This section of the machine requires the fastest response time. The maximum response time for Linac segments 1 and 3, folding segments, Beam delivery System (BDS) is 45 µs. For other systems the response can be greater than 50 µs but should be the shortest time available with reasonable cost for the MPS. RF cavity, magnet, BLM, and BCM should be treated as critical devices for MPS. S. Peng, July 13th, 2011, Controls Review, Slide 5

6 System Specification Response time: FPS shall have response time less than 10µs (assuming detector latency 15µs and mitigation latency 10µs) Scalability and Flexibility Binary interface for input/output (ON/NOK)» Number of inputs in total: Tradeoff between detail reason of trip and number of inputs» Design goal is 64 inputs per node in 2 x 32 or 4 x 16 combination, at least 32 inputs per node» Design goal is 8 outputs per node» I/O type shall be configurable (TTL, ), I/O card shall be detachable» Software-configurable latched/auto-reset input» A 1U (up to 2U) rack mounted chassis Support both local and global decision Timing integration Be aware of global timing information and machine/beam mode» Redistribute timing info on MPS fiber network, no separate timing interface needed for MPS nodes The first fault identification capability Offline analysis with timestamp (resolution 100ns) Fail-safe (include mitigation method) EMI proof S. Peng, July 13th, 2011, Controls Review, Slide 6

7 System Specification (Cont d) Software integration for control room operation MPS FPS master shall be fully manageable thru EPICS Ideally MPS nodes shall be manageable directly via Ethernet, otherwise at least thru MPS master RPS integration Seamless integration with central control system, RDB, HLA High availability DFx Usability, Reliability, Serviceability, Maintainability Redundant in communication path (optional) Field Physical Access Control Quality Management and Development Process Control Document Control and Change Control Board (CCB) Risk-Based Approach V-Model or similar Verification & Validation S. Peng, July 13th, 2011, Controls Review, Slide 7

8 LLRF: ~345 LLRF controllers Each should have two MPS inputs (one latched, one autoreset) Latency is ~2µs Diagnostics 161 BLM 14 BCM (could be reduced down to 8 or 5) Latency 15µs Others Critical System FPS Input S. Peng, July 13th, 2011, Controls Review, Slide 8

9 FPS Scale The deployment plan should consider channel occupancy efficiency and future growth SNS has about 1100 inputs» Planned upgrade provides 1920 capability (~57% channel occupant rate) Multi-zone solution will help in many aspects Clean separation Less nodes per zone leads to less technical challenge Better scalability Need to identify the reasonable maximum number of zones to be supported The design shall be able to support 4000 ~ 5000 inputs in total ~500 each zone Physical distribution 52 Cryo modules One or two MPS node(s) in the RF/Diag rack to provide at least 64 inputs capability per module S. Peng, July 13th, 2011, Controls Review, Slide 9

10 Two Topologies under consideration Tree structure (like timing distribution) Pros» Flexibility» Same as timing» Software configuration for multi-zones Cons» Aggregation delay» Need smart fanout/concentrator» Hard to detect dead node unless polling/cyclic operation Ring Pros» Support commissioning of each zone of the machine» Reduce the size of the chain to reduce overall latency» Easy to detect dead node, but bypassing a module is needed sometime Cons» Different from timing S. Peng, July 13th, 2011, Controls Review, Slide 10

11 Low Level Link Layer Xilinx FPGA RocketIO implementation MRF timing physical layer (MRF/SLAC/BNL: 20*Carrier Clock RocketIO, Tree topology) White Rabbit (CERN, tree topology) NSLS II BPM physical layer (6.25Gbps RocketIO, Ring topology) Hardware for MPS node and Timing receiver could be very similar S. Peng, July 13th, 2011, Controls Review, Slide 11

12 Tree structure Limit to two levels of fanout/concentrator to reduce latency (up to 64 nodes, not a hard limit) Data aggregation is still a bit challenging Is 10us doable? How to avoid packets collision? How to detect failed node? Tree topology S. Peng, July 13th, 2011, Controls Review, Slide 12

13 Tree topology Courtesy of Cosylab S. Peng, July 13th, 2011, Controls Review, Slide 13

14 Fiber length counts here Assuming following dimensions of FRIB accelerator building Length approx. 150m Width approx. 30m.. and considering Tree topology Signal path: node -> master -> node Worse distance between node and master: 180m 150m + 30m (depends on cable path) then the maximum cable length between detection and mitigation is approx. 360m This is the worst case (2 x 180m) Can be halved with a well considered placement of MPS devices and optimal cable paths So ~2µs propagation delay 150m 30m Courtesy of Cosylab P. Chu, Controls Infrastructure, 28 Jun 2011, Slide 14

15 MPS response time is a sum of Latency estimate Time for node to transmit fault event» < 1µs Time for master to receive fault event and to transmit mitigation request»< 2µs Time for node to receive mitigation request and trigger mitigation device»< 1µs Time for signal propagation» Time for MPS switches to forward fault event/mitigation request» Optical links between MPS devices» < 4µs MPS response time can be below 8µs Including 2µs for signal propagation delay Performance measured on MPS prototype Cosylab s MPS master Cosylab s MPS node MRF Fanout/Concentrator as MPS switch Measured numbers much smaller, but increased with estimated impact of 64 inputs per MPS node 4000 inputs in total Two levels of MPS switches More complex logic on MPS master Courtesy of Cosylab P. Chu, Controls Infrastructure, 28 Jun 2011, Slide 15

16 MPS zones Other aspects Software configurable Any number of inputs per zone May coincidence with network topology e.g. one MPS switch per zone (8 x 64 = 512 inputs) Support for commissioning per zone Dead node detection Each node constantly transmit alive message Dead node is detected in a few tens of nanoseconds No packet collisions Each MPS switch port has its own event queue to avoid collisions QoS - events are forwarded by priority Courtesy of Cosylab P. Chu, Controls Infrastructure, 28 Jun 2011, Slide 16

17 Dual ring topology NSLS II FOFB solution Master and Nodes could be quite similar Master must have multiple ports» But same core can be still shared for link layer No concentrator/fanout needed, streaming data High speed link (6.25Gbps at NSLS II) Low latency Capable to deliver data rather than just heartbeat or carrier signal Courtesy of NSLS II S. Peng, July 13th, 2011, Controls Review, Slide 17

18 Development approach Share development effort with other projects FPGA core Possibly same link layer as timing Same hardware (PC board) as timing Re-usable industrial standard S. Peng, July 13th, 2011, Controls Review, Slide 18

19 PLC/softIOC based solution Set up and verify the machine operating mode Verify that all the relevant equipment is operating and within the desired setpoint ranges for the selected machine mode Verify the equipment masks in the MPS hardware for each machine mode Verify the beam parameters requested are within tolerance for the machine mode Schedule user defined beam parameters Provide an operator interface Run Permit System (RPS) Make sure beam/machine mode is consistent in all related parties Form one summarized input to FPS to turn off beam if needed S. Peng, July 13th, 2011, Controls Review, Slide 19

20 GTS RPS Concentrator MASTER Concentrator Concentrator EndNode1 EndNode2 EndNode64 GTS RPS MASTER SFP SFP... SFP End Node End Node FPS Topology End Node End Node End Node End Node Tree topology Easy to implement Almost same delay for all end nodes Need MHz reference clock which is higher than system clock Poor message capacity Hard to extend VS Multi-Circle topology 80.5MHz Reference clock which is as same as system clock Easy to extend Rich message capacity Different delay for different end node Need a big master S. Peng, Controls and Computing Department Manager, Slide 20

21 Facility for Rare Isotope Beams FRIB-P20100-SP R001 Page 1 of 8 FRIB Beam and Machine Modes Issued 17 February 2012 FRIB Beam and Machine Modes Prepared by FRIB-P20100-SP R001 Issued 17 February 2012 Approved by 2/22/2012 2/22/2012 X Daniela Leitner Commissioning Department Manager Signed by: leitnerd Approved by 2/22/2012 X Jie Wei Accelerator Systems Division Director Signed by: Jie Wei Concurred 2/22/2012 X Georg Bollen Experimental Systems Division Director Signed by: bollen Concurred 2/28/2012 X Yoshishige Yamazaki Yoshishige Yamazaki Accelerator Systems Division Deputy Director Signed by: Yamazaki, Yoshishige Concurred 2/22/2012 X Eduard Pozdeyev Front End & Transport Area Department Mana... Signed by: pozdeyev Concurred 2/22/2012 X Felix Marti Charge Stripper Area Group Leader Signed by: marti Concurred 2/22/2012 X Marc Hausmann Fragment Separator Group Leader Signed by: Marc Hausmann Concurred X Sheng Peng Controls & Computing Department Manager Signed by: pengs Facility for Rare Isotope Beams U.S. Department of Energy Office of Science Michigan State University East Lansing, MI Ph: (517) Fax: (517)

22 Facility for Rare Isotope Beams FRIB-P20100-SP R001 Page 2 of 8 FRIB Beam and Machine Modes Issued 17 February 2012 X Robert Webber Diagnostics Group Leader Signed by: webber 2/22/2012 Facility for Rare Isotope Beams U.S. Department of Energy Office of Science Michigan State University East Lansing, MI Ph: (517) Fax: (517)

23 Facility for Rare Isotope Beams FRIB-P20100-SP R001 Page 3 of 8 FRIB Beam and Machine Modes Issued 17 February 2012 Table of Contents Table of Contents... 3 Revision History... 3 Authorizing Document... 3 Authorized Documents... 3 Authorized Committees and Boards Scope Beam Mode tables Description of the Beam Operation Modes O1: Linac Nominal Operation Mode O2: CW Low Power Operation O3: Nominal Linac Tuning Mode O4: Full Current -Short Pulse O5: Power Ramp-up / Fault recovery O7: Cavity Loading O8: Lithium stripper testing O9: Carbon Stripper power ramp up O10: Front-End Commissioning/Setup FRIB Machine Modes Tables...7 Revision History Revision Issued Changes R February 2012 Original issue None. None. None. Authorizing Document Authorized Documents Authorized Committees and Boards Facility for Rare Isotope Beams U.S. Department of Energy Office of Science Michigan State University East Lansing, MI Ph: (517) Fax: (517)

24 Facility for Rare Isotope Beams FRIB-P20100-SP R001 Page 4 of 8 FRIB Beam and Machine Modes Issued 17 February Scope The purpose of this document is to define the operating beam modes and machine modes for the FRIB facility during commissioning and operations. Sections 2 and 3 define the beam modes and their associated beam time structure and cycle repetition rate. Section 4 defines the machine modes that the Personnel Protection System (PPS) must cover. 2 Beam Mode tables Table 1. Beam modes for the driver linac including operation of the separator target. ID Description Time Structure Repetition Rate O1 Linac Nominal Operation Continuous beam with 50 Mode µsec gap at 100 Hz O2 O3 CW Low Power Operation Nominal Linac Tuning Mode Beam Intensity/ Power Scope NA 10kW to 400 kw Entire machine after O5 is completed Continuous beam with 50 µsec gap at 100 Hz NA < 10 kw Entire machine to target facility beam dump. 50 µsec pulse Single shot 50 eµa nominal, Entire machine to target or 150W facility beam dump. Beam on ~1 Hz target is defocused to 5mm diameter. Time structure downstream of LEBT chopper. O4 Full Current -Short Pulse 5 µsec pulse Single shot or ~1 Hz O5 O6 Power Ramp-up / Fault recovery Fragment separator commissioning and secondary beam development Dynamic over 10 minutes (see section 3.8) Variable pulse length and duty factor up to CW beam >~200 eµa Entire machine to target facility beam dump. Beam on target is defocused to 5mm diameter. Time structure downstream of LEBT chopper. Dynamic Dynamic to 400 kw Entire machine for beam power > 10kW CW. Time structure downstream of LEBT chopper. Variable pna Entire machine. Time structure downstream of LEBT chopper. Table 2. Beam modes for the driver linac operation of the separator target is not permitted or required. ID Description Time Structure Repetition Rate O7 Cavity loading 5-20msec pulses Single shot, ~1 Hz O8 Stripper testing (Li) Pulse length several sec with 50 µsec gap at 100 Hz O9 Carbon stripper power Linear power ramp in 10 ramp up minutes O10 Front-End Commissioning/set-up Variable pulse length and duty factor 5% duty cycle Beam Intensity/ Power 3pµA - 10 pµa <150W 50eµA to 8pµA 1kW Scope Linac only, beam to BDS dump. Time structure downstream of LEBT chopper. FS1 beam dump FS1-b, FS1 collimator FS1 beam dump FS1-b, FS1 collimator Variable 2.3 to 650 eµa Up to MEBT beam dump Facility for Rare Isotope Beams U.S. Department of Energy Office of Science Michigan State University East Lansing, MI Ph: (517) Fax: (517)

25 Facility for Rare Isotope Beams FRIB-P20100-SP R001 Page 5 of 8 FRIB Beam and Machine Modes Issued 17 February Description of the Beam Operation Modes 3.1 O1: Linac Nominal Operation Mode CW operation defines the nominal operation mode for FRIB after O5 is completed. The final operating power ranges from 10kW to 400kW for all ions. The time structure of this beam is CW with a 50 μsec diagnostic gap with a repetition rate of 100Hz. 3.2 O2: CW Low Power Operation CW mode defines the maximum beam power that the target can tolerate without power ramp up. The time structure of this beam is CW with a 50 μsec diagnostic gap with a repetition rate of 100Hz. 3.3 O3: Nominal Linac Tuning Mode This mode describes the nominal tune up mode which uses a beam intensity of 50eμA and a pulse length of ~50 μs with a repetition rate of 1Hz or less after the LEBT chopper. The BDS quadrupole triplet focusing strength is reduced to produce a beam spot of 5mm diameter on the target. For tuning the linac the BDS beam dump will be utilized. Only when the BDS is tuned the target facility beam dump will be utilized. 3.4 O4: Full Current -Short Pulse This mode covers the operation with interceptive diagnostics such as profile monitors and bunch length monitors. The BDS quadrupole triplet focusing strength is reduced to produce a beam spot of 5mm diameter on the target. For tuning the linac the BDS beam dump will be utilized. Only when the BDS is tuned the target facility beam dump will be utilized. 3.5 O5: Power Ramp-up / Fault recovery This beam mode defines the power ramp up to the target from a cold start or after an extended beam loss (>60sec). Two restart beam modes have been developed to respect the thermal stress specification of the target for beam outages of less than 60 seconds. The target beam interaction is defined in detail in DCC document T40309-SP R High power operation (cold start) This mode describes a 10 min power ramp from cold target conditions for beam powers greater than 10kW CW. Pulse length should be approximately 600nsec. The exact pulse length accuracy is not an issue, but must be less than 2μsec. The repetition rate will ramp up from 2kHz up to 25kHz in 30sec using the LEBT chopper. Next the duty factor will be increased to 100% using a predefined ramp defined below (see table ) Linearly increasing the pulse length to reach a temperature of 700 C on the beam impact area Linearly increasing the pulse length to 50% of the beam power Facility for Rare Isotope Beams U.S. Department of Energy Office of Science Michigan State University East Lansing, MI Ph: (517) Fax: (517)

26 Facility for Rare Isotope Beams FRIB-P20100-SP R001 Page 6 of 8 FRIB Beam and Machine Modes Issued 17 February 2012 Linearly increasing the pulse length to reach full power Table Power ramp up scheme for the target from a cold start. Step Description time cumulative length P (kw) f (khz) length(s) time (s) (ms) High power operation (hot start) Beam cut outs below 5s: Full power can be applied with a linear ramp of 2s (ramp pulse length from 10μs to 40 μs at 25kHz repetition rate). 5s < beam drop < 60 sec: Full power can be applied with a linear ramp of 10-20s (ramp pulse length from 5μs to 40 μs at 25kHz repetition rate). Beam cut outs 60 sec or longer: Cold start ramp is required O6: Fragment separator commissioning and secondary beam development This beam mode describes operation during commissioning of the fragment separator and during secondary beam development for rare isotope experiments. The intensity of the beam is limited by the maximum count rate that the detector system can tolerate and in some cases by the maximum intensity the scintillator based beam viewers can tolerate. When beam viewers are used, power reduction through a reduced duty cycle is a feasible option. In the case of particle-by-particle detection with detectors this is not the case and a cw-beam is required. 3.6 O7: Cavity Loading A pulsed mode with low duty factor up to full beam intensity within the pulse is used for linac tune up to test the effect of the beam loading on the cavity feedback. A pulse length of up to 20 msec with a repetition rate of 1Hz or less will be used. 3.7 O8: Lithium stripper testing Stripper commissioning and conditioning required an intense beam to verify the stripper response to a high thermal load. The beam will be dumped in Beam Dump FS1-b and the collimator. Pulse lengths of several seconds will be needed. With the nominal beam power after LS1 of 40kW and a beam dump FS1-b power capability of 3kW a maximum duty factor of 5% is permitted in this mode. 3.8 O9: Carbon Stripper power ramp up A 10 minute linear power ramp up is required to condition the carbon stripper for nominal operating conditions after venting or maintenance. The power ramp will be achieved using a combination of attenuators and LEBT chopper. The maximum beam power in this operation mode is restricted to 1kW. DT (± C) Taverage ( C) 1 0.6ms (2ms) at 2kHz to 0.6ms (2ms) at 25kHz khz/s ms (2ms) at 25kHz to 5ms at 25kHz ms/s ms at 25kHz to 20ms at 25kHz ms/s ms at 25kHz to 40ms at 25kHz ms/s 0.5 Tmax ( C) Tmin ( C) stress (Mpa) Ramp Power Ramp (kw/s) Facility for Rare Isotope Beams U.S. Department of Energy Office of Science Michigan State University East Lansing, MI Ph: (517) Fax: (517)

27 Facility for Rare Isotope Beams FRIB-P20100-SP R001 Page 7 of 8 FRIB Beam and Machine Modes Issued 17 February O10: Front-End Commissioning/Setup For the front end commissioning and beam set-up for operation, beam operation will be permitted up to the MEBT beam stop. Variable pulse length and duty factor up to CW beam will be used to minimize degradation of the interceptive diagnostics. 4 FRIB Machine Modes Tables Table 4.1 lists the FRIB five machine modes and their relation to the beam modes. The machine modes determine the personal protection system design. Table 4.1 FRIB machine modes and their relation to the operating modes ID Description Beam Mode Access M0 Maintenance (no beam) N/A entry permitted to service building, FE building, tunnel, target building M1 M2 M3 M4 Beam delivery up to the MEBT beam stop after RFQ Beam in the linac (no beam to target facility) Secondary beam development & BDS tuning (Linac, target, fragment separator) Beam delivery to the experimental system O10 O7,O8,O9 O1,O2,O3,O4,O5,O6 O1,O2,O5,O6 entry permitted to service building, FE building, tunnel, target building entry permits are independent of linac operation entry permitted to service building, FE building, target building entry permits are independent of linac operation entry permitted to service building, FE building entry permitted to service building, FE building, entry permits to experimental areas are dependent on beam path. Facility for Rare Isotope Beams U.S. Department of Energy Office of Science Michigan State University East Lansing, MI Ph: (517) Fax: (517)

28 Facility for Rare Isotope Beams FRIB-P20100-SP R001 Page 8 of 8 FRIB Beam and Machine Modes Issued 17 February 2012 Figure 1. Layout of the FRIB driver linac and target. The sections for the 4 beam machine modes are indicated. Facility for Rare Isotope Beams U.S. Department of Energy Office of Science Michigan State University East Lansing, MI Ph: (517) Fax: (517)

29 FRIB-T30101-AD R001 Page 1 of 1 MEMORANDUM Date: July 15, 2011 TO: Thomas Glasmacher, Project Manager Jie Wei, Accelerator Systems Division Director FROM: Thomas Russo, Electrical Engineering Department Manager Sheng Peng, Controls & Computing Department Manager CC: SUBJECT: Work interface between Electrical Engineering Department and Controls & Computing Department Treaty points for the various systems were discussed and agreed. Tom Russo Electrical Engineering Department Manager FACILITY FOR RARE ISOTOPE BEAMS Michigan State University East Lansing, Michigan Tel: +1 (517) Fax: +1 (517) russo@frib.msu.edu For the subsystems of diagnostics (loss monitor system, current monitors, and the others), the FPGA/software driver/application/gui will be handled by Controls. Everything towards the detector will be handled by diagnostics. Systems will be developed as a coordinated effort between groups to meet physics requirements. Power supplies will have Ethernet-based controller installed. This portion will be handled by the PS group. Controls will provide the Ethernet service for power supplies, PLC wherever required and software on top of them. Controls will also provide suggestions for future potential improvement of PS controller. The RF group is using FPGAs in the low level controls. Here the treaty point is soft. RF group will work with controls for hardware and software selection and revision control. Device specific FPGA coding may be done by the RF group. Devices will be designed with controls support and must be able to support waveform generation. The upper level software will be handled by Controls. All racks/cable tray layout/ long hauls etc. will be owned by the EE department. Controls will make request to EE department for service needed. MSU is an affirmative-action, equal-opportunity employer.

30 Global Systems Safety in Design Personnel Protection System Sheng Peng Controls and Computing Department Manager This material is based upon work supported by the U.S. Department of Energy Office of Science under Cooperative Agreement DE-SC Michigan State University designs and establishes FRIB as a DOE Office of Science National User Facility in support of the mission of the Office of Nuclear Physics.

31 Outline Controls Role Scope of PPS PPS requirement in place Current design and development status Summary S. Peng, December 2011 PPS Workshop - 06, Slide 2

32 Controls is the Implementer ESH & Q owns the PPS regulatory requirements FRIB Regulatory Requirements (R10103-TD ) Preliminary Hazard Analysis (PHA) (T10401-TD )»Describes hazards and mitigations Preliminary Safety Assessment Document (PSAD) (T10401-TD )»Report on the overall safety of facility Divisions own PPS Personnel Protection System (PPS) System Requirements Document (SRD) (T31304-CM ) Operation is the major customer Controls implements the PPS system S. Peng, September 2012 ESHAC Review, Slide 3

33 Process and Control s Role Applicable regulations (On top of the mandatory regulations mentioned before) ISO 9001:2008 Quality Management System (Voluntary) DOE O 420.2C Safety of Accelerator Facilitates (Voluntary) ANSI N43.1 Radiological Safety in the Design & Operations of Particle Accelerators (guidance) FRIB Governing Document (Project Office) FRIB Quality Manual FRIB-T10402-MA FRIB Regulatory Requirements Document FRIB-R10103-TD FRIB Document Control Guide FRIB-T10502-MA ES&H FRIB Project Preliminary Hazard Analysis FRIB-T10401-TD DRAFT FRIB Preliminary Safety Assessment Document FRIB-T10401-TD SAD/HA Division Coordinate requirement collection Detail Hazard and mitigation System Requirement Document FRIB-T31304-CM Controls Internal workflow and procedure such as Configuration Management, Development Life Cycle and Quality Assurance SIL/PL analysis and specification Implementation Participate verification (IAT, SAT and Interlock Check) S. Peng, September 2012 ESHAC Review, Slide 4

34 PPS Requirement in Place Regulatory requirements are identified PSAD and PHA are in place PPS is the Credited Engineering Control for certain hazards» Unexpected radiation exposure» Oxygen deficiency hazard PPS SRD is in place Machine mode and PPS sectors had been defined Access modes had been defined Basic functions are identified Preliminary specification for each area is in place S. Peng, September 2012 ESHAC Review, Slide 5

35 PSAD and PHA in Place S. Peng, December 2011 PPS Workshop - 06, Slide 6

36 PPS Scope Identified Radiation Safety System (RSS) Radiation Control System (RCS) Access Control System Areas: LINAC Target Oxygen Deficiency Hazard Control System (ODHCS) Area LINAC Target Cryoplant S. Peng, April 2012 Lehman Review - B06, Slide 7

37 Machine Mode Defined (P20100-SP ) S. Peng, April 2012 Lehman Review - B06, Slide 8

38 Access Mode Defined No Beam Regulated Access (by card reader) Sweep Linac, Target, NSCL as Sectors Limited Access, Magnet power on, RF power off (by card reader, key and interlocks) Prohibited Access, RF power enabled (i.e. no access, interlocks enabled) Beam When the beam is on in the tunnel, the access mode to the tunnel shall be Prohibited Access. Additional modes needed during installation, testing and commissioning will be defined as required for safe operation. Maintenance (including periodic testing/certification) Hot Cell access control is determined by Target segment status Prohibited Access, during beam operations or required delay immediately after beam operations Prohibited Access, during highly activated equipment movement Regulated Access (by card reader) Limited Access governed by operations in the Hot Cell. S. Peng, December 2011 PPS Workshop - 06, Slide 9

39 Basic PPS Functions Identified Shut off beam when physical barriers between personnel and hazards are unsecured Shut off beam upon activation of an E-STOP Support administrative actions to clear personnel from operating tunnel before beam operations Inhibit operation of radiation generating devices when a radiation dose over a set limit is detected outside beam enclosures Deter unauthorized entry to exclusion areas (for prompt radiation) Deter unauthorized entry into areas containing induced radiation (i.e. Target Hot Cell and Non-Conventional Utility Vaults) Provide visual indications of enclosure status at outside access points Warn personnel located in beam enclosures before beam operation De-energize exposed electrical conductors if personnel enter the tunnel (except in magnets on mode ) Shut off beam if target and/or beam dump are not in position Detect and Alarm when Oxygen level falls below 19.5% S. Peng, December 2011 PPS Workshop - 06, Slide 10

40 PPS Design and Development Status PED is in place Segmentized design to avoid unnecessary downtime Critical/mitigation devices (BID) had been identified Key technology has been identified Isolated network and safety rated communication CF designed integrated Quality assurance plan is being evaluated SCM, SDLC and V-model are adopted Prototype with TDCM and ReA3 PPS S. Peng, September 2012 ESHAC Review, Slide 11

41 Segment-based Solution Selected Segmentation helps initial checkout, annual check and any future upgrade from SNS experience and others as well Centralize controller with multi-drops was planned. Now we are moving to multi-controller solution FRIB PPS has four segments which are defined by building structure, function and historical reasons: LINAC segment including Front End» Paperclip shape does not allow further segmentation» Front End is low energy and provides mitigation devices Target Cryoplant Existing NSCL beamlines and ReA Each segment has one or more Allen Bradley GuardLogix Controllers in Main Control Room with distributed Guard I/O in the field Considering Compact GuardLogix Dedicated Ethernet enables safety data sharing cross segments S. Peng, December 2011 PPS Workshop - 06, Slide 12

42 MCR FRIB PPS Segments Defined According to Machine Modes

43 Redundant Critical Devices/Beam Inhibit Devices Identified Two E-bends are essential mitigation devices to turn off beam The Stopper after RFQ serves as the secondary mitigation device PPS will inform MPS as well as an additional redundant protection Voltage on Source Platform can be controlled as a reachback. MEBT ECR beamline1 CSS line ECRIS1 & HV platform1 ECR beamline2 ARTEMIS & HV platform2 Ground level line Vertical line RFQ Tunnel line S. Peng, December 2011 PPS Workshop - 01, Slide 14

44 BID Example: E-bend abort switch This device is used as a PPS critical device for fast beam inhibit in case of gate crash or other fault It is designed to remove voltage from the e-bend in 1us or less Fail safe Two E-bends provide redundancy Each E-bend has two plates for further redundancy T. Russo, December 2011 PPS Workshop - 08, Slide 15

45 BID Example: High Power Beam Stopper A high power beam stopper is planned between the RFQ and LS1. This is a critical device. The purpose of this device is to prevent any beam from getting to LS1. It will permit operation of the RFQ with beam during tunnel access. PPS will actuate this device in case of gate crash preventing acceleration of beam. The beam stop will be deployed in conjunction with other faster methods of beam inhibit. T. Russo, December 2011 PPS Workshop - 08, Slide 16

46 Redundant Critical Devices/Beam Inhibit Devices Identified Delivers FRIB accelerator as part of a DOE-SC national user facility with high reliability & availability Accelerate ion species up to 238 U with energies of no less than 200 MeV/u Provide beam power up to 400kW Satisfy beam-on-target requirements Energy upgrade by filling vacant slots with 12 SRF cryomodules Maintain ISOL option Upgradable to multiuser simultaneous operation of light/heavy ions with addition of a light-ion injector S. Peng, December 2011 PPS Workshop - 01, Slide 17

47 BID Example: Multi Bending Dipoles Up to four bending dipoles provide redundancy PPS controls the first one and at least one more The PPS enables bending dipoles when conditions are safe If an unsafe condition detected (access violation or high radiation in an occupied area) then the beam is shut off and critical dipole magnets are disabled. T. Russo, December 2011 PPS Workshop - 08, Slide 18

48 Allen Bradley GuardLogix PLC Allen Bradley Guard I/O Access control Door strike/crash bar Warning lights/horns Arm box E-Stop Key bank Radiation detector: Chipmunk Canberra Air Monitor Ludlum Alpha/Beta sample counter ODH Oxigraf O2iM Key Technology Identified S. Peng, December 2011 PPS Workshop - 06, Slide 19

49 PPS PLCs are in a physically isolated network An PLC will be acting as gateway to provide information to outside In the designated PPS Zone of firewall IOC will talk to this PLC and provide information to control system PPS Network is Isolated S. Peng, April 2012 Lehman Review - B06, Slide 20

50 CF Integrated The integration with Conventional Facility is moving forward well Cable trays have been identified» Homerun» Cryoplant» Target area Conduit with special color has been agreed Rack has been reserved UPS capacity has been reserved Dual AC solution is identified and tested Door requirement has been addressed Access Control» Five PPS doors are identified Full function with Key Bank» Five PPS crash doors Only crash-bar with switches to turn off beam ODH» No door lock enforcement from PPS Badge reader with training control» Indicator inside and outside Detail location still needs to work out S. Peng, Controls and Computing Department Manager, Slide 21

51 Applicable Standards for Engineering Design ISA Standards ISA Specifies requirements for the Safety Instrumented System (SIS) assessment, design, installation, Operation and maintenance of SIS. IEC (International Electro-technical Commission) IEC Part 1 Functional safety Safety instrumented systems for the process industry sector EN ISO safety requirements and guidance on the principles for the design and integration of safety-related parts of control systems (SRP/CS), including the design of software. For these parts of SRP/CS, it specifies characteristics that include the performance level required for carrying out safety functions. It applies to SRP/CS, regardless of the type of technology and energy used (electrical, hydraulic, pneumatic, mechanical, etc.), for all kinds of machinery. S. Peng, December 2011 PPS Workshop - 06, Slide 22

52 Workflow and Development Life Cycle Need for New PPS System Initiate RSWCF Validation Scope and Methodology Determination Safety Functions Requirements Specification Software Functions Determination Hardware Functions Determination Implement Change Initial Acceptance Test Success Close RSWCF Problems Development and Review Cycle Rework Proposal Preliminary Design Review (Project and RSO/RSC) Success 12 Months 6 Months Safety Assurance Test Success Interlock Checks Success Problems Problems Rework Procedure Safety Validation Planning Bench Testing Specified? Validation Procedure Review Success Rework Software Withdraw Software from Version-Control Repository Software Design and Development Software Bench Testing Success Deposit Software in Version-Control Repository Assign New Version Number Rework Software System Technical Design Review (Project and RSO/RSC) Success Hardware Design and Development Rework Hardware Routine Testing Per Guideline 27 Correct the Procedure Assess Failure with RSO Administrative Mitigation System in Operation Engineering Change Problems Procedure Error Assessment of Failure Is the Failure Reportable? Undesired Functionality Discovered Failed Hardware Initiate RSWCF; Determine Tests Repair Hardware Lifecycle Special Functions Key System Review or Assessment System Testing or Validation System in Operation Additional Cycle Implementation, Operations, and Maintenance Cycle Need for New Functional Requirements Re-perform Test Success Close RSWCF Problems S. Peng, December 2011 PPS Workshop - 06, Slide 23

53 Prototype Example: TDCM PPS System Hazards Mitigated Radiation Safety Access Control Systems Oxygen Deficiency Hazards PPS for TDCM PPS used the same PLC hardware planned for FRIB Provided valuable hands-on training for new personnel which will be supporting and installing PPS controls for FRIB» Including gathering requirements» Determining placement of detectors, warning lights, Search and evict hardware, and gate switches» Compilation of System Testing Checklists» Documentation of procedures to operate the system» Presentation of system to Interlock Validation Committee» Verification/validation of the system S. Peng, Controls and Computing Department Manager, Slide 24

54 Prototype Example: TDCM PPS System Hardware used in installation also planned for FRIB AB GuardLogix Processor AB Safety Point I/O Warning Lights AB Trojan Style Door/Gate Switches Safety Status Panel various components Power Supplies Breakers, terminal blocks, brackets S. Peng, Controls and Computing Department Manager, Slide 25

55 PPS Path Forward to Technical Design Complete Finalize internal PPS development life cycle Decide and deploy the requirement tracking tool DOORS/EA/Teamcenter Develop Engineering Design Specification SIL/PL analysis Evaluate key parting and build test bench ODH monitor Chipmunk Door parts S. Peng, Controls and Computing Department Manager, Slide 26

56 Summary Requirement is in place and well understood Interfaces with ESH&Q, ASD, ESD and CFD are well established PPS preliminary design is in place The detail design in on track to complete the full design S. Peng, December 2011 PPS Workshop - 06, Slide 27