From the LHC Reference Database to the Powering Interlock System

Proceedings of ICALEPCS2003, Gyeongju, Korea FROM THE LHC REFERENCE DATABASE TO THE POWERING INTERLOCK SYSTEM M.Zerlauth, C.Dehavay, B.Puccio, R.Schmidt, E.Veyrunes, CERN, Geneva, Switzerland Abstract The protection of the magnet powering system for the Large Hadron Collider (LHC) currently being built at CERN is a major challenge due to the unprecedented complexity of the accelerator [1]. The Powering Interlock System of the LHC will have to manage more than 1600 DC circuits for magnet powering, different in their structure, complexity and importance to the accelerator. For the coherent description of such complex system, a Reference Database as unique source of the parameters of the electrical circuits has been developed. The information, introduced via a generic circuit description language, is first used for installing the accelerator and making all electrical connections. The data is then used for tests and commissioning. During operation, the Powering Interlock System manages all critical functions. It consists of 36 PLC based controllers distributed around the machine and requires a flexible and transparent way of configuration, since each controller manages different numbers and types of electrical circuits. The PLC process is customised using configuration data downloaded from the Reference Database in order to ensure a correct mapping of the electrical circuit parameters to the operation of the interlock system. 7 powering subsectors for normal conducting magnets, distributed around the machine as shown in Figure 1 [2]. Each powering subsectors is independent from the other ones in terms of powering, operation and commissioning. One electrical circuit is always allocated to one powering subsectors. None of its elements exceeds the subsector. Figure 1: Powering Subsectors in the LHC DESCRIPTION OF THE LHC POWERING More than 10000 superconducting and normal conducting magnets are distributed around the LHC circumference and have to be connected to 1712 different power converters located mostly in the underground areas and in various surface buildings. Correct powering of all magnets is vital for the successful accelerator operation. The basis of the construction, commissioning and operation is a coherent description of the magnet powering system. The concept of powering subsectors The LHC superconducting magnets are powered separately in each of the eight symmetrical sectors. In each sector there are several cryostats housing the magnets, in total more than 40 around the LHC. Such separation is required to limit the energy stored in one electrical circuit, and to avoid cables carrying high current across the insertions. A drawback is a considerable increase of the component inventory necessary for LHC operation (power converters, current feed-throughs, etc.). Considering these given hardware limitations and to further simplify installation, commissioning and operation, the powering system is subdivided into 28 powering subsectors for the superconducting magnets and 395 The Circuit Description Language (CDL) To introduce the connection data for the electrical circuits into the LHC Reference database a generic language was developed [3], describing the connection of elements in the electrical circuit in a sequential way. From the mechanical layout of the machine the set of electrically connectable elements is generated (an electrical circuit element can be a power converter, a magnet, a normal conducting cable, a superconducting busbar, a current lead, …). The description of the circuits with the CDL is derived from 40 electrical circuit drawings in the format A0, describing the physical order and connections in between these electrical circuit elements. Both, the CDL and the set of electrical circuit elements will be processed by the CDL interpreter. The interpreter converts the circuit description to a standard, database readable format (XML) and verifies the correctness of description by different predefined means. Thus, an XML description is generated for every electrical circuit in the LHC and will be uploaded via an Application Programming Interface (API) to the LHC Reference Database (see ). Proceedings of ICALEPCS2003, Gyeongju, Korea failure are present for all 14 circuits. Only 8 circuits have a dedicated quench signal and only one circuit the possibility for requesting a discharge of energy. Figure 2: Uploading the circuit data Figure 3: Current Loops for a powering subsector of an inner triplet cryostat Data Verification within the LHC Reference Database Ensuring consistency and correctness of data is a major challenge. The information will determine the connections of about 60 wires in all interconnections of cryo-assemblies throughout the long arc cryostats. It will be used to configure the powering interlock controller (see chapter 3) and to generate input files for optic programs. The data will be displayed via standard webinterfaces to the users [4] and, last not least, will be used to operate the magnet powering system. Verification of data is done by the CDL interpreter and additionally by a person by cross-checking the circuit description with the original electrical circuit drawings. Finally, verification has been performed with the optics program MAD using input files with the powering information from the LHC Reference Database. Since the same information is provided to installation teams, risks of wrong connections are minimised. POWERING INTERLOCKS Electrical circuits with large stored energies are equipped with energy extraction systems and dedicated quench protection systems for the different components (current leads, superconducting busbars, magnets, etc.). Circuits with little stored energy and their components are protected directly by the power converter. Circuits are also different with respect to their relevance during beam operation. Classes of Electrical Circuits The electrical circuits are grouped into four classes, since the principles for the protection vary for the different circuits. Hardwired signals will be exchanged via four types of current loops between the power converters, the quench protection system (QPS) and the powering interlock controller. The loops transmit information like power permit, quench signals, requests for an extraction of energy and failures of power converters. Figure 3 shows the signals exchanged for an inner triplet, a powering subsector with 14 electrical circuits. The signals for power permit and powering 396 Table 1 summarizes the difference in numbers and types of electrical circuits attached to one powering interlock controller. The large variety shows once more the necessity of a coherent database description. Table 1: Interfaces for the different PIC’s PIC_NAME CIPCX.R1 CIPCL.R1 CIPCA.R1 CIPCA.L2 CIPCM.L2 CIPCX.L2 .. INT_A 1 0 1 3 0 1 … INT_B1 7 1 14 25 1 8 … INT_B2 0 3 4 5 2 0 … INT_C 5 10 8 10 12 5 … The Powering Interlock Controller The powering interlock system is based on a distributed system of 36 industrial PLC’s. One PLC is allocated to the protection of one powering subsector (two PLC’s in case of the long arc cryostats). Part of the system is installed close to the accelerator in tunnel enlargements. The radiation levels impose the placement of deported I/O units, connected via Profibus to the CPU which is located in an adjacent underground area where radiation is low. As failures of the system cannot be completely excluded, a quasi-redundant system has been chosen, where the three systems are connected via the same current loop. Even in case of fault of the PLC the basic protection mechanisms are still guaranteed, as signals issued by the QPS will still be received by the power converter and vice versa. Only mechanisms such as switching off a complete powering subsector after failure of a major circuit in the subsector will be lost. THE SOFTWARE OF THE PIC The software for all the different PLC’s will be unique, despite the difference in hardware to be managed by the different controllers. For each of the four circuit types the functionality to be performed by the PIC has been described in state diagrams, which are the basis for the PLC software. The software will also ensure recording of data for post mortem analysis and time stamping of all Proceedings of ICALEPCS2003, Gyeongju, Korea state transitions. In case of a failure in a circuit with great relevance during beam operation, a beam dump request will be issued for the beam interlock controller [5]. The configuration file for the PIC A configuration file from the LHC Reference Database will deliver the specific hardware configuration of the corresponding subsector. After the successful installation of the hardware in the tunnel, the software will be downloaded via the supervision or via direct access to the PLC. For this, the configuration file and the software will be pre-processed to configure the addresses of inputs and outputs according to the connected signals. A typically configuration file is shown in . The file defines the name, number, type and parameters of all circuits in this subsector. For each type of circuit the maximum possible number of circuits has to be foreseen in the configuration file and non existing circuits will be masked via a flag called ‘Circuit OK’. This mechanism of masking can be used for later commissioning scenarios if e.g. certain circuits are not yet installed but commissioning should already start. . Table 2: Typical fragment of a configuration file ID 1 2 3 4 5 6 … 43 44 NAME RQX.R1 CIRCUIT TYPE A RCBXH1.R1 RCBXH2.R1 RCBXH3.R1 … RCOSX3.R1 RCOX3.R1 B1 B1 B1 … C C CIRCUIT OK 1 0 0 1 1 1 … 1 1 PAR _PF 1 0 0 0 … 0 0 PAR _DB 1 Supervision of the PIC The requirements for the supervision for the powering interlock system are similar to several other systems in the LHC. A SCADA system has been chosen as a standardised platform for the supervision, following CERN recommendations. As for the configuration of the hardware, the screens for the supervision will be configured with data coming from the LHC Reference Database. Starting from a general screen where the status of all powering subsectors is visualised, the operator will have the possibility to access to more detailed screens for each powering subsector. As failures of the supervision or the controls hardware need to be anticipated, no safety critical signals for the protection of electrical circuits will be processed at the supervision level. Only for starting of the powering in a powering subsector a general ‘permit’ signal from the cryogenic and from the quench protection system will be obtained via the supervision. The status may change during the powering of the machine. It is left to the operator to abort the powering after loss of these signals since the protection is always ensured at the hardware level. OUTLOOK 0 0 0 … 0 0 The pre-processing in the PLC will start with assigning the first e.g. three inputs and outputs to the signals of the circuit of type A. The next circuit is of type B1 and will therefore be assigned the inputs and outputs 4 and 5 and the physically connected signals will correspond to the addressed inputs and outputs of the downloaded software. Testing the software Testing the functionality of the software and the corresponding hardware is vital before and after installation of the 36 different PIC systems in the tunnel. The most complex PIC’s have to manage around 80 inputs and the same number of outputs, while several events can happen at the same time instance. First tests have been performed using truth tables to verify the basic functionalities of the software. Later on a dedicated test system will be able to completely emulate the two systems connected to the PIC (the QPS and the power converter systems) and to simulate simultaneous events and realistic failure cases. 397 A prototype of the LHC powering interlock controller is undergoing the first tests. Gained experience during testing already showed that a modular system with several types of crates (containing the connectors, patch panels, I/O modules and a minimum amount of electronics to handle between 5 and 11 electrical circuits each) will be installed into the rack. This will simplify the system and minimize intervention times in the tunnel. In case of fault, one crate is replaced during a short intervention. The repair will be performed later and does not decrease the availability of the system. Further improvements will be applied to achieve the final version of the hard- and software, to be ready for commissioning of the first PIC in the LHC tunnel in the beginning of 2005. REFERENCES [1] F. Bordry et al., Machine Protection for the LHC: Architecture of the Beam and Powering Interlock Systems Project Report 521, December 2001. [2] B. Puccio, R. Schmidt, M. Zerlauth, “Powering Subsectors”, CERN, Geneva, EDMS Doc.Nr.361532. [3] M. Zerlauth, A. Jimeno, G. Morpurgo, R. Schmidt, “The Electrical Circuit Description for the LHC”, EPAC’02, Paris, June 2002. [4] http://edms.cern.ch/DLHClayout/plsql/main.home? p_version=STUDY [5] R. Schmidt et al., Beam interlocks for LHC and SPS, these proceedings