EtherCAT based RF Interlock System for SwissFEL LLRF 2015 Abstract As part of the overall development effort for SwissFEL's RF and LLRF systems, the RF interlock system is developed with the goal to protect the high-power RF system including the accelerating structures against damage. To ensure autonomous and reliable operation, the RF interlock system main functionalities and detector inputs are well separated from the LLRF as well from the control system. The main challenges of an RF interlock system are the detections and reactions to various sensor input types such as pulsed RF signals with 50 nanoseconds up to microseconds pulse durations and all kind of standard digital and analog I/O signals. These requirements lead to the concept of a dedicated FPGA for safety logic handling with interconnection to the standard COTS based I/Os and towards the control system over a deterministic real time EtherCAT field bus link. A dedicated precise temperature monitoring system with up to 40 PT100 channels is included in the EtherCAT bus, which is used to generate temperature interlocks. Manuel Brönnimann, Roger Kalt, Alex Dietrich, Werner Sturzenegger, Florian Gärtner Conclusion Due to the modularity of the system all RF interlock units for all different type of RF stations at the SwissFEL are identical. At each RF station it is possible to bypass the unused interlock inputs by an external connector. This gives the chance to have only one firmware for all different types of RF stations in the SwissFEL which reduces to overall maintenance effort. For the RF interlock System four different modes have been elaborated. If the facility is in operation, the normal operation mode where the beam is on is active. Over the control system it is possible to switch in the conditioning mode where it should be possible to conditioning one RF station during beam operation. In the conditioning mode the trigger of the station will be delayed and the interlocks to the alarms of the machine protection system will be bypassed. For maintenance purposes a load mode for testing the station on an RF load and a diode mode where no RF is generated and the high voltage modulator is operated in diode mode are included. The availability of a big variety of COTS EtherCAT slave clamps enables an easy extension of the system for other machines. The switching-off reaction time for these COTS modules is only based on the EtherCAT frame rate which is currently set to 500 Hz. This leads to a reaction time of 4ms which is sufficient for the 10ms SwissFEL trigger cycles. The series of the RF interlock system has been built successfully for the SwissFEL. After an intake control and an EMI test the installation into the accelerator has now started. Revision 1, BN84, LLRF15 EtherCAT Master [2] Standalone real time EtherCAT master stack EPICS IOC included for connection to control system Implemented on IFC 1210 P2020 CPU but convertible also on x86 or other platforms Temperature measurement system 40 PT100 temperature sensors →Class A PT100 sensors →Relative temperature resolution < ° C pp →Uncalibrated absolute temperature accuracy < ±0.25 ° C p →Read out error < ° C / K if environment temperature changes 4 external humidity, pressure and temperature sensors µC (C8051F38x) based System EtherCAT Slave module (Anybus) Generation of sum interlock Beckhoff IO modules Modular IO’s with Beckhoff clamps Digital IO’s →24VDC, 5VDC and potential free contacts Analog IO’s →4…20mA and 0…10V Safety Logic PCB Spartan6 FPGA with RF interlock firmware Fast direct digital IO’s →24VDC, 5VDC and optocouplers 8 RF peak detectors →for RF pulses down to 50ns pulse S-, C- and X-Band →Detection of unwanted RF leakage between the RF pulses Digital safety IO’s (redundant) EtherCAT Slave module (Anybus) Remote Firmware update over EtherCAT bus ■ ice-water ■ ambient IFC1210 IOC Temperature over Bus acquisition System (ToBaS) RF interlock unit Safety logic PCB FPGA block diagram Readout accuracy in unstable environment 4 wire PT100 Ext. Sensor RS485 EtherCAT master System overview [1] refer to [2] refer to ICALEPCS 2015 paper MOPGF27 eth1  eth0  serial  4x 40x RF interlock unit High voltage modulator in standby state High voltage of the modulator is “on” but trigger to the modulator is disabled No interlock pending RF is allowed and the trigger to the HV modulator is enabled Intermediate state for synchronize switching to RF ready (delay 5ms)