DAQ control system for multi-beamline simultaneous experiments at SACLA Takashi SUGIMOTO Japan Synchrotron Radiation Research Institute (JASRI/SPring-8)

Slides:

Advertisements

Similar presentations

Network Security Essentials Chapter 11

Advertisements

New Radiation Safety Interlock System for the SPring-8 Accelerator Complex C. Saji, M. Toko, T. Matsushita, R. Furuta, H. Hanaki, S. Hashimoto 1), Y. Hashimoto,

Firewalls By Tahaei Fall What is a firewall? a choke point of control and monitoring interconnects networks with differing trust imposes restrictions.

Guide to Network Defense and Countermeasures Second Edition

Information Security 1 Information Security: Security Tools Jeffy Mwakalinga.

Firewall Configuration Strategies

Chapter 8: Local Area Networks: Internetworking. 2 Objectives List the reasons for interconnecting multiple local area network segments and interconnecting.

K. Salah 1 Chapter 31 Security in the Internet. K. Salah 2 Figure 31.5 Position of TLS Transport Layer Security (TLS) was designed to provide security.

Lesson 3 – UNDERSTANDING NETWORKING. Network relationship types Network features OSI Networking model Network hardware components OVERVIEW.

Lesson 11-Virtual Private Networks. Overview Define Virtual Private Networks (VPNs). Deploy User VPNs. Deploy Site VPNs. Understand standard VPN techniques.

Internetworking School of Business Eastern Illinois University © Abdou Illia, Spring 2007 (Week 4, Tuesday 1/30/2007)

Chapter 10 Introduction to Wide Area Networks Data Communications and Computer Networks: A Business User’s Approach.

1 Chapter 8 Local Area Networks - Internetworking.

Network Security. Network security starts from authenticating any user. Once authenticated, firewall enforces access policies such as what services are.

1 Chapter 8 Local Area Networks - Internetworking Data Communications and Computer Networks: A Business User’s Approach.

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. 6 Packet Filtering By Whitman, Mattord, & Austin© 2008 Course Technology.

Firewall 2 * Essential Network Security Book Slides. IT352 | Network Security |Najwa AlGhamdi 1.

A Guide to major network components

Computer Networks IGCSE ICT Section 4.

Computer Networking Devices Seven Different Networking Components.

CHAPTER Introduction to LANs. MODULE Purpose and Use of a Network.

Switches in Networking B. Konkoth. Network Traffic  Scalability  Ability to handle growing amount of work  Capability of a system to increase performance.

MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration Chapter 9 Network Policy and Access Services in Windows Server 2008.

And how they are used. Hubs send data to all of the devices that are plugged into them. They have no ability to send packets to the correct ports. Cost~$35.

Chapter 2 Information Security Overview The Executive Guide to Information Security manual.

Packet Filtering. 2 Objectives Describe packets and packet filtering Explain the approaches to packet filtering Recommend specific filtering rules.

Network Security Essentials Chapter 11 Fourth Edition by William Stallings Lecture slides by Lawrie Brown.

1 WHY NEED NETWORKING? - Access to remote information - Person-to-person communication - Cooperative work online - Resource sharing.

By Kyle Slinger.  A network is where you can send information to and from different PCs.

Lecture#2 on Internet and World Wide Web. Internet Applications Electronic Mail ( ) Electronic Mail ( ) Domain mail server collects incoming mail.

Workshop “Vacuum systems of Synchrotron Light Sources“ organized by MAX-LAB & ALBA Barcelona, th September 2005 Instrumentation and Vacuum Control.

Common Devices Used In Computer Networks

Data Communications and Networking CSCS 311 Lecture 2 Amjad Hussain Zahid.

Chapter 8 Local Area Networks: Internetworking Data Communications and Computer Networks: A Business User’s Approach.

P RESENTED B Y - Subhomita Gupta Roll no: 10 T OPICS TO BE DISCUSS ARE : Introduction to Firewalls  History Working of Firewalls Needs Advantages and.

11 SECURING YOUR NETWORK PERIMETER Chapter 10. Chapter 10: SECURING YOUR NETWORK PERIMETER2 CHAPTER OBJECTIVES  Establish secure topologies.  Secure.

Emerging Technologies. Emerging Technology Overview  Emerging technologies are those which are just beginning to be adopted or are at the initial acceptance.

NETWORKING COMPONENTS AN OVERVIEW OF COMMONLY USED HARDWARE Christopher Johnson LTEC 4550.

Network and Perimeter Security Paula Kiernan Senior Consultant Ward Solutions.

Chapter 10: MANs and WANs. Topics What is MAN, WAN? How are they different from LANs? Subnet and three different switched-networks Connection-oriented.

Networks and Protocols CE Week 2a. Network hardware.

OS Services And Networking Support Juan Wang Qi Pan Department of Computer Science Southeastern University August 1999.

Securing the Network Infrastructure. Firewalls Typically used to filter packets Designed to prevent malicious packets from entering the network or its.

McLean HIGHER COMPUTER NETWORKING Lesson 14 Firewalls & Filtering Comparison of Internet content filtering methods: firewalls, Internet filtering.

1 BROOKHAVEN SCIENCE ASSOCIATES Redundancy Requirements for Critical Devices R. Casey August 8, 2007.

NETWORKING FUNDAMENTALS. Network+ Guide to Networks, 4e2.

ITGS Network Architecture. ITGS Network architecture –The way computers are logically organized on a network, and the role each takes. Client/server network.

Overview of Firewalls. Outline Objective Background Firewalls Software Firewall Hardware Firewall Demilitarized Zone (DMZ) Firewall Types Firewall Configuration.

Data Communications & Computer Networks, Second Edition1 Chapter 8 Local Area Networks: Internetworking.

Understand Network Isolation Part 2 LESSON 3.3_B Security Fundamentals.

Internetworking School of Business Eastern Illinois University © Abdou Illia, Spring 2016 (February 3, 2016)

Renewal of the Remote Maintenance System for the SPring-8 Control System T. SUGIMOTO and T. SAKAMOTO JASRI/SPring-8, JAPAN.

Networking Components Assignment 3 Corbin Watkins.

Activity 1 5 minutes to discuss and feedback on the following:

Networking Components Quick Guide. Hubs Device that splits a network connection into multiple computers Data is transmitted to all devices attached Computers.

Introduction to Networking. What is a Network? Discuss in groups.

Lecture 10 Page 1 CS 236 Online SSL and TLS SSL – Secure Socket Layer TLS – Transport Layer Security The common standards for securing network applications.

Firewalls. Overview of Firewalls As the name implies, a firewall acts to provide secured access between two networks A firewall may be implemented as.

WARCS (Wide Area Remote Control for SPring-8)‏ A. Yamashita and Y.Furukawa SPring-8, Japan Control System Cyber-Security Workshop (CS)2/HEP Oct

أمن المعلومات لـ أ. عبدالرحمن محجوب حمد mtc.edu.sd أمن المعلومات Information Security أمن المعلومات Information Security  أ. عبدالرحمن محجوب  Lec (5)

C. Saji, M. Toko, T. Matsushita, R. Furuta, H. Hanaki, S

Phare EIONET Centralised Training Session

Computer Data Security & Privacy

Cisco Router Technology

Server Concepts Dr. Charles W. Kann.

Introduction to Networking

Firewalls Routers, Switches, Hubs VPNs

Computer communications

Presentation transcript:

DAQ control system for multi-beamline simultaneous experiments at SACLA Takashi SUGIMOTO Japan Synchrotron Radiation Research Institute (JASRI/SPring-8) 1

SPring-8 and SACLA 2

SPring-8: Light source complex 3 Electron Injector (1-GeV Linac and 8-GeV booster synchrotron) New Subaru (1.5-GeV Storage Ring) SPring-8 (8-GeV Storage Ring) SACLA (X-ray Free Electron Laser Facility)

SACLA Beamlines 4 XFEL MOM305, HOSODA et al., “A Control System for a Dedicated Accelerator for SACLA Wide-band Beam Line” FEL BL3 and BL2 are in operation. BL3/BL2 fast-switched XFEL distribution has just started in FY2015. BL1 is under commissioning. Operation time is 7,000 hour/year.

Overview of SPring-8 Campus Network 5

Machine Control Research (Development and Experiment) Research (Development and Experiment) General Purpose DMZ SPring-8 Campus Network 6 Data Analysis Internet

Machine Control Research (Development and Experiment) Research (Development and Experiment) General Purpose DMZ SPring-8 Campus Network 7 SPring-8 Control SPring-8 Control SACLA Control SACLA Control Software Developme nt SPring-8 Experiment SPring-8 Experiment SACLA Experiment SACLA Experiment SACLA Data Acquisition SACLA Data Acquisition Data Analysis Office Network Public Servers HPC System Defense-in-depth oriented network system (2010-) VPN IPS Internet Router w/ ACL

Machine Control Research (Development and Experiment) Research (Development and Experiment) General Purpose DMZ SPring-8 Campus Network 8 SPring-8 Control SPring-8 Control SACLA Control SACLA Control Software Developme nt SPring-8 Experiment SPring-8 Experiment SACLA Experiment SACLA Experiment SACLA Data Acquisition SACLA Data Acquisition Data Analysis Office Network Public Servers HPC System Defense-in-depth oriented network system (2010-) VPN 3rd (CS) 2 /HEP, 2011, Grenoble IPS Router w/ ACL Internet

SPring-8 Experiment Network 9 Presented on 3rd (CS)2/HEP Workshop, 2011

Office Network History of SPring-8 Experiment Network (1of3) 10 SPring-8 Control SPring-8 Control SPring-8 Experiment SPring-8 Experiment Internet In early days of SPring-8 ( ), the experimental network is a part of office network without any access control. Public Servers

Office Network History of SPring-8 Experiment Network (1of3) 11 SPring-8 Control SPring-8 Control SPring-8 Experiment SPring-8 Experiment Internet In early days of SPring-8 ( ), the experimental network is a part of office network without any access control. In 1990s, number of network-connected PCs increased. Anyone (with/without evil intention) in office can control experimental instruments. Public Servers

History of SPring-8 Experiment Network (2of3) 12 SPring-8 Control SPring-8 Control SPring-8 Experiment SPring-8 Experiment Office Network Internet In 1998, the experimental network is segregated using firewall(s). Public Servers

History of SPring-8 Experiment Network (2of3) 13 SPring-8 Control SPring-8 Control SPring-8 Experiment SPring-8 Experiment Office Network Internet In 1998, the experimental network is segregated using firewall(s). Public Servers However, because of such historical reason, the experiment network have internet connectivity.

History of SPring-8 Experiment Network (2of3) 14 SPring-8 Control SPring-8 Control SPring-8 Experiment SPring-8 Experiment Office Network Internet In 1998, the experimental network is segregated using firewall(s). Public Servers However, because of such historical reason, the experiment network have internet connectivity. With internet connectivity, recent VPN technologies can pass through the firewalls. (Unmanaged VPNs: e.g. TeamViewer, splashtop, …)

History of SPring-8 Experiment Network (3of3) 15 SPring-8 Control SPring-8 Control SPring-8 Experiment SPring-8 Experiment Office Network Public Servers Internet We installed “next-generation firewall” in 2010, to block such unmanaged VPNs.

History of SPring-8 Experiment Network (3of3) 16 SPring-8 Control SPring-8 Control SPring-8 Experiment SPring-8 Experiment Office Network Public Servers Internet We installed “next-generation firewall” in 2010, to block such unmanaged VPNs. When malware infected PC is connected to the experiment network, the NG-FW can block the C & C traffic. C & C Server

17

History of SPring-8 Experiment Network (3of3) 18 SPring-8 Control SPring-8 Control SPring-8 Experiment SPring-8 Experiment Office Network Public Servers Internet We installed “next-generation firewall” in 2010, to block such unmanaged VPNs. When malware infected PC is connected to the experiment network, the NG-FW can block the C & C traffic. Why do we install such a expensive firewalls? Experimental network must have internet connectivity to transfer data to office and/or other institutes. (Historical reason)

History of SPring-8 Experiment Network (3of3) 19 SPring-8 Control SPring-8 Control SPring-8 Experiment SPring-8 Experiment Office Network Public Servers Internet We installed “next-generation firewall” in 2010, to block such unmanaged VPNs. When malware infected PC is connected to the experiment network, the NG-FW can block the C & C traffic. Why do we install such a expensive firewalls? Experimental network must have internet connectivity to transfer data to office and/or other institutes. (Historical reason) It is difficult to catch up the newest technologies and vulnerabilities.  We made tight security policy at the SACLA.

SACLA Network System 20

Machine Control Research (Development and Experiment) Research (Development and Experiment) General Purpose DMZ SPring-8 Campus Network 21 SPring-8 Control SPring-8 Control SACLA Control SACLA Control Software Developme nt SPring-8 Experiment SPring-8 Experiment SACLA Experiment SACLA Experiment SACLA Data Acquisition SACLA Data Acquisition Data Analysis Office Network Public Servers HPC System VPN Today’s Topic IPS Router w/ ACL Internet

Summary SACLA Experimental Network Policy 1.No internet connectivity 2.Segregate LANs based on purpose 3.Logically segmented by experimental area/unit, to perform multi-beamline experiments 4.Physically segmented by beamlines to guaranty DAQ performance 22

1. No Internet Connectivity 23 SACLA Control SACLA Control SACLA Experiment SACLA Experiment SACLA Data Acquisition SACLA Data Acquisition HPC System Router w/ ACL Data transfer servers At first, we decided to have no internet connectivity at the SACLA network systems. Dedicate servers take charge of data transfer to other institutes. Internet By segregating network systems from the Internet, experimental systems are prevented from recent vulnerabilities which utilize the internet.

1. No Internet Connectivity 24 SACLA Control SACLA Control SACLA Experiment SACLA Experiment SACLA Data Acquisition SACLA Data Acquisition HPC System Router w/ ACL Data transfer servers

SACLA Control SACLA Experiment SACLA Data Acquisition 2. Segregate LANs based on purpose 25 Camera DAQ ServersStorage User Workstation (User-WS) Undulator Shutter Focusing Shutter Sample Changer Beamline Master Server (BL-Master) Beamline Workstation (BL-WS)

2. Segregate LANs based on purpose 26 Camera DAQ ServersStorage Undulator Shutter Focusing Shutter Sample Changer SACLA Control SACLA Experiment SACLA Data Acquisition User Workstation (User-WS) Beamline Master Server (BL-Master) Beamline Workstation (BL-WS) BL-WS is accountable for X-ray optics control.

2. Segregate LANs based on purpose 27 Camera DAQ ServersStorage Undulator Shutter Focusing Shutter Sample Changer SACLA Control SACLA Experiment SACLA Data Acquisition User Workstation (User-WS) Beamline Master Server (BL-Master) Beamline Workstation (BL-WS) BL-WS is accountable for X-ray optics control. BL-Master is accountable for DAQ system and movers. (e.g. sample changer)

2. Segregate LANs based on purpose 28 Camera DAQ ServersStorage Undulator Shutter Focusing Shutter Sample Changer SACLA Control SACLA Experiment SACLA Data Acquisition BL-Master is accountable for DAQ system and movers. (e.g. sample changer) User Workstation (User-WS) Beamline Master Server (BL-Master) Beamline Workstation (BL-WS) BL-WS is accountable for X-ray optics control. Experimental users send control message to BL-Master. (e.g. start DAQ, sample change, open shutter…)

2. Segregate LANs based on purpose 29 Camera DAQ ServersStorage Undulator Shutter Focusing Shutter Sample Changer SACLA Control SACLA Experiment SACLA Data Acquisition BL-Master is accountable for DAQ system and movers. (e.g. sample changer) User Workstation (User-WS) Beamline Master Server (BL-Master) Beamline Workstation (BL-WS) BL-WS is accountable for X-ray optics control. If instrument belongs to SACLA Control, BL- Master forward control message to BL- WS.(e.g. open shutter) Experimental users send control message to BL-Master. (e.g. start DAQ, sample change, open shutter…)

2. Segregate LANs based on purpose 30 Camera DAQ ServersStorage Undulator Shutter Focusing Shutter Sample Changer SACLA Control SACLA Experiment SACLA Data Acquisition BL-Master is accountable for DAQ system and movers. (e.g. sample changer) User Workstation (User-WS) Beamline Master Server (BL-Master) Beamline Workstation (BL-WS) BL-WS is accountable for X-ray optics control. If instrument belongs to SACLA Control, BL- Master forward control message to BL- WS.(e.g. open shutter) Experimental users send control message to BL-Master. (e.g. start DAQ, sample change, open shutter…)

2. Segregate LANs based on purpose 31 Camera DAQ ServersStorage Undulator Shutter Focusing Shutter Sample Changer SACLA Control SACLA Experiment SACLA Data Acquisition BL-Master is accountable for DAQ system and movers. (e.g. sample changer) User Workstation (User-WS) Beamline Master Server (BL-Master) Beamline Workstation (BL-WS) BL-WS is accountable for X-ray optics control. If instrument belongs to SACLA Control, BL- Master forward control message to BL- WS.(e.g. open shutter) Direct access from User-WS to BL-WS is forbidden. The reason are 1. To ensure control system consistency, such as status. 2. Single UI provided by BL-Master for controlling all experimental instruments. Experimental users send control message to BL-Master. (e.g. start DAQ, sample change, open shutter…)

SACLA Experimental Hall 32 XFEL FEL Each beamline passing several experimental hutches (EHs). By dividing EHs, experiments and preparation will be performed simultaneously.

EH5EH4 EH2 EH1 EH3 History and Current Status of SACLA Beamlines 33 BL3 is the first beamline, which delivers XFEL to users. (2011) BL3 EH: Experimental Hutch

EH5 EH6 EH4c EH2 EH1 EH4b EH3 History and Current Status of SACLA Beamlines 34 Fast-switched XFEL distribution BL2 is in operation. (2014) Fast-switched XFEL distribution to BL2/BL3 is started. (2015) BL3 BL2 BL3 is the first beamline, which delivers XFEL to users. (2011) EH: Experimental Hutch

EH5 EH6 EH4c EH2 EH1 EH4b EH3 EH4a History and Current Status of SACLA Beamlines 35 Fast-switched XFEL distribution Dedicated Accelerator BL3 BL2 BL1 BL2 is in operation. (2014) Fast-switched XFEL distribution to BL2/BL3 is started. (2015) BL3 is the first beamline, which delivers XFEL to users. (2011) BL1 offers more experimental opportunity to users, especially from EUV to soft X-ray FEL. (2016) EH: Experimental Hutch commissioning

EH5 EH6 EH4c EH2 EH1 EH4b EH3 EH4a History and Current Status of SACLA Beamlines 36 BL3 BL2 BL1 BL2 is in operation. (2014) Fast-switched XFEL distribution to BL2/BL3 is started. (2015) BL3 is the first beamline, which delivers XFEL to users. (2011) BL1 offers more experimental opportunity to users, especially from EUV to soft X-ray FEL. (2016) EH: Experimental Hutch Under such circumstance, multi groups perform experiments and preparations, simultaneously. Preparation Experiment Preparation

EH5 EH6 EH4c EH2 EH1 EH4b EH3 EH4a History and Current Status of SACLA Beamlines 37 BL3 BL2 BL1 BL2 is in operation. (2014) Fast-switched XFEL distribution to BL2/BL3 is started. (2015) BL3 is the first beamline, which delivers XFEL to users. (2011) BL1 offers more experimental opportunity to users, especially from EUV to soft X-ray FEL. (2016) EH: Experimental Hutch Under such circumstance, multi groups perform experiments and preparations, simultaneously.  Security issue occurred Preparation Experiment Preparation

EH5 EH6 EH4c EH2 EH1 EH4b EH3 Security Issue: wrong shutter operation 38 BL3 BL2 Preparation Experiment Group-A Group-B During machine time of group-A, Shutter CLOSED ??? shutter closed suddenly.

EH5 EH6 EH4c EH2 EH1 EH4b EH3 Security Issue: wrong shutter operation 39 BL3 BL2 Preparation Experiment Group-A Group-B During machine time of group-A, shutter closed suddenly. Shutter ??? Trouble source is control message from EH5 to BL-Master. BL-Master (BL2) BL-Master (BL3) CLOSED

EH5 EH6 EH4c EH2 EH1 EH4b EH3 Security Issue: wrong shutter operation 40 BL3 BL2 Preparation Experiment Group-A Group-B During machine time of group-A, shutter closed suddenly. Shutter OPEN Trouble source is control message from EH5 to BL-Master. BL-Master (BL2) BL-Master (BL3) Another situation: People are in EH2 to check instruments. It might be a radiation accident. !!! (This situation does not occurred actually. People are protected by interlock system.)

Problem: Network Segment 41 EH5 EH6 EH4c EH2 EH1 EH4b EH3 BL3 BL2 BL-Master (BL3) BL-Master (BL2) All of EHs shared one network segment. (This design is same as SPring-8 experiment network) Since IP address of User-WS/carry-in PCs was arbitrary, the BL-Master can not distinguish message authority: “where this message come from?” User WS ???

3. Logically segmented by experimental area/unit 42 EH5 EH6 EH4c EH2 EH1 EH4b EH3 BL3 BL2 BL-Master (BL3) BL-Master (BL2) In 2014, we divided network segments corresponding to each EHs. User WS BL3-EH1 BL3-EH2BL3-EH4BL3-EH5 BL2-EH3 BL2-EH4 BL2-EH / / / / / / /23

MADOCA2 Message Routing with ACL 43 object namemanagement method WEPGF107, MATSUMOTO et al., “Multi-host Message Routing in MADOCA II” We can use IP/subnet as ACL keys

3. Logically segmented by experimental area/unit 44 EH5 EH6 EH4c EH2 EH1 EH4b EH3 BL3 BL2 BL-Master (BL3) BL-Master (BL2) User WS BL3-EH1 BL3-EH2BL3-EH4BL3-EH5 In 2014, we divided network segments corresponding to each EHs. Using MADOCA2, the BL-Master distinguish message authority, like these: BL3-Master: Accept message from BL3-EH2 “drives motor in BL3-EH2”

3. Logically segmented by experimental area/unit 45 EH5 EH6 EH4c EH2 EH1 EH4b EH3 BL3 BL2 BL-Master (BL3) BL-Master (BL2) User WS BL3-EH1 BL3-EH2BL3-EH4BL3-EH5 In 2014, we divided network segments corresponding to each EHs. Using MADOCA2, the BL-Master distinguish message authority, like these: BL3-Master: Accept message from BL3-EH2 “drives motor in BL3-EH2” BL3-Master: Discard message from BL3-EH5 “open shutter of BL3-EH1”

3. Logically segmented by experimental area/unit 46 EH5 EH6 EH4c EH2 EH1 EH4b EH3 BL3 BL2 BL-Master (BL3) BL-Master (BL2) User WS BL3-EH1 BL3-EH2BL3-EH4BL3-EH5 In 2014, we divided network segments corresponding to each EHs. Using MADOCA2, the BL-Master distinguish message authority, like these: BL3-Master: Accept message from BL3-EH2 “drives motor in BL3-EH2” BL3-Master: Discard message from BL3-EH5 “open shutter of BL3-EH1” BL3-Master: Accept message from BL3-EH5 “drives motor in BL3-EH5”

3. Logically segmented by experimental area/unit 47 EH5 EH6 EH4c EH2 EH1 EH4b EH3 BL3 BL2 BL-Master (BL3) BL-Master (BL2) In 2014, we divided network segments corresponding to each EHs. User WS BL3-EH1 BL3-EH2BL3-EH4BL3-EH5 Firewall offers more essential filters. “Drop packets from BL3-EH5 to BL2-Master” Using MADOCA2, the BL-Master distinguish message authority, like these: BL3-Master: Accept message from BL3-EH2 “drives motor in BL3-EH2” BL3-Master: Discard message from BL3-EH5 “open shutter of BL3” BL3-Master: Accept message from BL3-EH5 “drives motor in BL3-EH5”

4. Physically segmented by beamlines 48 MPCCD SACLA BL2 Data handling Servers Tier-1 Storage Experimental Hall Computer Room SACLA BL3 Data Flow Each beamline occupies dedicate physical network from detector frontend to Tier- 1 storage. The data-handling servers are used for buffering (several seconds). In addition, on-the-fly low-level filtering are performed using the data-handling servers. ICALEPCS2013 TUPPC015, San Francisco

EH5 EH6 EH4c EH2 EH1 EH4b EH3 EH4a Summary 49 Fast-switched XFEL distribution Dedicated Accelerator BL3 BL2 BL1 commissioning SACLA Experimental Network Policy 1.No internet connectivity 2.Segregate LANs based on purpose 3.Logically segmented by experimental area/unit, to perform multi- beamline experiments 4.Physically segmented by beamlines to guaranty DAQ performance We are ready to perform multi-beamline simultaneous experiments at BL1/BL2/BL3 (and BL4/BL5 in the future).