1. System Architecture of MPSVac and MPSID
Critical Design Review for MPSVac and MPSID
Manuel Zaera-Sanz
ICS/Protection Systems Group

2. Manuel Zaera-Sanz. ICS/Protection Systems Group
Table of contents
Introduction
Signal definition for MPSVac and MPSID
Design Architecture of MPSVac and MPSID
Networking Infrastructure of MPSVac and MPSID
Conclusions and Further work
Manuel Zaera-Sanz. ICS/Protection Systems Group

3. 1. Introduction: BIS Architecture
Manuel Zaera-Sanz. ICS/Protection Systems Group

4. Introduction: Scope of MPSVac
Protect the equipment in the proton beam accelerator
against beam damage preventing the wrong machine configuration. MPSVac will not allow beam if valves are closed upstream of beam destination
Manuel Zaera-Sanz. ICS/Protection Systems Group

5. Introduction: Scope of MPSID
Protect the equipment in the proton beam accelerator
against beam damage preventing the wrong machine configuration. MPSID will not allow inserting a device upstream beam destination if the beam power is too high, or will request to stop beam if already inserted
Manuel Zaera-Sanz. ICS/Protection Systems Group

6. 2. Signal definition for MPSVac
Manuel Zaera-Sanz. ICS/Protection Systems Group

7. Signal definition for MPSVac: Architecture
Manuel Zaera-Sanz. ICS/Protection Systems Group

8. Signal definition for MPSID
Manuel Zaera-Sanz. ICS/Protection Systems Group

9. Signal definition for MPSID: Architecture
Manuel Zaera-Sanz. ICS/Protection Systems Group

10. Manuel Zaera-Sanz. ICS/Protection Systems Group
3. Design Architecture: PLC Hardware and communications for MPSVac and MPSID
Two S CPUs: Standard and Failsafe
PROFIBUS between PLC CPUs (Master/Slave) as iDevices
HMI TP 1200 (only monitoring)
Redundant powering SITOP PSU8200 (10 A) and
redundancy module SITOP PSE202U
Selectivity module SITOP PSE200U
Opt./Elect. Switches SCALANCE XC206-2SFP
PROFINET in Failsafe PLC CPU
I/O modules in ET200SP format: FDI,FDQ,FRQ,DI,DQ
Anybus CompactCom as gateway with FBIS
Technical network: Ethernet
Copper category 6A (SFTP) Patch Panel
Optical glass fibre cables (OS2, 10um)
Manuel Zaera-Sanz. ICS/Protection Systems Group

11. Design Architecture: HW Signals exchange for MPSVac
End Switches in each Vacuum Sector Gate Valve (Valve Open or Closed)
dedicated to MPSVac:
Number of switches: 2 per vacuum sector gate valve
Parameters: sensor evaluation 1oo2, non-equivalent,
short circuit test enabled, sensor supply internal (VS)
Detection of short circuit within the channel pair,
with other channels or other sensor supplies
Detection of short circuit with M to DIn
Detection of short circuit with M to VS or defective
Discrepancy error detection
Proton Beam Vacuum Interlock (PBVI) Beam Permit (PBVI VBP):
DPDT relay governed by PBVI PLC
Same parameterization of the FDI PLC module
Same detection of faults achievable
Manuel Zaera-Sanz. ICS/Protection Systems Group

12. Design Architecture: HW Signals exchange for MPSID
End Switches in each Insertable Device dedicated to MPSID (ID IN or OUT):
Number of switches per ID type: FCs(2), AS(1), WS(1), Slits(1), Grids(1), LBMs(1),GB(2)
Same Parameterization as for end-switches for vacuum sector gate valves
Same fault detection
Discrepancy error detection
Insertable Device Motion Control (IDMC) Beam Permit (IDMC BP):
DPDT relay instead of a switch governed by MC PLC
Same parameterization
Same detection of faults achievable
Cooling: same principle as above for IDMC BP
Movement Permit: FDQ governing FRQ (coupling relay) commanding a Power relay(MC)
Manuel Zaera-Sanz. ICS/Protection Systems Group

13. Design Architecture: HW Signals exchange for MPSVac and MPSID to FBIS
Hardwired current loops for “Beam Permit” and “MPSVac/MPSID Ready”:
Courtesy from Stephane Gabourin
Manuel Zaera-Sanz. ICS/Protection Systems Group

14. Design Architecture: HW Signals exchange for MPSVac and MPSID to FBIS
PROFINET signals exchange to FBIS (data link) for MPSVac and MPSID:
“Beam Permit”
“MPSVac/MPSID Ready”
Configured Beam Mode of MPSVac/MPSID
Configured Beam Destination of MPSVac/MPSID
Position of IDs (OUT or not OUT) only in the case of MPSID
“Alive”: bit toggling acting as a clock signal to FBIS
Anybus CompactCom M40: MPSs PLC “see” FBIS as a PROFINET I/O device (32 bytes I /32 bytes O)
Manuel Zaera-Sanz. ICS/Protection Systems Group

15. Design Architecture: HW Signals exchange for MPSVac and MPSID to FBIS
Requested vs. Configured Beam Mode and Beam Destination:
FBIS
Equally configured?
MPSVac
MPSVac Configured (BM,BD)
Requested (BM,BD)
Beam Allowed /
Beam Not Allowed
MPSID
MPSID Configured (BM,BD)
Manuel Zaera-Sanz. ICS/Protection Systems Group

16. Design Architecture: SW Signals exchange for MPSVac and MPSID with EPICS and Timing
MPS PLC system(MPSVac or MPSID)
- Requested Beam Mode
- Requested Beam Destination
- Commands from Operator like “ARM”
EVENT Rcv.
Gateway PLC CPU
FBIS IOC
- Monitoring data (periodically each 500ms) and archiving in EPICS (on change). May require PLC circular buffers.
- Content of PLC circular buffers archiving a “snapshot” of the MPS system (interlocks event freezes data buffer)
EPICS coms
MPS IOC
Safety Critical PLC CPU
PROFIBUS
RS485
NTP server
High availability cluster
ICS/Infrastructure
Critical SW
Manuel Zaera-Sanz. ICS/Protection Systems Group

17. Design Architecture: MPSVac and MPSID Software Architecture
Start-up process:
”Strict versioning with One single source of information for PLC + EPICS”
CCDB
VERSION X
- Configuration data of PLC: SW=Configuration Table, HW description
- Configuration data of EPICS including ALL CRCs(Configuration data of PLC)
SQL script
Configuration data of PLC
Configuration data of EPICS
PLC
EPICS
Version X
Crosscheck
(CRCs)
CRC(PLC SW=Configuration Table and HW)
CRCs(Configuration data of PLCs)
Manuel Zaera-Sanz. ICS/Protection Systems Group

18. Design Architecture: MPSVac Software Architecture
Software principle: ”Once the code is fully verified and validated, keep
the code and make it configurable by configuration tables”
“Beam Permit”:
Courtesy from Enric Bargallo
Manuel Zaera-Sanz. ICS/Protection Systems Group

19. Design Architecture: MPSVac Software Architecture
State Machine for MPSVac:
Manuel Zaera-Sanz. ICS/Protection Systems Group

20. Design Architecture: MPSID Software Architecture
Software principle: ”Once the code is fully verified and validated, keep
the code and make it configurable by configuration tables”
“Beam Permit”:
Courtesy from Enric Bargalló

21. Design Architecture: MPSID Software Architecture: “MOVEMENT PERMIT”
Courtesy from Enric Bargalló

22. Design Architecture: MPSID Software Architecture: “MOVEMENT PERMIT”
Courtesy from Enric Bargalló

23. Design Architecture: MPSID Software Architecture
State Machine for MPSID:
Manuel Zaera-Sanz. ICS/Protection Systems Group

24. 4. Networking Infrastructure of MPSVac and MPSID

25. 5. Conclusions and Further work
Failsafe Real-Time architecture of MPSVac and MPSID has been presented
Signals exchange and interfaces defined according to use cases and criticality
Solutions for MPSVac and MPSID integrated with FBIS (SW and HW)
Fixed core critical software configurable through “Configuration Tables”
Critical software designed following a formal approach: State and Output Equations
Strict Versioning with a single source of information for PLC and EPICS
Simulations and work in the MPS Lab. indicate scan cycles on the order of 100ms
Further work:
Programming, Verification and Validation of the MPSVac and MPSID for NCL
Extend to the rest of the LINAC according to Installation & Commissioning plans
Manuel Zaera-Sanz. ICS/Protection Systems Group

26. THANK YOU !!!
Courtesy from Dirk Nordt