ICALEPCS2011 - List of Authors (Vergara-Fernandez, A.)

Paper

Title

Page

News from ITER Controls - A Status Report

1

A. Wallander, L. Abadie, F. Di Maio, B. Evrard, J-M. Fourneron, H.K. Gulati, C. Hansalia, J.Y. Journeaux, C.S. Kim, W.-D. Klotz, K. Mahajan, P. Makijarvi, Y. Matsumoto, S. Pande, S. Simrock, D. Stepanov, N. Utzel, A. Vergara-Fernandez, A. Winter, I. Yonekawa
ITER Organization, St. Paul lez Durance, France

Construction of ITER has started at the Cadarache site in southern France. The first buildings are taking shape and more than 60 % of the in-kind procurement has been committed by the seven ITER member states (China, Europe, India, Japan, Korea, Russia and Unites States). The design and manufacturing of the main components of the machine is now underway all over the world. Each of these components comes with a local control system, which must be integrated in the central control system. The control group at ITER has developed two products to facilitate this; the plant control design handbook (PCDH) and the control, data access and communication (CODAC) core system. PCDH is a document which prescribes the technologies and methods to be used in developing the local control system and sets the rules applicable to the in-kind procurements. CODAC core system is a software package, distributed to all in-kind procurement developers, which implements the PCDH and facilitates the compliance of the local control system. In parallel, the ITER control group is proceeding with the design of the central control system to allow fully integrated and automated operation of ITER. In this paper we report on the progress of design, technology choices and discuss justifications of those choices. We also report on the results of some pilot projects aiming at validating the design and technologies.

Slides MOBAUST01 [4.238 MB]

WEPMU006

Architecture for Interlock Systems: Reliability Analysis with Regard to Safety and Availability

1058

S. Wagner, A. Apollonio, R. Schmidt, M. Zerlauth
CERN, Geneva, Switzerland
A. Vergara-Fernandez
ITER Organization, St. Paul lez Durance, France

For accelerators (e.g. LHC) and other large experimental physics facilities (e.g. ITER), the machine protection relies on complex interlock systems. In the design of interlock loops, the choice of the hardware architecture impacts on machine safety and availability. While high machine safety is an inherent requirement, the constraints in terms of availability may differ from one facility to another. For the interlock loops protecting the LHC superconducting magnet circuits, reduced machine availability can be tolerated since shutdowns do not affect the longevity of the equipment. In ITER's case on the other hand, high availability is required since fast shutdowns cause significant magnet aging. A reliability analysis of various interlock loop architectures has been performed. The analysis based on an analytical model compares a 1oo3 (one-out-of-three) and a 2oo3 architecture with a single loop. It yields the probabilities for four scenarios: (1)- completed mission (e.g., a physics fill in LHC or a pulse in ITER without shutdown triggered), (2)- shutdown because of a failure in the interlock loop, (3)- emergency shutdown (e.g., after a quench of a magnet) and (4)- missed emergency shutdown (shutdown required but interlock loop fails, possibly leading to severe damage of the facility). Scenario 4 relates to machine safety and together with scenarios 2 and 3 defines the machine availability reflected by scenario 1. This paper presents the results of the analysis on the properties of the different architectures with regard to machine safety and availability.

Paper	Title	Page
MOBAUST01	News from ITER Controls - A Status Report	1
	A. Wallander, L. Abadie, F. Di Maio, B. Evrard, J-M. Fourneron, H.K. Gulati, C. Hansalia, J.Y. Journeaux, C.S. Kim, W.-D. Klotz, K. Mahajan, P. Makijarvi, Y. Matsumoto, S. Pande, S. Simrock, D. Stepanov, N. Utzel, A. Vergara-Fernandez, A. Winter, I. Yonekawa ITER Organization, St. Paul lez Durance, France
	Construction of ITER has started at the Cadarache site in southern France. The first buildings are taking shape and more than 60 % of the in-kind procurement has been committed by the seven ITER member states (China, Europe, India, Japan, Korea, Russia and Unites States). The design and manufacturing of the main components of the machine is now underway all over the world. Each of these components comes with a local control system, which must be integrated in the central control system. The control group at ITER has developed two products to facilitate this; the plant control design handbook (PCDH) and the control, data access and communication (CODAC) core system. PCDH is a document which prescribes the technologies and methods to be used in developing the local control system and sets the rules applicable to the in-kind procurements. CODAC core system is a software package, distributed to all in-kind procurement developers, which implements the PCDH and facilitates the compliance of the local control system. In parallel, the ITER control group is proceeding with the design of the central control system to allow fully integrated and automated operation of ITER. In this paper we report on the progress of design, technology choices and discuss justifications of those choices. We also report on the results of some pilot projects aiming at validating the design and technologies.
	Slides MOBAUST01 [4.238 MB]

WEPMU006	Architecture for Interlock Systems: Reliability Analysis with Regard to Safety and Availability	1058
	S. Wagner, A. Apollonio, R. Schmidt, M. Zerlauth CERN, Geneva, Switzerland A. Vergara-Fernandez ITER Organization, St. Paul lez Durance, France
	For accelerators (e.g. LHC) and other large experimental physics facilities (e.g. ITER), the machine protection relies on complex interlock systems. In the design of interlock loops, the choice of the hardware architecture impacts on machine safety and availability. While high machine safety is an inherent requirement, the constraints in terms of availability may differ from one facility to another. For the interlock loops protecting the LHC superconducting magnet circuits, reduced machine availability can be tolerated since shutdowns do not affect the longevity of the equipment. In ITER's case on the other hand, high availability is required since fast shutdowns cause significant magnet aging. A reliability analysis of various interlock loop architectures has been performed. The analysis based on an analytical model compares a 1oo3 (one-out-of-three) and a 2oo3 architecture with a single loop. It yields the probabilities for four scenarios: (1)- completed mission (e.g., a physics fill in LHC or a pulse in ITER without shutdown triggered), (2)- shutdown because of a failure in the interlock loop, (3)- emergency shutdown (e.g., after a quench of a magnet) and (4)- missed emergency shutdown (shutdown required but interlock loop fails, possibly leading to severe damage of the facility). Scenario 4 relates to machine safety and together with scenarios 2 and 3 defines the machine availability reflected by scenario 1. This paper presents the results of the analysis on the properties of the different architectures with regard to machine safety and availability.