6/1/2015TTF2/XFEL Technical Interlock1 The Design of a technical Interlock for TTF2/XFEL RF Stations H.Leich, S.Choroba, T.Grevsmühl, A.Kretzschmann, U.Schwendicke,

04/18/23 TTF2/XFEL Technical Interlock 1

The Design of a technical Interlock for TTF2/XFEL RF Stations

H.Leich, S.Choroba, T.Grevsmühl, A.Kretzschmann, U.Schwendicke, R.Wenndorff

DESY, Germany

Joint project: DESY Hamburg and DESY Zeuthen People involved:

S. Choroba, T. Grevsmuehl, J. Kahl, F.R. Kaiser,

K. Rehlich, O. Hensler

(DESY Hamburg )A. Kretzschmann, H. Leich, U. Schwendicke, R. Wenndorff,

G. Trowitzsch, S. Weisse(DESY Zeuthen)


Sources of Interlock Error Signals

• Hard component failures (non-reversible hardware malfunction)

--> broken cable or damaged contact, dead sensor, ...

• Soft errors (e.g. sparks in the klystron or wave guide system,

temperature above a threshold, ...)

• Error conditions caused by transient noise from the RF station itself

Main Task of the Interlock Sytem Guarantee the operator/other persons safety

Prevent any damage from the cost expensive components of the RF station

Also prevent any damage from other environment

Collect status information of all components of the RF station and send this information to the main Slow Control System


Components of a TTF2/XFEL RF Station

HV Power Supply• Provide the input voltage of 1-12 KV to the capacitor bank of the Modulator

Modulator• Discharges a fraction of the energy stored in the capacitor bank into the pulse

transformer. A bouncer circuit will ensure that the 120 kV high voltage output pulse will be flat i.e. voltage drop will not exceed some predefined level.

HV Transmission Line• Connects the Modulator with the pulse transformer.

Pulse Transformer• Transforms the 12 kV, 1200 A pulse generated by the Modulator into a 120 kV, 120 A

pulse driving the Klystron cathode voltage.

Persons and machine safety systems, control electronics• Several personnel and machine safety systems are interacting together to provide a

safe operation of the whole system

Low Level RF System (LLRF)


Analog Process Input

Sensor Sensor

Components of the RF Station

Process Analysis

Digital Process Input

Output to Process

Analog Output

Digital Output

Adapter Unit Adapter Unit

Interlock System Architecture

Interlock Controller

Higher Level Control System (DOOCS)

Strictly hierarchical Architecture


…Slave

Module

Hardwired Interlock

Logic

32 Bit RISC CPU

(NIOS-II)Slave

Module

Slave Expansion Board (optional)

Interlock Controller

Backplane

Processor Bus,

Interrrupt and misc. Busses

Pure Hardware

Progr. Processor

Architecture Overview

Interlock Status Bus


19” 4U System with dedicated backplane optimized to the application

3U-Eurocard board format with two 5-Row connectors (CPCI type): 125 + 110 = 235 pins

enough pin resources per slot and to build a compact interlock/control system• Front-to-rear connections: 40 Pins

• Control Bus: 50 Pins

• Time Multiplex Bus: 16 Pins

• Service Request lines: 20 Pins (one per slave slot)

• Direct Digital Out: 24 Pins

Data throughput: • Control Bus: 15 MBytes/s• Time Mux Bus: updates 128 Interlock

Status Signals within 1µs

The Implementation


Structure of the Interlock Crate Bus System

Interlock Controller:

Time-Mux-Bus: 16 Control-Bus: 50Service Request: 20Direct IO: 24Serial Bus (SPI): 4dedicated lines for system test: 2(all lines LVTTL,Clock - LVDS)

I/O - &

other Modules

Time-Multiplex-Bus

Control-Bus

Serv.-Req.-Bus

BusInit, BusClock

Power, SPI, Reserve

Additional spare lines at backplane for free use by other (future) components / systems

Direct Data Out


Interlock Inputs

• Digital Inputs

- Oil levels

- Cooling water flow

-Vacuum pump current

• Analog Inputs

- Oil temperature

- Cooling water temperature

- Klystron Filament voltage & current

- Solenoid voltage & current

- SF6 gas pressure


Interlock Inputs / Outputs

• Inputs from other Subsystems

- Persons interlock

- RF leakage detector

- Modulator ready

- Gun interlock

- RF system ready

• Interlock Outputs- Modulator on/off

- Heater power supply on

- Klystron solenoid power supply on

- RF enable


Ext

ern

al D

evic

es

NIOS-II

32-Bit RISC CPU

Internal SPI Interface

Hardwired Interlock Logic

Flash Memory

32 MByte

Cyclone-II EP2C35F484-C7

Data Bus

Interlock Direct Data Out

Time Mux Bus :Address Out Data In

Cntrl Bus:Address OutStrb,WeData I/O

Inte

rloc

k B

us

Inte

rfac

es:

Con

trol

Bu

s, T

ime

Mu

ltip

lex

Bu

sS

ervi

ce R

equ

est

lin

es, …

Address Bus

SDRAM

64 MByte

RTC

(connected to SPI)

Ethernet Controller

256 KByte MRAM

Controller Architecture

Interlock Service Request

Read Interlock Status, Channel masking, …



Components to be tested:

• Controller

• Backplane

• Slaves (all installed)

• Power Supply modules and Fans

Interlock Selftest


Constraints

• After reset a test of all components is performed using a special Test Mode (System Test). Two dedicated bus lines (SysTest_A and SysTest_B) control the operations in this mode.

• If SysTest was successful the system enters the normal Interlock Mode

• In Interlock Mode all components, which are accessible from the CPU, can be tested (e.g. periodically when the HV pulse pauses)

• Simple logic – let the Controller‘s CPU do most of the jobs


Field type Field name Field length

(byte)

example

Binary Station number 1 18

Binary A/B-side flag 1 1 (B-side)

ASCII module name 24 Controller

ASCII Version # 8 1.2

ASCII Prog. File name 24 Intlk3_cntrl.pof

ASCII Prog. File date 8 051103

Modul ID Structure


The 32-bit RISC processor on the Controller board performs all necessary control functions to all slave modules in the interlock crate. The interface to the DOOCS Control System is implemented via Ethernet. A TINE server runs on the NIOS processor and provides an interface to a DOOCS client.

All status information and all mask data will be accessible as properties in the context of TINE

All actual values of analog input channels are implemented as properties

All commands to the interlock crate (to the controller) are implemented as DOOCS properties and may be issued by a DOOCS client

The actual values of the data mentioned above are stored in the DOOCS History Format

Interface to the higher level Control System


• A Fail-safe timer on the controller monitors the TINE-server operations. After it times out (if the TINE server hangs up or as a result of a special TINE command) a Web-Server is started automatically.

• The Web-server provides access to all system resources (status, masks, analog channels) but also provides the possibility to upload new software onto the controller and to reprogram the serial flash device which holds the actual FPGA configuration.

• Only authorized users are able to change flash content (program flash or FPGA configuration flash) and/or perform reset operations (Hard- or Soft-reset)

Web-Server for debugging and maintenance


Slave Module Overview:

Digital IO Light Link

Versatile Link (VL)- or ST- Connectors Basic card: 4x Input + 4x Output + max. 2 piggyback‘s piggyback: either 8x Output (VL)

or 8x Input (VL)

or 4x Input & 4x Output (VL)

or 3x Input & 3x Output (ST)


Digital Input/Output Module

8 Input Groups: 2 groups with 8 channels and 6 groups with 4 channels per group: • Input Voltage Range: –14 V to 40 V; • Switch Detection Threshold: typical 3.75 V• Programmable Wetting Current

4 programmable inputs per group to Monitor 4 Switch–to–Battery or 4 Switch-to-Ground Switches 2 Output Groups with 4 channels per group:

• RDS(ON) of 0.55 Ω (typical)• Outputs are current limited (0.8 A to 2.0 A) to drive incandescent lamps• Output voltage clamp is +45 V and -20 V (typical) during inductive switching.• Short circuit detect and current limit with automatic retry • Independent over-temperature protection

Each group is DC-decoupled from all other groups and the rest of the board The module incorporates an interface to the interlock hardware


Analog Input/Output Module

4 groups of 4 channels each: 2 output channels (based on16 bit DAC) and 2 input channels (based on 16 bit ADC) Voltage range for input and output is 0 … 10V Outputs are buffered to drive 600 Ω loads Conversion rate is: 125 kSamples/s integrated self test possibility: each voltage output can be connected (via an analog switch) to a corresponding voltage input Each group is DC-decoupled from all other groups and the rest of the board


Analog Input Module with Window Comparators

36 analog inputs; 32 of them are fed via programmable window comparators two versions:

o current input: 4...20 mA; Label Ao voltage input: 0...+10 V; Label V

Sample rate: all 36 inputs are updated within 1 ms Sensor excitation from internal +12 V; optional +24 V Accuracy : ± 0,5 K guaranteed, typically better than ± 0,1 K Resolution for interlock : 0,1 K Drift with temperature : < 100 ppm which is 0,1 % / 10 K, not compensated access to all data and control registers via the Control Bus This module incorporates an interface to the interlock hardware


TINE Server

NIOS-II processor system hardware

MicroC/OS-II

Software device drivers

HAL API

LwIP software components

TINE server BSD

sockets


Interlock WebServer – Screenshot 1


Interlock WebServer – Screenshot 2




Interlock Crate with Backplane


Interlock Controller Board (Final Version)


Light Link IO Board (ST-Conn.)


Light Link IO Board (Versatile Link)


Digital IO Board


Analog IO Board


Distribution Panel

Documents

6/1/2015TTF2/XFEL Technical Interlock1 The Design of a technical Interlock for TTF2/XFEL RF Stations H.Leich, S.Choroba, T.Grevsmühl, A.Kretzschmann, U.Schwendicke,