Event generation and simulation of exception handling with the ITER PCSSP

The plasma control system simulation platform (PCSSP) for ITER shall support the analysis and development of methods to be used by the ITER plasma control system (PCS) for handling exceptions to optimize pulses and assist in machine protection. PCSSP will permit to investigate physical and technical events, such as component failures, control degradation, operation domain excess, plasma state bifurcation or instabilities, and interlock activity. Serving that purpose, the plasma, actuator, diagnostics and PCS simulation modules in PCSSP will be enhanced to compute nominal and off-normal data. Configured by an event schedule, an event generator will orchestrate the activation and manipulate the characteristics of such off-normal computation. In the simulated PCS exceptions will be handled in a pulse supervision layer operating on top of the pulse continuous control (PCC) feedback loops. It will monitor events, decide on which exceptions to respond, and compute new control references to modify PCC behavior. We discuss basic concepts for the event generation in PCSSP, and a preliminary architecture for exception handling in PCS, and show how these will be configured with event and pulse schedules.     

Physics of the conceptual design of the ITER plasma control system

The ITER plasma control system (PCS) will play a central role in enabling the experimental program to attempt to sustain DT plasmas with Q = 10 for several hundred seconds and also support research toward the development of steady-state operation in ITER. The PCS is now in the final phase of its conceptual design. The PCS relies on about 45 diagnostic systems to assess real-time plasma conditions and about 20 actuator systems for overall control of ITER plasmas. It will integrate algorithms required for active control of a wide range of plasma parameters with sophisticated event forecasting and handling functions, which will enable appropriate transitions to be implemented, in real-time, in response to plasma evolution or actuator constraints.In specifying the PCS conceptual design, it is essential to define requirements related to all phases of plasma operation, ranging from early (non-active) H/He plasmas through high fusion gain inductive plasmas to fully non-inductive steady-state operation, to ensure that the PCS control functionality and architecture will be capable of satisfying the demands of the ITER research plan. The scope of the control functionality required of the PCS includes plasma equilibrium and density control commonly utilized in existing experiments, control of the plasma heat exhaust, control of a range of MHD instabilities (including mitigation of disruptions), and aspects such as control of the non-inductive current and the current profile required to maintain stable plasmas in steady-state scenarios. Control areas are often strongly coupled and the integrated control of the plasma to reach and sustain high plasma performance must apply multiple control functions simultaneously with a limited number of actuators. A sophisticated shared actuator management system is being designed to prioritize the goals that need to be controlled or weigh the algorithms and actuators in real-time according to dynamic control needs. The underlying architecture will be event-based so that many possible plasma or plant system events or faults could trigger automatic changes in the control algorithms or operational scenario, depending on real-time operating limits and conditions.     

Actuator and diagnostic requirements of the ITER Plasma Control System

The ITER Plasma Control System (PCS) requires an extensive set of about 50 diagnostic systems to measure the plasma response and about 20 actuators to act on the plasma to carry out its control functions. The specifications and real limitations of the actuators and diagnostics are being assessed as part of the ongoing conceptual design of the PCS to understand the potential impact on plasma control. The actuators include magnetic coils (central solenoid (CS), poloidal field (PF), vertical stability (VS), edge localized mode (ELM), correction coils (CC)), heating and current drive (electron cyclotron (EC), ion cyclotron (IC), neutral beam injection (NBI), and possibly lower hybrid (LH)), glow discharge cleaning, fueling and impurity gas and pellet injection, vacuum pumping, and disruption mitigation systems. Diagnostic systems are prioritized according to their role in machine protection (MP), basic control (BC), advanced control (AC), and physics studies (PS). At the conceptual design phase, detailed control algorithms do not yet need to be specified, but conceptual solutions must be chosen that satisfy the PCS requirements for control within the real constraints of the diagnostics and actuators. The feasibility of the chosen solutions must be proven either through established control schemes on existing machines or through an R&D program to develop them before they will be required on ITER. The diagnostic and actuator requirements of the PCS will evolve from first plasma through the high performance DT phase. A comparison is made of the expected requirements to control vertical stability, sawteeth, neoclassical tearing modes (NTMs), edge localized modes (ELMs), error fields, resistive wall modes (RWMs), Alfvén eigenmodes, and disruptions with the ITER baseline actuator and diagnostic specifications.     

Towards the conceptual design of the ITER real-time plasma control system

ITER will be the world's largest magnetic confinement tokamak fusion device and is currently under construction in southern France. The ITER Plasma Control System (PCS) is a fundamental component of the ITER Control, Data Access and Communication system (CODAC). It will control the evolution of all plasma parameters that are necessary to operate ITER throughout all phases of the discharge. The design and implementation of the PCS poses a number of unique challenges. The timescales of phenomena to be controlled spans three orders of magnitude, ranging from a few milliseconds to seconds. Novel control schemes, which have not been implemented at present-day machines need to be developed, and control schemes that are only done as demonstration experiments today will have to become routine. In addition, advances in computing technology and available physics models make the implementation of real-time or faster-than-real-time predictive calculations to forecast and subsequently to avoid disruptions or undesired plasma regimes feasible. This requires the PCS design to be adaptable in real-time to the results of these forecasting algorithms. A further novel feature is a sophisticated event handling system, which provides a means to deal with plasma related events (such as MHD instabilities or L-H transitions) or component failure. Finally, the schedule for design and implementation poses another challenge. The beginning of ITER operation will be in late 2020, but the conceptual design activity of the PCS has already commenced as required by the on-going development of diagnostics and actuators in the domestic agencies and the need for integration and testing. This activity is presently underway as a collaboration of international experts and the results will be published as a subsequent publication. In this paper, an overview about the main areas of intervention of the plasma control system will be given as well as a summary of the interfaces and the integration into ITER CODAC (networks, other applications, etc.). The limited amount of commissioning time foreseen for plasma control will make extensive testing and validation necessary. This should be done in an environment that is as close to the PCS version running the machine as possible. Furthermore, the integration with an Integrated Modeling Framework will lead to a versatile tool that can also be employed for pulse validation, control system development and testing as well as the development and validation of physics models. An overview of the requirements and possible structure of such an environment will also be presented.     

ASDEX Upgrade Discharge Control System—A real-time plasma control framework

ASDEX Upgrade is a fusion experiment with a size and complexity to allow extrapolation of technical and physical conditions and requirements to devices like ITER and even beyond. In addressing advanced physics topics it makes extensive use of sophisticated real-time control methods. It comprises real-time diagnostic integration, dynamically adaptable multivariable feedback schemes, actuator management including load distribution schemes and a powerful monitoring and pulse supervision concept based on segment scheduling and exception handling. The Discharge Control System (DCS) supplies all this functionality on base of a modular software framework architecture designed for real-time operation. It provides system-wide services like workflow management, logging and archiving, self-monitoring and inter-process communication on Linux, VxWorks and Solaris operating systems. By default DCS supports distributed computing, and a communication layer allows multi-directional signal transfer and data-driven process synchronisation over shared memory as well as over a number of real-time networks. The entire system is built following the same common design concept combining a rich set of re-usable generic but highly customisable components with a configuration-driven component deployment method.We will give an overview on the architectural concepts as well as on the outstanding capabilities of DCS in the domains of inter-process communication, generic feedback control and pulse supervision. In each of these domains, DCS has contributed important ideas and methods to the on-going design of the ITER plasma control system. We will identify and describe these essential features and illustrate them with examples from ASDEX Upgrade operation.     

Architectural concept for the ITER Plasma Control System

The plasma control system is a key instrument for successfully investigating the physics of burning plasma at ITER. It has the task to execute an experimental plan, known as pulse schedule, in the presence of complex relationships between plasma parameters like temperature, pressure, confinement and shape. The biggest challenge in the design of the control system is to find an adequate breakdown of this task in a hierarchy of feedback control functions. But it is also important to foresee structures that allow handling unplanned exceptional situations to protect the machine. Also the management of the limited number of actuator systems for multiple targets is an aspect with a strong impact on system architecture. Finally, the control system must be flexible and reconfigurable to cover the manifold facets of plasma behaviour and investigation goals.In order to prepare the development of a control system for ITER plasma operation, a conceptual design has been proposed by a group of worldwide experts and reviewed by an ITER panel in 2012. In this paper we describe the fundamental principles of the proposed control system architecture and how they were derived from a systematic collection and analysis of use cases and requirements. The experience and best practices from many fusion devices and research laboratories, augmented by the envisaged ITER specific tasks, build the foundation of this collection. In the next step control functions were distilled from this input. An analysis of the relationships between the functions allowed sequential and parallel structures, alternate branches and conflicting requirements to be identified. Finally, a concept of selectable control layers consisting of nested “compact controllers” was synthesised. Each control layer represents a cascaded scheme from high-level to elementary controllers and implements a control hierarchy. The compact controllers are used to resolve conflicts when several control functions would use the same command signals as their outputs. They consist of a collection of potentially conflicting control functions from which one at a time is exclusively activated by a mode selector signal.It can be shown that this architectural design is capable of implementing all of the presently known functional control requirements. Furthermore, this design takes already into account that the result of future experiments at ITER will create additional requirements on the functions or performance of ITER plasma control.     

Breaking down the requirements: Reliability in remote handling software

Software requirements have an important role in achieving reliability for operational systems like remote handling: requirements are the basis for architectural design decisions and also the main cause of defects in high quality software. We analyze related recommendations and requirements given in software safety standards, handbooks etc. and apply them to remote handling control systems, which typically have safety-critical functionality, but are not actual safety-systems?for example the safety-systems in ITER will be hardware-based.Based on the analysis, we develop a set of generic recommendations for control system software requirements, including quality attributes, software fault tolerance, and safety and as an example we analyze ITER remote handling system software requirements to identify and present dependability requirements in a useful manner. Based on the analysis, we divide a high-level control system into safety-critical and non-safety-critical subsystems, and give examples of requirements that support building a dependable system.     

The European contribution to the ITER Remote Maintenance

For a first-of-a-kind nuclear fusion reactor like ITER, remote maintainability of neutron-activated components is one of the key aspects of plant design and operations, and a fundamental ingredient for the demonstration of long-term viability of fusion as energy source.The European Domestic Agency (EU DA, i.e. Fusion for Energy, F4E) is providing important support to the ITER Organisation (IO) in specifying the functional requirements of the Remote Handling (RH) Procurement Packages (i.e. the subsystems allocated to EU DA belonging to the overall ITER Remote Maintenance Systems IRMS), and in performing design and R&D activities – with the support of national laboratories and industries – in order to define a sound concept for these packages.Furthermore, domestic industries are being involved in the subsequent detailed design, validation, manufacturing and installation activities, in order to actually fulfil our procurement-in-kind obligations.After an introduction to ITER Remote Maintenance, this paper will present status and next stages for the RH systems allocated to EU DA, and will also illustrate complementary aspects related to cross cutting technologies like radiation tolerant components and RH control systems.Finally, the way all these efforts are coordinated will be presented together with the overall implementation scenario and key milestones.     

Study on the Flexible Support Legs for ITER Transfer Cask System

In fields of remote handing i.e. robot technology for fusion engineering reactor, such as ITER or the China fusion engineering test reactor, the flexible support legs are key components for their transfer cask system to adjust its position, joining to hot cell or tokamak ports for maintaining the fusion device. For ITER machine, each support leg should withstand maximum 50 tons load and adjust its height in 150 mm. Defect in original ITER design was presented. A new concept for the support legs was configured and its feasibility was proven. Detailed design and simulation was done for the new support leg with virtual prototype technology. Simulation results show that new support leg could not only meet all required function but also has merits of constant load during the tuning process with linear relation of control variable parameters, which is intended to be used for Tokamak reactors.     

Coupling DCS and MARTe: two real-time control frameworks in collaboration

Fusion experiments place high demands on real-time control systems. Within the fusion community two modern framework-based software architectures have emerged as powerful tools for developing algorithms for real-time control of complex systems while maintaining the flexibility required when operating a physics experiment. The two frameworks are known as DCS (Discharge Control System), from ASDEX Upgrade and MARTe (Multithreaded Application Real-Time executor), originally from JET.Based on the success of DCS and MARTe, ITER has chosen to develop a framework architecture for its Plasma Control System which will adopt major design concepts from both the existing frameworks.This paper describes a coupling of the two existing frameworks, which was undertaken to explore the degree of similarity and compliance between the concepts, and to extend their capabilities. DCS and MARTe operate in parallel with synchronised state machines and a common message logger. Configuration data is exchanged before the real-time phase. During the real-time phase, structured data is exchanged via shared memory and an existing DCS algorithm is replicated within MARTe. The coupling tests the flexibility and identifies the respective strengths of the two frameworks, providing a well-informed basis on which to move forward and design a new ITER real-time framework.     

The Design of the Plasma Control System in KTX

KTX(Keda Torus for eXperiment)is a new reversed field pinch device.The KTX plasma control system(PCS)can provide real-time,stable,flexible plasma control which is designed by ASIPP(Institute of Plasma Physics,Chinese Academy of Sciences),based on the Linux cluster system and EPICS(Experimental Physics and Industrial Control System)framework,and developed from DIII-D(Doublet III-D)PCS.The control of the equilibrium field in KTX uses a PID(Proportional-Integral-Derivative)feedback controller.The control of the gas injection is an open loop control.The plasma control simulation system is one part of the plasma control system,which is used to test the plasma control algorithm if it is revised and updated.The KTX PCS has been successfully tested using HT-7(Hefei Torus 7)experiment data in simulation mode.In the next phase,an error field feedback control and KTX simulator will be added to the KTX PCS,and the KTX PCS will be applied in experiments in the future.     

Mechanical design features and challenges for the ITER ICRH antenna

The ITER Ion Cyclotron Resonant Heating (ICRH) antenna provides plasma heating at a power of 20 MW. Operation in the ITER environment imposes significant thermal power handling capability, structural integrity, shielding and operations requirements. The design will require a step change over any predecessor in terms of power, scale and complexity. This paper reports the main mechanical design features that address the challenges and often conflicting requirements during the conceptual design phase.     

Real-time exception handling—Use cases and response requirements

Adequate real-time event detection and exception handling for machine protection and plasma optimization are important for safe and efficient operation of fusion devices. Within the scope of a layered protection hierarchy, the exception handling goals of the real-time control system are to optimize control performance, switch to alternate investigations, terminate the discharge in a controlled way, or alarm the interlock system when control is lost. Analysis of these goals shows that they can be implemented with two methods: the modification of the reference values to respond to degradation of sensors, actuators or controllers, and the replacement of schedules to perform other investigations, which includes controlled termination and interlock alarm cases. In support of these methods the sensor and evaluated data quality and the time-varying actuator characteristics and capacity must be communicated to users of those information to avoid failure propagation.     

Integrated operation of diagnostic and control systems

In fusion research the ability to generate and sustain high performance fusion plasmas gains more and more importance. Optimal combinations of magnetic shape, temperature and density profiles as well as the confinement time are identified as advanced regimes. Safe operation in such regimes will be crucial for the success of ITER and later fusion reactors. The operational space, on the other hand, is characterized by nonlinear dependencies between plasma parameters. Various MHD limits must be avoided in order to minimize the risk of a disruption.Sophisticated feedback control schemes help to tackle this challenge. But these in turn require detailed information on plasma state in time to allow proper reaction. Control system and diagnostic systems therefore must establish a symbiotic relationship to carry out such schemes. Today, all major fusion devices implement such a concept.An implementation of such a concept with sustained integration is presented using the example of ASDEX Upgrade. It covers data communication via a real-time network, synchronization mechanisms for data-driven algorithm execution as well as operational aspects and exception handling for failure detection and recovery. A modular distributed software framework offers standardized user algorithm interfaces, automated workflow procedures and the application of various computer and network hardware components. Designed with a special focus on reliability, robustness and flexibility, it is a sound base for exploring ITER-relevant plasma regimes and control strategies.     

Concept design of fusion power shutdown system for ITER

ITER is a nuclear facility. It is essential to maintain operational safety or to bring this facility to a safe state in case of accidents or incidents. During plasma operation ITER plasma will generate significant heat loads on the plasma facing components. For a few reference accidents there is the need to stop plasma reliably within a certain time. Fusion power shutdown system is the safety system to implement this termination function for ITER. It is based on the concept of massive gas injection.This paper summarizes the safety requirements, logics and the physics requirements on this system for reliable termination of ITER plasma. With regard to the quantity of gas, transient behavior simulation is shown, subsequently providing guideline for laboratory bench-testing. Conceptual engineering design of the system is given together with instrumentation and control specifications.     

Development of the simulation platform between EAST plasma control system and the tokamak simulation code based on Simulink

Plasma control system (PCS),mainly developed for real-time feedback control calculation,plays a significant part during normal discharges in a magnetic fusion device,while the tokamak simulation code (TSC) is a nonlinear numerical model that studies the time evolution of an axisymmetric magnetized tokamak plasma.The motivation to combine these two codes for an integrated simulation is specified by the facts that the control system module in TSC is relatively simple compared to PCS,and meanwhile,newly-implemented control algorithms in PCS,before applied to experimental validations,require numerical validations against a tokamak plasma simulator that TSC can act as.In this paper,details of establishment of the integrated simulation framework between the EAST PCS and TSC are generically presented,and the poloidal power supply model and data acquisition model that have been implemented in this framework are described as well.In addition,the correctness of data interactions among the EAST PCS,Simulink and TSC is clearly confirmed during an interface test,and in a simulation test,the RZIP control scheme in the EAST PCS is numerically validated using this simulation platform.     

The ITER Remote Maintenance Management System

A major challenge for the ITER project is to develop and implement a Remote Maintenance System, which can deliver high Tokamak availability within the constraints of the overall ITER programme objectives.Much of the maintenance of ITER will be performed using remote handling methods and some with combined manual and remote activities working together.The organization and management of the ITER remote handling facilities will be of a scale unlike any other remote handling application in the world.The ITER remote handling design and procurement activities will require co-ordination and management across many different sites throughout the world. It will be a major challenge for the ITER project to ensure a consistent quality and technical approach in all of the contributing parties. To address this issue the IO remote handling team are implementing the ITER Maintenance Management Plan (IMMP) comprising an overarching document defining the policies and methodologies (ITER Remote Maintenance Management System or IMMS) and an associated ITER remote handling code of practise (IRHCOP).The IMMS will be in document form available as a pdf file or similar. The IRHCOP will be implemented as a web based application and will provide access to the central resource of the entire code of practise from any location in the world. The IRHCOP data library will be centrally controlled in order that users can be assured of the data relevance and authenticity.This paper will describe the overall approach being taken to deal with this challenge and go on to detail the structure and content of both the IMMS and the IRHCOP.