Unified software development approach for the safety-critical ITER maintenance devices

The RH devices used for ITER divertor maintenance are movers or manipulators composed of electro-hydraulic and electrical actuators. Such devices are CMM, CTM and WHMAN to assist CMM and CTM. These devices execute complex and safety-critical operations while supporting ITER reactor elements weighting several tons. Despite the differences in the load capacity and functionality, the control system of these devices can be categorized as position servo control or force servo control. In this paper we propose the use of unified software development approach currently developed and demonstrated at the DTP2. This new approach takes into account the ITER RH requirements for all maintenance devices, not only the water-hydraulic maintenance devices. The need for extensive software verification and validation utilizing international standards for safety-critical systems is addressed. This applies both to control software architecture and user interface design. In principle, we propose that all ITER maintenance devices are developed and tested with the common software architecture and user interface. This makes it possible to reuse generic software modules that are well documented and tested, resulting decreased verification and validation period and development cost. Utilising this approach also improves reliability and safety of the maintenance operations.     

ITER remote maintenance system configuration model overview

A challenge for the ITER project is to manage the design of many systems being developed in parallel. In order to control the machine configuration and ensure proper design integration, the ITER project has implemented the so-called “configuration management models” (CMMs), aimed at controlling and managing the machine systems’ interfaces. Specific issues are raised for modelling the ITER remote maintenance system (IRMS). That system shall provide the mean to support the remote maintenance operations for in-vessel components, remote transfer of activated components between the vacuum vessel (VV) and the hot cell facility and remote repairing, refurbishing and/or processing operations in the hot cell facility.The IRMS are dynamic, constantly changing morphologies, working envelopes and locations within the plant. This raises the issue of how to integrate the dynamic nature of this equipment into the CMM required for design integration. This paper describes the design methodology that is being developed to address the specific nature of the IRMS in the building of the CMM and gives examples to demonstrate the benefits to be gained by adopting this approach.     

ITER prototype fast plant system controller

ITER CODAC Design identified the need for slow and fast control plant systems, based respectively on industrial automation technology with maximum sampling rates below 100 Hz, and on embedded technology with higher sampling rates and more stringent real-time requirements. The fast system is applicable to diagnostics and plant systems in closed-control loops whose cycle times are below 1 ms. Fast controllers will be dedicated industrial controllers with the ability to supervise other fast and/or slow controllers, interface to actuators and sensors and high performance networks (HPN).This contribution presents the engineering design of two prototypes of a fast plant system controller (FPSC), specialized for data acquisition, constrained by ITER technological choices. This prototyping activity contributes to the Plant Control Design Handbook (PCDH) effort of standardization, specifically regarding fast controller characteristics. The prototypes will be built using two different form factors, PXIe and ATCA, with the aim of comparing the implementations. The presented solution took into consideration channel density, synchronization, resolution, sampling rates and the needs for signal conditioning such as filtering and galvanic isolation. The integration of the two controllers in the standard CODAC environment is also presented and discussed. Both controllers contain an EPICS IOC providing the interface to the mini-CODAC which will be used for all testing activities. The alpha version of the FPSC is also presented.     

Generic control system design for the Cassette Multifunctional Mover and other ITER remote handling equipment

A new suite of Remote Handling (RH) equipment, addressing the latest design of the divertor region, is currently being specified for ITER, with procurement of the Cassette Multifunctional Mover (CMM) scheduled for 2005–2006. This presents a unique opportunity to address a vital component of the RH system – the control system – and this paper introduces a number of concepts based on replication of design and implementation for functionally similar RH systems. Correctly implemented, this should improve equipment availability and reliability, reduce overall support requirements, and minimise the risks of serious failure.     

Design and application of an EPICS compatible slow plant system controller in J-TEXT tokamak

J-TEXT tokamak has recently implemented J-TEXT COntrol, Data Access and Communication (CODAC) system on the principle of ITER CODAC. The control network in J-TEXT CODAC system is based on Experimental Physics and Industrial Control System (EPICS). However, former slow plant system controllers in J-TEXT did not support EPICS. Therefore, J-TEXT has designed an EPICS compatible slow controller. And moreover, the slow controller also acts the role of Plant System Host (PSH), which helps non-EPICS controllers to keep working in J-TEXT CODAC system. The basic functionalities dealing with user defined tasks have been modularized into driver or plug-in modules, which are plug-and-play and configured with XML files according to specific control task. In this case, developers are able to implement various kinds of control tasks with these reusable modules, regardless of how the lower-lever functions are implemented, and mainly focusing on control algorithm. And it is possible to develop custom-built modules by themselves. This paper presents design of the slow controller. Some applications of the slow controller have been deployed in J-TEXT, and will be introduced in this paper.     

Simulation-based design process for the verification of ITER remote handling systems

The work behind this paper takes place in the EFDA's European Goal Oriented Training programme on Remote Handling (RH) “GOT-RH”. The programme aims to train engineers for activities supporting the ITER project and the long-term fusion programme. One of the projects of this programme focuses on the verification and validation (V&V) of ITER RH system requirements using digital mock-ups (DMU). The purpose of this project is to study and develop efficient approach of using DMUs in the V&V process of ITER RH system design utilizing a System Engineering (SE) framework. Complex engineering systems such as ITER facilities lead to substantial rise of cost while manufacturing the full-scale prototype. In the V&V process for ITER RH equipment, physical tests are a requirement to ensure the compliance of the system according to the required operation. Therefore it is essential to virtually verify the developed system before starting the prototype manufacturing phase. This paper gives an overview of the current trends in using digital mock-up within product design processes. It suggests a simulation-based process design centralized around a simulation lifecycle management system. The purpose of this paper is to describe possible improvements in the formalization of the ITER RH design process and V&V processes, in order to increase their cost efficiency and reliability.     

Architectural concept for the ITER Plasma Control System

The plasma control system is a key instrument for successfully investigating the physics of burning plasma at ITER. It has the task to execute an experimental plan, known as pulse schedule, in the presence of complex relationships between plasma parameters like temperature, pressure, confinement and shape. The biggest challenge in the design of the control system is to find an adequate breakdown of this task in a hierarchy of feedback control functions. But it is also important to foresee structures that allow handling unplanned exceptional situations to protect the machine. Also the management of the limited number of actuator systems for multiple targets is an aspect with a strong impact on system architecture. Finally, the control system must be flexible and reconfigurable to cover the manifold facets of plasma behaviour and investigation goals.In order to prepare the development of a control system for ITER plasma operation, a conceptual design has been proposed by a group of worldwide experts and reviewed by an ITER panel in 2012. In this paper we describe the fundamental principles of the proposed control system architecture and how they were derived from a systematic collection and analysis of use cases and requirements. The experience and best practices from many fusion devices and research laboratories, augmented by the envisaged ITER specific tasks, build the foundation of this collection. In the next step control functions were distilled from this input. An analysis of the relationships between the functions allowed sequential and parallel structures, alternate branches and conflicting requirements to be identified. Finally, a concept of selectable control layers consisting of nested “compact controllers” was synthesised. Each control layer represents a cascaded scheme from high-level to elementary controllers and implements a control hierarchy. The compact controllers are used to resolve conflicts when several control functions would use the same command signals as their outputs. They consist of a collection of potentially conflicting control functions from which one at a time is exclusively activated by a mode selector signal.It can be shown that this architectural design is capable of implementing all of the presently known functional control requirements. Furthermore, this design takes already into account that the result of future experiments at ITER will create additional requirements on the functions or performance of ITER plasma control.     

Design progress of the ITER blanket remote handling equipment

The ITER blanket (BL) is composed of about 400 modules in the vacuum vessel (VV). The BL has to be maintained by remote handling means due to high radiation levels in the VV after D-T operation. The remote handling (RH) equipment for BL maintenance consists of articulated rail, supports, a rail-mounted vehicle, a telescopic arm, an end-effecter, tools and related systems such as transfer casks and umbilical system.Towards the construction, the BL RH equipment design has been improved and developed in more detail, based on the 2001 FDR design. The overview of design results is introduced in this paper. The design of rail deployment system of the BL RH has been updated to enable the rail connection in the transfer cask in order to minimize occupation space at storage area. For this purpose, design work has been performed for concept, sequence and typical simulation of BL replacement in the VV and rail deployment/storage of the RH equipment in the cask, including cask docking. In particular, the technical issues of the rail connection in the cask are (1) tight tolerance of a pin at a hinge, (2) limited space for the connection inside a cask and (3) tight positioning accuracy. This paper summarizes the idea to solve these issues and the results of the design work. The paper also introduces new cable handling equipment, rail support equipment and BL module transporter.     

Study on the key technologies of the Transfer Equipment Cask for Tokamak Equator Port Plug

The Transfer Equipment Cask (TECA) is a key solution for Remote Handling (RH) in Tokamak Equator Port Plug (TEPP) operations. From the perspectives of both engineering and technical designs of effective experiments on the TEPP, key technologies on these topics covering the TECA are required. According to conditions in ITER (International Thermonuclear Experimental Reactor) and features of the TEPP, this paper introduces the design of an Intelligent Air Transfer System (IATS) with an adaptive attitude and high precision positioning that transports a cask system of more than 30 tons from the Tokamak Building (TB) to the Hot Cell Building (HCB). Additionally, different actuators are discussed, and the hydraulic power drive is eventually selected and designed. A rhombic-like parallel robot is capable of being used for docking with minimum misalignment. Practical mechanisms of the cask system are presented for hostile environments. A control architecture with several algorithms and information acquired from sensors could be used by the TECA. These designs yield realistic and extended applications for the RH of ITER.     

Results of CMM standalone tests at DTP2

A full scale physical test facility, DTP2 (Divertor Test Platform 2) has been established in Finland for demonstrating and refining the Remote Handling (RH) equipment designs for ITER. The first prototype RH equipment at DTP2 is the Cassette Multifunctional Mover (CMM) equipped with the Second Cassette End Effector (SCEE) delivered to DTP2 in October 2008. The purpose is to prove that CMM/SCEE prototype can be used successfully for the 2nd cassette RH operations. At the end of F4E grant “DTP2 test facility operation and upgrade preparation”, the RH operations of the 2nd cassette were successfully demonstrated to the representatives of Fusion for Energy (F4E).During the grant the High Level Control (HLC) software developed at DTP2 was integrated with the CMM/SCEE hardware. The performance criteria of the CMM/SCEE equipment were defined based on the ‘EN ISO 9283 Manipulating industrial robots – Performance criteria and related test methods’ standard. Considerable improvement to the performance was achieved with the aid of compensation functions, which took into account the deflections and the compliance effects caused by the Divertor Cassette weighting 9000 kg. According to measurements the positioning error at the furthest point of the cassette was reduced from 80 mm to 5 mm.So far the 2nd cassette mock-up has been installed and removed already some tens of times. The reliability of the HLC software is sufficient to operate the CMM/SCEE all day without interruptions. Also the execution of the automatic RH processes with the overall RH system is reliable and repeatable in terms of accuracy and cycle time.These experiments provide a solid basis for investigating the RH system ability to perform fail-safe operations in various failure scenarios and to recover from them. The target of the continuing R&D is to find out a more complete set of functional and non-functional requirements for the RH system for Divertor Cassette maintenance to ensure an adequate level of requirements and procedures for ITER.     

The European contribution to the ITER Remote Maintenance

For a first-of-a-kind nuclear fusion reactor like ITER, remote maintainability of neutron-activated components is one of the key aspects of plant design and operations, and a fundamental ingredient for the demonstration of long-term viability of fusion as energy source.The European Domestic Agency (EU DA, i.e. Fusion for Energy, F4E) is providing important support to the ITER Organisation (IO) in specifying the functional requirements of the Remote Handling (RH) Procurement Packages (i.e. the subsystems allocated to EU DA belonging to the overall ITER Remote Maintenance Systems IRMS), and in performing design and R&D activities – with the support of national laboratories and industries – in order to define a sound concept for these packages.Furthermore, domestic industries are being involved in the subsequent detailed design, validation, manufacturing and installation activities, in order to actually fulfil our procurement-in-kind obligations.After an introduction to ITER Remote Maintenance, this paper will present status and next stages for the RH systems allocated to EU DA, and will also illustrate complementary aspects related to cross cutting technologies like radiation tolerant components and RH control systems.Finally, the way all these efforts are coordinated will be presented together with the overall implementation scenario and key milestones.     

A method for enabling real-time structural deformation in remote handling control system by utilizing offline simulation results and 3D model morphing

A full scale physical test facility, DTP2 (Divertor Test Platform 2) has been established in Finland for demonstrating and refining the Remote Handling (RH) equipment designs for ITER. The first prototype RH equipment at DTP2 is the Cassette Multifunctional Mover (CMM) equipped with Second Cassette End Effector (SCEE) delivered to DTP2 in October 2008. The purpose is to prove that CMM/SCEE prototype can be used successfully for the 2nd cassette RH operations. At the end of F4E grant “DTP2 test facility operation and upgrade preparation”, the RH operations of the 2nd cassette were successfully demonstrated to the representatives of Fusion For Energy (F4E).Due to its design, the CMM/SCEE robot has relatively large mechanical flexibilities when the robot carries the nine-ton-weighting 2nd Cassette on the 3.6-m long lever. This leads into a poor absolute accuracy and into the situation where the 3D model, which is used in the control system, does not reflect the actual deformed state of the CMM/SCEE robot. To improve the accuracy, the new method has been developed in order to handle the flexibilities within the control system's virtual environment. The effect of the load on the CMM/SCEE has been measured and minimized in the load compensation model, which is implemented in the control system software. The proposed method accounts for the structural deformations of the robot in the control system through the 3D model morphing by utilizing the finite element method (FEM) analysis for morph targets. This resulted in a considerable improvement of the CMM/SCEE absolute accuracy and the adequacy of the 3D model, which is crucially important in the RH applications, where the visual information of the controlled device in the surrounding environment is limited.     

Developments in remote metrology at JET

The need to maximise the operational availability of fusion devices has driven the enhancements in accuracy, flexibility and speed associated with the inspection techniques used at JET. To this end, the remote installation of the ITER-Like Wall (ILW) tiles, conduits and embedded diagnostics has necessitated the adoption of technologies from other industries for their use in conjunction with the JET Remote Handling (RH) system. The novel adaptation of targetless stereophotogrammetry, targeted single-camera photogrammetry and gap measurement techniques for remote applications has prompted a range of challenges and lessons learnt both from the design process and operational experience.Interfacing Commercial Off-The-Shelf (COTS) components with the existing RH equipment has highlighted several issues of relevance to the developing ITER RH system. This paper reports results from the stereophotogrammetry and the single-camera photogrammetry surveys, allowing analysis of the effectiveness of the RH system as a platform for in-vessel measurement. This includes scrutiny of the accuracy achieved with each technique as well as the impact on the in-vessel Configuration Management Model (CMM). The paper concludes with a summary of key recommendations for the ITER RH system based on the experience of remote metrology at JET.     

Improving the performance of DTP2 bilateral teleoperation control system with haptic augmentation

The remote maintenance of the ITER divertor is largely dependent on the usage of haptically teleoperated manipulators and man-in-the-loop operations. These maintenance operations are very demanding for the manipulator operators, yet vital for the success of the whole ITER experiment. Haptic shared control of the maintenance manipulators offers a promising solution for assisting the teleoperators in the maintenance tasks. A shared control system assists the operator by generating artificial guiding force effects and overlaying them on top of the haptic feedback from the teleoperation environment.An experimental haptic shared control system, called the Computer Assisted Teleoperation (CAT) has been developed at the Divertor Test Platform 2 (DTP2). In this paper, we investigate the design of the system and how the system integrates with the ITER compliant DTP2 prototype Remote Handling Control System (RHCS). We also experimentally assess the effect of the guidance to the operator performance in an ITER-relevant maintenance scenario using the Water Hydraulic MANipulator (WHMAN), which is specially designed for the divertor maintenance. The result of the experiment gives suggestive indication that the CAT system improves the performance of the operators of the system.     

FTU toroidal magnet power supply slow control using ITER CODAC Core System

FTU (Frascati Tokamak Upgrade) three-level slow control system has undergone several enhancements during its lifetime, involving essentially the supervisory and medium level, while the lower level is still mainly based on old Westinghouse Numalogic PLCs (Programmable Logic Controller). The legacy PLC controlling the toroidal magnet flywheel generator, named MFG1, is now being replaced with a more modern Siemens Simatic S7 PLC, because of its versatility an the ability to be integrated via standard networking protocol.The upgrade to this family of Siemens PLCs, which in the meantime has been selected as standard by ITER CODAC, has made MFG1 slow control an ideal candidate to deploy ITER CODAC software technologies and architecture to a running plant in an operating tokamak environment. A project has thus been started to port MFG1 control to ITER CODAC I&C architecture using the software package CODAC Core System to interface the PLC with the ITER standard systems for instrumentation and control, Plant System Host (PSH) and Mini-CODAC, developing dedicated HMI (Human–Machine Interface) and realizing the communication layer between MFG1 plant system and FTU supervisor.This paper will give a full account of the project and will report the results that have been obtained up to now, focusing also on the definite advantages provided by a distributed control architecture compared to the supervisor-dependent one still running at FTU, in view of future fusion devices.     

A functional approach for managing ITER operations

ITER is currently the most ambitious project on nuclear fusion research. Its objective is to demonstrate the feasibility of fusion as an energy source for the future. The complexity of the systems required to meet this challenge present many opportunities for omissions or incorrect assumptions. System engineering allows the engineer to deal with such a complexity by developing a Functional Breakdown Structure (FBS). Unlike a Plant Breakdown Structure (PBS), the FBS is a function-oriented tree, not a product-oriented tree. It details operations or activities that have to be performed as needed functions of the architecture, allowing identification of any missing elements, defining the personnel skills required to operate the architecture and managing the machine availability.     

Software fault detection and recovery in critical real-time systems: An approach based on loose coupling

Remote handling (RH) systems are used to inspect, make changes to, and maintain components in the ITER machine and as such are an example of mission-critical system. Failure in a critical system may cause damage, significant financial losses and loss of experiment runtime, making dependability one of their most important properties. However, even if the software for RH control systems has been developed using best practices, the system might still fail due to undetected faults (bugs), hardware failures, etc. Critical systems therefore need capability to tolerate faults and resume operation after their occurrence. However, design of effective fault detection and recovery mechanisms poses a challenge due to timeliness requirements, growth in scale, and complex interactions. In this paper we evaluate effectiveness of service-oriented architectural approach to fault tolerance in mission-critical real-time systems. We use a prototype implementation for service management with an experimental RH control system and industrial manipulator. The fault tolerance is based on using the high level of decoupling between services to recover from transient faults by service restarts. In case the recovery process is not successful, the system can still be used if the fault was not in a critical software module.