Implementation of ITER Fast Plant Interlock System Using FPGAs With CompactRIO

Interlocks are the instrumented functions of ITER that protect the machine against failures of the plant system components or incorrect machine operation. Regarding instrumentation and control, the interlock control system (ICS) ensures that no failure of the conventional ITER controls can lead to a serious damage of the machine integrity or availability. The ICS is in charge of the supervision and control of all the ITER components involved in the instrumented protection of the tokamak and its auxiliary systems. It is constituted by the central interlock system (CIS), different plant interlock systems (PISs), and its networks. The ICS does not include the sensors and actuators of the plant systems, but it is in charge of their control. The ITER interlock system shall be designed, built, and operated according to the highest quality standards. The international standard IEC-61508 has been chosen as the reference. In both CIS and PIS cases, two main architectures are used: 1) a slow architecture, for those functions with response time requirements slower than 100 ms (300 ms for central interlock functions), based on programmable logic controller technologies and 2) a fast architecture, based on field programmable gate array (FPGA) technologies, for the functions with faster requirement times. The proposed design for fast PIS is based on the use of reconfigurable input/output (RIO) technology from National Instruments (NI CompactRIO platform). In order to provide a high integrity solution, failure modes, effects, and diagnostic analysis (FMEDA) has been conducted to analyze the component behavior. According to the output of the FMEDA, a set of diagnostics has been defined and additional redundancy was added to the architecture to improve the integrity figures. The defined configuration has been called the “double-decker solution,” with two chassis running in parallel, communicated between them using a synchronous high-speed serial line, and using redundant modules to implement the input and output measurements/excitations and redundant analog and digital modules to implement the diagnostics of these input/output modules. The integrity figures for the “double-decker” solution are obtained from the classification of the failure rates, obtaining for different configurations a safe failure fraction of 85% and a probability of dangerous failure per hour of less than 1E−07. The FPGA design includes all the hardware to support the data acquisition from the input modules, the implementation of the diagnostic functionalities for analog and digital modules, the voting schema, and the activation/deactivation of digital outputs. The platform includes an external test platform, also based on NI CompactRIO technology, to perform the validation of the system and to register the performance of different interlock functions implemented. The response time obtained for the transistor–transistor logic (TTL) input to TTL output interlock function ranges from 5 to
$20~\mu \text{s}$
; for the analog input to TTL output, the response time is in the range of 41–
$90~\mu \text{s}$
, and for interlock functions using 24-V digital input to 24-V digital output, the time can rise up to
$643~\mu \text{s}$
.