ITER_D_32GEBH v2.5 2 PHYSICAL ARCHITECTURE Any plant system I&C is made up of a set of standard components. These standard components can be selected and combined in different ways to address the particular plant system I&C characteristics and requirements. The set of components can be viewed like Lego biocks to be assembled by the plant system 18C designer. Figure 2-tillustrates how the plant system I&C components can be connected to the central I&C networks. Normally a particular plant system I&C does not require all shown connections, Hardwired connections used by interlock discharge loop and nuclear eafety are not shown, = = a Lo =e] | =) see ge | 1&C ‘Signal Signe! Signal Signal ‘Signal =) [ee] [c=] [=] [ee 41 q] | q] +1 Figure 2-1 Network connections of plant system 1&C The baseline physical network topology is flat, ie. all non-safety components are connected to the Plant Operation Network (PON) via a switch as illustrated in Figure 2-2. Although it is possible to physically Connect components in a hierarchical way using prvate networks, this is not recommended since it will make remote maintenance more difficult, For example, a development station for a controller (not shown) could be connected anywhere on the PON and reach the carget controller. On the other hand a plant system may head to deploy field networke below a controller, cn example indicated ae the connection from controller 10 remote I/O in Figure 2-2. The Central Interlock’ Network (CIN) is an independent network connecting the Interlock controller to the Central Interiock System, The Central Safety System is spllt in two parts, one for ‘occupational safety and one for nuclear safety. The Central Safety Networks (CSN-OS and CSN-N) are independent segregated networks connecting safety contvollers and logic solvers to the Central Safely Systems. The High Performance Networks (HPN) are physically separated networks, which may connect to te Plant System Host and/or fast controlie's depenaing on the particular plant system I&C. The HPN lines pointing to the grey area indicate a possible connection as detailed in Chapter 3. All network connections are provided by network panels distributed throughout all ITER site buildings. Nuclear safety logic solvers Connect to CCS-N SIC cubicles in dedicated SIC rooms. Actuators, sensors and analogiie signal conditioning are considered outside the scone of plant system IRC.ITER_D_32GEBH v2.5 ‘copAe 4 —— nial Safety] ee Satomi Intro System nomncscnsancsn) —_[ ait 00NE Stem |eetntorl Par Opaaton Rete PON aoa an 8 Ras ie SE Fa ee = a conttor | | cone | | cone | [Same 1 ITT 11 111 Mo | | vena | | vente vars tare Actas and Sears Figure 2-2 IMustration of a possible plant system I&C physical architecture. Lines are cables. 2.1 OSI layer 2 switch The OSI layer 2 switch is an IO furnished standerd Ethemet switch which allows full management of the Plant Operation Network (PON). The OS! layer 2 switch is installed in a plant system I&C cubicle. There are fone or more OSI layer 2 switches in a particular plant system I&C. 2.2 Plant System Host The Plant System Host (PSH) is an IO furnished hardware and software component installed in a plant system I8C cubicle, There is one and only one PSH in a plant system I&C, The PSH runs RHEL (Red Hat Enterprise Linux) and has EPICS (Experimental Physics and Industrial Control System) soft IOC's (Input Output Controllers). It provides standard CODAC services such as health monitoring, common state ‘management, maintenance tunctions and time source, Ine PSH 1s Tully data dnven, 1. ts customized tor a particular plant system I&C by self-description. There is no plant specific code in a PSH. A PSH has no I/O. 2.3 Fast Controller A fast controller is a dedicated industrial controler implemented in PCI family form factor with PCle communication fabric installed in a plant system I&C cubicle. There may be zero, one or many fast controllers in a plant system I&C. A fast controller runs RHEL or MRG-R and has EPICS I0C’s, it acts as a channel access server and exposes process variables (PV) [RD3] to PON. A fast controller normally has VO and the IO supports a set of standard /O modules with associated EPICS drivers. A fast controller may have interfaces to high performance nelworks (HPN), ie. the Synchronaus Ratabus Netwark (SPN) for real-time contro! and events, Time Communication Network (TCN) for absolute time synchronization andior Data ‘Archive Network (DAN) for high throughput archiving. Fast controllers involved in critical real-time operations un a real time (RT) enabied version of Linux (MRG-R) on a separate core or CPU. A fast controller can have plant-specific logic and can act as supervisor for other fast controllers and/or slow controllers, The Plant ‘System Operating State is maintained by the supervising controller. 2.4 Slow Controller A slow controller is a Siemens Simatic S7 Industrial programmable logic controller (PLC) installed in a plant system I&C cubicle. There may be zero, one of many slow controllers in a plant system I&C. A slow Conlvoller tuns soflware and plant-specinc logic programmed with Step 7 and interfaces (o ellher he PSH ut a fast controller using an IO-furished interface (EPICS driver and self description). A slow controller normally has WO and the IO supports a set of standard I/O modules. A slow controller has no interface to the HPN. A slow controller can synchronize its time using NTP over PON. A slow controller can act as supervisor for other slow controllers. The Plant System Operating State is maintained by the supervising controller. 6ITER_D_32GEBH v2.5 2.5 Interlock Control r An interlock controller is a Siemens Simatic S7 FH industrial programmable logic controller (PLC) andlor a RIO FPGA controller installed in a plant system 1&C cubicle, possibly with hardwired logic for high performance protection functions. There may be zero, one or many interlock controllers in a plant system TEC. An interlock controller runs software and plant specific logic programmed with Stop 7 or LabVIEW FPGA, interfaces to the Central Interiock System via CIN and to PSH via PON for non-critical data. An interlock controller normally has 1/0 and 10 suppatts a set of standard IjO modules. An interlock controller can act as supervisor for other interlock controllers. 2.6 Occupational Safety Controller The technology for occupational safety controllers s identical to Siemens Interlock Controller. There may be ze‘o, one or many occupational safety controllers in a plant system I&C. An occupational safety controller has I/O and IO supports a set of standard /O modules. 2.7 Nuclear Safety Logic Solvers ‘A nuclear safety logic solver is a Siemens Simatic S7-400F/FH PLC for SIC 2 cat C and SR cat C systems, and HIMA Planar 4 solid state for SIC 1 cat A and SIC 2 cat B systems. There may be zero, one or many ‘nuclear safety logic solvers in a plant system I&C. A nuciear safety logic solver has UO and IO supports a set of standard /O modules. 2.8 COTS Intelligent Device ‘A.COTS intaligent device is a commercial off-the-shelf controller, which implements an integrated control function, eg. a bulking management system or a power supply controler (such as inteligent electronic devices as defined by IEC 61850). A COTS inteligent device has an ethernet interface and is considered a black box in the ITER I&C System. A COTS inteligent device can be physically connected either to the OSI layer 2 switch or as a slave to a slow or fast controller. It is the responsiblity of the plant system 1&C developer to design and implement an interface, ether to a slow controller or toa fast controler. The use of 2.COTS inteligent device in 2 plant system I&C has to be approved by the IO through the deviations policy defined in [RD2]. A COTS inteligent device is not maintained by the IO. 2.9 Remote l/O ‘Aromote VO deviee is an I/O chassis, with or without intelligence, geographically acparated from other plant system I&C components. A remote 1/0 device is connected to a siow controller or fast controller via a field network or @ field bus. The IO provides a catalogue of standard remote 0 devices. An intelligent remote VO device can be a slow controller or an EPICS enabled controller viewed as a fast controller from the CODAC. ‘System / Mini-CODAC. 2.10Signal Interface ‘A signal interface is the mechanics, cabling and eectronics between the actuators/sensors/analogue signal conditioning and the controllers. Signal interfaces are described in [RDS]. 2.11 Cubicles The components (switches, PSH, fast and slow controllers, part of signal interface) are embedded within Cubicles defined in an IO catalogue of products. The unit for hardware delivery between the PS suppliers and 10, Is a cubicle together with spare parts