# Draft:

# The TTF2 / XFEL RF Station Interlock: 

# Requirements and Implementation

## 

## Introduction

**The main Task of the Interlock System is to prevent any damage from
the components of a TTF2/XFEL RF station.**

The implementation of the interlock system should guarantee a maximum
time of operation of the RF stations which implies the implementation of
self diagnostic and repair strategies on module basic.

**Additional Tasks are**

-   Collection and temporary storage of status information of the
    individual channels of the interlock system; transfer of this
    information to the Control system

-   Some Slow control functions; e.g. HV setting and monitoring

-   Control outputs to other subsystems

## Requirements

## System Description

The TTF2/XFEL RF station consists of several units which are specified,
designed, assembled, in­stalled, and commissioned by different DESY
groups and external companies.

  -------------------------------------------------- --------------------
  RF-Subsystem                                       Reponsibility

  AC Power Connection                                MKK

  HV Power supply (HV-PS)                            MKK

  Pulse former (Modulator)                           PPT

  HV transmission line                               MKK

  Pulse transformer (PT)                             ABB

  Klystron                                           Thales

  RF-Distribution                                    MHF-p

  Low Level RF (LLRF)                                MHF-p

  Klystron-Auxiliaries                               MHF-p
  -------------------------------------------------- --------------------

For TTF2 and XFEL the HV-PS and the Modulator will form Unit 1, and the
PT and the Klystron will form Unit 2. In the actual planning for XFEL
Unit 1 will be installed in the service buidlings while Unit 2 will be
installed in the tunnel. This is also true for TTF2 with the exception
that Klystrons not installed in the tunnel will be close to Unit 1. Both
units will be separated by a short HV transmission line. The HV-PS and
the Modulator will be controlled by their own control units with
separate power supplies.

**HV Power Supply**

The HV Power supply will provide an output voltage of 0-12 KV which is
regulated to ensure that the capacitor bank of the Modulator is charged
to the correct voltage while maintaining constant load on the mains. The
load of the mains will be constant and not depend on voltage settings,
pulse duration and pulse repetition rate.

**Modulator**

The Modulator will discharge a fraction of the energy stored in the
capacitor bank into the pulse transformer. A bouncer circuit will ensure
that the 120 kV high voltage output pulse will be flat i.e. the voltage
drop should not exceed some predefined level.

**HV Transmission Line**

HV transmission line connects the Modulator with the pulse transformer.
For the installation in the tunnel the transmission line will have a
length of about 100 m while all other installation will use a short
connection of a few meters.

**Pulse Transformer**

The pulse transformer will transform the 12 kV, 1200 A pulse from the
Modulator to the the 120 kV, 120 A pulse driving the Klystron cathode
voltage.

**Persons and machine safety systems**

Several personnel and machine safety systems are interacting together to
provide a safe operation of the whole system (see Fig. 1). Hardware
status can be monitored by the TTF2 control system.

**Low Level RF System (LLRF)**

## 

## Sources of Interlock Error Signals

-   hard component failures (non-reversible hardware malfunction): e.g.
    broken cable or damaged contact, dead sensor etc.

-   soft errors: e.g. sparks in the klystron or in the wave guide
    system, temperature above the threshold

-   transient error (conditions caused by transient noise from the RF
    station during its operation)

## Input signals to the Interlock

-   **Digital Inputs**

> \- Oil levels
>
> \- Cooling water flow
>
> \- Vacuum pump current

-   **Analog Inputs**

> \- Oil temperature
>
> \- Cooling water temperature
>
> \- Heater current
>
> \- Solenoid current
>
> \- SF6 gas pressure (wave guide system)

-   **Inputs from other subsystems**

> \- Persons interlock
>
> \- Gun interlock
>
> \- Reflected Power Meter
>
> \- RF leakage detector
>
> \- Spark detector
>
> \- Modulator ready
>
> \- Preamplifier ready
>
> \- RF system ready

## Output signals to Subsystems of the RF station

-   Modulator on

-   Heater power supply on

-   Solenoid power supply on

-   RF enable

## Response Times

-   Ultra Fast (**U**): Rt \< 1 µs

-   Fast (**F**): Rt = 1 \... 5 µs

-   Normal (**N**): Rt \> 5 µs

## Channel Masking

For any individual input channel a mask function should be implemented
which allows to exclude this channel from all of the interlock
functions. This is useful for debugging the system and for maintaining
different interlock configurations.

The list of TTF2/XFEL interlock signals (see file: RF_Interlock
signals.xls)

Specifies individually for each input channel the mask function
(maskable from Control System or not). Mask operations via the control
system are secured by password mechanism. Masking operations must cause
an entry into the Logbook File.

## Thresholds

Two types of Thresholds should be implemented:

-   absolute max./min. thresholds. Any violation of these thresholds
    will force the shutdown of one ore more subsystems or switch off all
    components of the RF station.

-   Programmable (soft) thresholds. A violation of these boundaries will
    generate an alarm message to the Control System. Soft thresholds are
    only available for analog input channels

Absolute thresholds are setup at power up by hardware from a ROM. These
values can be overwritten by the control system in a way that the
condition to be checked become more restrictive, i.e. new upper
thresholds must be *lower* than the reset value, new lower thresholds
must be *higher* than the reset value. All threshold values can be read
back by the Control System.

After program start up all threshold registers are loaded with values
previously stored in the controller's on-board flash.

## Self test after power up

After power up an intensive self test has to be performed (see also
Interlock3_Systemtest.ppt) :

-   the NIOS processor of the Controller performs a check of its
    external memory

-   in parallel all slave modules incorporating a NIOS processor perform
    an internal self test

-   the NIOS processor of the Controller activates special test logic
    and continues testing all interlock related backplane
    interconnections. After that the controller searches for all
    existing slave modules in the crate and checks that they are
    configured properly

-   the controller initializes all slave modules and starts its normal
    operation

## Test during normal operation 

-   A special designed module monitors the fans, the temperature at
    various points of the crate and all voltages from the crate internal
    power supplies. These values are read out by the controller and, in
    case of some threshold violation, a warning message is sent to the
    Control System (e.g. over-temperature or fan failure).

-   In the case of a power down an interrupt is sent to the NIOS
    processor of the controller. The power supplies provide normal
    operating voltages after ac power down for min. 2 ms which is
    sufficient to read out the status of the monitor module and to store
    this information in the NVRAM of the controller. After next power up
    this information may be sent to the control system for analysis.

## Other Implementation Constraints

-   process-I/O should not use cables to/from the front side of the
    crate; all cabling must be done from rear site (constraint from
    TESLA TDR)

-   combine all Interlock functions and some Slow control functions into
    only one crate per RF-station

-   perform communication between modules via backplane (no extra cables
    for communication)

## List of interlock signals

See file: ***XFEL_Interlock signals.xls***

## Implementation Details

-   The interlock mechanics is a 19" 4U crate with dedicated backplane
    optimized to the application

-   3U CPCI-like board format is used with two 5-row connectors per
    board:

> à 125 + 110 = 235 pins to the backplane:

-   Control Bus: 50 Pins

-   Time Multiplex Bus: 16 Pins

-   Service Request lines: 20 Pins (one per slave slot)

-   Direct Out: 24 Pins

-   Front-to-rear connections: 40 Pins

An interlock system consists of 1 Controller and up to 20 I/O-Modules

**The interlock crate layout**

##  

## System Modules 

### Controller

-   Implements all interlock functions for the components of a RF
    station based on signals pre-processed locally inside the different
    IO modules.

> The interlock functions are processed fully independent of the onboard
> RISC processor

-   Controls all IO modules in the crate

-   Master of all backplane busses

-   Source of the bus timing signals

-   Incorporates a 32-bit RISC processor (NIOS-II) running a
    small-footprint RTOS to perform the different control functions and
    to implement the interface to a higher level control system:

    -   Performs some Slow control functions

    -   System check after power up or per command

    -   Implements the interface to the higher level control system

-   Onboard MRAM and Flash-memory provide the basis to store setup
    values and history of control/interlock channels non-volatile
    locally

### Digital Input/Output

-   8 Input Groups: 2 groups with 8 channels and 6 groups with 4
    channels per group:

    -   Input Voltage Range: --14 V to 40 V;

    -   Switch Detection Threshold: typical 3.75 V

    -   Programmable Wetting Current

    -   4 programmable inputs per group to Monitor 4 Switch--to--Battery
        or 4 Switch--to--Ground Switches

-   2 Output Groups with 4 channels per group:

    -   R~DS(ON)~ of 0.55 Ω (typical)

    -   Outputs are current limited (0.8 A to 2.0 A) to drive
        incandescent\
        lamps

    -   Output voltage clamp is +45 V and -20 V (typical) during
        inductive switching

    -   Short circuit detect and current limit with automatic retry

    -   Independent overtemperature protection

-   Each group is DC-decoupled from all other groups and the rest of the
    board

-   The module incorporates an interface to the interlock hardware

### Analog Input/Output 

-   4 groups of 4 channels each:

-   2 output channels (based on a 16 bit DAC) and 2 input channels
    (based on a 16 bit ADC)

-   Voltage range for input and output is 0 ... 10V

-   Outputs are buffered to drive 600 Ω loads

-   Conversion time is: tbd

-   integrated self test possibility: each voltage output can be
    connected (via an analog switch) to a corresponding voltage input

-   Each group is DC-decoupled from all other groups and the rest of the
    board

    1.  **Digital IO for Light Links**

    -   Versatile Link or ST style connectors

    -   Basic card: 4x Input + 4x Output (both Versatile Link) + max. 2
        piggyback's

    -   Piggyback with Versatile Link style Connectors:

> either 8x Output
>
> or 8x Input
>
> or 4x Input & 4x Output

-   piggyback with ST type connectors:

> 3x Input & 3x Output

-   This module incorporates an interface to the interlock hardware

# Analog Input Module with Window Comparator Functionality

-   36 analog inputs; 32 of them are fed via programmable window
    comparators

-   two versions: -

    -   current input: 4\...20 mA; Label **A**

    -   voltage input: 0\...+10 V; Label **V**

-   Sample rate: all 36 inputs are updated within 1 ms

-   Sensor excitation from internal +12 V; optional +24 V

-   Accuracy : ± 0,5 K guaranteed, typically better than ± 0,1 K

-   Resolution for interlock : 0,1 K

-   Drift with temperature : \< 100 ppm which is 0,1 % / 10 K, not
    compensated

-   access to all data and control registers via the **Control Bus**

-   This module incorporates an interface to the interlock hardware

## Control Functions

-   Setup of all operation parameters

-   Managing the Klystron-HV:

```{=html}
<!-- -->
```
-   Set voltage level and current value for the Klystron power supplies

> (heater, solenoid, bias) and monitor these values

-   vacuum control (voltage and current settings and monitoring)

-   control of the start-up procedure

-   monitoring the purveyance

-   implementation of procedures aiming to increase the life-time of the
    Klystron

```{=html}
<!-- -->
```
-   LLRF -- high power part

```{=html}
<!-- -->
```
-   check of modulator status, power meters, preamplifier status, spark
    detectors, leakage detectors

```{=html}
<!-- -->
```
-   Masking operations

## Interface to a higher level Control System

The Controller incorporates a 32-bit RISC processor (called NIOS). The
program running on this processor performs all necessary control
functions to all slave modules in the interlock crate. The interface to
the Control System is implemented via Ethernet. A TINE server runs on
the NIOS processor and provides an interface to a DOOCS client.

The following applies to the interface Controller -- DOOCS:

-   All status information and all mask data will be implemented as
    properties in the context of TINE

-   All actual values of analog input channels are implemented as
    properties

-   All commands to the interlock crate (to the controller) are
    implemented as DOOCS properties and may be issued by a DOOCS server

-   The actual values of the data mentioned above have to be stored in
    the DOOCS History Format

-   

## Design documents

-   RF_Interlock_signals.xls

-   Control Bus Interface for Interlock3 Slaves.doc

-   Interlock3_Systemtest.ppt

-   XFEL_interlock_Arch.ppt