OPERATOR INTERVENTION SYSTEM FOR REMOTE ACCELERATOR DIAGNOSTICS AND SUPPORTAAkito UCHIYAMAB◎ Kazuro Furukawa

CYoshihide Higurashi(A)Sokendai, (B)KEK, (C)RIKEN Nishina CenterAbstract

Large experimental physics projects, such as ITER and LHC, are typically managed by international collaboration. Similarly, the International Linear Collider(ILC), a next generation project, will be launched as a result of the collaborative eﬀorts of multiple institutes from three regions. After its collaborative commencement, all collaborators apart from the host country will need to have methods for remote maintenance, control, and monitoring of its associated devices.
For example, a method has to be provided for connecting to the control system network via wide area network (WAN) links from various collaborating institutions. However, from a practical application standpoint, the remote operation of an accelerator via WAN is beset by a number of issues. One such issue is thatthe accelerator has both experimental device and radiation generator characteristics. Additionally, any mistake operation of the remote control system could
result in an immediate breakdown. For this reason, we propose the implementation of an operator intervening system for remote accelerator diagnostics andsupport that can obviate any diﬀerences between the local control room and remote locations.

Purpose of our work was ...

to realize safe remote control for EPICS-based WebSocket operation by the on-site operator intervention(Allow/Deny judgement for EPICS PVs), because we have to prevent a mistake operation and a machine trouble.

User Interface for remote operation (WebSocket-based OPI)

User Interface for on-site operator (Web application using Ajax)

Waiting for on-site the judgement of operator

Send operation request
Control available

Request device namefrom remote location

Device name in remote operation
Stop operation

Set duration time

Done devices list

Overview of the system

Defense-in-depth network

System policy
・The operator intervention system can control the availabilityof remote operations by sending system ﬂag values to theMySQL database.
・ The access control mechanism for the CA protocol is utilized
by the access control security system of the PV gateway(GATEWAY.pvlist).

・So, we use virtulization environment to constructmulti-layer network architecture

・This is one of the mostuseful methods for
improvement ofnetwork security.

Required services
・MySQLThe access control mechanism use stored ﬂag values

・EPICS PV gateway (Customized)

Implementation of the upper and lower limit function (GATEWAY.limit ﬁle)by modifyed source code.

・WebSocket server (coded by Node.js)
・Apache + PHP (LAMP)

・The EPICS access security control is not suitable method
for accessing from Internet because of impersonation.

Use Ajax for the development because interactive response is not essential.

SSL +Password

・VMware vSphere Hypervisor
was adapted for virtualization
software.

・NFS

This is used for share the logs among hosts.

Test system using WAN emulator [2]

WebSocket Operator Interface
・WAN(Wide Area Network) emulator
creates another network witha performance of 2.0 Mbps and 200 msec latency= Neworking performance as between Japan and U.S.A.

・WebSocket = New protocol to realizes an interactive response usingbidirectional communication with web. (Ajax is not suitable.)
・We developed WebSocket -based OPI for EPICS-based control system [1]Result of the test system
・We were able to successfully operate part of the 28GHz SC-ECRIS(gas valves, RF power, electrode position, and so on) in RIKEN
RI Beam Factory.
・We conﬁrmed that the output instructions were not reached to
EPICS IOC without on-site operator permission.

[1] A. Uchiyama, et al, Proceedings of PCaPAC2012, Kolkata, India, WECC02[2] A. Uchiyama, et al, Rev. Sci. Instrum. (to be published)
KEK Preprint 2013-38,
http://www-lib.kek.jp/tiﬀ/2013/1327/1327038.pdf

iPhone, Android are also Available !
mailto:a-uchi@riken.jp