ITER ECH&CD Control System: architecture, interfaces and status of development.

. The ITER ECH&CD system is designed to inject 20 MW of millimetre-wave at 170 GHz into the vacuum vessel. The system is composed of many sub-systems, namely High-Voltage Power Supplies (HVPS), Gyrotrons, Transmission Lines (TL), Ex-vessel Waveguides (EW), Launchers. It is the role of the EC Plant Controller (ECPC) to integrate all the Sub-system Control Units (SCU), to prepare the system for operation and to execute the real-time requests coming from the plasma control system. The ECPC also implements plant level protection functions involving more than one sub-system and it interfaces with the ITER Central I&C. This paper gives an overview of the EC system and a description of the control system development focusing on the architecture and the interfaces. Control and protection functions are presented together with a functional allocation to better define interfaces and responsibilities. The preliminary design of the interface with the Plasma Control System to implement advanced control functions is also presented.


Introduction
The ITER Electron Cyclotron Heating and Current Drive (EC H&CD) system is being designed to supply up to 20MW of power at 170 GHz. This power is generated from a set of 24 RF Sources (or Gyrotrons) and the associated High Voltage Power Supplies (HVPS) and transmitted to the plasma via Transmission Lines (TL), Ex-Vessel Waveguides (EW) and two different types of Launcher: one Equatorial (EL) and four Upper Launchers (UL), as shown in Fig. 1. HVPSs and RF sources are placed in Building B15 (or RF Building); transmission lines run along the walls of Building B13 and reach 5 different openings in Building B11 to arrive to the 5 launchers (see Fig. 1 for more details).
The HVPS and RF Sources are grouped into 12 modular sets, such that each system can be operated independently of the status of the other modules.
Inline switches in the TL allow the power generated by a single gyrotron to be directed toward different launchers, as explained in Section 2. This allows the EC system to be more flexible and to implement different control functions.
The EC system is used for a variety of heating and current drive (HCD) applications and it requires a complex control system, consisting of a Plant Controller (ECPC) and a series of Subsystem Control Units (SCUs). The control system is used to monitor the EC * Corresponding author: giuseppe.carannante@iter.org system status and drive the actuators (power, steering mirrors, switches etc.) following the requests coming from the Plasma Control System. The ECPC is also in charge of plant level protection functions and of interfacing with the ITER Central I&C. As it can be seen in Fig. 2, the procurement strategy of the EC system is quite complex and involves 5 different domestic agencies. To make the integration easier, the ECPC was introduced as a coordinator of the entire plant. Clear interfaces and responsibilities were agreed upon during the system conceptual design review in 2013 [1] and further detailed during periodical workshops.
The installation phase for the first subsystems started in the beginning of 2022 and the first commissioning is expected to start by the fall of the same year. The installation and commissioning will continue for several years, in which the plant will be in a number of different configurations. The ECPC needs to cope with this complication and to allow parallel operation of different subsystems at the same time by implementing the required functionalities and ensuring a safe operation. This is achieved by means of operation modes and tasks, as it will be explained in the next sections.

System layout
The EC system is quite distributed and its operation is rather complex because of the different functions that can be performed. To allow a higher flexibility in the implementation of the plasma control functions, the generated power can be redirected toward different launchers in real-time during the pulse.
In particular, 24 transmission lines arrive to the EL and 8 lines arrive to each of the ULs. This means that the transmission lines have 24 entries on the gyrotron side and 56 entries on the launcher side. To allow moving the power from one launcher to another, inline switches are placed in the TLs. While all the ULs have 8 input transmission lines, only 4 gyrotrons can be connected to UL 12 and UL 13 and 8 gyrotrons can be connected to UL 15 and UL 16, more details can be seen in Fig. 3 for the UL 12 and for the UL 15.
Moving the power from one launcher to another requires a series of activities. The RF generation needs to be paused during the movement, this is achieved by switching off the HVPS. This operation may require changing the mirrors position, the polarisers, the TL switches, the isolation valves and the isolation shutter valves. The entire switching sequence is performed in less than 3 seconds.
The EC operation is carried out from the ITER control room; for local commissioning or special operation requiring the operators to be close to the EC equipment, a temporary control room is installed in the RF building.

Confinement barriers and safety functions
From the vacuum point of view, the EC system can be separated in 3 different sections, namely the Gyrotrons, the TL and the Launchers.
The gyrotron is kept under vacuum by internal ion pumps controlled by the gyrotron SCU.
The output window of the gyrotron is connected via a Matching Optic Unit (MOU) to a TL that is comprised of many different components, as shown in Fig. 4, and goes up to the other vacuum boundary represented by the diamond window in B11. This section is kept under vacuum by a dedicated loop implemented by the ITER Vacuum System.
The EW and the Launchers are then connected to the vacuum vessel.
The diamond window is the boundary with the EW, the continuation of the TL in the B11 toward the launchers. The diamond window is a first confinement barrier and it is protected by an isolation valve that is closed in case of potential loss of vacuum. This valve is controlled by the Vacuum System and the Central Safety System (CSS) and requests to open it or close it can be issued by the ECPC only for operation or maintenance purposes. Additional confinement barriers are present at the Port Cell and the Gallery boundaries and are protected by isolation shutter valves (see Fig. 4). These failsafe pneumatic valves are controlled by the EC control system and by the CSS via two solenoid valves in series on the same compressed air circuit. The safety actuation is always performed by the CSS.
Every time the CSS closes one of the isolation valves, it also sends a request to the ECPC to trip all the gyrotrons connected to that line, in order to reduce the risk of damage of the gyrotron itself, the diamond window and other RF components. This action is not classified as a safety function but as an investment protection.
Additional safety functions are defined to isolate the cooling water and gas lines crossing the safety boundaries, to detect loss of cooling of the EW components and to detect arcs in the diamond window.
Occupational safety functions are also identified, related to electrical and radiological risks. The access to high voltage area is controlled in the HVPS with both passive and active protection functions. To protect against X-rays produced by the gyrotrons during operation, the entire gyrotron area is fenced and the access is controlled by the Plant Safety System. Specific procedures are put in place to avoid the operation if personnel is present inside the area.
Since the implementation of these safety functions has been transferred to the Central Safety System and it is not in the scope of the EC Control System, the details of the functions and their implementation goes beyond the scope of this paper.

ITER Central I&C
The ITER Central I&C is composed of different layers of control and protection systems: The Plasma Control System is implemented in the same CODAC infrastructure and has a direct interface to the ECPC via SDN.

Staged approach
A staged approach has been introduced in 2016 with the re-baselining exercise. It introduced the different operation phases and the requirements for each phase of the plant systems.
The ITER Staged Approach has three non-nuclear operating phases prior to DT operation. The first phase (First Plasma) will include 7 MW of installed EC power coming from a set of 4 HVPSs, 7 gyrotrons, 7 TLs and 1 UL in Port 16. Due to the efficiency of the various components involved in the transmission, the power delivered to the plasma is 5.8 MW.
The first plasma will be carried out with polarizers and launcher mirrors in a fixed position. The total EC on-pulse length for each FP pulse shall be less or equal to 300 ms. This requirement was set for the design of the mirror of the First Plasma Protection Components and it is now a constraint for the first plasma. This pulse length of 300 ms is the total integrated time for the EC to be on in each ITER pulse; it can be delivered in a single time window (of 300 ms) but the EC power can also be modulated over the entire FP pulse, lasting up to 1 s. Only the UL in Upper Port 16 will be used and all the 7 gyrotrons will be connected to it. The cooling water system for the TL in B13, EW and UL will not be functional.
These reduced functionalities make the control system for first plasma much easier, although the current architecture and interfaces are already compliant with more complex functions.
The following phase will be the Pre-Fusion Plasma Operation-1 and will have the entire EC system installed and functional and the operation will be extended to 100 seconds. Even if some of the advanced PCS control functions, like NTM control, will not be needed in this phase, the required interfaces will already be implemented in the EC control system to allow sufficient time to test and debug them before the next operation phase.
Since different control and protection functionalities are needed before each plasma campaign, the staged approach has also been applied to the control system. Both the hardware and the software of the EC Plant Controller will be updated in stages, going from the simple tools and simulators needed to allow the commissioning of the subsystems (Stage 1) to the complete system integrating all the subsystems and implementing the full PCS interface  Stage 1: a portable system used to perform the Factory Acceptance Tests (FAT) of the SCUs and the Site Acceptance Tests (SAT) if the final configuration is not available on site;  Stage 2: a temporary system to support the SAT of HVPS, Gyrotrons and TL on an RF dummy load, implementing all the partial control and protection functions and simulating all the required signals coming from missing systems;  Stage 3 (First Plasma): a system to support integrated commissioning of the entire EC system and the operation for first plasma;  Stage 4 (Full system): a system to support advanced operation and the complete interface with central I&C. The FAT Tools will be used in 2022 for the first HVPS commissioning. Stage 2 has been already delivered to IO and successfully went through the SAT. It will be installed in its final location in B15 as soon as the access will be granted and it will be used for the commissioning of the first gyrotron by the fall of 2023.
The next step is to go through the FDR of the stage 3 and work toward the additional requirements coming from the parallel operation of multiple gyrotrons.

Functional analysis
The functional analysis of the EC control system has been performed for the system conceptual design review in 2013 and refined with the design evolution of the different components.
Protection and control functions have been firstly identified and then allocated to the various components in the control system architecture.
Apart from internal faults of the single subsystems like loss of control or loss of communication, the protection functions listed in Table 1 have been identified and allocated to the different SCUs.
The main functions needed to control the power generation and deposition are summarized in Fig. 5. The functional allocation and the interface with the PCS will also be discussed. The final goal of the EC control system is to generate the required amount of power and deposit it at the required location in the vacuum vessel. Many power and location references can be generated at the same time because many different launching points are available: 3 launching points in the EL and 2 launching points in each UL. This allows the EC system to be used for more than one plasma control function at a time.
Given the fact that different mirrors can access different but overlapping areas in the plasma, the first thing to do is to allocate the power and location references to specific launching points. Then, the polarisation and the launching mirror position have to be computed. Once all these references are available, the control system needs to guarantee that the HVPSs, gyrotrons, TL switches, TL polarisers and the launching mirrors are all controlled in real-time to execute them.
The allocation of functions between PCS and ECPC has been performed trying to make use of all the features of the system while minimising the duplication of information, interfaces and functions. The problem has been divided into three flows of information: the knowledge of the current power and deposition location, the knowledge of the power availability in the present and in the near future, the control of the power deposition for the different plasma control functions.
These three flows are represented, from top to bottom, in Fig. 6. The red blocks represent the functions allocated to the ECPC while the blue blocks are the ones implemented by the PCS. The arrows represent the information flow, not necessarily implemented in a physical interface since more than one block can reside in the same hardware component. The red/blue arrow is the interface between the two control systems and it is implemented by the fast real time network SDN.
The first function (first line in Fig. 6) implemented by the ECPC is to interface with the EC subsystems to retrieve the EC status, to calculate the full beam characterisation per each launching point and send it to the PCS, which in turn translate this into relevant plasma information.
The second ECPC function is to calculate the potential subsystem state in terms of: accessible location, k vector, ellipticity, polarisation, power. The potential state is the one that can be reached in the near future (3 seconds maximum) by rearranging the available power. This information is crucial to the PCS to optimize the use of the EC and the other additional heating systems [2,3,4]. The parametric representation of the potential EC state is an open point and will be further investigated during the design phase. The PCS role for this function is again to translate the EC potential state into relevant information for the plasma, mainly in terms of power for heating and current drive and of deposition location (ρdep).
These first two functions complete the first two lines in Fig. 6. The direction of the arrows change in the last line, since it represents the information flow generated by the PCS. For each control function, the PCS firstly generates a desired power request and deposition location, then assigns the reference to a specific launching point with the related information (k vector, polarisation) and finally sends it to the ECPC. It is the role of the ECPC to translate this information into low level references for the gyrotrons, TL switches and polarisers, launcher mirrors and to make sure that the references are followed in real-time.
PCS also takes into account the constraints from the EC to move the power from one launcher to another and may decide to pre-emptively allocate power to a specific area to be able to cope with potential control needs. As an example, a specific flux surface could be tracked and EC power pre-allocated to it if an NTM is likely to occur.
One of the functions for which the EC system is the main actuator is the stabilisation of Neoclassical Tearing Modes (NTM). This function puts very stringent requirements on the control system to be able to modulate the RF generation synchronously with the NTM rotation up to 5 kHz. Since the interface with the PCS is much slower (the expected update rate is between 100 Hz and 1 kHz), different solutions are currently under investigation. One solution is that PCS calculates the NTM frequency and phase and communicates it to the ECPC at the actual communication rate, the ECPC would then implement a phase locked loop to generate the triggers for the gyrotrons. This solution would work under the assumption that the phase shift of the islands rotation is substantially slower than the ECPC-to-PCS communication. Another option is to add a high speed interface with a dedicated diagnostic to the ECPC system. Two possible diagnostics are the Magnetics diagnostics and the inline ECE [5]; the latter would use one of the beam lines as ECE channel. As of today, there is no high speed link to the Magnetics diagnostics and the inline ECE is not in the ITER baseline design. Hence, the issue is still open and it will have to be addressed in the future.

Architecture
The control system architecture is depicted in Fig. 7. Each of the subsystems mentioned above is independently controlled by an SCU. Two gyrotrons are grouped in one SCU because they are connected to the same HVPS set, hence they are considered as one operation unit. The ECPC acts as master of the SCUs, supervising the operation of the entire plant and providing the interface to the ITER central I&C. The ECPC includes a Plant Interlock System (PIS). The occupational safety functions are implemented by a Plant Safety System for Occupational Safety (PSS-OS), managing electrical and radiological hazards in building B15. The implementation of the PSS-OS is delegated to the Central Safety System and it is not included in the scope of the EC control system.
Control, protection and safety functions are always implemented in the lowest possible layer of the control hierarchy, which means that functions involving only one subsystem are implemented in the SCUs; functions involving more than one subsystem are implemented in the ECPC.
CIS and CSS implement functions involving external plant systems and they can inhibit the operation of the EC system in every operation mode.
Communication among different controllers is via fibre optic cables whenever possible, including network interfaces. Standard ITER networks are used to communicate among EC control system devices and with the Central I&C.
Each SCU has a direct connection to PON for parameters setting and to report back the states.

Operation principles
The EC plant is composed of many subsystems and a high flexibility is required in its operation. To allow the system to be flexible enough, a complex operation has been introduced in which the system is broken down in groups that can work together or in a segregated way.
For each SCU and for the ECPC, the segregation defines if it is under the supervision of a higher level controller (Synchronous control) or if it is controlled by an operator via a CODAC HMI (Asynchronous control). When the ECPC is in Synchronous control, the requests coming from the Central I&C are then translated into subsystems requests and sent to the SCUs that are Synchronous. The Central I&C is represented either by the SUP (ITER supervisor, configuring the plant systems and controlling their operating states) or by the PCS. In Fig. 8, the first N subsystems are in Synchronous operation and M subsystems are in Asynchronous operation (directly controlled via their HMIs).
When the ECPC is in Asynchronous operation, only the requests coming from an operator are executed. Even if the ECPC is Asynchronous, its operation can include one or more subsystems, which will be in Synchronous operation with the ECPC. When a given subsystem (HVPSs, gyrotrons, TLs, EWs, launchers) is in Asynchronous mode, an operator can directly control the subsystem by sending requests via the CODAC HMI.
The supervisory hierarchy inside the EC system is shown in Fig. 9. The supervisory system of the HVPS SCU is the correspondent gyrotron SCU; for all the other subsystems, the supervisor is the EC Plant Controller. Fig. 10 shows the source of the commands in a generic SCU in the different segregation modes. The interface with the HMI is always active for monitoring but the commands are only accepted when the system is in Asynchronous control.
It is worth noting that only the HVPSs have a local mode, in which the system is operated with a local HMI (on the HVPS control cubicle); this mode is only used for the HVPS commissioning or maintenance on an electrical dummy load. Each one of the 12 sets of HVPSs, gyrotrons, TLs and of the 5 launchers can perform a different operational task at the same time.
Tasks can involve a single subsystem, a group of subsystems or the entire EC system. Many tasks can be performed at the same time; the supervision and the plant protection is ensured by the ECPC and the Central I&C.
Taking the gyrotron as an example, the following tasks can be performed:  Gyrotron commissioning in free air: the transmission line is not connected and the beam pattern at the output of the gyrotron matching optic unit is checked. This operation is better carried out in the temporary control room in the RF building because frequent access to the gyrotron area might be required. This operation is only needed for the first gyrotron commissioning or maintenance. Absorbing material and a target to collect the thermal footprint is needed. Special safety provisions are put in place.  Alignment of beam in transmission lines: same as the previous task but a section of transmission line of a given length is added. This operation is only needed for the first TL commissioning or maintenance.  Gyrotron operation on dummy load: transmission line is connected up to the RF dummy load. This operation can be carried out from the main control room or from the temporary control room. This operation is needed for the commissioning of gyrotrons or other components.  Gyrotron operation on a short pulse dummy load in different locations: to measure TL efficiency and calibrate the RF power delivered to the plasma for each gyrotron, a short pulse dummy load needs to be mounted in different locations (at least at the end of the line in B13 or B11).  Gyrotron conditioning: full details in Section 7.1.  Commissioning of the control system: the control system of each of the subsystems can be tested without transmitting RF power to the vessel. This operation is needed for first commissioning and after each control system upgrade; it can be carried out from the main control room or from the temporary control room in B15.

Gyrotron conditioning
The standard gyrotron preparation requires ramping up the filament current and waiting for the emitter temperature to be stabilised before being able to perform a long pulse. This time is needed for the emitter ring to reach the thermal operating point. Since there is no direct measurement of the emitter temperature, very short pulses are performed to check the status of the gyrotron by looking at the beam current. During the pulse, the cool down effect on the emitter, due to the beam current, needs to be compensated by acting on the filament power. Different solutions exist to adapt the filament power during the pulse, based on feedback or feedforward control.
After a pulse, the emitter state is unknown and it depends on the pulse length and on the control algorithm chosen to stabilise the beam current. This means that there is a transient after each pulse, lasting several minutes, during which the gyrotron might not be ready for another pulse.
When the EC system is used in an ITER pulse, all the power needs to be ready as soon as possible to allow the plasma control system to perform its functions. For this reason, gyrotron conditioning will have to be performed during the pulse as a parallel activity. Two mechanisms are needed to perform this function: an RF dummy load that can always be used if needed; the ability of the control system to perform a conditioning task to one or several gyrotrons, while the rest of the system is potentially performing different tasks. The control system needs to accommodate for this need and allow parallel operation of different subsystems as explained at the beginning of the section and in Fig. 8.
Another reason to perform conditioning is when an unpredicted behaviour is observed. As an example, if a gyrotron is having frequent arcs during a pulse, an asynchronous/conditioning task can be selected for that particular gyrotron so that an operator can try conditioning it on a dummy load to be able to use that gyrotron again in the same or in the next pulse.
For the sake of completeness, it is worth mentioning that having a reliable model of the gyrotron might solve the problem of knowing the emitter state at all times. A modelling activity has been started in 2018 by F4E [6], to predict the gyrotron behaviour and to be able to design more robust controllers. The activity is still ongoing with different goals: refine the model of the gyrotron, validate the model inside the pulse and between pulses (when the beam current is off), design a controller stabilising the beam current during the pulse and controlling the emitter temperature outside the pulse. The results of the modelling activity will not be presented in this work and will be the subject of a future publication.

Conclusions
The EC control system is a complex and distributed system, it has many interfaces and includes control, protection and safety functions.
An EC Plant Controller was introduced in 2013 to control and supervise the EC system and to provide an interface layer with the Central I&C.
The system went through a Conceptual Design Review in 2013, where the main requirements were agreed among all the stakeholders. Many workshops and subsystems design reviews have been then organised to further clarify the requirements and follow up the design of the ECPC and of the SCUs. All the EC control system stakeholders actively participated to these meetings, together with the responsible officers of all the relevant interfacing systems.
The system is now approaching a new phase with the installation of the HVPS and Gyrotrons in 2022. By the fall of 2022, the first commissioning of the HVPS procured by F4E will start.
The installation and commissioning activities will continue for a long period until the First Plasma and then the rest of the systems will be installed for the next plasma operation phase. The ECPC will adapt to the different phases by providing the required functionalities and by ensuring a safe operation.
It is important to note that the EC control system involves 5 different DAs and it is the results of a big distributed effort of all the parties including the ITER Organisation, the DAs and fusion laboratories around the world.
The views and opinions expressed herein do not necessarily reflect those of the ITER Organization.