Fusion Engineering and Design 112 (2016) 788–795

Contents lists available at ScienceDirect

Fusion Engineering and Design

journal homepage: www.elsevier.com/locate/fusengdes

Current status of ITER I&C system as integration begins

William Davis a,∗ , Anders Wallander a ,
Izuru Yonekawa b , the IO-CT Control System Division
a
ITER Organisation, Route de Vinon-sur Verdon, CS 90 046, 13067 St. Paul Lez Durance Cedex, France
b
Nippon Advanced Technology Ltd., 3129-45 Hibara Muramatsu, Tokai, Naka-gun, Ibaraki 319-1112, Japan

h i g h l i g h t s

• The ITER I&C system is organisationally complicated and technically challenging.

• Standard technologies for the ITER I&C systems have been selected.
• Supply of non-standard technologies will cause serious issues.
• Differing levels of design maturity of plant I&C systems is a serious challenge.
• Systems are in the final stages of design and are being delivered to site.

a r t i c l e i n f o a b s t r a c t

Article history: The ITER I&C system is organisationally complicated and technically challenging, and integrating its
Received 19 June 2015 many sub-systems into a single coherent system is critical for the ITER project to meet its objectives. This
Received in revised form 6 April 2016 paper explains the integration risks being faced now and anticipated in the near future. Standardisation
Accepted 8 April 2016
initiatives by the ITER central team to mitigate these risks are described. The paper also presents the
Available online 10 May 2016
architecture of the ITER I&C system, the current status of design and manufacture key developments
made in recent years, and the current and future activities of the central I&C teams. Finally, a short
Keywords:
description is given of the plant I&C systems that will be delivered to ITER in the near future.
CODAC
Integration © 2016 ITER Organization. Published by Elsevier B.V. All rights reserved.
Interlocks
Nuclear
Safety
ITER

1. Introduction maturity of plant I&C systems ranges from conceptual to complete

and delivered, and this presents risks to the design consistency for
The ITER instrumentation and control (I&C) system will be one the whole machine. When ITER construction is complete there will
of the largest and most complex control systems in the world when be approximately 180 plant I&C systems. The first plant system I&C
it becomes operational. It is composed of three functionally distinct components have been delivered to site and will be installed as part
tiers—conventional, interlock and safety. The central I&C systems of the steady state electrical power distribution system in 2016.
are supplied by the ITER organisation central team (IO-CT) and the Others have not yet completed conceptual design review, which
plant I&C systems supplied mostly by the domestic agencies (IO- means their requirements are not yet fully known and understood.
DAs). This paper presents the current status of the ITER I&C systems, All these plant I&C systems need to be integrated physically,
following past status reports [1–8]. electrically, logically and – most importantly – functionally, into a
The preliminary design of the central I&C systems is complete consistent and interoperating whole. There will be approximately
and the final design of the control, data access and communication 300 interfaces (physical and functional) between central I&C sys-
(CODAC) system infrastructure and underlying software services tems and plant I&C systems. Each of these interfaces will have
has also been completed [9]. For all central I&C systems the require- further complexity depending on network, safety class, building,
ments have been completely defined and approved. The design and many other aspects. The whole ITER I&C system will com-
prise, roughly, 4800 cubicles, 100000 components, over 3000 km
of cables including 400 km of network cables, across 90 buildings
and plant areas. Whilst figures for other comparable systems are
∗ Corresponding author.
E-mail address: [email protected] (W. Davis).

http://dx.doi.org/10.1016/j.fusengdes.2016.04.017
0920-3796/© 2016 ITER Organization. Published by Elsevier B.V. All rights reserved.
 W. Davis et al. / Fusion Engineering and Design 112 (2016) 788–795 789

Fig. 1. Communication interfaces between IO-CT, IO-DAs and tier 1 suppliers for ITER I&C system.

difficult to find the headline figures for ITER I&C hint at the scale of curement arrangement. For example, the poloidal field coil power
the work for design, manufacture and integration. supply (CPS) system (MAG-PFCS) is being supplied by three IO-DAs.
At least 300 people are estimated to be currently involved with Therefore the I&C from each IO-DA must be first integrated together
the ITER I&C system and this is will increase over the next few into a single plant I&C system, and then integrated to the central
years as systems are manufactured, installed and tested. The work I&C systems. A different example is where a single contractor is
of integrating the ITER I&C system is led by the IO-CT control sys- supplying an integrated I&C design for some buildings’ services
tem division in collaboration with the rest of the ITER organisation, I&C (BUIL-Bxx) and liquid and gas utilities I&C (UTIL-CA, DW, etc).
domestic agency partners and suppliers, shown in Fig. 1. These additional organisational factors increase the complexity of
integration by increasing the number of interfaces.
2. Architecture of the ITER I&C system
2.1. Conventional control system
The ITER I&C system enables integrated and automated opera-
tion alongside dependable and timely safety and protection. Fig. 2 The chosen technologies for the CCS are predominantly open-
shows the three distinct tiers of conventional, interlock and safety source for fast functions, using PIC MG 1.3 [10] compliant hardware
which together make up the ITER I&C system, and the separation for plant systems, and CODAC core system [11–13] for all fast plant
into central and plant I&C systems. functions and central services. Siemens S7 PLCs [14] are the cho-
Within each tier the plant I&C systems interface with the cen- sen technology for slow (>100 ms response time) functions. CODAC
tral I&C systems. Based on the present designs, in the conventional core system is based on Red Hat Enterprise Linux (RHEL) [15], using
control system (CCS) there will be ∼180 plant I&C systems which experimental physics and industrial control system (EPICS) [16]
interface with CODAC through the plant system host (PSH). Approx- and control system studio [17] to integrate all parts of the CCS,
imately 60 of these systems are involved in plasma control and a including the human machine interfaces (HMIs).
further 60 whose functions are closely correlated with tokamak
operation. The remaining systems provide services to the other 2.2. Interlock control system
plant systems required for tokamak operation. The plant I&C sys-
tems are separated into 18 control groups, each group contains For investment protection functions the interlock control sys-
plant I&C systems with related functions for control of the overall tem (ICS) will have around 30 plant interlock systems (PIS)
facility. This hierarchy is known as the control breakdown structure interfacing to the central interlock system (CIS) [18]. To meet the
(CBS) and is shown in Fig. 3. demanding performance and integrity requirements of these func-
The project’s procurement approach drives the separation into tions there are three different technologies being used, each of
central and plant I&C systems. This is because the central I&C is which requires a different interface between the plant and central
being supplied in-fund by the IO-CT and the plant I&C systems being systems. For slow functions up to ITER Interlocks Integrity Level 3
largely supplied in-kind by the IO-DAs. However, as the procure- (3IL-3, ∼SIL 3 from IEC 61508 [19]) fault-tolerant Siemens S7 PLCs
ments were allocated mainly for political reasons there is rarely a will be used. For fast functions up to 3IL-3 a CompactRIO [20] based
1:1 relationship between plant I&C system (CBS level 2) and pro- platform has been developed using National Instruments hardware,
790 W. Davis et al. / Fusion Engineering and Design 112 (2016) 788–795

Fig. 2. ITER I&C system architecture.

Fig. 3. The ITER control breakdown structure, with current numbers of plant I&C systems in the 18 ITER control groups.
 W. Davis et al. / Fusion Engineering and Design 112 (2016) 788–795 791

which will only use hardwired optical signals for critical functions. opposite effect and will increase the resources needed for integra-
Finally for the protection of the magnets a current-loop based sys- tion and reduce availability of the system over the lifetime of the
tem has been developed which will detect faults and directly put ITER project.
the superconducting circuit into a safe state by a coordinated dis- The central I&C team have defined an interface standard for each
charge of the coil currents. The HMI in the main control room will central I&C system that will be used by all plant I&C systems. The
use WinCC-OA [21] on RHEL. Non-critical data from plant inter- plant control design handbook (PCDH) [26–28] contains the rules
lock systems, such as real values and controller monitoring, will be for ITER I&C. Satellite documents provide a range of guidance and
communicated to CODAC and not to the CIS. instructions for integration of plant I&C with central I&C. Each plant
I&C system supplier will receive an I&C integration kit to assist with
2.3. Safety control system integration to CODAC. The kit contains the PSH, a network switch,
all the high performance network cards required by the system and
Safety functions are separated into two distinct safety control a “mini” version of CODAC. To date more than 30 of these kits have
systems (SCS), one for nuclear safety (SCS-N) [22] and one for been supplied. For integration with CIS the team is developing a
occupational/non-nuclear safety (SCS-OS) [23]. In each system the similar “mini” version of CIS and is supplying all the current-loop
plant safety systems (56 PSS-N, ∼40 PSS-OS) will interface to the interface boxes required by the plant systems for protection of the
central safety systems (CSS-N or CSS-OS). For nuclear safety the superconducting magnets. For integration with CSS-N and CSS-OS
qualification and licensing risk of programmable systems led to the standard test environments are being developed.
project decision to use only solid state logic to implement functions The most obvious integration problem with non-standard I&C
categorised as A or B (according to IEC 61226 [24]). The HIMA Planar equipment is communication compatibility. If plant I&C systems
4 [25] platform has been selected for these functions. Siemens S7 cannot communicate with central I&C systems then integrated
fault-tolerant PLCs will be used to implement IEC 61226 category C operation from the main control room will not be possible. Even if
functions in the SCS-N and functions up to SIL-3 in the SCS-OS. The communication is possible, the communication must provide cer-
HMIs for SCS-N will be hardwired for category A and B and based tain features and performance to achieve integrated operation. For
on WinCC-OA for category C; SCS-OS will also use WinCC-OA. example, the HMIs for plant systems must permit interlocking of
A recent change to the project baseline transferred responsibil- local and remote operation. This will ensure that only one HMI can
ity for many of the PSS-N logic controllers from the plant system control plant at a single time whilst still allowing others to moni-
teams to the central I&C team. The reason for this change was to tor the live plant state. Communication in the interlock and safety
reduce qualification and licensing risks by reducing the variety of systems must also have sufficient fault-tolerance and diagnostic
different designs and implementations. Now only IO-CT and IO-EU coverage to meet the integrity requirements.
will supply PSS-N, and in practice the PSS-N from IO-CT will be Specific examples of non-standard technologies currently pro-
merged into the CSS-N, greatly reducing the number of interfaces posed by ITER suppliers include:
and simplifying integration.
- LabVIEW-RT based controller for electron-cyclotron, ion-
2.4. HMIs for the main control room cyclotron and diagnostic neutral beam system power supplies
- QNX-based controller for CPS ACDC converters
The ITER project has selected two different HMI platforms for - Custom-made PCBs without long-term manufacturer support
the main control room. The conventional control system needs to - Relay-based nuclear safety systems for the tokamak/hot-cell
be sufficiently flexible to provide operator interfaces ranging from cargo lift.
monitoring and control of process systems such as cooling water, to
the visualisation of the plasma control system (PCS). It must also be In all these cases the system is being assembled specifically for
extendible to add new operator interfaces in future. Control system the ITER project and is not an off-the-shelf item or derived from a
studio was selected because it has been developed and proven in standard product line. The central I&C team is exploring alterna-
use at large scientific facilities around the world, and its open source tive solutions for integrating this equipment with the central I&C
nature provides the flexibility and extendibility that is needed. systems, and the suppliers will make provision for its maintenance
WinCC-OA was selected as the HMI platform for the high- and obsolescence.
integrity systems because it is already certified to IEC 61508 SIL3
which makes it suitable to use for the SCS-OS and ICS. For the SCS- 4. Design maturity impact on integration
N SIL3 certification is a good starting point to achieve IEC 61513
category C qualification. Diversity from the conventional system Due to the demands of the project each plant I&C system is cur-
also removes a potential common cause of failure, a key principle rently at a different stage in its design and they are progressing at
of high-integrity systems. The vendor provides all the tools needed different rates. Fig. 4 shows the current design phase of the plant
to interface it with our main high-integrity controllers (S7 PLCs) I&C systems. This means that some system designs do not yet have
which removes most of the integration risk. In addition, there will sufficient detail about their interfaces with the central I&C systems
be a hardwired panel for the SCS-N for critical functions. and other plant systems on which they depend. In these cases it is
necessary to estimate the interfaces and ensure that the interfacing
3. Standardisation of plant I&C technologies systems will provide the necessary services in adequate capacity.
However, one must not be too risk averse and overestimate require-
To improve system availability and reduce the risks from obso- ments, because this will lead to the interfacing systems being built
lescence the ITER project requirements require the standardisation with too much capacity, therefore increasing cost and complexity.
of equipment for as many parts as possible, for as many systems as Even when a plant system has achieved the final design mile-
possible. The central I&C team have assessed the expected needs stone there can be a wide range of differences in the completeness
of the plant systems and defined a catalogue of products which of the design at this stage. The IO-CT I&C integration team assess the
will be suitable for the vast majority (>99%) of use cases. This will completeness of plant I&C system design at the final design review
also simplify integration during commissioning by reducing the risk and the compliance with the PCDH. The assessments help the IO-CT
of incompatibilities. Use of non-standard equipment will have the I&C integration team identify topics on which to provide more sup-
792 W. Davis et al. / Fusion Engineering and Design 112 (2016) 788–795

tant information to know is which networks are required in which

locations for the installation starting in 2017.

5. Activities of the central I&C teams

5.1. CODAC

The CODAC team’s focus has been on development of CODAC

core system to ensure all necessary features are included to support
the plant I&C systems, such as the self-description data configura-
tion tool [30]. CODAC core system has been successfully validated
by plasma experiments at KSTAR [31] and is used for some parts of
the I&C at SPIDER [32]. ITER’s data archiving system has been imple-
mented and integrated within CODAC core system [33,34] and the
high-level applications are being developed, such as the real-time
framework for the PCS [35,36]. A working version of CODAC is cur-
Fig. 4. Lifecycle phase of ITER plant I&C systems in March 2016.
rently installed in the headquarters building for monitoring the site
15 kV electrical supply [37], poloidal field coil fabrication building
and construction site alarms.
Suitable hardware for a wide range of slow and fast control sys-
port and information. Table 1 shows the results of this assessment, tems has been selected following a thorough campaign of driver
where the plant systems are anonymous. The maturity of diagnos- development and compatibility testing [38,39]. Use cases have been
tics I&C systems, though not yet at final design stage, has also been produced and implemented to test the ability of CODAC core sys-
assessed [29]. tem to interface with typical plant I&C systems. These use cases
These assessments tell us that the maturity of the I&C design for include PLC-based control of cooling water systems and the high-
a plant system is usually less mature than the design of the plant speed data acquisition and calculations needed for diagnostics [40].
system itself. This is expected, but when interfacing systems need More recently a model of the CCS is being developed to test the inte-
information it is necessary to give them this information to avoid gration of CODAC with plant systems. In 2017 installation of central
delaying the project. networks infrastructure will start. The final design review for the
Systems that support plant I&C systems are generally at a more CODAC applications is scheduled for 2018, with the PCS final design
advanced level of design maturity than the plant I&C systems are. due to be completed in 2021.
These supporting systems require confirmation of their interfaces
so they can progress with construction. For example, buildings 5.2. CIS
engineers must know the number, weight and heat load of cubicles
so that adequate structural and environmental support is pro- The final design review for the CIS was held recently, in March
vided. The electrical distribution system engineers need to know 2016. Recently the fast interlock controller design was finalised
the electrical load characteristics and number of clients for each for series production and mini-CISes were supplied for the factory
distribution board. acceptance tests of CPS and RPC I&C. CIS v.0 was produced as a proof
Cable trays are a critical item for the project. The cable trays of concept and demonstrated at the interim design review in 2014.
team need to know the end points and characteristics of all cables The CIS team also supported the development of the test system
so they can provide suitable capacity to route cables where they for the high temperature superconducting current leads in 2014 as
are needed. The constraints of the building designs mean it is not part of this development and proving process.
always possible to provide the required capacity. Unfortunately this It is essential that the PISes will correctly integrate with CIS and
means some I&C cubicles may not be located in the first choice meet the performance and integrity requirements of each 3IL. To
locations. help the plant I&C system engineers achieve this detailed design
The central I&C systems have been designed to ensure that their and implementation guidance has been produced. The CIS team
own designs can progress without mature design information from have provided detailed technical support to help the suppliers
other plant I&C systems. At the same time, the central I&C sys- implement this guidance.
tems designs will accommodate the needs of plant I&C systems The next major milestone will be the production and installation
with more advanced design maturity. At this stage the most impor- of CIS v.1 at the National Fusion Research Institute of Korea (NFRI)

Table 1
ITER plant I&C system design completeness and PCDH compliance at final design review.

Plant I&C system A B C D E F G H I J K L M N O P Q Average

PCDH deliverable % completeness assessment

D1A (Functional analysis) 95 80 95 70 50 50 80 70 70 70 70 70 70 95 100 50 90 75
D1B (Detailed functional breakdown) 50 30 60 40 0 0 20 0 0 0 70 70 70 90 100 50 40 41
D1C (Hardware architecture) 80 90 60 40 20 20 50 50 50 50 70 70 70 95 90 50 40 59
D5 (Controllers configuration) 0 50 0 0 10 10 20 10 10 10 50 50 50 90 85 40 10 29
D6 (Signals list) 0 100 0 75 75 75 75 75 75 75 40 30 50 90 85 40 20 58
D7 (Variables list) 0 0 0 0 0 0 0 0 0 0 40 30 50 90 85 30 20 20
D8 (Cubicles configuration) 0 70 20 25 10 10 20 20 20 20 50 30 50 95 85 30 10 33
D9 (Plant system operating states) 0 0 0 0 0 0 0 0 0 0 40 30 40 90 85 30 90 24

Average 42
PCDH compliance 36 80 71 60 40 40 60 40 40 40 60 30 60 90 90 50 74 57

Note: Bold values signifies the result of the average (mean) calculation of the preceding columns.
 W. Davis et al. / Fusion Engineering and Design 112 (2016) 788–795 793

and other industrial partners in Korea in 2017. The possibility of a occupational safety. For conventional functions all systems in a sin-
real-time interlock system to shadow the PCS will be investigated. gle building will be interfaced to a building management system
(BMS). The BMS in turn interfaces with the PSH. Safety systems
5.3. CSS-N & CSS-OS will interface with the CSS-N and CSS-OS via a PSS-N or PSS-OS con-
troller if necessary. These systems will operate under the authority
The development of the CSS-N has focussed on selection and of the central I&C systems but will generally run autonomously and
qualification of hardware that will meet the requirements of IEC without the need for central control.
61513 and associated standards. The necessary system plans and Fire detection and protection functions are done by dedicated
documentation that ensure the final CSS-N can be qualified to the and self-contained systems as per French regulations. These sys-
nuclear standards have been produced. Approximately 200 nuclear tems are monitored by the BMS, and in nuclear buildings there is
safety I&C functions have been identified and more than half of the some coordination with the SCS-N.
specifications are complete. Product qualification of the Siemens Each building will be monitored by the site alarm survey until its
S7 fault-tolerant PLCs for category C functions is complete and BMS and central I&C infrastructure are available. Each BMS will be
in progress for HIMA Planar 4, WinCC-OA and other equipment. integrated with CODAC and used for more detailed monitoring of
Environmental testing of the selected equipment, including the the building’s services when the building is handed over to IO-CT.
control cubicles and safety desk, is in progress. Guidelines for the The first building is expected to be complete in 2017 and buildings
development and implementation of PSS-OS to ensure successful will continue to be constructed until 2025.
integration with CSS-OS have been produced.
6.2. Utilities (control group UTIL)
6. Integration of central and plant I&C systems
There are a range of utility systems which supply services across
At present the systems with the most advanced I&C designs are the site. Liquid and gas services such as compressed and breathing
those which will be delivered and installed first. These are building air, demineralised water, nitrogen and helium are supplied in the
services, utilities, CPS and cooling water (except tokamak cooling same contracts as the buildings’ services. Each utility’s control sys-
water), which are described in the following sections and their tem will be interfaced directly to a dedicated PSH, not via the BMS.
primary locations on site shown in Fig. 5. Some of these systems will also have safety functions interfaced via
a PSS controller to CSS. For example, the breathing air system for
6.1. Buildings services (control group BUIL) occupational safety and compressed air for nuclear safety systems.
The site will have two electrical networks. The steady state
The building services maintain the buildings’ internal environ- electrical network (SSEN) supplies power on a continuous basis
ments and support plant systems within the buildings. Typically to all systems. Diesel generators and batteries provide uninter-
these services are heating, ventilation and air conditioning, lighting, ruptible and short-break backup power for safety and investment
lifts and cranes, doors, and detections of leaks from liquid and gas protection purposes. The pulsed power electrical network (PPEN)
systems. Depending on the building there may be nuclear and occu- supplies power to systems involved in plasma operation, primarily
pational safety functions. For example, confinement of radioactive the CPS and heating and current drive (H&CD) systems. Different
contamination for nuclear safety and detection of low oxygen for control system architectures are used for different voltage levels

Fig. 5. site map with primary locations of utilities, RPC and cooling water shown.
794 W. Davis et al. / Fusion Engineering and Design 112 (2016) 788–795

and classes of power supply [37]. Both SSEN and PPEN will use IEC bus-bar monitoring. Each of these will have a dedicated I&C sys-
61850 [41] devices for monitoring and control of high and medium tem using standard components for the interfaces with the central
voltage equipment. The IEC 61850 network will be interfaced to I&C systems. The master control system will interface with the PCS
CODAC via Siemens SIMATIC gateway devices and a PLC to the PSH. using SDN to receive coil current and voltage references, which it
Low voltage and backup power distribution will not use IEC 61850 will use to coordinate the individual AC/DC converter controllers
and these systems will be directly monitored and controlled by The MCS will also provide predicted Q values to the RPC over SDN.
PLCs. Systems for control of safety power supplies will interface to The SNUs will be controlled directly by PCS and will provide the
CSS-N, although the technology to be used for control of the diesel main coil current measurements used by the PCS.
generators is not yet confirmed so could pose some integration All three interlocks technologies (slow, fast and current-loop)
risks. will be used in the CPS I&C. The CIS will coordinate protection
In the event of a loss of off-site power (LOSP) systems that are functions between the CPS and other plant systems to ensure the
connected to the short-break power supplies will be disconnected superconducting magnets are not damaged. The fast discharge
for ∼90 s to allow the diesel generators to start without load. As units and protective make switches for the toroidal field coils will
the diesel generators increase in power output the systems will be also be interfaced with CSS-N to implement nuclear safety func-
sequentially reconnected. The I&C of the safety power supply will tions. These functions are needed to ensure that if a magnet does
do this autonomously without input from CSS-N. The control of fail then it will not damage the rest of the tokamak and cause loss
this function for investment protection power supplies has not yet of confinement of radioactive material. Local occupational safety
been determined and may involve CODAC and/or CIS, depending functions will be monitored by CSS-OS, same as for other electrical
on the range of possible plant configurations that need to be man- systems. SATs of all converters and integration with the central I&C
aged. Most I&C systems will not be affected by LOSP as they will systems will start in 2019.
be connected to uninterruptible power supplies, not short-break A fourth I&C system will control the power supplies for in-vessel
supplies. coils which are not superconducting. The design of this system is
Only the essential alarms of the liquid and gas services, SSEN and still at the conceptual stage.
PPEN will be monitored by the site alarm survey during construc-
tion. Integration with the central I&C systems will start when their 6.4. Cooling water (control group CWS)
top-level controllers and the central I&C infrastructure are avail-
able. Site-wide dedicated I&C networks will be installed for SSEN The cooling water system procurement is shared between two
and PPEN and some liquid and gas services. This will ensure they IO-DAs, one responsible for the tokamak cooling water system
can be fully monitored and controlled prior to the availability of (TCWS).The other IO-DA is responsible for all other cooling water
central I&C infrastructure. SSEN and PPEN are expected to begin systems, including safety and non-safety related chilled water
operation in 2017, with the emergency power supply expected to systems, the secondary circuit of tokamak cooling, the site heat
be available by 2023. rejection system, and all systems required to cool other plant sys-
The reactive power compensation and harmonic filtering tems, e.g. cryogenics, CPS, H&CD systems.
(RPC&HF) system compensates for the reactive power and har- The non-TCWS scope will be controlled by a single high-
monics created by the CPS and ensures that they remains within availability S7 PLC with remote I/O arranged in a ring architecture
the limits required by RTE, the local electricity grid operator. How- to improve network availability [43]. The nuclear safety functions
ever its control system is quite different from the other utilities for control of safety-related chilled water will be implemented by
as it will use fast controllers. It will receive predicted Q values the CSS-N team as described earlier. The various cooling water cir-
from the CPS to allow feed-forward control for better response cuits will be installed in sequence over several years. This means the
times. The Q values will be received using the synchronous data control system must contain all software for control of all circuits
network (SDN), which is one of ITER’s high performance networks from the start or will need to be upgraded each time a new circuit
with very low latency. Although its operation is closely linked with is installed. There are more than 150 I&C cubicles foreseen for the
tokamak operation it is not interfaced with the PCS, instead it oper- entire cooling water system, interfacing ∼11000 field signals.
ates autonomously in common with other utilities. There will be an
interface to CIS for monitoring its local protection functions. Site 6.5. Other plant I&C systems
acceptance test (SAT) of the first unit of the RPC system is expected
to be completed in 2018 after which it will be interfaced to the Details on many other ITER plant I&C systems have been pre-
central I&C networks. sented and published in recent years [44–50].
Local occupational safety functions of SSEN, PPEN and RPC relat-
ing primarily to electrical safety will be monitored by CSS-OS. 6.6. Central I&C systems

6.3. Superconducting magnet coil power supplies (part of control The policy of the central I&C systems is that all central I&C ser-
group MAG) vices will be available at the physical location when the plant I&C
systems need them. This includes all central I&C networks and
The CPS, in particular the AC/DC converters, will be delivered to all applications that are needed for SAT and integration of plant
site starting in 2017. These systems require fast control of the elec- systems, such as archiving, alarm systems and HMIs.
trical parameters in the order of micro-seconds. There are three I&C Initially plant I&C systems will be integrated to the version of
systems, each controlling one of the three main sets of supercon- CODAC in the headquarters building or other temporary locations.
ducting magnet coils. Once the control building is ready (expected to be in 2022) then
The procurement of the AC/DC converters is shared between two the central I&C networks and CODAC will be installed and services
IO-DAs, with one also being responsible for the master control sys- gradually migrated, and is expected to be complete in 2024.
tem which will coordinate the local converter controllers [42]. This The first versions of CSS-N and CSS-OS, and CIS v2.0 will be
has resulted in two different designs of local converter controller, installed in the same locations as CODAC, with dedicated rooms
both of which use non-standard technologies and custom-designed used for CSS-N equipment. All central interlock and safety functions
embedded controllers. A third IO-DA will provide the switching will be in operation before integrated commissioning activities
network units, fast-discharge units, protective make switches and start to ensure that personnel and plant are protected.
 W. Davis et al. / Fusion Engineering and Design 112 (2016) 788–795 795

As described earlier, CODAC applications for alarms, archiving [17] Control System Studio, http://controlsystemstudio.org/.
and HMIs are already in service and will be extended to meet the [18] ITER internal document, Central Interlock System—design description
document internal reference QCH3GL.
needs of each plant I&C system as they are integrated. The supervi- [19] IEC 61508:2010, Functional safety of electrical/electronic/programmable
sion and coordination application will begin operation in the early electronic safety-related systems.
stages of plant system commissioning to assist coordination and [20] National Instruments CompactRIO, http://www.ni.com/compactrio/.
[21] Siemens SIMATIC WinCC Open Architecture, http://w3.siemens.com/mcms/
will be developed to provide more complex functions as integration human-machine-interface/en/visualization-software/simatic-wincc-open-
progresses. The pulse scheduling and plasma control applications architecture/pages/default.aspx.
will be the last parts of the central I&C systems to reach matu- [22] ITER internal document, Central Safety System for Nuclear Safety (CSS-N)
Preliminary detailed design document internal reference QEZGLD.
rity and be installed as they will not be needed until integrated
[23] ITER internal document, Central Safety System for Occupational Safety
commissioning. (CSS-OS) Preliminary detailed design document internal reference DFY725.
[24] IEC 61226:2009, Nuclear power plants—Instrumentation and control
important to safety—Classification of instrumentation and control functions.
7. Conclusions
[25] HIMA Planar4,http://www.hima.com/products/Planar4 default.php.
[26] J.Y. Journeaux, Plant Control Design Handbook, 2013 http://static.iter.org/
There are many challenges to be faced and overcome during the codac/pcdh7/Folder%201/1-Plant Control Design Handbook 27LH2V v7 0.
pdf.
design and integration of the ITER I&C system to enable ITER to meet
[27] ITER website plant control design handbook pages, http://www.iter.org/
its objectives. A wide range of activities have been completed, are mach/codac/PlantControlHandbook.
in progress and are planned to ensure that I&C integration will be [28] J.Y. Journeaux, et al., Instrumentation and control standardization in the ITER
achieved on time and the project will be a success. project, SOFT-26, Fusion Eng. Des. 86 (October (6–8)) (2011) 1157–1162.
[29] S. Simrock, et al., Maturity assessment of ITER diagnostics plant
instrumentation and control design, SOFT-28, Fusion Eng. Des. 96–97
Disclaimer (October) (2015) 952–956.
[30] D. Stepanov, et al., Integrated approach to the development of the ITER control
system configuration data, ICALEPCS (2012), ISSN 2226-0358, p. 74–77.
The views and opinions expressed herein do not necessarily [31] M. Park, et al., Orally presented at 9th IAEA technical meeting on control, in:
reflect those of the ITER Organization. Data Acquisition and Remote Participation for Fusion Research, Hefei China,
2013.
[32] A. Luchetta, et al., Control and data acquisition of the ITER full-scale ion
Acknowledgements source for the neutral beam test facility, Fusion Eng. Des. 96–97 (October)
(2015) 512–516.
Carlos Fernandez Robles, Guoming Liu, Pierre Petitpas, Mikyung [33] R. Castro, et al., Data archiving system implementation in ITER’s CODAC core
system, SOFT-28, Fusion Eng. Des. 96–97 (October) (2015) 751–755.
Park, Stefan Simrock, Denis Stepanov, Antonio Vergara Fernandez [34] R. Castro, et al., Data archiving software implementation in ITER’s CODAC core
and Ryan Wagner from IO-CT. System, in: Presented at SOFE, Austin, USA, 2015.
Mahesh Khedekar and Ranjan Sharma from Tata Consultancy [35] A. Winter, et al., Implementation strategy for the ITER plasma control system,
SOFT-28, Fusion Eng. Des. 96–97 (October) (2015) 720–723.
Services. [36] M.L. Walker, et al., Development environment for tokamak plasma control, in:
All colleagues from IO-CT, IO-DAs and their partners who are Presented at SOFE, Austin, USA, 2015.
contributing to the design of the ITER I&C system. [37] S. Nair et al, Instrumentation and control of the ITER electrical power
distribution system, Electrical Machines and Systems (ICEMS), 2013
International Conference (2013) 1313–1318, http://dx.doi.org/10.1109/
References ICEMS.2013.6713241.
[38] M. Ruiz, et al., ITER fast plant system controller prototype based on PXIe
[1] J. Lister, et al., The ITER CODAC conceptual design, SOFT-24, Fusion Eng. Des. platform, 8th IAEA technical meeting on control data acquisition, and remote
82 (October (5–14)) (2007) 1167–1173. participation for fusion research, Fusion Eng. Des. 87 (December (12)) (2012)
[2] J. Lister, et al., The status of the ITER CODAC conceptual design, 6th IAEA 2030–2035.
technical meeting on control, data acquisition and remote participation for [39] B.B. Carvalho, et al., The ITER fast plant system controller ATCA prototype
fusion research, Fusion Eng. Des. 83 (April (2–3)) (2008) 164–169. real-Time software architecture, SOFT-27, Fusion Eng. Des. 88 (October (6–8))
[3] N. Utzel, et al., ITER CODAC status and implementation plan, 16th IEEE NPSS (2013) 541–546.
Real-time Conference. IEEE Transactions on Nuclear Science 57 (2) (2010). [40] S. Simrock, Diagnostic use case examples for ITER plant instrumentation and
[4] L. Scibile, et al., The ITER safety control systems—status and plans, 7th IAEA control, Presented at ICALEPCS (2013).
technical meeting on control, data acquisition and remote participation for [41] I.E.C. 61850, Communication networks and systems in substations.
fusion research, Fusion Eng. Des. 85 (July (3–4)) (2010) 540–544. [42] J. Goff, et al., Control and Instrumentation of the ITER Coil Power Supply
[5] A. Wallander, et al., ITER instrumentation and control—status and plans, 7th System, Control and Automation 2013: Uniting Problems and Solutions, IET
IAEA technical meeting on control, data acquisition and remote participation Conference (2013) 1–6, http://dx.doi.org/10.1049/cp.2013.0006.
for fusion research, Fusion Eng. Des. 85 (July (3–4)) (2010) 529–534. [43] H. Patel, et al., Process control design of ITER heat rejection system, in:
[6] A. Wallander, et al., Baseline architecture of ITER control system, 17th IEEE Presented at 10th IAEA Technical Meeting on Control, Data Acquisition and
NPSS real-time conference, IEEE Trans. Nucl. Sci. 58 (4) (2011). Remote Participation for Fusion Research, Ahmedabad India, 2015.
[7] A. Wallander, et al., News from ITER controls—a status report, ICALEPCS [44] G. Carannante, et al., User requirements and conceptual design of the ITER
(2012), ISSN 2226-0358, p. 23–26. electron cyclotron control system, SOFT-28, Fusion Eng. Des. 96–97 (October)
[8] A. Wallander, et al., Approaching the final design of the ITER control system, (2015) 420–424.
Presented at ICALEPCS (2013). [45] B. Boussier, et al., Progress in the design of ITER front-end vacuum
[9] ITER internal document, CODAC detailed design document internal reference instrumentation and controls, SOFT-27, Fusion Eng. Des 88 (October (6–8))
6M58M9. (2013) 831–843.
[10] PIC MG SHB Express Overview, https://www.picmg.org/openstandards/shb- [46] B. Boussier, et al., Preliminary design of ITER cryopumps front-end
express/. cryodistribution system instrumentation and controls, Presented at SOFE
[11] F. Di Maio, CODAC Core System Overview, http://static.iter.org/codac/cs/ (2015).
CODAC Core System Overview 34SDZ5 v5 0.pdf (2015). [47] A. Neto, et al., Conceptual architecture of the plant system controller for the
[12] F. Di Maio, et al., The CODAC software distribution for the ITER plant systems, magnetics diagnostic of the ITER tokamak, SOFT-28, Fusion Eng. Des. 96–97
in: Presented at ICALEPCS 2013, San Francisco, USA, 2016. (October) (2015) 887–890.
[13] ITER website CODAC core system page, [48] T. Yamamoto, et al., Development of instrumentation and control systems for
http://www.iter.org/mach/codac/CoreSystem. the ITER diagnostic systems in JADA, SOFT-28, Fusion Eng. Des. 96–97
[14] Siemens SIMATIC Industrial Automation Systems, http://w3.siemens.com/ (October) (2015) 1012–1016.
mcms/automation/en/automation-systems/industrial-automation/Pages/ [49] D. Hamilton, et al., Progress in standardization for ITER remote handling
Default.aspx. control system, ISFNT-11, Fusion Eng. Des. 89 (October (9–10)) (2014)
[15] Red Hat Enterprise Linux, https://www.redhat.com/en/technologies/linux- 2409–2414.
platforms/enterprise-linux. [50] B. Arambhadiya, et al., Design status of ITER IC H&CD plant system control,
[16] EPICS—Experimental Physics and Industrial Control System, http://www.aps. IEEE 25th Symposium on Fusion Engineering (SOFE) (2013) 1–6, http://dx.doi.
anl.gov/epics/. org/10.1109/SOFE.2013.6635448.