Enrique Blanco Viñuela

CERN | CERN · Beams Department (BE)

In the last few years, control engineers have started to use artificial neural networks (NNs) embedded in advanced feedback control algorithms. Its natural integration into existing controllers, such as programmable logic controllers (PLCs) or close to them, represents a challenge. Besides, the application of these algorithms in critical applicatio...

PLCverif is an actively developed project at CERN, enabling the formal verification of Programmable Logic Controller (PLC) programs in critical systems. In this paper, we present our work on improving the formal requirements specification experience in PLCverif through the use of natural language. To this end, we integrate NASA’s FRET, a formal req...

PLCverif is an actively developed project at CERN, enabling the formal verification of Programmable Logic Controller (PLC) programs in critical systems. In this paper, we present our work on improving the formal requirements specification experience in PLCverif through the use of natural language. To this end, we integrate NASA’s FRET, a formal req...

An important aspect of many particle accelerators is the constant evolution and frequent configuration changes that are needed to perform the experiments they are designed for. This often leads to the design of configurable software that can absorb these changes and perform the required control and protection actions. This design strategy minimizes...

An important aspect of many particle accelerators is the constant evolution and frequent configuration changes that are needed to perform the experiments they are designed for. This often leads to the design of configurable software that can absorb these changes and perform the required control and protection actions. This design strategy minimizes...

Software model checking has recently started to be applied in the verification of programmable logic controller (PLC) programs. It works efficiently when the number of input variables is limited, their interaction is small and, thus, the number of states the program can reach is not large. As observed in the large code base of the CERN industrial P...

Continuous Integration and Continuous Deployment (CI/CD) is a software engineering methodology which emphasises frequent, small changes committed to a version control system, which are verified by a suite of automatic tests, and which may be deployed to different environments. While CI/CD is well established in software engineering, it is not yet w...

The design and development of Safety Instrumented Systems (SIS) according to the IEC 61511 standard is a long and costly process. Although the standard gives recommendations and guidelines for each phase of the safety life-cycle, implementing them is not a simple task. Access to reliability data, hardware and systematic safety integrity analysis, s...

One of the most critical phases in the development of a Safety Instrumented System (SIS) is the functional specification of the Safety Instrumented Functions (SIFs). This step is carried out by a multidisciplinary team of process, controls and safety experts. This functional specification must be simple, unambiguous and compact to allow capturing t...

Continuous integration is widespread in software development, but a number of factors have thus far limited its use in Programmable Logic Controller (PLC) application development. A key requirement of continuous integration is that build and test stages must be automated. Automation of the build stage can be difficult for PLC developers, as buildi...

AWAKE is a proton-driven plasma wakefield acceleration experiment. We show that the experimental setup briefly described here is ready for systematic study of the seeded self-modulation of the 400 GeV proton bunch in the 10 m long rubidium plasma with density adjustable from 1 to $10\times {10}^{14}$ cm−3. We show that the short laser pulse used fo...

Safety is likely the most critical concern in many process industries, yet there is a general uncertainty on the proper engineering to reduce the risks and ensure the safety of persons or material at the same time of providing the process control system. Some of the reasons for this misperception are unclear requirements, lack of functional safety...

The development of critical systems requires the application of verification techniques in order to guarantee that the requirements are met in the system. Standards like IEC 61508 provide guidelines and recommend the use of formal methods for that purpose. The ITER Interlock Control System has been designed to protect the tokamak and its auxiliary...

Programmable logic controllers are typically programmed in one of the five languages defined in the IEC 61131 standard. While the ability to choose the appropriate language for each program unit may be an advantage for the developers, it poses a serious challenge to verification methods. In this paper we analyse and compare these languages to show...

This paper presents the improvements made on the cryogenic control system for the LHC beam screens. The regulation objective is to maintain an acceptable temperature range around 20 K which simultaneously ensures a good LHC beam vacuum and limits cryogenic heat loads. In total, through the 27 km of the LHC machine, there are 485 regulation loops af...

CERN has recently designed and constructed a new cryogenic facility for testing large and heavy superconducting magnets at liquid helium temperatures. The facility, erected in a large assembly hall with cranes capable of up to 100 t, provides a cooling capacity of 1.2 kW at 4.5 K equivalent, 15-kW LN <sub xmlns:mml="http://www.w3.org/1998/Math/Math...

The complexity and quality needs of PLC-based control system software have largely increased. Formal specification methods can help to cope with these needs. Besides formal verification, another benefit of a formal specification language is the possibility to provide automatic generation of the final source code. This paper overviews PLCspecif, our...

Programmable Logic Controllers (PLCs) are widely used in the industry for various industrial automation tasks. Besides non-safety applications, the usage of PLCs became accepted in safety-critical installations, where the cost of failure is high. In these cases the used hardware is special (so-called fail-safe or safety PLCs), but also the software...

This paper presents the different control strategies deployed in the LHC cryogenic system in order to compensate the beam induced effects in real-time. The LHC beam is inducing important heat loads along the 27 km of beam screens due to synchrotron radiation, image current and electron clouds. These dynamic heat loads significantly disturb the cryo...

This paper presents the improvements made on the cryogenic control system for the LHC beam screens. The regulation objective is to maintain an acceptable temperature range around 20 K which simultaneously ensures a good LHC beam vacuum and limits cryogenic heat loads. In total, through the 27 km of the LHC machine, there are 485 regulation loops af...

This work deals with the optimal management of a cryogenic plant composed by parallel refrigeration plants, which provide supercritical helium to pulsed heat loads. First, a data reconciliation approach is proposed to estimate precisely the refrigerator variables necessary to deduce the efficiency of each refrigerator. Second, taking into account t...

Programmable Logic Controllers (PLCs) are embedded computers widely used in industrial control systems. Ensuring that a PLC software complies with its specification is a challenging task. Formal verification has become a recommended practice to ensure the correctness of safety-critical software but is still underused in industry due to the complexi...

Model checking is a promising formal verification method to complement testing in order to improve the quality of PLC programs. However, its application typically needs deep expertise in formal methods. To overcome this problem, we introduce PLCverif, a tool that builds on our verification methodology and hides all the formal verification-related d...

The correctness of the software used in control systems has been always a high priority, as a failure can cause serious expenses, injuries or loss of reputation. To improve the quality of these applications, various development and verification methods exist. All of them necessitate a deep understanding of the requirements which can be achieved by...

We present a proof of concept Non-linear Model Predictive Controller (NMPC) for the Superfluid Helium Cryogenic Circuit at the Large Hadron Collider (LHC). The real-time online output feedback economic NMPC is based on a complex first principles model. Through the paper, we highlight the practical methods leading to the real-time feasibility: 1) wi...

A transducer based on a virtual flow meter is proposed for monitoring helium distribution and consumption in cryogenic systems for particle accelerators. The virtual flow meter allows technical and economical constraints, preventing installation of physical instruments in all the needed measurement points, to be overcome. Virtual flow meter perform...

This paper describes the application of Model Based Predictive Control (MBPC) to the temperature regulation of the superconducting magnets for the future Large Hadron Collider (LHC), the next particle accelerator being built at the European Center for Particle Physics (CERN). This controller has the capability of having different sampling times for...

We consider the problem of temperature stabi-lization of the Large Hadron Collider's (LHC) superconducting magnets, cooled with superfluid helium 4 (He II). The tempera-ture dynamics is highly non-linear, exhibiting inverse response, variable dead-times, strong couplings between process variables and strong saturation effects. Multiple operational...

The control system of the Large Hadron Collider cryogenics manages over 34’000 instrumentation and actuator channels. The complete information on their characteristics and parameters can be extracted from a set of views on the Layout database, to generate the specifications of the control system; from these, the code to populate PLCs (Programmable...

One of the main obstacle that prevents model checking from being widely used in industrial control systems is the complexity of building formal models out of PLC programs, especially when timing aspects need to be integrated. This paper brings an answer to this obstacle by proposing a methodology to model and verify timing aspects of PLC programs....

Verification of critical software is a high priority but a challenging task for industrial control systems. Model checking appears to be an appropriate approach for this purpose. However, this technique is not widely used in industry yet, due to some obstacles. The main obstacles encountered when trying to apply formal verification techniques at in...

Formal verification has become a recommended practice in the safety-critical application areas. However, due to the complexity of practical control and safety systems, the state space explosion often prevents the use of formal analysis. In this paper we extend our former verification methodology with effective property preserving reduction techniqu...

ESS was hosting a workshop in collaboration with CERN, GSI, DESY, ITER, IFMIF, MAX IV, CEA-Saclay, INFN on 29th and 30th of August 2013, with about 50 participants, including 30 from outside ESS. About 30 presentations were given. The main focus was on PLC based interlock systems, however also fast interlock systems based on FPGAs were discussed. T...

Testing of critical PLC (Programmable Logic Controller) programs remains a challenging task for control system engineers as it can rarely be automated. This paper proposes a model based approach which uses the BIP (Behavior, Interactions and Priorities) framework to perform automated testing of PLC programs developed with the UNICOS (UNified Indust...

CERN has developed a dedicated library to model helium cryogenic plants with a commercial software called EcosimPro. The aim of such a library is to provide a simple way to model small and large scale cryogenic systems performing dynamic simulations in an acceptable timescale to assist both control and operation teams in the optimal commissioning a...

Operation of the LHC during 2010 and 2011 with 3.5 TeV beam energy and luminosity up to 3.65x1033 cm-2 s-1, led to radiation-induced failures of micro-electronic devices used in the cryogenic control system. Mitigating actions addressed equipment relocation and corrective patches on electronics and software. Driven by the technical requirements and...

In the 27 km circumference Large Hadron Collider, the temperature of more than 1600 main superconducting magnets is stabilized below 2 K by the Super uid Helium Cryogenic Circuit. The key component of the circuit's Standard Cell is an over 100 m long bayonet heat exchanger with two phase ow of super uid helium, He II, that is integrated into the ma...

The Large Hadron Collider (LHC) was commissioned at CERN and started operation with beams in 2008. The LHC makes extensive use of superconductors, in magnets, electrical feed boxes and accelerating cavities, which are operated at cryogenic temperatures. The process automation for the cryogenic distribution around the 27 km accelerator circumference...

Superfluid helium is used in the cryogenic circuit that cools down and stabilizes temperature of more than 1600 high performance, main superconducting magnets of the Large Hadron Collider (LHC) - the new particle accelerator at European Organization for Nuclear Research (CERN). This paper presents a simulation study of the application of Nonlinear...

A 107-m long superconducting magnet string representing a full-cell of the LHC machine was designed for assembly and commissioning at CERN in order to validate the final design choices. This new facility, thereafter called Test String 2, and its cryogenic infrastructure cons ist of feed and return boxes coupled via transfer lines to a 6 kW @ 4.5 K...

The Large Hadron Collider makes extensive use of superconductors, in magnets for bending and focusing the particles, and in RF cavities for accelerating them, which are operated at 1.9 K and 4.5 K. The process automation for the cryogenic distribution around the accelerator circumference is based on 16 Programmable Logic Controllers, each running 2...

This paper describes the application of a nonlinear model-based control strategy in a real challenging process. A predictive controller based on a nonlinear model derived from physical relationships, mainly heat and mass balances, has been developed and commissioned in the inner triplet heat exchanger unit (IT-HXTU) of the large hadron collider (LH...

The UNICOS industrial controls framework, initially designed for LHC cryogenics controls on top of the PVSS-II SCADA system, is being successfully deployed for several other projects based on different architectures. This includes a variety of front-end systems (multiple PLC and VME solutions), communication methods and device models. In addition t...

String2 was a 120 m full-scale model of a regular cell of the LHC accelerator arc. It was composed of eight superconducting main magnets, fed by a separate cryogenic distribution line (QRL); an electrical feed box (DFB) which supported the superconducting current leads that powered the magnets [1]. Bearing an intensive experimental programme, Strin...

The thesis addresses the study, analysis, development, and finally the real implementation of an advanced control system for the 1.8 K Cooling Loop of the LHC (Large Hadron Collider) accelerator. The LHC is the next accelerator being built at CERN (European Center for Nuclear Research), it will use superconducting magnets operating below a temperat...

The LHC Test String 2 is a 107‐m long superconducting magnet string representing a full‐cell of the LHC machine. It was designed and commissioned at CERN in order to validate the final design choices and to investigate the collective behavior and operation modes of the LHC machine systems. It has been commissioned and operated since April 2001 and...

This paper describes the application of a nonlinear model-based control strategy in a real challenging process. A predictive controller based on a non linear model derived from physical relationships, mainly heat and mass balances, has been developed and commissioned in the Inner Triplet Heat Exchanger Unit (IT -HXTU) prototype of the LHC particle...

After the commissioning and the first powering of the main circuits in autumn 2001 in its shorter version, the facility was completed to a full cell of LHC in the regular part of an arc and commissioned in July 2002. During this second run, which accumulated more than 4000 hours below 2 K, a very dense experimental program was carried-out to valida...

After the commissioning of String 2 Phase1 and the powering of the main circuits in autumn 2001, a short yet vigorous experimental program was carried-out to validate the final design choices for the technical systems of LHC. This program included the investigation of thermo-hydraulics of quenches quench propagation, power converter controls and tr...

The future Large Hadron Collider (LHC) at CERN will include eight interaction region final focus magnet systems, the so-called “Inner Triplet,” one on each side of the four beam collision points. The Inner Triplets will be cooled in a static bath of pressurized He II nominally at 1.9 K. This temperature is a control parameter and has very severe c...

CERN is now setting up String 2, a full-size prototype of a regular cell of the LHC arc. It is composed of two quadrupole, six dipole magnets, and a separate cryogenic distribution line (QRL) for the supply and recovery of the cryogen. An electrical feed box (DFB), with up to 38 High Temperature Superconducting (HTS) leads, powers the magnets. Abou...

The Inner Triplet Heat Exchanger Test Unit (IT-HXTU) is a 30-m long thermal model designed at Fermilab, built in US industry, fully automated and tested at CERN as part of the US LHC program to develop the LHC Interaction Region quadrupole system. The cooling scheme of the IT-HXTU is based on heat exchange between stagnant pressurized He II in the...

The LHC accelerator will employ 1800 superconducting magnets (for guidance and focusing of the particle beams) in a pressurized superfluid helium bath at 1.9 K. This temperature is a severely constrained control parameter in order to avoid the transition from the superconducting to the normal state. Cryogenic processes are difficult to regulate due...

The temperature of the superconducting magnets for the future LHC accelerator is a control parameter with strict operating constraints imposed by (a) the maximum temperature at which the magnets can o perate, (b) the cooling capacity of the cryogenic system, (c) the variability of applied heat loads and (d) the accuracy of the instrumentation. A te...

The UNICOS (UNified Industrial COntrol System) framework was created back in 1998. Since then a noticeable number of applications in different domains have used this framework. Furthermore UNICOS has been formalized and its supervision layer has been reused in other kinds of applications (e.g. monitoring or supervisory tasks) where a control layer...

In early 2001 a control system called UNICOS (UNified Industrial COntrol System) developed at CERN with the objective of building the LHC cryogenics control system was commissioned for the first time. It deployed the controls layers covering the SCADA (Supervisory Control And Data Acquisition) and the PLC (Programmable Logic Controllers) layers. A...

The UNICOS (UNified Industrial COntrol System) framework, and concretely the CPC (Continuous Process Control) package, has been extensively used in the domain of continuous processes (e.g. cryogenics, gas flows) and also in others specific to the LHC machine as the collimators environmental measurements interlock system. The application of the UNIC...

The low beta quadrupole magnets in the CERN Large Hadron Collider (LHC) are installed in high radiation areas on either side of the experiments. The system is equipped with sophisticated hydrostatic levelling and stretched-wire position measuring systems. A UNICOS-based control system using motorized jacks was installed to correct the alignment of...

The LHC cryogenics control system is based on the CERN Industrial framework UNICOS (Unified Industrial Control System). UNICOS covers aspects related to both the SCADA (Supervisory Control And Data Acquisition) and the PLC (Programmable Logic Controllers). The LHC cryogenic instrumentation must deal with the hostile radiation environment present in...

The Large Hadron Collider (LHC) was commissioned at CERN and started operation with beams in 2008. Several months of operation in nominal cryogenic conditions have triggered an optimisation of the process functional analysis. This lead to a few revisions of the control logic, which were realised on-the-fly. During the 2008-09 shut-down, and in orde...