Introduction

Heavy ion medical machine (HIMM) is the first domestic medical heavy ion accelerator with independent intellectual property rights in China [1]. As synchronous ring injector of accelerator, the electron cyclotron resonance ion source is built to produce beams with highly charged ions for HIMM [2]. The control system must manage several subsystems and devices efficiently and precisely to satisfy a variety of physical requirements. In the present paper, we discuss the development of the control system framework to improve the data acquisition and control characteristics for ECR ion source. Details of the system architecture, interlocking protection, main test results and resulting performance are described in the following sections.

Figure 1 shows that beam slits are used to limit the envelope of beam to a special location. The beam direction can be limited by horizontal slit or vertical slit, and position resolution is 0.1 mm. Faraday conductor is installed to collect ion beams to measure the beam intensity. Cone-type barrel copper conductor and negative bias are applied to reduce electron escape caused by ion sputtering to improve the accuracy of measurement, and the resolution is 0.1 A. Allison emittance detector employs dual slit and electrical scanning to sample beam. The horizontal emittance and vertical emittance are measured, respectively, and the resolution is 0.1 mm. Angle resolution is about 1.2 mrad. The mechanical error of the system is less than 2%.

Fig. 1
figure 1

Ion source platform schematic. It consists of ion source, glaser lens, bidirectional correction magnet, dual 90° analysis magnet, quadrupolel lens, beam slits, faraday tube and emittance detector

Full size image

Hardware system design

The ion beam generated by the ion source is accelerated by the cyclotron, and the high-energy ion beam is obtained. In the ion source control system, the modules need to be controlled mainly including vacuum module, molecular pump module, valve measurement module, cooling water module, bias power supply module, gas motor module, microwave module, signal source module, high-voltage module, extraction high-voltage module, dry pump module, mechanical pump module and intake module. Generally, ion source equipment is divided into high-voltage platform devices and low-voltage platform devices according to the working environment. The hardware architecture of the ion source control system is shown in Fig. 2. Thus, the related devices can be directly controlled with the RS485 ports or intranet. Given special working requirements, single-mode glass fibers are used between devices and converters.

Fig. 2
figure 2

Architecture of ion source control system. Devices are controlled by network switches connected to the Industrial PC (IPC). The serial port servers are used to control the devices by employing RS485 serial interfaces. Single-mode glass fibers are used between HV platform and server

Full size image

The controllers are designed with a transient voltage suppressor diode in the input port. This can prevent damage to the controllers from the electrical surges. Ferrite beads are fixed around the signal lines to suppress spike signals to the controllers, giving the controllers further protection from electrical surge damage.

Software architecture design

The control software consists of four layers, the user interface (UI), system interaction (SI), problem domain (PD) and data management (DM). The UI corresponds to remote monitoring, SI to server control, PD to field control and DM to database. These layers reflect the hierarchical structure of the system. The control architecture is capable of extending the system functions and upgrading devices. The server control layer plays a key role in the control system. The TCP/IP protocol is adopted for data transmission, and embedded SQLite is used for data processing and storage. The network controls and monitors the parameters of the system to achieve an optimized status. The network interconnects all of the different types of control hardware and provides a way to communicate with any other subsystem outside the project scope.

The control layer receives user commands and analyses them to manage the field equipment. The real-time status of the system will be sent to the data servers, which receive the experiment data acquired by the data acquisition systems. These data are processed and stored in the experiment database. The system also provides users with data services relevant to the query commands, including experiment data archiving, data processing and experiment data query. The field devices execute the network commands to connect to the system. The user interface of control system is shown in Fig. 3.

Fig. 3
figure 3

User interface of control system

Full size image

The fault-tolerant mechanism can guarantee the proper data transmission. The fault-tolerant mechanism is different from state signal or analog signal. For the state signal, the delay can avoid the incorrect data transmission [3]. If the same state feeds back for several seconds, then the control software can confirm it is reliable data, or it will be ignored. The time threshold can be changed. Threshold is set according to the property of the signal. If the signal changes quickly, then the ongoing time threshold is short. The slope of the analog signal is used to guarantee correct transmission of analog data.

Especially, the fault-tolerant mechanism is also important for the interlock protection [4]. The timely and accurate interlock protection is one of the basic requirements for the control software. Unsafe interlock protection may lead to an accident during operation of the accelerator. The feedback control can guarantee the commands are executed properly. When a command is sent to the controller, the corresponding parameters will be changed. The control software will detect the parameters. If the parameters are not changed within the specified time, a new command will be sent.

In addition, some devices may change or upgrade in particular nuclear physics experiments, and some new devices may need to be tested. So, in this case, the control software must be able to change the control commands and the state machine for these situations. Therefore, it is very important for control system with healthy flexibility and universality. The module mechanism provides a flexible reconfiguration function in the control software and different functions are implemented in different modules. The control software is composed of function modules and their communication, including but not limited to the communication modules, data decoding modules, data display modules and data storage modules. The module can be added or deleted from the software to meet the requirement of the control system. This structure allows new devices to be added easily [5].

Interlocking and protection

In order to prevent the power supplies leakage accident which may lead to breakdown of other device, alarm and interlock functions are added to control system. When the control system is operational, fault and malfunction in any of the devices can cause unstable operation of electronic cooler system, or seriously damage to the equipment. To ensure stable operation, interlock protection and alarm hardware are added to the remote control system. Required interlock of microwave machine and HV power supply is shown in Table 1.

Table 1 Required interlock of microwave machine and HV power supply
Full size table

When recoverable damage occurs, the control software must be able to recover communication. The control software systems must issue an alert when the damage is not recoverable. For example, if a large-scale slope of an analog signal is detected, the current value of the analog signal should be wrong, and an interlock protection needs to be triggered. Therefore, the fault-tolerant mechanism is particularly important for the interlock protection and a timely and accurate interlock protection mechanism is one of the basic requirements of the control software. The state of interlocking protection for accelerator system is shown in Fig. 4. Hardware interlock is designed for fast reaction conditions such as flow state, water pressure, vacuum and magnetic field related to vulnerable equipment and personal protection devices [6]. Software interlock, by contrast, is applied for water temperature and other things referring to slow reaction time devices [7].

Fig. 4
figure 4

Program state diagram for interlocking protection in subsystems

Full size image

Results and conclusions

After a long period of operation test, the system has been running steadily and reliably. Specifically, the C5+ ion beam had been extracted successfully. In practice, the control system is able to control and monitor all beam parameters. The reconstruction guaranteed the safe and stable operation of the control system. For beam emittance test, the slit distance of X direction is set to 12 mm and Y direction 40 mm. The servo motor rotates to 74°. The bias voltage reaches to − 20.6 × 4 V. Analysis magnet current is assigned the value of 161.5 A and glaser lens current assigned the value of 320 A. X rectification current reaches to 6 A and the value for C5+ ions beam intensity equals to 109 eμA. Parameters of the tested beam are shown in Table 2.

Table 2 Parameters of the test ion beam
Full size table

The current scanning of analysis magnet ranges from 80 A to 350 A. The scanning time is 30 s and the data acquisition frequency reaches to 10 times/s. Magnet scanning spectrum is shown in Fig. 5.

Fig. 5
figure 5

Magnet scanning spectrum. H2+ is selected as the standard reference peak and the analysis magnet current corresponding to the peak value is 158.1 A

Full size image

Specially, the peak value corresponding to the scanning spectrum of the analysis magnet is calculated by the equation as follows:

$$ I \propto B \propto \sqrt U \sqrt {\frac{m}{q}} , $$

I is defined as the current value of analysis magnets, B as magnetic induction intensity of analysis magnets, U as extraction high voltage, m as relative atomic mass of ions and q as charge number of ions. According to the formula, the current value of analysis magnet corresponding to C5+ is 173.2 A. When the current value of analysis magnet is set to 173.2 A and then C5+ peak position is identified. Finally, the standard reference peak is closer to the beam peak, the current error will be smaller. So, H2+ is chosen for standard reference peak for analysis. Moreover, the magnet quality could effect on the reference peak position slightly.

The latest performance, development and operational statuses of the control system are presented. The latest results and the reliable long-term operation of the accelerator demonstrated that the performance has been continually improved with the development of the control system. The control system meets the requirements of the control functions so that the experiment operations become more automatic and visual. Thus far, the system has been running successfully for several months. Experiments show that the system offers the advantages of precision, efficiency, stability and convenient operation.