Oriented Service Computation In Magnetic Fusion Research
by David P. Schissel Presented at IFIP Working Conference WoCo9 Prescott, AZ July 1712, 2006
Acknowledgment
The National Fusion Collaboratory Project Team Members (Distributed) C-Mod (MIT), DIII-D (GA), NSTX (PPPL) Argonne National Lab, Lawrence Berkley Lab, Princeton University, University of Utah The Staff of the DIII-D National Fusion Facility Work is supported by the USDOE Department of Energy SciDAC: Office of Advanced Scientific Computing Research Significant leveraging: Office of Fusion Energy Sciences
Presentation's Key Points
The international fusion community is building ITER Located in France, burning plasma #1 DOE/OS Facility priority National Fusion Collaboratory Project (FusionGrid) Fusion scientists using NFC tools NFC Project modifying/creating new software Collaborative Control Room: Time critical analysis Push time critical analysis to the WAN Being tested by FusionGrid on existing machines Extend our existing tools to meet future needs Both functionality and to the broader international FES community We seek new partners to help test and extend our work
The Fusion Reaction Powers the Stars and Produces the Elements of the Periodic Table
For 50 years worldwide, teams have been trying to exploit the fusion reaction as a practical energy source
The promise is for an environmentally friendly method for generating electricity with an inexhaustible fuel supply
The Fusion Reaction Elastic Scattering Curves Lead us to the Study of Confined Plasmas
Even at the optimum energy, the nuclei are much more likely to scatter elastically than to fuse Nuclei must be confined for many interaction times Multiple scatterings thermalize the constituent particles At the energies involved (10 - 100 keV) matter becomes fully ionized = plasma
Magnetic Confinement - Ionized Particles are bent by the Lorentz Force into Circular Orbits
In the simple example shown, there is no confinement at all parallel to the magnetic field (B)
For a practical device, the end losses must be eliminated
Fusion Research Presents Many Challenges
Development of physical models for plasma stability and transport Vast range in space and time which can span over 10 decades 3D motion, extreme anisotropy, free energy driven turbulence Design large experiments 3D coupling of electromagnetics, structures, heat transfer, neutronics Development of complex diagnostics Development of plasma heating and fueling methods Acquisition, analysis, display and interpretation of large quantities of experimental data All of these are computationally intensive
Three Large U.S. Experimental Facilities and a Vibrant Theoretical Community
3 Large Experimental Facilities ~$1B replacement cost Numerous theoretical groups High-performance computing
67 U.S. fusion research sites Over 1500 scientists Efficient collaboration is required Geographically diverse teams
Fusion Science Today is Worldwide Team Sport
An Example From The DIII-D National Fusion Facility in San Diego
Next Fusion Device is ITER to be Built in France
China, Europe, India, Japan, South Korea, Russia, United States
~5B total construction cost First plasma ~10 years
Burning plasma experiment Demonstrate physics viability First on our list is fusion. The prospect of limitless source of clean energy for the world leads with our commitment to join the international fusion energy experiment known as ITER. Secretary of Energy Spencer Abraham, November 10, 2003
Introducing the Department's 20-year plan for building the scienti!c facilities of the future.
The National Fusion Collaboratory Project (FusionGrid)
Funded by the US DOE under the SciDAC Program A distributed team: C-Mod, DIII-D, NSTX; ANL, LBL, PCS, Utah Started as a pilot project but has transitioned to productin usage Unify distributed MFE research into a U.S. Virtual Organization
GOALS
More efficient use of experimental facilities Integrate theory & experiment Facilitate multi-institution collaboration Create standard tool set
Not Focusing On Traditional Grid Applications Cycle Scavenging & Dynamic Configuration
Traditional computational Grids, arrays of heterogeneous servers Machines can arrive and leave Adaptive discovery where problems find resources Workload balancing and cycle scavenging Bandwidth diversity where not all machines are well connected
This model is not well suited to fusion computation: We are aiming to move high-performance distributed computing out onto the wide area network
Placing Distributed Computing Applications on the Wide Area Network Presents Significant Challenges
Crosses administrative boundaries Increased security complexity including authentication & authorization Resources not owned by a single project or program Distributed control of resources by owners is essential Needs for end-to-end application performance & problem resolution Resource monitoring, management & troubleshooting not simple Higher latency challenges network throughput & interactivity People are not in one place for easy communication
The Vision for the NFC's Technologies: Optimize the Most Expensive Resource People's Time
Data, Codes, Analysis Routines, Visualization Tools should all be thought of as network accessible services (SOA) Access is stressed rather than portability Transparency and ease of use are crucial elements Not CPU cycle scavenging or "distributed" supercomputing Shared security infrastructure with distributed authorization and resource management Ease of use: "security with transparency" X.509 certificates from a trusted Certificate Authority Distributed authorization (ROAM) for stakeholder resource control Collaborative nature of research requires shared visualization applications and widely deployed collaboration technologies Integrate geographically diverse groups
FusionGrid: Unified Security Model with Data Access
Authentication: PKI via X.509 certificates FusionGrid CA & RAs Centralized certificate management Onetime login (Globus GSI & GRAM) Authorization: Centralized ROAM Controlled by resource providers More secure & easier to use Data: Secure via MDSplus Client-server model Not file transfer
MDSplus data system used worldwide
TRANSP: Successful Grid Computing for Fusion Science
The U.S. TRANSP Service 5,800 cases, 35,000 CPU hours 10 fusion experimental machines Centralized expertise for better support Debugging, maintenance, monitoring Reduced administration work at other labs Smaller sites to use bigger codes Model for other codes GATO released rapidly ONETWO transport code in future
FusionGrid's Usage Continues to Grow
Total TRANSP Runs Per Year
TRANSP In Runs FY 2004
FusionGrid Monitoring (FGM) for Scientists
FusionGrid Monitoring Web client with real-time graphics
Web browser client java servlet Expert system Registered posts Relational database
Self-management of Credentials was too Burdensome to FusionGrid scientists
Credential management a burden Browser/platform problems Exporting/converting/installing Had to learn a new concept openssl x509 -in cert.p12 clcerts -nokeys -out usercert.pem
Scientists need to get work done, not figure out how to work with certificates
A solution was needed Make things simple for the users
/etc/grid-security/grid-mapfile
Authorization Relied on Grid-Mapfiles and Lacked a Big-Picture Coherence
Site administrators need to control access to their sites
Resource providers need to control access to their codes/data Users just need to get work done In this distributed environment, it was easy to get lost A solution was needed
Security was Simplified through a Credential Manager and a New Authorization System
Self-management of credentials was too hard for users Get rid of self-management where possible Use MyProxy to get rid of import/export/installation tasks Credential manager to request/renew/revoke certificates Password hint/change Authorization was too hard for users and admins Create something better Created an authorization system called ROAM Resource Oriented Authorization Manager Build a coherent model of grid-wide authorization Centralized authorization information Leave room for innovation
MyProxy Credential Manager Simplified many Tasks
MyProxy used to store delegated proxy certificates
Users retrieve delegation when they sign in Username/Password: understood by all
Credential manager created simple web interface for many tasks Request certificate Request password hint Change password
A Coherent Authorization Information Model Laid the Foundation for a New Authorization System (ROAM)
Resource Oriented Authorization Manager
RESOURCES resource USERS user dn
_
_
Focus on resources A resource can be a code, a database, an entire site
fname RESOURCE-PERMISSIONS lname
_
resource
_
permission AUTHORIZATIONS user
_
If you have to sign a form to use it, it's probably a resource
PERMISSIONS permission
_
resource
_
permission context
_
Empower stakeholders to specify types of permissions
Users and Admins Interact with ROAM through a Secure Web Page
Users request authorization through web page Admins grant authorization through same web page Create new resource or permissions
View your permissions
Show log of queries
ROAM Avoids Push Model of Authorization
User "signs in" as normal, tries to use a resource as normal Resource queries ROAM for authorization information and makes authorization decision based on that information
Example: a Typical Two-Rule Authorization Policy
Authorization policy for a service S1 might be User must have access permission to site S0 User must have execute permission on code S1
Service sends two queries to ROAM
If answers are both yes, user can use the computational service
User Feedback on Credential Management Positive
Put simply, nobody misses self-management of credentials
Scientists understand the metaphor Username/password needed to "sign on" to grid No new knowledge needed therefore no training Easier to get work done
Other benefits: Password hint/change has been helpful MyProxy arguably more secure: users don't interact with their files (which are kept on a secure server) and instead "sign-in"
Fusion Experiments Consist of Pulses
Turn on again, then off again
Raw data from sensors is collected during each pulse
Raw data analyzed between pulses Decisions on what to do for the next pulse are based on data analysis
Experimental Fusion Science is and will continue to be a Very Demanding Real-Time Activity
Different than other sciences: e.g. High Energy Physics
Today Most Between-Pulse Analysis is Local
24-CPU DIII-D Linux Cluster
FusionGrid Tested for ...