Results of the Risk Analysis LIU PT 05.11.2015 A spare RFQ for Linac4 ? Results of the Risk Analysis What is the result of EN for Linac4 M. Vretenar and C. Rossi From the 2015 CMAC Report (Cost Review of LIU & HL-LHC): «the large operating cost of the LHC could justify the acquisition of a spare RFQ to address this single-point failure item»

The Linac4 RFQ Four-vane structure 3 m length three modules of 1 m each RF frequency 352.2 MHz Energy 45 keV – 3 MeV Between LEBT (2 m) and MEBT 4 years for detailed design, construction and commissioning

Why is the RFQ so critical Essential for operation. Sensitive: small variations to geometry or voltage (coming from deformations or contaminations) critically reduce beam transmission. Exposed to load from ion source (hydrogen, unmatched particles, caesium). Monobloc brazed structure: the 3 modules cannot be opened for repair or modifications. Machining of new modules takes years. Long experience of problems: at CERN (oil pollution, 1989), at JPARC (oil pollution), at SNS (detuning). Laboratories that have foreseen a spare: CERN (Linac2, 1992), JPARC (2010), SNS (ongoing), ISIS.

RFQ risk analysis Methodology: Mini-workshop (17.06.2015) with participation of CERN experts in RFQ and in the surrounding systems, with the goal of: a) list all possible failure scenarios; b) collectively evaluate the probability and impact of these failures; c) collectively elaborate mitigations that if applied would reduce probability and/or impact. Participants: C. Rossi (BE/RF), M. Vretenar (DG/DI), A. Lombardi (BE/ABP), S. Mathot (EN/MME), R. Scrivens (BE/ABP), J. Lettry (BE/ABP), J. Hansen (TE/VSC). The team identified and analysed 8 failure modes (risks):   Risk 1 Electrode damage (sputtering of copper) due to beam loss at the RFQ entrance 2 Electrode contamination due to Cs deposition / normal caesiation. 3 Electrode contamination due to Cs deposition / caesiation accident. 4 Damage of the RF power coupler (mechanical deformation or surface effects) 5 Vacuum degradation due to a cooling circuit water leak (e.g. from erosion of the brazed joints of the water circuit caps). 6 Mechanical deformation of the RFQ. 7 Vacuum contamination of the RFQ from hydrocarbons. 8 Flanges for RF tuner or RF pick-up broken because of mechanical stress.

Reduction of high intensity (Isolde) Risk classification LEVEL DEFINITION LIKELIHOOD 1 Marginal Once in >50 years 2 Low Once in 30-50 years 3 Medium Once in 10-30 years 4 High Once in 5-10 years 5 Very high Once in 1-5 years PROBABILITY LEVEL DEFINITION Total beam loss Reduction of high intensity (Isolde) 1 Negligible Beam stop < 1 hour Reduction < 1 day 2 Marginal 1 hour < Beam stop < 1 day 1 day < Reduction < 1 week 3 Medium 1 day < Beam stop < 1 week 1 week < Reduction < 2 months 4 Critical 1 week < Beam stop < 2 months 2 months < Reduction < 1 year 5 Catastrophic Beam stop > 2 month Reduction > 1 year IMPACT

Risk rating Risk Analysis P I S Mitigation P' I' S' 1   Risk Analysis P I S Mitigation P' I' S' 1 Electrode damage (sputtering of copper) due to beam loss at the RFQ entrance Certainly occurring, effect is limited because of the low duty cycle of Linac4 (0.08%) and of the presence of a pre-chopper 5 Mitigation measures already present: a) surveillance on beam transmission; b) pre-chopper cutting unused beam. Additional measure: a mask in the LEBT to scrape beam out of RFQ acceptance (to be installed when beam is stable). 3 2 Electrode contamination due to Cs deposition / normal caesiation. Certainly occurring, effect is limited because Cs penetrating in the RFQ immediately oxidises (oxide is not e emitter) Implement a hard-wired interlock on top of existing procedure to assure that the amount of Cs that can enter the RFQ is always a controlled quantity. Electrode contamination due to Cs deposition / caesiation accident. Might happen (ISIS); in the worst case, would require a cleaning of the RFQ 4 8 Damage of the RF power coupler (mechanical deformation or surface effects) Already well protected mechanically, surface problems quite unlikely A "box" around the coupler is already implemented. Additional mitigation would be to build a spare Ridge 1 Vacuum degradation due to a cooling circuit water leak (e.g. from erosion of the brazed joints of the water circuit caps). The caps on the cooling circuits are brazed over a long distance, if happens differential pumping can be applied No mitigation measure can be envisaged; the risk is evaluated as low. 6 Mechanical deformation of the RFQ. No stresses present on the cavity, field can be corrected Build 12 additional tuners or variable tuners. 7 Vacuum contamination of the RFQ from hydrocarbons. Pumps are dry, oil quantity is minimal, voltage is not too high Accept reduced beam transmission during re-conditioning. Flanges for RF tuner or RF pick-up are broken because of mechanical stress. Weldings and brazes are strong, if happens repair or differential pumping can be applied Install a protection on critical elements.

Risk Analysis summary Overall cost of the proposed mitigations: about 90 kCHF Conclusion: after applying mitigations (total cost about 100 kCHF), all risks have an impact medium (1 week LHC beam stop) or lower; the medium impact corresponds to risks with marginal probability (every 50 years).

Conclusions The experts look confident that the Linac4 RFQ is quite safe and that problems could be repaired in a time comparable to what needed to install the spare. This is a consequence of the solid design (different from JPARC and SNS) and of the relaxed operating conditions as compared to other RFQs (low duty cycle, conservative field level, relatively long LEBT). Is RFQ technology reaching maturity? BUT: Is our list of risks exhaustive? Are there other unforeseen events that could happen? The error bars in this type of exercises are large, in particular when evaluating events with high impact and low probability. A careful approach should be recommended. We could exploit the fact that CERN is the only laboratory equipped with workshops that can rapidly produce RFQ modules and that some of the failures considered in the risk analysis have a long time constant (from first appearance to impact on operation).

Additional options (on top of the mitigations identified in the risk analysis) *: full construction at CERN, cost estimated by EN/MME; alternatively, one could build the RFQ outside of CERN