LIU PT 05.11.2015
M. Vretenar and C. Rossi
From the 2015 CMAC Report (Cost Review of LIU & HL-LHC): «the large operating cost of the
LHC could justify the acquisition of a spare RFQ to address this single-point failure item»
•
•
•
•
•
•
•
Four-vane structure
3 m length
three modules of 1 m each
RF frequency 352.2 MHz
Energy 45 keV – 3 MeV
Between LEBT (2 m) and MEBT
4 years for detailed design,
construction and
commissioning
1. Essential for operation.
2. Sensitive: small variations to geometry or voltage (coming from
deformations or contaminations) critically reduce beam transmission.
3. Exposed to load from ion source (hydrogen, unmatched particles,
caesium).
4. Monobloc brazed structure: the 3 modules cannot be opened for
repair or modifications. Machining of new modules takes years.
5. Long experience of problems: at CERN (oil pollution, 1989), at JPARC
(oil pollution), at SNS (detuning).
Laboratories that have foreseen a spare: CERN (Linac2, 1992), JPARC
(2010), SNS (ongoing), ISIS.
 Methodology: Mini-workshop (17.06.2015) with participation of CERN experts in RFQ
and in the surrounding systems, with the goal of: a) list all possible failure scenarios; b)
collectively evaluate the probability and impact of these failures; c) collectively
elaborate mitigations that if applied would reduce probability and/or impact.
 Participants: C. Rossi (BE/RF), M. Vretenar (DG/DI), A. Lombardi (BE/ABP), S. Mathot
(EN/MME), R. Scrivens (BE/ABP), J. Lettry (BE/ABP), J. Hansen (TE/VSC).
 The team identified and analysed 8 failure modes (risks):
1
2
3
4
5
6
7
8
Risk
Electrode damage (sputtering of copper) due to beam loss at the RFQ entrance
Electrode contamination due to Cs deposition / normal caesiation.
Electrode contamination due to Cs deposition / caesiation accident.
Damage of the RF power coupler (mechanical deformation or surface effects)
Vacuum degradation due to a cooling circuit water leak (e.g. from erosion of the
brazed joints of the water circuit caps).
Mechanical deformation of the RFQ.
Vacuum contamination of the RFQ from hydrocarbons.
Flanges for RF tuner or RF pick-up broken because of mechanical stress.
LEVEL
DEFINITION
LIKELIHOOD
1
Marginal
Once in >50 years
2
Low
Once in 30-50 years
3
Medium
Once in 10-30 years
4
High
Once in 5-10 years
5
Very high
Once in 1-5 years
PROBABILITY
LEVEL
DEFINITION
Total beam loss
Reduction of high intensity (Isolde)
1
Negligible
Beam stop < 1 hour
Reduction < 1 day
2
Marginal
1 hour < Beam stop < 1 day
1 day < Reduction < 1 week
3
Medium
1 day < Beam stop < 1 week
1 week < Reduction < 2 months
4
Critical
1 week < Beam stop < 2 months
2 months < Reduction < 1 year
5
Catastrophic
Beam stop > 2 month
Reduction > 1 year
IMPACT
Risk
Analysis
P I S
1
Certainly occurring, effect is
Electrode damage (sputtering of
limited because of the low duty
copper) due to beam loss at the RFQ
5 1 5
cycle of Linac4 (0.08%) and of
entrance
the presence of a pre-chopper
2
Certainly occurring, effect is
Electrode contamination due to Cs limited because Cs penetrating
5 1 5
deposition / normal caesiation.
in the RFQ immediately
oxidises (oxide is not e emitter)
3
Electrode contamination due to Cs
deposition / caesiation accident.
4
5
6
7
8
Damage of the RF power coupler
(mechanical deformation or surface
effects)
Vacuum degradation due to a cooling
circuit water leak (e.g. from erosion of
the brazed joints of the water circuit
caps).
Might happen (ISIS); in the
worst case, would require a
cleaning of the RFQ
Already well protected
mechanically, surface problems
quite unlikely
The caps on the cooling circuits
are brazed over a long distance,
if happens differential pumping
can be applied
No stresses present on the
Mechanical deformation of the RFQ.
cavity, field can be corrected
Vacuum contamination of the RFQ Pumps are dry, oil quantity is
from hydrocarbons.
minimal, voltage is not too high
Weldings and brazes are strong,
Flanges for RF tuner or RF pick-up are
if happens repair or differential
broken because of mechanical stress.
pumping can be applied
2 4 8
1 4 4
1 2 2
Mitigation
Mitigation measures already present:
a) surveillance on beam transmission;
b) pre-chopper cutting unused beam.
Additional measure: a mask in the LEBT
to scrape beam out of RFQ acceptance (to
be installed when beam is stable).
Implement a hard-wired interlock on top
of existing procedure to assure that the
amount of Cs that can enter the RFQ is
always a controlled quantity.
Implement a hard-wired interlock on top
of existing procedure to assure that the
amount of Cs that can enter the RFQ is
always a controlled quantity.
A "box" around the coupler is already
implemented. Additional mitigation
would be to build a spare Ridge 1
P' I' S'
3
1
3
3
1
3
1
4
4
1
2
2
No mitigation measure can be envisaged;
2
the risk is evaluated as low.
1
2
3
6
2
4
3
6
Build 12 additional tuners or variable
2
tuners.
Accept reduced beam transmission
2 3 6
2
during re-conditioning.
2 4 8
4 2 8 Install a protection on critical elements.
2
Overall cost of
the proposed
mitigations:
about 90 kCHF
Conclusion: after applying mitigations (total cost about 100 kCHF), all risks have an
impact medium (1 week LHC beam stop) or lower; the medium impact corresponds to
risks with marginal probability (every 50 years).

The experts look confident that the Linac4 RFQ is quite safe and that problems could
be repaired in a time comparable to what needed to install the spare.

This is a consequence of the solid design (different from JPARC and SNS) and of the
relaxed operating conditions as compared to other RFQs (low duty cycle,
conservative field level, relatively long LEBT). Is RFQ technology reaching maturity?
BUT:

Is our list of risks exhaustive? Are there other unforeseen events that could happen?

The error bars in this type of exercises are large, in particular when evaluating events
with high impact and low probability.
A careful approach should be recommended.
We could exploit the fact that CERN is the only laboratory equipped with workshops that
can rapidly produce RFQ modules and that some of the failures considered in the risk
analysis have a long time constant (from first appearance to impact on operation).
(on top of the mitigations identified in the risk analysis)
*: full construction at CERN, cost estimated by EN/MME;
alternatively, one could build the RFQ outside of CERN