1. Results of the Risk Analysis
LIU PT
A spare RFQ for Linac4 ?
Results of the Risk Analysis
What is the result of EN for Linac4
M. Vretenar and C. Rossi
From the 2015 CMAC Report (Cost Review of LIU & HL-LHC): «the large operating cost of the LHC could justify the acquisition of a spare RFQ to address this single-point failure item»

2. The Linac4 RFQ Four-vane structure 3 m length
three modules of 1 m each
RF frequency MHz
Energy 45 keV – 3 MeV
Between LEBT (2 m) and MEBT
4 years for detailed design, construction and commissioning

3. Why is the RFQ so critical
Essential for operation.
Sensitive: small variations to geometry or voltage (coming from deformations or contaminations) critically reduce beam transmission.
Exposed to load from ion source (hydrogen, unmatched particles, caesium).
Monobloc brazed structure: the 3 modules cannot be opened for repair or modifications. Machining of new modules takes years.
Long experience of problems: at CERN (oil pollution, 1989), at JPARC (oil pollution), at SNS (detuning).
Laboratories that have foreseen a spare: CERN (Linac2, 1992), JPARC (2010), SNS (ongoing), ISIS.

4. RFQ risk analysis
Methodology: Mini-workshop ( ) with participation of CERN experts in RFQ and in the surrounding systems, with the goal of: a) list all possible failure scenarios; b) collectively evaluate the probability and impact of these failures; c) collectively elaborate mitigations that if applied would reduce probability and/or impact.
Participants: C. Rossi (BE/RF), M. Vretenar (DG/DI), A. Lombardi (BE/ABP), S. Mathot (EN/MME), R. Scrivens (BE/ABP), J. Lettry (BE/ABP), J. Hansen (TE/VSC).
The team identified and analysed 8 failure modes (risks):
Risk 1
Electrode damage (sputtering of copper) due to beam loss at the RFQ entrance 2
Electrode contamination due to Cs deposition / normal caesiation. 3
Electrode contamination due to Cs deposition / caesiation accident. 4
Damage of the RF power coupler (mechanical deformation or surface effects) 5
Vacuum degradation due to a cooling circuit water leak (e.g. from erosion of the brazed joints of the water circuit caps). 6
Mechanical deformation of the RFQ. 7
Vacuum contamination of the RFQ from hydrocarbons. 8
Flanges for RF tuner or RF pick-up broken because of mechanical stress.

5. Reduction of high intensity (Isolde)
Risk classification
LEVEL
DEFINITION
LIKELIHOOD 1
Marginal
Once in >50 years 2
Low
Once in years 3
Medium
Once in years 4
High
Once in 5-10 years 5
Very high
Once in 1-5 years
PROBABILITY
LEVEL
DEFINITION
Total beam loss
Reduction of high intensity (Isolde) 1
Negligible
Beam stop < 1 hour
Reduction < 1 day 2
Marginal
1 hour < Beam stop < 1 day
1 day < Reduction < 1 week 3
Medium
1 day < Beam stop < 1 week
1 week < Reduction < 2 months 4
Critical
1 week < Beam stop < 2 months
2 months < Reduction < 1 year 5
Catastrophic
Beam stop > 2 month
Reduction > 1 year
IMPACT

6. Risk rating Risk Analysis P I S Mitigation P' I' S' 1
Risk
Analysis P I S
Mitigation P' I' S' 1
Electrode damage (sputtering of copper) due to beam loss at the RFQ entrance
Certainly occurring, effect is limited because of the low duty cycle of Linac4 (0.08%) and of the presence of a pre-chopper 5
Mitigation measures already present: a) surveillance on beam transmission; b) pre-chopper cutting unused beam. Additional measure: a mask in the LEBT to scrape beam out of RFQ acceptance (to be installed when beam is stable). 3 2
Electrode contamination due to Cs deposition / normal caesiation.
Certainly occurring, effect is limited because Cs penetrating in the RFQ immediately oxidises (oxide is not e emitter)
Implement a hard-wired interlock on top of existing procedure to assure that the amount of Cs that can enter the RFQ is always a controlled quantity.
Electrode contamination due to Cs deposition / caesiation accident.
Might happen (ISIS); in the worst case, would require a cleaning of the RFQ 4 8
Damage of the RF power coupler (mechanical deformation or surface effects)
Already well protected mechanically, surface problems quite unlikely
A "box" around the coupler is already implemented. Additional mitigation would be to build a spare Ridge 1
Vacuum degradation due to a cooling circuit water leak (e.g. from erosion of the brazed joints of the water circuit caps).
The caps on the cooling circuits are brazed over a long distance, if happens differential pumping can be applied
No mitigation measure can be envisaged; the risk is evaluated as low. 6
Mechanical deformation of the RFQ.
No stresses present on the cavity, field can be corrected
Build 12 additional tuners or variable tuners. 7
Vacuum contamination of the RFQ from hydrocarbons.
Pumps are dry, oil quantity is minimal, voltage is not too high
Accept reduced beam transmission during re-conditioning.
Flanges for RF tuner or RF pick-up are broken because of mechanical stress.
Weldings and brazes are strong, if happens repair or differential pumping can be applied
Install a protection on critical elements.

7. Risk Analysis summary
Overall cost of the proposed mitigations: about 90 kCHF
Conclusion: after applying mitigations (total cost about 100 kCHF), all risks have an impact medium (1 week LHC beam stop) or lower; the medium impact corresponds to risks with marginal probability (every 50 years).

8. Conclusions
The experts look confident that the Linac4 RFQ is quite safe and that problems could be repaired in a time comparable to what needed to install the spare.
This is a consequence of the solid design (different from JPARC and SNS) and of the relaxed operating conditions as compared to other RFQs (low duty cycle, conservative field level, relatively long LEBT). Is RFQ technology reaching maturity?
BUT:
Is our list of risks exhaustive? Are there other unforeseen events that could happen?
The error bars in this type of exercises are large, in particular when evaluating events with high impact and low probability.
A careful approach should be recommended.
We could exploit the fact that CERN is the only laboratory equipped with workshops that can rapidly produce RFQ modules and that some of the failures considered in the risk analysis have a long time constant (from first appearance to impact on operation).

9. Additional options
(on top of the mitigations identified in the risk analysis)
*: full construction at CERN, cost estimated by EN/MME; alternatively, one could build the RFQ outside of CERN