ARIEL e-linac Machine Protection System Requirements

TRIUMF Document-85636 ARIEL e-linac Machine Protection System Requirements Document Type: Requirement (Specifications) Release: 02 Release Date: 2013/06/17 Author(s): Shane Koscielniak Note: Before using a copy (electronic or printed) of this document you must ensure that your copy is identical to the released document, which is stored on TRIUMF s document server. 20130617 153300 Template: Document-18187 Rel.3 Page 1 of 2

ARIEL e-linac Machine Protection System Requirements Document:85636 Release No: 02 Release Date: 17/06/2013 History of Changes Release Number Date Description of Changes Author(s) 1 2013/05/22 Initial Release Shane Koscielniak 2 2013/06/17 Changes since Release 1 ii) Policy statement concerning recovery from beam throttling ii) Use of radioactive source for calibration of PMTs and LICs. Shane Koscielniak 20130617 153300 Template: Document-18187 Rel.3 Page 2 of 2

ARIEL e-linac Machine Protection System Requirements 1 Introduction This document, and its companion Rationale (Document # 87810), concerns the Machine Protection System (MPS) for the ARIEL electron linear accelerator (e-linac) and beamlines; this is intended to be a 500kW beam power capable accelerator with current up to 10mA and energy up to 75 MeV, and nominal energy 50 MeV. The linac is housed in a vault called the electron hall (e-hall); and the majority of the beamline is in a separate tunnel leading to the target stations. The primary mission of the MPS is protection of the accelerator and beamline equipment from damage associated with operation of a high-power electron beam. The secondary mission is to provide a beam loss accounting and tools for enforcing strict upper limits on long-term loss rates. The MPS is critical to efficient commissioning and trouble-free routine operation of the facility. The MPS operates in the context of the Personnel Radiation Safety System (PRS) and its requirements. 1.1 Naming Some of the concepts upon which the E-linac MPS is founded originate from the CEBAF MPS at Jefferson Laboratory, Virginia USA. Please note, that which is called Beam Properties at TRIUMF- ISAC is called Beam Mode at Jefferson Laboratory, and that which is called Beam Path at ISAC is called Machine Mode at JLab. The JLab convention emphasizes (i) that each Beam Property (i.e. Beam Mode) is a single state, but with several attributes; and (ii) that the Beam Path (i.e. Machine Mode) is in fact a characteristic property of the machine, and not of the charged particle beam. For consistency across the TRIUMF site, the ISAC name convention shall be adopted; nevertheless the Jefferson laboratory intentions shall be observed. 2 Reaction The Fast Shut Down (FSD) accepts inputs from critical devices and the Beam Loss Monitor (BLM) system, and initiates beam property changes or fast beam trips (via the gun-interface). The FSD shall also accept input from the Beam Position Monitors (BPMs): trajectory out of range is a predictor for imminent beam loss and could initiate a beam properties change. The FSD elaborates critical signals and react with the prescribed reaction time. Rapidity requirements depend on the potential hazard associated with the given signal. The FSD accepts signals from BLMs and critical equipment. Only devices that can be damaged or whose failure can directly cause damage are introduced as inputs for the FSD. For example, required fast 1 1 Section 2 of Rationale document. 1 P age

response is <10 μsec for signals issued by beam loss monitors (BLM) and insertion devices, whereas magnet failures are typically 2 slow due to their large inductance and are not interfaced into the FSD. The required action is determined from the device/signal originating the FSD trip; and might be to invoke beam properties with lower beam current. For the sake of example, the FSD inputs, reaction time and reduced beam properties (mode) is given in Table 5. Default Beam Mode and timing requirements for each FSD input in JLAB IR FEL MPS document. This is excerpted in Section 7 of this document. The fast beam shut off will be achieved by tripping off at the electron source. The fast beam inhibit should operate in the fail safe mode. It is mandatory that devices requesting MPS reaction transmit their interlock signals in the fail-safe fashion. The FSD reactions, (i.e. beam trips or beam property change) and accompanying loss data, will be logged and made available to the E-linac Control System for aid in fault diagnosis. 2.1 Equipment failures The MPS deals with two specific types of equipment faults: Faults that lead to inserting devices into the beam. Faults that lead directly to the damage of another device by the beam. Example of the former: a faulty vacuum valve stays in the closed position, or faulty diagnostic actuator stays inserted, or two diagnostics are inserted simultaneously in one box. This must be defeated by hardware interlocks. An example of the latter: beam is present and there is no appreciable loss and then the raster magnet fails. The beam must be withdrawn (i.e. fast trip) on a timescale of 100 µs otherwise the tuning dump will suffer damage. This scenario must be avoided by direct interlock of the raster to the MPS and thence electron gun. The usual classes of equipment internal fault that lead to equipment OFF (to avoid internal damage) are dealt with by the systems themselves and/or responded to by EPICS controls; they are not the domain of the MPS. 3 Devices that need MPS interlock, and particularly interrupt 3.1 Preamble Of course, all systems need interlock in the sense that they must be present and operational prior to a request for beam on. Most of these are entirely the domain of EPICS; i.e. software interlocks based on the equipment status reported to EPICS. However, there is a subset of devices that the JLab MPS insists be hardware interlocks; namely the mandatory critical devices and the discretionary intercepting devices. 2 With the exception of dipoles leading to beam dump locations. 2 P age

Similarly, all systems need a response to interlock interrupt : many equipment fault states are incompatible with beam operation and must lead to beam off. Moreover, there are interdependencies between systems. For example, some classes of cryogenic or vacuum fault will result in requests for beam of and HPRF off. When the timescale for development of such faults and their consequences is of order seconds or more, the response to an equipment fault is enacted within EPICS whether or not it may precipitate beam loss. However, there is a subset of devices whose fault modes are potentially damaging on fast time scales (<100ms) and which require direct intervention by the MPS on a interlock interrupt. This set of devices is that defined in Section 3.2; it includes the mandatory and discretionary devices but is broader and contains additional devices. Moreover, the rapidity of the response varies by device; and in principle can be enacted by different levels of hardware/software with the appropriate latency. 3.2 Devices that need MPS intervention For these devices, the required MPS reaction to a fault is defined in a table indexed by device and its corresponding attributes time to respond and default beam property under fault condition. Equipment owners shall provide this data to the MPS coordinator. See example Table 5. Default Beam Mode and timing requirements for each FSD input in JLAB IR FEL MPS document. This is excerpted in Section 7 of this document. MPS shall automatically protect (i.e. interlock before beam on, or interlock interrupt while beam on) the following devices from suffering or causing beam-related damage: a. Vacuum valve inserted in the beam path b. Vacuum faults leading to beamline pressure rise 3 c. Fast Acting Vacuum Valve(s) d. Intercepting diagnostics 4 i. Excessive beam current ii. Loss of cooling water, if applicable (EPICS) iii. Insertion due to fault in reading of status. iv. View screen calibration targets are compatible only with no e-beam. e. Other insertion devices, if applicable f. Targets and Beam dumps i. Loss of water flow (EPICS) ii. Loss of raster iii. Loss of defocusing magnet (EPICS) iv. Excessive temperature (EPICS) v. Excessive quadrant plate signals. g. High power RF system faults i. Cavity quench fault (if practicable) ii. Power coupler vacuum (i.e. warm or cold RF window fault) iii. Klystron Arc fault 3 The residual gas out scattering rates from the beam pipe at 1 atmosphere of air inside the pipe are about 1% per cm is lost on the pipe. After 1 metre, almost all is lost. 4 Includes beam stops and Faraday cups. 3 P age

iv. Klystron HV Power Supply (KPS) fault (EPICS) v. Others h. Gun system fault. i. High Voltage (HV) out of range (EPICS) ii. Others, if any i. User equipment if applicable j. MPS shall protect the beam dumps and the RIB targets; i.e. interlock to the raster magnets and water cooling circuits. Note, there are two kinds of damage scenario represented in this list: 1) The device is itself directly damaged (a, c, d, e) 2) The device fault directly leads to the damage of another device (b, f, g, h). Note also, that we stipulate MPS shall protect. This is NOT synonymous with FSD. In some cases, the response will be through the FSD and in others it is via EPICS (as indicated). 4 Trip Recovery & Post-Mortem Trip recovery may entail diagnosis of fault conditions and causation chains. With multiple pieces of hardware and inter-related systems, conditions may be quite complex. Where possible the MPS should help to identify the initial fault; it does this in two ways: Providing visual synoptic displays of beam loss at individual detector locations By latching all equipment values at the time of trip (to within the sub-system time resolution). The post mortem requirement shall extend to the first FSD-driven request for a beam property change. 4.1 Latch and Time Stamp All systems shall have a provision to latch their state variables and read out to EPICS. In particular, systems which sample their internal states at high rates (such as Low Level RF 50kHz and Beam Position Monitors up to 1 MHz) shall latch and time stamp, and then read out their buffers. Systems that must accept latching and time stamping of their internal buffers are LLRF and BPMs. The time stamping must be according to a central clock and will enable the correlation of the data in the latched devices. 5 Beam Path and Properties Which operating modes are safe for the machine will depend on the beam energy and intensity (beam property) and the machine components in use (beam path). In some cases, peak and average power may be substituted for energy and current, because they are calculable from one another. Beam power may be calculated in software from EPICS values. The MPS must have means of establishing what are safe configurations of devices and means for inhibiting beam-on requests by operators unless a machine-safe configuration is present. 4 P age

Beam path is a minimalist start-through-end list of critical equipment. Beam property is a current and time structure delivering a peak and average power at a given energy. Operation mode is a permitted (i.e. equipment safe) combination of beam-path and beam-property. The procedure is for the operator first to request a beam path, and then to request a beam property. For a particular beam path, some devices are mandatory (vacuum valves, beam stop/dump, dump dipoles) while others are discretionary (insertable beam diagnostics). Machine path is selected through ECS (EPICS controls), and ECS must automatically control the status (IN/OUT, ON/OFF, POLARITY, WITHIN-ACCEPTABLE-RANGE, etc) of the mandatory devices according to the path. The operator selects, through ECS, a beam property from those permitted by the MPS. For example, a 100kW c.w. beam is not permitted unless the beam path includes either the 100kW tuning dump or one of the full power target stations as the beam terminus. For a particular pulsed beam property, some values (pulse length and rep rate) are discretionary provided the peak and average power remain within acceptable ranges. The operator proposes discretionary values through the ECS, and the MPS performs beam power computations and logic that permit or prohibit the request. The operator chooses the status of discretionary insertable devices, if any, through ECS. The ECS performs veto on requests. A machine configuration is the combination of mandatory critical devices and discretionary insertable devices present in the start-through-end list. The MPS senses the status 5 of all critical devices and logically determines if the configuration and beam property is allowed. If the operation mode is permitted then the e-gun inhibit is removed; if the operators selection is not permitted, then the inhibit is not removed. 5.1 Mandatory Critical Devices Here we are concerned with preventable configuration errors. The complete list of device types is as follows: vacuum valves that may be penetrated by the beam, beam stop/dump, dipole magnets leading directly to a dump. These devices know from the beam path (alone) their required status (e.g. must be IN/OUT of must beam ON/OFF). Their logic is captured in a truth table indexed by device and beam path. Equipment owners shall provide this data to the MPS coordinator. See example Table 1. Required Vacuum Valve Status for each Machine Operating Mode in JLAB IR FEL MPS document. 5.2 Discretionary Insertable Devices These are the intercepting diagnostics, and include the insertable beam stops. Here we are concerned with preventable configuration errors. For these devices, the required MPS permissions are defined in a table indexed by beam property. 5 Insertable devices while in motion are considered to be IN for assessing vulnerability to damage. 5 P age

Equipment owners shall provide this data to the MPS coordinator. See example Table 3. Allowed Beam Mode vs. status of insertion devices in JLAB IR FEL MPS document. Fast wire scanners may either fly or be stepped. These states are distinct and correspond to different beam property. Different types of view screen target may occur in the same ladder; if their compatibility differs between beam modes, then this shall be stated. There is the complication that in some cases, the beam terminus is a discretionary device, namely one of the insertable beam stops. These cases are called out as explicit beam paths. 6 Operations Modes Proposal Operation mode: a permitted (machine safe) combination of beam path and beam property. See for example Table 4. Matrix of Beam Mode vs. Machine Operating Mode in JLAB IR FEL MPS document. 6.1 Candidate Beam Properties Property # Description Macropulse width 0 No beam 1 Scintillator viewer limited 2 OTR viewer limited Pulse repetition frequency In-pulse current, I Average power constraint 100µs 10Hz 0.1mA I 2W @ 10MeV 0.2mA 1ms 10Hz 2mA 20W @ 10MeV 3 Up to 100W 1ms 10Hz 10mA 100W @ 50 MeV 4 Up to 1kW Up to C.W. Up to C.W. 0.1mA 1kW @ 10MeV 5 Up to 100 kw C.W. C.W. 0.2mA I 4mA 100 kw @ 50-25 MeV 6 Up to 500kW C.W. C.W. 4mA I 10mA 500kW @ 50MeV 6.1.1 Interpretation Beam property sets the maximum level of beam power and/or current that is permitted. The lowest current from the electron gun is approx. 0.1 ma when RF modulation 6 is applied. Combinations in columns 3 through 5 must lead to average power less than or equal column 6. Property #1: compatible with all insertable diagnostic devices. Property #2: compatible with insertable diagnostic devices except scintillator view screens. Property #3: compatible with insertable diagnostic devices except scintillator and OTR view screens. Property #3-6: compatible only with fast wire scanner in its flying mode. 6 Beam is not permitted unless modulation is present. 6 P age

6.1.2 Default Beam Properties Given that Operators are permitted some discretion in precise settings, we must state the defaults for an FSD-initiated mode change or when Operator discretion is not exercised. Property # Macropulse width Pulse repetition frequency In-pulse current Average power constraint 0 1 100µs 10Hz 0.1 ma 1W @ 10MeV 2 100µs 10Hz 1.0 ma 10W @ 10MeV 3 100µs 10Hz 10 ma 100W @ 50MeV 4 C.W. C.W. 0.1 ma 1kW @ 10MeV 5 C.W. C.W. 1.0 ma 100kW @ 50MeV 6 C.W. C.W. 10 ma 500kW @ 50MeV 6.2 Candidate Beam Path Path # Definition/description 0 No beam permitted 1 E-gun ELBD:MB0 ELBD (300 kev 3kW dump) 2 E-gun EINJ EMBD:MB0 EMBD (10 MeV 1 kw dump) 3 E-gun EACA EABD:MB0 EABD (25 MeV 1 kw dump) 4 E-gun EACA EACB EHAT:FC1 (100 W beam stop) 5 E-gun EACA EACB EHAT:MB4 EHD (100 kw dump) 6 E-gun EACA, EACB EHAT:MB4 EHBT:FC41 (100 W beam stop) 7 E-gun EACA, EACB EHAT:MB4 EHBT:SEPTUM41: 100 kw West target 8 E-gun EACA, EACB EHAT:MB4 EHBT:SEPTUM41: 500 kw East target 9 E-gun EHAT:SEPTUM ERBT EHAT:MB1 ERBD (5 MeV 50kW dump) 10 E-gun EHAT:SEPTUM ERBT EHAT:MB4 EHBT:SEPTUM41: 500 kw East target @ 75 MeV 6.3 Candidate Operation Modes Property Path # # 0 1 2 3 4 5 6 7 8 9 10 0 Y Y Y Y Y Y Y Y Y Y Y 1 N Y Y Y Y Y Y Y Y Y Y 2 N Y Y Y Y Y Y Y Y Y Y 3 N Y Y Y Y Y Y Y Y Y Y 4 N Y Y Y N Y N Y Y Y Y 5 N Y N N N Y N Y Y Y Y 6 N N N N N N N N Y Y Y 7 JLAB FEL Example Table 5. Default Beam Property (Mode) and rapidity requirements for each FSD input 7 P age

Fault Type Description Defaults to JLAB FEL Beam Mode: Maximum time allowed to reach safe state Viewer Viewer status = NOT OUT 1 1 ms OTR in motion OTR Status = NOT IN OR NOT OUT 1 10 ms OTR IN OTR Status = IN 2 10 ms High Power Beam Dump Fault Dump cooling = fault 0 100 ms Insertable Dump in motion Dump Position = NOT IN OR NOT 1 10 ms OUT Insertable Dump IN Dump Position = IN 2 10 ms Multislit Multislit position = IN 2 10 ms Wiggler Accumulated Dose Wiggler Accumulated Dose > max limit 0 1 sec Gun HV Out of Range 0 100 ms Beam Loss Monitor Trip BLM detected signal > limit 0 156,000 ua-us Beam Loss Monitor HV Supply HV Supply Status = Fault 0 1 sec Vacuum Valve Fault Valve status = NOT OUT 0 1 ms Vacuum Chassis Fault Vacuum pressure > limit 0 1 ms RF P1 RF fault 0 100 us Optical Control Room FSD User Defined 0 10 ms Request User FSD Request User Defined 0 10 ms Beam Mode 0 Beam Mode 1 No Beam Viewer Limited Beam 7.1 Beam Loss Monitor Calibration (JLab) The BLM system is audited as part of the startup process after long shut downs - usually once or twice per year. Operations personnel does a quick BLM setup check before going to CW (high power) after a short down (hours). Both of the above use the internal LED test source. There are continuous health checks in the background. One of the most useful is Photo Multiplier Tube (PMT) current versus voltage. Beam based tests are performed only during commissioning or to rule out a BLM error as a source of frequent trips. 8 P age

Requirements 8 High-level functional requirements 1. MPS shall protect the accelerator components from damage related to the direct interaction with the beam. This includes uncontrolled and/or catastrophic beam losses, chronic beam losses, tuning losses, and long term radiation damage and/or activation. 2. The MPS shall facilitate configuration according to operation modes. An operating mode is a combination of a beam property and a beam path that is deemed safe to equipment. 3. MPS shall prevent human actions/errors that are incompatible with operating modes (i.e. perform veto). 4. The MPS shall provide a chronic beam loss accounting as a tool for long term loss management. Tool shall provide aggregate losses for whole machine and by-geographic area for time frames ranging from hours to months. 5. MPS shall prohibit electron beam emission from the gun if safe machine settings are not present (i.e. inhibit). 6. The MPS shall provide a fast beam trip function based on catastrophic beam loss detection (i.e. beam is previously ON and tripped OFF) by ionizing radiation monitors. 7. MPS shall provide a fast beam trip function based on greater than two BPM signals beyond threshold range. BPM signals shall be normalized such that transverse position out of range shall be independent of beam average or peak current. 8. The MPS shall provide a beam inhibit function based on the status of critical devices: i.e. beam is previously OFF, and cannot be turned ON until all interlocks are present. Which interlocks must be present depend on the operation mode. 9. The MPS shall provide an interlock interrupt response: the beam is previously ON and loss of the interlock leads to either a. beam property change, or b. beam turned OFF depending on the device fault. 10. MPS shall protect the beam. The system shall not generate unnecessary beam trips or equipment trips. a. Rapidity and type of response to an interlock interrupt depends on the type of fault; in some cases it may be permissible to change beam property (i.e. throttle back current). b. Excessive chronic loss leads the MPS to request that operators change beam property (i.e. throttle back current), but never a trip. c. The only devices turned off by a trip are: gun 650 MHz modulation, and klystron RF drive signal removed, and gun HVPS everything else stays on. The gun bias should be raised. 9 P age

d. Catastrophic loss always results in a beam fast trip. e. Machine operators must acknowledge a beam trip or throttle before attempting recovery. f. Reversal of a throttling back shall not occur without an Operator intervention. 11. The MPS shall have means to calibrate its ionizing radiation detectors against true beam losses. This implies those operating the MPS shall have the authority to request deliberate beam spills, provided that they are sufficiently small to avoid equipment damage (that is 10 W c.w. AND < 100 W peak). All intercepting devices except Faraday cups or beam stops or dumps must be withdrawn. 12. MPS shall help to identify the initial fault, that is provide the evidence (i.e. latch readbacks and provide geographic location(s) of loss). a. It is imperative that Beam Position Monitors buffers and captured LLRF signals latch and are time stamped; they are subsequently read out by EPICS controls for operator displays. 13. MPS shall be designed to have initial availability of>95%. The asymptotic availability should be 100%. Scheduled time shall approach 24/7 and up to 11 months/year. 14. MPS should facilitate the operation: The status of the system must be transparent to the operator at all times (i.e. truth tables for inhibits shall be available for viewing through EPICS controls). 15. MPS shall be compatible with the PRS. 16. The MPS shall distinguish proton and electron losses in the tunnel in order to minimize unnecessary trips. 17. Chronic loss management 7 is provided within the context of EPICS controls. 18. Dynamic range of chronic loss measurement devices shall be at least up to 1µA/m at 50 MeV and down to 20 na/m at 50 MeV. 19. It is not a requirement that the MPS shall make its own current measurement. It may rely on the values reported via the EPICS controls from previously verified devices. For a given beam property, the MPS requests beam source values. In C.W. mode the MPS requests current of a specified value from the gun HVPS (which measures and regulates its own current). In pulsed beam mode, the MPS requests an average current value from the gun HVPS a particular duty factor from the gun pulse train generator. 20. It is presumed that the gun HVPS and the pulsed beam current parameters are periodically calibrated by running C.W. and pulsed beams to the ELBD Faraday cup rated at 3kW. This may imply the necessity to read pulsed currents from the FC (yet to be determined). 21. EPICS displays the current measured at the DCCT and/or terminating Faraday cup or beam stop. 8.1 General technical requirements 1. MPS FSD shall not rely on direct inputs from the E-linac Control System (ECS) to maintain protection of critical machine components. 2. Critical devices are not directly controlled by the MPS, but MPS shall have right of veto over beam sent to critical devices. MPS monitors interlock status of the devices to permit/inhibit operation 7 See Section 8 of the Rationale document. 10 P age

modes. 3. MPS shall automatically determine the combination of beam property and beam path as being permitted by monitoring the status of the critical devices (dipoles and beam line insertion components such as valves, viewers, and beam stops). i.e. MPS shall not allow operator to choose an beam property that is incompatible with the machine configuration. Rationale: Removing arbitrariness from the beam property by the operator reduces the risk of human error. (TCC Agrees with this proposal.) 4. MPS shall make provisions to include the magnetic field measurements of dipoles leading to dumps (such as ELBD:MB0, EMBD:MB0, EABD:MB0, EHAT:MB4, etc) to determine the final intended destination (beam dump) for a given configuration. 5. MPS shall have means to compute peak power from beam energy and peak current; and compute average power from pulse length and repetition rate; and perform logic to test if parameters are valid for the beam property. This may be performed in software. 6. The MPS shall provide the gun modulation constraints in accord with beam property (i.e. pulse length, pulse repetition rate, within-pulse current to be compatible with beam power for that mode). 7. Once a valid beam property is established the MPS system shall automatically configure 8 itself to monitor only those inputs which are required for beam operation to the designated beam dump. For example, there is no point monitoring MPS detectors in the tunnel if the beam terminates at EABD. 8. Concerning 7, the permitted configurations can only be changed or disabled after a formal request to the shift leader. An example of the conditions where this authority may be exercised is the case of a device that is not correctly reading/reporting its true status. 9. In the case of simultaneous multiple critical equipment interlock interrupts, the MPS reaction is determined by the worst case damage fault. 10. Each critical device which may be the source of an interlock interrupt shall have attributes which define the time allowed to reach a safe state and the permitted beam property in the faulted state. 11. Operator interface to the MPS shall be through the EPICS control system. Operator screens will be used to monitor system status (inhibits, masks, etc) and reset trips. Additional screens may be used to setup beam loss monitors and initiate built in self tests of fast trip components (i.e. detectors and comparators). 12. The MPS shall foresee bypass mechanisms for the MPS hardware: software masks initiated by an operator (if enabled using hardware jumpers) and beam/machine mode masking. The bypass mechanisms are relevant for the system tests, debugging and developments. Masking shall never be used with RIB production or other high power beams. *Actually, there is an alternative to masking implemented at Jlab FEL but not CEBAF. Provided that Beam Mode is consistent with no damage, BLMs are automatically vetoed for the duration of beam pulses; there is no deliberate operator/intervention of masking and un-masking BLMs i.e. no 8 I.E. load the appropriate system matrix; there is no decision making involved. 11 P age

opportunity to forget to un-mask. 8.2 MPS hardware specific requirements The MPS hardware shall be designed with some or all of the following requirements. 1. Fail Safe Design (i.e. reverts to safe mode when it fails), detects internal faults, cable connection status, power supply faults, etc. 2. Safe against single point failures. 3. Remote self- test and calibration capability, inter-pulse test functions (Force a fault between pulses) 4. Machine path and beam property aware 5. Controlled access to threshold settings 6. Controlled access to bypass/mask regimes 7. Circular buffers, that may be read on demand by E-linac Control System (for MPS post mortem) 8. Generate latching and impose time stamping for post mortem of other systems. 9. Comply with timing requirements 10. Take into account signal propagation in media. 8.3 Fast shut down requirements 1. FSD system shall be fail safe. At least two complementary fail-safe devices are required for FSD. 2. FSD shall provide a beam inhibit. 3. FSD shall shut off the beam by means of the electron gun. 4. FSD reaction time <10μsec after threshold exceeded. 5. FSD shall receive fast trip signal from each and all critical devices. Criticality depends on consequences and reaction time. 6. FSD shall react to interrupt either by reducing the beam property or a beam trip, depending on criticality. 7. FSD causes a beam trip if integrated loss exceeds 9 0.1µC at any time during the 0.1 second integration. 8.4 Beam property related requirements 1. Insertable diagnostics that may be operated in different ways (e.g. wire scanners fly or step) shall have interlocks that are beam property aware. 2. The operating beam property shall set the limit on peak and average current through the e-gun interface (EGI). 8.5 Beam loss monitoring requirements 1. Each channel (i.e. loss detector) shall be capable of being masked to allow the use of nearby beamintercepting diagnostics hardware. 9 See Section 7 of the Rationale document. 12 P age

2. Readback of HV is essential to assure monitors (PMT or LIC) are alive. 3. Test of PMTs by illumination with LEDs shall be foreseen. 4. Periodic testing/calibration of PMTs and LICs either with a low power electron beam (<100W) or a radioactive source (which has been cross-calibrated against the electron beam) shall be foreseen. 9 References IR FEL MPS System Ver 1.0, September 19,1997 http://elinac.triumf.ca/e-linac/wbs-areas/accelerator/machine-protect/references/jlab-fel-mps- KellyMahoney12Sept2008.doc/view 13 P age