ACCELERATOR RELIABILITY - AVAILABILITY
L Hardy, ESRF, Grenoble, France

Abstract
Following a pioneering period during which the major
concern of accelerator physicists was to achieve thehighest intensity as well as explore the largest range ofenergy, accelerators quickly became a tool at the serviceof a wide community. Accelerators started to be used for
medical and industrial purposes. Now, a single accelerator
can also serve a wide range of Users at the same time (Xrays sources). Reaching a high Mean Time Between
Failure as well as high availability became a constraint forsuch Machines.
Various spallation neutron sources are upgraded. The ideaof using them for transmutation processes or in the longterm, to replace the conventional nuclear reactors, has
now been comprehensively studied. Besides pureaccelerator physics considerations, it is now agreed thatthe reliability of these accelerators must be drastically
improved with respect to the present situation.

1 RELIABILITY: GENERALCONSIDERATIONS AND DEFINITIONS

under stated conditions. A system must be designed forhigh reliability when the repair of its component is long.
- The Mean Time Between Failure (MTBF) is the mean
number of life units during which all parts of a system
perform within their specified limits, during a given timeinterval.
- The Mean Down Time (MDT), the average time asystem is unavailable due to a failure. This time includes
the actual repair time plus all delays associated with therepair (finding the spare part, etc).
- The Mean Time To Repair (MTTR) is the sum of
corrective maintenance time divided by the total numberof failures during a given time interval. In the case of aparticle accelerator, this may, for example, include
waiting for radiation decay.
- Redundancy is the existence of more than one means
for accomplishing a given function. It can be:• Active: if all redundant items operate
simultaneously, or• Stand-by: in the case where one or more
redundant items are activated solely upon
failure of the primary item performing thefunction.
Finally, a system can be classified as non-repairable(missile, etc) or repairable (particle accelerator, etc).

1.1 A brief history of reliability
First reliability models emerged during World War II.
The goal was to make the rockets as well as radars morereliable. At that time, there was some confusion:
reliability of electronic components (Random failures)
was computed as for mechanical components (aging,overstress, etc). The late comprehension of this difference
marked the beginning of redundancy /reliability models.
This methodology was not of concern for particle
accelerator designers, despite the fact that, at that time,
the first electron Linac had been around for 20 years, Vande Graaff had developed the first high voltage generator
10 years previous, cyclotron developments were well inprogress, the first functioning betatron had been
completed.
1.2 Some definitions and useful acronyms
Let us first review some words or acronyms that will be
used extensively in this paper. Further comprehensive
definitions can be found in [1].
- Availability represents the fraction of time during
which a system meets its specification. A system must be
designed for high availability when continuous service isimportant.
- Reliability reflects the probability that a system canperform its intended function for a specified time interval

2 ACCELERATORS: RELIABILITY AND
AVAILABILITY CONSIDERATIONS
Although frequent system failures may be an annoyance,
if each failure can be repaired in a very short time so thatthe system has a high availability, and the maintenancecosts are reasonable, then the poor reliability may be
acceptable. For example, if failures occur on average
every fifteen minutes but can be repaired in a few
milliseconds the user will not be too concerned. On theother hand, if repair of a failure takes hours or days, theuser has a non-available particle accelerator, which will
have a significant effect on Machine Operation and …
credibility!
We will see that this question is key issue for the designof the High Power Proton Accelerator (HPPA), which
will be used in the Accelerator Driven System (ADS).
The operational effectiveness of a system is obviously
influenced by the way its components were designed andbuilt. It is, however, also influenced by the way thesecomponents are used and maintained.
2.1 Reliability and availability of particle accelerators:
evolution of users requirements with time.
The 70’s was a transition period in the history of particle
accelerator reliability. Of course, at that time, thetechnology and physics concepts of particle accelerators
were well advanced: linear accelerators, cyclotrons, andsynchrotrons could already be found in the four corners of
the globe. But until then, the Users of these particle
accelerators were generally also the designers! The main
figures of merit were the energy and intensity. Users
accepted long failures provided they could sometimes doexperiments within the framework of these figures ofmerit.
In the early 1970's new high-intensity, intermediateenergy accelerators were built at laboratories in
Switzerland (SIN), Los Alamos (LAMPF), and Canada(TRIUMF). These new ``meson factories'' produced pions(and muons) of several orders of magnitude more thanprevious sources. It was the beginning of ‘meson’factories and accelerator physicists were now supposed toserve a community of experimental physicists withmachines as reliable and available as possible.
Also around that time, motivation was high for the designof dedicated storage rings for the production ofsynchrotron radiation. When the 5-GeV NINA electron
synchrotron located at the SRS Daresbury Laboratory in
the UK shut down, a plan was approved to build a 2-GeV
electron storage ring at the same site expressly forsynchrotron radiation. These new machines brought new
constraints: large numbers of Users for short periods oftime, short lifetime of biological samples, heat load on
beam lines such that hours were necessary to recoverfrom a micronic positioning of the monochromators after
a beam interruption. Nowadays, an X-ray source can hostabout 60 different experiments at the same time! Thesemachines therefore need a high level of availability andreliability. Typical figures for these machines are anavailability of over 93 % and an MTBF in the range of
10-50 hours.
In parallel to these developments, medical applications
took on a huge importance, whether this be for diagnosisor therapy. In these cases, the accelerator must be
available when the patient is ready to be treated. Morethan 10 000 cancer patients have been treated at over 10
accelerator laboratories the last 40 years [2]. In addition,
there may be budgetary consequences following Machine
unavailability since a typical proton therapy centre
employs about 120 people (doctor, physicists, etc), costs
about 100 M€ [3] and can treat 3500 patients per year!
To conclude on the subject of existing systems
demanding a very high level of confidence, I would liketo refer to one exemplary industrial application:- In recent years, Ion Beam Applications (IBA) has
developed and installed 16 cyclotrons for the productionof 103Pd [4]. Given the 14 day lifetime of the 103Pd, used
for prostate cancer treatment, these cyclotrons have to run
for continuous periods of one week and hence require ahigh level of availability. Although the dominant
perturbations are very short RF sparks, the total downtimeof these cyclotrons is less than 1 %!

3

STATUS OF SOME TYPICAL EXISTING
FACILITIES

3.1 For neutron production
3.1.1
SINQ: a continuous spallation source.
The neutron source, SINQ, located in Switzerland, is fed
by a high power cyclotron delivering 1.8 mA intensity
protons of 590 MeV out of which 1.2 mA goes to SINQ
target. The beam power available is roughly 1 MW andthis is the reason why this cyclotron is considered to be
the reference in its field [5]. Indeed the extrapolation to
the multi-Megawatt system required for ADS isreasonable. Let us take a look at recent statistics [5].
Interruptiontime
1'-3' 3'-15 15'-60' 1-2h 2-6h 6-12h 12-24h > 24 h
Number5245 524
93
19
21
6
4
4
Time sum(hours)
92 42
42
25
75
45
70
167
Table 1: Beam interruption distribution > 1 minute at PSI in 2001

Interruptions of between one and three minutes represent
89 % of beam trips, i.e., 5245 failures. These beam trips
are typically due to discharges in the electrostatic
elements in the cyclotron. After such a trip, about 20
seconds are needed to ramp the intensity. This problem
becomes particularly critical as the power increases(1.5 mA -> 1.8 mA). Only a few events are responsible
for large downtime: missing redundancy of some coolingequipment, savings on power supply spare parts, ‘run
until it fails’ policy for RF, etc. PSI experts agree thatdrastically reducing the downtime due to (long) failures issolely a financial issue. No technical obstacles have been
identified and a program has now been set up to achievethese goals. However the reduction of short beam trips
remains a real challenge! The behaviour of electrostatic
elements is not well understood (this assessment is agreed
by most RF experts in many accelerators centres!). PSI
has developed a strategy to reduce this type of short beamtrip [6]. Measures have been taken to increase the MTBF
(RF voltage breakdown inducing beam trips) and reduce
the MTTR. Since this could be considered as a point ofgeneral interest, I will go into more detail: In order toreduce component failures, a fault diagnosis tool was
implemented, providing comprehensive data about RF
transient events: main RF parameters are buffered andafter a beam trip, the buffer continues to be fed for several
hundred µs. Very detailed information in the µs range
before and after the event can then be extracted. Modern
quality control management was developed at all levels.
In order to reduce the absolute number of beam trips, theRF cavities were thoroughly conditioned (thus avoiding
breaking the RF windows), the beam is no longer turned
off during self-recovering µ-sparks ≤ 200 µs, a ramping
procedure was established in order to recover fullresonator voltage within a few seconds and the beam after
20 seconds. To increase the lifetime of RF coupling
windows, RF sparks are actively detected in order to
shutdown the RF driver within a few µs, hence reducing
the amount of evaporated metal, which is the main cause
for cracks in the RF windows. Since then, the lifetime ofcouplers at PSI has been dramatically increased. The
remaining challenge is to reduce the number of µsparks
and non-recovering sparks by understanding the cause
and thoroughly studying the breakdown mechanisms. The
fast event datalogging system has already been very
helpful in this respect.
To reduce the downtime after a failure, the event
datalogging system mentioned above is extensively used
and in addition, a rigorous spare part policy has been
implemented. Furthermore, equipments are designed toallow fast interchangeability of units/components. For
subsystems with limited lifetime (e.g. klystrons), a policyof preventive maintenance is applied: this equipment is
replaced after a predetermined operation time. Other parts(with an “undetermined” lifetime) are regularly inspected
and each failure is now considered as an opportunity to
improve the design.
After a few years of this strict but fruitful policy, thenumber of RF trips has been considerably decreased. At
the end of 2001, not a single RF event greater than one
minute was recorded over a 10-day period!
This first example demonstrates that, from atechnological point of view, there are no
insurmountable technological obstacles. It is, however,also a matter of finance, manpower and time!

SILHI (a CEA ion source for the IPHI HPPA-project),which produced a 75 mA proton beam for a 104 hourstest with a single failure of 2.5 minutes only [8]!

Figure 1: 104 hours-test with a single short failure on SILHI ion source.

As a first conclusion, failure databases of existing
facilities must be ‘decoded’ carefully. They are clearly
crucial in understanding weak points and are the fruit ofexperience. However, data should not be blindly
extrapolated for future accelerators since accelerator
technology is in constant evolution.
3.2 X-ray sources

3.1.2

LANSCE: a versatile proton source.
3.2.1

LANSCE is a spallation neutron source based on a Linac
set-up [7]. The proton Linac can simultaneously
accelerate H+ (1.25 mA) and H- ions (70 µA) to an energyof 800-MeV. The first stage of the accelerator contains
injector systems for each kind of particle (H+ and H-). At
the end of the Linac, a kicker sends H+ into an area where
the APT project (Acceleration Production of Tritium)
conducts materials irradiation tests whilst H- are sent to a
proton storage ring which will convert 750 µs Hmacropulses into 0.25 µs, intense proton bursts thatprovide the capability for precise neutron time-of-flightmeasurements. A thorough failure analysis has been
conducted for years at LANSCE. Excellent detailed
information can be found in [7]. The average number oftrips for H+ is 1.62 trip/hour whilst this number is 0.78 for
the H- beam. Detailed statistics give no room for doubt;
the H+ injector is responsible for 90% of the trips whose
duration is less than 1 minute and responsible for 77 % of
all trips (3584 trips linked to the injector in 2870 hours).
Next to the injector is the RF system, responsible for 5 %of all beam trips linked to the H+ beam. However, H+
injector downtime represents only 30 % of the total
downtime. However, these impressive figures must nothide the fact that the general availability of the H+ beam
was 86 % in 1997. For the H- beam, the injector looks
somewhat more ‘reliable’ and represents 26 % of all trips.
The reason is that this injector is more stable. However, it
is essential to mention that both injectors are CockroftWalton type injector. Nowadays, microwave ion sources
have proven to be much more reliable and suitable for
future accelerator systems. Let us take the example ofGeneral facts about X-ray sources reliability

X-ray sources are generally composed of an electron
Linac followed by a synchrotron booster and a storage
ring. Circulating electrons will generate intense X-rays,
which will serve an extraordinary diversity of scientists.
With present high-energy accelerators, about 60
experiments can be carried out at the same time aroundthe storage ring. Should the accelerator stop for one hour,a whole community will be brought to a standstill for thattime. Moreover, when the beam is back, it will take sometime for the monochromators to retrieve their nominal
micronic position (heating stroke effect). Finally, thedemand for experiments is growing with time: the beamtime demand is now about 2-3 times what can be offered!
These accelerators must then be reliable, and available asmuch as possible. As an example of a high energy X-ray
source (6 GeV) that has 10 years experience and whichpermanently tackles and improves reliability, the ESRF
(Grenoble-France) will be reviewed.
3.2.2

The European Synchrotron Radiation Facility

The ESRF typically runs 5600 hours per year.
1994

1996

1999

2000

2001

May
2002

Availability (%)

91.4

96.8

96.6

97.6

98.2

99.4

MTBF (hours)

13.5

41.2

31.9

38

46.1

63

Table 2: Evolution of accelerators availability and MTBF
at ESRFAvailability has drastically improved with time, now
reaching > 98 %, and the MTBF has almost quadrupled.
The MTTR is about one hour. How could this be?
Since 1992, all failures are recorded in a database, inwhich the accelerators are classified into 40 subcomponents. The main sources of long, as well as
repetitive interruptions were quickly identified andsolutions were brought. Here are some main examples
aimed at improving Machine reliability.
The Grenoble area is prone to storms that can beparticularly violent and frequent (on occasions, several
times a day), provoking beam loss due to high voltage
drops on the electrical mains. Statistics showed that thiscause alone would prevent reaching a general availabilityof 95 %. The first action consisted in installing a wide
infrastructure of 10 redundant 1-MVA diesel engines
directly adapted to the 20 KV line and able to take overany mains drop [9]. In the case of the drop being less than
20% on a single phase, only the alternators are used tocompensate (i.e., no diesel start, no use of accumulator,
no disconnection from the electricity supplier). If a larger
compensation is needed (drop > 20 %-160 ms or 50 %-60ms), the diesel engines are started. Of course, the cost of
this efficient installation was 6 M€ and the preventive
maintenance costs represent 60 k€/year. After six years ofexperience, the benefits have been reaped: 150 drops/year
are covered without diesel starts and 60 severe drops/year
are compensated by diesel start- ups! Moreover, theelectronic equipment is no longer subject to switching off
abruptly, which was one of the causes for faster ageing.
At the same time, the RF system was responsible formany beam failures, which tended to be both long andrepetitive. One cause, amongst others, for long RF
failures were the klystrons, the worst case being the“death” of the klystron requiring about 8 hours to be
replaced. To get around these problems, several actions
were taken. A pair of cavities fed by one klystron wasadded in the storage ring. This released some power fromthe other klystron feeding the two remaining pairs ofcavities. As a result, each klystron works well below their
upper limit. In addition, after having improved the RFshieldings, klystrons crowbars (repetitive failure) havedisappeared. A complex network of waveguides andswitches has been installed in order to allow an extremely
efficient redundancy: should a klystron fail, a spare
klystron is ready to take over in ½ hour, wherever it is on
the storage ring or on the booster. RF engineers have alsolaid to rest some generally accepted ideas: no correlation
between klystron death and operation at full power can bemade since only one klystron out of six died at full power.
The klystron high voltage gun is the dominant problem:
statistics made at LEP over 44 transmitters showed that
61% of the klystron failures were due to the gun!
Until the year 2000, radio-frequency arc detections weretaken as a major contributor to MTBF limitation. In 2000,
the Machine was stopped 38 times due to this kind of
failure, representing a MTBF of 146 hours for this‘equipment’. A study of the triggered signals led to apreliminary redesign of RF arc detection electronics andfollowing another retuning of the filtering time of these
50 detectors (in order to find a good compromise between
real arc detections and wrong arc detections), the MTBF
for this device is now reaching 404 hours for 2002! Thisis a good example of one low-cost efficient action!
Power supply failures can last a very long time when theyoccur (e.g., replacement of a transformer). To avoid a lossof time in these situations, a Super Spare Power Supply
was built. Its role is to supply any magnet power supply
that fails. Furthermore a matrix switching board was
installed allowing any magnet family to be powered by
the Super Spare Power Supply within less than one hour.
As a last example of preventive maintenance which is
now applied and which undoubtedly prevents several tensof hours of beam stoppage per year, I should mention theradio-gammagraphies, which are systematically carriedout after each vacuum intervention at the locations of the
RF fingers in order to detect early problems in themounting procedure. Since this procedure has been inplace no more RF fingers have melted and we estimatethat about 1 % per year of availability has been gained.
Analysing failure data and co-ordinating measures to fightthem now represents a full-time job at ESRF, but theresults are there!

4

FUTURE ACCELERATORSREQUIREMENTS

For many justified reasons not described in this paper, all
ADS accelerator designers agree that a level of 10-20
long beam interruptions/year is an upper limit. ‘Industrial’
ADS accelerators should even aim at limiting themselves
to 2-3 long trips/year. Trips < 100 ms could beaccommodated thanks to fuel inertia [10] since the fueltemperature only drops after a few seconds. However,efforts must be made to get rid of the short trips thatremain a concern for the spallation target window. There
are two possibilities: one based on cyclotrons, the otherbased on linear accelerators. In latest developments, an
RFQ design for the low energy part of the Linac (< 5
MeV) and supraconducting cavities for the high energy
part (100 MeV – 1 GeV) are widely considered.

5 SUPRACONDUCTIVITY RELIABILITY [11]5.1 General considerations
At a low working temperature, an impurity becomes asolid pellet, which can damage equipment; this isparticularly the case for turbine wheels but also holds true
many others components. A first step in equipment
reliability is to have an irreproachable impurity
measurement system. It is also essential to have a
redundancy of major equipment (cold box, compressors,etc). This is the only way to provide continuous cooling
capacity during shut down of some equipment for
maintenance (or repair). This aspect must be consideredduring the design phase!

5.2 Cryoplant experience at different facilities
At KEK, 137000 hours of experience has been gained.169
failures have been observed out of which 114 were for the
refrigerator system. After one year of ‘childhood’ disease,
the reliability is now constant at 99.2 %!
At Fermilab, 76000 hours of experience allows toconclude that after upgrades and operator training, thereliability of this equipment stands at 99.5 %!
Finally, at CERN, 120000 hours have been accumulated
by 4 cryoplants. The average reliability is 99.3%.

5.3 Conclusions
After an observed period of about 1 year necessary tomodify weak points and train people, the averagereliability of cryogenic facilities is higher than 99%.

6 A CHAIN IS AS STRONG AS ITSWEAKEST LINK!
Many R&D is done to improve reliability of accelerators:
voltage breakdown mechanisms are thoroughly studied[12], RFQ designs are optimised [13], microwave ion
sources can produce 100 hours of intense beam without afailure [8], ACTIVE redundancy schemes are proposed tocompensate RF faults on high-power Linacs [14], etc.
These efforts are useful only if all the links of the chain of
reliability are considered. Failure diagnostics tools are
essential and must be able to track and record any
slow/fast event. These tools exist and are no longer achallenge. They must be part of a future design.
Dedicated manpower must be considered to record andanalyse failures and hence, detect weak points, initiate
and follow improvement strategies. This is a dedicatedjob! Spare part policy must exist and must not be a dayto-day improvisation. Experts must be on standby andready to intervene 24 hours a day (ESRF policy). Human
mistake can be minimized with procedures andautomation. This requires rigorous and well-trained
operators! Thorough studies carried out in nuclear power
plants show that human error probability for a repetitive
task is about 3 10-3! Under high stress, this figure
becomes 0.2 and shows the importance of well-trained
staff! In the design phase, critical equipment must be
identified and adequate active or passive redundancy mustbe foreseen at this stage, even if it is bought later for
financial reasons.
Equipment must not work at full capacity; some marginmust be allowed. With respect to this point, an excellent
cost comparison between a normal and a conservative
design for the European Spallation Source Linac has been
made in [15] and shows that a highly reliable system
would cost about 50 % more than a ‘normal’ design.

7 CONCLUSIONS
The author is firmly convinced that the “dream machine”
of only a few trips per year is a possibility but thisawareness must be present in the preliminary designphase. Budget is undoubtedly a key issue in achieving

these goals (redundancy and qualified manpower is not
free!). Should we go to extremes, we could consider anaccelerator as a non-repairable system and apply failuretree analysis, which is currently used for satellites andspacecraft [16]!
WEB possibilities must be exploited to bring together theexperience of Institutes willing to share their reliability
experience (database, dedicated papers, problems andsolutions, etc). A WEB site dedicated to accelerator
reliability aimed at sharing ideas and database elements
will very soon start.

8 ACKNOWLEDGMENTS
I am grateful to C. Piaszczyk, whom I consider to be theleader in accelerator reliability issues, for the numerous
and excellent papers he wrote in this area. Many thanks to
ALL participants of the Accelerator Reliability Workshop
held in Grenoble-February 2002 from whom I obtained
most of the information of this paper. ARW proceedings
can be found on the ESRF WEB site: www.esrf.fr

9 REFERENCES[1] Military Handbook – Electronic Reliability Design
Handbook 338A. US Department of Defense.
[2] Advances of accelerator physics and technologiesWorld scientific- P. Mandrillon- chapter 20.
[3] Accelerator Reliability Workshop (ARW) 2002. How
to Design Medical Accelerator Systems for Reliability:
IBA PT System. Y. Jongen[4] Utilisation and reliability of high power proton
accelerators. Proceedings Aix-en-Provence 1999. Y.
Jongen[5] ARW 2002. High power cyclotrons. P.Schmelzbach[6] ARW 2002. Improving the reliability of the PSI
proton accelerator RF system. P.Sigg.
[7] Reliability assessment of the LANSCE accelerator
system. Marcus Eriksson’s thesis-Stockholm 1998
[8] ARW 2002. Reliability and availability of IPHI
project. P-Y Beauvais.
[9] High quality power supply at the ESRF – JF Bouteille– EPAC 96 proceedings.
[10] ARW 2002. ADS Based on Circular Accelerators - HAït Abderrahim[11] ARW 2002. Reliability of cryogenic facilities- C.
Commeaux[12] Investigation of voltage breakdown caused by microparticles – PAC 2001- Werner et al.
[13] Optimisation of RFQ design – EPAC98 –R.Ferdinand[14] Reliability increase ways for High-Power Linacs –ADS drivers – EPAC2000 – A.M.Kozodaev et al.
[15] ARW 2002. European Spallation Source Linac- R.
Ferdinand[16] ARW 2002. Product Assurance and management ofrisks in ESA spatial projects- A. Heurtel