linear accelerator facility safety assessment … accelerator facility safety assessment document...

Linear Accelerator Facility Safety Assessment Document

December 5, 2007 SLAC-I-010-30100-009-R001 ii

Table of Contents 1. INTRODUCTION..............................................................................................................................................1 2. SUMMARY ........................................................................................................................................................3 3. DESCRIPTION OF THE LINEAR ACCELERATOR FACILITY AND OPERATIONS ........................8

3.1 LINEAR ACCELERATOR FACILITY SUBSYSTEMS..........................................................................................8 3.1.1 Collider Injection Development Injector ...............................................................................................8 3.1.2 North and South Damping Rings ...........................................................................................................8 3.1.3 Linac Sector-0 through Sector-30..........................................................................................................9 3.1.4 Positron Source .....................................................................................................................................9 3.1.5 Beam Switchyard ...................................................................................................................................9 3.1.6 LCLS ......................................................................................................................................................9 3.1.7 End Station A .........................................................................................................................................9 3.1.8 NIT and SIT Transport Lines to PEP-II.................................................................................................9

3.2 OPERATING ORGANIZATION......................................................................................................................10 3.2.1 Accelerator Operations Organization .................................................................................................10

4. HAZARD ANALYSIS .....................................................................................................................................13 4.1 HAZARD ANALYSIS METHODOLOGY.........................................................................................................13

4.1.1 Identification of Potential Hazards......................................................................................................13 4.1.2 Evaluation of Potential Hazards..........................................................................................................14

4.2 RISK MINIMIZATION..................................................................................................................................14 4.3 ENVIRONMENTAL HAZARDS IDENTIFICATION AND ANALYSIS ..................................................................15

4.3.1 Seismic .................................................................................................................................................15 4.3.2 Environmental......................................................................................................................................15

4.4 CONVENTIONAL HAZARDS IDENTIFICATION AND ANALYSIS.....................................................................16 4.4.1 Chemical ..............................................................................................................................................16 4.4.2 Cryogenics and Oxygen Deficiency .....................................................................................................16 4.4.3 Electrical .............................................................................................................................................17 4.4.4 Fire ......................................................................................................................................................19 4.4.5 Magnetic Fields ...................................................................................................................................21 4.4.6 Mechanical ..........................................................................................................................................21 4.4.7 Noise ....................................................................................................................................................22 4.4.8 Noxious Gases .....................................................................................................................................22 4.4.9 Ladders ................................................................................................................................................22 4.4.10 Vacuum and Pressure .....................................................................................................................22

4.5 RADIATION HAZARDS IDENTIFICATION AND ANALYSIS ............................................................................23 4.5.1 Non-ionizing Radiation Hazards .........................................................................................................23 4.5.2 Ionizing Radiation Hazards .................................................................................................................25

5. ACCELERATOR SAFETY ENVELOPE .....................................................................................................32 5.1 ACCELERATOR OPERATIONS SAFETY........................................................................................................32 5.2 SAFETY ENVELOPE – TECHNICAL REQUIREMENTS....................................................................................33

5.2.1 Laser Power.........................................................................................................................................33 5.2.2 Electron Beam to End Station A ..........................................................................................................34 5.2.3 LCLS Electron Beam to the BSY..........................................................................................................34 5.2.4 Electron and Positron Beams to PEP-II via the NIT and SIT Systems ................................................35

5.3 SAFETY ENVELOPE – ADMINISTRATIVE REQUIREMENTS...........................................................................36 6. QUALITY ASSURANCE................................................................................................................................37 7. POST OPERATION ........................................................................................................................................38 APPENDIX A. REFERENCES................................................................................................................................39 APPENDIX B. ABBREVIATIONS USED IN THIS DOCUMENT .....................................................................41


December 5, 2007 SLAC-I-010-30100-009-R001 1

1. Introduction This Safety Assessment Document (SAD) identifies potential hazards associated with the operation and maintenance of the Linear Accelerator Facility at the Stanford Linear Accelerator Center (SLAC). The purpose of this SAD is to assure line managers, workers, users, and reviewers that all significant hazards presented by a facility and its operations have been adequately assessed and can be managed to an acceptable level of risk (see SLAC Guidelines for Operations, Chapter 25: Safety Assessment Documents). The Linear Accelerator Facility is comprised of the following subsystems as shown in Figure 1-1: Collider Injection Development (CID) Injector North and South Damping Rings (NDR and SDR) Linear Accelerator (Linac) Positron Source Beam Switchyard (BSY) Linac Coherent Light Source (LCLS) Injector and electron beam systems into the BSY A-Line to End Station A (ESA) and on to Beam Dump East (BDE) NIT and SIT transport lines to PEP-II

Figure 1-1. Linear Accelerator Facility Subsystems This SAD will be reviewed and updated as needed, but no less frequently than every two years. This SAD will also be revised whenever major modifications are made to the facility (see SLAC Guidelines for Operations, Chapter 25: Safety Assessment Documents). This SAD incorporates and supersedes the LCLS Injector Safety Assessment Document, dated January 3, 2007, and covers LCLS facilities up to and including the BSY. Separate SADs have been written for other major facilities at SLAC:

PEP-II Safety Assessment Document BABAR Safety Assessment Document


December 5, 2007 SLAC-I-010-30100-009-R001 2

In 1995, the DOE Office of Energy Research classified SLAC as a Low-Hazard Radiological Facility in response to an analysis described in the SLAC Accelerator Facilities: Implementation Plans for DOE Order 5480.25. The Linear Accelerator Facility, which is the primary accelerator facility at SLAC, has therefore been determined to be a low-hazard class facility as defined in Safety Analysis and Review System (DOE Order 5481.1B). Recently, a determination of a Finding of No Significant Impact (FONSI) was made on the Environmental Assessment for the LCLS Experimental Facility for the LCLS construction project.


December 5, 2007 SLAC-I-010-30100-009-R001 3

2. Summary This section contains a summary (Table 2-1) of the hazard analyses detailed in Section 4. The mitigated risk is derived from the probability (Table 2-2) and consequence (Table 2-3) of each type of hazard, as shown in Figure 2-1. The resulting mitigated risk for each hazard is summarized in Table 2-1. Laboratory policies, standards, and implementation guidance are documented in the SLAC ES&H Manual.

Table 2-1. Hazard Analysis Summary Section Risk Source Cause Potential

Impact Control/Mitigation Mitigated

Risk 4.3.1 Seismic Earthquakes. Personnel struck

by falling objects or collapsing buildings.

Implementation of building and structural codes. Design standards and safety committee review and inspections. Specification for Seismic Design of Building, Structures, Equipment, and Systems.

Low

4.3.2 Environmental Spills or improper discharges to sewers or storm drains.

Uncontrolled release of hazardous materials.

Environmental impact reviews of new construction. Oversight, disposal, and restoration services by Environmental Protection Department. Annual reviews.

Extremely low

4.4.1 Chemical Chemical cleaning of parts. Acid flushing of magnet coils generating chemical waste.

Health risk to personnel. Uncontrolled release.

Personnel Protective Equipment (PPE). Secondary chemical containment. Chemical process hazard analyses. Facilities Department procedures. Reviews by Hazardous Experimental Equipment Committee.

Extremely low

4.4.2 Cryogenics and oxygen deficiency

Liquid nitrogen spills or release of gases in accelerator enclosures.

Asphyxiation. Limit volumes of cryogenic liquids or gases in accelerator enclosures. Review by HEEC.

Extremelylow


December 5, 2007 SLAC-I-010-30100-009-R001 4

Section Risk Source Cause Potential Impact

Control/Mitigation Mitigated Risk

4.4.3 Electrical Contact with energized cables, bus bars, or terminals during installation or maintenance. Electrical shorts to ungrounded equipment. Failure of switches or breakers.

Shock or arc flash injury.

New equipment complies with all applicable electrical codes and standards. New equipment is EEIP certified. UL listed equipment, where applicable. Projects reviewed by the Electrical Safety Committee. Electrical safety training for maintenance and operations personnel. Lock and Tag Training (ES&H Courses 136 and 157). Summary of Requirements for Work in Accelerator Housings Equipment Lockout Procedure (ELP) for each power supply. Use of personal protective equipment (PPE).

Low

4.4.4 Fire Overloaded cable trays. Malfunction of electrical equipment.

Personnel injury. Loss of technical equipment. Partial loss of cable plant. Shut down of operations.

Smoke detection systems. Fire sprinklers in some areas. Proper design of cable plant. Fire breaks in cable trays. Palo Alto Fire Department (PAFD) is on-site.

Extremely low

4.4.5 Magnetic Fields

Exposure to high magnetic fields.

Interference with pacemakers. Injury from unexpected movement of ferromagnetic equipment.

Magnetic field notification postings. Exposed high magnetic fields are inaccessible. Posting for pacemakers.

Extremely low

4.4.6 Mechanical Falling objects. Failure of rigging fixtures. Unexpected movement of remotely controlled devices.

Pinched or crushed appendages.

Engineered systems designed to conservative standards. Tested and certified rigging fixtures. Training and certification of riggers. Engineered barriers for moving devices. Reviews by Hoisting and Rigging Committee.

Low

4.4.7 Noise Operation of large pumps.

Hearing loss from prolonged exposure.

Warning signs. Ear protection.

Low

4.4.8 Noxious gases Ionizing radiation in air in enclosed spaces.

Personnel injury. Enclosed beam chambers. Cool-down periods in tunnels.

Extremely low

4.4.9 Ladders Fall from tall ladders in linac access penetrations.

Personnel injury. Fall protection training (ES&H Courses 200, 201, and 202). Use of fall protection equipment.

Low


December 5, 2007 SLAC-I-010-30100-009-R001 5

Section Risk Source Cause Potential Impact

Control/Mitigation Mitigated Risk

4.4.10 Vacuum and Pressure

Failure of pressure vessels or pipes. Rupture of vacuum chambers.

Personnel injury. Conservative engineering standards. Design reviews. Acceptance testing of pressure devices.

Low

4.5.1.1 Non-ionizing Radiation: RF Radiation

Exposure to High power RF.

Personnel injury. Safety interlock system based on waveguide pressure sensors. Review by Non-Ionizing Radiation Safety Committee.

Extremely low

4.5.1.2 Non-ionizing Radiation: Laser Radiation

Eyes or skin exposed to Laser.

Eye or skin injury.

Safety reviews of laser system design. Engineered and reviewed personnel protection system (PPS). Reviews by Laser Safety Officer and by the Laser Safety Committee. American National Standard for Safe Use of Lasers: ANSI Z136.1-2000, PPE (gloves and laser goggles)

Extremely low

4.5.2 Prompt Ionizing radiation exposure inside the accelerator enclosure (greater than 10 rem/h).

PPS failure or inadequate search.

High radiation exposure.

Engineered and reviewed personnel protection system (PPS). Periodic testing of PPS. Radiation safety training. SLAC Guidelines for Operations, Search Procedures, Entry and Exit Procedures, PPS Interlock Checklists, PPS Certification Workbooks.

Extremely low

4.5.2 Residual Ionizing radiation exposure inside the accelerator enclosure (greater than 0.1 rem/h).

Work on or near activated components.

Health effects from exposure.

Radiation surveys. Use of Radiological Work Permits, personal dosimeters, and barriers. Radiation Safety Systems Technical Basis Document Radiation Physics Department procedures.

Low

4.5.2 Ionizing radiation exposure (greater than 25 rem/hr) outside the linac enclosure.

Shielding error or beam containment failure.

Radiation exposure.

Beam Containment System (BCS) Beam Shut-off Ion Chambers (BSOICs). Radiological Control Manual. Beam Authorization Sheets. Safety Inspection Checklists.

Extremely low


December 5, 2007 SLAC-I-010-30100-009-R001 6

Table 2-2. Hazard Probability Rating Levels Category Description

High Event is likely to occur several times in a year.

Medium Event is likely to occur annually.

Low Event is likely to occur during the life of the facility or operation.

Extremely low Occurrence is unlikely or the event is not expected to occur during the life of the facility or operation.

Incredible Probability of occurrence is so small that a reasonable scenario is inconceivable. These events are not considered in the design or SAD analysis.

Table 2-3. Hazard Consequence Rating Levels Consequence Level Maximum Consequence High Serious impact on-site or off-site. May cause deaths or loss of the

facility/operation. Major impact on the environment.

Medium Major impact on-site or off-site. May cause deaths, severe injuries, or severe occupational illness to personnel or major damage to a facility or minor impact on the environment. Capable of returning to operation.

Low Minor on-site with negligible off-site impact. May cause minor injury or minor occupational illness or minor impact on the environment.

Extremely low Will not result in a significant injury or occupation illness or provide a significant impact on the environment.


December 5, 2007 SLAC-I-010-30100-009-R001 7

Risk Matrix Consequence Level

High

Medium

Low

Extremely Low

Extremely Low

Low Medium High

Probability of Occurrence

Risk Level

High Unacceptable

Medium Unacceptable

Low Acceptable

Extremely Low Acceptable

Figure 2-1. Risk Determination


December 5, 2007 SLAC-I-010-30100-009-R001 8

3. Description of the Linear Accelerator Facility and Operations A detailed overview of the SLAC site including geology, hydrology, seismicity, and climate is available in Annual Site Environmental Report. The geology and hydrogeology of SLAC is further described in The Geology of the Stanford Linear Accelerator Center.

3.1 Linear Accelerator Facility Subsystems The Linear Accelerator Facility includes the linac and its associated systems (CID Injector, NDR and SDR, Positron Source, and the BSY), the LCLS injector and electron transport line to the BSY, the A-Line transport system through ESA to BDE, and the NIT and SIT transport lines to PEP-II. New electron transport systems are currently under construction east of the BSY as part of the overall LCLS project. These systems will be described and documented in future revisions of this SAD. The systems comprising the Linear Accelerator Facility are located throughout the radiological control area, from the CID injector at the west end of the site to the D-400 dump downstream of ESA at the east end, some two and one-half miles away. The Linear Accelerator Facility provides the following: Electron and positron beams from a few hundred MeV up to 50 GeV for high-energy physics

and advanced accelerator research. Compressed electron bunches up to 17 GeV for LCLS photon science. Secondary hadron beams to ESA for the development and calibration of new accelerator

components and detector systems. Electron and positron beams needed to fill the PEP-II High Energy Ring (HER) and Low

Energy Ring (LER) storage rings. The Linear Accelerator Facility can operate at rates up to 120 pulses per second. A rate of 30 pulses per second is normally used during PEP-II operations, because this reduced rate conserves electric power and is sufficient to keep the PEP-II rings filled.

3.1.1 Collider Injection Development Injector The Collider Injection Development (CID) injector produces intense bunches of electrons for the PEP-II and ESA programs. The CID injector includes two gun options: a relatively simple and reliable thermionic gun, and a more complex laser-driven photocathode gun capable of producing a highly polarized electron beam. The electrons are produced in short pulses at a repetition rate up to a maximum of 120 pulses per second for further acceleration in the linac.

3.1.2 North and South Damping Rings The North Damping Ring (NDR) damps the emittance of the electron beams from the CID injector, and the South Damping Ring (SDR) damps the positron beams reinjected into the accelerator structure from the positron source.

The damping requirements for the electron and positron beams are different. The electrons, as delivered, require only modest emittance damping, whereas the positrons, which are produced with a very large emittance from a solid target, require substantial emittance damping for most applications.


December 5, 2007 SLAC-I-010-30100-009-R001 9

3.1.3 Linac Sector-0 through Sector-30 The linac is an electron linear accelerator using 2856-MHz room temperature copper, disk-loaded waveguide structures, driven by SLAC-built klystrons and energy-doubling cavities. The linac is located in a tunnel 25 feet below the Klystron Gallery, which houses the klystrons and energy-doubling cavities. The linac is segmented into 31 sectors, beginning with CID and Sector 0 on the west end, and ending with Sector 30 on the east end. Each sector is approximately 100 meters long. The maximum repetition rate for the linac is 120 pulses per second (pps or Hz).

3.1.4 Positron Source Positrons are produced by directing a beam of electrons into a target near Sector 19. The target is a high-density water-cooled tungsten-rhenium plate, which is slowly rotated to dissipate the resulting heat over a larger area. The target section is followed by RF capture and acceleration sections which together deliver a beam of 200 MeV positrons. These are then transported through a return line back to the west end of the linac, where the West Turn Around (WTA) transport system injects them into the first sector of the linac for acceleration to 1.2 GeV and transmission to the SDR.

3.1.5 Beam Switchyard The Beam Switchyard (BSY) provides switching, energy definition, collimation, and transport functions for beams to the LCLS, ESA, and PEP-II.

3.1.6 LCLS The Linac Coherent Light Source (LCLS) is designed to produce an intense coherent X-ray beam by transporting a compressed beam of electrons through a magnetic undulator. This Safety Assessment Document covers the parts of the LCLS that directly involve the electron beam up to and including the BSY. These include the drive laser, the RF electron gun, the injector, two bunch compression chicanes in the linac tunnel, and the transport system to the BSY. As part of the LCLS construction project, the transport system will be extended through a new magnetic undulator, culminating in a heavily shielded underground dump system, which will be described in a future revision of this SAD. The LCLS uses the last kilometer of the existing linac, beginning in Sector 21 and extending through Sector 30. Magnetic chicane electron bunch compressors in Sectors 21 and 24 shorten the electron bunches longitudinally. These divide the Sectors 21-30 into five functional LCLS areas: Linac-1 (L-1), Bunch Compressor-1 (BC-1), Linac-2 (L-2), Bunch Compressor-2 (BC-2) and Linac-3 (L-3).

3.1.7 End Station A End Station A (ESA) is a facility for experimental physics and test beam activities involving electrons directed on to fixed targets. The transport system (A-Line) focuses and delivers beams to ESA up to the full energy of the linear accelerator. Beams may be transported through the end station to an underground beam dump (Beam Dump East) some 200 feet further east.

3.1.8 NIT and SIT Transport Lines to PEP-II The North Injection Transport line (NIT) is an array of dipole and quadrupole magnets, along with a vacuum chamber and instrumentation, which extends from Sector 10 in the linac tunnel to the end of Sector 30. Here it bends to the north and continues through a connecting tunnel to the


December 5, 2007 SLAC-I-010-30100-009-R001 10

PEP-II storage ring. The purpose of NIT is to transport electrons to the High Energy Ring (HER) in PEP-II.

The South Injection Transport line (SIT) is conceptually the same as NIT, but is designed to deliver positrons to the Low Energy Ring (LER) in PEP-II. SIT starts in Sector 4 of the linac tunnel, extends parallel to NIT to Sector 30, and at that point bends to the south through a connecting tunnel to PEP-II.

3.2 Operating Organization The Linear Accelerator Facility is managed with a system that reliably identifies safety standards and implementation guidance applicable to maintenance work and modifications. The technical managers have been trained to understand the need to address ES&H requirements before authorizing work on this facility. Policies and procedures governing the operation of this facility are designed to minimize any potential adverse environmental effects while accomplishing the facility's mission. SLAC's accomplishments to date demonstrate a commitment to minimizing any such adverse impacts.

3.2.1 Accelerator Operations Organization Operation of the Linear Accelerator Facility is under the control of the Accelerator Systems Division, which reports to both the LCLS Directorate and the Particle Physics and Astrophysics (PPA) Directorate. The Accelerator Operations Department is charged with the day-to-day running of the accelerator facility. The Engineering Operator-in-Charge (EOIC) is responsible for the safe and efficient running of the accelerator facility on a shift-by-shift basis. The EOICs are assisted in the Main Control Center (MCC) control room by Accelerator Systems Operators (ASOs). All operations are carried out in compliance with SLAC Guidelines for Operations and the Accelerator Division Operations Directives. These documents are used by the operating, safety, and maintenance groups to ensure that activities are carried out in a safe and effective manner. 3.2.1.1 Operations SLAC Guidelines for Operations and Accelerator Division Operations Directives are the controlling documents for facility operations. These documents, together with the more detailed procedures which implement them, are intended to ensure that a high level of performance is achieved in the operation of the accelerator, and that operations are carried out safely. The Accelerator Division Operations Directives define the roles and responsibilities of the EOIC and the on-duty control room staff and specify applicable detailed procedures. The procedures required for operation of the Linear Accelerator Facility are maintained in a hierarchical documentation system by the Accelerator Operations Department. The level of review and approval required for each procedure depends on its position in the hierarchy, with critical safety procedures being subject to the most rigorous control and approval processes. Critical accelerator safety procedures are updated whenever operational requirements change. The approving authority for each document is listed with the document, and the governing policies are described in the Accelerator Division Operations Directives. 3.2.1.2 Safety Safe operation of the accelerator facility is achieved through adherence to administrative procedures as described in SLAC Guidelines for Operations and Accelerator Division Operations


December 5, 2007 SLAC-I-010-30100-009-R001 11

Directives, as well as the SLAC ES&H Manual and the Radiation Safety Systems Technical Basis Document. While the EOIC has the primary responsibility for the safe operation of the Linear Accelerator Facility, the Accelerator Division Safety Office (ADSO) provides an overview function for all activities that have an impact on safety. 3.2.1.3 Maintenance Maintenance and installation activities are managed by the Accelerator Systems Division following processes and procedures described in the Accelerator Division Operations Directives and SLAC Guidelines for Operations. The area manager is responsible for coordinating all maintenance activities in his or her area. Short-term maintenance required for the daily operation of the accelerator during a running cycle is coordinated by the Accelerator Division Maintenance Office (ADMO) in the Accelerator Systems Division. Staff members from this group collect maintenance requests and schedule the work for the next available maintenance period. Maintenance activities requiring immediate action are coordinated and controlled by the EOIC with the assistance of the area manager for the particular area. 3.2.1.4 Training All employees and users are required to complete safety training programs tailored to their job responsibilities. For example, all employees and users who work in Radiological Control Areas are required to complete general safety training (EOESH) and GERT. This training is administered by the ES&H Division using formal course material and written tests. This requirement applies to outside contractors as well. Only appropriately trained and qualified personnel, or trainees under the supervision of trained and qualified personnel, are permitted to perform tasks that may affect safety and health.

Responsibility for training lies with line managers and supervisors. This includes periodically reviewing the duties of each person to assess the hazards he or she may encounter, determining the appropriate training requirements, and verifying that the employee has completed the requisite training. This is normally done as part of the Job Hazard Assessment and Mitigation (JHAM) process and is reviewed each year in conjunction with the annual employee performance evaluation process.

The ES&H Division offers training courses covering the hazards encountered by most employees. Employee records for these courses are maintained in a central database, with provisions for notifying employees and their supervisors when refresher training is due. Specialized training required by particular employees or groups is managed by each employee’s department, which is also responsible for record keeping.

The training requirements for accelerator operators are more extensive and detailed than for most other employees, and certain safety-critical tasks may only be carried out by operators who have completed specified training requirements. Operators are trained and qualified in accordance with a strictly controlled program administered by the Accelerator Operations Department of the Accelerator Systems Division as specified in the Accelerator Division Operations Directives. Three levels of Accelerator Systems Operators: ASO-1, ASO-2, and ASO-3 are defined for control room work assignments, in addition to the EOIC. The training requirements increase in difficulty at each succeeding level.


December 5, 2007 SLAC-I-010-30100-009-R001 12

Operator training is conducted by senior staff in the Accelerator Operations Department using detailed workbooks which are signed off as the operator-in-training demonstrates competence in each specific task. New personnel are assigned the qualification level of “New Operator” and begin training with the ASO-1 Qualification Workbook. Until they complete this workbook, they may only carry out work activities under the supervision of a qualified operator. Beyond the ASO-1 level, operators may progress through the ASO-2, ASO-3, and EOIC training using the corresponding qualification workbooks. Each workbook describes in detail the requirements for obtaining the qualification level being attempted. In general, the trainer may be any control room operator who has a higher qualification or another senior operations staff member. Final sign off on each section is done by the operator’s supervisor. The major elements of the training program include safety, technical procedures, documentation, and operating procedures. Under safety training, operators are given a safety orientation and a hazard communication briefing, and must complete courses conducted by the ES&H Division covering the personal protection system (PPS), radiation safety, electrical safety, and emergency preparedness. To operate the PPS controls for a specific area, control room operators are required to complete the corresponding PPS certification workbook. Workbooks are available for each of the major PPS areas. The workbooks contain training information on the operation of the PPS controls, as well as on Search Procedures, Exit and Entry Procedures, Safety Inspection Checklists, and PPS Interlock Checklists. Records of operator training in critical safety-related tasks are summarized in the Shift Schedules and Training Record Summaries. This document lists the current qualification level and PPS certifications for each operator and is used by the EOIC to schedule operator task assignments.


December 5, 2007 SLAC-I-010-30100-009-R001 13

4. Hazard Analysis This section identifies and evaluates the potential hazards associated with the operation of the Linear Accelerator Facility. The procedures and equipment used to ensure safe operation are specified in this section. Section 2 contains a summary of the potential hazards and analysis. The hazards and safety analysis process is governed by Safety of Accelerator Facilities, DOE Order 420.2B. Detailed guidance to implement the order is provided in the Accelerator Facility Safety Implementation Guide for DOE O 420.2B, Safety of Accelerator Facilities, DOE G 420.2-1. Safety issues that are not covered in this document, and for which a safety analysis has not been performed, could arise. Such an issue would constitute an Unreviewed Safety Issue under DOE Order 420.2B Section 4c. Activities that involve unreviewed safety issues must not be performed if significant safety consequences could result from either an accident or a malfunction of equipment that is important to safety. Activities involving identified unreviewed safety issues must not commence before DOE has provided written approval. The Linear Accelerator Facility has several types of hazards commonly found in general industry. These hazards are addressed in the SLAC ES&H Manual, which provides guidance in the applicability of federal and state regulations (e.g., Cal/OSHA) and professional and engineering standards (e.g., ANSI, ASME and NFPA70E). Specific standards, including DOE Orders, are established in the Work Smart Standards (WSS) and are included in the Stanford/DOE contract. Accelerator facilities are exempt from the regulations provided in Code of Federal Regulations, Nuclear Safety Management, Title 10 CFR, Part 830. Also, as a nonprofit educational institution, SLAC is exempt from Code of Federal Regulations Procedural Rules for DOE Nuclear Activities; Enforcement Process, Title 10 CFR, Part 820, Subpart B which establishes the procedures for investigating the nature and extent of violations of the DOE nuclear safety requirements and for adjudicating the assessment of a civil penalty.

4.1 Hazard Analysis Methodology

4.1.1 Identification of Potential Hazards Most potential hazards have been identified or anticipated and studied from the earliest days of SLAC. In addition, facility inspections, area manager walk-throughs, safety reviews and audits, and discussions with the engineers and potential users of the facilities have been used to identify other potential hazards. Potential hazards in accelerator facilities include:

chemical magnetic fields cryogenics and oxygen deficiency mechanical electrical noise environmental noxious gases fire occupational safety ionizing radiation seismic non-ionizing radiation vacuum and pressure. ladders


December 5, 2007 SLAC-I-010-30100-009-R001 14

The hazards of the Linear Accelerator Facility have been analyzed and mitigated to a level judged to be acceptable. During the design and construction of technical components, reviews are conducted to ensure that safety issues have been adequately addressed. This process begins with the identification of hazards and the development of controls or alternative mitigation mechanisms. Where necessary, designs are revised to ensure that the hazards are eliminated or appropriately mitigated. A formal readiness review is conducted prior to the start of commissioning of any major new facility and internal safety reviews are conducted periodically to ensure that no new safety concerns have arisen.

4.1.2 Evaluation of Potential Hazards The hazard evaluation process is a qualitative assessment of potential impacts in terms of hazards, initiators, likelihood estimates, preventive or mitigating features and public, environmental, and worker consequence estimates. The results of these evaluations confirm that the potential risks from operations and maintenance are acceptable. The scope and design of major modifications or additions to the Linear Accelerator Facility are reviewed by the SLAC SOC, which coordinates and assigns safety reviews to SLAC citizen committees. The members of these committees, appointed by the director, have relevant knowledge in applicable subject matter areas. In some cases, they review the system safety documentation and the equipment before new systems are energized. Comments and guidance from each of these reviews are incorporated into the safety design and procedures. The SLAC citizen committees typically involved in the review of major Linear Accelerator Facility projects are:

As Low as Reasonably Achievable (ALARA) Committee Earthquake Safety Committee (EqSC) Electrical Safety Committee (ESC) Environmental Safety Committee (EnvSC) Fire Protection Safety Committee (FPSC) Hazardous Experimental Equipment Safety Committee (HEEC) Hoisting and Rigging Safety Committee (HRC) Laser Safety Committee (LSC) Non-ionizing Radiation Safety Committee (NiRSC) Radiation Safety Committee (RSC) Safety Overview Committee (SOC)

To ensure ongoing compliance with all applicable safety standards, each accelerator facility is audited at least once every five years under a program managed by the Safety Overview Committee and described in Chapter 31 of the SLAC ES&H Manual.

4.2 Risk Minimization Many of the hazards associated with the Linear Accelerator Facility are already well understood, are covered by recognized industrial codes and standards, and have been mitigated to acceptable levels. The hazards addressed in this section are mainly those that present a potential to cause


December 5, 2007 SLAC-I-010-30100-009-R001 15

illness or injury to personnel, damage to the facility or its operation, or cause environmental damage due to causes not fully addressed by standard industrial safety practices.

4.3 Environmental Hazards Identification and Analysis A detailed overview of the SLAC site including geology, hydrology, seismicity, and climate is available in Annual Site Environmental Report. The geology and hydrogeology of SLAC is further described in The Geology of the Stanford Linear Accelerator Center.

4.3.1 Seismic The design of the Linear Accelerator Facility addresses hazards posed by seismic activity. Among the potential site-wide emergency situations that could occur at SLAC, a major earthquake is the most likely. Using newly collected data and evolving theories of earthquake occurrence, U.S. Geological Survey (USGS) and other scientists now conclude that there is a 62% probability of at least one magnitude 6.7 or greater quake, capable of causing widespread damage, striking somewhere in the San Francisco Bay region before 2032 (see Is a Powerful Quake Likely to Strike in the Next 30 Years?, U.S. Geological Survey Fact Sheet 039-03). SLAC structures have been designed to reduce the effects of a major earthquake to acceptable levels. The design of experimental equipment, including magnet supports, klystron supports, cable trays, and large experimental apparatuses as well as shielding modifications and new conventional construction are reviewed by the SLAC Earthquake Safety Committee. This facility is subject to both internally developed seismic standards and conventional building codes. Detailed seismicity information is available in Specification for Seismic Design of Buildings, Structures, Equipment and Systems at the Stanford Linear Accelerator Center.

4.3.2 Environmental The Linear Accelerator Facility was designed and built before the National Environmental Policy Act was developed; however, all new construction in the last three decades, including the LCLS project, has been carried out in compliance with this act. The Environmental Assessment for the LCLS Experimental Facility summarized the environmental issues associated with LCLS construction and operations. DOE representatives reviewed this document and issued a Finding of No Significant Impact (FONSI) in which they determined that the continued operation, construction and upgrades of the LCLS at SLAC do not constitute a major federal action significantly affecting the quality of the human environment within the meaning of the National Environmental Policy Act of 1969. The preparation of an environmental impact statement was not required. The Environmental Protection Department at SLAC provides technical and regulatory guidance and disposal services, and manages environmental restoration projects on the site. A National Emissions Standards for Hazardous Air Pollutants (NESHAPs) evaluation has been conducted for the LCLS by the Radiation Physics Department to estimate the potential for radioactive airborne emissions. The total dose to the maximally exposed individual resulting from the activation of air due to bremsstrahlung and neutron emission from the LCLS operation was estimated to be 6×10-4 mrem/year (see Shielding Requirements for Phase One of LCLS Injector Operation, RP-05-15). The calculated dose is well below the 10 mrem/year annual limit specified in National Emission Standards for Hazardous Air Pollutants: Subpart H: Department


December 5, 2007 SLAC-I-010-30100-009-R001 16

of Energy Facilities, Title 40 CFR, Part 61, Subpart H, and the 0.1 mrem/year SLAC design goal. Therefore, the risk to members of the public is minimal, and an annual administrative review of the facility is sufficient to evaluate any changes in operations, processes, beam intensity, or any other factors that may increase emissions to the environment.

4.4 Conventional Hazards Identification and Analysis SLAC strives to keep its workplace free from recognized hazards and promotes Integrated Safety and Environmental Management Systems. All Linear Accelerator Facility system design, fabrication, construction, installation, testing, and accelerator beamline operations fall under the normal SLAC occupational safety requirements as stated in the SLAC ES&H Manual. Applicable safety regulations are listed in the WSS set, based on known or anticipated facility hazards.

4.4.1 Chemical SLAC maintains an inventory of hazardous chemicals in compliance with the requirements imposed by San Mateo County. In addition to the inventory of chemicals at the facility, copies of the respective manufacturer’s Material Safety Data Sheets (MSDSs) are maintained. Reviews of the conventional safety aspects of the facilities show that use of these chemicals does not warrant special controls other than appropriate signs, procedures, appropriate use of personal protective equipment, and hazard communication training. New proposals involving the use of hazardous materials are reviewed by the Hazardous Experiment and Equipment Committee (HEEC). These proposals must identify the hazardous materials, quantities, the nature of the hazards and mitigation techniques, and any special controls required for safe operation. During the operation of the Linear Accelerator Facility, materials such as paints, epoxies, solvents, oils, and lead shielding are often used. The industrial hygiene program, which is detailed in the SLAC ES&H Manual, Chapter 5, addresses potential hazards to workers using such materials. The program identifies how to evaluate workplace hazards when planning work and the controls necessary to eliminate or mitigate these hazards to an acceptable level. Site and facility specific procedures are also in place for the safe handling, storing, transporting, inspecting and disposing of hazardous materials. These are contained in the SLAC ES&H Manual, Chapter 17, Hazardous Waste Management, and Chapter 40, Hazardous Materials Management, which describes the standards necessary to comply with the Code of Federal Regulations, Occupational Safety and Health Standards, Hazard Communication, Title 29 CFR, Part 1910.1200.

4.4.2 Cryogenics and Oxygen Deficiency Liquid nitrogen is used to service components in both the accelerator and experimental housings. The SLAC ES&H Manual, Chapter 36, defines the requirements for the safe use of liquid nitrogen in accelerator housings. Although cryogens are used extensively at SLAC, there are strict limitations on quantities that may be used in the accelerator housing or experiment hutches. Uses beyond defined limits require analyses and the use of ventilation, oxygen deficiency monitoring, or other controls. Compressed nitrogen, helium, and argon are extensively used in the Linear Accelerator Facility. These gases are not toxic, but can displace oxygen if released in spaces without adequate ventilation. The use of these gases is subject to review by the HEEC committee. HEEC may


December 5, 2007 SLAC-I-010-30100-009-R001 17

require additional engineering safeguards and monitoring to reduce the risk of any ODH accident to an extremely low level (see SLAC ES&H Manual, Chapter 36).

4.4.3 Electrical Electrical systems are found throughout accelerator facilities. High voltages, high currents, or high levels of stored energy present hazards if not managed properly. Mitigation of electrical hazards is achieved through engineered controls such as isolation and insulation, combined with policies, procedures and training for work on these systems. Work performed on electrical systems includes controls such as the use of Lock-Out Tag-Out (LOTO) procedures. Laboratory policy prohibits work on energized systems, except in extraordinary circumstances under very limited and controlled conditions. The design, upgrade, installation, and operation of electrical equipment is conducted in compliance with the following:

National Electrical Code, NFPA 70 OSHA 29 CFR, Part 1910, Subpart S, Electrical SLAC ES&H Manual, Chapter 8, Electrical Safety

Prevention of injuries to personnel through electrical shock and arc flash burns is of paramount concern and importance. Also important to the scientific mission of the Linear Accelerator Facility and its user community is the prevention of electrical faults that could damage equipment or impact operations. Proper engineering design is used for systems and components over 50 V to eliminate any accidental contact while they are energized. Where practical, systems are designed to operate at lower voltages. Much of the equipment in use at the facility has been designed and built for a specific purpose and is not commonly found in other industrial facilities. Although workplace experience with this equipment has been very good from both safety and operational perspectives, a program has been established to inspect all equipment that is not labeled by a Nationally Recognized Testing Lab (NRTL). These inspections are performed by trained staff members who examine all unlabeled equipment to confirm that it is free from reasonably-foreseeable risk due to electrical hazards. This program applies to all electrical equipment built, acquired, or brought to the Linear Accelerator Facility by workers, guests and contractors.

All personnel working with electrical equipment must be qualified by their supervisors to work safely with the equipment. For each employee or user, the supervisor prepares a training assessment which specifies the training requirements for the worker.

Any work requiring access to energized circuits is subject to the requirements of SLAC electrical safety procedures and Standard for Electrical Safety in the Workplace, NFPA 70E.

All LOTO activities or work with exposed energized conductors must be performed in accordance with an electrical work permit. Written procedures are established for more complicated activities to guide personnel in the operation and maintenance of equipment involving electrical hazards. Written procedures have also been developed to specify minimum approach distances to exposed conductors by people in accelerator housings.

Safety interlock systems are used where appropriate to ensure that access to high voltage and/or high current equipment takes place only under controlled circumstances. A


December 5, 2007 SLAC-I-010-30100-009-R001 18

labeling program has been developed to identify distribution panels and disconnect switches and their sources of power.

A labeling program has been developed to identify hazardous equipment (electrical and mechanical) throughout the facility. All new equipment has been labeled with appropriate hazard labels, and older equipment is being labeled before being worked on.

Electrical systems undergo preventive maintenance as scheduled by the Facilities Department.

Solid electrical grounding has been implemented throughout the LCLS systems, per UBC, NFPA and NEC requirements, and pre-existing facilities are being evaluated and upgraded as part of an aggressive safety program.

The personnel protection system (PPS) ensures that all exposed electrical hazards above 50 volts are de-energized whenever anyone is in the accelerator housing. All new equipment in the Linear Accelerator Facility is installed with mechanical barriers that mitigate the risk of exposure to electrical shock. LOTO procedures are defined in the Lock and Tag Program for the Control of Hazardous Energy. Electrical safety training and Lock and Tag training are provided for those personnel who may work on or near potential electrical hazards and for their supervisors. 4.4.3.1 AC Distribution The primary AC distribution to the site is at 12.47 kV. For most systems, transformers convert the 12.47 kV to 480 volts AC for subsequent distribution. The variable-voltage substations (VVS’s) that power the linac klystrons are powered directly at 12.47 kV. Because of the very high hazards, the substations are fenced, and access is limited to qualified high-voltage electricians. Other personnel do not normally have access to these areas. Most secondary distribution is 480 V, 3 phase, 60 Hz, ungrounded delta. This is used directly in many motors, pumps, power supplies, and other equipment. It is further transformed to 208/120 V, 3 phase for lights, utility outlets, and other general needs. The 480/277 V neutral is grounded. The hazard at 480 V is not only from electric shock, but also from possible arc formation at a short circuit. Short circuit currents can be extremely high, and the resulting arc flash can spray molten copper and other materials. The procedures followed on 480 V circuits include training, LOTO or key lockout, circuit voltage testing, and the use of proper personnel protective equipment. 4.4.3.2 High Voltage, Direct Current Some electronic devices contain high voltage, low current power supplies. While the current in some cases may present a direct shock hazard, in others it is too low to cause a direct injury, but may lead to indirect injuries, such as, falls, bumps or other physical mishaps. Accelerator and experimental components are prominently marked for a high-voltage hazard and may also be interlocked if a direct shock hazard exists. Currents of a few tens of mA passing through the body may result in physical injury. The RF systems, as well as various pulsed magnets, kickers, and other devices, use potentially lethal power supplies. All such power supplies are properly marked. Access panels are interlocked where appropriate, local status indicators are provided, and local lockout switches are provided where more than one turn-on location is used. Shorting devices are included when hazardous stored charges may be present.


December 5, 2007 SLAC-I-010-30100-009-R001 19

4.4.3.3 High Current, Low Voltage Electromagnets often operate at high currents, up to several thousand amperes, but at relatively low voltages. In some cases, the shock hazards are low but a short circuit can create an arc flash hazard. LOTO policies and procedures are used to control work on or near such hazards. In addition, warning signs, barriers, and interlock systems are often used for enhanced safety.

4.4.4 Fire There potential fire hazards associated with the Linear Accelerator Facility are:

1. Ignition of electrical cable insulation. 2. Overheating or electrical breakdown in power supplies or klystron modulators. These

devices are constructed in noncombustible steel cabinets which limit the extent and speed with which a fire could spread.

3. Overheating of magnets. Because magnets are of primarily noncombustible construction, they pose minimal danger.

4. Oil-filled transformers located in and adjacent to the exterior walls of the klystron gallery.

5. Transient combustible materials. The following describes briefly the fire hazards in each area associated with the linac. 4.4.4.1 Linac and Klystron Gallery A formal fire hazard analysis was not required when the linac was originally constructed, and fire detection and suppression systems were not implemented in a consistent way throughout the facility. A project has been initiated to install air-sampling, high sensitivity smoke detection systems throughout the Linear Accelerator Facility, and detailed engineering studies are in progress. Installation opportunities for this project are constrained by linac down times. The work will likely extend through 2008.

The modifications required for the LCLS were analyzed and described in the following documents as required by DOE Order 420.1 for modifications to existing facilities:

Title II Fire Hazards Analysis for the Linac Coherent Light Source (October 20, 2006) Equivalency Document for the Linac Coherent Light Source Non-Compliant Common

Path of Travel in Front End Enclosure (October 20, 2006) The klystron gallery is normally an unoccupied facility which has two additional fire hazards. Oil-filled transformers are located in exterior alcoves in each of the 30 sectors of the gallery. Additionally, each sector contains klystrons with modulator cabinets and associated hardware. Each klystron modulator contains a heat-sensitive fire alarm circuit which automatically alerts the on-site fire department at the first sign of a modulator fire. Area Managers maintain housekeeping standards to minimize the amount of transient flammable materials from their areas. Overall, the linac and klystron gallery present low fire hazards because of the minimal amount of combustible material. The injector portion of the linac is protected by a wet-pipe sprinkler system. Smoke detection is provided for the injector area as well as the north and south damping rings, and the associated DRIP area of the accelerator. These areas house magnets, cables, and other equipment in greater quantities than in typical accelerator sectors.


December 5, 2007 SLAC-I-010-30100-009-R001 20

A portion of the klystron gallery near the new LCLS injector system is protected by an ANALASER system supplemented by a VESDA (Very Early Smoke Detection Appliance) system in the Sector-20 alcove. A looped, two-source water supply feeds fire hydrants on 300-foot centers along the entire length of the klystron gallery for use by the Palo Alto Fire Department (PAFD). Manual fire alarm stations (see Fire Alarm System Reference Manual) are located throughout the linac and the klystron gallery and are connected to the site-wide fire alarm system. Additionally, portable fire extinguishers are provided throughout the structures. PAFD maintains an on-site fire station equipped with one 1,250-gpm fire engine and one wild land truck. PAFD is an ISO Class 2 rated department which can deliver six vehicles and 15 fire fighters in response to a fire at any SLAC facility. Both the linac and the klystron gallery are classified as “special purpose industrial occupancies” by the Life Safety Code, NFPA 101 (2006), which allows a maximum of 300 feet travel distance to an exit. Within the linac tunnel and support buildings, stairways or ladders leading directly to exits are spaced such that no point is more than 165 feet from an exit. 4.4.4.2 Main Control Center MCC is a two-story concrete and steel structure with a partial basement. Located south of the BSY, MCC houses computers, offices, and the main control room for the accelerator. In the north end of the building is a large open area containing power supplies and other electronic equipment. There is a substantial concentration of low-voltage signal cables in the basement. The fire hazards found in MCC are typical of those found in a computer center and are principally electrical and transient combustible materials. MCC, which is an occupied structure, is equipped with emergency lighting, exit signs, and multiple exits. Complete automatic wet pipe sprinkler protection and smoke detection systems throughout the building provide fire protection. Manual fire alarm stations are located throughout and are tied to the site-wide fire alarm system. Additionally, portable fire extinguishers are provided. 4.4.4.3 Beam Switchyard The BSY, located at the end of the two-mile linear accelerator is a large underground structure where beams are directed to any of several beam transport lines. The fire hazards in the BSY are virtually identical to those in the linac housing and are primarily associated with high-current DC circuits for magnets. The BSY has smoke and heat detectors along with manual fire alarm pull stations and a complement of portable fire extinguishers. This special-purpose facility is normally unoccupied. Adequate protection is provided by emergency lighting, exit signs, and multiple exits. 4.4.4.4 LCLS Fire hazards in LCLS areas were analyzed as described in LCLS Title II Fire Hazard Analysis, as required by Facility Safety, DOE O 420.1A, and Nonreactor Nuclear Safety Design Criteria and Explosives Safety Criteria Guide, DOE G 420.1-1. The conclusions developed through this analysis were reflected in the final facility design. The probability of a fire in the LCLS areas is similar to that in other SLAC accelerator facilities. Accelerator components are fabricated primarily from non-flammable materials, and combustible materials are kept to a minimum. The most likely fire with any substantial consequences would be in the insulating material of the electrical cable plant caused by an overload condition.


December 5, 2007 SLAC-I-010-30100-009-R001 21

New cables for the LCLS are being installed consistent with current SLAC standards for cable insulation and comply with National Electrical Code (NEC) standards concerning cable fire resistance. This reduces the probability of a fire starting and the deleterious health effects of combustion products of cables containing halogens. Smoke detection systems were installed in the beamline housing for early fire detection. The use of tray-rated, low-smoke zero halogen cable and of fire breaks in the cable trays mitigate fire spread potential. Support buildings for power supplies and electronic equipment are protected by automatic heat activated wet sprinkler systems. Fire extinguishers are located in all buildings and accelerator housings. The combination of smoke detection systems, sprinklers and the on-site fire department ensures a rapid response to any fire or smoke related incident. The LCLS conventional facilities, including the new beamline housings, have been designed within the framework of the model Uniform Building Code® (UBC®). The LCLS design complies with NFPA Standard 101®, the Life Safety Code® (LSC), for life safety compliance. 4.4.4.5 End Station A End Station A, a reinforced-concrete structure located in the research yard, is used for fixed-target experiments. Fire hazards here are essentially identical to those in the main linac structures.

4.4.5 Magnetic Fields Devices generating magnetic fields have numerous and diverse uses at the Linear Accelerator Facility. Sets of dipole, quadrupole, sextupole, and trim electromagnets guide electrons through the linac. Klystron assemblies employ permanent magnets of roughly 1000 gauss at contact. Vacuum ion pumps contain magnets with typical fields of 1800 gauss at contact. The concern with all of these devices is the strength and extent of the fringe fields and how these may impact persons and equipment in their vicinity. Fringe fields in excess of 5 gauss could adversely impact medical electronic devices (pacemakers), and fields in excess of 600 gauss strongly attract ferromagnetic implants (artificial joints), steel materials, and tools. The American Conference of Government Industrial Hygienists (ACGIH) recommends that people with cardiac pacemakers or other medical implants not be exposed to magnetic fields exceeding 5 gauss (0.5 mT). Magnetic fields in excess of that limit are present but are not accessible to personnel in normal work areas. Postings in publicly accessible areas alert personnel to local magnetic field hazards and conditions.

4.4.6 Mechanical The maintenance of accelerator components often involves moving massive objects requiring special lifting fixtures and procedures. While the objects being moved are sometimes unique or specialized technical components, the procedures for moving and installing them employ conventional rigging techniques. At SLAC, rigging is done only by trained and authorized technicians, and all cranes, hoists, and rigging fixtures are subject to formal testing and approval processes. Mechanical hazards associated with the rupture of vacuum vessels or piping and hoses containing high-pressure fluids are discussed separately in Section 4.4.10 below. The other mechanical hazards found in the Linear Accelerator Facility are devices that move under remote control. The bunch compressor chicanes and the actuator mechanisms on valves and wire scanners introduce potential pinch hazards; however, each of these devices has been


December 5, 2007 SLAC-I-010-30100-009-R001 22

covered with a protective barrier or has been demonstrated to move slowly enough or in such a way that no credible pinch hazard could arise.

4.4.7 Noise The Linear Accelerator Facility uses a wide variety of noisy equipment. Pumps, fans, and machine shop devices, among others, are possible sources of noise levels that might exceed the SLAC noise action level. The SLAC ES&H Manual, Chapter 18, Hearing Conservation contains requirements for reducing noise and protecting SLAC personnel who may be exposed to excessive noise levels. Warning signs are posted where hazardous noise levels may arise, and hearing protection devices are readily available.

4.4.8 Noxious Gases Toxic gases such as ozone and nitric oxides can be produced by ionization of air created by intense radiation fields. These gases can be a problem in accelerators where charged particle beams pass through air or where high-energy bremsstrahlung beams have significant path lengths in air. These conditions are not a significant hazard at the Linear Accelerator Facility because the beams are well contained within gas-tight vacuum chambers, and the small amounts of toxic gases produced in surrounding air is rapidly and safely dissipated.

4.4.9 Ladders Every linac sector has a vertical penetration to the surface with a 35-foot fixed vertical ladder which can be used for emergency egress. The penetrations in Sectors 2, 6, 8, 10, 11, 12, 14, 16, 18, 19, 20, 22, 26, 28, and 30 are equipped with fall-protection devices that will safely arrest the fall of anyone who slips off the ladder. Penetrations without these devices are not used for normal access. In addition, Sectors 4 and 24 have staircases with normal steps and handrails. These stairs, together with the fall-protection equipped penetrations, provide safe and convenient access to all parts of the linac housing. Accessing the linac with the ladders requires fall protection training and the use of the fall-protection equipment. See the SLAC ES&H Manual, Chapter 45, Fall Protection.

4.4.10 Vacuum and Pressure Vacuum and pressure vessels in the accelerator complex are potentially hazardous if they fail. The accelerator beam chambers are pumped down to a vacuum level that could lead to an implosion if a chamber were improperly designed or were damaged. In practice, accelerator vacuum systems are conservatively designed and tend to fail slowly without causing any risk to people. The usual cause of a loss of vacuum is a leaking weld or seal or an improperly fitted flange. The vacuum systems are divided into zones separated by gate valves and independently monitored with gauges and vacuum sensors. If a vacuum fault is detected, the valves close automatically to limit venting to as small a volume as practical. Cooling water and compressed air are distributed throughout the Linear Accelerator Facility for a variety of purposes. The cooling water, which is plumbed through a system of rigid pipes, flexible pipes, and hoses, introduces a rupture hazard. The rapid release of water would be a startle hazard and could cause a person to fall, but is unlikely to cause any major injury directly. These water systems are conservatively designed to reduce the likelihood of structural failure from stress cycles which occur during normal operations. Flexible pipe is chosen based on the operating pressure, and fittings are attached following the manufacturer’s specifications.


December 5, 2007 SLAC-I-010-30100-009-R001 23

Compressed air is used to actuate various valves and other pneumatic devices in the Linear Accelerator Facility, and introduces a risk of a startle hazard similar to a water hose rupture. The compressed air systems are also conservatively designed using high quality hoses and fittings. The tubing used to distribute the compressed air is typically small diameter, thereby impeding the flow of air and limiting the volume that could be released rapidly. In general, new or modified equipment is designed and built to conservative engineering standards, and new systems are subject to formal engineering reviews. Acceptance testing of pressurized systems is done where applicable.

4.5 Radiation Hazards Identification and Analysis Linear Accelerator Facility operations generate both ionizing and non-ionizing radiation. Non-ionizing radiation sources include lasers and pulsed klystron high power RF systems which generate electromagnetic radiation in the microwave range (2.856 and 11.424 GHz). Ionizing radiation hazards associated with high-energy electron and positron beams can be severe, and therefore are carefully studied and subject to formal reviews. The beams are accelerated and transported within vacuum enclosures, but significant fractions of the beams can be lost. When high-energy electrons or positrons strike matter, whether on a beam collimator or the side of vacuum pipe, secondary fields of photons, neutrons, and other particles are produced. In general, the unshielded secondary radiation fields from such losses are dominated by photons, particularly in the more forward direction from beam loss points. Passive shielding and PPS-controlled exclusion zones are necessary for ensuring that persons are not exposed to this radiation.

4.5.1 Non-ionizing Radiation Hazards 4.5.1.1 RF Radiation The emission of non-ionizing radiation is controlled to prevent the radio frequency (RF) power generated by the klystrons in the system from becoming a personnel hazard. Each klystron is capable of producing pulses of RF power at 2856 MHz with a peak power of about 60 MW. The RF system is designed so that the RF fields generated by the klystrons and by the electron beam are completely contained within the vacuum enclosure of the klystrons, waveguides, and accelerator structures. An RF safety program consisting of engineered and administrative controls ensures the containment of the RF fields during normal machine operation and control of the sources of the hazards during system maintenance. This system is based on interlocks to disable the RF power source in the event of a break in the vacuum system. The RF systems and associated safety interlocks are subject to reviews by the Non-ionizing Radiation Safety Committee. Surveys confirm that the RF fields are confined within the vacuum enclosure and are negligible compared to the safety levels set by the industry standards IEEE Standard C95.1 and the American Conference of Governmental Industrial Hygienists (ACGIH) threshold limit values (TLVs). 4.5.1.2 Laser Radiation Lasers are used as drive sources for the photocathode guns at CID and in the LCLS injector vault. Tables 4-1 and 4.2 list the optical radiation parameters of these lasers. Stability and timing requirements necessitate that laser light be transported though controlled environments. The transport lines between the laser rooms and the guns at CID and at the LCLS injector are stainless steel tubes. In normal operation, the laser optical components are covered to improve stability and enhance personnel safety. Laser shutters can be remotely closed and disabled using


December 5, 2007 SLAC-I-010-30100-009-R001 24

key-controlled interlocks. The integrated systems at CID and the LCLS injector are classified as Class IV lasers as defined in the ANSI Standard Z136.1.

Table 4-1. CID Gun Vault Laser Parameters Item Laser Beam Wavelength

(nm) Pulse

Length Single Pulse

Energy

Pulse Repetition Frequency

1 Nd:YAG pumped Ti:Sapphire

750-900 nm 2 ns 200 μJ 120 Hz

2 Nd:YLF pumped Ti:Sapphire

750-900 nm 2 ns 500 μJ 120 Hz

3 Flashlamp pumped Ti:Sapphire

750-900 nm 10 μs 20 mJ 120 Hz

Table 4-2. LCLS Injector Laser Parameters Item Laser Beam Wavelength

(nm) Maximum Available

Power

Single Pulse

Energy

Pulse Repetition Frequency

1 Seed Laser 755 nm 400 mW 4.2 nJ 119 MHz

2 Pump Lasers 532 nm 12 W 100mJ 120 Hz

3 UV for Gun 255 nm 300 mW 2.5 mJ 120 Hz

The use of lasers at SLAC complies with the American National Standard for the Safe Use of Lasers, the requirements of which have been included within the SLAC ES&H Manual, Chapter 10. These requirements establish hazard classifications based on the laser’s ability to cause biological damage to the eye or skin. Standard Operating Procedure (SOP) documents for each laser system describe the engineered and administrative controls used to mitigate the hazards. The Laser Safety Committee reviews the SOP and training documents and advises the Laser Safety Officer (LSO) who has safety oversight responsibility for lasers and may impose additional requirements. SLAC requires laser operators to be trained in general laser safety practices and also in the safety procedures specific to the lasers they operate. Engineered interlocks and special procedures allow qualified laser operators to be present for alignment purposes with laser beams present. Only qualified laser operators are allowed to enter laser rooms when hazardous conditions could exist and only in full compliance with formal procedures, including the use of specified personal protective equipment.


December 5, 2007 SLAC-I-010-30100-009-R001 25

Formal policies govern the use and control of laser keys and are subject to the authority of the LSO. Protection systems and warning signs appropriate to the classification of the lasers are implemented consistent with ANSI standards and the SOP. In addition, persons who work with these lasers participate in a medical surveillance program.

4.5.2 Ionizing Radiation Hazards The Radiation Safety Systems Technical Basis Document specifies an annual total effective dose equivalent limit of 5 rem to workers from both internal and external radiation sources. To ensure high standards of safety, SLAC maintains an administrative threshold control level of 1.5 rem. To protect against any possible radiation accident, however unlikely, it is customary at SLAC to carry out a detailed analysis of each mode of operation, including all plausible failure modes, and to demonstrate that transient events, such as beam faults, can not cause annual radiation dose limits to be exceeded. The special status of radiation hazards is exemplified in the requirement in the Radiological Control Manual that exposure to radiation should be minimized and driven as far below the statutory limits as is practicable. As a result, the risk of a serious radiation injury at SLAC accelerators and experiments is extremely low. Some areas at SLAC are designated as Radiologically Controlled Areas (RCAs) and are subject to special policies and procedures, with the intent of minimizing radiation exposures among people who work in these areas. These areas are established with the expectation that radiation levels will not exceed certain specified maxima depending on the type of zone. The Radiation Protection Field Operations Group maintains web-accessible lists of controlled areas with classification details and radiation safety work control requirements. The probability of significant contamination and ingestion of radionuclides within the Linear Accelerator Facility is very low. The following criteria are described in the Radiation Safety Systems Technical Basis Document:

The integrated dose equivalent outside the surface of the shielding barriers must not exceed 1 rem in a year for normal beam operation.

In the event of an MCI, the dose equivalent-rate is less than 25 rem/h, and the integrated dose equivalent is less than 3 rem.

The maximum dose equivalent rates in accessible areas at 1 foot from the shielding or barrier should not exceed 400 mrem/h for missteering conditions, defined as conditions that are comprised of infrequent or short-duration events in which the maximum allowable beam power, limited by beam-containment system (BCS) devices, is lost locally or in a limited area.

The dose equivalent for the maximally exposed member of the public due to ionizing radiation from all SLAC-produced pathways must be less than 100 mrem/yr. The design goal for the dose equivalent at the site boundary due to the operation of the Linear Accelerator Facility due to sky-shine and direct exposure must be below the design goal of 5 mrem/year.

Expected radiation sources have been identified and analyzed to determine the required radiation safety systems. These sources produce high-energy bremsstrahlung and particle radiation from the interaction of the primary electron beam with protection collimators, beam diagnostic devices, the electron stoppers and dumps, and interaction with the residual gases in the vacuum chambers. A radiation safety system consists of shielding, the BCS, and the PPS, along with a system of rigorously applied safety procedures and a lab-wide personal dosimetry program.


December 5, 2007 SLAC-I-010-30100-009-R001 26

The radiation safety program is designed to ensure that radiation doses received by workers and the public are “As Low As Reasonably Achievable” (ALARA), as well as to prevent any person from receiving more radiation exposure than is permitted under federal regulations. The ALARA program is designed to ensure that access to high radiation areas is controlled, that the accelerator facilities are adequately shielded, and that designs for new facilities and significant modifications incorporate dose reduction, contamination reduction, and waste minimization features in the earliest planning stages. Technical and administrative systems exist to implement the program, as described in the Radiation Safety Systems Technical Basis Document and the SLAC Guidelines for Operations. In addition to shielding, the radiation protection systems use a PPS and a BCS. These systems are subject to SLAC citizen committee reviews and technical implementation reviews by experts from within and outside of SLAC. These systems are implemented with hardware redundancy and are subject to configuration control requirements as defined in SLAC Guidelines for Operations. As part of the configuration control program, these systems are subject to access-driven inspections and check out. Further, these systems undergo rigorous annual certification as defined in SLAC Guidelines for Operations. The PPS ensures that the accelerator and other interlocked hazards are off whenever people are present in the accelerator housing. The BCS is designed to protect people outside the accelerator housing by limiting beam parameters, by ensuring the integrity of PPS stoppers and critical collimators, and by monitoring radiation levels outside the accelerator enclosure. 4.5.2.1 Shielding Requirements The radiation shielding policy at SLAC, applicable to the Linear Accelerator Facility, is documented in the Radiation Safety Systems Technical Basis Document. SLAC’s internal design criteria require that the effective dose equivalent must not exceed 400 mrem/h under a missteering scenario, and that under an accident scenario, the maximum dose equivalent does not exceed 25 rem averaged over a 1 hour period. The design of the shielding for the Linear Accelerator Facility has evolved over many years, from the first designs in 1965 to the present time. Records of shielding calculations are maintained in the minutes of the Radiation Safety Committee and in the archives of the Radiation Protection Department. Details of the LCLS injector shielding analysis and requirements can be found in Shielding and BCS Requirements for Phase One of LCLS Injector Operation and Radiation Safety Analysis for BC2 Chicane in Sector 24. 4.5.2.2 Personnel Protection System The PPS is designed to prevent beams from being delivered to areas where people could be present, and to automatically turn off beams and other interlocked hazards if someone tries to enter a PPS zone when the accelerator is on. The PPS also provides a means for ensuring that everyone who has entered a zone under Controlled Access conditions has come out before beam operations resume. The PPS is composed of beam stoppers, entry modules, and emergency shutoff buttons (see the Radiation Safety Systems Technical Basis Document). Entry to a zone requires that three PPS stoppers all be in a state that prevents the beam from reaching the zone. The following major PPS areas, sometimes called enclosures or zones, make up the Linear Accelerator Facility:

CID Injector Linac Sector-0


December 5, 2007 SLAC-I-010-30100-009-R001 27

DRIP North Damping Ring Vault South Damping Ring Vault Linac Sector Pairs: LI02 and LI03, LI04 and LI05, LI06 and LI07, LI08 and LI09, LI10

and LI11, LI12 and LI13, LI14 and LI15, LI16 and LI17, LI18 and LI19, LI 20 and LI21, LI 22 and LI23, LI24 and LI25, LI26 and LI27, LI28 and LI29

Linac Sector-30 Positron Vault Beam Switchyard End Station A, including Beam Dump East LCLS Injector Vault

The operation of PPS controls is governed by formal procedures: Search Procedures Exit and Entry Procedures Safety Inspection Checklists PPS Interlock Checklists

PPS Zone details are illustrated in PPS Zone Maps. Beamline devices for each area are detailed in Beamline Maps. The PPS for the Linear Accelerator Facility has been designed so that the individual zones can be interconnected in several different ways to accommodate the various operational needs. The operating modes are described in the following section. Modes of Operation The facility may be operated in the following modes:

BAS-II Mode: In this mode, the beam from CID may be accelerated as far as the Beam Analyzing Dump (BAS-II) at Sector-19. Entry is allowed in Sector-30, the BSY, and the end stations, provided that the BAS-II dump, the scattering targets at Sector 20-1 and 20-9, and the Sector-28 stopper are inserted. Entry is permitted to the damping ring vaults and the positron vault provided that the beam stoppers are in place.

BSY Mode: The beam may be terminated in the BSY and entry allowed to ESA and the LCLS zones, provided that the appropriate beam stoppers are in place. Alternatively, if ESA is in a No Access state and all other requirements have been met, beams may be transported through ESA to Beam Dump East.

Sector 5-30 Mode: This mode permits operation of the klystrons and electrical hazards in sectors 5 through 28 if used in conjunction with the BAS-II mode, or sectors 5 through 30 if in the BSY mode. Access is permitted in CID, Sector-0, DRIP, and the damping ring vaults, provided that the backward beam stopper at Sector-4 is inserted.

PPS Zone Interconnections The PPS has been designed to allow entry into one zone or enclosure without breaking the security of adjacent zones. This is an important feature, because searching tunnel areas is time-consuming and labor-intensive, particularly for areas such as End Station A, where seven searchers are required in addition to the PPS console operator in MCC. Thus, while the design is


December 5, 2007 SLAC-I-010-30100-009-R001 28

modular in the sense that zones are independent of each other, all zones must be properly interconnected for safe beam operation and for safe entry when the beams are off. For the linac, this interconnection is accomplished by the following two different circuits, sometimes called loops:

area secure loop set entry loop

The function of the area secure loop circuit is to check that each zone, from CID through to the beam destination, is properly searched and secured, and that the visual and audio warning messages have been completed before beams can be turned on. The loop consists of two wire pairs running the length of the machine. The loop is intercepted at each zone and is broken when security has been lost and made up when the area is secure. When the main PPS circuit logic receives both loop signals, confirming that all zones are ready for the beam, dual permissive signals are sent to each Variable Voltage Substation (VVS), allowing them to be turned on. The VVS permissive signals are sent on two independent 24 V logic lines. These logic signals terminate in each VVS, one controlling the undervoltage trip circuit and the other, the shunt-trip breaker. The set-entry loop prevents entry into a PPS zone until the PPS logic circuits confirm that all VVSs are off. At each VVS, two independent devices are monitored to confirm the off condition. These are an auxiliary contact on the main breaker and the output of an internal voltage monitor. The signals from these devices are connected into the set-entry loop at every alternate sector. When all VVSs are off, the loop is made up. Two independent wire pairs in a DC current-loop configuration are used to transmit the off status to a pair of loop receivers. When the two loop receivers indicate that both paths are satisfied, confirming that all VVSs are positively off, a permissive signal is generated by the PPS logic and sent to each key bank, allowing the MCC operator to release entry keys if all other safety conditions have been satisfied. PPS Zone Entry Requirements Certain beam stoppers must be closed, depending on the particular zone, before the PPS logic will generate permissive signals to release keys and to operate door latches. In addition to the requirement that stoppers be inserted, all electrical hazards in the area must be turned off before door latch and key permissives are given. The hazards and stoppers for each area are listed in the Entry and Exit Procedures. Security Violation A security violation in any zone that is receiving or is ready to receive the beam immediately turns off interlocked electrical hazards and removes beam-related radiation by inserting the stoppers and turning off the VVSs. The Entry and Exit Procedures list the specific stoppers that are inserted or turned off when security is lost in a zone and the electrical hazards that are turned off. Administrative Procedures Even the most carefully engineered interlock system can fail to provide protection if not augmented by administrative rules and procedures covering operation, testing, and modifications. Applicable Accelerator Systems Division procedures and their identifying numbers are listed in Appendix A. Summaries of the PPS-related administrative procedures follow:


December 5, 2007 SLAC-I-010-30100-009-R001 29

Search Procedures: The Search Procedures are formal documents that must be strictly followed to ensure that no person is left in a PPS zone when the hazards are enabled.

Entry and Exit Procedures: The Entry and Exit Procedures are formal documents that list the radiation stoppers and all electrical hazards associated with uncovered magnet terminals that must be turned off.

Safety Assurance Tests: Tests of the PPS done semi-annually, following detailed procedures and checklists prepared by the Controls Department and approved by the ADSO. The procedures include radiation interlock tests, electrical hazard tests, and system tests.

Testing: Whenever an area is searched, specific tests must be done on door microswitches and emergency off buttons to ensure that the PPS sensors are working properly. These tests are described in the Accelerator Systems Division PPS Interlock Checklists. Also, a safety inspection of the radiation protection devices must be made in accordance with written procedures following personnel access to any zone. These are described in the Safety Inspection Checklists issued by the Accelerator Systems Division.

Configuration Control: Policies govern the modification and retesting of PPS systems are described in the SLAC Guidelines for Operations. All changes must be carefully reviewed and approved, and retesting must be done in accordance with an approved procedure.

Beam Authorization Sheets: For each beam running cycle, specific limits on beam parameters and required safety devices are listed in the BAS. This is a formal document prepared by the Radiation Protection Department and subject to the approval of the ADSO and the head of the Accelerator Operations Department. Beam parameters are sometimes limited to levels significantly below the accelerator safety envelope.

Electrical Hazard Testing: Electrical Hazard Test Procedures are used to test energized magnets in tunnel areas. The procedures are issued by the Accelerator Systems Division. All personnel involved in testing interlocked accelerator hazards must adhere to these procedures.

Incident and Alarm Response: Incident Response Procedures and Alarm Response Procedures, issued by the Accelerator Systems Division, must be followed by control room operators whenever warning or alarm signals are received in MCC.

Operators are trained in the use of the PPS by senior Accelerator Operations personnel, and the progress and status of their training is carefully monitored and recorded in PPS certification workbooks for each area. 4.5.2.3 Beam Containment System SLAC’s beam containment policy, described in the Radiation Safety Systems Technical Basis Document, requires that beamlines be designed to limit the incoming beam power and detect beam losses to prevent excessive radiation in occupied areas. The containment of the beam is achieved by implementing a system of redundant fail-safe electronic and mechanical devices, which are subject to strict administrative controls. A typical BCS consists of mechanical devices such as collimators, magnets, electron beam stoppers, and dumps, and devices that shut off the beam when out-of-tolerance conditions are detected, such as average current monitors, burn-through monitors, and BSOICs. The specific BCS configuration required for a particular experiment or mode of operation is described in the corresponding Beam Authorization Sheet.


December 5, 2007 SLAC-I-010-30100-009-R001 30

The BCS for the Linear Accelerator Facility typically uses current monitor toroids to limit the incoming average beam power to less than an approved level, toroids and long ion chambers to limit normal beam losses, protection collimators to limit the range of trajectories of missteered beams, and ion chambers and flow switches to protect collimators, stoppers and dumps. The particular configuration depends on the experimental program and specific beam requirements. At CID, a toroid and pulse integrator module are used to monitor the beam charge on a pulse-by-pulse basis. This is to guard against a failure of the gun pulsing system that might cause the charge per pulse to increase beyond the design limits. If an out-of-tolerance condition is detected, the beam is stopped by multiple independent methods: the CID and linac klystrons are set to standby timing, the timing pulses for the CID guns are delayed, and the “quick” stopper and laser stoppers are inserted. The MCC is the primary collection point for the signals from the BSY, ESA, and the LCLS. Signals originate at beamline devices and are connected by cables to the processing electronics in locked racks in the control room. When a fault condition is detected, beam shut-off modules in MCC withdraw beam permissive signals, and beams are shut down using the same devices that shut off the beam at CID. The equipment at CID and MCC is under strict configuration control, and is checked daily or weekly in accordance with Beam Containment System Procedures, issued by the Accelerator Systems Division. Beamline Design and Implementation Devices along the beamline are designed either to absorb the maximum credible beam power, or are protected with ionization chambers, flow switches, temperature detectors, or burn-through monitors as required. The beam containment policy and guidelines for beam containment implementation are specified in the Radiological Control Manual and the Radiation Safety Systems Technical Basis Document. These provide the beamline designer with minimum requirements for the safe design of beamlines. The final design is normally reviewed by the Radiation Safety Committee. Administrative Procedures Beam Authorization Sheet: The Beam Authorization Sheet (BAS) specifies the beam containment devices that must be active for each beamline during a running cycle. The BAS is prepared by the responsible radiation physicist and is subject to approval by the ADSO and the head of the Accelerator Operations Department. Validation Procedures: Before each beam running cycle, the electronic devices that are required for each beamline are validated using procedures developed by the Beam Containment and Machine Protection Systems Group. Daily and Weekly Test Procedures: Most of the BCS sensors and modules use self-test signals or similar features to ensure system integrity. In addition, daily and weekly checks are carried out on the BCS systems required to be active by the BAS. These include daily checks that systems are active and weekly checks that trip point settings are correct. These routine checks are described in the Beam Containment System Procedures, prepared and maintained by the Accelerator Systems Division. Configuration Control: Procedures that control the modification and retesting of the BCS are described in the SLAC Guidelines for Operations. All changes must be reviewed and approved, and retesting must be done in accordance with an approved procedure.


December 5, 2007 SLAC-I-010-30100-009-R001 31

4.5.2.3.1 Beam Shut-off Ion Chamber System The linear accelerator beam produces negligible radiation at ground level along the linac, even when beam missteering or equipment failure causes significant beam loss in the tunnel. When the beam emerges from the BSY at the end of the two-mile tunnel, it is directed into experimental areas such as ESA and the LCLS. These concrete enclosures are not as thick as the earth shielding along the linac, and if a beam is missteered or intercepted in an unintended way, elevated radiation levels may exist in occupied areas. To prevent these elevated levels from remaining unnoticed for any length of time, a number of interlocked radiation monitors, known as Beam Shut-off Ion Chambers (BSOICs), have been installed in the research yard and other locations. The number of active BSOICs varies, depending on the experimental program. Each BSOIC provides an analog signal proportional to the actual radiation level at the BSOIC and a fail-safe interlock signal which acts to shut off the beam when the upper set point is exceeded. Typically, beam shut-off is achieved by automatic insertion of beamline stoppers. The location for each BSOIC is specified by a radiation physicist based on considerations such as the thickness of the shielding and the likelihood of beam losses at various locations. Most BSOICs are set at 100 mrem/hr, but individual set points vary, and may be as low as 10 mrem/hr. The BSOICs are not intended to monitor dose accumulation in occupied areas, but rather to detect and alarm in the case of a failure of the BCS. Configuration Control In accordance with the requirements of the SLAC Guidelines for Operations, all work on the BSOIC system is performed using Radiation Safety Work Control Forms. Personnel who work on these systems are specifically assigned and authorized to do this work. Acceptance Testing Acceptance testing of sub-assemblies and of each fully assembled BSOIC is the responsibility of the Radiation Protection Department. Testing includes calibration of each unit using a radioactive source. Defective units are repaired by the Controls Department. Field Certification When a BSOIC has been replaced in the field, Radiation Protection Department technicians, working with control room operators, confirm that the BSOIC and the appropriate shutoff paths are operating correctly. These tests are described in the BSOIC Certification Checklists. The checklists are prepared and maintained by the Accelerator Systems Division.


December 5, 2007 SLAC-I-010-30100-009-R001 32

5. Accelerator Safety Envelope This section describes the engineered and administrative bounding conditions that define the Accelerator Safety Envelope (ASE). No operation is allowed which violates the ASE. If such a violation occurs, the offending activity must be terminated immediately and not restarted before the Department of Energy has been notified. The ASE will be reviewed and updated as needed, but no less frequently than every two years. This ASE will also be revised as needed whenever major modifications are made to the facility (see SLAC Guidelines for Operations, Chapter 25: Safety Assessment Documents). The allowed running conditions for each mode of operation are listed explicitly in the corresponding Beam Authorization Sheet (BAS), which is issued for each running period and which is subject to a formal approval process. Compliance with the requirements of the BAS ensures that operational parameters remain within the bounds set by the ASE and that the level of risk to all persons is maintained at an acceptably low level. The BAS typically specifies allowed beam parameter limits, settings of radiation sensors, special shielding configurations, and lists of safety certifications, interlock checks, initial beam tests, and other requirements that may depend on particular experimental configurations. 5.1 Accelerator Operations Safety Engineered safety systems are employed to ensure that the accelerator components operate within their predetermined parameters or operating ranges, that no beam can be introduced into an area occupied by people, and that radiation levels in occupied areas do not exceed predetermined limits. Written procedures provide specific instructions for activities critical to ensuring that the accelerator can be operated safely. Variations in operating conditions are permitted as long as the consequences of the variations do not exceed the bounds imposed by the safety envelope. These variations of the operating conditions may be introduced during machine development study periods, special tests, or as part of the ongoing efforts to improve the performance of the facility. Unplanned events, such as power outages, may interrupt operations but do not compromise the safety of the facility. Shielding is designed to limit integrated radiation doses to acceptable levels, as defined in the Radiation Safety System Technical Basis Document. The maximum acceptable radiation levels are summarized in Table 5-1.

Table 5-1. Ionizing Radiation Shielding Design Limits Condition Limit Beam Loss

Exposure to worker 1 rem/year Normal operations

Exposure to public from skyshine at site boundary

0.1 rem/year Normal operations

Exposure to worker during safety system failure 25 rem/hour or 3

rem/event

Maximum beam power with BCS failure


December 5, 2007 SLAC-I-010-30100-009-R001 33

Three modes of operation are envisioned for the Linear Accelerator Facility in the next few years:

• Electron beam to End Station A. • Electron beam to the LCLS main dump. • Electron and positron beams to PEP-II via the NIT and SIT systems.

In addition, a beam of secondary particles can be generated in the BSY and delivered to ESA. Secondary beams of this kind are necessarily much lower in power and average energy than the primary beam used to produce them. Therefore, this mode can be considered a subset of the primary beam mode. The first mode listed below, in which the full linac is used to accelerate an electron beam to ESA, is SLAC’s original mode of operation and is potentially the most hazardous, because it involves a beam power level an order of magnitude higher than the other modes. Nevertheless, personnel doses resulting from operation of the Linear Accelerator Facility have remained below the limits listed in Table 5-1 for over forty years. This long-term success demonstrates that the shielding and other mitigating techniques described above have worked well for the Linear Accelerator Facility.

5.2 Safety Envelope – Technical Requirements

5.2.1 Laser Power Lasers are used as drive sources for the photocathode guns at CID and in the LCLS injector vault. The maximum powers generated by those lasers are listed in table 5-1.

Table 5-1. Maximum Laser Powers Item Laser Beam Wavelength

(nm) Maximum Available

Power 1 Nd:YAG pumped

Ti:Sapphire 750-900 nm 24 mW

2 Nd:YLF pumped Ti:Sapphire

750-900 nm 60 mW

3 Flashlamp pumped Ti:Sapphire

750-900 nm 2.4 W

4 LCLS Seed Laser 755 nm 400 mW

5 LCLS Pump Lasers 532 nm 12 W

6 UV for LCLS Gun 255 nm 300 mW

The use of lasers at SLAC complies with the American National Standard for the Safe Use of Lasers, the requirements of which have been included within the SLAC ES&H Manual, Chapter 10. Responsibilities and oversight of laser safety is described in Section 4.5.1.2.


December 5, 2007 SLAC-I-010-30100-009-R001 34

5.2.2 Electron Beam to End Station A This mode of operation offers the highest beam power available at SLAC. Calculations have been done to show that the Linear Accelerator Facility is capable, in principle, of accelerating a high-current electron beam up to a maximum theoretical power of 1350 kW at 50 GeV in ESA. The highest documented beam power achieved at SLAC was nearly 600 kW, which was achieved in 2003 during Experiment E-158. This was achieved using a direct (undamped) high charge electron beam from CID, accelerated through the full linac with all klystrons operating, and required a concerted effort by accelerator physicists and engineers, working along side the operations staff, for many weeks. This power level can be considered a practical upper limit on the beam power of the Linear Accelerator Facility. There are no further experiments foreseen that will require this power level. The beam power in the next few years is not expected to exceed 10 kW, although the facility is engineered to handle in excess of 1350 kW with a suitable arrangement of shielding and BSOIC monitors. A positron beam of about 3 x 1010 particles per pulse was delivered to ESA for brief periods in 1997 and 1998, and could be done again if the scientific program required such a beam. However, this mode requires reversing the polarities of a large number of magnets, and so is not likely to done without careful planning and deliberation. The maximum beam power achievable in this mode is approximately 40 kW, which is well within the safe bounding conditions of this facility. See Table 5-2.

Table 5-2. ESA Operation and Safety Envelope Energy Up to 50 GeV with the full linac. Beam power during typical operation (3.5 x 1010 e- per pulse at 28.5 Gev, 30 Hz)

5 kW

Operations envelope: Up to 600 kW with undamped electrons at 120 Hz; up to 65 kW e+ or e- with damping.

Theoretical maximum beam power for safety envelope:

1350 kW electrons without damping; 190 kW e+ or e- with damping.

5.2.3 LCLS Electron Beam to the BSY The maximum possible LCLS beam power is derived by assuming that the maximum possible electron current from the gun is accelerated to the maximum possible energy with a repetition rate of 120 pps.


December 5, 2007 SLAC-I-010-30100-009-R001 35

The maximum credible beam power is calculated by assuming the total stored energy in the gun is directed to the acceleration of electrons (“explosive electron emission”). The acceleration of this current in the accelerator structures is then simulated at the highest gradient consistent with beam loading effects. An energy spectrum for the beam is produced, and beam losses are calculated based on the physical aperture of the beamline. This analysis is done for the beam stopping at the TD11 stopper, and also for the beam accelerated down the linac to the BSY. The resulting parameters are summarized in Table 5-3.

Table 5-3. LCLS Operation and Safety Envelope Energy: Up to 17 GeV Nominal operating power: 1680 W Operations envelope: 5 kW Maximum credible LCLS beam power for safety envelope: 100 kW

An estimate of beam losses during normal operations of the LCLS injector system, and the maximum credible beam power are documented in the LCLS Physics Requirement Document. Estimates are made for beam loss at a number of locations including beam dumps, and under a variety of normal operating conditions, including an estimate for dark current. The maximum values in this table have been used as the basis for designing shielding for the LCLS systems.

5.2.4 Electron and Positron Beams to PEP-II via the NIT and SIT Systems In this mode, damped single bunches of electrons and positrons from the damping rings are accelerated through a portion of the linac to reach the energies needed for injection into PEP-II. The positrons are extracted from Sector 4 at an energy of 3.1 GeV, and the electrons are extracted at Sector 10 at an energy of 9.0 GeV. The installed hardware is capable of reaching slightly higher energies for each beam, but these values are normal for PEP-II operation. See Table 5-4.

Table 5-4. Operation and Safety Envelope for Beams to PEP-II Energy: Up to 12 GeV electrons.

Up to 4 GeV positrons. Operation envelope: 3.5 kW e-

1.5 kW e+ Theoretical maximum beam power for safety envelope:

333 kW e- 10 kW e+


December 5, 2007 SLAC-I-010-30100-009-R001 36

5.3 Safety Envelope – Administrative Requirements The safety envelope includes administrative policies and procedures to ensure that all required safety devices (toroid charge monitors, beam stoppers, beam loss monitors, supplemental shielding, etc.) are in place and functioning properly. These include procedures for verifying by inspection that the required safety devices are in place, initial beam tests to calibrate sensors and demonstrate the efficacy of shielding, and documented work control procedures and authorization policies for maintenance, replacement, or modification of safety devices. The specific devices required for each mode of operation are listed in the Beam Authorization Sheet. The PPS is subject to a documented safety assurance test before interlocked hazards are energized and every six months during extended running periods. Requirements for configuration control and periodic system testing are described in SLAC Guidelines for Operations.


December 5, 2007 SLAC-I-010-30100-009-R001 37

6. Quality Assurance The quality assurance (QA) program is described in the SLAC Assurance Program Description. SLAC’s QA program places a high priority on safety as well as on ensuring that equipment procurement, installation, and operations are carried out in an efficient and cost-effective manner. SLAC’s line management organization is responsible for providing appropriate resources to ensure that the facility meets its long-term performance goals in a safe and effective manner consistent with high standards of quality assurance. At all levels, management communicates high expectations and goals for the attainment of quality, and makes decisions to ensure that performance objectives for both construction and operation are met. Management also seeks out and uses, as applicable, modern quality assurance, manufacturing, and reliability approaches. The Accelerator Systems Division maintains a comprehensive document control system for all policies and procedures required for the safe operation of the Linear Accelerator Facility. SLAC Guidelines for Operations and Accelerator Division Operations Directives are the controlling documents for facility operations. The guidelines and directives, together with the more detailed procedures which implement them, are intended to ensure that a high level of performance is achieved in the operation of the accelerator, and that operations are carried out in a safe and effective manner.


December 5, 2007 SLAC-I-010-30100-009-R001 38

7. Post Operation Decommissioning of the Linear Accelerator Facility will be a major engineering task. Large volumes of reinforced concrete will have to be disassembled and removed, and large volumes of backfill will be required to restore the terrain. SLAC has developed programs to minimize contamination by reducing the generation of contaminants, to contain spills, and to dispose of contaminants. Decommissioning will require extensive soil sampling to evaluate the need to scrape and replace soil in order to achieve the goal of restoring the site to unrestricted residential standards. The decommissioning plan will delineate the applicable California and federal laws, consensus standards, DOE directives, and other requirements applicable to the activities at the time of decommissioning.


December 5, 2007 SLAC-I-010-30100-009-R001 39

Appendix A. References Accelerator Division Operations Directives SLAC-I-040-00100-001 Accelerator Facility Safety Implementation Guide for DOE O 420.2B, Safety of Accelerator Facilities

DOE G 420.2-1

Alarm Response Procedures SLAC-I-040-30700-002 American National Standard for the Safe Use of Lasers ANSI Z136.1-2000 Annual Site Environmental Report 2005 SLAC-R-831 ASO-1 Qualification Workbook SLAC-I-040-50400-001 BABAR Safety Assessment Document SLAC-I-023-302TP-000 Beam Authorization Sheets Beam Containment System Procedures SLAC-I-040-30200-007 Beamline Maps SLAC-I-040-20200-001 BSOIC Certification Checklists SLAC-I-040-30400-011 Code of Federal Regulations, Electrical OSHA 29, Part 1910,

Subpart S Code of Federal Regulations, Nuclear Safety Management Title 10 CFR, Part 830 Code of Federal Regulations, Occupational Safety and Health Standards, Hazard Communication

Title 29 CFR, Part 1910, 1200

Code of Federal Regulations, Procedural Rules for DOE Nuclear Activities; Enforcement Process

Title 10 CFR, Part 820, Subpart B

Electrical Hazard Test Procedures SLAC-I-040-30400-002 Entry and Exit Procedures SLAC-I-040-30400-003 Environmental Assessment for the LCLS Experimental Facility DOE/EA-1426 Equivalency Document for the Linac Coherent Light Source Non-Compliant Common Path of Travel in Front End Enclosure

October 20, 2006

Facility Safety DOE O 420.1A Fire Alarm System Reference Manual SLAC-I-040-30500-003 Incident Response Procedures SLAC-I-040-30700-001 Is a Powerful Quake Likely to Strike in the Next 30 Years? U.S. Geological Survey

Fact Sheet 039-03 LCLS Beam Containment System Requirements LCLS 1.1-311 LCLS Injector Physics Requirements PRD 1.2-001 LCLS Injector Safety Assessment Document SLAC-I-010-30100-015 LCLS Personnel Protection System Requirements LCLS 1.1-310 LCLS Physics Requirement Document 1.3-117 LCLS Quality Assurance Plan PMD-003 Life Safety Code NFPA 101 Linac Coherent Light Source Global Project Requirements LCLS 1.1-011 Lock and Tag Program for the Control of Hazardous Energy SLAC-I-730-0A10Z-001 National Electrical Code NFPA 70 National Emission Standards for Hazardous Air Pollutants: Subpart H: Department of Energy Facilities

Title 40 CFR, Part 61, Subpart H

Nonreactor Nuclear Safety Design Criteria and Explosives Safety Criteria Guide

DOE G 420.1-1

PEP-II Safety Assessment Document SLAC-I-010-30100-013 PPS Interlock Checklists SLAC-I-040-30400-005 PPS Zone Maps SLAC-I-040-30200-002 Radiation Safety Analysis for BC2 Chicane in Sector 24 RP-07-22 Radiation Safety Systems Technical Basis Document SLAC-I-720-0A05Z-002 Radiological Control Manual SLAC-I-720-0A05Z-001 Safety Analysis and Review System DOE O 5481.1B Safety Inspection Checklists SLAC-I-040-30400-004 Safety of Accelerator Facilities DOE O 420.2B


December 5, 2007 SLAC-I-010-30100-009-R001 40

Search Procedures SLAC-I-040-30400-001 Shielding and BCS Requirements for Phase One of LCLS Injector Operation

RP-05-07

Shielding Requirements for Phase One of LCLS Injector Operation RP-05-15 Shift Schedules and Training Record Summaries SLAC-I-040-20100-004 SLAC Accelerator Facilites: Implementation Plans for DOE Order 5480.25 SLAC Assurance Program Description SLAC-I-770-0A17B-001 SLAC Emergency Preparedness Plan SLAC-I-730-0A14A-001 SLAC ES&H Manual SLAC-I-720-0A29Z-001 SLAC Guidelines for Operations SLAC-I-010-00100-000 SLAC Integrated Safety and Environmental Management (ISEM) Program Description

Specification for Seismic Design of Buildings, Structures, Equipment, and Systems at the Stanford Linear Accelerator Center

SLAC-I-720-0A24E-002

Standard for Electrical Safety in the Workplace NFPA 70E Standard Operating Procedure for the LCLS Injector Laser LCLS 1.2-001 Summary of Requirements for Work in Accelerator Housings SLAC-I-010-00100-002 The Geology of Stanford Linear Accelerator Center SLAC-I-750-3A33X-002 Title II Fire Hazards Analysis for the Linac Coherent Light Source October 20, 2006 Work Smart Standards


December 5, 2007 SLAC-I-010-30100-009-R001 41

Appendix B. Abbreviations used in this Document ACGIH American Conference of Government Industrial Hygienists ADMO Accelerator Division Maintenance Office ADSC Accelerator Division Safety Committee ADSO Accelerator Division Safety Officer AE&CM Architect Engineer-Construction Manager AEC Atomic Energy Commission ALARA As Low As Reasonably Achievable ASE Accelerator Safety Envelope ASE Accelerator Safety Envelope ASE Accelerator Systems Operator BAS Beam Authorization Sheet BAS-II Beam Analyzing Dump BC Bunch Compressor BCS Beam Containment System BSOIC Beam Shutoff Ion Chamber BSY Beam Switchyard BTM Burn-Through Monitor CID Collider Injection Development Injector DOE U.S. Department of Energy ELP Equipment Lockout Procedure EnvSC Environmental Safety Committee EOIC Engineering Operator-in-Charge EPAC SLAC Experimental Program Advisory Committee EqSC Earthquake Safety Committee ESA End Station A ESC Electrical Safety Committee FHA Fire Hazard Analysis FONSI Finding of No Significant Impact FPSC Fire Protection Safety Committee GERT General Employee Radiation Training GeV Gigaelectron-volt HEEC Hazardous Experimental Equipment Safety Committee HER High-Energy Ring HRC Hoisting and Rigging Safety Committee IR Infrared ISEMS Integrated Safety and Environmental Management System LCLS Linac Coherent Light Source LCW Low Conductivity Water LER Low-Energy Ring Linac Linear Accelerator LOTO Lock Out, Tag Out LSC Laser Safety Committee or Life Safety Code LSO SLAC Laser Safety Officer MCC Main Control Center NDR North Damping Ring NEC National Electrical Code NESHAP National Emissions Standards for Hazardous Air Pollutants NFPA National Fire Protection Association NiRSC Non-ionizing Radiation Safety Committee NIT North Injection Transport


December 5, 2007 SLAC-I-010-30100-009-R001 42

PAFD Palo Alto Fire Department PPA Particle Physics and Astrophysics Division PPS Personnel Protection System QA Quality Assurance RCA Radiologically Controlled Area RF Radio frequency RPFO Radiation Protection Field Operations RSC Radiation Safety Committee RSO Radiation Safety Officer RTD Resistance Thermometer Device SAD Safety Assessment Document SDR South Damping Ring SIT South Injection Transport SLC SLAC Linear Collider SLUO SLAC Users Organization SOC Safety Overview Committee SPC SLAC Policy Committee SSRL Stanford Synchrotron Radiation Laboratory TLV Threshold Limit Value UBC Uniform Building Code UV Ultraviolet VESDA Very Early Smoke Detection Appliance VVS Variable Voltage Substation WSS Work Smart Standards WTA West Turn Around