An FMEA Assessment of an HTR-Based Hydrogen Production Plant

Abstract

The topic of hydrogen as an energy vector is widely discussed in the present literature, being one of the crucial technologies aimed at human carbon footprint reduction. There are different hydrogen production methods. In particular, this paper focuses on Steam Methane Reforming (SMR), which requires a source of high-temperature heat (around 900 °C) to trigger the chemical reaction between steam and CH₄. This paper examines a plant in which the reforming heat is supplied through a helium-cooled high-temperature nuclear reactor (HTR). After a review of the recent literature, this paper provides a description of the plant and its main components, with a central focus on the safety and reliability features of the combined nuclear and chemical system. The main aspect emphasized in this paper is the assessment of the hydrogen production reliability, carried out through Failure Modes and Effects Analysis (FMEA) with the aid of simulation software able to determine the quantity and origin of plant stops based on its operational tree. The analysis covers a time span of 20 years, and the results provide a breakdown of all the failures that occurred, together with proposals aimed at improving reliability.

1. Introduction

Decarbonization is one of the main final targets in any field of energy production in the present and future decades. To achieve this target, a fundamental step will consist of switching from fossil fuel-based technologies to cleaner ones. A potential solution comes from the use of hydrogen as an innovative energy vector that could replace traditional fossil fuels in particular for transport [1], whose incidence is increasing. Indeed, electric vehicle issues such as the “power to weight” ratio and the development of “green” processes for battery production have not yet been fully addressed. For these reasons, it is useful to find alternative strategies to address these drawbacks. A potential solution comes from the use of hydrogen as an innovative energy vector that could replace traditional fossil fuels [2].

Hydrogen is an “energy carrier” and not a primary energy source; therefore, the effectiveness of its use as a low-impact fuel depends strongly on the technology that is used to produce hydrogen itself. Consequently, an interesting option is to combine hydrogen production and nuclear power plants; this could lead to a system entirely absent of greenhouse gas emissions. As a chemical energy carrier, hydrogen can be stored, moved, and converted directly into heat, avoiding changeover efficiencies. Industrial hydrogen applications include energy production using gas turbines and transportation systems using fuel cells both for electric and hybrid vehicles, as well as being used directly in alternative engines. One of the major issues related to large scale use of H₂ is storage, which is more complicated compared with other gases [2,3].

Processes that can be used to obtain hydrogen are those that decompose water into its fundamental components; these processes are complicated because water molecules are very stable. The main processes are [4]:

• Steam methane reforming (SMR) uses methane along with water vapor; at present is the main conventional process for hydrogen production.
• Thermal decomposition provides heat to water, causing it to dissociate into its components. This process is not viable because of the high temperatures required and the need for strong vacuum conditions.
• Thermochemical cyclic processes, in which the heat necessary for water dissociation is partially provided by a series of endothermic and exothermic reactions.
• Electrolysis splits water through the direct application of electrical energy.
• Photolysis splits water by harnessing solar energy.
• Bacterial decomposition

The processes that are currently considered for industrial application are SMR, thermochemical cycles, and electrolysis.

Currently, about 65 million tons per year of H₂ are produced by reforming methane. This process generates about 600 million tons of carbon dioxide (CO₂) per year, which represents about 1% of global net greenhouse gas emissions [5].

The association of a hydrogen production system with a nuclear reactor allows for the utilization of a constant heat source that does not generate CO₂ emissions, thereby reducing the cost of energy services and the global impact on the environment.

Hydrogen production through the SMR process with heat provided by nuclear sources is considered the closest to commercialization and is seen as an intermediate step toward hydrogen production from nuclear energy using water.

Due to the nature of the process, SMR is not considered a long-term technology because the reforming and water shift processes use natural gas as a raw material and, consequently, emit CO₂ as a byproduct of the chemical reactions.

The association of an HTR to the SMR process appears to be the best combination at present. The main energy consumers among hydrogen production options are:

• (AE) Alkaline electrolysis
• (PEM) Proton-Exchange Membrane electrolysis
• (HTSE) High-Temperature Steam Electrolysis
• (SRP) Steam Reforming Process

The last one is the most efficient among those already available on an industrial scale and requires the least total amount of energy [2,3,4,5,6,7], see Figure 1

The advantages of nuclear-associated reforming include an increase in operating temperature above 500 °C, generating about 17% less CO₂ than reforming with the combustion of fossil resources.

In addition, since the nuclear reactor provides heat via helium, the consumption of methane gas to generate heat is no longer necessary and would be reduced by at least 30% [2,7].

This study concerns the association in terms of plant engineering and safety through an analysis of failure rates obtained according to an FMEA analysis methodology.

One of the main aims is to highlight the reduction in fossil fuel consumption and, above all, the safety of the combined system, studying how to act with a view to improvements.

The association of an HTR with an SMR cycle allows for improving the overall energy efficiency of the system: the heat generated by the reactor can be used not only for the reforming process but also for other industrial applications, such as electricity production or heating. In addition, the SMR process uses the heat generated without burning fossil fuels [2,3,4,5,6,7,8,9,10]. These multiple uses of heat increase the energy yield of the system and reduce operational costs. Another significant advantage is the intrinsic safety of fourth-generation reactors, including HTR. These reactors are designed with passive safety systems that reduce the risk of nuclear accidents. HTR uses advanced materials and design configurations that enhance the resistance to core meltdowns and other catastrophic events. If the coolant used for the nuclear core is helium gas, it is possible to design and manufacture a high-efficiency intermediate heat exchanger (IHX) in which heat is transferred from the primary to the secondary circuit, making this combination one of the most promising for industrial application in the future [2,3,4,5,6,7,10].

HTR is one of the Generation-IV types of reactors, partially still under development, expected to introduce marked differences from Generation II and III reactors, especially in the materials used, while continuing to have mainly uranium and plutonium as fissile material.

The primary goals of the development of fourth-generation reactors are:

• Safety and reliability, with a low likelihood and damage of reactor core damage.
• Economics, with a clear cost advantage and comparable financial risk to other energy sources and projects.
• Sustainability, with effective fuel utilization and reduction in nuclear waste, reduces long-term management burden.
• Proliferation resistance, being unattractive for diversion or theft of weapons-usable materials and increasing physical protection against terrorist attacks.

HTR uses graphite as a moderator and gas (usually helium) as a coolant. Its main components/systems are [8]:

• Reactor Core: circular cylinder consisting of hexagonal fuel blocks, graphite guide blocks, and control rods; alternatively, graphite pebbles can be used instead of fuel blocks. The reactor core uses graphite as a moderator since it is suitable as a structural material because of its excellent properties, including high resistance to radiation, high heat resistance (with a sublimation temperature of about 3000 °C), and high thermal conductivity. The core of an HTR has a large thermal capacity, which helps ensure a high level of safety, as it can manage temperature rises without reaching critical conditions.
• Nuclear Fuel: depending on its shape, the HTR fuel can be classified as prismatic (block type or pin-in-block) or pebble-bed. In prismatic type fuel, a compact fuel containing fuel particles is inserted into a graphite sleeve. In pebble-bed type fuel, CFPs (coated fuel particles) are sintered into spherical form with a diameter of approximately 6 cm starting from a graphite-based matrix. The individual CFPs are of the TRISO type (tri-isotropic-coated particles) and have uranium oxide cores typically enriched to 6% by weight and a diameter of 600 μm, coated with layers of ceramic materials.
• Control system: the reactivity is controlled through the control rods (CR), which are inserted into the core guide columns and the reflector columns. A reserved shutdown system (RSS) is provided as an emergency shutdown system and works by inserting boron carbide/graphite pellets into the third channel of each control rod guide column. The neutron absorber is made of B₄C and is coated with a cylindrical sheath nickel–iron–chromium alloy (800H-AT).
• Cooling system: helium was chosen as a coolant because it does not chemically react with the fuel and core structures. In this way, there is no need to consider the risks associated with instability situations when water is used as a coolant. Helium has minimal effects on neutron moderation and/or absorption and, therefore, does not influence the reaction in the core.

The HTR cooling system (Figure 2) is divided into:

-

MCS main cooling system

-

ACS auxiliary cooling system

The MCS consists of the helium-helium heat exchanger IHX and two pressurized water coolers (PPWC and SPWC). The ACS consists of an auxiliary heat exchanger (AHX), two auxiliary helium circulators, and an air cooler. In the event of an accident, forced core cooling must be available, and the ACS automatically starts in response to a reactor SCRAM signal. Two vessel cooling systems (VCS) for the reactor pressure vessel (RPV) are provided to prevent the reactor core and pressure vessel from suffering thermal damage when the ACS is unable to cool the core. The VCS is designed as an independent system, disconnected from other cooling systems with its own emergency power supply; it is also in service during normal operation to cool the concrete walls. The VCS functions as a residual heat removal system when forced circulation in a primary cooling system is no longer available due to a rupture in its piping system.

• Heat Exchangers/Steam Generator: Transfer the heat produced by nuclear fission to a secondary cycle.
• Containment System: designed to ensure safety; its purpose is to contain radioactive materials, prevent nuclear accidents, and maintain structural integrity.

HTR has four distinct containment systems:

-

The fuel coating

-

The RPV (reactor pressure vessel)

-

The CV (containment vessel)

-

The reactor building

The CV is a steel containment vessel installed in the reactor building; the primary functions of the CV include:

-

containing fission products (FP) and preventing their release into the cooling system and the atmosphere

-

limiting the amount of air that can enter the core and react with the graphite present

The primary cooling system and the RPV are contained within the CV. The reactor pressure vessel (RPV) consists of a vertical cylinder with hemispherical closures at the top and bottom areas. The upper head closure is bolted to a flange on the cylinder of the vessel. Major specifications are reported in

Table 1. Major specifications of the containment [8].

Containment	Material	Maximum Allowable Temperature
CV	SUS316	150 °C
RPV	2.25Cr-1Mo Steel	440 °C

.

For this analysis, the test reactor HTTR, built in Japan [8], was chosen as a reference; therefore, temperatures, pressures, and dimensions refer to it, and the secondary plant has been designed on this basis (

Table 2. Major reactor parameters specifications [8].

HTTR
Thermal power	30 MW
Coolant	Helium
Helium Core outlet coolant temperature	850/950 °C
Core inlet coolant temperature Fuel	395 °C
Fuel	Low-enriched UO2
Fuel element type	Prismatic block
Direction of coolant flowing through the core	Downward
Pressure vessel material	Steel
Number of main cooling loops	1
Heat removal system	Pressurized water cooler and IHX
Primary coolant pressure	4 MPa
Containment vessel	Steel containment
Plant lifetime	20 years

).

The secondary circuit is dedicated to hydrogen production and can be summarized as:

• Intermediate Heat exchanger (IHX)
• Exchangers and Hydrogen Generation System

As for other advanced nuclear plants [6], the IHX (Figure 3) is a key element, particularly for hydrogen production, so it is essential to define its operating parameters and perform safety checks. The advantages of introducing this exchanger include:

-

Separating the nuclear plant from the chemical plant

-

Eliminating the possibility of radioactive contamination in the final product

-

Preventing potential corrosion processes on the primary circuit side [11]

-

Facilitating maintenance and replacement of components in case of failure

-

Having a flexible design and managing hydrogen production

The disadvantages are:

-

The exchanger operates at high temperatures

-

There are significant temperature differences and high pressures, which necessitate a careful selection of suitable materials

Figure 3. IHX design [12].

Figure 3. IHX design [12].

The parameters related to the IHX strongly depend on the process and the type of plant; it must meet minimum lifespan requirements, with values around 100,000 operating hours. Since it must be inserted into a pressurized cycle, the connections and joints must have minimal clearance to avoid infiltration and bypass but must also account for thermal deformations. To validate any type of exchanger design, both experimental and numerical analyses are required [2].

In the IHX exchanger, the primary helium is moved by a blower and interacts with the secondary helium, which will then be used by the steam reformer instead of interacting with the pressurized water coolers, as shown in Figure 2. The secondary helium enters from the top and is uniformly distributed through an annular duct, exiting in a counterflow direction.

Inside the exchanger, the gas is routed through various sections: the hot helium enters and flows into the PGC (Primary Gas Cooler), while the secondary helium passes through dedicated collectors and, via the so-called “cold heads”, is directed into the tubes of the helical coil. The containment structure consists of a double-walled shell with an internal insulating layer that serves both as heat resistance and as a means of maintaining pressure.

The descending cold helium flows through the gap between the two walls, functioning both to distribute the temperature uniformly on the outer part and to maintain internal pressure. To minimize constraints on the radial and axial thermal expansion of the helical tubes, floating heads are used in the exchanger, allowing axial movement. For radial expansion, support tubes are implemented to control this effect [8,12].

Major IHX parameters are specified in

Table 3. Major IHX parameters specifications [8].

IHX
Design shell pressure	4.81 MPa
Design tube pressure	0.29 MPa
Design shell temperature	430° C
Design tube temperature	955° C
Primary helium (shell side) inlet temperature	850–950 °C
Primary helium (shell side) outlet temperature	389 °C
Primary helium (shell side) inlet pressure	4.06 MPa
Primary helium (shell side) pressure drop	1 kPa
Flow rate	3.4 kg/s
Secondary helium inlet temperature	270 °C
Secondary helium outlet temperature	775–860 °C
Secondary helium inlet pressure	4.21 MPa
Secondary helium pressure drop	20 kPa
Secondary helium flow rate	3.0 kg/s
Design lifetime	20 years

.

The steam reformer (SR) is a chemical reactor in which the oxidation reaction of the carbon present in methane takes place; schematically, it can be represented by a pressurized vessel in which the hot secondary helium releases heat to the mixture of methane and steam inside a bundle of tubes containing a nickel-based catalyst Ni₂/Al₂O₃. To optimize the heat transfer between helium and process gas, a double tube with radial fins was chosen. Inside the reformer, there is a catalytic bed made up of a total of 62 helical tubes. It must be taken into account that if the catalyst tube were infinitely long, the temperature of the process gas would approach that of the helium gas; therefore (see

Table 4. Major SR parameters specifications [13].

SR
Thermal power	10 MW
Secondary helium inlet temperature	880 °C
Secondary helium outlet temperature	600 °C
Secondary helium flow rate	25 kg/s

), the length of the catalyst tube is limited (typically to 10 m) because the generation of steam, downstream of the reformer, requires that the temperature of the helium gas at the reformer outlet to be about 600 °C. This represents a particular condition for the steam reforming reaction, which must absorb heat but in a controlled manner.

The Steam Generator consists of a pre-heater, an evaporator, and a super-heater; it is installed downstream of the SR, which is connected to the HTTR because the two have different thermal dynamics. The power of the nuclear reactor and the temperature of the primary helium have a proportional relationship. Primary helium transfers heat to secondary helium through heat exchange, governed by the operation of the IHX exchanger. Secondary helium is the heat source for the endothermic reaction, and the thermal energy required to complete the reaction increases drastically with a rise in reaction temperature. The difference in thermal dynamics, represented by heat exchanges, is managed by the steam generation group which ensures stable controllability for any disturbance to the SR. It is essential to ensure the continuous operation of the nuclear reactor by continuing to remove heat from it.

The Steam Generator is a well-established technology with various techniques to adjust the absorbed power. The entry of secondary helium at a temperature higher than the design value can be managed through various methods, including feedwater control, adjustment of ventilation speed and water flow, steam recirculation, or the use of a bypass [13].

The plant layout is shown in Figure 4.

The choice of a helium circuit as the cooling system considers the effects on materials; if water or carbon dioxide were used as the primary coolant, chemical reactions could occur, exacerbating wear effects.

For the helical tubes of the IHX exchanger, a nickel-based superalloy developed by JAEA (Tokyo, Japan) and Mitsubishi Materials (Tokyo, Japan), called Hastelloy X [2], was selected according to the required properties material.

Specifically, a Cr-Mo-Fe alloy from the XR series has been chosen, where R stands for resistance to high temperatures. These alloys are widely used in aircraft engines and can withstand high-temperature heat exchange (>600 °C).

A fundamental component of Hastelloy X is boron, which forms intergranular compounds that reduce creep phenomena and facilitate welding.

Two types of design (Figure 5) planned for the transport piping structure have been considered:

• A coaxial structure connecting the IHX to the primary exchanger (which varies depending on the type of production associated with the HTR)
• A single insulated duct for the secondary helium circuits

The inner pipe of the coaxial structure, where primary helium flows, is made of Hastelloy XR, with an internal wall coating of ceramic fibers composed of SiO₂ and Al₂O₃. The outer conduit, made of SUS316, carries secondary helium in counterflow, absorbing heat.

The single pipe design is constructed similarly to the inner tube of the coaxial structure [13].

The main material degradation mechanisms and their effects are [2,8,9,10,11,12,13,14]:

• Temperature → phase reactions
• Neutron irradiation → crystalline lattice damage, radiation effects
• Chemical conditions → formation of oxides/carbides
• Mechanical stress → thermal creep, plastic deformations, crack formation
• Thermal perturbation → reactor SCRAM
• Tritium permeation → radioactivity of the produced hydrogen

The process parameters of the reforming system are listed in

Table 5. Major Steam reforming process specifications [13].

SRP
Secondary Helium flow rate	9070 kg/h
Secondary Helium temperature:
Outlet/Inlet of the IHX	905/160 °C
Outlet/Inlet of the SR	880/600 °C
Outlet/Inlet of the SG	555/275 °C
Pressure	4.1 MPa
Process feed gas flow rate	6450 kg/h
Methane	1290 kg/h
Steam	5160 kg/h
Process feed gas composition:
CH4	17.7 mol%
C2H6	1.2 mol%
C3H8	0.6 mol%
C4H10	0.3 mol%
H2O	80.2 mol%
Process feed gas pressure	4.5 MPA
Product gas Composition:
H2	38.7 mol%
CO	4.7 mol%
CO2	5.7 mol%
CH4	5.1 mol%
H2O	46.0 mol%
Product gas pressure	4.1 MPa

.

The natural gas flow rate as feed gas is 1290 kg/h, and the steam flow rate at the reformer (SR) inlet is 5160 kg/h. The maximum pressure and temperature of the feed gas in the process are 4.5 MPa and approximately 830 °C.

The expected methane-to-hydrogen conversion rate is about 68%, meaning that 32% of the methane will remain in the produced gas. After the reforming process, the gas undergoes a pressure swing adsorption (PSA) process for H₂ purification and a preferential oxidation process for methane removal [13].

The SMR process involves breaking the bond between carbon and hydrogen in the methane molecule (CH₄) using heat and steam: in this way, carbon oxidation occurs, generating carbon dioxide (CO₂) and hydrogen (H₂).

The chemical reactions of the SMR process are as follows [7]:

$$C_n{H}_m+n{H}_{2}O \stackrel{Catalytic reactor}{\to } \left(n+{\displaystyle \frac{m}{2}}\right)H_2+nCO (700–850 °\mathrm{C})$$

(1)

$$x{H}_2+yCO+O_2\stackrel{Partial Oxidation}{\to } x{H}_{2}O+yC{O}_2 (700–900 °\mathrm{C})$$

(2)

Both are endothermic, and the heat needed is provided by the coolant from the nuclear reactor.

The reformed gas is then sent to a water–gas shift (WGS) converter: its primary function is to convert carbon monoxide (CO) into carbon dioxide (CO₂) and hydrogen (H₂) using water, thereby increasing the hydrogen yield.

The WGS process, which is slightly exothermic, is usually performed in two stages:

$$2H_{2}O+CO \stackrel{Catalytic reactor}{\to } CO+H_2 (300–450 °\mathrm{C})$$

(3)

$$C{H}_4+{\displaystyle \frac{1}{2}}{O}_2 \stackrel{Catalytic reactor or non}{\to } CO+2H_2 (200–250 °\mathrm{C})$$

(4)

Using an excess of steam (typically 300%) shifts the equilibrium in the water–gas shift reaction, thus obtaining a higher hydrogen yield and preventing carbon deposition due to the Boudouard reaction, which is also nickel-catalyzed.

The Boudouard reaction involves carbon monoxide (CO) and solid carbon (C) and is expressed by the following equation:

$$2CO\to {CO}_2+C$$

(5)

where two molecules of carbon monoxide combine to form one molecule of carbon dioxide and deposit one molecule of solid carbon; this reaction is important in industrial processes because the formation of solid carbon creates undesirable deposits on the surfaces of catalysts or plants.

Deposits can reduce process efficiency and cause operational problems, such as clogging pipes in reforming reactors. The most common practice to provide the necessary heat is the combustion of natural gas; an alternative solution is to exploit the heat output from an HTR plant [7].

Achieving high performance in hydrogen production through steam reforming requires:

-

A compact and high-performance steam reformer

-

Low heat losses in the hot gas duct installed between the reactor and the hydrogen production system

-

An emergency shut-off valve that can operate under high-temperature conditions in case of a radioactive release event in the reactor containment vessel

-

A hydrogen production rate greater than 4000 Nm³-STP/h

-

An overall efficiency of ~80%

The advantages of advanced reforming include an increase in the operating temperature of the reformer beyond 500 °C. This increase has a beneficial effect, generating about 17% less CO₂ compared to reforming with fossil fuel combustion. Additionally, compared with the case where heat is provided through fossil fuels, the CH₄ consumption for hydrogen production in a nuclear-connected plant would be reduced by at least 30% (up to 40%), as the nuclear reactor provides heat through helium [7].

The purpose of this paper is to provide an assessment of the reliability of the HTR-SMR system for hydrogen production through a reliability analysis (FMEA) using the FTA method supported by a proper simulation tool.

The aim is to identify the critical issues through simulations, starting from an analysis of the failure rates to identify the elements on which to act in order to improve the reliability of the full system.

The main results are gathering data and identifying possible strategies to improve the reliability of the combined production plant.

2. Materials and Methods

The reliability analysis of the hydrogen production plant involves the characterization and assessment of those failures having the capacity to compromise the hydrogen throughput. In particular, the present study is turned to quantify the plant unavailability total time, investigating the causes which lead to every plant stop occurring, by going in-depth down to the level of elementary components failures. The methodology adopted for achieving this goal is the Failure Modes and Effect Analysis (FMEA), carried out by means of the Fault Tree Analysis (FTA) technique supported by simulation. Since the plant’s expected lifetime is set to 20 years, the simulations have been protracted for this time span.

2.1. FMEA and FTA Methods

FMEA is a qualitative approach to reliability analysis that allows assessing of the behavior of a complex system by decomposition into its hierarchical levels of functionality [15]. FMEA includes three objectives:

• identifying and analyzing all potential failures associated with a system and assessing their effects;
• identifying the actions required to eliminate or significantly reduce the system failures and associated consequences;
• documenting the system from a functional point of view in the design and operating phase.

In order to add a quantitative dimension to FMEA aimed at carrying out a time-dependent analysis of the system reliability behavior, the FTA technique offers a systematic methodology able to graphically represent the hierarchical connections existing among the system parts in the form of an “operational tree”; the latter highlights the system chains of events with the use of Boolean type operators OR/AND.

An operational tree is a logic diagram that contains the functional dependencies of a system’s parts, allowing it to state the combination of basic events that lead to a top event. The representation starts with the identification of an undesired top event, in this case, system failure or malfunction, and continues with the determination of all possible event paths leading to the top event.

The advantage of applying FMEA and FTA to complex plant assemblies is the capacity of these methods in synergy to reach the desired level of detail regarding the system functional features.

2.2. Operational Tree Computer Simulation

The plant operational tree is the basis on which to perform a computational analysis aimed at quantifying the failure occurrences and analyzing their causes and possible elimination strategies. This analysis is carried out with the aid of a simulator described in the following.

The simulator is a Montecarlo-type solver [16,17,18,19,20,21] and takes the system operational tree as the main input.

Each component can be subdivided into its sub-components, reaching the desired degree of precision. For this purpose, the simulator employs two different types of entities called “nodes”:

• physical nodes: these nodes represent the self-standing components whose failure rate ${\lambda }_i$ is known.
• logical nodes: these nodes represent those components whose failure rate depends on that of the underlying sub-components. Logical node redundancy relations are set by a $k/n$ ratio, where $k$ indicates the number of sub-components that must be operative over the total number $n$ of sub-components.

For each ith node, a status variable $S_i$ indicates the component availability ($S_i$ = 1) or failure ($S_i$ = 0). To compute $S_i$, random number $x$ between 0 and 1 is extracted and compared with ${\lambda }_i$; if $x$ ≤ ${\lambda }_i$ the component is set as out of order. The system availability depends on the status of the “root”, a logical node lying at the top of the operational tree and representing the top event.

The solver simulation proceeds for time steps (clock time) of one hour. For each time step, the algorithm analyses all the nodes in the operational tree and calculates an equivalent time value for all nodes. Equivalent time takes into account the off-design operation by reducing or increasing the time accumulated by a component. The equivalent time of any component can be set as a function of its operational parameters (e.g., rotational speed, flow rate…).

In case of one component critical failure, its propagation determines the “top event”, and the system stops.

Input data required for the simulation include the system operational tree and parameters describing the components’ failure/maintenance characteristics.

In particular, for components the failure rate value ${\lambda }_i$ must be set, which can be:

• a constant value;
• a value function of either the clock time or the equivalent time;
• a function that depends on the status of other components whose malfunction may affect the failure rate of the component under examination (e.g., owing to vibrations);
• a mathematical formula indicating particular features of the component (e.g., good or bad installation) or the whole plant (e.g., favorable or unfavorable environment).

The solver consents to associate different failure modes to the components by the attribution of an occurrence probability value β to each selected failure mode.

2.3. Operational Tree for the HTGR-SMR Plant

In order to schematize the various event chains that drive the hydrogen production interruption (top event), the hydrogen production plant operational tree has been organized as follows:

• The supply processes fundamental for the system’s correct operation have been schematized by a set of logical nodes, described in detail in Section 2.3.1.
• Each of said processes (logical nodes) is composed of sub-assemblies such as heat exchangers, pumps, blowers, and valves; the latter constitute the physical nodes of the operational tree and are characterized by a failure rate value. These sub-assemblies are described in detail in Section 2.3.2.
• The global failure rate for each sub-assembly has been calculated based on the failure rates of their elementary components, such as pipes, flanges, motors, actuators, etc. The elementary components failure rates have been calculated according to the guidelines provided in [22] in Section 2.3.3.
• This arrangement for the operational tree ensures to obtain, as a result of simulations, the failure attitude of each assembly, highlighting the systems that require more attention; moreover, it allows to focus on those elementary components that represent critical units for the system operation, so that the appropriate prevention actions (e.g., components redundancy rather than components modification) can be decided in the design phase.

2.3.1. Plant Main Functions (Logical Nodes)

The fundamental processes that make it possible for the operation of the hydrogen production system to have been settled in the operational tree following the top-down approach that characterizes the FTA procedure; these complex systems have been schematized through logical nodes, characterized by a logical AND port and placed in sequence as described in the following points.

• Hydrogen production (HP): represents the upper-level logical node, i.e., the correct operation of the hydrogen production system. Following the sequence of these events, which, if verified, produce an interruption in hydrogen production, it can be stated that the functioning of this process is ensured by the availability of two processes, i.e., heated reactants supply (HRS in the following) and heat supply to process (HS in the following) and a physical component, i.e., the steam reformer.
• Heated reactants supply (HRS): represents the supply of reactants at the correct temperature to the steam reformer. Its functioning is ensured by the availability of the two reactant (steam and methane) supplies and the reactant pre-heaters.
• Heat supply to process (HS): represents the system ensuring the heat required by the steam reforming reaction and by the steam super-heating; such heat is made available by the secondary helium supply circuit, requiring the correct operation of the isolation valves on the supply (A) and return (R) lines and of the intermediate heat exchanger.
• Reactants supply to steam reformer (RSR): represents the supply of reactants; its functioning is ensured when both steam and methane supplies are available.
• Secondary helium supply (HE): represents the helium secondary circuit, ensuring the availability of the hot gas for heat supply. According to its assembly, this system’s availability is ensured by the correct operation of the physical components that constitute it, i.e., feedwater pre-heater, evaporator, super-heater, reactant pre-heaters, and helium circulation blower.
• Super-heated steam supply (SHS): represents the complex system dedicated to the supply of the super-heated steam. Its functioning is ensured by the availability of feedwater supply and steam generation.
• Feedwater supply (FS): provides the water for steam production and is composed of the feedwater storage tank and pump.
• Steam generation (SG): ensures the process of steam production by heat exchange with the helium; it is composed of three heat exchangers placed in series, i.e., feedwater pre-heater, evaporator, and super-heater.

2.3.2. Plant Sub-Assemblies (Physical Nodes)

As described above, the logical nodes indicating the system’s fundamental functions are subjected to the availability of their underlying physical components, i.e., the sub-assemblies grouped into four main categories: heat exchanger, blower, pump, and valve. The intermediate heat exchanger (IHX) is a particular type of heat exchanger and its composition differs from an ordinary heat exchanger. Finally, the steam reformer can be modeled similarly to a heat exchanger owing to the arrangement of its components.

The logical nodes that compose the operational tree are based on the failure rates of these sub-assemblies, which are classified as physical nodes and depicted by squares in Figure 6.

The failure rate of each physical node has been calculated according to its structural configuration by summing the failure rates of each elementary component multiplied by its numerosity. Mathematical expressions for sub-assembly failure rate calculations are presented and explained in the following points.

• Heat exchanger: Pre-heater, evaporator, super-heater, reactant pre-heaters, and steam reformer, whose architecture is comparable to that of an ordinary heat exchanger; all of these assemblies are composed of welded tubes, flanges for input and output streams connection, and a shell (pressure vessel); the failure rate for the heat exchanger assembly appears in Equation (6).

$${\lambda }_{Heat Exchanger}=n_{Flanges}·{\lambda }_{Flange}+{n_{Tubes}·\lambda }_{Tube}+{2·n}_{tubes}·{{\lambda }_{Weld}+\lambda }_{Shell}$$

(6)

The IHX is a heat exchanger with a particular architecture, having two bundles of helicoidal tubes for the secondary helium; primary helium reaches the two bundles in sequence by being circulated with a blower, whose failure rate needs to be considered in the computation, as indicated in Equation (7).

$${\lambda }_{IHX}=n_{flanges}·{\lambda }_{Flanges}+n_{tubes}·{\lambda }_{tubes}+{2·n}_{tubes}·{\lambda }_{Weld}+{\lambda }_{Shell}+{\lambda }_{Helium Blower}+{\lambda }_{Motor }$$

(7)

• Helium Blower assembly: composed of a helium blower and motor. This component appears in the main helium circulation loop and the internal circulation loop of the IHX.

$${\lambda }_{Helium Blower}={\lambda }_{Blower}+{\lambda }_{Motor }$$

(8)

• Water Pump assembly: composed of a water pump and motor.

$${\lambda }_{Pump Assembly}={\lambda }_{Pump}+{\lambda }_{Motor }$$

(9)

• Isolation valve (IV): composed of a valve and motor, both for the supply (A) and for the return (R) lines.

$${\lambda }_{Isolation Valve}={\lambda }_{Valve}+{\lambda }_{Motor}$$

(10)

2.3.3. Elementary Components

The elementary components, by which every above-described sub-assembly is constituted, are characterized by a failure rate value that needs to be evaluated according to the component operational conditions such as temperature, pressure, and viscosity of the treated fluid, maximum allowable leakage, component size, and material, stationary vs. transient conditions, etc. The components’ failure rates have been assessed according to [22] through correlations shaped as follows:

$${\lambda }_i={\lambda }_{i,b}·{\prod }_i{C}_i \left[{\displaystyle \frac{failures}{{10}^6 \mathrm{h}}}\right]$$

(11)

In which the component operational failure rate ${\lambda }_i$ is a function of the “base” failure rate value ${\lambda }_{i, b}$ (i.e., the average value assessed by experience) multiplied by correction factors $C_i$ taking into account the above-mentioned operational conditions typical of the specific application.

Elementary components’ failure rates are presented in the following, describing the expressions used for characterizing their failure rate expressed in failures per million hours of operation [f/10⁶ h].

• Tubes

  $${\lambda }_{Tube}={\lambda }_{Tube,b}·C_E$$

  (12)

  where:

  -

  ${\lambda }_{Tube,b}$ = 0.47 f/10⁶ h.

  -

  $C_E$ = 1.4: multiplying factor considering the stress applied to pipes, which is due to both high pressure and temperature
• Weldings

  $${\lambda }_{Weld}=1 \mathrm{f}/{10}^6 \mathrm{h}.$$

  (13)
• Flanges

  $${\lambda }_{Flange}={\lambda }_{Flange,b}·C_P·C_Q·C_{DL}·C_H·C_F·C_{\nu }·C_T$$

  (14)

  where

  -

  ${\lambda }_{Flange,b}$ = 2.4 f/10⁶ h

  -

  $C_P$ = 0.25: multiplying factor considering fluid pressure.

  -

  $C_Q$ = 5: multiplying factor considering allowable leakage; the value comes from the consideration that low fluid leakages are required for nuclear facilities.

  -

  $C_{DL}$= 39.3 (for helium); $C_{DL}$= 4.2 (for water/steam): multiplying factor considering flanges diameter.

  -

  $C_{\nu }$ = 1.4: multiplying factor considering fluid viscosity.

  -

  $C_T$ = 0.21: multiplying factor considering temperature variations in operation.

• Valves

  $${\lambda }_{Valve}={\lambda }_{Valve,b}·C_P·C_Q·C_{\nu }·C_B·C_{DS}·C_{\mu }$$

  (15)

  where:

  -

  ${\lambda }_{Valve,b}$ = 1.25 f/10⁶ h

  -

  $C_P$ = 0.1: multiplying factor considering operating pressure.

  -

  $C_Q$ = 5.0: multiplying factor considering allowable leakage.

  -

  $C_{\nu }$ = 1.4: multiplying factor considering fluid viscosity.

  -

  $C_B$ = 0.42: multiplying factor considering valve contact pressure, determined on the basis of the valve diameter and operating conditions.

  -

  $C_{DS}$ = 0.2: multiplying factor considering the size of the seat diameter of the valve.

  -

  $C_{\mu }$ = 0.8: multiplying factor considering the materials used.

• Pressure vessels (heat exchangers shell)

  $${\lambda }_{Shell}={\lambda }_{Shell,b}=0.01 \mathrm{f}/{10}^6 \mathrm{h}$$

  (16)
• Feedwater tank

At this level of the study, the tank has been considered to have a null failure rate.

• Blowers and pumps

  $${\lambda }_{Blower/Pump}=\left({\lambda }_{FD}·C_{SF}\right)+{\lambda }_{CA}+{\lambda }_{SE}+{\lambda }_{SH}+{\lambda }_{BE}$$

  (17)

  where

  -

  ${\lambda }_{FD}$ = 12.0 f/10⁶ h fluid driver (impeller) failure rate.

  -

  $C_{SF}=1.4 \mathrm{f}\mathrm{o}\mathrm{r} \mathrm{h}\mathrm{e}\mathrm{l}\mathrm{i}\mathrm{u}\mathrm{m} \mathrm{b}\mathrm{l}\mathrm{o}\mathrm{w}\mathrm{e}\mathrm{r}; C_{SF}=1.0 \mathrm{f}\mathrm{o}\mathrm{r} \mathrm{f}\mathrm{e}\mathrm{e}\mathrm{d}\mathrm{w}\mathrm{a}\mathrm{t}\mathrm{e}\mathrm{r} \mathrm{p}\mathrm{u}\mathrm{m}\mathrm{p}$: operating temperature multiplying factor.

  -

  ${\lambda }_{CA}$ = 0.010 f/10⁶ h: stator casing failure rate.

  -

  ${\lambda }_{SE}$ = 34.66 f/10⁶ h for helium blower; ${\lambda }_{SE}$ = 22.8 f/10⁶ h for water pump: sealing failure rate.

  -

  ${\lambda }_{SH}$ = 0.23 f/10⁶ h: shaft failure rate

  -

  ${\lambda }_{BE}$= 15 f/10⁶ h: bearing failure rate.

• Electric motors

  $${\lambda }_{Mot\mathrm{o}\mathrm{r}}=\left({\lambda }_{Motor,b}·C_{SF}\right)+{\lambda }_{WI}+{\lambda }_{BS}+{\lambda }_{ST}+{\lambda }_{AS}+{\lambda }_{BE}$$

  (18)

  where:

  -

  ${\lambda }_{Motor,b}$ = 10 f/10⁶ h basic motor failure rate.

  -

  $C_{SF}$ = 1 Motor load factor for load time variation; all motors have been considered operating at a steady state.

  -

  ${\lambda }_{WI}$ = 40 f/10⁶ h: the failure rate of motor internal circuits.

  -

  ${\lambda }_{ST}$ = 0.001 f/10⁶ h: stator casing failure rate.

  -

  ${\lambda }_{AS}$ = 22.8 f/10⁶ h: shaft failure rate.

  -

  ${\lambda }_{BE}$ = bearings failure rate; considered equal as for pumps and blowers.

Table 6. Failure rate of elementary components.

Failure Rate of Elementary Components	$\left[\frac{\mathit{f}\mathit{a}\mathit{i}\mathit{l}\mathit{u}\mathit{r}\mathit{e}\mathit{s}}{\mathit{m}\mathit{i}\mathit{l}\mathit{i}\mathit{o}\mathit{n} \mathit{h}\mathit{o}\mathit{u}\mathit{r}\mathit{s}}\right]$
Tube	34.66
Welding	1
Flange, helium	3.07
Flange, steam	0.06
Valve	0.06
Pressure vessel (Shell)	0.001
Water pump	50.4
Helium blower	66.70
Motor	76.00

summarizes the failure rates calculated through the previous expressions for each elementary component [22,23], whereas

Table 7. Failure rate of sub-assemblies (physical nodes).

Failure Rate of Sub-Assemblies	$\left[\frac{\mathit{f}\mathit{a}\mathit{i}\mathit{l}\mathit{u}\mathit{r}\mathit{e}\mathit{s}}{\mathit{m}\mathit{i}\mathit{l}\mathit{i}\mathit{o}\mathit{n} \mathit{h}\mathit{o}\mathit{u}\mathit{r}\mathit{s}}\right]$
IHX	544.5
Pre-heater	148.4
Evaporator	92.0
Super-heater	108.6
Reactant pre-heaters	108.6
Steam reformer	178.3
Isolation valve	76.0

indicates the failure rates for each sub-assembly calculated based on the elementary components that constitute its structure.

3. Results

In the present study, the failure rates of elementary components were considered to be constant with time. Only one failure mode for each elementary component (physical node) has been set. The equivalent time has been set as equal to the clock time, since the plant is expected to operate at design condition for most of its life.

The simulations have been carried out over a period of 175,200 h, corresponding to 20 years, which is the plant design operational lifespan. The analysis has focused solely on the hydrogen production plant, considering the thermal power source from the reactor to have a failure rate of zero.

To cope with the simulator’s probabilistic nature, five simulations have been made (in order to improve the statistical significance of the obtained results), and the final results regarding assemblies and elementary components’ failures have been averaged.

On the nuclear side, it is considered that potential malfunctions would not lead to reactor failure but only to SCRAM signals causing temporary operational interruptions. These would impact the chemical plant solely in terms of production without creating safety issues. If the reactor stops operating, its configuration allows it to dissipate residual heat safely. In case of reactor shutdown, a three-way valve between the two plants switches, interrupting the helium flow towards the plant’s chemical side and consequently stopping hydrogen production without causing further safety issues.

As already mentioned, the reported values represent an average of five simulations. Since these are stochastic simulations that take failure rates into account, choosing an average value provides a more reliable estimate of potential failures.

3.1. Simulations Results

3.1.1. Plant Availability

The graphs depicted in Figure 7 show the results of the five performed simulations; in these diagrams appear the number of hours for the operative plant (in green) and stopped plant (in red).

Each of the five simulations has been carried out with the same initial parameters, and the differences in results derive from the probabilistic nature of the Montecarlo simulator. The results exposed in the following paragraphs come from the averaging of these five launches.

The five results presented for the plant uptime and downtime have been averaged, obtaining a Mean Time Between Failures (MTBF) value of 304.4 h, corresponding to an average time interval between two failures of about 13 days.

3.1.2. Main Components (Sub-Assemblies) Failure Breakdown

This section is dedicated to the failure breakdown of the main components (i.e., IHX, reactant pre-heaters…) in order to individuate those assemblies representing a criticality for the plant functioning. The simulation’s output data make the number of failures for each main assembly available. These numbers have been averaged for the five simulations performed and are presented in

Table 8. Failure number for each plant component (physical nodes), averaged for five simulations.

Component	Averaged Failures Number
Steam Reformer	29.2
IHX	183.6
Feedwater Pre-heater	83.6
Evaporator	50.8
Super-heater	53.4
Reactant Pre-heaters	54.2
Isolation Valve_A	25.4
Isolation Valve_R	29
Feedwater Pump	27
Helium Circulation Blower	39.2
Total failures	575.4
Mean Time Between Failures	304.4 [h]

for each main component. Figure 8 shows the percentage of failures experimented by each main component with respect to the total plant failures, underlining the degree of criticality manifested by every assembly.

From Figure 8, the results clearly indicate that the most critical sub-assembly is the intermediate heat exchanger (IHX), whose failures are responsible for 32% of the total plant stops. With regards to the other assemblies, the failure breakdown shows that the malfunction percentage because of heat exchangers settles between 9% and 15%, while flow control and pumping components stay in the range of 5–7%. The steam reformer contributes to 5% of total failures.

3.1.3. Elementary Components Failure Breakdown

Table 9. Elementary components failure percentage breakdown for each main assembly.

Main Assembly	Elementary Component	Failure %
	Helium flanges	35.6
	Steam Flanges	2.7
	Tubes	27.4
	Weldings	34.2
	Shell	0.0
IHX	Flanges	43.9
	Tubes	12.5
	Weldings	17.2
	Shell	0.0
	Blower	12.6
	Blower Motor	13.7
Feedwater Pre-Heater	Helium Flanges	46.2
	Water Flanges	5.7
	Tubes	17.7
	Weldings	30.4
	Shell	0.0
Evaporator	Helium Flanges	73.2
	Steam Flanges	4.7
	Tubes	6.3
	Weldings	15.7
	Shell	0.0
Super-Heater	Helium Flanges	60.7
	Steam Flanges	5.2
	Tubes	12.4
	Weldings	21.7
	Shell	0.0
Reactant Pre-Heaters	Helium Flanges	70.1
	Reactants Flanges	1.8
	Tubes	10.3
	Weldings	17.3
	Shell	0.4
Isolation Valve-A	Valve assembly	0.0
	Valve motor	100.0
Isolation valve-R	Valve assembly	0.0
	Valve motor	100.0
Feedwater Pump	Pump assembly	43.7
	Electric motor	56.3
Secondary Helium Circulation Blower	Blower Assembly	48.0
	Blower electric motor	52.0

reports the breakdown of failures that occurred to each elementary component belonging to the various main assemblies. In the table, for each main component (e.g., steam reformer, reactant pre-heaters…), the percentage of failures caused by the various elementary components (e.g., tubes, flanges…) has been indicated. It is worth remarking that, for the most critical main assembly, e.g., the IHX, a significant part of the total ruptures (around 20%) comes from the helium internal circulation group; in particular, 12.6% of the IHX stops are due to the circulation blower failure, while 13.7% to the electric motor actioning the blower.

Figure 9 shows the distribution, in percentage, of the failures manifested by all the plant elementary components. As visible, most of the failures are caused by flanges in the helium circuit, electric motors, weldings, and tubes, with respectively 41%, 20%, 17%, and 11% of total failures.

4. Conclusions

This paper has presented the reliability analysis of a hydrogen production plant based on methane steam reforming and providing an HTTR as the thermal power source. The reliability analysis has employed the synergy of FMEA and FTA techniques, with the aid of a Montecarlo simulator, for monitoring the failures that occurred during the plant’s useful life.

Simulation results have evaluated an MTBF of about 13 days, which seems acceptable, keeping in mind that a large part of the failures is due to fluid losses through flanges, weldings and pipes, and another significant part is caused by the rupture of electric motors. In particular, simulations have highlighted a failure tendency of helium flanges, pipes and weldings in the IHX, implying losses of secondary fluid.

Basing the failures breakdown, the measures that can be implemented to reduce ruptures in the critical elementary components are suggested in the following:

• Modify the helium flanges in the IHX: such action would require a complete redesigning of the entire helium transport piping system, leading to disproportionate costs. The failure of the flanges result in helium gas leaks, which in themselves do not pose a problem, as helium is an inert gas with a low radioactive content due to tritium permeation (kept within permissible limits and thus not hazardous). The only issue related to helium leakage is the need for refilling, which leads to production downtime and cost.
• Provide redundancy for electric motors and machinery: The installation of two components in parallel would ensure, in case of one component failure, the immediate takeover by the other on standby. Redundancy would prevent failures, although requiring a significant financial investment.
• Since the IHX has shown to be the most critical single main assembly of the plant, development should focus on improving this component, by enhancing the materials used and increasing the quality controls on pipes and weldings. The IHX design associated with the HTTR includes an integrated recirculation blower with the function of transferring helium between two heat exchanging bundles. A possible modification might involve the installation of this recirculation loop outside the IHX shell, providing an insulated connection to prevent leaks; this would make it possible to provide redundancy for blowers and motors, which, as stated, are responsible for almost 20% of IHX failures.

As already mentioned, the SMR is a technology destined for limited future use. However, it can be hypothesized that, over the course of a few decades, it may be replaced by technology based on thermochemical cycles, which would still benefit from the development of the IHX (as it remains a mandatory component for this type of process). Also, on the basis of this consideration, potential future development of this work can be the extension of the FMEA analyses to different nuclear hydrogen production systems (e.g., I-S, etc.); as a further outcome, it will be possible to perform a comparison among different systems in order to classify them.