FMEA and Risks Assessment for Thermochemical Energy Storage Systems Based on Carbonates

Abstract

Thermochemical energy storage systems from carbonates, mainly those based on calcium carbonate, have been gaining momentum in the last few years. However, despite the considerable interest in the process, the Technology Readiness Level (TRL) is still low. Therefore, facing the progressive development of the technology at different scales is essential to carry out a comprehensive risk assessment and a Failure Mode Effect and Analysis (FMEA) process to guarantee the safety and operation of the technology systems. In this study, the methodology was applied to a first-of-its-kind prototype, and it is a valuable tool for assessing safe design and operation and potential scaling up. The present work describes the methodology for carrying out these analyses to construct a kW-scale prototype of an energy storage system based on calcium carbonate. The main potential risks occur during the testing and operation stages (>50% of identified risks), being derived mainly from potential overheating in the reactors, failures in the control of the solar shape at the receiver, and potential failures of the control system. Through the assessment of Risk Priority Numbers (RPNs), it was identified that the issues requiring more attention are related to hot fluid path to avoid loss of heat transfer and potential damages (personal and on the facilities), mainly due to their probability to occur (>8 on a scale of 10). The results derived from the FMEA analysis show the need for specific control measures in reactors, especially in the calciner, with high operation temperatures (1000 °C) and potential effects of overheating and corrosion.

1. Introduction

Large-scale energy storage has become one of the great challenges to achieving the ambitious goals set to increase the penetration of renewables significantly. Concentrating Solar Power (CSP) plants have a great potential for energy storage integration, which gives them great dispatchability compared to other renewable technologies, such as PV or wind energy [1]. The market for energy storage in solar thermal plants is clearly led by technology based on the exchange of sensible heat from molten salts [2]. However, molten salts present a series of drawbacks, such as corrosion [3], the need to keep them at temperatures higher than $~$220 °C to avoid their solidification (which involves an important energy consumption) [4], and the maximum temperature limitation to $~$550 °C to avoid salt degradation [5], which limits the power block efficiency.

As a promising alternative to molten-salts-based energy storage, Thermochemical Energy Storage (TCES) has been gaining momentum in the last few years [6]. Among them, carbonates-based systems are non-corrosive, non-toxic, and cheap (raw materials) [7], with a high energy density and allowing power production at temperatures higher than 800 °C, which boost the power cycle efficiency [8]. The most studied system is the one based on calcium carbonate in the so-called Calcium-Looping (CaL) process [9], which is also being developed as a potential CO₂ capture system in plants based on fossil fuels [10]. Many studies are being published, mainly investigating the performance of the reaction on a laboratory scale and by the simulation of different processes schemes to evaluate the efficiency of their integration in large-scale CSP plants. However, their Technology Readiness Level (TRL) continues to be low (TRL4, technology demonstrated on a laboratory scale).

The successful scaling of the process, first at kW scale in a relevant environment (TRL5) and later at a larger scale, is essential for developing this promising technology. However, due to the novelty of the process regarding the management of gas and solids at high temperature (even higher than 1000 °C), there is important challenges and risks. To reach a successful prototype development on a relevant scale, an exhaustive risk assessment that encompasses the different stages of the process is essential [11], as well as a Failure Mode Effect and Analysis (FMEA) that allows us to improve designs and identify potential failures and their probability of occurring, to reach a successful and safe operation. A correct evaluation of potential failures is essential for the development of mitigation measures that prevent problems if these failures occur [12]. These analyses are complementary to those linked to technical/scientific approaches, and they are fundamental for safe design, operation and scaling-up, when prototypes are under design, and operation. However, there is a reduced number of publications under this approach. In FMEA analysis, decisions on the present work are based on Risk Priority Numbers (RPN) [13]. In the last years, several FMEA papers have been published directly related to the energy sector, such as for sensible energy storage systems [14], Lithium-ion batteries management [15,16], hydrogen refueling station [17], liquefied natural gas sector [18], or municipal solid-waste management [19].

This work shows the methodology followed for these analyses in a real case: the construction of the first prototype at a relevant scale (TRL5) of an energy storage system, a CaL-based TCES in CSP plants, through the SOCRATCES project [20,21], in Seville. This is the first work related to risk assessment and FMEA related to promising thermochemical systems for energy storage. It aims to bridge the gap between the laboratory and prototype scales from a risk-analysis point of view, providing a valuable methodology for application in other prototypes. It is valuable information for engineers and scientists involved in prototypes development and scaling up within the energy sector.

2. A Real Case of Study: Developing a KW-Scale CSP–CaL Prototype

SOCRATCES project aims to develop novel thermochemical energy storage based on the the CaL process for its integration in CSP plants [22]. In SOCRATCES, a kW-scale prototype, the first of its type, is under design, construction, and testing. Moreover, several components have specifically been developed for advancing the knowledge of the processes and the requisites for technology for scaling up.

The CSP–CaL process consists of using the heat provided for a CSP receiver to carry out the endothermic decomposition of CaCO₃ (calcination) in CO₂ and CaO, which are stored separately. Calcination occurs in a solid–gas reactor (calciner), which typically has been proposed as a Fluidized Bed (FB) [23]. However, Entrained Flow (EF) reactors are gaining impetus in the last years due to their potential to operate with fine particles [24]. Once energy is demanded, the stored products are sent to another solid–gas reactor (carbonator), where energy is recovered by the reverse reaction (carbonation), which releases the energy previously stored to a power cycle by its exothermic nature. Figure 1 shows a conceptual scheme for the CSP–CaL integration.

Figure 1. CSP–Calcium Looping conceptual scheme. Adapted from Reference [8].

The equipment represented in Figure 1 is included in the SOCRATCES prototype. The calciner is an EF reactor in which a stream composed of CaCO₃ particles and CO₂ enters through a pneumatic conveying system. A 40 m² solar field provides the required energy to carry out the endothermic calcination. Another EF reactor is constructed for the carbonation reaction, which is coupled with a Stirling engine to produce electricity from the stored materials. The power output constrains the selection of the power block. At an industrial scale, more efficient power cycles would be considered at [25]. The reactors include several heaters to guarantee isothermal operation at a prototype scale and emulate different operating conditions. A schematic of the pilot plant configuration of the SOCRATCES project is shown in Figure 2.

Figure 2. SOCRATCES pilot plant scheme.

The SOCRATCES technological concept and reaction have been proven successful at the laboratory scale [26]. However, the scale-up of the processes at the prototype level and higher scales will show new challenges regarding materials behavior and components performance, including additional issues on the operation and efficiency effects. One of the SOCRATCES project objectives is to learn about the performance of solid materials at high temperatures in terms of their transport, storage, and cyclability. It involves a series of kW-prototype scale challenges that must be assessed based on a detailed risk assessment.

3. CSP–CaL Prototype Risk Assessment

The risk assessment aims to reduce the risks in prototype design, construction, and scaling up, identifying risks early on and planning how to manage them. According to ISO 31010, the risk is a combination of the consequences of an event (hazard) and the associated likelihood/probability of its occurrence. The following factors should be considered:

• Nature and types of risks assessed.
• Definition of likelihood (Table A1 in Appendix A).
• Definition of consequences of the risk. The consequences will be described quantitatively as a function of its impact on the project’s objectives (Table A2 in Appendix A).
• Definition of the risk level. It is the magnitude of risk or combination of risks, expressed in terms of probability and consequence combination. Depending on the level of the risk, it is classified as low, medium, moderate, high, very high, or extreme risk.

The risks identified within the CSP–CaL prototype construction were consolidated and grouped by the different parts of the project life cycle (Figure 3), with the full description of each of the project’s risks and their corresponding mitigation actions. The first group includes those general transversal risks identified as those that affect the entire project life cycle. The second group comprises those that affect specific parts and components. The third group includes all those linked to testing and operation, and finally, the fourth group includes those identified as affecting the scalability and pathway to commercialization.

Figure 3. Project lifecycle stages.

Risk Assessment Development

This section collects the main risks of the scaling-up process divided into categories according to Figure 3. The present work is mainly focused on prototype construction and testing, these being the categories in which we go into more detail along this section.

Firstly, the main risks affecting the construction of the prototype are assessed (Table 1). They appear as a potential gap between design and on-site installation work. Special attention requires equipment manufacturing (when they are not commercially available) and plant integration work: foundations, piping, instrumentation, mechanical supports, and others. An action plant with a clear definition of tasks and responsibilities, as well as a daily evaluation, is fundamental to the success of the construction.

Table 1. Definition of main risks affecting the construction of the prototype.

Risk ID	Description and Consequences	Source of Risk	Mitigation Action
R1	Delays in transferring information/ components/ modules between partners suppliers and EPC companies for prototype integration (includes material exchange)	Modules design and construction	Management board controls. Clear definition of responsibilities Consider alternative pathways to advance in construction activities until the reception of information to avoid accumulated delays Identification of alternative systems for temporal substitution of modules or components with delays/failures
R2	Non-adequate correspondence of plans and components	Modules design and construction	Clear definition in the action plan of the responsibility for information transmission.
R3	Differences in modules information availability and accuracy.	Results integration	Following of results and data quality
R4	Issues in modules construction, transport, or erection	Modules construction	Clear definition in the action plan of the responsibilities for task implementation and times
R5	Problems with prototypes location (legal constraints, delays in permits, etc.)	Prototype construction	Participation of specialized technicians for legal framework and documents
R6	Appear unexpected new results and technological challenges, critical component breakdown, unexpected low performance	Technology watch	Technologies evaluated at different levels of integration, in a sequential process, from laboratory to demonstrators, to identify separate effectsRedesign of alternatives
R7	The appearance of new requisites of technologies, new regulations or changes in costs or materials availability	Technology watch	Project’s technology watch must deliver information periodically to maintain a continuous flow of information
R8	Non-unexpected availability (or delays) for implementing in demonstrator location	Prototype construction	Flexibility for readapting modules. Periodical meetings to identify alternative solutions

Table 2 classified the items shown in Table 1 according to the risk level. Note that classification is made based on the combination of likelihood and consequence of each risk following (Appendix A section). Thus, very high risks are related to issues on modules construction, transport, or erection and issues with licenses or permits on-site, a situation that could lead to delays in the tests planned to validate the technology.

Table 2. Evaluation of main risks affecting the CSP–CaL prototype construction.

Risk Level	Prototype Construction		Consequence
			Insignificant	Minor	Moderate	Major	Severe
Low	Likehood	Rare
Medium		Unlikely			R3-R6-R7	R2
High		Possible				R1	R5-R8
Very high		Likely				R4
Extreme		Almost Certain

Following is described the most prominent risks in each part and system of the pilot plant and their evaluation associated with the plant’s operation and the testing campaign. This phase of the project is where the most significant risks were identified. Because of this, this stage of pilot plant testing and operation is also studied in the Product Failure Mode Analysis (FMEA) developed in the next section. Table 2 summarizes the main risks associated with this stage from a general perspective, whilst specific issues with each main system of the prototype are analysed under the FMEA assessment in Section 4.

Table 3 and Table 4 evaluates the risk level of each item affecting the testing and operation of the prototype. Higher risks are associated with loss of remote control and potential inadequate operation of systems because of issues in the signal tracing, which can cause materials failures and compromise the safe operation of the plant.

Table 3. Definition of main risks affecting the testing and operation of the pilot plant.

Risk ID	Description and Consequences	Source of Risk	Mitigation Action
R9	Delays in laboratory facilities startup. Non-availability for testing equipment	Planning	Laboratory facilities startup with adequate time before starting main activities.
R10	Inconsistent measures from different sources	Measurement equipment and protocols	Setting of templates and standards for data collecting and information presentation at the beginning of the tasks.
R11	Incorrect records keeping	Data management	Clear definition in the Action plan of the responsibilities for information keeping at each subsequent step.
R12	Low availability of demonstration cases/modules testing	Modules construction	Definition in the action plan of strategies for validation of modules.
R13	Excessive fatigue of materials of construction due to cyclic operation	Materials failure	The materials of construction must be chosen for their ability to withstand high temperature and still perform mechanically. Regular programmed materials inspection will be performed to avoid catastrophic failures. The reactors should be designed to be extracted and replaced (if needed) for mechanical and material analyses after operation time.
R14	Disfigurement of units due to differential thermal expansion at high temperatures (calciner and carbonator operation up to 1000 °C)	Magnitudes resizing with operation and heating	Lateral fixations should be included to allow displacements. System includes monitoring of displacement. Need for a control system actuation to avoid disfigurement or structural damages.
R15	High emissivity losses leading to unexpected results	Heat losses at solar receiver	The receiver’s cavity design should be selected based on its better ability to retain radiation than others (e.g., a bare tube). At prototype; Integration of measures to control surface absorptivity and beam down (low emissivity losses design). Absorptivity losses evaluated and included in calculations
R16	Errors in programming the control software cause malfunctions, e.g., an incomplete reaction in the carbonization process	Incomplete tested control software for the carbonator	Simulating the control software as far as possible; foreseen remote access to fix errors remotely.
R17	Bad data acquisition and observation	An incomplete programmed master control unit (MCU)	Remote access to the MCU to fix any errors quickly.
R18	Loss of remote control and loss of data acquisition	Control	Duplicate control system in the equipment for automatic stop procedure and position of components.
R19	Potential inadequate operation on systems	Control	Commissioning procedure for labeling. Periodic revision status.

Table 4. Evaluation of main risks affecting the CSP–CaL prototype operation.

Risk Level	Operation and Testing Likelihood		Consequence
			Insignificant	Minor	Moderate	Major	Severe
Low		Rare
Medium		Unlikely			R12	R16	R13-R14
High		Possible			R10-R11-R17	R9-R15	R18-R19
Very high		Likely
Extreme		Almost Certain

Finally, risks affecting the CSP–CaL prototype scalability and commercialization must be considered. They are related to (i) the appearance of unexpected performance in the testing stage, compromising the technology deployment; (ii) ownership’s conflict for novel technology developments; (iii) difficulties in commercializing products and services; and (iv) higher investment costs of the technologies than expected before the testing stage. None of these items should fall into the classification of very high or severe risks. However, they do expose the need to include mitigation actions such as: (i) evaluation of technologies at different levels of integration, in a sequential process, from laboratory to demonstrators, to identify separate effects related to the unexpected performance of the facility; (ii) design of the warning and control systems to detect abnormalities in the performance; (iii) redesign of alternatives as soon as problems appear; (iv) identification of suitable applications and synergies to boost the technology through the learning curve until a mature status; and (v) consider potential alternative markets if the commercialization stagnates.

4. Product and Process Failure-Mode Effect and Analysis (FMEA)

FMEA is an essential reliability analysis technique that evaluates designs and identifies potential failures and their probability of occurring. Generally, FMEA is a proactive method for evaluating a process to identify the need for and the effects of design changes [27]. It departs from the risk analysis and complements it with additional information for implementing monitoring actions and control actions to reduce potential failures in the system, components, and processes. Due to the nature of the analyses, FMEA is focused on this work in the CSP–CaL prototype operation and testing, as an engineering tool whose objective is to increase the technology reliability. CSP plants, in general, experience different issues resulting from failures of different impacts, reducing efficiency, and increasing downtime and maintenance costs. Besides, in developing novel prototypes, unexpected performances are probable due to the lack of previous experiences. Therefore, in order to minimize them and reduce the involved risks, it is critical to identify the critical failure modes in the facilities.

The FMEA aims to eliminate potential failures or reduce their impacts. The tool provides the structure for a cross-functional critique of a design or a process. This analysis is built around three elements: the effect, the cause, and the detection. The effect is the result of what potential failure can cause to the project; the cause will indicate the reasons why this problem has appeared; finally, detection is the selected way of controlling the process to avoid possible failures. For the analysis, the CSP–CaL integration is divided into subsections: solar side (receiver and heliostats field), materials storage, solid–gas reactors (calciner and carbonator), and power block.

4.1. Evaluation Method and Risk Criteria

The generic form of an FMEA is designed relatively simple and straightforward for worthy data acquisition and classification. Figure 4 presents a basic form that identifies all essential information to reduce or eliminate a root cause from either a design and/or a process. The rankings or criteria, as they are commonly known, are not globally standardised. There are no global criteria that everyone is using for all FMEAs and industries. The criteria must be based on logic, knowledge, and experience about the process at hand. In the present work, these criteria are based on the expertise of the authors in the study of the CaL process [26], as well as the experience in prototypes construction.

Figure 4. Typical FMEA pathway.

The evaluation includes the Severity (S), Probability (P), and Detection (D) of the risks [28]. Severity is a relative measure of the importance of the effect. When the severity changes depending on the point in time, we consider the worst-case scenario. Reducing the severity are necessary changes in the design, construction or operation and focus on reducing the standards, procedures, and instructions. Probability is the estimated number of failures, based on experience, that may occur for a given cause during the design life. Finally, the detection rate is a numerical rating of the probability that a given set of control measures or examinations will uncover a failure mode.

Risks inevitably exist in any system, design, or manufacturing process. The FMEA process aids in the identification of main risks then provides help to reduce its impact. It was carried out using Risk Priority Numbers or the RPN index. The RPN for each potential failure detected is calculated by multiplying the three scores, such as Severity (SEV), Probability (PRO), and Detectability (DET). These RPNs are considered for prioritising the risks with a potential failure mode [29]. Criteria for S, P and D are shown in Table A1, Table A2 and Table A3 (Appendix A section).

$$RPN=SEV\times PRO\times DET$$

(1)

The primary focus will be on the failures detected with a high number of RPN. For obtaining the RPN number of a potential failure mode, the three factors were introduced using an evaluation scale of 10 points (Table A1, Table A2 and Table A3). The higher the RPN of a failure mode, the greater the risk for the CSP–CaL prototype reliability. As design criteria, RPN values higher than 100 are considered critical and need to be evaluated carefully. Regarding the scores of RPNs, the failure mode assessed them and considering the results, and the proper actions were taken on the high-risk failure types.

4.2. FMEA Analysis for the CSP–CaL Prototype Operation and Testing

In this section, a detailed review of the potential issues derived from the operation of a prototype of a CSP–CaL plant at kW-scale is carried out. Potential failures are divided into (i) supplies and control system, (ii) solar side and power block, and (iii) reactors. Table 5 shows those potential failures related to supplies and control systems.

Table 5. Data collection and risk assessment of the FMEA analysis of the supplies and CO₂ compression system.

Item	System Devices, Component Failure Modes, and Potential Effects			SEV	PRO	DET	RPN
S1	Electrical supply	Supplies. Electrical circuit breaker triggering	Installation without power supply. Elements position fixed—regulation capacity loss.	4	4	2	32
S2	Compressed gas supply	Supplies. Compressed gas pressure loss	Installation without compressed gas supply. Pneumatic valves blocked. Effects on the reactors control system.	6	5	2	60
S3	Compressed gas supply	Supplies. Compressed gas regulator valve failure	Installation without compressed gas supply. Regulation capacity lost. Overpressure in the system.	6	5	2	60
CD1	CO2 compression and storage system	Communication loss with PLC	Loss of remote control. Loss of data acquisition.	3	3	2	18
CD2	CO2 compression and storage system	Pressure transmitter failure	Overpressure on the tank.	6	3	2	36
CD3	CO2 compression and storage system	Local electrical system failure	System out of operation. Loss of CO2 pressure and mass flow capacity reposition.	4	3	2	24
CD4	CO2 compression and storage system	Compressor forced ventilation system failure	Overheating of the compressor. Effect on compressor operation and consumption.	3	2	2	12
CD5	CO2 compression and storage system	Chiller failure	Overheating of CO2 supply to the tank.	3	2	2	12
CD6	CO2 compression and storage system	Filters clogged—cyclone and bag-paper filter	Reduction of CO2 mass flow. Compressor higher power consumption, load and noise.	2	4	3	24
CD7	CO2 compression and storage system	Regulation valves failure	CO2 compression and storage system. Insufficient pressure in the tank. Effect on calciner supply.	3	2	3	18

The FMEA analysis of the supplies and CO₂ compression system previous analysis is the resulting values are relatively low, and no significant values or actions to be taken are identified, additional to those already taken. Table 6 shows those potential failures related to solar side, control and power block systems. As in the supplies and compression systems, the FMEA analysis of the solar side, control system and power block results in favorable evaluations, and none of them results in a value above a level to be remarkable and additional actions to be taken.

Table 6. Data collection and risk assessment of the FMEA analysis of the solar side, control, and power block systems.

Item	System Devices, Component Failure Modes and Potential Effects			SEV	PRO	DET	RPN
C1	Master control unit (MCU)	Programming error or malfunction	Loss of observation the overall process	3	3	2	18
C2	Remote access to all control units	An outage of the Internet connection; Internal Network error	Loss of remote access to the overall process	3	4	2	24
C3	External connections	Internet access failure	Loss of remote control. Loss of data acquisition	6	5	3	90
C4	Equipment connections	Equipment communication failure	Loss of remote control. Loss of data acquisition	4	5	2	40
C5	Equipment signals	Analog signal failure (from PLC). Wire cut or similar	Loss of remote control. Loss of data acquisition	4	5	2	40
SO1	Solar field	Total Electrical power loss	Solar shape evolving over non protected areas	5	2	2	20
SO2	Solar field	CO2 mass flow loss	Wall temperature increase	5	2	2	20
SO3	Solar receiver	Communication loss	Concentrated solar flux drift. Solar shape evolving over non protected areas	3	3	2	18
SO4	Solar field	High Wind Speed	Damages on Heliostats	4	3	2	24
SO5	Solar field	Solar field. Heliostat Non-programmed movement in response to control actions	Solar shape evolving over non protected areas. Personnel risk if it happens during maintenance over the heliostats	4	3	2	24
SO6	Solar receiver	Solar receiver. Cavity receiver material ingress (solid, liquid, gaseous)	Effects on the heat transfer. Potential damages on surfaces	5	3	3	45
PB1	Power block	Cooling system failure	Failures on cooling system components: pump, fan, water spillage. Potential damage on engine	4	4	2	32
PB2	Power block	Vibrations	Noise, deterioration, transmission to other components	2	5	2	20
PB3	Power block	Electrical Power loss	Cooling system failure. Overheating	6	4	2	48
PB4	Power block	Load loss in the mechanical couple	Risk of over-speed and engine damage	6	3	2	36
PB5	Power block	Air valves	Engine performance affected	3	3	3	27
PB6	Power block	PLC	Loss of remote control. Loss of data acquisition	4	4	2	32

A comprehensive list of potential issues for the power block is difficult to compile unless a particular choice for a thermal-electrical conversion approach is detailed. The relevant failure modes for a Rankine cycle plant, for example, can be of an entirely different class in comparison to those anticipated to be encountered in a Brayton cycle or a Stirling cycle plant. However, literature pertaining to technology-specific treatment of risk analysis of this kind is quite rich, as documented by [30,31], for example. For a Stirling cycle power plant, which was the case in the investigation for the pilot-scale plant built by the SOCRATCES consortium, perhaps the principal potential failure to be feared is the overheating and the consequent over-speeding of the engine, possibly propagating the problem to the electrical side or encountering mechanical issues. In Table 6, only a glimpse of a handful of issues generally considered relevant to power plants is listed.

Table 7 shows those potential failures associated with both reactors, namely calciner and carbonator.

Table 7. Data collection and risk assessment of the FMEA analysis of the reactors (calciner and carbonator). Clc, calciner; Crb, carbonator.

Item	System Devices and Component Failure Modes			SEV	PRO	DET	RPN
RE1	Clc Cbr	Instrumentation signal failure (as in thermocouples, mass flow meters, and other equipment)	Loss of control and identification of failures	4	3	2	24
RE2	Clc Crb	PLC communication lost	Loss of remote control. Loss of data acquisition	3	5	2	30
RE3	Clc Crb	Screw feeder failure	Speed regulator performance fails because control or blocking	4	3	2	24
RE4	Clc	CO2 preheater failure	Cold CO2 in the calciner. Calcination process frozen.	2	3	2	12
RE5	Clc	Pneumatic conveying system clogging	Pipes blocked. Non enough material arriving at the calciner	3	6	2	36
RE6	Clc	Material wall deposition; clogging	Heat transfer penalized. Reaction penalized/stopped	3	6	2	36
RE7	Clc Crb	CO2 mass flow controller failure	Loss of control and identification of operation situation	3	4	2	24
RE8	Clc Crb	Vibrations in components; natural modes in the start-up or load changes	Noise, deterioration, transmission to other components	2	5	2	20
RE9	Clc Crb	Wiring failure	Loss of signal. Loss of control.	5	3	2	30
RE10	Clc	Nitrogen filter clogging	CO2 inertization at calciner exit affected	4	5	2	40
RE11	Clc	Swappable vessel; overload control; solids level above the threshold	Hot material is accumulated inside the reactor. Potential agglomeration and damages on the valve	5	3	2	30
RE12	Clc	Swappable vessel; shutter valve blocked	The bottom vessel cannot be isolated for movement	4	2	2	16
RE13	Clc Crb	Counterweigh failure; unbalance	Movement of structure	7	2	1	14
RE14	Clc Crb	Lighting strike	Damages on the equipment and personnel	8	5	1	40
RE15	Clc	Material spillage	Pipes break, inadequate manipulation, failure in the control system. Cold material implies loss and dirt. Hot material is a risk for personnel	8	2	2	32
RE16	Clc	Electrical power loss	Exothermic reaction control. Temperatures increase in some spots	2	3	2	12
RE17	Clc Crb	Sensor mount-seal: compression set	Leak	8	7	1	56
RE18	Clc	Sensor mount-seal: loosen during sensor assembly/service	Leak. Fall inside tank	8	2	1	16
RE19	Clc Crb	Sensor mount-seal: damaged internal thread	Cannot install sensor	5	2	1	10
RE20	Clc Crb	Sensor mount-seal: damaged external thread	Cannot install wire nut	4	3	1	12
RE21	Clc	Hold-fluid flow-path heat-transfer structure: stress crack	Cooling does not work. Sudden refrigerant loss.	8	8	2	128
RE22	Clc	Hold-fluid flow-path heat-transfer structure: stress crack	Leak. Loss of heat transfer.	8	5	2	80
RE23	Clc	Hold-fluid flow-path heat-transfer structure: corrosion	Leak. Loss of heat transfer.	8	7	5	280
RE24	Clc	Hold-fluid, flow-path heat-transfer structure: puncture	Leak. Loss of heat transfer.	8	10	1	80
RE25	Clc	Hold-fluid flow-path heat-transfer structure: burst fail	Leak. Loss of heat transfer.	8	2	5	80
RE26	Clc	Hold-fluid flow-path heat-transfer structure: plugged	Loss of heat transfer. Leakage due to increasing flow velocity	8	7	1	56
RE27	Clc	Hold-fluid flow-path heat-transfer structure: ballooning	Leak. Loss of heat transfer.	5	9	8	360
RE28	Clc Crb	Instrument air pressure loss, i.e., pneumatic control valve	Valve is in a fixed position without the capacity for control	4	2	2	16
RE29	Clc	Bottom vessel, overload control, solids level	Hot material is accumulated inside the carbonator. Potential agglomeration and damages on the valves.	4	5	2	40
RE30	Crb	Shutter valve blocked.	the bottom vessel cannot be isolated for movement	4	5	2	40
RE31	Crb	Uncontrolled exothermic reactions	Overheating	7	2	2	28
RE32	Crb	Inadequate labeling and signals of the components and their status	Potential inadequate operation on elements	4	2	3	24
RE33	Crb	Filter on top of the vessel—clogging	Overpressure	3	2	3	18
RE34	Crb	Filters on aeration lines—clogging	No air inserted on specific points. There is a wrong indication on pressure instruments	3	3	3	27
RE35	Crb	Clamp joints: gasket—damaged sealing gasket	Gas leakage	2	8	3	48
RE36	Crb	Screw feeder: inlet/outlet connections—bad seal	Gas leakage	2	2	4	16
RE37	Crb	Screw feeder: mechanism—stop rotating, clogging	feeder power shut down	5	5	2	50
RE38	Crb	Furnaces: ceramics—break	resistance short-circuit, resistance burn	8	4	2	64
RE39	Crb	Furnaces: control—control failure	resistance burn	8	1	1	8
RE40	Crb	Reactor: coil-cracking	Gas Leakage	8	3	3	72

Since the calciner and carbonation units are the core reactors of the overall plant, most of the risks faced are similar. Therefore, the most important risks based on severity scores concern the construction parts and the design of both units. In order to reduce the overall failure risk, the use of specific materials is used, and monitoring methods are implemented.

4.3. Contingency Measurements

The previous analyses are summarized in Figure 5. It provides a graphical overview of the complete analysis and allows the risks to be grouped into four main groups linked to different required actuation levels.

Figure 5. FMEA Assessment Map. Note that the x-axis represents the product of severe (SEV) and probability (PRO), while the y-axis represents the uncertainty (DET) produced by lack of failure detection.

Based on the assessment carried out on each risk, they were placed in one of the risk-map quadrants. Where they are placed will determine whether a risk control action will be taken on the identified risk, whether risk monitoring will be applied, whether a particular precaution will be taken or whether no action will be taken at all.

Risks that fall into the “Warning” quadrant have high levels of severity or probability of failure but were classified as having a high probability of being detected and are therefore considered hazardous. Actions are provided to minimize the severity and/or probability of failure. The risks detected in this part of the analysis are linked to the coolant filling hose, the compression system and the heat-transfer structure. In the measures applied to the hose, it is proposed as action a daily review, before starting the tests, by visual inspection, of the hose condition, which increases the probability of detecting bad connections or cracks. As for the compression system, the severity of failure is reduced by the availability of sealing rings. Finally, in the heat-transfer structure, daily checks of the heat-transfer structure condition are introduced before starting the tests, reducing the probability of failure by early detection of deterioration of the structure.

The risks that fall into the “Control and Supervision” quadrant do not have very high severity levels or failure probability. However, they were classified with a high probability level, so it is necessary to control them and periodically supervise that they are under control of not being detected. Therefore, in the risks framed within “Control and Supervision”, periodic reviews of the equipment condition are established to increase failure detection probability.

Risks that fall into the “Action Control” quadrant have both high levels of severity or probability of failure and a high level of probability of not being detected, so it is necessary both to minimize the severity and/or probability of failure and to control them and periodically monitor that they are under control. By means of the daily check of the condition of the heat-transfer structure, introduced earlier, before starting the tests, the probability of failure is reduced by early detection of deterioration of the structure. In addition, if more than five tests are performed on the same day, the structure must be rechecked, increasing the probability of detection.

5. Discussion

The results from risk assessment and FMEA are fundamental for a successful and safe prototype design, construction and testing, identified as the riskiest stages in the development of the thermochemical systems from the lab (TRL4) to the relevant environment (TRL5).

The risks affecting the design and construction of the prototype can be extrapolated to other projects related to the energy sector: energy storage, thermal systems, thermal reactors and chemical reaction control. Thus, a risk assessment was carried out for the entire life cycle of the project, from the theoretical development phase through prototype construction and experimental testing to the scale-up and commercialization phase.

The risk assessment shows how special attention and effort should be given to the construction of the individual modules during the construction phase so that problems and/or construction delays do not occur, clear control and understanding of the legal framework must be available within the project or use external support. In order to avoid delays in the implementation, flexibility in the assembly and integration of the modules should be identified and foreseen.

During the operation and testing phase, the risk assessment identifies as relevant a redundant control system to avoid loss of remote control and data acquisition or malfunctioning of the systems. The duplication of the control system in the equipment for the automatic shutdown procedure and the positioning of the components or a start-up procedure could help in this respect. Finally, it should be noted that the risks affecting the theoretical development or the scalability and commercialization of the CSP–CaL prototype do not fall into the classification of very high or severe risks, according to the risk assessment carried out.

As for the FMEA analysis, it focuses only on the operation and testing phase of the pilot plant. In the “Warning” quadrant, risks were placed with high levels of severity or probability of failure, but they have a high probability of being detected, so actions are foreseen to minimize the severity and/or probability of failure. The risks that fall into the “Control and Supervision” quadrant do not have very high levels of severity or probability of failure, but they were classified as having a low probability of being detected, and therefore periodic reviews of the condition of the equipment are established to increase the probability of detecting failures. The risks that fall into the “Action Control” quadrant have both high levels of severity or probability of failure and a high level of probability of not being detected, so it is necessary both to minimize the severity and/or probability of failure and to control them and periodically supervise that they are under control.

All failure modes detected in the analysis that require severity reduction measures or control and monitoring pertain to the reactors: calciner and carbonator. They correspond to failures in the seals or in the heat-transfer structure. In the heat-transfer structure, very different failure modes are assessed, such as a stress crack due to cooling losses, leakage due to corrosion, perforation or breakage, and plugging. Once severity or probability of failure mitigation and/or control and monitoring measures are applied, all detected failures fall within the “no action required” zone. In addition to being fundamental to avoid accidents in the plant, applying these measures would be key to increase the useful life of the different equipment in the plant.

This methodology of risk assessment and failure mode analysis described and applied in this work is of great interest and can provide clear benefits in the process of prototypes design and construction, especially for low TRL prototypes, and also contributes to scaling up. Specifically, it is identified that it can be directly extrapolated to thermal energy systems prototypes, including energy storage systems. The SOCRATCES research project, on which this work is based, develops the first prototype of new technology, a thermochemical energy storage plant based on Calcium-Looping on this scale (TRL 5). The methodology applied to its novel components and integration, which are the first of their kinds, is of high interest for successful development and scaling up of low TRL prototypes and their scaling up.

6. Conclusions

This paper shows the methodology followed for a comprehensive risk assessment and Failure Mode and Effects Analysis (FMEA) in a real case: the construction of the first full-scale prototype (TRL5) to assess CaL-based TCES in solar thermal plants, through the SOCRATCES project, in Seville, with a planned completion date of 2021.

The risk assessment aims to maximize the chances of successful prototype design and construction by identifying risks from the outset and planning how to manage, reduce, and/or control them. The risks identified in the construction of the CSP–CaL prototype were consolidated and grouped by the different parts of the project life cycle.

Focusing on the construction of the prototype, the highest risks are related to problems in the construction, transport, or assembly of the modules and to licensing or permitting issues on site, which could lead to delays in the planned tests to validate the technology. For pilot plant testing, the highest risks are associated with loss of remote control and possible malfunctioning of the systems due to signal routing problems, which can lead to material failures and compromise the safe operation of the plant.

FMEA is an essential reliability analysis technique that evaluates designs and identifies potential failures and their probability of occurrence. The FMEA assessment aims to eliminate potential failures or reduce their impact. The tool provides the structure for a cross-functional critique of a design or process. This analysis is built around three elements: effect, cause, and detection. These three elements allow risks to be classified into four quadrants.

These analyses show that the main potential risks for the case analyzed in this work occur during the test and operation stages, deriving mainly from potential overheating in the reactors, from failures in the control of the solar part in the receiver, and from potential failures in the control system. The results warn of the need to increase control measures in the reactors, especially in the case of the calciner, given the high temperatures (1000 °C) that can be reached, with potential overheating and corrosion effects. The methodology shown is of high value for the design and construction of novel experimental prototypes, with high uncertainties. It entirely complements and supports the technical design approaches. The methodology here presented and applied can be directly extrapolated to the analysis of other thermal systems.