# Failure Mode and Effect Analysis for a Programmable Logic Controller-Based Control Unit for a Miniature Neutron Source Reactor Pneumatic Transfer System

Authors: H. K. Obeng; E. O. Amponsah-Abu; B. J. B. Nayrko; R. Edziah; P. D. Gasu; A.G. Ampong
Journal: Journal of Electrical and Computer Engineering
 (2021)

---

## Abstract

The Pneumatic Transfer System (PTS) is an auxiliary system of Ghana Research Reactor-1 (GHARR-1) used to transfer the sample capsule in and out of the reactor irradiation sites. The PTS′ controller unit design and construction was carried out because the original transfer system was not designed to operate in Cyclic Neutron Activation Analysis (CNAA). To address these situations, a Programmable Logic Controller (PLC) has been used to design and construct a control unit to facilitate a CNAA application for GHARR-1. The design has been simulated successfully using LOGO! Soft Comfort software, version 8. A Failure Mode and Effect Analysis (FMEA) was conducted on the PTS Control Unit (PTSCU) to evaluate and document, by item failure mode analysis, the potential impact of each functional or hardware failure of the control unit, personnel and system safety, system performance, maintainability, and maintenance requirements. Each potential failure is ranked by the severity of its effect so that appropriate corrective actions can be taken to eliminate or control the high-risk items. The result obtained upon the analysis shows that the likelihood of occurrence of failures, detection, and severity on the control unit is low per the risk priority number. The paper outlines the severity classification and description used in FMEA, the likelihood of detecting various failures of components, and failure causes and effect.


---

## Body

## 1. Introduction

Ghana Research Reactor-1 (GHARR-1) is a Miniature Neutron Source Reactor (MNSR) used mainly for Neutron Activation Analysis (NAA), education, and training [1, 2]. The Pneumatic Transfer System (PTS) is an experimental facility of the reactor. It is meant for the transfer of sample capsules into the reactor for irradiation [3]. The new control unit is designed to replace the existing one to facilitate cyclic mode neutron activation analysis which the existing design did not consider. Another reason is that the components for the previous design could not be found on the local market, making it difficult to maintain the facility. The newly designed control unit uses a computer-based Programmable Logic Controller (PLC) with a LOGO! Soft Comfort version 8 software to program the PLC using the Function Block Diagram (FBD) programmable language or method [4]. A Failure Mode and Effect Analysis (FMEA) study is conducted on the PTS control unit to primarily identify known and potential failure modes, causes, and effects of each failure mode and prioritize the identified failure modes according to the Risk Priority Number (RPN). FMEA is a reliability and risk analysis procedure by which each potential failure mode in a system is analyzed to determine the results or effects, thereof, on the system and to classify each potential failure mode according to its level of severity. Each potential failure is categorized by the severity of its effect, in order that applicable corrective actions may be taken to eliminate or control the high-risk items. A qualitative overview of accident sequences could be derived from the FMEA tables looking at consequences’ descriptions and preventive and corrective actions. Furthermore, the analysis generates a rich store of record data that satisfy the requirement to prove compliance to standard criteria and as a store of information for future reference by designers, engineers, and quality assurance analysts. The design program could be simulated for its functionality before integration and implementation. FMEA provides valuable descriptive information about the system design and operation, by identifying in a concise manner the failure modes and compensation actions, as well as recommended actions, to mitigate against these failures. Severity considers the worst potential consequence of a failure, determined by the degree of injury, property damage, or system damage that could ultimately occur. The frequency of occurrence, severity, and detection of failure of a component is determined to ensure that any failure of a component will not damage the controller or affect the personnel or the PTS. Compensated actions are provided for any problem and corrective action to reliability and maintainability [4].The analysis is used to assess high-risk components and provide corrective actions. The FMEA also defines special test considerations, quality inspection points, preventive maintenance actions, operational constraints, useful life, and other pertinent information and activities necessary to minimize failure risk [5]. Nuclear facility system designers must design SSCs to standards. To determine if a SSC’s design complies with government and regulatory criteria, a manufacturer can analytically test a designed system [6]. One of such analytical tools is the FMEA. Compliance with these criteria provides reasonable assurance that nuclear facilities can be operated without undue risk to the health and safety of the public [7]. Nuclear-related thermal-hydraulic passive systems, protective systems, and computer-based safety digital instrumentation and control systems have been extensively analyzed with FMEA [8]. The International Atomic Energy Agency (IAEA) recommends that FMEA be performed for common cause failure (CCF) in SSCs [9]. It requires that a single failure not render the reactor system incapable of performing its required function which can increase the nuclear facility unavailability period. The purpose of this paper is to use the FMEA methodology to provide the reliability of the PTS Control Unit (PTSCU) designed to ensure system quality assurance and feedback to the designed activities.


## 2. Methodology

In this study, an FMEA based on the conceptual design of the PTS Control Unit (PTSCU) is presented. The methodology used consists firstly the definition of a functional block diagram for the Control Unit (CU) device as well as a conceptual full-scale diagram for implementation. These diagrams show the main systems and subsystems associated with the implementation of the PTSCU. An FMEA has been developed for the major components of the CU in order to identify the most critical components of the system as well as to identify the various failure modes that might affect the effective operation of the CU based on procedures outlined in [4, 5]. FMEA provides valuable descriptive information about the system design and operation, by identifying in a concise manner the failure modes and compensation actions, as well as recommend actions, to mitigate against these failures.The failure effect of a component on the CU operation and other systems were the main consideration for the analysis performed. In classifying the severity of system failure modes, a numerical code is used which ranks from 1 to 10. A higher number indicates the criticality of the component that must be evaluated for each component failure mode. This index is classified into the following main severity levels: none (1), low (2 and 3), medium (4 and 5), high (6 and 7), critical (8 and 9), and catastrophic (10). A description of these indices and their effects is presented in Table1 [5].Table 1
Severity classification and description used in FMEA.
EffectSystem functionalityRatingCatastrophicTotally incapacitates the system and fails to satisfy the design intent10CriticalSignificantly reduces the effectiveness of the system such that it would have little or no benefit and fails to satisfy the design intent98HighSignificantly reduces the effectiveness of the system such that it would fail to satisfy the design intent. However, the system would still operate and significant benefit would be gained from its operation76MediumReduces the level of redundancy that is built into the system. The effectiveness of the system would not be significantly reduced, and the design intent would still be satisfied54LowReduces the effectiveness of the system such that it is outside normal operating limits. However, the design intent would still be satisfied32NoneNo effect1The likelihood of occurrence of various failure modes is presented and described in Table2. The information presented on the likelihood of occurrence in the FMEA is mainly based on experience gained from the various components associated with the CU and manufacturer’s recommendations.Table 2
Likelihood of occurrence.
Likelihood of occurrenceDefinition guidanceCriteria: possible failure rate (%)RatingCertainAbsolute certainty10010HighVery likely to occur65–9998MediumLikely/possible35–6576LowUnlikely to occur5–3554RemoteVery unlikely to occur1–532NoneWill not occur01In Table3, the likelihood of detecting various failures is presented. This information presented in this section of the FMEA was also based on the experience in using such components in the CU device and manufacturer’s information.Table 3
Likelihood of detection of failures.
Likelihood of detectionCriteria: likelihood of detectionRatingUncertainUncertain that failure will be detected10LowLow chance that failure will be detected98ModerateModerate chance that failure will be detected76HighHigh chance that failure will be detected54Very highVery high chance that failure will be detected32CertainCertain that failure will be detected1


### 2.1. Conceptual Full-Scale Device Summary

Figure1 shows the block diagram of the conceptual full-scale integration of the CU in the existing PTS. The orange color is the controller unit which consists of electrical and electronic components. The green color is the fluid flow side (the pressurized air). The gray color is where neutrons collide with nuclei causing one of the following reactions: inelastic scattering, elastic scattering, radiative capture, or fission. The blue color represents the gamma spectrometry system for analysis.Figure 1
A complete functional block diagram of the PTS.The controller unit in Figure2 consists of three main components: a high-current dual regulated voltage power supply, PLC device, and 8-way relay bank. The power supply designed and constructed have a dual voltage of +24 VDC and +12 VDC and could be regulated from their internal reference voltage minimum of 1.25 to a safe maximum voltage of 30 VDC at a safe operating current of 5 Amps.Figure 2
Block diagram of the controller unit.Figure3 shows the flow chart for cyclic mode analysis with the conventional mode option with the CU incorporated. The phototransistors (PT1 and PT2) on top of the reactor and the detector serve as sensors. They detect the presence of a sample and switch from logic low level to high level, giving out a positive pulse signal to the PLC to act. The block diagram number representation is as follows: 1- dual regulated power supply, 2- PLC, 3- 8-way relay bank, 4- solenoid valves, 5- air-compressor, 6- reactor, 7- HPGe detector, and 8- analytical unit. PT = phototransistor. CC = compressor control. Figure 2 shows the designed CU to replace the existing control unit.Figure 3
Flow chart for cyclic mode analysis with the conventional mode option.Figures1 and 2 show the block diagram of a conceptual full-scale integration of the CU with the existing PTS. Figure 4 describes the legend of Figures 1 to 3. The description of various blocks and their functions, as well as likely effects of the CU on other systems, can be found in related documents [10].Figure 4
Legend of Figures1–3.The inputs used in completing the analysis include mainly data of various components from the designed CU document [10]. Definitions important for understanding various items in Table 4 are presented in Appendix A.Table 4
Failure mode and effect analysis for the PTS control unit.
(1) Item no.(2) Component(3) Function(4) Failure mode(5) Failure causeFailure effects(8) System failure mode detection(9) Compensating actionRisk analysis(6) Local(7) System(10) SEV(11) OCC(12) DET(13) RPN(14) Recommended action1AC voltage meterMeasures AC voltageNo readingDamageHummingLoss of supply voltage monitoringHummingFuses (main fuse and F1) to prevent circuit overloads32212Replace voltmeter2Solenoid valvesOpen and close to control the passage of compressed airi. Fail to openi. Voltage failurei. OverheatingSample capsules cannot be transferred into the reactor and backValves not open or close to transfer sample capsulesFuses (main fuse, F1, and F2) to prevent circuit overloads52440Replace solenoid valveii. Fails to closeii. Coils short or burntii. Hummingiii. Control Spring failure3PhototransistorsThey switch +24 DCV when detecting dark at their base glass surface to control the solenoid valvesi. Permanently ON or OFFi. High radiation of samplesFail to switch (not responding)Solenoid valves’ opening and closing cannot be controlledi. Sample capsule into the reactor and back to the detector not being controlledFuses (main fuse and F1) to prevent circuit overloads53345Replace phototransistorii. Fail to controlii. Malfunction of LED4Light Emitting Diodes (LEDs)A semiconductor device that emits visible light to operate the phototransistori. Burnti. Dropper resistor failureFail to turn ONi. The phototransistor cannot functionIntermittent operation of solenoid valves and phototransistorsFuses (main fuse, F1, and F2) to prevent circuit overloads53345Replace LEDii. Illumination intensity reducedii. Supply voltage reducedii. Light flickeringii. Solenoid valves cannot be controlled5SwitchesIsolate and deisolate load(s) from the power supplyi. Fail to openi. Contact dirty/corrodedi. Overheatingi. Intermittent operation of loadsi. Loads not operatingNone62224i. Replace switchesii. Fail to closeii. Release spring failureii. Arcingii. Intermittent measurementsii. Abnormal measurementsii. Can also use electrical circuit breakersiii. Visual smoke or arcing6FusesPrevent overcurrenti. Blow prematurelyi. Overcurrenti. Blown fusei. System shutdowni. Visual smokeFuses (F1 and F2) to prevent circuit overloads63118Remove the overload and replace fuse with spare. Consider the fuse ratingii. Fail to blow upon overcurrentii. Improper fuse selectionii. Arcing across fuse electrodesii. System malfunctionii. Loads not operatingiii. Fuse burned into placeiii. System power overloadiii. Indication and warning lights OFF7Relays (coils and contactsClose relay contacts when energized. The contacts engage and disengage the solenoid valves to the circuiti. Coil short circuit or burnt. ii. Fail to close (engage)i. Contact dirty/corrodedOverheatingi. Circuit overheatingi. Voltage measurements not as expectedFuses (F1 and F2) to prevent circuit overloads [6]53345Replace relay and any blown fuse(s), wire(s), or connector(s)iii. Open (disengage)ii. Release spring failureii. Blown fuseii. Visual smokeiii. Loss of power supply to operate the solenoid valvesiii. Loads (solenoid valves) not operating


## 2.1. Conceptual Full-Scale Device Summary

Figure1 shows the block diagram of the conceptual full-scale integration of the CU in the existing PTS. The orange color is the controller unit which consists of electrical and electronic components. The green color is the fluid flow side (the pressurized air). The gray color is where neutrons collide with nuclei causing one of the following reactions: inelastic scattering, elastic scattering, radiative capture, or fission. The blue color represents the gamma spectrometry system for analysis.Figure 1
A complete functional block diagram of the PTS.The controller unit in Figure2 consists of three main components: a high-current dual regulated voltage power supply, PLC device, and 8-way relay bank. The power supply designed and constructed have a dual voltage of +24 VDC and +12 VDC and could be regulated from their internal reference voltage minimum of 1.25 to a safe maximum voltage of 30 VDC at a safe operating current of 5 Amps.Figure 2
Block diagram of the controller unit.Figure3 shows the flow chart for cyclic mode analysis with the conventional mode option with the CU incorporated. The phototransistors (PT1 and PT2) on top of the reactor and the detector serve as sensors. They detect the presence of a sample and switch from logic low level to high level, giving out a positive pulse signal to the PLC to act. The block diagram number representation is as follows: 1- dual regulated power supply, 2- PLC, 3- 8-way relay bank, 4- solenoid valves, 5- air-compressor, 6- reactor, 7- HPGe detector, and 8- analytical unit. PT = phototransistor. CC = compressor control. Figure 2 shows the designed CU to replace the existing control unit.Figure 3
Flow chart for cyclic mode analysis with the conventional mode option.Figures1 and 2 show the block diagram of a conceptual full-scale integration of the CU with the existing PTS. Figure 4 describes the legend of Figures 1 to 3. The description of various blocks and their functions, as well as likely effects of the CU on other systems, can be found in related documents [10].Figure 4
Legend of Figures1–3.The inputs used in completing the analysis include mainly data of various components from the designed CU document [10]. Definitions important for understanding various items in Table 4 are presented in Appendix A.Table 4
Failure mode and effect analysis for the PTS control unit.
(1) Item no.(2) Component(3) Function(4) Failure mode(5) Failure causeFailure effects(8) System failure mode detection(9) Compensating actionRisk analysis(6) Local(7) System(10) SEV(11) OCC(12) DET(13) RPN(14) Recommended action1AC voltage meterMeasures AC voltageNo readingDamageHummingLoss of supply voltage monitoringHummingFuses (main fuse and F1) to prevent circuit overloads32212Replace voltmeter2Solenoid valvesOpen and close to control the passage of compressed airi. Fail to openi. Voltage failurei. OverheatingSample capsules cannot be transferred into the reactor and backValves not open or close to transfer sample capsulesFuses (main fuse, F1, and F2) to prevent circuit overloads52440Replace solenoid valveii. Fails to closeii. Coils short or burntii. Hummingiii. Control Spring failure3PhototransistorsThey switch +24 DCV when detecting dark at their base glass surface to control the solenoid valvesi. Permanently ON or OFFi. High radiation of samplesFail to switch (not responding)Solenoid valves’ opening and closing cannot be controlledi. Sample capsule into the reactor and back to the detector not being controlledFuses (main fuse and F1) to prevent circuit overloads53345Replace phototransistorii. Fail to controlii. Malfunction of LED4Light Emitting Diodes (LEDs)A semiconductor device that emits visible light to operate the phototransistori. Burnti. Dropper resistor failureFail to turn ONi. The phototransistor cannot functionIntermittent operation of solenoid valves and phototransistorsFuses (main fuse, F1, and F2) to prevent circuit overloads53345Replace LEDii. Illumination intensity reducedii. Supply voltage reducedii. Light flickeringii. Solenoid valves cannot be controlled5SwitchesIsolate and deisolate load(s) from the power supplyi. Fail to openi. Contact dirty/corrodedi. Overheatingi. Intermittent operation of loadsi. Loads not operatingNone62224i. Replace switchesii. Fail to closeii. Release spring failureii. Arcingii. Intermittent measurementsii. Abnormal measurementsii. Can also use electrical circuit breakersiii. Visual smoke or arcing6FusesPrevent overcurrenti. Blow prematurelyi. Overcurrenti. Blown fusei. System shutdowni. Visual smokeFuses (F1 and F2) to prevent circuit overloads63118Remove the overload and replace fuse with spare. Consider the fuse ratingii. Fail to blow upon overcurrentii. Improper fuse selectionii. Arcing across fuse electrodesii. System malfunctionii. Loads not operatingiii. Fuse burned into placeiii. System power overloadiii. Indication and warning lights OFF7Relays (coils and contactsClose relay contacts when energized. The contacts engage and disengage the solenoid valves to the circuiti. Coil short circuit or burnt. ii. Fail to close (engage)i. Contact dirty/corrodedOverheatingi. Circuit overheatingi. Voltage measurements not as expectedFuses (F1 and F2) to prevent circuit overloads [6]53345Replace relay and any blown fuse(s), wire(s), or connector(s)iii. Open (disengage)ii. Release spring failureii. Blown fuseii. Visual smokeiii. Loss of power supply to operate the solenoid valvesiii. Loads (solenoid valves) not operating


## 3. Results and Discussion

The results from the FMEA conducted on the PTS control unit designed and constructed for cyclic neutron activation analysis were found to be reliable and fit for the intended task as shown in Table5. The compensation actions analysis have brought up the idea of incorporating additional components to enhance the compensation actions, such as electrical circuit breaker and suppressing diodes to augment the functions of the fuse. Failure mode analysis is a systematic approach to quantify the failure modes, failure rate, and root causes of known failures. Usually, the FMA is based on historical information.Table 5
Risk analysis.
SeverityOccurrenceDetectionRisk priority numberAverage52.62.632.7DefinitionEffect ismediumThe likelihood of occurrence isremote with a possible failure rate of 5%The likelihood of detection isvery highThe risk priority number islowThe LOGO! version PLCs have their outputs to be short-circuit, proof and overload, proof [11]. The LM 317 voltage regulator used in the power supply also has overcurrent and overtemperature protection that shut down the device against overload or damage from operating in excessive heat [12]. These are some of the safety measures to enhance the compensation actions of the system.Details of the FMEA performed for the CU are presented in Table5. The inputs used in completing the analysis include mainly manufacturing data for various components [12] and experience acquired in using the components.


## 4. Conclusions

This study has presented an FMEA conducted for the conceptual CU design to be possibly integrated with the existing PTS. The risk analysis produced in this report has provided recommended actions to be incorporated into the design. It is expected that when the recommended actions are implemented, the RPN will reduce to a significant level to facilitate successful implementation of the modification. The analysis of failure and effects of the control unit does not have any effect on the reactor safety. The PTS is an auxiliary system of GHARR-1 and not important to reactor safety, as per safety classification of the IAEA [13]. Instrumentation and control functions, systems, and components are classified into two categories: items important to reactor safety and items not important to reactor safety [13]. Functions, systems, and components important to reactor safety are those which contribute to safely shutting down the reactor and maintaining it in a safe shutdown condition in and after operational states and accident conditions.In general, the implementation of the CU in an existing PTS is not expected to pose any significant risks in view of the outlined compensation actions and recommended actions. The study would serve as a valuable tool for subsequent analysis to be conducted in the future. The maintenance program developed for the PTSCU [14] is divided into two: routine maintenance, during which preventive and predictive maintenance would be carried out, and corrective maintenance [14] to ensure continuous operation when it is implemented.



---

*Source: 7653857-2021-08-26.xml*