Risk identification and assessment are crucial to ensure specific job-related risks are identified and precautionary measures can be taken. The risk assessment must be performed at several stages from the design phase up to operation and decommissioning. Risk assessment is important for every situation at risk which includes every change and each work performed.

Several types of assessment exist, and amongst others:

• those that deal with risk to personnel and assets during the work interventions (occupational safety)
• those that deal with risk to personnel and assets due to failure of the process or the asset (industrial safety)

Management should ensure that a comprehensive hazard identification and risk assessment process systematically identifies, assesses and manages the risks.

For recommendations on this section, please refer to:

• Global Care Group Rule
  • GR04 Risk assessment and control
  • GR05 Permit to work system
• Global Care Industrial Safety Framework:
  • Item 06 (Hazard identification and risk assessment)
  • Item 17 (Work control, permit-to-work and task risk management)
• INCOME – IND2C010

Operating manuals and required procedures must be developed and maintained.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 08 (Operating manuals and procedures)

Enforce a management of change (MoC) program for all permanent, temporary or emergency modifications to equipment, procedures and parts. This program must consider change of:

• Plant or installation
• Supplier
• Equipment repaired, modified, upgraded or replaced
• Procedure(s)
• Organisation or personnel

It is important that all changes are described, reviewed and approved by designated competent personnel before they are implemented and appropriate systems are in place to monitor and audit the management of change process.

Role and responsibilities of individuals and departments in this process must be clearly defined.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 12 (Management of Change & Project Management)
• Global Care Group Rule
  • GR04 Risk assessment and control
• INCOME – IND2C060

Proposed changes must be reviewed and approved.

Monitoring and auditing system must be put in place.

Risk must be assessed in case of change.

Operational readiness process is important to assure a safe and efficient operation in case of new or modified plant or equipment. This procedure includes the H&S risks as well as process safety risks introduced by commissioning and start-up of this new/modified element.

The operational readiness process should include several aspects like human and organisational factors but also hardware, software and procedures. It is important to note that one modification can have an impact on all those aspects. For example, a hardware or software modification, can require a review of procedures and human and organisational factors.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 13 (Operational readiness and process start-up)

Operation readiness process must be put in place and checked regularly.

This process must include human & organisational factors, hardware & software and procedures.

A crisis and emergency response plan must be put in place so that the organisation can respond effectively to any crises, emergency situation or incident. The goal of this is to reduce the consequences in case of event thanks to appropriate actions.

This element covers:

• Crisis management planning
• Local emergency planning
• Availability of emergency and safety equipment

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 14 (Emergency preparedness)
• Global Care Group Rule
  • GR13 (Supporting the victims of a serious event)
• Global Care crisis management framework
  • Crisis management guidelines

Identification of crisis and emergency scenarios.

Preparation and testing of the different scenarios.

Appropriate work control and permit to work arrangements are employed to assure the safety of personnel, plant, process and the integrity of the asset during work activities.

Work permits help to check if the risks related to the planned works are identified and managed and to control the access to the asset.

The work permit should consider at least electrical risks (including lock out tag out certificates), work in confined spaces, and hot works which requires a specific permit.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 07 (Work control, permit control, and task risk management)
• Global Care Group Rule
  • GR05 (Permit to work system)
• INCOME IND3C030 & IND3C040
• ENGIE Life-saving rules
• Global Care – technical guidelines – Work in confined spaces

Work authorization procedure is in place and used. Workers without authorization are not given access to the asset.

Permit to works are delivered to manage critical risks. Amongst others, a specific work permit is required for hot works.

Risk analysis available for each work.

Permit to work delivered before each activity defined as high risk (confined spaces, electricity, hot works etc.)

Anomalies and incident reporting is extremely important to detect shortcomings in existing practices or procedures. Appropriate actions must be taken to prevent their recurrence.

The reporting is of primary importance for high-potential incidents called HiPos. Those incidents could have caused one or more fatalities under other circumstances.

It is important to ensure that all incidents, HiPos and “near misses” are consistently reported and investigated (according to their potential severity) and that actions are defined and implemented on a timely basis.

The reporting and sharing of good practices must also be promoted.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 19 (Incident reporting and investigation)
• Global Care Group Rule
  • GR03 (Analysis of incidents with high potential severity)
• INCOME – IND2C010

Clear policy that every (near) incident and HiPo must be reported.

Procedures to report (near) incidents are available and used.

Each incident is investigated, the root cause is analysed.

Dedicated industrial safety performance indicators are defined and tracked, in addition to health and safety indicators.

Action plan is put in place to avoid accidents to happen again.

Fatal external cases are reviewed internally.

Inspections and maintenance are key for a safe and healthy asset. It will prevent unplanned unavailability and damages. It is important to identify safety critical equipment and to control, inspect and perform preventive maintenance on those equipments.

Independently of the maintenance scenario, a Supervisory Control And Data Acquisition (SCADA) system and a remote monitoring must allow permanent monitoring of performance, condition and health. It should deliver alarms for minor deviations and stop/disconnect the asset in case of major event.

Safety Critical Equipment must be identified via a formal process such as Process Hazard Review or Engineering Risk Assessment.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 15 (Inspection and maintenance)
  • Item 16 (Management of Safety Critical Devices)
• INCOME – IND2C010 & IND2C030

An ENGIE contract manager evaluates the service providers. The internal asset monitoring system (AMS) allows performance reviews (for example Darwin).

A condition monitoring system (CMS) and expertise team is in place. The CMS monitors critical individual components (e.g. Vibration monitoring) allowing in the best cases to receive early warnings to avoid failures.

Safety-critical equipment are identified, controlled, maintained.

Degraded modes are reviewed, and action plans are put in place when necessary.

Yearly meeting/evaluation with the service provider.

Permanent monitoring through AMS and CMS.

All ENGIE and contractor personnel having access to the wind farm must have completed safety awareness training on topics that could impact their safety, or the safety of the installation, and have gone through an induction process.

The Global Wind Organisation (GWO) developed a basic safety training consisting of four modules for onshore wind farms:

• First aid
• Manual handling
• Fire awareness
• Working at heights

Specific trainings for electrical safety are also required following local regulations. Other trainings recommended are:

• Use of the service lift
• Use of the winch
• Use of the WTG from OEMs

More generally, a training plan must in place and should help identify which person / function needs to conduct which type of training. This concerns health & safety training, industrial safety related training, or technical training.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 03 (Employee selection, placement and competency)
• INCOME – IND2C040

An adapted safety awareness and training procedure exists, is applied, and is up-to-date.

Trainings follow the standards set up by GWO.

Procedure & training material are reviewed on a yearly basis.

Training is refreshed every year or every two years according to local regulations, GWO standards or better.

All contractors active in or for a specific site should be registered to allow proper tracing of interventions, modifications and replacement of parts.

In order to assess the quality of service (beyond the obliged compliance) they should be routinely reviewed.

All HSE clauses should apply to subcontractors active on ENGIE (managed) sites.

In addition to HSE plans, bridging documents are sometimes in place in the industry. A bridging (or interface) document is a documented plan that defines how diverse organisations agree on which safety management elements will be used when co-operating on a project, contract or operation.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 18 (Contractor and supply, selection and management)
• Global Care Group Rule
  • GR02 (Health & safety with regard to subcontracting)
  • GR09 (Health & safety in projects and acquisitions)

Definition : 

“Bridging documents”:  in addition to HSE plans, bridging documents are sometimes in place in the industry. A bridging (or interface) document is a documented plan that defines how diverse organisations agree on which safety management elements will be used when co-operating on a project, contract or operation.

Contractors are registered and apply the same procedures and guidelines.

Contractors are regularly trained/ updated with necessary skills/ information.

Because of wind turbines height and location in open areas, lightning strikes on blades happen. Lightning can lead to damage or even destruction of the blade or electrical system.

It is important to set up a testing program for the lightning protection.

The Lightning Exposure Assessment has been done according to the requirements of the standard IEC 61400-24 latest Edition.

The wind turbine lightning protection system is certified according to the standard IEC 61400-24 latest Edition including all the parameters defined in the applicable Lightning Protection Level.

Lightning protection system is checked visually every year. Complete inspection of LPS (incl. continuity measurements): every 2 years for LPL-I and II, every 4 years for LPL-III and IV.

Lightning counter and intensity measurement device is installed on the lightning conductor (recording the lightning current) are at least yearly checked.

Industrial control systems (ICS) need to be protected against unauthorized access, use, disclosure, disruption, modification or destruction in conformity with the ENGIE ICS security Policy.

To address this, ENGIE developed the ICS Security Framework and its Progress Reporting tool which allows the sites to self-assess and follow-up its security maturity level.

By implementing the ICS Security Framework security controls, cybersecurity risks can be mitigated to an acceptable level and incidents can be avoided.

However, in the case of nations or industries submitted to comply with regulatory requirements, specific security measures may be mandatory and additional security controls might be needed.

For recommendations on this section, please refer to:

• Group Security Policy for lndustrial Control Systems
• ICS security framework

Overall security level in the Progress reporting tool.

Secured network connection in place.

Locking systems and gates are in place to prevent intrusion

Systems for intrusion detection (e.g. door sensors) are in place, monitored and maintained. A response plan is ready in case of intrusion.

Backup power is foreseen and the installation is maintained, inspected and tested.

Frequency of grid failures. Note that this is only applicable to operational sites with operating history; not applicable to sites which have recently reached COD.

Number of wind turbines on the same array. This highlights lower or higher production loss in case of damage to cable / power interruption to the substation.

UPS system is preventively replaced after 10 years.

Emergency generator (if applicable) is weekly started and visual inspection is performed every 4 months.

An ice detection system is in place. This detection must use one mature technology certified with the turbine.

Ice detection procedures exist and are used

Yearly test of the ice detection procedure

Ice detection procedures are yearly reviewed and new procedures are tested

The main risks linked with extreme weather conditions concern:

• Heavy wind
• High/low temperatures
• Seismic activity
• Lightning (is already assessed in a specific topic)

The risk for other extreme weather conditions (flood, temperatures) are extremely dependent on the wind farms location

Concerning seismic activity, the Eurocode 8 (or local equivalent) specifies the design requirements of structures for earthquake resistance. The design will depend of the seismic activity of the wind farm location.

The following documents are typically expected from the equipment manufacturer:

• Type Certificate
• Turbine technical specification
• « Site Suitability Load Analysis » for certified lifetime of the wind turbine

Definition:

“Normal Operating Parameters”: Wind (IEC class, rate wind speed, cut-in & cut-out), temperature, and air density normal operating parameters should be available on the machine Type Certificate. More parameters may be available on the machine technical specification.

Adequacy between turbine type and wind class (IEC 61400).

Wind farm location.

Weather conditions assessment performed during development stage based on standards IEC 61400-1 and -24 (lightning).

Blades are exposed to great forces, high fatigue cycles and to various weather conditions. Monitoring the condition of blades is therefore important to prevent (unrepairable) damage. Adequate maintenance of the pitch system is needed to insure stopping power at extreme wind speeds.

New ENGIE recommendations (as per new Guideline for Blade Inspections) will be:

• Inspection of 100% of the Blades Inside and Outside before End-Of-Warranty (usually 2 years).
• Ground based or drone inspections every year with a miniumum of 30%, average 50% and best 100% of the WTG. –> Frequency to be adapted in function of blade quality and ageing.
• Internal inspections every 5-7 years from EoW.

If some inspections are included in the LTSA, results (high resolution pictures, access to web platform and documented reports) have to be shared by the OEM or ISP.

Blade internal and external inspections (including lightning protection) are performed and actions are taken to repair damages.

Pitch system is adequately maintained and monitored (grease samples, internal clearance measurements).

Blade inspection every 2 year.

Yearly pitch grease analysis.

Availability of technical equipment and maintenance practices for the main bearing.

Existing vibration analysis with associated expertise for detection and advices.

Yearly grease sampling and analyses for grease cleanliness and wear particles.

A wind turbine gearbox is the link between the rotating blades and the generator. It consists of a high number of rotating parts which are exposed to wear. Adequate maintenance and monitoring is needed to prevent damage and to achieve the planned life span.

Oil analysis is performed and it is recommended this covers the following parameters: water content, viscosity, additives, wear elements (ICP), particle count, oil cleanliness, PQ index, color/appearance.

The gearbox is adequately maintained and monitored (oil level, oil cleanliness, oil quality, temperature deviation).

Detailed endoscopic gearbox inspections are performed if required after alarm from the vibration monitoring system (VMS) and confirmed by oil wear particles analyses.

VMS (vibration monitoring system) is installed and properly analysed with expertise support.

Gearbox lubrication oil sample is taken and analysed at least every year.

Detailed endoscopic gearbox inspection is performed during the first year after commissioning.

Generator is equipped with temperature measurements (bearing and winding), vibration sensors and automatic grease system.

The generator is adequately maintained.

Isolation resistance measurements are performed.

The isolation resistance is measured yearly.

For DFIG machines, slip rings are cleaned, measured and eventually ground on a yearly basis.

The wind farms grid connection consists of switchgear and eventually a transformer. The transformer typically transforms the produced electricity from medium voltage to high voltage when the grid is requiring it. The switchgear on the other hand is designed to connect and disconnect, detect grid faults and protect the wind farm. A failure of one of these component almost directly lead to an unavailability of the complete wind farm or at least one of the branches.

Also the substation needs to be maintained and visually inspected.

It is recommended that an arc flash study is performed on all electrical power cabinets (LV) and switchgear (MV/HV). This study would thus concern equipment in the substation, but also extend to the equipment within the wind turbine.

Oil and dissolved gases analysis should be performed on transformers according to the manufacturer’s recommendations.

Contingency plan for main transformer must exist and is complete.

The transformer and switchgear are adequately maintained.

Transformer oil and dissolved gas analysis is performed.

Transformer is protected with a Buchholz relay or equivalent.

Arc flash analysis.

The maintenance interval of the substation is yearly or shorter.

Transformer oil analysed periodically (at least every 3 year).

Yearly thermographic check of high and medium voltage cells and cabinets (if safely accessible).