Search in book...
Toggle Font Controls
Create new playlist

Name your new playlist

Playlist description (optional)
Sign In

Email address

Password

Forgot Password?

or

Continue with Facebook

Continue with Google
Sign Up

Full Name

Email address

Confirm Email Address

Password

or

Continue with Facebook

Continue with Google

Chapter 16

Hydroelectric Dam and Tidal Gates

Abstract

This example provides a Safety Integrity Level (SIL) assessment of the proposed flood gate control system (FGCS) at a hydro-electric dam, demonstrating that it meets the identified hardware reliability and minimum configuration requirements in accordance with IEC 61508. In order to identify the SIL requirements, a Layer of Protection Analysis (LOPA) was conducted at a meeting of interested parties. The study considered the hydro-electric plant to determine potential risks associated with the specified hazards.

Keywords

Dam overtopping; Flood gate control system; Hydroelectric project; Locks; LOPA; SIL; Water surge

16.1. Flood Gate Control System

16.1.1. Targets

In order to identify the SIL requirements, a Layer of Protection Analysis (LOPA) was conducted at a meeting of interested parties. The study considered the hydro-electric plant to determine potential risks associated with the specified hazards. See example in Section 13.6.

Table 16.1 summarizes the LOPA and the required Probability of Failure on Demand (PFD) values and corresponding SILs for each of the two hazards.

The FGCS was then analyzed to identify the Safety Instrumented Functions (SIFs) used to mitigate the specified hazards, as presented in Table 16.2.

16.1.2. Assessment

(a). Common cause failures (CCFs)

The β values used in the analysis were based on engineering judgment and are presented in Table 16.3.

Table 16.1

Summary of the LOPA.

Event (hazard) description	Consequence	Safety instrumented function (SIF) requirement (PFD)	SIF requirement (SIL)
Dam overtopping due to gates failing to open on demand during a major storm (requiring the use of one gate), which spillways are unable to mitigate	Death of more than one person	5.0 × 10⁻³	SIL2
Water surge: gates open spuriously at full speed, causing a surge of water which could drown multiple fishermen	Death of more than one person	2.3 × 10⁻³	SIL2

Table 16.2

Summary of safety functions.

Loop ref.	Input device	Input configuration	Logic device	Logic configuration	Output device	Output configuration	Safety function
A	Level transmitters microwave (2 off)/radar	2oo3	Safety PLC	1oo1	Two flood gate drives	1oo2	Detection of high loch level opens 1 out of 2 (1oo2) flood gates
B	Safety timer relay	1oo1	N/A	N/A	Line contactor	1oo1	If the open contactor is closed for more than 50 s (i.e., the gate is opening too quickly), power is isolated from the motor by opening the line contactor

Table 16.3

CCF contributions.

Redundant configuration	CCF β-factor	Justification
Microwave/radar level transmitters	5%	Three devices are mounted with separation and utilize two dissimilar technologies
Flood gate operation mechanism	2%	The flood gates (and the associated lifting gear) are physically separated from one another
Power supplies	10%	The two supplies are of similar technology

(b). Assumptions

The following summarizes the general assumptions used in the assessment:

the FGCS is assumed to be a low-demand system and therefore the LOW-DEMAND PFD targets apply;

the analysis assumes that all failure modes that are not revealed by self test will be identified by the proof test, i.e., the proof test is 100% effective;

the calculation of PFD is based upon an assumed MTTR of 24 hrs;

if a failure occurs, it is assumed that on average it will occur at the midpoint of the test interval; in other words, the fault will remain undetected for 50% of the test period;

the analysis assumes constant failure rates and therefore the effects of early failures are expected to be removed by appropriate processes; it is also assumed that items are not operated beyond their useful life, thus ensuring that failures due to wearout mechanisms do not occur

(c). Failure rates of component parts

Table 16.4 summarizes the data sources.

(d). Results and conclusions

The results of the assessment (Table 16.5) demonstrate that, based on the assumptions, the specified SIFs meet the hardware reliability and architectural requirements of the targets identified by the LOPA.

Table 16.4

Failure rates and the calculation of SFF.

Item/function	Dangerous failure mode	λdd	λdu	λs	SFF	Source
DC motor	Fails to start on demand	0.0E+00	1.8E-06	3.3E-06	65%	Faradip v.6.1
Motor brake	Fails on	0.0E+00	8.4E-08	3.6E-08	30%	NRPD-85
Chain drive	Breaks	0.0E+00	2.7E-06	3.0E-07	10%	Faradip v.6.1
Redundant power supply	Loss of power	5.5E-05	0.0E+00	0.0E+00	100%	Faradip v.6.1
Microwave level transmitter	Fails to detect high loch level	9.9E-07	2.0E-07	3.4E-07	87%	Manufacturer's data adjusted
FG PLC AI module	Fails to interpret high loch level	5.6E-07	2.1E-07	4.2E-07	82%	ESC Failure Rate Database
Radar level transmitter	Fails to detect high loch level	1.1E-06	3.6E-07	4.7E-07	82%	Manufacturer's data adjusted
Resolver	Erroneously detects gate in open position	1.4E-06	1.5E-07	1.5E-06	95%	Faradip v.6.1
FG PLC AI module	Erroneously detects gate in open position	5.6E-07	2.1E-07	4.2E-07	82%	ESC Failure Rate Database
FG PLC CPU	Fails to interpret high level or gate closed on demand	2.7E-07	3.0E-08	2.6E-06	99%	ESC Failure Rate Database
FG PLC DO (NDE) module	Fail to energize on demand	1.2E-07	7.4E-07	3.5E-07	39%	ESC Failure Rate Database
Line contactor (NDE)	Fails to close contacts on demand	0.0E+00	2.1E-07	9.0E-08	30%	Technis report T219
Safety timer relay	Contacts fail to open on demand	0.0E+00	1.5E-08	1.5E-06	99%	Technis report T219
Line contactor (NE)	Contacts fail to open on demand	0.0E+00	9.0E-08	2.1E-07	70%	Technis report T219

Table 16.5

Results.

Hazard	Target PFD	SIL	PTI hrs	PFD assessed	SIL from SFF	Overall SIL
Dam overtopping	5 × 10⁻³	2	8760	4 × 10⁻³	2	2
Water surge	2.3 × 10⁻³	2	8760	4.6 × 10⁻⁴	2	2

Reliability block diagram, dam overtopping.

Reliability block diagram, water surge.

16.2. Spurious Opening of Either of Two Tidal Lock Gates Involving a Trapped Vessel

The scenario involves either of a pair of lock gates moving despite no scheduled opening. This leads to a vessel becoming trapped and either sinking or causing harm to a person on board. A two-fatality scenario is perceived.

The following estimates of frequencies and propagations are credible:

Boat movements through the lock	12/day	Assume a half minute per passage
Boat situated such as to be trapped	17%	Based on an assumed 10 ft vessel in a 60 ft lock
Skipper fails to take avoiding action	10%	Judgment (noting 2 min closure time)
Entrapment causes damage to vessel	90%	Judged likely
Fatality ensues	50%	Judgment

The combination of the above factors, together with failures and incidents, is shown in Figure 16.1. The fault tree logic was analyzed using the TECHNIS fault tree package TTREE, which is reproduced at the end of this chapter. The probability of the top event is 3.1 × 10⁻⁵.

Assuming a maximum tolerable risk of 10⁻⁵ pa for this involuntary public risk, the maximum tolerable failure rate for the mitigating effect of the Junction Gates is:

$10^{- 5} pa / 3.1 \times 10^{- 5} = 3.2 \times 10^{- 1} pa .$ $10^{- 5} pa / 3.1 \times 10^{- 5} = 3.2 \times 10^{- 1} pa .$

The fault tree logic (Figure 16.2) was constructed as a result of studying the scenario. The frequency of the top event is 3.1 × 10⁻¹ pa per gate, which meets the requirement.

Figure 16.2 Fault tree (spurious gate movement).

The target (being greater than 10⁻¹) implies a target <SIL 1.

As can be seen from the fault tree output data shown at the end of this section, human error dominates the contributions to the top event (>95%).

We shall now address ALARP

A failure rate of 3.1 × 10⁻¹ pa maps to a fatality risk of 10⁻⁵ pa × 3.1 × 10⁻¹/3.2 × 10⁻¹ = 9.7 × 10⁻⁶ pa

Thus, assuming a “cost per life saved” criterion of £4,000,000, any proposal which might reduce the risk to the Broadly Acceptable limit of 10⁻⁶ pa might be tested as follows.

$£ 4,000,000 = £proposal / (9.7 \times 10^{- 6} - 10^{- 6}) \times 30 yrs \times 2 fatalities$ $£ 4,000,000 = £proposal / (9.7 \times 10^{- 6} - 10^{- 6}) \times 30 yrs \times 2 fatalities$

Thus any proposal costing less than £2300 should be considered. It is unlikely that any further risk reduction can be implemented within this sum; thus it might be argued that ALARP is satisfied.

However, it should be noted that:

• the predicted frequency is close to the target and reliability prediction is not a precise statistic;

• the domination of human error suggests further investigation.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.

Table of Contents for Chapter 16. Hydroelectric Dam and Tidal Gates

Create new playlist

Sign In

Sign Up