Skip to content

How this self-assessment tool is structured

The self-assessment tool is divided into 3 main topics:

  1. Site management of key safety system elements
  2. Management of Major Industrial Risks
  3. Management of Risks Related to Critical Components

Each main topic is divided into subtopics. The subtopics are described as shown in the table below:

[ X ] – Subtopic description

Description Summary of subtopic description
References to existing ENGIE rules or standards
Indicators Metrics that measure the risk exposure for this subtopic
Recurrence/Frequency Indicates how often the measure is to be checked

1. Site management of key H&S system elements

Goal of this section is to ensure that organisational measures are in place to manage risks related to wind turbines.


The key policies exist. This includes:

  • Health / Occupational Safety / Industrial Safety
  • Asset Integrity
  • Engineering Management
  • Environmental Compliance
  • Site security
  • Cybersecurity
  • Operation & Maintenance …
Indicators The policies must be approved and shared and applied on the site.
Recurrence/Frequency N/A

Risk identification and assessment are crucial to ensure specific job-related risks are identified and precautionary measures can be taken. The risk assessment must be performed at several stages from the design phase up to operation and decommissioning. Risk assessment is important for every situation at risk which includes every change and each work performed.

Several types of assessment exist, and amongst others:

  • those that deal with risk to personnel and assets during the work interventions (occupational safety)
  • those that deal with risk to personnel and assets due to failure of the process or the asset (industrial safety)

Management should ensure that a comprehensive hazard identification and risk assessment process systematically identifies, assesses and manages the risks.

For recommendations on this section, please refer to:

Indicators Risk assessment must be performed and action plan must be put in place.
Recurrence/Frequency Regular update of the risk assessment is required at least after each important modification (industrial hazard assessment) and before each type of work (occupational job safety analysis).

Operating manuals and required procedures must be developed and maintained.

For recommendations on this section, please refer to:

Indicators Operating manuals and procedures are identified, available, accurate, up-to-date, understood and effectively used.
Recurrence/Frequency N/A

Enforce a management of change (MoC) program for all permanent, temporary or emergency modifications to equipment, procedures and parts. This program must consider change of:

  • Plant or installation
  • Supplier
  • Equipment repaired, modified, upgraded or replaced
  • Procedure(s)
  • Organisation or personnel

It is important that all changes are described, reviewed and approved by designated competent personnel before they are implemented and appropriate systems are in place to monitor and audit the management of change process.

Role and responsibilities of individuals and departments in this process must be clearly defined.

For recommendations on this section, please refer to:


Proposed changes must be reviewed and approved.

Monitoring and auditing system must be put in place.

Risk must be assessed in case of change.

Recurrence/Frequency Periodically review and update procedures based on experience.

Operational readiness process is important to assure a safe and efficient operation in case of new or modified plant or equipment. This procedure includes the H&S risks as well as process safety risks introduced by commissioning and start-up of this new/modified element.

The operational readiness process should include several aspects like human and organisational factors but also hardware, software and procedures. It is important to note that one modification can have an impact on all those aspects. For example, a hardware or software modification, can require a review of procedures and human and organisational factors.

For recommendations on this section, please refer to:


Operation readiness process must be put in place and checked regularly.

This process must include human & organisational factors, hardware & software and procedures.

Recurrence/Frequency Process is reviewed in case of (near) incident or accident.

A crisis and emergency response plan must be put in place so that the organisation can respond effectively to any crises, emergency situation or incident. The goal of this is to reduce the consequences in case of event thanks to appropriate actions.

This element covers:

  • Crisis management planning
  • Local emergency planning
  • Availability of emergency and safety equipment

For recommendations on this section, please refer to:


Identification of crisis and emergency scenarios.

Preparation and testing of the different scenarios.

Recurrence/Frequency Annual testing of crisis and emergency response plan.

Appropriate work control and permit to work arrangements are employed to assure the safety of personnel, plant, process and the integrity of the asset during work activities.

Work permits help to check if the risks related to the planned works are identified and managed and to control the access to the asset.

The work permit should consider at least electrical risks (including lock out tag out certificates), work in confined spaces, and hot works which requires a specific permit.

For recommendations on this section, please refer to:


Work authorization procedure is in place and used. Workers without authorization are not given access to the asset.

Permit to works are delivered to manage critical risks. Amongst others, a specific work permit is required for hot works.


Risk analysis available for each work.

Permit to work delivered before each activity defined as high risk (confined spaces, electricity, hot works etc.)


Anomalies and incident reporting is extremely important to detect shortcomings in existing practices or procedures. Appropriate actions must be taken to prevent their recurrence.

The reporting is of primary importance for high-potential incidents called HiPos. Those incidents could have caused one or more fatalities under other circumstances.

It is important to ensure that all incidents, HiPos and “near misses” are consistently reported and investigated (according to their potential severity) and that actions are defined and implemented on a timely basis.

The reporting and sharing of good practices must also be promoted.

For recommendations on this section, please refer to:


Clear policy that every (near) incident and HiPo must be reported.

Procedures to report (near) incidents are available and used.

Each incident is investigated, the root cause is analysed.

Dedicated industrial safety performance indicators are defined and tracked, in addition to health and safety indicators.

Action plan is put in place to avoid accidents to happen again.

Fatal external cases are reviewed internally.

Recurrence/Frequency After each incident.

Inspections and maintenance are key for a safe and healthy asset. It will prevent unplanned unavailability and damages. It is important to identify safety critical equipment and to control, inspect and perform preventive maintenance on those equipments.

Independently of the maintenance scenario, a Supervisory Control And Data Acquisition (SCADA) system and a remote monitoring must allow permanent monitoring of performance, condition and health. It should deliver alarms for minor deviations and stop/disconnect the asset in case of major event.

Safety Critical Equipment must be identified via a formal process such as Process Hazard Review or Engineering Risk Assessment.

For recommendations on this section, please refer to:


An ENGIE contract manager evaluates the service providers. The internal asset monitoring system (AMS) allows performance reviews (for example Darwin).

A condition monitoring system (CMS) and expertise team is in place. The CMS monitors critical individual components (e.g. Vibration monitoring) allowing in the best cases to receive early warnings to avoid failures.

Safety-critical equipment are identified, controlled, maintained.

Degraded modes are reviewed, and action plans are put in place when necessary.


Yearly meeting/evaluation with the service provider.

Permanent monitoring through AMS and CMS.


All ENGIE and contractor personnel having access to the wind farm must have completed safety awareness training on topics that could impact their safety, or the safety of the installation, and have gone through an induction process.

The Global Wind Organisation (GWO) developed a basic safety training consisting of four modules for onshore wind farms:

  • First aid
  • Manual handling
  • Fire awareness
  • Working at heights

Specific trainings for electrical safety are also required following local regulations. Other trainings recommended are:

  • Use of the service lift
  • Use of the winch
  • Use of the WTG from OEMs

More generally, a training plan must in place and should help identify which person / function needs to conduct which type of training. This concerns health & safety training, industrial safety related training, or technical training.

For recommendations on this section, please refer to:


An adapted safety awareness and training procedure exists, is applied, and is up-to-date.

Trainings follow the standards set up by GWO.


Procedure & training material are reviewed on a yearly basis.

Training is refreshed every year or every two years according to local regulations, GWO standards or better.


All contractors active in or for a specific site should be registered to allow proper tracing of interventions, modifications and replacement of parts.

In order to assess the quality of service (beyond the obliged compliance) they should be routinely reviewed.

All HSE clauses should apply to subcontractors active on ENGIE (managed) sites.

In addition to HSE plans, bridging documents are sometimes in place in the industry. A bridging (or interface) document is a documented plan that defines how diverse organisations agree on which safety management elements will be used when co-operating on a project, contract or operation.

For recommendations on this section, please refer to:

Definition : 

“Bridging documents”:  in addition to HSE plans, bridging documents are sometimes in place in the industry. A bridging (or interface) document is a documented plan that defines how diverse organisations agree on which safety management elements will be used when co-operating on a project, contract or operation.


Contractors are registered and apply the same procedures and guidelines.

Contractors are regularly trained/ updated with necessary skills/ information.

Recurrence/Frequency Before/ during each intervention.

2. Management of major industrial risks

Goal of this section is to ensure that measures are in place to manage the major industrial risks related to wind turbines.


Fire in a wind turbine often leads to a complete destruction because a burning nacelle is unreachable for the fire department. Falling burning pieces can lead to damage in the surrounding of the turbine. A fire can also occur at the wind farms grid connection. The fire risk must be managed with a high priority.

It is important to work on all aspects to limit the risks:

  1. Prevention of fire: Smoking restriction, separate storage of flammable substances, hot work procedure applied, presence of handheld fire extinguishers, nacelle and hub made of non-combustible material
  2. Detection of fire: automatic fire detection systems must be installed throughout all buildings and critical plant.
  3. Avoid propagation of fire:
    1. For substations: sealing of all penetrations including cable paths are important to prevent propagation of fire and/or smoke
    2. For wind turbines, cleanliness and oil/grease leakage avoidance are keys.

In addition, a maintenance program should be established for fire detection, alarm and fire-fighting equipment.

Hot works should be compliant with the NFPA51B procedure, including delivery of a hot work permit.

For recommendations on this section, please refer to:


Procedures when fire occurs are in place, tested and available.

Fire prevention procedures are in place and used.

Fire detection devices are periodically checked and monitored.


Fire procedures are reviewed yearly. New procedures are tested (in line with NFPA applicable guidelines).

Fire suppression systems and/or extinguishers are yearly checked.

Fire detection devices are yearly checked and 24/7 monitored.


Because of wind turbines height and location in open areas, lightning strikes on blades happen. Lightning can lead to damage or even destruction of the blade or electrical system.

It is important to set up a testing program for the lightning protection.

The Lightning Exposure Assessment has been done according to the requirements of the standard IEC 61400-24 latest Edition.

The wind turbine lightning protection system is certified according to the standard IEC 61400-24 latest Edition including all the parameters defined in the applicable Lightning Protection Level.

Indicators Lightning protection system is installed and is periodically checked.

Lightning protection system is checked visually every year. Complete inspection of LPS (incl. continuity measurements): every 2 years for LPL-I and II, every 4 years for LPL-III and IV.

Lightning counter and intensity measurement device is installed on the lightning conductor (recording the lightning current) are at least yearly checked.


Industrial control systems (ICS) need to be protected against unauthorized access, use, disclosure, disruption, modification or destruction in conformity with the ENGIE ICS security Policy.

To address this, ENGIE developed the ICS Security Framework and its Progress Reporting tool which allows the sites to self-assess and follow-up its security maturity level.

By implementing the ICS Security Framework security controls, cybersecurity risks can be mitigated to an acceptable level and incidents can be avoided.

However, in the case of nations or industries submitted to comply with regulatory requirements, specific security measures may be mandatory and additional security controls might be needed.

For recommendations on this section, please refer to:

  • Group Security Policy for lndustrial Control Systems
  • ICS security framework

Overall security level in the Progress reporting tool.

Secured network connection in place.

Recurrence/Frequency N/A
Description Burglary or vandalism in the wind farm or wind turbine could lead to damage and/or production loss. The burglars could also harm themselves. Therefore it is important to detect and (if possible) prevent intrusion.

Locking systems and gates are in place to prevent intrusion

Systems for intrusion detection (e.g. door sensors) are in place, monitored and maintained. A response plan is ready in case of intrusion.

Recurrence/Frequency N/A
Description An unstable grid can lead to high production losses and higher (mechanical) stresses. It is therefore important that backup power is foreseen so that in case of grid failure, the vital parts of the machine stay supplied. This way the machines will be stopped in a controlled manner and important safety systems will stay operational. The machine can automatically restart when the grid failure disappears.

Backup power is foreseen and the installation is maintained, inspected and tested.

Frequency of grid failures. Note that this is only applicable to operational sites with operating history; not applicable to sites which have recently reached COD.

Number of wind turbines on the same array. This highlights lower or higher production loss in case of damage to cable / power interruption to the substation.


UPS system is preventively replaced after 10 years.

Emergency generator (if applicable) is weekly started and visual inspection is performed every 4 months.

Description The combination of low temperatures and high humidity can lead to ice accretion on the wind turbines blades. When the temperature is rising the ice can be thrown away and cause damage. An ice detection system automatically stops the wind turbine when icing conditions occur and thereby prevent ice throw. Ice falling from the stopped blades is unavoidable. The falling zone should be safeguarded if needed.

An ice detection system is in place. This detection must use one mature technology certified with the turbine.

Ice detection procedures exist and are used


Yearly test of the ice detection procedure

Ice detection procedures are yearly reviewed and new procedures are tested


The main risks linked with extreme weather conditions concern:

  • Heavy wind
  • High/low temperatures
  • Seismic activity
  • Lightning (is already assessed in a specific topic)

The risk for other extreme weather conditions (flood, temperatures) are extremely dependent on the wind farms location

Concerning seismic activity, the Eurocode 8 (or local equivalent) specifies the design requirements of structures for earthquake resistance. The design will depend of the seismic activity of the wind farm location.

The following documents are typically expected from the equipment manufacturer:

  • Type Certificate
  • Turbine technical specification
  • « Site Suitability Load Analysis » for certified lifetime of the wind turbine


“Normal Operating Parameters”: Wind (IEC class, rate wind speed, cut-in & cut-out), temperature, and air density normal operating parameters should be available on the machine Type Certificate. More parameters may be available on the machine technical specification.


Adequacy between turbine type and wind class (IEC 61400).

Wind farm location.

Weather conditions assessment performed during development stage based on standards IEC 61400-1 and -24 (lightning).

Recurrence/Frequency  N/A

3. Management of risks related to critical components

Goal of this section is to ensure that measures are in place to manage risks related to critical components.


An internal maintenance organization or a long-term wind turbine maintenance contract with a service provider will allow a guaranteed time or energy availability.

Critical equipment must be identified, and it is important that the maintenance contract includes sufficient spares to perform the manufacturer’s required maintenance.

Critical equipment is defined as per ENGIE-OPBARS-EP2: Contingency Planning for Critical Equipment (Spares)

Failure of critical equipment can lead to long downtimes. Business continuity and process start-up procedures are needed to control this downtime by preparing actions before the failure happens.

Accessibility of the site is also a key issue if spare parts of large dimensions must be transported.


Critical equipment”: Equipment which failure can lead to long downtime, such as (but not limited to): blades, main bearing, generator, gearbox, yaw system, pitch system etc.

Guaranteed time availability”: as defined in the maintenance contract. Depending on the contract, guaranteed availability may be in time or “energy”.


A maintenance contract (internally or externally) is in place. The contract is managed so contractual agreements are respected.

Critical spares must be identified and available.

Contract (balance of plant, crane,…), spare parts, management of obsolete components, procedures,… are in place over the business plan duration (and potential lifetime extension) to minimize downtime.

Site is easily accessible.


Strategy over the business plan are reviewed on a regular basis and minimally at major events on the fleet and contract modifications.

Procedures are reviewed at each modification.


Blades are exposed to great forces, high fatigue cycles and to various weather conditions. Monitoring the condition of blades is therefore important to prevent (unrepairable) damage. Adequate maintenance of the pitch system is needed to insure stopping power at extreme wind speeds.

New ENGIE recommendations (as per new Guideline for Blade Inspections) will be:

  • Inspection of 100% of the Blades Inside and Outside before End-Of-Warranty (usually 2 years).
  • Ground based or drone inspections every year with a miniumum of 30%, average 50% and best 100% of the WTG. –> Frequency to be adapted in function of blade quality and ageing.
  • Internal inspections every 5-7 years from EoW.

If some inspections are included in the LTSA, results (high resolution pictures, access to web platform and documented reports) have to be shared by the OEM or ISP.


Blade internal and external inspections (including lightning protection) are performed and actions are taken to repair damages.

Pitch system is adequately maintained and monitored (grease samples, internal clearance measurements).


Blade inspection every 2 year.

Yearly pitch grease analysis.

Description The main bearing supports the main shaft, the hub and blades (or generator, the hub and blades for direct drive machines). This low speed bearing can suffer from accelerated wear due to different factors (lack or poor lubricant quality, wind shear, wake effect,…). Changing the main bearing is a challenging and expensive project and generates substantial downtime.

Availability of technical equipment and maintenance practices for the main bearing.

Existing vibration analysis with associated expertise for detection and advices.

Yearly grease sampling and analyses for grease cleanliness and wear particles.

Recurrence/Frequency Yearly monitoring as a minimum

A wind turbine gearbox is the link between the rotating blades and the generator. It consists of a high number of rotating parts which are exposed to wear. Adequate maintenance and monitoring is needed to prevent damage and to achieve the planned life span.

Oil analysis is performed and it is recommended this covers the following parameters: water content, viscosity, additives, wear elements (ICP), particle count, oil cleanliness, PQ index, color/appearance.


The gearbox is adequately maintained and monitored (oil level, oil cleanliness, oil quality, temperature deviation).

Detailed endoscopic gearbox inspections are performed if required after alarm from the vibration monitoring system (VMS) and confirmed by oil wear particles analyses.

VMS (vibration monitoring system) is installed and properly analysed with expertise support.


Gearbox lubrication oil sample is taken and analysed at least every year.

Detailed endoscopic gearbox inspection is performed during the first year after commissioning.

Description The generator is the electrical heart of the wind turbine since it converts the rotational energy into electrical energy.  It is exposed to highly fluctuating loads and, although generator failures are not very common in wind industry, the cost and downtime for swapping a generator can be substantial.

Generator is equipped with temperature measurements (bearing and winding), vibration sensors and automatic grease system.

The generator is adequately maintained.

Isolation resistance measurements are performed.


The isolation resistance is measured yearly.

For DFIG machines, slip rings are cleaned, measured and eventually ground on a yearly basis.


The wind farms grid connection consists of switchgear and eventually a transformer. The transformer typically transforms the produced electricity from medium voltage to high voltage when the grid is requiring it. The switchgear on the other hand is designed to connect and disconnect, detect grid faults and protect the wind farm. A failure of one of these component almost directly lead to an unavailability of the complete wind farm or at least one of the branches.

Also the substation needs to be maintained and visually inspected.

It is recommended that an arc flash study is performed on all electrical power cabinets (LV) and switchgear (MV/HV). This study would thus concern equipment in the substation, but also extend to the equipment within the wind turbine.

Oil and dissolved gases analysis should be performed on transformers according to the manufacturer’s recommendations.


Contingency plan for main transformer must exist and is complete.

The transformer and switchgear are adequately maintained.

Transformer oil and dissolved gas analysis is performed.

Transformer is protected with a Buchholz relay or equivalent.

Arc flash analysis.


The maintenance interval of the substation is yearly or shorter.

Transformer oil analysed periodically (at least every 3 year).

Yearly thermographic check of high and medium voltage cells and cabinets (if safely accessible).

Back To Top