skip to Main Content

How this self-assessment tool is structured

The self-assessment tool is divided into 3 main topics:

  1. Site management of key H&S system elements
  2. Management of Major Industrial Risks
  3. Management of Risks Related to Critical Components

Each main topic is divided into subtopics. The subtopics are described as shown in the table below:

[ X ] – Subtopic description

Description Summary of subtopic description
Indicators Metrics that measure the risk exposure for this subtopic
Recurrence/Frequency Indicates how often the measure is to be checked

1. Site management of key H&S system elements

Goal of this section is to ensure that organisational measures are in place to manage risks related to wind turbines.


Risk identification and assessment are crucial to ensure specific job-related risks are identified and precautionary measures can be taken. The risk assessment must be performed at several stages from the design phase up to operation and decommissioning. Risk assessment is important for every situation at risk which includes every change and each work performed.

Management should ensure that a comprehensive hazard identification and risk assessment process systematically identifies, assesses and manages the risks.

Indicators Risk assessment must be performed and action plan must be put in place
Recurrence/Frequency Regular update of the risk assessment is required at least after each important modification and before each type of work
Description  Operating manuals and required procedures must be developed and maintained.
Indicators Operating manuals and procedures are identified, available, accurate, up-to-date, understood and effectively used.
Recurrence/Frequency N/A

Operational readiness process is important to assure a safe and efficient operation in case of new or modified plant or equipment. This procedure includes the H&S risks as well as process safety risks introduced by commissioning and start-up of this new/modified element.

The operational readiness process should include several aspects like human and organisational factors but also hardware, software and procedures. It is important to note that one modification can have an impact on all those aspects. For example, a hardware or software modification, can require a review of procedures and human and organisational factors.


Operation readiness process must be put in place and checked regularly

This process must include human & organisational factors, hardware & software and procedures

Recurrence/Frequency Process is reviewed in case of (near) incident or accident

Enforce a management of change (MoC) program for all permanent, temporary or emergency modifications to equipment, procedures and parts. This program must consider change of:

–       Plant or installation

–       Supplier

–       Equipment repaired, modified, upgraded or replaced

–       Procedure(s)

–       Organisation or personnel

It is important that all changes are described, reviewed and approved, by designated competent personnel, before they are implemented and appropriate systems are in place to monitor and audit the management of change process.

Role and responsibilities of individuals and departments in this process must be clearly defined.


Proposed changes must be reviewed and approved

Monitoring and auditing system must be put in place

Risk must be assessed in case of change

Recurrence/Frequency Periodically review and update procedures based on experience

A crisis and emergency response plan must be put in place so that the organisation can respond effectively to any crises, emergency situation or incident. The goal of this is to reduce the consequences in case of event thanks to appropriate actions.

This element covers:

–       Crisis management planning

–       Local emergency planning

–       Availability of emergency and safety equipment


Identification of crisis and emergency scenarios

Preparation and testing of the different scenarios

Recurrence/Frequency Yearly testing of crisis and emergency response plan

Work permits help to check if the risks related to the planned works are identified and managed and to control the access to the asset.

The work permit should consider at least electrical risks, LoTo and fall from height risks. Specific works like hot work will require a specific work permit.

Management of personal protective equipment (PPE) is of prime importance to assure a safe work. PPE should be valid, adapted to the work, in good shape and correctly checked.


Work permit procedure is in place and used. Workers without permit are not given access to the asset.

Specific work permit is required for hot work

PPEs are adapted to the work and in good condition


A work permit is needed for every work.

PPEs are yearly checked


Anomalies and incident reporting is extremely important to detect shortcomings in existing procedures. Appropriate actions must be taken to prevent their recurrence.

The reporting is of primary importance for high-potential incidents called HiPos. Those incidents could have caused one or more fatalities under other circumstances.

It is important to ensure that incidents, HiPos and “near hits” are consistently reported and investigated (analysis of the root cause) and that identified actions and learnings are implemented on a timely basis.


Clear policy that every (near) incident and HiPo must be reported.

Procedures to report (near) incidents are available and used

Each incident is investigated, the root cause is analysed

Action plan is put in place to avoid accidents to happen again

Fatal external cases are reviewed internally

Recurrence/Frequency After each incident

Inspections and maintenance are key for a safe and healthy asset. It will prevent unplanned unavailability and damages. It is important to identify safety critical equipment and to control, inspect and perform preventive maintenance on those equipment.

Independently of the maintenance scenario, a Scada system and a remote monitoring must allow permanent monitoring of performance, condition and health. It should deliver alarms for minor deviations and stop/disconnect the asset in case of major event.


An ENGIE contract manager evaluates the service providers/internal asset monitoring system (AMS) allows performance reviews (Darwin for example)

A condition monitoring system (CMS) and expertise team is in place

Safety critical equipment are identified, controlled, maintained

Degraded modes are reviewed and action plans are put in place when necessary


Yearly meeting/evaluation with service provider

Permanent monitoring through AMS and CMS


All internal and external personnel having access to the wind farm must have completed safety awareness training.

The Global Wind Organisation (GWO) developed a basic safety training consisting of four modules for onshore wind farms:

–       First aid

–       Manual handling

–       Fire awareness

–       Working at heights

Specific trainings for electrical safety are also required following local regulations.

Others trainings recommended are:

–              Use of the service lift

–              Use of the winch

–              Use of the WTG from OEMs


An adapted safety awareness and training procedure exists, is applied, and is up-to-date

Trainings follow the standards set up by GWO


Procedure & training material are reviewed on a yearly basis

Training is refreshed every year or every two years according to local regulations, GWO standards or better

2. Management of major industrial risks

Goal of this section is to ensure that measures are in place to manage the major industrial risks related to wind turbines.


Fire in a wind turbine often leads to a complete destruction because a burning nacelle is unreachable for the fire department. Falling burning pieces can lead to damage in the surrounding of the turbine. A fire can also occur at the wind farms grid connection. The fire risk must be managed with a high priority.

It is important to work on all aspects to limit the risks:

1. Prevention of fire: Smoking restriction, separate storage of flammable substances, hot work procedure applied, presence of handheld fire extinguishers, nacelle and hub made of non-combustible material

2. Detection of fire: automatic fire detection systems must be installed throughout all buildings and critical plant.

3. Avoid propagation of fire:

a. For substations: sealing of all penetrations including cable paths are important to prevent propagation of fire and/or smoke

b. For wind turbines, cleanliness and oil/grease leakage avoidance are keys.

In addition, a maintenance program should be established for fire detection, alarm and fire-fighting equipment.


Procedures when fire occurs are in place, tested and available

Fire prevention procedures are in place and used

Fire protection devices are periodically checked

Fire detection devices are periodically checked and monitored


Fire procedures are reviewed yearly. New procedures are tested.

Fire suppression systems and/or extinguishers are yearly checked

Fire detection devices are yearly checked and 24/7 monitored


Because of wind turbines height and location in open areas, lightning strikes on blades happen. Lightning can lead to damage or even destruction of the blade or electrical system.

It is important to set up a testing program for the lightning protection.

Indicators Lightning protection system is installed and is periodically checked

Lightning protection system is 2 yearly visually checked

Lightning counter and intensity measurement device is installed on the lightning conductor (recording the lightning current) are at least yearly checked


Industrial control systems (ICS) need to be protected against unauthorized access, use, disclosure, disruption, modification or destruction in conformity with the ENGIE ICS security Policy.

To address this, ENGIE developed the ICS Security Framework and its Progress Reporting tool which allows the sites to self-assess and follow-up its security maturity level.

By implementing the ICS Security Framework security controls, cybersecurity risks can be mitigated to an acceptable level and incidents can be avoided.

However, in the case of nations or industries submitted to comply with regulatory requirements, specific security measures may be mandatory and additional security controls might be needed.


Overall security level in the Progress reporting tool

Secured network connection in place

Recurrence/Frequency N/A
Description Burglary or vandalism in the wind farm or wind turbine could lead to damage and/or production loss. The burglars could also harm themselves. Therefore it is important to detect and (if possible) prevent intrusion.

Locking systems and gates are in place to prevent intrusion

Systems for intrusion detection (e.g. door sensors) are in place, monitored and maintained. A response plan is ready in case of intrusion.

Recurrence/Frequency N/A
Description An unstable grid can lead to high production losses and higher (mechanical) stresses. It is therefore important that backup power is foreseen so that in case of grid failure, the vital parts of the machine stay supplied. This way the machines will be stopped in a controlled manner and important safety systems will stay operational. The machine can automatically restart when the grid failure disappears.

Backup power is foreseen and the installation is maintained, inspected and tested

Frequency of grid failures

Number of wind turbines on the same array


UPS system is preventively replaced after 10 years

Emergency generator (if applicable) is weekly started and visual inspection is performed every 4 months

Description The combination of low temperatures and high humidity can lead to ice accretion on the wind turbines blades. When the temperature is rising the ice can be thrown away and cause damage. An ice detection system automatically stops the wind turbine when icing conditions occur and thereby prevent ice throw. Ice falling from the stopped blades is unavoidable. The falling zone should be safeguarded if needed.

An ice detection system is in place. This detection must use one mature technology certified with the turbine.

Ice detection procedures exist and are used


Yearly test of the ice detection procedure

Ice detection procedures are yearly reviewed and new procedures are tested


The main risks linked with extreme weather conditions concern:

–       Heavy wind

–       High/low temperatures

–       Seismic activity

–       Lightning (is already assessed in a specific topic)

The risk for other extreme weather conditions (flood, temperatures) are extremely dependent on the wind farms location

Concerning seismic activity, the Eurocode 8 (or local equivalent) specifies the design requirements of structures for earthquake resistance. The design will depend of the seismic activity of the wind farm location.


 Correct wind turbine for wind class (IEC61400)

Wind farm location

Recurrence/Frequency  N/A

3. Management of risks related to critical components

Goal of this section is to ensure that measures are in place to manage risks related to critical components.


An internal maintenance organization or a long term wind turbine maintenance contract with a service provider will allow a guaranteed time or energy availability.

Critical equipment must be identified and it is important that the maintenance contract includes sufficient spares to perform the manufacturer’s required maintenance.

Failure of main components can lead to long downtimes. Business continuity and process start-up procedures are needed to control this downtime by preparing actions before the failure happens.

Accessibility of the site is also a key issue if spare parts of large dimensions must be transported.


A maintenance contract (internally or externally) is in place. The contract is managed so contractual agreements are respected.

Critical spares must be identified and available

Contract (balance of plant, crane,…), spare parts, management of obsolete components, procedures,… are in place over the business plan duration (and potential lifetime extension) to minimize downtime

Site is easily accessible


Strategy over the business plan are reviewed on a regular basis and minimally at major events on the fleet and contract modifications

Procedures are reviewed at each modification

Description Blades are exposed to great forces, high fatigue cycles and to various weather conditions. Monitoring the condition of blades is therefore important to prevent (unrepairable) damage. Adequate maintenance of the pitch system is needed to insure stopping power at extreme wind speeds.

Blade internal and external inspections (including lightning protection) are performed and actions are taken to repair damages

Pitch system is adequately maintained and monitored (grease samples, internal clearance measurements)


Blade inspection every 2 year

Yearly pitch grease analysis

Description The main bearing supports the main shaft, the hub and blades (or generator, the hub and blades for direct drive machines). This low speed bearing can suffer from accelerated wear due to different factors (lack or poor lubricant quality, wind shear, wake effect,…). Changing the main bearing is a challenging and expensive project and generates substantial downtime.

Availability of technical equipment and maintenance practices for the main bearing

Existing vibration analysis with associated expertise for detection and advices

Yearly grease sampling and analyses for grease cleanliness and wear particles

Recurrence/Frequency Yearly monitoring as a minimum
Description The generator is the electrical heart of the wind turbine since it converts the rotational energy into electrical energy.  It is exposed to highly fluctuating loads and, although generator failures are not very common in wind industry, the cost and downtime for swapping a generator can be substantial.

Generator is equipped with temperature measurements (bearing and winding), vibration sensors and automatic grease system

The generator is adequately maintained

Isolation resistance measurements are performed


The isolation resistance is measured yearly

For DFIG machines, slip rings are cleaned, measured and eventually ground on a yearly basis


The wind farms grid connection consists of switch gear and eventually a transformer. The transformer typically transforms the produced electricity from medium voltage to high voltage when the grid is requiring it. The switch gear on the other hand is designed to connect and disconnect, detect grid faults and protect the wind farm. A failure of one of these component almost directly lead to an unavailability of the complete wind farm or at least one of the branches.

Also the substation needs to be maintained and visually inspected.


Contingency plan for main transformer must exist and is complete

The transformer and switch gear are adequately maintained

Transformer oil and dissolved gas analysis is performed

Transformer is protected with a Buchholz relay or equivalent


The maintenance interval of the substation is yearly or shorter

Transformer oil analysed periodically (at least every 3 year)

Yearly thermographic check of high and medium voltage cells and cabinets (if safely accessible)

Description A wind turbine gearbox is the link between the rotating blades and the generator. It consists of a high number of rotating parts which are exposed to wear. Adequate maintenance and monitoring is needed to prevent damage and to achieve the planned life span.

The gearbox is adequately maintained and monitored (oil level, oil cleanliness, oil quality, temperature deviation)

Detailed endoscopic gearbox inspections are performed if required after alarm from the vibration monitoring system (VMS) and confirmed by oil wear particles analyses

VMS (vibration monitoring system) is installed and properly analysed with expertise support


Gearbox lubrication oil sample is taken and analysed at least every year

Detailed endoscopic gearbox inspection is performed during the first year after commissioning

Back To Top