A generator provides enough power for you to continue working in the event of a power failure.

Emergency Generators

Emergency generators are included in large buildings to supply power to selected equipment when the main power is lost. Although they are used infrequently, they must be tested periodically, typically an hour per month, so they need to be acoustically isolated. This requires treatment of both the exhaust and the inlet/cooling air. Inlet air is drawn in through the radiator by a fan and is used to cool the engine as well as to provide the combustion air. It circulates through the generator room and exhausts out again through silencers. The air intake has a large open area since the fan can accommodate only a small back pressure. The exhaust passes through one, or more often two, large mufflers. A design is shown in Fig. 16.38.

6.7.1 Power, Internet, and Other Cutoffs

Nearly all hydraulic closures in modern projects make use of external power supplies, telephone and/or internet connections; and occasionally drinking water and gas from public systems. All such supplies can fail. Most systems of hydraulic closures are for this reason provided with emergency supplies of these media.

Power supplies can be backed up by emergency generators, battery packs, or local solar or other power systems, whereby the first of these options (diesel generators) is still the most common. Internet-based systems can be backed up by wired (either literally or optical fiber) telephone connections, or the other way round. There are diverse possibilities in this field and the choices depend on the aspects like:

risk of a cutoff, that is, its probability of occurrence and potential consequences;

expected duration of a cutoff, if predictable;

acceptable waiting time for restoration of supply;

acceptable emergency operation scenarios by long waiting times;

presence or absence of personnel on the site; and

cost effectivity of suitable backup systems.

With respect to the first two aspects, the Working Group 137 of PIANC issued some recommendations concerning commercial power supply [50]. Power supply should, for example, be selected based on the reliability of continuous and adequate power source. The report advices investigating the operating adequacy and reliability of the power supply under both routine and emergency conditions, particularly for navigation structures making part of flood defense systems. The same issue was addressed by the PIANC Working Group 138 that issued specific recommendations in this matter concerning the design of mechanical and electrical systems [51].

Obviously, these recommendations can be followed if there is a substantial choice in the commercial power supply. In many cases in Europe however, even if there are different power suppliers they still share the same supply networks, which does not make much difference in their reliability. In the United States, this is sometimes the case too, but in other instances different power companies can provide separate main feeder lines. An important issue is then the choice between the so-called radial power system and network power system. The USACE manual [52] discusses both systems in more detail, as well as their advantages and disadvantages.

Therefore, it seems more important to focus on the resilience of hydraulic closures themselves against the failures of power and other media. A basic requirement in this view should be that power or other media cutoffs may not directly result in dangerous situations. For example, a gate carrying hydraulic load should not spontaneously open and an open gate should not spontaneously close in the case of power, Internet, or any other external failure. In general, measures against such failures should result from a thorough risk analysis, supported by fault trees that comprise also other possible failures.

Once a power cutoff occurs, it will still be necessary to keep (or to bring) the affected gate in motion. There are two main reasons for that:

Power cutoffs never happen at convenient moments. The gate is then often on its way to another position and must get there anyway; or another gate must soon be open, for example, to free the vessels trapped in the chamber.

Most hydraulic closures must still remain in operation under no-power conditions, even if at a very low speed and with some other restrictions. This is called emergency operation.

In many modern systems, the backup power source automatically takes over. This guarantees that the operation is continued on emergency basis. Depending on the character of hydraulic closure and the performances required, the backup power source may need to provide full or reduced power. Most USACE lock sites, for example, have full power backup capability. Several European hydraulic gates are equipped with power backups of reduced capacity. Usual reductions of gate motion velocity are then 1:20 to 1:40. If the drive system is electromechanical (see Chapter 11 for details), the provided emergency power is often too low to move the main drive machinery. Therefore, additional low-power motors are usually provided, with appropriate gears.

A “classical” example of such an arrangement is shown in Fig. 6.39 for a medium-sized vertical lift gate. Note that the electric motor of the emergency drive has here about 15 times lower power than the main drive motor. Moreover, it is an AC motor, while the main drive has a DC motor. The DC motors were for a long time considered as providing better speed control opportunities. This is, normally, less significant in emergency situations when gate movements are very slow anyway. See more discussion on such issues in Chapter 11.

Nearly identical arrangements are used on other sites that utilize winch-driven hydraulic gates, like the large rolling gates in Belgium or in the new Panama Canal locks, see Figs. 3.179 and 3.180. Moreover, similar solutions are, in fact, common for nearly all other types of hydraulic gates, including the miter gates. An example of the latter is the new Juliana Lock in Gouda, the Netherlands, of which the miter gates are moved by rack-pinion devices driven from a tunnel under the lock chamber. The photo in Fig. 6.40 shows the arrangements of both the main and the emergency drives for the gates of this lock. Note that the two gate leaves are driven by a single drive unit located in the middle between the vertical shafts of pinions that directly drive the leaves. This automatically solves the synchronization issue, much like in the winch-driven vertical lift gate shown in Fig. 6.39. However, the tunnel under the lock chamber makes this solution quite expensive and less suitable for very wide and/or deep locks with miter gates.

The provisions shown in Figs. 6.39 and 6.40 are, obviously, also beneficial for reasons other than to backup power supply in the event of a cutoff. These reasons can be, for example:

individual testing of a gated closure or its components at any time;

setting the system in other than fully closed or open position for inspection and maintenance;

temporary operation during replacement or repair of the main controls or other items; and

handling ship collisions and other unusual events not covered by the programmable logic controllers (PLCs).

There are also other means to increase the resilience of a gated closure against power, Internet, or other external supply failure. Human creativity is quite impressing in this field, so it is impossible to give examples of all such means. To conclude with, Fig. 6.41 shows two of the many arrangements that can reduce the consequences of such failures. Photo (a) shows a spindle jack with direct connections for both power and manual drive, which increases its resilience against power cutoffs. Photo (b) shows a mobile, joystick-like radio control panel developed for emergency control of gate operation.

In terms of control technology, the arrangement in photo (a) can be seen as a so-called “relay based control,” while that in photo (b) makes use of a PLC. Note that it is imperative on PLC systems that some sort of uninterruptible power supply be provided, while the relay-based systems are more robust and less vulnerable to events like loss of power or lightning strikes. Therefore, many engineers favor the relay-based systems, particularly in backup arrangements. More discussion on handling power failures on locks and dams is presented in USACE manual [52].

Emergency Generation

Most offshore production installations have three or four main levels of operation which are reflected in control systems such as the emergency shutdown (ESD) system (PART 2 Chapter 15). If, however, there is a very large gas leak such that the installation is enveloped in a gas cloud, it would be necessary to isolate all forms of electrical power capable of igniting the gas, including in some instances, the direct current secure supply batteries. Assuming this dire situation (usually called Level Zero) has not occurred, the first level of operation is on battery power only and is considered in the ESD section in PART 2 Chapter 15.

The next level of operation is with the emergency generator only running. The provision of an emergency generator is a statutory safety requirement and as such should be designed to provide reliable power for statutory communications equipment, navigational aids, fire and gas monitoring, ballast systems for floating units and, although not a statutory requirement, accommodation cooking, drinking water, laundry and sanitation facilities. As this generator must not be dependent on the platform production processes for fuel, it is invariably diesel driven. Storage of petrol or propane on the platform would be considered a hazard, which would rule out the use of a spark ignition engine for this purpose. Emergency generators are usually designed to be automatically started on failure of other larger generators in the installation, by use of ‘dead bus’ relays. Again, there is a statutory requirement that the starting equipment for this generator is capable of at least six start attempts, frequently with a second bank of batteries on a manual changeover switch.

This generator should be located in a ‘safe’ area, close to the accommodation, radio room and process control room. A ‘day tank’ is required near the generator, big enough to run the machine for the time specified in the relevant statutory regulation. The time will vary depending on other installation conditions such as whether it is regarded as a ‘manned installation’ or ‘normally unmanned installation’ but may be 24, 48 or even 96 h.

The following points are often overlooked in specifications for emergency generator sets:

Despite the small size of the prime mover, air intakes must still be provided with spark-arresting devices and overspeed flap valves to prevent ingestion of gas, and exhausts with spark arrestors.

Interlocking facilities must be provided to ensure that the generator circuit breaker cannot close on to an existing fault when the generator is automatically started.

In the event of a fault, means should be provided to maintain the generator output current for long enough to operate protection devices, where this is possible with the limited magnitude of fault current available from such a machine. Leaving the machine running with collapsed excitation is dangerous, as the fault may disappear followed by a sudden and possibly unexpected reappearance of full voltage on the system. Fig. 2.3.1 shows a photograph of the typical current design of an emergency diesel generator set.

The generator container should satisfy the following:

Be pressurised, with automatic shutdown on loss of pressure, or alternatively all equipment within the container (including the prime mover) would need to be approved for use in a Zone 2 area (as per BS-EN 1834).

Be fitted with overspeed protection on the diesel engine.

Be fitted with appropriate noise suppression for its location.

Be fitted with vibration reducing measures and sound isolating deck/structural connections/supports.

The exhaust pipe on the engine to be fitted with an approved spark arrester.

The electrical start battery to be fitted with a circuit breaker for ‘Level Zero’ installation ESD.

A drip tray for collecting any oil or diesel leaks to be placed under the engine.

All oil and diesel lines to be made of hydrocarbon-resistant material (reinforced hose or piping).

Diesel tanks that are located such that the diesel is gravity-fed to the engine to be fitted with a manual shut-off valve.

Air intakes to be fitted with gas detection, which is part of the installation’s central monitoring system.

Diesel engines to have an emergency stop on the outside of the container.

Machinery designed for unmanned operation to be equipped with monitoring facilities in the installation manned control room.

A permanent fire extinguishing system with automatic release to be installed in addition to a manual release located on the outside.

Be provided with protective earthing.

Be provided with equipotential bonding facilities.

Intrinsically safe (IS) instrumentation and telecommunications in the container will require an external separate reference earth.

The above-mentioned list is not exhaustive and will vary because of national standards, the installation’s safety case, the location on the installation and the geographic location.

If for some reason (e.g., located in open air) the diesel engine requires to be approved for Zone 2 operation, then it will be necessary to comply with BS-EN 1834.

Because of the safety criticality of the emergency generator, a robust well-proven design should be utilised and rigorous factory inspection and test procedures must be applied during manufacture.

Fixed Sources

Stationary sources such as pumps, compressors, fans, and emergency generators, which are a fundamental part of buildings, can radiate noise into adjoining properties. In previous chapters various metrics for characterizing the noise from these sources have been discussed. The equivalent sound level Leq will be used here as the primary descriptive metric. It has the advantage of being mathematically efficient for both fixed and moving sources, and correlates well with human reaction. The Leq for a fixed source can be calculated from the steady level emitted over a given time period:

(5.1)L eq=Ls+10log(t/T)

where

Leq = equivalent sound level (dB or dBA)

L s = steady sound level (dB or dBA)

t = time the source is on (sec)

T = total time T ≥ t (sec)

When the on-time is equal to the total time, L eq is equal to the steady level. Multiple sources may be combined using their individual Leq levels and Eq. 2.62, even if the on-times are not coincident. Twenty-four-hour metrics such as Ldn can be calculated for fixed sources in a similar way, from knowledge of the time history. For example, for a constant 24-hour source, the Ldn is 6.4 dB higher than the steady level.

Emergency Switchboards

The function of the emergency switchboard is described in PART 1 Chapter 1.

It is beneficial to provide synchronising facilities for the switchboard’s associated emergency generator. The generator has automatic start facilities which will initiate a start following a main generation failure, provided the start signal is not inhibited by one of the safety systems. The synchronising facility gives a convenient means of routine load testing for the generator, and allows for changing over to main generation after a shutdown incident, without a break in the supply. The switchboard should also include facilities to prevent the generator from starting when a fault exists on the switchboard. Interlocking must be provided between the emergency generator incomer and the incomer from the rest of the platform power system if synchronising facilities are not available. As the emergency switchboard usually feeds all the ac and dc secure supply battery chargers and other vital equipment, it is important that planned switchboard maintenance outages are catered for in the design. It is not usual to go to the expense of a duplicate bus switchboard, but certain battery chargers and other vital equipment are usually fed from an alternative switchboard via a changeover switch. These supplies should also include those necessary for starting other generators and for safe area ventilation, the basic philosophy being to allow continued safe oil production whilst the switchboard is being serviced.

Relay G: Range 10%–200%, CT Ratio 2000/1

In mode 1, the utilities switchboard would be feeding the emergency switchboard, as the emergency generator would not be running. From the load flow data for the emergency switchboard:

Load=455kW+jl93kVAr≈649Aat0.92powerfactor

Largest motorload≈84Aat0.8power factor

Motorstartingcurrent≈504Aat0.2powerfactor

Therefore the maximum load during the starting of this motor is:

Load−motorFLC+motor start

(597+j253)−(67.2+j50.4)+(100.8+j494)=939.6Aat0.67power factor≈1000A

Relay G must permit the maximum load without tripping and must also coordinate with the largest outgoing fuse on the emergency switchboard, i.e., fuse Cl (160 A) must operate before relay G. Coordination with relay T is not considered necessary, since the accommodation switchboard would be supplied through circuit F. Relay Y does not need to coordinate with relay G, since feeder Y is only used in mode 3 operation (emergency generator only). However, the setting of relay G must also allow for back feeding of the utilities switchboard via the emergency switchboard and therefore coordination with fuse W, the largest utilities switchboard fuse.

The maximum fault current through feeder G is 56,000 A (from fault calculations). The operating time t of fuse Cl at 56 kA is 0.01 s, from the fuse characteristic. The setting of relay G for coordination with fuse Cl is three times the fuse rating, i.e., 3 × 160 A = 480 A, but the maximum load is 1000 A.

For back feeding of the utilities switchboard, relay G must coordinate with fuse W, which gives 3 × 355 A = 1065 A. From the load flow results, the maximum current flow through feeder G in the direction of the utilities switchboard is 1032 A at 0.8 power factor.

The starting current of the largest motor is 261 + j1281. Therefore the maximum load is:

(825.6+j784.8) −(174.4+j130.8)+(261+j1281)=912.2+j1935undefined=2139Aat0.43powerfactor

Therefore use the nearest setting of 2000 A. This is also the rating of the transformer which feeds the emergency switchboard.

From the SC calculations, the maximum SC current at fuse W is 44.3 kA.

From the fuse characteristics, the fuse operating time t is 0.01 s.

Therefore relay G operating time is:

t+0.4t+0.15=0.164s

The fault current as a multiple of the relay plug setting is 44,300/2000 = 22.

Therefore, from the relay characteristic the operating time of relay G at a TMS of 1 is 0.3 s. The required TMS is 0.164/0.3 = 0.54 ≈ 0.6 (nearest upward setting; using a setting of 0.5 would reduce the grading margin).

Field Faults and Asynchronous Operation

If the generator field current fails and the generator is running as the sole supplier of power on the installation, the set will trip on undervoltage, causing a blackout until the emergency generator starts. However, if the generator is running in parallel with a second machine, it would continue to generate power as an induction generator, whilst demanding a heavy reactive power flow from the machine in parallel with it. Both machines will tend to heat up, and in some cases, it may appear as if the healthy machine is the offender. A field failure relay of the mho impedance type is normally used to protect generators from this condition. The generator reactance for a machine where the excitation has failed is not fixed but describes a circular locus, and so the relay characteristic should be set to enclose this locus as fully as possible.

Transfer switch

A transfer switch (TS) is a critical component of the emergency power supply system for any facility. It selects a power source, either standard utility company-provided power or emergency generator power, and conducts that power to critical loads. TSs can be manually operated (static TS), or they can be automatic triggering when they sense one of the sources has lost or gained power.

An Automatic TS is often installed where a backup generator is located so that the generator can supply temporary electrical power if the utility source fails.

A static TS uses power semiconductors such as silicon-controlled rectifiers (SCRs) to transfer a load between two sources. Since there are no mechanical moving parts (as in the case of the automatic version), the transfer occurs rapidly, in less than 4 ms (within 1/4 of an electrical cycle). Static TSs are used to transfer electric loads between two independent AC power sources without interruption.

Recovery

Recovery is a major part of addressing a disaster. It involves addressing issues remaining after the disaster has been mitigated. The cost for services and replacement of structures that might occur during recovery often involve FEMA and the identification of a disaster area by the president. As noted previously, the governor of the state(s) in which the disaster(s) occur must request the assistance on behalf of those who have suffered as a result of the disaster, according to the requirements of the Stafford Act,.

Private reimbursement for loss may be available through insurers. Insurance policies must have been in place prior to the disaster and must cover appropriate exposures (e.g., property, flood, business interruption, earthquake, terrorism/acts of war, equipment replacement, and equipment rental expenses) in order for many of the financial ramifications of disaster to be addressed. Assuming that the insurance purchasing authority for the organization has properly secured insurance, it is important to have up-to-date equipment inventories with replacement values assigned to each piece of equipment. Inventories including photographs of all fixed and possibly expensive) equipment) should note the age of the equipment and the expected life cycle. A master log and tracking system for all equipment that leaves the building during a disaster with patients and staff should be maintained. Locating displaced equipment can be almost impossible without a tracking system. Accurately record all expenses. This information will be necessary in order to secure insurance, FEMA, and state reimbursement.

Recovery assessment should be performed as soon as possible after the event. The first assessment should be a safety assessment of the structural integrity of the buildings. Clinical engineering should complete an inventory of all medical equipment for damage assessments. Take pictures of all equipment prior to cleanup. Decisions will need to be made regarding the repair of equipment. Identify the condition of existing equipment and develop a strategy for replacement/repair of equipment, what can be repaired cost effectively, and who should be performing the repair. Evaluate the cost and requirements of in-house versus contracted repair services. Track the repairs, cost, and time expended. Evaluate the effects of sudden power loss when bringing equipment back online. All settings and alarms must be tested before patient use. Document decisions to repair or discard equipment.

The engineering department should be debriefed as a team on the status of the facilities equipment, the staff's contribution to the disaster efforts, and next steps. In order to capture information about how effective staff activities were during the disaster, it is important to document the disaster-related activities of the department staff. A secondary benefit from this process might be that equipment that has not been located might be captured in staff activity documents. Ask the team to identify efforts of disaster assistance that could benefit from changes or improvement. Identify what worked well.

Richter (2003) identifies a number of common postdisaster problems that can occur. Some of the following can impact on clinical engineers:

Failure of water pressure

Failure of backflow protection systems

Failure of emergency generators, air conditioning, and public utility systems

Difficulties with special needs patients (e.g., ventilator, dialysis)

Detrimental effect on operating systems (e.g., technology availability) due to volume of patients, evacuees, and residents

Failure of telecommunications systems/staffing systems

Flooding of mechanical rooms, (e.g., patient floors, elevator shafts)

Waste management problems

Loss of equipment on, and damage to, hospital roofs

Obstruction from debris

Inability to secure electronic doors and alarm systems manually

20-3-4 Area events

•

Grass was allowed to grow in an open air switchyard without cutting it in time. One day the tall grass caught fire with the plant in operation. All the protection systems of the switchyard were triggered and all the external lines were lost. The emergency generators operated as planned.

A ‘flood’ of solid boric acid on the upper head of a pressurized reactor. A large amount of solid boric acid (hundreds of kilograms) was deposited because of a small leak of primary (borated) water on the vessel head, inside the thermal insulation cover of the head itself. This situation remained undetected until the first refuelling stop of the reactor (when the insulation cover was removed). Boric acid could have caused corrosion of other points of the vessel head, but, fortunately, this did not happen.

The fire at the Browns Ferry station in 1975 (WASH 1975, Appendix XI) is one incident that has shaped today's views on nuclear safety. In one of the station's BWRs, during a plant stoppage, a check for leaks in the containment electrical penetrations was made using the tried and tested method of observing a candle flame positioned near the point under examination. Movement of the flame indicates a leak, and although this method may seem primitive, it is effective. However, the candle method has at least one drawback: fire. A candle at Browns Ferry, first ignited the expanded polyurethane used as a sealant and subsequently many electric cables caught fire. The fire spread and, because, at that time, the rules on the separation of redundant divisions of electric supplies were not yet well established, the possibility of injecting water into the primary system for cooling of the shutdown core was lost. The operators struggled for more than nine hours to restore the operation of the necessary components (primary relief valves and primary feed-water pumps) before they succeeded. Moreover, the operators were very inventive on that occasion and, even if the normal operations of these components had not succeeded, they had prepared a special temporary connection to the auxiliary steam generator of the station in order to operate a feed-water pump and, therefore, they would have in any case controlled the difficult situation. The accident did not cause any radioactive release to the outside.

The fire at the Vandellos 1 station in Spain in 1989 (CSN, 1990) was an incident rich in lessons to be learnt on the ways to effectively fight fires (typical common cause of failure in nuclear plants). A sequence of events was started by a fracture in a turbine blade. Strong vibration of the turbine-generator system followed together with a fire of the turbine lubrication oil and of the alternator hydrogen coolant. The fire spread generating many types of subsequent faults, including an internal station flood. Here too, the personnel succeeded in maintaining the operation of the minimum number of components necessary to cool the (gas-graphite, UK-type) reactor. No external radioactivity releases took place. Many lessons were learnt about fire aspects of design of power stations.