Wind Turbine Public Safety Risk, Direct and Indirect Health Impacts

Any discussion of public safety risk in an industry has to consider the question of safety culture in the industry. Mature industry, for which we will use the nuclear industry as an example, (although we could look at railways, air travel, or other examples) recognizes that safety culture is critical to sustain and improve safety. One finds the term used in a common manner by the nuclear industry regulators, agencies, and operators, for example:

Regulator - Canadian Nuclear Safety Commission (CNSC)

Regulator - United States Nuclear Regulatory Commission (USNRC)

International Advisory Agency - International Atomic Energy Agency (IAEA)

Industry Association - World Association of Nuclear Operators (WANO)

Industry Association - Institute of Nuclear Power Operations (INPO) in the USA

Operator - Électricité de France (EDF)

Operator - Bruce Power (in Canada)

Safety culture recognizes the need for continuous improvement, and to achieve that the sharing of information about adverse incidents, or operating experience about best practices in a learning atmosphere. The World Association of Nuclear Operators recognizes that “operating experience is highly valued and the capacity to learn from experience is well developed.” ⁷ The industry recognizes and encourages sharing of experience by programs such as the IAEA Operational Safety Review Team (OSART) or the WANO Peer Reviews. The organizations maintain databases of operating experience that are available both to industry and to the public.

In contrast, the wind industry has not yet developed the maturity to recognize the importance of sharing of experience. Operating information, and particular information about accidents and incidents is classified as commercially confidential. In searching records of wind industry incidents, repeatedly one finds that those trying to assess safety in the wind industry state that the industry does not have a comprehensive listing of incidents and events that can be used as a learning tool.

In 2002, the Netherlands Agency for Energy and the Environment (NOVEM) commissioned a handbook (in Dutch) to give procedures for the risk assessment of wind turbines. ⁸ A paper describing the handbook was presented at the Global Wind Energy Conference in 2002. ⁹ At the time the Handbook was prepared, the authors used wind turbine failure information from a German database, a Danish database, and a Dutch database.

A revised version of the Dutch wind turbine risk handbook was issued in 2014, “Handboek Risicozonering Windturbines” ¹⁰ . The revised version states, “It is striking that wind turbine failure data are not kept centrally.” It goes on to note, “The Caithness Windfarm Accident database is the most comprehensive database of accidents that is publicly available.” The Dutch Handbook compared the Caithness database information on German, Dutch and UK turbines, and information from “Windkraft” Journals. The Caithness database was the most comprehensive, although some of the news media links it included were no longer active. The accident data in the Caithness database for accidents in the Netherlands was checked with two manufacturers who confirmed the data included most, but not all the failures that the manufacturers were aware of. The Handbook states that the missed number of incidents (for the Netherlands) does not exceed 10 to 20%.

A “text-mining” paper in 2017 ¹¹ that studied wind turbine accidents notes, “As of January 2016, the most extensive data available on the Internet on wind turbines accidents was published by the Caithness Windfarm Information Forum (CWIF).”

A second 2017 ¹² paper that presents a general review of typical wind turbine mechanical failures also references the Caithness database as it’s source of information about blade failures.

Even in 2018, another paper ¹³ that set out to provide an analysis towards integrating wind turbine failures with public safety risks, and expanded an existing Fault Tree Analysis concluded that information available about wind turbine failures is still limited and there is a lack of detailed descriptions of incidents in the recorded data.

Perhaps it is because of the lack of a comprehensive wind industry database that a number of reports in the media document where reporters have contacted the wind industry about a recent failure, to receive a response such as, “the company confirmed this sort of incident is extremely rare,” (in this case a fire destroying a Vestas V80 turbine in Murdochville, Quebec) ¹⁴ even though the Caithness database identifies a similar event of the identical turbine type occurred in neighbouring province of Ontario, Canada only 7 months earlier, a similar Vestas 90 turbine destroyed by file in the neighbouring state of Maine, also 7 months earlier, and a similar Vestas V90 turbine destroyed by fire in the province of New Brunswick, immediately south of Quebec less than 4 years earlier. Perhaps had the company representatives been aware of the 2 fires in wind turbines of the same manufacturer in neighbouring jurisdictions in the previous 7 months, or the 93 fires in all types of wind turbines reported in the Caithness Windfarm Accident Statistics in the 5 years leading up to the fire in Murdochville, the response may not have been the same as to describe it as “extremely rare.” Not having an industry failure database is a problem.

The 4 fires in Vestas V80 and V90 turbines in Quebec, Ontario, New Brunswick and Maine occurred in the 5 years from 2009 – 2013 during a total of 10,377 turbine years of operation (of various types and brands) in the 4 jurisdictions. A fire failure rate of 4/10,377 turbine years (of all types) can be expressed as 3.9 x 10^-4. However, if one considers only the year of 2013, then the 3 Vestas fires in Ontario, Maine, and Quebec occurred during a total of 572 Vestas turbine years of operation (if one includes the New Brunswick data to compare the same data set). 3 fires in 572 turbine years of operation can be expressed as 5.2 x 10^-3.

The pharmaceutical industry carefully tracks low failure rates. The European Drug Regulatory Agency (EMA - European Medicines Agency) defines “rare” as affecting between 1 in 1,000 and 1 in 10,000. Similarly, they define “very rare” as affecting less than 1 in 10,000. These are the same levels of definition for “rare”, and “very rare” adverse drug reaction as used by the World Health Organization. ¹⁵:

Very common >= 1/10

Common (frequent) >= 1/100 and < 1/10

Uncommon (infrequent) >= 1/1000 and < 1/100

Rare >= 1/10,000 and < 1/1000

Very rare < 1/10,000

By these criteria the description of the third 2013 fire in Vestas turbines of neighbouring jurisdictions in 572 Vestas turbine years (5.2 x 10^-3) might be considered as “uncommon” but certainly not “extremely rare” as described by the industry.

Another comparison of the difference between a mature industry and an immature one with regard to safety culture can be seen in the response to technical issues of concern that arise. In nuclear plant accident management principles it is common to have at least one senior individual maintain an overview of the progression of events of an accident, without being directly involved in the routine decision making steps. The reason for this is to avoid the common failing of “group-think” where everyone goes along with the common understanding of what is happening without challenging the norm. Someone standing back, maintaining an independent overview is more likely to notice something unexpected happening than a group of people who are all following the same sequence of events in their minds. Identification of the unexpected can be critical to the success of the accident mitigation. Safety culture recognizes the value of independent overview, whether by independent assessments, or by individuals holding back to not be encompassed by “group-think.” Kaplan and Mikes ¹⁶ present a business perspective on managing risk including discussion about the subject of “group-think”. The Kaplan and Mikes paper also uses the example of the Deepwater Horizon oil rig explosion to point out that management failures can cripple “the ability of individuals involved to identify the risks they faced and to properly evaluate, communicate and address them.”

Those setting up operational experience sections in the nuclear industry carefully studied incidents in other industries, whether they might be rail, air, sea transportation, aerospace, or chemical events. Events such as the Bhopal chemical release, the Challenger space shuttle disaster, the Exxon Valdez oil spill, aircraft crashes, and even subway train accidents were studied along with the Three Mile Island and Chernobyl nuclear reactor accidents, to look for common links. A memorable finding was recognition of the common thread of projects being pushed forward with inadequate recognition of concerns being raised by knowledgeable individuals close to the issue. As an example study of the Challenger space shuttle disaster found that prior to the launch failure, the concern of sealing O-ring failure at cold temperatures was raised by technical experts, but was dismissed by those focusing on the schedule constraints. The issue was used as example of an inadequate safety culture. In the wind industry, a parallel example is the identification of a potential harm causing sequence of events, to which the common “group-think” is that in 30 years of the industry, we have never seen any member of the public harmed by a wind turbine accident. Dismissing a possibility because it is not known to have happened is only forestalling the day when an accident that can do harm happens, people will be harmed, and the subsequent investigation finds a large group of decision makers saying, “but nobody told us it could happen.”

In a mature industry, dealing with identified concerns is important. It is not sufficient to ignore the concern, or to use the excuse “it has never happened before”. The industry with a mature safety culture will disposition the identified concern and either show why:

The event cannot happen, or

What mitigating barriers are in place to prevent harm from occurring, or

That the risk of the event is less than other accepted risks, and the possibility is clearly identified so that potentially impacted individuals can either accept the risk, or move away from the risk zone. In some cases accepting this latter option may require compensation to enable the person to re-establish their life elsewhere.

As safety culture grows in an industry, and the importance of learning from the experience of others becomes ingrained, the openness of the industry increases. The secretive culture that restricts information as commercially confidential, for the advantage of some, is replaced by a culture that recognizes that success in an industry means that all players, and the public are winners.

An indication that the wind industry has embraced a true openness safety culture will be evident when those performing a risk evaluation no longer have to turn to a public database of failures maintained by a citizen group such as the Caithness Windfarm Information Forum. ¹⁷ Presumably an industry database should be able to be more inclusive of information such as accident details and turbine specifics than one that has to depend on media reports as its auditable source of information. Having that information readily available will be an asset to the industry, to decision makers, and to the public.

The Starr paper of 1969 identifies a useful beginning point suggesting, “the risk measure used here is the statistical probability of fatalities per hour of exposure of the individual to the activity considered.” ² For an individual impacted by wind turbines, the relevant risk is not the risk averaged over the year, but the risk at the time the individual is exposed to the risk.

The first conclusions of the Starr paper are also relevant to our study:

1) The indications are that the public is willing to accept “voluntary” risks roughly 1000 times greater than “involuntary” risks.

2) The statistical risk of death from disease appears to be a psychological yardstick for establishing the level of acceptability of other risks.

3) The acceptability of risk appears to be crudely proportional to the third power of the benefits (real or imagined).

4) The social acceptance of risk is directly influenced by public awareness of the benefits of an activity, as determined by advertising, usefulness, and the number of people participating.

The study of safety considerations from large wind turbines has a considerable history. The earliest relevant paper determined by the Google Scholar search described for this paper was written in 1979, by Dwight Reilly ¹⁸ of the United States National Aeronautics and Space Administration (NASA) who were developing the 2500 kW Mod-2 wind turbine prototype. The paper notes, “From the outset of the program the designer must address, in a formal and disciplined way, the issues associated with safety of hardware, safety of the environment and above all safety of the public and the construction and maintenance personnel.” There was of course no failure data, as at that time the turbine had yet to be erected.

Over the next decade, a succession of papers were issued ^{19, 20, 21, 22, 23} all dealing with the creation of calculation models, and considerations for calculation of trajectories of detached wind turbine blades, beginning from simple ballistic models to more complex Monte Carlo methods. In each case, the models were based on assumptions of blade throw dynamics, with little actual throw data to verify the models.

A number of papers have titles incorporating terms similar to “probabilistic risk assessment for wind turbine” or “reliability analysis methods for wind turbines” ^{24, 25, 26, 27, 28, 29, 30, 31, 32}. Examination of the papers determines that they are based on stochastic (i.e. random failure) models for maintenance optimization for the turbines, and are based on normal design conditions for wind load and blade strength, but not extreme failures, and do not generate data directly related to public safety such as distance travelled by failed components.

Finally, a number of most recent papers ^{33, 34, 35, 36, 37, 38, 39} are related to the risks from wind turbines. Where the papers indicate that they are related to public safety, they have been reviewed for relevance. Two of the papers ^{33, 36} calculate a blade failure frequency and discuss public safety, but do so based on a stochastic assessment of factors such as material strength, wind speed, and rotor speed. The papers were reviewed to determine if they included other severe factors that have been related to blade failure – lightning strike, fires from the nacelle progressing to the blades, tower contact by the blades, or severe weather conditions. These factors do not appear to be included in the referenced papers, and the papers do not address blade pieces actually falling to the ground where they would result in a public safety risk.

A consideration in many of the referenced papers for wind turbine risks is that carrying out the design of wind turbine systems on the basis of a probabilistic (also known as stochastic, or random) safety analysis, would result in requiring a smaller safety factor than required by a deterministic safety approach. In short, the design would cost less. This approach has been carried forward from design into the public safety arena, by calculating for example a probabilistic risk of a blade failure. That calculation assumes the random risk of the accident such as a lightening strike, the random wind direction that might be present that would affect the direction the damaged blade might fall in, and the random chance of a person being present where the damaged blade falls. These were argued to present a more realistic model of a person being injured by a falling blade, than the classical deterministic blade failure model. The classic deterministic model assumes the failure probability that occurs, and assumes that a person may be present in the impact area if there is no mitigating factor (fence for example) that prevents the person from being in that area.

It is important to consider how a mature industry treats the progression from a deterministic to a probabilistic safety assessment. A simplified explanation of the difference between deterministic and probabilistic risk assessment is given by the Web site http://www.preventionweb.net/risk/deterministic-probabilistic-risk Deterministic analysis is based on historical events, while probabilistic risk is based on future events that may not have happened yet. In the deterministic safety analysis in the nuclear industry for example ⁴⁰, the analysis starts with identifying possible initiating events that can impact public safety, and then determines that barriers are in place to prevent the initiating event from causing a public safety impact greater than acceptable limits. The industry then proceeds to also conduct a probabilistic safety assessment ⁴¹, that considers the probability, progression, and consequences of equipment failures or transient conditions from which it derives numerical estimates to show a consistent measure of safety for the facility. The goal of the probabilistic assessment is to identify the main contributors to risk, such as for example a loss of power that results in a loss of cooling flow over the fuel, that results in overheating, so that protective barriers can be assured for the initiating event. The analysis might identify the need to ensure an additional power supply backup, or more reliable backup power transfer electrical breakers for example. Part of the goal of a probabilistic risk assessment is to identify potential accidents that have not happened. Still, the analysts must start out with a deterministic assessment to ensure protection against known accident sequences.

The critical beginning point for any safety assessment is to determine the possible initiating events, and this is why having a database of known accidents is so important.

We begin in this paper by considering real data for accidents that may harm the public. Rather than looking at hypothetical accidents, we consider ones that we have fairly good confidence of the consequences of the accident. For this we will focus on real accidents that have occurred to wind turbines in the province of Ontario.

An assessment example is presented for the case of the 2546 industrial sized wind turbines in service the Canadian Province of Ontario by June 2018. Table 1 provides data for the 7 known failures in Ontario that resulted in blade pieces on the ground.

Failure #1. Television news broadcaster “CKNXA Channel” (now an affiliate of the Canadian Television Two (CTV 2) Network) in their news broadcast on April 28, 2007 documented blade damage in the Port Burwell wind turbine array. The news clip shows video of the reporter standing behind sections of failed wind turbine blade on the ground, with the turbine in the background. The video demonstrated that blade portions larger than the reporter hit the ground at a distance from the turbine. The newspapers “Simcoe Reformer” and “The Tillsonberg News” also documented the failure.

Failure #2. The Sault Star, Sault Ste. Marie, Ontario on February 22, 2008 documented blade damage in the Prince Wind Farm array in the news article “Wind Too Much for Turbine”. The article states, “An extensive investigation is underway to determine why the turbine sustained a damaged blade and has been inoperable for more than three weeks. "We believe the blade was damaged after the turbine shut itself down," said Jim Deluzio, general manager of Ontario Wind Operations with Brookfield Power Corp. "The investigation will look into the possibility of a defective blade. Winds were high but the blade should not have been damaged." The photograph of the turbine in the newspaper article shows a blade missing the internals.

Failure #3. A fire that destroyed wind turbine T19 in the Kingsbridge I wind turbine array in April 2013 was documented in a presentation by the site manager of the array operator to the Township of Ashfield-Colborne-Wawanosh municipal council on April 2, 2013. The Council minutes record, “Dan Hayden of Capital Power addressed Council in regards to the fire at the Wind Turbine early this morning, and gave a detailed verbal report.” Citizens present at the council meeting note the report documented that burning portions of the wind turbine (nacelle and/or blades) extended beyond 200 metres from the wind turbine tower. (Figure 3)

Figure 3.Kingsbridge I – T19 Apr 2, 2013 - Used with permission of Michael Leitch

Failure #4. The London Free Press, on August 4, 2015 documented failure of a turbine blade in the Goshen wind turbine array, noting, “Closer to London, officials from wind-energy giant NextEra Canada are investigating what mangled one of their turbines southwest of Exeter late Sunday or early Monday morning. One of the giant 50-metre-long blades on the turbine appeared to have snapped on the turbine tower that is part of the Goshen Wind Farm in South Huron.” Figure 4 (photographed within 24 hours of the failure) makes it clear that little of the blade internals remained with the turbine, but they were on the ground. The Figure also shows the array output at the time of the failure.

Figure 4.Goshen Wind Array, Turbine #85 Failure and Output Just Before Failure

Failure #5. CTV News documented failure of a Bornish wind turbine as having occurred on April 20, 2017. The documentation included photographs showing the damaged blade, without the internal structure. (Figure 5)

Figure 5.Bornish Wind Turbine – Used with permission of Scott Miller CTV News

Failure #6. Both Canadian national television networks CBC and CTV documented the collapse of a Raleigh (formerly known as Dillon) wind turbine early in the morning of January 19, 2018. The company later reported that the cause of the turbine collapse, which buckled the support tower in the middle, resulting in the nacelle and all blades on the ground, was as reported by CTV News “a single faulty blade.” The Sygration.com ⁴² chart of the Dillon Wind Power Array output for January 18 & 19, 2018 is shown as Figure 6A and the Raleigh Wind Farm Weather Conditions as Figure 6B. The electrical output shown on the Sygration.com site is derived from the public information published by the Ontario Independent Electrical System Operators (IESO) in the Generator Output and Capability reports. ⁴³ The Electrical Output chart shows a drop in output consistent with the wind speed drop shown in the Raleigh Wind Farm Weather conditions monitored at the Ridgetown Environment Canada monitoring site (shown as R on the chart) located about 10 km east of the turbine array, and the Chatham-Kent Environment Canada monitoring site (shown as CK on the chart), located about 10 km west of the turbine array. The Environmental Canada Historical Data available by site and date ⁴⁴ shows a wind speed reduction for these sites at about midnight on January 18 (the 24 hour time on the chart), and the array output is seen to reduce to zero as the wind speed picked up the next morning, when the turbines were taken out of service.

Figure 6A.Raleigh (formerly known as Dillon) Electrical Output Jan 18, 19, 2018

Figure 6B.Raleigh Wind Farm Weather Conditions, Jan 18 & 19, 2018

Failure #7, of a Huron Wind Array turbine occurred on May 4, 2018. It was possible for the author to photograph the failed turbine within hours of the failure, and to map out the debris field early the next morning before any debris collection had occurred.

The debris field was generally downwind of the turbine, in the direction of the wind at the time of the blade failure. Mapping major debris showed:

No debris from the tower to a distance 150 m from the tower.

Debris 1.2 m x 3.6 m at a distance 150 m from the tower.

Debris 1 m x 3.6 m at a distance 170 m from the tower.

Debris 1.2 m x 3.0 m at a distance 210 m from the tower.

Debris 1.2 m x 3.0 m at a distance 280 m from the tower.

Debris 1.0 m x 0.15 m at a distance 560 m from tower.

Minor debris pieces (smaller than about 0.2 m x 0.2 m) were seen scattered through out the debris field at distances from 150 m out to about 600 m. (Figure 7)

Figure 7.Huron Wind Blade Failure Debris Map

Calculation of valid and reliable wind turbine failure rates requires a criterion supported by three aspects:

A clear understanding of what failure rate is being tracked. For this study the data to be tracked is the simplistic frequency in events per turbine year in operation of industrial sized (greater than 50 metre hub height, and greater than 40 metre rotor diameter) wind turbine failures that result in blade pieces falling to the ground. These may result from blade failures, tower collapse, nacelle or rotor collapse, or fire that causes burning blades so that burning pieces may fall to the ground.

Detail of the specifics of the failed wind turbine – size, type, and time in service.

Details of the exposure time in service.

The reason for tracking the exposure time for the failed turbine is to be able to make an assessment of the failure compared to the well-known “bathtub” curve of failure rates. A description of this may be found in the papers:

“The Bathtub Curve and Product Failure Behaviour” – Part One – The Bathtub Curve, Infant Mortality and Burn in. ⁴⁵

“The Bathtub Curve and Product Failure Behaviour” – Part Two – Normal Life and Wear-Out. ⁴⁶

A simplified version of “The Bathtub Curve” for failure behavior is shown in Figure 8.

Figure 8.Bathtub Curve – Product Failure Rate

The figure shows that when a component is new, or a new design is introduced, the failure rate is typically higher during the prototype testing. At some time, the failure rate will have reduced to what is considered an acceptable value for commercial use, and the component is released for use. However, for demanding use, commonly known as “Mil-Spec” the end user may demand that the initial burn in period is extended until the failure rate falls to a constant rate, where failures are dominated by random (or chance) events, rather than the higher rate for a new component. The useful life of a component is usually considered to be bounded by when the failure rate starts to increase due to wear out. Depending on the user, the end of life is determined to be when the failure rate rises to what is considered to be their limiting value. For demanding users, this may be when the failure rate just starts to increase, while for some commercial users, a higher failure rate may be considered as economically acceptable.

In a similar manner as to tracking the lifetime failure rate of components in a nuclear plant, it is important that the failure data be for similar components so that the results can be representative. For example while early wind turbines had rotating blade tips for their braking system, modern turbines (constructed in the last 15 years or so) no longer use rotating blade tips, so failures caused by that component are not really relevant.

Similarly, since the Caithness Windfarm Information Forum database tries to collect any information about a wind turbine failure from public news sources, it may include information about smaller turbines as installed by a single resident. It is not really representative to include failures of a 10 kW machine with a 10-metre blade diameter with larger MW class turbines when calculating failure rates.

Some papers have presented information about the desirability of being able to specify accident modes more precisely, so as to be able to prepare a detailed probabilistic risk assessment, to show the true root cause of a consequential failure. While this is a desirable objective, unfortunately the information available in public databases is not sufficiently detailed to be able to determine the root cause in most cases. As an example of the lack of data we will consider the failure in January 2018 of a GE 1.5 MW wind turbine in the Raleigh Wind Power Array in Chatham Kent, Ontario. ⁴⁷ This was a turbine with a 1.5 MW generator, a nominal 80-metre hub height, and a nominal 78-metre rotor diameter. It was placed in service in January 2011. The failure, resulted in a buckling of the turbine support tower, so that all blades, and the nacelle could be seen in a report and photograph on both the CBC and CTV National News as catastrophically damaged at the base of the tower. After investigation, the operator, TerraForm Power reported that “a single faulty blade” caused the wind turbine to collapse. ⁴⁸

In general terms, the public CWIF database could only say, “tower collapse” as in the news media report. Even the manner in which a “single blade failure” might result in the tower collapse was not reported in any further detail. To properly prepare a fault tree based risk assessment, one could report the cause of a tower collapse in many ways, as was done in the paper “Towards analyzing public safety risk from wind turbines” ³⁶ published January 2018 in the Journal Reliability Engineering and System Safety. That journal article identified the event “collapse of tower” (a failure somewhere along the tower length) as opposed to a “toppling of tower” (due to a break at ground level or a mounting failure) as possibly arising from one of three possibilities:

Fatigue of material, from any of four possibilities:

 Higher loads attributed to wake effect

 Excessive “fibration” (vibration?) attributed to wind loads

 Airflow load from blade swinging along tower

 Production faults in steel

Extreme loads, from either of two possibilities:

Typhoon / Tornado

 Earthquake

  Blade hits tower, from any of three possibilities:

 Loss of a blade

 Partial blade break

 Extra bending of the blade attributed to turbulent wind

Presumably, a more detailed fault tree might also include these other possibilities for a tower collapse:

Overspeed of blades, resulting in blade tip contacting tower arising from:

 Brake failure following separation of turbine from electrical grid.

 Gearbox failure, resulting in rotor speed increasing.

 Control system failure allowing non-asynchronous turbines to accelerate.

 Control system failure allowing an asynchronous turbine to overload, increasing blade bending until contact occurs.

Overload of turbine, increasing blade bending, resulting in contact from:

 Cold weather operation, increasing air density.

High winds coupled with control system failure to shutdown turbine.

Because not all of the wind turbines in Ontario were placed in service at the same time, calculation of the failure rate needs to consider both the time in service at the time of each failure, plus the total time in service of Ontario wind turbines at the time of the failure, as shown in Table 2.

In Table 2, not only is the arithmetic failure rate shown, but also the statistical Chi Squared Confidence Level value of the failure rate. Use of the Chi-squared value helps to give an indication of the confidence that the actual failure rate will be represented by the value shown. The 50% confidence level (α) means that we are confident that the failure rate shown will be smaller than the value shown 50% of the time, and will exceed the value shown 50% of the time. The 90% confidence value means that we are confident that 90% of the time the failure rate will not exceed the value given. The data in the table shows that when the number of failures is low, and the total years in service value is also low, the Chi-squared confidence level failure rate will be quite a bit higher than the pure arithmetical failure rate. However, as the number of failures grows, and the total years in service grow, then the Chi-squared confidence level failure rate becomes closer to the arithmetical failure rate.

The failure rate for the arithmetical value and the Chi-squared value against the years in service is shown in Figure 9.

Figure 9.Arithmetical and Chi-Squared value for Ontario Wind Turbine Failures

Figure 9 shows that the failure rate is fairly constant for the Total Turbine Years in Service above about 4000 turbine years. This suggests that the amount of data is sufficient to predict the failure rate, and that the failure rate is in the random failure (or normal lifetime) period.

A simplified overview of the calculation of confidence levels is given in the somewhat dated book from 1974 titled, “Pocket Handbook on Reliability” ⁴⁹ issued by the Chief of the Reliability and Maintainability Division of the US Army Aviation Systems Command, noting it is an education handbook for engineers and managers who do work directly in reliability and who must communicate with other individuals who do likewise.

Failure Rate = Χ²_{α, 2r+2} / 2T

Where Χ²is the Chi Squared Value (which may be determined from tables or computer calculation) for the confidence level α, for the case of 2r+2 “degrees of freedom”, and r is the total number of failures occurring in time T.

When we look at the 50% Chi Squared Value of the failure rate after 7 failures, we read it is 0.000522. Taken another way, the reciprocal suggests the mean time between (wind turbine) failures (MTBF) in Ontario is (1 / failure rate), or 1915.7 turbine years. The data is showing that we can predict that a turbine failure occurs in Ontario about every 1915.7 turbine years in a fleet of 2546 turbines (possibly somewhat sooner 50% of the time, or possibly somewhat later 50% of the time, although the level nature of the data, and the closeness of the 90% confidence curve suggests the prediction is reasonable). Alternately we see that on average, the expectation is one turbine failure every 9 months for the province of Ontario. Another way of looking at this is to say that in a moderate sized turbine array of 75 turbines, the expectation is for one turbine failure every 25 years. To understand how we perceive these sort of numbers, we have to turn to our human nature.

Statistics Canada tells us there are about 14 million people in Ontario. For a population of that size, a frequency of one wind turbine event in nine months appears negligible, and there is little probability for these failures to be discussed as a provincial priority. Provincially, we focus instead on more frequent occurrences that impact more of the population rather than on individual risk. For example, the statistics for 2016 ⁵⁰ show 483 persons killed that year in 35,972 fatal and personal injury motor vehicle collisions. The same data shows that 1 in 20,000 drivers can expect to be killed in a motor vehicle accident per year. That is the sort of figure that gets provincial attention. However, there are factors that influence the probability of being involved in a motor vehicle related death. Drinking and driving, inattentive driving, speed-related collisions, and not wearing a set belt are (in total) related to 67% of the road fatalities. Thus the choices a driver makes can impact the probability of an accident. (Even when sometimes it is the “other driver” in the collision who is the cause.) Even choosing when to drive, such as considering the weather conditions, can be an important factor. If the roads are icy, or fog shrouded, a cautious driver may delay a trip that is not an emergency. The same cannot be said for wind turbine accident probabilities that the potential victim has no control over, although the cautious neighbour may choose to not walk on their own property if the wind is high. That raises a different legal question about being deprived of the enjoyment of use of property for those living near wind turbines.

Another example shows that it is not only high frequency events like highway accidents that garner provincial attention. A paper ⁵¹ published in 2014 examines all deaths caused by anaphylaxis in Ontario for a 25-year period. In those 25 years, the authors found that of the 92 deaths related to anaphylaxis, 12 of those deaths related to youth less than or equal to 18 years of age, while the majority related to adults. Peanuts and tree nuts related to less than 25% cases, while insect venom, reactions to medication, foods other than nuts, and unclear causes represented the bulk of the cases. The website, Food Allergy Canada ⁵² estimates that almost 500,000 children in Canada have food allergies and that peanut allergy in Canada affects about 2 in 100 children. From this, we might expect about 200,000 children in Ontario to have food allergies. This is of a population up to age 19 in Ontario of 3,019,640. ⁵³ The frequency of death of youth due to anaphylaxis is less than 1 in 2 years, or 1 in 400,000 exposure years of potentially impacted children, a frequency of 2.5 x 10^-6. To protect vulnerable members of society subject to this accidental rate, every school, and many recreational facilities that one may enter in the province of Ontario has a sign on the door noting that the facility is “nut-free” or at the very least, “nut-aware”. Ontario passed “Sabrina’s Law” in 2005 “Bill 3: An Act to Protect Anaphylactic Pupils” which applies to all publicly funded schools in Ontario to protect children from food allergies requiring every school board in Ontario establish and maintain an anaphylaxis policy to help students with serious allergies. ⁵¹ Society does recognize the need to protect vulnerable members from some causes for an event with a frequency of 2.5 x 10^-6 for impacted children.

Meanwhile the 2546 wind turbines currently in Ontario are permitted by regulations to be installed as near as blade length + 10 metres from roadways or the lot lines of neighbours when the failure rate experienced in Ontario is 5.2 x 10^-4 that have put blade parts on the ground. Neighbours of those wind turbines are protected by standards that exhibit a different level of care. The neighbours are expected to voluntarily avoid the part of their property that is next to the wind turbine sites where those blade parts may fall. Similarly, the protection for the 6,550 daily drivers on provincial highway 21 that pass the location shown in Figure 10⁵⁴ expects them to heed the blue sign that states in print too small to be read from a vehicle, “Caution – During potential icing conditions stay back 305 metres from wind turbine.” Yet, the highway edge is about 121 metres from the wind turbine, so compliance would mean the driver could not travel down the highway, yet the highway is not closed.

Figure 10.Turbine highway icing caution. Blue Sign Reads “CAUTION – DURING POTENTIAL ICING CONDITIONS STAY BACK 305 METRES FROM TURBINES”

The literature review identified few references specific to the relationship between wind turbines and highway safety. A recommendation issued to the Dutch Society for Energy and the Environment (NOVEM) in 1992 ⁵⁵ related mostly to the installation of guardrails to prevent drivers hitting wind turbines very near to the highway. There were no considerations in the paper of objects or ice falling from the wind turbine other than for collision with ice or parts that had already fallen. The paper did identify potential concerns from noise impacting signals, air turbulence, flashes and glare, or distraction of the driver. A paper in 2012 ⁵⁶, considered risk assessment of wind turbines close to highways, concluding that the risk of being hit by wind turbine material or ice was very low compared to the statistical risk of losing one’s life in an accident along the highway. Finally a 2017 paper ⁵⁷ studied driver behavior in an already industrialized location in Rotterdam after the installation of wind turbines. The authors found the mean speed of drivers was lowered, but the standard deviation of the vehicle speeds increased significantly. They also found that drivers shifted their travel position in the traffic lane to be further away from the wind turbines. While little immediate adverse effect was noted, the authors recommended continuing the study.

As final examples of the difference in protection afforded different hazards, a driver of a motor vehicle in Ontario is not allowed to smoke in the vehicle if there is a child on board. Similarly a smoker is not permitted to smoke in a public building, or within 9 metres of any entrance. Yet, a property owner can sign a lease to site a wind turbine on that property waiving any setback protection, even though there may be vulnerable age children living in the home on the property, there may be employees of the lease holder working on the property, or delivery couriers may have to deliver to the property. These vulnerable people will be put at risk without their permission by the lease signed by the property owner.

These differences demonstrate that the hazards posed by wind turbines do not generate the same level of concern as other issues. Unfortunately for those living near wind turbines, driving on the roadways beside them, or for the children living in homes where the owner has signed a lease permitting wind turbines on the property, their numbers are not a big part of the general population. The small minorities who are impacted without protection are expected to voluntarily tolerate the risk that is not faced by others as part of their daily life. It becomes a justice issue as to why a few are placed under increased risk due to inadequate protection policies.

In addition to the 7 identified wind turbine failures in Ontario, each wind turbine array in cooler climates may be susceptible to icing a number of times during the winter or early spring. The subject of ice falling from stopped wind turbine blades, or being thrown from moving wind turbine blades has been extensively studied. Early work ^{58, 59} identified a model for calculation of ice travel distance, and used a Monte Carlo analysis to determine the risk of hitting a person standing in a particular location. Initially a “safe” distance of 230 metres was suggested, beyond which ice would not be thrown. The work developed into an IEA (International Energy Agency) Working Group, the “Wind Energy Production in Cold Climate” group that met periodically at BOREAS (the Greek God of the North Wind) Conferences. ^{60, 61} As the models became more developed, it was possible to identify a risk of 10^-6 occurring at a distance of 350 metres from the turbine tower, and a risk of 10^-4 at a distance of 225 metres. A simplified empirical model was developed which suggested an ice throw distance of d = 1.5 x (D+H) where d is the ice throw distance, D is the rotor diameter, and H is the turbine hub height when a turbine is operating, or d = v x (D/2 + H) / 15 where d is the ice throw distance, v is the wind speed (in metres / second), D is the rotor diameter and H is the hub height when a turbine is shutdown. These become known as the Seifert model, from the name of the originator. Further work suggested ⁶² that “according to a risk assessment the danger to get hit by a piece of ice from a wind turbine can be quantified as considerably low to individuals and objects beyond distances of 200-300m.” A turbine manufacturer issued an advisory notice ⁶³ quoting the formula from the Wind Energy Production in Cold Climate for a safe distance of 1.5 x (hub height + rotor diameter), and noted this was recommended by Germanisher Lloyd as well as the Deutsches Windenergie Institut (DEWI), but added the actual distance was dependent on turbine dimensions, rotational speed, and other factors.

Early Ontario experience documented ice falling from a Tacke TW600 wind turbine in Bruce County. This turbine had a 50-metre hub height and a 42-metre rotor diameter. The experience was documented in a Garrad Hassan report ⁶⁴ prepared for the Canadian Wind Energy Association (CanWEA) for 13 events from 1995 to 2001. From that report, we read:

10 Jan 1998 - “There was some ice build up on blades during a freezing rain event, all ice fell off and unit ran OK” “Many ice pieces, largest piece was 12x12x2 inches, pieces up to 100 m from tower”

23 Feb 1996 - “About 1 ton of ice on ground. During my weekly inspection, found many pieces of ice at base of windmill. Pieces of ice had same curve as blade therefore these pieces of ice came from the leading edge of the blade. Estimated about 1000 pieces on ground. The largest pieces were 5 inches long 2 inches thick and 2 inches wide. The pieces were scattered up to 100 meters from base of windmill in same direction as blade arms were pointing – this was in the north-south direction as the wind was coming from the east. Most pieces were found within 50 meters from tower base”

Research in Europe continued to refine the ice throw / ice drop models. ^{65, 66} The 2010 report from VTT Finland noted that during cold weather operation a notable occurrence was the over-rating of turbines. The example was given of a 600 kW Tacke turbine in Ontario that showed output of 950 kW during -20°C weather resulting in the generator overheating and tripping out. A thorough review in 2011 for Nordic Energy Research shows the diversity of opinions and evidence about ice throw / ice drop. The report identifies first (page 34) that “The majority of recorded fragments of ice shed from wind turbines shows they have landed less than 100 m from the turbine.” (Quoting from the Garrad Hassan report of 2007 for CanWEA for a 50-metre turbine hub height with a 42-metre rotor diameter.) The next paragraph states, “Ice throw (shedding) has in Canada been a question of public safety in the regulatory process of wind farms. Thus measures have been taken in order to enable wind power development. In 2007 CanWEA suggested a minimum distance of blade length plus 10 metres from public roads, non-participating property lines and other developments to ensure public safety in the event of ice shedding.” On the next page, the report states, “In Finland two risk analysis’ of ice throws has been carried out in the last years by Ramboll.” The report then presents it’s Figure 6, to show, “In Rauma the conclusion of the work was that 70% of the ice pieces will be thrown 270 metres from turbines at the most.” The figure shows that 70% of the ice pieces corresponds to 6640 pieces. However, although 70% of the ice throw events are within 270 metres, the remaining 30% of the pieces (2875 pieces) extended out to 770 metres, with 15% of the pieces landing from 410 metres away from the turbine tower out to 780 metres.

The series of photos in Figure 11 shows ice falling from a shutdown Vestas V82 turbine with an 80-metre hub height and an 82-metre rotor diameter in Bruce County on April 12, 2013. Ice was falling in contiguous pieces over 50 cm x 20 cm to the ground, landing at locations 50 to 55m from the tower. The nearest Environment Canada weather station at Wiarton, Ontario ⁶⁷ shows the wind there was about 22 km/hr. (~ 6.1 m/s at the 10 metre level) during the time when video was recorded from which the time lapse photography was derived. The day was grey, and wind shear would likely have been low, suggesting a hub height wind speed of about 8.5 m/s. (6.1 m/s x (80m/10m)^0.16 ) Measuring the time from videos for the ice falling time showed the time from ice coming off the blades to hitting the ground was about 6.5 to 7.5 seconds. This would be consistent with the displacement from the tower as an average wind speed of 7 m/s x 6.5 to 7.5 seconds would result in a displacement of about 45.5 to 52.5 metres. With only a moderate increase in wind speed, or wind shear, or in the presence of a stable atmosphere the ice pieces would be carried horizontally a greater distance, or if the turbine was operating as may have been experienced with a considerably smaller turbine in the example of the Tacke TW600 turbine previously discussed. Today’s taller turbines will permit a longer drop time, and thus further horizontal displacement, even if the wind turbine is initially shutdown. It is notable that many of the ice sheets coming off the blades that carried away from the stopped turbine were hitting the ground intact, in contiguous pieces, rather than being broken into smaller pieces as suggested in the 2011 review for Nordic Energy Research. ⁶⁶. Pieces falling under the blades were often seen breaking into smaller pieces due to contact with the tower. This observation is consistent with that reported in the 2010 VTT “State of the Art Review” ⁶⁵ of the IEA Task 19, “The experience and the results of many calculations show that during the operation small fragments are hitting the ground in a longer distance than large pieces whereas from stopped turbines the larger pieces can be transported wider than small ones.”

Figure 11.Time Lapse – Circled Ice Falling from Stopped Turbine in Bruce County

Another sequence of photographs of ice on GE 1.5 MW sle turbines in Dufferin County, Ontario was taken on January 10, 2010 as shown in Figure 12. The photographs show locations on the turbine blades from which ice has fallen, and show a school bus passing down a roadway setback about 66 metres from turbines that were shedding ice. It is of concern to compare this setback distance with the data in the research at the Rauma site in Finland, ⁶⁶ where 70% of the ice travelled 70 metres or more.

Figure 12.Icing of GE 1.5 sle turbine – Used with permission of Michael Pobjoy

A possible explanation for the small setback distances might be gained from the Master’s Thesis of Marmutova ⁶⁸ in Finland, who notes that the primary goal in consideration of turbine icing is to estimate production losses, while considerations for ice to hit persons is a secondary concern. A Swedish “Elforsk” report on Icing of Wind Turbines ⁶⁹ reinforces the different perceptions of loss of production, noting, “The overall goal is to increase the ability to estimate electricity production from the turbines in areas at risk of icing of blades...” The report goes on to identify “Future Research Needs” to include under the heading “Safety Issues” the statement, “There is a clear need to carry out more experimental studies in order to better understand the characteristics of ice throw.” Additionally, the report states,

“the major drawback of using the (Seifert) formulas (for ice shed) is the fact that the dependency of the ice throw risk on the wind statistics under typical icing conditions is neglected.”

“the effect of breaking ice while flying through the air has not yet been examined.”

“there is a clear lack of validation data for the simulation results.”

Periodic reports from the IEA Wind Task Force 19, State of the Art of Wind Energy in Cold Climates continue to be issued ⁷⁰, That report noted for a Swiss Alpine site, “The ice detector inter-comparison has shown surprisingly poor results so far; no device has been able to measure icing correctly for a whole winter season. The monitoring of the wind turbine pointed out deficiencies in ice detection as well as blade heating performance. The paper notes on page 57, “Turbines with or without blade heating systems, pose a risk in the form of thrown ice. Irrespective of whether turbines are equipped with blade heating systems, warning signs should be used. Signs should be located at least with the distance of 1.5*(hub height + rotor diameter) from turbine in all directions.” The paper then follows on page 58 to note, “Canadian Wind Energy Association (CanWEA) ordered from Garrad Hassan Canada Inc. (GHC) a study including firstly recommendations for assessing the risk of ice fragments shed from wind turbines striking members of the public in the vicinity of wind farm projects in Ontario.” The report does not comment on the difference between the recommendation it makes on page 57 for signs posted at 1.5*(hub height + rotor diameter) and the report of Garrad Hassan that recommends a setback of (blade length+10m) that was accepted in Ontario regulations. For wind turbines currently approved in Ontario, this can mean a difference of recommendation in accordance with the IEW Task Force 19 of 300 metres for safety signage, versus an actual setback of 93.1 metres to a municipal roadway, and 82.1 metres (27% of the IEA recommendation) to the lot line of a neighbour.

The recommended work in references ⁶⁹ and ⁷⁰ for prevention of icing of wind turbine blades, and the de-icing of blades where icing has occurred has been discussed in a number of papers. A paper published in 2016 points out the work is still ongoing ⁷¹. That paper’s conclusion begins, “No proven reliable anti-icing and de-icing systems for wind energy industry are yet available on the market. Further testing is required to increase the reliability and safety design of these systems.”

An assessment of the impact energy required by ice or debris falling from wind turbines to injure an unprotected human, or passengers in a motor vehicle was summarized in a presentation at IWAIS 2015, the 16^th International Workshop on Atmospheric Icing of Structures. ⁷². Somewhat more detail is given in the authors’ companion presentation titled, “Methods for evaluating risk caused by ice thrown from wind turbines,” presented at Winterwind 2015, Piteå, Sweden ⁷³.

The IWAIS paper quotes from earlier work that an unprotected human is at risk of fatality if hit by a piece of ice with kinetic impact energy above 40 Joules, and weight above 100 g. They also show that a car window can be broken by impact energy above 140 Joules, so they estimate that a driver or passenger could suffer a fatality caused by the ice alone if it has an energy exceeding 180 joules. (This neglects a possibility of fatality caused if a car windshield breaks in front of the driver resulting in an accident, even if the ice does not itself have sufficient residual energy to injure the person.) The Winterwind presentation is somewhat less restrictive stating a “Falling ice fatality potential” of:

40-60 J: Serious injuries to forehead

>80 J: Serious injury to body.

The Winterwind presentation goes on to state; the impact energy depends on ice density, mass, and velocity. Impact of 40 J corresponds to:

200 g of ice falling from 30-50m

500 g of ice falling from 5-6m

To perform a quick verification calculation an ice piece 10 cm x 10 cm x 2 cm was assumed (mass about 0.18 kg) to fall from the hub height of an 80 m wind turbine. The calculation neglected wind speed, any contribution from moving blades, and air resistance to slow the acceleration. Anyone who has “skipped” a flat pebble across the surface of a pond can testify as to the effect of the impact of spin on the object, or the difference between throwing the pebble so the “thin side” of the object cuts through the air, as opposed to the “flat side.” As stated, this was only a quick verification calculation.

Simple acceleration due to gravity tells us that the distance travelled “s” is a function of the original velocity “V₀”, the (constant) acceleration due to gravity “a” and the time the object falls “t”.

S = V₀t + ½ at²

Substituting actual falling distance 80 m = 0 + ½ x [ 9.8 m/s² ] x t²

Solving for t, t = 4.04 seconds

Thus, velocity at impact = V₀ + [ 9.8 m/s² ] x 4.04 s

= 39.6 m/s

Hence energy at impact = ½ x [ mass x velocity² ]

= ½ x [ 0.1 m x 0.1 m x 0.02m x 917 kg/m³ ] x ( 39.6 m/s )²

= 143 Joules

Thus we confirm that a piece of ice smaller than observed falling from wind turbines can hit the ground with sufficient energy to kill an unprotected person, assuming the 40 to 60 joule impact fatality range, and potentially able to break a vehicle windshield.

As a check to verify the ability of 40 to 60 joule range to result in a fatality, a calculation was made to show the height that a concrete block (18 kg in mass) could be dropped from to hit the ground with energy of 40 to 60 joules.

Similar to the calculation shown above, for energy at impact of 40 joules, and a concrete block mass of 18 kg solving we find:

Energy at impact = ½ x [ mass x velocity² ]

40 Joules = ½ x [ 18 kg x velocity² ]

Since the units of Joules are [ kg x m² ] / s²

Velocity = 2.1 m/s

Then, since velocity at impact = (2.1 m/s) = V₀ + [ 9.8 m/s² ] x t

Solving we find: t = 0.21 s

Thus, distance the concrete block must fall is found from:

S = V₀t + ½ x [ 9.8 m/s² ] x [ 0.21 s ]²

S = 0.22 m

The reality check is, if a concrete block is dropped 0.22 metres onto a person’s head, could it be fatal? Even with little knowledge of the anatomy of a skull, it seems to be a reasonable assumption, particularly if the falling object has any sharp edges, such as an ice fragment from a wind turbine blade. That means the ice drop of larger pieces than required to yield a 40-Joule limit which have been observed falling a distance from wind turbines are indeed a hazard to protect against, and cannot be ignored.

A poster presentation ⁷⁴ at WindEurope Summit in 2016 discussing ice throw risk, begins stating, “Ice throw from wind turbines is a serious hazard.” While discussing personal injury from ice hitting a person, the presentation introduces the concept of “minimum endogenous mortality.” The presentation notes this concept then can provide a limit for mortality caused by a new technology that “should not exceed 1*10^-5 death per person and year.” The presentation goes on to note, “Alternatively the accepted death risk is regarded to depend on the amount of voluntariness and the amount of possible personal influence associated with the activity. If the possibility to avoid a risk approaches zero or if the risk is not taken voluntarily, the acceptance decreases. Here the minimum accepted risk reaches 1*10^-5 death per person and year, in the worst case, which is similar to the minimum endogenous mortality defined before.” We are reminded of the earlier reference to the writing of Starr in 1969 ² discussing the acceptance of involuntary risk.

The body of knowledge concerning ice throw hazard continues to grow. A paper presented at the WindEurope Conference & Exhibition in 2017 ⁷⁵ provides useful insight into understanding and acknowledging the ice throw hazard, as does the 2017 report of the IEA Expert Group Study on Wind Energy in Cold Climates ⁷⁶. The first paper notes that “apart from the moral obligation, there is a judicial and economical responsibility, since criminal and compensatory liability depends on the commitment to perform effective risk mitigation efforts.” In discussion of the “Basis for liability” the paper writes, “the licensee may be held liable despite fulfilling all public law requirements.” (This is discussing a Norwegian example.) The distances for ice throw (140 metres) shown in the paper for a Vestas V90 turbine are considerably higher than the values of blade length + 10 metres (55 metres for this turbine) described earlier that were recommended by CanWEA in 2007 “in order to enable wind farm development” that were adopted by the Canadian province of Ontario.

Many papers perform a calculation to determine the risk of a wind turbine accident to harm a member of the population. The “Dutch Handbook” Handboek Risicozonering Windturbines ¹⁰, identifies in its Table 4 that “vulnerable objects” such as homes, hospitals, and schools are to be maintained outside a 10^-6 risk contour, which they identify as the larger of (mast height + ½ rotor diameter) or the maximum casting distance at nominal speed. The latter value varies depending on the turbine specifics, but they define in Tables 2 and 3 of the Handbook the Local Risk (PR) for International Electrotechnical Commission (IEC) Category 1 (high wind speed turbines) and Category 2 (average wind speed turbines). They define PR as “risk of a place outside an establishment, expressed as a probability per year that a person who would stay uninterrupted and unprotected at that place, dies as a direct result of an unusual incident within that establishment.” In this case, for the PR = 10^-6 contour a calculated value for the maximum casting distance at nominal speed for a 3 MW turbine with a 120 metre hub height as 193 m for an IEC Category 1 (high wind speed turbine) and as 216 m for an IEC Category 2 (average wind speed turbine.) One might argue those calculated values based on actual experience. The Ontario Failure # 7 described earlier of the Huron Wind turbine with an 80 metre hub height and 80 metre rotor diameter (for which the nominal mast height + ½ rotor diameter would be 120 m) or for which the value in the Handbook Tables 2 and 3 would be 175 metres for an IEC Category 2 turbine, a blade piece 1.2m x 3m travelled a distance of 280 metres from the tower, yet a piece 1 m x 0.15 m travelled a distance of 560 metres from the tower. The 10^-6 risk contour for human fatality is a useful beginning point for risk comparisons. It is a value used in other industries as well.

However, many wind turbine risk assessments have a logical shortcoming that adversely impacts their calculation. A common manner of performing the calculation of individual risk used in many papers is to assume a standing person occupies only a small portion of the total exposure area, so the risk of striking the person is proportionally smaller than if the person was everywhere that a falling object might land. As an example the Garrad Hassan Recommendations for Risk Assessments of Ice Throw and Blade Failure in Ontario ⁶⁴ calculates individual risk for ice throw by saying the individual can be in any of the risk areas between a radius of 50 metres (the nominal exclusion zone for the public they use) and a radius of 300 metres which they show as the limit for ice throw from a Monte Carlo calculation. It argues that if the ice can fall anywhere in that annular space with a total area of 275,000 m² then the risk of ice fall is the same for all of those areas, but the individual could only be in 1 m² so the risk of hitting the person is reduced by a factor of 1/275,000 times. The calculation in that report assumes a “moderate” value of ice strikes per square meter per year at 50 metres from the tower of 0.002 times and then multiplies that by the total risk area of 275,000 m² to obtain a risk of being struck per year.

The calculations then determine an Individual Risk of IR as follows:

IR = 0.002 (strikes per year / m²) x (1 / 275,000) x 275,000 m²

= 0.002 strikes per year

(or 1 strike in 500 years).

Similar calculations in other papers use an individual forehead area of 0.1 m² as the potential area of impact to be able to reduce the risk by a further factor of 10.

The logical flaw is the assumption that the ice falls equally distributed around the turbine in any ice fall incident. In reality, as was demonstrated by the photo time sequence in Figure 11 of this paper, the ice fall is not equally distributed over the entire area, but is concentrated in a downwind sector. This is also the concern noted previously in the Swedish “Elforsk” study ⁶⁹. Similar to the blade debris field shown in Figure 7 of this paper, where the debris field was limited to about 16 degrees in width, or less than 5% of the total area of the annular ring, the ice does not fall equally everywhere but is distributed through the much smaller downwind sector, so that the “about 1 ton of ice on the ground” as reported in the same report for the single event all fall in that narrow band. We might consider the risk for any person unfortunate enough to be in that zone is increased by a factor of 20.

The second logical flaw performed in many individual risk assessments is the assumption that a person will choose to not be in the impact area, or, if they are passing through the exposure area in a motor vehicle, their exposure time will be a very small fraction of the time. As an example the assumption may be made that if a motor vehicle is travelling at 80 km/hr, and the roadway is 120 metres from a wind turbine, then the personal exposure time would be only 25 seconds or so as shown in Figure 13. A setback of 240 metres would produce a personal exposure time of about 18 seconds. Then a reduced daily risk is claimed on the basis of (18 to 25 seconds of exposure / 86,400 seconds per day).

Figure 13.Reduction of Risk by Assuming Residence only During Transit Time

Study of actual ice drop from a stopped wind turbine in Ontario shows that assumptions used in developing the Monte Carlo analysis for the debris field of ice from a wind turbine are not representative, as ice was seen to be falling well beyond the anticipated ice drop zone. Similarly, the research at the Rauma site in Finland reported earlier ⁶⁶ showed that 70% of the ice fall occurred beyond 70 metres. Yet the assumptions used for the Monte Carlo analysis suggested that the majority of the ice would fall at the base of the turbine. The landing position was shown to be dependent on existing wind at the time the ice starts to fall. Again, the ice field distribution is dependent on the wind direction.

Calculating the reduction of assuming residence only during transit time is also not always appropriate as if it were for an individual it does not consider what the actual risk is during the time the individual is present in the risk zone. An individual walking a dog, or working on repairing a fence line might be in the risk zone for much longer. Even if it were calculating a population risk for an automobile passing the wind turbine the assumption is inappropriate, as it does not consider that the section of road may have more than one motor vehicle passing it in a day, does not consider that any motor vehicle may pass by multiple wind turbines, and that each motor vehicle may have more than one passenger. As an example, along Highway 402, a multi lane limited access highway in Ontario, an average of 18,100 vehicles a day ⁷⁷ will pass 9 wind turbines in a 3.3 km section of the highway, all located within the possible ice throw zone at about 240 metres. Slightly further down the same highway, before any possible exit points are passed, the same 18,100 vehicles will pass a further 3 wind turbines also within the possible ice throw distance. The flaw in the calculation provided is that while it takes credit for a reduction factor of (18/86,400) based on the transit time for a single motor vehicle past a single wind turbine, or 2 x 10^-4 it fails to take account for the multiplier of not one, but 18,100 motor vehicles with multiple passengers, and not one but 12 wind turbine risk zones. The population factor becomes: (18/86,400) x (16,100) x (12) yielding a multiplier of 45 (times the total number of passengers in all of the 16,100 motor vehicles) that yields a considerably different result than 2 x 10^-4.

The intent of performing the previous calculation was not intended to provide a single value of a risk multiplier with a high degree of confidence, but to show that making flawed assumptions can present results with a large error. Other than for the case of multiple motor vehicles passing multiple wind turbines, it can generally be said that wind turbines are more of an individual risk than a population risk, as usually they are not near large areas of population density so large numbers of people are not involved.

In mature industries, such as the nuclear industry, regulations require the proponent to demonstrate acceptability for both individual and population risk. For the case of individual risk, even early papers written in the 1970’s calculation had to calculate the risk assuming the individual is present in the at risk environment, not to calculate the risk assuming the person is not present most of the time ⁷⁸. It is rather like saying that the risk from skydiving is low, because the risk only exists for perhaps 15 or 20 occurrences a year x an exposure of 20 minutes for each exposure. As Starr pointed out ², “the risk measure used here is the statistical probability of fatalities per hour of exposure of the individual to the activity considered.” We must calculate risk when the person is present in the risk zone, and not present an averaged value over a longer time when risk is less. The risk to a skydiver is during the jump, not the risk averaged over the year.

As an example in calculating the risk of radiation uptake by a member of the public living near a nuclear facility regulations require calculating the radiation dose assuming the person is continuously living at the boundary fence, drinks milk from cows that eat the grass growing alongside the fence, eats fish harvested from the discharge water outfall, and vegetables grown in gardens alongside the fence. While all of these assumptions may be considered to be very conservative, it is by making these conservative assumptions that the industry demonstrates its maximum impact, so it may confidently show that the risk is indeed low. By doing so, there is also a standard so that the results from one establishment can be compared with another. In a similar basis, if an individual who lives beside a wind turbine testifies that he or she does walk their dog along the fence line daily, or carries out routine farm activities there, then there is no basis for the wind turbine risk assessment to assume that the risk is low to that resident based on only occasional exposure to the risk. Individual risk is the condition that applies when the person is in the risk zone not a value averaged over a year.

A similar flaw exists in many of the calculations for blade throw incidents. As shown in Figure 7, actually none of the blade material was noted to have fallen in the first 150 metres from the tower, as the wind carried the debris away from the tower in this case. The debris field was narrow in width and was mostly concentrated between about 150 metres and 280 metres in that case. Again, it is a severe logical error to assume the debris is uniformly distributed when performing individual risk assessments, as in reality it was concentrated. Any person in that high-risk area indeed faces a considerable risk, well above the 10^-6 allowed risk for vulnerable persons by the “Dutch Handbook”.

The wind turbine industry has not yet developed the maturity to recognize the importance of sharing experience. Repeatedly, investigators studying wind turbine accidents and incidents in order to analyse failures to develop Fault Tree Analysis or other reliability models have pointed out concern that the industry does not have a comprehensive listing of failure data. Repeatedly, papers have identified that the citizen group Caithness Windfarm Information Forum, which bases it’s listing of failures from those provided by auditable public press sources maintains the most comprehensive database of wind turbine accidents.

A result of not knowing of failures of a similar nature that have occurred at neighbouring facilities is that operators are not learning to be able to improve their operation or equipment.

The industry description of failure frequency is not consistent with that used by other mature industries and as a result the industry is not giving a clear indication that they know the severity of recurrence.

The critical initiating point for any safety assessment is to determine the possible initiating events. Seven events that have happened in the Canadian province of Ontario were studied since they document actual occurrences of blade failures, tower collapse, and turbine fire. Each resulted in blade parts on the ground large enough to harm an unprotected citizen in the area. The goal of the study was to gain an appreciation of actual blade part travel distances, as actual data can be used to verify models. The study showed blade parts as large as 1 metre x 3.6 metres at distance of 170 metres from the tower, 1.2 metres x 3.0 metres (large enough to park an automobile on) at a distance of 280 metres from the tower, and 0.15 metres x 1.0 metres at a distance of 560 metres from the tower (with a sharp serrated edge) that could have injured an unprotected individual.

The seven Ontario failures were examined to show the case of a relatively constant 50% Chi-Squared Confidence Level Failure Rate failure rate of about 0.0005 (5.0 x 10^-4 failures per turbine year in operation), representative of the normal service period with a constant failure rate. This means this failure rate can be used to predict future failures in risk calculations.

The challenge was demonstrated of comparing the risk of death for an activity that the majority of Ontario residents take part in, of driving a motor vehicle, to the risk of death to an individual who may happen to be in the vicinity of a wind turbine when a failure occurs. For the first, the expectation is that 1 in 20,000 drivers are killed per year, a frequency of 5.0 x 10^-5 deaths per year for an activity voluntarily selected by choice of the drivers. For the second, the expectation for the individual in the vicinity of the failure is 5.0 x 10^-4 deaths per year, a factor 10 times higher, yet for an initiator that is an involuntary risk. Examples were given that we protect vulnerable children, at risk of an anaphylactic death from consuming peanut products where the risk is 2.5 x 10^-6 deaths per year.

Ice shed was shown to present an additional risk even if the turbine does not itself fail. Significant discrepancy was identified between setbacks for ice safety that have been accepted since 2007 in the Canadian province of Ontario, of (blade length + 10 metres), identified “to enable wind power development” and studies from Finland to show that while 70% of ice pieces will be thrown by a distance of 270 metres from a turbine, but in fact only 30% of the ice pieces will have been thrown less than blade length plus 10 metres, while 15% of the ice will be thrown greater than 410 metres.

The impact of flaws in assumptions made when calculating risk from falling ice or blades was discussed contrasting a generalized assumption of random ice throw pattern or blade throw pattern, with the actual distribution which is confined to a much tighter sector downwind of a turbine (if shutdown), or if the turbine is operating (facing upwind), then the thrown sector is more likely crosswind. Errors in assumption of risk to ice thrown on highways were identified in that instead of assuming one vehicle passes one turbine; multiple vehicles, each with an average of more than one passenger, may pass multiple turbines resulting in a very different population risk factor.

This research project was funded by the investigator and received no external funding.