Page - 1557 - in Book of Full Papers - Symposium Hydro Engineering

capture all possible failure sequences in an inductive analysis, it will typically not be possible to include all identified possible failure sequences in the analysis. Therefore if one defines failure modes as sequences of events from initiation to failure, one should not be surprised if a failure sequence that was not identified in the analysis occurs. Given that one can reasonably exclude defining failure modes in terms of the sequence of events between initiation and ultimate failure on the grounds that it is impossible for all but trivial systems, one must also accept that failure modes are not uniquely defined, [10], [11]. Rather, failure modes are a matter of the perspective at which the analysis is conducted. System level failure modes are different to parts level failure modes. This has hugely important implications for monitoring and surveillance as these activities are directed at detecting changes in performance of some feature of the dam be it at the system level as is the case with visual inspections of dam (e.g. deformation of the dam body), or tests of functionality of parts (e.g. measuring friction in a trunnion bearing). The concept of system level and parts level failure modes is illustrated in Figure 3, which also illustrates the relationships between cause-mode-effect for one module of the spillway sub-system, specifically the gate which is further resolved to its component parts. Found- ation Main dam Intake dam Spillway Abut- ments Head- works Chute Stilling basin System level Spillway sub-system level Upstream control Structure Gate Gate control Headworks module level Motor Skin plateGate component level Hoist drum Wire rope Lifting bracket Strut arm Trunion bearing Side seal Edge seal Sill beam 1 2 3 4 5 4-A 4-B 4-C System level Sub-system level 4-A-1 4-A-2 4-A-3 4-A 4 Module level 4-A-3-1 4-A-3-2 Component level Sub—system failure effects Module failure effects Component failure effects Failure modes Failure modes Failure modes Failure modes Failure modes System boundary Figure 3. Systems, parts and “cause – mode – effect” relationships Note, all features at the component level are not shown due to space limitations, and each component can be further resolved into the elements that comprise each component. At some point, it becomes necessary to ask the question: “To what extent should the system be resolved?” We suggest that the answer is that as a general principle resolution should be to the level at which maintenance and testing can be carried out. This then defines the level in the system at which the monitoring and surveillance effort should be directed because this is the level at which the operational failure risk is managed. Thus, the answers to the questions as to 1557