Why that Hi-Hi level switch is *really* important

[Albert LaFrance]

Now this is what I call a tank overflow!

The Taum Sauk upper reservoir failure of 2005:
http://web.mst.edu/~rogersda/dams/2_43_Rogers.pdf

 

[RussB]

I would think that if one thought of the "HI" warning as just as important, the "HI-HI" would be a little less critical. Redundant sensors may be a good approach also.

There is one of these systems on Lake Michigan, near Ludington, MI. I have been in the pump room on business but not involved with level control. Very interesting system.

 

[Albert LaFrance]

As seems to be the case so often, the failure was the result of multiple errors and misjudgments in design, construction and operation. The reservoir did in fact have redundant sensors, but the backup sensors (conductivity probes) ended up being above the overflow elevation of the parapet wall! And the primary (pressure) sensors were reading low because they had come loose from their mountings.

This would make an excellent case study for a class, because the basic problem is so simple. And the report touches on an interesting question for discussion: the fact that the control system could have been programmed to identify abnormal conditions - without any additional hardware - by comparing water depth readings with expected values based on pump runtime.

 

[MasterBlaster]

I actually refused to put HI-HI alarms in circuits at the water plant, against designer wishes. If a high-level alarm occurs, tend to it! Adding HI-HI does just what Russ suggests - causes an apathetic approach to high level alarms.

 

[Albert LaFrance]

BTW, check out the completely rebuilt (and much improved) reservoir - a very impressive structure!
http://ameren.com/sites/aue/Media/Pages/TSPhotos.aspx

In some of the photos you can see the bare and eroded area from the 2005 breach.

 

[robertmee]

I actually refused to put HI-HI alarms in circuits at the water plant, against designer wishes. If a high-level alarm occurs, tend to it! Adding HI-HI does just what Russ suggests - causes an apathetic approach to high level alarms.

I would differentiate between add a Hi-Hi failsafe switch vs not adding a Hi-Hi alarm. For mission critical situations never rely on a single device. Have either device set of a single Hi alarm if you wish, but it'd be foolish not to install a secondary switch. I refuse to guarantee tank operations without failsafe backup devices and always push the customer hard to install them. I shake my head when I see a tank on load cells or a continuous level probe with no discrete high level failsafe switch.