Rescue planning and attendants

On the third day of the outage, Kiera spends a shift outside the steam drum rather than in it. She is the tending worker at the north manway, with a clipboard, a radio, a gas monitor and an air horn, and her only job is the two boilermakers working inside. Dale tells her it is the most important job on the crew that day and the easiest one to do badly. An attendant who wanders off to fetch a tool, starts a conversation with the scaffold crew or helps with work at the manway is not watching the entrants. Then, after lunch, the station's rescue team runs a drill on the mud drum, and Kiera sees how long it actually takes to get an unconscious worker out of a horizontal drum through a manway the size of a dinner tray.

The attendant

Alberta's Code requires a tending worker at a confined space if the oxygen is below 19.5 % or above 23.0 %, if a substance listed in the Code is present above half of its exposure limit, or if the hazard assessment identifies a hazard that cannot be eliminated or effectively controlled. The tending worker keeps track of the number of workers in the space, stays in constant communication with them, has a reliable way to summon help immediately, and does not leave until every worker is out or another competent tending worker has taken over. Where none of those conditions apply, a competent worker named by the employer must still keep in communication with the entrants. Riverbend and Northgate go further than the minimum and require a dedicated tending worker for every confined space entry.

In practice, the attendant's work looks like this. Kiera checks the permit and the gas readings at the start of the shift and knows the retest time. She logs each entrant in and out on the board at the manway. She talks to the entrants every few minutes by voice or radio and knows what each of them is doing and where in the drum they are. She watches her own monitor and the ventilation, and listens for anything that changes: a blower stopping, an alarm, a change in the entrants' voices. If any of that goes wrong, she orders the entrants out. If an entrant does not answer, or collapses, she raises the alarm through the station's emergency number and starts the rescue plan from outside. She never enters.

Why rescue has to be planned

A person who stops breathing has only a few minutes before brain damage begins. A person who is unconscious in a low-oxygen atmosphere has even less time, because they are still breathing the bad air. A rescue that relies on calling the public emergency number and waiting for a fire truck will not arrive in time for an atmospheric emergency in a boiler drum, and most municipal crews are not equipped to get a person out of a drum anyway. The rescue has to be on site, ready, equipped and practised before the entry begins.

Alberta's Code requires an emergency response plan for confined space work to be in place before work begins, with workers able to perform an effective rescue and evacuate immediately when conditions warrant. The explanation guide to the Code is blunt that calling 911 alone is not an effective rescue plan; the employer must have basic on-site rescue capability. Large owners such as Riverbend keep a trained industrial rescue team on site during outages, and the confined space entry permit names it.

Non-entry and entry rescue

The safest rescue is the one that does not put anyone else inside the space. In a non-entry rescue, the entrant wears a full-body harness attached to a retrieval line, and the line runs to a mechanical winch on a tripod or davit above the opening. If the entrant collapses, the attendant or the rescue team cranks them out without entering. For a vertical entry, such as the top manway of a tank or a vessel, this works well. Ironbridge's procedure requires a retrieval system for every vertical entry deeper than about 1.5 m, unless the line itself would create a greater hazard, for example by snagging on internals.

A horizontal drum is a different problem. The steam drum's internals, separators, baffles and feed piping, mean that an entrant twenty feet along the drum is around several corners from the manway. A retrieval line attached to their harness would drag them into the internals rather than out of the drum. For the drums and the furnace, Riverbend's plan is an entry rescue: two members of the rescue team, wearing breathing apparatus if the atmosphere is suspect, enter, assess the casualty, give first aid, package them on a flexible stretcher designed to pass through small openings, and haul them out with a rope system rigged at the manway. Lines and stretchers are staged at the manway before the entry begins, not in a truck at the gate.

The size of the opening matters. A boiler drum manway is typically an ellipse of about 300 by 400 mm. A conscious worker can squeeze through it, but an unconscious one, packaged with a harness and possibly a breathing apparatus cylinder, cannot be pulled through easily. The rescue plan for each space considers whether a casualty can be got out through its openings at all, and if not, what alternative exists: a second manway, a larger access door, or cutting an opening as a last resort. At Northgate, the coker drum rescue plan uses the top head opening, which is much larger, with a crane-mounted man-basket on standby.

Timing a rescue

Rescue drills give real times. The code below adds up the stages of a rescue from the mud drum, using times from Riverbend's drill, and compares the total with the time a person can survive without breathing. The point is not the exact numbers, which vary with every space and team, but which stages take the longest and what could shorten them.

# Rescue timeline from the mud drum drill (minutes)
stages = [
    ("attendant notices no response and raises alarm", 0.5),
    ("rescue team receives call and moves to Unit 2",  3.0),
    ("team dons breathing apparatus at the manway",     1.5),
    ("first rescuer enters and reaches casualty",       1.5),
    ("assess, first aid, package on stretcher",         4.0),
    ("haul casualty out through manway",                3.0),
]
t = 0.0
for name, dt in stages:
    t += dt
    print(f"{t:5.1f} min  {name}")
print(f"total time to casualty out: {t:.1f} min")
print(f"time until a rescuer reaches the casualty: {sum(d for _, d in stages[:4]):.1f} min")
print("brain damage can begin after about 4 minutes without oxygen")
# effect of staging the team at the drum during entries
staged = [(n, (0.5 if 'moves' in n else d)) for n, d in stages]
print(f"with the team staged at Unit 2: reach casualty in {sum(d for _, d in staged[:4]):.1f} min")

  0.5 min  attendant notices no response and raises alarm
  3.5 min  rescue team receives call and moves to Unit 2
  5.0 min  team dons breathing apparatus at the manway
  6.5 min  first rescuer enters and reaches casualty
 10.5 min  assess, first aid, package on stretcher
 13.5 min  haul casualty out through manway
total time to casualty out: 13.5 min
time until a rescuer reaches the casualty: 6.5 min
brain damage can begin after about 4 minutes without oxygen
with the team staged at Unit 2: reach casualty in 4.0 min

The drill showed what the planners suspected. Nearly half the time to reach the casualty was the team getting to the boiler, and the second-largest piece was donning breathing apparatus. For entries where the atmosphere could change suddenly, Riverbend now stages two rescue team members at the boiler with their equipment ready, and the entrants wear an escape respirator. For the routine drum inspections, where the atmosphere is well controlled and continuously ventilated, the team responds from its base. The difference is decided in the hazard assessment for each entry.

Communication and signals

The attendant has to know at every moment that the entrants are all right. In a small, quiet space, voice works. In a long drum with blowers running, or when entrants are wearing respirators, radios are needed, and the attendant checks in at a fixed interval and expects an answer. Where radios do not work, because of the steel around the space or a hazardous location rating, a tag line with a set of tug signals or a hard-wired intercom is used. Every crew agrees its signals before entry and writes them on the permit or the hazard assessment. The rule for silence is simple: if an entrant does not answer a check, the attendant treats it as an emergency until proven otherwise.

Rescue equipment and self-rescue

Rescue equipment is checked before every entry, not when it is needed. The tripod or davit and its winch are inspected and set up over the opening; the retrieval line is attached to the entrant's harness where the plan calls for it; the stretcher, rope system and breathing apparatus are staged at the opening with the rescue team's sign-off on the permit. Breathing apparatus cylinders are checked full. The radios and the alarm are tested at the start of the entry. An escape respirator, where the plan requires one, is worn by the entrant, not left at the manway.

The best rescue is the one an entrant performs on themselves. Entrants are trained to leave a space at once, without being told, when their monitor alarms, when they feel unwell, when they notice a change such as a smell, a sound or a blower stopping, or when the attendant orders them out. They do not finish the weld or tighten the last bolt first. Leaving early costs a few minutes and a retest; staying costs lives. Every entrant also knows the second way out of the space, if there is one, and keeps the route to the manway clear of hoses, leads and tools so that it is never blocked.