Capstone: emergency response, case studies and a facility hazard review

This final lesson brings the course together in three parts. First, it looks at how facilities and pipelines respond to emergencies: the automatic systems that shut them down, the roles of field workers and the plans that protect the public. Second, it studies major facility and pipeline failures to see how the hazards and safeguards in Lessons 1 to 11 played out in real events. Third, it applies everything to a hazard review of the invented Spruce Ridge gas plant and its incoming line, ranking findings so that the most serious get fixed first. HSE-330 covered emergency response plans in general, including incident command and sour gas planning; this lesson focuses on what is specific to facilities and pipelines.

Emergency shutdown and blowdown

Facilities and pipelines are designed to make themselves safe automatically in an emergency. An emergency shutdown (ESD) system closes valves to isolate inventories, stops compressors and pumps, shuts off fuel to fired equipment and, at many compressor stations and gas plants, opens blowdown valves to send gas to the flare. ESDs can be triggered by fire and gas detectors, process trips, loss of power or instrument air, or a person pressing an ESD button. Pipelines have remotely operated or automatic shutoff valves at intervals that limit how much product can escape from a ruptured segment; recent rules in both countries have pushed for more of them, especially on large lines in populated areas.

Field workers need to know where the ESD stations are, what each one shuts down and how to reach them safely. They also need to know what an ESD does to the plant around them: a blowdown fills the air with noise, may cover the flare area with intense radiation and cold, and stops equipment that people may have been working on. Drills that include activating ESDs, at least in simulation, help crews respond without hesitation.

Field roles in an emergency

When a facility or pipeline emergency starts, the people on site are usually few and the plant is large. The emergency response plan assigns roles, and everyone should know theirs before the alarm sounds. In general:

• The first person to notice a release, fire or injury raises the alarm by the fastest route, often an ESD station, a manual pull station or a radio call to the control room.
• People not assigned to response go to the designated muster point, choosing an upwind route and an alternate muster point if the primary is downwind of the release.
• The control room or the senior person on site takes charge as incident commander under the incident command system until relieved.
• Operators isolate and depressure from safe locations if it is safe to do so, and never walk into a vapour cloud or a sour release to close a valve by hand.
• Trained responders handle rescue only with the right breathing apparatus and backup, because untrained rescue attempts in H2S and nitrogen atmospheres have killed many would-be rescuers.
• Designated people make notifications to regulators, local authorities and the public, as Lesson 2 described.

Protecting the public

Facilities and pipelines often sit near homes, roads, farms and towns, so their emergency plans must protect the public as well as workers. In Alberta, AER Directive 071 requires licensees to have emergency response plans, including sour gas plans with emergency planning zones for facilities and pipelines that could release enough H2S to harm the public, as HSE-330 explained. The CER requires federally regulated pipeline companies to maintain emergency management programs, consult with emergency responders and communities, and run exercises. Operators run continuing public awareness programs so that residents, landowners, excavators and local emergency services know where pipelines are, how to recognize a leak, what to do and whom to call.

Signs of a pipeline leak that the public, and workers, should recognize include a hissing or roaring sound, dead or discoloured vegetation over the right-of-way, bubbling in water, a rotten egg or petroleum odour, a dust cloud or mist, frozen ground in warm weather and liquid on the ground. The advice is the same for everyone: leave the area on foot in an upwind direction, do not use anything that could make a spark, including phones and vehicle ignitions near the leak, warn others to stay away and call the emergency number on the pipeline marker and 911 from a safe distance.

Case studies

Major failures teach lessons that procedures alone cannot. The cases below involved facilities and pipelines similar to those in this course. Each shows several barriers failing together, which is typical of major accidents.

The Canadian cases led to prosecutions and fines under environmental and fisheries law. Nexen pleaded guilty in 2018 to an Alberta Environmental Protection and Enhancement Act charge and federal Fisheries Act charges and was ordered to pay 460,000 dollars, most of it directed to environmental education and a pipeline learning centre. Husky pleaded guilty in 2019 and was fined about 3.8 million dollars under federal and Saskatchewan law, having spent more than 140 million dollars on cleanup. Beyond the penalties, both events changed how Alberta and Saskatchewan regulators oversee pipeline design for ground conditions, leak detection and response.

Common threads run through all of these. Integrity threats such as corrosion, cracking and ground movement were present for a long time before failure. Detection failed or was not believed. Records, procedures or training did not match the reality in the field. And the consequences depended heavily on how quickly the release was isolated and how close people, water supplies and homes were. Each of the course's lessons addresses one or more of these threads.

A hazard review of Spruce Ridge

A hazard review, sometimes called a site hazard walkdown, is a structured look at a facility to find hazards and weaknesses in safeguards. It is not a substitute for a full process hazard analysis, but supervisors, safety advisors and experienced operators use it regularly to keep a fresh eye on the plant. The review team walks the site with checklists drawn from the facility's hazards, notes findings with photographs and locations, and ranks them by likelihood and severity so that the most serious are fixed first.

Suppose a team from Larchwood walks the Spruce Ridge plant and the receiving end of the Kettle Creek line during a quiet day shift. Their findings are shown in the figure and ranked in the program below, using a simple five-by-five risk matrix. The findings and ratings are invented for teaching.

# Ranking invented hazard review findings at the Spruce Ridge plant (5 x 5 matrix).
findings = [
    (1, "Pig receiver has only a high-range gauge; no low-range gauge for zero checks", 3, 5),
    (2, "Slug catcher high-high level shutdown in bypass for 9 days, no permit", 4, 5),
    (3, "Block valve under acid gas KO drum relief valve found closed, no car seal", 3, 5),
    (4, "Molten S pit sweep air fan tripped; local alarm not wired to control room", 3, 4),
    (5, "Glycol still vent condenser bypassed; benzene smell at reboiler", 3, 3),
    (6, "Vibrating small-bore tubing on compressor 2 discharge, loose support", 4, 4),
    (7, "Wind-dependent muster point B downwind of acid gas flare in prevailing wind", 2, 5),
    (8, "Sweet-service ball valve installed on sour fuel gas line during repair", 2, 5),
    (9, "Spent amine filters stored dry in open bin", 3, 3),
    (10, "Temporary hose on condensate transfer, no MOC record, 4 months old", 3, 4),
]
ranked = sorted(findings, key=lambda f: (f[2] * f[3], f[3]), reverse=True)
print("Rank  Score  L x S  Finding")
for i, (n, text, L, S) in enumerate(ranked, 1):
    level = "HIGH" if L * S >= 15 else "MEDIUM" if L * S >= 8 else "LOW"
    print(f"{i:>4}  {L*S:>5}  {L} x {S}  #{n} {text}  [{level}]")
print(f"High-risk findings needing immediate action: {sum(1 for f in findings if f[2]*f[3] >= 15)}")

Rank  Score  L x S  Finding
   1     20  4 x 5  #2 Slug catcher high-high level shutdown in bypass for 9 days, no permit  [HIGH]
   2     16  4 x 4  #6 Vibrating small-bore tubing on compressor 2 discharge, loose support  [HIGH]
   3     15  3 x 5  #1 Pig receiver has only a high-range gauge; no low-range gauge for zero checks  [HIGH]
   4     15  3 x 5  #3 Block valve under acid gas KO drum relief valve found closed, no car seal  [HIGH]
   5     12  3 x 4  #4 Molten S pit sweep air fan tripped; local alarm not wired to control room  [MEDIUM]
   6     12  3 x 4  #10 Temporary hose on condensate transfer, no MOC record, 4 months old  [MEDIUM]
   7     10  2 x 5  #7 Wind-dependent muster point B downwind of acid gas flare in prevailing wind  [MEDIUM]
   8     10  2 x 5  #8 Sweet-service ball valve installed on sour fuel gas line during repair  [MEDIUM]
   9      9  3 x 3  #5 Glycol still vent condenser bypassed; benzene smell at reboiler  [MEDIUM]
  10      9  3 x 3  #9 Spent amine filters stored dry in open bin  [MEDIUM]
High-risk findings needing immediate action: 4

The ranking puts the bypassed slug catcher shutdown at the top, followed by the vibrating tubing, the receiver gauge and the closed relief valve block valve. Several findings share a pattern that this course has stressed: safeguards defeated or degraded without control. A shutdown in bypass for nine days without a permit, a relief valve blocked in, a sweet valve in sour service and a temporary hose that became permanent are all failures of management of change and bypass control, not of equipment design. The muster point downwind of the acid gas flare is rated lower in likelihood but still high in severity, and fixing it costs almost nothing.

Turning findings into action

A hazard review is only useful if its findings are acted on. For each finding, the team records an action, an owner and a due date, and high-risk findings get immediate interim measures. For Spruce Ridge, the actions might look like this:

The review team also looks for patterns behind the findings. Here, four findings involve uncontrolled changes or bypasses, which suggests a weakness in the plant's management of change and bypass culture rather than four unrelated mistakes. Addressing that weakness, through training, supervision, simpler MOC for small changes and leadership attention, will prevent findings that the walkdown did not catch.

Carrying the course forward

This course has followed oil and gas from the battery through compressor stations, a gas plant and pipelines. The same habits apply everywhere: know what is in the equipment and how much energy it holds; respect relief and shutdown systems; watch for corrosion, hydrates, cracks and movement; never assume a line is isolated until you have verified it; treat tanks, flares and pig traps as the high-risk equipment they are; protect pipelines on the right-of-way; and speak up when something does not match what you expect. HSE-333 completes the track with permits to work, isolation planning, simultaneous operations and handover, the systems that hold these habits together on a busy site.