Industrial site safety and permits

At six o'clock on Kiera's first morning at Riverbend, Dale takes her to the permit office before he takes her to the boiler. A line of foremen is already waiting at the window, where the station's permit issuer, an experienced operator named Tyrone Beaulieu, is checking each permit against the isolation board behind him. Nothing Ironbridge's crews do inside the station fence happens without a permit, and nothing happens on a piece of equipment until the station has isolated it, proved the isolation and handed it over in writing. Dale tells Kiera that the permit window is where the plant and the contractor shake hands, and that most of the worst accidents in industry started with a handshake that was not done properly.

The legal framework

In the United States, workplace safety is governed by the Occupational Safety and Health Act of 1970 and the standards OSHA issues under it. General industry rules, which cover most maintenance work in operating plants, are in 29 CFR 1910; construction rules are in 29 CFR 1926. Louisiana has no state plan, so federal OSHA enforces the rules at plants along the river. Where no specific standard applies, the general duty clause requires every employer to keep the workplace free of recognized hazards likely to cause death or serious harm. Workers have the right to information and training about hazards, to raise concerns without retaliation, and to refuse work that presents an imminent danger when there is no time to fix it by other means. On a multi-employer site, OSHA can hold the employer that created, controlled, exposed workers to or should have corrected a hazard responsible for it.

Under any of these frameworks, a worker has duties too: to work safely, to use the protective equipment and procedures provided, to report hazards and incidents, and not to put others at risk. Imran's orientation puts it simply. Ironbridge must give Kiera a safe system of work, the training to use it and the equipment it needs. Kiera must use all three, and she must speak up when something is wrong.

The permit-to-work system

A permit to work is a written authorization to do a defined job, on defined equipment, for a defined time, under defined precautions. It is the plant's way of controlling which work happens where and of making sure the people doing it know what the plant has done to make the equipment safe. Most industrial sites issue several types of permit. A general or cold work permit covers work that does not create a source of ignition. A hot work permit covers cutting, welding, grinding and other work that does. A confined space entry permit covers entry into a confined space, and is usually issued alongside a work permit for the work done inside. Other permits cover excavation, critical lifts, work on electrical equipment and the breaking of process lines.

Each permit has two key people. The permit issuer, an authorized person employed by the owner, prepares the equipment and authorizes the work. The permit receiver, usually the contractor's foreman, accepts the permit on behalf of the crew, confirms the precautions are in place and understood, and keeps the permit at the work site. Every worker on the crew signs on to the permit before starting and signs off when leaving. Kiera's name goes on the steam drum permit at 06:30, and if she leaves the work area for another task, her name comes off it.

Permits expire. At Riverbend a work permit is valid for one twelve-hour shift and must be revalidated by the issuer at the start of the next. A confined space entry permit is suspended if the space is left unattended, if an alarm sounds or if conditions change. When the night shift takes over a job, the outgoing receiver hands it over to the incoming one face to face, at the work site, with the permit in hand. The handover is where many incidents begin, because the people who knew about a problem go home and the people who did not know take over.

Isolation and lockout

Before any boilermaker opens a manway on Unit 2, the station has to make sure nothing can enter the drum: no steam, no water, no chemicals, no electrical energy to the drum level instruments or the sootblowers, and no movement of fans or dampers in the furnace. Isolation is the process of separating equipment from every source of energy and material, and holding it separated. The station's operators close and lock valves, open and lock breakers, and, for process lines, install blinds, solid plates bolted between flanges, or remove a spool piece so there is a visible gap. A double block and bleed, two closed valves with an open drain between them, is used where a blind is not practical.

Every person who works under the isolation puts a personal lock on it, usually through a group lock box. The station's operators apply their locks to the isolation points and put the keys in the box; each worker then applies a personal lock to the box. No one can remove the isolations until every worker's lock is off the box. OSHA's control of hazardous energy standard, 29 CFR 1910.147, sets out the lockout and tagout requirements for general industry, including group lockout, shift change procedures and periodic inspection of the procedures.

Isolation is only as good as its verification. After the isolations are applied, the station tries to start the equipment, checks that drains show no flow, and measures for pressure, voltage or temperature as appropriate. Tyrone's isolation list for the steam drum has thirty-four points, from the main steam stop valves and the feedwater isolation to the chemical injection lines and the drum level transmitters, and each is ticked as applied and verified. Dale checks the list against the drum before he signs as receiver, looking for anything that enters the drum but is not on the list.

Working alongside other crews

On a large outage several crews work in the same area at once: boilermakers on the waterwalls, insulators on the casing, electricians on the burner management system, scaffolders building the next level. Each crew is on its own permit, but their hazards overlap. A grinder on the scaffold sends sparks onto insulators working below. A crane lift passes over another crew's work area. Plants manage this through daily coordination meetings, a permit board that shows all active permits in an area, and rules such as no work directly beneath other work unless the lower level is protected. Simultaneous operations, sometimes called SIMOPS, are reviewed by the issuer before permits in the same area are issued.

The site's emergency arrangements also overlap. Every site has its own alarms: a general evacuation, a toxic gas release, sometimes a separate alarm for a fire in one unit. Kiera learns the station's alarm tones in orientation and where her muster point is, and she checks the wind direction on the nearest windsock each morning, because a gas release is escaped by moving crosswind and upwind, not just away from the source.

Noise on site

Some hazards affect the whole site rather than one job. Noise is the most common. Grinders, gouging, air arc, impact wrenches, fans and steam venting can push sound levels above 90 dBA across large parts of a plant during an outage, and long exposure causes permanent hearing loss. Noise exposure is measured as a dose: the fraction of the allowed exposure a worker has received. The allowed time halves for each increase in level by the exchange rate.

Here T is the allowed time in hours at sound level L, under OSHA's noise standard for general industry, 29 CFR 1910.95, the criterion level is 90 dBA and the exchange rate q is 5 dB; a dose of 50 %, equivalent to 85 dBA for eight hours, is the action level at which a hearing conservation program is required; C is the time actually spent at each level and D is the dose in percent. A dose above 100 % means the worker has exceeded the limit, and hearing protection must bring the level at the ear below it. The code below works out a day's dose for Kiera from the levels Imran measured on the outage.

# Daily noise dose for one shift (OSHA: 90 dBA, 5 dB exchange)
import math
Lc, q = 90, 5           # criterion level dBA and exchange rate dB
tasks = [("toolbox meeting and permit", 85, 1.0),
         ("grinding tube ends", 98, 2.5),
         ("fitting and tacking", 88, 4.0),
         ("near gouging crew", 102, 1.0),
         ("lunch and breaks", 70, 1.5)]
dose = 0.0
for name, level, hours in tasks:
    allowed = 8 / 2 ** ((level - Lc) / q)
    dose += 100 * hours / allowed
    print(f"{name:<28}{level:4d} dBA {hours:4.1f} h  allowed {allowed:6.2f} h")
print(f"daily dose: {dose:.0f} %")
twa = Lc + q * math.log2(dose / 100)
print(f"equivalent 8-hour level: {twa:.1f} dBA")

toolbox meeting and permit    85 dBA  1.0 h  allowed  16.00 h
grinding tube ends            98 dBA  2.5 h  allowed   2.64 h
fitting and tacking           88 dBA  4.0 h  allowed  10.56 h
near gouging crew            102 dBA  1.0 h  allowed   1.52 h
lunch and breaks              70 dBA  1.5 h  allowed 128.00 h
daily dose: 206 %
equivalent 8-hour level: 95.2 dBA

The result is far above 100 %, almost all of it from the grinding and the time near the gouging crew. Earplugs or earmuffs with a practical attenuation, used for the whole of those tasks, bring the dose under the limit, and Ironbridge's hearing conservation program adds annual hearing tests so that any loss is caught early. The difference between rules matters: Canadian provinces and many plant owners use the stricter 85 dBA and 3 dB rule, under which the same day gives a much higher dose, and some Gulf Coast owners apply it on their sites.

Reporting incidents and near misses

Every site expects incidents and near misses to be reported at once: injuries, however small, damage to equipment, spills, releases, fires, and events that could have hurt someone but did not. A near miss, such as a dropped wrench that lands a meter from someone, is reported because the next one might not miss. Reports go to the foreman first and then to the contractor's safety advisor and the owner. Serious incidents must also be reported to the regulator, and the scene is left undisturbed except to make it safe or help the injured until the investigators release it. The purpose of the investigation that follows is to find out why the incident happened and to fix the system, not to find someone to blame. Ironbridge shares the lessons from each investigation at the next morning's toolbox meetings across all its jobs.