Rescue planning and attendants

On the third day of the outage, Kiera spends a shift outside the steam drum rather than in it. She is the attendant at the north manway, with a clipboard, a radio, a gas monitor and an air horn, and her only job is the two boilermakers working inside. Dale tells her it is the most important job on the crew that day and the easiest one to do badly. An attendant who wanders off to fetch a tool, starts a conversation with the scaffold crew or helps with work at the manway is not watching the entrants. Then, after lunch, the station's rescue team runs a drill on the mud drum, and Kiera sees how long it actually takes to get an unconscious worker out of a horizontal drum through a manway the size of a dinner tray.

The attendant

OSHA's permit space rule requires at least one attendant outside the space for the duration of every permit entry. The attendant must know the hazards of the space and the signs of exposure, keep an accurate count and identity of the entrants, stay outside until relieved by another attendant, communicate with the entrants and monitor their status, watch conditions inside and outside the space, order the entrants out if conditions change or the attendant sees signs of exposure, summon rescue and emergency services, keep unauthorized people away, and perform non-entry rescue where the procedures call for it. The attendant must not do any other duty that interferes with monitoring and protecting the entrants. One attendant may watch more than one space only if the program allows it and the attendant can still do all of those duties for every space.

In practice, the attendant's work looks like this. Kiera checks the permit and the gas readings at the start of the shift and knows the retest time. She logs each entrant in and out on the board at the manway. She talks to the entrants every few minutes by voice or radio and knows what each of them is doing and where in the drum they are. She watches her own monitor and the ventilation, and listens for anything that changes: a blower stopping, an alarm, a change in the entrants' voices. If any of that goes wrong, she orders the entrants out. If an entrant does not answer, or collapses, she raises the alarm through the station's emergency number and starts the rescue plan from outside. She never enters.

Why rescue has to be planned

A person who stops breathing has only a few minutes before brain damage begins. A person who is unconscious in a low-oxygen atmosphere has even less time, because they are still breathing the bad air. A rescue that relies on calling the public emergency number and waiting for a fire truck will not arrive in time for an atmospheric emergency in a boiler drum, and most municipal crews are not equipped to get a person out of a drum anyway. The rescue has to be on site, ready, equipped and practiced before the entry begins.

OSHA's permit space rule requires the employer to evaluate any rescue service it relies on for its ability to respond in a time appropriate to the hazards of the space and to perform the rescue, and to give the service access to the spaces so it can plan and practice. An in-house rescue team must be trained in the rescue duties and the PPE they need, include at least one member trained in first aid and CPR, and practice a permit space rescue at least once every twelve months in a representative space. Large owners such as Riverbend keep a trained industrial rescue team on site during outages, and the entry permit names it.

Non-entry and entry rescue

The safest rescue is the one that does not put anyone else inside the space. In a non-entry rescue, the entrant wears a full-body harness attached to a retrieval line, and the line runs to a mechanical winch on a tripod or davit above the opening. If the entrant collapses, the attendant or the rescue team cranks them out without entering. For a vertical entry, such as the top manway of a tank or a vessel, this works well. OSHA requires a retrieval system for every vertical permit space entry deeper than 5 ft, unless the equipment would increase the overall risk of entry or would not contribute to the rescue; Ironbridge applies the same rule to all its jobs.

A horizontal drum is a different problem. The steam drum's internals, separators, baffles and feed piping, mean that an entrant twenty feet along the drum is around several corners from the manway. A retrieval line attached to their harness would drag them into the internals rather than out of the drum. For the drums and the furnace, Riverbend's plan is an entry rescue: two members of the rescue team, wearing breathing apparatus if the atmosphere is suspect, enter, assess the casualty, give first aid, package them on a flexible stretcher designed to pass through small openings, and haul them out with a rope system rigged at the manway. Lines and stretchers are staged at the manway before the entry begins, not in a truck at the gate.

The size of the opening matters. A boiler drum manway is typically an ellipse of about 12 by 16 in. A conscious worker can squeeze through it, but an unconscious one, packaged with a harness and possibly a breathing apparatus cylinder, cannot be pulled through easily. The rescue plan for each space considers whether a casualty can be got out through its openings at all, and if not, what alternative exists: a second manway, a larger access door, or cutting an opening as a last resort. At Northgate, the coker drum rescue plan uses the top head opening, which is much larger, with a crane-mounted man-basket on standby.

Timing a rescue

Rescue drills give real times. The code below adds up the stages of a rescue from the mud drum, using times from Riverbend's drill, and compares the total with the time a person can survive without breathing. The point is not the exact numbers, which vary with every space and team, but which stages take the longest and what could shorten them.

# Rescue timeline from the mud drum drill (minutes)
stages = [
    ("attendant notices no response and raises alarm", 0.5),
    ("rescue team receives call and moves to Unit 2",  3.0),
    ("team dons breathing apparatus at the manway",     1.5),
    ("first rescuer enters and reaches casualty",       1.5),
    ("assess, first aid, package on stretcher",         4.0),
    ("haul casualty out through manway",                3.0),
]
t = 0.0
for name, dt in stages:
    t += dt
    print(f"{t:5.1f} min  {name}")
print(f"total time to casualty out: {t:.1f} min")
print(f"time until a rescuer reaches the casualty: {sum(d for _, d in stages[:4]):.1f} min")
print("brain damage can begin after about 4 minutes without oxygen")
# effect of staging the team at the drum during entries
staged = [(n, (0.5 if 'moves' in n else d)) for n, d in stages]
print(f"with the team staged at Unit 2: reach casualty in {sum(d for _, d in staged[:4]):.1f} min")

  0.5 min  attendant notices no response and raises alarm
  3.5 min  rescue team receives call and moves to Unit 2
  5.0 min  team dons breathing apparatus at the manway
  6.5 min  first rescuer enters and reaches casualty
 10.5 min  assess, first aid, package on stretcher
 13.5 min  haul casualty out through manway
total time to casualty out: 13.5 min
time until a rescuer reaches the casualty: 6.5 min
brain damage can begin after about 4 minutes without oxygen
with the team staged at Unit 2: reach casualty in 4.0 min

The drill showed what the planners suspected. Nearly half the time to reach the casualty was the team getting to the boiler, and the second-largest piece was donning breathing apparatus. For entries where the atmosphere could change suddenly, Riverbend now stages two rescue team members at the boiler with their equipment ready, and the entrants wear an escape respirator. For the routine drum inspections, where the atmosphere is well controlled and continuously ventilated, the team responds from its base. The difference is decided in the hazard assessment for each entry.

Communication and signals

The attendant has to know at every moment that the entrants are all right. In a small, quiet space, voice works. In a long drum with blowers running, or when entrants are wearing respirators, radios are needed, and the attendant checks in at a fixed interval and expects an answer. Where radios do not work, because of the steel around the space or a hazardous location rating, a tag line with a set of tug signals or a hard-wired intercom is used. Every crew agrees its signals before entry and writes them on the permit or the hazard assessment. The rule for silence is simple: if an entrant does not answer a check, the attendant treats it as an emergency until proven otherwise.

Rescue equipment and self-rescue

Rescue equipment is checked before every entry, not when it is needed. The tripod or davit and its winch are inspected and set up over the opening; the retrieval line is attached to the entrant's harness where the plan calls for it; the stretcher, rope system and breathing apparatus are staged at the opening with the rescue team's sign-off on the permit. Breathing apparatus cylinders are checked full. The radios and the alarm are tested at the start of the entry. An escape respirator, where the plan requires one, is worn by the entrant, not left at the manway.

The best rescue is the one an entrant performs on themselves. Entrants are trained to leave a space at once, without being told, when their monitor alarms, when they feel unwell, when they notice a change such as a smell, a sound or a blower stopping, or when the attendant orders them out. They do not finish the weld or tighten the last bolt first. Leaving early costs a few minutes and a retest; staying costs lives. Every entrant also knows the second way out of the space, if there is one, and keeps the route to the manway clear of hoses, leads and tools so that it is never blocked.