Plant Safety & Situational Awareness

Situational awareness is a diagnostic skill. It is not a poster, and it is not the ten seconds of nodding you do before signing a form.

It is the ability to walk up to a machine you may never have seen and answer three questions before you touch anything: what here can move, what here can release, and who else is working on this. Everything else in this chapter is a method for answering those three reliably, under time pressure, on a plant that is still running around you.

The reason it is the first chapter is that every other skill in this course assumes it. You cannot measure a circuit you have not made safe to approach, and a diagnosis is worth nothing if arriving at it puts you in hospital.

Hazard and risk are not the same word

A hazard is something with the potential to cause harm — stored pressure, a rotating shaft, 480 V, a chemical, a load suspended overhead. Hazards are properties of the plant. They are there whether or not anybody is present.

Risk is the chance that a particular hazard harms a particular person doing a particular thing. Risk depends on you: where you are standing, what you are about to do, what you know, and what you have controlled.

The distinction matters because it tells you what you can change. You very rarely get to remove a hazard on a callout at two in the morning. You almost always get to change the risk.

The plant does not know you are there

This is the sentence worth carrying out of the chapter. A machine has no awareness of you. It has a sequence, a set of inputs, and a PLC that will do exactly what it was told the moment its conditions are met.

That has a consequence people learn late and expensively: a machine that is not moving is not the same as a machine that is safe. It may be waiting on a sensor. It may be part-way through a cycle with a timer running. It may be under remote control from a station you cannot see. It may be stopped only because upstream has starved it, and upstream is about to recover.

Stillness is not a safety condition. Isolation is, and that is Chapter 2.

Energy is the thing you are actually looking for

Almost every serious injury on a plant is stored or transmitted energy arriving somewhere a person is. So the useful habit is to stop cataloguing machines and start cataloguing energy.

The list matters more than it looks. The commonest fatal mistake is not failing to isolate — it is isolating one energy source, feeling protected, and walking into a second one that was never on the list. Electrical isolation on a machine with a raised platen and a charged accumulator has controlled a third of the problem.

The hierarchy of controls, and why PPE is at the bottom

When you are deciding whether a job is safe to do, you are really asking which control is protecting you and how much weight it will bear.

Read it as a reliability ranking, not a menu. Elimination and substitution act on the hazard and keep working when everybody is tired. Engineering controls — a fixed guard, an interlock, a physical isolating device — work whether or not you remembered them today. Administrative controls — procedures, permits, training, signage — only work if a human reads and follows them. PPE works only if it is present, worn, correct for the hazard, and undamaged.

The trap is that the ranking runs almost exactly opposite to visibility. Nobody photographs a well-designed interlock. Everybody notices a missing glove. Sites under pressure drift down the hierarchy because the bottom is the part that can be audited from a distance — which is how a plant ends up with excellent PPE compliance and a guard that has been defeated for two years.

Permits are a conversation with a record attached

A permit to work is not paperwork. It is a structured conversation between the person who owns the plant and the person about to work on it, and the document is only the receipt.

The permit types you will meet most often:

• Hot work — welding, grinding, cutting, anything producing sparks or flame. Usually carries a fire watch and a defined period after the work stops, because ignition is often delayed.
• Confined space — anywhere with restricted entry and exit and a potential atmosphere problem: tanks, silos, pits, some large machine enclosures. Atmosphere testing, a standby person, and a rescue plan are the substance; the form is not.
• Working at height — anything where a fall is possible, which includes far more of a plant than people expect.
• Line breaking — opening any pipe or vessel that has contained a product, chemical, steam or pressure.
• Electrical work — energized work in particular. NFPA 70E treats working on live equipment as the exception, not the default: it wants an energized electrical work permit and a documented reason the equipment cannot be put into an electrically safe work condition first. That is a specific authorization, not a general permit.

What actually makes a permit work is its conditions and its validity. A permit says what has been isolated, what has been tested, what must stay in place, and for how long. When those conditions change — a shift ends, a second crew arrives, an isolation is lifted, the atmosphere test ages out — the permit is no longer telling the truth about the plant, whatever it says on the paper.

Reading a live process area

Working around running plant is a normal part of the job. Being deliberate about it is what separates a technician who does it for thirty years from one who has an accident in the first two.

Use your senses as instruments, and know what each one is worth. Sound is the fastest and most sensitive channel you have — you will hear a bearing, a leak or a motor laboring long before an instrument shows it. Smell catches hot insulation, burning belts and coolant. Sight catches the slow things: a browned terminal, a hydraulic weep, a build-up where product is escaping. Touch is the one to be careful with, because the temperatures that damage a hand arrive faster than the reflex to move it.

Know where you are standing. Not in a line of fire, not under a suspended load, not inside the swing of a robot or the pinch of an infeed, not where an opening door will trap you. Ask yourself where you would go if something let go right now, and make sure that place exists before you need it.

Know how the machine starts. Remote start from an HMI at the other end of the line, an automatic restart after a fault clears, and a colleague pressing reset without knowing you are inside are three routes to the same injury.

When it has already happened

Everything above is about preventing an incident. This is the part most training stops before, and it is the part you will need at two minutes' notice with no time to look anything up.

Your first job is not first aid. Unless you are trained and it is safe to approach, your first job is to stop there being a second casualty. Rescuers walking into the thing that got the first person is one of the most reliable patterns in serious industrial accidents — the gas that dropped somebody in a pit, the conductor that is still live, the load that has not finished moving. Make the scene safe, then help.

Raise the alarm properly. An emergency call is only as good as the information in it, and on a large site the thing that costs minutes is not the ambulance, it is the ambulance finding you. Have ready:

• Where you are, precisely enough for someone who has never been here — site name, building, gate or entrance to use.
• What happened, and to how many people.
• What hazards are still present, because that changes who they send and how they approach.
• Who is meeting the ambulance at the gate, and who is opening it.

Know the arrangements before you need them. Who the first aiders are, where the nearest kit and defibrillator are, what number to call on this site — an internal emergency number is common, and dialing 911 directly instead can delay access through a controlled gate. On a customer's site this is a question you ask when you sign in, not when somebody is on the floor.

Say the thing that changes the treatment. A few injuries look trivial and are not, and the words you use decide how they are handled:

• Hydraulic injection — Chapter 11. The entry wound looks like a splinter. Say the words "high-pressure injection injury" and name the fluid.
• Chemical exposure — name the substance and hand over the safety data sheet. Some exposures have specific antidotes and a delay is the whole problem.
• Electric shock — say so even if the person seems fine. Cardiac effects can be delayed, and "they were thrown across the room but they are up and talking" is still a hospital case.
• Arc flash — flash burns to the eyes can develop hours later.

Afterwards. Do not tidy up. The scene is evidence and moving things is a problem for the investigation and for the injured person's own record. Report it through your employer's process the same shift, and on a customer's site report it to both your employer and the site — the reporting duties are separate and each of you has them. Some injuries are legally notifiable and the clock is short — OSHA wants a fatality reported within 8 hours, and an amputation, loss of an eye or an inpatient hospitalization within 24, on top of what goes on the 300 log. Deciding whether one of those applies is not your call to make alone.

Then the part nobody schedules: check on the person, and expect to be affected yourself. Being shaken after an incident is an ordinary response and not a professional failing, and sites that treat it as one get incidents that go unreported.

Situational awareness does not usually fail in a dramatic way. It erodes, and the erosion is comfortable — which is exactly why the failure modes below are worth studying as failure modes rather than as character flaws.

This is not a fault-finding sequence. It is the sequence you run on arrival, before any of the fault-finding in the rest of the course begins. It costs three or four minutes and it is the cheapest thing in this course.

1. Stop at the boundary and look before you enter

   Safety

   Do not walk into the cell while you are still reading the work order. Stop at the edge and spend thirty seconds: what is running, what is stopped, what is raised, what is leaking, where are the other people, what does it smell like. You will never have a cheaper opportunity to notice something wrong, because from here you can still leave without having committed to anything.

2. Know the emergency arrangements before you need them

   Safety

   On a site you do not work at every day: the internal emergency number, where the first aid kit and defibrillator are, who the first aiders are, which gate an ambulance would use and who would open it. Thirty seconds at sign-in, and the alternative is finding out while somebody is on the floor.

3. Find out what the machine is supposed to be doing right now

   Not what it is doing — what it believes it is doing. Is it in auto or manual? Faulted, or waiting? Mid-cycle with a timer running? Under local control, or can somebody start it from an HMI six hundred feet away? A stopped machine in auto with a satisfied fault is a machine about to run.

4. List every energy source, out loud if it helps

   Safety

   Electrical, pneumatic, hydraulic, gravitational, stored mechanical, thermal, chemical, rotational. Walk the list rather than trusting recall, because the one that hurts you is by definition the one you did not think of. Note which have residual energy that outlives their isolating device — accumulators, capacitors, raised loads, coasting rotors.

5. Find out who else has an interest in this machine

   Operators, another trade, a contractor, the shift that just left, a control engineer working remotely. Ask, and ask specifically: is anyone else working on this, and is anything already isolated or removed? A second person's half-finished work is invisible to you and will not announce itself.

6. Decide whether it genuinely needs to be live

   Safety

   Most work does not. Some diagnosis genuinely does — a fault that only exists while running cannot be found on a dead machine. Make that a decision rather than a default: if it must be live, it needs the correct authorization, the correct PPE, and wherever possible a second person. If it does not, isolate it and stop thinking about it. See Chapter 2.

7. Get the permit, then check its conditions still hold

   Safety

   Read what it actually says is isolated and tested, and then verify that independently at the plant. A permit is a claim about the state of the machine at the moment it was written. Your life is being staked on the claim still being true now, and the gap is measured in shifts.

8. Set up your exit and your communications before you start

   Where you would move if something let go, and whether that route is still clear once you have put a toolbox down in it. Whether anyone knows you are in there. Whether you can call for help from where you will actually be — inside a machine, on your knees, with the radio in a bag by the panel is not communications.

9. Re-run this whenever anything changes

   Safety

   A second person arrives, the shift changes, production restarts an adjacent line, you move to a different part of the machine, or the job turns out to be something other than what you were called for. Any of those invalidates the assessment you made on arrival. The most dangerous moment on most jobs is not the beginning — it is the point where the job quietly became a different job.

None of these come from not caring. Every one of them has a reason that makes sense in the moment, which is precisely why knowing the reason is the defense.

• Reading stillness as safety

  Why

  A stopped machine gives every sensory signal of being finished: no noise, no movement, nothing to react to. Your nervous system treats that as safe because in almost every other context it is. The correction is not vigilance, which fades — it is a rule that does not depend on how the machine looks: hands go in after isolation, never before.

• Trusting an isolation you did not apply

  Why

  It is genuinely reasonable to believe a colleague. The problem is that you cannot see what they isolated, only that something is isolated, and you have no way to know whether they found all eight energy sources or the first three. Personal locks exist for exactly this reason: your protection should not depend on the completeness of somebody else's mental list.

• Treating the permit as the thing to be obtained

  Why

  Under pressure the permit becomes an obstacle between you and the job, so the goal quietly shifts from being safe to having the paper. The tell is signing without reading the conditions. The permit is a record of a conversation — if the conversation did not happen, the record is a fiction that will be read out at an inquiry.

• Wearing the hazard instead of removing it

  Why

  PPE is the visible control, so it feels like the responsible choice, and reaching for better gloves is faster than arguing for a guard. But choosing PPE where an engineering control was possible means accepting the hazard and betting on equipment that protects one person and fails silently. Ask what you are actually being protected from, and whether that thing needed to be there at all.

• Not saying anything because you are new

  Why

  The person most likely to spot a normalized deviation is the one who has not normalized it yet, and they are also the one least likely to speak. Being new is not a reason to stay quiet about something that looks wrong — it is the reason you can see it. The question "is it meant to be like that?" costs you nothing and has stopped more incidents than any procedure.

• Rushing the last ten minutes

  Why

  Guards go back on, locks come off, and the machine is handed over — and by then the difficult part is over and the attention has already left. A large share of injuries happen during restoration, not during the work: a guard refitted loose, a lock removed while somebody is still inside, a test run with a tool left in the machine. Treat restoration as a task with its own checks, not as tidying up.

Five questions. Each one is answerable by reasoning about a situation rather than by recalling a rule, which is the point of the whole course.