Loss of Ventilation During a Wet-Well Confined Space Entry

1. Evacuate, do not enter. Order the entrants out using the tripod and winch, and put a person at the entry to prevent anyone going down. The instinct to 'go and get them' is the single largest cause of multiple-fatality confined-space incidents; a would-be rescuer without respiratory protection becomes a second casualty within seconds.

2. Alarm and account for everyone. Raise the plant emergency response, confirm all three persons are out and conscious, and call for medical assessment. H2S is a chemical asphyxiant: 14 ppm exceeds typical short-term exposure limits (many jurisdictions set 8-h limits of 5–10 ppm and short-term limits around 10–15 ppm, against an IDLH of 100 ppm), and anyone with headache, nausea, eye irritation or a period of breathlessness needs evaluation. Note that smell is not a guide - olfactory fatigue and paralysis occur at higher concentrations.

3. Re-establish control of the space. Isolate the well (lock out the jetting or mixer equipment), replace barriers, and have the space ventilated and tested continuously with a calibrated instrument before any re-entry. Do not use the site monitors to make decisions.

4. Preserve evidence before it is cleaned up. Download the personal and entry-point monitors, photograph the blower panel and the tripped RCD, sequester the permit and the contractor's rescue plan, and take statements while memories are fresh. Once the shift ends and the hose is packed away, the investigation has nothing to work with.

5. Notify. Inform the contractor's safety manager and your client's management, and make the regulatory notification required in your jurisdiction - an unplanned loss of ventilation with entrants in the space and a breached permit is normally reportable even without injury.

6. Suspend the work pending investigation. The fact that the work continued to the end of the shift is itself a finding: nobody on site recognised the event as an incident.

Critical (life-threatening) - engineering and monitoring:

1. Loss of ventilation. Forced air was the only control actually keeping the atmosphere safe, and it depended on a single circuit protected by an RCD that could trip. There was no airflow sensor, no alarm at the entry point, and no interlock between airflow and the permit. Any engineering control with a single point of failure and no detection is not a control, it is a hope.
2. Wrong monitoring location and invalid instruments. The entry-point panel read 0 ppm while the entrant's personal monitor peaked at 14 ppm - a textbook demonstration that gas must be measured at the work face and at the entrant. Worse, the bump test was 11 days overdue and the calibration gas had expired two months earlier, so every reading on site, including the reassuring zero, was evidentially worthless. Instrument reliability is part of the control.

High - administrative and emergency response: 3. The attendant left the post. The standby person is the last line of defence and the only link between the entrants and the surface; assigning that person other duties removes the control entirely. 4. Rescue plan 'call 911'. A municipal emergency service cannot reach the bottom of a 4.5 m wet well and retrieve an unconscious casualty within the two to three minutes an H2S exposure allows. A workable plan needs a trained rescue team, retrieval equipment rigged for immediate use, and a drilled response time.

Moderate - permit discipline: 5. Permit extended verbally and read across past its expiry with no re-test. The permit is the control document; if it can be extended by word of mouth it provides no barrier at all. There was also no recorded gas test at the work face at any point.

Ranking logic. Controls are ranked by two questions: can this failure alone kill someone, and what would have caught it? The ventilation failure and the invalid monitoring both answer yes to the first, and neither had any independent detection - so they come first. The attendant and the rescue plan determine whether a bad outcome becomes a fatality. The permit failures are systemic enablers: they allowed all of the others to persist unnoticed.

Investigation structure. Use a bow-tie around a single top event: an IDLH atmosphere at the work face with entrants present. Threats on the left: loss of ventilation, unexpected gas generation from the sludge, reverse flow through the suction line, instrument failure, entrant error. Consequences on the right: incapacitation, fatality, failed rescue. Then test each barrier against the evidence: which barriers existed, which were present but failed, and which never existed at all. A 5-why chain gives the proximate story - blower stopped because the RCD tripped, nobody noticed because there was no airflow alarm, there was no airflow alarm because the entry was designed around a single blower with no failure detection. Stop the chain when you reach a barrier that can actually be built.

Corrective actions, in hierarchy order:

Eliminate/reduce the entry: clean the wet well from the surface with a vacuum or jetting nozzle wherever the geometry permits; the only reliable way to control a confined-space atmosphere is to remove the need for people to be in it.

Engineering: two blowers on independent circuits, one on essential power, with an airflow sensor and audible/visual alarm at the attendant post; alarm contacts interlocked so that loss of airflow invalidates the permit and sounds at the entry; gas detection at the work face and on each entrant, bump-tested at the start of every shift with a documented log and calibration-gas expiry control; a retrieval system rigged and tested before entry.

Administrative: permit revalidation with a recorded gas test before any extension; attendant with no other duties, in continuous voice or radio contact; a rescue plan with a nominated team, equipment on site, and a drilled response; stop-work authority written into the contractor's method statement and exercised without blame.

PPE: harnesses, escape sets, personal monitors as the last line, not the control.

Conditions to resume. (1) All engineering controls installed and function-tested in the presence of the client's representative; (2) a witnessed rescue drill at the actual well; (3) instrument records verified as current; (4) revised permit and rescue plan reviewed and signed; (5) an independent audit of the contractor's confined-space arrangements, because this event suggests a pattern rather than a one-off. Only then restart - and start with a supervised trial entry at reduced duration, with a stand-by rescue team present on site.