H2S Detector Bypass, Hot Work and Production Pressure
A sour gas gathering station handles 45 MMscfd at 1,180 ppm H2S. Two fixed H2S monitors cover the process area; one failed 11 days ago and the spare is held in customs. The remaining detector sits on the upwind edge. The night supervisor has placed the failed channel in bypass so the control room does not receive a continuous fault alarm, and has not told the day superintendent. A hot-work permit is open 30 m from the inlet separator for flange insulation removal. Two contractor fitters do not carry personal monitors or escape sets. One tells you he smells rotten eggs near the drain and has a headache. Production is at 92% of a take-or-pay nomination; a shutdown costs about $180,000 per day, and the country manager has emailed that 'we cannot afford another trip'. Wind is 2 m/s toward the contractor laydown where 14 people are in a safety meeting.
1. State your actions in the first 30 minutes, in order, with the reasoning behind each.
Read the worked answer
Treat the smell and headache as a possible exposure, not a nuisance. The odour threshold for H2S is below 1 ppm, but at 1,180 ppm olfactory fatigue is rapid, so a person who still smells rotten eggs is near a source and may soon lose the ability to detect it. Headache is consistent with exposure.
First: stop the hot work and remove the ignition source; a flammable gas release is possible alongside the H2S. Second: sound the station alarm, direct all personnel, including the 14 in the laydown, to muster upwind and account for everyone. Third: isolate the drain and the inlet separator, and approach with breathing apparatus and personal monitors; do not send unprotected fitters to investigate. Fourth: verify gas concentrations at the drain, the laydown and the control room intake, and establish an exclusion zone. Fifth: notify the superintendent, HSE and the control room, and record the times. Sixth: provide first aid and medical assessment for the symptomatic fitter. Do not restart production until the source is found and the area is gas-free.
2. What are your professional and ethical obligations regarding the bypassed detector and the country manager's email?
Read the worked answer
The bypass is a defeat of a safety-critical device. It required a management-of-change review, a risk assessment and compensating measures, and it was concealed from the day superintendent. That is a reportable integrity issue, not an administrative shortcut. Placing a failed channel in bypass to silence a fault alarm removes the only warning for a toxic release and is precisely the kind of normalisation the profession must resist.
My obligations are to: restore or replace the detection, or install continuous portable monitoring with written compensating measures approved by operations management; inform the superintendent and HSE in writing; report the loss of safety-critical equipment and the release to the regulator within the statutory timeframe; and document the decision trail, including the email. The country manager's instruction is production pressure, not a technical direction, and I should respond in writing that I cannot comply while the safety case is breached and that I am exercising stop-work authority. If overruled, escalate to the asset general manager and the professional body's ethics process. Concealing the bypass or the exposure would be a breach of professional conduct and possibly a legal offence.
3. Set the conditions for restarting the station. Which of them are non-negotiable?
Read the worked answer
Non-negotiable: the H2S source is identified and repaired or isolated; gas testing shows the area below alarm thresholds; at least two independent detection paths are working, or a written compensating-monitoring plan is approved and staffed; personal monitors and escape sets are issued to everyone in the process area; the hot-work permit is closed and a new gas test is done before any hot work resumes; the exposed fitter is medically assessed and the incident is reported.
Also required: a management-of-change record for the bypass and its removal; a review of why the spare took 11 days and a critical-spares stockholding change; a communication to the contractor workforce; and a documented stop-work decision. The restart should be authorised by the superintendent, not the night supervisor, and production ramp-up should be staged while the drain and separator are monitored. The $180,000 per day is a real cost, but it is an order of magnitude below the cost of a fatality, a regulatory shutdown and the loss of licence to operate.