The evacuation reaches every person, with the muster point that applies
It is declared from the control room, plant-wide or by zone. Each watch or phone vibrates and shows the way to the muster point that belongs to it in that scenario: an arrow, the metres still to go and an alert on arrival. From there, the headcount runs on its own.
plant-wide or by zonemuster point by scenarioposition every 3 s
The siren sounds. And everyone heads wherever they think.
The site’s emergency plan (plan de autoprotección) says where to go. The day it is tested is a drill in good weather, with everyone warned in advance and the usual workforce.
The problem isn’t that people don’t know they have to leave. It’s that what they know is the usual muster point, and on that day it may not be the right one.
The PA system doesn’t reach everywhere
Inside a hall with the compressor running, or with hard hats on, the siren can be heard and the message can’t. Anyone far away knows they have to leave, but not which way out or where to.
The usual muster point doesn’t work for everything
It was designed for a fire inside the plant. With a gas leak, the one downwind is the last place to send anyone; with a tsunami, it may be in a flood-prone area.
The contractor who arrived this morning didn’t do the drill
They know which gate they came in through. They don’t know which of the two muster points is theirs, and they will follow whoever is in front of them.
The official alert goes to personal phones, and personal phones aren’t allowed in
In a classified area a personal phone is not intrinsically safe, and in half the plant nobody carries one. And even if it gets through, ES-Alert says what is happening in the province, not which point in your plant to go to.
It is declared from the control room, and it reaches every device
Whoever is handling the emergency starts it from the control room with two decisions: plant-wide or by zone, and which scenario it is. With those, the system knows whom to alert and which muster point to send each one to.
Each watch or phone vibrates, gives the reason and shows the bearing and the metres still to go to its point; the phone also shows the plan with the hazard, the wind and the route along the roads. During the evacuation the watch sends its position every three seconds, and when the device enters the muster point’s geofence it confirms it: that is the data that adds to the headcount.
IN THE CONTROL ROOM · COMPRESSION LEAK · PR-2 CLOSED
Plant-wide or by zone
A leak in compression doesn’t empty the whole plant. The unit is evacuated, along with the ones downwind, and the rest of the plant carries on working with the alert in view in the control room. When everything is needed, it’s one more button.
The scenario decides the muster point
Each scenario has its valid muster point and its closed points. It is set up once, with the plant in front of you and no rush, and on the day it happens nobody has to decide it over the radio.
And a drill runs the same way
Same button, same route on every device, marked as a drill. It is logged as one, so testing the plan doesn’t pollute the record of real emergencies.
LEAVING
The reason, the point assigned to them and how far is left. Real screenshot from the Wear OS app.
ON ARRIVAL
The watch confirms entry into the geofence. It is the figure that closes the headcount.
Three emergencies, three different muster points
The mechanism doesn’t change. What changes is which muster point is ruled out, and that is decided once per scenario.
Gas leak
The muster point downwind is closed for that scenario. The routes from the affected unit point to the one on the opposite side, and so do those from the rest of the plant, because an evacuation by zone never sends anyone across the cloud.
Fire spreading
With a fire coming in from the west, the right point is the one to the east. Today the emergency coordinator decides that on the spot, over the radio; here it is decided when the scenario is set up, with the plant in front of you and no rush.
Tsunami or flood
The usual muster point may fall in a flood zone. The route for this scenario climbs to high ground, and that can only be decided on the day the zones are drawn, not the day the wave arrives.
The emergency that doesn’t start inside your plant
There are emergencies your plant doesn’t cause but that still affect it: a flood, a fire spreading, a leak at the neighbouring installation. Almost all of them have something a fall doesn’t: they come with a warning and time ahead, and that time is only worth something if it turns into people moving.
The most demanding case is right on our doorstep. Huelva, Spain, sits on the Gulf of Cádiz, the area of mainland Spain with the highest tsunami risk: the wave from the 1755 Lisbon earthquake reached the Huelva coast 55 minutes after the tremor, with the chemical cluster on the estuary. But the mechanism isn’t specific to Huelva. The threat changes and so do the minutes; what you do with them is the same in Tarragona, Puertollano or Avilés.
When an alert is issued, Spain sends it out through ES-Alert to mobile phones. But in a classified area personal phones aren’t allowed in, they aren’t intrinsically safe, and in half the plant nobody carries one. And even if it gets through, it says what is happening in the province, not which point in your plant to go to.
The watch does get through, and so does the company phone with the app, ATEX-certified ones included, with what the plant’s plan says. From there it is the same evacuation as above, with the scenario that applies: the tsunami route climbs to high ground rather than to the usual muster point, which may be in a flood zone. Who is missing and where they were last, and the log with the time of each event, are the same as in any other.
A tsunami drill on the phone: the official alert, the minutes left and what the plant’s plan says. Real screenshot of the app.
Today a person starts the evacuation from the control room as soon as the alert arrives. Having the alert come in on its own, from European seismic networks or from AEMET (Spain’s weather service) or Protección Civil (civil protection) warnings, is on the product roadmap.
What this doesn’t do
It doesn’t decide to evacuate. A person declares it, using the judgement of the emergency plan and of the emergency coordinator; the system gives the order, ready-made, for each person, and the data they lack today while people are leaving.
It guides whoever carries a watch or a phone with the app. The badge, in development, will alert with vibration and a beep, but with no screen it can’t show the route. A visitor who comes in for two hours with an escort is still a matter for access control and for whoever escorts them. What this solves is the workforce and the contractors, which is where the volume is.
And with the watch it is deployed where there is no explosive atmosphere. In classified areas the app runs on ATEX-certified phones, and the ATEX-certified watch is in development. The device changes, not the system.
See it with your plant in front of you
The mock-up is the control room at work: an evacuation is launched, each watch gets its heading and the counter climbs while people enter the muster point.