The call no operations manager should ever receive — and the system failures that make it inevitable.
It was 9:47 PM on a Tuesday when David Kessler's phone rang.
He didn't recognize the number. He almost let it go to voicemail. He'd been watching the Astros game, half-asleep on the couch, and his mind was already on tomorrow's production meeting. But something made him pick up.
It was Sarah. Marcus Herrera's wife.
"David, Marcus isn't home yet."
He sat up. Marcus had been on his route since 6 AM. Eighteen wells across the south section, a couple of pump checks, routine stuff. He should have been home by 5, 5:30 at the latest. It was almost 10.
"He's probably just running late," David said, but even as the words came out, he knew they were wrong. Marcus didn't run late. In fourteen years, the man had never missed dinner without calling.
David started dialing. Marcus's cell went straight to voicemail. He called the night pumper — nobody had seen Marcus since mid-afternoon. He called dispatch — last GPS ping from Marcus's truck showed it stationary at a well site in the southeast corner of the field since 3:12 PM.
3:12 PM.
That was six and a half hours ago.
David was in his truck in four minutes. He called two other operators and told them to meet him there. The drive took forty minutes, which meant the entire time Marcus had been at that site — if he was still there — nobody knew. Nobody checked. Nobody asked.
They found Marcus at the base of a pipe rack. A section of 2-7/8" tubing had shifted and struck him. He was dead. The coroner would later estimate he'd been killed almost instantly, sometime around 3:15 PM.
For six hours and thirty-two minutes, Marcus Herrera lay in the dirt next to a well he'd serviced a hundred times. His truck was parked twenty feet away. His radio was in the cab. His phone had died. And nobody in his company — not his supervisor, not dispatch, not a single system in a multi-million dollar technology stack — noticed that he hadn't moved, hadn't checked in, hadn't come home.
Sarah Herrera found out her husband was dead at 10:43 PM because she was the only person tracking where he was.
This Isn't a Hypothetical
The story above is a composite, but it is not fiction. It is assembled from real OSHA fatality reports, real incident investigations, and real patterns documented across decades of oil and gas field operations. The details change — the name, the well, the piece of equipment — but the structure repeats with devastating consistency.
According to the CDC's Fatalities in Oil and Gas Extraction (FOG) database, 21.5% of all worker fatalities in oil and gas extraction involved workers who were working alone. One in five. Not in confined spaces on a drilling rig with a crew of twelve. Alone. At a well site, a compressor station, a tank battery, a gathering line — the places where lease operators, pumpers, and field technicians spend their days with nobody else around.
The fatality rate in oil and gas extraction runs seven times higher than the all-industry average for U.S. workers, averaging roughly 100 deaths per year. And the leading causes read like a catalog of hazards that lone workers face every single day:
- Vehicle incidents — 40% of all fatalities. Long drives on rural roads, often before dawn or after dark.
- Contact with objects and equipment — 26% of all fatalities. Struck-by and caught-between incidents involving pipe, equipment, and moving machinery.
- Explosions and fires — 15% of fatalities. Tank batteries, vapor recovery units, well completions.
- Exposure to harmful substances — including H₂S, which kills within minutes at high concentrations and accounted for multiple fatalities including a 2019 incident in Odessa, Texas where a pumper responding to an alarm at a waterflood station was overcome by hydrogen sulfide in an enclosed pumphouse. His wife, worried when he didn't come home, drove to the site with their children and was also fatally exposed.
- Falls — from tanks, catwalks, and elevated equipment.
Three out of every five on-site fatalities result from struck-by, caught-in, or caught-between hazards — the exact kind of incident that happens silently, to one person, with no witness.
The Six-Hour Problem
Here's what makes lone worker fatalities different from other industrial accidents: the injury itself is often survivable. What isn't survivable is the time.
In trauma medicine, the concept of the "golden hour" — coined by Dr. R. Adams Cowley at Baltimore's Shock Trauma Institute — holds that a critically injured person's chances of survival are greatest when they receive definitive medical care within the first sixty minutes after injury. While modern research has nuanced this (survival doesn't drop off a cliff at 60 minutes), the underlying principle is unchallengeable: time to treatment is the single most important variable in trauma survival.
Now consider where your lone workers operate. Rural counties. Lease roads that don't appear on Google Maps. Well sites thirty minutes from the nearest paved road and ninety minutes from the nearest trauma center. A 2026 study found that rural trauma patients experience an average of 7-hour delays in reaching definitive care, with transfers averaging 188 miles.
The golden hour isn't just difficult to achieve in the oilfield. It's nearly impossible — unless someone knows immediately that a worker is down.
And that's the core failure. Not the hazard itself. Not the lack of PPE. Not the absence of training. The failure is that nobody knew.
In Marcus's case, the system didn't fail at the moment of the accident. It failed at 3:30 PM when nobody noticed his truck hadn't moved. It failed at 4:00 PM when he didn't check in and nobody followed up. It failed at 5:00 PM when he should have been driving home and no alarm was triggered. It failed at every minute of every hour between 3:15 PM and 9:47 PM, when the only monitoring system that worked was a wife who expected her husband for dinner.
The Check-In Illusion
Most operators will read this and say, "We have check-in procedures." And they do. A morning safety meeting. Maybe a midday radio call. Perhaps a text at end of shift. Some companies use apps that require field workers to press a button every few hours.
These systems create the appearance of monitoring without the reality of protection.
Consider what a check-in actually tells you:
- At the moment the button was pressed, the person was alive and had phone service.
- That's it.
It doesn't tell you where they are. It doesn't tell you what they're doing. It doesn't tell you whether they've been exposed to H₂S since the last check-in. And most critically, it doesn't trigger a response until the next scheduled check-in is missed — which could be hours away.
A pumper checks in at noon. Gets struck by shifting pipe at 1:15 PM. The next check-in isn't until end of shift at 5:00 PM. Nobody notices a missed check-in until 5:30 PM. By the time someone drives out to investigate, it's 6:30 PM or later.
That's five hours of a person lying in the field. Five hours where a survivable injury becomes an unsurvivable one. Five hours where a family waits and doesn't know.
The check-in system didn't fail. It worked exactly as designed. The design is the failure.
What "Keeping Tabs" Actually Means
Real lone worker protection isn't a check-in button. It's a system that knows — continuously, passively, and in real-time — where your people are, whether they're moving, and whether something has gone wrong.
This requires three things:
1. Continuous Location Awareness
Not periodic check-ins. Continuous. The system should know where every field worker is at all times — not because Big Brother is watching, but because when someone doesn't move from a well site for ninety minutes during what should be a thirty-minute pump check, that's a signal. When a truck hasn't left a location by the time the route says it should have, that's a signal. When the GPS track stops mid-route on a county road, that's a signal.
This isn't surveillance. It's the same principle as aviation transponders. We don't track aircraft to spy on pilots. We track them so that when something goes wrong, we know exactly where to send help — immediately.
2. Automated Escalation
When a signal fires, the response can't depend on a dispatcher noticing it, or a supervisor checking a screen, or someone remembering to follow up. The escalation has to be automatic and immediate. Worker stationary beyond expected duration → alert to supervisor. No response from supervisor within five minutes → alert to safety coordinator. No movement and no contact within fifteen minutes → emergency response initiated with exact GPS coordinates.
This is what separates a monitoring system from a protection system. Monitoring tells you what happened. Protection changes what happens next.
3. Integration with the Daily Work Plan
Here's what most standalone lone worker systems miss: they operate in isolation. They know where a person is, but they don't know where the person should be. They don't know the planned route, the expected duration at each stop, or the risk profile of each location. Without that context, every alert is either a false alarm or a surprise.
When lone worker monitoring is integrated into the operational plan — when the system knows that this operator is supposed to be at Well 14-7 for a pump inspection that typically takes 25 minutes, and it's now been 90 minutes with no movement — the alert isn't just "worker stationary." It's "worker stationary for 65 minutes beyond expected task duration at a site with a history of H₂S readings." That context changes the urgency, the response, and the outcome.
The Cost of Not Knowing
After Marcus's death, the investigation revealed what investigations always reveal: the company had safety policies. They had check-in procedures. They had hazard assessments. On paper, they were compliant.
But compliance didn't bring Marcus home.
The aftermath played out the way it always does. OSHA investigation. Citations. Legal proceedings. A wrongful death settlement that was sealed but rumored to be significant. Workers' compensation claims. The company hired a safety consulting firm. They updated their procedures. They added another layer of check-ins.
And within six months, the new procedures were being skipped because they slowed down the work, and there was no system to enforce them.
The financial cost of a lone worker fatality is devastating — legal liability, regulatory penalties, increased insurance premiums, lost productivity, recruitment costs. Industry estimates put the total cost of a single workplace fatality at $1.4 million or more when you factor in direct costs, indirect costs, and organizational impact.
But the real cost isn't financial. The real cost is the phone call at 9:47 PM. The real cost is a family that will never be whole again. The real cost is an operations manager who will carry that night with him for the rest of his career, asking himself the question that has no good answer:
How did we not know?
The Question You Should Be Asking Right Now
Tomorrow morning, your field teams will leave the yard. They'll drive to well sites, compressor stations, tank batteries, and pipeline right-of-ways. They'll work alone, in rural locations, sometimes hours from the nearest hospital. Some of them will encounter hazards — shifting equipment, H₂S pockets, unstable ground, high-pressure systems.
Ask yourself three questions:
1. Right now, do you know where every one of your field workers is?
Not where they were at the last check-in. Right now. If one of them stopped moving thirty minutes ago, would you know?
2. If someone went down at 2:00 PM, when would you find out?
Not when could you find out. When would you find out? Based on your current systems and procedures, how many hours would pass before anyone raised an alarm? Be honest.
3. If a spouse called you tonight and said their partner hadn't come home, could you tell them where to look?
Could you pull up a screen and say, "Their last known location was here, at this time"? Or would you start making the same phone calls David Kessler made, hoping someone remembers seeing them, hoping the GPS in their truck has a recent ping, hoping that wherever they are, it's not too late?
If you can't answer all three of those questions with confidence, your lone workers are not protected. They are counted. There is a difference.
Time Matters
In the hours after Marcus Herrera was struck, his body temperature dropped. The blood pooling from his head wound soaked into the caliche. The sun moved across the sky and set. The automated systems at the well site continued operating normally — the SCADA system reported pressures, temperatures, and flow rates to the control room without interruption. Every piece of data the operation needed to monitor the equipment was flowing perfectly.
Nobody was monitoring the person.
That's the gap. We have invested billions of dollars in systems that tell us the second a compressor trips, a tank level rises, or a pressure reading deviates. We know the status of every piece of iron in the field in real-time. But the people we send to service that iron? We check on them every four hours. If we remember.
Your SCADA system doesn't wait until tomorrow morning to tell you a well went down. It tells you immediately. Your lone worker protection should work the same way — continuous, automatic, and immediate. Because the stakes aren't production. The stakes are someone's father, someone's husband, someone's mother coming home at the end of the day.
Every operator in this industry knows the risks. Every company has safety policies and procedures. But policies don't save lives at 3:15 PM on a Tuesday afternoon in the southeast corner of a field when nobody is watching.
Systems save lives. Real-time systems. Systems that know where your people are, what they should be doing, and how long they've been still.
Do you know when your people got home last night?
Are you sure?
WorkSync's SafeOPS integrates lone worker monitoring directly into daily operational intelligence — connecting worker location, planned routes, task duration, and risk context into a single protection system. When a field worker stops moving beyond expected parameters, the escalation is automatic, immediate, and informed by the operational context of what that person was supposed to be doing and where. Because the question isn't whether you have a check-in procedure. The question is whether you'd know in time to make a difference.
Learn more about SafeOPS at work-sync.ai
Sources and Data References:
- CDC/NIOSH Fatalities in Oil and Gas Extraction (FOG) Database, 2014–2019: 21.5% of fatalities involved workers working alone.
- OSHA Oil and Gas Extraction Hazards Data: Three of every five on-site fatalities result from struck-by/caught-in/caught-between incidents.
- Bureau of Labor Statistics Census of Fatal Occupational Injuries: Oil and gas extraction fatality rate is seven times higher than the all-industry average.
- CDC MMWR Surveillance Summary (2023): 470 oil and gas extraction worker fatalities during 2014–2019, with vehicle incidents (40.3%) and contact with objects/equipment (25.9%) as leading causes.
- U.S. Chemical Safety and Hazard Investigation Board: 2019 Odessa, Texas H₂S fatality investigation at waterflood station.
- Journal of Lancaster General Health / R. Adams Cowley: "Golden hour" concept in trauma medicine.
