Health and Safety Executive

Overview of TEMPSC performance standards

Prepared by Serco Technical and Assurance Services for the Health and Safety Executive 2007

RR599 Research Report

Health and Safety Executive

Overview of TEMPSC performance standards

J K Robson Serco Technical and Assurance Services Building 150 Harwell Scientific and Innovation Campus Harwell Oxfordshire OX11 0RA

In the majority of offshore emergency scenarios on the UKCS the totally enclosed motor propelled survival craft (TEMPSC) are relied upon as the secondary means for mass evacuation, after helicopters. In many ways the lifeboats of the early part of the 20th century remain recognisable to those of the latter part though more recent changes to launch systems such as on load release and the free-fall concept have become more widespread, driven by legislative changes that are usually in response to specific incidents. Though the new systems are commonplace across both maritime and offshore industries a number of accidents have been reported that can be attributed to shortcomings in their design, use or maintenance. Even though TEMPSC are subject to performance standards as laid down by the International Maritime Organisation (IMO), these address issues primarily of concern to the carriage and use of lifeboats on ships rather than on installations. This study investigated the current regulatory regime as applied to TEMPSC and its relevance, bearing in mind the specific circumstances encountered, to craft for use offshore. This report and the work it describes were funded by the Health and Safety Executive (HSE). Its contents, including any opinions and/or conclusions expressed, are those of the author alone and do not necessarily reflect HSE policy.

HSE Books

 Crown copyright 2007 First published 2007 All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording or otherwise) without the prior written permission of the copyright owner. Applications for reproduction should be made in writing to: Licensing Division, Her Majestys Stationery Office, St Clements House, 2-16 Colegate, Norwich NR3 1BQ or by e-mail to hmsolicensing@cabinet-office.x.gsi.gov.uk

ii

CONTENTS
1 2 INTRODUCTION TOTALLY ENCLOSED MOTOR PROPELLED 2.1 BACKGROUND 2.2 DAVIT CRAFT AND LAUNCH SYSTEMS 2.3 FREE-FALL CRAFT 2.4 LIFEBOAT/TEMPSC MAINTENANCE AND DURABILITY LIFEBOAT/TEMPSC PERFORMANCE STANDARDS 3.1 IMO STANDARDS 3.2 PERFORMANCE BASED STANDARDS 3.3 RESEARCH YIELDING PERFORMANCE RESULTS OFFSHORE REGULATORY REGIME AS 4.1 OVERVIEW 4.2 SAFETY CASES 4.3 PFEER INSTALLATION EVACUATION USING TEMPSC 5.1 INTRODUCTION 5.2 TEMPSC SELECTION 5.3 PREPARATION FOR LAUNCH 5.4 EMBARKATION 5.5 LOWERING MECHANISM ACTIVATED AND DESCENT INITIATED 5.6 TEMPSC DESCENDS TO THE SEA 5.7 RELEASE GEAR ACTIVATED 5.8 CRAFT LEAVES THE PLATFORM VICINITY 5.9 TEMPSC HOLDING POSITION 5.10 RECOVERY OF TEMPSC OCCUPANTS TO FRC AND RESCUE VESSEL 5.11 RECOVERY OF TEMPSC OCCUPANTS TO HELICOPTER 5.12 RESCUE FROM WATER TO TEMPSC LIFEBOAT/TEMPSC ACCIDENT CASE STUDIES 6.1 TYPICAL DAVIT LIFEBOAT/TEMPSC LAUNCH AND RECOVERY ROUTINE 6.2 LIFEBOAT SAFETY STUDIES AND ACCIDENT REPORTS 6.3 RESULTS OF ANALYSIS 6.4 RISK MITIGATION MEASURES 6.5 QUALITATIVE/QUANTITATIVE ON-LOAD RELEASE STUDY NOVEL MEANS OF ESCAPE 7.1 SEASCAPE SYSTEM OF EVACUATION 7.2 NORSAFE RESCUBE 1 3 3 5 10 12 13 13 15 16 21 21 21 21 25 25 27 27 28 28 29 30 30 31 33 34 35 37 37 37 39 42 44 45 45 47

iii

CONCLUSION 8.1 PERFORMANCE STANDARDS 8.2 TEMPSC EQUIPMENT 8.3 EVACUATION BY TEMPSC 8.4 LIFEBOAT/TEMPSC ACCIDENTS 8.5 SUMMARY REGULATORY NOTICES

49 49 50 51 51 53 55

APPENDIX 1

iv

EXECUTIVE SUMMARY
In many respects the environment in which offshore installations operate on the United Kingdom Continental Shelf (UKCS) is similar to that experienced by merchant vessels and so it is no surprise that operators turned to the marine industry for some their lifesaving appliances. In the majority of offshore emergency scenarios on the UKCS the totally enclosed motor propelled survival craft (TEMPSC) as lifeboats are termed, are relied upon as the secondary means for mass evacuation, after helicopters. Their use, in preference to other marine lifesaving appliances such as liferafts, has a lot to do with the concept that survival craft should be capable of being navigated independently, although in this respect TEMPSC are used for purely for abandonment and to clear the immediate area of danger rather than as a means of bringing survivors to shore. In many ways the lifeboats of the early part of the 20th century remain recognisable to those of the latter part though changes to launch systems such as on load release and, more recently, the free-fall concept. While there is much to commend the TEMPSC concept; their constant availability, being subject to internationally agreed standards and the choice they offer through location and redundancy, recent developments have brought with them increased requirements for design/construction, maintenance and crew training. The principle aim driving the introduction of on load release gear was to facilitate the safe release of the boats from the falls during an evacuation, especially in heavy weather conditions. To minimise the possibility of accidental or premature boat release before reaching the water SOLAS specified adequate protection without being specific about how this could be implemented. Manufacturers developed their own sometimes very novel solutions to this requirement and the manner and complexity of operation, the maintenance requirement and the equipments susceptibility to degradation due to corrosion varied immensely. Almost as soon as on load release gear was fitted to TEMPSC/lifeboats a worrying trend of increased accidents connected to their use became apparent. Although the majority of accidents involving such equipment occurred to vessel mounted craft, several have also been reported to those on fixed or mobile installations, many involving injuries and some causing fatalities. Investigations have revealed a number of factors were involved but in many the accident has been attributed to some extent to the on load release mechanism. In recent years a number of steps have been taken from both operational and regulatory positions in an attempt to remedy this situations. To overcome some of the shortcomings associated with conventional davit launched craft a wholly new launching concept was introduced in the form of free-fall TEMPSC. The specially designed craft incorporate a hull form to permit release from a vessel/installation to then fall freely under gravity before entry and partial submergence in the water. Some forward motion is induced during the launch and this is sufficient to take the craft away from the installation under its own momentum. In principle the free-fall concept may overcome the possibility of washback that many conventional craft launches are susceptible to and may reduce some of the potential dangers inherent in on load release gear. However, with the large forces at play during free-fall launch, particularly when the craft enters the water, it is important that the highest standards of design, construction, testing and maintenance are maintained. Though complying with all relevant standards a series of recent field tests on some designs of free-fall TEMPSC have demonstrated the potential for canopy deformation from the weight of water

during launch. Had the craft been fully occupied it is possible that some of those inside may have suffered some form of head/neck injuries. Recent events have demonstrated that even though lifeboats/TEMPSC are subject to performance standards as laid down by the International Maritime Organisation (IMO), these address issues primarily of concern to the carriage and use of lifeboats on ships rather than on installations. With TEMPSC for offshore use there are three areas of particular concern: a) the launch height is likely to be much greater, b) manoeuvring away from an installation is likely to be more difficult, and c) survivor weight is assumed to be 75kg yet a recent survey on the UKCS indicated a weight of 89kg is to be expected. Key events driving the development of performance standards specifically for the offshore EER process were the loss of the Ocean Ranger semi-submersible in 1982 and Piper A installation in 1988. At the highest level the so called Performance-Based Standards (PBS) should be verifiable measures that provide qualitative targets and quantitative measures of a prescribed minimum level of performance. The major benefit of PBS is their focus on what must be done rather than on how it should be done, as is the case with more prescriptive regimes. In the aftermath of the Ocean Ranger loss the Canadian regulators developed the Canadian Offshore Petroleum Installations Escape, Evacuation, and Rescue (EER) Performance-Based Standards. On the UKCS the approach to performance standards is somewhat different in manner but similar in outcome insofar as the Offshore Installations (Prevention of Fire and Explosion and Emergency Response) Regulations (PFEER) encourages Duty Holders to define their own performance standards when carrying out a PFEER Assessment. Research has been carried out over the last 15 years to assist industry in this process as well as providing HSE inspectors with benchmark data to assess Safety Cases against. Through the quantitative and qualitative results there is now a much better understanding of many of the issues surrounding the use of TEMPSC as a means of mass evacuation from offshore installations. Many of the failure modes for evacuation by TEMPSC are now well documented and measures have been put in place to minimise their effects. At the global level there is an increasing awareness of the potential hazards associated with lifeboats/TEMPSC and in recent years the IMO has begun to address the issues through a series of circulars to raise awareness. In parallel some new equipment designs, particularly new designs for on load release hooks, have been introduced and in studies have proved themselves to have a higher level of inherent safety than older designs. Aside from redesigning critical components to enhance safety much research and effort has been expended on proving new and novel concepts to supplement, or in some cases supersede, existing escape and evacuation methods. The extent to which such equipment will be taken up in the offshore industry remains to be seen.

vi

1 INTRODUCTION
The Duty Holders of all offshore oil and gas installations on the United Kingdom Continental Shelf (UKCS) submit a Safety Case to the UKs Health and Safety Executive (HSE) in which they present their assessment of the risks their installation is likely to face along with details of how they have been quantified and will be mitigated. Some Duty Holders may determine that some risks can be managed through the operational systems already in place or by modifying working practices under certain circumstances whereas other risks may be so serious as to warrant inclusion in the installations emergency response plan, possibly leading up to partial down-manning or, in extremis, platform evacuation. In many respects the environment in which offshore installations exist is similar to that experienced by merchant vessels and so it is no surprise that operators turned to the marine industry for their lifesaving appliances. Most evacuation and survival equipment can equally well serve both industries albeit some modifications may be required to address the particular circumstances offshore. For many years the primary means of escape from a foundering vessel was via lifeboat and it was natural that the growing number of offshore installations in all areas of the world would adopt the same technology. A major difference with the maritime industry however, was that because of the increased danger from spilled and possibly burning oil on the sea surface near an evacuated installation, the lifeboats were enclosed by a canopy at a time when many vessels (aside from tankers) were still fitted with open boats. The design and construction of such boats for offshore use coined the name totally enclosed motor propelled survival craft (TEMPSC) whereas they are still known as lifeboats in the marine industry. In this report the craft are referred to according to their use, i.e., lifeboats if the context of their carriage is on ships and TEMPSC in an offshore setting. The development of the craft is explored further in Section 2. The performance of lifeboats/TEMPSC are explored in Section 3. This section proposes the case for developing performance standards that TEMPSC could reasonably be expected to achieve as well as reviewing the large body of relevant research studies where typical environmental conditions have been reported for various parts of the evacuation chain. Distilling the results of research it has been possible to provide an estimate of the different environmental criteria under which TEMPSC have been successfully launched. In preparing their Safety Cases Duty Holders are required to provide a summary of their compliance with the Offshore Installations (Prevention of Fire and Explosion and Emergency Response) Regulations 1995, known throughout the industry as PFEER: they are assisted in that process by the guidance 1 that accompanies the regulations. Equipment such as TEMPSC are considered evacuation systems. The PFEER regulation 15 makes requirements for the safe evacuation of all persons & their being taken to a place of safety or to a place where they can be recovered. In the context of this work Section 4 of this report looks at the relevant sections of PFEER in more detail. The decision to evacuate an installation can be considered to be the culmination of one series of events, i.e., the initiating accident, and the beginning of another the evacuation process. Section 5 of this report provides an overview of the whole offshore installation evacuation process and then focuses on the possible failure modes in using TEMPSC.

Prevention of Fire and Explosion and Emergency Response on Offshore Installations Approved Code of Practice and Guidance

Section 6 reviews the circumstances of several of the growing number of accidents that have occurred to lifeboats/TEMPSC. Accident investigation bureaux from several maritime nations have produced reports detailing either the results of specific lifeboat related investigations they have carried out, or more generic studies assessing causation factors and any apparent trends in the area. TEMPSC are not the only means through which an installation can be evacuated and over the years a number of novel and innovative escape systems have been trialled with varying degrees of success. Section 7 provides background to several novel escape systems or equipment used to assist in maximising the success of an evacuation. Section 8 draws together the different facets of the study and discusses what the implications may be for the future. It seeks not to lay down what the performance standards for TEMPSC should be, but suggests there is a place for such standards, probably as a result of wide and detailed consultation with industry, upon which the evacuation of the UKCSs installations by TEMPSC could be expected to be successfully achieved.

2 TOTALLY ENCLOSED MOTOR PROPELLED SURVIVAL CRAFT

2.1 BACKGROUND To help place this section in context it is beneficial to explain the meanings of evacuation and escape as defined by PFEER.

Evacuation means leaving the installation and its vicinity in an emergency in a systematic manner and without entering the sea. This could be achieved through the use of helicopters, direct sea transfer, bridge-links or TEMPSC. Escape is the process used when evacuation has failed. It may involve entering the sea directly through means such as davit launched liferafts, chute systems, ladders and individually controlled descent devices. In general, these methods are generally the least favoured options for removing personnel from an installation.

In the majority of offshore emergency scenarios TEMPSC are relied upon as the secondary means for mass evacuation (after helicopters) and their use, in preference to other marine lifesaving appliances such as liferafts, has a lot to do with the concept that survival craft should be capable of being navigated independently. Although in the past survivors have successfully undertaken remarkable ocean voyages to reach safety, improved global communications means it is no longer the case that survivors would be expected to move too far from the vessel/installation they have abandoned as the datum for a search would be the last known position. Search and rescue operations are generally initiated promptly and concluded quickly and providing the means for occupants to survive for extended periods is probably less important now than in the past. Notwithstanding this, some means of propulsion are still required to ensure the craft can initially clear the abandonment and overcome backwash and also any area that may be subject to fire/gas or explosion. As with most equipment the design of lifeboats/TEMPSC and their launching systems have changed gradually over the years, usually in response to the demands for larger capacity, greater protection for those using them, ease of operation and enhanced safety. The force for change has tended to be accidents resulting in large loss of life such as the passenger vessel Titanic in 1912 and semi-submersible accommodation unit Alexander Keilland in 1980. In the intervening years lifeboats have been used on many occasions, most noticeably, in two world wars, however there were very few changes to boat and equipment design. Those that have occurred have been incremental, slow and usually in response to changes in legislation. In many ways the lifeboats of the early part of the 20th century remain recognisable to those of the latter part. The construction material may have changed from wood, possibly to aluminium and then to glass reinforced plastic (GRP) and a once canvas and wood cover has been replaced by an integral and rigid affair. An engine replaced sail or oars and a boats equipment has been supplemented as technology progresses but, by and large, the form, function and operation of the lifeboat has remained. Lifeboats/TEMPSC of various capacities and designs have been developed by a variety of manufacturers and are generally available as either conventional (davit) fall craft or, more recently, free-fall. The latter design vary in length from around 6.5m with a carrying capacity of 16 persons,

to 14m, with a carrying capacity of up to 80 persons. The former type have similar capacities but on a shorter water line length.

Figure 1 Early Watercraft lifeboat/TEMPSC for tankers or offshore installations At this point it is important to briefly consider some of the many attributes that lifeboats/TEMPSC lend to evacuation and rescue. While other sections of this report deal with some of the issues associated TEMPSC use, it is right to describe some of their many benefits. Moreover, how measures have been implemented in the UKCS to manage and control some of the risks that otherwise imprudent or improper operation or maintenance may create:

Being installation based TEMPSC are ready for immediate use. The time required from the occurrence of a major incident requiring evacuation to craft launch is often measured in a few minutes. Conversely, waiting for sufficient helicopter capacity to first arrive and then evacuate an installation may take longer, especially when considering helicopter queuing that may occur at the helideck while flights are boarded. Where appropriate, international (IMO) standards have been adopted in the design, manufacture, testing, inspection and maintenance of lifeboats. Adherence to these standards ensures at least a minimum and universally accepted expectation of performance and to some extent consistency of operation across all TEMPSC, i.e., craft are broadly similar and personnel can readily acclimatise to TEMPSC of different designs and manufacturers. An installation will usually contain some redundancy in TEMPSC in terms of both their number and location. This affords some protection for personnel against events on the installation and allows the optimum selection of craft to minimise hazard exposure and the likelihood of collision with the jacket after launch.

More recently, in response to a number of potential and actual accidents involving TEMPSC during routine maintenance and testing, there has been clarification of the guidance available to those involved in such activities. In practical terms the revised guidance has resulted in a number of procedural changes being implemented to enhance personnel safety and confidence:

Further IMO guidance (see Appendix 1) and guidance in OSD Safety Notice 1/06 Ensuring Adequate Safety During Davit Lifeboat Drills, Testing and Maintenance on UK Offshore Installations.

Reinforcement and/or further testing of free-fall lifeboats in UK and Norway beyond the international standard. Norwegian initiative to improve the international lifeboat standards. Increased use of specialised contractors for lifeboat testing and maintenance. Lifeboat launch tests either carried out with increased precautions to reduce risk to the testers, or launch tests replaced by comprehensive in situ testing. Hardware and software measures to ensure maintenance pennants are connected correctly. Reduced number of personnel entering lifeboats during drills. Additional OPITO requirement that coxswain training include an assessment of familiarity with the installation lifeboats. Increased availability of hook release gear which is further protected against accidental opening, for example the harbour bolt system).

2.2 DAVIT CRAFT AND LAUNCH SYSTEMS

Davit launched lifeboats/TEMPSC generally have hull forms with rounded bilges and a similar design and shape at both bow and stern. The length to beam ratios are usually between 2.5 to 2.9. Propulsion is provided by small, water-cooled diesel engines but the craft have limited speed because of their round-bilge hull form. Davit launched lifeboats/TEMPSC are designed and constructed to withstand impact loads associated with small drop heights. Conventional davits have, by and large, to be parallel to a vessel/installation because of the difficulty or undesirability of equipment overhanging beyond the sides. This is a particular problem on ships but although less so on installations, the fabrication costs are increased and especially so if perpendicular davits are installed as retrofit. The main drawback with lifeboats/TEMPSC being parallel to a structure is the increased difficulty in manoeuvring the craft clear. Under ideal weather conditions the crafts stern may come close to the vessel/installation as it is powered ahead and turned and at worst it will be impossible to clear the structure. Furthermore, backwash from the turbulent water in the vicinity of legs can make steering extremely difficult to the extent that it may force the craft beneath the installation.

Figure 2 Stern of davit launched lifeboat/TEMPSC

Figure 3 Interior of davit launched lifeboat/TEMPSC

A major area of change has been in the launching systems: until relatively recently boats were lowered/retrieved using a fibre or wire rope at each end, termed the falls, via radial/quadrant davits, luffing davits and later gravity davits. When waterborne the falls were released from the boat's connecting hooks. To address concerns with the difficulty in releasing the two falls simultaneously, particularly when the craft became fully enclosed, the on-load release was developed and various designs have been produced to enable a boat to be released before it reaches the water. However, perhaps the most fundamental design change in recent years in respect of launch systems has been the development and introduction of the free-fall concept. Using specially designed and constructed lifeboats/TEMPSC, all occupants board the craft before releasing it to fall under the force of gravity to the water. 2.2.1 Off-Load Release Of the simplest design usually consisting of a ring attached to the end of each fall and the hooks at each end of the boat. During boat launching after the falls have been slacked simultaneously until the boat is supported by the water, both rings are unhooked from the hooks. In the majority of cases and in anything other than calm conditions this is difficult and dangerous to achieve successfully; hands may become trapped between the parts, one hook might be released while the other is not or shock loadings to the boats structure in way of the hooks can cause damage. As the sea state worsens so the risk of injury and potential boat damage increases. To ensure the boat is fully waterborne and prevent shock loading of the falls it is necessary to pay them out sufficiently to the deepest part of the trough, as the boat then rises on the next crest the overrun falls/hook then collapse into the boat and may become entangled with other fittings as the boat slides into the next trough. Release of only one hook leaves the boat susceptible to misorientation or possibly even capsize if the wave height is large enough to lift the boat from the water supported by one hook. To overcome the shortcomings of a purely manual off-load hook release mechanism the Mills Empress Instantaneous Release Gear was produced in the 1950s and was approved by the UK regulatory authorities in 1956. The gear provides a means of simultaneously releasing both ends of the boat by pulling on a releasing handle. The release gear consists of two pivoted hooks, one hook at each end of the boat, and a connecting chain between the hooks protected by a casing. The hooks are held in the closed position by balanced weights, ensuring that when the boat is stowed the hooks are always closed and engaged on the fall link. When the lifeboat is being lowered the weight of the boat is taken by the hooks and it is impossible to open them against this load. As the lifeboat becomes waterborne, the load on the hooks decreases and they can be opened to release the boat.

Figure 4 Mills Empress off-load release mechanism hook The loss of the semi-submersible flotel Alexander L. Kielland in the Ekofisk field of the Norwegian sector in March 1980 drew attention to the difficulty in releasing TEMPSC from their falls and manoeuvring them away from the installation in particularly adverse weather conditions. The Commission set up to investigate the casualty reported 2 : "On board Alexander L. Kielland there were 7 covered lifeboats, each with seats for 50 men. 4 of the lifeboats were lowered without particular problems. On the other hand, problems occurred with the release of the lifeboat hooks. The hooks which were equipped with simultaneous release can not be released as long as they are under load and this was difficult due to the rough sea on the day of the accident. For this reason 3 of the boats were blown against the platform and crashed. On the fourth boat the after part of the wheelhouse was crashed. Through the opening caused by the crash a man managed to release the after hook by hand. Before that someone had succeeded in one way or another to release the forward hook. A fifth boat came down on the water bottom-up when the platform capsized. The hooks had been released in some way or another. People in the boat and people outside it, managed by common efforts to turn it on even keel. Stemming from this incident the need for lifeboat/TEMPSC on-load release gear was highlighted throughout the marine and offshore industries. Rather than relying on the craft to be waterborne with no weight on the falls to permit the hooks to be released, the so-called offload release, the new mechanism would enable a boat to be released while its full weight was still supported by the falls, even if it was clear of the water.

Investigation Commissions report NOU 1981:11, Chapter 6, Summary.

2.2.2 On-Load Release The Alexander Keilland accident was a catalyst for the development and mandatory introduction of on-load release gear. Discussions held at the International Maritime Organisation (IMO) culminated in amendments to Chapter III of SOLAS requiring all ships built after 1 July 1986 to have automatic release hooks for use with their davit launched liferafts and release gear capable of being operated on- and off-load for their lifeboats and rescue boats. The principle aim for the new release gear was to facilitate the safe release of the boats from the falls during an evacuation, especially in heavy weather conditions. The idea being that the boat would be lowered to the water and could then be released regardless of whether either of the falls were experiencing any of the boats weight caused by its movement due to sea state. To minimise the possibility of accidental or premature boat release before reaching the water SOLAS specified adequate protection without being specific about how this could be implemented. Manufacturers developed their own sometimes very novel solutions to this requirement and the manner and complexity of operation, maintenance requirement and susceptibility to degradation due to corrosion varied immensely. A number of ships were fitted with the new equipment before the regulations were fully implemented and from the very earliest days accidents during practice drills were reported. As far back as October 1986 the UK Department of Transport issued M.1248 (Automatic Release Hooks for Liferafts and Disengaging Gear for Lifeboats and Rescue Boats) drawing attention to several accidents that had occurred and highlighting the need for a robust maintenance, training and testing regime. The Merchant Shipping Notice M1248 is reproduced in Appendix 1. Chapter III of SOLAS was further amended when IMO Resolution MSC.48(66) adopted the International Life-Saving Appliance (LSA) Code on 4 June 1996. A significant change required on-load release to have special mechanical protection rather than adequate protection to prevent accidental or premature. The requirements came into effect for systems fitted to new ships and therefore many lifeboats will still be fitted with their original equipment. Under the 1996 amendment most designs of on-load release incorporated a mechanical or hydrostatic interlock which, in the latter case, prevents release until the craft is waterborne, although they can be overridden to provide full on-load release capability. In implementing the regulations some flag administrations interpret this SOLAS requirement differently insofar as they do not insist on an interlock to prevent premature release. This has resulted in a number of manufacturers designing equipment that do not have a common level of protection against premature release. Despite several changes to SOLAS to minimise incidents, almost continuously since the introduction of on-load release an increasingly large number of accidents involving lifeboats/TEMPSC have been reported and some of these involve serious injury or even loss of life. While it is true some of the increase in reported accidents involving these craft may be attributable to a more mature reporting and investigation environment in recent years, it is also fair to say that increased complexity in design, operation and maintenance has led to more accidents. The nature of the equipment heavy equipment being operated at height with people inside gives rise to potentially serious injuries should an accident occur. Examination of accident investigation reports where lifeboats/TEMPSC have been involved has revealed that failure of, or premature opening of the on-load release mechanism has been frequently cited as the cause or contributory factor. Using information from a number of sources a more in-depth analysis of lifeboat/TEMPSC accidents is detailed in Section 6.

Figure 5 Schematic of typical early type onload release hook

Figure 6 Typical early type on-load release hook

Notwithstanding the apparent complacency that has developed among equipment manufacturers for a number of years, there has been some limited success at redesigning the on-load release hook mechanism in attempt to overcome some of the many identified shortcomings. One such recent design is depicted below: Innovative features of the design are said to include curve to curve faces on the release pin/hook finger to provide greater contact area, a safety pin that, when in position, completely prevents accidental hook release and a visual warning window to indicate the status of the hook. The hook is reported to be of stainless steel construction to reduce maintenance.

Figure 7 Recent design on-load release hook A comparative study into the relative performance of an older design of on-load release hook against one of more recent design was carried out during 2003. Information on the outcomes from the study is included in Section 6.5.

2.3 FREE-FALL CRAFT

From the early 1960s a radical departure from the conventional davit and fall launching system was first explored (and was first installed on a ship in 1961) although the system did not see widespread acceptance and use in the marine and offshore industries until the 1990s. The concept, which necessitated a complete rethink of lifeboat/TEMPSC hull form and seating arrangements, abandoned davits, falls and hooks altogether in favour of releasing the craft and allowing it to free-fall to the water. Free-fall lifeboats/TEMPSC differ considerably in hull form from the davit launched craft because of the need to minimise hydrodynamic loads when they enter the water. This has led to the development of wedge shaped bows and deep-vee sections to minimise impact loads. The length to beam ratios are generally greater than 3 for smaller craft and up to 4.5 for longer craft.

Figure 8 Bow of free-fall lifeboat/TEMPSC

Figure 9 Interior of free-fall lifeboat/TEMPSC

Launching of free-fall craft is carried out in one of two ways; down an inclined plane perpendicular to the structures side to induce some forward motion before it falls free of the launching ramp, or being allowed to fall vertically, albeit with a bow down attitude. The hull form and interior seat design differ depending on the launch method and it is unclear whether craft designed for one type of launch should be released for free fall in any other manner.

Figure 10 Drop launched free-fall TEMPSC

Figure 11 Skid launched free-fall TEMPSC

10

To ensure the lifeboat/TEMPSC remains intact on entering the water from launch heights as great as 35 metres as well as minimising the decelerations on the occupants the hull form differs markedly from davit launched craft. The bow and forward canopy are integral and designed to be submerged during launch and the hulls deadrise is increased to facilitate water entry. Survivor seats are ergonomically shaped and angled/orientated to minimise shock loadings on survivors. In many designs the seats face aft with high backs though in some craft they face forwards: this is in comparison to the benches around the sides and on the centreline of conventional craft. On entering the water the craft, which may rotate slightly to a different attitude during the freefall if the loading either to forward/aft or port/starboard is not even, has sufficient stored forward momentum to clear the impact point and drift directly away from the vessel or installation. With the crafts engine running and propeller engaged shortly before launch the craft can manoeuvre away seamlessly with reducing risk of backwash. However, depending on the direction and strength of wind and/or waves there is a possibility the lifeboats/TEMPSC may broach and lay across the waves or capsize if conditions are severe enough. Although these are very real concerns it appears that little research has been undertaken into launch performance where the results are in the public domain. Even if research is carried out a potential drawback lies in interpreting the results; because the conditions existing at the moment of the crafts impact with the water, in what is an essentially a random seaway, are difficulty to predict. Unfortunately this means there are no known criteria for the maximum sea state or wave directions where a good prospect of successful free-fall launch can be assumed. Instead, it may be safer to adopt a probabilistic approach in determining the success or otherwise of free-fall lifeboat/TEMPSC launch. Some of the concerns expressed above came to a head during 2005 in the Norwegian Continental Shelf and exposed some potential shortcomings and conflict between the regulatory regime for type approval for free-fall TEMPSC and the actual conditions under which they may be used. The circumstances surrounding the test launch and subsequent damage that occurred to a number of type approved free-fall TEMPSC on the NCS are a matter of public record. Briefly, a skid launched free-fall TEMPSC was loaded to the equivalent of the full certified maximum load and launched. The TEMPSC suffered permanent structural damage in way of the superstructure, which was deflected downwards, as were interior stiffening bars intended to protect the occupants. Damage was also sustained to the forward and aft entry hatches and partial flooding occurred. Further launch tests were carried out on other skid launched TEMPSC but with a loading of 50% of the certified maximum load and at a lower launch height that that for which the TEMPSC was certified. The results were similar insofar as deflection of the canopy occurred on water entry although to a lesser extent than previously observed and not sufficient to cause permanent structural damage, although it was still considered that a risk to occupants would be present. Remedial action to strengthen the skid launched free-fall TEMPSC was carried out and a programme of both model testing and finite element analysis was commenced to determine whether drop launched TEMPSC would perform similarly: early analysis found they probably would and that these would also require modification. A major issue highlighted from the damage sustained by the launch-tested craft and the probable damage that may occur to other craft (based on model and analysis) was the potential shortcomings of the type approval process for free-fall craft. All the damaged craft were

11

reported to be fully type approved and to have been constructed in accordance with such approval. That damage was sustained indicates either the construction process did not fully comply with the requirements of type approval or, more likely, that there are limitations in terms of the fitness for purpose of installation based free-fall TEMPSC even though they may have met all design and construction criteria. These issues are discussed in greater detail in Section 3.1.

2.4 LIFEBOAT/TEMPSC MAINTENANCE AND DURABILITY

Since their introduction lifeboats/TEMPSC have been constructed using wood, steel, aluminium and more recently GRP; all of which can suffer degradation in performance over time, especially when preventative maintenance procedures are not adhered to. Structural strength is of particular concern in free-fall craft where it is conceivable that the effects of ageing may not be apparent without detailed examination yet to remain intact on launch the craft is required to possess the same strength as when new. A number of studies into GRP embrittlement over time have been conducted with apparently contrary conclusions; a prcis of two such studies (a 1960 study and a 1993 study) is contained in an HSE research report 3 . The earlier report indicated GRP deterioration was of little concern whereas the later study highlighted up to 50% reduction in strength. However, in the later study the craft being studied was used for training purposes and had seen several hundred launch cycles leading to the possibility that the loss of structural strength was caused more by excessive use than by material degradation. A primary conclusion of the HSE study highlighted the need to conduct fatigue studies on representative samples of fibreglass construction as used on lifeboats.

Review of Current Free-Fall Lifeboat Literature and Recommendations for Needed Research and Development, December 1997, OTO 96 007

12

3 LIFEBOAT/TEMPSC PERFORMANCE STANDARDS

3.1 IMO STANDARDS
In themselves lifeboats/TEMPSC are subject to a number of standards dealing with their design, construction and equipment but little detailing the expectations of their use and what constitutes a successful evacuation outcome. Over approximately the last 25 years the IMO has adopted a number of resolutions dealing with the evaluation, testing and acceptance of life saving appliances. Resolution A.520(13) was adopted by the Assembly in 1983 to cater for prototype novel life-saving appliances do not fully meet the requirements of Chapter III of the 1974 SOLAS Convention but nonetheless provide the same or higher safety standards. This resolution was supplemented by the adoption of the International Life-Saving Appliance (LSA) Code by Resolution MSC.48(66) at the MSCs 66th session in June 1996 with the aim of providing international standards for the life-saving appliances required by Chapter III of the 1974 SOLAS. The LSA Code was made mandatory by resolution MSC.47(66) and entered into force on 1 July 1998. To encompass the need for more precise requirements for the testing of life-saving appliances the MSC adopted the Revised Recommendation on Testing of Life-Saving Appliances by Resolution MSC.81(70) to assist LSA manufacturers, test facilities, surveyors and others in mutually accepting the type approval of appliances approved by other administrations, i.e., a world wide standard that if LSA can comply with in one country it should be acceptable to other countries. MSC/Circ.980 (Standardised Life-Saving Appliance Evaluation and Test Report Forms) was produced after MSCs 73rd session in December 2000 and provide a detailed methodology to assist in testing prototype LSA and recording the results. Based on the LSA Code, the annex to the document presents the test procedure, acceptance criteria and parameters deemed to be significant for a wide range of LSA. Of particular relevance to this study are Section 4.4 (Davit Launched Lifeboats), Section 4.5 (Free Fall Lifeboats) and Section 6.1 (Launching and Embarkation Appliances) of the annex. The following topics are addressed: Section 4.4 Visual inspection Section 4.5 Visual inspection Section 6.1 Visual inspection

Freeboard, stability and self-righting tests Seating strength and space tests Release mechanism tests Operational tests Towing and painter tests Strength tests Additional tests for fireprotected lifeboats Additional tests for partially-enclosed lifeboats

Freeboard, stability and self-righting tests Seating strength and space tests Release mechanism tests Operational tests Towing test Strength tests Additional tests for fireprotected lifeboats

Static proof load test Operational load test Turning in test Winch brake test Hand operation test

13

The standards outlined above are laid down by the IMO and perhaps understandably address issues primarily of concern to the carriage and use of lifeboats on ships. While there are a number of similarities between the marine and offshore industries, i.e., a need to evacuate a potentially large number of personnel from a hazardous situation, there are also large differences in environment that raise some doubts about whether marine equipment is entirely suited to offshore use. Three areas are of particular concern:

TEMPSC launch height is usually several times greater from an installation than from a vessel. On davit launched TEMPSC the increased fall length could lead to an increased pendulum effect with consequent mis-alignment when taking the water or damage through contact with the installations members. The IMO strength test in this respect (annex 4.4.7.1) requires continued structural integrity after an impact test where the craft, fitted with fenders or skates, strikes a vertical surface at 3.5ms-1. However, on an installation a TEMPSC may strike a tubular member or other protrusion that places greater stress on the craft than hitting a flat plate. On free-fall TEMPSC injury to the occupants or structural damage to the craft could occur from the increased drop height but more likely is the potentially adverse effect caused by wind on the TEMPSC during its free-fall. As the launch height is greater the length of time that the craft is exposed to wind while falling, perhaps causing a turning moment, will also be greater. Manoeuvring away from an installation in anything other than benign conditions is likely to be more difficult than a similar manoeuvre away from a vessel. Wash back may result in the TEMPSC being driven either against an installations structural members or between them where the sea conditions are much more confused, eddies and vortices are created and a partial loss of buoyancy may occur. Extricating a battened down TEMPSC from such a situation will place great demands on the coxswain, possibly over and above those in which he has been trained. Survivor weight is assumed to be 75kg. The IMO standards adopt a single assumed figure of 75kg (except seating strength test where 100kg is used) for each person the craft is certified to carry and for many years and for many of the worlds seafarers this is probably a realistic figure. However, in recent years anecdotal evidence suggested that many workers in the offshore industry, particularly in areas of the developed world, exceed this figure by some considerable margin. To test this evidence HSE recently undertook a study 4 where a sample of offshore workers (64 males and 6 females) was surveyed. The results yielded an estimated average weight of UK offshore workers (in work clothes) of 89.1kg. In the Gulf of Mexico the disparity between the average weight of offshore workers and that assumed for TEMPSC testing purposes is even greater as a 95kg average weight per worker has been proposed 5 . This potentially difficult situation could be exacerbated still further by the extra weight caused by personal protective equipment (PPE) worn by occupants. Although many fixed installations have seen a reduction in the number of persons on board (POB) compared to TEMPSC capacity, many MODU operate at, or near, full POB capacity and hence it is quite likely that some of their TEMPSC would be fully loaded and have a total weight in excess of that for which type approval was assigned.

Other aspects of the strength test for davit launched craft include a drop test and overload test, both of which should result in no damage .. that would affect the lifeboat's efficient functioning without being specific on the level of damage permitted or what constitutes efficient functioning.

4 5

Loughborough University and Aston Business School, HSE Research Report 342, 2005 Energy Institute, Human Factors No. 5, Safety Information Bulletin, September 2004

14

The strength tests of free-fall lifeboats/TEMPSC are somewhat different from those for davit launched craft insofar as the free-fall test (annex 4.5.7.1) may be carried out using scaled models that are at least 1m in length. If this is done other full scale craft should be used to confirm the results from the model. The acceptance criteria of the free-fall test refer primarily to acceleration forces rather than structural aspects, although the results of full scale tests may to some extent be considered qualitative in respect of the crafts structural integrity. The overload test requires a free-fall craft to withstand the forces acting upon it when evenly loaded with a full load of 75kg per seat when free-fall launched from a height of 1.3 times the approval height for which it is to be approved. The acceptance criterion for this test requires the TEMPSC to then pass the operational test and for there to be no significant damage to it. As in the case of davit launched craft, the assessment of significant damage rests with those conducting the test. It should be noted that the IMO permits the overload test of ramp launched free-fall TEMPSC to be conducted without a ramp, i.e., a vertical drop launch, if a ramp is unavailable provided the keel is at the same angle as that normally occurring when the craft enters the water. Investigations into the cause of the TEMPSC structural damage referred to in Section 2.4.3 reportedly pointed to the effect of the weight of water on the canopy top as the craft became partially submerged immediately after entering the water. Considering that the LSA Code requires free-fall launch testing to be carried out in calm water only and the annex to MSC/Circ.980 makes no provision for recording the sea conditions, this then leads to further questions being raised about the launch performance of free-fall lifeboats/TEMPSC in more severe seas. In an attempt to redress this information gap the Duty Holder involved in the NCS incident performed further full scale and model testing in a variety of sea conditions. Preliminary analysis of the test results reportedly indicated that in severe weather conditions (20m wave height) the water pressure on the canopy roof can be significantly more than what it would be in still water conditions. Tests further demonstrated the problems associated with uneven loading of a skid launched TEMPSC in that where the weight was concentrated towards the bow the rotation prior to entering the water was more pronounced leading to the craft submerging even deeper. The effect of this would be to potentially overload the canopy structure to a greater extent than if the occupant weight had been distributed more evenly.

3.2 PERFORMANCE BASED STANDARDS

Key drivers in the development of performance standards for the EER process were the loss of the Ocean Ranger semi-submersible in 1982 and Piper A installation in 1988. At its conclusion the Ocean Ranger Commission 6 made a total of 136 recommendations; some of which highlighted the need for consideration to be given to the development of a concise set of performance standards for various aspects of EER. At the highest level the so called Performance-Based Standards (PBS) should be verifiable measures that provide qualitative targets and quantitative measures of a prescribed minimum level of performance. The major benefit of PBS is their focus on what must be done rather than on how it should be done, as is the case with more prescriptive regimes. The former concentrates on the result whereas the latter set out details of the process which, under some circumstances, may not achieve the desired results. Although the development and adoption of PBS in the offshore industry is a relatively recent concept, many military organisations have used performance based standards and measurement
6

Canadian Federal-Provincial Royal Commission on the Ocean Ranger Marine Disaster Report Two Recommendation 107.

15

systems for much longer and have gone some way in defining why and how they should be used. The Canadian military have defined PBS thus 7 : There are three broad elements in the performance measurement framework: Measures; Indicators; and Standards. They are defined as follows: (a) Measures are attributes that must be analysed to determine whether the expected results are being achieved; (b) Indicators are aspects of the measures that are to be assessed; and (c) Standards are the quantitative targets or qualitative goals to be achieved. A further Canadian innovation in recent years is the development of the Canadian Offshore Petroleum Installations Escape, Evacuation, and Rescue (EER) Performance-Based Standards 8 . The performance standards are intended to be used by operators and regulators of offshore installations in both Arctic and temperate Canadian waters. They establish objective and measurable criteria to optimise equipment design, performance, reliability and availability. The PBS defined in the final draft of the Canadian document cover a broader scope than merely TEMPSC insofar as they also covers alarms, escape routes, escape/muster plans and temporary safe refuge. For the purposes of the document TEMPSC are known as semi-dry active evacuation systems and standards are laid down for their design, performance, availability and reliability in all key areas. On the UKCS the approach to performance standards is somewhat different in manner but similar in outcome to the Canadian model. PFEER encourages Duty Holders to define their own performance standards when carrying out a PFEER Assessment, basing these on the particular circumstances of their installations. However, it may be beneficial to consider the evacuation sequence against the available quantitative evidence to assist HSE in determining whether any claimed standards are valid.

3.3 RESEARCH YIELDING PERFORMANCE RESULTS

Over approximately the last 15 years the HSE have undertaken a large body of research to increase understanding of many of the issues surrounding the use of TEMPSC as a means of mass evacuation from offshore installations. Some of the earlier studies, though carried out a number of years ago, are particularly relevant to this work and have been reconsidered for this study, albeit with an eye on the current state of TEMPSC design, operational and maintenance philosophies. Using the main Failures identified in Section 5 as the topic all available research has been reviewed to determine whether trials or other studies have been carried out that yielded relevant quantitative or qualitative results. 3.3.1 TEMPSC selection The outcome of the decision making process in respect of ensuring enough TEMPSC of sufficient capacity and location are provided to account for all environmental conditions is more qualitative

Canadian Department of National Defence, Defence Planning Guide, Chapter 5: Performance Measurement, 1998 (CDND, 1998) 8 PBS Development Task Force, 2002. (http://iot-ito.nrc-cnrc.gc.ca/eer/documents/PBS-Final_Draft-all.pdf)

16

than quantitative. In a research report 9 looking at many aspects of offshore evacuation recommendations were made concerning the number and location of TEMPSC on an installation, their size and construction, necessary training for deployment and recovery, etc. In summary the overriding consideration in whether an installation can be adequately abandoned by TEMPSC should be their design (free-fall or conventional davits) and location (exposed to prevailing conditions or not). Further guidance on the numbers of lifeboat places and their location is contained within the PFEER ACOP & Guidance, paragraph 155. 3.3.2 Lowering mechanism activated and descent initiated A retrospective assessment 10 of the performance of TEMPSC in major evacuation of installations highlighted the possible causes of failure of the system. Of particular significance was the effect on obstructions to or diminishment of the clearance between the descent path of the TEMPSC and the structure. Other analytical tools exist 11 that can predict the probability of successful escape by TEMPSC from fixed or floating platforms using historical information on each factor that influences a successful evacuation. This has been done for both conventionally lowered fall wire systems and the Preferred Orientation and Displacement system (PROD) 12 which also involved tank tests for the latter. However, in neither case were any conclusions drawn as to the limits of operability with regard to environmental factors. Quantitative results were presented in another report 13 on sea trials of the PROD system where the ability to successfully launch in wave heights of around 6.4m was demonstrated. The report went on to highlight six Non-PROD TEMPSC launches carried out in 20 knot winds and 1.0 m maximum wave heights towards the rig. The results showed a maximum stern set-back of 4m. For free-fall TEMPSC, an analytical tool was developed 14 that can be used to predict motions during launch, structural response on impact with the water, and occupant motions within the vessel. However, it is not known whether this tool has been applied to the problem of defining environmental limits for launch. 3.3.3 TEMPSC leaves platform vicinity A study 15 investigating set-back towards the structure due to wind when lowering and wash-back due to wave and current effects after becoming waterborne tested several types of TEMPSC in full scale trials. However, many of the factors that contribute to set-back, wash-back and manoeuvring are related to characteristics of the craft and can be design specific; for example, one TEMPSC may react to the wind/waves in one way whereas another may manoeuvre differently in the same conditions. The outcome of the trials projected an estimate of the limiting sea state for which a successful manoeuvre away from the platform could be undertaken was approximately Beaufort force 6, i.e., 3-4m significant wave height (Hs) and 30 knots of wind.

"Compilation of Evacuation, Report Recommendations", by Technica Consulting Scientists and Engineers, 924/AH, October 1986. 10 "An Objective Numerical Assessment of the Capabilities of Survival Craft in Emergency Evacuation from the North Sea", M.A.F Pyman, D.H Slater, Paper No. 12, 14-16 November 1983. 11 "Risk Assessment of Emergency Evacuation from Offshore Installations", by Technica Consulting Scientists and Engineers for the Health and Safety Executive, September 1983. 12 "UK PROD Trials Undertaken on Self Propelled Semi-Submersible Drilling Vessel Aladdin, OT096 707. 13 "Severe Weather Trials of a Device to Improve the Probability of Successful Escape by Survival Craft", S.P.K. Pope, Conference Proceedings: Escape, Survival, Rescue at Sea, 29-31 October 1986, Pope 6., Vol I. 14 "Feasibility of Computer Simulation of the Launch of Free-Fall Lifeboats", by Frazer-Nash Consultancy Limited for the Health and Safety Executive, OTH-92-391. 15 "Manoeuvrability of TEMPSC", by RGIT Survival Centre Ltd for the Health and Safety Executive, November 1990, OTO-89-027.

17

A more recent study 16 looked in detail at the structural design basis for TEMPSC, primarily on estimating the likelihood of a generic TEMPSC suffering structural failure due to each of six design events:

Colliding with the platform during descent TEMPSC dropping into the sea TEMPSC and occupants overloading davits TEMPSC complete immersion in water Damage to TEMPSC during towing Collision between TEMPSC and platform during escape

The report presents a compelling case for arriving at its conclusions which, from a structural perspective, suggest that of the design events investigated the most likely to occur is the TEMPSC being dropped into the sea (once every 150 years during an emergency but once every 3 years during drills/maintenance). The figures for the likelihood of a TEMPSC dropping into the sea are based on a review of TEMPSC accident data, probabilistic failure data for different aspects of the launch sequence, earlier studies and assumptions about the frequency of both emergency and test launches. The report also concluded that: any TEMPSC launched a short distance away from the platform into a moderate sea, with wave motion towards the platform, is likely to collide with some jacket member(s) at velocities likely to cause damage to propulsion and steering equipment and to suffer significant structural damage. But, because TEMPSC launch on the windward side of an installation is expected to occur during an emergency evacuation, the frequency of occurrence for both these events occurring simultaneously on the UKCS is once every 15 20 years. 3.3.4 TEMPSC holding position Assuming the TEMPSC successfully clears the installation the occupants will be in an enclosed craft that is particularly susceptible to external environmental conditions. In some cases these may be severe enough to induce physiological reactions that may be detrimental to the operation of the TEMPSC 17 . 3.3.5 Recovery of TEMPSC occupants to FRC and rescue vessel Anecdotal evidence from some ERRV operators indicates that the recovery of survivors from a TEMPSC to an ERRV can be achieved more safely by using the FRC as a fender; between the TEMPSC and ERRV. Reports suggest this has been achieved in up to 25 knots winds and sea states up to 3m. The more usual, and safer, method of survivor recovery is to first effect the transfer to a FRC and then to hoist the FRC back to the ERRV. In these circumstances it is more likely that the limiting factor will be ability to recovery the FRC to its mother vessel. It is generally accepted that this becomes extremely difficult in sea states above 5.5m Hs.

TEMPSC Structural Design Basis Determination. Part 3 Event Levels and Safety Margins by P A F A Consulting Engineers, May 2001, D3834 17 "Survivability of Occupants of Totally Enclosed Motor Propelled Survival Craft", by I.M Light and S.R.R Coleshaw, OTH-92-376.

16

18

As part of the increased launch operability limits suggested by the use of PROD-type systems (referred to in Section 3.3.2) research was undertaken in parallel to enhance the safe recovery of occupants from a TEMPSC onto a rescue vessel. The Lifeboat Occupant Recovery System (LORS) 18 was developed and demonstrated in response to a number of previous failures and fatalities that had occurred during the transfer process. The outcome of the trials suggested that there would be an increased likelihood of a successful survivor transfer if the TEMPSC and rescue fitted were fitted with the LORS, although it is believed that the equipment was never produced commercially. 3.3.6 Recovery of TEMPSC occupants to helicopter Trials have shown that evacuation of TEMPSC occupants to a helicopter is difficult. This is particularly the case when attempting to transfer survivors via a TEMPSCs side door where studies 19 have demonstrated that winch transfer in wave heights greater than 2m is all but impossible. Offering a better prospect of successful transfer of survivors to a helicopter, use of the TEMPSCs roof hatch has been demonstrated 20 in wind speeds of 25 knots. 3.3.7 Mathematical modelling An attempt to mathematically model the TEMPSC launch procedure and quantify the effect of differing parameters was undertaken in 1988 with the ESCAPE program 21 . Users of the program enter various parameters for which a solution is sought such as the environmental conditions, the type of structure, the number, location and dimensions of TEMPSC and alternative helicopter evacuation. Finally, the user specifies the probabilities (from 0% - 100%) for certain determined events such as the likelihood that the coxswain will be unable to release the winch in storm conditions. Based on user input data the outcome of the program is a predicted three-dimensional path for the TEMPSC following launch. The program also contains tables that can be used to assume the seriousness and location of any impact between the TEMPSC and installation and hence suggest estimates for the number of fatalities that could be expected to occur. In the years since the program was prototyped it is believed that little or no additional development work has been carried out. The status of the programs validation protocol is similarly uncertain as is whether it was ever used in earnest or simply to demonstrate a concept.

18 19

LORS Lifeboat Occupant Recovery System, by Husky/Bow Valley East Coast Project, OTO-96-706. "Review of the Probable Performance of Offshore TEMPSC", MaTSU MaTR/142. 20 "Helicopter Rescue from Offshore Survival Craft", by Techword Services for the Department of Energy, OTH-90-319. 21 ESCAPE II: Risk Assessment of Emergency Evacuation of Offshore Installations, by Technica, OTH 88 285.

19

20

4 OFFSHORE REGULATORY REGIME AS APPLIED TO TEMPSC

4.1 OVERVIEW
After the Piper Alpha disaster in the North Sea in 1988 Lord Cullen chaired the official Public Inquiry in two parts; the first established the causes of the disaster and the second made recommendations as to the future safety regime. The resulting reports contained a total of 106 recommendations aimed at operators, the HSE and others.

4.2 SAFETY CASES

A key recommendation from the inquiry was assigned to HSE and was for the development and implementation of regulations that required the Operator/Owner of every installation to submit a Safety Case to the HSE for their acceptance. Under the 1992 Regulations the Safety Case was very often a complex document in which the Operator/Owner demonstrated that the Company had:

An adequate Safety Management Systems. Identified risks and reduced them to as low as reasonably practicable. Put management controls in place. Provided for temporary safe refuge to be available. Made provisions for safe evacuation and rescue.

By November 1993 a Safety Case had been submitted to the HSE for every installation and by November 1995 all had been accepted. Under the Offshore Installations (Safety Case) Regulations 2005 (OSCR), which came into force on 6 April 2006 replaced and revoked the previous 1992 regulations, several schedules cover a number of different installation operating scenarios and detail the particulars to be included in the safety case submission.

4.3 PFEER
To complement the Safety Case Regulations in fostering a goal setting approach the Offshore Installations (Prevention of Fire and Explosion and Emergency Response) Regulations 1995 (PFEER) were developed. Without PFEER it is possible to argue that, based on historical events and quantified risk assessment (QRA), TEMPSC may be unnecessary. To overcome this clearly undesirable situation PFEER introduces the concept of reasonable foreseeability, a regime that does not depend on the formal calculation of QRA to determine the existence and magnitude of risk, but instead on whether a particular hazard is foreseeable and how, assuming it is, the consequences may be mitigated. At the highest level PFEER requires the person or company responsible for an installation to protect persons on the installation from fire and explosion and securing effective emergency response. Through this the regulations aim to promote a risk based systematic approach for

21

managing fire and explosion hazards and emergency response that considers the various stages of an emergency and how within each of those stages it can be most effectively conducted. A cornerstone of PFEER, enshrined within Regulation 5, is the requirement for Duty Holders to establish appropriate standards of performance to be attained by anything provided for .. ensuring effective evacuation, escape, recovery and rescue . To assist Duty Holders and other interested parties in understanding and fulfilling PFEERs requirements the HSE produced an Approved Code of Practice (ACoP) and Guidance to accompanying the regulations. To the extent applicable to this study, i.e., those dealing with performance standards, the following paragraphs are of most relevance: Paragraph 45: - A performance standard is a statement, which can be expressed in qualitative or quantitative terms, of the performance required of a system, item of equipment, person or procedure and which is used as the basis for managing the hazard e.g., planning, measuring, control or audit through the life cycle of the installation. The regulation does not specify what performance standards should be that is for the Duty Holder to decide, taking account of the circumstances on the particular installation. Paragraph 50: - The process of assessment should involve the following steps: . identifying performance standards for those measures to protect persons from fire and explosion and to ensure effective evacuation, escape and rescue. Paragraph 51: - There may be considerable iteration between the steps. The aim is to come out of the assessment process with measures for the effective management of fire and explosion hazards and for evacuation, escape and rescue and appropriate standards for them. Paragraph 56: - That part of the assessment dealing with evacuation, escape and rescue should address: . the means of evacuation including type, capacity and location available for the evacuation of personnel from temporary refuge, muster areas and other parts of the installation from which access to temporary refuge is not readily available. Paragraph 57: - The assessment should identify the factors which might affect the availability of measures and arrangements. This should include the environmental and weather conditions which may limit the capacity to carry out effective evacuation, escape and rescue. Further guidance on effective recovery and rescue arrangements is given in the ACOP and guidance to regulation 17. Paragraph 58: - Setting performance standards for measures is a crucial aspect of the assessment process. Performance standards should relate to the purpose of the system, item of equipment, procedure, etc. which they describe. They may be described in terms of FUNCTIONALITY, SURVIVABILITY, RELIABILITY AND AVAILABILITY. They should be measurable and auditable. From the foregoing it is apparent that aside from requiring performance standards to be developed, the regulations and guidance are not prescriptive in terms of what the performance

22

standards should be, instead leaving it for the for the Duty Holder to decide depending on the circumstances of their particular case. However, in some respects this makes the HSEs task of reviewing Duty Holders PFEER assessments more difficult insofar as they may differ markedly in scope and detail yet there may not be any benchmarks against which they can be assessed. By reviewing the deliverables from a number of pertinent HSE research reports it may be possible to collate and combine the outcomes to produce guidance for HSE Inspectors to assist them in their assessment of Duty Holders submissions in respect of TEMPSC performance standards. This is explored further in Section 5. After first detailing the sequence of events likely to occur when TEMPSC are used for installation evacuation, many of the systems failings and their consequences are detailed.

23

24

5 INSTALLATION EVACUATION USING TEMPSC

5.1 INTRODUCTION
This section of the report details the role, potential failure modes, cause and effect on TEMPSC within the overall ER plan. The EER process from an offshore installation is complex due to the various paths that may be adopted; these depend primarily on the particular circumstances and nature of the emergency. To simplify the process it can be broken down into a series of phases:

DETECTION of problem Sounding the ALARM ACCESS the MUSTER station, normally in the temporary refuge (TR) EGRESS from muster station PRIMARY EVACUATION method (assumed for this study to be via TEMPSC) RECOVERY from TEMPSC Transfer to a PLACE OF SAFETY

For the purposes of the study only the events subsequent to leaving the TR are considered in detail. Each phase has a number of components or sub-phases, for example preparing the craft for launch, boarding and launch sequence, etc. Each sub-phase is considered separately to identify possible failures, failure causes and failure modes. The nomenclature adopted in the tables is: the termination of the ability of an item to perform a required function. In the context of this report failure is not an isolated event. There may be deep underlying causes why an item fails and there may be remote consequences of an item failure that involves people and property. and modes.

Failure:

the isolated circumstances during design, manufacture, assembly, installation or use that lead to failure. Failure mode: the effect by which failure is observed. Item failure may happen at any time or stage through failure of a dependent item which makes a contribution to the failure event.

Failure cause:

Primary failure: Secondary failure:

failure of an item not caused either directly or indirectly by failure of another item. failure of an item caused either directly or indirectly by failure of another item.

25

26

5.2 TEMPSC SELECTION

Failure

5.2.1 Inappropriate craft selected

Failure Cause (Primary) OIM selects wrong TEMPSC.

Failure Cause (Secondary) Prevailing wind not in normal direction. OIM has insufficient information on weather conditions. OIM is unaware of TEMPSC launch risks in specific weather conditions.

Failure Mode Unsuccessful launch.

Comments

OIM is unaware of damage to TEMPSC.

TEMPSC cannot be launched.

5.3 PREPARATION FOR LAUNCH

Failure

5.3.1 Seawater cocks jammed 5.3.2 Failure to start engine 5.3.3 Excessive personnel payload

Failure Cause (Primary) Lack of maintenance.

Failure Cause (Secondary)

Failure Mode Water will enter craft on launch.

Comments Seawater cock may be self closing and normally set closed.

Lack of maintenance. Lack of coxswain training. Lack of control by muster controller.

Unable to use craft. Lack of training. Lack of POB control. Inadequate provision of TEMPSC. Overloaded TEMPSC.

27

5.4 EMBARKATION
Failure

5.4.1 Access to craft blocked 5.4.2 Craft descends before loading complete

Failure Cause (Primary) Protection against fire, blast, smoke or gas fails. Speed of incident.

Failure Cause (Secondary)

Failure Mode TEMPSC cannot be boarded. TEMPSC does not launch. Some crew left behind.

Comments

Lack of training.

5.5 LOWERING MECHANISM ACTIVATED AND DESCENT INITIATED

Failure

5.5.1 Release pins jammed 5.5.2 On-load release hook inadvertently operated by human action

Failure Cause (Primary) Inadequate or ineffective maintenance of release mechanism. Lack of crew training.

Failure Cause (Secondary)

Lack of maintenance.

Failure Mode TEMPSC launch delayed or TEMPSC may not release at all. Crew have to make an alternative escape. TEMPSC may fall from great height to sea or be left suspended from one hook. Many severe casualties are likely in either case TEMPSC cannot be used

Comments

28

5.6 TEMPSC DESCENDS TO THE SEA

Failure

5.6.1 Winch/brake release mechanism seizes 5.6.2 Winch fails to control descent 5.6.3 Falls wire/ shackles break 5.6.4 Release hook opens spontaneously when boat is at height 5.6.5 Falls wire not long enough 5.6.6 TEMPSC integrity compromised by fire

Failure Cause (Primary) Inadequate or ineffective maintenance of release mechanism. Inadequate or ineffective maintenance of winch. Inadequate or ineffective maintenance of wire/shackles. Inadequate or ineffective maintenance of on-load release hooks or improper setting of interlock. Inadequate or ineffective test. No protection for fire during descent phase.

Failure Cause (Secondary)

Failure Mode TEMPSC does not descend.

Comments

Rapid descent to sea level that may cause fatalities. As above. Rapid descent to sea level that may cause fatalities.

Fire deluge does not operate.

TEMPSC does not descend to sea surface. High internal temperatures.

5.6.7 Wave impact damages craft 5.6.8 Craft hits object in water

Impact of wave on bottom of craft outside design limits.

Structural collapse of TEMPSC (Canopy/Hull).

GRP offers good thermal protection, however steel and aluminium (used in freefall craft) have a high thermal conductivity that may increase internal temperatures. Magnitude of horizontal forces during breaking wave conditions need to be better assessed.

Debris from installation.

Structural collapse of TEMPSC (Canopy/Hull).

29

Failure

5.6.9 TEMPSC failure from impact with installation

Failure Cause (Primary) Excessive wind loading.

Failure Cause (Secondary) Insufficient TEMPSC overhang.

Failure Mode Structural collapse of TEMPSC (Canopy/Hull).

Comments Data on severe weather trials/modelling of TEMPSC launch are limited. Structural and fendering requirements to be assessed to improve damage resistance.

Movement of installation/ vessel, e.g. semi-submersible or FPSO.

Inadequate strength of canopy/hull.

5.6.10 Craft yaws rotates during descent

Craft with single fall wire.

Anti-twist falls wires not used. Orientation system such as PROD, TOES, SCAT not used. Launch not practised therefore extent of rotation not verified. Operator rotates craft on docking into position introducing a torque on the fall. Orientation system such as PROD, TOES, SCAT not used.

TEMPSC facing in wrong direction. TEMPSC unable to clear the installation.

Rotation of twin fall craft by wind.

TEMPSC facing in wrong direction. TEMPSC unable to clear the installation.

5.7 RELEASE GEAR ACTIVATED

Failure

5.7.1 Falls wires not released

Failure Cause (Primary) Failure of release gear (ratchet/lock, etc.)

Failure Cause (Secondary)

Failure Mode TEMPSC not released. TEMPSC unable to leave the vicinity of the platform.

Comments Waves may pound the craft.

30

5.8 CRAFT LEAVES THE PLATFORM VICINITY

Failure

5.8.1 Set back

Failure Cause (Primary) The use of the rudder sets the stern of the craft back towards the installation.

Failure Cause (Secondary) Craft does not point away from installation. Lack of overhang. Hull form increases setback. Lack of acceleration. Lack of enhanced launch systems.

Failure Mode Craft impacts structure.

Comments The action of the rudder used to steer the craft in the escape direction also sets the stern of the craft back towards the installation.

5.8.2 Wash back 5.8.3 Propeller rotation on parallel mounted TEMPSC impedes escape from platform vicinity 5.8.4 Coxswain does not steer correct course

Adverse wind and waves. Driveshaft/rudder/gearbox failure. TEMPSC will tend to move to one side or the other depending on the direction propeller rotation.

Craft impacts structure. Propeller rotation not taken into account when specifying the TEMPSC design. Escape from vicinity not as rapid as it might be.

Poor visibility. Compass not used correctly (poor calibration, magnetic deviation or difficult to use or see). Lack of crew competency (training, human error).

Smoke. Fog.

Craft impacts structure.

Inadequate viewing position from coxswains seat.

31

5.9 TEMPSC HOLDING POSITION

Failure Failure Cause (Primary) Adverse wind and wave effects. Movement of occupants within TEMPSC. Failure Cause (Secondary) Sea anchor not deployed or deployed incorrectly. Engine failure. Coxswain competency (inadequate training) Occupants not strapped in. Small number of occupants in TEMPSC. Inappropriate TEMPSC design. Failure Mode TEMPSC capsizes. Comments Stability

5.9.1 Position of centre of gravity temporarily altered

Adverse wind and wave. 5.9.2 Centre of gravity too close to centre of rotation Engine not powerful enough. 5.9.3 TEMPSC drifts from position Sea anchor not deployed or deployed incorrectly. Engine failure. Time waited for weather to abate.

TEMPSC rolls like a barrel. Occupants at risk of injury or may be incapacitated by seasickness. Craft impacts structure.

Information on TEMPSC trials in severe weather is often unavailable.

5.9.4 Deterioration of health of crew and TEMPSC occupants

Fumes from engine. Seasickness Inadequate sluicing to remove vomit from floor of TEMPSC. Noise of engines puts stress on occupants and makes communication difficult.

Poor judgement of occupants and crew. Unable to operate TEMPSC effectively. Incapacity of occupants due to seasickness/ dehydration.

32

Failure

5.9.5 Another craft tries to tow TEMPSC

Failure Cause (Primary) Towing of TEMPSC to shore.

Failure Cause (Secondary)

Failure Mode Risk of capsize.

Comments Towing a TEMPSC has been demonstrated to be extremely hazardous.

5.10 RECOVERY OF TEMPSC OCCUPANTS TO FRC AND RESCUE VESSEL

Failure

5.10.1 TEMPSC occupants fall into sea during recovery

Failure Cause (Primary) Disordered disembarkation unbalances TEMPSC. Recovery of the TEMPSC as a unit onto the deck of a rescue ship is not commercially available.

Failure Cause (Secondary) The rescuers do not wait a sufficient amount of time for severe weather to abate. Large attendant ships not being used to provide a lee.

Failure Mode TEMPSC occupants fall into sea during recovery.

Comments

TEMPSC occupants debilitated by seasickness so cannot aid their own recovery. FRC not used to effect transfer.

Direct recovery of TEMPSC to deck of ship could possibly be the most effective method of survivor recovery although development costs have so far prevented such a product being available. TEMPSC occupants fall into the sea with no effective means of buoyancy Unprotected TEMPSC occupants fall into the sea. Whenever possible inflatable rather than inherently buoyant lifejackets should be worn

5.10.2 TEMPSC occupants do not wear survival suit during transfer 5.10.3 TEMPSC occupants do not wear lifejackets during transfer

Survivors not wearing lifejacket.

33

5.11 RECOVERY OF TEMPSC OCCUPANTS TO HELICOPTER

Failure

5.11.1 Survivor snags on TEMPSC during lift

Failure Cause (Primary) Lack of suitable top hatch or platform.

Failure Cause (Secondary) Inadequate design of TEMPSC. Two way marine radio communication between TEMPSC and helicopter not available to coordinate recovery of occupants. SAR aircrews and TEMPSC coxswains have irregular opportunities to train for recovery from these unusual craft.

Failure Mode Survivor hurt or not rescued.

Comments TEMPSC design should avoid snagging hazards.

5.11.2 Survivor hurt during lift

Inherently buoyant lifejacket worn by survivor.

Survivor hurt.

Lifejackets should be inflatable because an inherently buoyant lifejacket forces the wearers' head back in a dangerous manner.

34

5.12 RESCUE FROM WATER TO TEMPSC

Failure

5.12.1 Water floods TEMPSC during rescue

Failure Cause (Primary) Side doors used to recover persons in water during anything but calm weather.

Failure Cause (Secondary) No aft cockpit to aid rescue of persons in the water. Large side doors. Moderate weather or worse. TEMPSC occupants lend a hand to recover person in the water. Those not strapped in destabilise the craft. Lack of lifting device.

Failure Mode Multiple fatalities.

Comments

5.12.2 TEMPSC occupants fail to rescue others in the water

TEMPSC poorly designed.

Fatality

TEMPSC are poorly designed for the purpose of rescuing persons from the water.

35

36

6 LIFEBOAT/TEMPSC ACCIDENT CASE STUDIES

To place this section in context the generic procedure for a test lifeboat/TEMPSC launch and recovery on a typical UK offshore installations (fixed or MODU) using fixed davits is described. Although differences in design between the craft of individual manufacturers may require slight modifications to the process, this procedure is typical of those carried out with onload release hooks.

6.1 TYPICAL DAVIT LIFEBOAT/TEMPSC LAUNCH AND RECOVERY ROUTINE

1. Prior to launch the harbour pins, if fitted, are removed. This effectively removes all mechanical restraints on the davits and they are now held in position by the tension in the falls as led to the winch drum. 2. Remove any safety pins holding the winch brake dead mans handle in position. When the handle is lifted it disengages the brake and allows the winch drum to rotate and the falls to pay out. Launching can also be effected from the craft itself via a remote lowering control. 3. The floating blocks come free and the full weight of the craft is transferred to the falls.The craft continues its descent into the water, suspended from the falls. 4. Once the craft is floating on the water the hydrostatic interlock permits the on-load hooks to be opened from inside the craft by pulling on the central release handle. The suspension rings are now freed from the hooks and the craft can move away. 5. To reconnect the craft to the falls the forward and aft on-load hooks first have to be reset. The craft is then manoeuvred and brought under the floating blocks and the suspension rings are slipped into the hooks. The retaining latch prevents the suspension ring from slipping out when there is no load on the falls. 6. An electric winch hoists the craft back up until the floating blocks bear against the davit heads. 7. The davits and the craft are then secured by re-engaging the harbour pins, if used. On the face of it the procedure appears straightforward and, given that SOLAS requires abandon ship drills to be held frequently, crews should become familiar with the process and confident with the equipment and in their own ability to carry it out successfully and safely. However, the reality is somewhat different and has resulted in a relatively high accident rate and consequent serious injury involving equipment designed primarily to save life

6.2 LIFEBOAT SAFETY STUDIES AND ACCIDENT REPORTS

As early as October 1986, just months after their use became mandatory, the UK regulators had become concerned at the number of reported accidents involving lifeboat on-load release gear. This prompted the UK Department of Transport to issue M.1248 reminding those involved in lifeboat drills and tests of the need for full and regular training in the correct operation of the equipment.

37

Since then and despite regular warnings from flag state administrations, underwriters, classification societies and P&I clubs the number of accidents and the seriousness of the consequences continued to rise and led to several studies being conducted by interest parties; these included:

OCIMF 22 Results of a Survey Into Lifeboat Safety OCIMF, Intertanko and SIGTTO 23 Lifeboat Incident Survey 2000 MAIB 24 Review of Lifeboat and Launching Systems Accidents

The reports and studies listed above provide an analysis of many lifeboat accidents gathered from a number of sources. For instance, the OCIMF reports rely on questionnaire results from ship operators whereas the MAIB Safety Study addressed their own extensive database of marine accidents. The 1994 OCIMF study analysed 92 incidents, the 2000 study looked at 89 incidents and the MAIB study a total of 125 incidents. All the incidents analysed in the reports above are believed to relate to ships lifeboats. In addition to the studies carried out into lifeboat safety in a general level, several national maritime accident investigation bodies have produced reports subsequent to investigations into specific lifeboat related accidents. The following are of particular note as they resulted in injuries/fatalities to those involved: Table 1 Major accidents involving TEMPSC
Country/ investigator UK MAIB UK MAIB UK MAIB UK MAIB Canada CTSB Canada CTSB Canada CTSB Canada CTSB Australia ATSB Australia ATSB Australia ATSB Country/
22 23

Ship name Gulser Ana European Highway Marine Explorer RFA Fort Victoria Farandole Iran Salam Iolcos Grace Pacmonarch1 Washington Trader1 Ma Cho Port Arthur

Accident date 17/10/2001 1/12/2001 14/03/2001 10/09/2004 14/05/1996 29/11/1993 9/11/1998 26/10/2000 6/08/2000 9/12/2002 20/10/2003

Lifeboat/accident details Stbd. Spontaneous hook release Port 4 injuries Premature hook release Winch 2 injuries Port Premature hook release Stbd. Spontaneous hook release Stbd. Hook connections Port Premature hook release Port Premature hook release Port Premature hook release Stbd. Premature hook release Stbd. Premature hook release Lifeboat/accident details 2 injuries 4 injuries 2 injuries Injures 4 injuries

Investigation report number 41/2002 1/2002 2/2002 9/2005 M96L0043 M93L0006

5 injuries M98W0245 1 fatality 1 injury M00W0265 3 fatalities None 160 1 injury 4 injuries 188 198

Accident

Investigation

Oil Companies International Marine Forum May 1994 Society of International Gas Tanker and Terminal Operators, London 24 Marine Accident Investigation Branch Safety Study 1/2001

38

investigator Australia ATSB Australia ATSB New Zealand TAIC New Zealand TAIC
Notes:
1

Ship name Cape Kestrel Alianthos Aratere Nicolai Maersk

date 12/10/2001 24/01/2001 6/08/2001 13/02/2001

Port Over-rode limits Port Premature hook release Port Spontaneous hook release Port Over-rode limits

Injures 4 injuries None None 6 injuries 1 fatality

report number 173 164 01-211 01-203

The Pacmonarch and Washington Trader were sister ships with identical lifeboats when the accidents occurred. The vessel operator subsequently removed four lifeboats and their launching equipment from the vessels and replaced it with those of a different manufacturer.

Accidents, including some resulting in injuries and fatalities, have also occurred with TEMPSC fitted to installations although it is believed to be a much less frequent occurrence than with those on ships. Nonetheless, a recent fatal accident during a test launch on board the semisubmersible Pride Rio de Janeiro in Portland, Maine on 13 January 2000 demonstrates that such events can also occur in the offshore environment. The report into the accident by the US Occupational Safety & Health Administration attributed the spontaneous release of the stern hook during hoisting to an improperly reset on-load release hook and the design preventing visual checks to confirm its security. Incidents during the routine servicing of TEMPSC have also been reported on the UKCS and these too have primarily involved issues with the on-load release hooks; though subsequent investigations have shown the causes were significantly different from those occurring in the marine industry. That fewer incidents have occurred to installation mounted TEMPSC compared to those on ships can probably be attributed to the better training, maintenance and testing regimes on the former, although there are also comparatively fewer TEMPSC in use aboard installations than there are on ships.

6.3 RESULTS OF ANALYSIS

The reports identified in Section 6.2 provide in-depth analysis of the accidents they have identified and this report does not seek to reproduce the results. However, it is believed that the salient points that each report contains can highlight common failings across a wide number of accidents and to this end the summary results and pertinent conclusions have been considered.

39

6.3.1 OCIMF - Results of a Survey Into Lifeboat Safety Table 2 OCIMF summary of results
Reasons for activities Drill 82% Activities during incidents Underlying causes Recovering 10% Lowering 26% Design fault 29% Brake Maintenanc e Emergency 2% Stowing 18% Human error Survey 6% Launching 11% Poor maintenance 4% Davit Other 10% Physical conditions 4% Fall wire Disembarking 5% Communications /training 3% Other 17%

30% Component failure 38% Component Hook/ failure release gear 32% Hook/release Design gear failure fault cause 50%

22% Remote brake release 26% 5% Human error Equipment failure 30% 19%

11% 9% Poor Training maintenance 5% 5%

OCIMF Conclusions:

The results demonstrated that most lifeboat incidents occur during training drills required by the SOLAS Convention, flag State or Company directives. As the purpose of this training should be to raise crew confidence and competence to handle a real emergency, the marine community should reconsider if this objective is being fulfilled. The design and construction of lifeboats and in particular auxiliary equipment, such as brakes and release gear, play a significant part in contributing towards the cause of many lifeboat incidents with the most catastrophic event being the opening of a boat hook with the boat some distance from the water. Incidents of this nature can be avoided if the boat crew is able to confirm the hook is secure for lowering or lifting. Their repeated failure has, however, played a large role in reducing ship staff confidence in lifeboats. The results suggest that some boats are not sympathetically designed for the crew. The canopy of a lifeboats may limit the coxswain's ability to supervise the securing of hooks for lifting. This canopy, coupled with fore and aft hatches that are not designed with due consideration for the need to observe and avoid swinging blocks during the recovery operation, puts the boat crew in jeopardy when trying to come alongside and hook up in a seaway. Human error proved to be a significant contributory factor in many of the reported lifeboat incidents, as it is in most accidents. Lack of supervision was not found to be a significant factor in the cause of reported human error related incidents therefore the potential for mistakes might reasonably be expected to increase during the stress of a real emergency situation. SOLAS requirements for lifeboats are focused on launching. Although regular training is required, insufficient emphasis is placed on measures designed to ensure that routine operations, such as recovery and lifting of lifeboats and rescue boats, can be conducted safely.

40

Crews lack confidence in the current generation of lifeboats to the extent that there is sometimes an unwillingness to conduct the necessary drills. Responsibility for much of this cynicism rests in the lack of human factors considered in lifeboat design and legislation. This is reflected in the design, and construction of some boats where the focus is cost competitiveness rather than providing equipment that is easily maintained and simple to understand and operate.

6.3.2 OCIMF, Intertanko and SIGTTO Lifeboat Incident Survey 2000 Table 3 OCIMF, Intertanko and SIGTTO summary of results
Craft type Freefall 6% Drill 39% Component failure 48% Hook/ release gear 30% Open -onboard release 7% Maintenance 36% Poor maintenance 19% Brake 24% Open - no onboard release 3% Survey Enclosed onboard release 84% Emergency Not specified 9% 0% 16% Communications/ Human error Design training fault 10% 10% 13% Remote brake Davit/gripe Fall wire Other release 12% 2% 2% 30%

Reasons for activities Underlying causes Component failure

OCIMF, Intertanko, SIGTTO Conclusions:

Both this report and the 1994 survey show that the design and construction of lifeboats and their auxiliary equipment, such as hook and hook release equipment and winch brakes play a significant part in incidents involving lifeboats. Retrieval of the boat is a secondary factor almost entirely confined to the mechanics of training exercises/drills. It appears that the designers of such boats and their securing methods have not addressed this secondary factor with sufficient thought. This can be illustrated by the design of complicated hook release equipment. Once assembled and maintained correctly such equipment can be very reliable, however, should a small error in the location or a reduction of clearance occur with even seemingly minor parts, disastrous consequences can ensue. Making minor adjustments to these complicated arrangements is prone to error when securing a boat on its falls in a seaway. Design factors also apply to types of materials used. Should the hook release equipment be manufactured from a material susceptible to wastage then reliability and maintenance can be severely affected. Operational human error does not appear to be a direct cause of many incidents. Human error in design and not adequately specifying launch and recovery equipment standards for practical eventualities is apparent.

41

6.3.3 MAIB - Review of Lifeboat and Launching Systems Accidents Table 4 MAIB summary of results
Classification Hooks Tricing and bowsing Falls, sheaves and blocks Engine and Starting Gripes Winches Davits Free-fall Weather Not otherwise classified TOTALS Number of incidents 11 10 12 18 12 32 7 2 2 19 125 Injuries 9 5 19 15 10 8 7 1 0 13 87 Lives Lost 7 2 2 0 0 0 0 0 0 1 12

MAIB Conclusions:

A root cause of many of the accidents was the over-complicated design of the lifeboat launch system and its component parts, which in turn required extensive training to operate. Training, repair and maintenance procedures fell short of what was necessary, and that there were extensive problems with manufacture, construction, maintenance and operation. Launch systems should capable of being operated and readily understood by people with minimum training and experience and, above all, can be used for training and deployment both reliably and safely without injuring anyone.

6.4 RISK MITIGATION MEASURES

Although many in the marine industry have been aware of the potentially perilous state of some designs of lifeboat/TEMPSC equipment for almost 20 years, concerted and global efforts to address the shortcomings have been initiated only relatively recently. Perhaps stung by the publication of the reports outlined in Section 6.3, as well as a number of others, in recent years the IMO have turned their attention to this matter. Although the timescales required to modify the regulatory regime and attitudes is necessarily protracted the measures proposed by the IMO, if implemented, may go some way towards reducing the number of lifeboat/TEMPSC related accidents in the future. Of particular relevance to this study are the following circulars issued by the IMOs Maritime Safety Committee (MSC) since 2002. Copies of the documents detailed below are included in Appendix 1.

42

MSC/Circ.1049 18 May 2002 Accidents with Lifeboats Essentially this document acknowledges the IMOs awareness of worsening accident rate during lifeboat/TEMPSC drill, inspections or maintenance and highlights the categories and circumstances when most accidents are likely to occur. The circular goes on to recommend flag states make their marine industry aware of the problem, ensure all relevant documentation is understood by those involved in drills and that they themselves are properly qualified and experienced, and that any shore maintenance is carried out by approved repairers. In essence the document appears to be a stop gap measure to raise awareness of the problem within the industry while allowing more time to fully consider the issues. It repeats good advice while at the same time appearing to do little to address the root of the problem which is more likely to be with the design and manufacture of the equipment.

MSC/Circ.1093 17 June 2003 Guidelines for Periodic Servicing and Maintenance of Lifeboats, Launching Appliances and On-Load Release Gear The guidelines contained in the circular provide a clear and unambiguous statement of best practice with respect to periodically inspecting and maintaining lifeboats and their ancillary equipment. Responsibilities and expected qualification levels are clearly defined as is the need for proper record keeping. Great emphasis, quite rightly, is placed on matters to do with the maintenance of the release gear, particularly those with on-load designs, and detailed descriptions of the steps to be followed are presented. On the whole, in terms of an inspection/maintenance regime for lifeboats, the contents of the circular are of great benefit to those carrying out the work and, if complied with, ought to minimise the occurrence of accidents caused by improper maintenance.

RESOLUTION MSC.152(78) (adopted on 20 May 2004) Adoption of Amendments to the International Convention for the Safety Of Life At Sea, 1974 Contained within a number of amendments to SOLAS, notably to Regulation 19 (Emergency training and drills) and Regulation 20 (Operational readiness, maintenance and inspections), concerning the conditions and operational tests to be carried out during weekly and monthly inspections, a new paragraph (para. 7.1) was added to Regulation 20 of Chapter III: All lifeboats, except free-fall lifeboats, shall be turned out from their stowed position, without any persons on board if weather and sea conditions so allow. The effect of this amendment will be to permit lifeboats to be lowered or recovered without the need for a launching crew to be inside. It is anticipated that crew would ready the boat prior to launch and then exit before it is moved away from its stowed position. Similarly, on recovery the crew would leave the craft after it is made ready to hoist but before the lift begins.

43

MSC/Circ.1127 15 December 2004 Early Implementation of Amendment to SOLAS Regulation III/19.3.3.3 Adopted by Resolution MSC.152(78) Although the MSC adopted the amendment to SOLAS regulation III/19.3.3.3 in May 2004 (MSC.152(78)) in relation to the operating crew being aboard lifeboats at the time of launching during abandon ship drills, the change was not due to enter force until 1 July 2006. Because of the seriousness of the issue and the likely continued injury to seafarers in the interim, this circular urges SOLAS contracting governments to implement the amendment before the scheduled date. Mindful of the potential for new, albeit different, risks to seafarers to occur through the adoption of the amendment the circular draws attention to the need for proper arrangements for crew access and egress to/from lifeboats.

MSC/Circ.1136 15 December 2004 Guidance on Safety During Abandon Ship Drills Using Lifeboats The circular refers back to previous MSC meetings and reiterates the categories that most lifeboat related accidents can be attributed to historically. The remainder of the guidance is aimed almost exclusively at seafarers and deals with the planning and conduct of lifeboat drills and the lesson learning resulting from it. Unfortunately, there is no mention of addressing the shortcomings of davits and the launching equipment (although this may be being addressed in other areas of IMO), instead assuming accidents will diminish if seafarers were only more careful, motivated and better trained to carry out their duties. While this is no doubt true to some extent and accepting there may be accidents regardless of how well the equipment has been designed, it is also fair to say that some accidents can be attributed to poor equipment design and/or manufacture rather than simply those operating it.

6.5 QUALITATIVE/QUANTITATIVE ON-LOAD RELEASE STUDY

A recent study 25 , no doubt prompted by the continuing toll in death and injuries caused by failures or improper/premature release of on-load release hooks on lifeboats/TEMPSC, was commissioned by Transport Canada. Referring to the MAIB report and others, the study set out to explain the degree to which damage or improper use of the release cable could have an effect on hook operation. Using two designs of type approved on-load release hook, one of older manufacture and one more modern where an attempt had been made to design out most of the inherent failings, a series of comparative physical tests were carried out. The report from the study lays out the comparative results in some detail. In short, it found that the hook of modern design displayed a great deal of inherent locking stability, i.e., the ability of the hook to resist premature opening and remain closed while under load. By comparison, the hook of older design had no inherent locking stability and as a result if the cable is removed from the cam and an applied load is put on the hook, the cam rotates open on its own. This occurs at loads as low as 1000kg.

25

Lifeboat Release Mechanism Testing. 14 September 2005

44

7 NOVEL MEANS OF ESCAPE

Since the earliest days of offshore oil and gas exploration TEMPSC have been considered as the primary means of waterborne escape and although free-fall TEMPSC have become more common in recent years, for the most part conventional twin-fall davit launched craft are still in the majority. While free-fall craft go a long way in overcoming what is accepted to be the most hazardous phase of TEMPSC evacuation, the launch and getting away from the installation, there have been a number of other developments both in the offshore environment as well as the marine industry aimed at further increasing the prospect of a successful outcome. In the following sub-sections two such systems are described. The extent to which they are applicable or suitable for use offshore is not debated nor should their inclusion been seen as an endorsement of either the concept or construction.

7.1 SEASCAPE SYSTEM OF EVACUATION Development of the Seascape System of Evacuation (SSE) began in 1985 as a result of the findings of the enquiry into the loss of the semi-submersible drilling rig Ocean Ranger. In the Royal Commissions Report One, among over 100 recommendations, it was suggested that .. Canadian authorities consider the development of an evacuation system that will provide an adequate and safe means of escape in foreseeable emergency and storm conditions 26 The SSE comprises a specially designed TEMPSC, termed the Life-Rescue Craft (LRC), along with a launching davit and ancillary equipment. On launching the LRC is lowered under gravity from its stowage position via an articulated arm in a controlled fashion. By design the LRC floats free of the arm when it becomes waterborne some 30m from the structure on which it is fitted. The articulated arm is designed to continue rotating after LRC release and eventually sink beneath the sea surface. Full scale trials of the SSE were held at Portugal Cove, Newfoundland during 2004 and reportedly demonstrated the systems ability to launch its LRC in up to 5m head seas. A draft final report of the SSE project, including full scale trials results to August 2004, has been produced 27 and can be referred to for further information on background, design and development. Although some of the systems performance criteria relate specifically to operation on the Eastern Canadian shelf, i.e., the ability to launch on to ice, on the face of it the trials results suggest that the system could also be used for escape from offshore installations in other areas including on the UKCS. It is understood some further demonstration trials still need to be carried out, in particular the systems ability to launch directly on to the deck of a rescue vessel, before it can be claimed that it fully meets all performance targets. Figure 12 represents the SSEs general arrangement for its full scale trials. It is presumed that if fitted offshore the fabricated tower structure would be replaced by a suitably strengthened and modified arrangement on an installation.

26

Canadian Federal-Provincial Royal Commission on the Ocean Ranger Marine Disaster Report One Recommendation 22. 27 Seascape System of Evacuation (SSE) JIP Final Report - SSP019-01, 2004.

45

Figure 12 SSE test rig general arrangement

Figure 13 SSE Life-Rescue Craft (LRC) The LRC is said to be constructed of aluminium-alloy, be 12.8m in length and powered by twin 150hp turbo-charged diesel engines with twin screws. The capacity is reported to be 70 persons.

46

7.2 NORSAFE RESCUBE

In some respects, particularly regarding the potentially large numbers involved, the risks associated with evacuating an offshore installation are similar to those encountered in abandoning cruise ships or ferries. Although originally designed for the latter, the Norsafe Rescube 28 is said to offer a dry shod evacuation system that is accessible from a number of decks simultaneously, has a large capacity and is capable of operating/launching quickly. While stowed the craft is designed to lie vertically within recesses in a vessels topsides with access provided to the interior of several decks. Once loaded the craft is partially launched by gravity davit until the correct attitude is achieved and thereafter free-falls to the water. It is not known whether variants of the system are being designed for use offshore though it is conceivable that such a system may be positioned against the exterior of a temporary safe refuge (TSR) and be particularly useful where the TSR covers more than one deck.

Figure 14 Norsafe Rescube general arrangement

28

www.norsafe.no/rescubeny.htm

47

Figure 15 Norsafe Rescube boarding and launching system Although it is expected that most evacuees from offshore installations will be able to play a greater role in the abandonment procedure than cruise ship/ferry passengers, on the face of it there may well be some benefit of the merits of the Norsafe Rescube being critically assessed by the oil and gas industry.

48

8 CONCLUSION
8.1 PERFORMANCE STANDARDS
8.1.1 IMO standards Quite correctly the marine industry relies heavily on the IMO for their standards and in the case of lifeboats a comprehensive set of requirements has been produced in the form of the LSA Code. What is apparent, however, is that the standards are based entirely on the equipment being used on vessels and the needs unique to that environment. For instance, the likely accelerations on free-fall lifeboat occupants are considered in great detail whereas the effect on the crafts structural integrity during launch is only briefly addressed and then only with acceptance criteria that appear to be subjective. Given that many vessels have a much lower freeboard than offshore installations both the effects of accelerations on occupants and possible damage to the crafts structure may be greater. The IMO standards for lifeboats in the annex to MSC/Circ.980 are broad in scope and highly detailed yet there is a complete absence of weather parameters under which the tests should be carried out. It is believed that the majority of type approval trials will be carried out in sheltered waters or harbours in benign conditions: the sort of conditions under which a very limited number of evacuations by lifeboat/TEMPSC are likely to occur. In many respects the weather may not have too much effect on the results but in some, particularly the launch tests, the effect could be profound. It is a matter of record that many launches, both from vessels and from installations, have occurred in severe weather and this is probably the biggest factor affecting a successful outcome. To entirely overlook the effect of weather on type approval tests is an oversight that will do little to instil confidence of those who may have to use the equipment in all weathers. While it is justifiable for all concerned to be confident that equipment will perform as expected in more benign conditions than those under which the trials were conducted, the same can not be said when the situation is reversed. Although the LSA Code does mention the use of models for type approval it is possible this is to minimise manufacturing costs rather than because of the robustness of the results they produce. However, no mention is made of finite element analysis which, together with model testing, could provide a practical insight into craft performance in a range of sea conditions. All in all the case for simply transplanting marine industry lifeboats to offshore installations, albeit a practice that exists across all offshore oil producing areas of the world, appears to be not fully made as yet and to some extents calls into question their fitness of purpose. 8.1.2 Performance based standards The recent Canadian approach to performance based standards for evacuation, escape and rescue, i.e., laying down minimum performance standards to be achieved without prescribing how they may be achieved, follows the UKs general goal setting regime and therefore the principle may be suitable for consideration for the UKCS. With such a bold step it is imperative that consultations with all interested parties are broad in scope as well as detailed as to implement an ill-considered set of PBS could set back the process irrevocably. However, in some respects defining PBS may be considered as a means to an end rather than an end in itself because difficulties still remain for those assessing the suitability and robustness of proposed EER measures in relation to the PBS. This is because the general lack of empirical data on the escape process, particularly that part of the process dealing with TEMPSC launch and getting away, means the assessment could become a somewhat subjective task. Greater

49

levels of objectivity and transparency could be achieved with a larger body of validated data to draw upon. Perhaps this lack of information could be aided by considering within TEMPSC design specifications both a minimum speed for given sea-state and standards of manoeuvrability in waves. A limited amount of trials data in respect of set back does exist although clearly there is an urgent need for this to be expanded. Coupled with this is the need to better understand the hydrodynamic principles of the problem, possibly through the use of mathematical modelling.

8.2 TEMPSC EQUIPMENT

Some activities involving simple routine or planned maintenance activities have resulted in serious accidents, injuries or fatalities, whereas other accidents have occurred during periodic drills or test launches. Be it failures or premature opening of release hooks, inability to clear the installation due to set back, or shortcomings in design leading to difficulties in survivor transfer, it is worrying that a system purportedly to save lives could have caused so many accidents. Moreover, that the well documented and understood equipment failings could have been allowed to endure for many years does not show the relevant international regulatory bodies in a good light. Simply issuing warnings to those involved to take care when using the equipment, acknowledging that it could be dangerous, without addressing the root cause of poor design will do little to improve the situation. Anecdotal evidence suggests that a situation has now been reached where, because of the adverse publicity surrounding the majority of equipment, those who may have to use it in time of emergency have little faith in it being able to provide a safe and successful launch. Some opinions, expressed both in private and in public by respected sources, lead to the conclusion that many designs of on-load release hooks are merely accidents waiting to happen. This perception is often reinforced for a number of reasons:

Poor design leading to inappropriate or deficient maintenance. Overly complicated or contra-intuitive operating procedures. Lack of familiarity in use (possibly resulting from the belief that the activity could be dangerous).

This impression of institutional failings is strengthened when new equipment designs are tested in comparison with older, though still type approved, designs. With the benefit of new design technology it can be demonstrated that many of the earlier failings can be removed. All that should now remain is for a root and branch review and reform of equipment specifications to bring them up to what is possible by modern standards rather than to continue to accept the lowest common denominator. It is a clear case of standards failing to keep pace with technical possibilities. It is also unfortunate that because the current situation has been allowed to persist for such a long period the feelings of mistrust among those who may have to use the equipment may well remain even if standards are raised. User confidence may take years to recover and permeate through the industry as it is highly unlikely that any strengthened specifications, should they be implemented, will apply to existing equipment.

50

8.3 EVACUATION BY TEMPSC

Several of the elements of a TEMPSC evacuation sequence are known to be restricted by environmental parameters. These can have a detrimental effect on the operation of the craft, either directly or as a result of inducing physiological factors upon the occupants. However, in the stages of launch, getting away and rescue there appears to be little account taken of environmental parameters or specifications for limits of operability. In the majority of cases where performance data from research are available the operability limits tend to be expressed in terms of wind speed or the even broader measure of Beaufort force. Although there is a rough correlation between Beaufort force or wind speed and sea state there are a number of factors that affect both the significant wave height and, more importantly for boat launching, the wave steepness. The duration of a storm, the fetch and water depth all play a part in creating wave heights and steepness that differ from place to place. A review of relevant and available literature has shown that several analytical tools have been developed with reference to TEMPSC evacuation. Furthermore, several studies have been undertaken in the relatively recent past (up to 10 years ago) with regard to launch, getting-away and rescue by helicopter or FRC. The publicly available outcomes from the research have highlighted some aspects of the present capabilities but have not defined the limits of operability. It is also possible that similar or complementary research has also been undertaken by private bodies more recently, for instance by lifeboat/TEMPSC designers or manufacturers, the results of which would have been useful for this study, however, we have been unable to ascertain whether this is the case or not. In some respects the historical approach to lifeboats/TEMPSC and other aspects of the evacuation sequence has been through the provision of effective and to a large part reliable EER equipment. This has been done at the expense of either improving, understanding or even making meaningful estimates of what the limits of the equipments operability would be. To some extent this is understandable: The number of incidents where installation evacuations are required is small and hence there is little real experience. Even where data from such sources is available it may be more subjective than that gathered by independent and verifiable means.

Carrying out trials in adverse weather, and in doing so potentially exposing those involved to risk, may be morally difficult to justify. The diverse range of equipment and local environmental conditions that exist across the UKCS may mean the results would only be valid at the location in which they were carried out. The training and skill of those involved in TEMPSC launching will be almost impossible to benchmark yet will have a profound impact on its success.

8.4 LIFEBOAT/TEMPSC ACCIDENTS

A review of the accident investigation reports where a lifeboat/TEMPSC was involved has revealed a common failure mode is present in quite a large proportion of the incidents; namely, even though a launch is successful the on-load release hooks are often improperly set when the craft is recovered. Thereafter, in many cases the craft is an accident waiting to happen, be it at any time from the boat being hoisted from the water up to the time it is next launched and enters the water. Unbeknown to those operating the hooks their integrity may appear to be intact and it may even be possible to engage any built-in safety features. Subsequently, possibility as a result

51

of vibration or impact with the structure the hooks may open spontaneously and unexpectedly and the craft either falls to the water or becomes hung up on one hook and ejects the occupants. The reasons for so many accidents stemming either directly or indirectly from the on-load release appear to be many and diverse;

Poor equipment design leading to the inability of those using it to confirm whether it is safe. Materials used in the construction of release equipment being unable to withstand the rigours of the marine environment. Inadequate training of those using and maintaining the equipment. Non-standard design across manufacturers and differences in interpretation by flag states lead to equipment with variable levels of integrity.

Despite the enduring nature of lifeboat/TEMPSC accidents and consequent investigation reports recommending measures to minimise recurrence, for many years little appears to have been done. To some extent that such a situation has been allowed to develop can be understood insofar as marine equipment manufacturers design and produce these craft and their launching systems to satisfy the provisions of the IMO and consequently possibly feel unable or unwilling to go beyond the minimum. However, in some ways MSC circulars 1049 and 1136 have missed the point. While they warn those involved in drills of the cause of previous accidents, suggest that drills should be safe and properly planned and that where crew are to be put on a craft then it should be first lowered and recovered unmanned, they do little to address any design or production failings. Other than placing the onus on the crew to be aware of and overcome any equipment shortcomings, the crux of many of the deficiencies still rests with the design and materials of the release mechanism and these have been left largely as is. Furthermore, the revised guidance does not address the recovery phase after the boat has been taken away from the falls and where it may be necessary to raise the boat with crew on board a phase notorious for accidents because of the difficulty in manipulating and confirming the on-load release has been properly reset prior to hoisting. While the measures outlined in Section 6.4 are unlikely to provide the means to completely prevent lifeboat/TEMPSC related accidents, as it stands the modified guidance is good, common sense advice. Unfortunately, most of recent initiatives do little to challenge the current status quo and appear to rely on equipment manufacturers to improve the design and functionality of their launching systems well beyond what appears to be a lamentably low threshold of acceptability. Crews involved in drills have become so concerned for their own safety that there is widespread and marked reluctance to take part if it involves them boarding the craft. It is believed that those working with lifeboats/TEMPSC are already aware that it can be a dangerous activity and check the equipment as far as they are able prior to use; for the new guidance to only suggest making additional checks and be extra careful will do little to assuage crew mistrust of the equipment. To some extent the recent changes to the guidance is an opportunity missed. Minimum performance standards in respect of design, materials and construction have not been addressed nor does it appear that the human element has been considered. While it may be relatively straightforward to provide engineering solutions to a particular scenario, i.e., the need for an onload release mechanism, the ergonomic issues and potential for human error in its operation has not been properly considered during the design phase.

52

It is suggested that what would have benefited crews more than simply being reminded of the risks and advised to rigorously maintain and check the equipment would have been the drafting of amended regulations to enhance the quality of the equipment thereby reducing the potential for accidents.

8.5 SUMMARY
Due to their historical development as primarily a life-saving appliance for the maritime industry, almost all lifeboat/TEMPSC performance standards are focussed on ensuring minimum standards in design, construction and maintenance for use in vessel abandonment. Their use more recently in the offshore environment, particularly after being involved in a number of accidents, has led to several more critical assessments of whether these craft can follow the maritime regulatory regime and still meet the offshore industrys needs. By and large these assessments have highlighted some significant differences in the way these craft are required to function offshore compared to on board vessels. All in all the case for simply transplanting marine industry lifeboats to offshore installations, albeit a practice that exists across all offshore oil producing areas of the world, appears to be not fully made as yet and to some extents calls into question their fitness of purpose.

53

54

APPENDIX 1 REGULATORY NOTICES

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

Published by the Health and Safety Executive

11/07

Health and Safety Executive

Overview of TEMPSC performance standards

In the majority of offshore emergency scenarios on the UKCS the totally enclosed motor propelled survival craft (TEMPSC) are relied upon as the secondary means for mass evacuation, after helicopters. In many ways the lifeboats of the early part of the 20th century remain recognisable to those of the latter part though more recent changes to launch systems such as on load release and the free-fall concept have become more widespread, driven by legislative changes that are usually in response to specific incidents. Though the new systems are commonplace across both maritime and offshore industries a number of accidents have been reported that can be attributed to shortcomings in their design, use or maintenance. Even though TEMPSC are subject to performance standards as laid down by the International Maritime Organisation (IMO), these address issues primarily of concern to the carriage and use of lifeboats on ships rather than on installations. This study investigated the current regulatory regime as applied to TEMPSC and its relevance, bearing in mind the specific circumstances encountered, to craft for use offshore. This report and the work it describes were funded by the Health and Safety Executive (HSE). Its contents, including any opinions and/or conclusions expressed, are those of the author alone and do not necessarily reflect HSE policy.

RR599

www.hse.gov.uk