Escape, Evacuation, and Rescue

REPORT JULY
434-19 2023
RISK ASSESSMENT DATA DIRECTORY
Escape, evacuation, and rescue

Acknowledgements
This Report was produced by the IOGP Safety Committee.
Front cover photography used with permission courtesy of ©kali9/iStockphoto
About
This data sheet provides Quantitative Risk Assessment (QRA) data and guidance
for Muster, Evacuation, Escape and Rescue (EER) for all onshore facilities and
offshore installations.
Feedback
IOGP welcomes feedback on our reports: publications@iogp.org
Disclaimer
Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither IOGP nor any of its Members past present
or future warrants its accuracy or will, regardless of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which
liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms
of this disclaimer. The recipient is obliged to inform any subsequent recipient of such terms.
Please note that this publication is provided for informational purposes and adoption of any of its recommendations is at the discretion of the user. Except
as explicitly stated otherwise, this publication must not be considered as a substitute for government policies or decisions or reference to the relevant
legislation relating to information contained in it.
Where the publication contains a statement that it is to be used as an industry standard, IOGP and its Members past, present, and future expressly disclaim all
liability in respect of all claims, losses or damages arising from the use or application of the information contained in this publication in any industrial application.
Any reference to third party names is for appropriate acknowledgement of their ownership and does not constitute a sponsorship or endorsement.
Copyright notice
The contents of these pages are © International Association of Oil & Gas Producers. Permission is given to reproduce this report in whole or in part provided
(i) that the copyright of IOGP and (ii) the sources are acknowledged. All other rights are reserved. Any other use requires the prior written permission of IOGP.
These Terms and Conditions shall be governed by and construed in accordance with the laws of England and Wales. Disputes arising here from shall be
exclusively subject to the jurisdiction of the courts of England and Wales.
REPORT JULY
434-19 2023
RISK ASSESSMENT DATA DIRECTORY
Revision history
VERSION DATE AMENDMENTS
1.0 March 2010 First release
2.0 July 2023 Full revision

Contents
Abbreviations 6
1. Scope and definitions 7

1.1 Scope 7
1.2 Definitions 7
2. Overview of EER process 10

2.1 Introduction 10
2.2 Generic stages of EER 10
2.3 Statutory and operator requirements 13
2.4 Analysis process 13
3. Muster 16
3.1 General guidance on escape routes 16
3.2 Requirement for muster 16
3.3 Availability of escape route to primary muster point 17
3.4 Availability of escape route to secondary muster point 18
3.5 Smoke obscuration 18
3.6 Mustering times 19
3.7 Trapped workers 21
3.8 Guidance on availability of escape routes to muster areas 21
4. Evacuation 22
4.1 Requirement to evacuate 22
4.2 Helicopter evacuation 22
4.3 Lifeboat evacuation 23
4.3.1 Evacuation fatality rates from recorded incidents 29
4.4 Life rafts 30
4.5 Guidance on evacuation analysis 31
4.5.1 Frequency of installation evacuation 31
4.5.2 Probability of evacuation success 31
4.5.3 Lifeboat/life raft evacuation 31
5. Escape to sea 32
4
6. Rescue and recovery 34

6.1 Overview 34
6.2 Recovery fatality rates 34
6.3 Cold water immersion 35
6.4 Rescue fatality rate calculation 38
6.5 Guidance on survival times in water 39
7. EER for onshore sites 40
8. General guidance 41
8.1 Post-PFEER activity in the UK in relation to evacuation, escape and rescue 41
8.2 Improving survival times 41
8.3 Reducing recovery times 41
8.4 Ice bound installations 42
9. Recommended data sources for further information 43
10. References 44
Appendix A: Beaufort Scale 45
Appendix B: Worked Example 46
5
Abbreviations
AEGL Acute Exposure Guideline Level

ARRC Autonomous Rescue and Recovery Craft
CMPT Centre for Marine and Petroleum Technology
DAL Design Accident Load
DC Daughter Craft
DoE (UK) Department of Energy (no longer exists as such)
EPIRB Emergency Position Indicating Radio Beacon
EER Evacuation, Escape and Rescue
ERP Emergency Response Plan
ERRV Emergency Response and Rescue Vessel
ERRVA Emergency Response and Rescue Vessel Association
FRC Fast Rescue Craft
H2S Hydrogen Sulphide
IDLH Immediately Dangerous to Life or Health
IMO International Maritime Organization
IOGP International Association of Oil and Gas Producers
IRT Ice Reinforced Totally Enclosed Motor Propelled Survival Craft
HSE (UK) Health and Safety Executive
MOB Man overboard
OIM Offshore Installation Manager
OREDA Offshore Reliability Data
OSC On-Scene Commander
PFEER Prevention of Fire and Explosion, and Emergency Response
PLB Personal Locator Beacon
POB People on Board
QRA Quantitative Risk Assessment
SAR Search And Rescue
SBV Standby Vessel
TEMPSC Totally Enclosed Motor Propelled Survival Craft
Nederlandse Organisatie voor Toegepast Natuurwetenschappelijk Onderzoek
TNO
(Netherlands Organization for Applied Scientific Research)
TOES TEMPSC Orientation and Evacuation System
TR Temporary Refuge
UKCS United Kingdom Continental Shelf
6
1. Scope and definitions
1.1 Scope
This data sheet provides Quantitative Risk Assessment (QRA) data and guidance for Muster,
Evacuation, Escape and Rescue (EER) for all onshore facilities and offshore installations.
The primary focus of this data sheet will be for offshore installations as this has the
potential to be more significant in personnel risk terms compared to onshore facilities.
However, where appropriate the discussion will be extended to onshore facilities and the
complexity of any assessment should be commensurate with the complexity of the facility.
Total evacuation of an installation is a rare event such that information from past accidents
data is sparse and QRA relies on analysis of potential escalation scenarios and associated
EER activities. This data sheet contains a number of example rulesets and general
guidance for EER analysis. These rule sets detail the principles to be adopted and these
may be further developed in conjunction with installation-specific EER arrangements. Any
data presented are derived mainly from the North Sea. For other areas of the world, the
user should take local legislation and climatic conditions into consideration.
Assuming personnel have survived the initial effects of an accident, personnel EER
from onshore facilities is generally less complex and of inherently lower risk. Qualitative
analysis, geared towards provision of suitable escape routes and appropriate rescue
and medical contingency planning, will often be adequate. Some onshore facilities may
require temporary shelters for protection from toxic gas releases such as H2S. Additional
emergency procedures may also be required for remote onshore facilities such as those in
desert, cold climate and jungle environments.
It is noted that much of the data set out in the following sections has been provided by IOGP
Members as the industry focus has been on making practical improvements in hardware
rather than enhancing the nature and basis of EER analysis. Therefore, this data sheet
should be used as guidance on the type of data required at each stage rather than definitive
values.
1.2 Definitions
There are several international guidelines on the topic of EER and some definitions vary
between them. In this document, the definitions used are consistent with those in the UK
PFEER Regulations [1].
Alarm
Alarm is the process of communicating an unsafe condition and making personnel aware
of an emergency via a warning system that may be audible and, where necessary, visual
including public address systems.
7
Access
Access is the process of personnel leaving their work area and moving away from the
immediate area of the hazardous condition (note that in some of the literature this would be
termed “Escape”. In this document the term Escape is as defined below).
Muster
Muster is the process of assembling personnel in a muster area where it is safe to

assemble allowing time for the emergency to be assessed and for control to be taken.
Generally, a muster area should either be inside a Temporary Refuge (TR) or provide
protection against a foreseeable major incident for a specified endurance period.
Egress
Egress is the process of moving along an egress route from a workplace to muster areas/
TR and from the TR to an evacuation or escape means.
Evacuation
Evacuation is the process of leaving an installation and its vicinity, in an emergency, in a

systematic manner and without directly entering the sea. Successful evacuation will result
in persons being transferred to a place of safety, by which is meant a safe onshore location,
or a safe offshore location or marine vessel with suitable facilities.
Means of evacuation may include helicopters, bridge transfer and lifeboats1. In some
locations, davit-launched life rafts may also be considered as a means of evacuation where
there is insufficient provision of lifeboats to evacuate all personnel. In multi-platform
installations connected by bridges it may be considered that, provided the separation of the
platforms is sufficiently great, a worker crossing to a platform other than the one on which
the incident occurred may be considered to have evacuated.
Escape (to sea)
Escape to sea is the process of leaving the installation in an emergency when the
evacuation system is not accessible or has failed; it may involve entering the sea directly
and is the ‘last resort’ method of getting personnel off the installation.
Means of escape cover items which assist with descent to the sea, such as chute systems,
ladders and individually controlled descent devices (e.g., donuts); and items which
personnel can board on reaching the sea such as throw-over life rafts. Scramble nets and
knotted ropes may also be considered as means of escape but are less desirable since they
require a degree of strength and dexterity and are therefore not controlled descent devices.
If no other means of escape are available, workers may have to jump into the sea from
height.
1
In some regions, including the North Sea, it is expected that all lifeboats will be Totally Enclosed Motor Propelled Survival Craft
(TEMPSC) but in other parts of the world lifeboats may be open. Available data of lifeboat failure rates tend to refer to TEMPSC.
In this document reference will be made to “lifeboat” to include all types.
8
Impairment
Condition under which a piece of equipment, shelter or escape route is no longer able
to perform as required. This does not necessarily mean that persons using that facility
become fatalities.
Rescue/recovery
This is normally addressed as ‘Recovery and Rescue’ and is the process of recovering
persons following their evacuation or escape from the installation and rescuing of persons
near the installation (such as a person who has fallen overboard) and taking such persons
to a place of safety. The recovery and rescue arrangements are:
• Facilities and services external to the installation, such as vessels, public sector and
commercially provided search and rescue facilities
• Facilities on the installation such as installation-based fast rescue craft
Place of safety
This is an onshore or safe offshore location or vessel where medical treatment and other
facilities for the care of survivors are available.
The means of evacuation/escape are generally categorized as primary, secondary or

tertiary.
Primary means of evacuation include:

• Helicopters
• Bridge links to vessels, e.g., compensated walk-to-work walkways or flotels which
can disengage from the installation, or supply vessel stationed at the boat landing,
which are considered places of safety
Secondary means of evacuation include:

• Enclosed lifeboats (TEMPSC)
• Open lifeboats
• Davit launched Life rafts as part of a controlled evacuation strategy.
Tertiary means are all other equipment which enable a worker to reach the sea, including:
• Life rafts2
• Skyscapes
• Descent devices
• Ladders
• Ropes
• Nets
• Jumping
2
Liferafts may be launched with workers already onboard. More usually they are launched unmanned and workers use other means to
board them in the sea.
9
2. Overview of EER process
2.1 Introduction
All EER activities expose personnel to an element of risk. However, three broad classes of
EER can be distinguished:
• Routine Practice. These might be organized throughout the year at an installation to
rehearse the procedures and use of the EER equipment. The timing and conditions
of such activities can, to a large extent, be controlled so that personnel are not put
at unnecessary risk. The risks stemming from routine practice are not typically
documented as part of a QRA. The risks are recognized, and measures put in place
to control these risks such as the guidance provided in [2]. Fatalities arising from
practice drills would be covered in a risk assessment as occupational risks.
• Precautionary. These might occur in the event of a drilling kick, an un-ignited
gas leak, a drifting ship nearby, a minor structural failure, threatening platform
movements in rough seas or an event on a bridge-linked platform”. Such an activity
is not usually done under great pressure and typically using helicopters rather than
lifeboats. Historically there have been few fatalities in such events.
• Emergency. These might occur in the event of an ignited blowout, leak from process
equipment, an imminent collision or a structural collapse. Such activities are usually
performed with urgency and, historically, are more likely to result in fatalities.
In developing predictions about the frequency of EER activities for a given installation,
influences will include, for instance, local environmental factors, the nature and extent of
processing facilities, and the intrinsic hazards of the process.
A multitude of variables can influence the outcome success of offshore EER activities. The
weather is an important factor and should an emergency evacuation be necessary during
severe conditions, the risks of the EER activities are greater.
As each installation has its own unique characteristics, it is necessary to model the
EER operation to give some basis for EER effectiveness. Assessment of EER provision is
mostly undertaken by establishing whether the measures put in place comply with the
requirements of the regulator and/or company specific guidance. In addition, a quantitative
study may assign failure and fatality rates to the various stages of the process to establish
the risk contribution to workers.
2.2 Generic stages of EER

Figure 2-1 provides a basic flowchart for the key stages of offshore emergency response as
defined by the HSE [3]. Table 2-1 provides a list of descriptions and possible failure modes
for use within the EER analysis at each of these stages. Emergency response may include
evacuation, escape or a mix of both.
The stages of an EER are complex and need to be considered with care during a risk
assessment. The stages shown in Table 2-1 should be tailored for the particular installation
10
and its potential major accident scenarios. It should be recognized that different failure
modes will carry different levels of risk for participants.
Figure 2-1: Basic EER Stages
Table 2-1: Generic Stages of EER
Stage Description Possible problems
Alarm Detection system warns of an unsafe • Detection fails

condition. Control room operator decides • Delay (any cause)
that there is an emergency and starts
• Operator error
emergency procedure. Using the public
address system, personnel are told that • Visual/Audible Alarm fails
there is an emergency. • Public Address System fails
• Public Address System not heard
Access Personnel become aware that they should • Personnel do not hear alarms and do not notice the
leave their work area. They move out of the hazard condition
immediate area. • Hazard condition incapacitates personnel before they
can leave the area
• Personal Protective Equipment (e.g., smoke hoods)
unavailable
• Escape routes blocked due to hazard or other causes
• Personnel ignore procedures and do not escape
• Escape routes not understood by personnel
11
Stage Description Possible problems
Muster Personnel assemble in a designated muster/ •M

uster area not tolerable due to accident effects, e.g.,
refuge area. smoke, heat
• Lack of order within muster/ refuge area
Egress Personnel move to the helideck or to • Egress routes affected by the hazard
lifeboat/or life raft boarding areas to await • Helicopters unavailable
controlled embarkation
• Lack of control
• Personal Protective Equipment (e.g., smoke hoods)
unavailable
Evacuation Personnel leave the installation using the • Failure in the organization or in the judgment of leaders
primary and preferred means, helicopter, or • Uncontrolled situation resulting in early departure,
using the primary mainstay means, lifeboats leaving others
or davit-launched life rafts. Alternative
• Insufficient capacity due to evacuation means out of
evacuation means may include crane or
service
gondola systems for lowering personnel to
attendant vessels or crossing to a bridge- • Evacuation/transfer means unavailable (wholly or
linked platform. partially) due to adverse weather conditions or damage
by fire or explosion
• Failure during transfer/launch process
• Personnel injured while awaiting order to evacuate
Escape Personnel leave the installation by controlled • Access to controlled descent provisions hampered
descent provisions, ladders, stairs, chutes, • Hazard effects, e.g., proximity to ongoing fires
personal descenders, throw-over life rafts, or
• Debris in the water
uncontrollably by jumping.
• Descent devices do not work
• Operation of descent devices not understood
Rescue Personnel in the water or in life rafts • Adverse weather/visibility

await external parties (air and marine) to • Inadequate external support
provide rescue. Those in the water are the
• Unavailable, inappropriate or damaged personal
first priority, next life raft then lifeboats
protective equipment (lifejacket, survival suit, etc).
occupants.
• Personnel injury
• Those in water affected by cold
• Those in water affected by heat or other effects of an
incident
• Possible shark attack in tropical waters
Recovery Various scenarios including; • Adverse weather

• Helicopter shuttles evacuees to base/ship/ • Lack of control on lifeboat disembarkation
nearby platform. • Accident during pick-up
• Lifeboat transfers evacuees to helicopter • Rescue vehicle suffers accident
or ship then on to a place of safety.
• Ineffective support facilities on recovery vessel
• Lifeboat reaches shore or another
platform.
• Pick-up from life raft and transfer to a
place of safety.
• Those immersed rescued from water and
transferred to a place of safety.
The decision to evacuate the installation is made by a designated On-Scene Commander

(OSC), typically the Offshore Installation Manager (OIM). Emergency Response Teams
advise the OIM of the severity of the incident. In most cases, the OIM would stand-by and
wait for the response teams to control the incident and return the installation to normal
operations. Depending on the severity of the event, the installation layout, the weather
conditions, and the response teams’ capabilities, the OIM may choose to:
12
• Remain on the installation until the incident is over. This may be adopted for small
incidents (e.g., false alarms, minor oil leaks etc.), but these are not usually modelled
in a QRA. It may also be adopted for major incidents of short duration (e.g., a large
isolated process release) when it is considered that impairment of the Temporary
Refuge is unlikely and that remaining there is a safer option than evacuation or escape.
• Evacuate non-essential personnel only as a precaution during incidents such as
imminent severe weather or a drifting vessel in the vicinity. A fire-party or other
essential crew would be left on the installation. These precautionary evacuations
could be modelled as extra transportation risk but are often not modelled in a QRA as
they have a very low risk of fatality.
• Evacuate all personnel.
2.3 Statutory and operator requirements

The provision of escape routes, mustering points and means of leaving the installation is
typically dictated by regulatory bodies who set out minimum requirements. In the UKCS
the requirements are provided in the Prevention of Fires and Explosions, and Emergency
Response Regulations (PFEER) [1]. Operators may include further requirements as part of
their design and operation standards. Further guidance is provided by certifying bodies.
2.4 Analysis process

The overall process is shown in Figure 2-2 in the form of a flow diagram which can be
applied to each individual who survives the immediate effects of the accident. Table 2-2 list
the various Event Stages which have Yes/No probabilities together with the other nodes.
Table 2-2: Event stage description
Event Stage No. Location of Status of Individual at Start of Event

Node Description
or Node Individual Stage or Node
Event Stage 1 Muster required Initial Location Trying to Muster
Survive#1 Safe in initial location Initial Location Survived in Initial Location
Event Stage 2 Escape route to primary muster point available Initial Location Trying to Muster
Event Stage 3 Escape route to secondary muster point available Initial Location Trying to Muster
Trapped Under Trapped on

Trapped on installation Trapped
Threat Installation
Trapped on
Event Stage 4 Escape required Trying to Escape
Installation
Trapped on
Event Stage 5 Attempt escape Trying to Escape
Installation
Event Stage 6 Killed by hazardous event Escaping Trying to Escape
Trapped on
Survive#2 Survived in trapped location Survived in Trapped Location
Installation
Trapped on
Fatality#1 Fatality Fatality While Attempting Escape
Installation
13
Event Stage No. Location of Status of Individual at Start of Event

Node Description
or Node Individual Stage or Node
Mustered Mustered at primary or secondary muster point At Muster Point Mustered
Event Stage 7 Evacuation required At Muster Point Mustered
Survive#3 Safe in muster location At Muster Point Survived in Muster Area
Event Stage 8 Evacuation by primary means available At Muster Point Mustered
Mustered/Lifeboat
Event Stage 9 Lifeboat available and not failing pre-launch Mustered
Embarkation Area
Event Stage 10 Lifeboat fails during launch Lifeboat Launching Trying to Evacuate in Lifeboat
In Lifeboat In lifeboat at sea In Lifeboat at Sea Awaiting Recovery
Event Stage 11 Survive lifeboat launch failure Lifeboat Launching Trying to Evacuate in Lifeboat
Fatality While Attempting Lifeboat

Fatality#2 Fatality In Failed Lifeboat
Evacuation
Mustered/Life raft
Event Stage 12 Life rafts available and not failing pre-launch Mustered
Embarkation Area
Event Stage 13 Life raft fails during launch Life raft Launching Trying to Evacuate in Life raft
Event Stage 14 Successfully leave installation by tertiary means Attempting Escape Trying to Escape by Tertiary Means
Fatality#3 Fatality Attempting Escape Fatality in Tertiary Means Escape
Boarding Life
In water In Water Trying to Board Life raft
raft
Event Stage 15 Successfully board life raft In Water Trying to Board Life raft
In Life raft In life raft at sea In Life raft at Sea Awaiting Recovery
In Sea In water In Water Awaiting Recovery
Event Stage 16 Life raft fails in sea In Life raft at Sea Awaiting Recovery
Event Stage 17 Recovered from lifeboat and returned to shore In Lifeboat at Sea Awaiting Recovery
Fatality#4 Fatality In Lifeboat at Sea Fatality in Lifeboat
Event Stage 18 Recovered from life raft and returned to shore In Life raft at Sea Awaiting Recovery
Fatality#5 Fatality In Life raft at Sea Fatality in Life raft
Event Stage 19 Recovered from water and returned to shore In Water Awaiting Recovery
Fatality#6 Fatality In Water Fatality in Water
Survive#4 Safe in place of safety Place of Safety Survived - Place of Safety
Workers who are killed before mustering are considered to be immediate fatalities due to the effects
of the initial incident and are not accounted for in this process. It does, however, take account of
fatalities among workers who are trapped and killed by the effects of the incident rather than the
EER process. The diagram has various termination points which either indicate fatality or survival.
Guidance on evaluating the probability of the alternative options at each of the numbered Event
Stages are given in the following sections.
For some installations the flow diagram could be simplified by combining or eliminating Event
Stages, e.g., where there are no lifeboats.
14
Figure 2-2: EER analysis flow diagram

3. Muster
Note that in this section the term “Escape Route” is used to indicate the route taken while
moving to the muster area or TR. Using the definition given in Section 1.2 this would
more appropriately be termed “Muster Route” to distinguish between this phase and the
“Escape” phase. The term is used here because of its common use within industry.
3.1 General guidance on escape routes

Guidance of the provision of escape routes is available in regulatory legislation and in other
standards such as [4] which includes the following clauses:
• “Safe, direct and unobstructed exits, access, and escape routes shall be provided
from all regularly manned areas of the mobile unit or offshore installation to
Temporary Refuge, muster areas and embarkation or evacuation points.”
• “All regularly manned areas shall be provided with at least two exits and escape
routes, separated as widely as practicable such that at least one exit and the
connected escape route will be passable during an accidental event. Escape routes
shall normally be provided on both sides of the mobile unit or offshore installation.”
• “Dead ends greater than 7 m in length shall be avoided.”
• “Escape routes shall be of suitable size to enable quick and efficient movement
of the maximum number of personnel who may require using them, and for easy
manoeuvring of fire-fighting equipment and use of stretchers.”
• “Any necessary changes in elevation along escape routes shall be by stairs. Ladders
may only be accepted where it is clearly not practicable to install stairs, and only for
use by a very limited number of personnel in an emergency.”
• “All escape route doors shall be readily operable in the main direction of escape and
shall not be a hazard to personnel using the escape route outside. Doors from cabins
and small offices are excluded from this requirement.”
• “The surfaces of decks, walkways, platforms, stairs and ladder rungs etc. shall be
non-slip, and designed for drainage and easy cleaning of contaminants like mud and
oil, where relevant.”
3.2 Requirement for muster

The requirement to muster (Event Stage 1) is dependent on the assessment of the severity
of the incident. This assessment will normally be carried out by operators in the control
room who will attempt to communicate this to the workforce. It may also be taken by
workers in the vicinity of the incident who elect to move towards the muster area before
an instruction is received. The incident may be sufficiently minor, e.g., a small leak from
a diesel tank, that a general alarm does not need to be raised. However, for the types
of incident addressed in a QRA it can be assumed that normal work will cease and that
all workers who are not already at a muster point will move towards one. Hence, the
probability of the “Yes” branch at Event Stage 1 can be taken as 1.
16
3.3 Availability of escape route to primary muster point

In most cases, a decision to muster in the primary muster point will apply to all workers
on the installation. However, there may be some locations on the installation from which
mustering to the primary muster point is not advisable since doing so may expose workers
in those locations to greater risk. An example of this would be for workers on a platform
in a bridge linked installation where the incident is on the platform where the primary
muster point is located. The installation’s emergency operating procedures may dictate
that such workers should move to a secondary muster point on that platform or one further
away from the incident. Note that this may be the case even if the escape route to the
primary muster point is not impaired by the incident. For example, if the incident is a small
unignited gas leak which is insufficient to impair the escape route, it may nevertheless be
unwise to use that route while there is a risk the leak may ignite.
The availability of escape routes, including those across bridge-links, to muster areas is
dependent on the level of overpressure damage, heat radiation levels, smoke and toxic gas
concentrations. From the Vulnerability of Humans data sheet [5] and the UK HSE [6], it is
recommended that escape routes should be considered impaired if thermal radiation is
above 6 kW/m2 and workers have protective clothing or above 5 kW/m2 for workers who do
not. An escape route may also be considered to be impaired if the thermal dose acquired by
traversing the route exceed 290 TDU as given in [7].
Routes where smoke obscuration reduces the visibility to less than 10 m should also be
considered impaired. From CMPT [8], escape routes may be made permanently impassable
by an explosion overpressure above 0.35 bar. It is noted that many companies provide
escape packs with smoke hoods, although little credit is adopted for using smoke hoods
for the access (immediate escape) stage as they are typically located in accommodation
areas for use in aiding helicopter or lifeboat boarding. Even when they are available, it is
conventional not to take credit for them since personnel may not don them correctly under
stress.
The likelihood of an escape route to the primary muster point being available (Event Stage
2) is dependent on the physical effects of the incident along that route and the location of
the starting point as well as the availability of alternate routes. For a given incident it may
also be dependent on the size of the release, the orientation and the wind direction. An
example matrix is shown in Table 3 1 which relates to the simplified arrangement shown in
Figure 3 1 with a release occurring in Area 2. Workers in Area 1 have unobstructed routes
to the muster location. Workers in Area 2 may have their route to the muster point impaired
depending on the size and direction of the release. In these cases they may prefer to move
to Area 4. Workers in Area 3 are likely to all route out of the module impaired. However, in
this example, depending on the size and direction of the release, they may be able to move
to area 4. Escape routes for workers in Area 4, a bridge linked platform, would remain
where they are as routes to the muster would require them to go onto the event platform.
17
Figure 3-1: Example layout of installation areas
Table 3-1: Example matrix for escape route availability
Unignited Release Ignited Release

Start
Location Very Very
Small Medium Large Small Medium Large
Large Large
Area 1 0 0 0 0 0 0 0 0
Area 2 0 0 0 0.2 0 0 0.1 0.5
Area 3 0 0.1 0.2 0.5 0 0.5 1 1
Area 4 1 1 1 1 1 1 1 1
A simple analysis may assume that survivors of the initial event will be able to muster if
there is at least one escape route available, i.e. availability is 1. If all escape routes are
unavailable a value of zero is applied.
3.4 Availability of escape route to secondary muster point

Where the escape route to the primary muster point is not available workers will normally
try to access a secondary muster point which has been designated and equipped for this
eventuality. There may be more than one secondary muster point, particularly on multi-
platform installations.
The likelihood of an escape route to the secondary muster point is available (Event Stage 3)
is similar to that for the primary muster point. However, it would have to be impaired by the
physical effects of the release itself as it is the only remaining alternative for sheltering.
3.5 Smoke obscuration

A visibility of 4-5 m is considered to be about the threshold of diminished performance
and is the smoke level that should be considered in smoke ventilation system design. It
is suggested that there should be a minimum of 3 m vision for escape from a primary
compartment and at least 10 m for an escape route.
18
Important factors to consider in a risk analysis with regard to obscuration of vision (and
time to escape) are:
• Smoke concentration
• Arrangements of escape ways (layout, sign, illumination, railing, etc.)
• Training of personnel
• Familiarity with the installation
Where an escape way is well laid out and provided with high visibility marking or escape
lighting (including effective provision of torches/light-sticks), then the 3 m criterion may be
applied.
Alternatively, impairment of escape ways or the TR can be considered to occur when the
particulate concentration exceeds that giving a visibility reduction of 1 dB/m.
3.6 Mustering times

The time to muster may be required to estimate the numbers of workers in each area of
an installation as time progresses. Bercha et al. [9] present details of an analysis for a
typical installation including estimated times for workers to react to an emergency, speed
of movement and the time taken to complete other stages of the evacuation process. These
values, relating to offshore installations, are presented in Table 3-2 and Table 3-3. Values
for onshore sites may be different, e.g., 2.5 m/sec for horizontal travel on an escape route.
This data may also be useful in estimating fatality rates for workers exposed to varying
radiation levels or toxic gas concentrations as they leave their work location and move
along escape routes. Where breathing apparatus is worn, there will be additional time
required to don this and travel speeds may be reduced by 20% - 25%.
Table 3-2: Typical reaction times following an alarm being raised
Personnel or Issue Delay (secs) Comment
Personnel in Process Modules 90 Time to make workplace safe
Personnel in Workshops 60 Time to make workplace safe
Drill Crew 180 Time to make workplace safe
Crane Driver 130 Assume suspended load to be lowered
Catering/laundry staff 30 Reaction time
Personnel sleeping 150 Time to wake and dress
All other personnel 10 Recognition of alarm
Bottleneck 10 Time to open door
The time taken for the alarm to be raised will depend on the magnitude of the release.
Small releases on offshore installations may up to 2 minutes to be detected and validated.
For onshore sites this may take up to 20 minutes.
19
Table 3-3: Typical travel speeds
Method/Impairment Average Speed (m/sec)
External or Internal Walkway 1.0
Congested internal walkway (15-20 people) 0.6
Stairway 0.6
Debris impaired stairway 0.1
In Smoke (0% – 2.3%) 0.7
In Smoke (2.3% – 15%) 0.4
In Smoke (> 15%) 0.2
Ladder 0.2
Under great stress/panic 0.6
When assessing existing assets, it may be appropriate to validate with data collected from
muster drills on the time taken to achieve muster for workers starting in different locations.
The TNO Green Book [10] provides a method for calculating the equivalent exposure time based
on the initial incident radiation. This takes account of the reduction in radiation as a worker
moves to a “safe” location. A “safe” location is one that sees radiation of less than 1 kW/m2.
Where
teff is the effective exposure duration
tr is the reaction time
tv,eff is the effective exposure duration during escape
tv is the escape time, tv = (xs -xo)/u
xo is the distance from the centre of the fire
xs is the distance from the centre of the fire to a safe location, and
u is the speed of escape
The dose received is dependent on the reaction time and the speed of travel. Typical values
for these are given in Table 3-2 and Table 3-3 where, for example, the reaction time for a
worker in a process area is given as 90 seconds. This is in response to a general alarm
which could be related to an incident elsewhere on the platform; if the event is a jet fire
within the same vicinity, awareness and reaction time would be shorter. The average speed
moving along an internal or external gangway is given as 1 m/s.
As an example, consider a worker who is 5 metres away from the centre of the fire and
experiences a radiation level of 35 kW/m2. If they react in 10 seconds and move at 1 m/s
to reach a location 100 metres from the centre of the fire where the radiation level has
reduced to 1 kW/m2, then
20
Escape time, tv = (100-5)/1= 95 seconds
Effective time during escape
Which gives an effective exposure duration to 35 kW/m2 of tr + tv,eff = 12.5 seconds. Although
it takes the worker 105 seconds to reach the safe zone, the effective exposure duration is
only 12.5 seconds because the radiation level reduces with distance from the fire.
Muster drills conducted by an IOGP member for incident scenarios not involving major
incidents or injuries suggest that typical times required to complete muster for medium to
large sized platforms are in the range 5 - 8 minutes.
3.7 Trapped workers

Some workers may be unable to reach the primary muster point or any designated
secondary muster point. They may be in a location where they can survive the effects of the
incident until it is brought under control. However, if they feel threatened by the incident
they may elect to attempt to escape to sea. The probability of the incident requiring an
escape to sea will be dependent on the level of radiation, smoke or toxic gas at the trapped
location (Event Stage 4) which can be assessed from the consequence modelling in a QRA.
The probability of the worker attempting an escape will be dependent on the availability
of the escape points and the risk involved in reaching one (Event Stage 5). However, it is
expected that since the level of danger in their trapped location is high, it is likely that they
will attempt an escape. Therefore conservatively a fatality rate of 1 should be adopted for
Event Stage 6, unless there is a specific assessment which justifies the selection of a less
conservative value (there should be a documented demonstration that under the hazardous
event, there is a certain survival probability for people).If no attempt is made the worker
may become a fatality in the trapped location (Event Stage 6). Again, the probability is high
and a fatality rate of 0.8 is suggested in the absence of a more specific assessment.
3.8 Guidance on availability of escape routes to muster areas

The criteria shown in this section are samples of rule sets that can be used to evaluate the
number of fatalities to personnel trapped over an extended period due to effects from an
explosion or fire of long duration. The criteria may be considered conservative when escape
is possible within a few minutes after the start of a fire. Rule sets should be developed
which are specific to the circumstances.
The Vulnerability of Humans data sheet provides data on levels of overpressure, radiation or
exposure to toxic gas which could result in fatalities as opposed making routes impassable.
21
4. Evacuation
4.1 Requirement to evacuate

The muster points (typically Temporary Refuges) are selected/designed to ensure protection
to identified hazards such that the need to evacuate the installation is low. The decision to
evacuate will typically be determined by an assessment of how the incident is developing or
receding and whether the muster point is likely to lose its integrity. The value for this (Event
Stage 7) will normally be determined within a QRA as part of the consequence modelling
and will be specific to the scenario.
The decision to evacuate is associated with the muster point being impaired or shortly
becoming impaired. Criteria for impairment include the following and in some cases may
result in fatalities.
• The overpressure exceeding the design capacity.
• The flame impingement time of the boundaries or structural supports exceeding the
fire resistance time.
• The gas concentration exceeding 60% of LFL.
• Combined effect of smoke/heat dose components exceeds unity as described in 434-14.
• Toxic dose exceeds AEGL2 levels.
For a given accident scenario the probability of impairment is the combined effect of these.
4.2 Helicopter evacuation

Use of helicopter to evacuate (Event Stage 8) is only possible in situations where both
helicopter(s) and helideck are available. Many potential major accident scenarios would
make it very dangerous to use helicopter transportation as heat, smoke and flames from
fires tend to propagate upwards and may impair a helideck. Helicopter evacuation is more
often used for performing precautionary evacuations.
Any evaluation of helicopter options must include an assessment of:

• The time scale of the incident.
• The possible timing of the incident in relation to the availability of helicopters and
crew (i.e., day or night).
• The defined evacuation plan i.e., to shore, ships, or other installations.
• The possible problems in the access, mustering, and loading process.
It would be appropriate for a QRA to neglect the possibility of helicopter evacuations for
loss of containment events.
22
4.3 Lifeboat evacuation

If evacuation by helicopter is not possible, evacuation from an offshore installation will
normally be attempted by lifeboat. The UK HSE have carried out an overview of TEMPSC
performance standards [11]. The critical features affecting the risks of evacuation by
lifeboat are:
Pre-launch (Event Stage 9)

• Potential for embarkation areas to be impaired by explosion, radiation or smoke.
• Availability of lifeboats for launch, given the consequences of the event necessitating
evacuation.
• The number and capacity of lifeboats available.
• Time required to load and launch the lifeboat(s) compared to the time for the event to
escalate.
Post-launch (Event Stage 10)

• The risk of an unsuccessful launch in the prevailing weather conditions.
• The risk of an accident during recovery of personnel to a place of safety.
The level of radiation required to impair the embarkation area is dependent on the
duration of exposure and the level of smoke obscuration which would prevent boarding
the lifeboat. In the absence of more detailed installation specific studies, the following are
recommended values for considering an embarkation area to be impaired:
Overpressure > 0.353 barg
Radiation > 4 kW/m2
Visibility4 < 3 metres visibility
Toxic Gas > IDLH concentration5
It is generally considered that the endurance time for the embarkation area and lifeboat
should be at least as long as that required for the Primary Muster Station.
Where the embarkation area is also used as a muster point the time spent in the area is
likely to be longer and the impairment criteria for radiation and toxic gas should be reduced
accordingly such that an equivalent dose is obtained. In the absence of a detailed study the
AEGL 2 concentration for an appropriate time should be applied. For example, the AEGL 2
level for 10 minutes to H2S is 41 ppm [12].
Where AEGL values aren’t available for a given gas, e.g., carbon dioxide, a toxicologist
should be consulted. For carbon dioxide a concentration of 5% (50,000 ppm) may be used
in the absence of a more detailed study. Information on the effects of carbon dioxide are
available in [13] and [14].
The anaesthetic effect of hydrocarbon vapours may also need to be considered.
3
The lifeboat itself may be damaged at lower levels of overpressure. Ideally, information should be obtained from the manufacturer
4
Visibility may be affected by smoke or clouds of condensed vapour
5
The most likely toxic gas is hydrogen sulphide for which the IDLH is 100 ppm
23
In cases where the primary muster area is impaired it is likely that an alternative area will
be used for muster even if remote from the embarkation area.
Many companies will use these criteria in conjunction with a design accident load (DAL)
as a threshold for providing protection to equipment and critical structures. For fires and
explosions, a design accident load or return frequency of one in ten thousand years (10-4
per year) is often used for structural elements such as walls and floors and this may also
be applied to escape equipment which are likely to be required when the primary muster
point has been impaired. DNV’s guidance on Safety Principles and Arrangements [4] states
that accidental loads affecting safety functions should have an individual (per load type)
frequency of occurrence not exceeding a value the order of 10-4 per year. This will normally
correspond to an overall frequency of 5 x 10-4 per year as the impairment frequency limit.
This is consistent with Norsok Standard Z-013 [15]. OEUK (formerly OGUK) guidance [16]
states that since lifeboats need to survive more serious events that could lead to major
structural failure, “A maximum tolerable frequency of failure may need to be as low as once
in 100,000 years”, i.e., 10-5 per year. Individual operators or other regulatory bodies may
specify other acceptance criteria.
The probability of successful lifeboat evacuation is strongly influenced by the facility

layout and weather conditions. Therefore, installation designers and facility operators
will generally ensure there are sufficient clearance distances between lifeboat and
structures to minimize the potential of the lifeboat to be swept back towards the facility
once released. For davit-launched lifeboats, where possible, this may be by ensuring they
are perpendicular/end-on mount to reduce the wind loading on descent which could cause
platform collisions. This also provides the ability to drive more quickly away (without a
need to turn) when seaborne reducing the swept back collision potential (see Table 4-1 for
example). These relate to Event Stage 10.
Table 4-1: Effect of Clearance on Davit-Launched Lifeboats, [8]
Clearance from Structure Fatality Probability
0 to 3 m 0.135
3 to 5 m 0.062
5 to 7 m 0.034
7 to 10 m 0.029
> 10 m 0.021
Typical probabilities of successful lifeboat evacuation are provided in the tables below and
relate to Event Stages 9 and 10. These are taken from simulation studies, model tests and
full-scale trials and depend on weather conditions as well as lifeboat type. The design of
a lifeboat to withstand physical effects due to an incident can also affect the success of an
evacuation.
The values in the following tables are not necessarily compatible and where there is a
conflict it is suggested that the data in Table 4-2 is used.
24
Table 4-2: Failure Probabilities for Different Lifeboat Concepts, [8]
Failure Mode Davit-Launched6 Slide-Launched7 Vertical Drop8
Under repair 0.005 0.005 0.005
Lifeboat Cannot be Engine fails to start 0.025 0.025 0.025

Used Failure to start lowering 0.005 0.015 0.015
Lifeboat Cannot be Used - Overall 0.0347 0.0444 0.0444
Failure during descent Lowering fails 0.005
Excessive slamming on entry to

0.001 0.050 0.010
water
Failure to release fall wire 0.030 N/A N/A

Failure on Entering
Release above wave trough 0.010 N/A N/A
Water
Breakage of one fall wire 0.010 N/A N/A
Failure on Entering Water -

0.0503 0.0500 0.0100
Overall
Collision, wave impact See Table 4 1 0.020 0.015
Collision, operational delay See Table 4 1 0.040 0.030

Failure in Sea
Manoeuvring error 0.050 0.020 0.020
Failure in Sea - Overall 0.231 0.078 0.064
Overall Failure Probability 0.298 0.163 0.114
Some values in Table 4-2 could be adjusted if actual test data for a specific installation is
available. This would be particularly applicable to failure modes in the “cannot be used
category”. The consequences of failure are dependent on the stage at which the failure
occurs. The following distributions are based on consensus judgement by IOGP Members
(Event Stage 11):
• Lifeboat cannot be used: Workers have to use an alternative lifeboat or resort to a
means of escape.
• Failure during descent: 50% of occupant are fatalities, 25% are injured in the water,
25% are uninjured in the water.
• Failure on entering water: 25% of occupant are fatalities, 25% are injured in the water,
50% are uninjured in the water.
• Failure in Sea: Depends on whether lifeboat drifts away from the installation or back
towards it. In general, assume 25% fatalities and 75% survive in unpowered lifeboats.
Other sources of information provide failure probabilities for TEMPSC evacuation for
different weather states as shown in Table 4-3 and Table 4-4.
25
Table 4-3: Failure Probabilities for TEMPSC Evacuation
Wind Force (Beaufort Scale)

Source
Calm Moderate Severe Extreme Averaged
Bercha, [8] 0.1232 0.2108 0.5510 0.9074 0.2239
HSE, non-TOES 0.12 0.40 0.64 0.78 0.37

[17]
HSE, TOES [17] 0.02 0.03 0.19 0.30 0.05
Table 4-4: Failure Probabilities for TEMPSC Evacuation [8]
Weather Category Beaufort Number Davit Launched Freefall
Calm 0-3 0.2 0.05
Moderate 4-6 0.4 0.10
Gale 7-9 0.9 0.25
Storm >9 0.95 0.6
The analysis should also take into account reserve capacity of lifeboats and their locations
on the installations. There will normally be a regulatory requirement for lifeboat capacity
to be at least equal to 150% of the maximum POB and/or for there to be sufficient capacity
remaining if one lifeboat is unavailable.
HSE guidance on the structural design basis for TEMPSC [17] gives failure probabilities for
a specific single fall TEMPSC type. These are replicated in Table 4-5. These values may be
higher than for a twin fall or freefall lifeboat given the additional difficulty in handling.
Table 4-5: Failure Probabilities for the Launch of a 50-man Whittaker Capsule [17]
Stage Mode
Weighted
Calm Moderate Severe Extreme
Average
Weather
0.237 0.610 0.148 0.012
Probability
Engine cannot
0.000 0.005 0.010 0.010 0.0046
be started
Seawater
Craft 0.000 0.000 0.000 0.000 0.0000
cocks jammed
Preparing for
Launch Damage to
craft/launch 0.000 0.000 0.002 0.002 0.0003
mechanism
Stage Total 0.000 0.005 0.012 0.012 0.0049
Descent
before loading 0.002 0.002 0.002 0.002 0.0020
complete
Embarkation
Craft access
0.002 0.002 0.002 0.002 0.0020
blocked
Stage Total 0.004 0.004 0.004 0.004 0.0040
26
Stage Mode
Weighted
Average
Cable jammed
on sheaves/ 0.002 0.002 0.002 0.002 0.0020
tube
Release pin
0.002 0.002 0.002 0.002 0.0020
jammed
Craft Descent
Brakes
begins
jammed by 0.002 0.002 0.002 0.002 0.0020
obstruction
Falls drum
0.0004 0.0004 0.0004 0.0004 0.0004
obstructed
Stage Total 0.0064 0.0064 0.0064 0.0064 0.0064
Launch
mechanism 0.0004 0.0004 0.0004 0.0004 0.0004
hit by debris
Release hook
0.003 0.003 0.015 0.015 0.0048
opened
Winch/brake
mechanism 0.002 0.002 0.002 0.002 0.0020
seized
Craft
Winch fails
descends to
to control 0.0004 0.0004 0.0004 0.0004 0.0004
near Sea Level
descent
Craft hits
structure due 0.000 0.000 0.000 0.000 0.0000
to wind
Fall wire/
attachments 0.002 0.002 0.002 0.002 0.0020
break
Stage Total 0.0078 0.0078 0.0197 0.0197 0.0096
Wave impact
0.000 0.000 0.050 0.100 0.0079
damages craft
Descent
Falls wire not
Completed 0.002 0.002 0.002 0.002 0.0020
long enough
Stage Total 0.0020 0.0020 0.0519 0.1018 0.0099
Failure of
Failure of
rachet, lock, 0.0004 0.015 0.14 0.14 0.0307
release gear
etc.
27
Stage Mode
Weighted
Average
Hits structure
– coxswain 0.100 0.200 0.300 0.400 0.1921
error
Hits structure
0.000 0.2182 0.3054 0.440 0.1805
– wind/waves
Departure Craft capsizes 0.000 0.000 0.05 0.100 0.0079

From Platform Hits Structure
0.000 0.000 0.000 0.000 0.0000
- tide
Propeller/
drive shaft 0.002 0.002 0.002 0.002 0.0020
fails
Stage Total 0.0004 0.015 0.140 0.140 0.0307
Overall Failure Rate9 0.120 0.400 0.640 0.777 0.3713
The phases involved in the launch of a TEMPSC and the typical times to complete these are
given in Table 4-6 and Table 4-7.
Table 4-6: Typical Times and Failure Modes for Evacuation of a North Sea Installation by
40-person TEMPSC
Action (with Indicative Duration) Possible Problems
Muster
Go to stations
Effects of incident. Escape ways blocked or unusable. Alarm ignored or not
Head Count
observed by personnel. Problems of command.
Order to abandon
(5 to 15 mins)
Prepare to launch Muster area exposed to heat or smoke. Craft damaged by effects of incident.
(3 to 5 mins) Engine defect. Gear stuck. Sea cocks jammed. Craft damaged.
Embark
Personnel injured. Premature descent. Access blocked. Other delays.
(3 to 10 mins)
Start to lower
Descend under control to near Release/cable/brakes jammed, craft hooked up on gear and various other
sea level mechanical defects. Craft hits structure due to wind. Premature release of craft
Final descent to sea from falls. Release fails. Craft damaged by effects of the incident (heat, fire, blast,
Release fire on sea).
(1 min)
Steer into structure. Blown back into structure. Tides carries craft into structure.
Move away from installation
Mechanical failures. No pickup means.
Craft not located. Craft sinks or capsizes before recovery. Injured person die
Stay intact while awaiting pickup
before recovery. Excessive delay in pickup leads to death or injury of personnel.
Personnel recovered successfully Mistakes during recovery. Failure of mechanism.
Recovery unit reaches shore Helicopter or ship suffers failure.
9
Calculated as the product of element failures where elements are in bold.
28
Table 4-7: Times for TEMPSC Evacuation Stages
Stage Typical Time (mins)
Preparation & roll call10 2
Movement of personnel from TR to TEMPSC 3
Lowering of TEMPSC to water surface 2
Disconnecting of TEMPSC from lowering cables 2
Movement of TEMPSC to location in water clear of the platform 2-4
Bercha et al. [9] also presented an analysis for an installation off the coast of Canada
which is subject to ice flows for part of the year, and which required evacuation using Ice
Reinforced Totally Enclosed Motor Propelled Survival Craft (IRT). For this they used a Monte
Carlo analysis to calculate the distribution of time for the various stages of the evacuation.
Estimated times relating to the evacuation process are listed in Table 4-8.
Table 4-8: Times for Evacuation Stages for Ice Reinforced Totally Enclosed Motor Propelled
Survival Craft (IRT)
Best Time Expected Time Worst Time

Stage
(mins) (mins) (mins)
IRT preparation simultaneously with roll call, life

4 6 12
jacket donning, and final instructions
Boarding of IRT 3 5 15
Launch of IRT including opening of portals,

telescoping boom, vertical decent, disconnect 3 6 15
and release of lowering cables
Results of the Monte Carlo combination of these times gave an expected time of 17 minutes
with a maximum (95%) probability of exceedance of 25 minutes and a best expected time in
the order of 12 minutes.
4.3.1 Evacuation fatality rates from recorded incidents

Instances of evacuation from offshore installations are rare. Table 4-9 shows details of a
number of incidents in the period 1984 to 2021 where evacuations took place. This is taken
from a review of lifeboat safety incidents [18]. In the Enchova incident, 36 workers were
killed due to the malfunction of a lifeboat while a further 6 died after jumping into the sea.
The number of workers who successfully escaped is not known. The remaining 6 incidents
in the table show 64 fatalities out of 492 evacuating. This gives a fatality rate of 0.13.
10
Assumed to include boarding time.
29
Table 4-9: Evacuation Fatality Data
No. of personnel
Year Country Installation Fatalities
Evacuating
1984 Brazil Enchova 42
1988 UK Ocean Oddsey 1 59
2006 UK Centrica Rough 0 70
2007 Mexico Usumacincta 22 73
2010 USA Deepwater Horizon 11 126
2015 Azerbaijan Gunashli No. 10 30 63
2021 Malaysia Naga 7 0 101
Note: The Alexander Kielland accident is not included because it utilized a different lifeboat release and retrieval system (LRSS)
4.4 Life rafts

Availability and pre-launch failure of davit launched life rafts should be assessed on an
installation specific basis (Event Stage 12). In the event that life rafts are not accessible the
worker is trapped on the installation and escape to sea may be required (Event Stage 5 –
see section 3.7). Failure probabilities for life raft are given in Table 4-10 based on results
from computer modelling (Event Stages 12, 13, 15 and 16 combined). The breakdown of
the phases where the failure occurs is not given but it is stated that most of the failures
are due to the inability to board the raft or the raft drifting into the platform structure.
These failures do not imply fatalities but rather result personnel in the water. Life rafts
tend to capsize if struck by breaking waves. The probability of capsize (Event Stage 16)
can therefore be estimated based on the probability of encountering a breaking wave. The
effects of loading condition, drogue type and other parameters on capsize probability have
been investigated by Paterson et al [19].
Table 4-10: Life raft Failure Probabilities [8]
Weather Category Proportion Failure Probability
Calm (Beaufort 0-3) 0.30 0.26
Moderate (Beaufort 4-7) 0.65 0.58
Severe (Beaufort 8+) 0.05 0.96
Overall 1.00 0.5
An assessment by IOGP Members to break the overall probabilities presented in Table 4-10
into probabilities for each of the constituent Event Stages concluded on the values shown in
Table 4-11.
30
Table 4-11: Breakdown of Life raft Failure Probabilities
Failure Pre- Failure During Unable to Failure After

Launch Launch Board Life raft Boarding Overall Failure
Weather Category
(Event (Event (Event (Event Probability
Stage 12) Stage 13) Stage 15) Stage 16)
Calm (Beaufort 0-3) 0.05 0.06 0.12 0.06 0.26
Moderate (Beaufort 4-7) 0.05 0.175 0.35 0.175 0.58
Severe (Beaufort 8+) 0.05 0.43 0.86 0.43 0.96
4.5 Guidance on evacuation analysis
4.5.1 Frequency of installation evacuation

The frequency of having to evacuate an installation is very low. This is due to the low
frequency of severe accidents combined with the provisions made to keep workers safe
while remaining on the installation until the event subsides.
Helicopter evacuation might not be achievable until some hours after the initiating event.
Fire, smoke and gas presence can prevent the use of helicopter. For such cases, lifeboats
provide an alternative means of evacuation. Evacuation to a bridge linked platform may also
be considered if the platform is sufficiently separate from the affected platform that there
is no ongoing risk to personal who are able to reach it. Alternatively, “Evacuation” may be
considered to be the process for leaving the entire installation.
4.5.2 Probability of evacuation success

The probabilities presented are taken from various sources and have a high degree of
uncertainty given the limited amount of experience of actual evacuations. Any probabilities
used should be scrutinized and developed specifically for the installation evacuation
arrangement and facilities.
4.5.3 Lifeboat/life raft evacuation

Table 4-2, Table 4-3, and Table 4-5 give a range of predictions for the success rate of
lifeboat evacuation. Similarly, Table 4-10 gives values for life rafts. These data figures are
not precise but provide examples of the ways in which the evacuation process can fail and
show that launching of lifeboat/life raft does not guarantee safe evacuation.
Lifeboat/life raft evacuation success data are generally predictions based on North Sea
experience of davit launched lifeboat/life raft. Installations in other areas may use craft
which are not davit launched. This could affect the success rate for evacuation.
31
5. Escape to sea
Events that lead to the need for evacuation of the installation may also impair the means of
evacuation or access to them. In such a case, personnel will have to leave the installation
using direct entry to the sea
The critical features of escaping to the sea are:

• Availability of means of escape to the sea, such as skyscape, ladders, scrambling
nets, ropes and personal escape equipment. These may be impaired or rendered
inaccessible by the event which initiated the evacuation.
• The reliability of the available means of escape, which is typically expressed in terms
of the fatality rate among people using it.
• The ability of the personnel to deploy the means of escape during an emergency
situation.
Fatalities due to escape to sea are available from a number of sources or by engineering
judgement. Some values are presented in Table 5-1 (Event Stage 14).
Table 5-1: Example Fatality Rates During Escape from the Installation to Sea Level
Escape Means CMPT [8] IOGP Recommended
Jumping 0.1 0.1
Sliding/climbing down ropes or hoses 0.01
Climbing down scrambling nets 0.01
Climbing down ladders/stairways 0.003
Skyscape 0.005
Decent Devices (e.g., Donuts) 0.01
A severe fire at sea level will have the effect of increasing these rates. CMPT suggests
increasing the rate by 50%.
Workers who use a tertiary means of escape can be expected to attempt to board a life raft
if one is available (Event Stage 12). If a life raft is available then the following probabilities of
boarding are recommended:
• Where the means of escape is associated with the launch of a life raft and there is
direct entry to the life raft (e.g., skyscape, donuts): 0.9
• Where the means of escape is associated with the launch of a life raft but does not
involve direct entry to the life raft (e.g., ladders, ropes or scramble nets: 0.8)
• Where escape is from a trapped location remote from the launch point of a life raft: 0.6.
Table 5-2 provides sample values from an IOGP Member for situations where there is a
standby vessel present. It is noted that these values combine the fatality rate for entering
the water and, if that is survived, the subsequent failure to be recovered (Event Stages 14
and 19 combined).
32
Table 5-2: Sample Rule Set for Fatality Rate Upon Entering the Sea to Escape (North Sea
Data)
Weather Category No or Low Fire Effects at Sea Level High Fire Effects at Sea Level
Calm (wind 0 to 5 m/s) 0.06 0.15
Moderate (wind 5 to 12 m/s) 0.22 0.22
Severe (wind > 12 m/s) 0.92 0.92
Notes:
• If there is no standby vessel the fatality rate is taken as 0.8 averaged over all weather
states.
• Probabilities cover full scope of evacuation: entering sea; remaining at sea surface;
rescue.
• Personnel making a sea entry are expected to be wearing survival suit and life-jacket.
• The data does not differentiate sea temperature effects on personnel survival rate.
In reality, personnel survival time in cold water immersion, depends on local sea
temperatures and generic human endurance times.
The probabilities presented in Table 5-1 are sample extracts from typical rule sets from
IOGP Member databases. Similar to the above, probabilities used should be scrutinized and
developed specific to the installation escape arrangement and facilities.
33
6. Rescue and recovery
6.1 Overview
The purpose of the rescue and recovery arrangements is to ensure prompt recovery to a
place of safety of personnel evacuating by lifeboat or entering the water during escape or
because of a man overboard (MOB) incident11. Such rescue and recovery arrangements are
normally achieved through the use of ‘local’ search and rescue (SAR) helicopters, standby
vessels (SBVs)/ Emergency Response and Rescue Vessels (ERRV) and fast rescue craft
(FRCs) as specified by the installation’s Emergency Response Plan (ERP).
The critical features affecting the risks of rescue and recovery are:
• Location of the SAR helicopter(s)
• Response / launch times for the SAR helicopter and SBV/ERRV
• Speed of the SAR helicopter and SBV/ERRV
• Capacity of the SAR helicopter and SBV/ERRV together with their associated Fast
Rescue Craft (FRC) and Daughter Craft (DC)
• The time taken to rescue people from the sea, compared to their survival time in the
prevailing conditions. This depends on:
– the availability of suitable rescue craft
– their reliability and performance in the rescue task
– the environmental conditions affecting survival times and rescue performance
– t he number of people to be rescued and the clothing and survival equipment
used
– t he use of aids to locate people in the water such as personal locator beacons
(PLBs).
6.2 Recovery fatality rates

For workers evacuating the facility via a lifeboat the probability of recovery (Event Stage
17) is high but still dependent on weather conditions. Workers may have to remain in the
lifeboat until conditions improve. Values from evacuation experience and judgement are
given in Table 6-1. The values in the second and third columns are from [8] where the
judgement reflects the high risks associated with transferring a person from a lifeboat to
another vessel in other than calm conditions. In practice, knowing that this is the case, it is
likely that workers will be left in the lifeboat until the weather subsides and the operation
can be carried out safely. Hence, the IOGP-recommended values are to assume a fatality
rate of 0.01 in all-weather states.
11
Note that MOB incidents are generally included as part of the assessment of occupational risks within a QRA
34
Table 6-1: Fatality rates during recovery from lifeboat
Weather Category Experience [8] Judgement [8] IOGP Judgement
Calm 0.00 0.01 0.01
Moderate 0.00 0.10 0.01
Severe 0.26 0.50 0.01
Overall 0.01 0.08 0.01
Recovery from a life raft that hasn’t failed (Event Stage 18) will be more hazardous.
Recommended values based on judgement are given in Table 6-2.
Table 6-2: Fatality rates during recovery from life raft
Weather Category Fatality Rate
Calm (wind 0 to 5 m/s) 0.00
Moderate (wind 5 to 12 m/s) 0.00
Severe (wind > 12 m/s) 0.06
6.3 Cold water immersion

Table 6-3 replicates the information in the HSE’s review of the probable survival times for
a “Standard Man” immersed in the North Sea [20]. The report describes these as “broad
estimates of the likely survival times for the 2nd percentile thin offshore individual” and
notes that “the time estimates are presented in ranges to indicate the upper boundaries
where the probability of survival becomes increasingly less likely.” This assumes that the
individuals are not significantly incapacitated by injury, sea sickness, etc. Fatter, motivated
fit individuals who are wearing an effective lifejacket which gives adequate mouth clearance
above the waves are likely to exceed these time ranges.
Table 6-3: Timescale within which a “standard man” is likely to succumb to drowning
Timescale Withing Which the “Standard Man”

Clothing Assembly is Likely to Succumb to Drowning
(Worn with Beaufort Wind Force
Lifejacket) Winter Summer
(Water Temperature 5ºC) (Water Temperature 13ºC)
0-2 Within ¾ hour Within 1¼ hour
Working Clothes - 3-4 Within ½ hour Within ½ hour

No Immersion Suit
Within significantly less than Within significantly less than
5 and above
½ hour ½ hour
0-2 Within 2 hours >3 hours

Dry Membrane Suit
Worn Over Working 3-4 Within 1 hour Within 2¾ hour
Clothes – No
Leakage into Suit Within significantly less than Within significantly less than
5 and above
1 hour 2¾ hours
35
Timescale Withing Which the “Standard Man”

Clothing Assembly is Likely to Succumb to Drowning
(Worn with Beaufort Wind Force
Lifejacket) Winter Summer
(Water Temperature 5ºC) (Water Temperature 13ºC)
0-2 Within 1¼ hours Within 2½ hours

Membrane Suit
Worn Over Working 3-4 Within ½ hour Within 1 hour
Clothes With 1 Litre
Leakage Inside Suit Within significantly less than Within significantly less than
5 and above
½ hour 1 hour
Dry Insulated Suit 0-2 >3 hours >3 hours

Work Over Working
3-4 >3 hours >3 hours
Clothes – No
Leakage Into Suit 5 and above >= 3 hours >3 hours
0-2 >3 hours >3 hours

Dry Insulated Suit
3-4 Within 2¾ hours >3 hours
Work Over Working
Clothes – 1 Litre Within Significantly less than
Leakage Into Suit 5 and above 2¾ hours. May well exceed 1 >3 hours
hour
The report also provides a graph showing curves for estimated survival times in calm
water which are consistent with the values for Beaufort 0 – 2. The report recommends time
reduction factors applicable to wind conditions of Beaufort 3 and above of 0.5 for non-
leaking suits and 0.45 for leaking suits. Based on the graph presented in [20], Figure 6-1
has been produced for calm water and Figure 6-2 for higher wind speeds.
Figure 6-1: Predicted survival time against sea temperature for different categories of clothing –
calm water
36
Figure 6-2: Predicted survival time against sea temperature for different categories of clothing –
beaufort 3 and above
A further time factor can be applied to values taken from the graphs to account for reduced
survival times for injured staff. These are 0.85 for recovery during summer and 0.6 during
winter.
In warmer water factors other than hypothermia may become more important.
The UK HSE [21] suggests that the “maximum exposure time doubles for each 5ºC
increase, at 0ºC maximum exposure time is 15 minutes”. This gives a survival time of 30
minutes for immersion in water at 5ºC and 1 hour at 10ºC. This does not stipulate what
clothing or sea conditions are assumed. A comparison with the curve for “Working Clothing
Only” from Figure 6-1 is shown in Figure 6-3.
37
Figure 6-3: Comparison of hse cold water immersion survivability curve with wissler model for
“working clothes only”
The HSE [22] provide some estimates survival times for combinations of clothing in light
and heavy sea conditions at 5ºC.
The fatality rate for workers in the sea (Event Stage 19) is equivalent to the probability that
the time taken to recover them is greater than their survival time.
6.4 Rescue fatality rate calculation

In a screening study an assessment may be made of the proportion of workers that are
likely to be recovered within their survival time. This is equivalent to the fatality rate of a
given worker. Sea conditions are assumed the same for all workers but the assessment
may allow for proportions in different types of clothing whereby different survival times
apply.
For example, suppose 50% of workers, in water at 6 ºC and Beaufort 4, have insulated suits
and 50% have normal working clothing. The time to rescue those with insulated suits is
4 hours 25 minutes and it is assumed that 90% of these workers will be recovered in that
time. However, for those without insulated suits the survival time is 25 minutes and it is
assumed that only 20% will be recovered within this time. This gives an overall fatality rate
of (0.5 × 0.1) + (0.5 × 0.8) = 0.45.
38
A more detailed calculation may utilize a timeline model which takes account of the
time to mobilize the rescue craft and rescue the first worker and the time between each
subsequent rescue. It should be noted that the time to rescue each successive worker
may increase due to drifting resulting in the distance between workers increasing as the
number of workers remaining in the water decreases.
6.5 Guidance on survival times in water

The survival times are taken from HSE Offshore Technology Report OTO 95 038 [20].
Survival times may be multiplied by 0.6667 to give a factor of safety as suggested in
guidance PBN 97/20 of HSE for demonstration of good prospect in compliance with PFEER
[1]. This may appropriate for a study to demonstrate good prospect of recovery but should
not be included in a QRA.
Work related to survival times typically date from the late 1980s/early 1990s. There has
been little subsequent development in this area. Prior to the PFEER regulations [1] coming
into force in the UK, a significant degree of EER analysis was performed associated with the
Piper Alpha Disaster report by Lord Cullen which required EER Analysis as a “forthwith”
study in advance of the Safety Case Regulations [23] which were enacted in 1993 (most
recently updated in in 2015). Much of the more recent numerical analysis work built upon
the earlier DEn ESCAPE work involving Technica.
The PFEER Regulations set out requirements on emergency response issues, principal
among which was the requirement to demonstrate a good prospect of rescue and recovery.
The Regulations enabled the possibility of Standby Vessel sharing to be considered. Recent
industry activity focuses on the practicalities of effective rescue and recovery rather than
quantifying the risk.
39
7. EER for onshore sites
The above sections relate to EER for offshore installations. For onshore installations the
analysis is significantly simpler and primarily consists of two stages for workers on site.
• Probability of workers being able to get to temporary shelter (muster point)
• Probability of being able to move from the temporary shelter to a place of safety
before the shelter is impaired or being able to stay in the shelter until the incident has
subsided
The means of evacuation are less complex to analyse since for onshore incidents it is easier
for workers to run to a safe distance. However, some consideration needs to be given to
workers who have to make their workplace safe and/or descend to ground level before they
can move away. This may apply to workers on the top of storage tanks or the upper levels of
process modules.
The integrity of onsite buildings will need to be assessed for the need for fire/blast proofing
or if release of toxic gas is a hazard, the air tightness of buildings.
Sites may require exits in the appropriate locations even if they aren’t normally used.
For large incidents which may affect neighbouring industrial sites or residential areas there
is a need to manage the risks to people in those areas. This may include:
• Communication of the emergency situation and guidance on actions to be taken
(e.g., staying indoors)
• Liaison with local emergency services and operators of nearby sites
• Restricting access to affected areas through road closures
40
8. General guidance
8.1 Post-PFEER activity in the UK in relation to evacuation, escape

and rescue
Good prospect of rescue and recovery requires the ability to deploy resources quickly
enough to recover people before survival times were exhausted. Therefore, the following
aspects of survival have been considered:
• To improve survival times in water
• To deploy new and different resources to get to and recover people in the water more
quickly.
8.2 Improving survival times

Survival time has been shown to be linked to the type of survival suits being worn. Zips and
worn seals compromise suits and cause ingress of water, which reduces survival times, so
alternative suit and lifejacket combinations were developed and additional training provided
to reduce such problems.
In addition, there has been widespread adoption of thermal immersion garment liners
worn within survival suits in defined weather/sea conditions to enhance the “good
prospect”.
8.3 Reducing recovery times

As an aid to faster recovery of personnel from the water, the use of personnel locator
beacons (PLB), previously limited to lifeboats, helicopter and life rafts, has been adopted
by many companies. When using PLBs, it important to ensure that when activated these
devices do not interfere with helicopter Emergency Position Indicating Radio Beacon
(EPIRB) signals.
Advances began with better systems of recovering personnel from the sea and, in
particular, lessons learned from earlier emergency situations prompted:
• The development of devices such as the Jason’s Cradle and Dacon Scoop
• The development of Caley davits for FRC quick recovery in rough weather with an
inbuilt heave compensation device
• Lower freeboard, and better illuminated and defined SBV rescue zones
A SBV code of practice was developed to harmonize the specification of SBVs, outlining
different classes of vessel essentially related to the POB on the installations they are
attending. This has since been replaced by the Emergency Response Rescue Vessel (ERRV)
code [11].
41
The specifications of equipment and manning requirements were developed to ensure

effective resources could be available to rescue, recover, attend survivors and crew the
vessels effectively.
With respect to SBV, the industry began to increase the number, capacity, reliability,
endurance and speed of fast rescue craft. From the mid 1990s, fast rescue craft began to
develop towards the “daughter craft” (DC) principle. These craft were larger, had canopies
and could operate somewhat independently of the SBV for defined periods. This enabled
more distant deployments and enabled closer support for example for helicopter operations
between local facilities, greater support under shared SBV circumstances e.g., over the side
work close in support. DC have greater weather limitations than FRC as their weight makes
rough weather recovery a problem, limiting their deployment to moderate seas.
From the late 1990s, BP and various partners began to advance the Jigsaw concept that
would provide good prospects of rescue and recovery by a more focused deployment
of higher specification SBV and offshore based Search and Rescue (SAR) helicopter
provisions (essentially equipped with forward looking Infrared systems, for the location of
those immersed, and winch recovery provisions). The Jigsaw vessels are equipped with
Autonomous Rescue and Recovery Craft (ARRC). These are essentially vessels that can be
deployed using dual davits, which have a Rigid Inflatable Boat basis but with large cabs over
2 decks allowing comfortable autonomous operations and effective recovery capabilities.
8.4 Ice bound installations

Away from the UKCS and the North Sea, work has been applied in the field of Emergency
Response towards colder and ice oilfield environments. The Terra Nova development
demonstrated the need to keep lifeboats in warmed garage facilities to ensure quick,
effective use. The Sakhalin developments have demonstrated the need for new thinking
in relation to evacuating onto full or partial sea ice cover. More recently the Kashagan
development in the northern Caspian Sea, icebound in winter, has required creative
solutions for emergency response arrangements, also influenced by significant potential
for high concentration H2S situations.
42
9. Recommended data sources for

further information
The principal sources of the data presented in Sections 3 to 6 are:
• A Guide to Quantitative Risk Assessment for Offshore Installations [8]
• Methods of Approximation and Determination of Human Vulnerability for Offshore
Major Accident Hazard Assessment [5]
• Review of Probable Survival Times for Immersion in the North Sea [20]
OREDA includes some recorded failure incident and failure rate data for conventional davit
launched lifeboats.
The Vulnerability of Humans guidance [5] provides data complementary to that discussed in
Section 6.
Most of the data presented are generally based on the North Sea experience. Installations
in other areas operating in different environmental conditions and operating standards may
be subjected to area specific data.
There are limited data available for use in EER analysis, however, a number of organizations
provide guidance on EER best practice through their websites, within the UK this includes
OEUK, the Health and Safety Executive (HSE) UK, Emergency Response and Rescue Vessel
Association (ERRVA) UK, and The Step Change in Safety group. For Norway the Norwegian
Petroleum Services Authority (PSA) provides guidelines. For other offshore sectors local
authorities can be referred to such Transport Canada, Mineral Management Services (US),
Occupational Safety and Health Administration (US), US Coast Guard, and in general the
International Maritime Organization (IMO).
43
10. References
[1] HSE 2016. Prevention of Fire and Explosion, and Emergency Response on Offshore Installations (PFEER)
Regulations 1995: Approved Code of Practice and Guidance. 3rd Edition. ISBN 978 0 7176 6326 2.
[2] Step Change in Safety 2003. Loading of Lifeboats during Drills – Guidance.
https://homeport.uscg.mil/Lists/Content/Attachments/740/Loading_of_Lifeboat_Guidance1.pdf
[3] HSE 1995. A Methodology for Hazard Identification on EER Assessments. OTH 95 466.
[4] DNV 2014. Safety Principles and Arrangement. Offshore Standard DNV-OS-A101.
[5] IOGP. Risk Assessment Data Directory, Vulnerability of Humans. Report No. 434-14.
[6] HSE. Methods of approximation and determination of human vulnerability for offshore major accident
hazard assessment. [Online]. [cited 2022]. Available from: https://www.hse.gov.uk/foi/internalops/
hid_circs/technical_osd/spc_tech_osd_30/spctecosd30.pdf
[7] HSL. Human Vulnerability to Thermal Radiation Offshore, 2004. Report No.: HSL/2004/4.
[8] CMPT 1999. A Guide to Quantitative Risk Assessment for Offshore Installations. J. Spouge. ISBN I 870553
365.
[9] Bercha 2000. Escape, Evacuation and Rescue Modelling for Frontier Offshore Installations. F. G. Bercha,
A. C. Churcher, M. Cerovsek. OTC 12158.
[10] TNO. A Model for the Determination of Possible Damage, 1992. Report No.: CPR 16E.
[11] HSE 2007. Overview of TEMPSC Performance Standards. RR599.
[12] United States Environmental protection Agency, Hydrogen Sulfide Results – AEGL Program,
https://www.epa.gov/aegl/hydrogen-sulfide-results-aegl-program, Accessed June 2022.
[13] Ter Burg, W. and Bos, P.M.J., 2009, Evaluation of the Acute Toxicity of CO2, RIVM Centrum vor Stoffen en
Integrale Risicoschatting (SIR).
[14] Ter Burg, W., 2022, Probit function technical support document – 20210401 – Carbon Dioxide, National
Institute for Public Health and the Environment.
[15] NORSOK 2001. Risk and Emergency Preparedness Analysis. NORSOK Standard Z-013 Rev 2.
[16] OGUK 2018, Emergency Response & Rescue Vessel Management Guidelines, Issue 6.
[17] HSE 2004. TEMPSC Structural Design Basis Determination: Part 1 – Input Data Capture and Review. RR198.
[18] Heeney, Paul. A Review of Lifeboat Safety Incidents, EERTAG Meeting#92.
[19] Paterson, R, et al. An investigation of life raft performance and recovery systems in extreme seas,
International Conference on Escape, Evacuation and Rescue, RINA, London, 1996.
[20] HSE 1996. Review of Probable Survival Times for Immersion in the North Sea, OTO 95 038.
[21] HSE. Indicative Human Vulnerability to the Hazardous Agents Present Offshore for Application in
Risk Assessment of Major Accidents, HID Semi Permanent Circular no. SPC/Tech/OSD/30. [Online].;
2010 [cited 2021]. Available from: https://www.hse.gov.uk/foi/internalops/hid_circs/technical_osd/
spc_tech_osd_30/index.htm
[22] HSE 2010. Methods of Approximation and Determination of Human Vulnerability for Offshore Major
Accident Hazard Assessment. November 2010. SPC/Tech/OSD/30 Rev 3.
[23] HSE 2015, The Offshore Installations (Offshore Safety Directive) (Safety Case etc.) Regulations 2015.
44
Appendix A: Beaufort Scale
The fatality rates associated with escape and evacuation are dependent on the weather conditions at
the time of the incident, primarily on the wind speed. Typically, the weather conditions are dived into
3 or 4 classifications which each cover a range of Beaufort numbers. Wind speeds, wave heights and
sea conditions for each Beaufort number are presented in Table A-1. Note that ranges covered by the
descriptions “Calm”, “Moderate” and “Severe” are not necessarily consistent between different sources.
Table A-1: Beaufort Wind Scale
Beaufort
Description Wind speed Wave height Sea conditions
Number
< 1 knot
0 Calm 0m Sea like a mirror
< 0.5 m/s
1–3 knots Ripples with appearance of scales are formed, without

1 Light air 0–0.3 m
0.5–1.5 m/s foam crests
4–6 knots Small wavelets still short but more pronounced; crests
2 Light breeze 0.3–0.6 m
1.6–3.3 m/s have a glassy appearance but do not break
7–10 knots Large wavelets; crests begin to break; foam of glassy

3 Gentle breeze 0.6–1.2 m
3.4–5.5 m/s appearance; perhaps scattered white horses
11–16 knots Small waves becoming longer; fairly frequent white

4 Moderate breeze 1–2 m
5.5–7.9 m/s horses
17–21 knots Moderate waves taking a more pronounced long form;

5 Fresh breeze 2–3 m
8–10.7 m/s many white horses are formed; chance of some spray
22–27 knots Large waves begin to form; the white foam crests are
6 Strong breeze 3–4 m
10.8–13.8 m/s more extensive everywhere; probably some spray
28–33 knots Sea heaps up and white foam from breaking waves
High wind, moderate
7 4–5.5 m begin to be blown in streaks along the direction of the
gale, near gale 13.9–17.1 m/s wind.
34–40 knots Moderately high waves of greater length; edges of

8 Gale, fresh gale 5.5–7.5 m crests break into spindrift; foam is blown in well-
17.2–20.7 m/s marked streaks along the direction of the wind
41–47 knots High waves; dense streaks of foam along the direction
9 Strong/severe gale 7–10 m
20.8–24.4 m/s of the wind; sea begins to roll; spray affects visibility
Very high waves with long overhanging crests;

48–55 knots resulting foam in great patches is blown in dense white
10 Storm/whole gale 9–12.5 m streaks along the direction of the wind; on the whole
24.5–28.4 m/s the surface of the sea takes on a white appearance;
rolling of the sea becomes heavy; visibility affected
Exceptionally high waves; small- and medium-sized

56–63 knots ships might be for a long time lost to view behind the
11 Violent storm 11.5–16 m waves; sea is covered with long white patches of foam;
28.5–32.6 m/s everywhere the edges of the wave crests are blown into
foam; visibility affected
≥ 64 knots The air is filled with foam and spray; sea is completely
12 Hurricane force ≥ 14 m white with driving spray; visibility very seriously
≥ 32.7 m/s affected
45
Appendix B: Worked Example
The calculation of the overall fatality rate can be undertaken using the decision tree diagram in
Figure 2-2 by applying branch probabilities recommended in this data sheet or assessed specifically
for a particular scenario. The worked example shown here relates to an offshore installation which
has lifeboats, life rafts and tertiary means of escape provided by donuts and ladders. The individual
concerned is initially in a process area remote from the temporary refuge and has survived the
effects of the immediate effects of the incident. The incident is assumed to have a high (0.6)
probability of impairing the muster points and forcing an evacuation. The weather condition at the
time of the incident is moderate. Rescue craft recover 80% of workers within their survival time.
The cumulative probability at any stage is calculated by multiplying the input cumulative probability
at each Event Stage by the appropriate “Yes” or “No” branch probabilities. At some points in the
analysis cumulative probabilities are combined before feeding into the next stage.
For a given installation, the calculation can be applied to a given accident scenario, which may be
specific to combinations of barrier failures, in a given weather condition and for workers in a given
location. This could result in a very large number of combinations each of which have a distinct
set of branch probabilities. In practice, it would be practical to group both accident scenarios and
platform locations where they are similar to limit the number of combinations.
The overall process as depicted in Figure 2-2 may be simplified to reduce the number of Event
Stages and hence the number of branch probabilities.
The worked example is shown in two formats (Table B-2 and Figure B-1). The overall fatality rate is
calculated by summing the values at the 6 “Fatality” end points.
In this example the survival and fatality probabilities are summarized in Table B-1. The probability
of evacuation in this case is calculated as 0.47966 and this can be used to calculate the fatality
probabilities for workers evacuating or escaping. These values are also given in Table B-1.
Table B-1: Summary of Outcomes
Probability Given
Outcomes Location Probability Given Incident
Evacuation/Escape
Initial Location 0.20000 N/A

Trapped Location 0.02434 N/A
Survival Muster Location 0.29600 N/A
Place of Safety 0.46677 0.97312
Total 0.98711 0.97312
Trapped on Installation 0.00000 N/A
In Failed Lifeboat 0.00351 0.00732
Attempting Escape 0.00092 0.00192
Fatality Failed Lifeboat Recovery 0.00393 0.00819
Failed Life raft Recovery 0.00000 0.00000
Failed Recovery From Sea 0.00454 0.00946
Total 0.01289 0.02688
46
Table B-2: Worked example – tabular format
Status of Cumulative Probabilities

Analysis Node Location of individual at Stage Input Yes Branch
Node Description Basis No Branch Prob
Name Individual Start of Event Probability Probability
Stage Yes Branch No Branch
Event Stage 1 Muster required Initial Location Trying to Muster 1.00000 0.80 Consequence assessment [3.2] 0.2000 0.80000 0.20000
Safe in initial Survived in Initial

Survive#1 Initial Location 0.20000 Event stage 1 "No" Probability
location Location
Escape route to
Assessment of available routes
Event Stage 2 primary muster Initial Location Trying to Muster 0.80000 0.70 0.3000 0.56000 0.24000
[3.3]
point available
Escape route
to secondary Assessment of available routes
Event Stage 3 Initial Location Trying to Muster 0.24000 0.75 0.2500 0.18000 0.06000
muster point [3.4]
available
Trapped Under Trapped on Trapped on Sum of Event Stages 3 and 12

Trapped 0.06084
Threat installation Installation "No" cumulative probabilities
Trapped on
Event Stage 4 Escape required Trying to Escape 0.06084 0.60 Consequence assessment [3.7] 0.4000 0.03651 0.02434
Installation
Trapped on Recommended conservative

Event Stage 5 Attempt escape Trying to Escape 0.03651 1.00 0.0000 0.03651 0.00000
Installation assumption [3.7]
Killed by Recommended conservative

Event Stage 6 Escaping Trying to Escape 0.00000 0.85 0.1500 0.00000 0.00000
hazardous event assumption [3.7]
Survived in Trapped on Survived in Sum of Event Stages 4 and 6

Survive#2 0.02434
trapped location Installation Trapped Location "No" Cumulative probabilities.
Fatality While
Trapped on Event Stage 6 "Yes" cumulative
Fatality#1 Fatality Attempting 0.00000
Installation probability
Escape
Mustered at
primary or Sum of Event Stages 2 and 3
Mustered At Muster Point Mustered 0.74000
secondary "Yes" Cumulative probabilities.
muster point
Evacuation
Event Stage 7 At Muster Point Mustered 0.74000 0.60 Consequence assessment [4.1] 0.4000 0.44400 0.29600
required

Safe in muster Survived in Event Stage 7 "No" cumulative

Survive#3 At Muster Point 0.29600
location Muster Area probability
Evacuation by
Event Stage 8 primary means At Muster Point Mustered 0.44400 0.05 Consequence assessment [4.2] 0.9500 0.02220 0.42180
available
Mustered/
Lifeboat available
Lifeboat Availability and consequence
Event Stage 9 and not failing Mustered 0.42180 0.95 0.0500 0.40071 0.02109
Embarkation assessment [4.3]
pre-launch
Area
Trying to
Lifeboat fails Lifeboat Lifeboat launch failure data
Event Stage 10 Evacuate in 0.40071 0.02 0.9800 0.00801 0.39270
during launch Launching [4.3]
Lifeboat
Awaiting Stage Event 10 "No" cumulative

In Lifeboat In lifeboat at sea In Lifeboat at Sea 0.39270
Recovery probability
Trying to 1 minus weighted average of

Survive lifeboat Lifeboat
Event Stage 11 Evacuate in 0.01287 0.7274 fatalities during launch and on 0.2726 0.00936 0.00351
launch failure Launching
Lifeboat entering sea [4.3]
Fatality While
Attempting
Fatality#2 Fatality In Failed Lifeboat 0.00351 Stage Event 11 "No" probability
Lifeboat
Evacuation
Life rafts Mustered/Life

Availability and consequence
Event Stage 12 available and not raft Embarkation Mustered 0.02109 0.96 0.0400 0.02025 0.00084
assessment [4.4]
failing pre-launch Area
Trying to
Life raft fails Life raft Recommended value from
Event Stage 13 Evacuate in Life 0.02025 0.24 0.7600 0.00486 0.01539
during launch Launching Table 4 11 [4.4]
raft
Successfully 1 minus weighted average

Attempting Trying to Escape
Event Stage 14 leave installation 0.03651 0.9748 fatality rates for 40% donuts, 0.0252 0.03559 0.00092
Escape by Tertiary Means
by tertiary means 40% ladders, 20% jumping [5]
Attempting Fatality in Tertiary Event Stage 14 "No" cumulative

Fatality#3 Fatality 0.00092
Escape Means Escape probability

Trying to Board Event Stage 14 "Yes"

Boarding Life raft In water In Water 0.03559
Life raft cumulative probability
Successfully Trying to Board 1 minus recommended value

Event Stage 15 In Water 0.04495 0.76 0.2400 0.03416 0.01079
board life raft Life raft from Table 4 11 [4.4]
Sum of Event Stage 13

Awaiting "No" Cumulative probability
In Life raft In life raft at sea In Life raft at Sea 0.04955
Recovery and Event Stage 15 "Yes"
Cumulative probability
Sum of Event Stage 15

Awaiting "No" cumulative probability
In Sea In water In Water 0.02268
Recovery and Event Stage 16 "Yes"
cumulative probability
Life raft fails in Awaiting Recommended value from

Event Stage 16 In Life raft at Sea 0.04955 0.24 0.7600 0.01189 0.03766
sea Recovery Table 4 11 [4.4]
Recovered from
Awaiting 1 minus recommended value
Event Stage 17 lifeboat and In Lifeboat at Sea 0.39270 0.99 0.0100 0.38877 0.00393
Recovery from Table 6 1 [6.2]
returned to shore
Fatality in Event Stage 17 "No" cumulative

Fatality#4 Fatality In Lifeboat at Sea 0.00393
Lifeboat probability
Recovered from
Awaiting 1 minus recommended value
Event Stage 18 life raft and In Life raft at Sea 0.03766 1.00 0.0000 0.03766 0.00000
Recovery from Table 6 2[6.2]
returned to shore
Fatality in Life Event Stage 18 "No" cumulative

Fatality#5 Fatality In Life raft at Sea 0.00000
raft probability
Recovered Evaluation based on time

Awaiting
Event Stage 19 from water and In Water 0.02268 0.8 to rescue, clothing and 0.2000 0.01814 0.00454
Recovery
returned to shore environmental factors [6.3]
Event Stage 19 "No" cumulative

Fatality#6 Fatality In Water Fatality in Water 0.00454
probability
Sum of Event Stages 8, 17,

Safe in place of Survived - Place
Survive#4 Place of Safety 0.46677 18 and 19 "Yes" Cumulative
safety of Safety
Probability
Figure B 1: Worked example - diagrammatic form

This page is intentionally blank
51
This data sheet provides Quantitative
Risk Assessment (QRA) data and
guidance for Muster, Evacuation,
Escape and Rescue (EER) for all
onshore facilities and offshore
installations.
IOGP Headquarters www.iogp.org

City Tower, 40 Basinghall Street, London EC2V 5DE, United Kingdom
T: +44 (0)20 3763 9700
E: reception@iogp.org
IOGP Americas IOGP Asia Pacific IOGP Europe IOGP Middle East & Africa
T: +1 713 261 0411 T: +60 3-3099 2286 T: +32 (0)2 790 7762 T: +20 120 882 7784
E: reception-americas@iogp.org E: reception-asiapacific@iogp.org E. reception-europe@iogp.org E: reception-mea@iogp.org

Escape, Evacuation, and Rescue

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Escape, Evacuation, and Rescue

Uploaded by

Copyright:

Available Formats

REPORT JULY

RISK ASSESSMENT DATA DIRECTORY

Escape, evacuation, and rescue

Front cover photography used with permission courtesy of ©kali9/iStockphoto

IOGP welcomes feedback on our reports: publications@iogp.org

RISK ASSESSMENT DATA DIRECTORY

Escape, evacuation, and rescue

VERSION DATE AMENDMENTS

1.0 March 2010 First release

2.0 July 2023 Full revision

1. Scope and definitions 7

2. Overview of EER process 10

6. Rescue and recovery 34

7. EER for onshore sites 40

9. Recommended data sources for further information 43

Appendix A: Beaufort Scale 45

Appendix B: Worked Example 46

AEGL Acute Exposure Guideline Level

1. Scope and definitions

Muster is the process of assembling personnel in a muster area where it is safe to

Evacuation is the process of leaving an installation and its vicinity, in an emergency, in a

Escape (to sea)

The means of evacuation/escape are generally categorized as primary, secondary or

Primary means of evacuation include:

Secondary means of evacuation include:

2. Overview of EER process

2.2 Generic stages of EER

Figure 2-1: Basic EER Stages

Table 2-1: Generic Stages of EER

Stage Description Possible problems

Alarm Detection system warns of an unsafe • Detection fails

Stage Description Possible problems

Muster Personnel assemble in a designated muster/ •M

Rescue Personnel in the water or in life rafts • Adverse weather/visibility

Recovery Various scenarios including; • Adverse weather

The decision to evacuate the installation is made by a designated On-Scene Commander

2.3 Statutory and operator requirements

2.4 Analysis process

Table 2-2: Event stage description

Event Stage No. Location of Status of Individual at Start of Event

Event Stage 1 Muster required Initial Location Trying to Muster

Survive#1 Safe in initial location Initial Location Survived in Initial Location

Trapped Under Trapped on

Event Stage 6 Killed by hazardous event Escaping Trying to Escape

Event Stage No. Location of Status of Individual at Start of Event

Mustered Mustered at primary or secondary muster point At Muster Point Mustered

Event Stage 7 Evacuation required At Muster Point Mustered

Survive#3 Safe in muster location At Muster Point Survived in Muster Area

Event Stage 8 Evacuation by primary means available At Muster Point Mustered

In Lifeboat In lifeboat at sea In Lifeboat at Sea Awaiting Recovery

Fatality While Attempting Lifeboat

Fatality#3 Fatality Attempting Escape Fatality in Tertiary Means Escape

In Sea In water In Water Awaiting Recovery

Fatality#4 Fatality In Lifeboat at Sea Fatality in Lifeboat

Fatality#5 Fatality In Life raft at Sea Fatality in Life raft

Fatality#6 Fatality In Water Fatality in Water

Survive#4 Safe in place of safety Place of Safety Survived - Place of Safety

Figure 2-2: EER analysis flow diagram

3.1 General guidance on escape routes

3.2 Requirement for muster

3.3 Availability of escape route to primary muster point

Figure 3-1: Example layout of installation areas

Table 3-1: Example matrix for escape route availability