| Written by Mark Buzinkay
Table of contents:
- Why Fail Safe Design Is Essential Offshore
- Connecting Hardware with Fail-Safe Operational Processes
- Designing Offshore Work Around Human Error
- Optimising Emergency Management Through Fail Safe Design
- Implementing and Sustaining Fail Safe Protection
- FAQ
- Takeaway
- Glossary
Why Fail Safe Design Is Essential Offshore
Offshore oil and gas installations and offshore wind farms operate far from many of the resources available at an onshore industrial site. External firefighters, medical teams and specialist rescue personnel may take considerable time to arrive. During severe weather, even transferring an injured person to a vessel or helicopter can become difficult. The installation and its crew must therefore be capable of detecting, controlling and surviving an incident with the resources immediately available.
Fail safe design begins with a realistic assumption: equipment will eventually fail, power may be interrupted, communications may be lost, and people will make mistakes. The objective is not to claim that failure can be eliminated. It is to ensure that a foreseeable failure does not automatically produce an unsafe condition.
A familiar example is a spring-return valve. During normal operation, pneumatic or electrical energy may hold the valve open. If that energy disappears, the spring moves the valve to its predefined safe position. The system does not wait for an operator to notice the problem and issue a command. The physical design produces the intended response.However, “safe” does not always mean “closed” or “stopped.” A fuel valve may need to close to isolate a fire, while a cooling-water valve may need to remain open to prevent overheating. Emergency lighting, fire detection, communications and evacuation systems must continue operating when normal production equipment shuts down. The correct safe state must therefore be defined for each function through hazard analysis rather than applied as a universal rule.Fail safe design should also be distinguished from related concepts:
- Fault prevention seeks to stop failures from occurring.
- Fault detection identifies abnormal conditions.
- Fail-safe behaviour moves equipment toward a safer condition after a fault.
- Fault tolerance allows a system to continue providing a necessary function despite a fault.
- Redundancy provides additional components or pathways but is useful only if a common cause cannot disable them simultaneously.
- Error recovery allows an incorrect action to be reversed or corrected before it causes harm.
Offshore installations need all these approaches. Their combined benefits include lower accident risk, reduced escalation potential, clearer emergency decisions, greater operational resilience and improved protection of personnel and the environment.
Fail-safe measures can also support availability. Although an automatic trip may interrupt production, it can prevent equipment damage, fire or loss of containment that would cause a much longer shutdown. Effective protection therefore balances production continuity with the principle that production must never take priority over life safety.
The UK Health and Safety Executive describes fail-safe control as arranging equipment so that an actuator takes up its tripped state following a loss of signal or power. Its guidance also highlights failure detection, performance monitoring and sufficient emergency energy supplies as important control-system measures (HSE: Control systems (1)).
Connecting Hardware with Fail-Safe Operational Processes
Offshore safety cannot be created by installing individual protective devices. Hardware, software, procedures, responsibilities and maintenance activities must work as an integrated system.
On an oil and gas platform, the protection layers commonly begin with process control. Sensors monitor pressure, temperature, flow, liquid level and gas concentration. When conditions move outside their normal range, the control system may adjust the process or warn the operator. If conditions reach a dangerous threshold, an independent protective function can initiate isolation, depressurisation or shutdown.
Emergency shutdown systems divide an installation into isolatable areas. When a serious leak or fire is detected, shutdown valves can interrupt hydrocarbon flow and limit the inventory available to feed the event. Blowdown systems may reduce pressure, while fire and gas systems can activate alarms, ventilation changes, dampers, deluge equipment or ignition-source isolation.
The design must consider the complete response. Closing one valve may trap pressure between two isolation points. Stopping ventilation may prevent smoke or gas from spreading, but it can also affect occupied spaces. Disconnecting electrical power may remove an ignition source while simultaneously turning off equipment needed for detection or escape. Engineers must analyse these interactions and define an ordered response that leads toward the safest achievable condition.
The HSE’s guidance on emergency isolation (2) describes the role of automatic and remotely operated shut-off valves, operation from a safe location and fire-safe construction. Although the guidance is not limited to offshore facilities, its principles illustrate why valve location, actuation and failure position must be considered together.
Offshore wind installations present different hazards but require the same philosophy. A turbine protection system may detect excessive wind speed, vibration, generator faults, abnormal rotor speed or electrical problems. It can pitch the blades, apply braking, disconnect electrical systems or place the turbine in a controlled parked condition. Substations need protection, isolation and emergency power for essential services. Access systems, lifts, cranes and transfer equipment must also enter or maintain a safe condition when control power or communication fails.
Reliable work processes must reinforce hardware protection. Permit-to-work systems, energy isolation, lockout/tagout, lifting plans and access restrictions control activities that could defeat technical safeguards. A permit is not merely paperwork: it confirms that hazards have been assessed, isolations applied, responsibilities assigned and conflicting work identified. HSE guidance stresses that a permit-to-work system (3) supports, but does not replace, robust risk assessment.
An effective fail-safe process should make unsafe sequences difficult. For example, an access hatch should not be opened while hazardous machinery is moving; a turbine should not be returned to remote operation while technicians remain inside; and an isolated process section should not be repressurised until work permits and isolations have been reconciled.
Nevertheless, interlocks require careful management. Bypasses may be necessary for testing or maintenance, but every bypass weakens a barrier. It should therefore be authorised, visible, time-limited and removed before normal operation resumes.
Fail-safe functions also deteriorate. A valve may seize, a detector may become contaminated or a backup battery may lose capacity. Inspection, proof testing and preventive maintenance must demonstrate that the safety function actually works—not merely that the component is present (see also: emergency response kit for FPSOs). Testing should include the sensor, logic, actuator, power source and communication path wherever practicable.
Read more about emergency response training offshore!
Designing Offshore Work Around Human Error
Technical protection can fail if it assumes that every person will always interpret information correctly and perform the right action in the right order. Offshore crews work with complex systems, rotating shifts, changing contractors, noise, vibration and demanding environmental conditions. Fatigue and time pressure can further affect attention and judgement.
What is human error?
Human error is an unintended action or decision that produces, or could produce, an unwanted outcome. It includes slips and lapses during familiar tasks, mistakes caused by incorrect plans or assumptions, and context-dependent rule violations. Offshore, fatigue, noise, time pressure, confusing interfaces and incomplete information can increase its likelihood. Treating error as predictable allows designers to strengthen barriers, simplify decisions and prevent one imperfect action from escalating into a serious operational accident or emergency.
A foundational reference is James Reason’s book Human Error (4), which explains different error mechanisms and how organisational conditions contribute to accidents. The HSE similarly notes that human failure is not random and that understanding the factors behind it enables more effective controls (HSE: Managing human failures (5)).
Applying this knowledge means designing work around actual human capabilities. Controls should have consistent functions and clear labels. Displays should help operators distinguish normal conditions, warnings and urgent trips. Alarms should identify what has happened, where it occurred and what response is expected.
Too many alarms can be as dangerous as too few. During an escalating incident, hundreds of secondary warnings may follow the initiating event. If the interface gives each warning equal prominence, the operator must reconstruct the situation while under severe pressure. Alarm prioritisation, suppression of consequential alarms and clear presentation of the primary hazard reduce this burden.
Critical actions may require confirmation, but confirmation dialogues should not become automatic clicks that operators stop reading. More robust approaches include explicitly selecting the affected equipment, presenting the consequence of the action, and requiring independent verification where the risk justifies it.
Procedures should similarly support performance instead of shifting all responsibility to the user. They must be accessible, written in operational language and structured around decisions that people actually face. Important prerequisites and stop conditions should be obvious. During an emergency, short action cards or role-specific checklists are usually more usable than extensive manuals.
Fail-safe crew protection also includes preventing people from entering hazardous places. Electronic access control can check whether a worker has the required qualification and whether a permit is active. Location or presence information can warn when personnel remain in an area before machinery restarts. Such systems should provide a controlled override for exceptional situations, with authorisation and a reliable audit trail.
Technology must never create false certainty. A location system may show the last known position rather than a person’s current location. An access record confirms that someone passed a checkpoint, not necessarily that the person remains inside. Interfaces must reveal data age, uncertainty and system status so that decision-makers understand what is known and what still needs verification.
Optimising Emergency Management Through Fail Safe Design
Emergency management is where technical systems, human behaviour and organisational preparation converge. Its purpose is not simply to raise an alarm. It must detect the event, notify everyone at risk, control escalation, guide people toward safety, account for personnel, support rescue and maintain essential information as conditions change.
The UK’s Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations address detection, communication, emergency control, escape, and evacuation. The associated HSE guidance on PFEER (6) also covers the initiation and direction of emergency response and arrangements for early warning of major accidents. For offshore wind, the G+ Integrated Offshore Emergency Response guidelines (7) provide an industry approach to coordinating emergency arrangements across accountable organisations.
Detecting and communicating without delay
Fire, gas, process and environmental detection systems should initiate predefined responses where waiting for manual intervention would create unacceptable delay. Depending on the scenario, this may include shutdown, isolation, ventilation control, alarms and notification of the emergency-response organisation.
Notification needs multiple channels. Audible alarms may be masked by machinery or hearing protection. Visual signals may not be seen by someone working inside equipment. A worker climbing a turbine or handling tools may be unable to retrieve a telephone. Fixed alarms should therefore be supplemented by personal, hands-free devices capable of producing sound, light or vibration.Hands-free notification reduces the number of actions required from the recipient. The worker does not need to find a phone, unlock it, open an application and interpret a long message. A wearable can provide an immediate alert and, where supported, a short instruction such as evacuate, remain in place or proceed to the designated muster point.
The system should not depend on a single network. Local alarms, radio, public address, wearable notifications and resilient data connections can complement each other. Backup power should maintain life-safety functions when the main electrical supply is unavailable.
Designing for behaviour under stress
Emergency plans often assume orderly, rational behaviour. Real reactions are less predictable. A person may freeze, return for personal belongings, follow colleagues without checking the route or continue a familiar task despite an alarm. A contractor may not understand a site-specific signal. Smoke, darkness and noise can impair perception, while conflicting messages undermine trust.
Fail-safe emergency design reduces the need for interpretation. Alarm meanings should be consistent, instructions short and escape routes unmistakable. Emergency lighting and photoluminescent markings should remain effective after power loss or smoke development. Alternative routes must be identified because fire, flooding, structural damage or a hazardous gas cloud may block the normal route.Drills should test these complications rather than repeatedly rehearsing ideal conditions. Useful scenarios include loss of communications, an inaccessible muster point, missing contractors, disabled readers, conflicting location data or a casualty requiring assistance. The objective is to expose dependencies and practise recovery, not merely achieve a fast drill time.
Removing error from personnel accounting
Traditional mustering relies on printed personnel-on-board lists, handwritten registers, radio reports or supervisors calling names. These processes are vulnerable to outdated data, duplicate identities, misunderstood names and delayed reporting. Personnel may have changed work areas, transferred to another installation or boarded a vessel without the central list being updated.
Electronic mustering reduces these weaknesses by associating each person with a unique wearable credential. At a muster point, fixed or portable readers can register arrivals automatically without requiring workers to queue, present a card or operate a device. The emergency team receives a continually updated comparison between the persons expected and those confirmed safe.A useful display should answer four questions:
- Who is currently associated with the installation?
- Who has reached safety?
- Who remains unaccounted for?
- What reliable information exists about each missing person’s last known area?
The distinction between “not yet mustered” and “known to be in danger” is important. Failure to register may result from a damaged wearable, an unavailable reader or an alternative evacuation route. Electronic data should support judgement, not replace it.
Designing e-mustering to fail safely
An e-mustering system becomes a safety risk if it works only while every reader, network connection and central server remains available. A resilient design can store the current personnel list locally, operate muster points offline and synchronise records when connectivity returns. Battery-backed readers, portable devices and redundant communication paths reduce dependency on fixed infrastructure.
The interface should show device health, coverage gaps, timestamps and conflicting records. Emergency leaders must be able to add manual confirmations while preserving the difference between automatically detected and verbally reported status. A documented fallback—such as controlled manual accounting—remains necessary.
Hands-free e-mustering can also provide useful information before everyone reaches a muster station. Zone-level detection may indicate that a missing worker was recently present in a turbine, machinery space or accommodation area. That information can narrow a search and help responders avoid unnecessary exposure. However, location accuracy and latency must be understood, clearly displayed and included in drills.
Implementing and Sustaining Fail Safe Protection
Implementation begins by identifying credible failures rather than immediately selecting technology. Hazard identification, HAZOP, failure modes and effects analysis, bow-tie analysis and task analysis can reveal how technical faults and human actions might combine.
For every safety-critical function, the project team should define:
- The hazard being controlled.
- The required safe or survivable state.
- The initiating conditions and response time.
- The dependencies on power, sensing, software and communication.
- The consequences of false activation or failure to activate.
- How faults will be detected and communicated.
- How the function will be tested, restored and documented.
The analysis should include common-cause failures. Two identical sensors connected to the same power supply do not provide meaningful resilience against power loss. Two communication channels routed through the same network component can fail together. Physical separation, independent energy sources and technological diversity may therefore be necessary.
Design validation should involve the people who will use and maintain the system. Operators can identify awkward control sequences, technicians can reveal inaccessible test points, and emergency teams can assess whether information is understandable under pressure. This involvement is particularly important when oil and gas processes, wind assets, vessels and contractor systems interact.
The G+ Safe by Design guidance recommends assessing risk-reduction measures and considering how quickly emergency response or evacuation must be initiated as a hazard escalates. This highlights an important principle: a technically correct safeguard may still be inadequate if it responds too slowly.
Commissioning should test normal operation, component faults, loss of energy, communications failure and recovery. Emergency exercises should confirm that alarms reach people in different environments, personnel data remain accessible, and fallback procedures work. Findings from drills, incidents, near misses and maintenance should feed back into the design.
Fail safe design is therefore not a one-time engineering phase. It is a lifecycle discipline extending from concept selection through operation, modification and decommissioning. Its success depends on understanding how the system fails, making that failure visible, and ensuring equipment and personnel can move toward a controlled condition.
FAQ
What is the difference between fail safe design and redundancy?
Fail-safe design determines how a system behaves when something fails, ideally moving it to a safer condition. Redundancy adds alternative components or pathways so a function can continue after one component fails. A redundant system is not automatically fail-safe: duplicated components may share the same power supply, environment, software defect or communication network and therefore fail simultaneously.
Does fail safe always mean shutting equipment down?
No. Shutdown may safely isolate hydrocarbons or stop moving machinery, but other functions must remain available. Cooling, emergency lighting, fire detection, communications and personnel accounting may need fault-tolerant operation. The appropriate response can be isolation, controlled shutdown, continued operation or transition to a degraded mode, depending on the hazard analysis.
Can electronic mustering replace emergency drills and manual procedures?
No. E-mustering can accelerate personnel accounting and reduce transcription errors, but it cannot guarantee that every person follows instructions or that every device remains available. Drills are required to test behaviour, routes, equipment and command decisions. A controlled manual fallback should remain available for device, power or network failures.
Takeaway
Fail safe design accepts that equipment can fail and people can make mistakes, then prevents a single fault from escalating through safe states, independent barriers and recoverable processes. For offshore crews, e-Mustering extends this principle into emergency management: hands-free identification, automatic personnel accounting and resilient last-known-location data reduce manual errors and accelerate informed rescue decisions. At the same time, offline operation and tested fallback procedures preserve the function when infrastructure is degraded.
Delve deeper into one of our core topics: Emergency Response Management
Glossary
Human error is an unintended action or decision that produces, or could produce, an unwanted outcome. It includes slips and lapses during familiar tasks, mistakes caused by incorrect plans or assumptions, and context-dependent violations of rules. Offshore, fatigue, noise, time pressure, confusing interfaces and incomplete information can increase its likelihood. Treating error as predictable allows designers to strengthen barriers, simplify decisions and prevent one imperfect action from escalating into a serious operational accident or emergency. (8)
References:
(1) https://www.hse.gov.uk/comah/sragtech/techmeascontsyst.htm
(2) https://www.hse.gov.uk/comah/sragtech/techmeasisolatio.htm
(3) https://www.hse.gov.uk/humanfactors/topics/ptw.htm
(5) https://www.hse.gov.uk/humanfactors/topics/humanfail.htm
(6) https://www.hse.gov.uk/pubns/books/l65.htm
(8) James Reason, Human Error, Cambridge University Press, 1990.
Note: This article was partly created with the assistance of artificial intelligence to support drafting. The images were created by AI.
Related Articles
Related Product
