EERA for Offshore Oil & Gas Facilities: How to Prove Personnel Can Reach Safety

Summary: EERA—Evacuation, Escape and Rescue Analysis—tests whether offshore personnel can respond to a major accident, reach a suitable muster area or Temporary Refuge, and leave or escape the installation with a credible prospect of recovery and rescue. In the UK, PFEER regulation 5 requires this assessment and measurable performance standards for each credible scenario. It does not prescribe a standalone report, a universal ten-minute muster time, or a fixed sixty-minute Temporary Refuge endurance period.

When an Emergency Starts, Drawings Alone Are Not Proof

An alarm sounds on an offshore installation. A release may be escalating, smoke or toxic gas may be moving across access ways, and one or more routes may already be unavailable. At that point, personnel need more than arrows on a plot plan. They need an alarm they can recognise, a route that remains tenable, a place that remains safe long enough, and evacuation, escape, recovery and rescue arrangements that still function under the accident conditions.

That is the purpose of an Evacuation, Escape and Rescue Analysis, commonly shortened to EERA. A robust EERA does not simply confirm that routes, muster stations and survival craft exist. It tests whether the complete emergency response sequence can succeed for the people, hazards, layout and operating environment of the installation.

The standard of proof is not “the drawing shows a route.” It is a traceable demonstration that personnel can recognise the emergency, reach an appropriate muster area or Temporary Refuge before routes become untenable, remain protected while decisions are made, and evacuate or escape with a credible prospect of recovery and rescue.

Read: Offshore Safety Management– Why and How

What Is an EERA?

EERA stands for Evacuation, Escape and Rescue Analysis. In offshore practice, it is the structured assessment of the arrangements that protect personnel after a major accident has occurred or is developing. In the UK, the legal foundation is regulation 5 of PFEER, which requires the duty holder to perform, repeat as appropriate and keep a record of an assessment, including performance standards, for fire and explosion protection and effective evacuation, escape, recovery and rescue measures.

A useful distinction is that UK law requires the assessment, not a particular document title or format. The evidence may be presented as one EERA report, several linked technical studies, or material integrated into the Safety Case and supporting documents. What matters is completeness, traceability, measurable performance standards and evidence that the arrangements are suitable for foreseeable emergencies.

A competent EERA should answer four questions:

• Can personnel detect and understand the emergency, take the required immediate actions and reach a suitable muster area or refuge?
• Will the available routes and muster or refuge locations remain usable for long enough under the relevant accident scenarios?
• Can everyone be evacuated, or escape if systematic evacuation fails, including credible degraded or unavailable equipment cases?
• Can evacuees and escapees be recovered, and can persons in distress near the installation be rescued and taken to a place of safety?

Use the Terms Correctly: Muster, Temporary Refuge, Evacuation and Escape

Several terms are often blurred in EERA reports. That can hide a gap in the emergency strategy.

• A muster area is a designated place where personnel assemble and are accounted for. It may be within a Temporary Refuge, but the two are not automatically the same. Separate muster areas may be necessary for scenarios such as structural failure, loss of stability or impairment of the main refuge.
• A Temporary Refuge (TR) is a place designed to protect occupants from the external major-accident environment for a defined survival time. It supports command, accounting and preparation for evacuation or escape.
• Evacuation is the planned or systematic process of leaving the installation and being taken to a place of safety. The preferred means is installation-specific and may vary with the scenario.
• Escape is the last-resort means of leaving when systematic evacuation arrangements fail. It may expose personnel to the sea and therefore cannot be judged without recovery arrangements.
• Recovery and rescue complete the chain. Survival craft capacity or personal survival equipment is not enough if people cannot be recovered within the time and environmental limits assumed by the assessment.

The Three Operational Stages an EERA Must Test

1. Alarm, Response and Movement to Muster

The first stage begins before a person starts walking. The analysis should include alarm detection, alarm recognition, communications, immediate shutdown or make-safe duties, pre-movement delay, donning of emergency equipment, route selection and movement to the assigned muster location.

The route assessment should cover primary and alternative routes, doors and hatches, stairs, ladders, handrails, non-slip surfaces, emergency lighting, signage, congestion points, counterflow, vertical movement and access from isolated or intermittently occupied areas. It should also test scenario-dependent impairment from fire, smoke, toxic gas, explosion damage, flooding, dropped objects, structural deformation or loss of power.

The central test is not a generic travel distance. It is whether the required safe egress time—including pre-movement and queueing—remains below the available time before the route or destination becomes impaired, with an appropriate margin for uncertainty.

2. Muster and Temporary Refuge Protection

At muster, the installation must account for all persons on board, including contractors, visitors, personnel with emergency duties and people who may need assistance. The analysis should test capacity, access, communications, redundancy, command arrangements and the time required to identify missing personnel.

There is no universal ten-minute muster criterion in current UK HSE guidance or NORSOK Z-013:2024. A ten-minute target may exist in a company standard or a particular Safety Case, but it should not be presented as a general regulatory benchmark. The defensible criterion is the installation-specific time required to complete the relevant actions before routes, muster areas or the TR are impaired.

3. Evacuation, Escape, Recovery and Rescue

The evacuation strategy should define preferred and alternative means for each relevant scenario, together with the conditions under which each option remains available. Depending on the installation, this may include totally enclosed motor-propelled survival craft (TEMPSC), free-fall survival craft, davit-launched craft, helicopters for precautionary or controlled evacuation, life rafts or other escape systems.

The assessment should not assume that every system remains available. It should test credible loss of a launch station, fire or smoke at embarkation points, trim or list, degraded power, adverse weather and sea state, injured personnel, reduced crew availability and common-cause impairment. Helicopter evacuation should only be credited where mobilisation, transit, landing conditions and the accident development make it credible. Fast rescue craft, standby vessels and search-and-rescue resources primarily support recovery and rescue; they are not interchangeable with installation evacuation capacity.

For UK installations, HSE guidance expects preferred and alternative means with capacity for all personnel in reasonably foreseeable emergencies. The accompanying PFEER ACOP notes that, in most cases, the alternative sea-going provision will be TEMPSC and that 150% TEMPSC places are expected unless the Regulation 5 assessment justifies a different standard. This is UK-specific guidance, not a universal international rule.

What Regulations and Standards Drive the Assessment?

United Kingdom Continental Shelf

• The Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 (PFEER): Regulation 5 sets out the assessment and performance standards; regulations 14–17 address muster, evacuation, escape, recovery, and rescue.
• The Offshore Installations (Offshore Safety Directive) (Safety Case etc.) Regulations 2015 (SCR 2015): the Safety Case must demonstrate the management of major-accident hazards and describe the emergency response arrangements. Current Safety Cases are thoroughly reviewed at intervals not exceeding five years and revised when appropriate, including for material change.
• Current HSE Emergency Response and Temporary Refuge Integrity inspection guides: these explain what inspectors look for in performance standards, route and refuge endurance, evacuation, escape, recovery and rescue arrangements.

Norway and International Projects

• NORSOK Z-013:2024 provides a current framework for risk and emergency preparedness assessment. It is used to establish dimensioning of accidental events, response strategies and emergency performance requirements; those requirements remain installation-specific.
• ISO 15544:2024 specifies objectives, functional requirements and guidelines for emergency response on fixed offshore structures and floating production, storage and offloading systems.
• ISO 13702:2024 addresses control and mitigation of fire and explosion hazards on offshore production installations and is relevant to the accident loads and impairment conditions used in EERA.

The applicable hierarchy must be confirmed for the jurisdiction, installation type, flag or coastal-state requirements, class rules and company standards. Mobile offshore units may also be governed by IMO, flag-state and coastal-state requirements that differ from fixed production installations.

United States Gulf of Mexico

For US Outer Continental Shelf operations, avoid presenting API RP 75 or IADC guidance as a direct legal requirement to produce an “EERA.” BSEE’s Safety and Environmental Management Systems requirements are contained in 30 CFR Part 250 Subpart S, with API RP 75 incorporated in the regulatory framework and other USCG or marine requirements applying as relevant. IADC HSE Case guidance can support good practice, particularly for mobile units, but is not itself a regulation.

How to Conduct a Defensible EERA — Step by Step

1. Define the installation, operating modes and POB basis — Set the physical boundary, maximum and normal personnel on board, occupancy by area and shift, contractors and visitors, temporary work sites, combined operations, shutdown or maintenance modes, and any personnel who may require assistance.
2. Establish the major-accident scenario set — Use the Safety Case hazard register, QRA, fire and explosion analysis, dispersion studies, HAZID/HAZOP outputs and operational experience. Include more than hydrocarbon fires and explosions where relevant: toxic or asphyxiant releases, non-process fires, structural failure, flooding or loss of stability, ship or aircraft impact, dropped objects, extreme weather, loss of utilities and simultaneous or common-cause events.
3. Define performance standards and acceptance criteria before calculating — Specify functionality, reliability, availability and survivability requirements for alarms, communications, routes, lighting, muster areas, the TR, evacuation systems, personal survival equipment and recovery/rescue resources. Define impairment criteria, time criteria and required margins. Do not select a generic ten- or sixty-minute value simply because it is familiar.
4. Verify the as-built condition — Perform a physical walkdown supported by current drawings, laser scan or 3D model where available. Check doors, hatches, temporary obstructions, gratings, handrails, signage, lighting, access control, dropped-object exposure, fire doors, weather protection and the effect of maintenance or simultaneous operations. Record photographs and action owners.
5. Build the personnel response and movement model — Estimate required safe egress time using scenario-appropriate pre-movement, donning, horizontal movement, stair or ladder movement, congestion, counterflow, queueing, accounting and assistance assumptions. A single 1.2 m/s walking speed is not enough. Movement data should be selected for each route element and population, then sensitivity-tested and compared with drill evidence.
6. Determine route and destination tenability — Use fire, smoke, toxic-gas, explosion and structural analyses to establish when each route, muster area, refuge intake, embarkation point or launch station becomes unavailable. Compare the required time with the available safe time for each scenario and occupancy group, including alternative routes and uncertainty margins.
7. Assess muster and Temporary Refuge integrity — Demonstrate capacity, accounting, command, communications and survivability. The TR assessment should address structural response, blast and fire resistance, smoke and toxic-gas ingress, HVAC isolation or other protective mode, air-change/leakage performance, internal heat and humidity, oxygen depletion and carbon-dioxide build-up, door opening, internal fire, loss of power and the endurance of critical systems.

8. Test evacuation and escape systems — Assess location, access, capacity, boarding and launch time, operating limits, weather and sea state, trim/list, casualty handling, crew competence, degraded availability and common-cause failure. Do not credit repeated lifeboat “shuttle” cycles unless the concept is specifically designed, demonstrated and accepted; survival craft are normally assessed as one-way emergency systems.
9. Demonstrate recovery and rescue — Show how people in survival craft, life rafts or the sea will be located, approached, recovered, treated and taken to safety. Confirm response times, operating limits, availability, capacity, interfaces and communications for installation-based craft, standby vessels, aviation or external search-and-rescue resources. Survival time assumptions must exceed the credible time to recovery with suitable margin.
10. Validate, close gaps and keep the analysis live — Compare calculations with muster and evacuation drills, exercise observations, equipment tests and operating experience. Track assumptions, uncertainties, recommendations, compensating measures and closure evidence. Trigger review through Management of Change and after relevant incidents, drills, POB or layout changes, equipment changes and Safety Case reviews.

Temporary Refuge Integrity: Use a Demonstrated Survival Time, Not a Generic Hour

The original draft’s reference to a “commonly referenced” 60-minute TR endurance should be removed. Current HSE guidance requires the duty holder to define a TR survival time and demonstrate that it is realistic for the installation’s major-accident hazard profile. The time must be commensurate with the time needed to complete evacuation or escape; scenarios that could impair the TR earlier must be recognised in the emergency response plan.

A complete TR integrity demonstration should address:

• Structural survivability against the defined accidental loads, including blast, fire, impact and—where applicable—loss of stability or structural support.
• External fire and heat exposure, passive fire protection, penetrations and the endurance of boundaries, doors and windows.
• Smoke, flammable and toxic-gas ingress. HVAC may isolate, shut down, pressurise, recirculate or use another protective mode; the correct response depends on the design and performance standard. The timing and reliability of detection and isolation are critical.
• Internal habitability: occupancy, oxygen, carbon dioxide, temperature, humidity, smoke from internal incidents and the effect of door opening during muster or evacuation.
• Availability of emergency power, lighting, communications, control and accounting functions for the claimed survival time.
• The link to evacuation and escape: a TR endurance claim is not meaningful unless the complete sequence can be finished within that time under the scenario being credited.

What Genuine Proof Looks Like

A defensible EERA is an evidence chain, not a narrative assurance. Strong studies normally contain the following:

• A scenario-to-safeguard traceability matrix showing which hazards challenge each route, muster location, TR boundary, launch station and recovery arrangement.
• As-built walkdown records with dated photographs, drawings, route dimensions, obstruction findings and close-out evidence.
• Time-based calculations that include alarm recognition, pre-movement, donning, travel, congestion, accounting, boarding, launch and recovery—not travel time alone.
• Fire, smoke, toxic-gas, explosion or structural outputs that establish route and refuge impairment times and explain modelling assumptions and uncertainty.
• Drill and exercise data used to validate the calculation model, including the slowest credible groups and degraded communications or route scenarios.
• Capacity and availability analysis for evacuation, escape, recovery and rescue systems, including credible equipment unavailability and environmental operating limits.
• A controlled action register that converts findings into design changes, maintenance, operational restrictions, procedures, training, drills or compensating measures.

Common EERA Failures—and How to Avoid Them

1. Treating the design-stage study as permanent — Facilities change. New equipment, temporary scaffolding, changed access control, additional beds, altered POB or revised hazard inventories can invalidate the original conclusion. Link EERA review triggers to Management of Change and assurance processes.
2. Using familiar numbers without a source — A ten-minute muster target, sixty-minute TR endurance or one walking speed may look precise but can be technically weak. Use scenario-specific performance requirements and cite the basis for every key assumption.
3. Calculating travel time instead of emergency response time — Personnel do not move at the instant an alarm starts. Include recognition, decision, worksite make-safe duties, PPE, route selection, queues, accounting and preparation to board or launch.
4. Assuming the main route and main TR always survive — The assessment should identify alternative routes and destinations and test common-cause impairment. A main TR may not be appropriate for every structural, stability or toxic-gas scenario.
5. Treating TR leakage testing as the whole integrity assessment — Air leakage is only one input. Structural, thermal, toxicological, HVAC, power, occupancy and duration performance must be integrated.
6. Crediting evacuation without credible recovery — Life rafts, personal survival equipment or escape to sea are not complete safeguards unless recovery can occur within the stated survivability limits and environmental conditions.
7. Disconnecting EERA, QRA, ERP and performance standards — The scenario set, accident development, emergency actions and equipment performance assumptions should be consistent across the Safety Case, QRA, fire and explosion analysis, TR study, EERA, Emergency Response Plan and verification scheme.

How EERA Connects to the QRA, Safety Case and Emergency Response Plan

The QRA and supporting consequence studies identify the major-accident scenarios, frequencies, effects and potential escalation that challenge personnel protection. EERA translates that hazard picture into time-dependent emergency-response demands: where people are, what actions they must take, which routes and destinations remain available, and how evacuation, escape, recovery and rescue will be achieved.

For UKCS facilities, the Regulation 5 assessment and performance standards support the Safety Case demonstration and the emergency response arrangements. The Emergency Response Plan should use the EERA outputs: alarm actions, scenario-dependent muster strategy, decision points, evacuation hierarchy, escape provisions, recovery interfaces, communications and contingencies. Safety and environmental-critical elements and their verification or assurance arrangements should be consistent with the EERA performance claims.

The result should be a maintained operational control document—not a report produced once for design approval. Current Safety Cases must undergo thorough review at intervals not exceeding five years, while the PFEER assessment itself must be repeated as often as appropriate. Material changes and evidence from drills, incidents or equipment impairment may require earlier review.