Emergency lighting on offshore installations
SPC/TECH/OSD/40
Purpose
The purpose of this SPC is to inform OSD Inspectors of inspection and assessment criteria for the functional aspects of emergency lighting systems and illuminated safety signs on offshore installations. Helideck lighting, derrick lighting, TEMPSC internal lighting, etc are excluded from the scope of this SPC, as they are not normal emergency lighting.
There are two aspects to this SPC:
- basic design functional requirements; and
- operational requirements.
The main emphasis of this document is on the effective delivery of the illumination function in the event of failure of main lighting. Potential illumination issues which are not common problems, eg glare, contrast, are addressed only briefly, or not at all. Other issues not directly related to the illumination function, for example IP rating, Ex certification, electric shock hazards, etc, are out with the primary scope of this document and so are addressed only briefly, or not at all.
Background
During offshore inspections, it has been noted that emergency lighting often fails when called upon. A failure rate of 40%+ of fittings is not unusual; typical failures relate to battery supplies. Such a high failure rate calls into question the operability of the system; failures could lead to personnel panicking and being unable to escape to a place of safety during an emergency, or being unable to attend to emergency tasks.
Action required by OSD inspectors
OSD inspectors should consider the use of this guidance in offshore inspection work, in particular noting operational issues such as emergency lighting outages and the management thereof. Equally, OSD Inspectors carrying out assessment of new designs or Safety Cases should consider the use of this guidance in their assessments.
Please see Appendix 1 for Regulatory requirements and Appendix 2 for Technical details.
Further Information
For further information relating to this circular, please contact OSD3.5 or OSD3.3.
Appendix 1 – Regulatory Requirements
The main specific legislation on offshore emergency lighting is to be found in PFEER, with SCR05 also relevant. Note that some requirements are expressed in terms of a major accident and others in terms of an emergency.
Although there is some degree of overlap, the exact definitions are important in any enforcement action.
PFEER Regulation 12 (b)(ii) requires that measures provided with a view to limiting the extent of an emergency should be capable of remaining effective in an emergency, so far as is reasonably practicable; this may include emergency lighting.
In the context of an emergency, Regulation 14(2) requires the following areas to be provided with 'adequate emergency lighting' and marked with 'suitable signs':
- Egress from accommodation and work areas
- Access to muster areas
- Access to temporary refuge
- Access to evacuation and escape points
- Evacuation and escape points
In the context of an emergency, PFEER Regulation 14(2) also requires that muster areas, egress, access and evacuation points and escape points be marked with suitable signs. Regulation 14 does not require that these signs be internally illuminated; these areas must have area wide illumination, which should render signs visible. However, in practice safety signs are often internally illuminated by normal and/or emergency illumination arrangements.
Emergency lighting and safety signs generally satisfy the SCR05 definition of Safety Critical Elements (SCEs), since the overall aims are:
- To facilitate correct operation of the installation (eg to facilitate the timely starting of additional power generation) when systems including main lighting fail, thus preventing a major accident, or eliminating a potential cause or substantial contribution to a major accident;
- To allow personnel to intervene effectively in the development of a major accident (eg by the timely starting of fire pumps) thus limiting the effects;
- To facilitate personnel escape from an accidental event (eg by mustering in a timely manner), thus limiting the effects; and
- To facilitate evacuation or escape of persons from the installation, thus limiting the effects of the major accident.
So, in each situation where there is the potential for the accidental event to be a major accident as defined in SCR05, the relevant emergency lighting or safety signs are SCEs, and come within the scope of verification.
SCR05 define an additional class of equipment called 'specified plant', which is subject to similar requirements to safety critical elements. Specified plant may include emergency lighting and safety signs provided to satisfy PFEER Regulations 15 and 16, eg lighting to assist evacuation or escape, which does not invoke the concept of major accident. For emergency lighting, which is neither SCE nor specified plant, the relevant performance standards derive from PFEER Regulation 5. This requires appropriate standards of performance to be attained by anything provided by measures (a) for ensuring effective evacuation and escape to avoid or minimise a major accident; and (b) for protecting persons from a major accident involving fire or explosion (but not other major accidents).
Enforcement action in relation to inadequate emergency lighting and signs, or inadequate management arrangements in relation thereto, should be taken under specific PFEER legislation where applicable. Enforcement under SCR05 can be used for emergency lighting or safety signs which are not included in the specific PFEER requirements. This might include for example the Control Room or Radio Room, where these are not considered to be PFEER Regulation 14(2) egress or access, evacuation and escape points, or muster areas.
Para 182 of the ACOP to PFEER indicates that a portable light source should be included as an item of personal protective equipment; PFEER Regulation 18 requires a written scheme of examination for such PPE.
SCR05 Schedules 2 and 3 require a description in relevant Safety Cases of how the duty holder has ensured, or will ensure, the suitability of the safety critical elements, including some emergency lighting and safety signs, as discussed above.
Appendix 2 – Technical Details
Definitions
Maintained lighting – lighting which is energised at all times.
Non-maintained lighting – lighting which is in operation only when the electrical supply to the normal lighting fails.
Combined luminaries - these contain both the normal lamps plus the emergency lamps (whether maintained or non-maintained) within a single luminaire fitting.
Lighting Basics
The luminous intensity of a source of light is measured in candela (cd, also known as the international candle). The cd is defined as the luminous intensity of monochromatic 540 terahertz (THz) light (where the eye is most sensitive) at a radiant intensity on 1/683 watts per steradian (the steradian is the unit of solid angle, about 12.6 per sphere). The factor 1/683 was chosen so that the candela is approximately equivalent to the luminous intensity of a typical candle, because early work on light was based on the luminous intensity of a small flame.
The luminous flux (also called luminous power) of the source is the total power emitted in all directions, weighted for eye sensitivity, for which the unit is lumen (candela.steradian).
Incident light (called illuminance) on a surface enables people to see that surface, so lighting performance standards are defined in terms of illuminance. Illuminance depends on the area over which the luminous flux falls. The unit of illuminance is the lux (lx or lux), and is lumens/m2.
To give a feel for illuminance, full daylight is about 10,000 lx, a very dark day about 100 lx, and full moonlight about 0.1 lx. Indoor illuminances are much lower than full daylight, and the Application Guide2 indicates normal lighting on offshore installations in the range 50 to 500 lx, depending on the type of area. An illuminance as low as 0.1 lx can be adequate to allow personnel to find their way about. These indications place the minimum levels of illumination recommended by EN18386 into context, ie as low as 0.2 lx on the centre line of escape routes, 0.5 lx open area (anti panic) lighting, 5 lx at first aid posts or firefighting posts, and at least 10% of normal with a minimum of 15 lx in high risk task areas or intensive activity areas.
Note that the visibility of a surface depends on a number of other factors discussed in standards, eg glare, contrast, surface finish, uniformity of illumination, diversity (ie ratio maximum/minimum illuminance), etc, but there is little evidence of significant offshore problems in these areas.
In the case of internally illuminated safety signs, personnel look towards the source rather than at its incident light on other surfaces. The brightness of such a source (also called its luminance) depends on the size of the source as well as its luminous intensity, so the units are cd/m2, and this is the relevant performance measure for safety signs. BS5499-39 recommends a minimum luminance of 2 cd/m2 for internally illuminated signs, and BS5499-210 recommends the lower level of 0.51cd/m2 for self luminous (eg tritium) signs.
To give a feel for luminance, the luminous intensity of a typical candle is approximately 1 cd – imagine that illuminating an 0.5m2 sign (this is 2cd/m2).
Required Level of Illumination
In practice, some form of emergency lighting arrangement is required in any area which is or can be staffed, in order to allow effective and timely emergency response activities or escape (but not normal operations); the relevant areas include both internal areas such as enclosed modules, and external areas such as walkways and bridges. The minimum level of illumination required is different according to the nature of activities envisaged in the area. Response time when power input fails and endurance time when normal power fails are also important performance measures.
For general areas, sufficient illumination simply to escape (eg to the temporary refuge) is sufficient. Such escape lighting should give adequate visual conditions to allow occupants to reach designated escape routes from anywhere within that general area, and for this purpose a minimum of 0.5 lx within the general area is recommended by EN18386. Illuminated directional signs (or a series of signs) should guide personnel towards the emergency exit. Small enclosed storage areas such as cupboards, where there is no realistic prospect of personnel being unable to escape, do not require emergency lighting. Larger storage areas where there is a possibility of personnel being trapped in darkness should be equipped with emergency lighting and safety signs which fully meet the other requirements of the standards and this document (eg this could mean a minimum of two luminaires). An endurance of 1 hour is recommended by EN18386, for escape purposes; a response of 50% in 5 sec and 100% within 60 sec is also recommended, except for high risk areas, where 0.5 sec is recommended.
Floor level lighting may be appropriate in some circumstances, eg along corridors which may become smoke logged (smoke tends to rise to ceiling level, so that low level illumination is more useful).
For safe movement along defined escape routes, an average illuminance of 1 lx is recommended by EN18386. However, EN18386. allows a deviation for the UK of a minimum of 0.2 lx on the centre line of the escape route, with at least 50% of a 2m wide escape route lit to a minimum of 0.1 lx. Directional signs are required along the escape route. EN18386 requires a response of at least 50% of the specified illuminance within 5 sec and 100% within 60 sec; however, a deviation for the UK of 15 sec is allowed where most of the occupants are familiar with the premises and escape routes (note that this will not in general apply to the peripatetic offshore workforce, so this deviation is not relevant to most offshore installations). An endurance of 1 hour is recommended by EN18386; a response of 50% in 5 sec and 100% within 60 sec is also recommended, except for high risk areas, where 0.5 sec is recommended.
For other areas, higher levels of illumination will be required to allow the foreseeable (rather more complex) emergency activities in those places. EN18386 requires 5 lx near first aid posts, fire fighting equipment, and call points.
For MODUs, IMO8 recommends a 5 lx level of emergency lighting (with commensurate signage) in such areas as:
- Lifeboat embarkation point
- Helideck access
- Fire/sprinkler pump area
High risk task areas require a yet higher level of illuminance to allow effective emergency activities, and 10% of normal, with a minimum of 15 lx, is recommended by EN18386. A response time of 0.5 sec is also recommended; this can normally be achieved only by tungsten filament lamps or maintained fluorescent lamps. Possible examples of high risk task areas given in IMO8 are:
- Stowage points for Emergency Response Teams and equipment
- Radio room/CCR/control point
- Alternative muster/control/etc points
Endurance is required to be as long as is required by the tasks envisaged in that area (EN18386).
Cabins will be in darkness when personnel are asleep, so some provision should be made for emergency signage or (non maintained) lighting to allow escape into the corridor, which must be illuminated as it represents the 'safe egress from accommodation' mentioned in PFEER Regulation 14 (and signage should be provided in the corridors to show the routes to muster points). Note that in practice, this requirement is often addressed with only one emergency luminaire per cabin plus a safety sign indicating the exit route, and where either of these fails, the performance standard will not be met – this failure will need urgent action, either to repair the luminaire/sign or to take the cabin out of service.
On older installations, where fixed emergency lighting is not provided in sleeping cabins and the PFEER requirement is addressed with a torch or light stick, its storage location will need to be visible in darkness, eg by self illuminated signage. Such torches or light sticks should be accessible to the occupant of the top bunk to avoid the possibility of a fall from the top bunk during darkness. Alternatively, it may be that light leakage from the corridor via small gaps around the door may provide useful visual cues – however, if this is advanced as a formal argument; some means of guaranteeing such light leakage would be required. These arrangements are less than ideal, and cannot be accepted if there is an opportunity to improve matters – so when accommodation is being refurbished (or newly built), fully engineered electric emergency lighting and safety signs should be installed.
The above discussion concerns escape lighting and lighting to accommodate emergency tasks during an outage of main lighting. There may exist a requirement for lighting of special tasks (eg in a confined environment) to allow them to be completed safely; no further guidance can be offered because of the variety of these tasks. Such special lighting is not 'emergency lighting' in the normal sense, but may raise some of the same issues, in particular continuity of supply where loss of that lighting function could expose workers to danger. Such lighting failure should be addressed in the normal task risk assessment.
Source of Power
Emergency lighting is normally powered from the emergency switchboard; this is usually powered from main generation via the main switchboard, but is powered by emergency generation when main generation fails. As an alternative to a prime mover source of power, a central battery supply (UPS) or local battery within each luminaire may be provided, trickle charged from main or emergency generation, and the performance standards then apply to this battery arrangement, not to the prime mover. Where no battery backed supply is provided, the prime mover power supply arrangements should be such that a fire or other incident in main generation does not render emergency generation inoperative, and vice versa (IMO8). Where emergency generation may take longer than acceptable to re-establish the supply to the emergency lighting system (eg longer than 45 sec, IMO8), a transitional battery supply should be provided; IMO8 suggests that for MODUs it should be designed to last 30 min. The emergency source of power (typically emergency generation) on MODUs should be capable of supplying inter alia the emergency lighting for 1 hours (IMO8). Note that other emergency systems may be connected to the emergency switchboard or central battery/UPS supply.
Some luminaries contain a (trickle charged) battery pack and are autonomous; in high risk task areas they should take no longer than 5 seconds to achieve 50% rated light output after switching to battery mode, and no longer than 60 sec to achieve 100% output (see EN18386 and BS60598-2-2211).
Some battery powered emergency lighting systems have a 'rest mode' to inhibit them when the incoming power supply fails but the emergency lighting function is not needed, eg when the area is unoccupied and completely out of use; this arrangement conserves battery capacity (see BS60598-2-2211). The system should revert to normal mode of operation when the normal power supply is restored. Such systems are rare offshore and are not recommended, because of the potential for maloperation.
Internally illuminated safety signs should have two internal illumination systems (eg one powered from the main power supply and one powered from the emergency power supply), or alternatively one internal illumination system, and another external system, eg the area-wide emergency lighting system should illuminate the sign at a satisfactory level.
Tritium powered signs are self powered, and do not need any form of electrical supply, though note that there is a disposal problem. Photoluminescent signs are energised by previous illumination, and require no electrical input.
Design Issues
Detailed design issues are touched upon only briefly in this SPC, but any obvious vulnerability as regards fire rating of cables, their mechanical protection, IP rating, etc might warrant further investigation.
Emergency lighting should be designed to be testable, by allowing simulation of power failure. The main issue is with battery powered systems. Full discharge battery tests create vulnerability if a real incident occurs whilst the batteries are being discharged or recharged. This situation can be ameliorated by arranging luminaries such that alternate luminaries can be tested separately, by a dual battery arrangement, or by a 2/3 discharge test with a check on battery voltage at the end of the test to determine residual battery capacity (BS EN 6203412).
Institute of Petroleum Part 1513 raises the issue of large but infrequent releases, and suggests that where such releases are possible, it may be appropriate for zone 1 areas to be surrounded by a Zone 2 rather than a safe area. There is a similar issue with regard to Zone 2 hazardous areas and their Ex certified apparatus; the definition of Zone 2 revolves around typical disturbances from normal operation, so that the flammable atmosphere is present only for short (undefined) periods which total no more than 10 hours per year (see Ref 13). An emergency in the PFEER sense is likely to be a much larger and longer lasting event, beyond the design accidental event, where the release may extend beyond Zone 2 areas and encroach on safe areas and on the TR boundaries. Thus it will generally be prudent to use Ex certified luminaires (and associated junction boxes, etc) in all outside areas classified as safe and in all inside safe areas (such as utility modules) which may contain flammable gas during large-scale emergencies; this may not apply within the TR since there are other measures to ensure that a flammable atmosphere cannot accumulate.
Changes to plant layout, the installation of any form of partition, or anything which can obstruct illumination or the visibility of emergency signs (in each case, whether temporary or permanent) can change the requirements for emergency lighting or emergency signs. These facilities should therefore be addressed as part of the change control procedure.
Operational Issues
In view of the very large number of light fittings on a typical installation, it is possible that at any one time a small number of them will not be in full working order. Thus the installed coverage pattern should allow the performance standard to be met even where an individual fitting in a given zone has failed (so that a single failure does not cause a failure of the emergency illumination function to meet its performance standard). A maximum number of failed fittings per zone should be specified in the performance standard so that alternative precautions can be put in place should too many fittings fail in a particular zone (eg to evacuate the affected zone); this number of failed fittings may vary according to the particular area. BS52661 recommends that the illuminance requirement be satisfied with a large number of lower power luminaries rather than few higher power units, so that no part of an escape route is lit by just one luminaire, and if one luminaire fails, no part of the escape route is plunged into darkness.
On older installations, obsolescence and availability of spares can be an issue. It is an acceptable practice to replace luminaries which are no longer supported by the manufacturer only when they fail, and then to cannibalise the failed unit for operable spares.
Most types of lamp suffer from degradation of luminous flux through time, and a maintenance factor may be used to quantify that fall off; this will feed into the design to inform luminaire spacing and routine replacement/relamping interval. Lamp failure can also occur, and a lamp survival factor is used to describe this phenomenon; the lamp change interval should be chosen to achieve a sufficiently high lamp survival factor which is then used in the design to inform luminaire spacing. Note that dirt will tend to obscure the luminaire, which therefore requires to be cleaned so as to maintain an acceptable light output, and periodic routine cleaning should be specified and carried out as appropriate.
Ex rated emergency lighting should receive its Ex scheduled maintenance as determined by the Ex maintenance strategy. Note that fluorescent lamps tend to heat up as they approach their end of life condition, and this can violate the luminaire 'T' rating. This is a factor which should be considered in the relamping strategy.
Inspection questions and activities
Are sufficient areas provided with emergency lighting, and are these categorised as SCEs if appropriate? For example, is there SCE categorised lighting in areas such as the Control Room or Radio Room? Has the ICP been involved in oversight of the design and ongoing maintenance? What feedback has been received from the ICP? Note that the requirements of SCR05 Schedule 7 apply, including periodic examination and testing, remedial action and record keeping.
Does the coverage of luminaries give adequate illumination, including the situation where one or more luminaries have failed? Does the performance standard specify the maximum number of failed luminaries at each location which can be tolerated without putting alternative safeguards in place? Does the performance standard specify the minimum endurance time of the emergency lighting?
Is there any TA oversight of luminaire failure rates and other performance issues such as battery performance?
Where torches are provided in cabins to satisfy PFEER Regulation 18/para 182, a written scheme of examination and testing must be prepared and operated, and the results recorded (PFEER Regulation 18). If the torch is the recognised emergency lighting facility in sleeping cabins, is it visible in darkness? Is there a practical opportunity to install a fixed electric emergency lighting and emergency sign system?
Periodic routine maintenance, inspection and testing should be scheduled as defined by the TA or manufacturer, and as required to achieve the defined performance standard. This routine work will include:
- Engine driven supplies should be checked to ensure that they successfully supply the emergency lights (this will usually be done anyway for other reasons)
- Confirmation of (central) battery charging (this will usually be done anyway for other reasons)
- Short duration test to verify that all luminaires are working.
- Full duration test of batteries (the impact of time to recharge batteries to be minimised, eg by testing alternate luminaires). A 2/3 discharge test with a check on battery performance may be preferable, see BS EN 620341212.
Note that batteries have a finite service life, and should be replaced as required. For example, some lead acid batteries may have a satisfactory service life in the region of 5 years at normal ambient temperature, shorter at high temperature15.
Much can be achieved by a simple walk around inspection, with a closer external examination of some fittings for corrosion, signs of water ingress, etc. Signs should also be included in this inspection, as they can be obscured, damaged, or missing; sometimes signs have not been updated when other changes have taken place, eg might direct personnel to lifeboats which have been removed. An internal examination of luminaires or illuminated signs is probing, but is out with the scope of normal HSE inspection activity.
Request the duty holder to activate sample sections of emergency lighting, after checking with the duty holder as to which areas of emergency lighting can reasonably be isolated and then activated for test purposes; this may require access to drawings showing layout etc, and the existence/correctness of these drawings is in itself a useful inspection topic (also check that the luminaires in a given area are on more than one circuit, as appropriate). If in doubt about how to test emergency lighting, consult OSD3.5 prior to the inspection. Illuminance can be assessed subjectively, as the minimum level defined in standards is in itself a subjective judgement. Compare the number and location of luminaires found to be failed with the duty holders performance standard for number of luminaires which can fail without compromising the required minimum emergency lighting.
Safety Case Assessment
The Case should demonstrate that the emergency lighting function has been considered, that performance standards have been established, that its power supply arrangements are adequate, and that its in-service performance is monitored.
SCR05 Schedules 2 and 3 require a description of how the duty holder has ensured, or will ensure, the suitability of the Safety Critical Elements. Emergency lighting will often be an SCE in some areas, so the case should demonstrate that the emergency lighting system has been designed to the relevant standards listed in the Safety Case reference section, whether published standards or the duty holder's own standards.
References
Note – where references are undated, the latest published edition applies
- BS 5266 Emergency Lighting. Back to reference of footnote 1
- Application Guide – Lighting in Hostile and Hazardous Environments – The Chartered Institute of Building Services 1983, ISBN 0 90095326 8. Back to reference of footnote 2
- Lighting Guide 12: Emergency Lighting Design Guide - The Society of Light and Lighting 2004, ISBN 1 903287 51 0
- International Convention on the Safety of Life at Sea – SOLAS
- BS IEC 61892 Mobile and Fixed Offshore Units – Electrical Installations
- EN1838 Lighting Application – Emergency Lighting. Back to reference of footnote 6
- BS EN 50172 Emergency Escape Lighting Systems
- IMO Code for the Construction and Equipment of Mobile Offshore Drilling Units. Back to reference of footnote 8
- BS 5499-3: Specification for Internally Illuminated Fire Safety Signs. Back to reference of footnote 9
- BS 5499-2: Specification for Self Luminous Fire Safety Signs. Back to reference of footnote 10
- BS 60598-2-22 - Luminaries – Particular Requirements For Emergency Lighting
- BS EN 62034 Automatic Test Systems for Battery Powered Emergency Escape Lighting. Back to reference of footnote 12
- Area classification code for installations handling flammable fluids
Part15. Institute of Petroleum, 2nd Edition August 2002. Back to reference of footnote 13 - 14. AP 437 Offshore Helicopter Landing Areas – Guidance on Standards, Civil Aviation Authority.
- Information from the IBT website .Back to reference of footnote 15