Process Safety · Lesson 46 · 8 min read

A Temporary Refuge Only Protects While Its Environment Remains Tenable

A temporary refuge is not simply a room where people gather. It is a major-accident barrier that must keep its occupants able to think, communicate and prepare for evacuation while fire, smoke, heat or hazardous gas may be outside. If the enclosure or supporting systems cannot maintain a tenable environment, the refuge may lose its protective purpose before evacuation is possible.

The barrier is a tenable environment

A temporary refuge, often incorporating the control room and accommodation, gives people a protected place during a developing offshore emergency. Its safety claim may include resistance to heat and blast, limitation of smoke and gas ingress, breathable air, communications, emergency command facilities and enough endurance for the installation's response and evacuation plan.

The protection can be degraded by small physical defects. A damaged door seal, open door, unsealed cable penetration, leaking window, missing cladding or failed water seal can increase air leakage. HVAC dampers may not close, detectors may not identify contamination at the intake, or control logic and power may be unavailable. Heat can also impair occupants even if smoke and gas remain outside.

A pressurisation or leakage test is therefore useful evidence about enclosure condition, but it is not proof of the complete survival claim. The result must be considered with the hazard assessment, HVAC response, structural and passive-fire protection, emergency utilities, occupancy and the time needed to manage and escape the event.

HSE guidance: integrity is more than one test result

HSE's current offshore inspection guide says temporary-refuge survivability should increase with the potential severity of major-hazard exposure. It identifies doors, seals, windows, penetrations, the external surface, HVAC, detection, shutdown and information to emergency managers as parts of the safety-critical function. The guide also explains that a pressurisation test can reveal enclosure porosity and support degradation trending, but does not by itself prove survivability and endurance against every major-accident hazard.

HSE's PFEER guidance requires the refuge survival time to be adequately defined and supported by suitable performance criteria and testing. Events that could compromise integrity within that time should be identified and addressed in the emergency response plan.

Recent official findings show how the barrier can degrade

HSE enforcement records provide practical examples. A 2025 notice concerning Seafox 4 recorded that positive pressure was not maintained during normal operation, an earlier integrity test had failed and no action had been taken at the time identified by HSE. Another 2025 notice concerning Tartan A described missing external cladding, waterlogged insulation, water ingress and a significant integrity-test failure that had not yet been repaired and retested when inspected. Both notices were later recorded as complied with.

These findings are not evidence about any other installation and their site-specific performance criteria must not be copied elsewhere. Their wider lesson is that enclosure condition, test results and restoration actions need active ownership. A known defect cannot be treated as paperwork only when it affects the place intended to protect everyone during a major event.

Hypothetical FPSO example: a small penetration defeats the claim

Hypothetical example—not a documented incident: After communications work on an FPSO, a temporary cable remains routed through a refuge doorway. The door appears closed but cannot fully seat against its seal. During an authorised drill, the HVAC changes to its emergency mode after an intake alarm, yet the refuge pressure trend does not respond as expected.

The team declares the affected function impaired, checks the approved emergency and operating restrictions, removes the temporary routing, restores the boundary and repeats the required functional tests. They also inspect similar penetrations and review why the work control and handback process did not protect a safety-critical element. This example supplies no universal leakage limit, survival time or permission to continue operations with an impaired refuge.

Critical controls

Define the performance claim. Connect the refuge survival time and tenability criteria to credible fire, explosion, smoke, toxic and asphyxiating-gas scenarios. Include occupancy, incident management and evacuation timing.

Protect the enclosure. Inspect and maintain doors, seals, windows, cladding, penetrations, glands, drains and water seals. Temporary cables, hoses or work openings need authorised arrangements that do not silently bypass the boundary.

Prove the HVAC response. Verify intake detection, alarms, fan and damper actions, emergency modes, power supplies and control-room indications as a complete function. Confirm that the test demonstrates the intended response rather than only a local component.

Manage impairments. Assess every failed test, damaged boundary, isolated detector, defective damper or unavailable utility against the current major-hazard scenarios. Apply authorised compensating measures and operating limits, communicate them at handover and verify restoration.

Test emergency use. Drills should cover occupancy, door discipline, communications, command roles, atmosphere information and decisions about evacuation. A technically sound room still depends on people using it correctly.

Leadership actions

Leaders should review more than the latest test certificate. Ask whether defects were closed, trends are worsening, modifications changed the hazard profile, dampers and penetrations are accessible for maintenance, and impairments are visible to decision-makers. Provide shutdown or work windows when the claimed refuge protection cannot otherwise be demonstrated.

Three practical actions

• Walk the boundary: check doors, seals, penetrations, cladding and temporary routings against the current drawings and performance standard.
• Trace one response: follow an intake detector signal through alarm, HVAC isolation, damper movement, indication and operator action.
• Challenge open defects: confirm every failed test or degraded element has an assessed consequence, authorised controls, owner and verified close.

Official video note

No directly relevant official incident or technical video focused on offshore temporary-refuge integrity was verified for this lesson. Unrelated footage has not been embedded.

Takeaway and team discussion

Key takeaway: a temporary refuge is protective only while its enclosure, HVAC, utilities and people maintain a tenable environment for the required emergency period.

Discussion question: which temporary-refuge element on our installation has the weakest current evidence that it will perform throughout a credible major-accident scenario?

Continue in the Process Safety hub, and connect this lesson with temporary-building siting, end-to-end gas detection, passive fire protection and emergency-system resilience.

Verified primary references

1. UK HSE: Offshore Inspection Guide—Temporary Refuge Integrity—current official inspection criteria covering survivability, enclosure condition, HVAC, detection, testing and hazard-profile changes.
2. UK HSE: Prevention of fire and explosion, and emergency response on offshore installations (L65)—official PFEER guidance on refuge survival time, performance criteria and emergency planning.
3. UK HSE enforcement notice 314928563: Seafox 4—official record concerning temporary-refuge pressure, integrity-test performance and corrective action.
4. UK HSE enforcement notice 315360309: Tartan A—official record concerning refuge cladding, water ingress, integrity testing and restoration.
5. UK HSE Research Report RR1179: Temporary refuges on offshore installations—official research on heat impairment and refuge-performance assessment.

Published and sources checked 28 October 2026. Educational discussion only: apply the installation's approved safety case, performance standards, emergency response plan, verification, impairment, management-of-change and operating procedures. No universal leakage limit, pressure, survival time or permission to operate with an impaired refuge is supplied.

Discuss this article in the comments →

Register interest in future HSSE email updates