Motion-compensated gangway injuries: reading HSE's safety bulletin

What HSE has flagged, and why it reaches past offshore wind

The Health and Safety Executive has published a safety bulletin following a serious injury connected to the operation of a motion-compensated gangway. The notice is aimed at duty holders across the offshore energy sector, where walk-to-work (W2W) transfer of personnel between a vessel and a fixed or floating structure has become one of the most frequently repeated operations of the working season.

We read the bulletin as a warning about a class of hazard, not a single broken component. Motion-compensated gangways have made personnel transfer look ordinary. That appearance is precisely the problem HSE is pointing at: the frequency and apparent ease of the operation have run ahead of the discipline applied to controlling it. The bulletin does not confine the risk to offshore wind. Anyone mobilising a survey spread, a diving team or construction personnel across an active-compensation gangway is exposed to the same failure modes, and the same organisational drift.

The source material available to us is the HSE notice itself, so we keep the grounding narrow. What follows is our engineering analysis of how these injuries occur, why they slip past assurance, and what a control set that actually holds in a rising sea looks like.

How the failure forms: the compensation that hides its own limits

A motion-compensated gangway holds a bridge still relative to a structure while the vessel moves beneath it. Active hydraulic luffing, telescoping and slewing actuators are driven from a motion reference unit and control software, cancelling heave, roll and pitch within a defined envelope. The person crossing experiences a stable walkway. The machinery underneath is working hard, continuously, to produce that stillness.

The hazard is structural to the design philosophy. Compensation succeeds almost all of the time, which trains the crew’s mental model to treat the bridge as a fixed walkway. That model is correct in the middle of the operating envelope and wrong at its edges. The credible failure mechanisms cluster into a few families:

• Envelope exceedance. Vessel motion or sea state moves beyond the compensated range and the actuators reach their end-stops. The gangway “runs out” of stroke and transmits vessel motion suddenly rather than smoothly. The transition from stable to violent can be a single wave.
• Control or power fault. Loss of hydraulic pressure, a control-signal fault or a motion-reference error causes the boom to drop, swing or slew without command.
• Mode error. A person is on, or steps onto, the bridge while the system is not in active compensated mode, or while the tip is transitioning between docked and active states.
• Station-keeping excursion. A DP position loss changes the gangway geometry and tip loading rapidly; under force control the boom can retract or reposition while someone is mid-crossing.
• Interface trap and crush points. At the tip landing and at the vessel end, a moving boom and frame create pinch points that are benign when compensation holds and dangerous the instant it does not.

The typical injury does not begin with the machine. It begins in planning and ends at the interface. Operating limits are set optimistically or lifted from a generic manual rather than the specific vessel-and-gangway configuration. The sea state sits near the limit with a degrading forecast. The DP footprint and the transfer-permission logic are not tightly coupled, so the vessel is allowed to work at the edge of its envelope while people are on the bridge. Compensation performance has quietly degraded through deferred maintenance or motion-reference drift. Then a person loiters in the transition zone, or a second person steps on, and a wave arrives that the system cannot cancel. Every link on its own looks tolerable. Assembled, they put a body at a crush point at the worst moment.

Why routine audits sign off a hazard they never see

The reason these events keep happening is that the standard assurance regime inspects the wrong things. Audits check that the gangway holds valid certification – a DNV-ST-0358 certificate for the equipment and its declared operating envelope is common – that operators hold training records, and that the safety management system describes the procedure. All of that can be in order while the live decision chain that actually keeps people safe is never tested.

A walk-through in calm weather sees a smooth, quiet transfer and signs it off. The hazard only reveals itself at the envelope edge or on a component failure, neither of which appears on a settled afternoon. Assurance that never observes the operation under load is assurance of paperwork, not of practice.

Three specific blind spots recur. First, envelope margin is rarely presented to the decision-maker in a form they can act on. A green light confirms the system is compensating now; it says nothing about how much actuator stroke remains before end-stop. Crews are asked to judge margin they cannot see. Second, DP status and gangway status are frequently monitored from separate pictures. The DPO watches position and the yellow/red alert limits; the gangway operator watches the bridge. Without a shared, explicit link between a position alert and transfer permission, the two roles can be comfortable individually while the combined operation is not. Third, sudden-movement near-misses that occur with no one on the bridge are under-reported because “no harm resulted.” Those events are the leading indicator of an envelope or maintenance problem, and discarding them removes the earliest warning available.

This is the same concealment dynamic that erodes DP assurance more broadly, where events that produce no visible damage never enter the record and the fleet learns nothing. We have argued elsewhere that the incidents crews quietly absorb are the ones that later kill the assurance case, and gangway near-misses belong squarely in that category.

What this carries into survey and diving mobilisation

Motion-compensated gangways are not a wind-farm problem. Survey and diving teams use the same systems to reach platforms and offshore assets, and mobilisation is the phase where transfer discipline is weakest. Schedule pressure is highest, the crew is often on an unfamiliar vessel-and-gangway configuration, fatigue after a long transit is common, and the first crossings happen before anyone has built a feel for how the system behaves in that specific sea state.

Two distinct risk regimes get blurred during mobilisation. Personnel transfer and cargo transfer over the same gangway are different operations. Carrying spares, tooling, sensor units or gas fittings changes a person’s balance, occupies their hands, and can interfere with any fall protection. Where equipment is moved as a load, the operation properly falls under LOLER (Lifting Operations and Lifting Equipment Regulations) as a lifting operation and should be planned and supervised as one, not treated as an extension of someone walking across. The gangway equipment itself sits under PUWER (Provision and Use of Work Equipment Regulations), with the associated duties for suitability, maintenance and inspection.

The transition zone – the step from the moving vessel frame onto the compensated bridge and off again at the structure – is where the injuries concentrate. It is the same handling and body-position hazard that produces lost-time injuries on cluttered survey decks, and the same organisational failure to control it. The mechanics of how handling and isolation failures generate recurring survey-deck LTIs map directly onto the gangway interface: an energetic system, a person in the load path, and a control that depended on everyone doing the right thing at the right moment.

For diving operations specifically, the exposure is the routine crossing of divers, life support technicians and supervisors, plus the movement of gas quads, umbilical stores and spares. A diving crew that treats vessel-to-platform transfer as trivial relative to the sat spread has misjudged where the day’s highest-consequence exposure actually sits.

Controls that hold up in a rising sea

The controls below are testable. A survey or diving manager should be able to check each one against the actual operation, not against the procedure that describes it.

Set a configuration-specific operating envelope, and display the margin. Derive limits from the DNV-ST-0358 certified envelope and the manufacturer’s operational manual for the specific vessel-and-gangway pairing, not a generic table. Define green/amber/red operating states against significant wave height, wave period, wind and current, and against the vessel’s motion response. Amber must trigger a documented decision, not a shrug. Where the system can display remaining stroke or compensation margin, put that number in front of the person authorising transfers.

Couple the ASOG to transfer permission explicitly. The Activity Specific Operating Guidelines must name personnel transfer as the activity, with setpoint, footprint radius and yellow/red position limits tied to a defined action: yellow alert stops new transfers and clears the bridge, red alert retracts the gangway. Build this per IMCA M 220 and cross-reference the personnel-transfer guidance in IMCA M 202 / SEL 025. Crews bypass ASOG when it is written as a document rather than as an operating rule; the failure pattern behind ASOG deviations and drift-off decisions is the one to design out here.

Give one named controller the authority to stop. A single gangway controller, competent and assessed, in direct communication with the DPO and the receiving structure, holds a permission-to-cross protocol with closed-loop confirmation. No one steps on without a positive “go,” and the controller can halt the operation without seeking approval. Split authority is how a stop-work decision dies in committee while a wave is inbound.

Enforce mode discipline and interface hygiene. Transfer only in active compensated mode with a confirmed green state. Retract or park the boom when not actively transferring. Hold to the certified bridge capacity, and in marginal conditions restrict to one person at a time, moving continuously, hands free. Do not allow anyone to stand in the transition zone. Separate cargo transfer from personnel transfer and plan it as a lift where LOLER applies.

Test the machine, not just the paperwork. Run daily function checks of the compensation system under PUWER, verify motion-reference health, check hydraulics and end-stops, and log actuator stroke usage so degradation shows up as a trend rather than a surprise. A gangway that has been quietly hitting its stops in moderate seas is telling you something before it hurts someone.

Re-assess when conditions change, and rehearse the failure. Trigger a management of change whenever the forecast, the vessel or the gangway configuration shifts. Yesterday’s limits do not apply to today’s sea state. Drill the loss-of-compensation scenario with a person on the bridge: where they go, how they are recovered, MOB readiness and communications. Capture every sudden-movement event, including those with no one aboard the bridge, and treat them as the leading indicators they are.

HSE’s bulletin is a reminder that the safest-looking operation on the vessel is the one most likely to be under-controlled. The engineering answer is not more faith in the compensation system. It is a set of limits that are specific, visible and enforced, a decision chain with a single point of control, and an assurance process that inspects the operation when the sea is working against it rather than when it is flat.

---

Based on: Serious injury – motion compensated gangways