The blocked escape hatch: why egress audits keep missing it

A hatch that would not open

IMCA’s safety flash records a simple sequence with a serious edge. During a management walk-around, someone tried to leave the steering room through the emergency escape hatch to the deck and found it would not open. Checking from the deck side gave the answer at once: a fuel hose had been left lying across the hatch cover after an offshore transfer, and its position held the cover shut. Anyone in the steering room during a fire or flooding event would have been trapped at exactly the moment the secondary means of escape was meant to save them.

The stated causes are ordinary. Post-operation housekeeping was not effective. The hose was left on the hatch instead of being returned to its stowage after transfer. Temporary placement of equipment on the hatch was accepted without anyone thinking about escape access. Earlier walk-arounds had passed the same condition without seeing it.

What deserves attention is the company the flash keeps. The same page lists three related reports: mooring ropes blocking an escape hatch by “only a centimetre” (SF 12/21), a blocked emergency exit hatch (SF 02/23), and a bunker hose obstructing an emergency exit (SF 20/25). Four documented instances of one safety barrier defeated in the same way, by items left lying on the hatch. That pattern is the real subject here. A single blocked hatch is a housekeeping lapse. A recurring blocked hatch is a control that does not work.

How a fuel hose became a life-safety failure

The escape hatch from a steering gear compartment or machinery space is not a convenience. Under SOLAS Chapter II-2 Regulation 13, normally manned spaces and machinery spaces require at least two means of escape, arranged so that a fire or flood affecting one route still leaves a way out. The deck hatch is that second route. It exists solely for the case where the primary route is gone. Its whole value is availability in a degraded situation, which means its performance can only be judged under the conditions it is built for, not on a calm day alongside.

In barrier terms the hatch is a recovery barrier – it does nothing to prevent the fire, and everything to prevent the fire from killing the person in the space. When a hose sits on top of it, the barrier is defeated, but nothing visible changes. The space still functions. The watch is still kept. The defeat is a latent condition, dormant until an event calls on the barrier, and by then there is no time to clear a hose from the far side.

The causal chain is worth separating into its parts, because each part is a control that failed independently:

• The trigger was a routine offshore transfer. Fuel and bunker hoses are handled, then recovered. Nothing about the task is unusual, and that is precisely the risk – routine work attracts the least scrutiny.
• The immediate cause was placing the hose on a flat, convenient surface that happened to be a safety-critical hatch. Congested decks on a dive support or survey vessel offer few clear surfaces during a spread; a hatch cover reads as usable space to a tired crew at the end of a transfer.
• The systemic cause was the absence of a restoration step with a named owner. The job was treated as finished when the transfer was complete, not when the area was restored and the escape route confirmed clear.
• The latent failure was that the defeated barrier survived multiple walk-arounds. Detection existed on paper and did not function in practice.

This is the same mechanism behind a large share of deck injuries, where a routine activity leaves a hazard live because the task was declared complete before the area was made safe. We have written before about the recurring isolation failures that generate lost-time injuries on survey decks, and the shape is identical: the work looks done, the residual hazard is invisible, and the person exposed is not the person who created it.

Why every previous walk-around passed it

The detection gap is the part of this event that transfers to every vessel, so it is worth being precise about why a visual audit fails against this hazard.

A walk-around confirms presence, not function. An auditor sees a hatch, sees it is there, sees no obvious damage, and moves on. A hose lying on a hatch cover does not announce itself as a defeated escape route – it reads as equipment on a deck, which is normal. The audit is asking the wrong question. It asks “is the hatch there and undamaged”, when the barrier’s performance standard is “can one person open it from inside, without tools, in seconds, under emergency conditions”. Those are different tests, and only the second one matters.

Two human-factors effects compound this. The first is normalisation of deviance: once a hose has sat on a hatch a few times without consequence, the sight stops registering as wrong. The second is inattentional blindness during routine inspection – an auditor scanning for the familiar will not see the unfamiliar meaning of a familiar object. Neither is a competence failure. They are predictable properties of visual inspection, and they are why a purely visual regime cannot be relied on to protect a recovery barrier.

There is also an accountability void specific to transfer operations. During a bunkering or fuel transfer, the deck crew, the officer of the watch, and sometimes a third-party supplier all have a hand in the task. Recovery and stowage of hoses can fall between them. When responsibility is shared without being assigned, restoration is nobody’s explicit job, and the hose stays where it was dropped. The ISM Code requires shipboard operations and maintenance to be planned and verified, but a safety management system only closes this gap if the close-out of a transfer names who confirms the escape routes are clear.

Escape routes are barriers, not tidiness

The correcting idea is to stop filing escape-route obstruction under housekeeping and start managing it as barrier integrity. A blocked hatch is not an untidy deck; it is a safety-critical barrier in a failed state, and it should be reported, logged and rectified with the same urgency as a disabled fire pump or an isolated gas detector.

On a diving support vessel this discipline carries extra weight, because the vessel runs several life-safety systems at once and the deck is denser than on most craft. Dive control, the saturation system, hyperbaric evacuation arrangements, gas quads, hot water units, umbilicals and reels all compete for space, and the machinery and steering spaces below sit under a working deck. IMCA D 014, the International Code of Practice for Offshore Diving, sets the expectation that escape and evacuation arrangements are maintained and verified, and the density of a live dive spread is exactly the environment in which a hatch becomes a convenient surface. When a hyperbaric evacuation may already depend on clear routes for stretcher or chamber movement, an obstructed egress point is not an isolated defect – it degrades the whole evacuation case. For teams weighing what a saturation emergency actually demands of the vessel, the constraints in reading DMAC 31 on accelerated emergency decompression show how little margin exists once an evacuation is under way.

Barrier thinking also reframes the “temporary” excuse. A hose on a hatch is described as temporary placement, and temporary is treated as acceptable because it is short-lived. But a barrier defeated for five minutes is fully defeated for those five minutes, and an emergency does not schedule itself around the crew’s intentions. Any temporary condition that touches an escape route, a fire door, firefighting equipment or an access way is a change to the vessel’s safety state and belongs inside management of change, not inside routine judgement. The IOGP Life-Saving Rules make bypassing or disabling a safety control a stop-work matter; obstructing an escape hatch is the marine equivalent, and it should carry the same authority to intervene.

Closing the gap: verification that actually tests egress

The fix is not more walk-arounds of the same kind. It is a different verification standard, clear ownership after transfers, and physical proof that the barrier works. The following steps are specific and testable inside any vessel’s safety management system.

Register every escape route and hatch as a named safety-critical barrier. Give each one an owner, a written performance standard, and a verification frequency. A workable standard for a manned-space hatch is: opens from inside by one person, without tools, in under a defined number of seconds, with the route beyond it clear for the full body envelope. If it cannot meet that, it is a defect, not a housekeeping note.

Test function, not appearance. Physically open every escape hatch from the inside on a set schedule – weekly for spaces that are normally manned, and additionally on completion of every fuel, bunker or mooring operation, since those are the tasks that produce this exact hazard. Record the test with the barrier’s identifier, the person, and the result. A hatch that has not been opened has not been verified.

Assign restoration to a named person at transfer close-out. A transfer is not complete when the product stops flowing; it is complete when hoses are recovered, stowed in their designated location, and escape routes confirmed clear. Put the name of the person who confirms this on the permit or the operation log, and do not close the task without it. Where a third party handles the hose, the vessel still owns the confirmation.

Mark keep-clear zones physically. Paint or tape a hatched keep-clear boundary around every escape hatch and access-way termination on deck, and prohibit any stowage inside it. A visible boundary converts an invisible rule into something a tired crew can see at the end of a transfer, and it gives an auditor a concrete thing to check.

Put a “prove it” step in every audit and management visit. The auditor opens the hatch. That single act would have caught this condition, would have caught its three siblings, and turns a passive look into an active test. Train walk-around leaders to treat escape routes, hatches, firefighting equipment and access ways as the specific items they must physically challenge, not glance at.

Drill egress from the spaces that rely on the second route. Include the steering gear compartment and machinery spaces in emergency exercises, run them using the secondary escape hatch, and confirm Emergency Escape Breathing Devices (EEBDs) are in date and accessible on the way. A drill that only ever uses the primary route never tests the barrier that failed here.

The through-line is that a recovery barrier can only be trusted if it is verified under the conditions it exists to serve. The blocked hatch survived because everyone confirmed it was present and nobody confirmed it worked. Change the test, name the owner of the restoration step, and the small housekeeping failure stops turning into a high-consequence trap.

---

Based on: Emergency escape hatch to the deck could not be opened