Designing for the 1% Event
Why Marine Access Systems Must Be Designed Beyond Normal Operation
Introduction
Marine access systems are often designed around normal operating conditions.
But marine operations rarely remain normal indefinitely.
A vessel can experience unexpected movement. Hydraulic pressure can be lost. An electrical supply can fail. Weather conditions can deteriorate. A landing position can change. An automated system can stop partway through a deployment sequence.
The important engineering question is therefore not whether an unusual event will ever occur.
It is:
How will the marine access system respond when it does?
The concept of “designing for the 1% event” is not about predicting every possible failure or assigning a literal probability to an incident.
It is about identifying credible abnormal conditions and ensuring that the marine gangway or accommodation ladder has a controlled, considered and recoverable response.
Normal Operation Is Only Part of the Design Envelope
A marine gangway may operate predictably under normal conditions.
But its engineering should extend beyond the ideal operating scenario.
Depending on the vessel and application, credible abnormal conditions may include:
- loss of primary power
- hydraulic system failure
- electrical or control-system fault
- sensor failure
- unexpected vessel movement
- changing tide or freeboard
- excessive wind
- physical obstruction
- partial deployment
- loss of communication
- emergency recovery
The objective is not to design for every imaginable event.
It is to identify credible failure modes, understand their consequences and establish appropriate responses.
This is a fundamental principle of engineering risk management.
Failure Should Be Designed — Not Discovered
One of the most useful questions an engineer can ask is:
What happens when this system does not behave as intended?
That question should be asked before equipment is installed, not after a failure occurs.
For a marine access system, this can mean examining:
- What can fail?
- How will the operator know?
- What happens immediately after the failure?
- Does the system move, stop or hold position?
- Can the affected system be isolated?
- Can personnel remain safe?
- Can the equipment be recovered?
- Is manual intervention required?
- What procedures are necessary?
- What maintenance or inspection requirements arise?
This approach is particularly important for marine gangways and accommodation ladders used for personnel transfer.
When people depend on equipment to provide safe access between a vessel and another location, failure behaviour becomes an important part of the overall system design.
Hydraulic Failure: What Happens When Pressure Is Lost?
Hydraulic actuation is an effective way to move large and heavy marine access equipment.
However, hydraulic systems also introduce specific failure modes that need to be considered during design.
These can include loss of pressure, hose failure, valve malfunction, leakage or loss of hydraulic power.
Depending on the system architecture, engineering considerations may include:
- load holding
- controlled movement
- pressure monitoring
- hydraulic isolation
- hose integrity
- valve behaviour
- emergency operation
- manual or alternative recovery
The appropriate arrangement depends on the gangway configuration, load requirements, operating envelope and vessel application.
The important principle is that hydraulic failure should have a defined engineering response.
Electrical and Control-System Failure
Modern automated marine gangways can rely on electrical power, PLCs, sensors, control interfaces and communication between system components.
That creates additional potential failure modes.
These may include:
- loss of electrical power
- PLC or controller fault
- sensor failure
- communication loss
- control-interface failure
- incorrect or unavailable position feedback
- loss of system status information
The system should have a defined response to each credible failure condition.
Depending on the application, this may involve:
Controlled stopping
Alarms and fault indication
System isolation
Manual intervention
Emergency power
Alternative recovery procedures
The correct approach depends on the vessel and the specific control architecture.
The important point is that failure behaviour should be engineered rather than left to operator improvisation.
Dynamic Marine Conditions Change the Engineering Problem
A marine gangway does not operate in a laboratory.
The relationship between the vessel, gangway and landing point can change continuously.
Vessel movement, tide, weather and loading conditions can alter the geometry and forces experienced by the access system.
The engineering problem therefore involves the interaction between:
Vessel
↓
Marine access system
↓
Landing point
↓
Personnel
↓
Environment
This is why the operating envelope needs to be clearly understood.
Questions may include:
- How much vessel movement is expected?
- What landing conditions are acceptable?
- What freeboard variation needs to be accommodated?
- What environmental conditions limit operation?
- What happens when those limits are exceeded?
A marine gangway should not simply be designed to reach a landing point.
It should be engineered to operate within a defined and understood envelope.
What Happens When the Landing Point Moves?
One of the characteristics that distinguishes marine access equipment from conventional land-based access equipment is the relative movement between the vessel and its landing point.
A vessel may rise and fall with the tide.
Another vessel may move relative to it.
A floating structure may respond to waves.
Wind can alter vessel position.
These movements can change the geometry of the access system while personnel are using it.
This makes operating limits and controlled movement particularly important.
The access system should be designed around the conditions in which it is intended to operate rather than assuming that the landing position will remain fixed.
Human Response Is Part of the Safety System
Engineering a failure response is only half the task.
The operator also needs to understand what to do.
A recovery procedure that exists only in an engineering drawing or technical manual is unlikely to be sufficient on its own.
The operator needs clear information about:
- what has happened
- whether the system has stopped
- whether movement is permitted
- what action is required
- what action must not be taken
- whether the system can be isolated
- how the equipment can be recovered
This is where human factors and operational procedures become part of marine access engineering.
EHL’s Access System Assurance approach considers emergency response readiness, crew competency and operating conditions as components of broader marine access-system assessment. EHL Group — Maritime Access Systems
A technically capable system still depends on people being able to understand and operate it correctly.
Designing for Recoverability
One of the most valuable questions in marine gangway design is:
If the system stops in the wrong position, how do we get it somewhere safe?
This is the difference between simply designing for failure and designing for recoverability.
A system that stops when a fault occurs may prevent further movement, but it can still create an operational problem if the gangway remains partially deployed or obstructs another vessel system.
Recoverability considers what happens next.
Depending on the system, this may involve:
- emergency controls
- manual override
- alternative hydraulic operation
- emergency power
- mechanical recovery
- controlled isolation
- defined operator procedures
The appropriate recovery strategy will depend on the equipment and application.
But the principle remains consistent:
Recovery should be part of the original design — not an emergency improvisation.
The Difference Between Fail-Safe and Recoverable
These concepts are related but not identical.
A fail-safe response aims to move or hold the system in a condition that minimises risk following a fault.
A recoverable system considers how the equipment can subsequently be returned to a safe and usable condition.
For marine access equipment, both considerations can be important.
Stopping safely may be the first objective.
Being able to subsequently recover the gangway may be the second.
This distinction is particularly relevant for large automated accommodation ladders and gangways where a partial deployment can affect vessel operations.
Designing for Abnormal Conditions Does Not Mean Over-Engineering
There is a misconception that designing for unusual events automatically means adding unnecessary complexity.
It does not.
Good engineering is about identifying credible risks and proportionate responses.
Not every hypothetical failure requires another sensor, another control system or another component.
Instead, the designer should ask:
What is the consequence of this failure?
How likely is the failure?
Can the risk be eliminated through design?
Can it be reduced through control or protection?
What is the simplest reliable recovery method?
This approach can produce a system that is both robust and maintainable.
The objective is not maximum complexity.
It is appropriate engineering.
Failure Modes Should Influence Maintenance
Failure-mode thinking also has implications beyond the original design.
If a particular component is critical to safe operation, its condition may require greater attention during inspection and maintenance.
This can influence:
- inspection intervals
- preventative maintenance
- component replacement
- spare-parts planning
- condition monitoring
- operator checks
- documentation
A component that appears minor from the outside may have a significant effect on the complete access system if its failure prevents safe operation.
This is another reason to consider the gangway as an integrated marine access system rather than an isolated piece of equipment.
Design, Test and Operate Against the Same Failure Scenarios
Failure planning becomes considerably more valuable when it is carried through the entire equipment lifecycle.
The same credible failure scenarios identified during engineering should, where appropriate, influence:
Design
What should happen?
↓
Testing
Does it actually happen as intended?
↓
Commissioning
Has the response been verified?
↓
Training
Does the operator understand the response?
↓
Maintenance
Are critical components being monitored?
↓
Operational assurance
Does the system remain capable of responding appropriately?
This creates a much stronger connection between engineering design and real-world vessel operation.
The EHL Approach: Engineering Beyond Normal Operation
At EHL Group, marine access systems are approached as complete engineered systems.
That means considering not only how a gangway or accommodation ladder operates when everything is working correctly, but also how the system behaves when conditions change or components fail.
Mechanical structure, hydraulics, electrical systems, controls, automation, operator interaction, emergency response and lifecycle maintenance all contribute to the overall performance of the access system.
The objective is straightforward:
Design the expected operation.
Understand the abnormal operation.
Engineer the recovery.
Conclusion: The Best Time to Discover Failure Behaviour Is Before Failure
The most important time to discover how a marine access system behaves during a failure is before the failure occurs.
Designing for abnormal conditions does not mean attempting to predict every imaginable scenario.
It means identifying credible failure modes, understanding their consequences and establishing controlled responses.
For marine gangways and accommodation ladders, this can mean considering:
- hydraulic failure
- electrical failure
- control-system faults
- sensor failure
- vessel movement
- changing landing conditions
- environmental limits
- partial deployment
- emergency recovery
- operator response
The result is a system designed not only for normal operation, but for the conditions that test its engineering.
Because when the unexpected happens, good engineering should already have an answer.
Ask the Engineer
Have a marine gangway or accommodation ladder requirement where failure response, emergency recovery or operating conditions need to be considered?
EHL Group works with vessel owners, shipbuilders, naval architects and operators to engineer marine access systems around the vessel, its operating environment and its mission.
Engineering the Connection.
Access by Design. Performance by Engineering.
Contact: solutions@ehlsolutions.com
FAQ
What does failure-mode design mean for a marine gangway?
Failure-mode design considers what could happen if components or systems malfunction and establishes appropriate responses. This can include controlled stopping, alarms, isolation, manual intervention and emergency recovery.
What happens if a hydraulic marine gangway loses pressure?
The response depends on the hydraulic architecture and safety design. Load holding, controlled movement, isolation and emergency recovery should be considered during engineering so that loss of hydraulic pressure does not create an uncontrolled condition.
What happens if an automated accommodation ladder loses electrical power?
The system should have a defined response to power loss. Depending on its design, this may include controlled stopping, emergency power, manual recovery or another engineered recovery procedure.
Why is emergency recovery important for marine gangways?
A system that stops safely during a fault may still need to be moved to a safe or stowed position. Emergency recovery planning therefore addresses how the equipment can be managed after a primary system failure.
What environmental conditions should marine gangways be designed for?
Design conditions can include vessel movement, tidal variation, wind, weather exposure, temperature, saltwater, changing landing positions and expected loading. The applicable operating envelope should be established for the particular vessel and application.
How can marine gangway risk be reduced?
Risk can be addressed through appropriate structural design, safe operating envelopes, engineered controls, interlocks, preventative maintenance, inspection, operator training and documented emergency procedures.
Why should marine access systems be designed for abnormal conditions?
Because personnel-transfer equipment needs to remain controllable when operating conditions change. Considering credible abnormal conditions during design can reduce the likelihood that a foreseeable fault becomes a larger operational or safety event.
