Offshore Personnel-on-Board (POB) and heli-manifest controls: survival certificate interlocks, TEMPSC lifeboat seats, and muster reconciliation

Topics: pob tracking system, offshore crew management software, oil and gas workforce management.

While O047 governs offshore crew rotation cycles and payroll back-to-back handovers, and O075 covers onshore terminal gate competency cards, offshorePersonnel-on-Board (POB) control is a life-safety and aviation-weight barrier. An offshore platform or FPSO cannot allow even one person on board above its certified Totally Enclosed Motor Propelled Survival Craft (TEMPSC) lifeboat capacity, nor can it allow an outbound key emergency role (such as a certified Lifeboat Coxswain or Helideck Assistant) to depart on a helicopter if doing so drops the platform below its mandatory Safety Case Emergency Response Team (ERT) complement. This guide (O121) defines the dynamic POB cap calculation, heliport survival-certificate interlock, actual-weight flight manifest, XBR window-seat rule, and real-time RFID/T-card muster reconciliation workflow.

Scope and governance boundary

This article specifies the onshore heliport check-in, offshore POB/accommodation ledger, and emergency muster system integration:

• What this workflow governs: Dynamic POB limit calculation (min(Beds, Operable TEMPSC Seats, Sewage/Water Life-Support Limit)), pre-flight survival/medical certificate validation across the entire planned offshore hitch, calibrated passenger-plus-suit-plus-baggage scale integration (IOGP Report 690), XBR shoulder-width seat allocation, bunk/lifeboat seat assignment, and drill/emergency RFID muster reconciliation.
• What this workflow does not replace: It does not replace the Helicopter Pilot-in-Command's final aircraft weight, center-of-gravity, and weather abort authority, nor the Offshore Installation Manager's (OIM's) statutory command during platform abandon-ship or precautionary down-manning events.

1. Step 1 — Record intake & baseline identification: Calculate an offshore installation's **Dynamic Maximum POB Ceiling** continuously as the minimum of **approved accommodation bed capacity**, **operable primary/secondary TEMPSC lifeboat seat capacity ([IMO SOLAS / MODU Code](https://www.imo.org/en/OurWork/Safety/Pages/LifeSavingAppliances-default.aspx))**, and **active Emergency Response Team (ERT) minimum manning**, rather than using a static nameplate bed number.
2. Step 2 — Cross-system reference & custody linkage: Enforce a hard heliport check-in block when any passenger's **OPITO BOSIET/FOET survival**, **CA-EBS compressed-air breathing**, **H2S**, or **OEUK/Offshore Medical** certificate expires before their scheduled return flight date ([OPITO Standards](https://www.opito.com/standards-and-qualifications)).
3. Step 3 — Exception quarantine & authority check: Weigh every passenger wearing their flight survival suit plus all hold baggage on calibrated heliport scales ([IOGP Report 690](https://www.iogp.org/bookstore/product/offshore-helicopter-recommended-practices/)), and record **Extra Broad (`XBR`) shoulder measurements** so helicopter emergency-exit window seating rules are never violated.
4. Step 4 — Verified disposition & audit trail closure: Assign every onboarding person a specific **cabin bunk**, **primary/secondary muster station**, **TEMPSC lifeboat seat number**, and **emergency duty role (Coxswain, Helideck Fire Team, First Aider)** before the helicopter lifts off from the shore base.

Why static bed-booking spreadsheets fail offshore safety case audits?

Installations that manage helicopter bookings and cabin allocations in manual spreadsheets suffer three recurring safety violations:

1. Lifeboat Downgrade Not Propagated to Heli-Booking Caps: When a 70-person TEMPSC lifeboat undergoes davit wire replacement or engine overhaul—or when a lifeboat is derated by 12 seats due to high-BMI offshore weight standards—the platform's allowable POB drops immediately. If the onshore logistics coordinator continues booking flights against the 140-bed accommodation nameplate, the incoming helicopter arrives at an over-POB platform.
2. ERT Role Depletion During Crew Change ("Orphaned Coxswain"): If two certified Lifeboat Coxswains and two Helideck Fire Team members board the first outbound flight before their back-to-back replacements land on a delayed second flight, the installation operates in violation of its Safety Case ERT matrix during the gap.
3. Estimated vs Scale-Weighed Helicopter Payloads and XBR Seating: Using assumed average passenger weights instead of scale-weighed body + immersion suit + CA-EBS vest + baggage weights (IOGP Report 690), or seating more passengers with shoulder width $>48.5\text{ cm}$ (XBR) than the helicopter has compatible push-out emergency exit windows, creates fatal aviation evacuation hazards.

• Primary control scope: pob tracking system across compliance & safety and connected ERP/EAM records.
• Segregation boundary: Operational status updates never auto-close engineering, safety, or finance sign-off gates.
• Verification cadence: Reconcile open exceptions, overrides, and late adjustments at each shift or period close.

Offshore POB, heli-manifest, and lifeboat control matrix

Illustrative worked example: dynamic TEMPSC downgrade, flight bump, and AW139 payload reconciliation

Illustrative operating scenario with synthetic figures to demonstrate dynamic POB ceiling, certificate blocking, and helicopter payload arithmetic; not a client case study.

Consider offshore production platform CPP-ALPHA (Safety Case nameplate capacity $= \mathbf{140\text{ beds}}$, served by two $70$-person primary TEMPSC lifeboats plus one $70$-person secondary/redundancy boat) preparing for morning crew-change Flight H-104 (Leonardo AW139 helicopter).

Step 1: Compute Dynamic Platform POB Ceiling after lifeboat derating

1. Nameplate accommodation capacity: $140\text{ beds}$.
2. Lifeboat maintenance derating: During weekly inspection, TEMPSC-02 develops a hydraulic accumulator leak on one launch control block, temporarily restricting certified primary evacuation capacity across operable craft (TEMPSC-01 + approved backup allocation) to $128\text{ certified seats}$ until the afternoon spare part arrives.
3. Dynamic Platform POB Ceiling: $$\text{POB}_{\text{ceiling}} = \min(140\text{ beds},\ 128\text{ operable TEMPSC seats}) = \mathbf{128\text{ persons}}$$

Step 2: Reconcile Flight H-104 passenger list against POB cap and survival certificates

• Opening platform POB before Flight H-104: $119\text{ persons}$.
• Originally requested Flight H-104 manifest: $16\text{ inbound}$ passengers and $5\text{ outbound}$ passengers.
• Unadjusted projected closing POB: $$\text{POB}_{\text{unadjusted}} = 119 + 16 - 5 = 130\text{ persons}\quad (>128\text{ dynamic ceiling by }+2\text{ persons})$$
• Automated heliport pre-check-in gate audit:
  • Passenger PAX-11 (Vendor Scaffolding Inspector): OPITO FOET certificate expired on 2026-10-18 ($2\text{ days}$ prior to flight). Status: HARD BLOCK (CERT_EXPIRED).
  • Passenger PAX-15 (Campaign Painting Contractor — Priority 4): Valid certificates, but bumping 1 additional non-essential campaign passenger is required to respect the $128$-person dynamic TEMPSC ceiling. Status: HELD FOR NEXT FLIGHT (POB_CAP_WAITLIST).
• Adjusted compliant Flight H-104 manifest: $14\text{ inbound}$ passengers and $5\text{ outbound}$ passengers: $$\text{POB}_{\text{adjusted}} = 119 + 14 - 5 = \mathbf{128\text{ persons}}\quad (\le 128\text{ dynamic TEMPSC ceiling — PASS})$$

Step 3: Verify AW139 scale-weighed payload and XBR seating compliance

At the shore heliport check-in desk (IOGP Report 690), the $14$ cleared inbound passengers are weighed wearing survival immersion suits and CA-EBS vests alongside their hold baggage:

Upon helideck touchdown on CPP-ALPHA, the 5 outbound passengers disembark/board as sequenced, the 14 inbound passengers scan their RFID muster badges at the helideck turnstile, and the ERP POB board confirms $128\text{ persons on board}$ with 64 assigned to TEMPSC-01 and 64 assigned to TEMPSC-03 ($100.0%$ lifeboat seat accountability).

Acceptance tests and operational readiness criteria

1. ACT-O121-01 (Dynamic Lifeboat & Bed Ceiling Interlock): Whenever a TEMPSC lifeboat is marked derated or out-of-service in the ERP maintenance module, the platform's maximum allowable POB ceiling must automatically step down, blocking any inbound flight manifest whose net arrival count ($\text{Current POB} + \text{Inbound} - \text{Outbound}$) or helideck-turnaround peak exceeds the active ceiling.
2. ACT-O121-02 (Hitch-Duration Certificate Expiry Block): The check-in workflow must reject boarding pass generation if BOSIET/FOET, CA-EBS, or Offshore Medical expiry dates fall earlier than Scheduled Return Date + 7 Days.
3. ACT-O121-03 (ERT Minimum Manning Outbound Protection): An outbound flight manifest cannot be finalized if removing the listed outbound passengers drops on-board certified Coxswains, Helideck Fire Team, or Medics below the platform Safety Case minimum.
4. ACT-O121-04 (Scale-Weighed Payload & XBR Window Seat Lock): The manifest generator must require electronic scale inputs for both clothed/suited passenger weight and baggage weight (rejecting default estimates) and block seat map sign-off if any XBR passenger is assigned to a non-compatible window seat.

Next steps

1. Link CMMS lifeboat availability directly to the POB booking engine: Ensure any lifeboat davit or engine defect immediately updates the maximum platform headcount cap.
2. Enforce return-date + 7-day buffer checks on OPITO and medical certificates: Prevent personnel from becoming stranded offshore with expired survival credentials if weather delays return flights.
3. Integrate heliport check-in load cells with the manifest software: Capture actual suited passenger weights and XBR shoulder classifications automatically per IOGP Report 690.
4. Run automated shift-change ERT coverage simulations before locking flight manifests: Verify that every lifeboat and emergency response team remains fully staffed across staggered flight arrivals.

Frequently Asked Questions

How do offshore installations reconcile Personnel-on-Board (POB) limits, BOSIET/HUET survival certificate validity, helicopter weight manifests, and muster-station lifeboat seat allocations?

Teams should govern pob tracking system by linking every transaction to its source evidence, timestamp, and assigned owner before permitting downstream posting. Distinct from O075 (general contractor gate competency); O121 enforces hard installation POB bed/lifeboat capacity caps, heliport check-in weight-and-balance manifests, and real-time T-card/RFID muster accountability. Rather than relying on informal spreadsheet overrides, the workflow enforces a documented verification gate and preserves the original observation whenever a correction is recorded.

How does offshore crew management software handle exceptions and mismatches?

When a discrepancy occurs during offshore crew management software, the system routes the blocked record into an owned exception queue rather than silently dropping or auto-adjusting the balance. Assigned operational, quality, and finance owners must review and approve exceptions before posting. Each exception retains the original quantity, date, and counterparty reference until the designated reviewer resolves the variance with supporting evidence.

What should teams test before automating oil and gas workforce management?

Before scaling oil and gas workforce management, run a bounded pilot using historical records that include partial receipts, late updates, duplicate messages, and rejected lines. Verify that the integration preserves idempotency, maintains a clear segregation of duties between operational entry and financial approval, and produces an auditable trail for every state transition.

Summary and next actions

1. Map the current pob tracking system record boundaries, system of record, and named approval owners before changing workflow rules.
2. Separate operational status updates from engineering, safety, or financial disposition sign-off.
3. Validate exception queues, duplicate handling, and cutoff reconciliation in a bounded pilot before production rollout.