Lifeboats – Launching, Maintenance and On-Load Release

The thing that is supposed to save your life should not be the thing most likely to take it.
And yet, for decades, that is exactly what the lifeboat has been.

Introduction

No other piece of safety equipment on a merchant vessel carries the same contradiction. The lifeboat exists for a single catastrophic moment that, statistically, most seafarers will never face. But the obligation to prove it works — the drills, the lowering, the servicing of hooks and winches — creates a repeating exposure to genuine danger that has produced a body count the industry has been slow to confront.

Between the early 1990s and the mid-2010s, lifeboat accidents during drills and maintenance killed and maimed more crew than lifeboat deployments ever saved. The numbers are not ambiguous. MAIB, MARS, Gard, and the IMO’s own correspondence groups documented case after case: boats dropping from davit height onto the water or the deck below, hooks releasing under load without command, falls parting, brakes failing. The root causes were not exotic. They were mechanical — poorly designed on-load release hooks, inadequately maintained winches, absent or ritual pre-launch checks — combined with a culture that treated the lifeboat drill as a box to tick rather than the most dangerous operation of the week.

The regulatory response came eventually. MSC.1/Circ.1206 and its revisions. The 2011 amendments to SOLAS III and the LSA Code. The 2013 hook replacement deadline. These changed the landscape. But regulations do not lower boats. People do. And the gap between what the paperwork says and what actually happens on the embarkation deck remains, on too many ships, wide enough to kill.

Contents

• 1. The Casualty Record — What the Numbers Actually Say
• 2. On-Load Release Gear — The Design Failure That Took Twenty Years to Fix
• 3. What a Properly Certified Hook Looks Like Today
• 4. SOLAS Pre-Launch Checks — The Sequence That Cannot Be Shortened
• 5. The Maintenance Regime — Monthly, Quarterly, Annual, Five-Yearly
• 6. Winch Maintenance — Brake, Governor, Clutch, Limit Switches
• 7. The Drill Itself — Treating It as the Most Dangerous Operation on Board
• 8. Closing Reality

1. The Casualty Record — What the Numbers Actually Say

The most widely cited figure comes from work compiled for the IMO’s DE Sub-Committee and later referenced by MAIB and industry P&I clubs: between 1992 and 2012, lifeboat-related accidents during drills and maintenance killed an estimated 16 people per year globally. Some sources put the number higher. The figure for serious injuries — crushed limbs, spinal fractures, traumatic brain injuries — is harder to pin down but multiples the fatality count several times over.

Set that against the number of lives saved by lifeboats in actual abandonment during the same period and the arithmetic is uncomfortable.

The training killed more people than the emergency it trained for.

The failure modes were consistent. Premature release of the on-load hook while the boat was still at davit height. Uncontrolled descent due to winch brake failure. Falls parting under shock load. Crew entering or working beneath a boat that was not properly secured. In almost every investigation, the proximate cause was mechanical, but the systemic cause was organisational: inadequate maintenance, skipped checks, unfamiliarity with the specific hook type fitted, and a casual approach to the drill evolution.

These were not freak events. They were the predictable output of a system in which a highly dangerous mechanical operation was repeated at intervals on every ship in the world fleet, using equipment that was often poorly designed, inconsistently maintained, and operated by crews who rotated every few months.

2. On-Load Release Gear — The Design Failure That Took Twenty Years to Fix

The on-load release hook was conceived for a legitimate reason. In a genuine abandonment, a lifeboat may need to be released while the falls are still under tension — for instance, if the vessel is listing, sinking, or there is a need to clear the ship’s side immediately upon waterborne. The hook must open under load on deliberate command.

The problem was that too many hook designs could also open under load by accident.

Through the 1990s and 2000s, the global fleet carried a proliferation of on-load release mechanisms from dozens of manufacturers, with widely varying designs. Some used a hydrostatic interlock that was supposed to prevent release until the boat was waterborne. Some relied on a cam-and-lever arrangement that could be defeated by vibration, corrosion, or simple misunderstanding of the operating sequence. Some had reset procedures so complex that even experienced officers got them wrong — and getting the reset wrong on an on-load hook means the hook is live when it should not be.

A hook that can be accidentally opened under load is not a safety device. It is an execution mechanism.

The issue was compounded by maintenance. On-load release hooks sit in an exposed marine environment and require regular greasing, inspection of pivot pins, and functional testing. On ships where the lifeboat was treated as furniture — swung out for the quarterly drill and otherwise ignored — internal corrosion could freeze the mechanism or, worse, alter the geometry of the cam faces so that the interlock no longer held.

Investigation after investigation found the same pattern: a hook that had been in service for years without proper examination, operated by a crew that did not fully understand its release and reset sequence, with no manufacturer’s documentation on board or documentation in a language nobody could read.

IMO responded incrementally. MSC.1/Circ.1206 in 2006 introduced guidelines for periodic servicing and evaluation. MSC.1/Circ.1392 tightened the requirements. But the decisive step came with the 2011 amendments to SOLAS Regulation III/1.5 and the revised LSA Code, which mandated that all on-load release hooks not complying with the new performance standard (MSC.81(70) as amended by MSC.321(89)) be replaced by the first scheduled drydocking after 1 July 2014, but not later than 1 July 2019. The new standard required hooks to be designed so that accidental release was physically impossible under normal operating conditions, and to have a clear, unambiguous reset procedure.

This was, in effect, an admission that the existing fleet of hooks was systemically dangerous.

3. What a Properly Certified Hook Looks Like Today

A compliant on-load release hook, post-MSC.321(89), has specific characteristics that should be verifiable during any competent inspection.

The release mechanism must require at least two deliberate, separate actions to open under load. These actions must be sequential and cannot be performed simultaneously by accident. The hook must be designed so that it cannot be inadvertently released by a single point failure — no single broken pin, seized cam, or corroded lever should be capable of causing release.

Hydrostatic interlocks, where fitted, must be tested and certified. The hook must be clearly marked with the manufacturer’s name, type designation, serial number, SWL, and the date of last thorough examination. Operating and reset instructions must be permanently displayed at the hook — not in the coxswain’s manual stowed in a locker, but at the hook, in a weatherproof placard, in English and the working language of the crew.

The reset procedure must be designed so that an incorrectly reset hook is visually obvious. This was one of the critical changes. Older designs could be reset incorrectly with no external indication — the hook looked closed but was not properly latched. The current standard requires a positive visual indicator of correct engagement.

If the hook cannot be confirmed as correctly reset by visual inspection from outside the mechanism, it does not meet the standard.

Class certification of the hook is documented by a statement of compliance, and the five-yearly thorough examination must be carried out by the manufacturer or a manufacturer-authorised service provider. This is not a job for the ship’s crew, the bosun, or a general riding squad. It requires specific competence, tooling, and the authority to condemn and replace components.

4. SOLAS Pre-Launch Checks — The Sequence That Cannot Be Shortened

Every lowering evolution — drill or maintenance — begins with a pre-launch check sequence. It is laid out in the ship’s SMS, derived from SOLAS III/19 and III/20, the LSA Code, and the manufacturer’s instructions. It is not advisory. It is mandatory, and every step exists because its omission has, at some point, resulted in a casualty.

The checks include, at minimum:

• Confirmation that the area beneath the davit and the embarkation deck are clear of personnel not involved in the operation.
• Visual inspection of both falls for broken wires, kinks, corrosion, and correct spooling on the drum.
• Inspection of the on-load release hook for correct reset — visual confirmation of the positive engagement indicator.
• Confirmation that the winch brake is set and holding.
• Confirmation that the tricing and bowsing arrangements are in place and functional.
• Verification that the harbour safety pin (or equivalent device) is in place and will only be removed at the correct point in the launch sequence.
• Confirmation that the helmsman and coxswain are briefed and in position.
• Confirmation that a means of communication exists between the embarkation deck and the boat.

Each of these items has a casualty behind it. The harbour pin exists because boats have released at the davit head. The falls inspection exists because wire has parted under a boat full of people. The brake check exists because boats have dropped in freefall to the water.

A checklist read aloud with nothing actually checked is not a safety measure. It is a liability document.

Shortcuts in this sequence tend to cluster around two moments: the very start, when the pressure is to get on with it, and the moment just before lowering, when the focus shifts to the operation itself and the pre-checks are assumed to have been done. The responsible officer must be present, must witness, must confirm. Delegation to an unsupervised AB is not compliance.

5. The Maintenance Regime — Monthly, Quarterly, Annual, Five-Yearly

SOLAS III/20 and the associated MSC circulars establish a tiered maintenance regime. The intervals are minimums, not targets.

Monthly: Visual inspection of the lifeboat and launching appliance. Condition of the falls. Correct stowage and securing of the boat in the davit. Inventory check of the boat’s equipment and provisions. Engine start and run. This is the turn-out. The boat is not lowered to the water. It is swung out, inspected in the davit, and recovered.

Three-monthly (quarterly): The boat is lowered to the water, or at minimum to the embarkation deck level. If lowered to the water, the engine is run ahead and astern, the steering tested, the release gear operated (off-load), and the boat recovered. This is the evolution that carries the launch risk and demands the full pre-launch check sequence.

Annual: A thorough examination of the launching appliance, including load testing of the davit and winch. The falls are proof-loaded or renewed on a cycle determined by the manufacturer and Class (typically five years for wire falls, less if condition demands). The on-load release gear is operationally tested and inspected by a competent person.

Five-yearly: Thorough overhaul and examination of the lifeboat, davit, winch, and on-load release hook by the manufacturer or authorised service provider. This includes full disassembly of the hook mechanism, NDT of critical components, load testing, and recertification. The five-yearly is a Class requirement and must be documented with a surveyor present or the report submitted to Class for endorsement.

The critical point is that these intervals are linked but not interchangeable. A quarterly lowering does not satisfy the annual load test. A monthly inspection does not satisfy the quarterly lowering. And none of them satisfy the five-yearly thorough examination. The records must show each tier completed independently, at or within its interval.

An overdue five-yearly with a full set of monthly inspection records does not represent a well-maintained boat. It represents a paperwork exercise built on top of a compliance failure.

6. Winch Maintenance — Brake, Governor, Clutch, Limit Switches

The winch is the single most safety-critical mechanical component in the launching system, and it is the one most likely to be neglected between service intervals because it sits behind a housing and does not look like it needs attention.

Four subsystems require specific, regular attention.

Brake

The winch brake arrests and holds the boat during lowering and in the stowed position. Brake linings wear. Brake drums corrode. Adjustment mechanisms seize. A brake that held last quarter may not hold today. The brake must be tested under load — not simply checked for the presence of a brake handle. Specific torque values and adjustment criteria are in the manufacturer’s manual. If that manual is not on board, it must be obtained before the next lowering.

Centrifugal Governor (Speed-Limiting Device)

The governor prevents the boat from exceeding a safe lowering speed. It operates on centrifugal force and, like all mechanical governors, depends on free movement of its weights, linkage, and braking surfaces. Seized governor weights will not arrest an over-speed condition. The governor must be tested dynamically — during an actual lowering — and its operation confirmed. A governor that has never been tested because the boat is always lowered on the hand brake is a governor of unknown status.

Drum Clutch

The clutch engages and disengages the drum from the drive motor for powered recovery. A slipping clutch will fail to recover the boat. A seized clutch may prevent gravity lowering. Clutch condition is confirmed during the quarterly lowering and recovery evolution — if recovery is sluggish or requires multiple attempts, the clutch is suspect.

Limit Switches

Upper and lower limit switches prevent over-travel of the falls in both directions. A failed upper limit switch allows the boat to be hoisted into the davit head, overloading the structure. A failed lower limit switch allows the falls to unspool completely. Both must be tested at each quarterly lowering. Bypassed or disconnected limit switches — sometimes done to work around a fault — represent an immediate danger and must be reported and rectified before the next operation.

A winch is not serviceable because it turned last time. It is serviceable because every subsystem within it has been confirmed within its maintenance interval.

7. The Drill Itself — Treating It as the Most Dangerous Operation on Board

The lifeboat drill is a controlled lowering of a heavy, suspended load carrying personnel, using mechanical equipment exposed to a marine environment, operated by a crew whose composition changes every few months. It frequently takes place alongside, in port, with the attendant distractions of cargo operations, shore personnel, and time pressure to sail.

By any objective risk assessment, it is one of the highest-risk operations conducted on a merchant vessel. It deserves to be treated as such.

This means a toolbox talk that is not a formality. It means a designated officer supervising from the embarkation deck who has no other duty during the evolution. It means a clear, rehearsed sequence of commands between the embarkation deck and the boat crew. It means the evolution is stopped — not adapted, not hurried through — if any check reveals a deficiency.

It means the crew are told, clearly and without euphemism, that this operation has killed people. Not theoretically. Not on other ships. On ships exactly like this one, with equipment exactly like this, operated by people exactly like them.

The instinct on many ships is to minimise the drill. Get it done. Tick the box. Get back to cargo work. That instinct has buried people.

A drill treated as routine becomes a drill where the checks are routine. And routine checks are the ones that get skipped.

There is a particular danger in the moment of recovery. The boat is waterborne, the drill is considered over, and attention drops. Recovery hoisting is powered, which means the winch, clutch, and limit switches are all active. If the falls are cross-reeved or the boat is not centred beneath the davit, shock loads can develop during hoisting that exceed the SWL of the gear. Recovery deserves the same level of supervision as lowering.

Manning in the boat during a drill lowering should be the minimum required to test the systems — coxswain, helmsman, engine operator. There is no reason to fill a lifeboat with the full complement for a routine quarterly lowering. The risk is not justified. Simulated embarkation can be conducted with the boat at the embarkation deck. Actual waterborne testing requires only enough crew to operate the boat.

PSC and Class will look at the drill records. But they will also look at the quality of those records. A logbook entry that says ‘lifeboat drill carried out satisfactorily’ tells an investigator, after an accident, that nobody was paying attention. A record that notes who supervised, what was checked, what deficiencies were found and rectified, and what the lowering and recovery times were — that record tells a different story.

8. Closing Reality

The lifeboat is a survival system that demands respect not only for what it is designed to do, but for what it is capable of doing when it fails. The on-load release hook, the winch brake, the wire fall — each is a single-point-of-failure component in a system that suspends people at height over water or steel deck.

The regulatory framework that now exists — the hook replacement programme, the tiered maintenance regime, the five-yearly thorough examination — was built on a foundation of dead and injured seafarers. Every requirement traces back to a specific failure, a specific casualty, a specific investigation that found the same systemic causes: poor design tolerated too long, maintenance deferred or simulated, checks abbreviated or skipped, and an organisational culture that treated the drill as an administrative burden rather than a live operation with lethal potential.

The obligation is not complicated. Maintain the gear to the manufacturer’s standard. Conduct every pre-launch check as if the boat will drop if one is missed — because it might. Staff the drill with supervision proportionate to its risk. Record what was actually done, not what was supposed to be done.

The lifeboat drill is not a fire drill. It is a crane lift with people in the hook. Treat it as anything less and the next casualty is just waiting for its date.