Working Aloft

A man hanging in a harness is not a man who has been saved. He is a man whose rescue has not yet begun.

Introduction

Every year, people fall from height on ships. The locations are entirely predictable: the foremast during navigation light repairs, the monkey island during antenna work, the crane jib during greasing, the funnel casing during soot-blower maintenance. The task is almost always routine. The weather is almost always moderate. The person who falls was almost always wearing a harness.

That last point deserves to sit for a moment. The harness was on. The person fell anyway, or the harness held but nobody could get them down. The permit was signed. The toolbox talk was done. The boxes were ticked. And somebody still ended up in a body bag or an air ambulance.

The persistent gap in working aloft is not a lack of paperwork. It is a lack of imagination — a failure to think past the ascent and into the arrest, past the arrest and into the rescue, past the rescue and into the reality that a 90-kilogram person hanging motionless at 18 metres above a steel deck cannot help themselves and has perhaps six minutes before suspension trauma becomes life-threatening.

This article is about the things that actually matter when people go up.

Contents

• 1. The Places People Fall From
• 2. The Permit — What the Chief Officer Is Actually Signing
• 3. Harnesses, Lanyards, and Anchor Points — The Equipment People Get Wrong
• 4. Fall Arrest vs Work Positioning — Two Different Systems, Two Different Purposes
• 5. Rescue Planning Before the Ascent
• 6. Weather, Motion, and the Decision to Stop
• 7. Dropped Object Prevention
• 8. Common Failures That Kill
• 9. Closing Reality

1. The Places People Fall From

The foremast is the most common site. Navigation light replacement, radar scanner maintenance, aerial rigging. The structure is narrow, the ladders are vertical or near-vertical, the platforms — if they exist — are minimal. Handrails may be token. Gratings may be corroded. The mast sways more than any other point on the ship, amplifying even modest vessel motion into a violent arc at height.

The monkey island draws people for meteorological instrument servicing, VSAT dome work, signal halyard replacement. It is lower than the mast and feels safer. That feeling is the problem. The edges are often low coamings rather than proper guardrails. A stumble is a fall.

Crane structures — the jib, the pedestal, the cab roof — are worked on during greasing, wire inspection, limit switch testing. The geometry is irregular. Anchor points are scarce or non-existent. The person working is often reaching, twisting, leaning outboard. A foothold on a greasy surface is not a foothold.

The funnel casing and its internal platforms host boiler uptake inspections, exhaust gas economiser cleaning, soot-blower repairs. These are hot, confined, awkward spaces at height. The combination of heat, restricted movement, and vertical exposure creates compound risk that a standard working-at-height assessment barely touches.

Every one of these locations has killed someone. Not on derelict ships. On well-managed fleets, with ISM systems in place and permits signed.

2. The Permit — What the Chief Officer Is Actually Signing

The permit to work aloft is not a record that someone asked permission. It is a declaration by the issuing officer — typically the Chief Officer — that a specific set of conditions have been verified, that specific controls are in place, and that a specific rescue method has been agreed before the person leaves the deck.

A signed permit without the checks done is worse than no permit at all. It creates a false record of safety. It provides the company with a document that says everything was in order. It insulates everyone except the person who fell.

Before signing, the Chief Officer should physically verify:

• The anchor points to be used — not assumed, not pointed at on a drawing, but identified on the structure and confirmed as rated or engineered for fall arrest loads (minimum 12 kN for a single-person anchor, or per maker’s plate).
• The harness and lanyard to be used — inspected that day, not last month. Stitching, buckles, webbing condition, shock absorber pack integrity, karabiner gate function, certification date.
• The rescue plan — not a line on the permit saying ‘rescue by ship’s crew.’ A named method: who goes up, with what equipment, by what route, to do what, and how the casualty is lowered. If the answer involves improvisation, the answer is not ready.
• Communications — a dedicated working channel, a radio on the person aloft, a radio with the standby person on deck, and a check call agreed at fixed intervals.
• The weather — current and forecast for the duration of the task. Wind, sea state, swell, any expected change.
• The exclusion zone below the work area — rigged and manned or signed.

The Chief Officer’s signature is a personal professional commitment that these things are true at the time of signing. If any one of them is not verified, the permit should not be signed. The pressure to get the job done does not change the physics of a fall.

3. Harnesses, Lanyards, and Anchor Points — The Equipment People Get Wrong

A full-body harness for fall arrest is not the same item as a sit harness for work positioning, and it is emphatically not a safety belt worn around the waist. The old-style waist belt — still found aboard, still worn by people who should know better — will cause severe internal injuries or spinal damage in a fall arrest event. It is not rated for fall arrest. It has not been rated for fall arrest for decades. Its continued presence on any ship is an indictment of whoever manages the safety equipment inventory.

A full-body fall arrest harness distributes the arrest load across the thighs, pelvis, chest, and shoulders. It has a dorsal (rear) attachment point rated for fall arrest. Some have a sternal (front) attachment point. The leg straps and chest strap must be adjusted to fit — snugly, not loosely. A harness worn slack adds free-fall distance before arrest loads are taken. Every additional centimetre of slack translates to additional force on the body and additional distance below the anchor point at arrest.

The lanyard connects the harness to the anchor point. There are two fundamentally different types, and confusing them has consequences.

A fall arrest lanyard incorporates an energy absorber — the stitched pack that tears open under load to limit the arrest force on the body to approximately 6 kN. It is designed to deploy once, in a single fall event. After deployment, it is destroyed. The full deployed length of a typical fall arrest lanyard with energy absorber is approximately 1.75 metres. Add the harness attachment geometry and body displacement during arrest, and the total fall distance below the anchor point may be 4 to 5 metres. If there is not at least that much clearance below the worker’s feet, a fall arrest lanyard cannot do its job. The person hits the deck — or the structure — before the system completes its work.

That clearance calculation is missed constantly. It is the single most common technical failure in working-at-height planning aboard ship.

The anchor point must be above the dorsal attachment point of the harness, strong enough to withstand the arrest load, and independent of the structure being worked on. A handrail is not an anchor point unless it is engineered and marked as one. A pipe run is not an anchor point. A cable tray is not an anchor point. If the only available fixing is a structural member of uncertain strength, a competent assessment of that member’s capacity must be made — by someone who understands what 15 kN of dynamic shock load does to a corroded bracket.

An anchor point that fails is not a partial failure. It is a total system collapse.

4. Fall Arrest vs Work Positioning — Two Different Systems, Two Different Purposes

Fall arrest stops a person who has already fallen. Work positioning holds a person in place so they can work with both hands free. The two serve different functions and must never be substituted for each other without understanding the implications.

A work positioning lanyard is short — typically under one metre — and is attached to side D-rings on the harness, wrapped around a structure, and adjusted so the worker can lean back against it and remain supported. It is not designed to arrest a free fall. It is designed to prevent the worker from reaching a fall edge in the first place, or to hold them in a stable working position on a vertical structure such as a mast ladder.

Work positioning must always be backed up by a separate fall arrest system. If the work positioning lanyard fails, or the worker unclips to reposition, the fall arrest lanyard on the dorsal D-ring must be connected to an independent anchor point and ready to catch. Without that backup, work positioning is a single-point-of-failure system. On a moving vessel, single-point-of-failure systems for life safety are not acceptable under any circumstances.

The certifications are different. The inspection regimes are different. The markings are different. If the person selecting the equipment cannot explain which is which and why both are needed, the job is not ready to start.

5. Rescue Planning Before the Ascent

This is the section that matters most, and it is the section most often reduced to a single line on a permit form.

A person who has been arrested by a full-body harness at height cannot self-rescue. The forces involved in the arrest event are likely to cause disorientation, potential injury, and immediate onset of harness hang syndrome — the compression of femoral veins by the leg straps, pooling blood in the legs, and progressive reduction in venous return to the heart. Consciousness can be lost within minutes. Cardiac arrest can follow.

The rescue plan must exist before the person leaves the deck. It must answer every one of these questions:

• Who performs the rescue? Named individuals, briefed, equipped, standing by on deck — not on watch elsewhere, not in the engine room, not ashore.
• How do they reach the casualty? By what route, with what equipment? If the primary route is the same ladder the casualty fell from, is it still usable? Is there an alternative?
• How is the casualty lowered? By what means? A rescue descent device? A pre-rigged hauling line? A stretcher system? Whatever it is, it must be rigged or immediately available, not stored in a locker three decks down.
• What is the time target? From the moment of the fall to the moment the casualty is on deck and receiving first aid. Fifteen minutes is a maximum. Ten is better. Longer than that and the physiology is unforgiving.
• Has the rescue been practised? Not discussed. Practised. With the actual equipment, at the actual location, by the actual personnel. A rescue plan that has never been tested is a theory, not a plan.

If the rescue plan cannot be articulated clearly by the person in charge of the job, the permit should be refused.

6. Weather, Motion, and the Decision to Stop

There is no universal wind speed limit for working aloft. The variables are too many — the height, the exposure, the nature of the task, the experience of the person, the vessel’s motion characteristics in the prevailing sea state. But the absence of a fixed limit does not mean the assessment is subjective. It means it must be made carefully, by someone who understands what a 25-knot gust does to a person on a mast platform 30 metres above the waterline, and what a 5-degree roll period does to that same person’s ability to hold position and control tools.

Many companies set administrative limits: work aloft ceases above Beaufort Force 5, or above a specified roll angle, or when the Master judges conditions unsuitable. These are minimum standards. Conditions below those thresholds can still be unworkable depending on the task and the location.

The critical failure mode is not starting work in bad weather. It is continuing work after conditions change. The forecast said moderate. The job was half done. The wind increased. The swell came up. Nobody called a stop because the job was nearly finished.

Nearly finished is the most dangerous phase of any job aloft.

The OOW must be informed that personnel are working aloft. The OOW must monitor weather changes and has the authority — and the obligation — to call the work down if conditions deteriorate. That authority must be understood by everyone before the job begins. It is not a suggestion. It is an order.

7. Dropped Object Prevention

A spanner dropped from 25 metres strikes the deck at approximately 80 kilometres per hour. A shackle, a bottle of touch-up paint, a marlinspike, a mobile phone — all of them become lethal projectiles in a fall from working height.

Dropped object prevention is not optional and it is not an afterthought. Every tool taken aloft must be tethered to the worker or secured in a closed tool bag that is itself tethered. Loose items in pockets are not secured. Items placed on a platform grating are not secured. On a vessel with any motion at all, anything not physically attached to something will eventually move, and moving on a mast platform means falling off a mast platform.

The exclusion zone below the work area must be rigged before the ascent — not after, not once the work starts, not when someone remembers. Barrier tape as a minimum. Physical barricades where practicable. A dedicated lookout at deck level if the area is a traffic route. Signage alone is not sufficient. People walk through signs.

Hard hats are mandatory for all personnel within the exclusion zone, including the standby person and any supervisory visitors. The person aloft wears a hard hat with a chin strap — a bare head at height is an invitation to a secondary injury during any stumble or arrest event.

8. Common Failures That Kill

These are not theoretical. Every one of these has appeared in casualty investigation reports, repeatedly, across flag states and fleet types.

Single-point anchor reliance. One clip, one point, no backup. The karabiner gate sticks. The anchor fails. The lanyard is accidentally unclipped during repositioning. Without redundancy, a single mechanical failure equals a fatality.

Harnesses used as belts. Leg straps left undone. The harness worn over bulky clothing so loosely that in an arrest event the wearer submarines through it. Or the old waist-only belt used because it is faster to put on. Speed of donning is not a factor that matters to a dead person.

No radio communications. The person aloft has no radio. The standby person on deck has no radio. Communication is by shouting. In wind, at height, through a hard hat, shouting does not work. And when conditions change or an emergency develops, the delay in communication becomes the delay in response. Seconds matter. Shouting wastes them.

Work continued after conditions changed. The swell increased. The wind backed and freshened. Rain made the ladder rungs slippery. Nobody made the call to come down because the job was almost done. This is the most common precursor narrative in fatal fall-from-height incidents at sea.

Rescue plan absent or fictional. The permit says ‘rescue by ship’s crew using available means.’ That is not a plan. That is a sentence. When the person is hanging unconscious at the top of the foremast and the bosun is looking up trying to work out how to reach them, that sentence provides nothing. The equipment is not staged. The route is not planned. The people are not briefed. The casualty dies while the rescue is being invented.

Inspections not done. The harness was last inspected six months ago. The lanyard’s energy absorber pack is swollen from moisture ingress. The karabiner gate does not lock. The webbing has a cut that was not noticed because nobody looked. Textile PPE degrades. It degrades faster in a marine environment. The inspection before use — by the wearer, verified by the supervisor — is not a bureaucratic requirement. It is the last check before the equipment is asked to hold a life.

Equipment that has not been inspected has an unknown status. Unknown is not the same as safe.

9. Closing Reality

The harness does not save the person. The harness arrests the fall. What saves the person is the rescue that follows — and the rescue that follows depends entirely on planning that happened before the person ever left the deck.

Every signature on a permit to work aloft is a statement that the fall has been imagined, the arrest has been planned for, and the rescue has been prepared. If any one of those is missing, the signature is a lie, and the system is relying on luck.

Luck is not a control measure. It never has been.