Knowledge / Maintenance and reliability

Maintenance deferral: temporary controls and cumulative risk

Assess deferred work through the impaired function, interacting defects, credible temporary controls and a defined expiry and restoration path.

On this page

Deferring maintenance changes the period during which a known task or defect remains unresolved. It does not change the physical condition merely by moving a due date. A defensible deferral decision explains the function at risk, the evidence for continued operation within the applicable requirements, the controls that actually exist and the conditions that end the deferral. Several individually modest impairments can combine into a major loss of resilience.

Describe the impaired function rather than the overdue label

An overdue inspection with no observed defect, a degraded pump and a failed protective switch are different states. Record what is known, what remains uncertain and which failure mechanism the deferred task addresses. “Maintenance overdue” is an administrative description; it does not quantify the functional consequence or establish that the equipment is already failed.

Conversely, a recent completed task does not prove readiness if a defect has since appeared. The assessment should use actual condition, test history and operating context. Identify the applicable manufacturer, class, flag and company requirements and the authority needed for any deviation. A local risk assessment cannot by itself waive a binding requirement or create authority that the assessor does not possess.

Review interacting impairments together

A duty pump defect may appear tolerable while a tested standby is available. If the standby’s automatic-start circuit is also impaired, the combined state differs materially from either work order viewed alone. Shared power, cooling, sensors, sea inlets and personnel can create further dependence. Review the function across systems, not merely the number of overdue jobs in each department.

HSE’s Key Programme 3 report documents weaknesses in offshore deferral practice, including isolated assessments of multiple safety-critical failures and unimplemented additional measures. It is historical offshore evidence, not a current marine deferral rule. Its useful lesson is that approval paperwork and a list of intended controls are insufficient when the combined operating state has not been examined.

Use a simple redundancy example carefully

Assume two genuinely independent units can each satisfy one demand, with hypothetical failure probability 0.01 per demand for each. If either successful unit suffices, failure of both has probability 0.01 × 0.01 = 0.0001. If one unit is knowingly unavailable during maintenance, the remaining functional failure probability is 0.01 under the same assumptions, one hundred times larger.

This is a conditional demand example, not an accident-frequency calculation or a justification for any deferral. Shared failures can invalidate the multiplication, and a demand may have consequences outside the model. The example shows why removing redundancy is a material state change even when the remaining machine is healthy. Calling the unavailable unit “temporarily out” does not preserve its reliability contribution.

Relate the extension to exposure

A longer deferral usually adds exposure to the unresolved condition, but the relationship depends on operating mode and deterioration. For an invented constant event rate of 0.002 per day, the probability of at least one event in 30 days is 1 − exp(−0.002 × 30) = 5.82%; in 60 days it is 11.31%. The model assumes a constant rate and independent increments and is not an estimate for any actual ship.

A calendar extension spanning a high-load voyage can add more consequential exposure than the same number of idle days. Ageing, weather, restricted waters, cargo requirements and alternative equipment availability may change the assessment. Record the assumed operating envelope and the events that invalidate it. Do not treat an approved number of days as permission to enter any operating condition during that period.

Under an invented constant 0.002/day event rate, the at-least-one probability curve rises from 0 to 5.82% at 30 days and 11.31% at 60. A second 30-day administrative extension does not restart the cumulative-exposure clock.
Original constant-intensity Poisson exposure curve,4.2 drawing units/day and 18 units/percentage point. Counts have independent increments under the stated model; the ordinate is the probability of one or more defined events since the original start, not the incremental probability during the next interval. The rate is invented and does not quantify any actual impaired vessel. No acceptable deferral duration, temporary-control credit or authority to waive requirements is implied.

Demand a causal explanation for temporary controls

An additional watch is useful only if the relevant deterioration is observable, the observer can recognize it and a timely effective response exists. More frequent readings do not replace a failed automatic protection against a fast event unless the alternative has been specifically justified. State what the control detects or prevents, its trigger, response and limits.

A spare brought on board may shorten repair delay but does not prevent the installed unit from failing. Reduced load may help a load-dependent mechanism but not an unrelated hidden control failure. Temporary controls should therefore be linked to the specific failure path. Check their resources, competence and availability, and verify implementation before crediting them in the decision. A promised future control is not a current barrier.

Give the deferral an expiry and stop triggers

Define the latest date or operating exposure, the planned repair opportunity and the conditions requiring earlier reassessment. A worsening measurement, loss of another barrier, missed monitoring round or route change can invalidate the basis. The owner of the deferral needs a practical way to receive those changes rather than relying on a document filed ashore.

An extension is a new decision using updated evidence, not a clerical continuation. Repeated short extensions can accumulate a long unexamined impairment. Preserve the original due date, each decision, total deferred duration and changed conditions. Missing evidence should remain missing; it should not be replaced by assumed successful past tests to make the risk assessment easier.

Keep the operational handover usable

The operating team needs a concise statement of the impaired function, current restrictions, actual temporary controls, monitoring duty, escalation trigger and repair plan. Link that statement to the detailed assessment. A lengthy risk matrix is of little use if the watch cannot identify which standby arrangement is unavailable tonight.

Coordinate simultaneous work and planned tests so they do not unknowingly remove a credited control. Include the effect of personnel availability where manual action is part of the temporary arrangement. HSE’s maintenance, inspection and testing overview emphasizes both resources and the management process. A backlog count alone cannot show whether the remaining functions are adequately supported.

Check whether the temporary workload is feasible

Temporary manual controls can compete for the same person and time. In an original workload example, six added checks each require 15 minutes within a four-hour watch. They consume 90 of 240 minutes, or 37.5% of the watch, before travel, interruptions or the watchkeeper’s existing duties. Listing each check as a small commitment separately hides their combined burden.

This arithmetic does not determine a safe workload limit. It reveals an assumption that needs operational review: whether the checks can actually occur at the required times without weakening another duty. Assess simultaneous demands and handovers, and verify actual completion records. If the control depends on resources that are not available, the deferral basis needs revision; repeating the instruction more firmly does not supply the missing capacity.

Close with restored function and learning

Closure requires the repair or justified task completion, relevant functional verification and removal or reconciliation of temporary controls. A part delivery is a milestone, not restoration. A completed repair awaiting a protective test remains a different state from fully released equipment. Preserve the dates so actual impaired exposure can be reviewed.

Investigate repeated deferrals caused by inaccessible equipment, unrealistic schedules, unreliable procurement or unclear ownership. The solution may involve task design or logistics rather than repeatedly rewriting risk assessments. There is no universal acceptable deferral duration: the decision remains bounded by the function, evidence, interactions and applicable requirements. Moving a deadline should never be mistaken for restoring a barrier.

Sources