In short: A muster point headcount at a refinery or fuel terminal has one job, which is to tell the incident controller within minutes who is unaccounted for and where they were last seen. On most UK COMAH sites that answer still depends on a swipe list, a paper roll and a radio, and it breaks down in exactly the conditions (turnarounds, contractors, alternate muster points) when it matters most.
Key Takeaways
- The headcount decides who goes back in — Every name that cannot be reconciled at the muster point becomes a search, and on a major hazard site that means sending responders towards the hazard.
- Turnarounds and contractors break paper rolls — A shutdown can multiply the people on site several times over, and the gate list falls out of step with who is actually inside within hours.
- Muster readers need coverage at every muster point — Electronic mustering only works if handheld readers, location tags and warden radios have a signal at the primary and the alternate assembly areas, including when the site's own systems are failing.
In a nutshell
What is a muster point on a COMAH site?
A muster point is a designated assembly area where everyone on site gathers when the emergency alarm sounds, so that the site can be accounted for and the people who are missing can be identified. On an office estate it is a sign in the car park and a fire warden with a clipboard. On a refinery, a gas terminal or a bulk fuel depot it is part of the on-site emergency plan, and the headcount taken there feeds the most consequential decision the incident controller will make in the first half hour, namely whether to send people back into the plant to look for someone.
Under the Control of Major Accident Hazards Regulations 2015, an upper-tier COMAH operator must prepare an on-site emergency plan and review, test and, where necessary, revise it at intervals of no more than three years. Accounting for people is a standing part of that plan, and the Competent Authority (HSE with the Environment Agency, SEPA or Natural Resources Wales) will expect to see that the arrangement has been exercised. The Regulatory Reform (Fire Safety) Order 2005 adds a general duty for evacuation procedures across all workplaces. Neither sets a target time for a muster, which leaves each site to set its own.
Why does the muster point headcount matter more on a major hazard site?
Because an unreconciled name on a major hazard site has to be treated as a person in danger until proven otherwise. If the roll says 412 are inside and 409 are at the muster points, the incident controller has three people to find, and the search will be carried out by an emergency response team in breathing apparatus, walking into an area that may contain a vapour cloud, a fire or a toxic release.
Offshore, the lesson came from Piper Alpha, which killed 167 people in July 1988; Lord Cullen's inquiry led to the safety case regime and to the Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, under which personnel-on-board tracking and timed musters to the temporary refuge are now routine on every installation on the UK Continental Shelf. Onshore, the equivalent discipline is less uniform. At Texas City in March 2005, the 15 people killed were contractors, most of them in temporary trailers sited near the isomerisation unit, and the US Chemical Safety Board found that non-essential staff had not been moved away from the unit before a hazardous start-up.
The cost of a poor headcount therefore runs in both directions: (i) a false missing person sends a search team into the hazard for no reason, and (ii) a genuinely missing person who has been ticked off by mistake gets no search at all.
How do most UK sites take a muster point headcount today?
Most sites run some combination of three methods, and many run all three at once because none is trusted on its own.
Firstly, the gate list. Turnstiles or card readers at the site entrance record who has badged in and out, and when the alarm sounds someone prints, or calls up on a tablet, the list of everyone recorded as inside. Secondly, the paper roll or T-card board, where each muster point warden holds a list or a rack of cards and ticks off the people who arrive. Thirdly, the radio sweep, where wardens read out names or numbers to the control room or the incident controller, who reconciles the totals by hand.
Each method has a known weakness. Gate lists are only as good as the discipline at the turnstile, and tailgating, a vehicle gate left open for a delivery, or a contractor who badged in at the wrong reader all leave the list wrong before the alarm has even sounded. Paper rolls depend on the warden knowing faces, which is reasonable on a quiet weekday with a stable workforce and much less reasonable at 2am during a turnaround. Radio sweeps are slow, and they use the same channel the incident team needs for everything else.
What goes wrong during a turnaround?
A turnaround is the period when an operator shuts down a refinery unit or a terminal for planned maintenance and inspection, and it is the moment when the headcount is most likely to fail. The workforce can grow several times over for a few weeks, most of the additional people are contractors who do not know the site, and work is spread across scaffolds, vessels and confined spaces that are normally empty.
At Stanlow, Fawley or the Humber refinery, a major turnaround can bring in contractors in their thousands, many on rotating shifts and many working inside structures where the nearest muster point is not obvious. The gate list grows in volume while getting less accurate, because shift changes produce crowds at the turnstiles and supervisors under time pressure wave people through. Wardens do not know faces. Some contractors are inside confined spaces under a permit, with a standby attendant, and the muster arrangement has to account for both of them as well as for the permit being suspended.
We wrote about the permit side of this in our piece on digital permit to work during turnarounds; the muster is the other end of the same problem. If a site already knows which permits are live and where, the muster system should be able to cross-check that list against the people who have reached a muster point, and send the search team to the permit location first.
What does electronic mustering need from the site network?
Electronic mustering replaces the tick on a paper roll with a read: a badge tapped on a muster reader, a wearable tag that registers when it arrives in the muster area, or a handset that checks in. The reconciliation then happens in software, against the gate list and any location data, and the incident controller sees a live list of who is unaccounted for and, ideally, where each of them was last located.
The products to do this are mature, and several access control and worker-safety vendors sell them. The weak point is almost always the link between the muster point and the system that holds the list, and there are three reasons for that.
Firstly, muster points are usually on the edge of the site, upwind and away from the process plant, in car parks, on grass verges or by the perimeter fence, where nobody ever ran a data cable. A fixed muster reader needs power and a network connection at a place that is otherwise empty.
Secondly, there is never only one muster point. Sites designate alternates, because the primary assembly area may be downwind of the release, and the incident controller chooses on the day. Portable muster readers solve the cabling problem, but they then need a mobile signal at every alternate, and public network coverage on large industrial estates (on the Humber bank, at Grangemouth or along Milford Haven, for example) is variable at ground level and not something the site controls.
Thirdly, the network has to keep working while the site is having its worst day. If the mustering system depends on the site's corporate Wi-Fi, a cloud service reached over a single fibre, or a public network that becomes congested when hundreds of people pick up their phones at once, then it is most likely to fail at the moment it is needed.
Where does private 5G fit, and where does it not?
A private 5G network gives a site one licensed, managed radio layer that it controls, covering the process areas, the tank farms and every primary and alternate muster point from a small number of radio units. We believe that matters for mustering in three specific ways: (i) portable muster readers and warden handsets work at any assembly area the incident controller chooses, because the coverage has been planned and surveyed to include them; (ii) the core network and the mustering application can run on site, behind a UPS, so they keep working if the fibre to the outside world is cut; and (iii) the same network carries the location data from worker tags and handsets, so a missing person comes with a last known position rather than a name alone.
Positioning is the part that changes the search. A badge reader tells the incident controller that a person is missing; a tag that has been reporting its position over the network tells them that the person was last seen on the second level of a scaffold on the crude unit four minutes ago. GPS performs badly inside steel structures, which is why we cover indoor positioning in our post on lone worker safety on UK energy sites.
Private 5G has limits here. It does not remove the need for paper as a fallback, and any site that removes the T-card board before it has proven the electronic system through several live exercises is taking a risk the Competent Authority will question. Handsets and tags used inside hazardous areas must be ATEX or IECEx certified, which narrows the device choice and adds cost (we cover that in our post on ATEX mobile phones). And for a small depot with one muster point beside the office, a cabled reader and a good paper roll will do the job; the case for a site-wide network is strongest on large, multi-unit sites with alternates, contractors and turnarounds.
How should a site test whether its muster point headcount works?
The honest test is a timed, unannounced exercise during a busy period, scored on two numbers: how long it took to reach a reconciled count, and how many names were wrong at the end of it (people listed as missing who were safe, or people ticked off who were not there). A muster that is fast but wrong is worse than a slow one, and both numbers belong in the COMAH exercise record.
We would suggest sites run the exercise at least once during a turnaround, once at night and once with the primary muster point declared unusable, because those are the three conditions that expose a gate list, a paper roll and a patchy signal. If the radio traffic during the exercise is dominated by wardens reading out names, or if a portable reader at the alternate muster point cannot reach the server, that is the gap to close first.
Aerix designs and runs private 5G networks for UK industrial sites, including coverage surveys of muster points and alternate assembly areas. If your next COMAH exercise or turnaround is coming up, talk to us about surveying the site before it starts.