Applied

Lessons Learnt - Macondo


The following  contains extracts from the USCG Deepwater Horizon investigation. Any opinions expressed or any bias placed are those of the website author and are to generate discussion points.


This document was used in an attempt to develop discussion within the authors employer by relevant departments to compare any deficiencies that may have existed on Deep Water Horizon  to ensure similar did not exist on  their vessels.


No criticism is meant of any persons or company involved in this dreadful incident.












Deepwater Horizon


Lessons Learnt





Marine Team informal Discussion record


Activity record

Section Title Page Discussion

4.1 Electrical Equipment 6  

4.2 Equipment Operation 8  

4.3 Equipment 9  

4.4 Maintenance 11  

4.5 Common Ventilation Systems 12  

4.6 Management 12  

4.7 Training 16  

4.8 Structural Layout 18  

4.9 Crew Actions 20  

4.10 Individual Actions 21  

    




Contents

1.0 INTRODUCTION 5

2.0 Definitions 5

2.1 USCG REPORT, REPORT 5

2.2 VESSEL, DWH 5

2.3 OWNER(S), VESSEL OWNERS 5

2.4 DESIGNATED PERSON ASHORE (DPA) 5

2.5 MODU 5

2.6 INCIDENT 5

2.7 SIR 5

3.0 SCOPE 5

4.0 Dialog 6

4.1 ELECTRICAL EQUIPMENT 6

4.1.1 Report Findings –Hazardous Equipment 6

4.1.2 Report Findings – Hazardous Equipment management 7

4.1.3 Report Findings – Third Party Equipment 7

4.1.4 Report Finding -  Electrical power Distribution 7

4.1.5 Report Finding –Transitional Power 7

4.2 EQUIPMENT OPERATION 8

4.2.1 Report Findings – Emergency Generator Starting 8

4.2.2 Report Finding – Closed Bus-tie Operations 8

4.3 EQUIPMENT 9

4.3.1 Report Findings Main Engine 9

4.3.2 Report Findings Gas detection System 9

4.3.3 Report Finding – Lifeboats 10

4.3.4 Report Finding –Lighting 10

4.4 MAINTENANCE 11

4.4.1 Report Findings –Condition of electrical equipment in Hazardous Zones 11

4.4.2 Report Finding – Leg Ladders 11

4.4.3 Report Finding – Watertight Doors 11

4.5 COMMON VENTILATION SYSTEMS 12

4.5.1 Report Finding 12

4.6 MANAGEMENT 12

4.6.1 Report Findings – Overriding Authority 12

4.6.2 Report Finding – Management of Salvage/Fire fighting Efforts 13

4.6.3 Report finding – Interpretation of Flag State Rules 14

4.6.4 Report Findings- Onshore response 15

4.6.5 Report Findings – Safety Culture 15

4.7 TRAINING 16

4.7.1 Report Finding – ISM 16

4.7.2 Report Finding –actions on gas detection 16

4.7.3 Report Finding – Launching Lifeboats 16

4.7.4 Report Finding – Launching Davit Launched Liferafts 17

4.7.5 Report Finding – STCW 18

4.8 STRUCTURAL LAYOUT 18

4.8.1 Report Finding – Fire Protection 18

4.8.2 Report Finding – Blast protection 19

4.9 CREW ACTIONS 20

4.9.1 Report Findings -Distraction 20

4.9.2 Report Finding – Manual Ventilation shutdown on Gas detection 20

4.9.3 Report Finding – Search and rescue 21

4.9.4 Report Finding –Launching Life raft 21

4.10 INDIVIDUAL ACTIONS 21

4.10.1 Report Finding – Masters Actions 22

4.10.2 Report Finding – Fire Fighting Team Muster 22

4.10.3 Report Finding – Actions on Bridge to Outbreak of fire 23

5.0 Information 25

5.1 H CLASS BULKHEADS 25


1.0 INTRODUCTION

On 20th April 2010 , the MODU Deepwater Horizon was on DP   engaged in a drilling  and well abandonment project for BP on the US Outer Continental Shelf (OCS).

Loss of Well Control led to an explosion, fire and sinking of the vessel as well as taking 11 lives and injuring 16 other persons

This document details a review of the USCG investigation into the circumstances surrounding the Explosion, Fire, Sinking and Loss of live on the MODU Deepwater horizon.

The Purpose of this document is to find the salient issues against which lessons may be learnt. It is split up into a number of topics each of which will be discussed as a separate issue. It deliberately repeats a limited number of issues where they are particularly important to the foundation principles of the topic


2.0 Definitions

2.1 USCG report, Report

Investigation report MISLE Activity Number:3721503 into the circumstances surrounding the Explosion, Fire, Sinking and loss of Eleven Crew members about the MODU Deepwater Horizon

2.2 Vessel, DWH

Deepwater Horizon

2.3 Owner(s), Vessel Owners

Transocean, Owner-Operator of Deepwater horizon

2.4 Designated Person Ashore (DPA)

Person  with in depth knowledge of companies Safety Management System (SMS) and access to the highest level of Management

2.5 MODU

Mobile Offshore Drilling Unit. Deepwater horizon was built to  IMO MODU 1989, this has subsequently been revised to IMO MODU 2009 which shall apply to all new built vessels after 2012

2.6 Incident

Loss of Well Control and subsequent Explosion, Fire and loss of life on Deepwater Horizon on the 20th April 2010

2.7 SIR

Superintendents Inspection Report

3.0 SCOPE

This document is limited to the findings of the USCG  investigation into the systems and actions  that may have prevented or mitigated the incident or its subsequent severity. It does not look at the decisions surrounding the operations other than those which are covered by  ISM or  Similar.

Content is limited to  the salient issues contained in the report and does not seek to interpret all content rather than bring out a number of points for informal discussion.


This document is Marine focused

4.0 Topics

4.1 Electrical Equipment

4.1.1 Report Findings –Hazardous Equipment


“At the time of the explosions, the electrical equipment installed in the “hazardous” areas of the MODU (where flammable gases may be present) may not have been capable of preventing the ignition of flammable gas. ............................ an April 2010 audit found that DEEPWATER HORIZON lacked systems to properly track its hazardous electrical equipment, that some such equipment on board was in “bad condition” and “severely corroded,” and that a subcontractor’s equipment that was in “poor condition” had been left in hazardous areas. Because of these deficiencies, there is no assurance that the electrical equipment was safe and could not have caused the explosions.” (Page xi)


..........the April 2010 ModuSpec USA, Inc. audit found that DEEPWATER HORIZON lacked systems to properly track its hazardous electrical equipment and that the hazardous areaelectrical equipment on board was in “bad condition.” The audit determined that contrary to the IMO International Safety Management (ISM) Code, none of the classified electrical equipment on the Drill Floor had been tagged with an identification number, and the MODU did not have on board a hazardous area equipment registry or hazardous area drawing that would have identified both the classified electrical equipment and the boundaries of the hazardous areas. Since the crew did not have any means to clearly identify the classified electrical equipment or the extent of the hazardous areas, there can be no assurance that no unclassified fixtures were introduced into the hazardous areas during maintenance or modifications.” (Page 25)


Conclusions...The classified electrical equipment installed on DEEPWATER HORIZON at the time of the incident may not have been capable of preventing the ignition of flammable gas. Previous

audit findings showed a lack of control over the maintenance and repair of such equipment;” (Page 31)


Notes

This concern is repeated a number of times an probability given to this being a source of ignition for the initial explosion ( with gas ingress into No3 Engineroom  for second).


The Vessel  has a very extensive EEX register which is complete and has thrown up a number of compliance issues. This is due to the active decision made to focus on compliance for equipment contained in the Hazardous Zone  drawings, additional workscope has come about because of an interpretation by DNV of a MODU  requirement to protect against sources of ignition in ‘Exceptional Circumstances. This was viewed as meaning a subsea gas release which created a hazardous gas cloud able to freely move about the vessel. As such all equipment not contained in pressurised areas had to be either Zone 2 rated, isolated, or readily isolatable on gas detection without exposing person to risk


There was been a loosening of DNV’s position on this initially from a ‘greater good’ argument where the availability of Non-EEX essential equipment such as navigational Aids and SOLAS equipment was accepted. More lately the dilution argument for the Dive House appears to have been accepted and a recent meeting held with DNV has possibly resulted in the acceptance of the limited exposure to risk through the small conduit size to the Well.


Seawell  has an existing register which is badly out of date. Actions are underway to resolve this

Discussion Points

Do we treat this seriously enough. Does the changes to OMS9 042 resolve this issue. Do we have sufficient focus of sources of ignition.  Do we believe that the chief engineer has sufficient information to appraise the suitability of third Party Equipment on  vessels

4.1.2 Report Findings – Hazardous Equipment management


A recommendation to IMO was given as

“Include clear requirements for labelling and control of electrical equipment in hazardous areas and to require continued inspection, repair, and maintenance of such electrical equipment;” (page xi)i


Changes have been made to OMS9 042 to implement proper management of  Hazardous Equipment and the associated register. This includes   periodical inspections and close out procedures.


4.1.3 Report Findings – Third Party Equipment

“and that a subcontractor’s equipment that was in “poor condition” had been left in hazardous areas”


Are we doing enough with regard to this? The management of Third Party Contractors is through Business Development and it is for their consideration. They should be providing to the Chief Engineers the assessment and certification Packs  to the chief Engineer who can then subsequently inspect and give assurance to the Master that  the equipment does not represent a risk. Recent discussion with Chief Engineer on Vessel indicated this was not happening.  


4.1.4 Report Finding -  Electrical power Distribution

The Vessel has 6 Main Engines each located in their own protected space. The vessel was operating closed bus-tie closed loop.  The justification for this is given that the breakers are able to open on fault detection in 100mS,


It is not clear but it would appear that only No3 & 6 engines were running although this may not be the case



4.1.5 Report Finding –Transitional Power

“During the casualty, the transitional electrical power on board DEEPWATER HORIZON was operational in the CCR and throughout the MODU, unless the location supplied by the UPS was too damaged to function. As a result, the crew was able to hear and acknowledge alarms, had working IACS panels, utilized the PA/GA systems and utilized the communications system in the CCR. There is no indication of a failure of transitional power.”(page 18)


Discussion Points

We have had two transitional power failures on two  vessels in recent times. This appears to provide evidence that we do not properly maintain and test this system. Is this something we need to be more prescriptive with in OMS and demonstrated during the SIR


4.2 Equipment Operation

4.2.1 Report Findings – Emergency Generator Starting

“The chief engineer tried to start the standby generator in order to bring one of the main generators on line to supply electrical power for the fire pumps. He was unsuccessful.” (Page xiii)

The vessel has 6 Main Engines each located in a protected space  AND an emergency generator. Unfortunately it is not properly explained in the document why such difficulty was experienced in getting this engine started however without it they could not get the others running... apparently. This engine drives amongst a limited number of other items an air start compressor. It would be interesting to learn what happened to the reserve air capacity that should have been already available


Discussion Points

Are their weaknesses in the emergency back up system provided to Seawell And Vessel, Do we carryout sufficient real world’ on load testing, if not why not. Should we be giving more visibility than at present to the importance of testing SOLAS equipment



4.2.2 Report Finding – Closed Bus-tie Operations

DEEPWATER HORIZON had two incidents in 2008 that jeopardized the safety of the MODU, but did not result in investigation. In August 2008, DEEPWATER HORIZON lost electrical power and “blacked out,” which resulted in the vessel losing the ability to actively maintain its position for a period of two minutes


Transocean never conducted an investigation sufficient to determine the precise cause of the blackout. Although the crew planned to change out an actuator and a governor, or a speed limiter on one of the diesel generators, to address the problem, according to ABS’s assistant chief surveyor for offshore, “one governor failure on a DP-3 Class rig should not cause any blackout at all.”


Although not required by law or regulation, neither RMI nor ABS conducted a third-party investigation of this incident. When asked why ABS did not investigate the loss of power, ABS’s assistant chief surveyor for offshore stated, “I can only assume that the guy talking with the people onboard understood the situation and decided it  wasn’t a Class issue.(Page 98)


Note

The governor was found to be 15000 Hours passed its service point.


has had blackout of a vessel which could have resulted in a very serious incident due to a similar issue


Discussion Points

Why do we think the vessel blacked out. Was this contributory to the black out  following the incident.  What could have been done to prevent this.

4.3 Equipment

4.3.1 Report Findings Main Engine

An explosion occurred which took out No3 Engineroom and subsequently blacked the vessel out. Prior to this the engines were heard to ‘rev up’


“Despite the presence of these safety mechanisms, crew members testified that before the explosions, they heard the online engines “rev up,” increasing in rpm, which could indicate that flammable gases were feeding the engines and causing “overspeeding.”(Page 15)

Notes

Assuming this is true this is most likely caused by a HC rich atmosphere entering into the engine though  the Engineroom ventilation system. In this condition the shut down system becomes non-operational as  the engine runs without  the need of a fuel supply. The only way to stop an engine in this condition is by shutting off the air supply typically by a damper mounted in the scavenge trunking- as in this case,  although  other methods are used.


Discussion Point

Are we adequately protected against engine overspeed through ingress of HC.  On some ships this is provided by a canvass cover which can be quickly thrown over the turboblower inlet. Is this practical.

4.3.2 Report Findings Gas detection System

“A September 2009 audit of DEEPWATER HORIZON on behalf of BP revealed problems with both the operability of the fire and gas detection system and the training and knowledge of personnel charged with operating it. The audit found that two flammable gas detectors and seven fire detection devices on the MODU were inoperable and required repair. In addition, at the time of the audit, the Drill Shack’s fire and gas detection system panel was displaying numerous active alarm conditions, including fire alarm, fault emergency shutdown, fault fire and gas, and fire and gas override. These fault conditions rendered the fire and gas detection system inoperable at that time. However, the driller and assistant driller on duty at the time of the audit were unaware of the fault conditions....................................In addition, the chief electronics technician testified that it was standard practice to have a number of detectors set in “inhibited” mode, such that the detection of gas would be reported to the control panel but no alarm would sound, to prevent false alarms from awakening sleeping crew members during the night” (Page 20)


“The chief electrician testified that if the access door to the Drill Shack was held open for an extended period of time the work station would “lose purge.” Because the BOP control panel was kept separate under a positive pressure, if the BOP control panel doors were opened causing it to “lose purge,” it would automatically shut down electrical power, requiring the panel to be cleared and restarted. As a result, the crew had set the positive pressure feature of the BOP control panel in a continuously bypassed condition to avoid unnecessary shutdown of the system.” (Page 26)



Notes

Vessels has suffered reliability issues with one  being particularly severe. Efforts are underway to resolve this including r a proposal being formed to have the current system replaced with one of more consistent design


Assurance should be given that ALL equipment supplied in the doghouse  is properly protected by the automated isolation system. Where this is not the case then steps should be taken to provide for this.


Discussion Points

Is it  ever acceptable to operate with a failed  or by-passed Gas detector head. How would we manage such a situation should it occur in operation.

How do we capture equipment being installed outside of existing safety protection systems.  

4.3.3 Report Finding – Lifeboats

“As personnel continued to board Lifeboat # 1, crew members attempted to load a stretcher .................... Once he was loaded, he was taken off the stretcher and the stretcher was thrown out of the lifeboat. ..................... who was assigned to Lifeboat # 2, was one of the last people to enter Lifeboat # 1, along with the on-watch Subsea Engineer. .......................... physically wedge himself into the cramped lifeboat to get a seat because some of the injured were laid out.  There was “mass confusion” over how occupants could secure themselves with the color coded shoulder harnesses (Page 48


Discussion Points

Do we routinely practice  getting IP on a stretcher in and out of the lifeboat- are they suitable. Do we routinely  practice or mimic full complement m abandonment to one side. Are we happy that we would not have the same issues with regards to size of personnel

4.3.4 Report Finding –Lighting

“The DEEPWATER HORIZON operations manual states that if normal and standby power were to fail, lighting could still be provided at essential locations by 1.5 hour rated battery back-up systems built into selected lights wired to the standby system.220 Many of the survivors reported difficulty finding their way out of the Accommodations and Galley Areas due to darkness.221 It is not clear if there was an inadequate level of battery lighting, if the battery lighting units had

been damaged by the explosion, or if they were inoperable because they had not been properly maintained. Once the personnel arrived at the Embarkation Stations, there was no emergency lighting to illuminate those areas.” (Page 55)

Notes

There has recently been two failures of  Ships Battery back up systems on H vessel, one of which whilst vessel in service when she suffered a Black  out and the Battery supplied system failed to operate leading to loss of  such as  GA.


Emergency lighting at Lifeboat embarkation deck is a statutory requirement.


Discussion Points

Why do you think they escape route where poorly lit. Is the use of tape over lights appropriate. Are we happy that the routes are properly lit on our vessels


4.4 Maintenance

4.4.1 Report Findings –Condition of electrical equipment in Hazardous Zones

“.............several of the shale shaker motor starters were “extremely dirty and covered in mud,” drilling mud agitator frames were “severely corroded,” and both types of equipment had missing or illegible certification labels” (Page 25)

Notes

When looking at the current status of EEX equipment on one of the vessel


Discussion Points

How do we capture this. Is the SIR robust enough for this. What about the proposed changes to OMS9 042,  is this the solution?



4.4.2 Report Finding – Leg Ladders


The master then jumped approximately 50 feet into the water, followed by the on-watch SDPO182 and on-watch motorman. The chief electronics technician made his way to the Helicopter Landing Deck

from which he jumped approximately 71 feet into the water. They did not use the fixed metal ladders extending from the embarkation deck to the surface of the water.(Page 49)


The DEEPWATER HORIZON was fitted with fixed vertical ladders at the Embarkation Decks that extended from the embarkation deck to the waterline.213 However, the on-watch SDPO knew the bottom 15 to 20 feet of the ladders were severely damaged, so that even if he used one, he would still have had to jump. (Page 54)


Discussion Points

Why do you think the ladders were so corroded.  Do you believe this would have been reported, why was it not acted upon


4.4.3 Report Finding – Watertight Doors

In April 2010, a second report, from a survey conducted by inspectors contracted by Transocean, identified one issue “that directly affect[s] the stability of the rig”:

“The watertight doors appeared to be in fair condition. The rig had two of the hydraulic doors out of service and not working correct[ly], on the 28 1/2 m (94 ft) deck level and also on the 24 m (79 ft) deck level, that have to be manually opened and closed.”


Discussion Points

Should the vessel have been operating with two water tight doors not capable of being  closed remotely

Did this add to the sinking of the vessel


4.5 Common Ventilation systems

4.5.1 Report Finding

“The design did not adequately take into account that the proximity of the air inlets to each other created a risk that flammable gases could impact all six generators at once.”


“Conclusions ...The arrangement of main and emergency generators on DEEPWATER HORIZON met the requirements of the 1989 IMO MODU Code for separation by A-60 divisions; however, the arrangement of air inlets was not adequately taken into account. Flammable gases may have affected all six engine rooms since their air inlets were not exclusively located. “ (Page 32)


Notes

Guidance should be given to assist the  senior watchkeeper on the bridge how to balance the risk of gas  ingress into No3 Engineroom, against the loss of equipment supplied in activating the manual damper closure following gas detection


Currently this is not pressing  as the risks  is relatively  low but with increased volumes of HC’s associated to  future Well Return operations this will become more pressing.


Discussion Points

Are we satisfied that there are not risks created by positioning of vents, in particular new vents on Vessel for No3 Engineroom for current and future planned operations. Do we know enough abouth planned operations to make this assessment







4.6 Management

4.6.1 Report Findings – Overriding Authority

Because of a “clerical error,” by the Republic of the Marshall Islands, DEEPWATER HORIZON was classified in a manner that permitted it to have a dual-command organizational structure under which the OIM was in charge when the vessel was latched on to the well, but the master was in charge when the MODU was underway between locations or in an emergency situation. When the explosions began, however, there was no immediate transfer of authority from the OIM to the master, and the master asked permission from the OIM to activate the vessel’s EDS. This command confusion at a critical point in the emergency may have impacted the decision to activate the EDS. (page xii)


“....... command was to shift from the OIM to the master. The transfer of responsibility and authority could be done verbally, with the time noted and a formal documented transfer completed when time allowed. Whenever possible, a PA system broadcast was to be made at the time of transfer to ensure that all personnel were aware of any change in command.

This arrangement may have impacted the decision to activate the vessel’s EDS. At the time of the casualty, the master was in the CCR conducting a familiarization tour for BP and Transocean executives. The OIM was below in his stateroom and did not arrive in the CCR for several minutes after the explosions. Upon his arrival, there was no immediate transfer of responsibility between the OIM and the master and no verbal or PA announcement to indicate that the master

had relieved the OIM as the person in charge. This failure to clearly delineate that the responsibility for the operation of DEEPWATER HORIZON had shifted from the OIM to the master created a situation in the CCR where it was unclear who was in charge. The lack of

clarity is evidenced by the fact that the master asked the OIM for permission to activate the EDS. The confusion was further demonstrated by the fact that by this time, the subsea supervisor had already activated the EDS” (Page 28)

Notes

On DWH the Master not only refused to operate the ESD despite the obvious loss of Well control until he had got the permission of the OIM he acted to prevent the Subsea Engineer from doing the same.


The Masters role   incorporating the OIM position  dictates that the issues surrounding the decision made or not made by the DWH Master are mute.

Discussion Points

Is there conflict or lack of clarity at any time with regard to this. Can we give examples.


4.6.2 Report Finding – Management of Salvage/Fire fighting Efforts

“The parties involved in the fire-fighting and salvage efforts made two decisions that, taken together, resulted in a marine fire-fighting effort that lacked direction and coordination and paid insufficient attention to the risks of excess water destabilizing the MODU. These decisions were

(1) the Coast Guard’s decision to focus priority on Search and Rescue; and (2) the Transocean salvage contractor’s decision not to develop a salvage plan.” (Page 78)


At the same time, no one from DEEPWATER HORIZON took charge of marine fire-fighting.

The master was responsible for the safety of DEEPWATER HORIZON, but could not recall leading a fire-fighting effort before he departed the scene on the morning of April 21. Transocean’s operations manager-performance, who remained on scene after the survivors departed, indicated that he was not leading the fire-fighting effort (Page 79)


“The unavailability of loading information during the response, which would have indicated the displacement, weight centers, and tank levels maintained onboard DEEPWATER HORIZON prior to the incident, prevented responders from being able to take reports from on scene and use a computer model to rapidly evaluate various damage scenarios to possibly determine how long they had until the MODU sank or capsized.

An operations manager for Transocean, who was also the initial Transocean emergency response center coordinator for the response, testified that “there are vessel reports, loading conditions sent in so that they are there and available in the event we need them.”However, when Transocean was required by subpoena to provide “the most recent loading data of DEEPWATER HORIZON prior to the incident,” the company did not produce any and stated that they “have not

located any documents responsive to this request”.(Page 84)


Conclusions....... “Transocean did not follow its operations manual, specifically by not maintaining watertight integrity and by not conducting required deadweight surveys.

Transocean responders were unfamiliar with the vessel response plan; specifically they did not use pre-established resource providers.”(Page 87)


Report Finding

In the event of a serious contingency requiring abandonment who do we believe will manage the fire fighting co-ordination

Are we able to assist with Stability issues. Who is co-ordinating fire fighting on sight after abandonment. How is this tied into stability


Should we have an agreement with a Salvage Company, Does  Helix Already have an agreement in place?



4.6.3 Report finding – Interpretation of Flag State Rules

“The Minimum Safe Manning Certificate (MSMC) issued by the Republic of the Marshall Islands (RMI) for DEEPWATER HORIZON listed the vessel as a self-propelled MODU rather than as a dynamic positioned vessel. RMI has since acknowledged that listing the unit as a self-propelled MODU was the result of a “clerical error.”. For self-propelled MODUs, the RMI requires a master to be on board when the vessel is underway and allows an OIM to be in charge when it is latched-up. For dynamically positioned vessels, the RMI requires a master to be on board at all times but does not clearly define the chain of command.”(Page 27)

Notes

It is  possible that Transocean may have recognised this ‘error’ but chose to comply with its effects as a deliberate act for their own reasons.


have been in discussion with DNV regarding the Well Intervention Notation  and in particular the difference between the equipment requirements for WI and WI-R. ***** are making argument that there is a reduced risk due to the conduit size and that the equipment requirements should be reduced and that interpretation of MODU should be more favorable

Discussion Points

Is  ******* going down the same road as Transocean potentially did or are the arguments put forward in terms of the level of risk valid. Do Marine sufficiently understand the risks to make this  judgement call or are we battering DNV  blindly



4.6.4 Report Findings- Onshore response

The investigation revealed that Transocean responders were not familiar with the VRP and its requirements. When a Transocean operations manager assigned as coordinator for the Transocean emergency response center was asked “Have you heard of what is called a “vessel response plan?” he responded, “I am not familiar with the term “vessel response plan,” no sir.”

The director of upgrade and repair projects had a similar response and confirmed that he had never seen the VRP. Furthermore, there was no specific evidence establishing that Transocean had conducted the drills required by the VRP. The Transocean director of upgrade and repair projects within the engineering and technical support group, who was also a member of the Transocean Emergency Response team responding to the event and had been employed by

Transocean or a predecessor company since 1984, testified that he last participated in a drill regarding a fire on a MODU five or six years ago. Given  Transocean’s responders unfamiliarity with the VRP after the incident, it is Questionable if the required training portion of the plan was exercised. (Page 83)


Discussion Points

Are we conformable that in the event of a contingency Marine are in a position to  assist eht vessel. Do we believe this is true of *****. How could we improve on this. Where is our VRP? Should we make up a response package containing  drawings, Stability information etc to supplement the ER Folder?

In the event of abandonment who would take control of Salvage/Fire Fighting.


4.6.5 Report Findings – Safety Culture

“Transocean also did not create a climate conducive to such analysis and reporting of safety concerns. In March 2010, Transocean hired Lloyd’s Register, a classification society, to conduct a SMS Culture/Climate Review which included auditors conducting surveys at Transocean offices and vessels over a two week period. The results indicated that “a significant proportion (43.6%) of the personnel participating in the perception survey reported that they worked with a

fear of reprisal if a casualty or near miss occurred. This issue is strongly related to the company’s casualty investigation process, which nearly 40% of the participants believed was applied to apportion blame.”At a company where employees fear reprisal for whatever reason and when there are significant costs associated with any unscheduled shutdown or delay of drilling activities, it is unlikely that the crew would report safety issues even if it identified risks” (Page 104).


“Given the fear of reprisal amongst almost half of the crew members questioned during the Lloyds Register SMS Climate and Culture assessment, and the inherent difficulties for crew members to come forward with information about safety concerns, consideration should be given to making reporting of safety violations mandatory rather than voluntary” (Page 109)


Discussion Points

Do we believe we have an issue at *********. Should this be mandatory, what are the negative effects of this





4.7 Training

4.7.1 Report Finding – ISM

“The master acknowledged that the training he received on the Safety Management System consisted of viewing a PowerPoint presentation, the content and whereabouts of which he was unable to recall. The master was not aware that he had the authority to activate the Emergency Disconnect System” (Page xix)

Discussion Point

Do we provide sufficient training not only for the Master but  other members of both on and offshore. Is it good enough that we simply point them in the direction of the information. Should we have an assurance activity such as a checklist where the persons confirms that  they have read certain sections


4.7.2 Report Finding –actions on gas detection

When the Bridge crew began receiving the gas alarms, they did not immediately activate the ESD system to prevent ignition by the engines. This delay may be attributed to a lack of clear procedures and training.(Page 27)


Conclusions....The fire and gas detection system was not arranged to automatically activate the emergency shutdown (ESD) system if flammable gases were detected in critical areas. The system relied upon the crew on watch in the Central Control Room/Bridge to take manual actions to activate the necessary ESD systems; however, inadequate training was provided to clarify each crew member’s responsibilities in the event of fire or gas detection. As a result, the Engine Control Room was not immediately notified to shut down the operating generators following the detection of gas, nor was the ESD systems activated for these areas.” (Page 32)

Discussion Points

Have we ‘enabled’ the crew to make the correct decisions with regard to this. Should this decision making process be included in more drills. Have we identified where all these critical decisions are located. Can we give additional examples such as the decision of the Chief Engineer to release the CO2 into a space which he knowingly contains person(s)


4.7.3 Report Finding – Launching Lifeboats

“As personnel continued to board Lifeboat # 1, crew members attempted to load a stretcher ...........Once he was loaded, he was taken off the stretcher and the stretcher was thrown out of the lifeboat.........He described the environment inside the lifeboat as“pandemonium.” There was “mass confusion” over how occupants could secure themselves with the color coded shoulder harnesses.

According to a crane operator, the muster of personnel at Lifeboat # 2’s Embarkation Deck was so chaotic that they attempted to have the mustering personnel count off to determine how many people were at the station. The personnel were so scared that they could not provide an accurate count, so the decision was made that they would just to fill the boat to capacity, load the wounded and launch.” (Page 48)


“.........the coxswain was “a bit excited” so he told the coxswain “to calm down.” .......... He recalled the coxswain was going to turn on the air supply to the lifeboat and the  water spray system to cool the boat; however, that was never done.” (page 49)


“Consistent with previous drills, DEEPWATER HORIZON evacuated personnel donned lifejackets after being alerted of the emergency. In addition, previous practice lowering, starting and operating the lifeboats proved critical as both boats were safely launched from DEEPWATER HORIZON without serious incident”. (Page 60)

Discussion Points

Despite these comments the USCG highlight that the efficiency at which the lifeboats where launched  no doubt saved a large number of lives. Do we treat this seriously enough? Do we ensure that persons attending drills are fully kitted and booted and that they treat it seriously.


Are we sure the coxswain understands how to turn on the cooling water/ air supplies


4.7.4 Report Finding – Launching Davit Launched Liferafts

“As a result of the crew’s efforts to quickly launch the liferaft with a line still attached to the MODU, all of the occupants were tossed about and one fell out of the liferaft upon its impact with the water. DEEPWATER HORIZON’s Manual for Lifesaving Appliances outlines detailed operating instructions from Schat-Harding, the manufacturer of the liferaft launching appliance (davit), and requires the officers-in-charge of emergency procedures to further read the

liferaft manufacturer’s (VIKING) operating instructions. Notably, the two sets of instructions differ in the sequence of actions to be performed by the officer-in-charge. The davit manufacturer requires adjusting the attitude of the davit first while the liferaft manufacturer

requires the attaching of the liferaft first.Only the VIKING instructions, typically posted at the operating station, remind crew members to disconnect the painter line” (Page 60)


“.........this requirement only tests the operation of the davit and does not exercise the crew’s readiness to use the davit and liferaft together” (page 61)


Conclusion....Transocean’s failure to include on board training in the use of davit-launched liferafts, including the proper inflation and lowering of the liferafts at intervals of not more than four months as prescribed by regulations, significantly reduced the crew’s competency in performing these functions in an emergency” (Page 70)

Discussion Points

Are we confident that the Crew are adequately informed and trained in operating the davit Launched Liferafts


4.7.5 Report Finding – STCW

“Safe Manning Certificate (MSMC) identifying the required capacities such as master, OIM, chief engineer, oiler, and the other positions on the MODU. The RMI confirmed DEEPWATER HORIZON met its Manning Schedule for a dynamically positioned vessel (DPV) MODU at the time of the casualty. According to that schedule, the minimum crew required to operate and respond to emergencies on board DEEPWATER HORIZON was fourteen persons.

However, the DEEPWATER HORIZON Station Bill require more than thirty additional emergency positions including fire team leaders, person in charge of muster, and personnel to clear accommodations, to be filled by industrial and catering crews, none of whom are subject to the STCW.” (page 65)


Note

This echoes the intent of Special Purpose Ship regulations and STCW training for special persons on the vessel. Similar to above  exists on vessels


Discussion Points

Should all persons who are declared on the Station Bill, or who may  be expected to assist during a contingency receive and appropriate level of training. Does the limitation in Fire Fighting equipment preclude this. What about if the contingency takes out a section of trained crew, will the remainder be expected to cope



4.8 Structural Layout


4.8.1 Report Finding – Fire Protection

“DEEPWATER HORIZON did not have barriers sufficient to provide effective blast protection for the crew. Although the barriers separating the Drill Floor from adjacent crew quarters met the standards of the IMO MODU Code, those specifications are only designed to slow the spread of fire, not to resist an explosion. They did not prevent personnel in the crew accommodations area from sustaining injuries.”


“A-class bulkheads are not expected to function as effective fire barriers when exposed to a hydrocarbon fire source. The IMO MODU Code structural fire protection requirements were taken from the International Convention for the Safety of Life at Sea (SOLAS) Chapter II-2 regulations for passenger and cargo ships. The fire scenarios envisioned are typical accommodation area fires involving ordinary combustibles. The approval of A-class bulkheads is based on a standard SOLAS fire test method intended to replicate the burning of materials found in staterooms, such as wood, paper and plastic. The fire risk posed by different fire sources is linked to the fuel’s heat of combustion, which for ordinary combustible materials, is in the range of 16-19 MJ/kg (7,000 to 8,000 BTU/lb). Hydrocarbons are capable of causing more severe fires since their heat of combustion is expected to be in the 44-51 MJ/kg (19,000-22,000 BTU/lb) range.” (Page 40)


“A more stringent laboratory fire test method has been developed to simulate exposure to large scale hydrocarbon fires. Fire barriers that have met the standards of the hydrocarbon fire test are designated as H-class fire barriers.”(Page 40)


1989 IMO MODU Code specifies that:

“9.3.5 Consideration should be given by the Administration to the siting of superstructures and deckhouses such that in the event of fire at the Drill Floor at least one escape route to the embarkation position and survival craft is protected against radiation effects of that fire as far as practicable.” (Page 53)

Notes


Of note from the Macondo incident was the failure of A60 bulkheads to adequately protect against   the explosion and fire. Whilst the former is understood  with the requirements for additional scantling in ‘blast walls’ the latter was less well known with Hydrocarbon fires exposing  structures to 2 to 3 times the heat from ‘ordinary combustible materials’ which the A60is designed to protect against. A BP executive was badly burned despite being within an A60 bounded corridor


Discussion Points

Does the low volumes of HC we expect to see mitigate the concerns regarding the abilities of the A60  bulkhead to protect against HC fire. Do we feel that personnel in evacuation are adequately protected. What about the deck mounted liferafts on Vessel from Radiant heat  Should we be  reviewing   the exposure to explosion from the Derrick/Tower area  to evacuation Routes as well as to embarkation into SOLAS equipment.  Of note are  liferafts which are particularly susceptible to the effects of smoke and radiant heat from the fire.


What do we know about ‘H’ Class bulkheads, is his something we should have in mind when reviewing modifications to structures around the deck.


Are we satisfied that Engineering factor in the effects of HC fires on the structures they install  and the results that failures of same will cause in terms of evacuation, fire fighting etc.





4.8.2 Report Finding – Blast protection

“Typical explosion pressures expected from the ignition of hydrocarbon vapors during a blowout approach the range of 0.02-0.04 N/mm2 (0.2 – 0.4 bar).81 Thus, without further means of blast protection, personnel cannot be effectively shielded from a Drill Floor explosion by Aclass bulkheads.” (Page 22)



Discussion Points

Do we consider that the provision for blast protection is adequate given the level of risk  for current operations. What about future operations such as Well Testing. Are marine suitably informed of the risks of this operation to recognise issues and provide resolutions.



4.9 Crew Actions

4.9.1 Report Findings -Distraction

“The DEEPWATER HORIZON crew did not follow its own emergency procedures for notifying the crew of an emergency and taking steps to prepare for evacuation. For example, contrary to standard procedure, the crew failed to sound the general alarm after two gas detectors activated. This failure may be attributable to the presence of the BP and Transocean executives onboard, which had also prevented key personnel from attending to the well control issues immediately prior to the blowout. A senior drilling crew member acknowledged that if he and the master had not been conducting a tour for the company executives, he would have been on the Drill Floor while key tests were being conducted.” (Page xv)


“........ the senior toolpusher acknowledged that the tour took him away from the Drill Floor: when asked “if the tour wasn’t going on, if there wasn’t visitors, would you have stayed [on the Drill Floor],” he said, “Yes, sir. And I wouldn’t be here talking to you.” Thus, had the BP and Transocean executives not been on board DEEPWATER HORIZON that evening, the OIM and the senior toolpusher would likely have been more aware of the existing well conditions. In turn, once the blowout occurred, there is a greater likelihood that they would have been engaged sufficiently to implement the emergency procedures outlined in the operations manual” (Page 52)


Notes

The relevance for this  is in two ways

Auditing especially when offshore

Request for information

The tour of the vessel entrained much of the senior management including the OIM, Senior Toolpusher, Master and the senior DP watchkeeper leaving junior team members in control of an unstable situation for which evidence existed.

Discussion Points

Is there a mechanism that allows the vessel to push back against excessive auditing if they feel that it is impacting on their abilities to assure and provide for  safe operations. How would onshore react if  Offshore prevented an audit taking place that may have a commercial impact due to   above


4.9.2 Report Finding – Manual Ventilation shutdown on Gas detection


“The gas and fire detection system was not arranged to automatically stop the engines and other machinery or close ventilation dampers if flammable gas was detected; it instead relied on personnel on watch in the CCR to manually activate the ESD systems. However, the crew was not provided with training or procedures to clarify when conditions warranted activation of the ESD systems and what actions to take in such an event. Thus, when multiple gas alarms were received in the CCR during the well control event, no personnel manually activated the ESD systems for the operating main engines” (Page 21)


Notes

No3 Engineroom on WE is required to be isolated by manual intervention of the DP officer on gas detection rather than the automated process seen elsewhere


Discussion Point

Do we feel that  we have properly guided the DP officer in judging the balance between the risk of the gas ingress and the loss of project equipment caused by  closing the dampers and the engines stopping

With the Dampers  having been closed, should  a manual remote stop also  occur on the engines/Switchboard  rather than allow them to run down against the closed ventilation. If we did the latter what are the concerns in terms of creating a negative pressure and potentially inducing gas into that space with equipment, including  still llive. Is it possible that the negative pressure may lead to failure of the dampers? Is ti possible that the negative pressure may make access to these spaces subsequently difficult


4.9.3 Report Finding – Search and rescue

There is, however, no evidence that prior to the abandonment of the MODU, there was any organized effort to determine the condition or location of crew members who may have been injured or trapped. (Page 35)


Discussion Points

Why do we think there was  a lack of co-ordination in the Search and Rescue



4.9.4 Report Finding –Launching Life raft

“As the liferaft quickly descended approximately thirty-five feet below the Liferaft Embarkation Deck, the liferaft's painter line, which was still attached to the MODU, became taut.The liferaft tilted approximately 90 degrees, ejecting the off-watch toolpusher from the stretcher while the other occupants tumbled within the confines of the liferaft. Once the liferaft hit the water, the on-watch DPO fell out of the raft and swam away.The chief mate, chief electrician, and chief engineer exited the raft and began pulling it away from the burning DEEPWATER HORIZON. (Page 50)


Notes

This may have been in part as there where two slightly conflicting launching procedures, one from the Davit Supplier and one from the  raft manufacturer. It is likely that the painter became entangled thus unexpectedly reducing its length


Discussion Point

Are we comfortable that the drills covering the davit launched liferafts are appropriate

4.10 Individual Actions

Note that  this section does not represent either agreement of condemnation with the actions of persons during what was an exceptional circumstance. Its purpose is to allow assessment of their appropriateness given both hindsight and the ability to analyse in an unpressurised environment.


4.10.1 Report Finding – Masters Actions

Shortly thereafter, the on-watch subsea supervisor arrived in the CCR and advised the master, “I’m EDSing.” The master responded, “No, calm down. We’re not EDSing...............Approximately five minutes later, the offshore installation manager (OIM) arrived in the CCR. The master asked and received permission from the OIM to EDS.24 The master then told the onwatch subsea supervisor to EDS; the subsea supervisor responded, “I already hit it” (Page 3)


“Upon arriving at his Fire and Emergency Station in the CCR, the chief engineer heard “The master screaming at the on-watch DPO for pushing the distress button.”After assessing the emergency condition on the Drill Floor and evaluating the fire condition, the chief mate returned to the CCR, reported an uncontrolled fire and informed the master that the crew needed to evacuate.” (Page 47)


Once the liferaft was inflated, the chief engineer ran over to a nearby stretcher containing the offwatch toolpusher and proceeded to drag it across the deck to the Liferaft Embarkation Deck.

The master said, “Leave him,” referring to the injured man. Nevertheless, the chief mate and the chief electrician boarded the raft first, then assisted the chief engineer in loading the stretcher into the liferaft. After the stretcher was loaded, the chief engineer, electrical/electronics supervisor, the senior toolpusher, and the DPO boarded the liferaft. (Page 49)


Discussion Points

Why do we think he was against operating the ESD. Was it fear of repercussions, lack of training or simply that he was complying with Transoceans SMS  in a way he  is expected through tradition to do.


Why do you think that the Master was so concerned that the DPO had sent out the Alert (presumably GMDSS) which resulted in the coast guard putting out a ship alert#


It appears that the Master made a questionable decision when asking the Chief Engineer to leave the IP, but what if he did so to ensure that the other persons could clear the vessel. He did remain back.


4.10.2 Report Finding – Fire Fighting Team Muster


“And that time my first thought was to go to the fire-fighting equipment. Being that when I got there I wasn't the only one there, I was -- I was -- as I was untying my boots to put on the fire-fighting equipment. I noticed that I was the only one there. I looked up at the derrick again and by that time I knew that we were not going to be able to fight this fire. So, I decided to tie my boots back on and make myself -- my way to the lifeboat deck. When I got down there was some other members of the roustabout crew and they told me that they had been to the fire-fighting equipment, but they thought the same as I did that there was no way that we were going to be able to put the fire out.”(Page 43


“The record of the fire drill held on April 18, 2010, just two days prior to the casualty, recommended that more focus be given to the proper donning of personal protective equipment during drills, since it was observed that the brigade members were hesitant to put on hoods during exercises because they were hot and uncomfortable. Further, the OIM placed a comment in the record that fire drills need to be treated as “the real deal”  (Page 43)


Discussion Points

Why did the team(s) fail to Muster, where their decisions appropriate.  Is there anything that could have been done before the incident that would have improved on this

4.10.3 Report Finding – Actions on Bridge to Outbreak of fire

“The Bridge Crew of DEEPWATER HORIZON was likely overwhelmed by the multiple audible and visual alarms immediately before and after the series of explosions and ensuing fire.

The standard procedure for alerting the crew to flammable gas emergencies required the onwatch DPO to manually activate the general alarm (GA) system after two or more gas detectors were activated. In this case, multiple gas alarms had been activated and acknowledged, but the GA was not sounded until the explosions occurred. When asked why the GA was not immediately sounded after the first alarms were received, the on-watch DPO stated, “It was a lot to take in. There was a lot going on”. (Page 61)


“..... despite providing formal and shipboard training, Transocean’s training scenarios did not prepare the merchant marine officers and industrial drilling crew to function as a team under foreseeable hazards such as a well blowout, ........... According to the records of drills, the marine crew and the drill crew performed all required drills within their respective occupations, but the entire crew

did not collectively participate in the fire and abandonment drills because of drilling operations.95% of the time, the drill crew would take their muster and emergency preparations on the Drill Floor. Third party contractors were excused from the drills”. (Page 62)


“Conclusions...... Conducting weekly fire and abandonment drills at fixed times and on predetermined days did not adequately prepare the crew to respond to the casualty “as if the drill was an actual emergency.” The crew would have been better prepared if emergency drills were staggered at different times of the day, on different days and during varying environmental conditions”.(Page 70)


“Certain crew actions during the event itself indicated that Transocean’s emergency drills did not properly prepare the crew for simultaneous well control, fire-fighting, and abandon ship emergencies. The on-watch dynamic positioning officer failed to follow emergency procedures and sound the general alarm after observing the gas detection alarms, failed to notify the watchstanders in the ECR of the alarms so they could shut down the engines, and did not activate the emergency shutdown system for ventilation during a high gas alarm.” (Page 102)

Discussion Points

What could have been done to prevent this. Are more comprehensive and structured drills the way. Do we accept the commercial impact of taking the vessel offhire for half a day every so often to carry out  multi Scenario high impact  Drills. Should we be including Third party Contractors in these



5.0 Information


5.1 H Class Bulkheads

H-120 class divisions are those divisions formed by decks and bulkheads which comply with the following:

They shall be constructed of steel or other equivalent material;

They shall be suitably stiffened;

They shall be so constructed as to be capable of preventing the passage of smoke and flame after 120 minutes exposure to a hydrocarbon fire test;

They shall be so insulated that, if the designated exposure face(s) is (are) exposed to the hydrocarbon fire test for two hours, the average temperature on the unexposed face will not increase at any time during the test by more than 140°C above the initial temperature nor shall the temperature at any point of the face, including any joint, rise more than 180°C above the initial temperature within two hours;

Structures intended to be load bearing should either be tested under representative conditions of loading and restraint or have the temperature of the load bearing medium monitored during the test to demonstrate that the maximum temperature attained would not have resulted in loss of strength or stiffness or excessive expansion such as to impair the load bearing capacity.


 

H-60 class divisions are those divisions formed by decks and bulkheads which comply with the following:

They shall be constructed of steel or other equivalent material;

They shall be suitably stiffened;

They shall be so constructed as to be capable of preventing the passage of smoke and flame after 120 minutes exposure to a hydrocarbon fire test;

They shall be so insulated that, if the designated exposure face(s) is(are) exposed to the hydrocarbon fire test for one hour, the average temperature on the unexposed face will not increase at any time during the test by more than 140°C above the initial temperature nor shall the temperature at any point on the face, including any joint, rise more than 180°C above the initial temperature within one hour;

Structures intended to be load bearing should either be tested under representative conditions of loading and restraint or have the temperature of the load bearing medium monitored during the test to demonstrate that the maximum temperature attained would not have resulted in loss of strength or stiffness or excessive expansion such as to impair the load bearing capacity.


 

H-0 class divisions are those divisions formed by decks and bulkheads which comply with the following:

They shall be constructed of steel or other equivalent material;

They shall be suitably stiffened;

They shall be so constructed as to be capable of preventing the passage of smoke and flame after 120 minutes exposure to a hydrocarbon fire test;

Structures intended to be load bearing should either be tested under representative conditions of loading and restraint or have the temperature of the load bearing medium monitored during the test to demonstrate that the maximum temperature attained would not have resulted in loss of strength or stiffness or excessive expansion such as to impair the load bearing capacity.