On April 20 2010 a blowout occurred on the semi-submersible Deepwater Horizon which had just completed a well for BP in the Gulf of Mexico. 11 of the personnel on board died in the subsequent explosion and the remaining crew members evacuated by lifeboat, liferaft and by jumping into the sea. After a couple of days the still burning rig sank in 5000 feet (1524 metres) of water with the riser still attached and the well continued to belch forth thousands of barrels of crude oil per day into the Gulf. The time taken to control the well is measured in months, and during this time a number of investigations took place including one by BP, the operator, one by the US Coast Guard and one termed as “The President’s Investigation”. By enrolling with the Coast Guard as a journalist I was able to follow the progess of the event and the investigation, and as a result compiled a commentary on my old website and then a section of my book “A Catalogue of Disasters”. So for the interest of visitors to this website I have uploaded the resulting document. For convenience I divided it into sections.

Section 1. The vessels involved: The preamble: the Sequence of Events. Click Here

Section 2. The Progress of the investigations: BP’s attempt to stem the flow of oil. Click Here

Section 3. The content of the Investigations:  and my comments. 

Section 4. The Senior Toolpusher’s Testimony. Click Here

 

The Damon B Bankston by Oddgeir Refvik. 

THE INVESTIGATIONS.

What will continue to be described here as the “Coast Guard Investigation” was initiated by the US Coast Guard in conjunction with the Bureau of Ocean Energy Management Regulation and Enforcement (BOEMRE), who were the successors to the Minerals Management Service (MMS) an early casualty in the restructuring of the US offshore regulatory regime. The USCG also carried out its investigation jointly with the Republic of the Marshall Islands the flag of the rig.

The investigators almost immediately identified its areas for investigation. These were:

·      The materiel condition and emergency preparedness of Deepwater Horizon;

·      The vessel’s dual-command organizational structure and how it impacted the crew’s situational awareness, risk assessment and decision making;

·      The role that Transocean’s safety management system played leading up to and during this casualty;

·      The Republic of the Marshall Islands’ safety oversight of Deepwater Horizon;

·      The Coast Guard’s regulatory requirements for U.S. and foreign-flagged MODUs that engage in activities on the U.S. OCS;

·      The “flag state/coastal state” oversight regime for foreign MODUs, which engage in activities on the U.S. OCS;

·      The application of the1989 IMO MODU Code to Deepwater Horizon

·      and The international standards and Coast Guard regulations pertaining to vessels with dynamic positioning systems.

 

The Coast Guard investigation concentrated on the time from the start of the well control event onwards starting with how the explosions had occurred. The well fluids and the gas passed through the mud gas separator and overcame its systems, to exit from the top of the derrick, and probably elsewhere in the Drill Floor area. At this time there were two generators operating, No 3 and No 6, and all the systems in the Drill Floor area were also working.

The investigation had taken in the audits of the equipment installed in what are formally identified as “Hazardous Areas”, all of which are supposed to be electrically safe, either by being explosion proof, low energy or purged by air so as to be at a higher pressure than the surrounding areas. These are known as EX systems. Recent audits had found that much of it was substandard in a variety of ways, and temporary electrical systems may have been in the area, any of which could have caused ignition. There was also the possibility that due to the extent of the gas release, ignition of the first explosion could have been caused by electrical equipment outside the Hazardous Areas. Apparently Transocean had failed to properly manage the EX equipment in the hazardous areas. Some of it was in poor condition, and none of it was tagged in any way, making it impossible for the company to keep track of what was, and what was not, EX. There is much said about the status of what is known in the report as the “Drill Shack” which was intended to be maintained at a positive pressure, so that non EX equipment could be used inside it. However, if the doors were left open it would lose pressure. The BOP control panel was separately positively pressured and if its door was opened and therefore pressure was lost, electrical power would automatically be shut down (It is not absolutely clear from the report whether it is the Doghouse or the BOP panel loss of pressure which would cause the loss of power). But either way, to avoid having to go through the whole process of restarting this system the shut down had been bypassed. It was said that this condition had existed for five years, and a witness stated that “the whole fleet ran them in bypass”.

The second explosion almost certainly occurred in the No 3 engine or the electrical systems in the immediate area. This view is supported by the witness testimony regarding the destruction of the adjacent deckheads and bulkheads. The investigation went into the location of the ventilation for the engines which drew their air from the area on the Main Deck directly above the engine spaces, via the engine rooms. The engines were provided with a number of automatic means of overspeed prevention at least one of which should have been capable of shutting them down, even if they were being fuelled by the gas from the blowout. However, despite these systems witnesses said that No 3 engine had been heard to overspeed. The explosion in the main generator areas resulted in a total loss of power, which indicated to the investigators that even though the rig conformed with regulatory requirements in relation to the provision of emergency power, this had been inadequate to deal with the casualty. Various systems which would be used in an emergency were powered by UPS (uninterruptable power supplies) and so lighting and communications were available after the explosions.

The investigators found fault with the 1989 MODU Code requirements for fire and gas detection and the means of emergency shutdown of the power systems and the ventilation on oil rigs. Essentially what was required by the code was a system provided “to the satisfaction of the Administration”, which some would consider to be a pretty meaningless phrase. But in order to conform with this notional level of satisfaction the Deepwater Horizon was provided with an extensive fire and gas detection system, with detection means for H2S and HC gas and fire and smoke in many spaces, and at ventilation inlets. None of these detection systems automatically shut down anything, and many of the alarms and detectors had been bypassed in order to avoid waking up sleeping personnel. Nor were there any proper instructions to those manning the Control Room/Pilot House as to what action to take on receiving gas or fire alarms. One of the audits carried out in 2009 had found many alarm conditions on the fire and gas panel in the Driller’s Doghouse which would have rendered the panel inoperable, but the Driller on duty had been unaware of the problem.

Essentially this section of the report was dealing with the adequacy or not of the 1989 MODU Code, under which the rig had been constructed. It determined that even the 2009 MODU Code did not really provide guidance as to how gas and fire detection systems should operate, i.e. whether they should automatically shut down systems and vents, and if not what should be done by the Control Room Operators, and even, despite a paragraph relating to power systems and DP operations, what actions should actually be taken.

There is also a section in the report about the limitations of the blast protection installed on the rig, this in accordance with the 1989 MODU Code. And by this time there may be readers who are wondering why the 1989 MODU Code was used since the rig was built in 2002. This is because the designers will use the last code which was in place when the rig was built, and there is no requirement to update or modify a rig even if a later code in initiated, in this case the 2009 Code. In effect all the MODU Codes require little or no blast protection and the report details the places where those who died might have been and as a result that they had probably been killed by the blasts. There were also a number of people injured and, in the aide of increasing our understanding of what was happening in the accommodation, a witness statement is included later, which indicates that the accommodation had more or less collapsed due to the overpressures created by the two explosions.  The report states the cogent phrases from the 2009 code which are repeated here.

“In general accommodation spaces, service spaces and control stations should not be located adjacent to hazardous areas. However, where this is not practicable, an engineering evaluation should be performed to ensure that the level of fire protection and blast resistance of the bulkheads and decks separating these spaces from the hazardous areas is adequate for the likely hazard.”

As usual in the MODU Codes there is no guidance as to what form the “engineering evaluation” should take. 

Concerning the actual activities of the crew members during the accident, firstly the report suggests that maybe the drilling personnel should have used the diverter rather than the mud gas separator, since the latter system was soon overwhelmed. The report considers that the well control situation became evident at around 2100, but it was not until 2150 that the guys on the Drill Floor told anyone what was happening, and in the intervening period all sorts of “normal” activities were taking place. This is quite difficult to understand, and during a conversation by the author with some American drilling personnel a year or so later they thought that the drill crew might have been fearful of being Not Required Back (NRB), had they raised the alarm for no good reason. 

There was at least one call from the Drill Floor to the Control Room/Pilot House, to the on-watch DP Operator that they had problems and before and after the first explosion there were gas and fire alarms. But the watchkeepers took no action. There was a discussion between the Engine Control Room and the Pilot House about the situation, but the engineers were not told to shut down the engines. The DP Operator could also have done that, but there were no instructions or guidance on what to do in the event of fire or gas alarms. Of course shutting down the main engines might have resulted in loss of position, so the EDS system should have been operated first. But none of these things happened. The failure to operate the EDS was at least in part due to the confusion as to who was in charge at the time. The Marshall Islands had made the error of registering the vessel as a “Self Propelled MODU” rather than as a DP MODU. This allowed the OIM, a driller, to be in charge when the vessel was operating in drilling mode and the master to be in charge when under way or in emergencies. At the very least this allowed the confusion during the emergency to escalate. The situation would not have been allowed on a US flag MODU.

 The report goes into considerable detail relating to the inspections and audits carried out on the unit, which extended to 22 separate visits by inspectors in one year. These had different scopes and objectives, some being directed at flag state requirements, communications systems, lifesaving equipment and such. Some related to structural and other class surveys and some were audits carried out on behalf of BP and Transocean themselves. Specifically the US Coast Guard conducts annual Certificate of Compliance (COC) inspections one of which had been conducted in 2009 finding no defects. The specifics of the systems inspected or operated were not detailed in the reports. In fact oil rig systems are extremely extensive and complex, and it is difficult for any inspection to really cover the necessary ground. All they can do is sample the systems, and record the results. And the report notes that there is no means by which the various inspections can be co-ordinated, so that the results of one inspection can be of use to other inspectors. 

The investigation specifically mentions the failure of the Marshall Islands to carry out any sort of inspection on its own, rather than employing ABS to do the job for them. And indeed anyone who witnessed the Coast Guard Admiral being grilled by the Senate Transportation committee would have felt sympathy for him as he tried to explain the limits of the Coast Guard involvement into the operation of the Deepwater Horizon.

 

The investigation went on to consider fire fighting, since subsequent to the explosions, the rig had caught fire. Primarily since the power had shut down there was no possibility of any firewater being provided. The firefighting system required a main engine, a fire pump and the saltwater service system. Once all the main engines had ceased to operate, none of these systems were now available. There were other systems, primarily the CO2system, but none of the compartments fitted were deluged, although controls were available in the Control Room/Pilot House. The deluge which protected the aft accommodation bulkhead was inoperable due to the lack of firewater, and anyway it would have required a crew member to operate a valve on the deck. 

The firefighters themselves did not turn up at the emergency muster station apart from the Chief Mate and one other, and they more or less immediately decided that there was nothing they could do, which may have been a reasonable assumption, although the report takes them to task for not conducting a proper search for survivors. The investigators determined that the fire drills had not been taken seriously, since they had been held at the same time, on the same day of the week, 1030 on a Friday, and those who had more important things to do (in the view of the drilling department) were exempt. The lack of commitment on the part of the fire fighters had been noted in rig reports.

According to the sequence of events it was some minutes after the second explosion that the general alarm was sounded followed by an instruction on the PA system, made by the Senior DP Operator. In fact the alarms which had been manifest before the explosions should have resulted in the activation of the general alarm but it seems that the watchkeepers were bewildered by their extent. The PA instruction was recollected by the survivors as “This is not a drill… report to secondary emergency stations. Do not go outside.” At least one survivor went to his secondary station which was at the Galley, to find it collapsed and seeing that the door was open to the forward evacuation stations made his way in that direction. Out there he and others found one of the Assistant Drillers attempting to carry out a head count. Five people felt that this muster was taking too long and so they jumped into the sea. The FRC from the Damon B Bankston recovered these personnel within minutes.

In effect, despite the efforts of the Assistant Driller, the panic and chaos at the lifeboat stations, and inside the boats, was such that any attempt to reconcile numbers to determine who was missing was abandoned, and it was decided that once there was no-one left at the embarkation station the boats would get away. At the embarkation station the Transocean Operations Manager (Performance) had taken charge and having observed stuff falling out of the derrick had told No 2 boat to go. He had then gone to No 1 boat to wait for the Captain, who was supposed to be in charge of it, but when the latter arrived he said that there were still personnel to come and that they would go to the liferafts. So No 1 boat was launched. Both the boats got to the Damon B Bankston safely. The report states that all appropriate maintenance and training had been carried out for the boats, including launching them every three months, and that this had assisted with the successful departure from the area of the rig. On the other hand the MODU Code has guidance that the use of the liferafts should be exercised “where practicable” and hence there was no record of the rafts actually being inflated and lowered to the sea during drills. There was also some disparity between the liferaft instructions and the davit manufacturers instructions. This is obviously if anyone had been calm enough to read them.

After the forward boats had left there remained 10 people on board the rig, with no possibility of getting to the aft boats through the smoke, flames and heat. And so with some difficulty they prepared one of the liferafts for launch. Seven people including one stretcher case managed to board the raft, and in the increasing heat it was lowered to the water, some people thinking that it might burst into flames due to the radiation. Readers will recollect that the liferaft station was alongside the forward lifeboat evacuation station. The liferaft descended to the sea but it was attached to the rig, as all liferafts must be, by a long line and no-one had a knife to cut the cord. BP have a policy that there should be no knives on board their chartered units.

Meanwhile the Captain, the Senior Electronics Technician and the Senior DP Operator jumped over the side and swam to the raft, and the FRC from the Damon B Bankston approached and one of the people on it handed over a knife to cut the cord. Actually liferafts are provided with knives for this very purpose, but no-one had been able to locate it. The FRC then towed the raft, with people clinging to the outside of it, back to the ship. The rig was provided with vertical ladders on the columns but as a number of audits had identified, they were damaged, so even if they had been used, eventually the crew would have had to jump into the sea. 

The report notes that the means of evacuation from the accommodation to the forward lifeboat stations were generally effective, despite the difficulties inside the structure, although there seemed to be a lack of emergency lighting. Despite the lack of the standby generator which would have operated some systems had it worked, there should have been some battery powered lighting available, and it was not possible to determine whether these had been less than adequate or lacking in maintenance. During the evacuation it was noted that the liferaft had been close to catching fire due to the heat. The 1989 MODU Code says:

Consideration should be given by the Administration to the siting of superstructures and deckhouses such that in the event of fire at the Drill Floor at least one escape route to the embarkation position and survival craft is protected against radiation effects of that fire as far as practicable.

As the report says, “there is no assurance that the intervening structure will adequately block the expected radiant heat…”.

 The investigators found a number of problems with the boats. Firstly it was possible that if the designated rescue boat, No 2 lifeboat, had been damaged there would not have been one available. Secondly there had been problems with the stretcher case, who was actually the Transocean Operations Manager (Assets), and apparently despite the requirement that the boats should be able to accommodate stretcher cases, there was no testing of this aspect of their design as part of the approval process. And has been determined elsewhere by now, the space for the crew was based on a notional weight of 82.5 kg whereas the average weight of an offshore worker was by then 95 kg. 

It was acknowledged that the FRC from the Damon B Bankston had made a major contribution to the rescue operations, even though there was no formal requirement for the ship to carry such a craft. Neither was it required that the rig carry an FRC, since the No 2 lifeboat was designated as the “rescue boat” in accordance with MODU Code requirements. The capabilities of all MODUs to recover personnel from the sea are limited and it was testified that lifeboats would be used with extreme caution due to the difficulties of recovery, and hence the investigators were of the view that it might be an advantage for them to have FRCs.

This led into the regulatory requirement in the Gulf of Mexico OCS that the oil companies should provided the Coast Guard with an Emergency Evacuation Plan (EEP). BP had provided such a plan for Mississippi Canyon Block 252, and one had been provided for the Deepwater Horizon for Block 562 but there had been no check on this plan when the rig had moved to the former block to replace the Transocean Marianas. Nor was there any requirement in the plan or in the regulations, for a standby vessel to be provided, however the plan contained details of four vessels which could be used to evacuate people from the rig, one of which was the Damon B Bankston. The report states that even though it was not required to be one, the ship carried out the services of a standby vessel, and that “its construction and equipment standards and its crew’s actions that night saved lives”. The investigators went on to say that it might be all very well to submit an EEP, but not being required to demonstrate its effectiveness seriously undermined its value

There were some conclusions drawn in this part of the report, most of which have been identified in this narrative, however it was concluded that the visit of the VIPs to the rig had probably had a detrimental effect on the overview of the well control activities by the senior staff. The Senior Toolpusher would, he said, have spent more time on the Drill Floor ensuring that all was going well, rather than following the executives around. And it may be significant that they were actually in the control space when the event occurred. On the other hand the Senior Toolpusher was of the view that had he been able to oversee events on the Drill Floor, he also would have been a casualty, rather than the saviour of the situation. 

Also it was identified that the 2009 MODU Code had removed some requirements relating to the performance of crew musters and drills, and replaced them with recommendations. This would only add to the possible confusion during emergencies, so the investigators thought.

 

In general the process of pollution prevention and the saving of life are addressed differently in safety documentation, and the author has more interest in keeping people safe than anything else. However the Macondo well turned out to be a major challenge to the operator and so that aspect of the Coast Guard report is also considered here. In this part of the report and elsewhere, the complexity of the regulations are highlighted, as well as the lack of familiarity of those manning the onshore response centre with the regulations under which their oil rig was operating.

It may be that the Vessel Response Plan (VRP) might be a good example of how the regulations are framed and what companies response might be. The purpose of the Vessel Response Plan for the OCS in the Gulf is, in the simplest terms, to assist with the prevention of pollution from a casualty, and the plan is compiled by the owner or manager of the vessel or unit. So it was natural for the investigators to get hold of the plan and to determine its relevance to what actually happened in the accident.

The Transocean manager whose job it had been to coordinate the emergency response was asked if he had heard of the VRP, and his response was in the negative. A member of the Transocean team had contacted SMIT Salvage America to assist with the accident, even though a different company was the one assigned in the plan. And in a slightly more complex interaction the Smit Salvage American man had asked for a “HECSALV” computer stability model to be developed by the Transocean Naval Architect, even though the rig was, according to the VRP, enrolled in the ABS Rapid Response Damage Assessment (RRDA) programme  which used HECSALV. No-one actually contacted ABS, and as the investigators were later to discover, this was just as well since despite the words in the VRP, the Deepwater Horizon was not enrolled in the ABS process. These plans are supposed to be exercised several times a year, but it appeared to have been years since any drill of this type had been exercised involving the shoreside support group. 

When being grilled by the investigators one of the Transocean managers had indicated that loading information concerning their rigs was sent in daily so that they would be available if needed, but when asked to provide “the most recent loading data prior to the accident” the company could not find any.  

Back in the real world it would have been appropriate for Smit Salvage Americas to have developed a salvage plan, but it was not done since their representation at the Transocean office had determined that it would be necessary for the fuel for the fire to have been shut off before it would be worth doing this. And hence there seemed to be no-one at any time up to the arrival for the Seacor Vanguard,actually controlling the firefighting activities. From the viewpoint of an observer, now some years on, it is quite difficult to understand. Would a shipmaster just assign his ship to carrying out firefighting without any instruction to do so? Well apparently the answer is yes. The Coast Guard reason for not controlling the firefighting operations was that they were concentrating on search and rescue.

Because the rig sank and was discovered upside down on the seabed with everything from Main Deck level upwards submerged in the mud, the investigators were unable to determine why it had taken on a list and sunk, since this obviously indicated that some of the vast amounts of water which had been directed to the casualty must have been retained on board. And it was acknowledged that not to have deluged the rig might in any case resulted in total structural failure due to the fire. However, as is the way of these things they went into the results of previous audits and found that there had been problems with the watertight doors in the past, and that the control and indicator systems of some had been altered or lacked maintenance, making it more likely that some doors could be left open without the Control Room being aware of it. 

And finally in terms of stability it will be remembered that the Coast Guard had issued the Deepwater Horizon with a Certificate of Compliance for which the requirements of the IMO MODU Code were used as the standard, although there were other standards with which compliance could be achieved. The requirement was in this case that the rig conformed with the Marshall Islands Publication MI-293 which, amongst other things, would result in the issue of the flag state Safety Certificate. This would have been issued as the result of an inspection by ABS acting on behalf of the Marshall Islands. However, the investigators determined that in order to conform with MI-293 a deadweight survey should be carried out every five years, and this had not been done for the Deepwater Horizon, and that therefore the rig could have been unintentionally overloaded. 

The investigators then went into what up to now have been pretty well untested waters, after finding that the drill crew and the marine crew effectively never got together for any emergency exercises, and hence they did not actually know what to do in an emergency. They went into the STCW (Standards of Training and Certification and Watchkeeping) requirements for marine crews, and pointed out that in addition to these basic marine qualifications, those who were going to work on tankers or roll-on roll-off vessels required additional training, and yet no additional training was required for mariners serving on mobile drilling units. “Why not?” they asked. 

 

Finally, in the main part of the report the investigators address the thorny problem of the Deepwater Horizon’sconformance with the International Safety Management (ISM) code, required by all registered marine craft of more than 500 gross tons, including “self propelled MODUs”. The ISM code is intended to ensure that all vessels are provided with an effective safety management system which will in principle provide the procedures for operating the craft, the means of maintaining it and the process of risk assessment (although the code is not explicit in this area) Also required is the means by which incidents and accidents would be investigated and by which “opportunities for improvement” would be identified and actioned, which would include the conclusions from accident investigation. 

In order to provide evidence of conformance with the code the marine object is audited by the state where it is registered, usually using a representative from some acceptably honest and expert organisation, on their behalf. Often one of the classification societies is used, and in the case of the Deepwater Horizon the Marshall Islands had used DNV who had issued the rig with a Document of Compliance (DOC). The Document of Compliance would be used by others as evidence of the safe operation of the unit.

Conformance or not with the ISM Code is a fertile area for accident investigators, and so it proved for the Deepwater Horizon. The Coast Guard concentrated on two failures which had occurred in previous years, which should have been reported under ideal conditions and which should have resulted in formal investigation and some form of address by the registry. These were a blackout and the flooding of one of the pontoons which had cost nearly a million dollars to fix. The blackout had lasted two minutes, and should have been impossible for a DPIII rig, and the flooding had been a failure of the risk assessment process which had resulted in a valve being inadvertently opened while the associated pump was under repair. 

Also mentioned in the body of the report, rather than in the appendices, where the deficiencies are listed in detail, are the failures to carry out maintenance and the failures to rectify previous non conformances. It is part of any properly constituted safety management system to address the finding of any audit, since there is herein an “opportunity for improvement”. However the 2009 BP audit determined that many of the findings of the previous audit had been closed out and had either deteriorated again, or had not been properly addressed in the first instance. In other cases the findings were simply rejected without any good reason given. While these conditions existed, the report suggests that “no-one joined up the dots”, and also that these failures were endemic throughout the company. In fact DNV, having carried out a review of the Deepwater Horizon ISM system, issued a new Document of Compliance on April 21st, while offshore the rig was still burning out in the gulf. The report says that had DNV withheld the issue of this document it would have affected all Transocean self propelled units worldwide.

There was also a failure on the rig to properly deal with failings in the Permit to Work system, which if it had been effective, might have prevented people from working in the Mud Pump Room, actually during the well control event, and as usual when put under pressure the management both on board the rig, and ashore was found wanting.

Typically the ISM Code requires that there should be a Designated Person Ashore (DPA) who is an employee of the company, but when the appropriate person in the Transocean management was investigated he “demonstrated very little knowledge of the ISM Code”, and was unable to explain the company programme for compliance. In addition when the Captain of the rig was interrogated (probably the right word if you read the testimony) he did not know much, if anything about the company safety management system. He said that there was a PowerPoint presentation which he had recently viewed, but he could not remember any of the details. Also he did not know whether the SMS was computer based, or in a binder. The senior BP safety man interviewed did not know what the ISM Code was. He was an occupational health man and this may be an indication of the focus in the offshore industry on slips, trips and falls. In essence it is stated in the report that the Flag State, the Marshall Islands should have taken a greater part in the oversight of the rig’s safety management. Also since nearly all these processes are farmed out to third parties, no matter how expert, even the Coast Guard inspection processes have suffered.

Transocean had claimed that they had no responsibility for the safety of their rig. That, in their view, was BP’s job, but the two companies had signed a joint document which indicated that they were to share the responsibility. And of course as has been effectively demonstrated, if everything had been suitably set up and managed on the rig, then there was the possibility that even if the blowout had occurred, no-one would have died.

  

The investigation concluded that the first explosion took place on or around the Drill Floor and that the second explosion was probably initiated in the area of No 3 engine or the electrical systems in the area.  It also determined that in all probability the 11 people who lost their lives were either on the Drill Floor or in the area of the Mud Pits.

It was felt that had the diverter been used, then the initial force and volumes of the mud, well fluids and gas would have been directed overside, possibly giving the personnel in the vicinity the time to evacuate from the area and possibly preventing the explosions.

The electrical equipment in the “hazardous areas” on the rig was considered by previous audits to be in a poor condition, and the subcontractors equipment in the area was also in poor condition.

The gas detection systems which had the capability to automatically shut down various systems including the air flow into the engine rooms and the engines themselves, were inhibited from this part of the operation, and no-one had shut down the engines manually when the alarms occurred in the Control Room. Also numbers of detectors were bypassed to prevent false alarms waking those asleep.

The manner in which the rig had its emergency generator assigned, i.e. that it was allowed by regulation to be any one of the six separate generators, had its own failings, in that when there was an explosion in the engine room area this would probably involve the assigned emergency generator, and also the ventilation intakes were grouped in the same area, making the emergency generator similarly vulnerable to gas ingestion.

The blast protection was insufficient to protect the crew from explosions at the Drill Floor location, even though it conformed with the 1989 MODU Code requirements. 

The investigators identified what the report described as a “clerical error” (their quotation marks)  by the flag state allowing the Deepwater Horizon to be identified as a self propelled MODU, rather than a DP MODU, which in turn made it possible for Transocean to put in place the dual command system. This allowed the OIM, who was a driller, to be in charge when the rig was secured to the seabed (in the case of the casualty, by the riser) and for the Captain to be in charge when it was under way, or in an emergency situation. The result was confusion during the emergency, particularly when it came to operating the EDS.

Amongst a mass of findings in relation to the Safety Management System they suggested that the company adherence to the ISM Code had created a safety culture throughout the fleet which was described as “running it until it breaks”, ”only if it’s convenient” and “going through the motions”.

 

The report then makes extensive recommendations and it is suggested that to view them the Coast Guard report should be accessed on their website where they are laid out in full. 

There are numerous recommendations which relate to the IMO MODU Code, and its possible failings, some dealing with the inspection processes and the possible need for the flag states to audit the classification societies, and specifically there are suggestions that the positioning of the vents to the machinery spaces should be  considered, and the processes to be employed to shut down equipment considering the DP requirements of some units. There is also a recommendation relating to the clear designation of the person in charge in both normal and emergency situations.

In the area of fire protection the Coast Guard made recommendations which would be familiar to anyone who has carried out risk based assessments of the fire fighting capabilities of MODUs, generally considering improvements in passive fire protection and the provision of additional deluge systems. Probably uniquely however, they recommended a stand alone fire pump which would be diesel driven and provided with its own 18 hour fuel supply. 

Despite the fact that the evacuation, when it was initiated, went pretty well, there were numerous recommendations intended to improve this process. The investigators did not like the term “when practicable” probably with good reason, and required clarification in this area. They also wanted better training and exercising for emergencies and recommended the designation of specific standby vessels for rigs drilling on the OCS. They recommended a change to the MODU code, removing the ability of rig owners to designate one of the lifeboats as a “rescue boat”. They also wished a performance standard be established for the maximum radiant heat acceptable at the muster stations, as well as the means of calculating this.

There were a number of recommendations made regarding the improvements which might be made in the inspection processes, particularly in the area of the ISM Code, and DNV’s part in that activity. The final recommendation states that “DNV’s performance as the recognised organization for the RMI has been questionable” and that another organisation should be used to verify Transocean safety management system. There are some recommendations which relate to inspection processes in general particularly for foreign flag units. 

And importantly to those looking at this unfortunate accident from elsewhere on the planet, it was recommended that the possibility of adopting a form of “safety case” similar to that used in the North Sea might be considered.

Finally the report made some recommendations, generally that the heroic actions of some people should be recognised. These included the Captain and the FRC crew of the Damon B Bankston, and the small team on the rig who had gone to attempt to start the standby generator. On the other side of the coin consideration was to be given as to whether any action should be taken against the Captain of the Deepwater Horizon.

 

THE REPORT TO THE PRESIDENT 

This summary of the President’s report contains some of the author’s views in addition to those of the President’s investigators. It used some of the Coast Guard report and so it is presented as a narrative to prevent repetition.

Towards the end of January 2011 President Obama’s National Commission on the Deepwater Horizon Oil Spill presented its report. It runs to over 300 pages, and covers much else besides the actual  Deepwater Horizondisaster itself. It is an extensive piece of investigative reporting and all of it is worth reading.

    When investigating accidents there is much talk about looking for “root causes”, and the commission  determined that the failures that resulted in the loss of the Deepwater Horizon and the lives of eleven of the personnel who worked on it, were due to problems endemic in the industry and the manner in which it has been regulated. Within a few days of the accident the Marine Management Service had been effectively disbanded to be replaced by the Bureau of Ocean Energy Management, Regulation and Enforcement, amid accusations that the now defunct body had been in the hands of the operators, and lurid accounts of the exchange of favours of all sorts in return for agreements, acceptances and approvals. However, the commission found that the MMS had been starved of funds for years, which resulted in a lack of both numbers of personnel and expertise. The dual role of the MMS as the overseer for safety and the collector of revenues was also criticised for their lack of compatibility. Of course as far as the rig guys were concerned they were just a part of the normal inspection process which involved the MMS, the Coast Guard, the classification societies and flag state. All of these bodies had received nothing more than the usual courtesies while on board. At the time of the publication of the President’s report, visiting BOEMRE inspectors were only allowed to accept water. They even brought their own food. 

The report touches on a point which has been made by one or two academics over the last few years, and which was highlighted by the investigation into the Texas City Refinery disaster, another BP misfortune, where 15 people died in 2005. This is that there is now little relationship between occupational accident and “process failures”, i.e. major accidents. The accepted safety mantra in years gone by, was that if you prevented minor accidents from taking place, then the major accidents would also be prevented. Even in UK, where the safety case regime has been in place for 13 years, it appears to some safety engineers that the industry concentrates on occupational accidents, such as slips trips and falls, to the point that major accidents, the events which will result in multiple deaths if not prevented, are more or less ignored. Some have said that it would take another Piper Alpha to sort this out, but it never occurred to them that this would take place in the Gulf of Mexico. This is starkly illustrated by the fact that when the Deepwater Horizon blew up there were a number of Transocean and BP executives on board to celebrate the rig’s achievement of seven years without a lost time accident. A lost time accident? This is the industry’s traditional measurement of safety, and is an accident where the unfortunate injured person cannot continue working due to the severity of the injury. In the reception areas of the rig owners and operators all over the world there used to be boards on the walls presenting the days since the last lost time accident on every one of their installations. Imagine the situation where there has been 1000 days since the last LTA and some-one trips over a door sill and twists their ankle so that they can no longer carry on working. The 1000 days are wiped out and they start again. One day, two days, three days and so on! It would be heart-breaking. The President’s commission found that even though fatalities are twice as high in the Gulf of Mexico as they are in Europe, there would appear to be far fewer injuries. This is because the LTA structure discourages reporting, resulting in a distorted view of safety in the offshore environment. European safety specialists would be amazed to find that between 2001 and 2011 there had been a stunning 948 fires and explosions in the Gulf. Not far off 100 a year.

What else did the commission report? It identified the fact that the crew on the rig did not accept the signs that were presented to them that all was not well. This is not solely a problem for the offshore industry. We, as human beings, are reluctant to accept information which does not fit into our perception of what should be happening. This has been a feature of many offshore accidents, and can be identified as a component of human behaviour elsewhere. When the IRA blew the front off Harrods in December 1983 the people in the restaurant tried to pay their bills before leaving. They insisted on maintaining their normal patterns of activity in the face of evidence that they should have been getting out of there as quickly as possible. The failure to accept the evidence presented to them on board the Deepwater Horizon was manifest most notably during the testing of the cement plug. At that time, when there should have been no pressure above the cement, a pressure gauge indicated otherwise, but rather than accepting the evidence, the team on the rig decided that the gauge was faulty. There were also other unaccountable differences in pressure, which caused them to carry out a second test after they had accepted that the first might have failed. On the evening of 20th April the second negative pressure test continued to show differences in pressure between the kill line and the drill string, but this was explained away by one of the team as a known anomaly ( In the years since the accident this tendency has been described by the delightful phrase "Confirmation Bias"). 

People who are used to presenting UK safety cases are accustomed to having to identify a TR Temporary Refuge in which people could muster safely before taking further action to save themselves. This is of course as a result of Lord Cullen’s recommendation from the Piper Alpha enquiry, and was based on the fact that 70 people in the platform’s accommodation died in the disaster. So the safety case process would generally identify the accidents which could result in fires and explosions and then show how the TR, usually all or part of the accommodation, would protect people for a period to time which would allow them to get organised for their next move. This all seems eminently sensible, and it is probable that such an emergency process was initiated when Transocean suffered from a very similar well control problem (thankfully with a different outcome) in the North Sea. However, despite the fact that these emergency procedures have been in place for years in the North Sea, and have been accepted as “best practice”, elsewhere in the world it is more likely that when the alarm bells ring the crew will muster on the open deck and get into the lifeboats. So are the risks in the Gulf of Mexico, and Nigeria and the Far East different from those in the North Sea and the UK Atlantic margin? Of course not, only the perception is different.

And finally, and outwith any observations made by anyone in the investigations into this disaster, it is possible that constant exposure to difficulties and dangers causes one to develop a tolerance for situations which, under normal circumstances, would be unacceptable. When drilling and circulating was taking place at Macondo it seemed that the mud weight was always on the cusp, if it was too heavy it would leak away into the formation and there would be a tendency for the well to flow. As the drilling progressed it became more and more difficult to maintain this balance and over the duration of the well 3000 barrels of mud were lost to the formation, creating constant problems for the guys on the Drill Floor. But, they had overcome the difficulties, and it may have been the confidence developed by these successes that made the crew continue to battle with the blowout when they should actually have chosen “flight” rather than “fight”.

 

COMMENT.

There is little doubt that the for many years the offshore oil industry had seen regulations as nothing more than an impediment to the potential success of what-ever operation they happened to be carrying out, and therefore any action or intervention to circumvent the intent of any regulatory requirements was deemed to be acceptable. Probably a good example of this, as far as the Deepwater Horizon is concerned, was the Environmental Spill Plan lodged with the authorities by BP. It cited as their major source of expertise a gentleman who had been dead for five years, and mentioned, as did the plans for a number of other operators, that they intended to safeguard varieties of wildlife completely unknown to the Gulf of Mexico. Sometimes it appears that it is solely the boredom of the routines required to ensure that the processes remains safe that cause people to neglect or circumvent them. One cannot readily see why Halliburton should have doubted their own tests on the nitrogen cement, and carried out a second one, or why BP went ahead with the cement job before the second set of tests were completed, other than the underlying view that such activities were not really necessary. And it may be the whole attitude of “we know best” which answers the question posed by the managing director of BP, Tony Hayward. 

“What have we done to deserve this?” he asked in the aftermath of the Deepwater Horizon disaster. And even without the commission report there was a body of opinion amongst those who had had contact with BP that they were disinterested in the views or opinions of others, even if the others were experts in their fields. It seems that BP, like many large corporations, have such a sense of the rightness of everything they do, that they are unwilling to accept any sort of alternative view. It could be this sense of rightness that resulted in the onshore staff deciding that it was acceptable to install production casing with only 9 instead of 26 centralisers, a decision which may have been one of the reasons for the  reduced the integrity of the cement job. Also for complex reasons in the temporary abandonment process, they chose to set the cement plug at 3000 feet down in the well instead of near the surface, a process outwith the existing MMS regulations. 

The perception in large organisations that they know everything can result in relatively junior members of staff taking attitudes, which in some environments, might be considered to be bullying. There is anecdotal evidence that prior to the disaster Transocean staff argued with the senior BP representative on the rig as to possible next actions, but that in the end the BP rep’s requirements were accepted. 

Since this particular section of the book is presented differently from the others, taking in as it does lots of stuff from the various investigations, the media and the testimonies of the survivors even this, the comments section, is presented differently, and this starts with the release of the BP report on September 8 2010. In addition to the main report it contained 27 appendices. The other main protagonists, Transocean and Halliburton were extremely critical of it, dismissing it as “self serving”. Appendix I of the related documents is the “event tree” process which was used by the BP investigators to drill down to determine the reasons for the accident. The various items in the tree were considered and dismissed, and considered and retained. Those retained were written up in the report.

One of the boxes contained the information that the team on board the rig might have been distracted by preparations for the next well. And this raises a question, why were they preparing for the next well at a time when it seems to those of us looking at the operation in hindsight, all their attention should have been focused on the events in hand? Who then, had given instructions that preparations be made for the next job, when the current one was still demanding everyone’s attention. The words contained in the report were as follows:

From 13:28 hours to 17:17 hours, mud was offloaded to the supply vessel M/V Damon Bankston. Some of the mud pits and the trip tank were being cleaned and emptied, causing pit levels to change. These pit level changes complicated the ability to use pit volumes to monitor whether the well was flowing. Pit levels indicate the volume of the fluids at the surface. If the volume pumped into the well equals the volume returned from the well, pit levels remain constant, indicating no flow from the reservoir into the well. 

Other simultaneous operations, such as preparing for the next operation (setting a cement plug in the casing) and bleeding off the riser tensioners, were occurring and may have distracted the rig crew and mudloggers from monitoring the well.

Who had given the instruction that the pits be cleaned, at a time when they should, or possibly should, have still been monitoring the mud or seawater returns? Anyone who did not know how dangerous a blowout might be, knows now, and one of the ways of finding out whether the well is under control or not is whether precisely the same amount of liquid which is being pumped down the well is being returned. If less than the precise amount is being returned then some is being lost to the formation, or if more is being returned then the well is flowing. As we have seen from previous reports, both situations are dangerous. 

But the BP report does not tell us who had given the instructions to prepare for the next well, even though current well was not, so to speak, in the bag, so it was necessary to go through the USCG/MMS investigation transcripts, focusing on the evidence of the drilling people because it would be their job to talk to the BP reps and for them to carry out the various instructions they might be given. It was possible to  identify the moments on April 20 when BP and Transocean had discussed things and possibly disagreed on what should be done and in what way, but there was no definitive statement. However in the midst of it all was the testimony of Senior Toolpusher, Miles Ezell. I have reproduced almost in full elsewhere on the site because it brings home to us, particularly those of us who have become immersed in the cold presentation of information, that human beings were involved, and if we are not careful, the only memorial to the eleven men who lost their lives will be endless arguments between lawyers. I read this and decided that it was time to stop and think, and then to call it a day. You can find it if you…Click Here

 

We can still only guess who issued the instruction to prepare for the next well, but Miles Ezell’s testimony brings home to us what a terrible event this was. Both Jason Anderson and Steve Curtis and nine others died in the disaster. So one of the many lessons to be learnt may be that you have to get the drill crew off the Drill Floor once there’s nothing more they can do there. There are, after all, other BOP control panels.

 

At the time of the publication of the President’s report there seemed to be a number of possible directions to be taken by the American regulatory authorities there-after, one of which might be the introduction of a safety case regime, or something like it. But the safety case is not a silver bullet. It requires the active co-operation of everyone involved, and an honest approach to the problem of keeping the workforce alive and uninjured in what is accepted as being a dangerous environment. Everyone should take responsibility for their own safety and, possibly more importantly, the safety of others commensurate with their training, skills and responsibilities. It does not actually need a safety case to achieve this. It only requires a change of attitude.

But in the end the legislators in the United States initiated a regulatory regime which became known as SEMS, the requirement that all oil companies should be provided with a Safety and Environmental Management System, and that this system should be periodically audited by independent auditors. There were also rumours that the US Coast Guard was trying to create an environment where all marine craft would also need to be provided with a SEMS. This latter objective has yet to be achieved. There have continued to be accidents offshore in the Gulf of Mexico and at the time of the first audit of oil companies five had failed to set up their safety management systems and were shut down. The lesser players in this drama have bought their way out of trouble. BP continues to pay for its errors, in 2015 up to $42 billion and has been fined a further $18 billion to be paid in installments. On receipt of this news the share price rose. Investors expected worse.

 

 

 
Copyright © 2018 Ships and Oil. All Right Reserved.