An unusual view of a typical semi-submersible BOP on the surface. Of course they are usually on the seabed making the connection between to first section of casing and the Riser, and the deeper the water in which the rig is operating, the more complex the control systems for the valves and the rams become.

The offshore social media has recently been discussing the adequacy, or not, of the latest regulations to be implemented for units working in deep water offshore in the Gulf of Mexico, and there is much focus on the BOP and what it is going to do in the future, with for instance two sets of shear rams. And for those who might be wondering why two rather than one, I assume that this is not just doubling up the possible means of shutting off the well. I mean we already have a number of other sets of rams that should have been doing a job, but the shear rams are the final shot. And, alarmingly, so far they have not been able to shear all the bits of pipe passing through them.

The Driller always knows where, for instance, the “tool joints” are so the shear rams would not be fouled on them. But with two sets of shear rams he could just choose the one which were furthest away from the joint.  In addition in panic someone might press the shear ram button from a BOP control panel somewhere else, without having any idea about where the tool joints are as has happened many times. So in that case there would be more chance of success. The Norwegians require the shear rams to be capable of  operation from a lifeboat, using a remote panel and a transmitter dangling over the side. These are notoriously unreliable systems.

But the discussion about the shear rams has prompted me to ask, whether anyone has done anything to improve their emergency response processes since the Deepwater Horizon, and although this seems like only the other day, more than six years have now passed since the disaster.  And just to keep things clear when dealing with emergencies, firstly we consider prevention – ie not having any emergencies – secondly we provide preparation and lastly the execution of the emergency processes.

What happened on the Deepwater Horizon? Well, it may be remembered that the rig conformed to the 1989 MODU Code. This allowed the fire pumps to be located in two of the six engine rooms, and for one of the six main engines to be designated as the emergency generator. There was a smaller engine some distance away from the main engines but this was purely present to allow  a black start to be carried out. In addition, water for the fire pumps was provided by salt water service pumps in the pontoons,  also requiring a main engine; not to mention the fact that pump to pump systems are not noted for their reliability. Whether this system conformed with the regulations depends, in my view, on how you read them, but it is one thing to conform to the regulations, and as we are finding out, another to provide the best means of keeping our guys alive out there. It is probable that the pressure in the line between the pump in the pontoon, and the pump in the engine room was monitored and if it dropped the pump in the pontoon would automatically start up. A similar system in the FPSO P36 in Brazil in 2001, activated the pumps in the pontoon after an explosion in one of the columns had destroyed the pipework, and many tons of water were pumped into the rig until the pumps themselves were submerged and ceased to operate.

The Deepwater Horizon rig was provided with an extensive fire and gas detection system, but much of it was disabled to avoid waking people due to spurious activation. It is debatable as to whether having detection systems shut down anything is a good idea, but in any case none did on the rig and in addition there were no instructions for the control room staff as to what to do if they received an alarm.

The rig was provided with an emergency disconnect system which would have closed the BOP and disconnected the riser, therefore maybe preventing the egress of hydrocarbons from the well, and certainly saving the rig and everyone on board. It was operable by a single button in the Pilot House/Control Room, but it was not pressed until after the means of connecting it to the well had been blown apart. Elsewhere the investigators into the blowout on the West Vanguard in 1985 had been critical of the positioning of the means of disconnecting the riser from the well during that incident. It was by means of a lever, tied back with rope, in the Cellar Deck. And even though a brave man donned a dust mask and untied the rope and pulled the lever, the crew had no means of telling whether the riser had been disconnected or not.

In terms of systems, the Deepwater Horizon was not well prepared for emergencies. I had not intended to spend so much time writing about it, but it was well investigated, and so we know a lot about it, and it is apparent that much of what we are talking about is conformance with regulations, without any consideration as to whether such conformance is really likely to be any help if there is a catastrophic event, a point constantly made by the Coast Guard in their investigation into the event.

Case in point, the emergency generator. Best practice for the provision of the emergency generator is that it should be situated as far from the main generators as possible, so that in the event of a gas release at deck level of a semi or a jack-up, the OIM can choose which system to keep running, taking into consideration the wind speed and direction. The generator should power a whole raft of systems, including a fire pump (taking suction directly from the sea), the emergency lighting, the cement unit (if not self powered) and a ballast pump. But none of this is going to be any good if it is one of a raft of exploding machines. And here I will refer to a recommendation which I have recorded in my book “A Catalogue of Disasters”. It says: The power requirements during emergencies should be considered together with the control of possible sources of ignition. This recommendation was made by the investigators who reported on the blowout on the C.P.Baker in the Gulf of Mexico in 1964, 52 years ago. And we have to say that no doubt the people writing the regulations thought they had covered this, but no, the description allowed the rig designers to assign one of the main generators as the emergency generator.

From this point it is difficult to consider the equipment ansd structure of the rig without referring to the two explosions which effectively disabled it. The blasts more or less destroyed the accommodation, and some people were trapped under the wreckage. There was at least one muster station within the structure but it had been destroyed like most of the rest.

Readers not familiar with MODU Codes, and semi-submersible construction might be surprised about one of the requirements for “structural fire protection”. This says: ‘Exterior boundaries of superstructures and deckhouses enclosing accommodation, including any overhanging decks which support such accommodation, should be constructed to “A60” standard for the whole of the portion which faces and is within 30 metres of the centre of the rotary table.’  This has resulted in someone putting a compass in the centre of the rotary on the plan and drawing a circle at 30 metres – and what do you know, some of the spaces have protection, some partial protection and some none at all. And in the case of the Deepwater Horizon there seemed to be little protecting the accommodation from the blasts, even though the source was on the other side of the moonpool, but if one looks at the plans of the rig the Sack Store provided a connection between the two areas on the starboard side, so there-in may lie the answer.

And finally, as an example of lack of preparation for a major event I turn to one of my own experiences, and here I am constrained  not to identify the unit, but people on it will probably recognise it. This was a modern jack-up of impressive specification, with a Drillers Station that could have been used in a science fiction film. We, doing a risk assessment, went round all the enclosed spaces, assessing them for the possibility of fire, explosion and flood. The engine room was a delight, containing a number of engines and absolutely nothing else. But of course the space was provided with extensive portable firefighting equipment as well as a CO2 installed fire surpressant system in accordance with the regulatory requirements. So no problem there then, but we were then confronted with an auxilliary machinery space which contained all the stuff which the regulators had expected to find in the engine room. There were the two daily service fuel tanks, the fuel purifiers and a number of other auxilliary items, and hence the space was a serious fire risk, and if burnt out it would disable the rig, that is apart from risks to personnel. We designated the space as  being worthy of being provided with an installed fire surpressant system, but in our wash-up meeting the suggestion was discarded on the groundds that the rig already conformed with regulatory requirements. Conformance with the regulations could therefore have been counterproductive.

In this short article I have described some of the shortcomings generally to be found in the mobile unit business in the provision of structure and systems for dealing with emergencies. But what of the processes. The procedures provided by the management of these objects have proved to be a fertile area for the investigators into offshore disasters l

Copyright © 2019 Ships and Oil. All Right Reserved.