Rio de Janeiro, Brazil

June 22, 2001

 Inquiry Com mission into P-36 Accident

Carlos HELENO Netto Barbosa Chairman - Drilling and Logistics (Sondagem e Logística) SSE

CID Guilherme P Valerio SMS Corporativo

RONALDO DIAS Roncador Production Assets

Carlos BARTOLOMEU Bastos Barbosa Basic Production Engineering – CENPES

José Antônio de FIGUEIREDO Production Engineering – ENGENHARIA

Luiz Carlos Nery GUARABYRA Corporate Human Resources (RH Corporativo)

Carlos Henrique de Lima Ferreira CIPA (Internal Commission for Accident Prevention) Representati

Pedro Jose BARUSCO Filho E&P-CORP/ENGP/ENMBP

Prof TIAGO Alberto Piedras Lopes UFRJ (Federal University of Rio de Janeiro)/ Coppe

Antônio Carlos Ferreira RANGEL Representative of SINDIPETRO – NF (Petroleum Workers Union)

 Scope ofthe Investigation and Findings

SCOPE OF THE WORK:

Determine the causes of the accident
Contributing factors resulting in loss of stability of
the platform
To recommend measures for the elimination/control
of these causes and factors

COMMISSION WAS ASSURED OF TOTAL AUTONOMY

AND AUTHORITY

FINAL PRODUCT:
Most probable hypothesis explaining events which
occurred
Conclusions and Recommendations
 Investigation Methodology of P-36 Accident
The Accident
March 15 2001

Witness Statements Photographs Video Computer Records Documentation

Raising Data and Information

Scope of Verification by DNV

Constructing
Timeline of Accident
Scope of Accident Inquiry

Establishing Hypotheses

Testing the Hypotheses

Stability Dispersion Explosion Visit Documentary
HAZOP
Analysis Model Analysis Jack Bates Analysis

Interaction Timeline/Hypotheses Rejection of Hypotheses

Final Report

Immediate Causes
Analysis of Formal Accident Inquiry Basic Causes
Management Recommendations
 INVESTIGATION
INFORMATION COLLATING

PRINCIPAL SOURCE OF INFORMATION (P36) WAS LOST

64 INTERVIEWS
DOCUMENTATION/MATERIAL RETRIEVED FROM P-36
– Records of Ballast Operations
– Daily Production Bulletin
– Operational Situation Bulletin (SITOP)
– Treatment of Irregularities Report (RTA)
– Magnetic Files with Records of Fire and Gas and Shutdown Systems
• (Period from 08h00min on March 14 to 04h00min on March 15 2001)

PLATFORM PROJECT DOCUMENTATION

VIDEO TAPES AND PHOTOGRAPHS
ARTICLES PUBLISHED IN THE MEDIA
 INVESTIGATION
INFORMATION COLLATING
Analysis of Photographs and Videos

Normal Operation

After the Loss

After the Accident

 INVESTIGATION
INFORMATION COLLATING
Magnetic Files

•Fire and Gas records recovered

•11800 entries
•1723 entries between 1st and 2nd events (17 minutes )
•Work required for processing this data
 INVESTIGATION
Project Documentation INFORMATION COLLATING
 INVESTIGATION
Timeline Analysis
EVENT

First event. Shaking (jolt). Noise reported as falling deck cargo. Probable
mechanical rupture of the starboard emergency drain storage tank.

Verification of pressure loss in the fire tank. PS 70001 alarm s ounded

PT-70007 pressure in fire ring fell to 7-bar set point, which automatically starts the
two seawater pumps (XA/401 A/B/C/E) as well as two fire pumps (XA/401A/B/CE)
placing the platform in a FIREFIGHTING MODE.

OUTLET DAMPER VE-006ST. (exhaustion of starboard aft column) closes. The

corresponding EXHAUSTER (XA-2658) receives the same stop signal (status of
this ventilator is not indicated in the F&G and E8D system)
Waste oil pump XB149A (XB1 49AS) indicates no longer functioning
INLET DAMPER VE-002STS (verification of the starboard aft column) closes.
Corresponding VENTILATOR (XA-264H) receives the same stop signal (status of
the ventilator is not indicated in the F&G and E8D system)
XB70519B sea water pump electric drawer signal XA/039C (bow /starboard)
turning at high speed
OUTLET DAMPER DF-5251 – 09 (starboard aft column elevator well) confirms
closure
XS70701 and XS70704 – General Public Alarm A & B is sounded
Gas is detected on the Main Deck (external area) at the platform bow and air
ventilation intakes.
Gas detectors GS20HCA/HCB (ventilation intake of fire and freshwater pump
stations) operate at very high levels (60% of the LEL), remaining operational until
cutting out. Gas detectors GS52HCA/HCB (ventilation intake of PP-BE column)
operate at high level

Date/Time System Description

 INVESTIGATION
HAZOP
FAULT IN RISER
Date:
Participants of the HAZOP
Coordinator of the HAZOP simplified:

1 Description of scenario according to

Commission Inquiry
2 Physically possible?
If so, how?
3 Necessary contributory factors
4 Scenario indicators before the event
(verifiable)
5 Defective safety features
6 Liberation rate
7 Possible ignition source
8 Possible damage caused by the event
9 Scenario indicators after the event
(verifiable)
10 Intervention
11 Probability evaluation of the scenario
12 Others
 INVESTIGATION
Stability Analysis
 INVESTIGATION
Dispersion of Gases and Explosion Analysis

Gas concentration in column

(Cross Section)

Explosion due to excessive

pressure
 INVESTIGATION
Visit to sister platform Jack Bates

Jack Bates built according to the Water service pipes and ventilation
same Friede & Goldman project shafts on the 4th level
 INVESTIGATION

Event Final/Origin Type

* March 15 2001 00:22:54 ALARM/ALARM UNACK_ALM

Smoke detector activated, located in the column, elevation 28956 (DE-
5400-855-AMK-223)
* March 15 2001 00:24:14 NORMA/ALARM ACK_RTN
Smoke detector returns to normal
*March 15 2001 00:25:33 ALARM/ALARM UNACK_ALM
Smoke detector activated again
*March 15 2001 00:26:12 NORMAL/ALARM ACK_RTN
Smoke detector returns to normal
*March 15 2001 00:40:19 ALARM/ALARM UNACK_ALM
Smoke detector activated again

Damaged Zones

Purpose created
diagrams
 INVESTIGATION
TITLE: VENTILATION SYSTEM – FIRE ZONE 4
CAUSE AND EFFECT ANALYSIS

Gas detector and their logic

Gas detector registers and damper

activity

Purpose created
diagrams
 INVESTIGAÇÃO
Audit of Management Safety System
 MAIN DE
CK

SEC
OND
DEC
K

COL
UNA

FL ST
UT AB
UA ILI
DO T YB
R OX
 STARBOARD AFT COLUMN

MAIN DE
CK

SEC
OND
DEC
K

COL
UMN

FA
IR L
EA
RD
BO
X

PO ST
AB
NT ILI
OO T YB
N OX
 SECOND DECK

TANK TOP

SECOND LEVEL

THIRD LEVEL

FOURTH
LEVEL SEA WATER OUTLET
PIPE

QUINTO PISO
 FOURTH LEVEL

SEAWATER PUMP

PONTOON
 MAIN DECK

SECOND DECK

TANK TOP

VENTILATION SHAFTS

EXHAUST SHAFT

THIRD DECK
 TANK TOP

WASTE OIL TANK THIRD LEVEL

EMERGENCY DRAIN
STORAGE TANK

FOURTH LEVEL

SEA WATER OUTLET

PIPE
 Events ofthe Accident on Platform P-36

1st Event:
Rupture of the Emergency Drain Storage Tank in the starboard aft column

Accidental entry of hydrocarbons into the tank to be followed by water

Excessive internal pressure and rupture of the tank
Impact felt at 00:22 h on March 15 2001
Damage to equipment, pipes and electrical and electronic installations on the 4th
level
Flooding by water and oil with gas saturation on 4th level
Platform lists 2 degrees in 5 minutes
Loss of pressure in the firefighting network system
Platform in ESD mode
Emergency Firefighting Service goes to area of the occurrence
 Events ofthe Accident on Platform P-36
PRODUCTION ATMOSPHERIC
HEADER VENT

HEADER CAISSON
VALVE VALVE

RACQUET

PORT STARBOARD
EMERGENCY EMERGENCY
DRAIN TANK DRAIN TANK

RACQUETS

KEY:
OPEN VALVE

CLOSED VALVE

SEMI-OPEN VALVE
 Events ofthe Accident on Platform P-36

2nd Event:
Explosion, damage, impact and death of the firefighting crew

Gas rises from the 4th level and reaches the upper platform levels to produce
an explosive mixture
An ignition source provokes an explosion of the gas mixture
A strong explosion occurs in the area of the starboard aft column
This explosion occurs in the area where 11 members of the Firefighting
Service are located
Shock waves and heat of the explosion severely damage the structures,
equipment and accessories on the upper levels of the starboard aft area
Attempts to rescue the wounded (1 firefighter rescued, but dies one week
later )
Difficulties in maintaining platform stability
Evacuation begins 01:45h
Platform is abandoned at 06:00h
 Events ofthe Accident on Platform P-36

3rd Event:
Flooding of void spaces and loss of the platform

Flooding of the 4th level of the starboard aft column due to the rupture of the
DST, of the sea water line and the activating mechanism of the seawater
pumps
Flooding of the pumping stations, of the propellers and the the water
injection area through the ventilation shaft
Initial flooding of the 26S tank and the void space 61S through open
inspection doors
Entry of sea water occurred through the sea chest which remained open
(Fail-Set Valves)
Progressive flooding begins through the chain lockers, pontoon tanks, void
spaces of the starboard aft column and deck; greater list
Final list and loss of the platform
 Results ofthe Stability Analysis

The flooding of the interconnected compartments

caused the platform to sink and incline by more
than 16 degrees at about 8:15h on March 15 200,
sufficient to submerge the openings of the chain
lockers, a situation which exceeded the
structure’s maximum projected damage levels.
This initiated the process of progressive flooding
which ended in the sinking of the platform.
 Results ofthe Stability Analysis

Opening of the chain locker

 Hypotheses

HYPOTHESES INVESTIGATED, EVALUATED and REJECTED FOR 1st and 2nd

EVENTS

SINCE NO OBVIOUS CAUSES WERE IDENTIFIED,

VARIOUS SCENARIOS WERE ANALYZED

•EXPLOSION CAUSED BY BLOCKAGE

• SABOTAGE
• MISALIGNED PIPING
• MAINTENANCE SERVICES
• COLLISION
• CARGO HANDLING
• DIESEL OIL SYSTEM
 HYPOTHESES
HYPOTHESES REJECTED DUE TO LACK OF EVIDENCE
FOR SUCH IN THE 1ST and 2nd EVENTS

• EXPLOSION CAUSED BY BLOCKAGE

• SABOTAGE
• MISALIGNED PIPING

• MAINTENANCE SERVICES

• COLLISION

• CARGO HANDLING

• DIESEL OIL SYSTEM

 Conclusions

The conclusions reached herein are based on the records

of the Fire and Gas and Emergency Shut Down systems,
documentation recovered from the platform and from
existing Petrobras records.

Specific studies were made to give due technical support

to the hypotheses established.

However, it is important to note that with the loss of P-36,

there was no way of physically proving these hypotheses.
 Conclusions

As to the accident
On the basis of the available information, the commission
concluded that the most probable hypothesis for the sequence
of events was:
Excessive pressure in the Starboard Emergency Drain Tank
(EDT) due to a mixture of water, oil and gas, which caused a
mechanical rupture thus leaking the EDT fluids into the 4th level
area of the column.

The rupture of the Emergency Drain Tank caused damage to

various items of equipment and installations in the column,
principally the rupture of the sea water service pipe, thus
initiating the flooding of this compartment, and released
sufficient gas to fill the entire void space on the 4th level as well
as other areas of the platform.
 Conclusions

As to the accident

After 17 minutes, dispersed gas - in contact with an

ignition source - caught fire, causing a major explosion in
the area where the firefighting crew was located and also
resulting in serious physical damage to the platform.

After unsuccessful attempts to stabilize the unit, the

platform’s increasing inclination – reflecting continuous
flooding – resulted in the chain lockers and the vent tubes
of the buoyancy tanks reaching sea water level causing
progressive flooding, culminating in the loss of the
platform.
 Conclusions

As to the causes that brought about the accident

As with every major accident, that of P-36 did

not occur due to one single cause but was
provoked by a series of factors.
 Conclusions

As to the causes that brought about the accident

Below are listed some of the probable causes of the accident:

The unexpected flow through the entry valve of the starboard

EDT associated with the blocking of the vent and the racket
absence in the entry valve, thus causing excessive pressure
and rupture of the EDT;
Alignment of the port EDT to the production header instead of
to the Production Caisson, thus permitting the entry of
hydrocarbons into the starboard EDT;
Delay in activation of the drainage pump of the port EDT,
allowing a reverse flow of hydrocarbons for approximately an
hour;
 Conclusions

As to the causes that brought about the accident

Failure of the activators to close the sealed ventilation dampers
permitting leakage through to the sealed habitable
compartments of the column and pontoon;

Opening of the 26S tank and the 61S void space for inspection
without following the procedure which established contingency
measures, thereby increasing the volume subject to flooding;

Existence of two seawater pumps out of action for repair

without contingency measures for substitution, reducing the
scope to act in case of emergencies;

Deficient procedures and training to deal with emergency

situations for controlling stability and ballast.
 Recom mendations

To require the E&P analyze the complete range of the

problems cited and implement an Operational Excellence
Program in the Marine Production Units.

In spite of being an oil industry practice, the Commission

recommends that in future projects a management
decision be taken not to use tanks or receptacles in
columns or pontoons which are linked to processing
activities. For those existing units with receptacles or tanks
located in columns or pontoons and linked to processing
activities, we recommend that the E&P carries out a
reanalysis of its projects as to operational risk.

Adopt mechanisms for monitoring, evaluation and the

dissemination of the execution of actions herein proposed.
 Areas indicated forimprovement

During the course of the work of the Inquiry

Commission areas were identified with room
for improvement. While not directly linked to
the accident, these areas need to be
examined and included in the implementation
of the Operational Excellence Program for the
Marine Production Units.
 Areas indicated forimprovement

To improve the definition of responsibilities as they relate to the

operation, maintenance and supervision of areas of production,
platform infrastructure and control of stability.
– Examples: Supervision/operation of equipment facilities linked to the
processing activities (Waste Oil Tank, EDT);operation of ballast and
infrastructural equipment (Sea Water Pump)

Review supervisors’ functions to reduce their bureaucratic

activities and to concentrate their focus on operating activities,
such as: operations in progress; non-routine adjustments;
restrictions caused by warning or safety features; operational
procedures, the complexity or risk of which requires their
personal intervention.
 Areas indicated forimprovement

Review the size and upgrade the skills of the

Company platform crew in accordance with the
complexity of the installations and the operations
involved, the use of new technologies, the strategic
importance of the installations to the Company’s
business and avoid the accumulation of functions,
thus assuring the presence of the full supervisory
team on board.
 Areas indicated forimprovement

Restructure and establish priorities for maintenance activities

to ensure:
– Compliance with preventive/scheduled maintenance
programs;
– Reestablishment of maintenance engineering;
– Conclusion and effective implementation of the RAST;
– Elimination of late preventive maintenance routines;
– Re-dimensioning of Company teams;
– Ensure the necessary qualification levels for outsourced
teams especially in relation to mechanical and
instrumentation aspects.
 Areas indicated forimprovement

Systematize the process for the management of the

changes to ensure that the project alterations are only
implemented after the completion of risk analysis, up-
dating of documentation, the approval from the
appropriate authorities and training of the operating and
maintenance team. For this it is necessary, among other
measures:
– To train the teams in the techniques of identification,
evaluation and control of risk situations;
– To systematize the identification of potential risks in the
areas of Safety, the Environment and Health (SMS)
including major accident and total loss risks.
 Areas indicated forimprovement

To upgrade the Emergency Procedures and Plans in

relation to, among other aspects, the following topics:
– The firefighting crew to go directly to the location of the
occurrence;
– Compartments to remain sealed in case of flooding;
– Means to be used in the case of evacuation (cranes x
lifeboats);
– Use of portable gas detectors for continuous
monitoring with sound and visual alarms;
– Use of communication systems during emergencies.
 Areas indicated forimprovement

To invest in technical training involving control of

stability and ballast, promoting retraining and training in
emergency control. The training to be tailor made for
each unit.
To guarantee that the units’ documentation is up-to-
date and available both on-board and also with onshore
management.
To put into practice a system of copying and recovery
of key information before final evacuation through
implementation of features similar to those used in the
aeronautical industry, such as the black box or
removable HD with the object of recovering operating
information in the event of emergency.
 Areas indicated forimprovement

To reevaluate project requirements and the E&P

safety philosophy to include:
– More rigorous classification of areas;
– Restriction in the use of alternative requirements for
stabilizing in the event of damage;
– Restriction on the use of vital common systems by
floating units (refrigeration x ballast x firefighting);
– Use or not of FAIL-SET valves in ballast system;
– The number of ballast pumps interlinked in the case of
emergency;
– Prioritize alarms to avoid excessive information in the
control room, especially during emergency situations.
“ Every serious accident is unique, since
each one includes various elements
which only occur once.”

Gerard Mendel, in “Industrial Accidents, the cost of silence”, Michel

Llory, MultiMais Editorial, 1999