A full understanding of how the Deepwater Horizon explosion came about and the many failures of omission and commission must wait for the publication of the belatedly-launched Chemical Safety Board investigation. What is clear is that the US learned little from the Piper Alpha disaster, which had such an impact in Europe.
Had those lessons been learned, 11 workers may have been alive today, working on a rig which, on the day of its destruction, was celebrating a safety record.
That said, and with the necessary caveat regarding eyewitness testimony and the reliability of memory under and after traumatic incidents, MAC is providing the following analysis by Bill Campbell B.Sc. MIET C.Eng. retired Shell International Health and Safety Group auditor. It was original made available on the Step Change in Safety website.
Prior to the explosion were the risks to persons
on board Deepwater Horizon tolerable?
Bill Campbell B.Sc. MIET C.Eng.
Many commentators around the World talk about the cause of the explosion on Deepwater Horizon when they actually mean the cause of the Blowout and subsequent pollution. Blowouts are thankfully rare events and some have not led to explosions making recovery efforts more likely to succeed. The fatalities and the total destruction of the installation may have been prevented if an explosion had not occurred. So in this analysis of survivor testimony I concentrate on what the source of the ignition was. And postulate if design and operating changes adopted after a previous Disaster in the UK had been enacted in the US offshore oil industry the explosion may not have happened.
Occupational Safety versus Risk Awareness
On Deepwater Horizon (DH) at the time of the explosion there was a ceremony in the accommodation module celebrating 7 years without a Lost Time Incident. The installation owned and operated by Transocean had an outstanding record of preventing lost time incidents.
Post Piper Alpha, it was recognized that having a low number of lost time incidents, or as was the case on DH Horizon, zero incidents, was no assurance whatsoever that the risks to the health and safety of persons from major accident events on offshore installations were within acceptable limits.
Within US the oil industry in recent years were reminded of this. The technical investigation into the Texas City refinery explosion was critical in that whilst BP concentrated on occupational risks e.g. slips trips and falls it paid inadequate regard to the risks of catastrophic events.
The reality was that DH was a dangerous place for the persons on board irrespective of its world class performance in protecting them from occupational injuries.
If the probability of an undesirable event is high, and the consequences of that undesirable event are potentially catastrophic, then the risks are dangerously high. Risk as you are aware is the product of the probability and the consequence of the event happening. Whether assessed numerically, by Quantitative Risk Analysis (QRA), or by Qualitative Risk Analysis, DH as it operated in the period leading up to the incident had risk levels likely to be in the intolerable range, at levels unacceptable to Society in the weeks prior to the explosion.
Was the Disaster not only foreseeable but inevitable?
Due to well control problems a number of significant gas releases into the atmosphere occurred in the weeks prior to the disaster. Allied to this, and from examination of witness testimony, insufficient measures appear to have been in place to prevent gas being ingested into an enclosed Non Hazardous Area where sources of ignition are constantly present during normal operations.
So the probability that a flammable atmosphere could exist on DH was high and the probability of subsequent ignition causing an explosion was high. The two combined on the 20th May with catastrophic effect.
————————————————————————————————————-The following paragraphs cover two crucial questions
· Why was there an apparent acceptance of gas leaks in the weeks prior to the explosion?
· Why did the gas cloud ignite on the 20th May when previous gas releases had not
In the attempt to answer these questions the testimony of various survivors is examined, mainly that of Mike Williams re the CBS 60 minutes video.
Was there an inadequate reaction in the weeks before the blow-out to the gas releases caused by well control instability
It’s relevant here to give a picture of how gas releases would have been handled Offshore UK and the general attitude and intolerance of these events.
This is of interest to any formal US Inquiry and I hope to the work you have been tasked with.
Piper Alpha was as a result of gas entering a Non-Hazardous Area where sources of ignition were present during normal operations.
Post Piper Alpha an operator of any type of installation, Fixed, Floating Production or MODU needed to demonstrate to himself and his employees the risks to individuals, and to the total population of the installation were within acceptable limits. This could be done using QRA or Qualitative Risk Analysis. To assist this Explosion and Fire Analysis were completed. Also Survivability analysis to show that critical safety systems could withstand fire and explosion.
Further that the Operator had to provide a safe haven or Temporary Refuge (TR) on the installation that could endure all foreseeable threats from Fire or Explosion due to escalating hydrocarbon events for a stated endurance period, normally one hour. The Fire, Explosion and Survivability Studies thus also helped in the design requirements for the TR.
Other risks were assessed such as Ship Collision, Dropped Objects etc both relevant also to a MODU such as DH which since it was certified as a vessel the competent authority ABS would have I assume ensured it met all SOLAS requirements.
Lets take it as a given that the vessel complied with Class requirements. The dominant risk to persons on board were the risks of fire or explosion due to transient well instability with gas emitted at the Shale Shaker from the drilling cuttings or from an uncontrolled release from the well.
On DH was a significant gas release foreseeable?
As per testimony obtained from survivors and other sources on DH in the weeks and months before the blowout significant releases of flammable gas into the atmosphere had occurred. PA announcements warned those onboard to stop all work that may have caused an ignition. My assumption is that these releases were significant (meaning in UK legislation that they were potentially in the explosive range of the principal flammable gas methane circa 4.8 to 15 % by volume in the air). The Mud Treatment area, shale shaker etc, drill floor are areas where a flammable atmosphere is likely to occur in normal operation and these were no doubt classified as Zone 1 or 2. Electrical equipment located in these areas would have been explosion proof if installed, operated and maintained in line with certification requirements. My assumption is that on DH Hydrocarbon (HC) and Toxic Gas (H2S) detection systems were installed in these areas in line with industry practice.
Gas releases in UK are defined as Dangerous Occurrences
An apparent difference in attitude and approach to gas releases between UK and US seems to exist. In the UK all gas leaks are to be reported large or small. There is almost a zero tolerance to numerous small leaks and significant gas releases i.e. those that get into the explosive range in the UK. Such significant releases are defined as ‘dangerous occurrences’ and must by Law be reported.
Perhaps this is not surprising in the UK as 167 men died in 1988 as a result of an ignited gas leak. Like DH the Piper Alpha had forewarning when earlier in its operations a major gas leak had not ignited. Lord Cullen in his recommendations placed considerable emphasis on preventing gas leaks, but if they did happen, they must be prevented from igniting. The threat to persons on board installations from an escalating hydrocarbon event was to be reduced as far as was reasonably practicable (ALARP).
If, it had been operating in the North Sea the DH, with the significant gas leaks as described by survivors that occurred in the weeks before the incident, would have been expected to cease operations after making secure the well. The incident would have been reported to HSE. HSE Inspectors would more than likely fly out the next day and the operator would be required to indicate what actions he was to take before drilling could resume.
The point I make is perhaps to highlight my perception of the attitude and behavior to the risks associated with gas releases during drilling operations.
Drilling ahead at all costs despite the risks would not have been acceptable in the UK.
If flammable atmospheres are present on an offshore installation it doesn’t matter whether they come from the flange of a gas compressor (Piper A) or from the well via the drilling cuttings, the consequences can be catastrophic if the gas ignites.
From testimony and detail already in the public domain the US regulator MMS was aware of these problems and had requested that the Operator was to proceed with caution. Any Inquiry no doubt will determine how this not unreasonable request was enacted.
Was there adequate protection on Deepwater Horizon regards prevention of explosions?
There is no indication from any testimony that the developing blow-out itself caused any deaths or injuries and Toolpusher, Driller, Mud Engineer etc. as key players in the developing situation may have been able to take manual actions locally re the BOP and the employment of the surge diverter.
Although they would have very little time, just maybe, and with some difficulty, the situation could have been brought under control. The actions they were to take would have to be quick but it would have been much easier to tackle the problem with the installation in situ and the riser undamaged. With the explosion all hope was gone.
The destructive forces created in a methane/air explosion
The testimony from Mike Williams and his CBS 60 minutes interview.
It is very rare to get such testimony from someone so near the scene, and as he describes he owes his life to the protection given him by heavy door on the workshop wall between the workshop and the Diesel Engine module. But his vivid description he gives the reader an idea of the enormous forces created by the instantaneous pressure reached in the enclosed module in the microseconds following ignition. Flameproof electrical equipment designed to withstand an explosion of methane/air without distortion of the enclosures or covers and are normally tested by hydraulic pressure at 50psi. Consider the workshop door was say 8 ft by 5 ft, or 5,760 sq. inch. Now assume by conservative estimate 20psi was applied to every sq. inch of the workshop door. You now begin to imagine the destructive effects of an explosion and how fortunate Mike William was to survive. I discuss these forces later in relation to the accommodation module.
Where was the most likely source of ignition causing the explosion?
Consider the testimony of Mike Williams (CBS 60 minutes). It seems clear that when he heard the results of the gas ingesting into the air intakes of the Diesel Engines driving the AC alternators no explosion had yet occurred and AC generation is still ongoing because he talks about the lights still being on.
At around 21.49 the three fishermen in their boat, immediately under the installation, heard the roar coming from above and smell the gas. This is reasonably assumed as the blowout commencing. They beat a hasty retreat. From a distance they estimate at 100 yards, they see blue flashes and then all hell breaks loose. They video the fireball which is covering a significant area of the topsides.
Any Inquiry should determine the delay period between the uncontrolled release of hydrocarbons and the ignition. Survivors speak about gas shooting across the decks. So my opinion is that this delay would have been more than sufficient for the gas to migrate from the drill floor or mud treatment modules to the HVAC inlets of enclosed non-hazardous areas. The Diesel Engines, the AC Alternators, the 11 kV switchboard and the Emergency Generator located in these areas are all capable of causing the ignition of the gas.
In summary, the gas reached where Williams was located after as period of delay still to be determined but an explosion had not occurred and the AC Alternators had not tripped. The gas was clearly being ingested into the air intakes of the engines, these were overspeeding, the lights getting incredibly bright and then the first explosion occurred. If the gas had been ignited at the mud treatment skid or in the area around the drill floor/ riser an explosion would have occurred prior to Williams hearing its affect on the Diesel Engines.
Since the electrical equipment in these Drilling areas should be explosion proof, and since gas had entered these areas on several occasions in the weeks before the blowout, but had not ignited, it appears that the seat of the explosion was, on the balance of probabilities, where Williams was located. He has also testified to the force of this explosion at his location indicating it was local.
This in my opinion excludes other areas suspected of being the source of ignition such as the accommodation galley. The second explosion outside the second door to the workshop appears as violent as the first which would indicate this explosion was in another module adjacent to where Williams was located and not an explosion emanating from the accommodation module or elsewhere.
What was Williams witnessing?
The centrifugal over-speed device on the engine output shaft (if fitted) would probably have operated to close the fuel valve inlet. Disconcertingly however, to anyone who has ever witnessed this, the engine continues to rev and increase speed with an alternative source of fuel. This means that the gas/air mixture being ingested into the engine must have been in the explosive range 4.8 to 15% by volume or combustion could not have continued in the engine cylinder heads. The gas air mixture was fueling the Engine irrespective of the Diesel fuel supply having been isolated or not. This again supports my opinion that in the vicinity of the Diesel Engines in the Non Hazardous area where they were located, a flammable atmosphere existed some time after the blowout had commenced, and prior to the explosion.
Williams does not mention any sounding of a General Platform Alarm (GPA) or announcement on the PA system. His first realization that something is amiss is I hear the engines revving. My assumption is that the beep beep beep alarms he is hearing is from the Control Instrumentation panels for the Engines and not from any GPA but this should be clarified.
The Galley, could this have been the location of secondary explosion?
The description of the injuries to the personnel within the accommodation galley could suggest a smaller secondary explosion within the accommodation but the pressure wave is usually followed up with a slow moving flame-front. Testimonies do not indicate that persons within accommodation suffered burn injury. There is testimony from others also that the blast damaged escape walkways to the accommodation and it seems the injuries of those within may have occurred as the accommodation moved violently of its foundations.
Non Hazardous Areas
There are many open areas, around the helideck, outside muster stations, part of pipe deck etc considered Non Hazardous. But in abnormal conditions because they are open areas gas from a major leak such as a blowout could be present in these areas. By convention therefore, any electrical equipment in these areas is explosion proof. I would expect DH would be in line with this standard design practice.
Enclosed Non Hazardous Areas
This is my main area of interest.
Such areas have HVAC systems of forced ventilation normally 12 air/changes of the space per hour with internal pressure circa 5mm water gauge above atmospheric maintained. Thus over pressure ventilation ensures no significant ingress of air (or gas). It is usual to have an alarm from these enclosed areas to some central control room if the internal pressure falls to atmospheric indicating that the forced ventilation has failed.
This was how the HVAC on the Piper Alpha Central Control Room operated but on the fateful day in 1988 it was thought gas was ingested into the control room by the forced ventilation.
A significant post Piper Alpha design change therefore was that all such enclosed areas would have gas detection in the air inlets at 20% LEL would close the fire dampers in the HVAC inlets and trip the forced ventilation. In addition a signal from the gas sensors would trip the main AC generation. So there were in essence two barriers of protection after gas was detected in its HVAC inlets.
1. The area was essentially sealed to prevent ingress of gas by the closure of the fire rated dampers and loss of ventilation
2. The electrical equipment capable of causing a source of ignition was isolated by the tripping of the Main AC Generation
This is the same system of protection afforded the TR but with the addition that the inlets have smoke detection also.
In addition some areas such as that housing the Temporary Generator have gas detection also within the room which will inhibit the generator from starting if above gas above 20% LEL is detected.
So what would I have expected to happen on DH on 20th May if it had been afforded the same degree of protection as an offshore installation in the UK operating under a Safety Case, where Fire and Explosion studies had been completed and risks reduced to acceptable levels.
· On gas reaching 20% LEL in Drilling areas the main AC generation would trip
· A General Platform Alarm (GPA) would sound indicating change of status from normal alert – on many installations there are status lights, a traffic light system, green is normal, followed by yellow (10%LEL) and red (20% LEL), blue is abandon platform operated manually by the OIM
· Persons with no emergency duties would proceed to their muster stations in the TR immediately
· Persons with emergency duties would proceed to their designated areas (Search and Rescue Teams for example)
· Say for argument sake the gas detection system failed to operate in the Drilling areas
· On gas detection at 20% LEL in the HVAC inlets to the enclosed areas of the workshop where Williams was located, or the area containing the Diesel Engines, the forced ventilation would trip and the fire dampers close, the main AC generation would also be tripped and the GPA would indicate change of status
Contrast this with DH on 20th May
· Although gas was present all over the moon pool and mud treatment area Williams was not aware of this (nor anyone else not at the scene) as there apparently no alarm (GPA)
· On Gas entering the Diesel Engine area there was still no GPA and no gas detection apparently operated to close fire dampers and trip the forced ventilation
· The AC generation system was still running and the lights still get brighter and brighter
· The Diesel Engines were revving and overspeeding
· An explosion occurred
In conclusion, it would appear that that almost a quarter of a Century after 167 people were killed because gas entered a Non Hazardous Area containing sources of ignition this apparently happened again on DH.
The International Association of Drilling Contractors (IADC) based in Houston have HSE Case Guidelines Issue 3.2.1 May 2009 and on examination
· These adequately cover the requirements of what a TR is and how it is protected including smoke and gas detection in the air intakes
· However it does not give guidance on Non Hazardous Areas specifically other than normally manned areas should have smoke and gas detection on HVAC inlets
This does not appear to be competent guidance is that the intent of the various worldwide standards is to protect areas containing non-explosion protected electrical equipment whether these areas are normally manned or not. Utility Modules as those described above are attended from time to time but are not normally manned, so what does normally manned mean in the IADC context.
In any Case IADC inform me that the Regulator MMS does not require Operators in the US to produce or comply with HSE Cases or any relevant guidelines pertaining to them including the IADC guidelines.
Could it be the Deepwater Horizon and other installations offshore US are operating with similar risks because the benefits of having perhaps a more systematic approach to risk was ignored along with many of the recommendations from the Piper A Fatal Accident Inquiry.
I would appreciate a response, but in any case wish you well.
Comparative Analysis of the Piper Alpha & Deepwater Horizon causes and effects
|Piper Alpha 1988||Deepwater Horizon 2010|
|A significant gas leak had occurred from process equipment some months prior to the disaster which had not ignited – so an early warning had been given which was not acted on||A number of significant gas releases had occurred (due to well control problems) prior to the disaster that had not ignited. The Regulator MMS instructed Operator to proceed with caution|
|The explosion was thought to have been due to an ignition from non explosion-proof electrical equipment or some other form of spark in a non-hazardous area or naked flame (smoking allowed at that time) in the central control room||From the testimony of a survivor it appears that the source of ignition was in the Diesel Engine room or the 11kV switch-room both non hazardous areas|
|It was the consequences of the explosion that turned a recoverable situation into a non-recoverable situation leading to multiple fatalities and destruction of the installation, pollution was limited and local||It was the explosion that turned a potentially recoverable situation into a non-recoverable situation leading to multiple fatalities and destruction of the installation, pollution is widespread and ongoing|
|The subsequent fire was fuelled from incoming pipelines where there was an unacceptable delay in isolating by closing the ESD valves on the sending end platforms but in any case the volume of gas entrapped in the supply pipelines was considerable and there were no incoming ESD valves installed on Piper Alpha||The subsequent fire and ongoing pollution was fuelled from a well which cannot to date be isolated. Attempts to close the BOP and the emergency disconnect system from the location of the Bridge failed. The hydraulic lines to the BOP and disconnect system from the control panel on the Bridge may have been damaged by the explosion|
|The immediate response to the explosion was inadequate because key workers were killed or incapacitated and firewater pumps which should have started automatically had been isolated.||The immediate response to the explosion must have been severely restricted because key workers were killed or incapacitated and manual actions to close the BOP at the Drill floor or employ the surge diverter may not have been taken|
|Overwhelmed by the situation no attempts were made to rescue injured persons with the majority of the crew including the Installation Manager mustering in the accommodation module. Evacuation routes from accommodation to the lifeboats were damaged or immersed in heavy smoke||Overwhelmed by the situation no attempts were made to rescue injured persons with the majority of the crew having abandoned the installation using their own initiative with no muster or control apparent and leaving survivors with missing persons unaccounted for|
|Prior to the disaster abandonment drills were carried out every Sunday morning with no element of surprise||Prior to the disaster abandonment drills were carried out every Sunday morning with no element of surprise|
|Some crew escaped by jumping over 100 feet into the sea. There was no access to the sea (walkways, or rope ladders etc) from the location of the Muster stations||Some crew escaped by lowering a life raft by crane and others by jumping 85 feet into the sea. There was apparently no direct access to the sea (walkways, or rope ladders etc) from the location of the Muster stations|
|The accommodation module was of wooden construction and did not provide a safe haven or Temporary Refuge for workers sheltering therein. Its ventilation intakes allowed superheated smoke and CO to enter the module which also had no blast or fire protection due to its inadequate design features||The accommodation does not appear to comply with current internationally accepted standards for a Temporary Refuge. The explosion damaged escape routes to the accommodation and persons located within the accommodation were injured. There seemed to be no provisions to prevent smoke or gas entering the accommodation|
|The immediate aftermath of the explosion was captured on video||The immediate aftermath of the explosion was captured on video|
Measures taken in UK after Piper Alpha apparently not fully implemented in US – some of these measures may have prevented the Deepwater Horizon Disaster
Regulatory changes, Safety Cases and risk quantification etc
|Operators were obliged to quantify the risks on their installations and if these risks were unacceptable they were required by Law to reduce them as far as reasonably practicable (ALARP). All this was to be documented in a Safety Case which requires formal acceptance by the Regulator||Not applicable in the US. The MMS does not require Operators to prepare Safety Cases now called HSE Cases|
|Demonstration that these risks were ALARP was to be audited by the Regulator, the Health and Safety Executive (HSE). They had the statutory power to enforce Operators to carry out modifications etc to reduce risks and cease operations where risks were found to be unacceptable. This cost the industry circa £5 billion for the refurbishment of offshore installations including replacing accommodation modules with Temporary Refuges. New build installations were required to meet updated standards of design. The UK in essence had move to a system of self-regulation but with independent audit and inspection of compliance||Deepwater Horizon does not appear to be designed in line with changes adopted not only in UK but in many other countries – examples are given in tables below
Not applicable in the US. The MMS does not require Operators to prepare Safety Cases now called HSE Cases
|There are only three measures of risk applicable within a UK Safety Case. These are Individual Risk per Annum (IRPA), Potential Loss of Life (PLL), and Temporary Refuge Endurance Frequency. These indicators were developed to reduce the risk of major accident events, I.e. those involving multiple fatalities and loss of Assets. In general these indicators gave Operators a clearer understanding of Societal risks and where they are coming from. Societal or Residual risk are those risks to the total population of the installation, rather than occupational safety risks at the work-site as measured by Loss Time Incident Frequency (LTIF)
Although LTIF is a good indicator of how occupational risks (slips, trips and falls) are being managed there is no correlation between a low number of LTI and the risks of a major accident occurring so measures such as IRPA and PLL were introduced
A mandatory requirement was introduced to report gas leaks which are defined in UK as dangerous occurrences. A database of gas leak frequency and significance was establish and monitored to look for trends by the HSE. It is an offence in Law for an Operator not to Report a gas leak to the HSE
|Deepwater Horizon had gone 7 years without a LTI yet the risk of major accident events was high prior to the incident.
The technical report into the Texas City Refinery explosion criticised BP for being totally focussed on LTI prevention to the exclusion of potential catastrophic events but MMS did not seem to pick up on this, nor did Trans Ocean or BP in their offshore operations
It is not known if MMS impose a mandatory requirement that Operators report gas leaks
|A further estimated £2 million was spent on competence development – the Safety Case identifies safety critical positions such as the Offshore Manager, Inspectors, Helicopter Landing Officers, et al. The employer of the persons with safety critical roles was responsible for formally assessment of competence levels of these individuals. Offshore Managers and their Deputies were subject to simulator type training to assess their competence to manage Major Emergencies offshore. Managers deemed Not Yet Competent could not serve in that role||Not thought applicable in the US. The MMS does not require Operators to prepare HSE Cases which include guidelines on competence levels required for safety critical offshore staff|
Measures taken in UK after Piper Alpha apparently not fully implemented on Deepwater Horizon – these measures if implemented may have prevented the explosion
Design and Procedural Changes – prevention of explosion
|In Hazardous Areas where gas can be present during normal operation coincidental gas detection set at 10% Lowest Explosive Limit (LEL) would cause a General Platform Alarm (GPA) and at 20% LEL would take executive action to trip the primary AC generation reducing risk of source of ignition||Although gas would have swept across the Drill floor, moon pool area, Mud treatment module etc it appears from Mike Williams testimony from his workshop location that there were no General Alarms or PA announcement and the AC generation system continued to operate|
|In open, naturally ventilated Non Hazardous areas which are not enclosed like the helideck, outside muster stations, etc where gas is not likely to be present in normal operation by convention all electrical equipment should be explosion proof to reduce the risk of ignition in the unlikely event (blow-out for example) that gas migrates from hazardous areas||It is assumed Deepwater Horizon is in line with this convention. Explosion Proof types are normally Flameproof Ex (d), Increased Safety Ex (e) or Intrinsically safe Ex (I) . In the Driller’s Console purge protection is sometimes used|
|Enclosed Non Hazardous Areas are pressurised above atmospheric pressure circa + 5mm water gauge by HVAC systems such that gas can not in normal operation enter the area which will include electric equipment with potential of being source of ignition. The gas detection system operates as with Hazardous Areas in that 20% LEL detected either within the room or in the ventilation inlets will cause Primary AC generation to trip thus reducing risk of ignition. In addition the fire dampers in the air inlets will close and the HVAC system trip to prevent any gas being ingested. On tripping of Primary AC generation the Emergency Generator will auto start provided there is no gas in the room or the HVAC inlets to the room, if there is, protection will work as above and the Generator will be inhibited from starting
This modification was as a direct consequence of the Inquiry findings that the explosion on Piper Alpha was likely to have been initiated from a source of ignition in a Non Hazardous Area
|Mainly from the testimony of Mike Williams it is clear that significant quantities of gas were ingested into the Power Generation Module. The Diesel Engines should have tripped and the HVAC inlets to the room close at 20% LEL but the amount of gas entering the room would indicate otherwise
The 11kV switch-rooms if separate should have been provided the same protection This module containing prime movers driving AC alternators in turn feeding 11kV industrial switch-gear capable of igniting a gas-air mixture due to electrical arcing within the switch-gear during normal operation (Contactors and circuit breakers). The AC alternator Circuit breakers may have been tripped by overvoltage protection due to overspeeding of Alternator
|Gas Turbines and Diesel Engines normally located in Enclosed Non Hazardous Areas are protected by gas detection in their air intakes, or within their acoustic enclosures. If gas was sensed at 20% LEL these machines were tripped automatically thus shutting down before a gas mixture in the explosive range could effect the machines operation or cause a source of ignition||From the testimony of Mike Williams gas ingested into air intakes of the Diesel Engines caused them to over-speed and drive the Alternators above their synchronous speed of 3600 rpm.
Such over-speed increases the frequency (Hz) of the electrical output and also more importantly the Voltage which is a function of Frequency. This over-voltage had the potential of causing a source of ignition in Certified explosion-proof electrical equipment since the rise in voltage may have exceeded the equipment certified design limits
Measures taken in UK after Piper Alpha apparently not fully implemented on Deepwater Horizon – some of these measures may have aided the immediate emergency response and the protection of personnel from harm
Design and Procedural Changes – survivability of safety critical systems and provision of a safe haven to allow abandonment of all persons in a controlled manner
|Amongst other things Explosion and Fire Studies as part of the Safety Case must demonstrate that critical safety systems could survive an explosion by proper design and shielding etc – Survivability Studies. This would include remote control lines, hydraulic or electric to BOP, ESD valves etc. Ship Impact and safety & security concerns (sabotage or terrorism) prohibit entry into a 500m exclusion zone around installations. Standby search and rescue vessels enforce this||Attempts by the Subsea Engineer to close the BOP and the emergency disconnect system from the location of the Bridge failed. The hydraulic lines to the BOP from the control panel on the Bridge may have been damaged by the explosion according to Survivor testimony. Fishing vessels allowed under the installation|
|A major design change was the provision of a Temporary Refuge within which was to be located the central control room from where emergencies were to be managed.
Usually the TR is the accommodation module either newly installed or refurbished to meet the standard. The TR had to have an endurance period, normally 1 hour and to ensure this the box was fire rated (H120) and protected from the process by a Blast wall. The ventilation intakes close the fire dampers on 20% LEL gas detection and on the detection of smoke. It was smoke ingress that killed the majority of the 167 persons on Piper Alpha. Important to understand the TR is not limited to the accommodation module but includes the escape routes to the TR from the process and the evacuation routes to the lifeboats
|Witness testimony suggest ignition source for the explosion could have been the galley within the Accommodation module
Blast protection appeared to be inadequate as Persons within the accommodation injured by blast. Also escape routes leading to the accommodation module apparently damaged.
All this indicates accommodation module did not meet requirements of a Temporary Refuge as defined in by internationally accepted standards whether or whether not the Operator referred to it as such
|A variety of means were provided for persons to get direct access to the sea in an emergency if their route to the TR was blocked or unavailable||This facility was not apparent on Deepwater as survivors launched a life raft by using a crane or jumped into the sea risking injury|
|Time to Abandonment exercises were completed so that the Regulator could witness that all persons on board could return to the TR, muster, don life-vests etc and be loaded into the lifeboats. This time, under worst case exercise scenarios had to be less that the endurance time for the TR – normally 40-45 minutes for large and complex installations with enclosed concrete shafts. All Abandonment drills were carried out without the crew being made aware of them in advance, i.e. with an element of surprise. This was to give better assurance to the Operator that in a real emergency order and discipline would prevail and abandonment could be achieved within the criteria set||Prior to the disaster abandonment drills were carried out every Sunday morning with no element of surprise.
According to survivor testimony chaos reigned after the explosion. There was no effective command and control, no muster was taken and lifeboats were launched leaving some survivors and persons as yet not unaccounted for behind. Persons may have died on the installation who may have been rescued. The Captain had not operated the emergency disconnect etc system from the bridge. This was done by the Subsea Engineer. It is not clear who had the emergency response action to do this or whether the installation had emergency response procedures clarifying who should do what