Beruflich Dokumente
Kultur Dokumente
MAERSK NGUJIMA-YIN
Marine accident report
Fire/explosion
th
13
of April 2009
Page 1
Link to video clip on page 19
Purpose
The purpose of the investigation is to clarify the actual sequence of events leading to
the accident. With this information in hand, others can take measures to prevent similar
accidents in the future.
The aim of the investigations is not to establish legal or economic liability.
The Divisions work is separated from other functions and activities of the Danish Maritime Authority.
Reporting obligation
When a Danish merchant or fishing vessel has been involved in a serious accident at
sea, the Division for Investigation of Maritime Accidents must be informed immediately.
Phone: +45 39 17 44 00
Fax:
+45 39 17 44 16
E-mail: oke@dma.dk
Cell-phone: +45 2334 2301 (24 hours a day).
Contents
1
2
3
4
5
Summary .............................................................................................................. 5
Conclusion/Findings.............................................................................................. 5
Recommendations and initiatives.......................................................................... 7
The investigation................................................................................................... 8
Factual Information ............................................................................................... 8
5.1
Accident data............................................................................................... 8
5.2
Navigation Data ........................................................................................... 8
5.3
Ship data ...................................................................................................... 8
5.4
Weather data................................................................................................ 9
5.5
The Crew ...................................................................................................... 9
5.6
VDR ............................................................................................................ 10
5.7
Narratives................................................................................................... 10
5.8
The scene of fire........................................................................................ 13
5.8.1
Compressor train A.............................................................................. 13
5.8.2
Stored oil drums................................................................................... 14
5.9
Fire fighting systems ................................................................................ 14
5.9.1
Deluge systems ................................................................................... 14
5.9.2
Foam systems ..................................................................................... 15
5.9.3
Water mist system for gas turbines...................................................... 16
5.9.4
Hydrants on the new ring fire main ...................................................... 17
5.10 Fire fighting subsystems .......................................................................... 18
5.10.1
New ring fire main/water hammer ........................................................ 18
5.10.2
Debris from aft fire water pump engine ................................................ 20
5.10.3
Glass Reinforced Epoxy piping ............................................................ 21
5.11 Investigations by other parties................................................................. 23
5.11.1
NOPSA findings................................................................................... 23
5.11.2
Maersk FPSO & Woodside findings ..................................................... 23
5.12 Project setup and organisation ................................................................ 23
5.12.1
Brief time line....................................................................................... 23
5.12.2
Project setup and Organisation............................................................ 24
5.12.3
The safety case ................................................................................... 28
5.12.4
Company policies and core values ...................................................... 29
5.13 Commissioning ......................................................................................... 29
5.14 Security systems on board....................................................................... 31
5.14.1
Maintenance systems .......................................................................... 31
5.14.2
Integrated Control and Security System (ICSS) ................................... 32
5.14.3
Closed Circuit Tele Vision (CCTV)....................................................... 33
5.14.4
SYNERGI ............................................................................................ 33
5.15 Safety climate on board ............................................................................ 34
5.15.1
Safety meetings................................................................................... 34
5.15.2
Crew concerns..................................................................................... 34
5.15.3
Working climate on board .................................................................... 35
5.15.4
Training, competency and manning ..................................................... 36
5.15.5
Post event management ...................................................................... 37
5.16 Authorities and inspection ....................................................................... 37
5.16.1
Danish Maritime Authority.................................................................... 37
5.16.2
Classification scheme .......................................................................... 38
6
Analysis .............................................................................................................. 40
6.1
The cause of the explosion and fire......................................................... 40
6.2
Course of events leading up to the explosion and fire ........................... 41
6.2.1
Safety climate prior to production start-up............................................ 41
6.2.2
Deluge system..................................................................................... 41
Marine accident report
Page 3
6.2.3
Foam system ....................................................................................... 42
6.2.4
GRE Piping.......................................................................................... 42
6.2.5
Water mist system ............................................................................... 43
6.2.6
New ring fire main/water hammer ........................................................ 44
6.2.7
Debris from aft firewater pump engine ................................................. 45
6.2.8
Commissioning .................................................................................... 45
6.2.9
Maintenance ........................................................................................ 46
6.2.10
ICSS Integrated Control and Safety System ..................................... 46
6.2.11
Safety climate post production start-up - software................................ 47
6.2.12
Shore management ............................................................................. 48
6.3
The detection and identification of the explosion and fire ..................... 49
6.3.1
Detection of the fire scene ................................................................... 49
6.3.2
Identification of fire source ................................................................... 49
6.4
Fighting the fire ......................................................................................... 50
6.4.1
Automated systems ............................................................................. 50
6.4.2
Manual fire fighting .............................................................................. 51
6.4.3
Crew fire fighting efforts ....................................................................... 52
6.5
Post event management ........................................................................... 52
6.6
Audits and inspection ............................................................................... 53
7
Enclosures .......................................................................................................... 54
7.1
Excerpt from NOPSA improvement notice .............................................. 54
7.2
Excerpt from Woodside/Maersk report .................................................... 55
7.3
Purpose of Commissioning procedure.................................................... 58
7.4
Company policies...................................................................................... 59
7.5
ISM on board audit the 22nd 24th of October 2008................................. 61
7.6
ISM audit in Copenhagen on the 30th of January 2009............................ 62
7.7
ISM audit in Perth on the 17th of March 2009 ........................................... 64
7.8
ISM audit on board the 18th of March 2009 .............................................. 65
1 Summary
MAERSK NGUJIMA-YIN is a FPSO (Floating Production Storage and Offloading). The
vessel is operating in the Vincent Field off the cost of North West Australia, Nigaloo
National Park.
The vessel was originally build in 2000 and served as a VLCC until September 2007.
During 2007 and 2008 the vessel was rebuild in Singapore. In June-July 2008 the vessel was commissioned and commenced oil production.
At approximately 1250 on the 13th of April 2009 an explosion and subsequent fire occurred in the vessels gas compression module M60 due to a severe breakdown of a 3rd
stage HP gas compressor. No persons were injured by the explosion and fire or subsequently during the fire fighting.
The fire was contained at approximately 1425 while boundary cooling and vigilance
was maintained until next day.
2 Conclusion/Findings
The cause of the explosion and fire
The primary reason for the HP compressor failure on April 13, 2009 has been
identified as a flow transmitter error. After the failure the explosion and fire developed through the torn seal bearing cap and through the lubricating oil system. (6.1)
It is the assessment of the Division for Investigation of Marine Accident that the
safety climate on board during the project period in Thailand and Singapore has
been poor. (6.2.1)
There have been difficulties with deluge valves on module M60 and M70 prior
to the accident. (6.2.2)
The old foam system failed to work on demand during the fire due to defective
nozzles. (6.2.3)
GRE piping in two branch lines failed during the fire. The GRE piping has been
subjected to radiant heat and flames during the fire and has repeatedly been
subjected to pressure pulsations arising from water hammer and start-up of diesel driven fire pumps. Lloyds Register gave approval for GRE piping at L3 rating
according to IMO resolution A.753(18), appendix 2. (6.2.4)
The water mist system failed to work on demand during the fire because a nitrogen regulator was either obstructed or closed. (6.2.5)
Continuous problems with the new ring fire main have been identified. The
problems have not been resolved. (6.2.6)
Debris containing carbon deposits has been excreted from the exhaust system
of the aft fire water pump. It is reasonable to believe that the carbon deposits
originate from start-up of the engine where heavy black smoke is developed.
The issue has raised safety concerns but has not been resolved. (6.2.7)
Difficulties with the planned maintenance system SAP and corrective work
originating from commissioning has compromised planned maintenance. It is
the assessment of the Division for Investigation of Marine Accidents that maintenance planning on board and maintenance support from shore management
has been inadequate. (6.2.9)
It is the assessment of the Division for Investigation of Marine Accident that the
safety climate onboard after production start-up has remained poor. (6.2.11)
The ICSS was not able to establish the location of the fire and the crew did not
have an instant overview of the facilities as the CCTV was cut off, because it
was not powered from an uninterruptible power source. The identification of the
fire source and choice of fire fighting equipment was primarily based on visual
inspection by the crew and a stand by vessel. (6.3)
From the general alarm sounded and until the fire scene and fire sources were
established 1 hour and 16 minutes passed. It is the assessment of the Division
for Investigation of Marine Accident that the on board security system did not
provide adequate barriers against loss of instant overview. (6.3)
The automatic release of the deluge on modules M30 and M60 failed. Manual
release had to be carried out and approximately one hour passed from the fire
started until water was confirmed. The functionality of the deluge systems on
M30 and M60 has been insufficient. (6.4.1)
The Division for Investigation of Maritime Accident will emphasize the GRE piping failure when this report is forwarded to IMO.
4 The investigation
The Division for Investigation of Maritime Accidents has carried out the following activities as part of the investigation:
Meeting with the DPA and Maersk FPSO, Copenhagen on 5th of May 2009
Meeting on 4th of June 2009 with the Operational Superintendent that was on
board during the incident.
5 Factual Information
5.1 Accident data
Type of accident (the incident in details)
Time and date of the accident
Position of the accident
Area of accident
Injured persons
IMO Casualty Class
Explosion/Fire
1250 local time
21 261 S 114 040 E
North west Australia, Nigaloo National
Park
Nil
Serious
MAERSK NGUJIMA-YIN
Roskilde
OYTS2
9181182
8133400
DIS
Denmark
A.P. Moeller.
2000
FPSO(Floating Production Storage and
Offloading)
162154 GT
Lloyds Register of Shipping
332.95 m
27165 kW
Double hull, steel
Notice from Danish Maritime Authority B
41
3
N/A
13
5.6 VDR
The vessel is equipped with Voyage Data Recorder (VDR).
The VDR is covering the bridge and the ordinary marine systems.
The cargo control room is not covered by VDR and voice recordings from the incident
have not been recorded.
5.7 Narratives
MAERSK NGUJIMA-YIN is a Floating Production Storage and Offloading (FPSO). The
vessel was originally build in 2000 and served as a VLCC until September 2007.
During 2007 and 2008 the vessel was rebuilt in Singapore. In June-July 2008 the vessel was commissioned and commenced oil production.
For more technical details please refer to:
http://www.maersk-fpsos.com/fleet/fpsos/FleetItem.aspx?fid=43&cid=6
All time indications below are local time:
At approximately 1250 on 13th of April 2009 an explosion and subsequent fire occurred
in the vessels production module M60 due to a severe breakdown of a 3rd stage HP
gas compressor. No persons were injured by the explosion/fire or subsequently during
the fire fighting.
The fire was contained at approximately 1425 while boundary cooling and vigilance
was maintained until next day.
Preparations for evacuation of the FPSO were made.
Module M60 is a gas compression module consisting of two compressor trains A and
B. The compressor trains A and B are driven by two gas turbines respectively.
The function of M60 is to return the separated gas back into the well. M60 is placed in
star board side approximately 50 metres forward of midship.
At approximately 1245 two crew members were heading towards M60 to check an
alarm on a nitrogen gas seal for the high pressure compressor A. Halfway to M85 they
heard a loud noise of a winding down turbine followed by a deep thumb and loud bang.
They looked up and saw steam above M85 and subsequently a fireball followed by
thick black smoke.
At 1250, the general alarm was sounded and the two crew members returned to their
muster station in the accommodation.
An emergency shutdown and blow down was initiated and a full muster of 41 persons
was achieved shortly after. No persons were injured.
Deluge was activated on module M10, M30 and M60 but did not release.
M10 is the high pressure oil separation module, where water and gas for re-injection is
separated from the crude oil. M10 is placed adjacent to M60 towards port side.
M30 is the high pressure flare skid and holds a flare drum with a volume of approximately 80 m3. At the time of the accident it contained approximately 3 m3 compressed
process gas. M30 is placed in starboard side approximately 50 metres forward of M60.
M60
M30
M10
M60
Figure 1: MAERSK NGUJIMA-YIN General arrangement.
M30
Source: Maersk FPSO
Emergency response teams were engaged and the fire was assessed. It was established at 1325 that the fire was in module M60.
As the deluge did not release on module M60 and M30 a member of the fire fighting
team progressed to the deluge skids and released the deluge manually. Water from
M60 and M30 was confirmed at 1350.
Pulsing grey smoke was observed at 1359 from a standby supply vessel. At 1406, it
was confirmed that a direct current (DC) emergency lubrication oil pump for the compressors was still running. Two electricians were sent out to M85 to electrically cut of
the pump.
At 1425, the fire was contained.
A more detailed sequential overview of the events during the fire is presented below:
1250:
Indication on the Integrated Control Security System (ICSS) of fire in the compressor enclosures of module M60
Emergency shut down(ESD1) initiated
Blow down initiated
General alarm is sounded.
1251:
Switch to emergency power.
Closed Circuit Tele Vision (CCTV) is no longer available.
Deluge activated automatically from the ICSS on module M60.
Deluge activated manually from cargo control room on module M30.
1305
Marine accident report
Page 11
1316:
Attempt to visually confirm water on deluge from Monkey Island. No confirmation possible.
1320
According to white board in the cargo control room the flare is off indicating that
the production system is depressurized. Emergency response teams can be
engaged.
1324:
Public announcement of no blowing in facility, i.e. the production system is depressurized.
1325:
Positive visual confirmation of fire in M60 by emergency response team.
Identification of oil drums between compressor trains.
1327:
Emergency response team establishes that deluge is not active on M60.
1328:
Standby vessel visually confirms fire aft of forward crane.
1330:
Cargo fire pumps started in attempt to activate the old foam system.
1334:
Deluge manually released on M60 by an emergency team member and water is
confirmed visually.
1340:
Emergency response team is preparing attack with fire hoses.
1343:
Emergency response team establishes that deluge is not active on M30.
1346:
Deluge manually released on M30 by an emergency team member and water is
confirmed visually.
13:50:
Emergency response team attacked M60 with fire hoses from M20 blast wall
1359:
Pulsing smoke identified by a standby vessel.
1406:
It is identified that a DC lubrication oil pump is running on compressor A.
Flames are still observed on compressor A
1420:
Manual isolation of DC lubrication oil pumps accomplished.
1425:
The fire is reported to be contained and boundary cooling is maintained.
According to the compressor makers representative, who was on board during the
investigation, there has been a general record of leaks in nitrogen gas seals in the industry, but no record of explosion fires.
According to the FPSO crew there have been issues with compressor bearings and
alignments during the project before commissioning.
5.9.2
Foam systems
is supplied by dedicated foam pumps and a predefined mixture of sea water and foam
liquid is conveyed to the foam monitors/hydrants via the fire mains on upper deck.
Old system
During the accident the old foam system failed to work on demand.
According to the Operations Superintendent who was on board during the accident, the
foam system activated but the nozzles on the foam monitors were incorrectly set and
thus not usable.
In Lloyds Register Validation Activity Report 3 of 15th June 2009 it is stated that:
Deck Deluge Foam Monitors were witnessed to be operational on the 10/06/2009 following
progressive identification and rectification of significant defects
According to the FPSO crew the old foam system was inspected after the accident.
The inspection found that the system would never have worked properly, as the in line
proportioner was fitted back to front, and 2 pneumatically operated valves supplying
foam to the system were fitted back to front, meaning when the valves were commanded to open to supply foam concentrate to the pumps, they were in fact shut.
According to the FPSO crew the system had been signed off as fully tested and commissioned.
It has not been clarified when the old foam system was last tested before the accident.
New foam system
Foam should be instantly available from the foam hydrants on those modules where
foam hydrants are installed as the new ring fire main is constantly pressurized.
The system was commissioned from 13th of May to 7th of June 2008. Foam was not
released on any module during this period.
According to the FPSO crew the system was tested shortly after being commissioned.
During the test it showed several leaks in welds in several areas of the ship. A work
order was made in order to get it fixed, i.e. Maersk FPSO was informed.
In a list of completed work orders, provided by Maersk FPSO, Australia, a job completed on 27th of August 2008 has stated in the description field: EXT: Temp repair
topsides foam leaks. A job completed on 30th of August 2008 has stated in the description field: Pump does not pump to capacity pressure
On an internal Defects list from February 2009 it was noted: Topside foam pump A.
No discharge pressure
The water mist is controlled by an automatic detection system that responds on signals
from local fire detecting sensors. When any fire detector is activated the water mist
system is to release automatically.
The water mist system did activate automatically when the fire was detected, but water
and nitrogen was not released. Nitrogen is the driving media for the system.
According to Maersk FPSO, Copenhagen the water mist system did not release because a nitrogen regulator was obstructed.
According to Maersk/Woodside report of 12th of May 2009 a nitrogen regulator was
incorrectly set. See enclosure 7.2
According to the FPSO crew the above mentioned regulator was fully wound down and
closed. I.e. it did not operate at all.
According to the FPSO crew all water mist systems protecting on board gas turbines, in
total 5 (Three driving power generators and two driving the HP compressors), were
inspected after the accident. It was found on all 5 systems that none of the regulators
would have operated.
The mentioned regulator is set manually.
When The Division for Investigation of Maritime Accident came on board the regulators
had been operated due to testing.
On a general safety meeting on 25th of May 2008 it was raised that Water mist system
for turbines had not been signed off. The water mist system was commissioned on 26th
of May 2008.
According to the FPSO crew the water mist system has not been tested since it was
commissioned.
In the commissioning documents it was noted that none of the nitrogen bottles, containing the driving media, had been released during the commissioning tests.
In order to test the systems with out releasing the nitrogen bottles it is necessary to
close the regulator.
According to the FPSO crew not all scheduled maintenance jobs for the water mist
systems have been carried out.
cussions with personnel onboard indicate a previous problem with this design of hydrant, which is the subject of a technical query..1
Source: Major Investigation Report: Fire in gas compression module Asset/site: Maersk Ngujima-Yin,
Australia Date: 12.5.2009
The Division for Investigation of Maritime Accident observed that at least one DN 200
gate valve had to be manually closed in order to isolate the old fire system and thus
stopping the water hammer. See video 1.
The Division for Investigation of Maritime Accident observed several leaks in the safety
valve overflow system and on a safety valve.
The water hammer has occurred whenever the new ring fire main has been utilized for
any purpose.
When the new ring fire main has been used for deck wash or similar purposes a remotely controlled over board discharge valve on the forward part of the vessel has to
be opened manually in order to ensure a sufficient flow through the diesel driven
pumps to avoid damage. The mentioned discharge line has the dimension DN400 and
is supposed to be used in connection with tests of the diesel driven fire pumps.
In the cargo control room an arrangement drawing of the new fire ring main was posted
with a yellow post it on it saying:
Any extended period of time that the FWP is online, the dump valve is required to be
open to stop dead heading of the pump. There is a mark indicating the position. You
can also confirm the flow rate of 1600 m3/h at the FWPs
The jockey pumps have been out of service several times since they were installed.
Since May 2008 they have been in service for approximately 3 months.
According to the FPSO crew it has been verbally raised to Maersk FPSO that the water
hammer could compromise the safety of the fire mains.
According to the Operations Superintendent who was on board during the accident,
Maersk FPSO, Australia was approached by him regarding the water hammer. From
their side he was informed that a solution was in progress.
According to the Operations Superintendent the water hammer issue has descended
from the project phase. He does not know the exact details but has noted that the new
ring fire main system is very confusing.
Maersk FPSO, Copenhagen, has informed that they have been aware of the water
hammer issue since the vessel came on site and does not regard the water hammer as
a serious problem.
Maersk FPSO, Copenhagen, has informed that the issue has been handled locally by
the engineering manager in Perth.
Maersk FPSO, Copenhagen, has informed that the provisional technical solution has
been tested to the satisfaction of Maersk FPSO, Copenhagen.
In Lloyds Register Validation Activity Report 3 of 15th June 2009, it is stated that:
An anomaly was previously noted and remains on the on the fire main due to water hammer
when the deluge pumps start and was also observed when they stop during deluge system testing
in June 09. The water hammer is noted to be sufficient magnitude to require deck isolation
valves to be manually closed.
WEL/Maersk to take the necessary steps to minimise the potential for water hammer in the fire
main during operations including hydraulic analysis and adjustments to ring main fire system
including new settings for jockey pump operations.
During the investigation on board there was no evidence of an operating procedure to
secure safe operation of the amended new ring fire main system.
According to Maersk FPSO, Copenhagen a temporary operating procedure was instated the first time the jockey pumps failed. However, by later failures the procedure
has not been reinstated.
The exhaust system is placed a few meters outside the dangerous zone as defined in
the class rules.
According to the Operations Superintendent the debris issue has been discussed with
the class and has been raised in SYNERGI (a corporate near miss and safety breach
reporting system, see 5.14.4). He has informed that he is not confident that it is safe.
The issue has not been rectified.
In Lloyds Register Validation Activity Report 3 of 15th June 2009, it is stated that:
It was noted that solid material was exhausted from the Aft Firewater Pump from time
to time. This material appears to be a salt accumulation possibly from crystallisation
from an internal spray cooler.
WEL/Maersk should determine where the material dropping from the Aft Firewater
Pump is coming from and assess potential impacts to the pump and surroundings.
According to Maersk FPSO, Copenhagen the internal spray cooler cools the exhaust
pipe and also prevents carbon deposits to come alive.
According to the FPSO crew the pressure in the new ring fire main rises from 8 bar to
16-17 bar upon start-up of the diesel driven fire pumps.
A strong water hammer has occurred every time the diesel driven fire pumps have
been in use.
Marine accident report
Page 21
According to the FPSO crew the operations team raised concerns, during the project
stage in Singapore 2007 - 2008, about the integrity and safety of GRE. They were informed by Maersk FPSO that the GRE piping was accepted by class and had the same
heat resistance properties as steel.
Maersk FPSO, Australia has informed that:
The GRE piping might have been damaged by the initial explosion and
GRE has a very poor resistance to explosion/chock.
The GRE piping might have failed due to radiant heat from the fire after an unknown time.
A material failure analysis is ongoing.
Lloyds Register gave approval for GRE piping at L3 rating according to IMO
resolution A.753(18), appendix 2.
According to IMO resolution A.753(18), appendix 2, a water filed pipe is to be fire endurance tested for 30 minutes. The internal pressure during the test is to be maintained
at 3 0.5 bar. The resolution was adopted on 4th of November 1993.
Maersk FPSO, Copenhagen has informed that MAERSK NGUJIMA-YIN may be the
first Maersk project where GRE is used in fire systems.
Lloyds Register Technical Association has issued An interpretation of the IMO guidelines on the application of plastic pipes on ships, Paper No. 7. Session 1993-94
According to Lloyds Register rules approval of GRE piping will in general be accepted
in Class III piping systems (I.e. working pressure 16 bars and working temperature
200C.)
Source: Major Investigation Report: Fire in gas compression module Asset/site: Maersk Ngujima-Yin,
Australia Date: 12.5.2009
2008: Rebuilding finalized. MAERSK NGUJIMA-YIN arrived on-site in August. Oil production commenced. Commissioning in progress.
2009: Remaining commissioning. Projects team handed over punch lists of the systems to operations team in March 2009. Unfinished items still remained under the responsibility of projects team until March 2009.
The responsibility of the operations team has been to ensure that the vessel and all
equipments are suitable and provide safe operability.
Since March 2009 Maersk FPSO, Australia has been responsible for all outstanding
items in connection with the MAERSK NGUJIMA-YIN project.
According to the Operations Superintendent who was on board during the accident the
vessel has very little contact to Maersk FPSO, Copenhagen in daily life. It is Maersk
FPSO, Australia that handles all inquiries from the vessel.
Woodside
Woodside is the operator of the Vincent field and owner of the safety case. See below.
Woodside is a customer of Maersk FPSO.
The Vincent Facility includes the wells, subsea manifolds, multiphase pumps, flowlines,
umbilicals, risers, the mooring anchors, chains, STP buoy and the MAERSK NGUJIMA-YIN.
Woodside manages the overall day to day operation of the Vincent Facility via the Vincent Field Manager, who is on board the FPSO and is accountable for ensuring that
conduct of all activities are in accordance with the Safety Case and approved Operating Procedures when the FPSO is connected to the STP Buoy, i.e. connected to the
continental shelf.
Woodside is accountable to The National Offshore Petroleum Safety Authority
(NOPSA) and other relevant Australian authorities with respect to safety and environmental protection when the vessel is connected to the continental shelf.
The Operations Superintendent who was on board during the fire
The Operations Superintendent who was on board during the fire was employed on
MAERSK NGUJIMA-YIN in January 2009.
He has 32 years of experience at sea and has worked on several off-shore installations
in the North Sea. Most lately he has been supervisor on 3 off-shore new building projects.
During his first rosters he was on board with another Operations Superintendent familiarizing with the vessel.
The roster during which the explosion and fire occurred was his first roster in charge of
MAERSK NGUJIMA YIN.
Master/Operations Superintendent.The Maersk Ngujima-Yin FPSO Operations Superintendent supervises, and is responsible for the safe conduct of all activities and personnel on the Maersk NgujimaYin FPSO and reports to the Woodside Vincent Field
Manager when the FPSO is connected to the STP Buoy.
The Operations Superintendent will take on the role of Master when the FPSO is disconnected from the STP Buoy.
Chief engineer/Maintenance Supervisor
The person who is responsible for the maintenance of the FPSOs equipment.
Deck officers/POT Operations
The Production Operations Technician Operations are not deck officers in the normal
sense and will normally carry out process and utility operations, offtake and maintenance tasks.
Engine room officers/POT Mechanical
The Production Operations Technician Mechanicals are not marine engineers in the
normal sense and will normally carry out process and utility operations, offtake and
maintenance tasks.
3
Production Supervisor
Responsible for the supervision, planning and implementation of all production activities incorporating: Production, Utilities, to maximise optimum oil/gas production and
water injection rates within safety, legislative, environmental and company requirements.
Medic/safety officer
4
The Safety Case applies to all activities associated with the operation of the Vincent
Facilities, including the MAERSK NGUJIMA-YIN FPSO whilst connected to the STP
mooring system. The Safety Case comes into force upon the initial connection of the
FPSO to the STP mooting system and risers, including the subsequent commissioning
and hook up activities.
.
The objectives of the Safety Case are to:
Provide a resource for staff to use as a reference which:
Identifies all hazards that could cause a Major Accident Event (MAE) anti with
the Vincent Facility.
Identifies the controls in place to prevent and mitigate these hazards.
Describe the likelihood and consequences of any identified MAEs associated with the
Vincent Facility.
Demonstrate that there is a management system that is in place to continuality and
systematically manage hazards (all health and safety hazards) in the Operations Phase
in the life of the facility.
Demonstrate that the risks to personnel associated with the facility are eliminated or
reduced to As Low As Reasonably Practicable (ALARP) and that the control measures
are adequate; and
Comply with applicable regulations in relation to Safety Cases.
. 5
The Maersk FPSO Safety Management System (SMS) is a part of the safety case
Woodside normally has 2-3 representatives on board.
According to the Operations Superintendent, who was on board during the event, it is
an unusual setup that Woodside owns the safety case. With this setup it is not clear
who is actually in charge.
According to Maersk FPSO, Copenhagen it is common in Australia that the operator of
the field owns the safety case.
5
Source: Vincent Production Facility Safety Case Operations Phase Revision 1. Date: April 2008
According to the Operations Superintendent Woodside claims the right to control certain work systems, which in his opinion can confuse the crew. For instance, by leak
tests there are discrepancies between Maersk and Woodside procedures.
According to the Operations Superintendent Woodside has sometimes wanted to take
direct command over Maersk crew, which has resulted in friction between the two parties.
According to the Operations Superintendent he ought to be fully in charge since he has
the command in emergency situations and is responsible for the overall safety onboard. He does not want to accept that daily work is to be carried out as per other systems than Maersk management systems.
According to the Operations Superintendent this has been an ongoing discussion between him and Woodside on several occasions.
Health and Safety Policy and Quality Policy is presented in enclosure 7.4.
On more safety meetings during 1st quarter of 2009 the Operations Superintendents
gave presentations on management commitment and company core values
AP Moeller Maersk Group Core Values were presented in the booklet Defining Our
Core Values
The core values are:
5.13 Commissioning
According to Maersk FPSO, Copenhagen commissioning has been carried out by the
projects team, lead by Maersk FPSO, Copenhagen.
The commissioning process is described in company commissioning procedures, also
containing the commissioning documents.
The purpose of the commissioning procedure for Firewater, Foam, Deluge and Sprinkler system is presented in enclosure 7.3.
The commissioning process commenced in Thailand and Singapore and was finalized
on-site.
According to Maersk FPSO, Copenhagen the FPSO crew and Maersk projects team
held meetings every time a part was to be handed over and mechanical completion
punch lists containing items to be corrected were being made out.
According to Maersk FPSO, Copenhagen the Maersk projects team has been responsible for clearing out the items on the punch lists and testing the systems according to
procedure before final signing off.
It is stated in the commissioning procedure that:
System performance shall be executed, according to separate procedures, by Operations as part of the "daily operation" of system with assistance from Project Commissioning as required.
.6
According to the FPSO crew they identified more safety and operability issues which
were brought up to Maersk Projects. Some of these issues have not yet been addressed.
According to the FPSO crew, they were told during job interviews that they were to
assist the commissioning process.
According to the FPSO crew they meet resistance form Maersk Projects in more aspects:
FPSO crew was not granted access to full technical documentation of the plant.
FPSO crew was not allowed to participate in performance tests.
According to the FPSO crew many systems were commissioned and signed off without
being fully tested.
According to Maersk FPSO, Copenhagen, all systems were tested according to maintenance procedure and there exist handover documents on all systems.
The Division for Investigation of Maritime Accidents has received information on the
following defective systems:
Glycol contactor:
o
Source: Commissioning Procedure: Firewater, Foam, Deluge & Sprinkler System Date: 21.01.2008
scuffs of gas. The excessive glycol was carried over to the 3rd stage HP
compression suction scrubbers.
The Operations Superintendent who was on board during the accident has informed
that he has been taking part in start-up of rigs since 1992.
The Operations Superintendent has learnt from his previous projects that the crew
should be a part of commissioning and class testing because:
It is the opinion of The Operations Superintendent that the crew should always make
certain that all systems are working.
According to the Operations Superintendent many of the tests in connection with commissioning and class approval has not been verified by the MAERSK NGUJIMA-YIN
crew nor been carried out to their satisfaction. The crew more or less has been excluded from the commissioning process hence it has not been possible to establish
certainty about the systems.
The Operations Superintendent believes that the current problems on board MAERSK
NGUJIMA-YIN originate from the commissioning period and that the crew from the operations team has been excluded during the project phase.
turers manual. SAP equipment number design is reported as bad, un-logical and nonuser friendly.
NOPSA found that maintenance work orders did not provide appropriate descriptions
and task actions.
NOPSA found a maintenance backlog of over 2000 overdue safety critical items.
The Division for Investigation of Marine Accidents has requested NOPSA to confirm the
number mentioned above. NOPSA has not been able to confirm or reject this due to
confidentiality reasons imposed by Australian legislation.
According to Maersk FPSO, Copenhagen the maintenance backlog of SAP contained
pr. 24th April 2009:
497 outstanding items on planned safety critical maintenance.
55 outstanding items on corrective work orders on safety critical equipment.
According to the FPSO crew, 270 technical requests (TQs) have been submitted since
the vessel left Singapore. Approximately 70 technical requests have been concluded.
According to the Operations Superintendent who was on board during the accident the
process through the change management system takes too long time.
The Operations Superintendent informs that he has never before experienced so much
outstanding maintenance on other projects this late in a project.
According to the Operations Superintendent maintenance on overdue safety critical
items has a certain time limit. In his opinion the handling of these due items has failed
onboard.
Control system logs indicate a large volume of alarms prior to and during the incident..
According to the FPSO crew the number of blocks and overrides in the ICSS and deficiencies within the procedures has been of great concern.
According to the FPSO crew 4-6 blocks would normally cause concern on other facilities.
5.14.4 SYNERGI
SYNERGI is a corporate near miss and safety breach reporting system.
According to Maersk FPSO, Copenhagen SYNERGI contains 1505 records from May
2008 till 5th May 2009 reported by MAERSK NGUJIMA-YIN.
According to Maersk FPSO, Copenhagen SYNERGI has been available during the
entire project, since the vessel arrived in Singapore in 2007. The system is being accessed from Copenhagen on a daily basis and Copenhagen has received an average
of 116 reports per month from MAERSK NGUJIMA-YIN since May 2008.
Maersk FPSO, Australia has direct access to SYNERGI.
According to the FPSO crew, the online reporting systems such as SYNERGI were not
operable upon start of production in June-July 2008. In lieu of an online reporting system a provisional hazard card system was adopted.
According to the FPSO crew SYNERGI cannot be edited by crew members and all
safety cards have to be typed in by the Operations Superintendent which, by crewmembers, has been regarded as a management barrier in order to avoid sensitive information to Maersk FPSO, Copenhagen.
The Operations Superintendent who was on board during the event has informed that
the Operations Superintendent normally types in the safety cards to the system in order
to maintain a uniform quality of the reports so that these can be used in daily safety
work.
According to the Operations Superintendent it is normal practice on other installations
that the safety cards are handed out to and typed in by duty specific groups having
expert knowledge on a certain areas.
According to the Operations Superintendent the person who types in the safety card,
does not have the duty specific competencies, which can result in reports of variable
quality.
The vessel came to Singapore in a poor mechanical state and left in the same
state if not worse due to the equipment installed.
The shear volume of corrective and break-down maintenance is a major safety
concern.
Due to the shear volume of corrective and break-down maintenance there is no
or very little time for planned maintenance.
The plant is suffering from poor commissioning causing a lot of work.
Maersk only does the bare requirement to meet the standard in order to get
things running.
The work force has lost confidence that MAERSK NGUJIMA-YIN is a safe
place to work.
Lots of operators have left because they dont have confidence in Maersk
management
Maintenance comes second and production first
Behavioural based safety is missing in Maersk
I am very disappointed about how Maersk handles safety
I am a little concerned about future safety in connection with the loss of experience on board
Maersk has failed to meet their duty of care
During the construction in Singapore Maersk Projects made the crew feel like
2nd class citizen
Management in Perth is not supporting management on board
There has been a Systemic failure in the conception of this project from design/commissioning/operations, that is ongoing today and, if anything, getting
worse because of the increased workload being placed on workers
The big problem I see is that this model is still being used and the next project
will have the same problems
During the project phase in Singapore the crew raised concerns in letters to management several times.
On a human resource general meeting on board in October 2008 crew concerns and
opinions were being presented to the management of Maersk FPSO, Australia by the
crew.
A memorandum of this meeting has been recorded in the vessel Safety Management
System.
A list of issues, made out by the crew and presented on the meeting, was published on
a white board in the mess.
The headlines were
The above mentioned issues were to a large extent reflected in the memorandum of
meeting of the HR meeting.
During the project phase in Singapore the crew raised concerns in letters to management several times.
According to Maersk FPSO, Copenhagen a climate survey with anonymous participation on board MAERSK NGUJIMA-YIN from October 2008 did not show significant deviations from climate surveys on board other entities.
that there has been a huge turnover in manning during the project. He believes that the
turnover in manning has decreased during the first quarter of 2009.
According to the Operations Superintendent the drainage of experience due to turnover
in manning has influenced negatively on his work onboard since the crew has been
concerned about this.
The Operations Superintendent informs that before the accident the crew did not feel
ownership towards the project.
According to the FPSO crew the Operational Superintendent has an approach to safety
that is a radical change in a positive direction and is very much appreciated among the
crew.
After the accident
The FPSO crew has expressed their contentment with the approach to leadership and
safety work of the Operations Superintendent, who was on board during the fire.
The Operations Superintendent has informed that after the accident, it has been the
crew that has the good arguments when it comes to normalizing the conditions on
board.
It is the opinion of the Operations Superintendent that the crew should be appreciated
and encouraged in their commitment towards safety and encouraged to take ownership
of the project.
The Operations Superintendent has informed that he and one of his colleagues has
been trying to create a working climate where ownership is the central element. Both
have good experience with this approach from previous projects.
The Operations Superintendent has observed that the working climate on board has
been improving compared to when he came onboard first time, which he believes is
caused by an increased feeling of ownership among the crew.
According to the FPSO crew Woodside requested an internal investigation in 3rd quarter of 2008 due to the high turnover in manning.
On a Human resource general meeting on board in October 2008 turnover in manning
was discussed between crew and management.
On 30th of January 2009 an ISM audit was conducted in the Maersk FPSO, Copenhagen office. 2 non conformities were noted and 7 recommendations were given.
Non conformities, Recommendations and conclusion from the audit report are presented in enclosure 7.6.
On 17th of March 2009 an ISM audit was conducted in the Maersk FPSO, Perth office.
3 non conformities were noted and 3 recommendations were given.
Non conformities, Recommendations and conclusion from the audit report are presented in enclosure 7.7.
On 18th of March a second ISM audit was conducted onboard. 5 non conformities were
noted and 3 recommendations were given.
Non conformities, recommendations and conclusion from the audit report are presented in enclosure 7.8.
The final approval of the Trim and Stability information, intact & damaged, and
the associated Longitudinal Strength calculations.
The final approval and testing of the on board computer for the calculation of
stability and longitudinal strength.
The final approval of the Trim and Stability information is currently nearing completion
and it is hoped that the approval process will be completed by 20th. June 2009. When
that approval is made LR will issue all the full status International Regulatory certificates on behalf of DMA.
The other 2 outstanding items, i.e. the approval of the on board computer and the approval of the Operations Manual are Class requirements and may possibly not be completed in time for the issue of a full term class certificate at the time of the expiry of the
current interim certificate.
However, when the approval of the Trim and Stability information is complete I shall
request the Lloyds Register Class Committee to consider granting a full term Class
Certificate with conditions specifying the dates for the completion of the outstanding
activities. If that request is successful I hope to be able to issue a full term Class Certificate before the expiry of the current interim certificate.
Another of the outstanding items to be closed out comprised of a list, "Anomaly Register-DRIMS-Doc No-4340896-v3_Safety_Critical_Equipment_Impairment_Listing" which
was not attached to the validation statement.
On 4th November 2009 The Division for Investigation of Maritime Accident has received
DRIMS-#Doc No-4340896-v3_Safety_Critical_Equipment_Impairment_Listing from
Lloyds Register.
6 Analysis
6.1 The cause of the explosion and fire
Maersk/Woodside has conducted a preliminary Root Cause Analysis:9
.
The primary reason for the HP compressor failure on April 13, 2009 has been identified
as a flow transmitter error.
The flow transmitter error consisted in an offset that was interpreted as a flow rate. As
a consequence the anti-surge system was led to believe that the compressor operated
at flow rates above the surge protection line, and the anti-surge valve was therefore
kept close. In reality, the HP compressor was operating with insufficient discharge
pressure to inject and a closed anti-surge valve (i.e., no flow through the discharge
nozzle) causing significant internal heat generation. This off-design operating condition
was maintained for about an hour without the protection system or operators realising
the problem. Eventually, the internal temperature rise of the compressor led to a full
catastrophic failure. The exact sequence of events in the last phase up to the gas release is not yet fully understood, but inspection suggests that gas release was possible
due to the simultaneous failure of all gas barriers (primary and secondary dry gas seal
stages as well as tertiary seals). This simultaneous failure was a consequence of the
DE bearing cap bolts being torn out of the bearing housing, allowing the shaft motion to
exceed all internal sealing clearances.
..
According to the Root Cause Analysis a review has confirmed that the compressor
control system is fully in line with the industry standard.
According to the Root Cause Analysis it is unknown how the above described failure
sequence could generate enough power to tear the seal bearing cap open.
Propagation fire:
The increased pressure in the nitrogen gas seal allowed the leaking process gas to
propagate back through the bearing lubricating oil system and further through a common lubrication oil drain tank and into the gas turbine enclosure. The leaking process
gas exploded within the lubrication oil tank and the enclosure which, among other
things, was indicated by the enclosure doors being forced open. Buckling of the plate
fields forming the enclosure was also observed.
The supply of process gas process was interrupted shortly after the emergency shut
down.
Lubrication oil from the drain tank was still available and thus fuelling the fire.
According to the FPSO crew there have been issues with compressor bearings and
alignments during the project before commissioning.
It can be established that there has been issues raised concerning bearings and alignments and loose bolts on the compressors. However, it is not known if these issues
have had any influence on the sequence of events.
9
The primary reason for the HP compressor failure on April 13, 2009 has been identified
as a flow transmitter error. After the failure the explosion and fire developed through
the torn seal bearing cap and through the lubricating oil system.
The vessel came to Singapore in a poor mechanical state and left in the same
state if not worse due to the equipment installed.
During the construction in Singapore Maersk Projects made the crew feel like
2nd class citizen
There has been a Systemic failure in the conception of this project from design/commissioning/operations, that is ongoing today and, if anything, getting
worse because of the increased workload being placed on workers
The big problem I see is that this model is still being used and the next project
will have the same problems
According to the FPSO crew, management was approached continuously during the
project.
On a Human resource general meeting on board in October 2008 crew concerns and
opinions related to project management in Thailand and Singapore were being presented to the Management of Maersk FPSO, Australia by the crew.
The FPSO crew has felt kept out of commissioning and has felt disrespected. Crew has
felt that they were not listened to be management and that their involvement was not
appreciated.
It is the assessment of the Division for Investigation of Marine Accident that the safety
climate on board during the project period in Thailand and Singapore has been poor.
During the investigation on board the deluge system for module M11 was tested. The
test showed that the deluge valve worked and could be remotely released, but it was
later found that several nozzles were blocked.
There have been difficulties with deluge valves on module M60 and M70 prior to the
accident.
According to the FPSO crew the old foam system was inspected after the accident.
The inspection found that the system would never have worked properly, as the in line
proportioner was fitted back to front, and 2 pneumatically operated valves supplying
foam to the system were fitted back to front, meaning when the valves were commanded to open to supply foam concentrate to the pumps, they were in fact shut.
The old foam system failed to work on demand during the fire due to defective nozzles.
The GRE piping might have been damaged by the initial explosion and
GRE has a very poor resistance to explosion/chock.
The GRE piping might have failed due to radiant heat from the fire after an unknown time.
Marine accident report
Page 42
According to IMO resolution A.753(18), appendix 2, a water filed pipe is to be fire endurance tested for 30 minutes. The internal pressure during the test is to be maintained
at 3 0.5 bar gauge.The resolution was adopted on the 4th of November 1993.The
testing scheme does not take pressure pulsations into account.
According to Lloyds register rules approval of GRE piping will in general be accepted in
Class III piping systems (I.e. working pressure 16 bars and working temperature
200C.)
Under was has been regarded a normal working condition the GRE piping in the new
ring fire main has been subjected to pressure pulses from start-up of diesel driven fire
pumps and from water hammer.
It is the assessment of the Division for Investigation of Marine Accidents that the IMO
resolution A.753(18), appendix 2 testing scheme does not correspond to or reflects the
actual working conditions of the GRE piping used on board in the new ring fire main
system.
GRE piping in two branch lines failed during the fire. The GRE piping has been subjected to radiant heat and flames during the fire and has repeatedly been subjected to
pressure pulsations arising from water hammer and start-up of diesel driven fire
pumps. Lloyds Register gave approval for GRE piping at L3 rating according to IMO
resolution A.753(18), appendix 2.
The Division for Investigation of Maritime Accident cannot establish weather the regulator has been left closed after the testing or it has been closed later or has been obstructed for other reasons.
The water mist system failed to work on demand during the fire because a nitrogen
regulator was either obstructed or closed.
Any extended period of time that the FWP is online, the dump valve is required to be
open to stop dead heading of the pump. There is a mark indicating the position. You
can also confirm the flow rate of 1600 m3/h at the FWPs
In the case where the DN 400 over board dump valve is open, the back pressure in the
new ring fire main will be substantially reduced and with any other system on line the
pressure would drop further.
If the over board dump valve for some reason would be left open it could compromise
or delay the functionality of the new ring fire main. With a DN400 line open it is likely
that sufficient pressure in the new ring fire main for deluge and foam operation could
not be maintained.
Continuous problems with the new ring fire main have been identified. The problems
have not been resolved.
6.2.8 Commissioning
According to the FPSO crew, they were not allowed to participate in performance tests
and were not granted access to full technical documentation of the plant.
According to Maersk FPSO, Copenhagen commissioning has been carried out by the
projects team, lead by Maersk FPSO, Copenhagen.
It is stated in the commissioning procedure that:
System performance shall be executed, according to separate procedures, by Operations as part of the "daily operation" of system with assistance from Project Commissioning as required.
.
Several systems deluge, water mist, the new foam system and the glycol contactor have been defective after commissioning.
It is the assessment of The Division for Investigation of Maritime Accident that the
commissioning has been inadequate and has not reflected the intention of the commissioning procedure, because the crews participation has been limited.
6.2.9 Maintenance
NOPSA found a maintenance backlog of over 2000 overdue safety critical items during
their investigation.
NOPSA found that maintenance work orders did not provide appropriate descriptions
and task actions.
According to Maersk FPSO, Copenhagen the maintenance backlog of SAP contained
pr. 24th April 2009:
497 outstanding items on planned safety critical maintenance.
55 outstanding items on corrective work orders on safety critical equipment.
According to the FPSO crew SAP contains many insufficient job descriptions, i.e. many
job descriptions are not complete but are external references such as as per manufacturers manual. SAP equipment number design is reported as bad, un-logical and nonuser friendly.
Maersk FPSOs Copenhagen has informed that it has looked into the SAP system and
is of the opinion that the tasks are divided too much into minor issues and that the descriptions are too detailed.
According to the FPSO crew, 270 technical requests (TQs) have been submitted since
the vessel left Singapore. Approximately 70 technical requests have been concluded.
The corrective work after commissioning has caused so much work that planned maintenance has been postponed or sparsely done.
According to the Operations Superintendent who was on board during the accident the
process through the change management system takes too long time.
Difficulties with the planned maintenance system SAP and corrective work originating
from commissioning has compromised planned maintenance. It is the assessment of
the Division for Investigation of Marine Accidents that maintenance planning on board
and maintenance support from shore management has been inadequate.
Room display screen available to the Operator only provides three lines of alarm detail.
The control room operators console is exposed to constant distraction with other activities ongoing at other work stations.
According to the Woodside/Maersk report:
Witness statement from control panel operator indicated that he must go through a
number of steps in order to view the Emergency Control Panel. This delays the initiating of the emergency systems. The current DCS emergency panel design should be
reviewed; consider the implementation of a separate and designated screen for fire
system operations.
Control system logs indicate a large volume of alarms prior to and during the incident..
According to the FPSO crew the number of blocks and overrides in the ICSS and deficiencies within the procedures has been of great concern.
According to the FPSO crew 4-6 blocks would normally give rise to concern on other
facilities.
It is the assessment of the Division for Investigation of Marine Accidents that the number of block and overrides in the ICSS has been to an extent where credibility of the
systems could be called into question.
According to the FPSO crew, the online reporting systems such as SYNERGI were not
operable upon start of production in June-July 2008. In lieu of an online reporting system a provisional hazard card system was adopted.
On a Human resource general meeting on board in October 2008 crew concerns and
opinions were being presented to the Management of Maersk FPSO, Australia by the
crew.
Several concerns were related to the conditions on board regarding.
The FPSO crew has been disillusioned with Maersk FPSO due to lack of managerial
commitment and support with respect to safety, maintenance, manning and confidentiality.
It is the assessment of the Division for Investigation of Marine Accident that the safety
climate onboard after production start-up has remained poor.
The management has not provided the means necessary to accommodate and
coordinate the interests of the project team and the operations team.
The management has acted inadequately on the feedback from the FPSO crew
during the project and has not been able to re-establish a healthy safety climate
on board.
The emergency response team identified 5 oil drums between the two compressor
modules and the stand by vessel identified pulsing smoke which originates from a running DC lubrication oil pumps.
From the location of fire was visually confirmed until the sources of the fire were identified 41 minutes passed.
The identification of the fire source and choice of fire fighting equipment was primarily
based on visual inspection by the crew and the stand by vessel.
From the general alarm sounded and until fire sources were identified 1 hour and 16
minutes passed. It is the assessment of the Division for Investigation of Marine Accident that the on board security system did not provide adequate barriers against loss of
instant overview.
Attempt to visually confirm water on deluge from Monkey Island. No confirmation possible.
1327:
Emergency response team establishes that deluge is not active on M60.
1334:
Deluge manually released on M60 by an emergency team member and water is
confirmed visually.
1343:
Emergency response team establishes that deluge is not active on M30.
1346:
Deluge manually released on M30 by an emergency team member and water is
confirmed visually.
Deluge on modules M30 and M60 was released manually by way of the local deluge
skids by a member of the emergency response team.
From deluge was activated on M60 until it is established that it is not active 36 minutes
passed
From deluge was activated on M30 until it is established that it is not active 52 minutes
passed
From it is established that deluge is not active on M60 until water is confirmed 7 minutes passed
From it is established that deluge is not active on M30 until water is confirmed 3 minutes passed
The automatic release of the deluge on modules M30 and M60 failed. Manual release
had to be carried out and approximately one hour passed from the fire started until water was confirmed. It is the assessment of the Division for Investigation of Marine Accident that the functionality of the deluge systems on M30 and M60 has been insufficient.
7 Enclosures
7.1 Excerpt from NOPSA improvement notice
Source: NOPSA: Prohibition Notice, Notice Number 0197
Date: 20.4.2009
Improvement Notice 1
The ABB Central Control Room (CCR) Alarms Management System record of initiated
alarms during the period 1st March 2009 to 16th April 2009 details daily alarm counts
from 192 up to 3605 per day with the majority in excess of 300 per day. The Control
Room display screen available to the Operator only provides three lines of alarm detail.
The control room operators console is exposed to constant distraction with other activities ongoing at other work stations.
Improvement Notice 2
During a fire emergency response situation on the 13th April 2009, the deluge system
did not function on demand.
Improvement Notice 3
During the course of an investigation on board the facility from the 14th - 17th April
2009, I observed, based on the SAP maintenance backlog report on 17th April, that
there was a maintenance backlog of over 2000 safety critical items. It was also observed that maintenance work orders in SAP do not provide appropriate descriptions
and task actions.
Improvement Notice 4
During the course of an investigation on board the facility from the 14th -17th April 2009,
I observed, that there was no evidence of a system in place to provide training and
competency for control room related safety critical activities. For example, a Control
Room Operator (CRO) has only received basic (generic system) training on the ABB
control system with no facility specific training. There is no evidence of a competency
based assessment system in place, which coupled with recent turnover of CROs has
resulted in the potential for knowledge gaps regarding the facility process control system
Improvement Notice 5
During the course of an investigation on board the facility from the 14th 17th April
2009, I observed the firewater GRP (glass-reinforced plastic) pipework failed in 2 locations on the HP gas compression module.
regulator 84-PCV-4071 was incorrectly set and that no nitrogen could pass this point.
To confirm the integrity of the rest of the system, the regulator was properly set and a
controlled manual discharge of the water mist was carried out. Correct operation of the
system, including nozzle discharge within the A enclosure, was confirmed.
M60 deluge: At the time of the incident, fire within module M60 was confirmed via activation of two flame detectors. The ICSS system functioned as per the cause and effects, and a signal was sent to the ICSS system to activate deluge in M60. A pressure
response was noted within the deluge pipe work a short time later. However, a member
of the fire team confirms that he manually activated the deluge system some time later.
Initial investigation of the associated cabling indicates that it has not been compromised by the fire. Further investigation is required to understand what occurred.
GRE (Glass Reinforced Epoxy) fire system piping which ran adjacent to the compressor packages, failed at the joint, dropping water over the enclosure (This proved to be
positive in the mitigation of this particular fire). This is thought to be due to radiant heat
exposure (testing will confirm) resulting in the loss of water to 2 hydrants which were
positioned above the fire floor (this was not detrimental to the mitigation of this fire). It is
recommended that a review be conducted to ensure that the GRE piping installed is in
accordance with the appropriate standard for use in fire fighting systems.
ERT witness statements describe that one of the fire hydrants on the main deck immediately forward of the HP gas compression process modules failed to deliver water, the
next monitor forward off the same ring main delivered at good pressure. Discussions
with personnel onboard indicate a previous problem with this design of hydrant, which
is the subject of a technical query.
ERT witness statements mention that the fire hoses that were laid out, were stored 3
ways;
Standard Roll As used by FESA/ERGT
Dutch Roll Universal Roll
Out of Service Roll Rolled from the male coupling, this is to show that there is a fault
with the hose.
All fire hose should be made up in the FESA/ERGT Standard Roll unless it is damaged, then it is to be rolled from the male coupling and an Out of Service tag placed
on the female BIC.
4. OBSERVATIONS AND ADDITIONAL ACTIONS
The ERT witness statements have suggested that the fire safety plans available in the
fire locker should be reviewed, and if required made available in a larger format. It is
recommended ERT members use this plan in conjunction with regular emergency drills
throughout the facility to ensure they become and remain familiar with fire equipment,
its location and operation.
There were 5 x 200 litre oil drums stored between the two compression trains. Without
portable foam extinguishing equipment it may have been difficult to extinguish an oil
fire. Ensure all flammable liquids are stored and segregated as per the Australian Dangerous Goods Code of Practice or the relevant NORSOK standard and the Off-Shore
Petroleum and Greenhouse Gas Storage Act 2006.
The Emergency Response Team members do not have Nomex flash hoods. These are
now considered basic fire-fighting PPE within industry and consideration should be
given to issuing these to each member.
The 2nd ERT were 1 member down due to the final member being required in the
ECR. Review current ERT manning levels to ensure that adequate ERT members are
trained and available in-line with the station bill.
ERT witness statements request that the current steel breathing apparatus cylinders be
replaced with the Aluminium/fibre wrap cylinders. Conducting this change would reduce
the weight of a breathing apparatus from 16Kg down to 11Kg. Consideration could be
given that any cylinders that are due for hydrostatic test could be removed from service
and replaced with Aluminium/Fibre wrapped cylinders on an on-going basis.
Witness statement from control panel operator indicated that he must go through a
number of steps in order to view the Emergency Control Panel. This delays the initiating of the emergency systems. The current DCS emergency panel design should be
reviewed; consider the implementation of a separate and designated screen for fire
system operations.
The control room operator on shift at the time of the incident had been on the facility for
seven months. He was employed as a production operator. He had recently transferred
to the panel and was half way through his third three week swing as a control room
operator.
At the time of the incident the control room operator who had just come off shift was
redeployed to the control room operator to manage the fire and gas panel whilst the
onshift operator focused on the process panel. The operator on shift at the time of the
incident described having the second more experienced panel operator available as a
god send. A review of the manning levels in the control room should be undertaken.
Control system logs indicate a large volume of alarms prior to and during the incident.
An alarm rationalisation program should be conducted to reduce the number of standing alarms and the frequency of alarms. First out alarming should be considered to
enable clarity to the panel operators during process upsets.
There is no Master Clock for the numerous instrument and control systems. This has
made it impossible to accurately create a true sequence of events when accessing
information from the various systems. A Master Clock system should be incorporated
to ensure all instrument and control system data is time stamped in true chronological
order.
.
10
1, 11
30-04-2009
The shipping company must submit proposals for corrective actions to the Lead
Auditor no later than on 30-04-2009
6. RECOMMENDATIONS
A key role, as identified by the ISM Code, in the effective implementation of a safety management system is that of the Designated Person. This is the person based ashore whose influence
and responsibilities should significantly affect the development and implementation of a safety
culture within the Company.
The designated person should verify and monitor all safety and pollution prevention activities in
the operation of each ship. This monitoring should include, at least, the following internal processes:
The DP was not present at this audit, due to other activities, but was substituted by one of two
sub- DP. Furthermore the job description and role as described in the Code and MO Circulars
are not fully implemented in the SMS. It is strongly recommended that the function and the
qualification requirements of the DP mirror the intention of the Code.
The auditors were presented to the Company's Participants Committee, minutes of meeting during the audit, and had hence no possibility to review the document in advance. The company
should, when needed, review and evaluate the effectiveness of the SMS in accordance with procedures established by the company.
Management reviews support companies efforts in achieving the general safety management
objectives as defined in section 1.2.2 of the ISM Code. Based upon the results of such reviews,
the company should implement measures to improve further the effectiveness of the system. The
review should be performed on a periodical basis or when needed, e.g., in case of serious system failures. Any deficiencies found during the management review should be provided with
appropriate corrective action taking into account the Company's objectives. The results of such
reviews should be brought to the attention of all personnel involved in a formal way.
From the minutes of meetings, the auditor can not conclude how effective the company believes
the SMS is. The management review should at least take into account the results of the internal
audits, any non-conformities reported by the personnel, the master's reviews, analysis of nonconformities, accidents and hazardous occurrences and any other evidence of possible failure of
the SMS, like non-conformities by external parties, PSC inspection reports, and other key performance indicators.
The Company has recently changed the brand name, and a bulk part of the documents still
carry the old name. However, the company are in the process of downsizing the documentation
and will within the next half year, have changed a larger portion of the SMS so meanwhile they
will keep the old name on the SMS. This decision has not reached the units/ships.
During the audit, it was expressed by one of the audited a "blind faith in the documentation. The
audit showed that two standards and one regulation were obsolete. The company has established procedures to control all documents and data, which are relevant to the SMS, but there
room for improvements. The company should ensure that valid documents are available at all
relevant locations, changes to documents are reviewed and approved by authorised personnel
and that obsolete documents are promptly removed.
The company should re-emphasise the master's responsibility and authority. The company
should ensure that the SMS operating on board the ship contains a clear statement emphasising
the master's authority. The company should establish in the SMS that the master has the overriding authority and the responsibility to make decisions with respect to safety and pollution
prevention and to request the company's assistance as may be necessary.
7. CONCLUSION
The entity that is responsible for the operation of the ship is other than the owner, the owner
must report the full name and details of such entity to the auditor.
To comply with the requirements of the ISM Code, the Company should develop, implement and
maintain a safety management system to ensure that the safety and environmental protection
policy of the Company is implemented. The Company policy should include the objectives defined by the ISM Code.
The ISM Code identifies general safety management objectives. These objectives are:
to provide for safe practices in ship operation and a safe working environment;
to establish safeguards against all identified risks; and
Marine accident report
Page 63
The audit showed that the company has developed high safety and environmental standards,
and that the company is more than capable of conducting their business in accordance with the
intent of the Code.
The company has more than one shore side premises, which was not visited at the initial
assessment, but these will be audited in conjunction with the assessment of the ships/units initial
audits, during the period of validity of the Document of Compliance.
A Document of Compliance was issued to the company, copies of which should be forwarded to
each shore side premises and each ship in the company's fleet.
The general theme of the audit was the companys knowledge of and the responsibility toward
the flag State,and knowledge of statutory requirements. The DMA conclude that the staff was
familiar with the companys SMS and that the system overall was understood and used effectively by them. However, due to the nature of the business, i.e. offshore oil exploration, the focus
on maritime activities has room for improvements, as concluded in the interim audit of the
Maersk Ngujima-Yin. During the interviews, a lot of questions were answered truthfully and
comprehensively to my satisfaction and showed good understanding of the SMS and the underlying regulations and requirements.
However, the whole set-up between the operator and the company is complex and somewhat
blurred, probably due to the situation where the involved parties have to take into account both
maritime laws and continental shelf laws. Here among, the ownership of safety cases, when a
strong client makes the whole situation even more complicated and confusing. The auditor believes that the responsibility of the operator and of the company can remain divided and shared
at the same time, if improved with more transparency and accountability. If the operator takes
care of procedures involving continental shelf law in the interface with tankers, and the exploitation of the oil, and allow the company to take responsibility of the procedures which involves
the ship itself, things should be much clearer. This is not new to the shipping business, it is actually quite common that charterers of a ship do direct the shipmasters regarding its commercial activities, but remains uninvolved regarding safety of the crew, ship, cargo and environment, and I believe it can be done in this situation too. Those particular requirements, that the
operator might have and the company not, can be regulated in the contract.
The general theme of the audit was the knowledge of the ships responsibility toward the flag
State, and
knowledge of statutory requirements. The DMA conclude that the officers was familiar with the
companys SMS and that the system overall was understood and used effectively by them. However, due to the nature of the business, i.e. offshore oil exploration, the focus on maritime
activities has room for improvements, which was also concluded in the interim audit of the
Maersk Ngujima-Yin. During the interviews, a lot of questions was answered truthfully and
comprehensively to my satisfaction and showed good understanding of the SMS and the underlying regulations and requirements.
Among other things, the following topics was covered
The standard and knowledge of the SMS on board is high. However, the auditor believes there
is room for improvements. Some of the findings, both NC and Observations, are somewhat beyond the responsibility of the company, but should be included the SMS.
During the audit one of the things that stroke me most was the procedure for discharging. The
last discharge was scrutinised and there where two versions of checklists in use, both of which
belongs to the operator.
None of the checklists had a revision number. The officer in charge could not answer to the
question why or what had been changed or when. Nothing in his hand over note revealed anything of the reason. When I asked him how he should find out what version was correct or the
reason for change, he was uncertain of whom to ask, the operator or the company. Furthermore, the officer had no discharge plan, no ship/shore safety checklist (ISGOTT) or had no
reference to the OCIMF Ship to Ship Transfer Guidelines. All of this due to the fact that the
operator has taken charge of this procedure and dont involve the ships officers in the procedures. It is my opinion, that international recognised standard and industry practises should be
utilised as much as possible, i.e., ISGOTT, and STS Transfer Guidelines and the ownership of
these ship procedures should belong to the company.