Translation from Norwegian
PETROLEUM SAFETY AUTHORITY
Investigation Report
Report
Report title
Report number
Investigation of serious personal injury on Valhall Flank North
(VFN)
2 April 2004
Classification
 Public
 Restricted
 Withheld from public access
 Confidential
 Strictly confidential
Involved parties
Parties that are to have the report
Executive officer
BPTalismanEniDeaDong
MAB, KMA, HHM
Participants in the audit team
Signatures of the audit team
Marit A Brattbakk, Henrik Meling, Kjell M. Auflem
2
1
INTRODUCTION ........................................................................................... 4
1.1
Petroleum Safety Authority’s follow-up of the accident ......................... 4
1.2
Orders given during the summing-up meeting on board VFN ................ 4
1.3
Man, technology and organisation analysis (MTO diagram) .................. 5
2
MAIN IMPRESSION ...................................................................................... 5
3
COURSE OF EVENTS ................................................................................... 6
3.1
Actual and potential consequences .......................................................... 8
4
INVESTIGATION OF THE ACCIDENT SITE AND REVIEW OF THE
DOCUMENTATION ...................................................................................... 8
4.1
Investigations on West Epsilon’s BOP deck ........................................... 8
4.2
Investigation of the SIMOPS crane ......................................................... 9
Limit switch for “hook up” (SX420) .......................................................................... 9
Anti-collision system ................................................................................................ 10
Windscreen wiper and washer out of order ............................................................. 11
4.2.1
4.2.2
4.2.3
5
DIRECT AND UNDERLYING CAUSES OF THE INCIDENT ................. 12
5.1
Direct causes .......................................................................................... 12
Parts of the crane’s safety system did not function ................................................. 12
Inadequate pre-use inspection of the lifting equipment ........................................... 12
Inadequate control of the jib’s position ................................................................... 12
Hatches in the “dropped object” deck on West Epsilon were not secured ............. 13
5.1.1
5.1.2
5.1.3
5.1.4
5.2
Underlying causes of the incident .......................................................... 13
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.2.10
5.2.11
5.2.12
5.2.13
5.2.14
5.2.15
5.2.16
5.2.17
5.2.18
5.2.19
5.2.20
5.2.21
5.2.22
5.3
5.3.1
6
Instructor with inadequate competence ................................................................... 13
Inadequate FMEA ................................................................................................... 14
Inadequate control during the Factory Acceptance Test (FAT) .............................. 14
Inadequate certification for use and approval of the SIMOPS crane ...................... 14
Inadequate control during commissioning .............................................................. 15
Faults during handover from project to operations, Ready for Operation Certificate
(RFOC) .................................................................................................................... 15
SIMOPS crane was in operation while the limit switch was out of order ............... 15
Certification for use is not available on the installation ......................................... 16
Missing/inadequate user documentation for the SIMOPS crane ............................. 16
Crane and site-specific training of crane operators was not adequate ................... 16
Inadequate control of requirements for crane-specific and site-specific training ... 17
Inadequate risk assessment for planning of repairs to safety systems ..................... 17
Inadequate control of non-conformance ................................................................. 17
Inadequate planning of work on safety systems ....................................................... 18
Work on safety systems without necessary technical documentation ...................... 18
Work on safety systems carried out by personnel without the required competence
................................................................................................................................. 19
Operators of the SIMOPS crane do not have access to the maintenance system
(WorkMate) ............................................................................................................. 19
Risk that the crane could reach the hatches on the BOP deck not evaluated in the
safe work review (SAG) ........................................................................................... 20
Inadequate routines for daily check of SIMOPS crane ........................................... 20
Poor visibility through the skylight.......................................................................... 20
Manning during the operation not in accordance with procedure .......................... 21
Inadequate securing of load .................................................................................... 21
Other observations ................................................................................. 21
Barriers that have functioned .................................................................................. 21
DISCUSSION OF UNCERTAINTIES ASSOCIATED WITH THE
INVESTIGATION ......................................................................................... 22
6.1
Time of the incorrect installation of the anti-collision system (limit
switch for “jib angle”) ............................................................................ 22
6.2
Time when the limit switch for “hook up” was damaged ...................... 22
6.3
Securing the load immediately after the incident .................................. 22
6.4
Distribution of tasks between the slinger and signaller ......................... 23
6.5
Uncertainty as to how the “dropped object” hatch hit VFN .................. 23
3
6.6
Securing the “dropped object” hatches on WE ...................................... 23
6.7
Ambiguities in the governing documentation ....................................... 23
7
ABBREVIATIONS ....................................................................................... 23
8
DOCUMENT SUMMARY ........................................................................... 23
9
PARTICIPANTS ........................................................................................... 25
10
MTO DIAGRAM....................................................................................... 25
4
1
INTRODUCTION
On 2 April 2004 a person was seriously injured on BP’s installation Valhall Flank North
(VFN). He was struck by a 357 kg hatch that fell down from West Epsilon (WE). The
hatch had been pushed loose by the SIMOPS crane on VFN.
1.1
Petroleum Safety Authority’s follow-up of the accident
The Petroleum Safety Authority (PSA) was notified by BP at approximately 7:18 a.m.
and the PSA decided to travel offshore to investigate the accident. The PSA was also
requested to provide assistance to the police.
The PSA travelled offshore to VFN together with the police at 2:45 p.m. that same day,
arriving at WE 5:30 p.m. The investigation committee returned to shore on 5 April 2004
at approximately 9:00 a.m.
The following persons participated from the PSA:
Marit Brattbakk, emergency preparedness discipline network (investigation
leader)
Kjell Marius Auflem, maintenance and drilling discipline networks
Henrik Melting, maintenance and crane and diving operations discipline networks
The following persons participated from the police:
Stein Ege, emergency response leader
Aslaug Høgemark, tactical investigator
Rolf Lyster, technical investigator
The PSA participated in the police’s interviews of witnesses during the on-site
investigation at VFN/WE. The PSA also participated in some of the police’s interviews of
personnel in the onshore organisations. In Section 9 you will find a list of the interviews
we participated in.
The documents used in connection with the investigation, which were received on board
the VFN/WE and onshore, are listed in Section 8.
BP, Schlumberger and Smedvig established their own investigation groups. A report on
this work was sent to the PSA on 25 May 2004.
We would like to thank all those involved who showed us great courtesy in connection
with the investigation.
1.2
Orders given during the summing-up meeting on board VFN
The following order was given orally on the VFN installation on 5 April 2004:
”BP is ordered to stop all operations with SIMOPS cranes on the Valhall field until the
following has been satisfied:
 The Petroleum Safety Authority (PSA) orders BP to inspect and update cranes
with respect to their certification for use.
Cf. Section 83 of the Activities Regulations, Lifting Operations.
 BP is ordered to establish requirements for the competence of personnel involved
in lifting operations and work on lifting equipment. In addition, it must be
verified that the personnel have the necessary competence.
Cf. Section 19 of the Activities Regulations, Competence with guidelines, Letter
e), Section 22, Procedures, and Section 83, Lifting Operations.
5

Furthermore, BP is ordered to examine corresponding lifting equipment on other
BP installations on the Norwegian Continental Shelf and to make sure that they
are operated in accordance with the regulations.
BP shall confirm that the order has been satisfied before the cranes can be put into
operation”.
The PSA confirmed the order in writing by a letter on the same day. In addition, a
deadline of 7 April 2004 was set for a reply on the status of the first item in the order
concerning the certification for use.
1.3
Man, technology and organisation analysis (MTO diagram)
An MTO diagram has been prepared to aid in analysing the accident. See Section 10.
2
MAIN IMPRESSION
Further investigation shows that the most important underlying causes of the accident are
multiple in number and complex in nature, but all of them are linked to a serious failure
of BP’s management system. These conditions were not identified during the
implementation of the project or during operations, and they include, for example, the
following:
 Inadequate control of the program for the implementation of FAT,
commissioning and certification for use. During the preparation and
implementation of the programs, changes were not handled properly.
 Lack of personnel with crane expertise and competence in BP in the onshore
organisation and on the installations.
 Inadequate control of non-conformance.
 Inadequate control of user documentation on the installation.
 BP operated the SIMOPS crane without identifying faults in the safety systems.
 Inadequate control of competence to operate the SIMOPS crane.
 Inadequate risk assessment in connection with the planning of repairs to the
safety systems.
These are described in more detail in Section 5.2.
The direct causes of the incident are:
 Important parts of the crane’s safety system were not operating.
 Inadequate pre-use inspection.
 Inadequate control of the jib’s position.
 Failure to secure the hatch in accordance with Smedvig’s procedure.
These are described in more detail in Section 5.1.
The investigation has revealed collective breaches of procedures. The PSA’s investigation
after the fatal accident on Gyda in November 2002 also pointed out serious and collective
breaches of procedures. This may indicate that the measures taken after the Gyda accident
have not yet been implemented on VFN. The scope and seriousness of the observations
after the investigation on VFN indicate that there is still potential for improvement with
respect to BP's HSE culture.
The investigation revealed extensive and serious failures in BP’s management and control
of lifting equipment and lifting operations on VFN. The lack of competent personnel
(expert organisation) in both the engineering and operating phases has contributed largely
to a failure to identity and implement compensatory and/or corrective measures.
6
3
COURSE OF EVENTS
Photo 1: The hatch design on the BOP deck on WE.
Photo 2: The position of the SIMOPS crane on VFN in relation to WE. The “dropped
object” hatch and the well hatch can be seen at the bottom left.
The description of the course of events is based on statements from witnesses and
technical investigations at the accident site. In the following we rely on a description that
we regard as the most probable based on an overall evaluation. In instances where
witnesses have different opinions of the course of events, or where there is uncertainty of
the course of events, then this is explained in Section 6 of the investigation report.
When the incident occurred, 2 April 2004 at 6:15 a.m., there was limited visibility
(daybreak) and strong winds (approximately 40 knots).
When the drilling installation WE was contracted for work on the Valhall Flank South
(VFS) wellhead platform in October 2002, BP demanded that Smedvig install a so-called
“dropped object” deck on the BOP deck. This was do to prevent objects, liquids and
drilling mud from the BOP deck and drilling area from falling down on the wellhead
platform below. The “dropped object” deck consists of three rows of hatches. The two
outermost rows consist of larger hatches that are not designed to move under normal
operations. The hatches in the middle are smaller (up to 357 kg) and are designed so that
they can be moved when the drill floor and the Blow Out Preventer (BOP) is moved
across the cantilever deck. The hatches are equipped with chains at each end so that they
can be secured to the beams they lie on. The design and production of the hatches and
beams was carried out by Bjørge Offshore in Stavanger. The installation was carried out
in Rotterdam. The purpose of the “dropped object” deck was to enable work to be
performed on two levels simultaneously. Drilling and work on WE could be carried out
simultaneously as work was carried out on the installation below.
WE was moved to VFN and started drilling in August 2003. The consent application to
use VFN is dated 22 May 2003 and consent for use was granted on 14 July 2003. In
addition to a large offshore crane, a 20-tonne fixed hydraulic telescopic crane has also
been installed. This is called a Simultaneous Operations (SIMOPS) crane. This crane is
not specifically mentioned in the consent application. The crane is designed primarily for
use during work on the wells. The SIMOPS crane is placed on tracks so that it can be
moved. With the help of the offshore crane, the SIMOPS crane can also be lifted and
moved over to the other tracks on the opposite side of the deck.
Personnel from Schlumberger were working on the preparation of coiled tubing
operations on VFN. However, the work was stopped due to a fault in the equipment, and
the Schlumberger personnel were therefore available for other work. ABB was working
with high-pressure testing of the wellhead Christmas tree at well N14 at the same time.
After ABB was finished with the high-pressure testing, they needed to use the SIMOPS
crane on the deck above to remove two plugs in the production tubing directly below the
Christmas tree. BP’s Well Intervention Supervisor (WIS) asked Schlumberger to help
ABB with this work. Schlumberger’s personnel demanded that a SAG (Safe Work
Review) be performed, even though this was presented as an ordinary and routine job.
The use of a SAG was regarded as satisfactory in this case by the parties involved.
Photo 3: Skylight window in the crane operator cabin on the SIMOPS crane.
Photo 4: Extracting tool and plug that was laid on the weather deck.
The safe work review (SAG) meeting focused on control of the lifting equipment,
cordoning off the areas (on the weather deck and wellhead deck), fall safety equipment
7
(harness), danger of crushing injuries and the delegation of tasks. The risk of falling
objects from the weather deck to the wellhead Christmas tree deck on VFN was focused
on. The work permit was subsequently filled out and approved.
The slinger secured a lifting sling to the well hatch, and it was prepared for lifting by the
SIMOPS crane. The crane operator reported that he had poor visibility through the
windows in the cabin. The windows were clouded by drilling fluid. The window wipers
on the skylight window and the window washers were not operational. The signaller
fetched a high-pressure hose and cleaned the front windows of the crane cabin.
The skylight window was not cleaned. The reason for this was the fact that they wanted to
avoid elevated work. Hosing down the front windows was considered to be sufficient.
During this part of the operation both the signaller and slinger were located on the
weather deck.
After this the slinger went down to the wellhead Christmas tree deck to ensure that
ABB’s personnel were not inside the cordoned off area. He was in radio communication
with the crane operator and signaller. The well hatch was then lifted off and they placed it
over the hatch cover of well N2. Two plugs in the wellhead Christmas tree were lifted out
with the crane by means of a special tool. The last plug was lifted, together with the tool,
up through the hole and laid down on the weather deck. ABB's personnel secured the
wellhead Christmas tree on the wellhead deck. Then the personnel went outside the
cordoned off areas and the slinger instructed, via radio, that the well hatch could be lifted
back in place. When the incident occurred, the crane operator and signaller were in the
process of putting the well hatch back in place on the weather deck. The person who was
designated as the slinger in accordance with the safe work review (SAG) meeting was
still located on the deck below to ensure that no one was in the vicinity of the lifting
operation and that this area was cordoned off. The signaller remained behind on the
weather deck to help the crane operator to steer the well hatch in place. Guide ropes were
secured to the hatch. He also “bumps” the well hatch in order to position it right over the
opening.
To lift and centre the hatch over the opening, the crane operator extended the telescope on
the crane. The tip of the crane was then driven up into one of the “dropped object”
hatches on WE, so that the hatch was pushed out of its position and fell down
approximately 15 m. During its fall, the hatch struck the signaller in the face and right
foot. In addition, it struck the corner of the well hatch that was suspended by the crane.
The crane operator stopped the crane and went out to help the injured signaller.
Schlumberger’s supervisor and the WIS from BP, who had observed the lifting operation
and the incident at a distance, were among the first ones to arrive at the injured signaller’s
side.
The slinger who was located on the deck below heard a crash and was notified over the
radio by the crane operator that there had been an accident. The slinger ran up to the
weather deck. Here he saw that the others were taking care of the injured signaller. He
also saw that the load (well hatch) was swinging “violently”, most likely after being
struck by the “dropped object” hatch. He felt that the load was a potential danger to the
people located on deck, and since no one was inside the crane cabin, he climbed in to
lower and secure the load (well hatch). The well hatch was lowered down since the tip of
the crane still protruded through the BOP deck on WE.
The “dropped object” hatch lay over the signaller’s foot, so that the assisting personnel
had to move the hatch to free the injured signaller.
The emergency response and notification on board and onshore functioned satisfactory.
First aid was administered by those who arrived first and by a nurse from WE. A search
8
and rescue (SAR) helicopter was requisitioned from the Ekofisk field centre and the
injured signaller was sent from the helideck on VFN to Rogaland Central Hospital.
Notification to authorities was in accordance with the time limits stipulated in the
regulations.
3.1
Actual and potential consequences
The incident resulted in serious injuries to the signaller. The results could have been fatal
if the “dropped object” hatch’s trajectory or the position of the signaller had been just a
few centimetres different. The PSA therefore assumes that small changes in the course of
events could have resulted in a fatality. At the time of the incident there was only one
signaller in the area. If the slinger had also been in the area, the result could have been
multiple personal injuries or fatalities. There was also a potential for greater material
damage if the hatch had fallen further down through the well hatch opening and damaged
the wellhead Christmas tree on the deck below.
4
INVESTIGATION OF THE ACCIDENT SITE AND
REVIEW OF THE DOCUMENTATION
This part of the investigation is based on an examination of the accident site, equipment
involved, available documentation on VFN, as well as documentation and information
obtained later on.
When the investigation team arrived at the accident site, the equipment that was involved
had been secured and the area was cordoned off. It was reported that the hatch that fell
down on the deck on VFN had been moved slightly in order to free the injured signaller.
Furthermore, the well hatch that hung from the SIMOPS crane had been laid down on the
deck. On WE two of the hatches in the “dropped object” deck were secured to a two-part
chain sling that was suspended from the structure. This had been done after the incident to
protect these hatches from being pushed out of place by the jib that protruded through the
opening.
4.1
Investigations on West Epsilon’s BOP deck
Photo 5: Shows how the tip of the crane protrudes through the “dropped object” deck on
WE.
On the BOP deck on board WE, the tip of the jib protruded approximately 35 cm up
through the opening of the “dropped object” deck. This deck is installed around the BOP
and consists of hatches that can be moved as required (see the introduction to the
description of the course of events above). The hatches were equipped with chains at each
end so they could be secured to the steel beams they lay on. The chains on the remaining
hatches were not secured to the beams. The investigation of the mounting points on the
beam and chains on the hatch that fell down showed no damage that would indicate that it
had been secured to the beam.
Photo 6: The “dropped object” hatch that fell down on VFN.
Photo 7: Shows the damage to the well hatch.
Photo 8: Shows the tip of the jib and the position of the limit switch and the release
arrangement. This hangs down alongside the lifting wire.
Photo 9: Limit switch for “hook up” identical to the one mounted on the crane.
9
The “dropped object” hatches are made of a framework of steel beams with a steel plate
that is welded on. The hatch that fell down on VFN lay with the bottom up and there were
clear signs where the tip of the jib struck it. The damage indicates that the tip of the jib
first struck approximately the centre of the hatch. The jib slid subsequently along the edge
of the hatch and into the corner of the framework. From this position the crane has then
lifted and pushed the hatch out of position on the other side. As a result of this the hatch
could fall through the opening and down onto the deck on VFN.
In addition to the injured signaller, the hatch that fell struck a corner of the well hatch that
was suspended by the crane. The corner of this was bent downwards.
4.2
Investigation of the SIMOPS crane
The investigation group did not test the crane’s functions and safety systems themselves
after the incident. The group’s conclusions in this report are based on statements from
witnesses, conversations with personnel offshore, documentation obtained on the
installation, technical specifications and user instructions received from the crane
supplier, as well as reports from investigations of the crane after the incident occurred by
technical personnel from the supplier of the crane. The SIMOPS crane is a hydraulic
telescopic crane with a maximum working load limit of 20 tonnes. The crane was
manufactured by National Oilwell (Natoil) in Molde (previously AS Stålprodukter, Aktro
and Hydralift) and delivered to the VFN project while it was being built in Tønsberg.
Heerema was BP’s principal contractor. The crane was certified by Allum Marine AS in
May 2003 at the request of Heerema. This was done while the VFN installation was at the
construction site in Tønsberg.
The supplier delivered the crane with several safety systems to prevent overloading the
crane and the equipment on the crane, including a limit switch for “hook up”. In addition,
an anti-collision system was subsequently ordered (12 December 2002) to ensure that the
crane does not hit parts of the drilling rig above it, in this case WE. The installation of this
system was performed as part of the delivery for VFN, while it was retrofitted on VFN in
October 2003. During the investigation group’s stay on board VFN, it was not possible to
obtain adequate documentation that could show the function and placement of the safety
systems.
4.2.1
Limit switch for “hook up” (SX420)
Photo 10: Shows the broken release wire and the arm that was connected to the limit
switch.
Photo 11: Shows the position of the limit switch for “hook up”.
Photo 12: Shows the hook block and framework that was made as a replacement for
frame originally mounted.
The shaft on the switch was broken off. The release wire, release arm and the mounting
clip around the shaft hung down along the lifting wire.
This limit switch is supposed to function so that it stops the lifting winch when the
hook/hook block reaches the top of the telescopic section of the jib. According to the
document Functional Design Specification, Crane, this shall also stop the “telescope out”
function. However, this function is not described in the FMEA analysis that is enclosed
with the technical documentation that the PSA has subsequently received from the
supplier.
According to historical data in WorkMate, the available reports and statements by
personnel on VFN, the limit switch has been out of order on several occasions.
10




E-mail dated 19 January 2004 from BP to Natoil: “The final stop for lifting does
not work”.
Natoil was on board on 19 February 2004 and discovered a fault in the limit
switch. According to this report, the fault was not repaired because they lacked a
component.
On 26 February 2004 WorkMate reported that the limit switch had been replaced
by personnel from the Valhall field centre.
During the investigation it was observed that the limit switch for “hook up” was
broken since the shaft that the release mechanism was secured to was broken off.
Information from personnel on board indicates that the switch may have been broken
before the incident occurred. The limit switch is supposed to be secured, via an arm and
wire, to a weight that hangs around the lifting wire on the crane. When the hook block
lifts this weight, the limit switch is supposed to deactivate a valve that prevents any
further lifting. According to information the investigation committee obtained on VFN,
the hook block was designed in such a manner that the weight could easily get stuck and
follow the hook when it was lowered. It was claimed that this was the reason that the wire
for the limit switch had broken off on several occasions. The design illustrated in Photo
12 is a replacement for the original “stop bracket” that was welded onto the hook block
by the supplier.
Furthermore, Smedvig’s incident report (synergi report) dated 17 December 2003 reports
the following: When disconnecting the joystick on the SIMOPS crane, it was observed
that the lifting function still worked. This must be fixed by a crane mechanic.” The fault
has not been entered as an outstanding repair in WorkMate. No work orders or reports
that describe the repair of this fault have been found.
4.2.2
Anti-collision system
According to the “Functional Design Specification, Crane” document, dated 25 April
2003, an “anti-collision system” was installed on the crane. Section 6.4.5 of the document
briefly describes what the crane functions this system has an impact on. However, on
board VFN there was no other technical documentation available that showed the
placement of the equipment or how the system worked. The investigation group has
subsequently received the technical information and held a meeting with the crane
supplier to clarify in detail how the system is mounted and how it is supposed to work.
Photo 13: Shows the position of the limit switch for the jib angle.
Photo 14: Shows the transmitter for measuring the length of the telescopic deflection.
The system consists of a limit switch that is located at the bottom edge of the jib and
measures the jib angle. In addition, a transmitter is installed that measures the length of
the telescopic deflection. The system is set so that the jib cannot go above a preset angle
without the telescopic part being within a preset length. The purpose of the anti-collision
system is to prevent the crane from being driven into the drilling installation situated
above.
When the safety system is intact, it should not be possible to extend the telescope with the
angle the jib had when the incident occurred. This indicates that the anti-collision system
did not function.
From the documentation obtained and after conversations with the crane supplier, the
following historical facts were revealed:

The anti-collision system was ordered in December 2002.
11














The FAT (Factory Acceptance Test) was carried out on 10 April 2003. It did not
encompass checking out the anti-collision system.
The “Functional Design Specification, Crane” document, dated 25 April 2003
has a brief description of the anti-collision system.
Heerema contracted Allum Marine AS in May 2003 to certify the crane
(Certificate of application, dated May 2002). The certification was carried out in
accordance with the requirements of the Norwegian Maritime Directorate’s
regulations of 1987. Load test.
Handover from project to operations; RFO (Ready for Operation) form was
issued on 6 August 2003.
Excerpt from the punch list after commissioning for the SIMOPS crane
(Document no. PL HT 01839): Service engineer from Hydralift (Natoil) travelled
offshore on 14 August 2003 and worked to repair the window washing system on
the SIMOPS crane. He happened to get caught on the proximity switch (limit
switch for the “jib angle”) then and damaged it.
A new limit switch for the “jib angle” was installed and sealed 10 September
2003 by a Natoil service engineer
On 1 January 2004 it is reported that the “telescope is out of order” in the daily
inspection list.
In the maintenance system (KAO-032703) it is reported on 4 January 2004 that
the wire for the limit switch on the telescope is broken and that the wire and
possibly the limit switch must be replaced.
In Bjørge Offshore’s service report dated 1 February 2004, it is reported that the
limit switch barrel on the telescope is defective and that this will be sent back to
the supplier.
On 11 February 2004 it is registered in the maintenance system (KAO-032703)
that Natoil will come out on 17 February 2004.
Personnel from Natoil installed a new transmitter for measuring the length of the
telescope deflection and adjusted this. The limit switch for the jib angle is
defective and must be replaced. The report was dated 19 February 2004.
Work order (KAO-033708) for replacement of the limit switch for the jib angle
was issued on 21 February 2004.
The limit switch for the jib angle was replaced on 27 February by personnel from
the Valhall field centre.
Personnel from Natoil arrived at VFN on 4 April 2004. Investigations after the
incident showed that the limit switch for the jib angle was installed incorrectly.
The wires for plus and minus were switched and the switch had not been set
correctly.
It has not been documented that the safety systems on the crane, including the anticollision system, have been tested, performance tested and certified for use (certification
for use by a competence person or expert organisation).
4.2.3
Windscreen wiper and washer out of order
Photo 15: Shows the skylight window in the crane cabin and the lack of visibility through
it.
The visibility through the skylight window was very poor. According to information from
the crane operator, the window wiper and window washer for the skylight window in the
crane cabin did not work.
The window wiper and washer system had been out of order on several occasions. This
was repaired on 14 July 2003 according to the punch list received. It was also, according
to information from BP, repaired again by personnel from Natoil on 14 August 2003. In
an e-mail to Natoil on 19 January 2004, it was reported that the “window washer motor
12
does not work”. A work order was issued on 20 February 2004 (KAO-033686) for the
SIMOPS crane with the text “window washer motor does not work”, the start-up time for
the work was not entered. The work order was given the status: “for offshore
preparation.”
In the daily inspection form for the SIMOPS crane, a fault was reported for the “window
washing” and “top window wipers” on 29 and 31 March 2004, and for the “window
washer” on 28, 29 and 30 November 2003, as well as 1 and 2 December 2003. The faults
reported in the daily inspection form are not registered in the maintenance system.
5
DIRECT AND UNDERLYING CAUSES OF THE
INCIDENT
5.1
Direct causes
5.1.1
Parts of the crane’s safety system did not function
Non-conformance:
The SIMOPS crane was operated when the safety system was out of order. The status of
the safety system was not known when the incident occurred.
Evidence:
The tip of the crane collided with the hatches on WE’s BOP deck and resulted in one of
the hatches falling down. One of the causes of the collision was the fact that the anticollision system was not working. This was because the limit switch for the “jib angle”
was incorrectly connected and installed. The system was therefore out of order and the
crane had no actual limits for its lifting height with respect to the jib and telescopic
movements.
Requirements:
The Activities Regulations, Section 24, Safety systems.
The Activities Regulations, Section 83, Lifting operations, cf. NORSOK R-003 N, Section
5.5.6, Safe operation of lifting equipment.
5.1.2
Inadequate pre-use inspection of the lifting equipment
Non-conformance:
The crane operator had not carried out the necessary pre-use inspection to ensure that the
crane was in proper technical condition prior to use.
Evidence:
The pre-use inspection carried out on the SIMOPS crane did not include testing of the
safety systems. The crane had safety-related defects. The anti-collision system did not
work, the window wiper did not work, and there was not enough visibility in the crane’s
work area. The user documentation was inadequate. The lifting equipment was used even
though the safety systems were out of order.
Requirements:
The Activities Regulations, Section 83, Lifting operations, cf. NORSOK R-003 N, Section
5.5.6, Safe operation of lifting equipment.
The Activities Regulations, Section 19, Competence, cf. NORSOK R-003 N, Section
4.5.2.1.
5.1.3
Inadequate control of the jib’s position
Non-conformance:
13
The crane operator did not implement measures to ensure control of the jib and to avoid
collision with WE.
Evidence:
The crane operator did not have an adequate overview of the work area and did not
implement measures to prevent collision with WE. During the lifting operation the crane
operator had to lean forward to be able to see better. In order to reach well N14 he
chooses to extend the telescope and the jib is thus driven up into the deck of WE.
Requirements:
The Activities Regulations, Section 19, Competence, cf. NORSOK R-003 N, Section
4.5.2.1 and 4.1.h), BP’s HSE Directive 26, Section 6.7.
5.1.4
Hatches in the “dropped object” deck on West Epsilon were not secured
Non-conformance:
The “dropped object” hatches were not secured in accordance with procedure.
Evidence:
The procedure states that the hatches shall be secured. The hatches were not secured to
the beams they rested on with the proper chains and shackles. According to statements
from witnesses, Smedvig has been asked several times whether the “dropped object”
hatches could fall down. This has been denied. It has not been possible to document this
in minutes of safety meetings or otherwise.
Requirements:
The Activities Regulations, Section 22, Procedures.
Procedure WE-02-06-05, 14 inclusive, Installation and Maintenance Instructions, PBO8250081-P-04.
5.2
Underlying causes of the incident
The investigation team has revealed several weaknesses in BP’s management of the
project (VFN). In connection with exercising the option in the contract for the delivery of
an SIMOPS crane to VFN (including the anti-collision system), BP has failed to ensure
that this has been taken into account during construction, testing, completion, start-up and
operations. Defects in the crane documentation, testing and training have been identified.
It has not been documented that the reported faults and defects in the SIMOPS crane have
been subjected to formal non-conformance procedures.
The investigation group cannot see that these conditions have been evaluated by crane
experts in BP.
Barrier breaches were also been identified in connection with the planning and execution
of the lifting operation.
5.2.1
Instructor with inadequate competence
Non-conformance:
The instructor has not received the necessary training in the crane’s safety systems.
Evidence:
In August 2002 Natoil provided several people with site-specific and crane-specific
training for the SIMOPS crane. These persons include a Smedvig employee from
WE/VFS. This training was provided before the anti-collision system was installed on
this SIMOPS crane. Smedvig prepared subsequently a form for the approval of crane
operators for the SIMOPS crane. The crane training was continued by having crane
14
operators who had received training earlier (and were thus “cleared”) act as instructors
for new crane operators.
This training continued after WE was transferred to VFN. In a conversation with one of
the employees who had acted as an instructor, it was revealed that he had not been given
any crane-specific or site-specific training beyond being “cleared” as a crane operator. He
did not know how the safety systems on the SIMOPS crane functioned, and he had not
heard anything about the anti-collision system that had been installed. It was stated in this
connection that it was an established practice for persons who were “cleared” as a crane
operator to act as instructors and train new crane operators.
Requirements:
The Activities Regulations, Section 19, Competence.
HSE Directive 26, Section 6.11.4.
5.2.2
Inadequate FMEA
Non-conformance:
The effect of the failure modes for the crane’s safety system is inadequately described in
the Failure Mode and Effect Analysis (FMEA).
Evidence:
The FMEA was completed on 23 January 2003. The effect of the failure modes on the
anti-collision system has not been evaluated in the FMEA for VFN. The two analyses for
VFN and VFS are identical. This indicates that the analysis of VFS has been copied
before the anti-collision system was retrofitted there. The effect of the failure modes on
the limit switch for “hook up” is not described either in the FMEA in relation to
extending the telescope.
Requirements:
The Management Regulations, Section 13, General requirements for analyses, and the
Activities Regulations, Section 43, Classification. The Machine Regulations, Section 7, cf.
Appendix 1.
5.2.3
Inadequate control during the Factory Acceptance Test (FAT)
Non-conformance:
The anti-collision system is not included in the FAT.
Evidence:
The FAT was completed on 10 April 2003. The FAT did not encompass checking out the
anti-collision system. It is uncertain whether all parts of the limit switch function for
“hook up” have been tested. See Section 6.2.
Requirements:
The Activities Regulations, Section 14, Installation and commissioning, cf. the Machine
Regulations, Section 7, Appendix 1, Section 4.2.4, Inspection prior to use.
5.2.4
Inadequate certification for use and approval of the SIMOPS crane
Non-conformance:
The “certification for use” does not meet the requirements stipulated in the Petroleum
Regulations with respect to certification for use before first-time operation. Inadequate
correspondence between operating documentation and the SIMOPS crane’s equipment
(anti-collision system) was not identified and pointed out by BP’s expert organisation
before the crane was put into operation offshore. In addition, the expert organisation has
15
not made sure that all the necessary operating documentation has been made available on
the installation.
Evidence:
Allum Marine AS certified the SIMOPS crane during the project phase (May 2003) based
on the Norwegian Maritime Directorate’s regulations. The certificate for completion of
the load test is based on maritime regulations and does not document any testing of the
crane’s safety system. In connection with the start-up, BP did not provide the necessary
competence to ensure that the equipment was put into use in a proper manner with respect
to safety.
Requirements:
The Activities Regulations, Section 40, Use of work equipment, cf. Regulations relating to
the Use of Work Equipment, Section 14, Inspection of work equipment.
The Activities Regulations, Section 44, Maintenance program, Letter f), cf. NORSOK R003 N, Section 6.1.
BP’s Lifting Equipment Manual, Document no. 1.70.010, Section 8.5.3.
BP’s HSE Directive 26, Section 6.3.
5.2.5
Inadequate control during commissioning
Non-conformance:
Inadequate correspondence between the SIMOPS crane’s equipment (anti-collision
system) and the enclosed documentation was not discovered.
Evidence:
Commissioning of the SIMOPS crane was completed on around 7 July 2003. The anticollision system was not mentioned or described in the procedures for commissioning.
Requirements:
The Activities Regulations, Section 14, Installation and commissioning.
The Machine Regulations, Section 7, Appendix 1, Section 4.2.4, Inspection prior to use.
5.2.6
Faults during handover from project to operations, Ready for Operation Certificate
(RFOC)
Improvement potential:
BP did not check the contents of the operating manuals and based its certification on a
statement from the project. Inadequate correspondence between the crane’s equipment
and user documentation was not identified.
Evidence:
The RFOC document was issued on 6 August 2003. This shall provide a summary of any
outstanding work on the SIMOPS crane (punch list). Documentation for maintenance and
operation of the SIMOPS crane shall be part of the handover documentation and available
to the users. The RFO certificate’s checklist states: “Operational Manual available in
Dokumentum”, in other words, the operating manual shall be available in an electronic
database. In this phase, correspondence between the SIMOPS crane’s equipment and the
enclosed documentation was not checked.
Requirements:
The Activities Regulations, Section 14, Installation and commissioning.
The Machine Regulations, Section 7, Appendix 1, Section 4.2.4, Inspection prior to use.
The Activities Regulations, Section 18, Start-up of facilities.
5.2.7
SIMOPS crane was in operation while the limit switch was out of order
16
Non-conformance:
The crane was operated while the safety systems were out of order.
Evidence:
The crane was in daily operation from 1 to 10 September 2003, cf. form for daily
inspection of the SIMOPS crane on VFN. We also know based on Natoil's report and
information from BP that the limit switch for “jib up” was damaged during the repair of
the window washing system on 14 August 2003. The switch was repaired on 9 October
2003. Thus it has been documented that the crane was operated at the same time as the
safety system was out of order. The investigation group could not find any documentation
that the safety function was tested before operation here either.
Requirements:
Regulations relating to the Use of Work Equipment, Section 15, Letter c), Work
equipment that may pose a special risk when used.
The Activities Regulations, Section 28, Actions during conduct of activities, cf. NORSOK
R-003 N, Section 6.1.
The Activities Regulations, Section 83, Lifting operations, cf. NORSOK R-003 N, Section
5.5.6.
5.2.8
Certification for use is not available on the installation
Non-conformance:
Certification for use was not available on the installation
Evidence:
The installation did not have documentation for the SIMOPS crane on VFN that an expert
organisation had accepted the use of the crane.
Requirements:
The Activities Regulations, Section 14, Installation and commissioning, cf. NORSOK R003 N, Section 5.1.1.2.
BP’s Lifting Equipment Manual, Section 8.3, Offshore archives.
5.2.9
Missing/inadequate user documentation for the SIMOPS crane
Non-conformance:
The user documentation was not available or made known to the operating personnel,
including the management on VFN.
Evidence:
Adequate user documentation for the operation and maintenance of the crane, including
pre-use inspection procedures, was not available on board the installation.. Drawings and
descriptions of the safety systems were not available to operators of the crane
(Schlumberger personnel), or to personnel who were to carry out repairs on the crane.
Requirements:
The Activities Regulations, Section 18, Start-up of facilities.
The Activities Regulations, Section 14, Installation and commissioning, cf. NORSOK R003 N, Section 5.1.2.1.
The Activities Regulations, Section 83, Lifting operations, cf. NORSOK R-003 N, Section
4.1 f).
Lifting Equipment Manual, Section 8.3, Offshore archives.
5.2.10
Crane and site-specific training of crane operators was not adequate
Non-conformance:
17
Crane-specific and site-specific training has been inadequate, and it has, for example, not
included any control of the safety functions and risk elements associated with on-site
operation of the crane.
Evidence:
Training for the SIMOPS crane on VFS was carried out before the installation of the anticollision system in October/November 2003. These crane operators have subsequently
acted as instructors for operators of the SIMOPS crane on VFN. Due to inadequate
training on the anti-collision systems, the SIMOPS crane operators have not had adequate
knowledge to operate the crane in a proper manner with respect to safety. The training is
documented in the Smedvig document: “Familiarity training for the SIMOPS telescopic
boom crane 20h”. Documentation for completed training did not include the control of
safety functions.
Requirements:
The Activities Regulations, Section 19, Competence, cf. NORSOK R-003 N, Section 4.5.1,
Training of operators.
The Activities Regulations, Section 40, Use of work equipment, cf. Regulations relating to
the Use of Work Equipment, Section 10, Training, drilling and instruction of employees.
5.2.11
Inadequate control of requirements for crane-specific and site-specific training
Non-conformance:
BP had not uncovered the inadequate crane-specific and site-specific competence of the
personnel operating the SIMOPS crane on VFN.
Evidence:
The system to ensure, stipulate requirements for, verify and maintain competence that
could have revealed the inadequate knowledge of the anti-collision system on the crane
has been inadequate. The training material appears to be a copy of the material for the
system on VFS before the anti-collision system was installed there.
Requirements:
The Activities Regulations, Section 19, Competence, cf. NORSOK R-003 N, Section 4.5.1,
Training of operators.
5.2.12
Inadequate risk assessment for planning of repairs to safety systems
Improvement potential:
When planning repairs on safety systems the consequences of incorrect installation have
been underestimated.
Evidence:
A work order for the limit switch for “telescope out” was entered in the maintenance
system on 21 February 2004. The performance of this work was scheduled for 4 January
2004, and it was classified as Category C “non-critical”. An inadequate criticality
assessment can also be detected in statements and reports. These show that there have
been several instances where repairs and adjustments have been performed on the crane’s
safety systems without being documented in the maintenance system.
Requirements:
The Activities Regulations, Section 43, Classification, and Section 45, Planning and
priorities.
5.2.13
Inadequate control of non-conformance
Non-conformance:
18
Defects in the user documentation for the SIMOPS crane have been reported without
being subjected to any formal procedures.
Evidence:
Natoil’s report dated 19 February 2004 states that documentation for the electrical and
hydraulic systems were not available on the installation. This was also registered (but not
reported) by an automation technician from Valhall and a crane operator.
Requirements:
The Management Regulations, Section 20, Handling of non-conformities.
5.2.14
Inadequate planning of work on safety systems
Non-conformance:
The use of an expert organisation for control and approval for use after the safety systems
were repaired was not planned.
Evidence:
When the work orders to replace the limit switch for “hook up” and “jib angle” were
created, the following was entered in the maintenance system: “Function shall be tested
after installation and connection”. The work order stipulates a requirement for testing, but
it does not stipulate any requirements for the performance of the testing. In addition, it
does not stipulate any requirement for the use of an expert organisation. Several faults in
the SIMOPS crane that are documented in e-mails and daily inspection forms cannot be
traced in the maintenance system.
Requirements:
The Activities Regulations, Section 44, Maintenance program, Section f), cf. NORSOK R003 N, Section 6, Inspection, investigation and testing, Section 6.1.
The Activities Regulations, Section 43, Classification, and Section 45, Planning and
priorities.
The Activities Regulations, Section 40, Use of work equipment, cf. Regulations relating to
the Use of Work Equipment, Section 14, Inspection of work equipment.
5.2.15
Work on safety systems without necessary technical documentation
Non-conformance:
The switches were replaced without the necessary technical documentation that shall help
reduce the probability of errors.
Evidence:
During repair of the limit switch for “telescope out”, Natoil discovered faults in the limit
switch for “hook up” and “jib angle”. BP stopped operating the SIMOPS crane due to the
unavailability of components (cf. report from Natoil dated 19 February 2004). New limit
switches arrived at VFN on 24 February 2004.
Upon arrival at VFN, the automation technician realised that there were two switches that
had to be replaced. There were no drawings or operating instructions for the two switches
on board the installation. According to interviews, the two switches were installed in the
same way as the ones that were removed, and the automation technician drew a sketch of
the connections before replacing the switches.
Requirements:
The Activities Regulations, Section 28, Actions during conduct of activities.
The Machine Regulations, Appendix 1, Sections 1.7.4 and 4.4.2.
The Activities Regulations, Section 40, Use of work equipment, cf. Regulations relating to
the Use of Work Equipment, Section 9, Information to employees.
19
5.2.16
Work on safety systems carried out by personnel without the required
competence
Non-conformance:
Repairs are carried out on the SIMOPS crane by personnel without the necessary
competence with respect to the crane’s functions.
Evidence:
The automation technician associated with the SWAT team on Valhall felt himself
competent to replace the switches when he was requested to do so. He did not have any
experience in working on cranes and their safety systems. The automation technician
from the Valhall field centre reported in the work order system on 26 and 27 February
2004 that the switch for “hook up” and “jib angle” was “replaced and tested OK”. The
“test” was carried out by the automation technician and crane operator. The test was not
carried out or verified by an expert.
Statements from interviews also imply that personnel without the necessary competence
have worked on the safety systems on several occasions. A report from Natoil dated 19
February 2004 pointed out that others had adjusted the sensitivity of the anti-collision
system limit switches.
Requirements:
The Activities Regulations, Section 19, Competence.
The Activities Regulations, Section 40, Use of work equipment, cf. Regulations relating to
the Use of Work Equipment, Section 9, Information to employees, Section 10, Training,
drilling and instruction of employees, and Section 14, Inspection of work equipment.
BP Lifting Equipment Manual, Section 9.5 (including requirement to use a competent
inspector).
5.2.17
Operators of the SIMOPS crane do not have access to the maintenance system
(WorkMate)
Non-conformance:
Contracted operators of the SIMOPS crane do not have access to historical data and the
status of the crane. The crane operators are therefore not able to evaluate the
consequences of any outstanding maintenance on the lifting operations that are to be
performed.
Evidence:
During the interviews with the Schlumberger personnel, it emerged that they did not have
access to BP’s maintenance system. The offshore crane operator (contracted from Norsea
Electronic) said that when he was notified by the Schlumberger personnel that there were
faults in the crane, he forwarded the message by e-mail to the flank foreman. Reports of
faults were also given to the flank foreman directly. He did not know how others did this.
The offshore crane operator, who believed that he had ownership responsibility for the
SIMOPS crane, did not have access to the maintenance system either, and he could
therefore not follow up the maintenance status of the SIMOPS crane.
Requirements:
The Activities Regulations, Section 23, Use of facilities.
The Activities Regulations, Section 14, Installation and commissioning, cf. NORSOK R003 N, Section 5.1.2.1.
The Activities Regulations, Section 83, Lifting operations, cf. NORSOK R-003 N, Section
4.5.2.1, Follow-up and maintenance.
The Activities Regulations, Section 24, Safety systems.
BP’s HSE Directive 26, Section 6.3.
20
5.2.18
Risk that the crane could reach the hatches on the BOP deck not evaluated in the safe
work review (SAG)
Non-conformance:
The risk of collision danger associated with use of the SIMOPS crane in the area below
WE was not evaluated by the safe work review (SAG).
Evidence:
The Schlumberger personnel initiated an SAG, and is was carried out by the parties
involved. This review evaluates many risk factors, but the risk of the crane reaching the
hatches in the BOP deck was not evaluated. It was known among the Schlumberger and
Smedvig personnel that the SIMOPS crane had bumped into the “dropped object” hatches
and other parts of the structure on both WE and its sister rig Mærsk Guardian. This
happened when Mærsk Guardian was working on VFS and on the WP installation at
Valhall. It has also emerged during the investigation that the signaller had positioned
himself on WE to ensure that the crane did not bump into parts of the drilling installation
during previous lifting operations.
Requirements:
The Management Regulations, Section 22, Improvement.
The Activities Regulations, Section 83, Lifting operations, cf. NORSOK R-003 N, Section
4.1.
The Activities Regulations, Section 28, Actions during conduct of activities.
The Activities Regulations, Section 40, Use of work equipment, cf. Regulations relating to
the Use of Work Equipment, Section 7, General obligations for employers, and Section
43, Use of all types of work equipment.
5.2.19
Inadequate routines for daily check of SIMOPS crane
Non-conformance:
The form prepared by BP for the daily inspection does not describe any control of the
safety systems.
Evidence:
The inspection form in the crane manual is limited to a visual inspection and control of
the oil level. It had no information on how the safety functions should be tested before
starting up the crane. Thus no pre-use inspection routines were established for the
functions of the safety systems. The user instructions that were in the crane were
inadequate.
Requirements:
The Activities Regulations, Section 22, Procedures.
BP’s HSE Directive 26, Section 6.1.5.
The Activities Regulations, Section 40, Use of work equipment, cf. Regulations relating to
the Use of Work Equipment, Section 14, Inspection of work equipment.
5.2.20
Poor visibility through the skylight
Non-conformance:
The crane operator operated the crane without adequate visibility in the work area.
Evidence:
The window wipers and washers in the crane cabin were not operational. It was 6:15 a.m.
when the incident occurred, which means that the operation was carried out at “daybreak”
with floodlights (see reconstruction in Photo no. 15). The front and side windows were
cleaned with a high-pressure hose just as the operation was to start. The parties involved
21
chose not to clean the skylight window before the operation. The crane operator said in an
interview that this was because they wanted to avoid elevated work. Before the incident
occurred, the crane operator felt that the visibility was satisfactory. The crane operator
“assumed” that the signaller would make sure that the tip of the crane did not bump into
WE.
Faults in and the poor functioning of the window wipers and washers have been reported
and described several times since the crane was handed over in August 2003.
Requirements:
The Activities Regulations, Section 31, Arrangement of work, Section 32, Ergonomic
aspects, and the Facility Regulations, Section 19, Ergonomic design.
The Activities Regulations, Section 28, Actions during conduct of activities, and Section
29, Monitoring and control.
5.2.21
Manning during the operation not in accordance with procedure
Non-conformance:
The signaller carried out the tasks of both the signaller and slinger simultaneously.
Evidence:
When the well hatch was to be put in place, the operation was carried out by two persons,
the crane operator and the signaller. The signaller also functioned as a slinger during this
part of the lifting operation.
Requirements:
The Activities Regulations, Section 83, Lifting operations, cf. NORSOK R-003 N, Section
4.5.2.2.
BP’s HSE Directive no. 26, Section 6.1.6-7, clearly indicates the responsibilities and
duties of the slinger and signaller.
5.2.22
Inadequate securing of load
Non-conformance:
The crane operator left the crane cabin with the load suspended on the hook.
Evidence:
Immediately after the “dropped object” hatch falls down and the signaller is injured, the
crane operator runs out of the crane cabin to assist him. The slinger who comes running
from the deck below (the wellhead Christmas tree deck) believes that the well hatch has
started to swing violently approximately 1.5 m above the deck. He perceives the well
hatch as a risk and lowers it down on the deck. The swinging of the well hatch was
probably caused by the “dropped object” hatch striking it as it fell.
Requirements:
The Activities Regulations, Section 83, Lifting operations, cf. NORSOK R-003 N, Section
5.5.13.
BP’s HSE Directive 26, Section 6.5.1.
5.3
Other observations
5.3.1
Barriers that have functioned
Basic training for crane operators, signallers and slingers has been completed.
22
The emergency response functioned well after the incident. The injured person received
first aid from personnel and nurse on board. A SAR helicopter was requisitioned from
Ekofisk and the injured person was sent to a hospital in Stavanger for treatment.
6
DISCUSSION OF UNCERTAINTIES ASSOCIATED
WITH THE INVESTIGATION
6.1
Time of the incorrect installation of the anti-collision system (limit switch for
“jib angle”)
It has not been determined whether the limit switch was incorrectly installed prior to the
repair work on 26-27 March 2004. The automation technician from Valhall field centre
believes that the new limit switch for the “jib angle” was installed in exactly the same
way as the replaced component.
Natoil’s repairman subsequently states that the limit switch for “jib angle” did not give a
signal during testing on 19 February 2004. He was therefore unsure whether it was
installed with a complete signal or whether the signal was missing. He also noted that the
sensitivity of the switch had been adjusted. In the same report from Natoil, it was
ascertained that the switch was defective and a new component was ordered.
There is no documentation in connection with the FMEA, FAT, commissioning, RFO
certification, certification for use or Natoil’s repair work on 10 September 2003 that the
anti-collision system functioned as intended. The investigation group has thus not found
any documentation that the anti-collision system has been tested and found to be in order
by competent personnel at any time.
6.2
Time when the limit switch for “hook up” was damaged
During the investigation it was observed that the limit switch for “hook up” was damaged
due to the fact that the shaft that the release mechanism was attached to was broken off.
Information from personnel on board indicates that the switch may have been broken
before the incident occurred. According to the Functional Design Specification, it shall
not be possible to extend the telescope when this limit switch function is activated (hook
all the way up or wire/shaft broken off). The consequence of this failure mode is not
described for the limit switch for “hook up” in the FMEA. This function is not described
and tested in the FAT either. It has therefore not been documented that the limit switch
for “hook up” also prevents the ability to extent the telescope when it is activated. (In
Section13.2.2 of the FAT, the text “& telescope” has been written in by hand at some
point in time. It is uncertain what this entails with respect to testing and results).
It is thus uncertain whether the limit switch for “hook up” also stops the “telescope out”
function as described in the Functional Design Specification. Therefore it is possible that
the crane’s telescope functioned during the incident even though the limit switch function
for “hook up” was activated.
However, the location of the switch is such that the “dropped object” hatch that fell down
may have damaged the switch when it fell.
6.3
Securing the load immediately after the incident
The crane operator and slinger have different opinions on whether the load (well hatch)
was stationary or swinging “violently” after the incident. The damage to the well hatch
shows that it had been hit by the “dropped object” hatch, and it is therefore probable that
it started to swing as a result of this.
23
6.4
Distribution of tasks between the slinger and signaller
There is some disagreement between the parties involved in the lifting operation as to
who had the slinger role and who had the signaller role. The injured person believes
subsequently that he had the slinger role, while the other two involved believe that he had
the signaller role.
6.5
Uncertainty as to how the “dropped object” hatch hit VFN
Witnesses have different opinions on what the “dropped object” hatch hit first on VFN:
The deck, well hatch or the injured person directly.
6.6
Securing the “dropped object” hatches on WE
The hatches are secured so that they will not be lifted away by strong winds. The hatches
have an open framework on the underside. This enables the tip of the crane to get a good
grip between the ribs of the frame when it pushes the hatch up. Due to the way the
hatches are designed and the great pushing power of the telescopic crane, there is a
possibility that both chains could be ripped off, and the hatch could still have fallen down.
6.7
Ambiguities in the governing documentation
Section 9.5 of BP’s Lifting Equipment Manual’s states that a competent inspector is
required after the repair of the equipment. The term “lifting tool” is used in the manual,
but based on the description of the need for certification for use, BP must have meant
“lifting equipment”.
In addition, BP uses the term “competent inspector” in the same section, while they only
refer to an “expert inspector” in Section 4. The PSA assumes that these two terms are
synonymous.
7
ABBREVIATIONS
BOP
FAT
RFOC
VFN
VFS
WE
SAG
SAR
PSA
Natoil
WIS
CT
FMEA
Blow Out Prevention
Factory Acceptance Test
Ready For Operation Certificate
Valhall Flank North
Valhall Flank South
West Epsilon
Safe Work Review
Search and Rescue
Petroleum Safety Authority
National Oilwell AS
Well Intervention Supervisor
Coiled Tubing
Failure Mode and Effect Analysis
8
DOCUMENT SUMMARY
Documents 1-28 received on board WE/VFN
1.
2.
3.
4.
5.
POB - List at the time of the incident (1 April 2004).
POB - List “today’s date” (2 April 2004).
List of personnel involved. E-mail 2 April 2004 from BP Well Intervention
Supervisor.
Organisation chart for all the companies involved.
Work permit 115931, lift of well hatch and pulling BPV.
24
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
SAG
Notice of Unsatisfactory Conditions (MUF) concerning the incident.
Various drawings:
a. Safety plot plan main deck VFN (FN-HT-S-0039-001, rev. Z).
b. Assembly drawings and installation drawings of the “dropped object” hatches
on WE.
Copy of the log from WE.
Summary of all operations in the area during the last day with a copy of the work
permit.
Work orders relating to repairs on the SIMOPS crane on VFN.
a. Copy of e-mail from BP to Natoil, dated 19 January 2004: “Subject: Pedestal
crane - SIMOPS crane”.
Procedure – equipment-related instructions: (WE-02-06-05.14, rev. 02.)
Requirements for work on dropped object deck.
Installation and maintenance instructions. Document no. PBO-8250081-P-04,
rev. 02.
Smedvig Offshore Procedure: Requirements for lifting operations. Doc. no. SO02-05-02.07, rev. 11.
West Epsilon Procedure: Requirements for lifting operations. Doc. no. WE-0205-01.04, rev. 16.
BP HSE Directive 26: Crane and Lifting Operations, Procedure no. 0.60.012, rev.
02.
Weather and activity report from WE on 2 April 2004. From 00:00 to 24:00.
HSE – Instructions for the Valhall field: 62 Crane Operators on Valhall and
Hodd. Procedure no. 9.77.002, rev. 01.
Documentation of the competence of the personnel involved in the incident
(copies of course certificates).
Various forms that document the certification and training of personnel on VFN.
Training programme for slingers, signallers and crane operators.
Requirements for awareness/knowledge of BP’s HSE directives.
Form for documentation of familiarity training for the SIMOPS crane.
Miscellaneous SYNERGI – reports from incidents on the BOP deck on WE.
Excerpts from the Bridging Document for VFS drilling using WE 2.1 Roles and
Responsibilities.
BP’s Lifting Equipment Manual, BPN doc. no. 1.70.010, rev. no. 02.
Copy of the crane log from the SIMOPS crane on VFN: Form for daily
inspection, operating instructions, doc. no. FN-10439-Z- 0208, rev. Z1,
Instructions for Transport and Installation of Crane, doc. no. FN 10439-Z-0206,
rev. Z, Maintenance Instructions, doc. no. FN-10439-Z-0209, rev. Z, Lubrication
Chart, doc. no. FN-10439-Z-0210, rev. Z.
Functional design specifications for crane, doc. no. FN-10439-R-0201 rev. Z.
Operating Instructions, doc. no. FN-10439-Z- 0208 rev. Z2 (+ for VFS).
Maintenance Instructions, doc. no. FN-10439-Z-0209, rev. Z1 (+ for VFS).
Final documentation - package completion dossier, doc. no. FN-10439-Z-0216,
rev. Z.
Final documentation - User Manual, doc. no. FN-10439-Z-0216, rev. Z.
E-mail of 4 June 2004 from Natoil with attachment: Natoil’s report on the
investigation of the functionality of the limit switch for “hook up”, 3 June 2004.
Printouts from WorkMate: All registered maintenance on the SIMOPS crane on
VFN.
Training and curriculum for crane training, Ministry of Church, Education and
Research.
Contract excerpt: Schlumberger - BP “Coiled tubing contract - C1.2.11.6”.
Work reports from Natoil: Dated 30 May 2003, 14 July 2003, 14 August 2003, 9
October 2003 and 19 February 2004.
Work reports from Natoil: Dated 5 April 2004 and 3 May 2004 (work performed
after the incident).
25
39.
40.
59.
60.
Service report from Bjørge Offshore, signed 1 February 2004.
“Ready for Operation" certificate, “RFO – certificate”, doc. no. HT-RFO-9010ZS-02, signed by BP operations (Terje Iversen) 28 August 2003.
Allum Marine AS: Certificate of Application, dated May 2003.
E-mail dated 13 May 2004: Documentation on handling of punch point HTO
1839 (proximity switch).
Punch list for SIMOPS crane.
Guarantee declaration for the SIMOPS crane drag chain, dated 3 September
2003.
Commissioning procedure for SIMOPS crane, doc. no. FN-HT-Z-9010, rev. 0.
Factory Acceptance Test (FAT) & Commissioning Procedure, doc. no. FN10439-Z-0214, rev. Z.
Order confirmation (26 November 2002) and purchase order (8 January 2003) for
the anti-collision system.
Purchase order nr. 22532-0043, SIMOPS crane, VFN.
Natoil’s work report on fault localisation and start-up of anti-collision system on
VFS, 25 October 2003.
Fax from Heerema to PTS Aktro (Natoil): Confirmation of contents and
execution of training for the SIMOPS crane, dated 22 July 2002.
Order no. 53 21531 00 0075, rev. 02, 12 December 2002: Order for anti-collision
system on VFS.
Order no. 53 22532 00 0043, rev. 01, 12 December 2002: Order for anti-collision
system on VFN.
Specifications for the SIMOPS crane for VFN, doc. no. FN-HT-R-0104, rev. 0.
Requisition for SIMOPS crane on VFN, doc. no FN-HT-R-0004, rev.0.
Data sheet for SIMOPS crane on VFN, doc. no FN-HT-R-0204, rev.0.
E-mail dated 3 June 2004 with attachment: Risk Analysis - FMEA for VFS
SIMOPS crane, doc. no. FS-24079-S-0101, rev. 01.
E-mail (25 May 2004) from Natoil with answers to the questions from PSA
concerning the anti-collision system.
E-mail (25 May 2004) from BP with answers to questions on the retrofitting of
the anti-collision system.
E-mail from Natoil, 26 May 2004, FMEA for VFN.
E-mail from Natoil, 28 May 2004, “Subject: RE: MEA”.
9
PARTICIPANTS
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
The list shows the participants at the start-up and summing-up meetings on board and
onshore, as well as the personnel interviewed:
(list removed)
At the summing-up meeting, the personnel on board WE and VFN participated.
10
MTO DIAGRAM